apcore-cli 0.7.0 → 0.8.0

package/dist/bin/apcore-cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../node_modules/.pnpm/tsup@8.5.1_postcss@8.5.8_typescript@5.9.3/node_modules/tsup/assets/esm_shims.js","../../src/errors.ts","../../src/security/sandbox.ts","../../src/ref-resolver.ts","../../src/schema-parser.ts","../../src/approval.ts","../../src/output.ts","../../src/logger.ts","../../src/init-cmd.ts","../../src/display-helpers.ts","../../src/config.ts","../../src/shell.ts","../../src/security/audit.ts","../../src/security/config-encryptor.ts","../../src/security/auth.ts","../../src/security/index.ts","../../src/discovery.ts","../../src/system-cmd.ts","../../src/strategy.ts","../../src/builtin-group.ts","../../src/exposure.ts","../../src/canonical-help.ts","../../src/main.ts","../../bin/apcore-cli.ts"],"sourcesContent":["// Shim globals in esm bundle\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nconst getFilename = () => fileURLToPath(import.meta.url)\nconst getDirname = () => path.dirname(getFilename())\n\nexport const __dirname = /* @__PURE__ */ getDirname()\nexport const __filename = /* @__PURE__ */ getFilename()\n","/**\n * Error classes and exit code mapping for apcore-cli.\n *\n * Protocol spec: Error handling & exit codes\n */\n\n// ---------------------------------------------------------------------------\n// Error classes\n// ---------------------------------------------------------------------------\n\n/** Thrown when the user does not approve module execution within the timeout. */\nexport class ApprovalTimeoutError extends Error {\n  constructor(message = \"Approval timed out\") {\n    super(message);\n    this.name = \"ApprovalTimeoutError\";\n  }\n}\n\n/** Thrown when API key authentication fails or is missing. */\nexport class AuthenticationError extends Error {\n  constructor(message = \"Authentication failed\") {\n    super(message);\n    this.name = \"AuthenticationError\";\n  }\n}\n\n/** Thrown when encrypted config cannot be decrypted. */\nexport class ConfigDecryptionError extends Error {\n  constructor(message = \"Config decryption failed\") {\n    super(message);\n    this.name = \"ConfigDecryptionError\";\n  }\n}\n\n/** Thrown when module execution fails. */\nexport class ModuleExecutionError extends Error {\n  constructor(message = \"Module execution failed\") {\n    super(message);\n    this.name = \"ModuleExecutionError\";\n  }\n}\n\n/** Thrown when approval is denied by the user. */\nexport class ApprovalDeniedError extends Error {\n  constructor(message = \"Approval denied\") {\n    super(message);\n    this.name = \"ApprovalDeniedError\";\n  }\n}\n\n/** Thrown when schema validation fails. */\nexport class SchemaValidationError extends Error {\n  constructor(message = \"Schema validation failed\") {\n    super(message);\n    this.name = \"SchemaValidationError\";\n  }\n}\n\n/** Thrown when a module is not found. */\nexport class ModuleNotFoundError extends Error {\n  constructor(message = \"Module not found\") {\n    super(message);\n    this.name = \"ModuleNotFoundError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Exit code map\n// ---------------------------------------------------------------------------\n\nexport const EXIT_CODES = {\n  SUCCESS: 0,\n  MODULE_EXECUTE_ERROR: 1,\n  MODULE_TIMEOUT: 1,\n  INVALID_CLI_INPUT: 2,\n  MODULE_NOT_FOUND: 44,\n  MODULE_LOAD_ERROR: 44,\n  MODULE_DISABLED: 44,\n  DEPENDENCY_NOT_FOUND: 44,\n  DEPENDENCY_VERSION_MISMATCH: 44,\n  SCHEMA_VALIDATION_ERROR: 45,\n  APPROVAL_DENIED: 46,\n  APPROVAL_TIMEOUT: 46,\n  CONFIG_NOT_FOUND: 47,\n  CONFIG_INVALID: 47,\n  SCHEMA_CIRCULAR_REF: 48,\n  ACL_DENIED: 77,\n  // Config Bus errors (apcore >= 0.15.0)\n  CONFIG_NAMESPACE_RESERVED: 78,\n  CONFIG_NAMESPACE_DUPLICATE: 78,\n  CONFIG_ENV_PREFIX_CONFLICT: 78,\n  CONFIG_ENV_MAP_CONFLICT: 78,\n  CONFIG_MOUNT_ERROR: 66,\n  CONFIG_BIND_ERROR: 65,\n  ERROR_FORMATTER_DUPLICATE: 70,\n  KEYBOARD_INTERRUPT: 130,\n} as const;\n\nexport type ExitCode = (typeof EXIT_CODES)[keyof typeof EXIT_CODES];\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Map a caught error to the appropriate process exit code.\n * Also checks for apcore error codes on the error object.\n */\nexport function exitCodeForError(error: unknown): ExitCode {\n  if (error instanceof ApprovalTimeoutError) {\n    return EXIT_CODES.APPROVAL_TIMEOUT;\n  }\n  if (error instanceof ApprovalDeniedError) {\n    return EXIT_CODES.APPROVAL_DENIED;\n  }\n  if (error instanceof AuthenticationError) {\n    return EXIT_CODES.ACL_DENIED;\n  }\n  if (error instanceof ConfigDecryptionError) {\n    return EXIT_CODES.CONFIG_INVALID;\n  }\n  if (error instanceof SchemaValidationError) {\n    return EXIT_CODES.SCHEMA_VALIDATION_ERROR;\n  }\n  if (error instanceof ModuleNotFoundError) {\n    return EXIT_CODES.MODULE_NOT_FOUND;\n  }\n  if (error instanceof ModuleExecutionError) {\n    return EXIT_CODES.MODULE_EXECUTE_ERROR;\n  }\n\n  // Check for apcore error codes on the error object\n  if (error instanceof Error) {\n    const code = (error as unknown as Record<string, unknown>).code as string | undefined;\n    const codeMap: Record<string, ExitCode> = {\n      MODULE_NOT_FOUND: EXIT_CODES.MODULE_NOT_FOUND,\n      MODULE_LOAD_ERROR: EXIT_CODES.MODULE_LOAD_ERROR,\n      MODULE_DISABLED: EXIT_CODES.MODULE_DISABLED,\n      DEPENDENCY_NOT_FOUND: EXIT_CODES.DEPENDENCY_NOT_FOUND,\n      DEPENDENCY_VERSION_MISMATCH: EXIT_CODES.DEPENDENCY_VERSION_MISMATCH,\n      SCHEMA_VALIDATION_ERROR: EXIT_CODES.SCHEMA_VALIDATION_ERROR,\n      SCHEMA_CIRCULAR_REF: EXIT_CODES.SCHEMA_CIRCULAR_REF,\n      APPROVAL_DENIED: EXIT_CODES.APPROVAL_DENIED,\n      APPROVAL_TIMEOUT: EXIT_CODES.APPROVAL_TIMEOUT,\n      APPROVAL_PENDING: EXIT_CODES.APPROVAL_DENIED,\n      CONFIG_NOT_FOUND: EXIT_CODES.CONFIG_NOT_FOUND,\n      CONFIG_INVALID: EXIT_CODES.CONFIG_INVALID,\n      MODULE_EXECUTE_ERROR: EXIT_CODES.MODULE_EXECUTE_ERROR,\n      MODULE_TIMEOUT: EXIT_CODES.MODULE_TIMEOUT,\n      ACL_DENIED: EXIT_CODES.ACL_DENIED,\n      // Config Bus errors (apcore >= 0.15.0)\n      CONFIG_NAMESPACE_RESERVED: EXIT_CODES.CONFIG_NAMESPACE_RESERVED,\n      CONFIG_NAMESPACE_DUPLICATE: EXIT_CODES.CONFIG_NAMESPACE_DUPLICATE,\n      CONFIG_ENV_PREFIX_CONFLICT: EXIT_CODES.CONFIG_ENV_PREFIX_CONFLICT,\n      CONFIG_ENV_MAP_CONFLICT: EXIT_CODES.CONFIG_ENV_MAP_CONFLICT,\n      CONFIG_MOUNT_ERROR: EXIT_CODES.CONFIG_MOUNT_ERROR,\n      CONFIG_BIND_ERROR: EXIT_CODES.CONFIG_BIND_ERROR,\n      ERROR_FORMATTER_DUPLICATE: EXIT_CODES.ERROR_FORMATTER_DUPLICATE,\n    };\n    if (code && code in codeMap) {\n      return codeMap[code];\n    }\n  }\n\n  return EXIT_CODES.MODULE_EXECUTE_ERROR;\n}\n","/**\n * Sandbox — Subprocess isolation for module execution.\n *\n * Protocol spec: Security — sandboxed execution (tech-design §8.6.4).\n *\n * Uses a re-exec model: spawns `node <this-binary> --internal-sandbox-runner\n * <module_id>` with a stripped environment and isolated HOME/TMPDIR.\n * The child reads JSON from stdin, runs the module via a fresh\n * Registry+Executor, and writes JSON to stdout.\n */\n\nimport type { Executor } from \"../cli.js\";\nimport { ModuleExecutionError } from \"../errors.js\";\n\n// Environment forwarding strategy: allow PATH, LANG, LC_ALL + all APCORE_*\n// except APCORE_AUTH_* (credentials must not cross the trust boundary).\nconst SANDBOX_ALLOW_KEYS = [\"PATH\", \"LANG\", \"LC_ALL\"];\nconst SANDBOX_ALLOW_PREFIX = \"APCORE_\";\nconst SANDBOX_DENY_PREFIX = \"APCORE_AUTH_\";\n// Explicit deny-list for known credential keys (defense-in-depth mirroring Rust).\nconst SANDBOX_DENY_KEYS: readonly string[] = [\"APCORE_AUTH_API_KEY\"];\n\nconst SANDBOX_OUTPUT_SIZE_LIMIT = 64 * 1024 * 1024; // 64 MiB\n\n// ---------------------------------------------------------------------------\n// Sandbox\n// ---------------------------------------------------------------------------\n\n/**\n * Executes modules in an isolated subprocess to limit the blast radius\n * of untrusted or third-party modules.\n *\n * When disabled (the default), delegates directly to the Executor.\n * When enabled, spawns a restricted child process via re-exec with\n * `--internal-sandbox-runner <module_id>`.\n */\nexport class Sandbox {\n  private readonly enabled: boolean;\n  private readonly timeoutSeconds: number;\n\n  constructor(enabled = false, timeoutSeconds = 300) {\n    this.enabled = enabled;\n    this.timeoutSeconds = timeoutSeconds;\n  }\n\n  /**\n   * Execute a module, optionally inside a sandboxed subprocess.\n   */\n  async execute(\n    moduleId: string,\n    inputData: Record<string, unknown>,\n    executor: Executor,\n  ): Promise<unknown> {\n    if (!this.enabled) {\n      return executor.execute(moduleId, inputData);\n    }\n    return this._sandboxedExecute(moduleId, inputData);\n  }\n\n  private async _sandboxedExecute(\n    moduleId: string,\n    inputData: Record<string, unknown>,\n  ): Promise<unknown> {\n    const { spawn } = await import(\"node:child_process\");\n    const { tmpdir } = await import(\"node:os\");\n    const { join } = await import(\"node:path\");\n    const { mkdtempSync, rmSync } = await import(\"node:fs\");\n\n    const tmpDir = mkdtempSync(join(tmpdir(), \"apcore_sandbox_\"));\n\n    const env = buildSandboxEnv(tmpDir);\n    const binaryPath = process.argv[1];\n    const child = spawn(process.execPath, [binaryPath, \"--internal-sandbox-runner\", moduleId], {\n      env,\n      cwd: tmpDir,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    });\n\n    let stdout = \"\";\n    let stderr = \"\";\n    let totalBytes = 0;\n    let sizeExceeded = false;\n\n    child.stdout.on(\"data\", (chunk: Buffer) => {\n      totalBytes += chunk.length;\n      if (totalBytes > SANDBOX_OUTPUT_SIZE_LIMIT) {\n        sizeExceeded = true;\n        child.kill(\"SIGKILL\");\n        return;\n      }\n      stdout += chunk.toString();\n    });\n    child.stderr.on(\"data\", (chunk: Buffer) => {\n      stderr += chunk.toString();\n    });\n\n    child.stdin.write(JSON.stringify(inputData));\n    child.stdin.end();\n\n    return new Promise<unknown>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        child.kill(\"SIGKILL\");\n        reject(\n          new ModuleExecutionError(\n            `Sandbox module '${moduleId}' timed out after ${this.timeoutSeconds}s.`,\n          ),\n        );\n      }, this.timeoutSeconds * 1000);\n\n      child.on(\"close\", (code) => {\n        clearTimeout(timer);\n        try { rmSync(tmpDir, { recursive: true, force: true }); } catch { /* best-effort */ }\n\n        if (sizeExceeded) {\n          reject(new ModuleExecutionError(`Sandbox module '${moduleId}' output exceeded 64MiB limit.`));\n          return;\n        }\n        if (code !== 0) {\n          reject(new ModuleExecutionError(\n            `Sandbox module '${moduleId}' exited with code ${code}.${stderr ? ` stderr: ${stderr}` : \"\"}`,\n          ));\n          return;\n        }\n        try {\n          resolve(JSON.parse(stdout));\n        } catch {\n          reject(new ModuleExecutionError(\n            `Sandbox module '${moduleId}' returned non-JSON output: ${stdout.slice(0, 200)}`,\n          ));\n        }\n      });\n\n      child.on(\"error\", (err) => {\n        clearTimeout(timer);\n        reject(new ModuleExecutionError(`Failed to spawn sandbox process: ${err.message}`));\n      });\n    });\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Sandbox runner (invoked as a child process via --internal-sandbox-runner)\n// ---------------------------------------------------------------------------\n\n/**\n * Entry point for the sandbox child process.\n * Called when `--internal-sandbox-runner <module_id>` appears in argv.\n * Reads JSON from stdin, runs the module, writes JSON to stdout.\n */\nexport async function runSandboxRunner(moduleId: string): Promise<void> {\n  const extensionsRoot = process.env.APCORE_EXTENSIONS_ROOT ?? \"./extensions\";\n  // Dynamic import avoids circular deps and keeps the sandbox runner\n  // isolated from the host CLI initialization code.\n  const apcore = await import(\"apcore-js\").catch(() => {\n    process.stderr.write(\n      \"sandbox runner: apcore-js is not available in the sandboxed environment.\\n\",\n    );\n    process.exit(1);\n  });\n  if (!apcore) return;\n\n  let inputJson = \"\";\n  for await (const chunk of process.stdin) {\n    inputJson += chunk.toString();\n  }\n\n  let inputData: Record<string, unknown>;\n  try {\n    inputData = JSON.parse(inputJson);\n  } catch {\n    process.stderr.write(\"sandbox runner: failed to parse stdin as JSON.\\n\");\n    process.exit(1);\n    return;\n  }\n\n  const registry = new apcore.Registry({ extensionsDir: extensionsRoot });\n  await registry.discover();\n  const executor = new apcore.Executor({ registry });\n  try {\n    const result = await executor.call(moduleId, inputData);\n    process.stdout.write(JSON.stringify(result));\n    process.exit(0);\n  } catch (err: unknown) {\n    process.stderr.write(`sandbox runner error: ${err}\\n`);\n    process.exit(1);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nfunction buildSandboxEnv(tmpDir: string): NodeJS.ProcessEnv {\n  const env: NodeJS.ProcessEnv = {};\n  for (const key of SANDBOX_ALLOW_KEYS) {\n    if (process.env[key]) env[key] = process.env[key];\n  }\n  for (const [key, val] of Object.entries(process.env)) {\n    if (\n      key.startsWith(SANDBOX_ALLOW_PREFIX) &&\n      !key.startsWith(SANDBOX_DENY_PREFIX) &&\n      !(SANDBOX_DENY_KEYS as readonly string[]).includes(key)\n    ) {\n      env[key] = val;\n    }\n  }\n  env.HOME = tmpDir;\n  env.TMPDIR = tmpDir;\n  return env;\n}\n","/**\n * JSON Schema $ref resolver.\n *\n * Protocol spec: Schema resolution & $ref handling\n */\n\nimport { EXIT_CODES } from \"./errors.js\";\n\n// ---------------------------------------------------------------------------\n// resolveRefs\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve all $ref references in a JSON Schema.\n * Returns a fully inlined schema with $defs/definitions removed.\n */\nexport function resolveRefs(\n  schema: Record<string, unknown>,\n  maxDepth = 32,\n  moduleId = \"\",\n): Record<string, unknown> {\n  const cloned = structuredClone(schema);\n  const defs = (cloned.$defs ?? cloned.definitions ?? {}) as Record<\n    string,\n    unknown\n  >;\n  const result = resolveNode(\n    cloned,\n    defs,\n    new Set<string>(),\n    0,\n    maxDepth,\n    moduleId,\n  ) as Record<string, unknown>;\n\n  // Remove definition keys\n  delete result.$defs;\n  delete result.definitions;\n  return result;\n}\n\nfunction resolveNode(\n  node: unknown,\n  defs: Record<string, unknown>,\n  visited: Set<string>,\n  depth: number,\n  maxDepth: number,\n  moduleId: string,\n): unknown {\n  if (typeof node !== \"object\" || node === null || Array.isArray(node)) {\n    return node;\n  }\n\n  const obj = node as Record<string, unknown>;\n\n  // Handle $ref\n  if (\"$ref\" in obj) {\n    const refPath = obj.$ref as string;\n\n    if (depth >= maxDepth) {\n      process.stderr.write(\n        `Error: $ref resolution depth exceeded maximum of ${maxDepth} for module '${moduleId}'.\\n`,\n      );\n      process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);\n    }\n\n    if (visited.has(refPath)) {\n      process.stderr.write(\n        `Error: Circular $ref detected in schema for module '${moduleId}' at path '${refPath}'.\\n`,\n      );\n      process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);\n    }\n\n    // Parse ref target: extract key from \"#/$defs/Address\" → \"Address\"\n    const parts = refPath.split(\"/\");\n    const key = parts[parts.length - 1];\n\n    if (!(key in defs)) {\n      process.stderr.write(\n        `Error: Unresolvable $ref '${refPath}' in schema for module '${moduleId}'.\\n`,\n      );\n      process.exit(EXIT_CODES.SCHEMA_VALIDATION_ERROR);\n    }\n\n    const newVisited = new Set(visited);\n    newVisited.add(refPath);\n    return resolveNode(defs[key], defs, newVisited, depth + 1, maxDepth, moduleId);\n  }\n\n  // Handle allOf\n  if (\"allOf\" in obj && Array.isArray(obj.allOf)) {\n    const merged: Record<string, unknown> = {\n      properties: {},\n      required: [] as string[],\n    };\n    // Seed parent node's own properties/required BEFORE merging branches,\n    // so sibling fields are not silently dropped when a parent mixes\n    // top-level `properties` with `allOf` branches.\n    if (typeof obj.properties === \"object\" && obj.properties !== null) {\n      Object.assign(merged.properties as Record<string, unknown>, obj.properties);\n    }\n    if (Array.isArray(obj.required)) {\n      (merged.required as string[]).push(...(obj.required as string[]));\n    }\n    for (const subSchema of obj.allOf as unknown[]) {\n      const resolved = resolveNode(\n        subSchema,\n        defs,\n        visited,\n        depth + 1,\n        maxDepth,\n        moduleId,\n      ) as Record<string, unknown>;\n      if (resolved.properties) {\n        Object.assign(\n          merged.properties as Record<string, unknown>,\n          resolved.properties,\n        );\n      }\n      if (Array.isArray(resolved.required)) {\n        (merged.required as string[]).push(...resolved.required);\n      }\n    }\n    // Deduplicate required\n    merged.required = [...new Set(merged.required as string[])];\n    // Copy non-composition keys\n    for (const [k, v] of Object.entries(obj)) {\n      if (k !== \"allOf\" && !(k in merged)) {\n        merged[k] = v;\n      }\n    }\n    return merged;\n  }\n\n  // Handle anyOf / oneOf\n  for (const keyword of [\"anyOf\", \"oneOf\"]) {\n    if (keyword in obj && Array.isArray(obj[keyword])) {\n      const merged: Record<string, unknown> = {\n        properties: {},\n        required: [] as string[],\n      };\n      const allRequiredSets: Set<string>[] = [];\n      for (const subSchema of obj[keyword] as unknown[]) {\n        const resolved = resolveNode(\n          subSchema,\n          defs,\n          visited,\n          depth + 1,\n          maxDepth,\n          moduleId,\n        ) as Record<string, unknown>;\n        if (resolved.properties) {\n          Object.assign(\n            merged.properties as Record<string, unknown>,\n            resolved.properties,\n          );\n        }\n        if (Array.isArray(resolved.required)) {\n          allRequiredSets.push(new Set(resolved.required as string[]));\n        }\n      }\n      // Required = intersection of all branches\n      if (allRequiredSets.length > 0) {\n        let intersection = allRequiredSets[0];\n        for (let i = 1; i < allRequiredSets.length; i++) {\n          intersection = new Set(\n            [...intersection].filter((x) => allRequiredSets[i].has(x)),\n          );\n        }\n        merged.required = [...intersection];\n      } else {\n        merged.required = [];\n      }\n      // Copy non-composition keys\n      for (const [k, v] of Object.entries(obj)) {\n        if (k !== keyword && !(k in merged)) {\n          merged[k] = v;\n        }\n      }\n      return merged;\n    }\n  }\n\n  // Recursively process nested properties\n  if (\"properties\" in obj && typeof obj.properties === \"object\" && obj.properties !== null) {\n    const props = obj.properties as Record<string, unknown>;\n    for (const [propName, propSchema] of Object.entries(props)) {\n      props[propName] = resolveNode(\n        propSchema,\n        defs,\n        visited,\n        depth + 1,\n        maxDepth,\n        moduleId,\n      );\n    }\n  }\n\n  return obj;\n}\n","/**\n * JSON Schema -> Commander options mapping.\n *\n * Protocol spec: Schema-driven argument parsing\n */\n\nimport type { OptionConfig } from \"./main.js\";\nimport { EXIT_CODES } from \"./errors.js\";\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\n/** Sentinel type marker for boolean flags. */\nconst BOOLEAN_FLAG = Symbol(\"BOOLEAN_FLAG\");\n\ntype TypeResult = \"string\" | \"int\" | \"float\" | typeof BOOLEAN_FLAG | \"file\";\n\n/**\n * Map JSON Schema type to a type identifier.\n */\nexport function mapType(propName: string, propSchema: Record<string, unknown>): TypeResult {\n  const schemaType = propSchema.type as string | undefined;\n\n  // Check file convention\n  if (\n    schemaType === \"string\" &&\n    (propName.endsWith(\"_file\") || propSchema[\"x-cli-file\"] === true)\n  ) {\n    return \"file\";\n  }\n\n  const typeMap: Record<string, TypeResult> = {\n    string: \"string\",\n    integer: \"int\",\n    number: \"float\",\n    boolean: BOOLEAN_FLAG,\n    object: \"string\",\n    array: \"string\",\n  };\n\n  if (!schemaType) {\n    return \"string\";\n  }\n\n  return typeMap[schemaType] ?? \"string\";\n}\n\n/**\n * Extract help text from schema property, preferring x-llm-description.\n */\nexport function extractHelp(propSchema: Record<string, unknown>, maxLength = 1000): string | undefined {\n  let text = propSchema[\"x-llm-description\"] as string | undefined;\n  if (!text) {\n    text = propSchema.description as string | undefined;\n  }\n  if (!text) {\n    return undefined;\n  }\n  if (maxLength > 0 && text.length > maxLength) {\n    return text.slice(0, maxLength - 3) + \"...\";\n  }\n  return text;\n}\n\n// ---------------------------------------------------------------------------\n// schemaToCliOptions\n// ---------------------------------------------------------------------------\n\n/** Reserved CLI option names that cannot be used by schema properties. */\nconst RESERVED_NAMES = new Set([\n  \"input\", \"yes\", \"large_input\", \"format\", \"fields\", \"sandbox\",\n  \"verbose\", \"dry_run\", \"trace\", \"stream\", \"strategy\",\n  \"approval_timeout\", \"approval_token\",\n]);\n\n/**\n * Convert a JSON Schema `properties` object into an array of\n * Commander option configurations.\n */\nexport function schemaToCliOptions(\n  schema: Record<string, unknown>,\n  maxHelpLength = 1000,\n): OptionConfig[] {\n  const properties = (schema.properties ?? {}) as Record<\n    string,\n    Record<string, unknown>\n  >;\n  const requiredList = (schema.required ?? []) as string[];\n  const options: OptionConfig[] = [];\n  const flagNames: Record<string, string> = {};\n\n  for (const [propName, propSchema] of Object.entries(properties)) {\n    const flagName = \"--\" + propName.replace(/_/g, \"-\");\n\n    // Reserved name check (must precede collision check to match Python/Rust)\n    if (RESERVED_NAMES.has(propName)) {\n      process.stderr.write(\n        `Error: Module schema property '${propName}' conflicts with a reserved CLI option name. Rename the property.\\n`,\n      );\n      process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n    }\n\n    // Collision detection\n    if (flagName in flagNames) {\n      process.stderr.write(\n        `Error: Flag name collision: properties '${propName}' and '${flagNames[flagName]}' both map to '${flagName}'.