@tangle-network/agent-integrations 0.53.47 → 0.53.48

package/dist/chunk-U36WHHML.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/specs/types.ts","../src/specs/families.ts","../src/integration-kind-aliases.ts","../src/specs/overrides.ts","../src/specs/registry.ts","../src/specs/renderers.ts","../src/specs/validation.ts"],"sourcesContent":["import type {\n  IntegrationActionRisk,\n  IntegrationConnector,\n  IntegrationConnectorAction,\n  IntegrationConnectorCategory,\n  IntegrationConnectorTrigger,\n  IntegrationDataClass,\n} from '../index.js'\nimport type { OAuth2TokenClientAuthMethod } from '../connectors/types.js'\n\nexport type IntegrationAuthMode = 'oauth2' | 'api_key' | 'hmac' | 'none' | 'custom'\n\nexport type IntegrationSpecStatus = 'catalog' | 'executable' | 'deprecated'\n\nexport type IntegrationFamilyId =\n  | 'google'\n  | 'microsoft-graph'\n  | 'atlassian'\n  | 'salesforce'\n  | 'hubspot'\n  | 'slack'\n  | 'notion'\n  | 'standard-oauth2'\n  | 'api-key'\n  | 'hmac'\n  | 'none'\n\nexport type NormalizedPermission =\n  | `${string}.read`\n  | `${string}.write`\n  | `${string}.delete`\n  | `${string}.admin`\n\nexport interface IntegrationSpec {\n  kind: string\n  title: string\n  category: IntegrationConnectorCategory\n  status: IntegrationSpecStatus\n  family: IntegrationFamilyId\n  auth: IntegrationAuthSpec\n  permissions: PermissionDescriptor[]\n  actions: IntegrationConnectorAction[]\n  triggers?: IntegrationConnectorTrigger[]\n  setup: IntegrationSetupSpec\n  lifecycle?: IntegrationLifecycleSpec\n  plannerHints?: IntegrationPlannerHints\n  metadata?: Record<string, unknown>\n}\n\nexport type IntegrationAuthSpec =\n  | OAuth2AuthSpec\n  | ApiKeyAuthSpec\n  | HmacAuthSpec\n  | NoneAuthSpec\n  | CustomAuthSpec\n\nexport interface OAuth2AuthSpec {\n  mode: 'oauth2'\n  /** Authorization endpoint the connect flow sends the user to.\n   *\n   *  UNDEFINED when no shipped adapter and no family default supplies one —\n   *  i.e. the catalog knows the integration exists but nothing can currently\n   *  authenticate it. Callers must treat undefined as \"not connectable\" and\n   *  say so; this field was previously filled with\n   *  `https://example.invalid/<kind>/authorize`, a reserved TLD that can\n   *  never resolve, which made unconnectable integrations indistinguishable\n   *  from working ones. */\n  authorizationUrl?: string\n  /** Token endpoint. Undefined under the same condition as\n   *  {@link authorizationUrl}. */\n  tokenUrl?: string\n  clientIdEnv?: string\n  clientSecretEnv?: string\n  /** OAuth client authentication at the token endpoint. Defaults to\n   * `client_secret_post` when omitted. */\n  tokenClientAuthMethod?: OAuth2TokenClientAuthMethod\n  scopes: ScopeDescriptor[]\n  extraAuthParams?: Record<string, string>\n  redirectUriTemplate: string\n  pkce?: 'required' | 'supported' | 'unsupported'\n}\n\nexport interface ApiKeyAuthSpec {\n  mode: 'api_key'\n  credential: CredentialFieldSpec\n  placement?: 'bearer' | 'header' | 'query' | 'basic'\n}\n\nexport interface HmacAuthSpec {\n  mode: 'hmac'\n  credential: CredentialFieldSpec\n  signatureHeader?: string\n}\n\nexport interface NoneAuthSpec {\n  mode: 'none'\n}\n\nexport interface CustomAuthSpec {\n  mode: 'custom'\n  description: string\n}\n\nexport interface ScopeDescriptor {\n  normalized: NormalizedPermission\n  providerScope: string\n  title: string\n  reason: string\n  risk: IntegrationActionRisk\n  dataClass: IntegrationDataClass\n}\n\nexport interface PermissionDescriptor {\n  normalized: NormalizedPermission\n  providerScopes: string[]\n  title: string\n  risk: IntegrationActionRisk\n  dataClass: IntegrationDataClass\n  reason: string\n}\n\nexport interface CredentialFieldSpec {\n  label: string\n  description: string\n  env?: string\n  example?: string\n  regex?: string\n  secret: boolean\n}\n\nexport interface ConsoleStep {\n  id: string\n  title: string\n  detail: string\n  copyValue?: string\n}\n\nexport interface Quirk {\n  id: string\n  severity: 'info' | 'warning' | 'critical'\n  message: string\n}\n\nexport interface PostSetupCheck {\n  id: string\n  title: string\n  detail: string\n}\n\nexport interface HealthcheckSpec {\n  id: string\n  level: 'client_config' | 'connection' | 'webhook' | 'static'\n  method?: 'GET' | 'POST'\n  url?: string\n  expectedStatus?: number[]\n  description: string\n}\n\nexport interface IntegrationSetupSpec {\n  consoleUrl?: string\n  consoleSteps: ConsoleStep[]\n  credentialFields: CredentialFieldSpec[]\n  redirectUriTemplate?: string\n  knownQuirks?: Quirk[]\n  postSetup?: PostSetupCheck[]\n  healthcheck?: HealthcheckSpec\n}\n\nexport interface IntegrationLifecycleSpec {\n  supportsRefresh: boolean\n  supportsRevoke: boolean\n  supportsIncrementalAuth: boolean\n  recommendedHealthcheckIntervalHours?: number\n  freshnessSloMinutes?: number\n}\n\nexport interface IntegrationPlannerHints {\n  useFor: string[]\n  avoidFor?: string[]\n  dataFreshness: 'realtime' | 'near_realtime' | 'eventual' | 'manual'\n  writeRisk: 'low' | 'medium' | 'high'\n}\n\nexport interface IntegrationFamilySpec {\n  id: IntegrationFamilyId\n  title: string\n  authMode: IntegrationAuthMode\n  consoleUrl?: string\n  authorizationUrl?: string\n  tokenUrl?: string\n  redirectUriTemplate?: string\n  credentialFields: CredentialFieldSpec[]\n  consoleSteps: ConsoleStep[]\n  knownQuirks?: Quirk[]\n  lifecycle: IntegrationLifecycleSpec\n}\n\nexport interface IntegrationSpecValidationIssue {\n  path: string\n  message: string\n}\n\nexport interface IntegrationSpecValidationResult {\n  ok: boolean\n  issues: IntegrationSpecValidationIssue[]\n}\n\nexport interface RenderSpecOptions {\n  host: string\n  callbackPath?: string\n}\n\nexport interface RenderedConsoleStep extends ConsoleStep {\n  detail: string\n  copyValue?: string\n}\n\nexport interface CredentialValidationInput {\n  field: CredentialFieldSpec\n  value: string\n}\n\nexport interface CredentialValidationResult {\n  ok: boolean\n  field: string\n  message?: string\n}\n\nexport interface HealthcheckPlan {\n  kind: string\n  healthcheck: HealthcheckSpec\n  requires: Array<'client_id' | 'client_secret' | 'api_key' | 'hmac_secret' | 'connection_credentials'>\n  message: string\n}\n\nexport function specAuthToConnectorAuth(auth: IntegrationAuthSpec): IntegrationConnector['auth'] {\n  if (auth.mode === 'api_key') return 'api_key'\n  if (auth.mode === 'oauth2') return 'oauth2'\n  if (auth.mode === 'none') return 'none'\n  return 'custom'\n}\n","import type { IntegrationFamilyId, IntegrationFamilySpec } from './types.js'\n\nexport const INTEGRATION_FAMILIES: Record<IntegrationFamilyId, IntegrationFamilySpec> = {\n  google: {\n    id: 'google',\n    title: 'Google OAuth',\n    authMode: 'oauth2',\n    consoleUrl: 'https://console.cloud.google.com/apis/credentials',\n    authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUrl: 'https://oauth2.googleapis.com/token',\n    redirectUriTemplate: 'https://{host}/api/integrations/oauth/google/callback',\n    credentialFields: [\n      { label: 'Client ID', env: 'GOOGLE_OAUTH_CLIENT_ID', description: 'Google OAuth client ID.', example: '1234567890-abc.apps.googleusercontent.com', regex: '^[0-9]+-[a-zA-Z0-9_-]+\\\\.apps\\\\.googleusercontent\\\\.com$', secret: false },\n      { label: 'Client Secret', env: 'GOOGLE_OAUTH_CLIENT_SECRET', description: 'Google OAuth client secret.', example: 'GOCSPX-...', secret: true },\n    ],\n    consoleSteps: [\n      { id: 'project', title: 'Select project', detail: 'Open Google Cloud Console and select the project that owns the OAuth client.' },\n      { id: 'consent', title: 'Configure consent screen', detail: 'Configure OAuth consent, app name, support email, and publishing status appropriate for the deployment.' },\n      { id: 'client', title: 'Create web client', detail: 'Create an OAuth client of type Web application.' },\n      { id: 'redirect', title: 'Add redirect URI', detail: 'Add {redirectUri} as an authorized redirect URI.', copyValue: '{redirectUri}' },\n      { id: 'scopes', title: 'Add scopes', detail: 'Add the provider scopes listed in this spec.' },\n    ],\n    knownQuirks: [\n      { id: 'offline-access', severity: 'warning', message: 'Use access_type=offline and prompt=consent when refresh tokens are required.' },\n      { id: 'verification', severity: 'warning', message: 'Sensitive or restricted scopes may require Google verification before broad external use.' },\n    ],\n    lifecycle: { supportsRefresh: true, supportsRevoke: true, supportsIncrementalAuth: true, recommendedHealthcheckIntervalHours: 24 },\n  },\n  'microsoft-graph': {\n    id: 'microsoft-graph',\n    title: 'Microsoft Graph OAuth',\n    authMode: 'oauth2',\n    consoleUrl: 'https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade',\n    authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',\n    tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',\n    redirectUriTemplate: 'https://{host}/api/integrations/oauth/microsoft/callback',\n    credentialFields: [\n      { label: 'Client ID', env: 'MS_OAUTH_CLIENT_ID', description: 'Microsoft Entra application client ID.', example: '00000000-0000-0000-0000-000000000000', regex: '^[0-9a-fA-F-]{36}$', secret: false },\n      { label: 'Client Secret', env: 'MS_OAUTH_CLIENT_SECRET', description: 'Microsoft Entra client secret value.', secret: true },\n    ],\n    consoleSteps: [\n      { id: 'app', title: 'Register app', detail: 'Create or open an app registration in Microsoft Entra.' },\n      { id: 'redirect', title: 'Add redirect URI', detail: 'Add {redirectUri} as a Web redirect URI.', copyValue: '{redirectUri}' },\n      { id: 'secret', title: 'Create secret', detail: 'Create a client secret and store the secret value, not the secret ID.' },\n      { id: 'permissions', title: 'Add Graph permissions', detail: 'Add the delegated Graph scopes listed in this spec and grant admin consent where required.' },\n    ],\n    knownQuirks: [\n      { id: 'tenant-common', severity: 'info', message: 'The common tenant supports multi-tenant OAuth; single-tenant deployments should override the tenant segment.' },\n      { id: 'admin-consent', severity: 'warning', message: 'Some Graph scopes require tenant admin consent.' },\n    ],\n    lifecycle: { supportsRefresh: true, supportsRevoke: true, supportsIncrementalAuth: true, recommendedHealthcheckIntervalHours: 24 },\n  },\n  atlassian: {\n    id: 'atlassian',\n    title: 'Atlassian OAuth',\n    authMode: 'oauth2',\n    consoleUrl: 'https://developer.atlassian.com/console/myapps/',\n    authorizationUrl: 'https://auth.atlassian.com/authorize',\n    tokenUrl: 'https://auth.atlassian.com/oauth/token',\n    redirectUriTemplate: 'https://{host}/api/integrations/oauth/atlassian/callback',\n    credentialFields: [\n      { label: 'Client ID', description: 'Atlassian OAuth client ID.', secret: false },\n      { label: 'Client Secret', description: 'Atlassian OAuth client secret.', secret: true },\n    ],\n    consoleSteps: [\n      { id: 'app', title: 'Create OAuth app', detail: 'Create an OAuth 2.0 app in the Atlassian developer console.' },\n      { id: 'redirect', title: 'Add callback URL', detail: 'Add {redirectUri} as the callback URL.', copyValue: '{redirectUri}' },\n      { id: 'apis', title: 'Enable APIs', detail: 'Enable the Jira or Confluence APIs required by this connector.' },\n    ],\n    lifecycle: { supportsRefresh: true, supportsRevoke: false, supportsIncrementalAuth: false, recommendedHealthcheckIntervalHours: 24 },\n  },\n  salesforce: {\n    id: 'salesforce',\n    title: 'Salesforce OAuth',\n    authMode: 'oauth2',\n    consoleUrl: 'https://login.salesforce.com',\n    authorizationUrl: 'https://login.salesforce.com/services/oauth2/authorize',\n    tokenUrl: 'https://login.salesforce.com/services/oauth2/token',\n    redirectUriTemplate: 'https://{host}/api/integrations/oauth/salesforce/callback',\n    credentialFields: [\n      { label: 'Client ID', env: 'SALESFORCE_OAUTH_CLIENT_ID', description: 'Salesforce connected app consumer key.', secret: false },\n      { label: 'Client Secret', env: 'SALESFORCE_OAUTH_CLIENT_SECRET', description: 'Salesforce connected app consumer secret.', secret: true },\n    ],\n    consoleSteps: [\n      { id: 'connected-app', title: 'Create connected app', detail: 'Create a Salesforce connected app with OAuth enabled.' },\n      { id: 'callback', title: 'Add callback URL', detail: 'Add {redirectUri} as the callback URL.', copyValue: '{redirectUri}' },\n      { id: 'scopes', title: 'Select scopes', detail: 'Add api and refresh_token/offline_access, plus any connector-specific scopes.' },\n    ],\n    knownQuirks: [\n      { id: 'instance-url', severity: 'critical', message: 'Runtime calls must use the instance_url returned by the token response.' },\n    ],\n    lifecycle: { supportsRefresh: true, supportsRevoke: true, supportsIncrementalAuth: false, recommendedHealthcheckIntervalHours: 24 },\n  },\n  hubspot: {\n    id: 'hubspot',\n    title: 'HubSpot OAuth',\n    authMode: 'oauth2',\n    consoleUrl: 'https://developers.hubspot.com/',\n    authorizationUrl: 'https://app.hubspot.com/oauth/authorize',\n    tokenUrl: 'https://api.hubapi.com/oauth/v1/token',\n    redirectUriTemplate: 'https://{host}/api/integrations/oauth/hubspot/callback',\n    credentialFields: [\n      { label: 'Client ID', env: 'HUBSPOT_OAUTH_CLIENT_ID', description: 'HubSpot app client ID.', secret: false },\n      { label: 'Client Secret', env: 'HUBSPOT_OAUTH_CLIENT_SECRET', description: 'HubSpot app client secret.', secret: true },\n    ],\n    consoleSteps: [\n      { id: 'app', title: 'Create private/public app', detail: 'Create a HubSpot app and configure OAuth.' },\n      { id: 'redirect', title: 'Add redirect URL', detail: 'Add {redirectUri} to the app redirect URLs.', copyValue: '{redirectUri}' },\n      { id: 'scopes', title: 'Add CRM scopes', detail: 'Add the CRM object scopes listed in this spec.' },\n    ],\n    lifecycle: { supportsRefresh: true, supportsRevoke: true, supportsIncrementalAuth: false, recommendedHealthcheckIntervalHours: 24 },\n  },\n  slack: {\n    id: 'slack',\n    title: 'Slack OAuth',\n    authMode: 'oauth2',\n    consoleUrl: 'https://api.slack.com/apps',\n    authorizationUrl: 'https://slack.com/oauth/v2/authorize',\n    tokenUrl: 'https://slack.com/api/oauth.v2.access',\n    redirectUriTemplate: 'https://{host}/api/integrations/oauth/slack/callback',\n    credentialFields: [\n      { label: 'Client ID', env: 'SLACK_OAUTH_CLIENT_ID', description: 'Slack app client ID.', secret: false },\n      { label: 'Client Secret', env: 'SLACK_OAUTH_CLIENT_SECRET', description: 'Slack app client secret.', secret: true },\n    ],\n    consoleSteps: [\n      { id: 'app', title: 'Create Slack app', detail: 'Create or open a Slack app.' },\n      { id: 'redirect', title: 'Add redirect URL', detail: 'Add {redirectUri} under OAuth & Permissions.', copyValue: '{redirectUri}' },\n      { id: 'scopes', title: 'Add bot scopes', detail: 'Add the bot token scopes listed in this spec and reinstall the app.' },\n    ],\n    knownQuirks: [\n      { id: 'bot-token', severity: 'info', message: 'Slack usually returns a bot access token; refresh tokens require token rotation.' },\n    ],\n    lifecycle: { supportsRefresh: false, supportsRevoke: true, supportsIncrementalAuth: false, recommendedHealthcheckIntervalHours: 24 },\n  },\n  notion: {\n    id: 'notion',\n    title: 'Notion OAuth',\n    authMode: 'oauth2',\n    consoleUrl: 'https://www.notion.so/my-integrations',\n    authorizationUrl: 'https://api.notion.com/v1/oauth/authorize',\n    tokenUrl: 'https://api.notion.com/v1/oauth/token',\n    redirectUriTemplate: 'https://{host}/api/integrations/oauth/notion/callback',\n    credentialFields: [\n      { label: 'Client ID', env: 'NOTION_OAUTH_CLIENT_ID', description: 'Notion integration OAuth client ID.', secret: false },\n      { label: 'Client Secret', env: 'NOTION_OAUTH_CLIENT_SECRET', description: 'Notion integration OAuth client secret.', secret: true },\n    ],\n    consoleSteps: [\n      { id: 'integration', title: 'Create integration', detail: 'Create a Notion public integration.' },\n      { id: 'redirect', title: 'Add redirect URI', detail: 'Add {redirectUri} as the redirect URI.', copyValue: '{redirectUri}' },\n      { id: 'capabilities', title: 'Select capabilities', detail: 'Enable read/update/insert capabilities matching this connector.' },\n    ],\n    lifecycle: { supportsRefresh: true, supportsRevoke: true, supportsIncrementalAuth: false, recommendedHealthcheckIntervalHours: 24 },\n  },\n  'standard-oauth2': {\n    id: 'standard-oauth2',\n    title: 'Standard OAuth 2.0',\n    authMode: 'oauth2',\n    redirectUriTemplate: 'https://{host}/api/integrations/oauth/{kind}/callback',\n    credentialFields: [\n      { label: 'Client ID', description: 'OAuth client ID.', secret: false },\n      { label: 'Client Secret', description: 'OAuth client secret.', secret: true },\n    ],\n    consoleSteps: [\n      { id: 'app', title: 'Create OAuth app', detail: 'Create an OAuth app in the provider console.' },\n      { id: 'redirect', title: 'Add redirect URI', detail: 'Add {redirectUri} as an allowed redirect URI.', copyValue: '{redirectUri}' },\n      { id: 'scopes', title: 'Add scopes', detail: 'Add the scopes listed in this spec.' },\n    ],\n    lifecycle: { supportsRefresh: true, supportsRevoke: false, supportsIncrementalAuth: false, recommendedHealthcheckIntervalHours: 24 },\n  },\n  'api-key': {\n    id: 'api-key',\n    title: 'API key',\n    authMode: 'api_key',\n    credentialFields: [\n      { label: 'API Key', description: 'Provider API key or token.', example: 'sk_...', secret: true },\n    ],\n    consoleSteps: [\n      { id: 'token', title: 'Create token', detail: 'Create an API key/token in the provider console with the minimum required permissions.' },\n    ],\n    lifecycle: { supportsRefresh: false, supportsRevoke: true, supportsIncrementalAuth: false, recommendedHealthcheckIntervalHours: 24 },\n  },\n  hmac: {\n    id: 'hmac',\n    title: 'HMAC secret',\n    authMode: 'hmac',\n    credentialFields: [\n      { label: 'Signing Secret', description: 'Webhook signing secret.', secret: true },\n    ],\n    consoleSteps: [\n      { id: 'secret', title: 'Configure signing secret', detail: 'Configure the shared signing secret in the sender and receiver.' },\n    ],\n    lifecycle: { supportsRefresh: false, supportsRevoke: true, supportsIncrementalAuth: false, recommendedHealthcheckIntervalHours: 24 },\n  },\n  none: {\n    id: 'none',\n    title: 'No authentication',\n    authMode: 'none',\n    credentialFields: [],\n    consoleSteps: [\n      { id: 'configure', title: 'Configure endpoint', detail: 'No provider credentials are required.' },\n    ],\n    lifecycle: { supportsRefresh: false, supportsRevoke: false, supportsIncrementalAuth: false },\n  },\n}\n\nexport function getIntegrationFamily(id: IntegrationFamilyId): IntegrationFamilySpec {\n  return INTEGRATION_FAMILIES[id]\n}\n","/** Canonical provider ids shared by catalog, setup, runtime, and audits. */\nexport const INTEGRATION_KIND_ALIASES: Readonly<Record<string, string>> = {\n  'notion-database': 'notion',\n  'microsoft-onedrive': 'onedrive',\n  'microsoft-sharepoint': 'sharepoint',\n  'microsoft-excel': 'microsoft-excel-365',\n  'aws-s3': 'amazon-s3',\n  'outlook-calendar': 'microsoft-calendar',\n  'microsoft-outlook-calendar': 'microsoft-calendar',\n  'microsoft-outlook': 'outlook-mail',\n  'gmail-mail': 'gmail',\n  'google-pubsub': 'gcloud-pubsub',\n  bigquery: 'google-bigquery',\n  'slack-bolt': 'slack',\n  'help-scout': 'helpscout',\n  'mycase-piece': 'mycase',\n  jira: 'jira-cloud',\n  stripe: 'stripe-pack',\n  twilio: 'twilio-sms',\n  'twilio-voice': 'twilio-sms',\n  'telegram-bot': 'telegram',\n  scrapegrapghai: 'scrapegraphai',\n}\n\nexport function canonicalIntegrationKind(kind: string): string {\n  return INTEGRATION_KIND_ALIASES[kind] ?? kind\n}\n","/**\n * Per-kind overrides on top of family defaults.\n *\n * The family layer (`families.ts`) carries the auth-shape defaults — generic\n * \"API Key\" or \"Client ID + Client Secret\" credential fields, generic console\n * steps. Most kinds are happy with that. But some have provider-specific\n * shape that the family can't capture: Twilio's auth is two-part (Account\n * SID + Auth Token); Stripe's preferred path is restricted keys with specific\n * granted permissions; SendGrid demands a verified sender domain in the\n * console before keys work.\n *\n * `INTEGRATION_OVERRIDES` is the seam for that. The registry merges the\n * override on top of the family defaults at spec-build time. Override\n * fields are purely additive — set what you want to customize, leave the\n * rest absent and the family defaults apply.\n *\n * Adding a new override:\n *   1. Author the override entry below.\n *   2. The next spec build picks it up automatically; no other registry\n *      change needed. Coverage catalog stays compact.\n *\n * Why a separate map and not inline on `IntegrationCoverageSpec`: the\n * coverage catalog is a flat tuple list optimized for fast iteration over\n * 142 specs. Bloating the tuple with optional override fields hurts\n * readability of the catalog AND scatters provider knowledge across two\n * data shapes. Keeping overrides in their own keyed map means contributors\n * looking for \"how does Stripe credential setup work\" find it in one place.\n */\n\nimport type {\n  ConsoleStep,\n  CredentialFieldSpec,\n  HealthcheckSpec,\n  PostSetupCheck,\n  Quirk,\n} from './types.js'\n\nexport interface IntegrationOverride {\n  /** Replaces `setup.consoleUrl` from the family default. */\n  consoleUrl?: string\n  /** Replaces `setup.consoleSteps`. Specify the full list — overrides do\n   *  not deep-merge step arrays because step ordering is meaningful. */\n  consoleSteps?: ConsoleStep[]\n  /** Replaces `setup.credentialFields`. Use to add a second field (e.g.\n   *  Twilio Account SID + Auth Token), tighten validation regex, or\n   *  enrich field descriptions with provider-specific guidance. */\n  credentialFields?: CredentialFieldSpec[]\n  /** Appended to `setup.knownQuirks`. */\n  knownQuirks?: Quirk[]\n  /** Replaces `setup.postSetup`. */\n  postSetup?: PostSetupCheck[]\n  /** Replaces the healthcheck the registry would otherwise infer. */\n  healthcheck?: HealthcheckSpec\n}\n\nexport const INTEGRATION_OVERRIDES: Record<string, IntegrationOverride> = {\n  mongodb: {\n    credentialFields: [\n      {\n        label: 'MongoDB connection JSON',\n        description: 'JSON containing a public MongoDB host, database, user, password, optional port/auth source, and optional CA certificate. Verified TLS is mandatory.',\n        example: '{\"host\":\"cluster.example.mongodb.net\",\"port\":27017,\"database\":\"app\",\"user\":\"tangle_reader\",\"password\":\"...\",\"authSource\":\"admin\"}',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'user', title: 'Create a read-only MongoDB user', detail: 'Grant read on the intended database only. Do not grant write, cluster administration, JavaScript execution, or cross-database roles.' },\n      { id: 'network', title: 'Allow the Hub connection', detail: 'Expose one MongoDB node through a public TLS endpoint and restrict its firewall to Hub egress addresses when available.' },\n      { id: 'credential', title: 'Store the connection JSON', detail: 'Save the endpoint, database, read-only user, password, auth source, and optional CA certificate in the encrypted credential field.' },\n      { id: 'test', title: 'Test the connection', detail: 'The check pins a public address, verifies the TLS hostname and certificate, authenticates, and runs a fixed ping command.' },\n    ],\n    knownQuirks: [\n      { id: 'read-only', severity: 'info', message: 'The pack exposes collection/index metadata, structured scalar document reads, and counts only. Raw queries, JavaScript, aggregation, writes, and administrative commands are unavailable.' },\n      { id: 'direct-node', severity: 'warning', message: 'The hosted adapter pins one public seed and disables topology discovery so a server cannot redirect Hub to unvalidated private nodes.' },\n      { id: 'tls-only', severity: 'critical', message: 'Plain MongoDB connections are rejected. TLS 1.2 or newer and valid server certificates are mandatory.' },\n      { id: 'bounded-results', severity: 'info', message: 'Document reads return at most 1,000 documents and 10 MiB and accept fixed scalar predicates instead of raw MongoDB query objects.' },\n      { id: 'trigger-runtime', severity: 'warning', message: 'Change-stream triggers remain unavailable until a durable worker persists resume tokens and deliveries.' },\n    ],\n    healthcheck: {\n      id: 'mongodb.connection',\n      level: 'connection',\n      description: 'Resolve and pin a public address, negotiate verified TLS, authenticate, and run a fixed ping command.',\n    },\n  },\n  postgres: {\n    credentialFields: [\n      {\n        label: 'PostgreSQL connection JSON',\n        description: 'JSON containing a public PostgreSQL host, database, user, password, optional port, and optional CA certificate. Verified TLS is mandatory.',\n        example: '{\"host\":\"postgres.example.com\",\"port\":5432,\"database\":\"app\",\"user\":\"tangle_reader\",\"password\":\"...