\\n`,\n      );\n      process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n    }\n    flagNames[flagName] = propName;\n\n    const typeResult = mapType(propName, propSchema);\n    const isRequired = requiredList.includes(propName);\n    const helpBase = extractHelp(propSchema, maxHelpLength);\n    const helpText = isRequired\n      ? (helpBase ? helpBase + \" \" : \"\") + \"[required]\"\n      : helpBase ?? \"\";\n    const defaultValue = propSchema.default as unknown;\n\n    if (typeResult === BOOLEAN_FLAG) {\n      // Boolean flag pair: --flag/--no-flag\n      const flagBase = propName.replace(/_/g, \"-\");\n      // Cross-SDK parity (D11-005): Rust schema_parser.rs:272 also tracks\n      // the auto-generated `--no-<flag>` name in the collision map so a\n      // schema pairing a boolean ``force`` with a non-boolean ``no_force``\n      // is rejected at parse time. Without this, the second property\n      // silently shadows the negation flag.\n      const noFlag = `--no-${flagBase}`;\n      if (noFlag in flagNames) {\n        process.stderr.write(\n          `Error: Flag name collision: boolean property '${propName}' auto-generates '${noFlag}' which is already used by property '${flagNames[noFlag]}'.\\n`,\n        );\n        process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n      }\n      flagNames[noFlag] = propName;\n      const defaultVal = (propSchema.default as boolean) ?? false;\n      options.push({\n        name: propName,\n        flags: `--${flagBase}, --no-${flagBase}`,\n        description: helpText,\n        defaultValue: defaultVal,\n        required: isRequired,\n        isBooleanFlag: true,\n      });\n    } else if (\"enum\" in propSchema && Array.isArray(propSchema.enum)) {\n      const enumValues = propSchema.enum as unknown[];\n      if (enumValues.length === 0) {\n        // Empty enum — fall back to plain string option\n        options.push({\n          name: propName,\n          flags: `${flagName} <value>`,\n          description: helpText,\n          defaultValue,\n          required: isRequired,\n        });\n      } else {\n        const stringValues = enumValues.map(String);\n        const enumOriginalTypes: Record<string, string> = {};\n        for (const v of enumValues) {\n          if (typeof v === \"number\" && Number.isInteger(v)) {\n            enumOriginalTypes[String(v)] = \"int\";\n          } else if (typeof v === \"number\") {\n            enumOriginalTypes[String(v)] = \"float\";\n          } else if (typeof v === \"boolean\") {\n            enumOriginalTypes[String(v)] = \"bool\";\n          }\n        }\n        options.push({\n          name: propName,\n          flags: `${flagName} <value>`,\n          description: helpText,\n          defaultValue:\n            defaultValue !== undefined ? String(defaultValue) : undefined,\n          required: isRequired,\n          choices: stringValues,\n          enumOriginalTypes:\n            Object.keys(enumOriginalTypes).length > 0\n              ? enumOriginalTypes\n              : undefined,\n        });\n      }\n    } else {\n      // Standard option\n      let parseArg: ((value: string) => unknown) | undefined;\n      if (typeResult === \"int\") {\n        parseArg = (v: string) => {\n          const n = parseInt(v, 10);\n          if (isNaN(n)) throw new Error(`Invalid integer: ${v}`);\n          return n;\n        };\n      } else if (typeResult === \"float\") {\n        parseArg = (v: string) => {\n          const n = parseFloat(v);\n          if (isNaN(n)) throw new Error(`Invalid number: ${v}`);\n          return n;\n        };\n      }\n      options.push({\n        name: propName,\n        flags: `${flagName} <value>`,\n        description: helpText,\n        defaultValue,\n        required: isRequired,\n        parseArg,\n      });\n    }\n  }\n\n  return options;\n}\n","/**\n * Interactive approval prompts with timeout.\n *\n * Protocol spec: Approval workflow\n */\n\nimport * as readline from \"node:readline\";\nimport type { ModuleDescriptor } from \"./cli.js\";\nimport { ApprovalDeniedError, ApprovalTimeoutError } from \"./errors.js\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Get an annotation value from either a dict or an object.\n */\nfunction getAnnotation(\n  annotations: unknown,\n  key: string,\n  defaultValue: unknown = undefined,\n): unknown {\n  if (!annotations || typeof annotations !== \"object\") return defaultValue;\n  const ann = annotations as Record<string, unknown>;\n  return key in ann ? ann[key] : defaultValue;\n}\n\n/**\n * Read APCORE_CLI_APPROVAL_TIMEOUT env var (positive integer seconds).\n * Returns undefined on absent/empty/invalid values.\n */\nfunction readTimeoutFromEnv(): number | undefined {\n  const raw = process.env.APCORE_CLI_APPROVAL_TIMEOUT;\n  if (raw === undefined || raw === \"\") return undefined;\n  const parsed = parseInt(raw, 10);\n  if (!Number.isFinite(parsed) || parsed <= 0) return undefined;\n  return parsed;\n}\n\n// ---------------------------------------------------------------------------\n// CliApprovalHandler — implements apcore ApprovalHandler protocol (FE-11 §3.5)\n// ---------------------------------------------------------------------------\n\n/**\n * CLI ApprovalHandler that prompts in TTY, auto-denies in non-TTY.\n *\n * Implements the apcore ApprovalHandler protocol:\n * - `requestApproval(request) -> ApprovalResult`\n * - `checkApproval(approvalId) -> ApprovalResult`\n *\n * Pass to Executor via `executor.setApprovalHandler(handler)`.\n */\nexport class CliApprovalHandler {\n  autoApprove: boolean;\n  timeout: number;\n\n  constructor(autoApprove = false, timeout?: number) {\n    this.autoApprove = autoApprove;\n    const resolved = timeout ?? readTimeoutFromEnv() ?? 60;\n    this.timeout = Math.max(1, Math.min(resolved, 3600));\n  }\n\n  async requestApproval(request: Record<string, unknown>): Promise<Record<string, unknown>> {\n    const moduleId = (request.module_id as string) ?? \"unknown\";\n\n    if (this.autoApprove) {\n      return { status: \"approved\", approved_by: \"auto_approve\" };\n    }\n\n    const envVal = process.env.APCORE_CLI_AUTO_APPROVE ?? \"\";\n    if (envVal === \"1\") {\n      return { status: \"approved\", approved_by: \"env_auto_approve\" };\n    }\n    if (envVal !== \"\" && envVal !== \"1\") {\n      process.stderr.write(\n        `Warning: APCORE_CLI_AUTO_APPROVE is set to '${envVal}', expected '1'. Ignoring.\\n`,\n      );\n    }\n\n    if (!process.stdin.isTTY) {\n      return { status: \"rejected\", reason: \"Non-interactive session without --yes\" };\n    }\n\n    // TTY prompt\n    const annotations = request.annotations as Record<string, unknown> | undefined;\n    const extra = (annotations?.extra as Record<string, unknown>) ?? {};\n    const message = (extra.approval_message as string) ?? `Module '${moduleId}' requires approval to execute.`;\n\n    process.stderr.write(message + \"\\n\");\n    try {\n      await promptWithTimeout({ id: moduleId } as ModuleDescriptor, this.timeout);\n      return { status: \"approved\", approved_by: \"tty_user\" };\n    } catch {\n      return { status: \"rejected\", reason: \"User rejected or timed out\" };\n    }\n  }\n\n  async checkApproval(_approvalId: string): Promise<Record<string, unknown>> {\n    return { status: \"rejected\", reason: \"CLI does not support async approval polling\" };\n  }\n}\n\n// ---------------------------------------------------------------------------\n// checkApproval (legacy function wrapper)\n// ---------------------------------------------------------------------------\n\n/**\n * Check if module requires approval and handle accordingly.\n * Returns normally if approved (or approval not required).\n * Throws ApprovalDeniedError or ApprovalTimeoutError on denial/timeout so the\n * caller (buildModuleCommand action) can run audit flush and tear-down before\n * the process exits via the shared error path.\n */\nexport async function checkApproval(\n  moduleDef: ModuleDescriptor,\n  autoApprove: boolean,\n  timeout?: number,\n): Promise<void> {\n  const annotations = moduleDef.annotations;\n\n  // Check if approval is required\n  let requiresApproval: boolean;\n  if (moduleDef.requiresApproval !== undefined) {\n    requiresApproval = moduleDef.requiresApproval;\n  } else if (annotations) {\n    requiresApproval = getAnnotation(annotations, \"requires_approval\", false) === true;\n  } else {\n    return; // No annotations, no approval needed\n  }\n\n  if (!requiresApproval) {\n    return;\n  }\n\n  const moduleId = moduleDef.id;\n\n  // Bypass: autoApprove flag (highest priority)\n  if (autoApprove) {\n    return;\n  }\n\n  // Bypass: APCORE_CLI_AUTO_APPROVE env var\n  const envVal = process.env.APCORE_CLI_AUTO_APPROVE ?? \"\";\n  if (envVal === \"1\") {\n    return;\n  }\n  if (envVal !== \"\" && envVal !== \"1\") {\n    process.stderr.write(\n      `Warning: APCORE_CLI_AUTO_APPROVE is set to '${envVal}', expected '1'. Ignoring.\\n`,\n    );\n  }\n\n  // Non-TTY check — throw so caller can audit-flush before exit\n  if (!process.stdin.isTTY) {\n    throw new ApprovalDeniedError(\n      `Module '${moduleId}' requires approval but no interactive terminal is available. ` +\n        \"Use --yes or set APCORE_CLI_AUTO_APPROVE=1 to bypass.\",\n    );\n  }\n\n  // TTY prompt — throws on deny/timeout\n  const effectiveTimeout = timeout ?? readTimeoutFromEnv() ?? 60;\n  await promptWithTimeout(moduleDef, effectiveTimeout);\n}\n\n/**\n * Display approval prompt with timeout.\n */\nasync function promptWithTimeout(\n  moduleDef: ModuleDescriptor,\n  timeout: number,\n): Promise<void> {\n  // Clamp timeout\n  timeout = Math.max(1, Math.min(timeout, 3600));\n\n  const moduleId = moduleDef.id;\n  const annotations = moduleDef.annotations;\n  const message =\n    (annotations\n      ? (getAnnotation(annotations, \"approval_message\") as string | undefined)\n      : undefined) ??\n    `Module '${moduleId}' requires approval to execute.`;\n\n  process.stderr.write(message + \"\\n\");\n\n  const rl = readline.createInterface({\n    input: process.stdin,\n    output: process.stderr,\n  });\n\n  let timer: ReturnType<typeof setTimeout> | undefined;\n\n  try {\n    const answer = await Promise.race([\n      new Promise<string>((resolve) => {\n        rl.question(\"Proceed? [y/N] \", (ans) => resolve(ans));\n      }),\n      new Promise<never>((_, reject) => {\n        timer = setTimeout(() => {\n          reject(new ApprovalTimeoutError(\n            `Approval prompt timed out after ${timeout} seconds.`,\n          ));\n        }, timeout * 1000);\n      }),\n    ]);\n\n    // Clear the timeout — prompt resolved before timeout fired\n    if (timer) clearTimeout(timer);\n\n    const normalized = answer.trim().toLowerCase();\n    if (normalized === \"y\" || normalized === \"yes\") {\n      return;\n    }\n\n    throw new ApprovalDeniedError(\"Approval denied\");\n  } catch (err) {\n    if (timer) clearTimeout(timer);\n    // ApprovalTimeoutError and ApprovalDeniedError bubble up so the caller\n    // (buildModuleCommand action) can run AuditLogger flush / tear-down\n    // before the process-level error path exits via exitCodeForError.\n    throw err;\n  } finally {\n    rl.close();\n  }\n}\n","/**\n * TTY-adaptive output formatting (table/json/csv/yaml/jsonl).\n *\n * Protocol spec: Output formatting (FE-09 enhanced)\n */\n\nimport yaml from \"js-yaml\";\nimport { EXIT_CODES } from \"./errors.js\";\nimport type { ModuleDescriptor, PreflightResult } from \"./cli.js\";\n\n/**\n * Stringify a CSV cell value: scalars via String(), nested objects/arrays via\n * JSON.stringify so composite data survives a round-trip instead of rendering\n * as '[object Object]'.\n */\nfunction csvCellString(value: unknown): string {\n  if (value === null || value === undefined) return \"\";\n  if (typeof value === \"object\") return JSON.stringify(value);\n  return String(value);\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve output format with TTY-adaptive default.\n */\nexport function resolveFormat(explicitFormat?: string): string {\n  if (explicitFormat !== undefined) {\n    return explicitFormat;\n  }\n  return process.stdout.isTTY ? \"table\" : \"json\";\n}\n\n/**\n * Truncate text to maxLength, appending '...' if needed.\n */\nexport function truncate(text: string, maxLength = 80): string {\n  if (text.length <= maxLength) {\n    return text;\n  }\n  return text.slice(0, maxLength - 3) + \"...\";\n}\n\n/**\n * Render a simple plain-text table with column headers.\n */\nfunction formatTable(\n  headers: string[],\n  rows: string[][],\n): string {\n  // Calculate column widths\n  const colWidths = headers.map((h, i) =>\n    Math.max(h.length, ...rows.map((r) => (r[i] ?? \"\").length)),\n  );\n\n  const sep = colWidths.map((w) => \"-\".repeat(w)).join(\"  \");\n  const headerLine = headers\n    .map((h, i) => h.padEnd(colWidths[i]))\n    .join(\"  \");\n  const dataLines = rows.map((row) =>\n    row.map((cell, i) => (cell ?? \"\").padEnd(colWidths[i])).join(\"  \"),\n  );\n\n  return [headerLine, sep, ...dataLines].join(\"\\n\") + \"\\n\";\n}\n\n// ---------------------------------------------------------------------------\n// formatModuleList\n// ---------------------------------------------------------------------------\n\n/**\n * Format and print a list of modules.\n */\nexport function formatModuleList(\n  modules: ModuleDescriptor[],\n  format: string,\n  filterTags?: string[],\n  showDeps = false,\n  exposureFilter?: { isExposed(moduleId: string): boolean },\n): void {\n  if (format === \"table\") {\n    if (modules.length === 0 && filterTags && filterTags.length > 0) {\n      process.stdout.write(\n        `No modules found matching tags: ${filterTags.join(\", \")}.\\n`,\n      );\n      return;\n    }\n    if (modules.length === 0) {\n      process.stdout.write(\"No modules found.\\n\");\n      return;\n    }\n\n    const headers = [\"ID\", \"Description\", \"Tags\"];\n    if (showDeps) headers.push(\"Deps\");\n    if (exposureFilter) headers.push(\"Exposure\");\n    const rows = modules.map((m) => {\n      const base = [m.id, truncate(m.description, 80), (m.tags ?? []).join(\", \")];\n      if (showDeps) {\n        const deps = (m as unknown as Record<string, unknown>).dependencies;\n        base.push(String(Array.isArray(deps) ? deps.length : 0));\n      }\n      if (exposureFilter) {\n        base.push(exposureFilter.isExposed(m.id ?? \"\") ? \"\\u2713\" : \"\\u2014\");\n      }\n      return base;\n    });\n    process.stdout.write(formatTable(headers, rows));\n  } else if (format === \"json\") {\n    const result = modules.map((m) => {\n      const entry: Record<string, unknown> = {\n        id: m.id,\n        description: m.description,\n        tags: m.tags ?? [],\n      };\n      if (showDeps) {\n        const deps = (m as unknown as Record<string, unknown>).dependencies;\n        entry.dependency_count = Array.isArray(deps) ? deps.length : 0;\n      }\n      if (exposureFilter) {\n        entry.exposed = exposureFilter.isExposed(m.id ?? \"\");\n      }\n      return entry;\n    });\n    process.stdout.write(JSON.stringify(result, null, 2) + \"\\n\");\n  }\n}\n\n// ---------------------------------------------------------------------------\n// formatModuleDetail\n// ---------------------------------------------------------------------------\n\n/**\n * Convert annotations to a plain dict, filtering out falsy/default values.\n */\nfunction annotationsToDict(\n  annotations: unknown,\n): Record<string, unknown> | null {\n  if (!annotations) return null;\n  if (typeof annotations !== \"object\" || Array.isArray(annotations)) return null;\n  const result: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(annotations as Record<string, unknown>)) {\n    if (v !== null && v !== undefined && v !== false && v !== 0 && !(Array.isArray(v) && v.length === 0)) {\n      result[k] = v;\n    }\n  }\n  return Object.keys(result).length > 0 ? result : null;\n}\n\n/**\n * Format and print full module metadata.\n */\nexport function formatModuleDetail(\n  moduleDef: ModuleDescriptor,\n  format: string,\n): void {\n  if (format === \"table\") {\n    process.stdout.write(`\\nModule: ${moduleDef.id}\\n`);\n    process.stdout.write(`\\nDescription:\\n  ${moduleDef.description}\\n`);\n\n    if (moduleDef.inputSchema && Object.keys(moduleDef.inputSchema).length > 0) {\n      process.stdout.write(\"\\nInput Schema:\\n\");\n      process.stdout.write(JSON.stringify(moduleDef.inputSchema, null, 2) + \"\\n\");\n    }\n\n    if (moduleDef.outputSchema && Object.keys(moduleDef.outputSchema).length > 0) {\n      process.stdout.write(\"\\nOutput Schema:\\n\");\n      process.stdout.write(JSON.stringify(moduleDef.outputSchema, null, 2) + \"\\n\");\n    }\n\n    const annDict = annotationsToDict(\n      moduleDef.annotations,\n    );\n    if (annDict) {\n      process.stdout.write(\"\\nAnnotations:\\n\");\n      for (const [k, v] of Object.entries(annDict)) {\n        process.stdout.write(`  ${k}: ${v}\\n`);\n      }\n    }\n\n    // Extension metadata (x- prefixed)\n    const metadata = moduleDef.metadata;\n    if (metadata) {\n      const xFields: Record<string, unknown> = {};\n      for (const [k, v] of Object.entries(metadata)) {\n        if (k.startsWith(\"x-\") || k.startsWith(\"x_\")) {\n          xFields[k] = v;\n        }\n      }\n      if (Object.keys(xFields).length > 0) {\n        process.stdout.write(\"\\nExtension Metadata:\\n\");\n        for (const [k, v] of Object.entries(xFields)) {\n          process.stdout.write(`  ${k}: ${v}\\n`);\n        }\n      }\n    }\n\n    const tags = moduleDef.tags ?? [];\n    if (tags.length > 0) {\n      process.stdout.write(`\\nTags: ${tags.join(\", \")}\\n`);\n    }\n  } else if (format === \"json\") {\n    const result: Record<string, unknown> = {\n      id: moduleDef.id,\n      description: moduleDef.description,\n    };\n    if (moduleDef.inputSchema) result.input_schema = moduleDef.inputSchema;\n    if (moduleDef.outputSchema) result.output_schema = moduleDef.outputSchema;\n\n    const annDict = annotationsToDict(\n      moduleDef.annotations,\n    );\n    if (annDict) result.annotations = annDict;\n\n    const tags = moduleDef.tags ?? [];\n    if (tags.length > 0) result.tags = tags;\n\n    // Extension metadata\n    const metadata = moduleDef.metadata;\n    if (metadata) {\n      for (const [k, v] of Object.entries(metadata)) {\n        if (k.startsWith(\"x-\") || k.startsWith(\"x_\")) {\n          result[k] = v;\n        }\n      }\n    }\n\n    process.stdout.write(JSON.stringify(result, null, 2) + \"\\n\");\n  }\n}\n\n// ---------------------------------------------------------------------------\n// formatExecResult\n// ---------------------------------------------------------------------------\n\n/**\n * Select fields from a result using dot-path notation.\n * E.g., fields=\"status,data.count\" selects those paths.\n */\nfunction selectFields(result: Record<string, unknown>, fields: string): Record<string, unknown> {\n  const selected: Record<string, unknown> = {};\n  for (const f of fields.split(\",\")) {\n    const key = f.trim();\n    let val: unknown = result;\n    for (const part of key.split(\".\")) {\n      if (val && typeof val === \"object\" && !Array.isArray(val)) {\n        val = (val as Record<string, unknown>)[part];\n      } else {\n        val = undefined;\n        break;\n      }\n    }\n    selected[key] = val;\n  }\n  return selected;\n}\n\n/**\n * Format and print module execution result.\n *\n * Supports formats: json, table, csv, yaml, jsonl.\n * The `fields` option allows dot-path field selection on dict results.\n */\nexport function formatExecResult(\n  result: unknown,\n  format?: string,\n  fields?: string,\n): void {\n  if (result === null || result === undefined) {\n    return;\n  }\n\n  // Apply field selection if specified\n  let effective_result = result;\n  if (fields && typeof result === \"object\" && !Array.isArray(result) && result !== null) {\n    effective_result = selectFields(result as Record<string, unknown>, fields);\n  }\n\n  const effective = resolveFormat(format);\n\n  if (effective === \"csv\") {\n    if (typeof effective_result === \"object\" && !Array.isArray(effective_result) && effective_result !== null) {\n      const obj = effective_result as Record<string, unknown>;\n      const keys = Object.keys(obj);\n      const header = keys.map(escapeCsvField).join(\",\");\n      const row = keys.map((k) => escapeCsvField(csvCellString(obj[k]))).join(\",\");\n      process.stdout.write(header + \"\\n\" + row + \"\\n\");\n    } else if (Array.isArray(effective_result) && effective_result.length > 0 && typeof effective_result[0] === \"object\") {\n      const keys = Object.keys(effective_result[0] as Record<string, unknown>);\n      const header = keys.map(escapeCsvField).join(\",\");\n      const rows = effective_result.map((item) => {\n        const obj = item as Record<string, unknown>;\n        return keys.map((k) => escapeCsvField(csvCellString(obj[k]))).join(\",\");\n      });\n      process.stdout.write(header + \"\\n\" + rows.join(\"\\n\") + \"\\n\");\n    } else {\n      process.stdout.write(JSON.stringify(effective_result) + \"\\n\");\n    }\n  } else if (effective === \"yaml\") {\n    // Use js-yaml to produce spec-conformant output for values containing\n    // special YAML characters (':', leading '-', '@', '#', CR/LF, etc.).\n    process.stdout.write(yaml.dump(effective_result, { lineWidth: -1 }));\n  } else if (effective === \"jsonl\") {\n    if (Array.isArray(effective_result)) {\n      for (const item of effective_result) {\n        process.stdout.write(JSON.stringify(item) + \"\\n\");\n      }\n    } else {\n      process.stdout.write(JSON.stringify(effective_result) + \"\\n\");\n    }\n  } else if (\n    effective === \"table\" &&\n    typeof effective_result === \"object\" &&\n    !Array.isArray(effective_result)\n  ) {\n    // Key-value table\n    const entries = Object.entries(effective_result as Record<string, unknown>);\n    const headers = [\"Key\", \"Value\"];\n    const rows = entries.map(([k, v]) => [String(k), String(v)]);\n    process.stdout.write(formatTable(headers, rows));\n  } else if (typeof effective_result === \"object\") {\n    process.stdout.write(JSON.stringify(effective_result, null, 2) + \"\\n\");\n  } else if (typeof effective_result === \"string\") {\n    process.stdout.write(effective_result + \"\\n\");\n  } else {\n    process.stdout.write(String(effective_result) + \"\\n\");\n  }\n}\n\n/**\n * Escape a CSV field value — wrap in quotes if it contains comma, quote, or newline.\n */\nfunction escapeCsvField(value: string): string {\n  if (value.includes(\",\") || value.includes('\"') || value.includes(\"\\n\") || value.includes(\"\\r\")) {\n    return '\"' + value.replace(/\"/g, '\"\"') + '\"';\n  }\n  return value;\n}\n\n// ---------------------------------------------------------------------------\n// formatPreflightResult\n// ---------------------------------------------------------------------------\n\n/**\n * Format and print a PreflightResult to stdout.\n */\nexport function formatPreflightResult(result: PreflightResult, format?: string): void {\n  const resolved = resolveFormat(format);\n  if (resolved === \"json\" || !process.stdout.isTTY) {\n    const payload: Record<string, unknown> = {\n      valid: result.valid,\n      // JSON output key stays snake_case for cross-language CLI contract;\n      // runtime read uses camelCase to match apcore-js PreflightResult.\n      requires_approval: result.requiresApproval,\n      checks: result.checks.map((c) => {\n        const entry: Record<string, unknown> = { check: c.check, passed: c.passed };\n        if (c.error !== undefined && c.error !== null) {\n          entry.error = c.error;\n        }\n        if (c.warnings && c.warnings.length > 0) {\n          entry.warnings = c.warnings;\n        }\n        return entry;\n      }),\n    };\n    process.stdout.write(JSON.stringify(payload, null, 2) + \"\\n\");\n  } else {\n    // TTY table format\n    for (const c of result.checks) {\n      const hasWarnings = (c.warnings?.length ?? 0) > 0;\n      let sym: string;\n      if (c.passed && hasWarnings) {\n        sym = \"\\u26a0\"; // ⚠ passed with warnings\n      } else if (c.passed) {\n        sym = \"\\u2713\"; // ✓ passed\n      } else if (c.passed === false) {\n        sym = \"\\u2717\"; // ✗ failed\n      } else {\n        sym = \"\\u25cb\"; // ○ skipped\n      }\n      let status = `  ${sym} ${c.check.padEnd(20)}`;\n      if (c.error) {\n        const detail = typeof c.error === \"object\" ? JSON.stringify(c.error) : String(c.error);\n        status += ` ${detail}`;\n      } else if (c.passed && !hasWarnings) {\n        status += \" OK\";\n      } else if (!c.passed) {\n        status += \" Skipped\";\n      }\n      process.stdout.write(status + \"\\n\");\n      for (const w of c.warnings ?? []) {\n        process.stdout.write(`    Warning: ${w}\\n`);\n      }\n    }\n    const errors = result.checks.filter((c) => !c.passed).length;\n    const warnings = result.checks.reduce((sum, c) => sum + (c.warnings?.length ?? 0), 0);\n    const tag = result.valid ? \"PASS\" : \"FAIL\";\n    process.stdout.write(`\\nResult: ${tag} (${errors} error(s), ${warnings} warning(s))\\n`);\n  }\n}\n\n/**\n * Return the exit code for the first failed check in a PreflightResult.\n */\nexport function firstFailedExitCode(result: PreflightResult): number {\n  // Map preflight-check names (apcore-js PROTOCOL_SPEC) to CLI exit codes.\n  // Symbolic references so renumbering in errors.ts EXIT_CODES stays in sync.\n  const checkToExit: Record<string, number> = {\n    module_id: EXIT_CODES.INVALID_CLI_INPUT,\n    module_lookup: EXIT_CODES.MODULE_NOT_FOUND,\n    call_chain: EXIT_CODES.MODULE_EXECUTE_ERROR,\n    acl: EXIT_CODES.ACL_DENIED,\n    schema: EXIT_CODES.SCHEMA_VALIDATION_ERROR,\n    approval: EXIT_CODES.APPROVAL_DENIED,\n    module_preflight: EXIT_CODES.MODULE_EXECUTE_ERROR,\n  };\n  for (const check of result.checks) {\n    if (!check.passed) {\n      return checkToExit[check.check] ?? EXIT_CODES.MODULE_EXECUTE_ERROR;\n    }\n  }\n  return EXIT_CODES.MODULE_EXECUTE_ERROR;\n}\n","/**\n * Simple structured logger respecting logging.level config.\n */\n\nconst LEVELS = { DEBUG: 0, INFO: 1, WARNING: 2, ERROR: 3 } as const;\ntype LogLevel = keyof typeof LEVELS;\n\nlet currentLevel: LogLevel = \"WARNING\";\n\nexport function setLogLevel(level: string): void {\n  const upper = level.toUpperCase();\n  if (upper in LEVELS) {\n    currentLevel = upper as LogLevel;\n  }\n}\n\nexport function getLogLevel(): LogLevel {\n  return currentLevel;\n}\n\nfunction shouldLog(level: LogLevel): boolean {\n  return LEVELS[level] >= LEVELS[currentLevel];\n}\n\nexport function debug(message: string): void {\n  if (shouldLog(\"DEBUG\")) process.stderr.write(`DEBUG: ${message}\\n`);\n}\n\nexport function info(message: string): void {\n  if (shouldLog(\"INFO\")) process.stderr.write(`INFO: ${message}\\n`);\n}\n\nexport function warn(message: string): void {\n  if (shouldLog(\"WARNING\")) process.stderr.write(`WARNING: ${message}\\n`);\n}\n\nexport function error(message: string): void {\n  if (shouldLog(\"ERROR\")) process.stderr.write(`ERROR: ${message}\\n`);\n}\n","/**\n * Init command — scaffold new apcore modules (Phase 1).\n */\n\nimport { Command } from \"commander\";\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { EXIT_CODES } from \"./errors.js\";\n\n/**\n * Wrap a filesystem operation and exit with MODULE_EXECUTE_ERROR on failure.\n * Unwrapped mkdirSync/writeFileSync would surface raw Node stack traces to the\n * user; this helper funnels them through the CLI's standard stderr/exit path.\n */\nfunction runFsOp<T>(op: string, targetPath: string, fn: () => T, partial?: string[]): T {\n  try {\n    return fn();\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    process.stderr.write(`Error: failed to ${op} ${targetPath}: ${msg}\\n`);\n    if (partial && partial.length > 0) {\n      process.stderr.write(\n        `  Partial scaffold left on disk — you may want to remove: ${partial.join(\", \")}\\n`,\n      );\n    }\n    process.exit(EXIT_CODES.MODULE_EXECUTE_ERROR);\n  }\n}\n\nconst DECORATOR_TEMPLATE = `\\\nimport { module } from \"apcore-js\";\nimport { Type } from \"@sinclair/typebox\";\n\nexport const {varName} = module({\n  id: \"{moduleId}\",\n  description: \"{description}\",\n  inputSchema: Type.Object({}),\n  outputSchema: Type.Object({ status: Type.String() }),\n  execute: (_inputs) => {\n    // TODO: implement\n    return { status: \"ok\" };\n  },\n});\n`;\n\nconst CONVENTION_TEMPLATE = `\\\n/**\n * {description}\n */\n{cliGroupLine}\nexport function {funcName}(): Record<string, unknown> {\n  // TODO: implement\n  return { status: \"ok\" };\n}\n`;\n\nconst BINDING_TEMPLATE = `\\\nspec_version: \"1.0\"\nbindings:\n  - module_id: \"{moduleId}\"\n    target: \"{target}\"\n    description: \"{description}\"\n    auto_schema: true\n`;\n\n/**\n * Simple template rendering: replaces {key} with values from the context.\n */\nfunction renderTemplate(template: string, context: Record<string, string>): string {\n  let result = template;\n  for (const [key, value] of Object.entries(context)) {\n    // Replace all occurrences of {key} with the value\n    result = result.split(`{${key}}`).join(value);\n  }\n  return result;\n}\n\n/**\n * Register the init command group on the CLI program.\n */\nexport function registerInitCommand(cli: Command): void {\n  const initGroup = cli.command(\"init\").description(\"Scaffold new apcore modules.\");\n\n  initGroup\n    .command(\"module <module-id>\")\n    .description(\"Create a new module from a template.\\n\\nMODULE_ID is the module identifier (e.g., ops.deploy, user.create).\")\n    .option(\n      \"--style <style>\",\n      \"Module style: decorator (@module), convention (plain function), or binding (YAML).\",\n      \"convention\",\n    )\n    .option(\"--dir <path>\", \"Output directory. Default: extensions/ or commands/.\")\n    .option(\"-d, --description <text>\", \"Module description.\", \"TODO: add description\")\n    .action((moduleId: string, opts: { style: string; dir?: string; description: string }) => {\n      // Parse module_id into parts\n      const lastDot = moduleId.lastIndexOf(\".\");\n      const prefix = lastDot >= 0 ? moduleId.substring(0, lastDot) : moduleId;\n      const funcName = lastDot >= 0 ? moduleId.substring(lastDot + 1) : moduleId;\n\n      const style = opts.style;\n      const description = opts.description;\n\n      // Validate --dir to prevent path traversal\n      const dir = opts.dir ?? (style === \"decorator\" ? \"extensions\" : style === \"binding\" ? \"bindings\" : \"commands\");\n      if (dir.split(path.sep).includes(\"..\") || dir.split(\"/\").includes(\"..\")) {\n        process.stderr.write(`Error: Output directory must not contain '..' path components.\\n`);\n        process.exit(2);\n      }\n\n      switch (style) {\n        case \"decorator\":\n          createDecoratorModule(moduleId, prefix, funcName, description, dir);\n          break;\n        case \"convention\":\n          createConventionModule(moduleId, prefix, funcName, description, dir);\n          break;\n        case \"binding\":\n          createBindingModule(moduleId, prefix, funcName, description, dir);\n          break;\n        default:\n          process.stderr.write(`Error: Unknown style '${style}'\\n`);\n          process.exit(2);\n      }\n    });\n}\n\nfunction createDecoratorModule(\n  moduleId: string,\n  _prefix: string,\n  funcName: string,\n  description: string,\n  outputDir: string,\n): void {\n  runFsOp(\"create directory\", outputDir, () => fs.mkdirSync(outputDir, { recursive: true }));\n  const filename = moduleId.replace(/\\./g, \"_\") + \".ts\";\n  const filepath = path.join(outputDir, filename);\n\n  const varName = funcName + \"Module\";\n  const content = renderTemplate(DECORATOR_TEMPLATE, {\n    moduleId,\n    varName,\n    funcName,\n    description,\n  });\n  runFsOp(\"write file\", filepath, () => fs.writeFileSync(filepath, content));\n  process.stdout.write(`Created ${filepath}\\n`);\n}\n\nfunction createConventionModule(\n  moduleId: string,\n  prefix: string,\n  funcName: string,\n  description: string,\n  outputDir: string,\n): void {\n  // If prefix has dots, create subdirectories\n  const prefixParts = prefix.split(\".\");\n  const dirPath = prefixParts.length > 1\n    ? path.join(outputDir, ...prefixParts.slice(0, -1))\n    : outputDir;\n  runFsOp(\"create directory\", dirPath, () => fs.mkdirSync(dirPath, { recursive: true }));\n\n  let filename: string;\n  if (prefixParts.length > 1) {\n    filename = prefixParts[prefixParts.length - 1] + \".ts\";\n  } else {\n    filename = prefix + \".ts\";\n  }\n  // If the file would be the same as the function name, use prefix as filename\n  if (prefix === funcName) {\n    filename = prefix + \".ts\";\n  }\n  const filepath = path.join(dirPath, filename);\n\n  const cliGroupLine = moduleId.includes(\".\")\n    ? `export const CLI_GROUP = \"${prefixParts[0]}\";\\n`\n    : \"\";\n\n  const content = renderTemplate(CONVENTION_TEMPLATE, {\n    funcName,\n    description,\n    cliGroupLine,\n  });\n  runFsOp(\"write file\", filepath, () => fs.writeFileSync(filepath, content));\n  process.stdout.write(`Created ${filepath}\\n`);\n}\n\nfunction createBindingModule(\n  moduleId: string,\n  prefix: string,\n  funcName: string,\n  description: string,\n  outputDir: string,\n): void {\n  const partial: string[] = [];\n  runFsOp(\"create directory\", outputDir, () => fs.mkdirSync(outputDir, { recursive: true }));\n\n  const yamlFile = path.join(outputDir, moduleId.replace(/\\./g, \"_\") + \".binding.yaml\");\n  const target = `commands.${prefix}:${funcName}`;\n\n  const yamlContent = renderTemplate(BINDING_TEMPLATE, {\n    moduleId,\n    target,\n    description,\n  });\n  runFsOp(\"write file\", yamlFile, () => fs.writeFileSync(yamlFile, yamlContent));\n  partial.push(yamlFile);\n  process.stdout.write(`Created ${yamlFile}\\n`);\n\n  // Also create the target function file\n  const baseSrc = \"commands\";\n  runFsOp(\"create directory\", baseSrc, () => fs.mkdirSync(baseSrc, { recursive: true }), partial);\n  const srcFile = path.join(baseSrc, prefix.replace(/\\./g, \"_\") + \".ts\");\n  if (!fs.existsSync(srcFile)) {\n    const srcContent =\n      `export function ${funcName}(): Record<string, unknown> {\\n` +\n      `  /** ${description} */\\n` +\n      \"  // TODO: implement\\n\" +\n      '  return { status: \"ok\" };\\n' +\n      \"}\\n\";\n    runFsOp(\"write file\", srcFile, () => fs.writeFileSync(srcFile, srcContent), partial);\n    process.stdout.write(`Created ${srcFile}\\n`);\n  }\n}\n","/**\n * Display overlay helpers — shared resolution logic for CLI surfaces.\n */\n\nimport type { ModuleDescriptor } from \"./cli.js\";\nimport { lookupBindingDisplay } from \"./main.js\";\n\n/**\n * Extract resolved display overlay from a ModuleDescriptor's metadata.\n *\n * Resolution order:\n *   1. `descriptor.metadata.display` — overlay already baked into the\n *      descriptor (e.g. applied by apcore-toolkit's RegistryWriter at\n *      discovery time).\n *   2. Binding display map — populated by\n *      `applyToolkitIntegration(undefined, bindingPath)` from a\n *      `.binding.yaml` supplied via `--binding`. Used as a fallback when\n *      the descriptor was registered without overlay metadata.\n */\nexport function getDisplay(descriptor: ModuleDescriptor): Record<string, unknown> {\n  const metadata = descriptor.metadata ?? {};\n  const display = (metadata as Record<string, unknown>).display;\n  if (display && typeof display === \"object\" && !Array.isArray(display)) {\n    return display as Record<string, unknown>;\n  }\n  const overlay = lookupBindingDisplay(descriptor.id);\n  return overlay ?? {};\n}\n\n/**\n * Return [displayName, description, tags] resolved from the display overlay.\n *\n * Falls back to scanner-provided values when no overlay is present.\n */\nexport function getCliDisplayFields(descriptor: ModuleDescriptor): [string, string, string[]] {\n  const display = getDisplay(descriptor);\n  const cli = (display.cli && typeof display.cli === \"object\" && !Array.isArray(display.cli))\n    ? (display.cli as Record<string, unknown>)\n    : {};\n  const name = (cli.alias as string | undefined)\n    ?? (display.alias as string | undefined)\n    ?? descriptor.id;\n  const desc = (cli.description as string | undefined) ?? descriptor.description;\n  const tags = (display.tags as string[] | undefined) ?? descriptor.tags ?? [];\n  return [name, desc, tags];\n}\n","/**\n * ConfigResolver — 4-tier config resolution (CLI flag > env > file > default).\n *\n * Protocol spec: Configuration resolution\n */\n\nimport * as fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport yaml from \"js-yaml\";\nimport { warn as logWarn } from \"./logger.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/**\n * Default configuration values.\n *\n * Audit D9 (config cleanup, v0.6.x): the entries `sandbox.enabled`,\n * `cli.auto_approve`, `cli.stdin_buffer_limit`, and the eight `apcore-cli.*`\n * namespace aliases were removed because no production code path reads\n * them via `resolve()`. Sandbox is configured via the `--sandbox` CLI flag,\n * auto-approve via `--yes`, the stdin buffer is hard-coded, and namespace\n * aliases are registered separately by `apcore-js`'s Config Bus when\n * `registerConfigNamespace()` runs at `createCli` startup. The cross-key\n * file-lookup mechanism (`NAMESPACE_TO_LEGACY` / `LEGACY_TO_NAMESPACE`)\n * still works regardless — it does not depend on these DEFAULTS entries.\n */\nexport const DEFAULTS: Record<string, unknown> = {\n  \"extensions.root\": \"./extensions\",\n  \"logging.level\": \"WARNING\",\n  \"cli.help_text_max_length\": 1000,\n  // FE-11 config keys\n  \"cli.approval_timeout\": 60,\n  \"cli.strategy\": \"standard\",\n  \"cli.group_depth\": 1,\n  // Exposure filtering (FE-12)\n  \"expose.mode\": \"all\",\n  \"expose.include\": [],\n  \"expose.exclude\": [],\n  // Builtin group visibility (FE-13) — apcli.* keys are NOT in DEFAULTS.\n  // The runtime reads them via resolveObject('apcli') (raw yaml walk) and\n  // does not use the flat-key resolve() path. Python and Rust have no such\n  // entries either. (D11-008 cleanup)\n};\n\n/**\n * Defaults published to the apcore-cli Config Bus namespace (apcore >= 0.15.0).\n *\n * Exported for testability. Mirrors the snake_case DEFAULTS entries, with\n * `apcli` expressed as a nested object (matches the natural yaml shape).\n */\nexport const NAMESPACE_DEFAULTS: Record<string, unknown> = {\n  stdin_buffer_limit: 10_485_760,\n  auto_approve: false,\n  help_text_max_length: 1000,\n  logging_level: \"WARNING\",\n  approval_timeout: 60,\n  strategy: \"standard\",\n  group_depth: 1,\n  // FE-13 — builtin group visibility configuration\n  apcli: {\n    mode: null,\n    include: [] as string[],\n    exclude: [] as string[],\n    disable_env: false,\n  },\n};\n\n/** Namespace key ↔ legacy key mapping for backward compatibility. */\nconst NAMESPACE_TO_LEGACY: Record<string, string> = {\n  \"apcore-cli.stdin_buffer_limit\": \"cli.stdin_buffer_limit\",\n  \"apcore-cli.auto_approve\": \"cli.auto_approve\",\n  \"apcore-cli.help_text_max_length\": \"cli.help_text_max_length\",\n  \"apcore-cli.logging_level\": \"logging.level\",\n};\nconst LEGACY_TO_NAMESPACE: Record<string, string> = Object.fromEntries(\n  Object.entries(NAMESPACE_TO_LEGACY).map(([k, v]) => [v, k]),\n);\n\n/**\n * Register the apcore-cli Config Bus namespace (apcore >= 0.15.0).\n * Safe to call even when apcore-js is unavailable or < 0.15.0.\n */\nexport function registerConfigNamespace(): void {\n  try {\n    // Use createRequire to load apcore-js from an ESM module without relying on\n    // tsup's `shims` option (which injects a `require` into the bundled output\n    // but not into vitest/tsx dev paths). Native `require()` at module scope is\n    // a ReferenceError in strict ESM and would silently no-op via the catch.\n    const nodeRequire = createRequire(import.meta.url);\n    const { Config } = nodeRequire(\"apcore-js\");\n    if (typeof Config?.registerNamespace === \"function\") {\n      Config.registerNamespace({\n        name: \"apcore-cli\",\n        envPrefix: \"APCORE_CLI\",\n        defaults: NAMESPACE_DEFAULTS,\n      });\n    }\n  } catch {\n    // apcore-js not installed or < 0.15.0 — graceful no-op\n  }\n}\n\n// ---------------------------------------------------------------------------\n// ConfigResolver\n// ---------------------------------------------------------------------------\n\n/**\n * Resolves configuration from four tiers (highest to lowest priority):\n *   1. CLI flags\n *   2. Environment variables\n *   3. Config file (YAML/JSON)\n *   4. Built-in defaults\n */\nexport class ConfigResolver {\n  private readonly cliFlags: Record<string, unknown>;\n  private readonly configPath: string;\n  private fileCache: Record<string, unknown> | null = null;\n  private fileCacheLoaded = false;\n  /**\n   * Raw parsed yaml root (pre-flatten). Populated alongside `fileCache`\n   * on load. Used by `resolveObject()` to walk nested paths without\n   * invoking `flattenDict` — see FE-13 spec §4.8 M1 note.\n   * `null` when no config file is present or parsing fails.\n   */\n  private _rawConfig: Record<string, unknown> | null = null;\n\n  constructor(cliFlags?: Record<string, unknown>, configPath?: string) {\n    this.cliFlags = cliFlags ?? {};\n    this.configPath = configPath ?? \"apcore.yaml\";\n  }\n\n  /**\n   * Resolve a single configuration key across all four tiers.\n   */\n  resolve(key: string, cliFlag?: string, envVar?: string): unknown {\n    // Tier 1: CLI flag\n    //\n    // Cross-SDK parity (D11-007, 2026-04-26): only consult `cliFlags` when\n    // the caller passed an explicit `cliFlag` argument. Previously this code\n    // used `cliFlag ?? key` which silently fell back to looking up the\n    // config key itself in the cliFlags map — a phantom Tier-1 lookup that\n    // could shadow file/default values when callers populated cliFlags with\n    // config-keyed entries. Python (config.py:66) and Rust (config.rs:119)\n    // skip Tier-1 entirely when the flag arg is None / missing; TS now\n    // matches.\n    if (cliFlag !== undefined && cliFlag in this.cliFlags) {\n      const value = this.cliFlags[cliFlag];\n      if (value !== null && value !== undefined) {\n        return value;\n      }\n    }\n\n    // Tier 2: Environment variable\n    if (envVar) {\n      const envValue = process.env[envVar];\n      if (envValue !== undefined && envValue !== \"\") {\n        return envValue;\n      }\n    }\n\n    // Tier 3: Config file (try both namespace and legacy keys)\n    const fileValue = this.resolveFromFile(key);\n    if (fileValue !== undefined) {\n      return fileValue;\n    }\n    const altKey = NAMESPACE_TO_LEGACY[key] ?? LEGACY_TO_NAMESPACE[key];\n    if (altKey) {\n      const altFileValue = this.resolveFromFile(altKey);\n      if (altFileValue !== undefined) {\n        return altFileValue;\n      }\n    }\n\n    // Tier 4: Defaults\n    return DEFAULTS[key];\n  }\n\n  /**\n   * Load a value from the config file using a dot-separated key path.\n   */\n  private resolveFromFile(key: string): unknown {\n    if (!this.fileCacheLoaded) {\n      this.fileCache = this.loadConfigFile();\n      this.fileCacheLoaded = true;\n    }\n    if (this.fileCache === null) {\n      return undefined;\n    }\n    return this.fileCache[key];\n  }\n\n  /**\n   * Resolve a configuration key to its raw nested value (FE-13).\n   *\n   * Unlike `resolve()`, this method does NOT flatten the yaml tree — it\n   * walks the dot-separated path directly against the parsed yaml root.\n   * This lets callers retrieve non-leaf structures (booleans, arrays,\n   * objects) such as the `apcli` visibility config, which is naturally\n   * shaped as a nested object in apcore.yaml.\n   *\n   * Semantics:\n   *   - Returns `null` when no config file is loaded or when the path is\n   *     not present / descends into a non-object node (including arrays).\n   *   - Returns the raw value (boolean / array / object / scalar) when the\n   *     full path resolves to a leaf or intermediate node.\n   *\n   * Intentionally DOES NOT consult DEFAULTS, env vars, or CLI flags — it is\n   * strictly a yaml-tree accessor. Scalar `resolve()` semantics are\n   * unaffected.\n   */\n  resolveObject(key: string): unknown {\n    // Ensure raw config is populated (lazy load parity with `resolve`).\n    if (!this.fileCacheLoaded) {\n      this.fileCache = this.loadConfigFile();\n      this.fileCacheLoaded = true;\n    }\n    if (this._rawConfig == null) {\n      return null;\n    }\n    const parts = key.split(\".\");\n    let cur: unknown = this._rawConfig;\n    for (const p of parts) {\n      if (\n        cur != null &&\n        typeof cur === \"object\" &&\n        !Array.isArray(cur) &&\n        p in (cur as Record<string, unknown>)\n      ) {\n        cur = (cur as Record<string, unknown>)[p];\n      } else {\n        return null;\n      }\n    }\n    return cur;\n  }\n\n  /**\n   * Load and flatten a YAML config file.\n   */\n  private loadConfigFile(): Record<string, unknown> | null {\n    let content: string;\n    try {\n      content = fs.readFileSync(this.configPath, \"utf-8\");\n    } catch (err: unknown) {\n      if (err instanceof Error && \"code\" in err && err.code === \"ENOENT\") {\n        return null;\n      }\n      logWarn(\n        `Configuration file '${this.configPath}' is malformed, using defaults.`,\n      );\n      return null;\n    }\n\n    let parsed: unknown;\n    try {\n      parsed = yaml.load(content);\n    } catch {\n      logWarn(\n        `Configuration file '${this.configPath}' is malformed, using defaults.`,\n      );\n      return null;\n    }\n\n    if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n      logWarn(\n        `Configuration file '${this.configPath}' is malformed, using defaults.`,\n      );\n      return null;\n    }\n\n    // Record the pre-flatten root for resolveObject() (FE-13).\n    this._rawConfig = parsed as Record<string, unknown>;\n    return this.flattenDict(parsed as Record<string, unknown>);\n  }\n\n  /**\n   * Flatten nested dict to dot-notation keys.\n   */\n  private flattenDict(\n    d: Record<string, unknown>,\n    prefix = \"\",\n  ): Record<string, unknown> {\n    const result: Record<string, unknown> = {};\n    for (const [key, value] of Object.entries(d)) {\n      const fullKey = prefix ? `${prefix}.${key}` : key;\n      if (\n        typeof value === \"object\" &&\n        value !== null &&\n        !Array.isArray(value)\n      ) {\n        Object.assign(\n          result,\n          this.flattenDict(value as Record<string, unknown>, fullKey),\n        );\n      } else {\n        result[fullKey] = value;\n      }\n    }\n    return result;\n  }\n}\n","/**\n * Shell completion + man page generation.