\"}',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'user', title: 'Create a read-only PostgreSQL role', detail: 'Grant CONNECT on the database, USAGE on intended schemas, and SELECT on intended tables or views. Do not grant write, DDL, function execution, or replication privileges.' },\n      { id: 'network', title: 'Allow the Hub connection', detail: 'Expose PostgreSQL through a public TLS endpoint and restrict its firewall to the Hub egress addresses when available.' },\n      { id: 'credential', title: 'Store the connection JSON', detail: 'Save the endpoint, database, read-only role, password, and optional CA certificate in the encrypted credential field.' },\n      { id: 'test', title: 'Test the connection', detail: 'The check pins a public address, verifies the TLS hostname and certificate, authenticates, and runs a fixed current-database query.' },\n    ],\n    knownQuirks: [\n      { id: 'read-only', severity: 'info', message: 'The pack exposes metadata and structured SELECT reads only. Arbitrary SQL, functions, writes, DDL, COPY, and replication are not available.' },\n      { id: 'tls-only', severity: 'critical', message: 'Plain PostgreSQL connections are rejected. TLS 1.2 or newer and valid server certificates are mandatory.' },\n      { id: 'public-host', severity: 'warning', message: 'Hosted Hub rejects private, loopback, link-local, and mixed public/private DNS targets.' },\n      { id: 'bounded-results', severity: 'info', message: 'Reads return at most 10,000 rows and 10 MiB and use bounded scalar predicates instead of raw SQL.' },\n      { id: 'trigger-runtime', severity: 'warning', message: 'Database-change triggers remain unavailable until a durable logical-decoding or polling worker persists cursors and deliveries.' },\n    ],\n    healthcheck: {\n      id: 'postgres.connection',\n      level: 'connection',\n      description: 'Resolve and pin a public address, negotiate verified TLS, authenticate, and run a fixed current-database query.',\n    },\n  },\n  neverbounce: {\n    consoleUrl: 'https://app.neverbounce.com/',\n    credentialFields: [\n      {\n        label: 'NeverBounce API key',\n        description: 'Create a dedicated API key in Apps > API. Verification calls consume account credits.',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'key', title: 'Create a dedicated API key', detail: 'Open Apps > API in NeverBounce and create a key for Tangle Integration Hub.' },\n      { id: 'store', title: 'Store the API key', detail: 'Paste the key once. Tangle Hub seals it before persistence.' },\n      { id: 'test', title: 'Test account access', detail: 'The connection check reads account information without verifying an address or spending a verification credit.' },\n    ],\n    knownQuirks: [\n      { id: 'metered-verification', severity: 'warning', message: 'Every address verification can consume NeverBounce credits and remains approval-gated by default.' },\n      { id: 'query-auth', severity: 'warning', message: 'NeverBounce requires the API key in the request query string. Tangle redacts it from errors and logs.' },\n    ],\n    healthcheck: {\n      id: 'neverbounce.connection',\n      level: 'connection',\n      description: 'Read NeverBounce account information without consuming a verification credit.',\n    },\n  },\n  redshift: {\n    credentialFields: [\n      {\n        label: 'Redshift connection JSON',\n        description: 'JSON containing a public Redshift host, database, user, password, optional port, and optional CA certificate. Verified TLS is mandatory.',\n        example: '{\"host\":\"cluster.region.redshift.amazonaws.com\",\"port\":5439,\"database\":\"analytics\",\"user\":\"tangle_reader\",\"password\":\"...\"}',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'user', title: 'Create a read-only Redshift user', detail: 'Grant USAGE on intended schemas and SELECT on intended tables or views. Do not grant write, DDL, COPY, UNLOAD, or external-function privileges.' },\n      { id: 'network', title: 'Allow the Hub connection', detail: 'Expose the cluster through a public TLS endpoint and restrict its security group or firewall to the Hub egress addresses when available.' },\n      { id: 'credential', title: 'Store the connection JSON', detail: 'Save the endpoint, database, read-only user, password, and optional CA certificate in the encrypted credential field.' },\n      { id: 'test', title: 'Test the connection', detail: 'The check pins a public address, verifies the TLS hostname and certificate, authenticates, and runs a fixed current-database query.' },\n    ],\n    knownQuirks: [\n      { id: 'read-only', severity: 'info', message: 'The pack exposes metadata and structured SELECT reads only. Arbitrary SQL, writes, DDL, COPY, UNLOAD, and external functions are not available.' },\n      { id: 'tls-only', severity: 'critical', message: 'Plain PostgreSQL connections are rejected. TLS 1.2 or newer and valid server certificates are mandatory.' },\n      { id: 'public-host', severity: 'warning', message: 'Hosted Hub rejects private, loopback, link-local, and mixed public/private DNS targets.' },\n      { id: 'bounded-results', severity: 'info', message: 'Reads return at most 10,000 rows and 10 MiB and use bounded scalar predicates instead of raw SQL.' },\n      { id: 'trigger-runtime', severity: 'warning', message: 'The cataloged record-change trigger remains unavailable until an incremental polling worker persists its cursor and deliveries durably.' },\n    ],\n    healthcheck: {\n      id: 'redshift.connection',\n      level: 'connection',\n      description: 'Resolve and pin a public address, negotiate verified TLS, authenticate, and run a fixed current-database query.',\n    },\n  },\n  redis: {\n    credentialFields: [\n      {\n        label: 'Redis connection JSON',\n        description: 'JSON containing a public host, password, optional ACL username/database, and optional CA certificate. Verified TLS is mandatory.',\n        example: '{\"host\":\"cache.example.com\",\"port\":6380,\"username\":\"default\",\"password\":\"...\",\"database\":0}',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'account', title: 'Create a restricted Redis user', detail: 'Grant only PING, SCAN, TYPE, PTTL, GET, SET, DEL, and EVAL access for the intended key patterns.' },\n      { id: 'tls', title: 'Require verified TLS', detail: 'Use a public hostname with a valid certificate on the TLS listener. Plain Redis connections are rejected.' },\n      { id: 'credential', title: 'Store the connection JSON', detail: 'Save the host, port, restricted ACL credentials, database number, and optional CA certificate in the encrypted credential field.' },\n      { id: 'test', title: 'Test the connection', detail: 'The connection check pins a public address, verifies the TLS hostname and certificate, authenticates, and sends PING.' },\n    ],\n    knownQuirks: [\n      { id: 'tls-only', severity: 'critical', message: 'Plain Redis is rejected. TLS 1.2 or newer and valid server certificates are mandatory.' },\n      { id: 'standalone', severity: 'warning', message: 'This pack targets one standalone or managed primary endpoint. Redis Cluster and Sentinel discovery are not followed.' },\n      { id: 'bounded-scan', severity: 'info', message: 'Key discovery uses bounded SCAN pages and never runs the blocking KEYS command.' },\n      { id: 'string-writes', severity: 'info', message: 'Writes are limited to conditional string set/delete operations. Arbitrary commands and unconditional deletes are not exposed.' },\n      { id: 'trigger-runtime', severity: 'warning', message: 'The cataloged key-change trigger remains unavailable until a durable subscriber can persist keyspace events before acknowledging delivery.' },\n    ],\n    healthcheck: {\n      id: 'redis.connection',\n      level: 'connection',\n      description: 'Resolve and pin a public address, negotiate verified TLS, authenticate, send PING, and close.',\n    },\n  },\n  rabbitmq: {\n    credentialFields: [\n      {\n        label: 'RabbitMQ connection JSON',\n        description: 'JSON containing a public host, username, password, optional port/vhost, and optional CA or mutual-TLS credentials. Verified TLS is mandatory.',\n        example: '{\"host\":\"rabbitmq.example.com\",\"port\":5671,\"username\":\"tangle\",\"password\":\"...\",\"vhost\":\"/tenant\"}',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'account', title: 'Create a restricted RabbitMQ user', detail: 'Grant only configure, write, and read permissions required for the intended virtual host and resources.' },\n      { id: 'tls', title: 'Expose a verified TLS listener', detail: 'Use an AMQPS listener on a public hostname with a valid certificate. Plain AMQP is rejected.' },\n      { id: 'credential', title: 'Store the connection JSON', detail: 'Save the host, virtual host, restricted user, password, and optional TLS material in the encrypted credential field.' },\n      { id: 'test', title: 'Test the connection', detail: 'The connection check verifies public routing, TLS certificate validation, and RabbitMQ authentication without publishing a message.' },\n    ],\n    knownQuirks: [\n      { id: 'tls-only', severity: 'critical', message: 'Plaintext AMQP is rejected. TLS 1.2 or newer and valid server certificates are mandatory.' },\n      { id: 'public-host', severity: 'warning', message: 'Hosted Hub rejects private, loopback, link-local, and mixed public/private DNS targets.' },\n      { id: 'publisher-confirms', severity: 'info', message: 'Publish actions wait for broker confirmation and require the target queue or exchange to exist.' },\n      { id: 'consumer-runtime', severity: 'warning', message: 'The cataloged Message Received trigger still requires a durable polling worker that persists each event before acknowledging it.' },\n    ],\n    healthcheck: {\n      id: 'rabbitmq.connection',\n      level: 'connection',\n      description: 'Resolve a public host, negotiate verified TLS, authenticate, and close without publishing.',\n    },\n  },\n  duckdb: {\n    consoleSteps: [\n      { id: 'ready', title: 'Use the built-in runtime', detail: 'No provider account, endpoint, or credential is required. Each invocation uses a new in-memory database.' },\n      { id: 'query', title: 'Use query parameters', detail: 'Pass dynamic values through $1, $2, and the args array instead of interpolating them into SQL.' },\n    ],\n    knownQuirks: [\n      { id: 'ephemeral', severity: 'info', message: 'Tables exist only for one invocation and are discarded immediately afterward.' },\n      { id: 'external-access', severity: 'critical', message: 'File, network, extension, and attached-database access is disabled and locked before input tables are loaded.' },\n      { id: 'bounded-runtime', severity: 'warning', message: 'Input, output, rows, schema depth and width, memory, threads, and execution time are bounded for hosted Hub safety.' },\n      { id: 'integer-json', severity: 'info', message: 'DuckDB 64-bit integer results are serialized as decimal strings so JSON does not lose precision.' },\n    ],\n    healthcheck: {\n      id: 'duckdb.runtime',\n      level: 'connection',\n      description: 'Open a secured in-memory DuckDB instance and execute SELECT 1.',\n    },\n  },\n  kafka: {\n    credentialFields: [\n      {\n        label: 'Kafka connection JSON',\n        description: 'JSON containing public broker host:port entries and optional SASL or mutual-TLS credentials. TLS is always required.',\n        example: '{\"brokers\":[\"broker.example.com:9093\"],\"saslMechanism\":\"scram-sha-512\",\"saslUsername\":\"...\",\"saslPassword\":\"...\"}',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'account', title: 'Create a restricted Kafka principal', detail: 'Grant only the topics, groups, and administrative operations required by approved Tangle workflows.' },\n      { id: 'network', title: 'Expose TLS broker endpoints', detail: 'Use public TLS endpoints whose advertised broker addresses also resolve publicly.' },\n      { id: 'credential', title: 'Store the connection JSON', detail: 'Paste brokers plus SASL or mutual-TLS credentials into the encrypted connection field.' },\n      { id: 'test', title: 'Test topic discovery', detail: 'The connection check verifies public routing, TLS certificates, authentication, and topic-list permission without producing a record.' },\n    ],\n    knownQuirks: [\n      { id: 'tls-only', severity: 'critical', message: 'Plaintext Kafka is rejected. TLS 1.2 or newer and valid broker certificates are mandatory.' },\n      { id: 'public-brokers', severity: 'warning', message: 'Every bootstrap and advertised broker address must resolve publicly for hosted Hub execution.' },\n      { id: 'consumer-rebalance', severity: 'warning', message: 'A bounded consume joins the supplied consumer group and may rebalance its members, so it always requires approval.' },\n      { id: 'explicit-commit', severity: 'critical', message: 'Bounded consume never commits offsets automatically. Commit the returned next offsets only after downstream work succeeds.' },\n    ],\n    healthcheck: {\n      id: 'kafka.connection',\n      level: 'connection',\n      description: 'Connect over TLS, authenticate, and list topics without producing or consuming records.',\n    },\n  },\n  sftp: {\n    credentialFields: [\n      {\n        label: 'SFTP connection JSON',\n        description: 'JSON containing host, username, SHA-256 hostFingerprint, and password or privateKey; optional port, passphrase, and rootPath.',\n        example: '{\"host\":\"sftp.example.com\",\"username\":\"integration\",\"password\":\"...\",\"hostFingerprint\":\"SHA256:...\",\"rootPath\":\"/incoming\"}',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'account', title: 'Create a restricted SFTP account', detail: 'Use a customer-owned account limited to the directories and operations Tangle needs.' },\n      { id: 'fingerprint', title: 'Copy the server fingerprint', detail: 'Obtain the SHA-256 host-key fingerprint from the server administrator or a trusted out-of-band channel.' },\n      { id: 'credential', title: 'Store the connection JSON', detail: 'Paste the host, username, authentication secret, host fingerprint, and optional root path into the encrypted connection field.' },\n      { id: 'test', title: 'Test the connection', detail: 'The connection check verifies DNS, public routing, the pinned host key, authentication, and the configured root directory.' },\n    ],\n    knownQuirks: [\n      { id: 'public-endpoint', severity: 'warning', message: 'The hosted Hub rejects private and local SFTP targets. Expose a restricted public endpoint or use customer-hosted execution.' },\n      { id: 'host-key', severity: 'critical', message: 'Connections fail closed when the server host key differs from the stored SHA-256 fingerprint.' },\n      { id: 'root-scope', severity: 'critical', message: 'All paths are confined to rootPath, including after symbolic-link resolution.' },\n    ],\n    healthcheck: {\n      id: 'sftp.connection',\n      level: 'connection',\n      description: 'Connect, verify the pinned host key, authenticate, and read the current SFTP directory without modifying files.',\n    },\n  },\n  'azure-event-grid': {\n    consoleUrl: 'https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.EventGrid%2Ftopics',\n    credentialFields: [\n      {\n        label: 'Azure Event Grid credential bundle',\n        description: 'JSON containing the custom topic or domain endpoint, one topic access key, and a random delivery secret of at least 32 characters.',\n        example: '{\"endpoint\":\"https://topic.region.eventgrid.azure.net/api/events\",\"accessKey\":\"...\",\"deliverySecret\":\"...\"}',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'topic', title: 'Select a custom topic or domain', detail: 'Open the customer-owned Event Grid topic or domain and copy its /api/events endpoint.' },\n      { id: 'key', title: 'Copy one topic access key', detail: 'Use either active key and rotate between the primary and secondary keys without downtime.' },\n      { id: 'secret', title: 'Generate a delivery secret', detail: 'Generate at least 32 random characters and store it with the endpoint and access key.' },\n      { id: 'subscription', title: 'Configure authenticated delivery', detail: 'On each event subscription, add x-tangle-eventgrid-secret as a static secret delivery header with the same value.' },\n    ],\n    knownQuirks: [\n      { id: 'static-health', severity: 'info', message: 'The setup check validates endpoint and credential structure. A live publish would create a real external event and remains approval-gated.' },\n      { id: 'delivery-secret', severity: 'critical', message: 'Inbound delivery is rejected unless the event subscription sends the matching x-tangle-eventgrid-secret static delivery header.' },\n    ],\n    healthcheck: {\n      id: 'azure-event-grid.credentials',\n      level: 'static',\n      description: 'Validate endpoint, topic key, and delivery-secret structure without publishing an event.',\n    },\n  },\n  'azure-service-bus': {\n    consoleUrl: 'https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.ServiceBus%2Fnamespaces',\n    credentialFields: [\n      {\n        label: 'Azure Service Bus connection string',\n        description: 'Use a dedicated shared access policy with only Send, Listen, or Manage rights required by approved workflows. EntityPath may restrict the connection to one queue or topic.',\n        example: 'Endpoint=sb://namespace.servicebus.windows.net/;SharedAccessKeyName=...;SharedAccessKey=...;EntityPath=optional',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'namespace', title: 'Select the customer namespace', detail: 'Open the existing Azure Service Bus namespace or create one under the customer subscription.' },\n      { id: 'policy', title: 'Create a narrow shared access policy', detail: 'Grant only Send, Listen, or Manage rights required by approved workflows.' },\n      { id: 'entity', title: 'Prefer an entity-scoped connection', detail: 'Use a queue or topic EntityPath when namespace-wide discovery is not required.' },\n      { id: 'store', title: 'Store the connection string', detail: 'Copy the primary or secondary connection string into the encrypted connection credential field.' },\n    ],\n    knownQuirks: [\n      { id: 'destructive-receive', severity: 'critical', message: 'Receive-and-delete permanently removes the message as it is returned. Use it only when downstream handling can tolerate loss after a process failure.' },\n      { id: 'format-only-health', severity: 'info', message: 'The setup health check validates connection-string structure without consuming or sending a message. Live permissions are confirmed on the first approved operation.' },\n    ],\n    healthcheck: {\n      id: 'azure-service-bus.credentials',\n      level: 'static',\n      description: 'Validate the Azure Service Bus connection-string structure without sending or consuming a message.',\n    },\n  },\n  'gcloud-pubsub': {\n    consoleUrl: 'https://console.cloud.google.com/cloudpubsub',\n    credentialFields: [\n      {\n        label: 'Google Cloud service-account key JSON',\n        description: 'Create a dedicated service account, grant only the required Pub/Sub roles, and paste its downloaded JSON key.',\n        example: '{\"type\":\"service_account\",\"project_id\":\"...\",\"client_email\":\"...\",\"private_key\":\"...\"}',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'api', title: 'Enable the Pub/Sub API', detail: 'Enable Google Cloud Pub/Sub for the customer project.' },\n      { id: 'service-account', title: 'Create a service account', detail: 'Create a dedicated Tangle Integration Hub service account.' },\n      { id: 'roles', title: 'Grant narrow Pub/Sub roles', detail: 'Grant only viewer, publisher, subscriber, or editor access required by approved workflows.' },\n      { id: 'key', title: 'Create and store a JSON key', detail: 'Create one JSON key and save it in the encrypted connection credential field.' },\n    ],\n    knownQuirks: [\n      { id: 'at-least-once', severity: 'warning', message: 'Pub/Sub delivery is at-least-once by default. Consumers must deduplicate messages by a stable application identifier.' },\n      { id: 'pull-ack', severity: 'warning', message: 'Pulling a message starts its acknowledgement deadline. Acknowledge it only after downstream work succeeds.' },\n    ],\n  },\n  'digital-ocean': {\n    consoleUrl: 'https://cloud.digitalocean.com/account/api/tokens',\n    credentialFields: [{ label: 'DigitalOcean personal access token', description: 'Create a dedicated token with only the read or write scopes required by approved workflows.', secret: true }],\n    consoleSteps: [\n      { id: 'token', title: 'Create a scoped token', detail: 'Create a dedicated token under API > Tokens with the smallest required scopes.' },\n      { id: 'projects', title: 'Limit resource ownership', detail: 'Use dedicated projects and tags so connected automation touches only intended resources.' },\n      { id: 'store', title: 'Store the token', detail: 'Paste the token once. Tangle Hub seals it before persistence.' },\n    ],\n    knownQuirks: [\n      { id: 'billable-resources', severity: 'critical', message: 'Droplet, database, volume, and app creation can incur immediate charges. Keep all create, resize, action, and delete operations approval-gated.' },\n      { id: 'irreversible-delete', severity: 'critical', message: 'Resource deletion can permanently destroy data. Require explicit destructive-action approval and verified backups.' },\n    ],\n  },\n  clicksend: {\n    consoleUrl: 'https://dashboard.clicksend.com/#/account/subaccounts',\n    credentialFields: [\n      {\n        label: 'ClickSend API credential bundle',\n        description: 'JSON containing username and apiKey from the ClickSend dashboard.',\n        example: '{\"username\":\"...\",\"apiKey\":\"...\"}',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'account', title: 'Use a dedicated subaccount', detail: 'Create a restricted subaccount for Tangle Integration Hub when account isolation is required.' },\n      { id: 'credentials', title: 'Copy API credentials', detail: 'Copy the ClickSend username and API key into the encrypted credential bundle.' },\n      { id: 'sender', title: 'Configure approved senders', detail: 'Register and approve sender names or numbers before enabling outbound workflows.' },\n    ],\n    knownQuirks: [\n      { id: 'paid-delivery', severity: 'warning', message: 'Outbound SMS and voice delivery incurs provider charges. Connection health and read operations do not send messages; keep outbound actions approval-gated.' },\n      { id: 'sender-rules', severity: 'warning', message: 'Sender ID, consent, quiet-hours, and opt-out rules vary by destination country and remain the customer’s responsibility.' },\n    ],\n  },\n  discourse: {\n    consoleUrl: 'https://meta.discourse.org/t/create-and-configure-an-api-key/230124',\n    credentialFields: [\n      {\n        label: 'Discourse API credential bundle',\n        description: 'JSON containing apiKey and apiUsername. Store the public HTTPS forum root as connection metadata baseUrl.',\n        example: '{\"apiKey\":\"...\",\"apiUsername\":\"system\"}',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'key', title: 'Create a scoped API key', detail: 'In Admin > API > Keys, create a dedicated key with the smallest required scope and user level.' },\n      { id: 'username', title: 'Choose the acting user', detail: 'Use a dedicated service user whenever site-wide administrator authority is not required.' },\n      { id: 'host', title: 'Record the forum URL', detail: 'Store the public HTTPS forum root as connection metadata baseUrl.' },\n      { id: 'store', title: 'Store the credential bundle', detail: 'Save apiKey and apiUsername in the encrypted connection credential bundle.' },\n    ],\n    knownQuirks: [\n      { id: 'acting-user', severity: 'warning', message: 'Every action is attributed to Api-Username and limited by both that user and the key scopes. Use separate keys for automation with different authority.' },\n      { id: 'admin-actions', severity: 'warning', message: 'Category creation and moderation require staff or administrator authority and should remain approval-gated.' },\n    ],\n  },\n  baserow: {\n    consoleUrl: 'https://baserow.io/dashboard/settings/database-tokens',\n    credentialFields: [\n      {\n        label: 'Baserow database token',\n        description: 'Create a dedicated database token and grant only the required tables and create/read/update/delete permissions.',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'token', title: 'Create a database token', detail: 'Open workspace settings, create a dedicated token, and name it Tangle Integration Hub.' },\n      { id: 'permissions', title: 'Limit table permissions', detail: 'Grant only the tables and create, read, update, or delete operations required by approved workflows.' },\n      { id: 'store', title: 'Store the token', detail: 'Paste the token once. Tangle Hub seals it before persistence.' },\n    ],\n    knownQuirks: [\n      { id: 'token-scope', severity: 'info', message: 'Database tokens intentionally cannot create tables or manage webhooks. Those account-level operations require a short-lived user JWT and are not advertised by this connector.' },\n      { id: 'self-hosted-url', severity: 'info', message: 'For self-hosted Baserow, store the public HTTPS API root in connection metadata as baseUrl.' },\n    ],\n  },\n  'ping-identity': {\n    consoleUrl: 'https://console.pingone.com/',\n    credentialFields: [\n      {\n        label: 'PingOne worker credential bundle',\n        description: 'JSON containing clientId, clientSecret, and region (us, ca, eu, au, or asia). Store the PingOne environment id as connection metadata.',\n        example: '{\"clientId\":\"...\",\"clientSecret\":\"...\",\"region\":\"us\"}',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'worker-app', title: 'Create a worker application', detail: 'Create a dedicated PingOne worker application with the minimum user and group administration roles.' },\n      { id: 'environment', title: 'Record environment and region', detail: 'Copy the PingOne environment id and select its deployment region.' },\n      { id: 'credentials', title: 'Store worker credentials', detail: 'Save the client id and client secret in the encrypted connection credential bundle.' },\n    ],\n  },\n  onelogin: {\n    consoleUrl: 'https://admin.us.onelogin.com/api_credentials',\n    credentialFields: [\n      {\n        label: 'OneLogin API credential bundle',\n        description: 'JSON containing clientId, clientSecret, and region (us or eu).',\n        example: '{\"clientId\":\"...\",\"clientSecret\":\"...