\n *\n * Protocol spec: Shell integration\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { Command, Help, Option } from \"commander\";\nimport { EXIT_CODES } from \"./errors.js\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Convert a prog_name like 'my-tool' to a valid shell identifier '_my_tool'.\n */\nfunction makeFunctionName(progName: string): string {\n  return \"_\" + progName.replace(/[^a-zA-Z0-9]/g, \"_\");\n}\n\n/**\n * Shell-safe quoting.\n */\nfunction shellQuote(s: string): string {\n  return \"'\" + s.replace(/'/g, \"'\\\\''\") + \"'\";\n}\n\n// ---------------------------------------------------------------------------\n// Completion generators\n// ---------------------------------------------------------------------------\n\n/**\n * Enumerate non-hidden registered subcommands on the apcli Commander group.\n *\n * Per spec §4.13 (T-APCLI-40 regression guard): completion generation reads\n * Commander's registered set verbatim and MUST NOT re-invoke\n * `ApcliGroup.isSubcommandIncluded`. Registration time is the gate.\n */\nfunction enumerateApcliSubcommands(apcliGroup: Command | undefined): string[] {\n  if (!apcliGroup) return [];\n  return apcliGroup.commands\n    .filter((c) => !isCmdHidden(c))\n    .map((c) => c.name());\n}\n\n/** Enumerate non-hidden root-level subcommands on the program. */\nfunction enumerateRootCommands(program: Command): string[] {\n  return program.commands\n    .filter((c) => !isCmdHidden(c))\n    .map((c) => c.name());\n}\n\n/** Locate the apcli Commander subcommand if present. */\nfunction findApcliGroup(program: Command): Command | undefined {\n  return program.commands.find((c) => c.name() === \"apcli\");\n}\n\n/** Detect Commander command hidden flag across versions. */\nfunction isCmdHidden(cmd: Command): boolean {\n  const withHiddenFn = cmd as unknown as { hidden?: () => boolean };\n  const withHiddenField = cmd as unknown as { _hidden?: boolean };\n  if (typeof withHiddenFn.hidden === \"function\") return !!withHiddenFn.hidden();\n  return !!withHiddenField._hidden;\n}\n\nexport function generateBashCompletion(\n  progName: string,\n  program?: Command,\n): string {\n  const fn = makeFunctionName(progName);\n  const quoted = shellQuote(progName);\n\n  const apcliGroup = program ? findApcliGroup(program) : undefined;\n  const apcliVisible = apcliGroup !== undefined && !isCmdHidden(apcliGroup);\n  const rootCmds = program\n    ? enumerateRootCommands(program).filter(\n        (n) => n !== \"apcli\" || apcliVisible,\n      )\n    : [];\n  const apcliCmds = apcliVisible ? enumerateApcliSubcommands(apcliGroup) : [];\n\n  const rootOpts = rootCmds.join(\" \");\n  const apcliOpts = apcliCmds.join(\" \");\n\n  let body =\n    `${fn}() {\\n` +\n    `    local cur prev opts\\n` +\n    `    COMPREPLY=()\\n` +\n    `    cur=\"\\${COMP_WORDS[COMP_CWORD]}\"\\n` +\n    `    prev=\"\\${COMP_WORDS[COMP_CWORD-1]}\"\\n` +\n    `\\n` +\n    `    if [[ \\${COMP_CWORD} -eq 1 ]]; then\\n` +\n    `        opts=\"${rootOpts}\"\\n` +\n    `        COMPREPLY=( $(compgen -W \"\\${opts}\" -- \\${cur}) )\\n` +\n    `        return 0\\n` +\n    `    fi\\n`;\n  if (apcliVisible) {\n    body +=\n      `\\n` +\n      `    if [[ \\${COMP_CWORD} -eq 2 ]]; then\\n` +\n      `        if [[ \"\\${COMP_WORDS[1]}\" == \"apcli\" ]]; then\\n` +\n      `            local apcli_cmds=\"${apcliOpts}\"\\n` +\n      `            COMPREPLY=( $(compgen -W \"\\${apcli_cmds}\" -- \\${cur}) )\\n` +\n      `            return 0\\n` +\n      `        fi\\n` +\n      `    fi\\n`;\n  }\n  body += `}\\n` + `complete -F ${fn} ${quoted}\\n`;\n  return body;\n}\n\nexport function generateZshCompletion(\n  progName: string,\n  program?: Command,\n): string {\n  const fn = makeFunctionName(progName);\n  const quoted = shellQuote(progName);\n\n  const apcliGroup = program ? findApcliGroup(program) : undefined;\n  const apcliVisible = apcliGroup !== undefined && !isCmdHidden(apcliGroup);\n  const rootCmds = program\n    ? enumerateRootCommands(program).filter(\n        (n) => n !== \"apcli\" || apcliVisible,\n      )\n    : [];\n  const apcliCmds = apcliVisible ? enumerateApcliSubcommands(apcliGroup) : [];\n\n  const rootEntries = rootCmds.map((n) => `        '${n}:${n}'`).join(\"\\n\");\n  const apcliEntries = apcliCmds.map((n) => `        '${n}:${n}'`).join(\"\\n\");\n\n  return (\n    `#compdef ${progName}\\n` +\n    `\\n` +\n    `${fn}() {\\n` +\n    `    local -a commands\\n` +\n    `    commands=(\\n` +\n    (rootEntries ? rootEntries + \"\\n\" : \"\") +\n    `    )\\n` +\n    `    local -a apcli_cmds\\n` +\n    `    apcli_cmds=(\\n` +\n    (apcliEntries ? apcliEntries + \"\\n\" : \"\") +\n    `    )\\n` +\n    `\\n` +\n    `    _arguments -C \\\\\\n` +\n    `        '1:command:->command' \\\\\\n` +\n    `        '*::arg:->args'\\n` +\n    `\\n` +\n    `    case \"$state\" in\\n` +\n    `        command)\\n` +\n    `            _describe -t commands '${progName} commands' commands\\n` +\n    `            ;;\\n` +\n    `        args)\\n` +\n    `            case \"\\${words[1]}\" in\\n` +\n    `                apcli)\\n` +\n    `                    _describe -t apcli_cmds '${progName} apcli commands' apcli_cmds\\n` +\n    `                    ;;\\n` +\n    `            esac\\n` +\n    `            ;;\\n` +\n    `    esac\\n` +\n    `}\\n` +\n    `\\n` +\n    `compdef ${fn} ${quoted}\\n`\n  );\n}\n\nexport function generateFishCompletion(\n  progName: string,\n  program?: Command,\n): string {\n  const quoted = shellQuote(progName);\n\n  const apcliGroup = program ? findApcliGroup(program) : undefined;\n  const apcliVisible = apcliGroup !== undefined && !isCmdHidden(apcliGroup);\n  const rootCmds = program\n    ? enumerateRootCommands(program).filter(\n        (n) => n !== \"apcli\" || apcliVisible,\n      )\n    : [];\n  const apcliCmds = apcliVisible ? enumerateApcliSubcommands(apcliGroup) : [];\n\n  const lines: string[] = [];\n  lines.push(`# Fish completions for ${progName}`);\n  for (const name of rootCmds) {\n    lines.push(\n      `complete -c ${quoted} -n \"__fish_use_subcommand\" -a ${name} -d \"${name}\"`,\n    );\n  }\n  if (apcliVisible && apcliCmds.length > 0) {\n    lines.push(\"\");\n    for (const name of apcliCmds) {\n      lines.push(\n        `complete -c ${quoted} -n \"__fish_seen_subcommand_from apcli\" -a ${name} -d \"${name}\"`,\n      );\n    }\n  }\n  return lines.join(\"\\n\") + \"\\n\";\n}\n\n// ---------------------------------------------------------------------------\n// Program-wide man page generation\n// ---------------------------------------------------------------------------\n\n/** Escape a string for roff output. */\nfunction roffEscape(s: string): string {\n  return s.replace(/\\\\/g, \"\\\\\\\\\").replace(/-/g, \"\\\\-\").replace(/'/g, \"\\\\(aq\");\n}\n\n/**\n * Build a complete roff man page for the entire program.\n * Covers all registered commands including downstream business commands.\n */\nexport function buildProgramManPage(\n  program: Command,\n  progName: string,\n  version: string,\n  description?: string,\n  docsUrl?: string,\n): string {\n  const help = new Help();\n  const today = new Date().toISOString().slice(0, 10);\n  const s: string[] = [];\n\n  const resolvedDesc = description ?? program.description() ?? `${progName} CLI`;\n\n  s.push(`.TH \"${progName.toUpperCase()}\" \"1\" \"${today}\" \"${progName} ${version}\" \"${progName} Manual\"`);\n\n  s.push(\".SH NAME\");\n  s.push(`${progName} \\\\- ${roffEscape(resolvedDesc)}`);\n\n  s.push(\".SH SYNOPSIS\");\n  s.push(`\\\\fB${progName}\\\\fR [\\\\fIglobal\\\\-options\\\\fR] \\\\fIcommand\\\\fR [\\\\fIcommand\\\\-options\\\\fR]`);\n\n  if (resolvedDesc) {\n    s.push(\".SH DESCRIPTION\");\n    s.push(roffEscape(resolvedDesc));\n  }\n\n  // Global options\n  const globalOpts = help.visibleOptions(program)\n    .filter((o) => ![\"help\", \"version\", \"all\", \"man\"].includes(o.long?.replace(\"--\", \"\") ?? \"\"));\n  if (globalOpts.length > 0) {\n    s.push(\".SH GLOBAL OPTIONS\");\n    for (const opt of globalOpts) {\n      const flag = [opt.short, opt.long].filter(Boolean).join(\", \");\n      s.push(\".TP\");\n      s.push(`\\\\fB${roffEscape(flag)}\\\\fR`);\n      if (opt.description) s.push(roffEscape(opt.description));\n    }\n  }\n\n  // Commands\n  const allCommands = help.visibleCommands(program);\n  if (allCommands.length > 0) {\n    s.push(\".SH COMMANDS\");\n    for (const cmd of allCommands) {\n      if (cmd.name() === \"help\") continue;\n\n      const desc = help.subcommandDescription(cmd);\n      s.push(\".TP\");\n      s.push(`\\\\fB${progName} ${roffEscape(cmd.name())}\\\\fR`);\n      if (desc) s.push(roffEscape(desc));\n\n      // Command options\n      const cmdHelp = new Help();\n      const opts = cmdHelp.visibleOptions(cmd)\n        .filter((o) => ![\"help\", \"version\"].includes(o.long?.replace(\"--\", \"\") ?? \"\"));\n      for (const opt of opts) {\n        const flag = [opt.short, opt.long].filter(Boolean).join(\", \");\n        s.push(\".RS\");\n        s.push(\".TP\");\n        s.push(`\\\\fB${roffEscape(flag)}\\\\fR`);\n        if (opt.description) s.push(roffEscape(opt.description));\n        s.push(\".RE\");\n      }\n\n      // Nested subcommands (e.g., series init, asset add)\n      const subCmds = cmdHelp.visibleCommands(cmd).filter((c) => c.name() !== \"help\");\n      for (const sub of subCmds) {\n        const subDesc = help.subcommandDescription(sub);\n        s.push(\".TP\");\n        s.push(`\\\\fB${progName} ${roffEscape(cmd.name())} ${roffEscape(sub.name())}\\\\fR`);\n        if (subDesc) s.push(roffEscape(subDesc));\n        const subOpts = cmdHelp.visibleOptions(sub)\n          .filter((o) => ![\"help\", \"version\"].includes(o.long?.replace(\"--\", \"\") ?? \"\"));\n        for (const opt of subOpts) {\n          const flag = [opt.short, opt.long].filter(Boolean).join(\", \");\n          s.push(\".RS\");\n          s.push(\".TP\");\n          s.push(`\\\\fB${roffEscape(flag)}\\\\fR`);\n          if (opt.description) s.push(roffEscape(opt.description));\n          s.push(\".RE\");\n        }\n      }\n    }\n  }\n\n  // Environment\n  s.push(\".SH ENVIRONMENT\");\n  s.push(\".TP\");\n  s.push(\"\\\\fBAPCORE_EXTENSIONS_ROOT\\\\fR\");\n  s.push(\"Path to the apcore extensions directory.\");\n  s.push(\".TP\");\n  s.push(\"\\\\fBAPCORE_CLI_AUTO_APPROVE\\\\fR\");\n  s.push(\"Set to \\\\fB1\\\\fR to bypass approval prompts.\");\n  s.push(\".TP\");\n  s.push(\"\\\\fBAPCORE_CLI_LOGGING_LEVEL\\\\fR\");\n  s.push(\"CLI\\\\-specific logging verbosity (DEBUG|INFO|WARNING|ERROR).\");\n\n  // Exit codes\n  s.push(\".SH EXIT CODES\");\n  const exitCodes: [string, string][] = [\n    [\"0\", \"Success.\"],\n    [\"1\", \"Module execution error.\"],\n    [\"2\", \"Invalid CLI input or missing argument.\"],\n    [\"44\", \"Module not found, disabled, or failed to load.\"],\n    [\"45\", \"Input failed JSON Schema validation.\"],\n    [\"46\", \"Approval denied or timed out.\"],\n    [\"47\", \"Configuration error.\"],\n    [\"77\", \"ACL denied.\"],\n    [\"130\", \"Cancelled by user (SIGINT).\"],\n  ];\n  for (const [code, meaning] of exitCodes) {\n    s.push(`.TP\\n\\\\fB${code}\\\\fR\\n${meaning}`);\n  }\n\n  s.push(\".SH SEE ALSO\");\n  s.push(`\\\\fB${progName} \\\\-\\\\-help \\\\-\\\\-verbose\\\\fR for full option list.`);\n  if (docsUrl) {\n    s.push(`.PP\\nFull documentation at \\\\fI${roffEscape(docsUrl)}\\\\fR`);\n  }\n\n  return s.join(\"\\n\");\n}\n\n/**\n * Configure --help --man support on a Commander program.\n * When --man is passed with --help, outputs a complete roff man page\n * covering all registered commands (including downstream business commands).\n *\n * Usage in downstream projects:\n *   configureManHelp(program, 'reach', '0.2.0', 'ReachForge: The Social Influence Engine', 'https://reachforge.dev/docs');\n */\nexport function configureManHelp(\n  program: Command,\n  progName: string,\n  version: string,\n  description?: string,\n  docsUrl?: string,\n): void {\n  // Add --man as a hidden option\n  const manOpt = new Option(\"--man\", \"Output man page in roff format (use with --help)\").hideHelp();\n  program.addOption(manOpt);\n\n  // Intercept help to output roff when --man is set\n  program.addHelpText(\"beforeAll\", () => {\n    if (program.opts().man) {\n      const roff = buildProgramManPage(program, progName, version, description, docsUrl) + \"\\n\";\n\n      // If stdout is a TTY, render through a pager; otherwise output raw roff\n      // (allows piping/redirection like `reach --help --man > reach.1`)\n      if (process.stdout.isTTY) {\n        // Try mandoc first (available on macOS/BSD), then groff, then fall back to raw output\n        const pagers: Array<{ cmd: string; args: string[] }> = [\n          { cmd: \"mandoc\", args: [\"-a\"] },\n          { cmd: \"groff\",  args: [\"-man\", \"-Tutf8\"] },\n        ];\n        let rendered = false;\n        for (const { cmd, args } of pagers) {\n          const result = spawnSync(cmd, args, {\n            input: roff,\n            stdio: [\"pipe\", \"pipe\", \"pipe\"],\n            encoding: \"utf-8\",\n          });\n          if (result.status === 0 && result.stdout) {\n            const pager = process.env.PAGER || \"less\";\n            const pagerResult = spawnSync(pager, [\"-R\"], {\n              input: result.stdout,\n              stdio: [\"pipe\", \"inherit\", \"inherit\"],\n            });\n            if (pagerResult.status !== null) {\n              rendered = true;\n              break;\n            }\n          }\n        }\n        if (!rendered) {\n          process.stdout.write(roff);\n        }\n      } else {\n        process.stdout.write(roff);\n      }\n      process.exit(0);\n    }\n    return \"\";\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Command registration\n// ---------------------------------------------------------------------------\n\n/**\n * Locate the root Commander program by walking the parent chain from `host`.\n * When `host` is the root itself, returns `host`.\n */\nfunction findRootProgram(host: Command): Command {\n  let cur: Command = host;\n  while (cur.parent) cur = cur.parent;\n  return cur;\n}\n\n/**\n * Register the `completion` subcommand on `host` (typically the apcli group\n * per spec §4.1, or the root program during the transition period).\n *\n * The completion-script generator enumerates the actually-registered set of\n * subcommands from the root program's Commander tree at generation time\n * (spec §4.13).\n */\nexport function registerCompletionCommand(host: Command): void {\n  const completionCmd = new Command(\"completion\")\n    .description(\"Generate a shell completion script and print it to stdout.\")\n    .argument(\"<shell>\", \"Shell type: bash, zsh, or fish\")\n    .action((shell: string) => {\n      const validShells = [\"bash\", \"zsh\", \"fish\"];\n      if (!validShells.includes(shell)) {\n        process.stderr.write(\n          `Error: Unknown shell '${shell}'. Expected: bash, zsh, or fish.\\n`,\n        );\n        process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n      }\n\n      const root = findRootProgram(host);\n      const resolved = root.name() || \"apcore-cli\";\n      const generators: Record<string, () => string> = {\n        bash: () => generateBashCompletion(resolved, root),\n        zsh: () => generateZshCompletion(resolved, root),\n        fish: () => generateFishCompletion(resolved, root),\n      };\n      process.stdout.write(generators[shell]());\n    });\n  host.addCommand(completionCmd);\n}\n\n// registerShellCommands was removed in FE-13 create-cli-integration.\n// Call registerCompletionCommand directly (typically from the apcli group\n// dispatcher) and configureManHelp at the root program to get --help --man.\n","/**\n * AuditLogger — JSONL audit trail.\n *\n * Protocol spec: Security — audit logging\n */\n\nimport * as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport { warn as logWarn } from \"../logger.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\ntype ExecutionStatus = \"success\" | \"error\";\n\ninterface AuditEntry {\n  timestamp: string;\n  user: string;\n  module_id: string;\n  input_hash: string;\n  status: ExecutionStatus;\n  exit_code: number;\n  duration_ms: number;\n}\n\n// ---------------------------------------------------------------------------\n// AuditLogger\n// ---------------------------------------------------------------------------\n\n/**\n * Appends structured JSONL entries to an audit log file for every module\n * execution, supporting compliance and debugging.\n */\nlet _auditLogger: AuditLogger | null = null;\n\n/**\n * Set the module-level audit logger instance.\n */\nexport function setAuditLogger(auditLogger: AuditLogger | null): void {\n  _auditLogger = auditLogger;\n}\n\n/**\n * Get the current module-level audit logger instance.\n */\nexport function getAuditLogger(): AuditLogger | null {\n  return _auditLogger;\n}\n\n/**\n * Produce a stable, key-order-independent JSON serialization at every nesting\n * level. Used by AuditLogger.hashInput to guarantee that logically-equal\n * inputs hash identically (modulo salt) regardless of source key ordering,\n * and that inputs differing only in nested fields produce distinct canonical\n * bytes.\n *\n * Exported for testability — do not rely on this as a general-purpose helper;\n * only AuditLogger's hash path is a supported caller.\n */\nexport function canonicalizeForHash(value: unknown): unknown {\n  if (value === null || typeof value !== \"object\") return value;\n  if (Array.isArray(value)) return value.map(canonicalizeForHash);\n  const src = value as Record<string, unknown>;\n  const sorted: Record<string, unknown> = {};\n  for (const key of Object.keys(src).sort()) {\n    sorted[key] = canonicalizeForHash(src[key]);\n  }\n  return sorted;\n}\n\nexport class AuditLogger {\n  static readonly DEFAULT_PATH = path.join(\n    os.homedir(),\n    \".apcore-cli\",\n    \"audit.jsonl\",\n  );\n\n  private readonly logPath: string;\n  private writeFailureWarned = false;\n\n  constructor(path?: string) {\n    this.logPath = path ?? AuditLogger.DEFAULT_PATH;\n    this.ensureDirectory();\n  }\n\n  private ensureDirectory(): void {\n    const dir = path.dirname(this.logPath);\n    try {\n      fs.mkdirSync(dir, { recursive: true });\n      // Restrict to owner-only on Unix so audit log is not enumerable by\n      // other local UIDs on shared systems (mirrors Rust's 0o700 hardening).\n      try { fs.chmodSync(dir, 0o700); } catch { /* best-effort */ }\n    } catch {\n      // Silently ignore — we'll handle write errors in logExecution\n    }\n  }\n\n  logExecution(\n    moduleId: string,\n    inputData: Record<string, unknown>,\n    status: ExecutionStatus,\n    exitCode: number,\n    durationMs: number,\n  ): void {\n    const entry: AuditEntry = {\n      timestamp: new Date().toISOString(),\n      user: this.getUser(),\n      module_id: moduleId,\n      input_hash: this.hashInput(inputData),\n      status,\n      exit_code: exitCode,\n      duration_ms: durationMs,\n    };\n    try {\n      fs.appendFileSync(this.logPath, JSON.stringify(entry) + \"\\n\");\n      // Restrict to owner read/write (mirrors Rust's 0o600 hardening).\n      try { fs.chmodSync(this.logPath, 0o600); } catch { /* best-effort */ }\n    } catch (err) {\n      if (!this.writeFailureWarned) {\n        this.writeFailureWarned = true;\n        logWarn(`Could not write audit log: ${err}`);\n      }\n    }\n  }\n\n  private hashInput(inputData: Record<string, unknown>): string {\n    const salt = crypto.randomBytes(16);\n    const payload = JSON.stringify(canonicalizeForHash(inputData));\n    return crypto\n      .createHash(\"sha256\")\n      .update(Buffer.concat([salt, Buffer.from(payload, \"utf-8\")]))\n      .digest(\"hex\");\n  }\n\n  private getUser(): string {\n    try {\n      return os.userInfo().username;\n    } catch {\n      return process.env.USER ?? process.env.USERNAME ?? \"unknown\";\n    }\n  }\n}\n","/**\n * ConfigEncryptor — Keyring + AES-256-GCM fallback.\n *\n * Protocol spec: Security — config encryption\n */\n\nimport * as crypto from \"node:crypto\";\nimport * as os from \"node:os\";\nimport { ConfigDecryptionError } from \"../errors.js\";\nimport { warn as logWarn } from \"../logger.js\";\n\n// PBKDF2-HMAC-SHA256 iteration count — follows OWASP 2024+ minimum for SHA-256.\nconst PBKDF2_ITERATIONS = 600_000;\n\n// Static salt used only for backward-compatible reads of legacy enc: (v1) values.\nconst V1_STATIC_SALT = Buffer.from(\"apcore-cli-config-v1\");\n\n// ---------------------------------------------------------------------------\n// Keytar dynamic import helper\n// ---------------------------------------------------------------------------\n\nlet keytarModule: any = null; // eslint-disable-line @typescript-eslint/no-explicit-any\nasync function getKeytar(): Promise<any> { // eslint-disable-line @typescript-eslint/no-explicit-any\n  if (keytarModule) return keytarModule;\n  try {\n    // @ts-expect-error — keytar is an optional peer dependency\n    keytarModule = await import(\"keytar\");\n    return keytarModule;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Test-only seam: inject a stand-in `keytar` module so unit tests can\n * exercise reachable-but-failing keyring paths (D10-003 regression\n * coverage). Pass `null` to clear and fall back to real-keytar discovery\n * on the next call. Production code MUST NOT call this.\n */\nexport function _setKeytarForTesting(mod: unknown): void { // eslint-disable-line @typescript-eslint/no-explicit-any\n  keytarModule = mod;\n}\n\n// ---------------------------------------------------------------------------\n// ConfigEncryptor\n// ---------------------------------------------------------------------------\n\n/**\n * Encrypts and decrypts configuration values. Prefers OS keyring for key\n * storage, falling back to AES-256-GCM with a key derived from\n * APCORE_CLI_CONFIG_PASSPHRASE when set, or from hostname+username\n * (obfuscation-only) as a last resort.\n *\n * Wire format v2: enc:v2:<base64(salt(16)+nonce(12)+tag(16)+ciphertext)>\n * Legacy format:  enc:<base64(nonce(12)+tag(16)+ciphertext)>  (read-only)\n */\nexport class ConfigEncryptor {\n  static readonly SERVICE_NAME = \"apcore-cli\";\n  // One-shot flag so the \"obfuscation only\" warning fires exactly once\n  // per process instead of once per encrypt/decrypt call.\n  private static weakFallbackWarned = false;\n\n  /**\n   * Encrypt and store a configuration value.\n   *\n   * Cross-SDK contract (D10-003, 2026-04-26): when the OS keyring is\n   * detected as available but `setPassword` then throws (locked keyring,\n   * transient backend failure, permission revoked, etc.), the error is\n   * propagated wrapped in a `ConfigDecryptionError`. Previously TS\n   * caught the exception and silently fell through to AES file encryption\n   * — a quiet downgrade that surprised users who expected a hard failure.\n   * Python lets the keyring exception propagate raw; Rust returns\n   * `ConfigDecryptionError::KeyringError`. The fall-through to AES is\n   * still reached when `getKeytar()` returns `null` (keyring\n   * genuinely unavailable on this platform / install).\n   */\n  async store(key: string, value: string): Promise<string> {\n    const keytar = await getKeytar();\n    if (keytar) {\n      try {\n        await keytar.setPassword(ConfigEncryptor.SERVICE_NAME, key, value);\n        return `keyring:${key}`;\n      } catch (err) {\n        // Reachable but rejected the write — surface the error rather\n        // than downgrading to file encryption. Use the existing\n        // ConfigDecryptionError class so callers handling either store\n        // or retrieve failures can keep a single catch.\n        const detail = err instanceof Error ? err.message : String(err);\n        throw new ConfigDecryptionError(\n          `Failed to store '${key}' in OS keyring: ${detail}. ` +\n            `Unset APCORE_CLI_CONFIG_PASSPHRASE-aware backends or unlock the keyring before retrying.`,\n        );\n      }\n    }\n    logWarn(\"OS keyring unavailable. Using file-based encryption.\");\n    const ciphertext = this.aesEncrypt(value);\n    return `enc:v2:${ciphertext.toString(\"base64\")}`;\n  }\n\n  /**\n   * Retrieve and decrypt a configuration value.\n   */\n  async retrieve(configValue: string, key: string): Promise<string> {\n    if (configValue.startsWith(\"keyring:\")) {\n      const keytar = await getKeytar();\n      if (!keytar) {\n        throw new ConfigDecryptionError(\n          `Keyring module not available to retrieve '${key}'.`,\n        );\n      }\n      try {\n        const refKey = configValue.slice(\"keyring:\".length);\n        const result = await keytar.getPassword(\n          ConfigEncryptor.SERVICE_NAME,\n          refKey,\n        );\n        if (result === null || result === undefined) {\n          throw new ConfigDecryptionError(\n            `Keyring entry not found for '${refKey}'.`,\n          );\n        }\n        return result;\n      } catch (err) {\n        if (err instanceof ConfigDecryptionError) throw err;\n        throw new ConfigDecryptionError(\n          `Failed to retrieve from keyring: ${err}`,\n        );\n      }\n    }\n\n    if (configValue.startsWith(\"enc:v2:\")) {\n      const data = Buffer.from(configValue.slice(\"enc:v2:\".length), \"base64\");\n      try {\n        return this.aesDecrypt(data);\n      } catch {\n        throw new ConfigDecryptionError(\n          `Failed to decrypt configuration value '${key}'. Re-configure with 'apcore-cli config set ${key}'.`,\n        );\n      }\n    }\n\n    if (configValue.startsWith(\"enc:\")) {\n      const data = Buffer.from(configValue.slice(\"enc:\".length), \"base64\");\n      try {\n        return this.aesDecryptV1(data);\n      } catch {\n        throw new ConfigDecryptionError(\n          `Failed to decrypt configuration value '${key}'. Re-configure with 'apcore-cli config set ${key}'.`,\n        );\n      }\n    }\n\n    // Unrecognized prefix — return as-is\n    return configValue;\n  }\n\n  // Derive an AES-256 key with a provided salt (v2 format).\n  //\n  // Order of preference:\n  //   1. APCORE_CLI_CONFIG_PASSPHRASE env var — a real secret supplied by\n  //      the user; produces a key an attacker with filesystem read cannot\n  //      reconstruct without also knowing the passphrase.\n  //   2. hostname + username — obfuscation-only derivation for backward\n  //      compatibility. Emits a loud stderr warning on first use so\n  //      operators know the stored value is NOT protected against a\n  //      filesystem-read attacker.\n  private deriveKey(salt: Buffer): Buffer {\n    const passphrase = process.env.APCORE_CLI_CONFIG_PASSPHRASE;\n    if (passphrase && passphrase.length > 0) {\n      return crypto.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, 32, \"sha256\");\n    }\n    if (!ConfigEncryptor.weakFallbackWarned) {\n      logWarn(\n        \"APCORE_CLI_CONFIG_PASSPHRASE is not set. The `enc:v2:` fallback uses a key \" +\n          \"derived from hostname+username (non-secret inputs) and is OBFUSCATION \" +\n          \"ONLY — an attacker with filesystem read access can reconstruct the key. \" +\n          \"Set APCORE_CLI_CONFIG_PASSPHRASE or ensure the OS keyring is available \" +\n          \"for real encryption.\",\n      );\n      ConfigEncryptor.weakFallbackWarned = true;\n    }\n    const hostname = os.hostname();\n    const username = process.env.USER ?? process.env.USERNAME ?? \"unknown\";\n    const material = `${hostname}:${username}`;\n    return crypto.pbkdf2Sync(material, salt, PBKDF2_ITERATIONS, 32, \"sha256\");\n  }\n\n  private aesEncrypt(plaintext: string): Buffer {\n    const salt = crypto.randomBytes(16);\n    const key = this.deriveKey(salt);\n    const nonce = crypto.randomBytes(12);\n    const cipher = crypto.createCipheriv(\"aes-256-gcm\", key, nonce);\n    const ct = Buffer.concat([\n      cipher.update(plaintext, \"utf-8\"),\n      cipher.final(),\n    ]);\n    const tag = cipher.getAuthTag();\n    // Wire format v2: salt(16) + nonce(12) + tag(16) + ciphertext\n    return Buffer.concat([salt, nonce, tag, ct]);\n  }\n\n  private aesDecrypt(data: Buffer): string {\n    const salt = data.subarray(0, 16);\n    const nonce = data.subarray(16, 28);\n    const tag = data.subarray(28, 44);\n    const ct = data.subarray(44);\n    const key = this.deriveKey(salt);\n    const decipher = crypto.createDecipheriv(\"aes-256-gcm\", key, nonce);\n    decipher.setAuthTag(tag);\n    return Buffer.concat([decipher.update(ct), decipher.final()]).toString(\"utf-8\");\n  }\n\n  /** Decrypt legacy v1-format values: nonce(12)+tag(16)+ct, static salt. */\n  private aesDecryptV1(data: Buffer): string {\n    const nonce = data.subarray(0, 12);\n    const tag = data.subarray(12, 28);\n    const ct = data.subarray(28);\n    const hostname = os.hostname();\n    const username = process.env.USER ?? process.env.USERNAME ?? \"unknown\";\n    const passphrase = process.env.APCORE_CLI_CONFIG_PASSPHRASE;\n    const materials: string[] = passphrase\n      ? [passphrase, `${hostname}:${username}`]\n      : [`${hostname}:${username}`];\n\n    for (const material of materials) {\n      for (const iterations of [600_000, 100_000]) {\n        try {\n          const key = crypto.pbkdf2Sync(material, V1_STATIC_SALT, iterations, 32, \"sha256\");\n          const decipher = crypto.createDecipheriv(\"aes-256-gcm\", key, nonce);\n          decipher.setAuthTag(tag);\n          return Buffer.concat([decipher.update(ct), decipher.final()]).toString(\"utf-8\");\n        } catch {\n          // try next combination\n        }\n      }\n    }\n    throw new Error(\"v1 decryption failed with all material+iteration combinations\");\n  }\n}\n","/**\n * AuthProvider — API key auth with keyring/encrypted storage.\n *\n * Protocol spec: Security — authentication\n */\n\nimport type { ConfigResolver } from \"../config.js\";\nimport { AuthenticationError, ConfigDecryptionError } from \"../errors.js\";\nimport { ConfigEncryptor } from \"./config-encryptor.js\";\n\n// ---------------------------------------------------------------------------\n// AuthProvider\n// ---------------------------------------------------------------------------\n\n/**\n * Manages API key retrieval and request authentication.\n */\nexport class AuthProvider {\n  private readonly config: ConfigResolver;\n  private readonly encryptor: ConfigEncryptor;\n\n  constructor(config: ConfigResolver, encryptor?: ConfigEncryptor) {\n    this.config = config;\n    this.encryptor = encryptor ?? new ConfigEncryptor();\n  }\n\n  /**\n   * Retrieve the API key from the configured sources.\n   * Handles keyring: and enc: prefixes via ConfigEncryptor.\n   */\n  async getApiKey(): Promise<string | null> {\n    const result = this.config.resolve(\n      \"auth.api_key\",\n      \"--api-key\",\n      \"APCORE_AUTH_API_KEY\",\n    );\n    if (result === null || result === undefined) {\n      return null;\n    }\n    const strResult = String(result);\n    if (strResult.startsWith(\"keyring:\") || strResult.startsWith(\"enc:\")) {\n      try {\n        return await this.encryptor.retrieve(strResult, \"auth.api_key\");\n      } catch (err) {\n        if (err instanceof ConfigDecryptionError) {\n          throw new AuthenticationError(\n            \"Failed to decrypt stored API key. \" +\n              \"Re-configure with 'apcore-cli config set auth.api_key'.\",\n          );\n        }\n        throw err;\n      }\n    }\n    return strResult;\n  }\n\n  /**\n   * Add authentication headers to an outgoing request.\n   *\n   * Cross-SDK contract (D10-002, 2026-04-26): the input `headers` object\n   * is mutated **in place** and the same reference is returned. Callers\n   * that share the headers reference (the documented pattern in\n   * apcore-cli/docs/features/security.md §AuthProvider) can read\n   * `headers.Authorization` after the call without re-binding the\n   * return value. Python and Rust both mutate-and-return; TS previously\n   * spread into a new object, which silently broke shared-reference\n   * callers.\n   */\n  async authenticateRequest(\n    headers: Record<string, string>,\n  ): Promise<Record<string, string>> {\n    const key = await this.getApiKey();\n    if (!key) {\n      throw new AuthenticationError(\n        \"Remote registry requires authentication. \" +\n          \"Set --api-key, APCORE_AUTH_API_KEY, or auth.api_key in config.\",\n      );\n    }\n    // Reject keys with CR/LF — a stray clipboard newline produces a confusing\n    // HTTP error; failing early with a clear message is safer.\n    if (/[\\r\\n]/.test(key)) {\n      throw new AuthenticationError(\n        \"Malformed API key: contains invalid characters (CR/LF). \" +\n          \"Re-configure with 'apcore-cli config set auth.api_key'.\",\n      );\n    }\n    headers.Authorization = `Bearer ${key.trim()}`;\n    return headers;\n  }\n\n  /**\n   * Handle an HTTP response status code for auth-related errors.\n   */\n  handleResponse(statusCode: number): void {\n    if (statusCode === 401 || statusCode === 403) {\n      throw new AuthenticationError(\n        \"Authentication failed. Verify your API key.\",\n      );\n    }\n  }\n}\n","/**\n * Security module re-exports.\n *\n * Protocol spec: Security subsystem\n */\n\nexport { AuditLogger, setAuditLogger, getAuditLogger } from \"./audit.js\";\nexport { AuthProvider } from \"./auth.js\";\nexport { ConfigEncryptor } from \"./config-encryptor.js\";\nexport { Sandbox } from \"./sandbox.js\";\n","/**\n * Discovery commands — list, describe, exec, validate (FE-04, FE-11, FE-13).\n *\n * Protocol spec: Module discovery & introspection\n *\n * FE-13 (builtin-group): these registrars attach per-subcommand to an\n * `apcli` Commander sub-group rather than to the root program.\n */\n\nimport { Command, Option } from \"commander\";\nimport { checkApproval } from \"./approval.js\";\nimport type { Executor, ModuleDescriptor, Registry } from \"./cli.js\";\nimport { EXIT_CODES, exitCodeForError } from \"./errors.js\";\nimport { validateModuleId, collectInput } from \"./main.js\";\nimport {\n  formatExecResult,\n  formatModuleDetail,\n  formatModuleList,\n  formatPreflightResult,\n  firstFailedExitCode,\n  resolveFormat,\n} from \"./output.js\";\nimport { getAuditLogger } from \"./security/audit.js\";\n\nconst TAG_PATTERN = /^[a-z][a-z0-9_-]*$/;\n\nfunction validateTag(tag: string): void {\n  if (!TAG_PATTERN.test(tag)) {\n    process.stderr.write(\n      `Error: Invalid tag format: '${tag}'. Tags must match [a-z][a-z0-9_-]*.\\n`,\n    );\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n}\n\n/**\n * Collect repeated --tag options into an array.\n */\nfunction collectTag(value: string, previous: string[]): string[] {\n  return previous.concat([value]);\n}\n\n/**\n * Collect repeated --annotation options into an array.\n */\nfunction collectAnnotation(value: string, previous: string[]): string[] {\n  return previous.concat([value]);\n}\n\n/**\n * Get an annotation value from a module descriptor.\n */\nfunction getAnnotationFlag(moduleDef: ModuleDescriptor, flag: string): boolean {\n  const annotations = moduleDef.annotations;\n  if (!annotations || typeof annotations !== \"object\") return false;\n  const ann = annotations as Record<string, unknown>;\n  // Map CLI flag names to annotation property names.\n  // Keep in sync with apcore ModuleAnnotations: the 6 pre-0.19.0 boolean\n  // fields plus `paginated` (added in apcore 0.19.0). Parity with\n  // ../apcore-cli-python/src/apcore_cli/discovery.py `_ann_map`.\n  const map: Record<string, string> = {\n    \"destructive\": \"destructive\",\n    \"requires-approval\": \"requires_approval\",\n    \"readonly\": \"readonly\",\n    \"streaming\": \"streaming\",\n    \"cacheable\": \"cacheable\",\n    \"idempotent\": \"idempotent\",\n    \"paginated\": \"paginated\",\n  };\n  const attr = map[flag] ?? flag;\n  return ann[attr] === true;\n}\n\n/**\n * Register the `list` subcommand on the given group (FE-13).\n */\nexport function registerListCommand(\n  apcliGroup: Command,\n  registry: Registry,\n  exposureFilter?: import(\"./exposure.js\").ExposureFilter,\n): void {\n  const listCmd = new Command(\"list\")\n    .description(\"List available modules in the registry.\")\n    .option(\"--tag <tag>\", \"Filter modules by tag (AND logic). Repeatable.\", collectTag, [])\n    .option(\"--flat\", \"Show flat list (no grouping).\", false)\n    .option(\"--format <format>\", \"Output format.\", undefined)\n    .option(\"-s, --search <query>\", \"Filter by substring match on ID and description.\")\n    .addOption(\n      new Option(\"--status <status>\", \"Filter by module status.\")\n        .choices([\"enabled\", \"disabled\", \"all\"])\n        .default(\"enabled\"),\n    )\n    .option(\"-a, --annotation <flag>\", \"Filter by annotation flag (AND logic). Repeatable.\", collectAnnotation, [])\n    .addOption(\n      new Option(\"--sort <field>\", \"Sort order.\")\n        .choices([\"id\", \"calls\", \"errors\", \"latency\"])\n        .default(\"id\"),\n    )\n    .option(\"--reverse\", \"Reverse sort order.\", false)\n    .option(\"--deprecated\", \"Include deprecated modules.\", false)\n    .option(\"--deps\", \"Show dependency count column.\", false)\n    .addOption(\n      new Option(\"--exposure <mode>\", \"Filter by exposure status.\")\n        .choices([\"exposed\", \"hidden\", \"all\"])\n        .default(\"exposed\"),\n    )\n    .action((opts: {\n      tag: string[];\n      flat: boolean;\n      format?: string;\n      search?: string;\n      status: string;\n      annotation: string[];\n      sort: string;\n      reverse: boolean;\n      deprecated: boolean;\n      deps: boolean;\n      exposure: string;\n    }) => {\n      // Validate tags\n      for (const t of opts.tag) {\n        validateTag(t);\n      }\n\n      let modules: ModuleDescriptor[] = [];\n      for (const m of registry.listModules()) {\n        modules.push(m);\n      }\n\n      // Tag filter (AND logic)\n      if (opts.tag.length > 0) {\n        const filterTags = new Set(opts.tag);\n        modules = modules.filter((m) => {\n          const mTags = m.tags ?? [];\n          return [...filterTags].every((t) => mTags.includes(t));\n        });\n      }\n\n      // Search filter (case-insensitive substring on id + description)\n      if (opts.search) {\n        const query = opts.search.toLowerCase();\n        modules = modules.filter(\n          (m) =>\n            (m.id ?? \"\").toLowerCase().includes(query) ||\n            (m.description ?? \"\").toLowerCase().includes(query),\n        );\n      }\n\n      // Status filter\n      if (opts.status === \"enabled\") {\n        modules = modules.filter((m) => {\n          const enabled = (m as unknown as Record<string, unknown>).enabled;\n          return enabled !== false;\n        });\n      } else if (opts.status === \"disabled\") {\n        modules = modules.filter((m) => {\n          const enabled = (m as unknown as Record<string, unknown>).enabled;\n          return enabled === false;\n        });\n      }\n      // \"all\": no filter\n\n      // Deprecated filter (excluded by default)\n      if (!opts.deprecated) {\n        modules = modules.filter((m) => {\n          const deprecated = (m as unknown as Record<string, unknown>).deprecated;\n          return deprecated !== true;\n        });\n      }\n\n      // Annotation filter (AND logic)\n      if (opts.annotation.length > 0) {\n        for (const annFlag of opts.annotation) {\n          modules = modules.filter((m) => getAnnotationFlag(m, annFlag));\n        }\n      }\n\n      // Sort — usage-based sorts require system.usage modules\n      if (opts.sort === \"calls\" || opts.sort === \"errors\" || opts.sort === \"latency\") {\n        process.stderr.write(\n          `Warning: Usage data not available; sorting by id. Sort by ${opts.sort} requires system.usage modules.\\n`,\n        );\n      }\n      modules.sort((a, b) => (a.id ?? \"\").localeCompare(b.id ?? \"\"));\n      if (opts.reverse) {\n        modules.reverse();\n      }\n\n      // Exposure filter (FE-12)\n      let showExposureCol = false;\n      if (exposureFilter && opts.exposure !== \"all\") {\n        if (opts.exposure === \"exposed\") {\n          modules = modules.filter((m) => exposureFilter.isExposed(m.id ?? \"\"));\n        } else if (opts.exposure === \"hidden\") {\n          modules = modules.filter((m) => !exposureFilter.isExposed(m.id ?? \"\"));\n        }\n      }\n      if (opts.exposure === \"all\" && exposureFilter) {\n        showExposureCol = true;\n      }\n\n      const fmt = resolveFormat(opts.format);\n      const filterTagsArg = opts.tag.length > 0 ? opts.tag : undefined;\n      formatModuleList(modules, fmt, filterTagsArg, opts.deps, showExposureCol ? exposureFilter : undefined);\n    });\n  apcliGroup.addCommand(listCmd);\n}\n\n/**\n * Register the `describe` subcommand on the given group (FE-13).\n */\nexport function registerDescribeCommand(\n  apcliGroup: Command,\n  registry: Registry,\n): void {\n  const describeCmd = new Command(\"describe\")\n    .description(\"Show metadata, schema, and annotations for a module.\")\n    .argument(\"<module-id>\", \"Module ID to describe\")\n    .option(\"--format <format>\", \"Output format.\", undefined)\n    .action((moduleId: string, opts: { format?: string }) => {\n      validateModuleId(moduleId);\n\n      const moduleDef = registry.getModule(moduleId);\n      if (!moduleDef) {\n        process.stderr.write(\n          `Error: Module '${moduleId}' not found.\\n`,\n        );\n        process.exit(EXIT_CODES.MODULE_NOT_FOUND);\n      }\n\n      const fmt = resolveFormat(opts.format);\n      formatModuleDetail(moduleDef, fmt);\n    });\n  apcliGroup.addCommand(describeCmd);\n}\n\n/**\n * Register the `exec` subcommand on the given group (FE-13).\n *\n * Generic dispatch: `apcli exec <module-id> [--format fmt] [--input json]`.\n * Unlike the per-module commands built by `buildModuleCommand`, this command\n * does not derive options from the module's input schema — inputs are passed\n * as a JSON object via `--input`. This mirrors the apcli-flavoured generic\n * dispatch contract in the builtin-group feature spec.\n */\nexport function registerExecCommand(\n  apcliGroup: Command,\n  registry: Registry,\n  executor: Executor,\n): void {\n  const execCmd = new Command(\"exec\")\n    .description(\"Execute a module by ID with JSON input.\")\n    .argument(\"<module-id>\", \"Module ID to execute\")\n    .option(\"--format <format>\", \"Output format (json, table, csv, yaml, jsonl).\")\n    .option(\"--fields <fields>\", \"Comma-separated dot-paths to select from the result.\")\n    .option(\n      \"--input <json>\",\n      \"JSON object passed as input to the module. Use '-' to read JSON from stdin.\",\n    )\n    .option(\"-y, --yes\", \"Auto-approve if the module declares requires_approval.\", false)\n    .option(\n      \"--approval-timeout <seconds>\",\n      \"Seconds to wait for interactive approval.\",\n      parseInt,\n    )\n    .option(\"--sandbox\", \"Run module in an isolated subprocess with restricted env.\", false)\n    .option(\"--strategy <name>\", \"Execution strategy (standard, parallel, sequential, etc.).\")\n    .option(\"--trace\", \"Enable pipeline trace output.\", false)\n    .option(\"--dry-run\", \"Validate inputs without executing the module.\", false)\n    .option(\"--stream\", \"Stream output as JSONL instead of buffering.\", false)\n    .action(async (\n      moduleId: string,\n      opts: {\n        format?: string;\n        fields?: string;\n        input?: string;\n        yes: boolean;\n        approvalTimeout?: number;\n        sandbox: boolean;\n        strategy?: string;\n        trace: boolean;\n        dryRun: boolean;\n        stream: boolean;\n      },\n    ) => {\n      validateModuleId(moduleId);\n\n      const moduleDef = registry.getModule(moduleId);\n      if (!moduleDef) {\n        process.stderr.write(`Error: Module '${moduleId}' not found.\\n`);\n        process.exit(EXIT_CODES.MODULE_NOT_FOUND);\n      }\n\n      // Parse --input. Distinguish between a stdin marker (\"-\") — delegated\n      // to collectInput — and an inline JSON literal, which we parse directly\n      // here since collectInput only treats \"-\" specially.\n      let merged: Record<string, unknown> = {};\n      if (opts.input === \"-\") {\n        merged = await collectInput(\"-\", {}, false);\n      } else if (opts.input !== undefined) {\n        try {\n          const parsed = JSON.parse(opts.input);\n          if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n            process.stderr.write(\"Error: --input JSON must be an object.\\n\");\n            process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n          }\n          merged = parsed as Record<string, unknown>;\n        } catch (err) {\n          const msg = err instanceof Error ? err.message : String(err);\n          process.stderr.write(`Error: --input is not valid JSON: ${msg}\\n`);\n          process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n        }\n      }\n\n      const startTime = performance.now();\n      try {\n        await checkApproval(moduleDef, opts.yes, opts.approvalTimeout);\n\n        // --dry-run: validate without executing\n        if (opts.dryRun) {\n          if (executor.validate) {\n            const preflight = await executor.validate(moduleId, merged);\n            formatPreflightResult(preflight, opts.format);\n          } else {\n            process.stdout.write(JSON.stringify({ valid: true }) + \"\\n\");\n          }\n          return;\n        }\n\n        let result: unknown;\n        if (opts.strategy && executor.callWithTrace) {\n          const [res] = await executor.callWithTrace(moduleId, merged, { strategy: opts.strategy });\n          result = res;\n        } else {\n          const { Sandbox } = await import(\"./security/index.js\");\n          const sandbox = new Sandbox(opts.sandbox);\n          result = await sandbox.execute(moduleId, merged, executor);\n        }\n        const durationMs = Math.round(performance.now() - startTime);\n\n        // Format output first (canonical ordering: format → audit on success)\n        const fmt = resolveFormat(opts.format);\n        formatExecResult(result, fmt, opts.fields);\n\n        // Audit success AFTER format so a formatter exception suppresses the entry\n        const auditLogger = getAuditLogger();\n        if (auditLogger) {\n          auditLogger.logExecution(moduleId, merged, \"success\", 0, durationMs);\n        }\n      } catch (err: unknown) {\n        const exitCode = exitCodeForError(err);\n        const durationMs = Math.round(performance.now() - startTime);\n        try {\n          const auditLogger = getAuditLogger();\n          if (auditLogger) {\n            auditLogger.logExecution(moduleId, merged, \"error\", exitCode, durationMs);\n          }\n        } catch {\n          // Ignore audit failures during error handling\n        }\n        process.stderr.write(`Error: ${err instanceof Error ? err.message : err}\\n`);\n        process.exit(exitCode);\n      }\n    });\n  apcliGroup.addCommand(execCmd);\n}\n\n/**\n * Register the standalone validate command.