\",\"region\":\"us\"}',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'credentials', title: 'Create API credentials', detail: 'Create dedicated OneLogin API credentials with Manage users or the smallest sufficient privilege.' },\n      { id: 'region', title: 'Select tenant region', detail: 'Choose us or eu to pin both token and API requests to the tenant region.' },\n      { id: 'store', title: 'Store credentials', detail: 'Save the client id and client secret in the encrypted connection credential bundle.' },\n    ],\n  },\n  scim: {\n    credentialFields: [\n      {\n        label: 'SCIM bearer token',\n        description: 'Long-lived bearer token issued by the customer SCIM service provider.',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'endpoint', title: 'Record the SCIM base URL', detail: 'Use the public HTTPS SCIM 2.0 root, including any tenant path such as /scim/v2.' },\n      { id: 'token', title: 'Create a provisioning token', detail: 'Issue a dedicated least-privileged bearer token for users, groups, and membership operations.' },\n      { id: 'test', title: 'Test ServiceProviderConfig', detail: 'Verify the endpoint and token can read the SCIM ServiceProviderConfig resource.' },\n    ],\n    knownQuirks: [\n      { id: 'provider-variance', severity: 'warning', message: 'SCIM providers vary in supported filters, PATCH paths, and ETag behavior; use provider-native PatchOp payloads when a service diverges from RFC 7644.' },\n    ],\n  },\n  affinity: {\n    consoleUrl: 'https://support.affinity.co/s/article/How-to-Create-and-Manage-API-Keys',\n    credentialFields: [\n      {\n        label: 'Affinity API key',\n        description: 'Bearer API key created by an Affinity workspace administrator. API availability and record access follow the workspace plan and key owner permissions.',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      { id: 'check-plan', title: 'Confirm API access', detail: 'Confirm the workspace plan includes Affinity API access.' },\n      { id: 'create-key', title: 'Create an API key', detail: 'Create a dedicated key under Affinity Settings > API using a least-privileged integration user.' },\n      { id: 'paste-key', title: 'Paste the API key', detail: 'Paste the key once. Tangle Hub seals it before persistence.' },\n    ],\n    knownQuirks: [\n      { id: 'user-permissions', severity: 'warning', message: 'The key inherits its creator’s list-level and record permissions; missing records can be an authorization issue rather than a synchronization failure.' },\n    ],\n  },\n  dealcloud: {\n    consoleUrl: 'https://api.docs.dealcloud.com/',\n    consoleSteps: [\n      { id: 'contract', title: 'Confirm DealCloud API access', detail: 'Ask the DealCloud administrator or Intapp account team to enable API access for the customer site.' },\n      { id: 'schema-contract', title: 'Publish a schema contract', detail: 'Publish a scoped Schema Contract that names the entry types and fields Tangle may synchronize.' },\n      { id: 'credentials', title: 'Issue integration credentials', detail: 'Create customer-site credentials restricted to the published contract and Publications required for incremental synchronization.' },\n    ],\n    credentialFields: [],\n    knownQuirks: [\n      { id: 'commercial-access', severity: 'critical', message: 'DealCloud API access is customer-site and contract dependent. This entry remains non-executable until the customer supplies an approved schema contract, site URL, and credentials.' },\n      { id: 'custom-schema', severity: 'warning', message: 'Every DealCloud site is customized; map through the published Schema Contract instead of assuming global object or field names.' },\n    ],\n  },\n  otter: {\n    consoleUrl: 'https://otter.ai/',\n    consoleSteps: [\n      { id: 'contract', title: 'Confirm Otter API access', detail: 'Confirm the customer plan and commercial agreement include supported API access for transcripts and meeting metadata.' },\n      { id: 'credentials', title: 'Request integration credentials', detail: 'Obtain provider-issued credentials and the permitted workspace/account scope from Otter.' },\n      { id: 'scope', title: 'Record permitted data use', detail: 'Record retention, participant-consent, and transcript access rules before enabling ingestion.' },\n    ],\n    credentialFields: [],\n    knownQuirks: [\n      { id: 'no-public-self-serve-api', severity: 'critical', message: 'No generally available self-serve Otter API credential flow is documented. This entry is contract-only until provider-approved access exists.' },\n    ],\n  },\n  zoom: {\n    consoleUrl: 'https://marketplace.zoom.us/develop/create',\n    consoleSteps: [\n      { id: 'app', title: 'Create a General App', detail: 'Create a user-managed General App in Zoom App Marketplace.' },\n      { id: 'redirect', title: 'Add callback URL', detail: 'Add {redirectUri} as the OAuth redirect URL.', copyValue: '{redirectUri}' },\n      { id: 'scopes', title: 'Add granular scopes', detail: 'Add the user, meeting, webinar, and recording scopes listed by this integration.' },\n      { id: 'events', title: 'Enable event subscriptions', detail: 'Subscribe the Hub callback to meeting, recording, and transcript completion events needed by workflows.' },\n    ],\n  },\n  'microsoft-forms': {\n    consoleUrl: 'https://learn.microsoft.com/microsoft-365/community/working-with-microsoft-forms-using-microsoft-graph',\n    consoleSteps: [\n      { id: 'confirm-api', title: 'Confirm supported Forms access', detail: 'Confirm the customer has a provider-supported Microsoft Forms API path for the required tenant and form ownership model.' },\n      { id: 'approve', title: 'Approve tenant access', detail: 'Document the tenant administrator approval and the specific forms Tangle may read.' },\n    ],\n    credentialFields: [],\n    knownQuirks: [\n      { id: 'no-supported-graph-surface', severity: 'critical', message: 'Microsoft Graph does not expose a generally supported Forms response API. This entry stays non-executable until Microsoft provides or approves a supported access path.' },\n    ],\n  },\n  'microsoft-word': {\n    consoleUrl: 'https://learn.microsoft.com/graph/api/resources/onedrive',\n    consoleSteps: [\n      { id: 'use-files', title: 'Connect OneDrive or SharePoint', detail: 'Use the existing OneDrive or SharePoint connector for Word file discovery, permissions, versions, and download/upload.' },\n      { id: 'confirm-edit-api', title: 'Confirm document editing API', detail: 'Before enabling document-body edits, confirm a provider-supported Word editing API and tenant authorization path.' },\n    ],\n    credentialFields: [],\n    knownQuirks: [\n      { id: 'files-not-document-model', severity: 'critical', message: 'Microsoft Graph supports Word files through OneDrive and SharePoint but does not expose the full Word document object model. This entry stays non-executable for document-body actions.' },\n    ],\n  },\n  // ── Stripe pack ────────────────────────────────────────────────────\n  // Stripe issues two key types: secret keys (sk_*) and restricted keys\n  // (rk_*). For voice-agent workloads, restricted keys are the right call\n  // — least-privilege scoped to the specific resources the agent can\n  // touch. The hint nudges operators toward that path.\n  'stripe-pack': {\n    consoleUrl: 'https://dashboard.stripe.com/apikeys',\n    credentialFields: [\n      {\n        label: 'Stripe secret key',\n        description:\n          'Restricted key recommended. Dashboard → Developers → API keys → Create restricted key. ' +\n          'Grant write access on Customers, Invoices, and Checkout Sessions.',\n        example: 'sk_live_… or rk_live_… (use sk_test_… / rk_test_… for staging)',\n        regex: '^(sk|rk)_(live|test)_[A-Za-z0-9]+$',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      {\n        id: 'open-keys',\n        title: 'Open Stripe API keys',\n        detail: 'Visit https://dashboard.stripe.com/apikeys',\n        copyValue: 'https://dashboard.stripe.com/apikeys',\n      },\n      {\n        id: 'create-restricted',\n        title: 'Create a restricted key',\n        detail:\n          'Click \"Create restricted key\". Name it something descriptive ' +\n          '(e.g. \"ph0ny voice agent — prod\"). Grant WRITE on Customers, ' +\n          'Invoices, and Checkout Sessions. Leave everything else NONE.',\n      },\n      {\n        id: 'paste',\n        title: 'Paste the key',\n        detail:\n          'Copy the key Stripe shows once (rk_live_… or sk_live_…). ' +\n          'Paste it into ph0ny. The key is sealed before persistence.',\n      },\n    ],\n  },\n\n  // ── Twilio SMS ─────────────────────────────────────────────────────\n  // Twilio's REST API uses Basic auth with two parts: Account SID\n  // (public-ish, AC…) + Auth Token (secret). The default api-key family\n  // only exposes one field, which doesn't fit. Providing both fields\n  // explicitly lets the consumer's UI render two inputs.\n  'twilio-sms': {\n    consoleUrl: 'https://console.twilio.com/',\n    credentialFields: [\n      {\n        label: 'Account SID',\n        description: 'Your Twilio Account SID. Console → Account → API keys & tokens.',\n        example: 'AC… (34 hex chars)',\n        regex: '^AC[a-f0-9]{32}$',\n        secret: false,\n      },\n      {\n        label: 'Auth Token',\n        description:\n          'Your Twilio Auth Token (or Standard API Key secret). ' +\n          'Use a non-primary auth token in production so rotating it ' +\n          \"won't break other Twilio integrations.\",\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      {\n        id: 'open',\n        title: 'Open Twilio console',\n        detail: 'Visit https://console.twilio.com/',\n        copyValue: 'https://console.twilio.com/',\n      },\n      {\n        id: 'find',\n        title: 'Find your Account SID + Auth Token',\n        detail:\n          'Account info is on the dashboard home. For better security, ' +\n          'create a Standard API Key (Account → API keys & tokens → Create ' +\n          'API Key) and use the SID + Secret pair instead of the primary ' +\n          'auth token.',\n      },\n      {\n        id: 'paste',\n        title: 'Paste both values',\n        detail: 'Account SID is non-secret; Auth Token is sealed before persistence.',\n      },\n    ],\n    knownQuirks: [\n      {\n        id: 'subaccount-tokens',\n        severity: 'info',\n        message:\n          'If you use Twilio subaccounts, paste the SID/Token of the ' +\n          'subaccount that owns the phone numbers your agent calls — not ' +\n          'the master account.',\n      },\n    ],\n  },\n\n  // ── ph0ny ──────────────────────────────────────────────────────────\n  // ph0ny issues a single Bearer API key per developer. The key is a\n  // `plabs_` prefix followed by 32 url-safe nanoid chars. It is shown once\n  // at creation (POST /v1/keys in the developer portal); only its hash is\n  // stored server-side, so it cannot be retrieved later — rotate to replace.\n  phony: {\n    consoleUrl: 'https://api.ph0ny.com',\n    credentialFields: [\n      {\n        label: 'ph0ny API key',\n        description:\n          'Bearer key issued by ph0ny. Create one in the developer portal ' +\n          '(POST /v1/keys). Sent as `Authorization: Bearer <key>`.',\n        example: 'plabs_V1StGXR8Z5jdHi6BmyTAbCdEfGhIjKlm',\n        regex: '^plabs_[A-Za-z0-9_-]{32}$',\n        secret: true,\n      },\n    ],\n    consoleSteps: [\n      {\n        id: 'open-portal',\n        title: 'Open the ph0ny developer portal',\n        detail: 'Visit https://api.ph0ny.com and sign in to the developer portal.',\n        copyValue: 'https://api.ph0ny.com',\n      },\n      {\n        id: 'create-key',\n        title: 'Create an API key',\n        detail:\n          'In the portal, create a new API key (POST /v1/keys). Give it a ' +\n          'descriptive name (e.g. \"tangle agent — prod\"). ph0ny returns the ' +\n          'full key exactly once.',\n      },\n      {\n        id: 'paste',\n        title: 'Paste the key',\n        detail:\n          'Copy the plabs_… key ph0ny shows and paste it here. The key is ' +\n          'sealed before persistence.',\n      },\n    ],\n    knownQuirks: [\n      {\n        id: 'key-shown-once',\n        severity: 'warning',\n        message:\n          'ph0ny stores only a hash of the key — the full plabs_… value is ' +\n          'shown exactly once at creation and cannot be retrieved later. Save ' +\n          'it immediately; if lost, rotate to issue a replacement.',\n      },\n      {\n        id: 'rotate-endpoint',\n        severity: 'info',\n        message:\n          'Rotate a key with POST /v1/keys/:id/rotate. The old key is revoked ' +\n          'and a new plabs_… key is returned once — update this connection ' +\n          'with the new value.',\n      },\n    ],\n  },\n}\n\n/** Public read — undefined when no override exists for the kind. */\nexport function getIntegrationOverride(kind: string): IntegrationOverride | undefined {\n  return INTEGRATION_OVERRIDES[kind]\n}\n","import {\n  buildIntegrationCoverageConnectors,\n  listIntegrationCoverageSpecs,\n  type IntegrationCoverageSpec,\n} from '../coverage-catalog.js'\nimport type {\n  IntegrationConnector,\n  IntegrationConnectorAction,\n  IntegrationConnectorTrigger,\n  IntegrationDataClass,\n} from '../index.js'\nimport {\n  bundledApiKeyHint,\n  bundledAuthMode,\n  bundledOAuth2Auth,\n  getBundledAdapterManifest,\n} from '../connectors/bundled-manifests.js'\nimport type { ConnectorManifest } from '../connectors/types.js'\nimport { canonicalIntegrationKind } from '../integration-kind-aliases.js'\nimport { INTEGRATION_FAMILIES, getIntegrationFamily } from './families.js'\nimport { getIntegrationOverride } from './overrides.js'\nimport type {\n  ApiKeyAuthSpec,\n  CustomAuthSpec,\n  HealthcheckSpec,\n  HmacAuthSpec,\n  IntegrationAuthSpec,\n  IntegrationFamilyId,\n  IntegrationPlannerHints,\n  IntegrationSpec,\n  IntegrationSpecStatus,\n  NoneAuthSpec,\n  NormalizedPermission,\n  OAuth2AuthSpec,\n  PermissionDescriptor,\n  ScopeDescriptor,\n} from './types.js'\n\n/**\n * Executability and OAuth endpoints are DERIVED from the bundled adapter\n * registry, never restated here.\n *\n * This used to be a hand-maintained `EXECUTABLE_KINDS` set of 18 names. The\n * package ships 530 adapters, so the set was wrong by two orders of magnitude\n * and every new adapter silently landed as `status: 'catalog'`. Worse, the\n * oauth2 branch of `authFor` fabricated `https://example.invalid/<kind>/...`\n * whenever the family table had no endpoint — 104 of 131 oauth2 entries — so\n * a Connect button could be wired to a reserved TLD that can never resolve.\n * A catalog that describes connectors must read the connectors.\n */\nfunction bundledManifestFor(kind: string, coverageId: string) {\n  return getBundledAdapterManifest(kind) ?? getBundledAdapterManifest(coverageId)\n}\n\nexport function listIntegrationSpecs(): IntegrationSpec[] {\n  const connectors = new Map(buildIntegrationCoverageConnectors({ providerId: 'spec' }).map((c) => [c.id, c]))\n  return listIntegrationCoverageSpecs().map((coverage) => {\n    const connector = connectors.get(coverage.id)\n    if (!connector) throw new Error(`missing coverage connector for ${coverage.id}`)\n    return specFromCoverage(coverage, connector)\n  })\n}\n\nexport function getIntegrationSpec(kind: string): IntegrationSpec | undefined {\n  const canonical = canonicalIntegrationKind(kind)\n  return listIntegrationSpecs().find((spec) => canonicalIntegrationKind(spec.kind) === canonical)\n}\n\n/** Auth-driving descriptor the hub uses to start a connect flow per provider\n *  instead of hard-coding scopes/auth kind. Derived from the spec catalog\n *  ({@link getIntegrationSpec}); undefined when the kind is not in the\n *  catalog. */\nexport interface ConnectorAuthSpec {\n  kind: string\n  authKind: 'oauth2' | 'api_key' | 'none' | 'custom'\n  /** Provider scopes to request in the authorization grant. Empty for\n   *  api_key / none / custom. */\n  requestedScopes: string[]\n  /** OAuth-only: authorization + token endpoints and PKCE posture. Present\n   *  only when authKind === 'oauth2'. */\n  authorizationUrl?: string\n  tokenUrl?: string\n  pkce?: 'required' | 'supported' | 'unsupported'\n  redirectUriTemplate?: string\n  clientIdEnv?: string\n  clientSecretEnv?: string\n  tokenClientAuthMethod?: 'client_secret_post' | 'client_secret_basic'\n  extraAuthParams?: Record<string, string>\n}\n\nexport function resolveConnectorAuthSpec(kind: string): ConnectorAuthSpec | undefined {\n  const spec = getIntegrationSpec(kind)\n  if (!spec) return undefined\n  const auth = spec.auth\n  if (auth.mode === 'oauth2') {\n    return {\n      kind: spec.kind,\n      authKind: 'oauth2',\n      requestedScopes: auth.scopes.map((scope) => scope.providerScope).filter(Boolean),\n      authorizationUrl: auth.authorizationUrl,\n      tokenUrl: auth.tokenUrl,\n      pkce: auth.pkce,\n      redirectUriTemplate: auth.redirectUriTemplate,\n      clientIdEnv: auth.clientIdEnv,\n      clientSecretEnv: auth.clientSecretEnv,\n      tokenClientAuthMethod: auth.tokenClientAuthMethod,\n      extraAuthParams: auth.extraAuthParams,\n    }\n  }\n  if (auth.mode === 'api_key') {\n    return { kind: spec.kind, authKind: 'api_key', requestedScopes: [] }\n  }\n  if (auth.mode === 'none') {\n    return { kind: spec.kind, authKind: 'none', requestedScopes: [] }\n  }\n  return { kind: spec.kind, authKind: 'custom', requestedScopes: [] }\n}\n\nexport function listExecutableIntegrationSpecs(): IntegrationSpec[] {\n  return listIntegrationSpecs().filter((spec) => spec.status === 'executable')\n}\n\nexport function integrationSpecToConnector(spec: IntegrationSpec, providerId = 'spec'): IntegrationConnector {\n  return {\n    id: spec.kind,\n    providerId,\n    title: spec.title,\n    category: spec.category,\n    auth: spec.auth.mode === 'api_key' ? 'api_key' : spec.auth.mode === 'oauth2' ? 'oauth2' : spec.auth.mode === 'none' ? 'none' : 'custom',\n    scopes: spec.permissions.flatMap((permission) => permission.providerScopes),\n    actions: spec.actions,\n    triggers: spec.triggers,\n    metadata: {\n      ...(spec.metadata ?? {}),\n      source: 'integration-spec',\n      status: spec.status,\n      family: spec.family,\n      plannerHints: spec.plannerHints,\n    },\n  }\n}\n\nfunction specFromCoverage(coverage: IntegrationCoverageSpec, connector: IntegrationConnector): IntegrationSpec {\n  const kind = canonicalIntegrationKind(coverage.id)\n  const family = familyFor(coverage)\n  const familySpec = getIntegrationFamily(family)\n  const manifest = bundledManifestFor(kind, coverage.id)\n  // A spec with no shipped adapter has no real action ids to give. The\n  // coverage table would supply four synthesized from its action pack, and\n  // naming those is the failure this whole module exists to end: 33 of 143\n  // specs have no adapter, and every one of them advertised invented calls\n  // (`jira` claimed `tasks.search`/`tasks.read`/`tasks.create`/`tasks.update`,\n  // `microsoft-excel` claimed `records.query`...). A model told about a tool\n  // that cannot resolve spends the turn on it, and the failure reads as the\n  // agent being broken. Listing the connector with NO actions is honest and\n  // still discoverable — it is genuinely connectable, it just cannot run\n  // anything yet.\n  //\n  // The synthesized set is still what `permissions` and `plannerHints` are\n  // derived from, because those describe the DATA the connector reaches\n  // (read/write shape, data class, provider scopes) rather than callable\n  // entry points. Deriving them from an empty list instead would silently\n  // drop the write permission and downgrade every one of the 33 to\n  // `dataClass: 'public'` — trading a prompt defect for a consent defect.\n  const derivationActions = manifest\n    ? actionsFromManifest(manifest, dataClassFor(connector.actions))\n    : connector.actions\n  const actions = manifest ? derivationActions : []\n  const permissions = permissionsFor(coverage, derivationActions)\n  const auth = authFor(coverage, family, permissions, kind)\n  const status = statusFor(kind, coverage.id)\n  // Per-kind overrides layer in here — see specs/overrides.ts. The override\n  // is consulted under the canonical kind AND the original coverage id so\n  // alias-collapsed kinds (e.g. notion-database → notion) can carry an\n  // override under either name.\n  const override =\n    getIntegrationOverride(kind) ?? getIntegrationOverride(coverage.id)\n  // Family quirks + override quirks are concatenated; everything else is\n  // a replace (override fields take precedence when present).\n  const knownQuirks = override?.knownQuirks\n    ? [...(familySpec.knownQuirks ?? []), ...override.knownQuirks]\n    : familySpec.knownQuirks\n  return {\n    kind,\n    title: connector.title,\n    category: connector.category,\n    status,\n    family,\n    auth,\n    permissions,\n    actions,\n    triggers: connector.triggers,\n    setup: {\n      consoleUrl: override?.consoleUrl ?? familySpec.consoleUrl,\n      consoleSteps: override?.consoleSteps ?? familySpec.consoleSteps,\n      credentialFields: override?.credentialFields ?? credentialFieldsFor(auth),\n      redirectUriTemplate: auth.mode === 'oauth2' ? auth.redirectUriTemplate : familySpec.redirectUriTemplate,\n      knownQuirks,\n      postSetup: override?.postSetup,\n      healthcheck: override?.healthcheck ?? healthcheckFor(kind, status, auth),\n    },\n    lifecycle: familySpec.lifecycle,\n    plannerHints: plannerHintsFor(coverage, derivationActions),\n    metadata: { priority: coverage.priority, domains: coverage.domains },\n  }\n}\n\nfunction familyFor(spec: IntegrationCoverageSpec): IntegrationFamilyId {\n  if (hmacKinds.has(spec.id)) return 'hmac'\n  if (spec.auth === 'none') return 'none'\n  if (spec.id.startsWith('google-') || spec.domains.includes('google')) return 'google'\n  if (spec.id.startsWith('microsoft-') || ['outlook-mail', 'outlook-calendar', 'onedrive', 'sharepoint'].includes(spec.id)) return 'microsoft-graph'\n  if (['jira', 'confluence', 'trello', 'bitbucket'].includes(spec.id)) return 'atlassian'\n  if (spec.id === 'salesforce') return 'salesforce'\n  if (spec.id === 'hubspot') return 'hubspot'\n  if (spec.id === 'slack') return 'slack'\n  if (spec.id === 'notion') return 'notion'\n  if (apiKeyKinds.has(spec.id)) return 'api-key'\n  return 'standard-oauth2'\n}\n\nconst apiKeyKinds = new Set(['github', 'gitlab', 'airtable', 'asana', 'stripe', 'twilio', 'sendgrid', 'postmark', 'phony'])\nconst hmacKinds = new Set(['webhook'])\n\nfunction authFor(\n  spec: IntegrationCoverageSpec,\n  family: IntegrationFamilyId,\n  permissions: PermissionDescriptor[],\n  kind: string,\n): IntegrationAuthSpec {\n  const f = INTEGRATION_FAMILIES[family]\n  // The shipped adapter decides HOW a connector authenticates. The coverage\n  // table only guesses: it defaults every unlisted entry to the\n  // `standard-oauth2` family, which is how Coda — an api-key connector —\n  // came to advertise an OAuth flow it does not have.\n  const manifest = bundledManifestFor(kind, spec.id)\n  const realMode = manifest ? bundledAuthMode(manifest) : undefined\n  if (spec.auth === 'custom' && !manifest) {\n    return {\n      mode: 'custom',\n      description: `${spec.title} requires provider- or workspace-specific credentials and transport configuration.`,\n    } satisfies CustomAuthSpec\n  }\n  if (realMode === 'none') return { mode: 'none' } satisfies NoneAuthSpec\n  if (realMode === 'hmac') {\n    return {\n      mode: 'hmac',\n      credential: INTEGRATION_FAMILIES.hmac.credentialFields[0]!,\n      signatureHeader: `${spec.id}-signature`,\n    } satisfies HmacAuthSpec\n  }\n  if (realMode === 'api_key') {\n    const hint = manifest ? bundledApiKeyHint(manifest) : undefined\n    const credential = apiKeyFieldFor(spec.id)\n    return {\n      mode: 'api_key',\n      credential: hint ? { ...credential, description: hint } : credential,\n      placement: apiKeyPlacementFor(spec.id),\n    } satisfies ApiKeyAuthSpec\n  }\n  if (family === 'none' && !realMode) return { mode: 'none' } satisfies NoneAuthSpec\n  if (family === 'hmac' && !realMode) {\n    return { mode: 'hmac', credential: f.credentialFields[0]!, signatureHeader: `${spec.id}-signature` } satisfies HmacAuthSpec\n  }\n  if (family === 'api-key' && !realMode) {\n    return { mode: 'api_key', credential: apiKeyFieldFor(spec.id), placement: apiKeyPlacementFor(spec.id) } satisfies ApiKeyAuthSpec\n  }\n  const scopes = permissions.flatMap((permission) =>\n    permission.providerScopes.map((providerScope): ScopeDescriptor => ({\n      normalized: permission.normalized,\n      providerScope,\n      title: permission.title,\n      reason: permission.reason,\n      risk: permission.risk,\n      dataClass: permission.dataClass,\n    })),\n  )\n  // A shipped adapter is the authority on how its provider authenticates:\n  // it holds the endpoints the connect flow actually posts to and the exact\n  // scope set the grant must request. Prefer it over the family defaults,\n  // and never substitute a placeholder when neither knows — an absent URL is\n  // a fact the caller can check, whereas `https://example.invalid/...` is a\n  // dead link that reads as configuration.\n  const real = manifest ? bundledOAuth2Auth(manifest) : undefined\n  return {\n    mode: 'oauth2',\n    authorizationUrl: real?.authorizationUrl ?? f.authorizationUrl,\n    tokenUrl: real?.tokenUrl ?? f.tokenUrl,\n    clientIdEnv: real?.clientIdEnv ?? f.credentialFields.find((field) => !field.secret)?.env,\n    clientSecretEnv: real?.clientSecretEnv ?? f.credentialFields.find((field) => field.secret)?.env,\n    tokenClientAuthMethod: real?.tokenClientAuthMethod ?? 'client_secret_post',\n    scopes: real ? scopesFromManifest(real.scopes, permissions) : scopes,\n    extraAuthParams: real?.extraAuthParams ?? extraAuthParamsFor(family),\n    redirectUriTemplate: (f.redirectUriTemplate ?? 'https://{host}/api/integrations/oauth/{kind}/callback').replace('{kind}', spec.id),\n    pkce: family === 'google' || family === 'microsoft-graph' ? 'supported' : 'unsupported',\n  } satisfies OAuth2AuthSpec\n}\n\n/**\n * The action list an agent is shown, taken from the adapter's own capability\n * catalog.