\n */\nexport function registerValidateCommand(\n  cli: Command,\n  registry: Registry,\n  executor: Executor,\n): void {\n  const validateCmd = new Command(\"validate\")\n    .description(\"Run preflight checks without executing a module.\")\n    .argument(\"<module-id>\", \"Module ID to validate\")\n    .option(\"--input <source>\", \"JSON input file or '-' for stdin.\")\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (moduleId: string, opts: { input?: string; format?: string }) => {\n      validateModuleId(moduleId);\n\n      const moduleDef = registry.getModule(moduleId);\n      if (!moduleDef) {\n        process.stderr.write(`Error: Module '${moduleId}' not found.\\n`);\n        process.exit(EXIT_CODES.MODULE_NOT_FOUND);\n      }\n\n      const merged = opts.input ? await collectInput(opts.input, {}, false) : {};\n\n      if (!executor.validate) {\n        process.stderr.write(\"Error: Executor does not support validate.\\n\");\n        process.exit(EXIT_CODES.MODULE_EXECUTE_ERROR);\n      }\n\n      // Mirror buildModuleCommand's dry-run path: no approval gate (preflight\n      // does not execute), but audit-log exceptions so scripted callers\n      // always produce a trail even on failed validation (main.ts:1151-1159).\n      try {\n        const preflight = await executor.validate(moduleId, merged);\n        formatPreflightResult(preflight, opts.format);\n        process.exit(preflight.valid ? 0 : firstFailedExitCode(preflight));\n      } catch (err: unknown) {\n        const exitCode = exitCodeForError(err);\n        try {\n          const auditLogger = getAuditLogger();\n          if (auditLogger) {\n            auditLogger.logExecution(moduleId, merged, \"error\", exitCode, 0);\n          }\n        } catch {\n          // Ignore audit failures during error handling\n        }\n        process.stderr.write(`Error: ${err instanceof Error ? err.message : err}\\n`);\n        process.exit(exitCode);\n      }\n    });\n  cli.addCommand(validateCmd);\n}\n\n// registerDiscoveryCommands was removed in FE-13 create-cli-integration.\n// Call registerListCommand + registerDescribeCommand directly.\n","/**\n * System management commands — health, usage, enable, disable, reload, config (FE-11 F2).\n *\n * Each registrar delegates to the corresponding system.* module via the\n * executor. The six registrars are pure attach-only operations and are\n * dispatched by `createCli()`'s FE-13 apcli group integration.\n */\n\nimport { Command } from \"commander\";\nimport type { Executor } from \"./cli.js\";\nimport { exitCodeForError } from \"./errors.js\";\nimport { formatExecResult, resolveFormat } from \"./output.js\";\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Call a system module via executor.call() when available, falling back to\n * executor.execute() otherwise.\n */\nasync function callSystemModule(\n  executor: Executor,\n  moduleId: string,\n  inputs: Record<string, unknown>,\n): Promise<unknown> {\n  if (executor.call) {\n    return executor.call(moduleId, inputs);\n  }\n  return executor.execute(moduleId, inputs);\n}\n\n/**\n * Emit a result as JSON when in non-TTY or when the caller requested\n * JSON format, otherwise invoke the TTY render callback. The callback\n * closes over the caller's local state (moduleId, opts.reason, etc.) so\n * each registrar can render its own TTY shape without threading those\n * values through this helper.\n */\nfunction emitResult(\n  jsonPayload: unknown,\n  fmt: string,\n  ttyRender: () => void,\n): void {\n  if (fmt === \"json\" || !process.stdout.isTTY) {\n    process.stdout.write(JSON.stringify(jsonPayload, null, 2) + \"\\n\");\n  } else {\n    ttyRender();\n  }\n}\n\n// Exit code mapped from the error's class / apcore `.code` via exitCodeForError\n// so scripted callers can distinguish ACL_DENIED (77) from MODULE_NOT_FOUND (44)\n// from generic MODULE_EXECUTE_ERROR (1).\nfunction emitErrorAndExit(e: unknown): never {\n  process.stderr.write(`Error: ${e instanceof Error ? e.message : e}\\n`);\n  process.exit(exitCodeForError(e));\n}\n\n// ---------------------------------------------------------------------------\n// TTY formatters (pre-split shape, unchanged)\n// ---------------------------------------------------------------------------\n\n/** Render health summary as TTY text. */\nfunction formatHealthSummaryTty(result: Record<string, unknown>): void {\n  const summary = (result.summary ?? {}) as Record<string, unknown>;\n  const modules = (result.modules ?? []) as Record<string, unknown>[];\n\n  if (modules.length === 0) {\n    process.stdout.write(\"No modules found.\\n\");\n    return;\n  }\n\n  const total = summary.total_modules ?? modules.length;\n  process.stdout.write(`Health Overview (${total} modules)\\n\\n`);\n  process.stdout.write(`  ${\"Module\".padEnd(28)} ${\"Status\".padEnd(12)} ${\"Error Rate\".padEnd(12)} Top Error\\n`);\n  process.stdout.write(`  ${\"-\".repeat(28)} ${\"-\".repeat(12)} ${\"-\".repeat(12)} ${\"-\".repeat(20)}\\n`);\n\n  for (const m of modules) {\n    const top = m.top_error as Record<string, unknown> | undefined;\n    const topStr = top ? `${top.code} (${top.count ?? \"?\"})` : \"—\";\n    const rate = `${((m.error_rate as number ?? 0) * 100).toFixed(1)}%`;\n    process.stdout.write(\n      `  ${String(m.module_id).padEnd(28)} ${String(m.status).padEnd(12)} ${rate.padEnd(12)} ${topStr}\\n`,\n    );\n  }\n\n  const parts: string[] = [];\n  for (const key of [\"healthy\", \"degraded\", \"error\"]) {\n    const count = summary[key] as number | undefined;\n    if (count) parts.push(`${count} ${key}`);\n  }\n  process.stdout.write(`\\nSummary: ${parts.join(\", \") || \"no data\"}\\n`);\n}\n\n/** Render single-module health detail. */\nfunction formatHealthModuleTty(result: Record<string, unknown>): void {\n  process.stdout.write(`Module: ${result.module_id ?? \"?\"}\\n`);\n  process.stdout.write(`Status: ${result.status ?? \"unknown\"}\\n`);\n  const total = result.total_calls as number ?? 0;\n  const errors = result.error_count as number ?? 0;\n  const rate = result.error_rate as number ?? 0;\n  const avg = result.avg_latency_ms as number ?? 0;\n  const p99 = result.p99_latency_ms as number ?? 0;\n  process.stdout.write(`Calls: ${total.toLocaleString()} total | ${errors.toLocaleString()} errors | ${(rate * 100).toFixed(1)}% error rate\\n`);\n  process.stdout.write(`Latency: ${avg.toFixed(0)}ms avg | ${p99.toFixed(0)}ms p99\\n`);\n\n  const recent = (result.recent_errors ?? []) as Record<string, unknown>[];\n  if (recent.length > 0) {\n    process.stdout.write(`\\nRecent Errors (top ${recent.length}):\\n`);\n    for (const e of recent) {\n      const count = e.count ?? \"?\";\n      const last = e.last_occurred ?? \"?\";\n      process.stdout.write(`  ${String(e.code ?? \"?\").padEnd(24)} x${count}  (last: ${last})\\n`);\n    }\n  }\n}\n\n/** Render usage summary as TTY text. */\nfunction formatUsageSummaryTty(result: Record<string, unknown>): void {\n  const modules = (result.modules ?? []) as Record<string, unknown>[];\n  const period = result.period ?? \"?\";\n\n  if (modules.length === 0) {\n    process.stdout.write(`No usage data for period ${period}.\\n`);\n    return;\n  }\n\n  process.stdout.write(`Usage Summary (last ${period})\\n\\n`);\n  process.stdout.write(`  ${\"Module\".padEnd(24)} ${\"Calls\".padStart(8)} ${\"Errors\".padStart(8)} ${\"Avg Latency\".padStart(12)} ${\"Trend\".padStart(10)}\\n`);\n  process.stdout.write(`  ${\"-\".repeat(24)} ${\"-\".repeat(8)} ${\"-\".repeat(8)} ${\"-\".repeat(12)} ${\"-\".repeat(10)}\\n`);\n\n  for (const m of modules) {\n    const avg = `${((m.avg_latency_ms as number) ?? 0).toFixed(0)}ms`;\n    process.stdout.write(\n      `  ${String(m.module_id).padEnd(24)} ${String((m.call_count as number) ?? 0).padStart(8)} ` +\n      `${String((m.error_count as number) ?? 0).padStart(8)} ${avg.padStart(12)} ${String(m.trend ?? \"\").padStart(10)}\\n`,\n    );\n  }\n\n  const totalCalls = (result.total_calls as number) ?? modules.reduce((s, m) => s + ((m.call_count as number) ?? 0), 0);\n  const totalErrors = (result.total_errors as number) ?? modules.reduce((s, m) => s + ((m.error_count as number) ?? 0), 0);\n  process.stdout.write(`\\nTotal: ${totalCalls.toLocaleString()} calls | ${totalErrors.toLocaleString()} errors\\n`);\n}\n\n// ---------------------------------------------------------------------------\n// Per-subcommand registrars (FE-13)\n// ---------------------------------------------------------------------------\n\n/**\n * Attach the `health` subcommand to the passed apcliGroup.\n */\nexport function registerHealthCommand(apcliGroup: Command, executor: Executor): void {\n  const healthCmd = new Command(\"health\")\n    .description(\"Show module health status. Optionally specify a module ID for details.\")\n    .argument(\"[module-id]\", \"Module ID for detailed health\")\n    .option(\"--threshold <number>\", \"Error rate threshold (default: 0.01).\", parseFloat, 0.01)\n    .option(\"--all\", \"Include healthy modules.\", false)\n    .option(\"--errors <count>\", \"Max recent errors (module detail only).\", parseInt, 10)\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (\n      moduleId: string | undefined,\n      opts: { threshold: number; all: boolean; errors: number; format?: string },\n    ) => {\n      const fmt = resolveFormat(opts.format);\n      try {\n        if (moduleId) {\n          const result = await callSystemModule(executor, \"system.health.module\", {\n            module_id: moduleId,\n            error_limit: opts.errors,\n          }) as Record<string, unknown>;\n          emitResult(result, fmt, () => formatHealthModuleTty(result));\n        } else {\n          const result = await callSystemModule(executor, \"system.health.summary\", {\n            error_rate_threshold: opts.threshold,\n            include_healthy: opts.all,\n          }) as Record<string, unknown>;\n          emitResult(result, fmt, () => formatHealthSummaryTty(result));\n        }\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  apcliGroup.addCommand(healthCmd);\n}\n\n/**\n * Attach the `usage` subcommand to the passed apcliGroup.\n */\nexport function registerUsageCommand(apcliGroup: Command, executor: Executor): void {\n  const usageCmd = new Command(\"usage\")\n    .description(\"Show module usage statistics. Optionally specify a module ID for details.\")\n    .argument(\"[module-id]\", \"Module ID for detailed usage\")\n    .option(\"--period <period>\", \"Time window: 1h, 24h, 7d, 30d.\", \"24h\")\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (moduleId: string | undefined, opts: { period: string; format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n      try {\n        let result: unknown;\n        if (moduleId) {\n          result = await callSystemModule(executor, \"system.usage.module\", {\n            module_id: moduleId,\n            period: opts.period,\n          });\n        } else {\n          result = await callSystemModule(executor, \"system.usage.summary\", {\n            period: opts.period,\n          });\n        }\n        emitResult(result, fmt, () => {\n          if (moduleId) {\n            formatExecResult(result, fmt);\n          } else {\n            formatUsageSummaryTty(result as Record<string, unknown>);\n          }\n        });\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  apcliGroup.addCommand(usageCmd);\n}\n\n/**\n * Attach the `enable` subcommand to the passed apcliGroup.\n */\nexport function registerEnableCommand(apcliGroup: Command, executor: Executor): void {\n  const enableCmd = new Command(\"enable\")\n    .description(\"Enable a disabled module at runtime.\")\n    .argument(\"<module-id>\", \"Module ID to enable\")\n    .requiredOption(\"--reason <reason>\", \"Reason for enabling (required for audit).\")\n    .option(\"-y, --yes\", \"Signal explicit intent (forwarded to server-side approval gate).\", false)\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (moduleId: string, opts: { reason: string; yes: boolean; format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n      try {\n        const result = await callSystemModule(executor, \"system.control.toggle_feature\", {\n          module_id: moduleId,\n          enabled: true,\n          reason: opts.reason,\n        }) as Record<string, unknown>;\n        emitResult(result, fmt, () => {\n          process.stdout.write(`Module '${moduleId}' enabled.\\n  Reason: ${opts.reason}\\n`);\n        });\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  apcliGroup.addCommand(enableCmd);\n}\n\n/**\n * Attach the `disable` subcommand to the passed apcliGroup.\n */\nexport function registerDisableCommand(apcliGroup: Command, executor: Executor): void {\n  const disableCmd = new Command(\"disable\")\n    .description(\"Disable a module at runtime (calls are rejected until re-enabled).\")\n    .argument(\"<module-id>\", \"Module ID to disable\")\n    .requiredOption(\"--reason <reason>\", \"Reason for disabling (required for audit).\")\n    .option(\"-y, --yes\", \"Signal explicit intent (forwarded to server-side approval gate).\", false)\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (moduleId: string, opts: { reason: string; yes: boolean; format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n      try {\n        const result = await callSystemModule(executor, \"system.control.toggle_feature\", {\n          module_id: moduleId,\n          enabled: false,\n          reason: opts.reason,\n        }) as Record<string, unknown>;\n        emitResult(result, fmt, () => {\n          process.stdout.write(`Module '${moduleId}' disabled.\\n  Reason: ${opts.reason}\\n`);\n        });\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  apcliGroup.addCommand(disableCmd);\n}\n\n/**\n * Attach the `reload` subcommand to the passed apcliGroup.\n */\nexport function registerReloadCommand(apcliGroup: Command, executor: Executor): void {\n  const reloadCmd = new Command(\"reload\")\n    .description(\"Hot-reload a module from disk.\")\n    .argument(\"<module-id>\", \"Module ID to reload\")\n    .requiredOption(\"--reason <reason>\", \"Reason for reload (required for audit).\")\n    .option(\"-y, --yes\", \"Signal explicit intent (forwarded to server-side approval gate).\", false)\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (moduleId: string, opts: { reason: string; yes: boolean; format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n      try {\n        const result = await callSystemModule(executor, \"system.control.reload_module\", {\n          module_id: moduleId,\n          reason: opts.reason,\n        }) as Record<string, unknown>;\n        emitResult(result, fmt, () => {\n          const prev = result.previous_version ?? \"?\";\n          const newVer = result.new_version ?? \"?\";\n          const dur = result.reload_duration_ms ?? \"?\";\n          process.stdout.write(`Module '${moduleId}' reloaded.\\n`);\n          process.stdout.write(`  Version: ${prev} -> ${newVer}\\n`);\n          process.stdout.write(`  Duration: ${dur}ms\\n`);\n        });\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  apcliGroup.addCommand(reloadCmd);\n}\n\n/**\n * Attach the `config` subcommand (with `get` and `set` children) to the\n * passed apcliGroup.\n *\n * Signature note: config reads/writes go through `executor.call()` to\n * `system.config.get` / `system.control.update_config`, so this registrar\n * takes an {@link Executor} (not a Registry). The FE-13 dispatcher table\n * entry for `config` sets `requiresExecutor: true` accordingly.\n */\nexport function registerConfigCommand(apcliGroup: Command, executor: Executor): void {\n  const configGroup = new Command(\"config\")\n    .description(\"Read or update runtime configuration.\");\n\n  const configGetCmd = new Command(\"get\")\n    .description(\"Read a configuration value by dot-path key.\")\n    .argument(\"<key>\", \"Configuration key (dot-path)\")\n    .option(\"--format <format>\", \"Output format.\", \"table\")\n    .action(async (key: string, opts: { format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n      try {\n        const result = await callSystemModule(executor, \"system.config.get\", { key });\n        const value = (result as Record<string, unknown>)?.value ?? result;\n        emitResult({ key, value }, fmt, () => {\n          process.stdout.write(`${key} = ${JSON.stringify(value)}\\n`);\n        });\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  configGroup.addCommand(configGetCmd);\n\n  const configSetCmd = new Command(\"set\")\n    .description(\"Update a runtime configuration value (audit-logged; server-side approval gate applies).\")\n    .argument(\"<key>\", \"Configuration key (dot-path)\")\n    .argument(\"<value>\", \"New value\")\n    .requiredOption(\"--reason <reason>\", \"Reason for config change (required for audit).\")\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (key: string, value: string, opts: { reason: string; format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n      // Attempt to parse value as JSON for typed values\n      let parsedValue: unknown;\n      try {\n        parsedValue = JSON.parse(value);\n      } catch {\n        parsedValue = value;\n      }\n\n      try {\n        const result = await callSystemModule(executor, \"system.control.update_config\", {\n          key,\n          value: parsedValue,\n          reason: opts.reason,\n        }) as Record<string, unknown>;\n        emitResult(result, fmt, () => {\n          const old = result.old_value ?? \"?\";\n          const newVal = result.new_value ?? \"?\";\n          process.stdout.write(`Config updated: ${key}\\n`);\n          process.stdout.write(`  ${JSON.stringify(old)} -> ${JSON.stringify(newVal)}\\n`);\n          process.stdout.write(`  Reason: ${opts.reason}\\n`);\n        });\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  configGroup.addCommand(configSetCmd);\n\n  apcliGroup.addCommand(configGroup);\n}\n\n// registerSystemCommands was removed in FE-13 create-cli-integration.\n// createCli() now dispatches the six per-subcommand registrars directly via\n// the `_registerApcliSubcommands` table in src/main.ts.\n","/**\n * Pipeline strategy commands — describe-pipeline (FE-11 F8).\n */\n\nimport { Command, Option } from \"commander\";\nimport type { Executor, StrategyInfo } from \"./cli.js\";\nimport { resolveFormat } from \"./output.js\";\n\n/**\n * Look up `StrategyInfo` for an arbitrary strategy name.\n *\n * apcore-js exposes two introspection entry points:\n *   - `Executor.listStrategies()` (static): returns info for all globally\n *     registered strategies.\n *   - `executor.describePipeline()` (instance, no args): returns info for\n *     the executor's *currently-set* strategy only.\n *\n * To describe a non-current strategy we need the static `listStrategies`.\n * We reach it via the runtime constructor of the executor instance so the\n * CLI does not have to directly import the apcore-js `Executor` class\n * (preserves the loose structural contract used elsewhere in this package).\n *\n * Returns `{ info, isCurrent }` so the caller does not need a second\n * `describePipeline()` invocation to ask the same \"is this the current\n * strategy?\" question — only the current strategy exposes step-level\n * metadata (`executor.currentStrategy.steps`).\n */\nfunction lookupStrategyInfo(\n  executor: Executor,\n  strategyName: string,\n): { info: StrategyInfo | null; isCurrent: boolean } {\n  // 1. Is the requested strategy the executor's current one?\n  if (typeof executor.describePipeline === \"function\") {\n    try {\n      const current = executor.describePipeline();\n      if (current && current.name === strategyName) {\n        return { info: current, isCurrent: true };\n      }\n    } catch {\n      // Fall through to the static lookup.\n    }\n  }\n\n  // 2. Walk the static registry via the constructor.\n  const ctor = (executor as unknown as { constructor?: unknown }).constructor as\n    | { listStrategies?: () => StrategyInfo[] }\n    | undefined;\n  if (ctor && typeof ctor.listStrategies === \"function\") {\n    try {\n      const all = ctor.listStrategies();\n      const info = all.find((s) => s.name === strategyName) ?? null;\n      return { info, isCurrent: false };\n    } catch {\n      return { info: null, isCurrent: false };\n    }\n  }\n  return { info: null, isCurrent: false };\n}\n\n/** Preset pipeline steps for each strategy. */\nconst PRESET_STEPS: Record<string, string[]> = {\n  standard: [\n    \"context_creation\",\n    \"call_chain_guard\",\n    \"module_lookup\",\n    \"acl_check\",\n    \"approval_gate\",\n    \"middleware_before\",\n    \"input_validation\",\n    \"execute\",\n    \"output_validation\",\n    \"middleware_after\",\n    \"return_result\",\n  ],\n  internal: [\n    \"context_creation\",\n    \"call_chain_guard\",\n    \"module_lookup\",\n    \"middleware_before\",\n    \"input_validation\",\n    \"execute\",\n    \"output_validation\",\n    \"middleware_after\",\n    \"return_result\",\n  ],\n  testing: [\n    \"context_creation\",\n    \"module_lookup\",\n    \"middleware_before\",\n    \"input_validation\",\n    \"execute\",\n    \"output_validation\",\n    \"middleware_after\",\n    \"return_result\",\n  ],\n  performance: [\n    \"context_creation\",\n    \"call_chain_guard\",\n    \"module_lookup\",\n    \"acl_check\",\n    \"approval_gate\",\n    \"input_validation\",\n    \"execute\",\n    \"output_validation\",\n    \"return_result\",\n  ],\n  minimal: [\n    \"context_creation\",\n    \"module_lookup\",\n    \"execute\",\n    \"return_result\",\n  ],\n};\n\n/**\n * Register the describe-pipeline command.\n */\nexport function registerPipelineCommand(cli: Command, executor: Executor): void {\n  const pipelineCmd = new Command(\"describe-pipeline\")\n    .description(\"Show the execution pipeline steps for a strategy.\")\n    .addOption(\n      new Option(\"--strategy <name>\", \"Strategy to describe (default: standard).\")\n        .choices([\"standard\", \"internal\", \"testing\", \"performance\", \"minimal\"])\n        .default(\"standard\"),\n    )\n    .option(\"--format <format>\", \"Output format.\")\n    .action((opts: { strategy: string; format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n\n      // Look up info for the requested strategy (current strategy via\n      // describePipeline(), arbitrary strategy via Executor.listStrategies()).