\n *\n * The coverage table synthesizes actions from 19 generic \"action packs\", so\n * every finance-pack connector advertised the same four names —\n * `transactions.search`, `accounts.read`, `invoices.create`, `records.sync`.\n * For QuickBooks and Xero, one of those four exists. The other three are tool\n * calls that can only fail, while the capabilities that DO exist (`reports.get`,\n * `entities.query`, `tenants.list`) went unmentioned. Naming a tool that does\n * not exist is worse than naming none: the model spends the turn on it.\n */\nfunction actionsFromManifest(\n  manifest: ConnectorManifest,\n  fallbackDataClass: IntegrationDataClass,\n): IntegrationConnectorAction[] {\n  return manifest.capabilities.map((capability): IntegrationConnectorAction => {\n    const mutation = capability.class === 'mutation'\n    return {\n      id: capability.name,\n      title: capability.name,\n      risk: mutation ? 'write' : 'read',\n      requiredScopes: capability.requiredScopes ? [...capability.requiredScopes] : [],\n      dataClass: fallbackDataClass,\n      description: capability.description,\n      // A mutation reaching resources outside the caller needs confirmation\n      // before it runs; the adapter is what knows which those are.\n      approvalRequired: mutation ? capability.externalEffect : undefined,\n      inputSchema: capability.parameters,\n    }\n  })\n}\n\n/** Pair the adapter's REAL provider scopes with the closest permission\n *  descriptor for UI copy. The scope SET is taken verbatim from the manifest\n *  because it is what the authorization grant actually requests — only the\n *  surrounding title/risk labelling is matched heuristically, by whether the\n *  scope names a mutating capability. */\nfunction scopesFromManifest(\n  providerScopes: string[],\n  permissions: PermissionDescriptor[],\n): ScopeDescriptor[] {\n  const writePermission = permissions.find((permission) => permission.risk === 'write')\n  const readPermission = permissions.find((permission) => permission.risk === 'read') ?? permissions[0]\n  return providerScopes.map((providerScope): ScopeDescriptor => {\n    const mutating = /(?:^|[.\\/_:-])(?:write|manage|create|modify|edit|update|delete|full|readwrite)(?:$|[.\\/_:-])/i.test(\n      providerScope,\n    )\n    const base = (mutating ? writePermission : readPermission) ?? readPermission\n    return {\n      normalized: base?.normalized ?? 'unknown.read',\n      providerScope,\n      title: base?.title ?? providerScope,\n      reason: base?.reason ?? 'Requested by the connector.',\n      risk: mutating ? 'write' : 'read',\n      dataClass: base?.dataClass ?? 'private',\n    }\n  })\n}\n\nfunction credentialFieldsFor(auth: IntegrationAuthSpec) {\n  if (auth.mode === 'api_key' || auth.mode === 'hmac') return [auth.credential]\n  if (auth.mode === 'oauth2') {\n    return [\n      { label: 'Client ID', env: auth.clientIdEnv, description: 'OAuth client ID.', secret: false },\n      { label: 'Client Secret', env: auth.clientSecretEnv, description: 'OAuth client secret.', secret: true },\n    ]\n  }\n  return []\n}\n\nfunction permissionsFor(spec: IntegrationCoverageSpec, actions: IntegrationConnectorAction[]): PermissionDescriptor[] {\n  const dataClass = dataClassFor(actions)\n  const readScope = providerScopeFor(spec, 'read')\n  const writeScope = providerScopeFor(spec, 'write')\n  const permissions: PermissionDescriptor[] = [\n    {\n      normalized: `${spec.actionPack}.read` as NormalizedPermission,\n      providerScopes: readScope ? [readScope] : [],\n      title: `${spec.title} read`,\n      risk: 'read',\n      dataClass,\n      reason: `Read ${spec.title} data for user-authorized agent workflows.`,\n    },\n  ]\n  if (actions.some((a) => a.risk !== 'read')) {\n    permissions.push({\n      normalized: `${spec.actionPack}.write` as NormalizedPermission,\n      providerScopes: writeScope ? [writeScope] : [],\n      title: `${spec.title} write`,\n      risk: 'write',\n      dataClass,\n      reason: `Create or update ${spec.title} resources after policy approval.`,\n    })\n  }\n  return permissions\n}\n\nfunction providerScopeFor(spec: IntegrationCoverageSpec, mode: 'read' | 'write'): string {\n  const explicit = explicitScopes[spec.id]?.[mode]\n  if (explicit) return explicit\n  if (spec.auth === 'none') return ''\n  return `${spec.id}.${mode}`\n}\n\nconst explicitScopes: Record<string, Partial<Record<'read' | 'write', string>>> = {\n  gmail: { read: 'https://www.googleapis.com/auth/gmail.readonly', write: 'https://www.googleapis.com/auth/gmail.modify' },\n  'google-calendar': { read: 'https://www.googleapis.com/auth/calendar.readonly', write: 'https://www.googleapis.com/auth/calendar' },\n  'google-sheets': { read: 'https://www.googleapis.com/auth/spreadsheets.readonly', write: 'https://www.googleapis.com/auth/spreadsheets' },\n  'google-drive': { read: 'https://www.googleapis.com/auth/drive.readonly', write: 'https://www.googleapis.com/auth/drive.file' },\n  'google-docs': { read: 'https://www.googleapis.com/auth/documents.readonly', write: 'https://www.googleapis.com/auth/documents' },\n  'outlook-mail': { read: 'Mail.Read', write: 'Mail.Send' },\n  'outlook-calendar': { read: 'Calendars.Read', write: 'Calendars.ReadWrite' },\n  'microsoft-teams': { read: 'ChannelMessage.Read.All', write: 'ChannelMessage.Send' },\n  onedrive: { read: 'Files.Read', write: 'Files.ReadWrite' },\n  sharepoint: { read: 'Sites.Read.All', write: 'Sites.ReadWrite.All' },\n  slack: { read: 'channels:read', write: 'chat:write' },\n  hubspot: { read: 'crm.objects.contacts.read', write: 'crm.objects.contacts.write' },\n  salesforce: { read: 'api', write: 'api' },\n  notion: { read: '', write: '' },\n  github: { read: 'repo:read', write: 'repo' },\n  gitlab: { read: 'read_api', write: 'api' },\n  airtable: { read: 'data.records:read', write: 'data.records:write' },\n  asana: { read: 'default', write: 'default' },\n  stripe: { read: 'read_only', write: 'standard' },\n  twilio: { read: 'api_key', write: 'api_key' },\n}\n\nfunction plannerHintsFor(spec: IntegrationCoverageSpec, actions: IntegrationConnectorAction[]): IntegrationPlannerHints {\n  return {\n    useFor: spec.domains.map((domain) => domain.replace(/-/g, ' ')),\n    dataFreshness: ['calendar', 'chat', 'commerce', 'finance', 'support'].includes(spec.actionPack) ? 'near_realtime' : 'eventual',\n    writeRisk: actions.some((a) => a.risk === 'destructive') ? 'high' : actions.some((a) => a.risk === 'write') ? 'medium' : 'low',\n  }\n}\n\nfunction healthcheckFor(kind: string, status: IntegrationSpecStatus, auth: IntegrationAuthSpec): HealthcheckSpec {\n  if (status !== 'executable') {\n    return { id: `${kind}.static`, level: 'static', description: 'Catalog-only integration; no executable connector healthcheck is available yet.' }\n  }\n  if (auth.mode === 'oauth2') {\n    return { id: `${kind}.connection`, level: 'connection', description: 'Validate a user connection by calling the connector test endpoint.' }\n  }\n  if (auth.mode === 'api_key') {\n    return { id: `${kind}.connection`, level: 'connection', description: 'Validate API credentials by calling the connector test endpoint.' }\n  }\n  if (auth.mode === 'hmac') {\n    return { id: `${kind}.webhook`, level: 'webhook', description: 'Validate webhook signing configuration with a signed test payload.' }\n  }\n  return { id: `${kind}.static`, level: 'static', description: 'No credentials are required.' }\n}\n\nfunction statusFor(kind: string, coverageId: string): IntegrationSpecStatus {\n  return bundledManifestFor(kind, coverageId) ? 'executable' : 'catalog'\n}\n\nfunction dataClassFor(actions: IntegrationConnectorAction[]): IntegrationDataClass {\n  if (actions.some((a) => a.dataClass === 'secret')) return 'secret'\n  if (actions.some((a) => a.dataClass === 'sensitive')) return 'sensitive'\n  if (actions.some((a) => a.dataClass === 'private')) return 'private'\n  if (actions.some((a) => a.dataClass === 'internal')) return 'internal'\n  return 'public'\n}\n\nfunction apiKeyFieldFor(kind: string) {\n  return {\n    label: `${kind} API key`,\n    description: `API key or token for ${kind}.`,\n    example: kind === 'stripe' ? 'sk_live_...' : undefined,\n    secret: true,\n  }\n}\n\nfunction apiKeyPlacementFor(kind: string): ApiKeyAuthSpec['placement'] {\n  if (kind === 'sftp' || kind === 'kafka') return undefined\n  if (kind === 'clickup' || kind === 'gitlab') return 'header'\n  return 'bearer'\n}\n\nfunction extraAuthParamsFor(family: IntegrationFamilyId): Record<string, string> | undefined {\n  if (family === 'google') return { access_type: 'offline', prompt: 'consent', include_granted_scopes: 'true' }\n  if (family === 'notion') return { owner: 'user' }\n  return undefined\n}\n","import type {\n  ConsoleStep,\n  HealthcheckPlan,\n  IntegrationSpec,\n  RenderSpecOptions,\n  RenderedConsoleStep,\n} from './types.js'\n\nexport function renderConsoleSteps(spec: IntegrationSpec, options: RenderSpecOptions): RenderedConsoleStep[] {\n  const redirectUri = renderRedirectUri(spec, options)\n  return spec.setup.consoleSteps.map((step) => ({\n    ...step,\n    detail: renderTemplate(step.detail, spec, options, redirectUri),\n    copyValue: step.copyValue ? renderTemplate(step.copyValue, spec, options, redirectUri) : undefined,\n  }))\n}\n\nexport function renderRunbookMarkdown(spec: IntegrationSpec, options: RenderSpecOptions): string {\n  const steps = renderConsoleSteps(spec, options)\n  const lines = [\n    `# ${spec.title} Integration Setup`,\n    '',\n    `- Kind: \\`${spec.kind}\\``,\n    `- Status: \\`${spec.status}\\``,\n    `- Auth: \\`${spec.auth.mode}\\``,\n    `- Family: \\`${spec.family}\\``,\n  ]\n  if (spec.setup.consoleUrl) lines.push(`- Console: ${spec.setup.consoleUrl}`)\n  if (spec.setup.redirectUriTemplate) lines.push(`- Redirect URI: \\`${renderRedirectUri(spec, options)}\\``)\n  lines.push('', '## Credentials', '')\n  for (const field of spec.setup.credentialFields) {\n    lines.push(`- ${field.secret ? '[secret] ' : ''}${field.label}${field.env ? ` (\\`${field.env}\\`)` : ''}: ${field.description}`)\n  }\n  lines.push('', '## Permissions', '')\n  for (const permission of spec.permissions) {\n    lines.push(`- \\`${permission.normalized}\\`: ${permission.providerScopes.length ? permission.providerScopes.map((scope) => `\\`${scope}\\``).join(', ') : 'no provider scope'} - ${permission.reason}`)\n  }\n  lines.push('', '## Console Steps', '')\n  for (const [i, step] of steps.entries()) {\n    lines.push(`${i + 1}. ${step.title}: ${step.detail}`)\n  }\n  if (spec.setup.knownQuirks?.length) {\n    lines.push('', '## Known Quirks', '')\n    for (const quirk of spec.setup.knownQuirks) lines.push(`- ${quirk.severity}: ${quirk.message}`)\n  }\n  return `${lines.join('\\n')}\\n`\n}\n\nexport function renderAgentToolDescription(spec: IntegrationSpec): string {\n  const hints = spec.plannerHints\n  const useFor = hints?.useFor?.length ? `Use for ${hints.useFor.join(', ')}.` : `Use for ${spec.title} workflows.`\n  const risk = hints ? `Freshness: ${hints.dataFreshness}. Write risk: ${hints.writeRisk}.` : ''\n  return `${spec.title} (${spec.kind}). ${useFor} ${risk}`.trim()\n}\n\nexport function buildHealthcheckPlan(spec: IntegrationSpec): HealthcheckPlan {\n  const healthcheck = spec.setup.healthcheck ?? { id: `${spec.kind}.static`, level: 'static', description: 'No healthcheck defined.' as const }\n  const requires: HealthcheckPlan['requires'] = []\n  if (healthcheck.level === 'connection') requires.push('connection_credentials')\n  if (healthcheck.level === 'client_config' && spec.auth.mode === 'oauth2') requires.push('client_id', 'client_secret')\n  if (spec.auth.mode === 'api_key') requires.push('api_key')\n  if (spec.auth.mode === 'hmac') requires.push('hmac_secret')\n  return {\n    kind: spec.kind,\n    healthcheck,\n    requires,\n    message: healthcheck.description,\n  }\n}\n\nfunction renderTemplate(template: string, spec: IntegrationSpec, options: RenderSpecOptions, redirectUri?: string): string {\n  return template\n    .replaceAll('{host}', options.host)\n    .replaceAll('{kind}', spec.kind)\n    .replaceAll('{redirectUri}', redirectUri ?? renderRedirectUri(spec, options))\n}\n\nfunction renderRedirectUri(spec: IntegrationSpec, options: RenderSpecOptions): string {\n  return (options.callbackPath ?? spec.setup.redirectUriTemplate ?? '')\n    .replaceAll('{host}', options.host)\n    .replaceAll('{kind}', spec.kind)\n}\n\nexport function consoleStepsToText(steps: ConsoleStep[]): string {\n  return steps.map((step, index) => `${index + 1}. ${step.title}: ${step.detail}`).join('\\n')\n}\n","import type {\n  CredentialFieldSpec,\n  CredentialValidationResult,\n  IntegrationSpec,\n  IntegrationSpecValidationIssue,\n  IntegrationSpecValidationResult,\n} from './types.js'\n\nexport function validateIntegrationSpec(spec: IntegrationSpec): IntegrationSpecValidationResult {\n  const issues: IntegrationSpecValidationIssue[] = []\n  if (!spec.kind.trim()) issues.push({ path: 'kind', message: 'kind is required' })\n  if (!spec.title.trim()) issues.push({ path: 'title', message: 'title is required' })\n  if (!spec.actions.length) issues.push({ path: 'actions', message: 'at least one action is required' })\n  if (!spec.permissions.length) issues.push({ path: 'permissions', message: 'at least one permission is required' })\n  if (spec.auth.mode === 'oauth2') {\n    if (!spec.auth.authorizationUrl) issues.push({ path: 'auth.authorizationUrl', message: 'authorizationUrl is required' })\n    if (!spec.auth.tokenUrl) issues.push({ path: 'auth.tokenUrl', message: 'tokenUrl is required' })\n    if (!spec.auth.redirectUriTemplate) issues.push({ path: 'auth.redirectUriTemplate', message: 'redirectUriTemplate is required' })\n  }\n  const actionIds = new Set<string>()\n  for (const [index, action] of spec.actions.entries()) {\n    if (actionIds.has(action.id)) issues.push({ path: `actions[${index}].id`, message: `duplicate action id ${action.id}` })\n    actionIds.add(action.id)\n  }\n  return { ok: issues.length === 0, issues }\n}\n\nexport function assertValidIntegrationSpec(spec: IntegrationSpec): void {\n  const result = validateIntegrationSpec(spec)\n  if (!result.ok) {\n    throw new Error(`Invalid integration spec ${spec.kind}: ${result.issues.map((i) => `${i.path}: ${i.message}`).join('; ')}`)\n  }\n}\n\nexport function validateCredentialFormat(field: CredentialFieldSpec, value: string): CredentialValidationResult {\n  if (!value.trim()) return { ok: false, field: field.label, message: `${field.label} is required` }\n  if (field.regex && !new RegExp(field.regex).test(value)) {\n    return { ok: false, field: field.label, message: `${field.label} does not match expected format` }\n  }\n  return { ok: true, field: field.label }\n}\n\nexport function validateCredentialSet(spec: IntegrationSpec, values: Record<string, string>): CredentialValidationResult[] {\n  return spec.setup.credentialFields.map((field) => {\n    const key = field.env ?? field.label\n    return validateCredentialFormat(field, values[key] ?? '')\n  })\n}\n"],"mappings":";;;;;;;;;;;;AA2OO,SAAS,wBAAwB,MAAyD;AAC/F,MAAI,KAAK,SAAS,UAAW,QAAO;AACpC,MAAI,KAAK,SAAS,SAAU,QAAO;AACnC,MAAI,KAAK,SAAS,OAAQ,QAAO;AACjC,SAAO;AACT;;;AC9OO,IAAM,uBAA2E;AAAA,EACtF,QAAQ;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,qBAAqB;AAAA,IACrB,kBAAkB;AAAA,MAChB,EAAE,OAAO,aAAa,KAAK,0BAA0B,aAAa,2BAA2B,SAAS,6CAA6C,OAAO,4DAA4D,QAAQ,MAAM;AAAA,MACpO,EAAE,OAAO,iBAAiB,KAAK,8BAA8B,aAAa,+BAA+B,SAAS,cAAc,QAAQ,KAAK;AAAA,IAC/I;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,WAAW,OAAO,kBAAkB,QAAQ,+EAA+E;AAAA,MACjI,EAAE,IAAI,WAAW,OAAO,4BAA4B,QAAQ,0GAA0G;AAAA,MACtK,EAAE,IAAI,UAAU,OAAO,qBAAqB,QAAQ,kDAAkD;AAAA,MACtG,EAAE,IAAI,YAAY,OAAO,oBAAoB,QAAQ,oDAAoD,WAAW,gBAAgB;AAAA,MACpI,EAAE,IAAI,UAAU,OAAO,cAAc,QAAQ,+CAA+C;AAAA,IAC9F;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,kBAAkB,UAAU,WAAW,SAAS,+EAA+E;AAAA,MACrI,EAAE,IAAI,gBAAgB,UAAU,WAAW,SAAS,4FAA4F;AAAA,IAClJ;AAAA,IACA,WAAW,EAAE,iBAAiB,MAAM,gBAAgB,MAAM,yBAAyB,MAAM,qCAAqC,GAAG;AAAA,EACnI;AAAA,EACA,mBAAmB;AAAA,IACjB,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,qBAAqB;AAAA,IACrB,kBAAkB;AAAA,MAChB,EAAE,OAAO,aAAa,KAAK,sBAAsB,aAAa,0CAA0C,SAAS,wCAAwC,OAAO,sBAAsB,QAAQ,MAAM;AAAA,MACpM,EAAE,OAAO,iBAAiB,KAAK,0BAA0B,aAAa,wCAAwC,QAAQ,KAAK;AAAA,IAC7H;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,OAAO,OAAO,gBAAgB,QAAQ,yDAAyD;AAAA,MACrG,EAAE,IAAI,YAAY,OAAO,oBAAoB,QAAQ,4CAA4C,WAAW,gBAAgB;AAAA,MAC5H,EAAE,IAAI,UAAU,OAAO,iBAAiB,QAAQ,wEAAwE;AAAA,MACxH,EAAE,IAAI,eAAe,OAAO,yBAAyB,QAAQ,6FAA6F;AAAA,IAC5J;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,iBAAiB,UAAU,QAAQ,SAAS,+GAA+G;AAAA,MACjK,EAAE,IAAI,iBAAiB,UAAU,WAAW,SAAS,kDAAkD;AAAA,IACzG;AAAA,IACA,WAAW,EAAE,iBAAiB,MAAM,gBAAgB,MAAM,yBAAyB,MAAM,qCAAqC,GAAG;AAAA,EACnI;AAAA,EACA,WAAW;AAAA,IACT,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,qBAAqB;AAAA,IACrB,kBAAkB;AAAA,MAChB,EAAE,OAAO,aAAa,aAAa,8BAA8B,QAAQ,MAAM;AAAA,MAC/E,EAAE,OAAO,iBAAiB,aAAa,kCAAkC,QAAQ,KAAK;AAAA,IACxF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,OAAO,OAAO,oBAAoB,QAAQ,8DAA8D;AAAA,MAC9G,EAAE,IAAI,YAAY,OAAO,oBAAoB,QAAQ,0CAA0C,WAAW,gBAAgB;AAAA,MAC1H,EAAE,IAAI,QAAQ,OAAO,eAAe,QAAQ,iEAAiE;AAAA,IAC/G;AAAA,IACA,WAAW,EAAE,iBAAiB,MAAM,gBAAgB,OAAO,yBAAyB,OAAO,qCAAqC,GAAG;AAAA,EACrI;AAAA,EACA,YAAY;AAAA,IACV,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,qBAAqB;AAAA,IACrB,kBAAkB;AAAA,MAChB,EAAE,OAAO,aAAa,KAAK,8BAA8B,aAAa,0CAA0C,QAAQ,MAAM;AAAA,MAC9H,EAAE,OAAO,iBAAiB,KAAK,kCAAkC,aAAa,6CAA6C,QAAQ,KAAK;AAAA,IAC1I;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,iBAAiB,OAAO,wBAAwB,QAAQ,wDAAwD;AAAA,MACtH,EAAE,IAAI,YAAY,OAAO,oBAAoB,QAAQ,0CAA0C,WAAW,gBAAgB;AAAA,MAC1H,EAAE,IAAI,UAAU,OAAO,iBAAiB,QAAQ,gFAAgF;AAAA,IAClI;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,gBAAgB,UAAU,YAAY,SAAS,0EAA0E;AAAA,IACjI;AAAA,IACA,WAAW,EAAE,iBAAiB,MAAM,gBAAgB,MAAM,yBAAyB,OAAO,qCAAqC,GAAG;AAAA,EACpI;AAAA,EACA,SAAS;AAAA,IACP,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,qBAAqB;AAAA,IACrB,kBAAkB;AAAA,MAChB,EAAE,OAAO,aAAa,KAAK,2BAA2B,aAAa,0BAA0B,QAAQ,MAAM;AAAA,MAC3G,EAAE,OAAO,iBAAiB,KAAK,+BAA+B,aAAa,8BAA8B,QAAQ,KAAK;AAAA,IACxH;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,OAAO,OAAO,6BAA6B,QAAQ,4CAA4C;AAAA,MACrG,EAAE,IAAI,YAAY,OAAO,oBAAoB,QAAQ,+CAA+C,WAAW,gBAAgB;AAAA,MAC/H,EAAE,IAAI,UAAU,OAAO,kBAAkB,QAAQ,iDAAiD;AAAA,IACpG;AAAA,IACA,WAAW,EAAE,iBAAiB,MAAM,gBAAgB,MAAM,yBAAyB,OAAO,qCAAqC,GAAG;AAAA,EACpI;AAAA,EACA,OAAO;AAAA,IACL,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,qBAAqB;AAAA,IACrB,kBAAkB;AAAA,MAChB,EAAE,OAAO,aAAa,KAAK,yBAAyB,aAAa,wBAAwB,QAAQ,MAAM;AAAA,MACvG,EAAE,OAAO,iBAAiB,KAAK,6BAA6B,aAAa,4BAA4B,QAAQ,KAAK;AAAA,IACpH;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,OAAO,OAAO,oBAAoB,QAAQ,8BAA8B;AAAA,MAC9E,EAAE,IAAI,YAAY,OAAO,oBAAoB,QAAQ,gDAAgD,WAAW,gBAAgB;AAAA,MAChI,EAAE,IAAI,UAAU,OAAO,kBAAkB,QAAQ,sEAAsE;AAAA,IACzH;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,aAAa,UAAU,QAAQ,SAAS,mFAAmF;AAAA,IACnI;AAAA,IACA,WAAW,EAAE,iBAAiB,OAAO,gBAAgB,MAAM,yBAAyB,OAAO,qCAAqC,GAAG;AAAA,EACrI;AAAA,EACA,QAAQ;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,qBAAqB;AAAA,IACrB,kBAAkB;AAAA,MAChB,EAAE,OAAO,aAAa,KAAK,0BAA0B,aAAa,uCAAuC,QAAQ,MAAM;AAAA,MACvH,EAAE,OAAO,iBAAiB,KAAK,8BAA8B,aAAa,2CAA2C,QAAQ,KAAK;AAAA,IACpI;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,eAAe,OAAO,sBAAsB,QAAQ,sCAAsC;AAAA,MAChG,EAAE,IAAI,YAAY,OAAO,oBAAoB,QAAQ,0CAA0C,WAAW,gBAAgB;AAAA,MAC1H,EAAE,IAAI,gBAAgB,OAAO,uBAAuB,QAAQ,kEAAkE;AAAA,IAChI;AAAA,IACA,WAAW,EAAE,iBAAiB,MAAM,gBAAgB,MAAM,yBAAyB,OAAO,qCAAqC,GAAG;AAAA,EACpI;AAAA,EACA,mBAAmB;AAAA,IACjB,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,qBAAqB;AAAA,IACrB,kBAAkB;AAAA,MAChB,EAAE,OAAO,aAAa,aAAa,oBAAoB,QAAQ,MAAM;AAAA,MACrE,EAAE,OAAO,iBAAiB,aAAa,wBAAwB,QAAQ,KAAK;AAAA,IAC9E;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,OAAO,OAAO,oBAAoB,QAAQ,+CAA+C;AAAA,MAC/F,EAAE,IAAI,YAAY,OAAO,oBAAoB,QAAQ,iDAAiD,WAAW,gBAAgB;AAAA,MACjI,EAAE,IAAI,UAAU,OAAO,cAAc,QAAQ,sCAAsC;AAAA,IACrF;AAAA,IACA,WAAW,EAAE,iBAAiB,MAAM,gBAAgB,OAAO,yBAAyB,OAAO,qCAAqC,GAAG;AAAA,EACrI;AAAA,EACA,WAAW;AAAA,IACT,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,kBAAkB;AAAA,MAChB,EAAE,OAAO,WAAW,aAAa,8BAA8B,SAAS,UAAU,QAAQ,KAAK;AAAA,IACjG;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,SAAS,OAAO,gBAAgB,QAAQ,yFAAyF;AAAA,IACzI;AAAA,IACA,WAAW,EAAE,iBAAiB,OAAO,gBAAgB,MAAM,yBAAyB,OAAO,qCAAqC,GAAG;AAAA,EACrI;AAAA,EACA,MAAM;AAAA,IACJ,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,kBAAkB;AAAA,MAChB,EAAE,OAAO,kBAAkB,aAAa,2BAA2B,QAAQ,KAAK;AAAA,IAClF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,UAAU,OAAO,4BAA4B,QAAQ,kEAAkE;AAAA,IAC/H;AAAA,IACA,WAAW,EAAE,iBAAiB,OAAO,gBAAgB,MAAM,yBAAyB,OAAO,qCAAqC,GAAG;AAAA,EACrI;AAAA,EACA,MAAM;AAAA,IACJ,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,kBAAkB,CAAC;AAAA,IACnB,cAAc;AAAA,MACZ,EAAE,IAAI,aAAa,OAAO,sBAAsB,QAAQ,wCAAwC;AAAA,IAClG;AAAA,IACA,WAAW,EAAE,iBAAiB,OAAO,gBAAgB,OAAO,yBAAyB,MAAM;AAAA,EAC7F;AACF;AAEO,SAAS,qBAAqB,IAAgD;AACnF,SAAO,qBAAqB,EAAE;AAChC;;;AC9MO,IAAM,2BAA6D;AAAA,EACxE,mBAAmB;AAAA,EACnB,sBAAsB;AAAA,EACtB,wBAAwB;AAAA,EACxB,mBAAmB;AAAA,EACnB,UAAU;AAAA,EACV,oBAAoB;AAAA,EACpB,8BAA8B;AAAA,EAC9B,qBAAqB;AAAA,EACrB,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,UAAU;AAAA,EACV,cAAc;AAAA,EACd,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,gBAAgB;AAClB;AAEO,SAAS,yBAAyB,MAAsB;AAC7D,SAAO,yBAAyB,IAAI,KAAK;AAC3C;;;AC6BO,IAAM,wBAA6D;AAAA,EACxE,SAAS;AAAA,IACP,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,QAAQ,OAAO,mCAAmC,QAAQ,uIAAuI;AAAA,MACvM,EAAE,IAAI,WAAW,OAAO,4BAA4B,QAAQ,0HAA0H;AAAA,MACtL,EAAE,IAAI,cAAc,OAAO,6BAA6B,QAAQ,qIAAqI;AAAA,MACrM,EAAE,IAAI,QAAQ,OAAO,uBAAuB,QAAQ,4HAA4H;AAAA,IAClL;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,aAAa,UAAU,QAAQ,SAAS,4LAA4L;AAAA,MAC1O,EAAE,IAAI,eAAe,UAAU,WAAW,SAAS,wIAAwI;AAAA,MAC3L,EAAE,IAAI,YAAY,UAAU,YAAY,SAAS,wGAAwG;AAAA,MACzJ,EAAE,IAAI,mBAAmB,UAAU,QAAQ,SAAS,oIAAoI;AAAA,MACxL,EAAE,IAAI,mBAAmB,UAAU,WAAW,SAAS,0GAA0G;AAAA,IACnK;AAAA,IACA,aAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,QAAQ,OAAO,sCAAsC,QAAQ,4KAA4K;AAAA,MAC/O,EAAE,IAAI,WAAW,OAAO,4BAA4B,QAAQ,wHAAwH;AAAA,MACpL,EAAE,IAAI,cAAc,OAAO,6BAA6B,QAAQ,wHAAwH;AAAA,MACxL,EAAE,IAAI,QAAQ,OAAO,uBAAuB,QAAQ,sIAAsI;AAAA,IAC5L;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,aAAa,UAAU,QAAQ,SAAS,8IAA8I;AAAA,MAC5L,EAAE,IAAI,YAAY,UAAU,YAAY,SAAS,2GAA2G;AAAA,MAC5J,EAAE,IAAI,eAAe,UAAU,WAAW,SAAS,0FAA0F;AAAA,MAC7I,EAAE,IAAI,mBAAmB,UAAU,QAAQ,SAAS,oGAAoG;AAAA,MACxJ,EAAE,IAAI,mBAAmB,UAAU,WAAW,SAAS,kIAAkI;AAAA,IAC3L;AAAA,IACA,aAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,aAAa;AAAA,IACX,YAAY;AAAA,IACZ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,OAAO,OAAO,8BAA8B,QAAQ,8EAA8E;AAAA,MACxI,EAAE,IAAI,SAAS,OAAO,qBAAqB,QAAQ,8DAA8D;AAAA,MACjH,EAAE,IAAI,QAAQ,OAAO,uBAAuB,QAAQ,iHAAiH;AAAA,IACvK;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,wBAAwB,UAAU,WAAW,SAAS,oGAAoG;AAAA,MAChK,EAAE,IAAI,cAAc,UAAU,WAAW,SAAS,wGAAwG;AAAA,IAC5J;AAAA,IACA,aAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,QAAQ,OAAO,oCAAoC,QAAQ,kJAAkJ;AAAA,MACnN,EAAE,IAAI,WAAW,OAAO,4BAA4B,QAAQ,2IAA2I;AAAA,MACvM,EAAE,IAAI,cAAc,OAAO,6BAA6B,QAAQ,wHAAwH;AAAA,MACxL,EAAE,IAAI,QAAQ,OAAO,uBAAuB,QAAQ,sIAAsI;AAAA,IAC5L;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,aAAa,UAAU,QAAQ,SAAS,kJAAkJ;AAAA,MAChM,EAAE,IAAI,YAAY,UAAU,YAAY,SAAS,2GAA2G;AAAA,MAC5J,EAAE,IAAI,eAAe,UAAU,WAAW,SAAS,0FAA0F;AAAA,MAC7I,EAAE,IAAI,mBAAmB,UAAU,QAAQ,SAAS,oGAAoG;AAAA,MACxJ,EAAE,IAAI,mBAAmB,UAAU,WAAW,SAAS,0IAA0I;AAAA,IACnM;AAAA,IACA,aAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,WAAW,OAAO,kCAAkC,QAAQ,mGAAmG;AAAA,MACrK,EAAE,IAAI,OAAO,OAAO,wBAAwB,QAAQ,4GAA4G;AAAA,MAChK,EAAE,IAAI,cAAc,OAAO,6BAA6B,QAAQ,mIAAmI;AAAA,MACnM,EAAE,IAAI,QAAQ,OAAO,uBAAuB,QAAQ,wHAAwH;AAAA,IAC9K;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,YAAY,UAAU,YAAY,SAAS,yFAAyF;AAAA,MAC1I,EAAE,IAAI,cAAc,UAAU,WAAW,SAAS,uHAAuH;AAAA,MACzK,EAAE,IAAI,gBAAgB,UAAU,QAAQ,SAAS,kFAAkF;AAAA,MACnI,EAAE,IAAI,iBAAiB,UAAU,QAAQ,SAAS,gIAAgI;AAAA,MAClL,EAAE,IAAI,mBAAmB,UAAU,WAAW,SAAS,6IAA6I;AAAA,IACtM;AAAA,IACA,aAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,WAAW,OAAO,qCAAqC,QAAQ,0GAA0G;AAAA,MAC/K,EAAE,IAAI,OAAO,OAAO,kCAAkC,QAAQ,+FAA+F;AAAA,MAC7J,EAAE,IAAI,cAAc,OAAO,6BAA6B,QAAQ,uHAAuH;AAAA,MACvL,EAAE,IAAI,QAAQ,OAAO,uBAAuB,QAAQ,sIAAsI;AAAA,IAC5L;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,YAAY,UAAU,YAAY,SAAS,4FAA4F;AAAA,MAC7I,EAAE,IAAI,eAAe,UAAU,WAAW,SAAS,0FAA0F;AAAA,MAC7I,EAAE,IAAI,sBAAsB,UAAU,QAAQ,SAAS,kGAAkG;AAAA,MACzJ,EAAE,IAAI,oBAAoB,UAAU,WAAW,SAAS,mIAAmI;AAAA,IAC7L;AAAA,IACA,aAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,cAAc;AAAA,MACZ,EAAE,IAAI,SAAS,OAAO,4BAA4B,QAAQ,2GAA2G;AAAA,MACrK,EAAE,IAAI,SAAS,OAAO,wBAAwB,QAAQ,iGAAiG;AAAA,IACzJ;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,aAAa,UAAU,QAAQ,SAAS,gFAAgF;AAAA,MAC9H,EAAE,IAAI,mBAAmB,UAAU,YAAY,SAAS,gHAAgH;AAAA,MACxK,EAAE,IAAI,mBAAmB,UAAU,WAAW,SAAS,sHAAsH;AAAA,MAC7K,EAAE,IAAI,gBAAgB,UAAU,QAAQ,SAAS,mGAAmG;AAAA,IACtJ;AAAA,IACA,aAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,WAAW,OAAO,uCAAuC,QAAQ,sGAAsG;AAAA,MAC7K,EAAE,IAAI,WAAW,OAAO,+BAA+B,QAAQ,oFAAoF;AAAA,MACnJ,EAAE,IAAI,cAAc,OAAO,6BAA6B,QAAQ,yFAAyF;AAAA,MACzJ,EAAE,IAAI,QAAQ,OAAO,wBAAwB,QAAQ,wIAAwI;AAAA,IAC/L;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,YAAY,UAAU,YAAY,SAAS,6FAA6F;AAAA,MAC9I,EAAE,IAAI,kBAAkB,UAAU,WAAW,SAAS,gGAAgG;AAAA,MACtJ,EAAE,IAAI,sBAAsB,UAAU,WAAW,SAAS,qHAAqH;AAAA,MAC/K,EAAE,IAAI,mBAAmB,UAAU,YAAY,SAAS,6HAA6H;AAAA,IACvL;AAAA,IACA,aAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,WAAW,OAAO,oCAAoC,QAAQ,uFAAuF;AAAA,MAC3J,EAAE,IAAI,eAAe,OAAO,+BAA+B,QAAQ,0GAA0G;AAAA,MAC7K,EAAE,IAAI,cAAc,OAAO,6BAA6B,QAAQ,iIAAiI;AAAA,MACjM,EAAE,IAAI,QAAQ,OAAO,uBAAuB,QAAQ,6HAA6H;AAAA,IACnL;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,mBAAmB,UAAU,WAAW,SAAS,+HAA+H;AAAA,MACtL,EAAE,IAAI,YAAY,UAAU,YAAY,SAAS,gGAAgG;AAAA,MACjJ,EAAE,IAAI,cAAc,UAAU,YAAY,SAAS,gFAAgF;AAAA,IACrI;AAAA,IACA,aAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,oBAAoB;AAAA,IAClB,YAAY;AAAA,IACZ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,SAAS,OAAO,mCAAmC,QAAQ,wFAAwF;AAAA,MACzJ,EAAE,IAAI,OAAO,OAAO,6BAA6B,QAAQ,4FAA4F;AAAA,MACrJ,EAAE,IAAI,UAAU,OAAO,8BAA8B,QAAQ,wFAAwF;AAAA,MACrJ,EAAE,IAAI,gBAAgB,OAAO,oCAAoC,QAAQ,oHAAoH;AAAA,IAC/L;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,iBAAiB,UAAU,QAAQ,SAAS,6IAA6I;AAAA,MAC/L,EAAE,IAAI,mBAAmB,UAAU,YAAY,SAAS,kIAAkI;AAAA,IAC5L;AAAA,IACA,aAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,qBAAqB;AAAA,IACnB,YAAY;AAAA,IACZ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,aAAa,OAAO,iCAAiC,QAAQ,+FAA+F;AAAA,MAClK,EAAE,IAAI,UAAU,OAAO,wCAAwC,QAAQ,4EAA4E;AAAA,MACnJ,EAAE,IAAI,UAAU,OAAO,sCAAsC,QAAQ,iFAAiF;AAAA,MACtJ,EAAE,IAAI,SAAS,OAAO,+BAA+B,QAAQ,kGAAkG;AAAA,IACjK;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,uBAAuB,UAAU,YAAY,SAAS,wJAAwJ;AAAA,MACpN,EAAE,IAAI,sBAAsB,UAAU,QAAQ,SAAS,uKAAuK;AAAA,IAChO;AAAA,IACA,aAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,YAAY;AAAA,IACZ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,OAAO,OAAO,0BAA0B,QAAQ,wDAAwD;AAAA,MAC9G,EAAE,IAAI,mBAAmB,OAAO,4BAA4B,QAAQ,6DAA6D;AAAA,MACjI,EAAE,IAAI,SAAS,OAAO,8BAA8B,QAAQ,6FAA6F;AAAA,MACzJ,EAAE,IAAI,OAAO,OAAO,+BAA+B,QAAQ,gFAAgF;AAAA,IAC7I;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,iBAAiB,UAAU,WAAW,SAAS,wHAAwH;AAAA,MAC7K,EAAE,IAAI,YAAY,UAAU,WAAW,SAAS,6GAA6G;AAAA,IAC/J;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,YAAY;AAAA,IACZ,kBAAkB,CAAC,EAAE,OAAO,sCAAsC,aAAa,+FAA+F,QAAQ,KAAK,CAAC;AAAA,IAC5L,cAAc;AAAA,MACZ,EAAE,IAAI,SAAS,OAAO,yBAAyB,QAAQ,iFAAiF;AAAA,MACxI,EAAE,IAAI,YAAY,OAAO,4BAA4B,QAAQ,2FAA2F;AAAA,MACxJ,EAAE,IAAI,SAAS,OAAO,mBAAmB,QAAQ,gEAAgE;AAAA,IACnH;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,sBAAsB,UAAU,YAAY,SAAS,kJAAkJ;AAAA,MAC7M,EAAE,IAAI,uBAAuB,UAAU,YAAY,SAAS,qHAAqH;AAAA,IACnL;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,YAAY;AAAA,IACZ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,WAAW,OAAO,8BAA8B,QAAQ,gGAAgG;AAAA,MAC9J,EAAE,IAAI,eAAe,OAAO,wBAAwB,QAAQ,gFAAgF;AAAA,MAC5I,EAAE,IAAI,UAAU,OAAO,8BAA8B,QAAQ,mFAAmF;AAAA,IAClJ;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,iBAAiB,UAAU,WAAW,SAAS,6JAA6J;AAAA,MAClN,EAAE,IAAI,gBAAgB,UAAU,WAAW,SAAS,gIAA2H;AAAA,IACjL;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,YAAY;AAAA,IACZ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,OAAO,OAAO,2BAA2B,QAAQ,iGAAiG;AAAA,MACxJ,EAAE,IAAI,YAAY,OAAO,0BAA0B,QAAQ,2FAA2F;AAAA,MACtJ,EAAE,IAAI,QAAQ,OAAO,wBAAwB,QAAQ,oEAAoE;AAAA,MACzH,EAAE,IAAI,SAAS,OAAO,+BAA+B,QAAQ,6EAA6E;AAAA,IAC5I;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,eAAe,UAAU,WAAW,SAAS,0JAA0J;AAAA,MAC7M,EAAE,IAAI,iBAAiB,UAAU,WAAW,SAAS,8GAA8G;AAAA,IACrK;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,YAAY;AAAA,IACZ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,SAAS,OAAO,2BAA2B,QAAQ,yFAAyF;AAAA,MAClJ,EAAE,IAAI,eAAe,OAAO,2BAA2B,QAAQ,uGAAuG;AAAA,MACtK,EAAE,IAAI,SAAS,OAAO,mBAAmB,QAAQ,gEAAgE;AAAA,IACnH;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,eAAe,UAAU,QAAQ,SAAS,iLAAiL;AAAA,MACjO,EAAE,IAAI,mBAAmB,UAAU,QAAQ,SAAS,8FAA8F;AAAA,IACpJ;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,YAAY;AAAA,IACZ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,cAAc,OAAO,+BAA+B,QAAQ,sGAAsG;AAAA,MACxK,EAAE,IAAI,eAAe,OAAO,iCAAiC,QAAQ,oEAAoE;AAAA,MACzI,EAAE,IAAI,eAAe,OAAO,4BAA4B,QAAQ,sFAAsF;AAAA,IACxJ;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,YAAY;AAAA,IACZ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,eAAe,OAAO,0BAA0B,QAAQ,oGAAoG;AAAA,MAClK,EAAE,IAAI,UAAU,OAAO,wBAAwB,QAAQ,2EAA2E;AAAA,MAClI,EAAE,IAAI,SAAS,OAAO,qBAAqB,QAAQ,sFAAsF;AAAA,IAC3I;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,YAAY,OAAO,4BAA4B,QAAQ,kFAAkF;AAAA,MAC/I,EAAE,IAAI,SAAS,OAAO,+BAA+B,QAAQ,gGAAgG;AAAA,MAC7J,EAAE,IAAI,QAAQ,OAAO,8BAA8B,QAAQ,kFAAkF;AAAA,IAC/I;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,qBAAqB,UAAU,WAAW,SAAS,wJAAwJ;AAAA,IACnN;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,YAAY;AAAA,IACZ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,EAAE,IAAI,cAAc,OAAO,sBAAsB,QAAQ,2DAA2D;AAAA,MACpH,EAAE,IAAI,cAAc,OAAO,qBAAqB,QAAQ,kGAAkG;AAAA,MAC1J,EAAE,IAAI,aAAa,OAAO,qBAAqB,QAAQ,8DAA8D;AAAA,IACvH;AAAA,IACA,aAAa;AAAA,MACX,EAAE,IAAI,oBAAoB,UAAU,WAAW,SAAS,8JAAyJ;AAAA,IACnN;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,YAAY;AAAA,IACZ,cAAc;AAAA,MACZ,EAAE,IAAI,YAAY,OAAO,gCAAgC,QAAQ,qGAAqG;AAAA,MACtK,EAAE,IAAI,mBAAmB,OAAO,6BAA6B,QAAQ,iGAAiG;AAAA,MACtK,EAAE,IAAI,eAAe,OAAO,iCAAiC,QAAQ,mIAAmI;AAAA,IAC1M;AAAA,IACA,kBAAkB,CAAC;AAAA,IACnB,aAAa;AAAA,MACX,EAAE,IAAI,qBAAqB,UAAU,YAAY,SAAS,sLAAsL;AAAA,MAChP,EAAE,IAAI,iBAAiB,UAAU,WAAW,SAAS,kIAAkI;AAAA,IACzL;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL,YAAY;AAAA,IACZ,cAAc;AAAA,MACZ,EAAE,IAAI,YAAY,OAAO,4BAA4B,QAAQ,wHAAwH;AAAA,MACrL,EAAE,IAAI,eAAe,OAAO,mCAAmC,QAAQ,2FAA2F;AAAA,MAClK,EAAE,IAAI,SAAS,OAAO,6BAA6B,QAAQ,gGAAgG;AAAA,IAC7J;AAAA,IACA,kBAAkB,CAAC;AAAA,IACnB,aAAa;AAAA,MACX,EAAE,IAAI,4BAA4B,UAAU,YAAY,SAAS,gJAAgJ;AAAA,IACnN;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,YAAY;AAAA,IACZ,cAAc;AAAA,MACZ,EAAE,IAAI,OAAO,OAAO,wBAAwB,QAAQ,6DAA6D;AAAA,MACjH,EAAE,IAAI,YAAY,OAAO,oBAAoB,QAAQ,gDAAgD,WAAW,gBAAgB;AAAA,MAChI,EAAE,IAAI,UAAU,OAAO,uBAAuB,QAAQ,mFAAmF;AAAA,MACzI,EAAE,IAAI,UAAU,OAAO,8BAA8B,QAAQ,0GAA0G;AAAA,IACzK;AAAA,EACF;AAAA,EACA,mBAAmB;AAAA,IACjB,YAAY;AAAA,IACZ,cAAc;AAAA,MACZ,EAAE,IAAI,eAAe,OAAO,kCAAkC,QAAQ,2HAA2H;AAAA,MACjM,EAAE,IAAI,WAAW,OAAO,yBAAyB,QAAQ,qFAAqF;AAAA,IAChJ;AAAA,IACA,kBAAkB,CAAC;AAAA,IACnB,aAAa;AAAA,MACX,EAAE,IAAI,8BAA8B,UAAU,YAAY,SAAS,0KAA0K;AAAA,IAC/O;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,YAAY;AAAA,IACZ,cAAc;AAAA,MACZ,EAAE,IAAI,aAAa,OAAO,kCAAkC,QAAQ,yHAAyH;AAAA,MAC7L,EAAE,IAAI,oBAAoB,OAAO,gCAAgC,QAAQ,oHAAoH;AAAA,IAC/L;AAAA,IACA,kBAAkB,CAAC;AAAA,IACnB,aAAa;AAAA,MACX,EAAE,IAAI,4BAA4B,UAAU,YAAY,SAAS,0LAA0L;AAAA,IAC7P;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAe;AAAA,IACb,YAAY;AAAA,IACZ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aACE;AAAA,QAEF,SAAS;AAAA,QACT,OAAO;AAAA,QACP,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,WAAW;AAAA,MACb;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,QACE;AAAA,MAGJ;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,QACE;AAAA,MAEJ;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc;AAAA,IACZ,YAAY;AAAA,IACZ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS;AAAA,QACT,OAAO;AAAA,QACP,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,aACE;AAAA,QAGF,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,WAAW;AAAA,MACb;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,QACE;AAAA,MAIJ;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SACE;AAAA,MAGJ;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO;AAAA,IACL,YAAY;AAAA,IACZ,kBAAkB;AAAA,MAChB;AAAA,QACE,OAAO;AAAA,QACP,aACE;AAAA,QAEF,SAAS;AAAA,QACT,OAAO;AAAA,QACP,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,WAAW;AAAA,MACb;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,QACE;AAAA,MAGJ;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,QACE;AAAA,MAEJ;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SACE;AAAA,MAGJ;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SACE;AAAA,MAGJ;AAAA,IACF;AAAA,EACF;AACF;AAGO,SAAS,uBAAuB,MAA+C;AACpF,SAAO,sBAAsB,IAAI;AACnC;;;AClqBA,SAAS,mBAAmB,MAAc,YAAoB;AAC5D,SAAO,0BAA0B,IAAI,KAAK,0BAA0B,UAAU;AAChF;AAEO,SAAS,uBAA0C;AACxD,QAAM,aAAa,IAAI,IAAI,mCAAmC,EAAE,YAAY,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC3G,SAAO,6BAA6B,EAAE,IAAI,CAAC,aAAa;AACtD,UAAM,YAAY,WAAW,IAAI,SAAS,EAAE;AAC5C,QAAI,CAAC,UAAW,OAAM,IAAI,MAAM,kCAAkC,SAAS,EAAE,EAAE;AAC/E,WAAO,iBAAiB,UAAU,SAAS;AAAA,EAC7C,CAAC;AACH;AAEO,SAAS,mBAAmB,MAA2C;AAC5E,QAAM,YAAY,yBAAyB,IAAI;AAC/C,SAAO,qBAAqB,EAAE,KAAK,CAAC,SAAS,yBAAyB,KAAK,IAAI,MAAM,SAAS;AAChG;AAwBO,SAAS,yBAAyB,MAA6C;AACpF,QAAM,OAAO,mBAAmB,IAAI;AACpC,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,OAAO,KAAK;AAClB,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,UAAU;AAAA,MACV,iBAAiB,KAAK,OAAO,IAAI,CAAC,UAAU,MAAM,aAAa,EAAE,OAAO,OAAO;AAAA,MAC/E,kBAAkB,KAAK;AAAA,MACvB,UAAU,KAAK;AAAA,MACf,MAAM,KAAK;AAAA,MACX,qBAAqB,KAAK;AAAA,MAC1B,aAAa,KAAK;AAAA,MAClB,iBAAiB,KAAK;AAAA,MACtB,uBAAuB,KAAK;AAAA,MAC5B,iBAAiB,KAAK;AAAA,IACxB;AAAA,EACF;AACA,MAAI,KAAK,SAAS,WAAW;AAC3B,WAAO,EAAE,MAAM,KAAK,MAAM,UAAU,WAAW,iBAAiB,CAAC,EAAE;AAAA,EACrE;AACA,MAAI,KAAK,SAAS,QAAQ;AACxB,WAAO,EAAE,MAAM,KAAK,MAAM,UAAU,QAAQ,iBAAiB,CAAC,EAAE;AAAA,EAClE;AACA,SAAO,EAAE,MAAM,KAAK,MAAM,UAAU,UAAU,iBAAiB,CAAC,EAAE;AACpE;AAEO,SAAS,iCAAoD;AAClE,SAAO,qBAAqB,EAAE,OAAO,CAAC,SAAS,KAAK,WAAW,YAAY;AAC7E;AAEO,SAAS,2BAA2B,MAAuB,aAAa,QAA8B;AAC3G,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT;AAAA,IACA,OAAO,KAAK;AAAA,IACZ,UAAU,KAAK;AAAA,IACf,MAAM,KAAK,KAAK,SAAS,YAAY,YAAY,KAAK,KAAK,SAAS,WAAW,WAAW,KAAK,KAAK,SAAS,SAAS,SAAS;AAAA,IAC/H,QAAQ,KAAK,YAAY,QAAQ,CAAC,eAAe,WAAW,cAAc;AAAA,IAC1E,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf,UAAU;AAAA,MACR,GAAI,KAAK,YAAY,CAAC;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,cAAc,KAAK;AAAA,IACrB;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,UAAmC,WAAkD;AAC7G,QAAM,OAAO,yBAAyB,SAAS,EAAE;AACjD,QAAM,SAAS,UAAU,QAAQ;AACjC,QAAM,aAAa,qBAAqB,MAAM;AAC9C,QAAM,WAAW,mBAAmB,MAAM,SAAS,EAAE;AAkBrD,QAAM,oBAAoB,WACtB,oBAAoB,UAAU,aAAa,UAAU,OAAO,CAAC,IAC7D,UAAU;AACd,QAAM,UAAU,WAAW,oBAAoB,CAAC;AAChD,QAAM,cAAc,eAAe,UAAU,iBAAiB;AAC9D,QAAM,OAAO,QAAQ,UAAU,QAAQ,aAAa,IAAI;AACxD,QAAM,SAAS,UAAU,MAAM,SAAS,EAAE;AAK1C,QAAM,WACJ,uBAAuB,IAAI,KAAK,uBAAuB,SAAS,EAAE;AAGpE,QAAM,cAAc,UAAU,cAC1B,CAAC,GAAI,WAAW,eAAe,CAAC,GAAI,GAAG,SAAS,WAAW,IAC3D,WAAW;AACf,SAAO;AAAA,IACL;AAAA,IACA,OAAO,UAAU;AAAA,IACjB,UAAU,UAAU;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,UAAU;AAAA,IACpB,OAAO;AAAA,MACL,YAAY,UAAU,cAAc,WAAW;AAAA,MAC/C,cAAc,UAAU,gBAAgB,WAAW;AAAA,MACnD,kBAAkB,UAAU,oBAAoB,oBAAoB,IAAI;AAAA,MACxE,qBAAqB,KAAK,SAAS,WAAW,KAAK,sBAAsB,WAAW;AAAA,MACpF;AAAA,MACA,WAAW,UAAU;AAAA,MACrB,aAAa,UAAU,eAAe,eAAe,MAAM,QAAQ,IAAI;AAAA,IACzE;AAAA,IACA,WAAW,WAAW;AAAA,IACtB,cAAc,gBAAgB,UAAU,iBAAiB;AAAA,IACzD,UAAU,EAAE,UAAU,SAAS,UAAU,SAAS,SAAS,QAAQ;AAAA,EACrE;AACF;AAEA,SAAS,UAAU,MAAoD;AACrE,MAAI,UAAU,IAAI,KAAK,EAAE,EAAG,QAAO;AACnC,MAAI,KAAK,SAAS,OAAQ,QAAO;AACjC,MAAI,KAAK,GAAG,WAAW,SAAS,KAAK,KAAK,QAAQ,SAAS,QAAQ,EAAG,QAAO;AAC7E,MAAI,KAAK,GAAG,WAAW,YAAY,KAAK,CAAC,gBAAgB,oBAAoB,YAAY,YAAY,EAAE,SAAS,KAAK,EAAE,EAAG,QAAO;AACjI,MAAI,CAAC,QAAQ,cAAc,UAAU,WAAW,EAAE,SAAS,KAAK,EAAE,EAAG,QAAO;AAC5E,MAAI,KAAK,OAAO,aAAc,QAAO;AACrC,MAAI,KAAK,OAAO,UAAW,QAAO;AAClC,MAAI,KAAK,OAAO,QAAS,QAAO;AAChC,MAAI,KAAK,OAAO,SAAU,QAAO;AACjC,MAAI,YAAY,IAAI,KAAK,EAAE,EAAG,QAAO;AACrC,SAAO;AACT;AAEA,IAAM,cAAc,oBAAI,IAAI,CAAC,UAAU,UAAU,YAAY,SAAS,UAAU,UAAU,YAAY,YAAY,OAAO,CAAC;AAC1H,IAAM,YAAY,oBAAI,IAAI,CAAC,SAAS,CAAC;AAErC,SAAS,QACP,MACA,QACA,aACA,MACqB;AACrB,QAAM,IAAI,qBAAqB,MAAM;AAKrC,QAAM,WAAW,mBAAmB,MAAM,KAAK,EAAE;AACjD,QAAM,WAAW,WAAW,gBAAgB,QAAQ,IAAI;AACxD,MAAI,KAAK,SAAS,YAAY,CAAC,UAAU;AACvC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,aAAa,GAAG,KAAK,KAAK;AAAA,IAC5B;AAAA,EACF;AACA,MAAI,aAAa,OAAQ,QAAO,EAAE,MAAM,OAAO;AAC/C,MAAI,aAAa,QAAQ;AACvB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAY,qBAAqB,KAAK,iBAAiB,CAAC;AAAA,MACxD,iBAAiB,GAAG,KAAK,EAAE;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,aAAa,WAAW;AAC1B,UAAM,OAAO,WAAW,kBAAkB,QAAQ,IAAI;AACtD,UAAM,aAAa,eAAe,KAAK,EAAE;AACzC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAY,OAAO,EAAE,GAAG,YAAY,aAAa,KAAK,IAAI;AAAA,MAC1D,WAAW,mBAAmB,KAAK,EAAE;AAAA,IACvC;AAAA,EACF;AACA,MAAI,WAAW,UAAU,CAAC,SAAU,QAAO,EAAE,MAAM,OAAO;AAC1D,MAAI,WAAW,UAAU,CAAC,UAAU;AAClC,WAAO,EAAE,MAAM,QAAQ,YAAY,EAAE,iBAAiB,CAAC,GAAI,iBAAiB,GAAG,KAAK,EAAE,aAAa;AAAA,EACrG;AACA,MAAI,WAAW,aAAa,CAAC,UAAU;AACrC,WAAO,EAAE,MAAM,WAAW,YAAY,eAAe,KAAK,EAAE,GAAG,WAAW,mBAAmB,KAAK,EAAE,EAAE;AAAA,EACxG;AACA,QAAM,SAAS,YAAY;AAAA,IAAQ,CAAC,eAClC,WAAW,eAAe,IAAI,CAAC,mBAAoC;AAAA,MACjE,YAAY,WAAW;AAAA,MACvB;AAAA,MACA,OAAO,WAAW;AAAA,MAClB,QAAQ,WAAW;AAAA,MACnB,MAAM,WAAW;AAAA,MACjB,WAAW,WAAW;AAAA,IACxB,EAAE;AAAA,EACJ;AAOA,QAAM,OAAO,WAAW,kBAAkB,QAAQ,IAAI;AACtD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,kBAAkB,MAAM,oBAAoB,EAAE;AAAA,IAC9C,UAAU,MAAM,YAAY,EAAE;AAAA,IAC9B,aAAa,MAAM,eAAe,EAAE,iBAAiB,KAAK,CAAC,UAAU,CAAC,MAAM,MAAM,GAAG;AAAA,IACrF,iBAAiB,MAAM,mBAAmB,EAAE,iBAAiB,KAAK,CAAC,UAAU,MAAM,MAAM,GAAG;AAAA,IAC5F,uBAAuB,MAAM,yBAAyB;AAAA,IACtD,QAAQ,OAAO,mBAAmB,KAAK,QAAQ,WAAW,IAAI;AAAA,IAC9D,iBAAiB,MAAM,mBAAmB,mBAAmB,MAAM;AAAA,IACnE,sBAAsB,EAAE,uBAAuB,yDAAyD,QAAQ,UAAU,KAAK,EAAE;AAAA,IACjI,MAAM,WAAW,YAAY,WAAW,oBAAoB,cAAc;AAAA,EAC5E;AACF;AAcA,SAAS,oBACP,UACA,mBAC8B;AAC9B,SAAO,SAAS,aAAa,IAAI,CAAC,eAA2C;AAC3E,UAAM,WAAW,WAAW,UAAU;AACtC,WAAO;AAAA,MACL,IAAI,WAAW;AAAA,MACf,OAAO,WAAW;AAAA,MAClB,MAAM,WAAW,UAAU;AAAA,MAC3B,gBAAgB,WAAW,iBAAiB,CAAC,GAAG,WAAW,cAAc,IAAI,CAAC;AAAA,MAC9E,WAAW;AAAA,MACX,aAAa,WAAW;AAAA;AAAA;AAAA,MAGxB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,MACzD,aAAa,WAAW;AAAA,IAC1B;AAAA,EACF,CAAC;AACH;AAOA,SAAS,mBACP,gBACA,aACmB;AACnB,QAAM,kBAAkB,YAAY,KAAK,CAAC,eAAe,WAAW,SAAS,OAAO;AACpF,QAAM,iBAAiB,YAAY,KAAK,CAAC,eAAe,WAAW,SAAS,MAAM,KAAK,YAAY,CAAC;AACpG,SAAO,eAAe,IAAI,CAAC,kBAAmC;AAC5D,UAAM,WAAW,gGAAgG;AAAA,MAC/G;AAAA,IACF;AACA,UAAM,QAAQ,WAAW,kBAAkB,mBAAmB;AAC9D,WAAO;AAAA,MACL,YAAY,MAAM,cAAc;AAAA,MAChC;AAAA,MACA,OAAO,MAAM,SAAS;AAAA,MACtB,QAAQ,MAAM,UAAU;AAAA,MACxB,MAAM,WAAW,UAAU;AAAA,MAC3B,WAAW,MAAM,aAAa;AAAA,IAChC;AAAA,EACF,CAAC;AACH;AAEA,SAAS,oBAAoB,MAA2B;AACtD,MAAI,KAAK,SAAS,aAAa,KAAK,SAAS,OAAQ,QAAO,CAAC,KAAK,UAAU;AAC5E,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,MACL,EAAE,OAAO,aAAa,KAAK,KAAK,aAAa,aAAa,oBAAoB,QAAQ,MAAM;AAAA,MAC5F,EAAE,OAAO,iBAAiB,KAAK,KAAK,iBAAiB,aAAa,wBAAwB,QAAQ,KAAK;AAAA,IACzG;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,SAAS,eAAe,MAA+B,SAA+D;AACpH,QAAM,YAAY,aAAa,OAAO;AACtC,QAAM,YAAY,iBAAiB,MAAM,MAAM;AAC/C,QAAM,aAAa,iBAAiB,MAAM,OAAO;AACjD,QAAM,cAAsC;AAAA,IAC1C;AAAA,MACE,YAAY,GAAG,KAAK,UAAU;AAAA,MAC9B,gBAAgB,YAAY,CAAC,SAAS,IAAI,CAAC;AAAA,MAC3C,OAAO,GAAG,KAAK,KAAK;AAAA,MACpB,MAAM;AAAA,MACN;AAAA,MACA,QAAQ,QAAQ,KAAK,KAAK;AAAA,IAC5B;AAAA,EACF;AACA,MAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM,GAAG;AAC1C,gBAAY,KAAK;AAAA,MACf,YAAY,GAAG,KAAK,UAAU;AAAA,MAC9B,gBAAgB,aAAa,CAAC,UAAU,IAAI,CAAC;AAAA,MAC7C,OAAO,GAAG,KAAK,KAAK;AAAA,MACpB,MAAM;AAAA,MACN;AAAA,MACA,QAAQ,oBAAoB,KAAK,KAAK;AAAA,IACxC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,MAA+B,MAAgC;AACvF,QAAM,WAAW,eAAe,KAAK,EAAE,IAAI,IAAI;AAC/C,MAAI,SAAU,QAAO;AACrB,MAAI,KAAK,SAAS,OAAQ,QAAO;AACjC,SAAO,GAAG,KAAK,EAAE,IAAI,IAAI;AAC3B;AAEA,IAAM,iBAA4E;AAAA,EAChF,OAAO,EAAE,MAAM,kDAAkD,OAAO,+CAA+C;AAAA,EACvH,mBAAmB,EAAE,MAAM,qDAAqD,OAAO,2CAA2C;AAAA,EAClI,iBAAiB,EAAE,MAAM,yDAAyD,OAAO,+CAA+C;AAAA,EACxI,gBAAgB,EAAE,MAAM,kDAAkD,OAAO,6CAA6C;AAAA,EAC9H,eAAe,EAAE,MAAM,sDAAsD,OAAO,4CAA4C;AAAA,EAChI,gBAAgB,EAAE,MAAM,aAAa,OAAO,YAAY;AAAA,EACxD,oBAAoB,EAAE,MAAM,kBAAkB,OAAO,sBAAsB;AAAA,EAC3E,mBAAmB,EAAE,MAAM,2BAA2B,OAAO,sBAAsB;AAAA,EACnF,UAAU,EAAE,MAAM,cAAc,OAAO,kBAAkB;AAAA,EACzD,YAAY,EAAE,MAAM,kBAAkB,OAAO,sBAAsB;AAAA,EACnE,OAAO,EAAE,MAAM,iBAAiB,OAAO,aAAa;AAAA,EACpD,SAAS,EAAE,MAAM,6BAA6B,OAAO,6BAA6B;AAAA,EAClF,YAAY,EAAE,MAAM,OAAO,OAAO,MAAM;AAAA,EACxC,QAAQ,EAAE,MAAM,IAAI,OAAO,GAAG;AAAA,EAC9B,QAAQ,EAAE,MAAM,aAAa,OAAO,OAAO;AAAA,EAC3C,QAAQ,EAAE,MAAM,YAAY,OAAO,MAAM;AAAA,EACzC,UAAU,EAAE,MAAM,qBAAqB,OAAO,qBAAqB;AAAA,EACnE,OAAO,EAAE,MAAM,WAAW,OAAO,UAAU;AAAA,EAC3C,QAAQ,EAAE,MAAM,aAAa,OAAO,WAAW;AAAA,EAC/C,QAAQ,EAAE,MAAM,WAAW,OAAO,UAAU;AAC9C;AAEA,SAAS,gBAAgB,MAA+B,SAAgE;AACtH,SAAO;AAAA,IACL,QAAQ,KAAK,QAAQ,IAAI,CAAC,WAAW,OAAO,QAAQ,MAAM,GAAG,CAAC;AAAA,IAC9D,eAAe,CAAC,YAAY,QAAQ,YAAY,WAAW,SAAS,EAAE,SAAS,KAAK,UAAU,IAAI,kBAAkB;AAAA,IACpH,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,aAAa,IAAI,SAAS,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,OAAO,IAAI,WAAW;AAAA,EAC3H;AACF;AAEA,SAAS,eAAe,MAAc,QAA+B,MAA4C;AAC/G,MAAI,WAAW,cAAc;AAC3B,WAAO,EAAE,IAAI,GAAG,IAAI,WAAW,OAAO,UAAU,aAAa,kFAAkF;AAAA,EACjJ;AACA,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO,EAAE,IAAI,GAAG,IAAI,eAAe,OAAO,cAAc,aAAa,qEAAqE;AAAA,EAC5I;AACA,MAAI,KAAK,SAAS,WAAW;AAC3B,WAAO,EAAE,IAAI,GAAG,IAAI,eAAe,OAAO,cAAc,aAAa,mEAAmE;AAAA,EAC1I;AACA,MAAI,KAAK,SAAS,QAAQ;AACxB,WAAO,EAAE,IAAI,GAAG,IAAI,YAAY,OAAO,WAAW,aAAa,qEAAqE;AAAA,EACtI;AACA,SAAO,EAAE,IAAI,GAAG,IAAI,WAAW,OAAO,UAAU,aAAa,+BAA+B;AAC9F;AAEA,SAAS,UAAU,MAAc,YAA2C;AAC1E,SAAO,mBAAmB,MAAM,UAAU,IAAI,eAAe;AAC/D;AAEA,SAAS,aAAa,SAA6D;AACjF,MAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,cAAc,QAAQ,EAAG,QAAO;AAC1D,MAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,cAAc,WAAW,EAAG,QAAO;AAC7D,MAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,cAAc,SAAS,EAAG,QAAO;AAC3D,MAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,cAAc,UAAU,EAAG,QAAO;AAC5D,SAAO;AACT;AAEA,SAAS,eAAe,MAAc;AACpC,SAAO;AAAA,IACL,OAAO,GAAG,IAAI;AAAA,IACd,aAAa,wBAAwB,IAAI;AAAA,IACzC,SAAS,SAAS,WAAW,gBAAgB;AAAA,IAC7C,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,mBAAmB,MAA2C;AACrE,MAAI,SAAS,UAAU,SAAS,QAAS,QAAO;AAChD,MAAI,SAAS,aAAa,SAAS,SAAU,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,mBAAmB,QAAiE;AAC3F,MAAI,WAAW,SAAU,QAAO,EAAE,aAAa,WAAW,QAAQ,WAAW,wBAAwB,OAAO;AAC5G,MAAI,WAAW,SAAU,QAAO,EAAE,OAAO,OAAO;AAChD,SAAO;AACT;;;ACzdO,SAAS,mBAAmB,MAAuB,SAAmD;AAC3G,QAAM,cAAc,kBAAkB,MAAM,OAAO;AACnD,SAAO,KAAK,MAAM,aAAa,IAAI,CAAC,UAAU;AAAA,IAC5C,GAAG;AAAA,IACH,QAAQ,eAAe,KAAK,QAAQ,MAAM,SAAS,WAAW;AAAA,IAC9D,WAAW,KAAK,YAAY,eAAe,KAAK,WAAW,MAAM,SAAS,WAAW,IAAI;AAAA,EAC3F,EAAE;AACJ;AAEO,SAAS,sBAAsB,MAAuB,SAAoC;AAC/F,QAAM,QAAQ,mBAAmB,MAAM,OAAO;AAC9C,QAAM,QAAQ;AAAA,IACZ,KAAK,KAAK,KAAK;AAAA,IACf;AAAA,IACA,aAAa,KAAK,IAAI;AAAA,IACtB,eAAe,KAAK,MAAM;AAAA,IAC1B,aAAa,KAAK,KAAK,IAAI;AAAA,IAC3B,eAAe,KAAK,MAAM;AAAA,EAC5B;AACA,MAAI,KAAK,MAAM,WAAY,OAAM,KAAK,cAAc,KAAK,MAAM,UAAU,EAAE;AAC3E,MAAI,KAAK,MAAM,oBAAqB,OAAM,KAAK,qBAAqB,kBAAkB,MAAM,OAAO,CAAC,IAAI;AACxG,QAAM,KAAK,IAAI,kBAAkB,EAAE;AACnC,aAAW,SAAS,KAAK,MAAM,kBAAkB;AAC/C,UAAM,KAAK,KAAK,MAAM,SAAS,cAAc,EAAE,GAAG,MAAM,KAAK,GAAG,MAAM,MAAM,OAAO,MAAM,GAAG,QAAQ,EAAE,KAAK,MAAM,WAAW,EAAE;AAAA,EAChI;AACA,QAAM,KAAK,IAAI,kBAAkB,EAAE;AACnC,aAAW,cAAc,KAAK,aAAa;AACzC,UAAM,KAAK,OAAO,WAAW,UAAU,OAAO,WAAW,eAAe,SAAS,WAAW,eAAe,IAAI,CAAC,UAAU,KAAK,KAAK,IAAI,EAAE,KAAK,IAAI,IAAI,mBAAmB,MAAM,WAAW,MAAM,EAAE;AAAA,EACrM;AACA,QAAM,KAAK,IAAI,oBAAoB,EAAE;AACrC,aAAW,CAAC,GAAG,IAAI,KAAK,MAAM,QAAQ,GAAG;AACvC,UAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,MAAM,EAAE;AAAA,EACtD;AACA,MAAI,KAAK,MAAM,aAAa,QAAQ;AAClC,UAAM,KAAK,IAAI,mBAAmB,EAAE;AACpC,eAAW,SAAS,KAAK,MAAM,YAAa,OAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,OAAO,EAAE;AAAA,EAChG;AACA,SAAO,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA;AAC5B;AAEO,SAAS,2BAA2B,MAA+B;AACxE,QAAM,QAAQ,KAAK;AACnB,QAAM,SAAS,OAAO,QAAQ,SAAS,WAAW,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,WAAW,KAAK,KAAK;AACpG,QAAM,OAAO,QAAQ,cAAc,MAAM,aAAa,iBAAiB,MAAM,SAAS,MAAM;AAC5F,SAAO,GAAG,KAAK,KAAK,KAAK,KAAK,IAAI,MAAM,MAAM,IAAI,IAAI,GAAG,KAAK;AAChE;AAEO,SAAS,qBAAqB,MAAwC;AAC3E,QAAM,cAAc,KAAK,MAAM,eAAe,EAAE,IAAI,GAAG,KAAK,IAAI,WAAW,OAAO,UAAU,aAAa,0BAAmC;AAC5I,QAAM,WAAwC,CAAC;AAC/C,MAAI,YAAY,UAAU,aAAc,UAAS,KAAK,wBAAwB;AAC9E,MAAI,YAAY,UAAU,mBAAmB,KAAK,KAAK,SAAS,SAAU,UAAS,KAAK,aAAa,eAAe;AACpH,MAAI,KAAK,KAAK,SAAS,UAAW,UAAS,KAAK,SAAS;AACzD,MAAI,KAAK,KAAK,SAAS,OAAQ,UAAS,KAAK,aAAa;AAC1D,SAAO;AAAA,IACL,MAAM,KAAK;AAAA,IACX;AAAA,IACA;AAAA,IACA,SAAS,YAAY;AAAA,EACvB;AACF;AAEA,SAAS,eAAe,UAAkB,MAAuB,SAA4B,aAA8B;AACzH,SAAO,SACJ,WAAW,UAAU,QAAQ,IAAI,EACjC,WAAW,UAAU,KAAK,IAAI,EAC9B,WAAW,iBAAiB,eAAe,kBAAkB,MAAM,OAAO,CAAC;AAChF;AAEA,SAAS,kBAAkB,MAAuB,SAAoC;AACpF,UAAQ,QAAQ,gBAAgB,KAAK,MAAM,uBAAuB,IAC/D,WAAW,UAAU,QAAQ,IAAI,EACjC,WAAW,UAAU,KAAK,IAAI;AACnC;AAEO,SAAS,mBAAmB,OAA8B;AAC/D,SAAO,MAAM,IAAI,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,MAAM,EAAE,EAAE,KAAK,IAAI;AAC5F;;;AC7EO,SAAS,wBAAwB,MAAwD;AAC9F,QAAM,SAA2C,CAAC;AAClD,MAAI,CAAC,KAAK,KAAK,KAAK,EAAG,QAAO,KAAK,EAAE,MAAM,QAAQ,SAAS,mBAAmB,CAAC;AAChF,MAAI,CAAC,KAAK,MAAM,KAAK,EAAG,QAAO,KAAK,EAAE,MAAM,SAAS,SAAS,oBAAoB,CAAC;AACnF,MAAI,CAAC,KAAK,QAAQ,OAAQ,QAAO,KAAK,EAAE,MAAM,WAAW,SAAS,kCAAkC,CAAC;AACrG,MAAI,CAAC,KAAK,YAAY,OAAQ,QAAO,KAAK,EAAE,MAAM,eAAe,SAAS,sCAAsC,CAAC;AACjH,MAAI,KAAK,KAAK,SAAS,UAAU;AAC/B,QAAI,CAAC,KAAK,KAAK,iBAAkB,QAAO,KAAK,EAAE,MAAM,yBAAyB,SAAS,+BAA+B,CAAC;AACvH,QAAI,CAAC,KAAK,KAAK,SAAU,QAAO,KAAK,EAAE,MAAM,iBAAiB,SAAS,uBAAuB,CAAC;AAC/F,QAAI,CAAC,KAAK,KAAK,oBAAqB,QAAO,KAAK,EAAE,MAAM,4BAA4B,SAAS,kCAAkC,CAAC;AAAA,EAClI;AACA,QAAM,YAAY,oBAAI,IAAY;AAClC,aAAW,CAAC,OAAO,MAAM,KAAK,KAAK,QAAQ,QAAQ,GAAG;AACpD,QAAI,UAAU,IAAI,OAAO,EAAE,EAAG,QAAO,KAAK,EAAE,MAAM,WAAW,KAAK,QAAQ,SAAS,uBAAuB,OAAO,EAAE,GAAG,CAAC;AACvH,cAAU,IAAI,OAAO,EAAE;AAAA,EACzB;AACA,SAAO,EAAE,IAAI,OAAO,WAAW,GAAG,OAAO;AAC3C;AAEO,SAAS,2BAA2B,MAA6B;AACtE,QAAM,SAAS,wBAAwB,IAAI;AAC3C,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,IAAI,MAAM,4BAA4B,KAAK,IAAI,KAAK,OAAO,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,EAC5H;AACF;AAEO,SAAS,yBAAyB,OAA4B,OAA2C;AAC9G,MAAI,CAAC,MAAM,KAAK,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,MAAM,OAAO,SAAS,GAAG,MAAM,KAAK,eAAe;AACjG,MAAI,MAAM,SAAS,CAAC,IAAI,OAAO,MAAM,KAAK,EAAE,KAAK,KAAK,GAAG;AACvD,WAAO,EAAE,IAAI,OAAO,OAAO,MAAM,OAAO,SAAS,GAAG,MAAM,KAAK,kCAAkC;AAAA,EACnG;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,MAAM,MAAM;AACxC;AAEO,SAAS,sBAAsB,MAAuB,QAA8D;AACzH,SAAO,KAAK,MAAM,iBAAiB,IAAI,CAAC,UAAU;AAChD,UAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,WAAO,yBAAyB,OAAO,OAAO,GAAG,KAAK,EAAE;AAAA,EAC1D,CAAC;AACH;","names":[]}

package/dist/chunk-WE7SQ7PB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/connectors/types.ts","../src/connectors/adapters/tangle-id.ts"],"sourcesContent":["/**\n * Connector primitives — the contract a concrete first-party integration\n * (Google Calendar, HubSpot, Stripe, ...) implements. Lower level than the\n * hub-side `IntegrationProvider` interface from `../index.ts`: a single\n * `IntegrationProvider` typically wraps several connectors (e.g., a\n * \"first-party\" provider that lists all your shipped connectors as a\n * single catalog).\n *\n * Layering:\n *\n *   IntegrationHub                                — vendor-neutral facade (../index.ts)\n *     ↓\n *   IntegrationProvider                           — one per gateway or first-party provider\n *     ↓\n *   ConnectorAdapter (this file)                  — one per integration (Google Calendar, ...)\n *     ↓\n *   upstream HTTP API                             — vendor SDK / fetch / OAuth\n *\n * Three load-bearing decisions encoded here:\n *\n * 1. Capabilities are typed (`read` vs `mutation`). Every mutation MUST\n *    declare a CAS strategy. Conflict resolution is the SDK's job, not the\n *    connector's. `validateConnectorManifest()` rejects unsafe manifests\n *    before a connector is registered.\n *\n * 2. ConsistencyModel pins what the rest of the system can assume:\n *      authoritative → the source IS the truth (Calendar, payments)\n *      cache         → we mirror with TTL and may serve stale (price list)\n *      advisory      → informational only (FAQ doc)\n *    Agent planners can (and should) refuse to promise outcomes based on\n *    `cache`/`advisory` data without a live `authoritative` confirmation.\n *\n * 3. Capabilities surface to the calling agent's tool registry by\n *    transformation, not by hand-wiring. Adding a connector automatically\n *    expands the agent's toolbelt for that specific user without touching\n *    the prompt or runner.\n */\n\n/** Minimal JSON-schema shape used for capability arg validation. We\n *  intentionally don't pull `@types/json-schema` — most consumers already\n *  declare parameters as `Record<string, unknown>` and the\n *  shape is whatever the LLM SDK's structured-output expects. Keep the\n *  contract loose at the boundary; tighten via runtime zod where needed. */\nexport type CapabilityParameterSchema = Record<string, unknown>\n\n/** What the rest of the system is allowed to assume about freshness. */\nexport type ConsistencyModel = 'authoritative' | 'cache' | 'advisory'\n\n/** Capability classes. `read` is safe to retry; `mutation` must go through\n *  MutationGuard (CAS + idempotency). `subscribe` is reserved for future\n *  push-driven sources (webhook callbacks) and is not yet wired. */\nexport type CapabilityClass = 'read' | 'mutation' | 'subscribe'\n\n/** Compare-and-swap strategy a mutation uses to detect conflicts. */\nexport type CASStrategy =\n  /** Upstream returns an etag/sequence on read, accepts If-Match on write\n   *  (Google Calendar, GitHub, GDocs revision_id). The connector returns\n   *  412 / Precondition Failed on conflict; the SDK maps to ResourceContention. */\n  | 'etag-if-match'\n  /** Upstream guarantees exactly-once-per-key (Stripe, idempotent webhooks).\n   *  The SDK passes the idempotency key through; no etag check. */\n  | 'native-idempotency'\n  /** No upstream concurrency control. Connector MUST do read-then-write\n   *  and verify nothing changed in-between (best-effort). Suitable only\n   *  for low-contention single-user resources; rejected for any\n   *  consistencyModel='authoritative' write that may race. */\n  | 'optimistic-read-verify'\n  /** Source is not contended (e.g. logging, telemetry). Mutations are\n   *  fire-and-forget. Marks the capability as not eligible for\n   *  authoritative writes. */\n  | 'none'\n\nexport interface CapabilityRead {\n  name: string\n  class: 'read'\n  description: string\n  /** JSON-schema for the tool args the agent passes when invoking. */\n  parameters: CapabilityParameterSchema\n  /** Optional: declare which scopes (per the connector manifest) this\n   *  capability requires. The capability is hidden from the agent's\n   *  tool registry if the user's grant didn't include them. */\n  requiredScopes?: string[]\n}\n\nexport interface CapabilityMutation {\n  name: string\n  class: 'mutation'\n  description: string\n  parameters: CapabilityParameterSchema\n  /** Mandatory: how does the connector guarantee at-most-once + conflict-detect? */\n  cas: CASStrategy\n  /** True for capabilities that affect resources outside the calling user\n   *  (e.g. booking against a shared calendar, charging a card). The agent's\n   *  planner treats these specially: requires explicit caller confirmation\n   *  before the call. */\n  externalEffect: boolean\n  requiredScopes?: string[]\n}\n\nexport type Capability = CapabilityRead | CapabilityMutation\n\n/** OAuth2 scope catalog the user has granted us, plus arbitrary metadata\n *  the connector pinned at connect-time (calendar id, sheet id, webhook\n *  url, …). `metadata` MUST NOT contain secrets — those go in the\n *  encrypted credentials envelope. */\nexport interface DataSourceMetadata {\n  scopes: string[]\n  [key: string]: unknown\n}\n\n/** A connected, authenticated, ready-to-call data source for a project.\n *  Persistence shape mirrors the product's connection/source row but normalized — the\n *  encrypted credentials envelope is decrypted at hand-out time and held\n *  in memory only for the duration of the call. */\nexport interface ResolvedDataSource {\n  id: string\n  projectId: string\n  publishedAgentId: string | null\n  kind: string\n  label: string\n  consistencyModel: ConsistencyModel\n  scopes: string[]\n  metadata: Record<string, unknown>\n  /** Unwrapped credentials handed to the connector at call-time. Never\n   *  persisted in this shape; never logged. */\n  credentials: ConnectorCredentials\n  status: 'active' | 'revoked' | 'error'\n}\n\n/** Discriminated union of credential shapes. Connectors that need new\n *  shapes extend this union — `kind` is sealed via the tagged pattern so\n *  TypeScript catches an exhaustiveness gap at compile time. */\nexport type ConnectorCredentials =\n  | { kind: 'oauth2'; accessToken: string; refreshToken?: string; expiresAt?: number }\n  | { kind: 'api-key'; apiKey: string }\n  | { kind: 'custom'; values: Record<string, unknown> }\n  | { kind: 'hmac'; secret: string }\n  | { kind: 'none' }\n\n/** Result of a read capability invocation. */\nexport interface CapabilityReadResult {\n  /** Free-form payload — the connector's data shape. The agent receives\n   *  this as the tool result; planners consume it via JSON-shape contract\n   *  declared in the capability's `parameters` (output schema). */\n  data: unknown\n  /** Optional etag/sequence the caller can reuse for a subsequent CAS\n   *  mutation. */\n  etag?: string\n  /** When this read happened (UTC ms since epoch). */\n  fetchedAt: number\n}\n\n/** Result of a mutation capability invocation. Either committed (with the\n *  resulting etag/sequence so the caller can chain mutations), or\n *  contended (the upstream rejected with a state mismatch — the agent\n *  should re-read and retry, or surface alternatives to the caller). */\nexport type CapabilityMutationResult =\n  | {\n      status: 'committed'\n      data: unknown\n      etagAfter?: string\n      committedAt: number\n      /** True iff this commit was returned from the idempotency store\n       *  rather than executed against upstream. The caller can use this\n       *  to suppress confirmation messages on retry. */\n      idempotentReplay: boolean\n    }\n  | {\n      status: 'conflict'\n      /** Best-effort alternative options the upstream surfaced (e.g.,\n       *  next-available calendar slots after a booking conflict). */\n      alternatives: unknown[]\n      /** The current authoritative state, if the connector could re-read\n       *  cheaply. */\n      currentState?: unknown\n      message: string\n    }\n  | {\n      status: 'rate-limited'\n      /** Wall-clock ms the caller should wait before retrying. The SDK\n       *  computes this from the bucket's refill schedule so the agent\n       *  doesn't have to guess. */\n      retryAfterMs: number\n      message: string\n    }\n\n/** Inputs the SDK passes into the connector's executeRead / executeMutation. */\nexport interface ConnectorInvocation {\n  source: ResolvedDataSource\n  capabilityName: string\n  args: Record<string, unknown>\n  /** Idempotency key the caller (or the SDK's defaulting policy) supplied.\n   *  Always present at the connector boundary — the SDK manufactures one\n   *  if the agent didn't pass one. */\n  idempotencyKey: string\n  /** Optional caller-supplied etag the connector should send as If-Match. */\n  expectedEtag?: string\n  /** Product/session id (if any) for forensic logging. */\n  callSessionId?: string\n  /** Fired by the adapter when it rotates the credentials mid-call (e.g. an\n   *  OAuth access token refreshed on expiry). The host re-encrypts +\n   *  persists the rotated envelope so the next expiry does not force a\n   *  reconnect. Adapters MUST invoke this with the FULL rotated envelope,\n   *  not a partial — the previous refresh token is preserved by the caller's\n   *  refresh logic, not inferred here. */\n  onCredentialsRotated?: (credentials: ConnectorCredentials) => void\n}\n\n/** A single inbound event extracted from a push payload. The webhook\n *  receiver persists one `InboundEvent` row per entry the connector returns. */\nexport interface InboundEvent {\n  eventType: string\n  providerEventId?: string\n  payload: Record<string, unknown>\n}\n\n/** Adapter response from an inbound-webhook dispatch. The receiver persists\n *  every `events[]` entry, then either honors the connector's `response`\n *  override (Slack `url_verification` echo, provider-specific 2xx body) or\n *  defaults to `{status: 200, body: {received: true, count: events.length}}`. */\nexport interface EventHandlerResult {\n  events: InboundEvent[]\n  /** Optional: how to respond to the provider. Stripe wants 200 within\n   *  30s; Slack wants the challenge param echoed. */\n  response?: { status: number; body: unknown; headers?: Record<string, string> }\n}\n\n/**\n * Connector adapter — one per integration kind. Stateless. The SDK holds\n * the persistence + crypto + mutation-guard concerns; the adapter only\n * knows how to talk to its upstream.\n */\nexport interface ConnectorAdapter {\n  /** Manifest entry the registry uses to render UI + validate args. */\n  manifest: ConnectorManifest\n  /**\n   * True when this adapter only receives provider events and must not appear\n   * in public connector or action discovery. Hosts can still register it\n   * explicitly for their inbound route, which preserves its stable kind id.\n   */\n  inboundOnly?: boolean\n  /** Read invocation. Required when manifest.capabilities contains reads.\n   *  Should return whatever shape the capability declared\n   *  in its parameters output schema. */\n  executeRead?(inv: ConnectorInvocation): Promise<CapabilityReadResult>\n  /** Mutation invocation. Required when manifest.capabilities contains mutations.\n   *  Throws ResourceContention on a CAS miss; throws\n   *  any other Error for upstream failures. The MutationGuard wraps this\n   *  with idempotency-key short-circuit + audit logging — adapters do\n   *  NOT manage their own dedup. */\n  executeMutation?(inv: ConnectorInvocation): Promise<CapabilityMutationResult>\n  /** Inbound webhook signature verifier. Called BEFORE handleInboundEvent.\n   *  MUST use constant-time comparison (`crypto.timingSafeEqual`) for any\n   *  HMAC check. The receiver returns 401 on `valid=false` without invoking\n   *  handleInboundEvent. Optional: connectors that don't accept push events\n   *  omit this method and the receiver returns 405 for the kind. */\n  verifySignature?(input: {\n    rawBody: string\n    headers: Record<string, string | string[] | undefined>\n    source: ResolvedDataSource\n  }): { valid: boolean; reason?: string }\n  /** Inbound webhook dispatch. Called AFTER verifySignature passes. The\n   *  adapter parses the provider payload and emits zero-or-more\n   *  `InboundEvent` rows; the receiver persists them as one row each (modulo\n   *  the (dataSourceId, providerEventId) dedup unique). The optional\n   *  `response` overrides the receiver's default 200 (Slack `url_verification`\n   *  needs to echo the challenge in the body to pass Slack's app-config check). */\n  handleInboundEvent?(input: {\n    source: ResolvedDataSource\n    rawBody: string\n    headers: Record<string, string | string[] | undefined>\n  }): Promise<EventHandlerResult>\n  /** OAuth callback handler — exchanges the auth code for tokens, returns\n   *  the credentials envelope + scopes + metadata. Only present for\n   *  oauth2-style adapters. */\n  exchangeOAuth?(input: {\n    code: string\n    state: string\n    codeVerifier: string\n    redirectUri: string\n  }): Promise<{\n    credentials: ConnectorCredentials\n    scopes: string[]\n    metadata: Record<string, unknown>\n  }>\n  /** Refresh access token. Only required for oauth2 adapters with\n   *  short-lived access tokens. */\n  refreshToken?(input: ConnectorCredentials): Promise<ConnectorCredentials>\n  /** Health check — invoked when the user clicks \"Test connection\" in the\n   *  UI. Should perform the cheapest possible read that proves the grant\n   *  is still valid. Returns `{ok: false, reason}` rather than throwing\n   *  for the common case (token expired, scope missing). */\n  test(source: ResolvedDataSource): Promise<{ ok: true } | { ok: false; reason: string }>\n}\n\n/** Static manifest a connector module exports. Drives the UI catalog,\n *  scope display, capability discovery for the agent's tool registry. */\nexport interface ConnectorManifest {\n  /** Stable kind id used as the foreign key in DataSource.kind. */\n  kind: string\n  /** Human label shown in the UI catalog. */\n  displayName: string\n  /** One-paragraph description shown next to the connect button. */\n  description: string\n  /** Auth shape this connector requires. */\n  auth: AuthSpec\n  /** Capability catalog — the agent's tool registry derives ToolDefinition\n   *  entries from this list at request time. */\n  capabilities: Capability[]\n  /** ConsistencyModel default for this kind — overridable per DataSource\n   *  if a particular instance is special (e.g., a user marks a sheet as\n   *  `cache` because they refresh it nightly). */\n  defaultConsistencyModel: ConsistencyModel\n  /** Connector category for UI grouping. */\n  category:\n    | 'calendar'\n    | 'spreadsheet'\n    | 'crm'\n    | 'doc'\n    | 'webhook'\n    | 'storage'\n    | 'comms'\n    | 'commerce'\n    | 'database'\n    | 'sales-intelligence'\n    | 'market-intelligence'\n    | 'hr'\n    | 'other'\n  /** Optional icon URL or named icon. */\n  icon?: string\n  /** Optional per-kind rate-limit budget. The SDK enforces it inside\n   *  `executeGuardedMutation` and the read path of `/invoke`. Omit to\n   *  leave the connector unrestricted. */\n  rateLimit?: RateLimitSpec\n}\n\n/** Token-bucket budget the SDK enforces against the connector's upstream.\n *  We meter on OUR side rather than letting the upstream reject so a\n *  chatty agent can't burn quota that's shared across customers (almost\n *  every OAuth client is). */\nexport interface RateLimitSpec {\n  /** Max requests per window. */\n  requests: number\n  /** Window in ms. */\n  windowMs: number\n  /** Whether to apply across all DataSources sharing the same OAuth\n   *  client (true; default), or per-DataSource (false). The former\n   *  matches how upstreams meter (per-app), so almost always pick true. */\n  scope?: 'oauth-client' | 'data-source'\n}\n\n/** Source mapping for `OAuth2AuthSpec.tokenMetadata`. A bare string names the\n *  token-response field to capture (capture-if-present). The object form marks\n *  the field `required` so a missing/empty value fails the token exchange loud\n *  rather than silently capturing nothing. */\nexport type TokenMetadataSource = string | { field: string; required?: boolean }\n\n/** How an OAuth token endpoint receives this application's client credentials.\n *\n * OAuth providers default to `client_secret_post`, which sends both values in\n * the form body. `client_secret_basic` instead sends an HTTP Basic header and\n * deliberately omits the credentials from that body. */\nexport type OAuth2TokenClientAuthMethod =\n  | 'client_secret_post'\n  | 'client_secret_basic'\n\ntype OAuth2AuthSpec = {\n  kind: 'oauth2'\n  /** OAuth2 grant type. Defaults to `'authorization_code'` (the interactive\n   *  3-legged flow). Set `'client_credentials'` for machine-to-machine\n   *  providers (e.g. Paychex) that issue tokens directly from client\n   *  id/secret with no user-facing authorization step — `authorizationUrl`\n   *  is then omitted. */\n  grantType?: 'authorization_code' | 'client_credentials'\n  /** Authorization endpoint URL. Required for the `authorization_code`\n   *  grant; omitted for `client_credentials` (there is no authorize step). */\n  authorizationUrl?: string\n  /** Token endpoint URL. */\n  tokenUrl: string\n  /** Scopes requested in the authorization grant. The user UI shows\n   *  these so the customer knows what's being shared. */\n  scopes: string[]\n  /** Separator used when serializing multiple scopes into the authorization\n   *  URL. OAuth defaults to spaces; Zoho requires comma-delimited scopes. */\n  scopeSeparator?: ' ' | ','\n  /** Whether the connector supports incremental authorization (Google\n   *  does; many don't). */\n  incremental?: boolean\n  /** Env-var name holding the OAuth client_id. */\n  clientIdEnv: string\n  /** Env-var name holding the OAuth client_secret. */\n  clientSecretEnv: string\n  /** OAuth client authentication for the authorization-code token exchange.\n   * Defaults to `client_secret_post` for backward compatibility. */\n  tokenClientAuthMethod?: OAuth2TokenClientAuthMethod\n  /** Optional extra params attached to the authorization URL (e.g.,\n   *  Google's `access_type=offline&prompt=consent` to obtain refresh\n   *  tokens). */\n  extraAuthParams?: Record<string, string>\n  /** Whether to send the `scope` query param on the authorization URL.\n   *  Defaults to true. Set false for providers that reject a per-request\n   *  scope and pin scopes app-side (e.g. HelloSign/Dropbox Sign). */\n  sendScopeParam?: boolean\n  /** Declarative capture of provider-specific fields from the OAuth token\n   *  response into the connection's `metadata`, keyed by the connection-metadata\n   *  key to write → the token-response field to read. The counterpart to\n   *  `baseUrl.metadataKey`: providers like Gong return a per-customer host\n   *  (`api_base_url_for_customer`) at token exchange that every later call must\n   *  target, but the standard token parser keeps only the canonical OAuth\n   *  fields and drops the rest. Declaring the mapping here makes `completeAuth`\n   *  persist the value into `metadata` so `baseUrl` resolution finds it. Mark a\n   *  field `required` to fail the exchange loud when it is absent (surfacing the\n   *  break at connect, not first call). Optional and backward-compatible —\n   *  connectors that omit it are unaffected. */\n  tokenMetadata?: Record<string, TokenMetadataSource>\n}\ntype ApiKeyAuthSpec = {\n  kind: 'api-key'\n  /** UI hint shown when collecting the key. */\n  hint: string\n}\ntype SingleAuthSpec = OAuth2AuthSpec | ApiKeyAuthSpec | { kind: 'hmac' } | { kind: 'none' }\n\nexport type AuthSpec =\n  | SingleAuthSpec\n  | {\n      kind: 'one_of'\n      /** Preferred auth kind for setup UI and OAuth-connect flows. */\n      preferred: 'oauth2' | 'api-key'\n      /** Explicit supported auth modes. Do not infer fallback modes. */\n      options: readonly [SingleAuthSpec, SingleAuthSpec, ...SingleAuthSpec[]]\n    }\n\n/** Thrown by `executeMutation` when upstream rejects on CAS — caught and\n *  rewrapped by MutationGuard. */\nexport class ResourceContention extends Error {\n  override readonly name = 'ResourceContention'\n  constructor(\n    message: string,\n    public readonly alternatives: unknown[] = [],\n    public readonly currentState?: unknown,\n  ) {\n    super(message)\n  }\n}\n\n/** Structured HTTP failure detail attached to the typed provider errors below.\n *  The platform classifier reads `status`/`reason` off the thrown instance to\n *  route a 403 by WHY it failed (credential vs config/permission vs quota)\n *  instead of regexing a flattened message. */\nexport interface ProviderHttpErrorInit {\n  /** Upstream HTTP status (e.g. 401, 403, 429). */\n  status: number\n  /** Provider-specific machine reason (e.g. Google's `accessNotConfigured`,\n   *  `dailyLimitExceeded`, `invalid_grant`) — the actionable signal. */\n  reason?: string\n  /** Parsed upstream error body, kept for diagnostics/audit. */\n  body?: unknown\n}\n\n/** Thrown when the connector finds the user's grant has been revoked or the\n *  access token is no longer valid AND refresh failed — reconnecting fixes it.\n *  Surfaces to the UI as \"Reconnect required\". Carries optional structured\n *  `{status, reason, body}` so the platform can confirm a 401/403 really is a\n *  credential reason before flipping the connection to reconnect_required. */\nexport class CredentialsExpired extends Error {\n  override readonly name = 'CredentialsExpired'\n  readonly status?: number\n  readonly reason?: string\n  readonly body?: unknown\n  constructor(\n    message: string,\n    public readonly dataSourceId: string,\n    init?: ProviderHttpErrorInit,\n  ) {\n    super(message)\n    this.status = init?.status\n    this.reason = init?.reason\n    this.body = init?.body\n  }\n}\n\n/** Thrown when the provider rejects the call for a configuration or permission\n *  reason that reconnecting the credential CANNOT fix — the API isn't enabled\n *  for the project (`accessNotConfigured`), a required scope is missing\n *  (`insufficientPermissions`), or the resource is forbidden\n *  (`PERMISSION_DENIED`). Distinct from CredentialsExpired so the platform\n *  surfaces \"fix the project/scope\" instead of sending the user into an\n *  unresolvable reconnect loop. */\nexport class ProviderConfigError extends Error {\n  override readonly name = 'ProviderConfigError'\n  readonly status: number\n  readonly reason?: string\n  readonly body?: unknown\n  constructor(\n    message: string,\n    public readonly dataSourceId: string,\n    init: ProviderHttpErrorInit,\n  ) {\n    super(message)\n    this.status = init.status\n    this.reason = init.reason\n    this.body = init.body\n  }\n}\n\nexport interface ProviderRateLimitedInit extends ProviderHttpErrorInit {\n  /** Wall-clock ms the caller should wait before retrying — resolved from the\n   *  provider's `Retry-After` when one was sent. */\n  retryAfterMs?: number\n}\n\n/** Thrown when the provider throttles the call (quota / rate limit). Gmail and\n *  Calendar surface daily/per-user limits as HTTP 403 with a quota `reason`\n *  (`rateLimitExceeded`/`dailyLimitExceeded`/`userRateLimitExceeded`), NOT 429\n *  — so it is classified by reason, not status, and must never read as a\n *  credential failure. The message includes \"rate limit\" so a platform that\n *  only inspects the message still routes it to rate-limited. */\nexport class ProviderRateLimited extends Error {\n  override readonly name = 'ProviderRateLimited'\n  readonly status: number\n  readonly reason?: string\n  readonly body?: unknown\n  readonly retryAfterMs?: number\n  constructor(\n    message: string,\n    public readonly dataSourceId: string,\n    init: ProviderRateLimitedInit,\n  ) {\n    super(message)\n    this.status = init.status\n    this.reason = init.reason\n    this.body = init.body\n    this.retryAfterMs = init.retryAfterMs\n  }\n}\n\nexport interface ConnectorManifestValidationIssue {\n  path: string\n  message: string\n}\n\nexport interface ConnectorManifestValidationResult {\n  ok: boolean\n  issues: ConnectorManifestValidationIssue[]\n}\n\n/** Validate the static connector manifest before a provider registers it.\n *  This catches the expensive mistakes early: duplicate capability names,\n *  mutation capabilities without CAS, authoritative fire-and-forget writes,\n *  and invalid rate-limit specs. */\nexport function validateConnectorManifest(manifest: ConnectorManifest): ConnectorManifestValidationResult {\n  const issues: ConnectorManifestValidationIssue[] = []\n  if (!manifest.kind.trim()) issues.push({ path: 'kind', message: 'kind is required' })\n  if (!manifest.displayName.trim()) issues.push({ path: 'displayName', message: 'displayName is required' })\n  validateAuthSpec(manifest.auth, issues)\n  const seen = new Set<string>()\n  for (const [index, capability] of manifest.capabilities.entries()) {\n    const path = `capabilities[${index}]`\n    if (!capability.name.trim()) issues.push({ path: `${path}.name`, message: 'capability name is required' })\n    if (seen.has(capability.name)) issues.push({ path: `${path}.name`, message: `duplicate capability name: ${capability.name}` })\n    seen.add(capability.name)\n    if (capability.class === 'mutation') {\n      if (!capability.cas) issues.push({ path: `${path}.cas`, message: 'mutation capability must declare a CAS strategy' })\n      if (manifest.defaultConsistencyModel === 'authoritative' && capability.cas === 'none') {\n        issues.push({ path: `${path}.cas`, message: 'authoritative mutations cannot use cas=\"none\"' })\n      }\n    }\n  }\n  if (manifest.rateLimit) {\n    if (!Number.isFinite(manifest.rateLimit.requests) || manifest.rateLimit.requests <= 0) {\n      issues.push({ path: 'rateLimit.requests', message: 'rateLimit.requests must be positive' })\n    }\n    if (!Number.isFinite(manifest.rateLimit.windowMs) || manifest.rateLimit.windowMs <= 0) {\n      issues.push({ path: 'rateLimit.windowMs', message: 'rateLimit.windowMs must be positive' })\n    }\n  }\n  return { ok: issues.length === 0, issues }\n}\n\nfunction validateAuthSpec(auth: AuthSpec, issues: ConnectorManifestValidationIssue[]): void {\n  if (auth.kind === 'oauth2') {\n    validateOAuth2AuthSpec(auth, issues, 'auth')\n    return\n  }\n  if (auth.kind !== 'one_of') return\n  if (auth.options.length < 2) {\n    issues.push({ path: 'auth.options', message: 'one_of auth must declare at least two options' })\n  }\n  const optionKinds = new Set(auth.options.map((option) => option.kind))\n  if (!optionKinds.has(auth.preferred)) {\n    issues.push({ path: 'auth.preferred', message: 'one_of preferred auth must match an option kind' })\n  }\n  for (const [index, option] of auth.options.entries()) {\n    if (option.kind === 'oauth2') {\n      validateOAuth2AuthSpec(option, issues, `auth.options[${index}]`)\n    }\n  }\n}\n\nfunction validateOAuth2AuthSpec(\n  auth: OAuth2AuthSpec,\n  issues: ConnectorManifestValidationIssue[],\n  path: string,\n): void {\n  if ((auth.grantType ?? 'authorization_code') === 'authorization_code' && !auth.authorizationUrl?.trim()) {\n    issues.push({ path: `${path}.authorizationUrl`, message: 'authorization_code grant requires authorizationUrl' })\n  }\n  if (\n    auth.tokenClientAuthMethod !== undefined &&\n    auth.tokenClientAuthMethod !== 'client_secret_post' &&\n    auth.tokenClientAuthMethod !== 'client_secret_basic'\n  ) {\n    issues.push({\n      path: `${path}.tokenClientAuthMethod`,\n      message: 'tokenClientAuthMethod must be client_secret_post or client_secret_basic',\n    })\n  }\n}\n\nexport function assertValidConnectorManifest(manifest: ConnectorManifest): void {\n  const result = validateConnectorManifest(manifest)\n  if (!result.ok) {\n    throw new Error(`Invalid connector manifest ${manifest.kind || '<unknown>'}: ${result.issues.map((issue) => `${issue.path}: ${issue.message}`).join('; ')}`)\n  }\n}\n","/**\n * @stable Tangle Identity — `id.tangle.tools` connector + verifier.\n *\n * This is the *identity* substrate every Tangle product (legal, tax, gtm,\n * creative, agent-builder, sandbox, evals, …) sits on. The shape mirrors\n * what `tcloud` and the sandbox `PlatformClient` already implement against\n * the platform repo at `agent-dev-container-collab-m1/products/platform`,\n * so consumers can switch from a hand-rolled fetch loop to this adapter\n * without changing the wire protocol.\n *\n * What it covers, end-to-end:\n *\n *   verify_token({ token })\n *     → { kind: 'api_key' | 'session', valid, userId?, workspaceId?, scopes, expiresAt? }\n *     Verifies a single credential. Two token shapes are recognized:\n *       - `sk-tan-*` API keys — POST /v1/keys/verify with the service token.\n *         Returns `userId`, `keyId`, `product`, granted scopes (`allowedModels`\n *         + product flag), and budget metadata.\n *       - Better Auth session cookies / Bearer session tokens — GET\n *         /api/auth/get-session with the credential forwarded as-is.\n *         Returns the user row.\n *     Wrong-issuer / tampered / expired all surface as `{ valid: false }`\n *     with a stable `reason`. Never throws on bad-token; only throws when\n *     id.tangle.tools itself is unreachable or returns a 5xx (lets callers\n *     fail closed without confusing token failures with platform failures).\n *\n *   get_user({ userId })\n *     → { id, email, name?, image? }\n *     Read-only profile lookup. Service-token authenticated. Used by\n *     `requireTangleAuth` middleware to hydrate the request context when\n *     a downstream wants the user's email without re-verifying.\n *\n *   list_workspaces({ userId })\n *     → { workspaces: [{ id, name, role, isPersonal }] }\n *     A workspace = a Tangle team. Personal workspace is rendered with\n *     `isPersonal: true` (own id === userId on the platform schema).\n *     Mirrors `GET /v1/teams` on the platform side.\n *\n *   switch_workspace({ workspaceId })\n *     → { ok: true, workspaceId, scopes }\n *     Stateless on this adapter — the caller persists the workspaceId in\n *     its own session. The connector returns the workspace's effective\n *     scope set so the caller can immediately filter capability discovery\n *     against the new workspace's grant matrix.\n *\n *   revoke_session({ token })\n *     → { ok: true }\n *     For session tokens: POST /api/auth/sign-out. For API keys: DELETE\n *     /v1/keys/{id}. The adapter detects the kind from the prefix.\n *\n * Auth:\n *   - **Service token** (`Bearer svc_*`) is required for `verify_token` of\n *     `sk-tan-*` keys, `get_user`, `list_workspaces`, and `revoke_session`\n *     of API keys.\n *   - **Session cookie / Bearer session** is forwarded as-is for session\n *     verification and session revocation.\n *\n * The adapter is stateless. Caller resolves `serviceToken` + `baseUrl` from\n * env (`TANGLE_PLATFORM_URL`, `TANGLE_SERVICE_TOKEN`) and passes them at\n * construction. The adapter never reads from `process.env` itself — this\n * keeps it CF Worker compatible (no Node-only env semantics) and lets\n * tests inject a fake fetch + service token in one place.\n */\n\nimport {\n  type CapabilityMutationResult,\n  type CapabilityReadResult,\n  type ConnectorAdapter,\n  type ConnectorInvocation,\n  CredentialsExpired,\n} from '../types.js'\n\n/** Default platform URL (matches `DEFAULT_PLATFORM_URL` in tcloud). */\nexport const DEFAULT_TANGLE_PLATFORM_URL = 'https://id.tangle.tools'\n\n/** Hard timeout for every outbound platform call. Matches sandbox's\n *  `PLATFORM_FETCH_TIMEOUT_MS` so a slow id.tangle.tools doesn't tie up\n *  the consumer's request handler. */\nconst PLATFORM_FETCH_TIMEOUT_MS = 5_000\n\n/** API-key prefix the platform issues. Used to disambiguate token kind\n *  without a round-trip. */\nexport const TANGLE_API_KEY_PREFIX = 'sk-tan-'\n\n/** Service-token prefix. Mirrored from the platform's middleware so we\n *  can refuse to forward service tokens through the user-session path. */\nexport const TANGLE_SERVICE_TOKEN_PREFIX = 'svc_'\n\nexport interface TangleIdentityOptions {\n  /** Base URL of the id.tangle.tools deployment (no trailing slash). */\n  baseUrl?: string\n  /**\n   * Service token (`svc_*`) used for S2S calls (verify, provision, etc.).