\n      const { info, isCurrent } = lookupStrategyInfo(executor, opts.strategy);\n\n      if (info) {\n        // Step metadata (pure/removable/timeoutMs) is only available for the\n        // executor's *current* strategy via `currentStrategy.steps` — other\n        // registered strategies expose only their `StrategyInfo` summary.\n        const strategySteps = isCurrent ? (executor.currentStrategy?.steps ?? []) : [];\n        const header = `Pipeline: ${info.name} (${info.stepCount} steps)`;\n\n        if (fmt === \"json\" || !process.stdout.isTTY) {\n          const payload = {\n            strategy: info.name,\n            step_count: info.stepCount,\n            description: info.description,\n            steps: info.stepNames.map((name, i) => {\n              const stepMeta = strategySteps[i];\n              return {\n                index: i + 1,\n                name,\n                pure: stepMeta?.pure ?? false,\n                removable: stepMeta?.removable ?? true,\n                timeout_ms: stepMeta?.timeoutMs ?? null,\n              };\n            }),\n          };\n          process.stdout.write(JSON.stringify(payload, null, 2) + \"\\n\");\n        } else {\n          process.stdout.write(`${header}\\n\\n`);\n          process.stdout.write(`  ${\"#\".padEnd(4)} ${\"Step\".padEnd(28)} ${\"Pure\".padEnd(6)} ${\"Removable\".padEnd(11)} Timeout\\n`);\n          process.stdout.write(`  ${\"-\".repeat(4)} ${\"-\".repeat(28)} ${\"-\".repeat(6)} ${\"-\".repeat(11)} ${\"-\".repeat(8)}\\n`);\n          for (let i = 0; i < info.stepNames.length; i++) {\n            const stepMeta = strategySteps[i];\n            const pure = stepMeta?.pure ? \"yes\" : \"no\";\n            const removable = stepMeta?.removable !== false ? \"yes\" : \"no\";\n            const timeout = stepMeta?.timeoutMs ? `${stepMeta.timeoutMs}ms` : \"\\u2014\";\n            process.stdout.write(`  ${String(i + 1).padEnd(4)} ${info.stepNames[i].padEnd(28)} ${pure.padEnd(6)} ${removable.padEnd(11)} ${timeout}\\n`);\n          }\n        }\n        return;\n      }\n\n      // Fall back to static preset info for known strategies.\n      const steps = PRESET_STEPS[opts.strategy] ?? [];\n      const pureSteps = new Set([\n        \"context_creation\", \"call_chain_guard\", \"module_lookup\", \"acl_check\", \"input_validation\",\n      ]);\n      const nonRemovable = new Set([\n        \"context_creation\", \"module_lookup\", \"execute\", \"return_result\",\n      ]);\n\n      if (fmt === \"json\" || !process.stdout.isTTY) {\n        const payload = {\n          strategy: opts.strategy,\n          step_count: steps.length,\n          steps: steps.map((s, i) => ({\n            index: i + 1,\n            name: s,\n            pure: pureSteps.has(s),\n            removable: !nonRemovable.has(s),\n          })),\n        };\n        process.stdout.write(JSON.stringify(payload, null, 2) + \"\\n\");\n      } else {\n        process.stdout.write(`Pipeline: ${opts.strategy} (${steps.length} steps)\\n\\n`);\n        process.stdout.write(`  ${\"#\".padEnd(4)} ${\"Step\".padEnd(28)} ${\"Pure\".padEnd(6)} ${\"Removable\".padEnd(11)} Timeout\\n`);\n        process.stdout.write(`  ${\"-\".repeat(4)} ${\"-\".repeat(28)} ${\"-\".repeat(6)} ${\"-\".repeat(11)} ${\"-\".repeat(8)}\\n`);\n        for (let i = 0; i < steps.length; i++) {\n          const pure = pureSteps.has(steps[i]) ? \"yes\" : \"no\";\n          const removable = nonRemovable.has(steps[i]) ? \"no\" : \"yes\";\n          process.stdout.write(`  ${String(i + 1).padEnd(4)} ${steps[i].padEnd(28)} ${pure.padEnd(6)} ${removable.padEnd(11)} \\u2014\\n`);\n        }\n      }\n    });\n  cli.addCommand(pipelineCmd);\n}\n","/**\n * Built-in Command Group (FE-13).\n *\n * Encapsulates visibility resolution and subcommand filtering for the\n * reserved `apcli` group. Instantiated once by createCli() and attached\n * to the root command.\n *\n * Shape mirrors `src/exposure.ts` ExposureFilter: private constructor,\n * named static factories, and a small set of predicate methods.\n * See the feature spec §4.2–4.7 for authoritative semantics.\n */\n\nimport { EXIT_CODES } from \"./errors.js\";\nimport { warn } from \"./logger.js\";\n\n// ---------------------------------------------------------------------------\n// Types & constants\n// ---------------------------------------------------------------------------\n\n/**\n * Resolved visibility mode.\n *\n * `\"auto\"` is an internal sentinel — it is never returned from\n * {@link ApcliGroup.resolveVisibility} and is rejected when supplied via\n * user config (CliConfig or apcore.yaml).\n */\nexport type ApcliMode = \"auto\" | \"all\" | \"none\" | \"include\" | \"exclude\";\n\n/**\n * User-facing apcli config shape.\n *\n * Boolean shorthand maps to `{mode: \"all\"}` / `{mode: \"none\"}`.\n * Object form rejects `\"auto\"` per spec §4.2 (internal sentinel only).\n */\nexport type ApcliConfig =\n  | boolean\n  | {\n      mode?: Exclude<ApcliMode, \"auto\">;\n      include?: string[];\n      exclude?: string[];\n      disableEnv?: boolean;\n    };\n\n/** Set of group names reserved by apcore-cli (checked in cli.ts). */\nexport const RESERVED_GROUP_NAMES: ReadonlySet<string> = new Set([\"apcli\"]);\n\nconst VALID_USER_MODES: ReadonlySet<string> = new Set([\n  \"all\",\n  \"none\",\n  \"include\",\n  \"exclude\",\n]);\n\n/**\n * Canonical set of apcli subcommand names.\n *\n * Declarative mirror of the registration TABLE in `src/main.ts`\n * (`_registerApcliSubcommands`). Used by `_normalizeList` to warn on\n * unknown entries in include/exclude lists (spec §7 error table / T-APCLI-25).\n *\n * Keep in sync with main.ts TABLE if subcommands are added or removed.\n */\nexport const APCLI_SUBCOMMAND_NAMES: ReadonlySet<string> = new Set([\n  \"list\",\n  \"describe\",\n  \"exec\",\n  \"validate\",\n  \"init\",\n  \"health\",\n  \"usage\",\n  \"enable\",\n  \"disable\",\n  \"reload\",\n  \"config\",\n  \"completion\",\n  \"describe-pipeline\",\n]);\n\n// ---------------------------------------------------------------------------\n// ApcliGroup\n// ---------------------------------------------------------------------------\n\ninterface ApcliGroupInit {\n  mode: ApcliMode;\n  include: string[];\n  exclude: string[];\n  disableEnv: boolean;\n  registryInjected: boolean;\n  fromCliConfig: boolean;\n}\n\n/**\n * Visibility configuration for the built-in `apcli` command group.\n *\n * Instantiated via {@link ApcliGroup.fromCliConfig} (Tier 1) or\n * {@link ApcliGroup.fromYaml} (Tier 3). The constructor is private to\n * preserve the Tier-1-vs-Tier-3 flag distinction.\n */\nexport class ApcliGroup {\n  private readonly _mode: ApcliMode;\n  private readonly _include: string[];\n  private readonly _exclude: string[];\n  private readonly _disableEnv: boolean;\n  private readonly _registryInjected: boolean;\n  private readonly _fromCliConfig: boolean;\n\n  private constructor(init: ApcliGroupInit) {\n    this._mode = init.mode;\n    this._include = init.include;\n    this._exclude = init.exclude;\n    this._disableEnv = init.disableEnv;\n    this._registryInjected = init.registryInjected;\n    this._fromCliConfig = init.fromCliConfig;\n  }\n\n  /**\n   * Tier 1 constructor — config came from `createCli({ apcli })`.\n   *\n   * A non-auto mode from this tier wins over env var and yaml.\n   */\n  static fromCliConfig(\n    config: ApcliConfig | undefined,\n    opts: { registryInjected: boolean },\n  ): ApcliGroup {\n    return ApcliGroup._build(config, opts, /*fromCliConfig*/ true);\n  }\n\n  /**\n   * Tier 3 constructor — config came from `apcore.yaml`.\n   *\n   * Env var (Tier 2) may override the yaml-supplied mode.\n   */\n  static fromYaml(\n    config: unknown,\n    opts: { registryInjected: boolean },\n  ): ApcliGroup {\n    return ApcliGroup._build(\n      config as ApcliConfig | undefined,\n      opts,\n      /*fromCliConfig*/ false,\n    );\n  }\n\n  /**\n   * Non-panicking Tier 3 factory (A-001 parity with Rust's `try_from_yaml`).\n   * Returns `[instance, null]` on success or `[null, errorMessage]` on invalid input.\n   * Use this in programmatic contexts where throwing/exiting is unwanted.\n   */\n  static tryFromYaml(\n    config: unknown,\n    opts: { registryInjected: boolean },\n  ): [ApcliGroup, null] | [null, string] {\n    if (config !== null && config !== undefined && typeof config !== \"boolean\" && typeof config !== \"object\") {\n      return [null, `apcore.yaml 'apcli:' must be a bool, object, or null; got ${typeof config}`];\n    }\n    if (config !== null && config !== undefined && typeof config === \"object\" && !Array.isArray(config)) {\n      const mode = (config as Record<string, unknown>)[\"mode\"];\n      if (mode !== undefined && mode !== null) {\n        const validModes = [\"all\", \"none\", \"include\", \"exclude\"];\n        if (typeof mode !== \"string\" || !validModes.includes(mode)) {\n          return [null, `Invalid apcli mode: '${mode}'. Must be one of: all, none, include, exclude.`];\n        }\n      }\n    }\n    return [ApcliGroup.fromYaml(config, opts), null];\n  }\n\n  // -------------------------------------------------------------------------\n  // Internal builder — shared by both factories\n  // -------------------------------------------------------------------------\n\n  private static _build(\n    config: ApcliConfig | undefined,\n    opts: { registryInjected: boolean },\n    fromCliConfig: boolean,\n  ): ApcliGroup {\n    // Boolean shorthand → normalized object form.\n    if (config === true) {\n      return new ApcliGroup({\n        mode: \"all\",\n        include: [],\n        exclude: [],\n        disableEnv: false,\n        registryInjected: opts.registryInjected,\n        fromCliConfig,\n      });\n    }\n    if (config === false) {\n      return new ApcliGroup({\n        mode: \"none\",\n        include: [],\n        exclude: [],\n        disableEnv: false,\n        registryInjected: opts.registryInjected,\n        fromCliConfig,\n      });\n    }\n\n    // Missing / nullish → auto-detect (mode left as internal sentinel).\n    if (config === undefined || config === null) {\n      return new ApcliGroup({\n        mode: \"auto\",\n        include: [],\n        exclude: [],\n        disableEnv: false,\n        registryInjected: opts.registryInjected,\n        fromCliConfig,\n      });\n    }\n\n    if (typeof config !== \"object\" || Array.isArray(config)) {\n      // Unexpected shape — refuse to silently coerce.\n      process.stderr.write(\n        `Error: apcli config must be a boolean or object; got ${Array.isArray(config) ? \"array\" : typeof config}.\\n`,\n      );\n      process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n    }\n\n    const cfg = config as Record<string, unknown>;\n\n    // Mode validation. `\"auto\"` and unknown values are rejected.\n    let mode: ApcliMode;\n    if (cfg.mode === undefined || cfg.mode === null) {\n      // Object form without mode (e.g. `{disableEnv: true}`) → mode auto.\n      mode = \"auto\";\n    } else if (typeof cfg.mode !== \"string\") {\n      process.stderr.write(\n        `Error: apcli.mode must be a string; got ${typeof cfg.mode}. ` +\n          `Expected one of all|none|include|exclude.\\n`,\n      );\n      process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n    } else if (!VALID_USER_MODES.has(cfg.mode)) {\n      process.stderr.write(\n        `Error: apcli.mode '${cfg.mode}' is invalid. ` +\n          `Expected one of all|none|include|exclude.\\n`,\n      );\n      process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n    } else {\n      mode = cfg.mode as ApcliMode;\n    }\n\n    // include / exclude lists — warn on non-array, keep entries as-is.\n    const include = ApcliGroup._normalizeList(cfg.include, \"include\");\n    const exclude = ApcliGroup._normalizeList(cfg.exclude, \"exclude\");\n\n    // disableEnv — accept both camelCase (JS object literal) and snake_case\n    // (yaml-per-spec §4.2 / §10.3). Must be boolean; warn + treat as false\n    // otherwise.\n    const rawDisableEnv =\n      cfg.disableEnv !== undefined\n        ? cfg.disableEnv\n        : (cfg as Record<string, unknown>)[\"disable_env\"];\n    let disableEnv = false;\n    if (rawDisableEnv !== undefined) {\n      if (typeof rawDisableEnv === \"boolean\") {\n        disableEnv = rawDisableEnv;\n      } else {\n        warn(\n          `apcli.disable_env must be boolean; got ${typeof rawDisableEnv}. Treating as false.`,\n        );\n      }\n    }\n\n    return new ApcliGroup({\n      mode,\n      include,\n      exclude,\n      disableEnv,\n      registryInjected: opts.registryInjected,\n      fromCliConfig,\n    });\n  }\n\n  /**\n   * Normalize an include/exclude list. Non-array → warn and return [].\n   *\n   * Unknown but well-formed entries emit a WARNING (spec §7 error table,\n   * T-APCLI-25) but are retained in the returned list for forward-compat —\n   * if apcore-cli later adds a subcommand named `foo`, existing configs\n   * continue to work without a config change. At runtime, unknown names\n   * simply never match any registered subcommand.\n   */\n  private static _normalizeList(raw: unknown, label: string): string[] {\n    if (raw === undefined || raw === null) return [];\n    if (!Array.isArray(raw)) {\n      warn(`apcli.${label} must be a list; got ${typeof raw}. Ignoring.`);\n      return [];\n    }\n    const out: string[] = [];\n    for (const entry of raw) {\n      if (typeof entry === \"string\" && entry.length > 0) {\n        if (!APCLI_SUBCOMMAND_NAMES.has(entry)) {\n          warn(\n            `Unknown apcli subcommand '${entry}' in ${label} list — ignoring.`,\n          );\n        }\n        out.push(entry);\n      } else {\n        warn(`apcli.${label} contains non-string entry; skipping.`);\n      }\n    }\n    return out;\n  }\n\n  // -------------------------------------------------------------------------\n  // Public API\n  // -------------------------------------------------------------------------\n\n  /**\n   * Resolve effective visibility mode after applying tier precedence.\n   *\n   * Returns one of `\"all\" | \"none\" | \"include\" | \"exclude\"` — never `\"auto\"`.\n   *\n   * Tier order (spec §4.4):\n   *   1. CliConfig non-auto wins outright.\n   *   2. `APCORE_CLI_APCLI` env var (unless sealed by disableEnv).\n   *   3. yaml non-auto.\n   *   4. Auto-detect from registryInjected.\n   */\n  resolveVisibility(): \"all\" | \"none\" | \"include\" | \"exclude\" {\n    // Tier 1 — CliConfig non-auto.\n    if (this._fromCliConfig && this._mode !== \"auto\") {\n      return this._mode;\n    }\n\n    // Tier 2 — env var (unless sealed).\n    if (!this._disableEnv) {\n      const envMode = this._parseEnv(process.env.APCORE_CLI_APCLI);\n      if (envMode !== null) {\n        return envMode;\n      }\n    }\n\n    // Tier 3 — yaml non-auto.\n    if (this._mode !== \"auto\") {\n      return this._mode;\n    }\n\n    // Tier 4 — auto-detect.\n    return this._registryInjected ? \"none\" : \"all\";\n  }\n\n  /**\n   * True iff `subcommand` passes the include/exclude filter.\n   *\n   * Callers MUST first check {@link resolveVisibility} — this method throws\n   * under modes `\"all\"` or `\"none\"` (caller bug per spec §4.6).\n   */\n  isSubcommandIncluded(subcommand: string): boolean {\n    const mode = this.resolveVisibility();\n    if (mode === \"include\") return this._include.includes(subcommand);\n    if (mode === \"exclude\") return !this._exclude.includes(subcommand);\n    throw new Error(\n      `isSubcommandIncluded called under mode '${mode}'; caller should bypass.`,\n    );\n  }\n\n  /** True iff the `apcli` group itself should appear in root `--help`. */\n  isGroupVisible(): boolean {\n    return this.resolveVisibility() !== \"none\";\n  }\n\n  // -------------------------------------------------------------------------\n  // Env parser (Tier 2) — co-located per spec §4.4\n  // -------------------------------------------------------------------------\n\n  /**\n   * Parse APCORE_CLI_APCLI. Case-insensitive.\n   *\n   * - `show` / `1` / `true` → `\"all\"`\n   * - `hide` / `0` / `false` → `\"none\"`\n   * - Empty / unset → `null`\n   * - Anything else → warn and return `null`\n   */\n  private _parseEnv(raw: string | undefined): \"all\" | \"none\" | null {\n    if (raw === undefined || raw === \"\") return null;\n    const normalized = raw.toLowerCase();\n    if (normalized === \"show\" || normalized === \"1\" || normalized === \"true\") {\n      return \"all\";\n    }\n    if (\n      normalized === \"hide\" ||\n      normalized === \"0\" ||\n      normalized === \"false\"\n    ) {\n      return \"none\";\n    }\n    warn(\n      `Unknown APCORE_CLI_APCLI value '${raw}', ignoring. ` +\n        `Expected: show, hide, 1, 0, true, false.`,\n    );\n    return null;\n  }\n}\n","/**\n * Module Exposure Filtering (FE-12).\n *\n * Provides declarative control over which discovered modules are exposed\n * as CLI commands. Supports three modes: all, include (whitelist), and\n * exclude (blacklist) with glob-pattern matching on module IDs.\n */\n\nimport { warn } from \"./logger.js\";\n\n// ---------------------------------------------------------------------------\n// Glob pattern compiler\n// ---------------------------------------------------------------------------\n\n/** Escape special regex characters in a string. */\nfunction escapeRegex(str: string): string {\n  return str.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\n/**\n * Compile a glob pattern to a regex.\n *\n * - `*` matches a single dotted segment (no dots): `[^.]*`\n * - `**` matches across segments (any characters including dots): `.+`\n * - Literal text is matched exactly via regex escaping.\n */\nexport function compilePattern(pattern: string): RegExp {\n  const sentinel = \"\\x00GLOB\\x00\";\n  const escaped = pattern.replaceAll(\"**\", sentinel);\n  const parts = escaped.split(\"*\");\n  const regexParts = parts.map((p) => {\n    const restored = p.replaceAll(sentinel, \"**\");\n    return escapeRegex(restored);\n  });\n  let regex = regexParts.join(\"[^.]*\");\n  regex = regex.replaceAll(\"\\\\*\\\\*\", \".+\");\n  return new RegExp(`^${regex}$`);\n}\n\n/** Test whether a moduleId matches a glob pattern. */\nexport function globMatch(moduleId: string, pattern: string): boolean {\n  return compilePattern(pattern).test(moduleId);\n}\n\n// ---------------------------------------------------------------------------\n// ExposureFilter\n// ---------------------------------------------------------------------------\n\n/**\n * Determines which modules are exposed as CLI commands.\n *\n * Filtering modes:\n * - `all`: every discovered module becomes a CLI command (default).\n * - `include`: only modules matching at least one include pattern are exposed.\n * - `exclude`: all modules are exposed except those matching any exclude pattern.\n */\nexport class ExposureFilter {\n  static readonly VALID_MODES = [\"all\", \"include\", \"exclude\", \"none\"] as const;\n\n  readonly _mode: string;\n  private readonly _compiledInclude: RegExp[];\n  private readonly _compiledExclude: RegExp[];\n\n  constructor(mode = \"all\", include?: string[], exclude?: string[]) {\n    // Cross-SDK parity with apcore-cli-rust/src/exposure.rs:70 (D11-008):\n    // unknown mode values clamp to \"none\" with a warning so consumers that\n    // introspect ``filter.mode`` see a consistent string across the three\n    // SDKs. Runtime exposure decision is unchanged (isExposed already\n    // fail-closes on unknown modes via its default-false branch); the\n    // clamp aligns the persisted state.\n    if (!ExposureFilter.VALID_MODES.includes(mode as (typeof ExposureFilter.VALID_MODES)[number])) {\n      process.stderr.write(\n        `Warning: Unknown ExposureFilter mode '${mode}' — defaulting to 'none'. Valid modes: ${ExposureFilter.VALID_MODES.join(\", \")}.\\n`,\n      );\n      mode = \"none\";\n    }\n    this._mode = mode;\n    const dedup = (arr: string[]) => [...new Set(arr)];\n    this._compiledInclude = dedup(include ?? []).map(compilePattern);\n    this._compiledExclude = dedup(exclude ?? []).map(compilePattern);\n  }\n\n  /** Return true if the module should be exposed as a CLI command. */\n  isExposed(moduleId: string): boolean {\n    if (this._mode === \"all\") return true;\n    if (this._mode === \"include\") {\n      return this._compiledInclude.some((rx) => rx.test(moduleId));\n    }\n    if (this._mode === \"exclude\") {\n      return !this._compiledExclude.some((rx) => rx.test(moduleId));\n    }\n    return false;\n  }\n\n  /** Partition moduleIds into [exposed, hidden] lists. */\n  filterModules(moduleIds: string[]): [string[], string[]] {\n    const exposed: string[] = [];\n    const hidden: string[] = [];\n    for (const mid of moduleIds) {\n      (this.isExposed(mid) ? exposed : hidden).push(mid);\n    }\n    return [exposed, hidden];\n  }\n\n  /**\n   * Create an ExposureFilter from a parsed config dict.\n   *\n   * Expected: `{ expose: { mode: \"include\", include: [\"admin.*\"] } }`\n   */\n  static fromConfig(config: Record<string, unknown>): ExposureFilter {\n    const expose = config.expose ?? {};\n    if (typeof expose !== \"object\" || expose === null || Array.isArray(expose)) {\n      warn(\"Invalid 'expose' config (expected dict), using mode: all.\");\n      return new ExposureFilter();\n    }\n\n    const exposeObj = expose as Record<string, unknown>;\n    const mode = (exposeObj.mode as string) ?? \"all\";\n    if (![\"all\", \"include\", \"exclude\"].includes(mode)) {\n      throw new Error(\n        `Invalid expose mode: '${mode}'. Must be one of: all, include, exclude.`,\n      );\n    }\n\n    let include = exposeObj.include ?? [];\n    if (!Array.isArray(include)) {\n      warn(\"Invalid 'expose.include' (expected list), ignoring.\");\n      include = [];\n    }\n\n    let exclude = exposeObj.exclude ?? [];\n    if (!Array.isArray(exclude)) {\n      warn(\"Invalid 'expose.exclude' (expected list), ignoring.\");\n      exclude = [];\n    }\n\n    const filterList = (arr: unknown[], label: string): string[] => {\n      const result: string[] = [];\n      for (const p of arr) {\n        if (!p) {\n          warn(`Empty pattern in expose.${label}, skipping.`);\n        } else {\n          result.push(String(p));\n        }\n      }\n      return result;\n    };\n\n    return new ExposureFilter(\n      mode,\n      filterList(include as unknown[], \"include\"),\n      filterList(exclude as unknown[], \"exclude\"),\n    );\n  }\n}\n","/**\n * Canonical help formatter — clap/GNU-style output shared across the\n * apcore-cli SDK family (TS, Python, Rust).\n *\n * Conventions:\n *   - Description before Usage\n *   - `Usage: <prog> [OPTIONS] [COMMAND]` (uppercase)\n *   - `Commands:` section before `Options:`\n *   - `<UPPER>` placeholders\n *   - `[default: VALUE]` (brackets, no quotes)\n *   - `-h, --help` → \"Print help\", `-V, --version` → \"Print version\"\n *   - Long-only options indented 4 extra spaces so `--long` aligns with\n *     `-s, --long` rows\n */\n\nimport type { Command, Help, Option } from \"commander\";\n\ntype HelpTextSection =\n  | string\n  | ((ctx: { error: boolean; command: Command }) => string);\n\ninterface CommandHelpTextBag {\n  beforeAll?: HelpTextSection;\n  before?: HelpTextSection;\n  after?: HelpTextSection;\n  afterAll?: HelpTextSection;\n}\n\nfunction resolveHelpText(cmd: Command, section: keyof CommandHelpTextBag): string {\n  const bag = (cmd as unknown as { _helpText?: CommandHelpTextBag })._helpText;\n  const v = bag?.