\n   * Required for API-key verification and the user/workspace read paths.\n   * Omit only for session-only flows on a deployment that exposes those\n   * routes unauthenticated (rare; never in production).\n   */\n  serviceToken?: string\n  /** Service identity claimed in the `X-Service-Name` header. */\n  serviceName?: string\n  /** Injected fetch — defaults to global. Tests pass a vi mock. */\n  fetchImpl?: typeof fetch\n  /** Per-call timeout override (default {@link PLATFORM_FETCH_TIMEOUT_MS}). */\n  timeoutMs?: number\n}\n\n/** Stable result of a token verification. `valid: false` is returned for\n *  every recognizable bad-token shape (expired, tampered, wrong issuer,\n *  unknown kind); only true platform unreachability throws. */\nexport type TangleTokenVerifyResult =\n  | {\n      valid: true\n      kind: 'api_key' | 'session'\n      userId: string\n      /** Active workspace at the moment of issue, if the credential is\n       *  workspace-scoped (team-owned API key). Personal credentials\n       *  return the user's personal workspace (== `userId`). */\n      workspaceId: string\n      scopes: string[]\n      /** Wall-clock ms epoch when the credential expires. Undefined for\n       *  non-expiring credentials (most session cookies are sliding). */\n      expiresAt?: number\n      /** Stable id of the credential row, when known (key.id for API\n       *  keys, session.id for sessions). Useful for revoke + audit. */\n      credentialId?: string\n      /** Product the credential is scoped to, when known. */\n      product?: string\n      /** Owner shape — `user` for personal credentials, `team` for\n       *  team-owned API keys. Always matches the workspace's owner type. */\n      ownerType: 'user' | 'team'\n    }\n  | {\n      valid: false\n      /** Stable reason code: `tampered`, `expired`, `revoked`,\n       *  `wrong_issuer`, `unknown_kind`, `service_token_refused`. */\n      reason: TangleTokenVerifyFailure\n    }\n\nexport type TangleTokenVerifyFailure =\n  | 'tampered'\n  | 'expired'\n  | 'revoked'\n  | 'wrong_issuer'\n  | 'unknown_kind'\n  | 'service_token_refused'\n  | 'malformed'\n\nexport interface TangleUserSummary {\n  id: string\n  email?: string\n  name?: string | null\n  image?: string | null\n}\n\nexport interface TangleWorkspaceSummary {\n  id: string\n  name: string\n  role: 'owner' | 'admin' | 'member'\n  isPersonal: boolean\n  /** Effective scope set for the calling user inside this workspace.\n   *  Sourced from the team's plan + per-product policy on the platform. */\n  scopes: string[]\n}\n\n/** Thrown when id.tangle.tools is unreachable or returns 5xx. NOT thrown\n *  for bad-token responses — those round-trip as `{ valid: false }`. */\nexport class TangleIdentityUnreachableError extends Error {\n  override readonly name = 'TangleIdentityUnreachableError'\n  readonly status?: number\n  constructor(message: string, opts?: { status?: number; cause?: unknown }) {\n    super(message, opts)\n    this.status = opts?.status\n  }\n}\n\n/** Build a `ConnectorAdapter` exposing id.tangle.tools as a first-party\n *  integration. The adapter participates in the standard discovery /\n *  capability gating loop, so a product can list identity ops alongside\n *  Gmail / Stripe / etc. in the same tool registry. */\nexport function tangleIdentity(opts: TangleIdentityOptions = {}): ConnectorAdapter {\n  const client = createTangleIdentityClient(opts)\n  const adapter: ConnectorAdapter = {\n    manifest: {\n      kind: 'tangle-id',\n      displayName: 'Tangle Identity',\n      description:\n        'Verify Tangle session cookies and API keys issued by id.tangle.tools, resolve user + workspace identity, and gate capability discovery against the calling workspace scopes.',\n      auth: { kind: 'api-key', hint: 'Tangle platform service token (svc_*).' },\n      category: 'other',\n      defaultConsistencyModel: 'authoritative',\n      // 50 req/s per service token matches the platform's documented\n      // S2S budget. We meter on our side so a chatty product doesn't\n      // burn the shared service-token quota and block the rest.\n      rateLimit: { requests: 50, windowMs: 1_000, scope: 'oauth-client' },\n      capabilities: [\n        {\n          name: 'verify_token',\n          class: 'read',\n          description:\n            'Verify a session cookie or sk-tan-* API key. Returns { valid, userId, workspaceId, scopes, expiresAt } or { valid: false, reason }.',\n          parameters: {\n            type: 'object',\n            properties: {\n              token: { type: 'string', minLength: 1 },\n            },\n            required: ['token'],\n          },\n        },\n        {\n          name: 'get_user',\n          class: 'read',\n          description: 'Read the user profile (id, email, name, image) for a verified userId.',\n          parameters: {\n            type: 'object',\n            properties: { userId: { type: 'string', minLength: 1 } },\n            required: ['userId'],\n          },\n        },\n        {\n          name: 'list_workspaces',\n          class: 'read',\n          description: 'List workspaces (teams + the personal workspace) the user belongs to, with role + effective scopes.',\n          parameters: {\n            type: 'object',\n            properties: { userId: { type: 'string', minLength: 1 } },\n            required: ['userId'],\n          },\n        },\n        {\n          name: 'switch_workspace',\n          class: 'mutation',\n          description:\n            'Resolve a workspace by id and return its effective scope set. Stateless on this adapter — caller persists the workspaceId in its own session store.',\n          parameters: {\n            type: 'object',\n            properties: {\n              userId: { type: 'string', minLength: 1 },\n              workspaceId: { type: 'string', minLength: 1 },\n            },\n            required: ['userId', 'workspaceId'],\n          },\n          cas: 'native-idempotency',\n          externalEffect: false,\n        },\n        {\n          name: 'revoke_session',\n          class: 'mutation',\n          description: 'Revoke a session token or API key. Idempotent.',\n          parameters: {\n            type: 'object',\n            properties: { token: { type: 'string', minLength: 1 } },\n            required: ['token'],\n          },\n          cas: 'native-idempotency',\n          externalEffect: true,\n        },\n        {\n          name: 'workspaces.create',\n          class: 'mutation',\n          description:\n            'Create a new workspace (team) owned by the calling user. Idempotent by display name + owner — re-issuing with the same name returns the existing workspace.',\n          parameters: {\n            type: 'object',\n            properties: {\n              userId: { type: 'string', minLength: 1 },\n              name: { type: 'string', minLength: 1 },\n              slug: { type: 'string', minLength: 1 },\n            },\n            required: ['userId', 'name'],\n          },\n          cas: 'native-idempotency',\n          externalEffect: true,\n        },\n        {\n          name: 'workspaces.delete',\n          class: 'mutation',\n          description:\n            'Delete a workspace. Refuses to delete a user personal workspace. Idempotent: 404 is treated as a no-op.',\n          parameters: {\n            type: 'object',\n            properties: { workspaceId: { type: 'string', minLength: 1 } },\n            required: ['workspaceId'],\n          },\n          cas: 'native-idempotency',\n          externalEffect: true,\n        },\n        {\n          name: 'members.invite',\n          class: 'mutation',\n          description:\n            'Invite a member to a workspace by email. Idempotent: re-inviting the same email returns the existing invitation.',\n          parameters: {\n            type: 'object',\n            properties: {\n              workspaceId: { type: 'string', minLength: 1 },\n              email: { type: 'string', minLength: 3 },\n              role: { type: 'string', enum: ['owner', 'admin', 'member'] },\n            },\n            required: ['workspaceId', 'email'],\n          },\n          cas: 'native-idempotency',\n          externalEffect: true,\n        },\n        {\n          name: 'members.remove',\n          class: 'mutation',\n          description:\n            'Remove a member from a workspace by userId. Idempotent: 404 is treated as a no-op.',\n          parameters: {\n            type: 'object',\n            properties: {\n              workspaceId: { type: 'string', minLength: 1 },\n              userId: { type: 'string', minLength: 1 },\n            },\n            required: ['workspaceId', 'userId'],\n          },\n          cas: 'native-idempotency',\n          externalEffect: true,\n        },\n      ],\n    },\n\n    async executeRead(inv: ConnectorInvocation): Promise<CapabilityReadResult> {\n      if (inv.capabilityName === 'verify_token') {\n        const token = readStringArg(inv.args, 'token')\n        const result = await client.verifyToken(token)\n        return { data: result, fetchedAt: Date.now() }\n      }\n      if (inv.capabilityName === 'get_user') {\n        const userId = readStringArg(inv.args, 'userId')\n        const user = await client.getUser(userId)\n        return { data: user, fetchedAt: Date.now() }\n      }\n      if (inv.capabilityName === 'list_workspaces') {\n        const userId = readStringArg(inv.args, 'userId')\n        const workspaces = await client.listWorkspaces(userId)\n        return { data: { workspaces }, fetchedAt: Date.now() }\n      }\n      throw new Error(`tangle-id: unknown read capability ${inv.capabilityName}`)\n    },\n\n    async executeMutation(inv: ConnectorInvocation): Promise<CapabilityMutationResult> {\n      if (inv.capabilityName === 'switch_workspace') {\n        const userId = readStringArg(inv.args, 'userId')\n        const workspaceId = readStringArg(inv.args, 'workspaceId')\n        const result = await client.switchWorkspace(userId, workspaceId)\n        return {\n          status: 'committed',\n          data: result,\n          committedAt: Date.now(),\n          idempotentReplay: false,\n        }\n      }\n      if (inv.capabilityName === 'revoke_session') {\n        const token = readStringArg(inv.args, 'token')\n        await client.revokeSession(token)\n        return {\n          status: 'committed',\n          data: { ok: true },\n          committedAt: Date.now(),\n          idempotentReplay: false,\n        }\n      }\n      if (inv.capabilityName === 'workspaces.create') {\n        const userId = readStringArg(inv.args, 'userId')\n        const name = readStringArg(inv.args, 'name')\n        const slug = readOptionalStringArg(inv.args, 'slug')\n        const workspace = await client.createWorkspace(userId, { name, slug })\n        return {\n          status: 'committed',\n          data: workspace,\n          committedAt: Date.now(),\n          idempotentReplay: false,\n        }\n      }\n      if (inv.capabilityName === 'workspaces.delete') {\n        const workspaceId = readStringArg(inv.args, 'workspaceId')\n        await client.deleteWorkspace(workspaceId)\n        return {\n          status: 'committed',\n          data: { ok: true, workspaceId },\n          committedAt: Date.now(),\n          idempotentReplay: false,\n        }\n      }\n      if (inv.capabilityName === 'members.invite') {\n        const workspaceId = readStringArg(inv.args, 'workspaceId')\n        const email = readStringArg(inv.args, 'email')\n        const role = readOptionalRole(inv.args, 'role')\n        const invitation = await client.inviteMember(workspaceId, email, role)\n        return {\n          status: 'committed',\n          data: invitation,\n          committedAt: Date.now(),\n          idempotentReplay: false,\n        }\n      }\n      if (inv.capabilityName === 'members.remove') {\n        const workspaceId = readStringArg(inv.args, 'workspaceId')\n        const userId = readStringArg(inv.args, 'userId')\n        await client.removeMember(workspaceId, userId)\n        return {\n          status: 'committed',\n          data: { ok: true, workspaceId, userId },\n          committedAt: Date.now(),\n          idempotentReplay: false,\n        }\n      }\n      throw new Error(`tangle-id: unknown mutation capability ${inv.capabilityName}`)\n    },\n\n    async test(source) {\n      try {\n        // Cheapest probe: hit the platform's /health endpoint. Doesn't\n        // burn the service-token quota and proves the deployment is up.\n        const ok = await client.ping()\n        if (!ok) return { ok: false, reason: 'id.tangle.tools /health returned non-200' }\n        return { ok: true }\n      } catch (err) {\n        if (err instanceof CredentialsExpired) {\n          return { ok: false, reason: 'service token rejected — rotate TANGLE_SERVICE_TOKEN' }\n        }\n        return { ok: false, reason: err instanceof Error ? err.message : String(err) }\n      }\n    },\n  }\n  return adapter\n}\n\n/** Low-level HTTP client used by the adapter. Exported so consumers\n *  (middleware, connect routes, custom apps) can hit id.tangle.tools\n *  without going through the connector pipeline. */\nexport interface TangleIdentityClient {\n  verifyToken(token: string): Promise<TangleTokenVerifyResult>\n  getUser(userId: string): Promise<TangleUserSummary>\n  listWorkspaces(userId: string): Promise<TangleWorkspaceSummary[]>\n  switchWorkspace(\n    userId: string,\n    workspaceId: string,\n  ): Promise<{ ok: true; workspaceId: string; scopes: string[] }>\n  revokeSession(token: string): Promise<void>\n  /** Create a new workspace owned by `userId`. The platform's\n   *  `POST /v1/teams` returns the persisted row. Idempotent on\n   *  `(ownerId, name)` upstream; conflicts are unwrapped to the\n   *  existing row, not surfaced as errors. */\n  createWorkspace(\n    userId: string,\n    spec: { name: string; slug?: string },\n  ): Promise<TangleWorkspaceSummary>\n  /** Delete a workspace. Refuses to delete the user's personal\n   *  workspace (the platform-side `/v1/teams/{id}` returns 409). */\n  deleteWorkspace(workspaceId: string): Promise<void>\n  /** Invite a member to a workspace by email. Idempotent: re-issuing\n   *  the same invite returns the existing pending invitation row. */\n  inviteMember(\n    workspaceId: string,\n    email: string,\n    role?: TangleWorkspaceSummary['role'],\n  ): Promise<TangleInvitationSummary>\n  /** Remove a member from a workspace by `userId`. 404 is a no-op. */\n  removeMember(workspaceId: string, userId: string): Promise<void>\n  ping(): Promise<boolean>\n}\n\nexport interface TangleInvitationSummary {\n  id: string\n  workspaceId: string\n  email: string\n  role: TangleWorkspaceSummary['role']\n  status: 'pending' | 'accepted' | 'revoked'\n}\n\nexport function createTangleIdentityClient(opts: TangleIdentityOptions = {}): TangleIdentityClient {\n  const baseUrl = (opts.baseUrl ?? DEFAULT_TANGLE_PLATFORM_URL).replace(/\\/+$/, '')\n  const serviceToken = opts.serviceToken\n  const serviceName = opts.serviceName ?? 'integrations'\n  const fetchImpl = opts.fetchImpl ?? fetch\n  const timeoutMs = opts.timeoutMs ?? PLATFORM_FETCH_TIMEOUT_MS\n\n  function s2sHeaders(): Record<string, string> {\n    if (!serviceToken) {\n      throw new TangleIdentityUnreachableError(\n        'tangle-id: serviceToken is required for service-to-service calls (verify, get_user, list_workspaces, revoke)',\n      )\n    }\n    return {\n      'content-type': 'application/json',\n      authorization: `Bearer ${serviceToken}`,\n      'x-service-name': serviceName,\n    }\n  }\n\n  async function jsonFetch(path: string, init: RequestInit): Promise<Response> {\n    let res: Response\n    try {\n      res = await fetchImpl(`${baseUrl}${path}`, {\n        ...init,\n        signal: init.signal ?? AbortSignal.timeout(timeoutMs),\n      })\n    } catch (err) {\n      throw new TangleIdentityUnreachableError(\n        `tangle-id: request to ${path} failed`,\n        { cause: err },\n      )\n    }\n    return res\n  }\n\n  async function readErrorDetail(res: Response): Promise<string> {\n    try {\n      const text = await res.text()\n      return text.trim().slice(0, 200)\n    } catch {\n      return ''\n    }\n  }\n\n  async function verifyApiKey(token: string): Promise<TangleTokenVerifyResult> {\n    const res = await jsonFetch('/v1/keys/verify', {\n      method: 'POST',\n      headers: s2sHeaders(),\n      body: JSON.stringify({ key: token }),\n    })\n    if (res.status === 401) {\n      // Service token rejected — distinct from \"token is bad\". The\n      // platform middleware refuses our svc_* credential. Surface that\n      // as `service_token_refused` so the caller can rotate.\n      return { valid: false, reason: 'service_token_refused' }\n    }\n    if (!res.ok) {\n      throw new TangleIdentityUnreachableError(\n        `tangle-id: /v1/keys/verify returned ${res.status}: ${await readErrorDetail(res)}`,\n        { status: res.status },\n      )\n    }\n    const body = (await res.json().catch(() => null)) as\n      | {\n          valid?: boolean\n          userId?: string\n          ownerId?: string\n          ownerType?: 'user' | 'team'\n          keyId?: string\n          product?: string\n          allowedModels?: unknown\n          expiresAt?: string\n        }\n      | null\n    if (!body || typeof body.valid !== 'boolean') {\n      return { valid: false, reason: 'malformed' }\n    }\n    if (!body.valid || !body.userId) {\n      return { valid: false, reason: 'revoked' }\n    }\n    const scopes = Array.isArray(body.allowedModels)\n      ? body.allowedModels.filter((value): value is string => typeof value === 'string')\n      : []\n    if (body.product) scopes.push(`product:${body.product}`)\n    const expiresAt =\n      typeof body.expiresAt === 'string' && body.expiresAt\n        ? Date.parse(body.expiresAt)\n        : undefined\n    return {\n      valid: true,\n      kind: 'api_key',\n      userId: body.userId,\n      workspaceId: body.ownerType === 'team' && body.ownerId ? body.ownerId : body.userId,\n      ownerType: body.ownerType ?? 'user',\n      scopes,\n      ...(Number.isFinite(expiresAt) ? { expiresAt: expiresAt as number } : {}),\n      ...(body.keyId ? { credentialId: body.keyId } : {}),\n      ...(body.product ? { product: body.product } : {}),\n    }\n  }\n\n  async function verifySession(token: string): Promise<TangleTokenVerifyResult> {\n    // Better Auth's get-session endpoint accepts either:\n    //   - Cookie header `better-auth.session_token=<jwt>` (browser flow)\n    //   - Bearer token (mobile / CLI flow), which Better Auth's bearer\n    //     plugin extracts and resolves to a session row.\n    // We always send Bearer; the platform's auth handler treats absent\n    // cookie + present Bearer identically.\n    const res = await jsonFetch('/api/auth/get-session', {\n      method: 'GET',\n      headers: {\n        accept: 'application/json',\n        authorization: `Bearer ${token}`,\n      },\n    })\n    if (res.status === 401 || res.status === 403) {\n      return { valid: false, reason: 'expired' }\n    }\n    if (!res.ok) {\n      throw new TangleIdentityUnreachableError(\n        `tangle-id: /api/auth/get-session returned ${res.status}: ${await readErrorDetail(res)}`,\n        { status: res.status },\n      )\n    }\n    const body = (await res.json().catch(() => null)) as\n      | {\n          user?: { id?: string; email?: string }\n          session?: { id?: string; expiresAt?: string; activeTeamId?: string | null }\n        }\n      | null\n    if (!body || !body.user || typeof body.user.id !== 'string') {\n      return { valid: false, reason: 'expired' }\n    }\n    const expiresAtRaw = body.session?.expiresAt\n    const expiresAt = expiresAtRaw ? Date.parse(expiresAtRaw) : NaN\n    return {\n      valid: true,\n      kind: 'session',\n      userId: body.user.id,\n      workspaceId: body.session?.activeTeamId || body.user.id,\n      ownerType: body.session?.activeTeamId ? 'team' : 'user',\n      scopes: [],\n      ...(Number.isFinite(expiresAt) ? { expiresAt } : {}),\n      ...(body.session?.id ? { credentialId: body.session.id } : {}),\n    }\n  }\n\n  return {\n    async verifyToken(token: string): Promise<TangleTokenVerifyResult> {\n      if (!token || typeof token !== 'string') {\n        return { valid: false, reason: 'malformed' }\n      }\n      if (token.startsWith(TANGLE_SERVICE_TOKEN_PREFIX)) {\n        // Service tokens MUST NOT be accepted as user identity. The\n        // platform middleware sets `authMethod: 'service_token'` and\n        // refuses every user-bound route on that path; mirror the\n        // refusal here so a misconfigured product can't accidentally\n        // treat an svc_* as the calling user.\n        return { valid: false, reason: 'service_token_refused' }\n      }\n      if (token.startsWith(TANGLE_API_KEY_PREFIX)) {\n        return verifyApiKey(token)\n      }\n      // Anything else — treat as a session bearer (Better Auth-emitted\n      // JWTs are opaque to us). Wrong-issuer / random-string lands\n      // on the 401 path inside `verifySession` and round-trips as\n      // `expired`. We do not pre-validate JWT signatures — only the\n      // platform holds the signing secret.\n      return verifySession(token)\n    },\n\n    async getUser(userId: string): Promise<TangleUserSummary> {\n      if (!userId) {\n        throw new TangleIdentityUnreachableError('tangle-id: getUser requires a non-empty userId')\n      }\n      const res = await jsonFetch(`/v1/users/${encodeURIComponent(userId)}`, {\n        method: 'GET',\n        headers: s2sHeaders(),\n      })\n      if (res.status === 404) {\n        throw new TangleIdentityUnreachableError(`tangle-id: user ${userId} not found`, { status: 404 })\n      }\n      if (!res.ok) {\n        throw new TangleIdentityUnreachableError(\n          `tangle-id: /v1/users/${userId} returned ${res.status}: ${await readErrorDetail(res)}`,\n          { status: res.status },\n        )\n      }\n      const body = (await res.json().catch(() => null)) as\n        | { success?: boolean; data?: { id?: string; email?: string; name?: string | null; image?: string | null } }\n        | null\n      const data = body?.data\n      if (!data || typeof data.id !== 'string') {\n        throw new TangleIdentityUnreachableError('tangle-id: /v1/users response had an invalid shape')\n      }\n      return {\n        id: data.id,\n        ...(typeof data.email === 'string' ? { email: data.email } : {}),\n        ...(data.name !== undefined ? { name: data.name } : {}),\n        ...(data.image !== undefined ? { image: data.image } : {}),\n      }\n    },\n\n    async listWorkspaces(userId: string): Promise<TangleWorkspaceSummary[]> {\n      const res = await jsonFetch('/v1/teams', {\n        method: 'GET',\n        headers: { ...s2sHeaders(), 'x-platform-user-id': userId },\n      })\n      if (!res.ok) {\n        throw new TangleIdentityUnreachableError(\n          `tangle-id: /v1/teams returned ${res.status}: ${await readErrorDetail(res)}`,\n          { status: res.status },\n        )\n      }\n      const body = (await res.json().catch(() => null)) as\n        | {\n            success?: boolean\n            data?: Array<{\n              id?: string\n              name?: string\n              role?: string\n              isPersonal?: boolean\n              scopes?: unknown\n            }>\n          }\n        | null\n      const rows = Array.isArray(body?.data) ? body!.data : []\n      const workspaces: TangleWorkspaceSummary[] = []\n      for (const row of rows) {\n        if (!row || typeof row.id !== 'string' || typeof row.name !== 'string') continue\n        const role: TangleWorkspaceSummary['role'] =\n          row.role === 'owner' || row.role === 'admin' ? row.role : 'member'\n        const scopes = Array.isArray(row.scopes)\n          ? row.scopes.filter((value): value is string => typeof value === 'string')\n          : []\n        workspaces.push({\n          id: row.id,\n          name: row.name,\n          role,\n          isPersonal: Boolean(row.isPersonal) || row.id === userId,\n          scopes,\n        })\n      }\n      return workspaces\n    },\n\n    async switchWorkspace(userId, workspaceId) {\n      const workspaces = await this.listWorkspaces(userId)\n      const match = workspaces.find((w) => w.id === workspaceId)\n      if (!match) {\n        throw new TangleIdentityUnreachableError(\n          `tangle-id: workspace ${workspaceId} not found for user ${userId}`,\n          { status: 404 },\n        )\n      }\n      return { ok: true, workspaceId: match.id, scopes: match.scopes }\n    },\n\n    async revokeSession(token: string): Promise<void> {\n      if (!token) return\n      if (token.startsWith(TANGLE_SERVICE_TOKEN_PREFIX)) {\n        throw new TangleIdentityUnreachableError(\n          'tangle-id: refusing to revoke a service token — rotate it instead',\n        )\n      }\n      if (token.startsWith(TANGLE_API_KEY_PREFIX)) {\n        // We don't know the key id until we verify; do that first so\n        // revoke is keyed by id (the only thing the platform's DELETE\n        // /v1/keys/{id} accepts). Bad-key responses are no-ops.\n        const v = await verifyApiKey(token)\n        if (!v.valid || !v.credentialId) return\n        const res = await jsonFetch(`/v1/keys/${encodeURIComponent(v.credentialId)}`, {\n          method: 'DELETE',\n          headers: s2sHeaders(),\n        })\n        if (res.status === 404) return\n        if (!res.ok) {\n          throw new TangleIdentityUnreachableError(\n            `tangle-id: DELETE /v1/keys/${v.credentialId} returned ${res.status}: ${await readErrorDetail(res)}`,\n            { status: res.status },\n          )\n        }\n        return\n      }\n      // Session token — Better Auth's sign-out endpoint accepts the\n      // session via Bearer + Cookie. We forward the credential as-is.\n      const res = await jsonFetch('/api/auth/sign-out', {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          authorization: `Bearer ${token}`,\n        },\n        body: '{}',\n      })\n      // Better Auth returns 200 on a fresh sign-out and 200/401 on a\n      // stale one; either way the session is no longer usable.\n      if (res.status >= 500) {\n        throw new TangleIdentityUnreachableError(\n          `tangle-id: /api/auth/sign-out returned ${res.status}: ${await readErrorDetail(res)}`,\n          { status: res.status },\n        )\n      }\n    },\n\n    async createWorkspace(userId, spec) {\n      if (!userId) {\n        throw new TangleIdentityUnreachableError(\n          'tangle-id: createWorkspace requires a non-empty userId',\n        )\n      }\n      const res = await jsonFetch('/v1/teams', {\n        method: 'POST',\n        headers: { ...s2sHeaders(), 'x-platform-user-id': userId },\n        body: JSON.stringify({\n          name: spec.name,\n          ...(spec.slug ? { slug: spec.slug } : {}),\n        }),\n      })\n      if (res.status === 401) {\n        throw new CredentialsExpired(\n          'tangle-id: service token rejected on POST /v1/teams',\n          'tangle-id',\n        )\n      }\n      if (!res.ok) {\n        throw new TangleIdentityUnreachableError(\n          `tangle-id: POST /v1/teams returned ${res.status}: ${await readErrorDetail(res)}`,\n          { status: res.status },\n        )\n      }\n      const body = (await res.json().catch(() => null)) as\n        | {\n            success?: boolean\n            data?: { id?: string; name?: string; role?: string; isPersonal?: boolean; scopes?: unknown }\n          }\n        | null\n      const data = body?.data\n      if (!data || typeof data.id !== 'string' || typeof data.name !== 'string') {\n        throw new TangleIdentityUnreachableError(\n          'tangle-id: POST /v1/teams response had an invalid shape',\n        )\n      }\n      const role: TangleWorkspaceSummary['role'] =\n        data.role === 'owner' || data.role === 'admin' ? data.role : 'owner'\n      const scopes = Array.isArray(data.scopes)\n        ? data.scopes.filter((value): value is string => typeof value === 'string')\n        : []\n      return {\n        id: data.id,\n        name: data.name,\n        role,\n        isPersonal: Boolean(data.isPersonal) || data.id === userId,\n        scopes,\n      }\n    },\n\n    async deleteWorkspace(workspaceId) {\n      if (!workspaceId) {\n        throw new TangleIdentityUnreachableError(\n          'tangle-id: deleteWorkspace requires a non-empty workspaceId',\n        )\n      }\n      const res = await jsonFetch(`/v1/teams/${encodeURIComponent(workspaceId)}`, {\n        method: 'DELETE',\n        headers: s2sHeaders(),\n      })\n      if (res.status === 401) {\n        throw new CredentialsExpired(\n          'tangle-id: service token rejected on DELETE /v1/teams',\n          'tangle-id',\n        )\n      }\n      if (res.status === 404) return\n      if (!res.ok) {\n        throw new TangleIdentityUnreachableError(\n          `tangle-id: DELETE /v1/teams/${workspaceId} returned ${res.status}: ${await readErrorDetail(res)}`,\n          { status: res.status },\n        )\n      }\n    },\n\n    async inviteMember(workspaceId, email, role) {\n      if (!workspaceId) {\n        throw new TangleIdentityUnreachableError(\n          'tangle-id: inviteMember requires a non-empty workspaceId',\n        )\n      }\n      if (!email) {\n        throw new TangleIdentityUnreachableError(\n          'tangle-id: inviteMember requires a non-empty email',\n        )\n      }\n      const res = await jsonFetch(\n        `/v1/teams/${encodeURIComponent(workspaceId)}/invitations`,\n        {\n          method: 'POST',\n          headers: s2sHeaders(),\n          body: JSON.stringify({\n            email,\n            ...(role ? { role } : {}),\n          }),\n        },\n      )\n      if (res.status === 401) {\n        throw new CredentialsExpired(\n          'tangle-id: service token rejected on POST invitation',\n          'tangle-id',\n        )\n      }\n      if (!res.ok) {\n        throw new TangleIdentityUnreachableError(\n          `tangle-id: POST /v1/teams/${workspaceId}/invitations returned ${res.status}: ${await readErrorDetail(res)}`,\n          { status: res.status },\n        )\n      }\n      const body = (await res.json().catch(() => null)) as\n        | {\n            success?: boolean\n            data?: {\n              id?: string\n              workspaceId?: string\n              teamId?: string\n              email?: string\n              role?: string\n              status?: string\n            }\n          }\n        | null\n      const data = body?.data\n      if (!data || typeof data.id !== 'string') {\n        throw new TangleIdentityUnreachableError(\n          'tangle-id: POST invitation response had an invalid shape',\n        )\n      }\n      const resolvedRole: TangleWorkspaceSummary['role'] =\n        data.role === 'owner' || data.role === 'admin' ? data.role : 'member'\n      const status: TangleInvitationSummary['status'] =\n        data.status === 'accepted' || data.status === 'revoked' ? data.status : 'pending'\n      return {\n        id: data.id,\n        workspaceId: data.workspaceId ?? data.teamId ?? workspaceId,\n        email: data.email ?? email,\n        role: resolvedRole,\n        status,\n      }\n    },\n\n    async removeMember(workspaceId, userId) {\n      if (!workspaceId || !userId) {\n        throw new TangleIdentityUnreachableError(\n          'tangle-id: removeMember requires non-empty workspaceId and userId',\n        )\n      }\n      const res = await jsonFetch(\n        `/v1/teams/${encodeURIComponent(workspaceId)}/members/${encodeURIComponent(userId)}`,\n        {\n          method: 'DELETE',\n          headers: s2sHeaders(),\n        },\n      )\n      if (res.status === 401) {\n        throw new CredentialsExpired(\n          'tangle-id: service token rejected on DELETE member',\n          'tangle-id',\n        )\n      }\n      if (res.status === 404) return\n      if (!res.ok) {\n        throw new TangleIdentityUnreachableError(\n          `tangle-id: DELETE /v1/teams/${workspaceId}/members/${userId} returned ${res.status}: ${await readErrorDetail(res)}`,\n          { status: res.status },\n        )\n      }\n    },\n\n    async ping(): Promise<boolean> {\n      const res = await jsonFetch('/health', { method: 'GET' })\n      return res.ok\n    },\n  }\n}\n\nfunction readStringArg(args: Record<string, unknown>, key: string): string {\n  const value = args[key]\n  if (typeof value !== 'string' || !value) {\n    throw new Error(`tangle-id: missing required argument \"${key}\"`)\n  }\n  return value\n}\n\nfunction readOptionalStringArg(args: Record<string, unknown>, key: string): string | undefined {\n  const value = args[key]\n  if (value === undefined || value === null) return undefined\n  if (typeof value !== 'string' || !value) return undefined\n  return value\n}\n\nfunction readOptionalRole(\n  args: Record<string, unknown>,\n  key: string,\n): TangleWorkspaceSummary['role'] | undefined {\n  const value = args[key]\n  if (value === 'owner' || value === 'admin' || value === 'member') return value\n  return undefined\n}\n"],"mappings":";AAmbO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAE5C,YACE,SACgB,eAA0B,CAAC,GAC3B,cAChB;AACA,UAAM,OAAO;AAHG;AACA;AAAA,EAGlB;AAAA,EAJkB;AAAA,EACA;AAAA,EAJA,OAAO;AAQ3B;AAqBO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAK5C,YACE,SACgB,cAChB,MACA;AACA,UAAM,OAAO;AAHG;AAIhB,SAAK,SAAS,MAAM;AACpB,SAAK,SAAS,MAAM;AACpB,SAAK,OAAO,MAAM;AAAA,EACpB;AAAA,EAPkB;AAAA,EANA,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAWX;AASO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EAK7C,YACE,SACgB,cAChB,MACA;AACA,UAAM,OAAO;AAHG;AAIhB,SAAK,SAAS,KAAK;AACnB,SAAK,SAAS,KAAK;AACnB,SAAK,OAAO,KAAK;AAAA,EACnB;AAAA,EAPkB;AAAA,EANA,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAWX;AAcO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EAM7C,YACE,SACgB,cAChB,MACA;AACA,UAAM,OAAO;AAHG;AAIhB,SAAK,SAAS,KAAK;AACnB,SAAK,SAAS,KAAK;AACnB,SAAK,OAAO,KAAK;AACjB,SAAK,eAAe,KAAK;AAAA,EAC3B;AAAA,EARkB;AAAA,EAPA,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAYX;AAgBO,SAAS,0BAA0B,UAAgE;AACxG,QAAM,SAA6C,CAAC;AACpD,MAAI,CAAC,SAAS,KAAK,KAAK,EAAG,QAAO,KAAK,EAAE,MAAM,QAAQ,SAAS,mBAAmB,CAAC;AACpF,MAAI,CAAC,SAAS,YAAY,KAAK,EAAG,QAAO,KAAK,EAAE,MAAM,eAAe,SAAS,0BAA0B,CAAC;AACzG,mBAAiB,SAAS,MAAM,MAAM;AACtC,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,CAAC,OAAO,UAAU,KAAK,SAAS,aAAa,QAAQ,GAAG;AACjE,UAAM,OAAO,gBAAgB,KAAK;AAClC,QAAI,CAAC,WAAW,KAAK,KAAK,EAAG,QAAO,KAAK,EAAE,MAAM,GAAG,IAAI,SAAS,SAAS,8BAA8B,CAAC;AACzG,QAAI,KAAK,IAAI,WAAW,IAAI,EAAG,QAAO,KAAK,EAAE,MAAM,GAAG,IAAI,SAAS,SAAS,8BAA8B,WAAW,IAAI,GAAG,CAAC;AAC7H,SAAK,IAAI,WAAW,IAAI;AACxB,QAAI,WAAW,UAAU,YAAY;AACnC,UAAI,CAAC,WAAW,IAAK,QAAO,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,SAAS,kDAAkD,CAAC;AACpH,UAAI,SAAS,4BAA4B,mBAAmB,WAAW,QAAQ,QAAQ;AACrF,eAAO,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,SAAS,gDAAgD,CAAC;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,WAAW;AACtB,QAAI,CAAC,OAAO,SAAS,SAAS,UAAU,QAAQ,KAAK,SAAS,UAAU,YAAY,GAAG;AACrF,aAAO,KAAK,EAAE,MAAM,sBAAsB,SAAS,sCAAsC,CAAC;AAAA,IAC5F;AACA,QAAI,CAAC,OAAO,SAAS,SAAS,UAAU,QAAQ,KAAK,SAAS,UAAU,YAAY,GAAG;AACrF,aAAO,KAAK,EAAE,MAAM,sBAAsB,SAAS,sCAAsC,CAAC;AAAA,IAC5F;AAAA,EACF;AACA,SAAO,EAAE,IAAI,OAAO,WAAW,GAAG,OAAO;AAC3C;AAEA,SAAS,iBAAiB,MAAgB,QAAkD;AAC1F,MAAI,KAAK,SAAS,UAAU;AAC1B,2BAAuB,MAAM,QAAQ,MAAM;AAC3C;AAAA,EACF;AACA,MAAI,KAAK,SAAS,SAAU;AAC5B,MAAI,KAAK,QAAQ,SAAS,GAAG;AAC3B,WAAO,KAAK,EAAE,MAAM,gBAAgB,SAAS,gDAAgD,CAAC;AAAA,EAChG;AACA,QAAM,cAAc,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC;AACrE,MAAI,CAAC,YAAY,IAAI,KAAK,SAAS,GAAG;AACpC,WAAO,KAAK,EAAE,MAAM,kBAAkB,SAAS,kDAAkD,CAAC;AAAA,EACpG;AACA,aAAW,CAAC,OAAO,MAAM,KAAK,KAAK,QAAQ,QAAQ,GAAG;AACpD,QAAI,OAAO,SAAS,UAAU;AAC5B,6BAAuB,QAAQ,QAAQ,gBAAgB,KAAK,GAAG;AAAA,IACjE;AAAA,EACF;AACF;AAEA,SAAS,uBACP,MACA,QACA,MACM;AACN,OAAK,KAAK,aAAa,0BAA0B,wBAAwB,CAAC,KAAK,kBAAkB,KAAK,GAAG;AACvG,WAAO,KAAK,EAAE,MAAM,GAAG,IAAI,qBAAqB,SAAS,qDAAqD,CAAC;AAAA,EACjH;AACA,MACE,KAAK,0BAA0B,UAC/B,KAAK,0BAA0B,wBAC/B,KAAK,0BAA0B,uBAC/B;AACA,WAAO,KAAK;AAAA,MACV,MAAM,GAAG,IAAI;AAAA,MACb,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEO,SAAS,6BAA6B,UAAmC;AAC9E,QAAM,SAAS,0BAA0B,QAAQ;AACjD,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,IAAI,MAAM,8BAA8B,SAAS,QAAQ,WAAW,KAAK,OAAO,OAAO,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,KAAK,MAAM,OAAO,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,EAC7J;AACF;;;ACxiBO,IAAM,8BAA8B;AAK3C,IAAM,4BAA4B;AAI3B,IAAM,wBAAwB;AAI9B,IAAM,8BAA8B;AAgFpC,IAAM,iCAAN,cAA6C,MAAM;AAAA,EACtC,OAAO;AAAA,EAChB;AAAA,EACT,YAAY,SAAiB,MAA6C;AACxE,UAAM,SAAS,IAAI;AACnB,SAAK,SAAS,MAAM;AAAA,EACtB;AACF;AAMO,SAAS,eAAe,OAA8B,CAAC,GAAqB;AACjF,QAAM,SAAS,2BAA2B,IAAI;AAC9C,QAAM,UAA4B;AAAA,IAChC,UAAU;AAAA,MACR,MAAM;AAAA,MACN,aAAa;AAAA,MACb,aACE;AAAA,MACF,MAAM,EAAE,MAAM,WAAW,MAAM,yCAAyC;AAAA,MACxE,UAAU;AAAA,MACV,yBAAyB;AAAA;AAAA;AAAA;AAAA,MAIzB,WAAW,EAAE,UAAU,IAAI,UAAU,KAAO,OAAO,eAAe;AAAA,MAClE,cAAc;AAAA,QACZ;AAAA,UACE,MAAM;AAAA,UACN,OAAO;AAAA,UACP,aACE;AAAA,UACF,YAAY;AAAA,YACV,MAAM;AAAA,YACN,YAAY;AAAA,cACV,OAAO,EAAE,MAAM,UAAU,WAAW,EAAE;AAAA,YACxC;AAAA,YACA,UAAU,CAAC,OAAO;AAAA,UACpB;AAAA,QACF;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,OAAO;AAAA,UACP,aAAa;AAAA,UACb,YAAY;AAAA,YACV,MAAM;AAAA,YACN,YAAY,EAAE,QAAQ,EAAE,MAAM,UAAU,WAAW,EAAE,EAAE;AAAA,YACvD,UAAU,CAAC,QAAQ;AAAA,UACrB;AAAA,QACF;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,OAAO;AAAA,UACP,aAAa;AAAA,UACb,YAAY;AAAA,YACV,MAAM;AAAA,YACN,YAAY,EAAE,QAAQ,EAAE,MAAM,UAAU,WAAW,EAAE,EAAE;AAAA,YACvD,UAAU,CAAC,QAAQ;AAAA,UACrB;AAAA,QACF;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,OAAO;AAAA,UACP,aACE;AAAA,UACF,YAAY;AAAA,YACV,MAAM;AAAA,YACN,YAAY;AAAA,cACV,QAAQ,EAAE,MAAM,UAAU,WAAW,EAAE;AAAA,cACvC,aAAa,EAAE,MAAM,UAAU,WAAW,EAAE;AAAA,YAC9C;AAAA,YACA,UAAU,CAAC,UAAU,aAAa;AAAA,UACpC;AAAA,UACA,KAAK;AAAA,UACL,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,OAAO;AAAA,UACP,aAAa;AAAA,UACb,YAAY;AAAA,YACV,MAAM;AAAA,YACN,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,WAAW,EAAE,EAAE;AAAA,YACtD,UAAU,CAAC,OAAO;AAAA,UACpB;AAAA,UACA,KAAK;AAAA,UACL,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,OAAO;AAAA,UACP,aACE;AAAA,UACF,YAAY;AAAA,YACV,MAAM;AAAA,YACN,YAAY;AAAA,cACV,QAAQ,EAAE,MAAM,UAAU,WAAW,EAAE;AAAA,cACvC,MAAM,EAAE,MAAM,UAAU,WAAW,EAAE;AAAA,cACrC,MAAM,EAAE,MAAM,UAAU,WAAW,EAAE;AAAA,YACvC;AAAA,YACA,UAAU,CAAC,UAAU,MAAM;AAAA,UAC7B;AAAA,UACA,KAAK;AAAA,UACL,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,OAAO;AAAA,UACP,aACE;AAAA,UACF,YAAY;AAAA,YACV,MAAM;AAAA,YACN,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,WAAW,EAAE,EAAE;AAAA,YAC5D,UAAU,CAAC,aAAa;AAAA,UAC1B;AAAA,UACA,KAAK;AAAA,UACL,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,OAAO;AAAA,UACP,aACE;AAAA,UACF,YAAY;AAAA,YACV,MAAM;AAAA,YACN,YAAY;AAAA,cACV,aAAa,EAAE,MAAM,UAAU,WAAW,EAAE;AAAA,cAC5C,OAAO,EAAE,MAAM,UAAU,WAAW,EAAE;AAAA,cACtC,MAAM,EAAE,MAAM,UAAU,MAAM,CAAC,SAAS,SAAS,QAAQ,EAAE;AAAA,YAC7D;AAAA,YACA,UAAU,CAAC,eAAe,OAAO;AAAA,UACnC;AAAA,UACA,KAAK;AAAA,UACL,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,OAAO;AAAA,UACP,aACE;AAAA,UACF,YAAY;AAAA,YACV,MAAM;AAAA,YACN,YAAY;AAAA,cACV,aAAa,EAAE,MAAM,UAAU,WAAW,EAAE;AAAA,cAC5C,QAAQ,EAAE,MAAM,UAAU,WAAW,EAAE;AAAA,YACzC;AAAA,YACA,UAAU,CAAC,eAAe,QAAQ;AAAA,UACpC;AAAA,UACA,KAAK;AAAA,UACL,gBAAgB;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,YAAY,KAAyD;AACzE,UAAI,IAAI,mBAAmB,gBAAgB;AACzC,cAAM,QAAQ,cAAc,IAAI,MAAM,OAAO;AAC7C,cAAM,SAAS,MAAM,OAAO,YAAY,KAAK;AAC7C,eAAO,EAAE,MAAM,QAAQ,WAAW,KAAK,IAAI,EAAE;AAAA,MAC/C;AACA,UAAI,IAAI,mBAAmB,YAAY;AACrC,cAAM,SAAS,cAAc,IAAI,MAAM,QAAQ;AAC/C,cAAM,OAAO,MAAM,OAAO,QAAQ,MAAM;AACxC,eAAO,EAAE,MAAM,MAAM,WAAW,KAAK,IAAI,EAAE;AAAA,MAC7C;AACA,UAAI,IAAI,mBAAmB,mBAAmB;AAC5C,cAAM,SAAS,cAAc,IAAI,MAAM,QAAQ;AAC/C,cAAM,aAAa,MAAM,OAAO,eAAe,MAAM;AACrD,eAAO,EAAE,MAAM,EAAE,WAAW,GAAG,WAAW,KAAK,IAAI,EAAE;AAAA,MACvD;AACA,YAAM,IAAI,MAAM,sCAAsC,IAAI,cAAc,EAAE;AAAA,IAC5E;AAAA,IAEA,MAAM,gBAAgB,KAA6D;AACjF,UAAI,IAAI,mBAAmB,oBAAoB;AAC7C,cAAM,SAAS,cAAc,IAAI,MAAM,QAAQ;AAC/C,cAAM,cAAc,cAAc,IAAI,MAAM,aAAa;AACzD,cAAM,SAAS,MAAM,OAAO,gBAAgB,QAAQ,WAAW;AAC/D,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,aAAa,KAAK,IAAI;AAAA,UACtB,kBAAkB;AAAA,QACpB;AAAA,MACF;AACA,UAAI,IAAI,mBAAmB,kBAAkB;AAC3C,cAAM,QAAQ,cAAc,IAAI,MAAM,OAAO;AAC7C,cAAM,OAAO,cAAc,KAAK;AAChC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,MAAM,EAAE,IAAI,KAAK;AAAA,UACjB,aAAa,KAAK,IAAI;AAAA,UACtB,kBAAkB;AAAA,QACpB;AAAA,MACF;AACA,UAAI,IAAI,mBAAmB,qBAAqB;AAC9C,cAAM,SAAS,cAAc,IAAI,MAAM,QAAQ;AAC/C,cAAM,OAAO,cAAc,IAAI,MAAM,MAAM;AAC3C,cAAM,OAAO,sBAAsB,IAAI,MAAM,MAAM;AACnD,cAAM,YAAY,MAAM,OAAO,gBAAgB,QAAQ,EAAE,MAAM,KAAK,CAAC;AACrE,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,aAAa,KAAK,IAAI;AAAA,UACtB,kBAAkB;AAAA,QACpB;AAAA,MACF;AACA,UAAI,IAAI,mBAAmB,qBAAqB;AAC9C,cAAM,cAAc,cAAc,IAAI,MAAM,aAAa;AACzD,cAAM,OAAO,gBAAgB,WAAW;AACxC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,MAAM,EAAE,IAAI,MAAM,YAAY;AAAA,UAC9B,aAAa,KAAK,IAAI;AAAA,UACtB,kBAAkB;AAAA,QACpB;AAAA,MACF;AACA,UAAI,IAAI,mBAAmB,kBAAkB;AAC3C,cAAM,cAAc,cAAc,IAAI,MAAM,aAAa;AACzD,cAAM,QAAQ,cAAc,IAAI,MAAM,OAAO;AAC7C,cAAM,OAAO,iBAAiB,IAAI,MAAM,MAAM;AAC9C,cAAM,aAAa,MAAM,OAAO,aAAa,aAAa,OAAO,IAAI;AACrE,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,aAAa,KAAK,IAAI;AAAA,UACtB,kBAAkB;AAAA,QACpB;AAAA,MACF;AACA,UAAI,IAAI,mBAAmB,kBAAkB;AAC3C,cAAM,cAAc,cAAc,IAAI,MAAM,aAAa;AACzD,cAAM,SAAS,cAAc,IAAI,MAAM,QAAQ;AAC/C,cAAM,OAAO,aAAa,aAAa,MAAM;AAC7C,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,MAAM,EAAE,IAAI,MAAM,aAAa,OAAO;AAAA,UACtC,aAAa,KAAK,IAAI;AAAA,UACtB,kBAAkB;AAAA,QACpB;AAAA,MACF;AACA,YAAM,IAAI,MAAM,0CAA0C,IAAI,cAAc,EAAE;AAAA,IAChF;AAAA,IAEA,MAAM,KAAK,QAAQ;AACjB,UAAI;AAGF,cAAM,KAAK,MAAM,OAAO,KAAK;AAC7B,YAAI,CAAC,GAAI,QAAO,EAAE,IAAI,OAAO,QAAQ,2CAA2C;AAChF,eAAO,EAAE,IAAI,KAAK;AAAA,MACpB,SAAS,KAAK;AACZ,YAAI,eAAe,oBAAoB;AACrC,iBAAO,EAAE,IAAI,OAAO,QAAQ,4DAAuD;AAAA,QACrF;AACA,eAAO,EAAE,IAAI,OAAO,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AA6CO,SAAS,2BAA2B,OAA8B,CAAC,GAAyB;AACjG,QAAM,WAAW,KAAK,WAAW,6BAA6B,QAAQ,QAAQ,EAAE;AAChF,QAAM,eAAe,KAAK;AAC1B,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,YAAY,KAAK,aAAa;AAEpC,WAAS,aAAqC;AAC5C,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,gBAAgB;AAAA,MAChB,eAAe,UAAU,YAAY;AAAA,MACrC,kBAAkB;AAAA,IACpB;AAAA,EACF;AAEA,iBAAe,UAAU,MAAc,MAAsC;AAC3E,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,UAAU,GAAG,OAAO,GAAG,IAAI,IAAI;AAAA,QACzC,GAAG;AAAA,QACH,QAAQ,KAAK,UAAU,YAAY,QAAQ,SAAS;AAAA,MACtD,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,IAAI;AAAA,QACR,yBAAyB,IAAI;AAAA,QAC7B,EAAE,OAAO,IAAI;AAAA,MACf;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,gBAAgB,KAAgC;AAC7D,QAAI;AACF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,KAAK,KAAK,EAAE,MAAM,GAAG,GAAG;AAAA,IACjC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,iBAAe,aAAa,OAAiD;AAC3E,UAAM,MAAM,MAAM,UAAU,mBAAmB;AAAA,MAC7C,QAAQ;AAAA,MACR,SAAS,WAAW;AAAA,MACpB,MAAM,KAAK,UAAU,EAAE,KAAK,MAAM,CAAC;AAAA,IACrC,CAAC;AACD,QAAI,IAAI,WAAW,KAAK;AAItB,aAAO,EAAE,OAAO,OAAO,QAAQ,wBAAwB;AAAA,IACzD;AACA,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,IAAI;AAAA,QACR,uCAAuC,IAAI,MAAM,KAAK,MAAM,gBAAgB,GAAG,CAAC;AAAA,QAChF,EAAE,QAAQ,IAAI,OAAO;AAAA,MACvB;AAAA,IACF;AACA,UAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAY/C,QAAI,CAAC,QAAQ,OAAO,KAAK,UAAU,WAAW;AAC5C,aAAO,EAAE,OAAO,OAAO,QAAQ,YAAY;AAAA,IAC7C;AACA,QAAI,CAAC,KAAK,SAAS,CAAC,KAAK,QAAQ;AAC/B,aAAO,EAAE,OAAO,OAAO,QAAQ,UAAU;AAAA,IAC3C;AACA,UAAM,SAAS,MAAM,QAAQ,KAAK,aAAa,IAC3C,KAAK,cAAc,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IAC/E,CAAC;AACL,QAAI,KAAK,QAAS,QAAO,KAAK,WAAW,KAAK,OAAO,EAAE;AACvD,UAAM,YACJ,OAAO,KAAK,cAAc,YAAY,KAAK,YACvC,KAAK,MAAM,KAAK,SAAS,IACzB;AACN,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,QAAQ,KAAK;AAAA,MACb,aAAa,KAAK,cAAc,UAAU,KAAK,UAAU,KAAK,UAAU,KAAK;AAAA,MAC7E,WAAW,KAAK,aAAa;AAAA,MAC7B;AAAA,MACA,GAAI,OAAO,SAAS,SAAS,IAAI,EAAE,UAA+B,IAAI,CAAC;AAAA,MACvE,GAAI,KAAK,QAAQ,EAAE,cAAc,KAAK,MAAM,IAAI,CAAC;AAAA,MACjD,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAClD;AAAA,EACF;AAEA,iBAAe,cAAc,OAAiD;AAO5E,UAAM,MAAM,MAAM,UAAU,yBAAyB;AAAA,MACnD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,eAAe,UAAU,KAAK;AAAA,MAChC;AAAA,IACF,CAAC;AACD,QAAI,IAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAC5C,aAAO,EAAE,OAAO,OAAO,QAAQ,UAAU;AAAA,IAC3C;AACA,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,IAAI;AAAA,QACR,6CAA6C,IAAI,MAAM,KAAK,MAAM,gBAAgB,GAAG,CAAC;AAAA,QACtF,EAAE,QAAQ,IAAI,OAAO;AAAA,MACvB;AAAA,IACF;AACA,UAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAM/C,QAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,OAAO,KAAK,KAAK,OAAO,UAAU;AAC3D,aAAO,EAAE,OAAO,OAAO,QAAQ,UAAU;AAAA,IAC3C;AACA,UAAM,eAAe,KAAK,SAAS;AACnC,UAAM,YAAY,eAAe,KAAK,MAAM,YAAY,IAAI;AAC5D,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,QAAQ,KAAK,KAAK;AAAA,MAClB,aAAa,KAAK,SAAS,gBAAgB,KAAK,KAAK;AAAA,MACrD,WAAW,KAAK,SAAS,eAAe,SAAS;AAAA,MACjD,QAAQ,CAAC;AAAA,MACT,GAAI,OAAO,SAAS,SAAS,IAAI,EAAE,UAAU,IAAI,CAAC;AAAA,MAClD,GAAI,KAAK,SAAS,KAAK,EAAE,cAAc,KAAK,QAAQ,GAAG,IAAI,CAAC;AAAA,IAC9D;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,YAAY,OAAiD;AACjE,UAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,eAAO,EAAE,OAAO,OAAO,QAAQ,YAAY;AAAA,MAC7C;AACA,UAAI,MAAM,WAAW,2BAA2B,GAAG;AAMjD,eAAO,EAAE,OAAO,OAAO,QAAQ,wBAAwB;AAAA,MACzD;AACA,UAAI,MAAM,WAAW,qBAAqB,GAAG;AAC3C,eAAO,aAAa,KAAK;AAAA,MAC3B;AAMA,aAAO,cAAc,KAAK;AAAA,IAC5B;AAAA,IAEA,MAAM,QAAQ,QAA4C;AACxD,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,+BAA+B,gDAAgD;AAAA,MAC3F;AACA,YAAM,MAAM,MAAM,UAAU,aAAa,mBAAmB,MAAM,CAAC,IAAI;AAAA,QACrE,QAAQ;AAAA,QACR,SAAS,WAAW;AAAA,MACtB,CAAC;AACD,UAAI,IAAI,WAAW,KAAK;AACtB,cAAM,IAAI,+BAA+B,mBAAmB,MAAM,cAAc,EAAE,QAAQ,IAAI,CAAC;AAAA,MACjG;AACA,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,wBAAwB,MAAM,aAAa,IAAI,MAAM,KAAK,MAAM,gBAAgB,GAAG,CAAC;AAAA,UACpF,EAAE,QAAQ,IAAI,OAAO;AAAA,QACvB;AAAA,MACF;AACA,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAG/C,YAAM,OAAO,MAAM;AACnB,UAAI,CAAC,QAAQ,OAAO,KAAK,OAAO,UAAU;AACxC,cAAM,IAAI,+BAA+B,oDAAoD;AAAA,MAC/F;AACA,aAAO;AAAA,QACL,IAAI,KAAK;AAAA,QACT,GAAI,OAAO,KAAK,UAAU,WAAW,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,QAC9D,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,QACrD,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,MAC1D;AAAA,IACF;AAAA,IAEA,MAAM,eAAe,QAAmD;AACtE,YAAM,MAAM,MAAM,UAAU,aAAa;AAAA,QACvC,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,WAAW,GAAG,sBAAsB,OAAO;AAAA,MAC3D,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,iCAAiC,IAAI,MAAM,KAAK,MAAM,gBAAgB,GAAG,CAAC;AAAA,UAC1E,EAAE,QAAQ,IAAI,OAAO;AAAA,QACvB;AAAA,MACF;AACA,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAY/C,YAAM,OAAO,MAAM,QAAQ,MAAM,IAAI,IAAI,KAAM,OAAO,CAAC;AACvD,YAAM,aAAuC,CAAC;AAC9C,iBAAW,OAAO,MAAM;AACtB,YAAI,CAAC,OAAO,OAAO,IAAI,OAAO,YAAY,OAAO,IAAI,SAAS,SAAU;AACxE,cAAM,OACJ,IAAI,SAAS,WAAW,IAAI,SAAS,UAAU,IAAI,OAAO;AAC5D,cAAM,SAAS,MAAM,QAAQ,IAAI,MAAM,IACnC,IAAI,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IACvE,CAAC;AACL,mBAAW,KAAK;AAAA,UACd,IAAI,IAAI;AAAA,UACR,MAAM,IAAI;AAAA,UACV;AAAA,UACA,YAAY,QAAQ,IAAI,UAAU,KAAK,IAAI,OAAO;AAAA,UAClD;AAAA,QACF,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,gBAAgB,QAAQ,aAAa;AACzC,YAAM,aAAa,MAAM,KAAK,eAAe,MAAM;AACnD,YAAM,QAAQ,WAAW,KAAK,CAAC,MAAM,EAAE,OAAO,WAAW;AACzD,UAAI,CAAC,OAAO;AACV,cAAM,IAAI;AAAA,UACR,wBAAwB,WAAW,uBAAuB,MAAM;AAAA,UAChE,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,aAAO,EAAE,IAAI,MAAM,aAAa,MAAM,IAAI,QAAQ,MAAM,OAAO;AAAA,IACjE;AAAA,IAEA,MAAM,cAAc,OAA8B;AAChD,UAAI,CAAC,MAAO;AACZ,UAAI,MAAM,WAAW,2BAA2B,GAAG;AACjD,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,UAAI,MAAM,WAAW,qBAAqB,GAAG;AAI3C,cAAM,IAAI,MAAM,aAAa,KAAK;AAClC,YAAI,CAAC,EAAE,SAAS,CAAC,EAAE,aAAc;AACjC,cAAMA,OAAM,MAAM,UAAU,YAAY,mBAAmB,EAAE,YAAY,CAAC,IAAI;AAAA,UAC5E,QAAQ;AAAA,UACR,SAAS,WAAW;AAAA,QACtB,CAAC;AACD,YAAIA,KAAI,WAAW,IAAK;AACxB,YAAI,CAACA,KAAI,IAAI;AACX,gBAAM,IAAI;AAAA,YACR,8BAA8B,EAAE,YAAY,aAAaA,KAAI,MAAM,KAAK,MAAM,gBAAgBA,IAAG,CAAC;AAAA,YAClG,EAAE,QAAQA,KAAI,OAAO;AAAA,UACvB;AAAA,QACF;AACA;AAAA,MACF;AAGA,YAAM,MAAM,MAAM,UAAU,sBAAsB;AAAA,QAChD,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,eAAe,UAAU,KAAK;AAAA,QAChC;AAAA,QACA,MAAM;AAAA,MACR,CAAC;AAGD,UAAI,IAAI,UAAU,KAAK;AACrB,cAAM,IAAI;AAAA,UACR,0CAA0C,IAAI,MAAM,KAAK,MAAM,gBAAgB,GAAG,CAAC;AAAA,UACnF,EAAE,QAAQ,IAAI,OAAO;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,gBAAgB,QAAQ,MAAM;AAClC,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,MAAM,MAAM,UAAU,aAAa;AAAA,QACvC,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,WAAW,GAAG,sBAAsB,OAAO;AAAA,QACzD,MAAM,KAAK,UAAU;AAAA,UACnB,MAAM,KAAK;AAAA,UACX,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,QACzC,CAAC;AAAA,MACH,CAAC;AACD,UAAI,IAAI,WAAW,KAAK;AACtB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,sCAAsC,IAAI,MAAM,KAAK,MAAM,gBAAgB,GAAG,CAAC;AAAA,UAC/E,EAAE,QAAQ,IAAI,OAAO;AAAA,QACvB;AAAA,MACF;AACA,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAM/C,YAAM,OAAO,MAAM;AACnB,UAAI,CAAC,QAAQ,OAAO,KAAK,OAAO,YAAY,OAAO,KAAK,SAAS,UAAU;AACzE,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,OACJ,KAAK,SAAS,WAAW,KAAK,SAAS,UAAU,KAAK,OAAO;AAC/D,YAAM,SAAS,MAAM,QAAQ,KAAK,MAAM,IACpC,KAAK,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IACxE,CAAC;AACL,aAAO;AAAA,QACL,IAAI,KAAK;AAAA,QACT,MAAM,KAAK;AAAA,QACX;AAAA,QACA,YAAY,QAAQ,KAAK,UAAU,KAAK,KAAK,OAAO;AAAA,QACpD;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,gBAAgB,aAAa;AACjC,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,MAAM,MAAM,UAAU,aAAa,mBAAmB,WAAW,CAAC,IAAI;AAAA,QAC1E,QAAQ;AAAA,QACR,SAAS,WAAW;AAAA,MACtB,CAAC;AACD,UAAI,IAAI,WAAW,KAAK;AACtB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,IAAI,WAAW,IAAK;AACxB,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,+BAA+B,WAAW,aAAa,IAAI,MAAM,KAAK,MAAM,gBAAgB,GAAG,CAAC;AAAA,UAChG,EAAE,QAAQ,IAAI,OAAO;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,aAAa,OAAO,MAAM;AAC3C,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,OAAO;AACV,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,MAAM,MAAM;AAAA,QAChB,aAAa,mBAAmB,WAAW,CAAC;AAAA,QAC5C;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,WAAW;AAAA,UACpB,MAAM,KAAK,UAAU;AAAA,YACnB;AAAA,YACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,UACzB,CAAC;AAAA,QACH;AAAA,MACF;AACA,UAAI,IAAI,WAAW,KAAK;AACtB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,6BAA6B,WAAW,yBAAyB,IAAI,MAAM,KAAK,MAAM,gBAAgB,GAAG,CAAC;AAAA,UAC1G,EAAE,QAAQ,IAAI,OAAO;AAAA,QACvB;AAAA,MACF;AACA,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAa/C,YAAM,OAAO,MAAM;AACnB,UAAI,CAAC,QAAQ,OAAO,KAAK,OAAO,UAAU;AACxC,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,eACJ,KAAK,SAAS,WAAW,KAAK,SAAS,UAAU,KAAK,OAAO;AAC/D,YAAM,SACJ,KAAK,WAAW,cAAc,KAAK,WAAW,YAAY,KAAK,SAAS;AAC1E,aAAO;AAAA,QACL,IAAI,KAAK;AAAA,QACT,aAAa,KAAK,eAAe,KAAK,UAAU;AAAA,QAChD,OAAO,KAAK,SAAS;AAAA,QACrB,MAAM;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,aAAa,QAAQ;AACtC,UAAI,CAAC,eAAe,CAAC,QAAQ;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,MAAM,MAAM;AAAA,QAChB,aAAa,mBAAmB,WAAW,CAAC,YAAY,mBAAmB,MAAM,CAAC;AAAA,QAClF;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,WAAW;AAAA,QACtB;AAAA,MACF;AACA,UAAI,IAAI,WAAW,KAAK;AACtB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,IAAI,WAAW,IAAK;AACxB,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,+BAA+B,WAAW,YAAY,MAAM,aAAa,IAAI,MAAM,KAAK,MAAM,gBAAgB,GAAG,CAAC;AAAA,UAClH,EAAE,QAAQ,IAAI,OAAO;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,OAAyB;AAC7B,YAAM,MAAM,MAAM,UAAU,WAAW,EAAE,QAAQ,MAAM,CAAC;AACxD,aAAO,IAAI;AAAA,IACb;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAA+B,KAAqB;AACzE,QAAM,QAAQ,KAAK,GAAG;AACtB,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO;AACvC,UAAM,IAAI,MAAM,yCAAyC,GAAG,GAAG;AAAA,EACjE;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,MAA+B,KAAiC;AAC7F,QAAM,QAAQ,KAAK,GAAG;AACtB,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,MAAO,QAAO;AAChD,SAAO;AACT;AAEA,SAAS,iBACP,MACA,KAC4C;AAC5C,QAAM,QAAQ,KAAK,GAAG;AACtB,MAAI,UAAU,WAAW,UAAU,WAAW,UAAU,SAAU,QAAO;AACzE,SAAO;AACT;","names":["res"]}