[section];\n  if (typeof v === \"function\") return v({ error: false, command: cmd });\n  return v ?? \"\";\n}\n\nfunction uppercasePlaceholders(flags: string): string {\n  return flags\n    .replace(/<([a-zA-Z0-9_-]+)>/g, (_, name) => `<${name.toUpperCase()}>`)\n    .replace(/\\[([a-zA-Z0-9_-]+)\\]/g, (_, name) => `[${name.toUpperCase()}]`);\n}\n\nfunction optionTerm(opt: Option): string {\n  const flags = uppercasePlaceholders(opt.flags);\n  // Align long-only options with short+long rows: \"  -s, --long\" vs \"      --long\"\n  if (!opt.short && flags.startsWith(\"--\")) return \"    \" + flags;\n  return flags;\n}\n\nfunction optionDescription(opt: Option): string {\n  let desc = opt.description;\n  const d = opt.defaultValue;\n  if (d !== undefined && d !== false && d !== \"\" && d !== null) {\n    desc = `${desc} [default: ${String(d)}]`;\n  }\n  return desc;\n}\n\n/**\n * Move `-h, --help` and `-V, --version` to the end of the options list so\n * they always render last (clap convention), regardless of registration\n * order inside `createCli`.\n */\nfunction reorderHelpVersionLast(opts: readonly Option[]): Option[] {\n  const helpOpts: Option[] = [];\n  const versionOpts: Option[] = [];\n  const rest: Option[] = [];\n  for (const o of opts) {\n    if (o.long === \"--help\") helpOpts.push(o);\n    else if (o.long === \"--version\") versionOpts.push(o);\n    else rest.push(o);\n  }\n  return [...rest, ...helpOpts, ...versionOpts];\n}\n\nexport function canonicalFormatHelp(cmd: Command, helper: Help): string {\n  const sections: string[] = [];\n\n  const beforeAll = resolveHelpText(cmd, \"beforeAll\");\n  if (beforeAll) sections.push(beforeAll);\n\n  const desc = cmd.description();\n  if (desc) sections.push(desc);\n\n  const before = resolveHelpText(cmd, \"before\");\n  if (before) sections.push(before);\n\n  const visibleOpts = reorderHelpVersionLast(helper.visibleOptions(cmd));\n  const visibleCmds = helper.visibleCommands(cmd);\n  const args = (cmd as unknown as {\n    registeredArguments?: Array<{ name: () => string; required: boolean }>;\n  }).registeredArguments ?? [];\n\n  let usage = `Usage: ${cmd.name()}`;\n  if (visibleOpts.length > 0) usage += \" [OPTIONS]\";\n  for (const a of args) {\n    const n = a.name().toUpperCase();\n    usage += a.required ? ` <${n}>` : ` [${n}]`;\n  }\n  if (visibleCmds.length > 0) usage += \" [COMMAND]\";\n  sections.push(usage);\n\n  if (visibleCmds.length > 0) {\n    const terms = visibleCmds.map((c) => c.name());\n    const w = Math.max(...terms.map((t) => t.length));\n    const lines = [\"Commands:\"];\n    visibleCmds.forEach((sub, i) => {\n      lines.push(`  ${terms[i].padEnd(w)}  ${sub.description()}`);\n    });\n    sections.push(lines.join(\"\\n\"));\n  }\n\n  if (visibleOpts.length > 0) {\n    const terms = visibleOpts.map(optionTerm);\n    const w = Math.max(...terms.map((t) => t.length));\n    const lines = [\"Options:\"];\n    visibleOpts.forEach((opt, i) => {\n      lines.push(`  ${terms[i].padEnd(w)}  ${optionDescription(opt)}`);\n    });\n    sections.push(lines.join(\"\\n\"));\n  }\n\n  const after = resolveHelpText(cmd, \"after\");\n  if (after) sections.push(after);\n\n  const afterAll = resolveHelpText(cmd, \"afterAll\");\n  if (afterAll) sections.push(afterAll);\n\n  return sections.join(\"\\n\\n\") + \"\\n\";\n}\n","/**\n * CLI entry point — createCli / main equivalents.\n *\n * Protocol spec: CLI bootstrapping & command registration\n * Implements: F1 (dry-run), F3 (enhanced errors), F4 (trace),\n * F5 (approval handler), F6 (stream), F8 (strategy), F9 (output formats),\n * F11 (extra commands)\n */\n\nimport { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\nimport * as path from \"node:path\";\nimport { Command, CommanderError, Option } from \"commander\";\nimport { EXIT_CODES, exitCodeForError } from \"./errors.js\";\nimport { resolveRefs } from \"./ref-resolver.js\";\nimport { schemaToCliOptions } from \"./schema-parser.js\";\nimport { checkApproval } from \"./approval.js\";\nimport { formatExecResult, formatPreflightResult, firstFailedExitCode, resolveFormat } from \"./output.js\";\nimport { setLogLevel, warn as logWarn } from \"./logger.js\";\nimport { registerInitCommand } from \"./init-cmd.js\";\nimport { getDisplay } from \"./display-helpers.js\";\nimport { ConfigResolver, registerConfigNamespace } from \"./config.js\";\nimport { CliApprovalHandler } from \"./approval.js\";\nimport { configureManHelp, registerCompletionCommand } from \"./shell.js\";\nimport {\n  registerDescribeCommand,\n  registerExecCommand,\n  registerListCommand,\n  registerValidateCommand,\n} from \"./discovery.js\";\nimport {\n  registerConfigCommand,\n  registerDisableCommand,\n  registerEnableCommand,\n  registerHealthCommand,\n  registerReloadCommand,\n  registerUsageCommand,\n} from \"./system-cmd.js\";\nimport { registerPipelineCommand } from \"./strategy.js\";\nimport { ApcliGroup, RESERVED_GROUP_NAMES } from \"./builtin-group.js\";\nimport type { ApcliConfig } from \"./builtin-group.js\";\nimport { ExposureFilter } from \"./exposure.js\";\nimport { AuditLogger, setAuditLogger } from \"./security/audit.js\";\nimport type { Executor, ModuleDescriptor, Registry } from \"./cli.js\";\nimport { canonicalFormatHelp } from \"./canonical-help.js\";\n\nconst __dirname = path.dirname(fileURLToPath(import.meta.url));\n\n/** Whether --verbose was passed (controls help detail level). */\nexport let verboseHelp = false;\n\n/** Set the verbose help flag. When false, built-in options are hidden from help. */\nexport function setVerboseHelp(verbose: boolean): void {\n  verboseHelp = verbose;\n}\n\n/** Base URL for online documentation. Null means no docs link shown. */\nexport let docsUrl: string | null = null;\n\n/**\n * Set the base URL for online documentation links shown in help and man pages.\n * Pass null to disable. Command-level help appends `/commands/{name}` automatically.\n *\n * @example setDocsUrl(\"https://docs.apcore.dev/cli\");\n */\nexport function setDocsUrl(url: string | null): void {\n  docsUrl = url;\n}\n\n/** Check if --verbose is present in process.argv (pre-parse, before Commander). */\nfunction hasVerboseFlag(): boolean {\n  return process.argv.includes(\"--verbose\");\n}\n\n/**\n * Resolve a positive-integer option: CLI flag > env var > default.\n * Invalid env values (non-integer, zero, negative) are ignored with a warning\n * so users aren't silently downgraded to the default.\n */\nexport function resolveIntOption(\n  cliValue: number | undefined,\n  envValue: string | undefined,\n  defaultValue: number,\n): number {\n  if (cliValue !== undefined && Number.isFinite(cliValue) && cliValue > 0) {\n    return cliValue;\n  }\n  if (envValue !== undefined && envValue !== \"\") {\n    const parsed = parseInt(envValue, 10);\n    if (Number.isFinite(parsed) && parsed > 0) {\n      return parsed;\n    }\n    process.stderr.write(\n      `Warning: invalid integer env value '${envValue}'; using default ${defaultValue}.\\n`,\n    );\n  }\n  return defaultValue;\n}\n\n/**\n * Resolve a string option: CLI flag > env var > undefined.\n * Empty strings are treated as absent.\n */\nexport function resolveStringOption(\n  cliValue: unknown,\n  envValue: string | undefined,\n): string | undefined {\n  if (typeof cliValue === \"string\" && cliValue !== \"\") {\n    return cliValue;\n  }\n  if (envValue !== undefined && envValue !== \"\") {\n    return envValue;\n  }\n  return undefined;\n}\n\nlet VERSION = \"0.0.0\";\ntry {\n  const pkg = JSON.parse(readFileSync(path.resolve(__dirname, \"../package.json\"), \"utf-8\"));\n  VERSION = pkg.version;\n} catch {\n  // Bundled environments (e.g., Bun compile) may not have package.json accessible\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** Configuration for a single Commander option derived from a JSON Schema property. */\nexport interface OptionConfig {\n  /** The property name from the schema. */\n  name: string;\n  /** Commander flags string (e.g. \"--my-flag <value>\" or \"--flag, --no-flag\"). */\n  flags: string;\n  /** Help text for the option. */\n  description: string;\n  /** Default value. */\n  defaultValue?: unknown;\n  /** Whether the field is required (for display only). */\n  required: boolean;\n  /** Enum choices (string values). */\n  choices?: string[];\n  /** Whether this is a boolean flag pair (--flag/--no-flag). */\n  isBooleanFlag?: boolean;\n  /** Maps string enum value → original type name (\"int\", \"float\", \"bool\"). */\n  enumOriginalTypes?: Record<string, string>;\n  /** Parser function for Commander (e.g. parseInt, parseFloat). */\n  parseArg?: (value: string) => unknown;\n}\n\n// ---------------------------------------------------------------------------\n// Enhanced error output (F3)\n// ---------------------------------------------------------------------------\n\n/**\n * Emit structured JSON error to stderr for AI agents.\n */\nexport function emitErrorJson(e: unknown, exitCode: number): void {\n  const err = e instanceof Error ? e : new Error(String(e));\n  const errRecord = err as unknown as Record<string, unknown>;\n  const code = errRecord.code ?? \"UNKNOWN\";\n  const payload: Record<string, unknown> = {\n    error: true,\n    code,\n    message: err.message,\n    exit_code: exitCode,\n  };\n  for (const field of [\"details\", \"suggestion\", \"ai_guidance\", \"retryable\", \"user_fixable\"]) {\n    const val = errRecord[field];\n    if (val !== undefined && val !== null) {\n      payload[field] = val;\n    }\n  }\n  process.stderr.write(JSON.stringify(payload) + \"\\n\");\n}\n\n/**\n * Emit human-readable error to stderr with guidance fields.\n */\nexport function emitErrorTty(e: unknown, exitCode: number): void {\n  const err = e instanceof Error ? e : new Error(String(e));\n  const errRecord = err as unknown as Record<string, unknown>;\n  const code = errRecord.code;\n  const header = code ? `Error [${code}]: ${err.message}` : `Error: ${err.message}`;\n  process.stderr.write(header + \"\\n\");\n\n  const details = errRecord.details;\n  if (details && typeof details === \"object\" && !Array.isArray(details)) {\n    process.stderr.write(\"\\n  Details:\\n\");\n    for (const [k, v] of Object.entries(details as Record<string, unknown>)) {\n      process.stderr.write(`    ${k}: ${v}\\n`);\n    }\n  }\n\n  const suggestion = errRecord.suggestion;\n  if (suggestion) {\n    process.stderr.write(`\\n  Suggestion: ${suggestion}\\n`);\n  }\n\n  const retryable = errRecord.retryable;\n  if (retryable !== undefined && retryable !== null) {\n    const label = retryable ? \"Yes\" : \"No (same input will fail again)\";\n    process.stderr.write(`  Retryable: ${label}\\n`);\n  }\n\n  process.stderr.write(`\\n  Exit code: ${exitCode}\\n`);\n}\n\n// ---------------------------------------------------------------------------\n// createCli\n// ---------------------------------------------------------------------------\n\n/**\n * APCore unified client facade (apcore-js >= 0.18.0).\n * Exposes registry and executor as top-level properties.\n */\nexport interface APCore {\n  registry: Registry;\n  executor: Executor;\n}\n\n/** Options for createCli. */\nexport interface CreateCliOptions {\n  extensionsDir?: string;\n  progName?: string;\n  verbose?: boolean;\n  /**\n   * APCore unified client instance (apcore-js >= 0.18.0).\n   * Mutually exclusive with registry/executor — providing app alongside\n   * either of those will throw.\n   */\n  app?: APCore;\n  /** Pre-populated Registry instance. Skips filesystem discovery when provided. */\n  registry?: Registry;\n  /** Pre-built Executor instance. Used alongside registry. */\n  executor?: Executor;\n  /** Extra commands to register after built-in commands (FE-11 F11). */\n  extraCommands?: Command[];\n  /** Exposure filter config or instance (FE-12). */\n  expose?: Record<string, unknown> | import(\"./exposure.js\").ExposureFilter;\n  /** Path to convention-based commands directory (apcore-toolkit ConventionScanner). */\n  commandsDir?: string;\n  /** Path to binding.yaml for display overlay (apcore-toolkit DisplayResolver). */\n  bindingPath?: string;\n  /**\n   * Built-in apcli group configuration (FE-13).\n   *\n   * Accepts:\n   *  - `true` / `false` (shorthand for `{mode: \"all\"}` / `{mode: \"none\"}`)\n   *  - A config object (see {@link ApcliConfig})\n   *  - A pre-built {@link ApcliGroup} instance (Tier 1 override)\n   *\n   * When absent, Tier 3 (apcore.yaml `apcli:` block) is consulted, falling\n   * back to auto-detect: standalone → visible, embedded → hidden.\n   */\n  apcli?: ApcliConfig | ApcliGroup;\n}\n\n/**\n * Build and return the top-level Commander program.\n *\n * @param extensionsDirOrOpts  Path to extensions directory, or a CreateCliOptions object.\n * @param progName       Program name shown in help (default: apcore-cli)\n * @param verbose        Show verbose help output\n */\nexport function createCli(\n  extensionsDirOrOpts?: string | CreateCliOptions,\n  progName?: string,\n  verbose = false,\n): Command {\n  // Normalise overloaded first argument.\n  let extensionsDir: string | undefined;\n  let registry: Registry | undefined;\n  let executor: Executor | undefined;\n  let extraCommands: Command[] | undefined;\n  let app: APCore | undefined;\n  let expose: Record<string, unknown> | import(\"./exposure.js\").ExposureFilter | undefined;\n  let apcliOption: ApcliConfig | ApcliGroup | undefined;\n  if (typeof extensionsDirOrOpts === \"object\" && extensionsDirOrOpts !== null) {\n    extensionsDir = extensionsDirOrOpts.extensionsDir;\n    progName = extensionsDirOrOpts.progName ?? progName;\n    verbose = extensionsDirOrOpts.verbose ?? verbose;\n    app = extensionsDirOrOpts.app;\n    registry = extensionsDirOrOpts.registry;\n    executor = extensionsDirOrOpts.executor;\n    extraCommands = extensionsDirOrOpts.extraCommands;\n    expose = extensionsDirOrOpts.expose;\n    apcliOption = extensionsDirOrOpts.apcli;\n  } else {\n    extensionsDir = extensionsDirOrOpts;\n  }\n\n  verboseHelp = verbose;\n  // Register Config Bus namespace (apcore >= 0.15.0)\n  registerConfigNamespace();\n\n  // Initialize audit logger (parity with apcore-cli-python __main__.py).\n  // Silently disabled if initialization fails (e.g., unwritable audit path).\n  try {\n    const auditLogger = new AuditLogger();\n    setAuditLogger(auditLogger);\n  } catch {\n    // audit logging unavailable — non-fatal\n  }\n\n  // Resolve program name\n  const resolvedProgName = progName ?? path.basename(process.argv[1] ?? \"apcore-cli\") ?? \"apcore-cli\";\n\n  // Resolve log level\n  const cliLogLevel = process.env.APCORE_CLI_LOGGING_LEVEL ?? process.env.APCORE_LOGGING_LEVEL ?? \"WARNING\";\n  setLogLevel(cliLogLevel);\n\n  // Validate parameter combination: app is mutually exclusive with registry/executor.\n  if (app && (registry || executor)) {\n    process.stderr.write(\"Error: app is mutually exclusive with registry/executor\\n\");\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n\n  // Extract registry/executor from APCore unified client when provided.\n  if (app) {\n    registry = app.registry;\n    executor = app.executor;\n  }\n\n  // Validate parameter combination: executor without registry is invalid.\n  if (executor && !registry) {\n    process.stderr.write(\"Error: executor requires registry — pass both or neither\\n\");\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n\n  // Wire CliApprovalHandler to the executor (FE-11 §3.5) so module calls that\n  // set `requires_approval: true` route through the interactive CLI prompt\n  // (or auto-approve when APCORE_CLI_AUTO_APPROVE=1). Parity with\n  // ../apcore-cli-python/src/apcore_cli/factory.py:315-327 — previously the\n  // TypeScript CliApprovalHandler class was exported but never plugged in,\n  // so requires_approval modules were rejected by the built-in gate even\n  // though the CLI had its own interactive handler ready to use.\n  if (executor && typeof (executor as unknown as Record<string, unknown>).setApprovalHandler === \"function\") {\n    try {\n      const handler = new CliApprovalHandler(/*autoApprove*/ false);\n      (executor as unknown as { setApprovalHandler: (h: unknown) => void }).setApprovalHandler(handler);\n    } catch {\n      // Non-fatal: handler wiring failed; built-in gate still applies.\n    }\n  }\n\n  const registryInjected = registry !== undefined;\n\n  const program = new Command(resolvedProgName)\n    .exitOverride()\n    .version(VERSION, \"-V, --version\", \"Print version\")\n    .helpOption(\"-h, --help\", \"Print help\")\n    .addHelpCommand(\"help [command]\", \"Print this message or the help of the given subcommand(s)\")\n    .description(\"apcore CLI — execute apcore modules from the command line\")\n    .option(\"--log-level <level>\", \"Logging level (DEBUG|INFO|WARNING|ERROR)\", \"WARNING\")\n    .option(\"--verbose\", \"Show all options in help output (including built-in apcore options)\");\n  program.configureHelp({ formatHelp: canonicalFormatHelp });\n\n  // Discovery flags are standalone-only (FE-13 T-APCLI-27/28).\n  if (!registryInjected) {\n    program.option(\"--extensions-dir <path>\", \"Path to extensions directory\");\n    program.option(\"--commands-dir <path>\", \"Path to convention-based commands directory\");\n    program.option(\"--binding <path>\", \"Path to binding.yaml for display overlay\");\n  }\n\n  // Build ApcliGroup via 3-source dispatch (FE-13 §4.8):\n  //   1) Pre-built ApcliGroup instance (pass-through)\n  //   2) CliConfig boolean/object (Tier 1, fromCliConfig)\n  //   3) Tier 3 yaml via ConfigResolver.resolveObject (fromYaml)\n  let apcliCfg: ApcliGroup;\n  if (apcliOption instanceof ApcliGroup) {\n    apcliCfg = apcliOption;\n  } else if (apcliOption !== undefined) {\n    apcliCfg = ApcliGroup.fromCliConfig(apcliOption, { registryInjected });\n  } else {\n    let yamlVal: unknown = null;\n    try {\n      const resolver = new ConfigResolver();\n      yamlVal = resolver.resolveObject(\"apcli\");\n    } catch {\n      yamlVal = null;\n    }\n    apcliCfg = ApcliGroup.fromYaml(yamlVal, { registryInjected });\n  }\n\n  // Construct the apcli sub-group. Hidden when visibility resolves to \"none\".\n  // Use Commander v12's public CommandOptions.hidden rather than reaching into\n  // the private _hidden field — this survives minor Commander bumps.\n  const apcliGroup = program\n    .command(\"apcli\", { hidden: !apcliCfg.isGroupVisible() })\n    .description(\"apcore-cli built-in commands\");\n\n  // Dispatch the 13-entry subcommand registrar table (FE-13 §4.9).\n  if (registry) {\n    (program as unknown as Record<string, unknown>)._registry = registry;\n    if (executor) {\n      (program as unknown as Record<string, unknown>)._executor = executor;\n    }\n  } else {\n    const resolvedExtDir = extensionsDir\n      ?? process.env.APCORE_EXTENSIONS_ROOT\n      ?? \"./extensions\";\n    void resolvedExtDir; // Will be used when apcore-js registry is wired\n  }\n\n  // Build exposure filter (FE-12) BEFORE the apcli dispatcher table so\n  // registerListCommand can consult the filter for --exposure. fromConfig\n  // throws on malformed shape (e.g. { mode: \"bogus\" }) — catch and exit with\n  // INVALID_CLI_INPUT so the caller sees a friendly message and the documented\n  // exit code, matching ApcliGroup._build's contract (review fix #1).\n  let exposureFilter: ExposureFilter;\n  try {\n    if (expose instanceof ExposureFilter) {\n      exposureFilter = expose;\n    } else if (typeof expose === \"object\" && expose !== null) {\n      exposureFilter = ExposureFilter.fromConfig({ expose });\n    } else {\n      exposureFilter = new ExposureFilter();\n    }\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    process.stderr.write(`Error: invalid 'expose' option — ${msg}\\n`);\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n\n  _registerApcliSubcommands(apcliGroup, apcliCfg, registry, executor, exposureFilter);\n\n  // FE-13 §11.2: standalone-mode deprecation shims for the 13 former\n  // root-level commands. No-op in embedded mode so branded CLIs never surface\n  // apcore-cli deprecation warnings to their end users.\n  _registerDeprecationShims(program, apcliGroup, registryInjected, resolvedProgName);\n\n  // Footer hints for discoverability\n  program.addHelpText(\"after\", [\n    \"\",\n    \"Use --help --verbose to show all options (including built-in apcore options).\",\n    \"Use --help --man to display a formatted man page.\",\n  ].join(\"\\n\"));\n\n  // Register --help --man support (stays at root — spec §4.1).\n  configureManHelp(program, resolvedProgName, VERSION);\n\n  // Register extra commands (F11) — validate no name collisions with live\n  // Commander tree (root + apcli group subcommands). FE-13 moved the old\n  // per-command constant into a live-tree walk; collision detection now\n  // reads the actual program shape. Reserved-name (`apcli`) and\n  // live-collision cases are hard exit 2 (FE-13 §4.10 / §7 FR-13-09).\n  if (extraCommands && extraCommands.length > 0) {\n    for (const cmd of extraCommands) {\n      const cmdName = cmd.name();\n      if (RESERVED_GROUP_NAMES.has(cmdName)) {\n        process.stderr.write(\n          `Error: extraCommands name '${cmdName}' is reserved\\n`,\n        );\n        process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n      }\n      const existing = program.commands.find((c) => c.name() === cmdName);\n      if (existing) {\n        // Deprecation shims are auto-registered in standalone mode and should\n        // yield to user-supplied extraCommands with the same name — they're\n        // transitional scaffolding, not a real collision. Non-shim collisions\n        // are still hard-rejected.\n        const isShim =\n          (existing as unknown as { __isDeprecationShim?: boolean }).__isDeprecationShim === true;\n        if (isShim) {\n          logWarn(\n            `extraCommands '${cmdName}' overrides the deprecation shim for the same name. ` +\n              `The shim will be removed.`,\n          );\n          const cmds = program.commands as unknown as Command[];\n          const idx = cmds.indexOf(existing);\n          if (idx >= 0) cmds.splice(idx, 1);\n        } else {\n          process.stderr.write(\n            `Error: extraCommands name '${cmdName}' collides with an existing command\\n`,\n          );\n          process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n        }\n      }\n      program.addCommand(cmd);\n    }\n  }\n\n  // Hook to apply optional toolkit integration before command execution.\n  // Commander actions are async, so we can set up toolkit state lazily.\n  program.hook(\"preAction\", async (thisCommand) => {\n    const opts = thisCommand.opts();\n    const commandsDir = opts.commandsDir as string | undefined;\n    const bindingPath = opts.binding as string | undefined;\n    await applyToolkitIntegration(commandsDir, bindingPath);\n  });\n\n  return program;\n}\n\n// ---------------------------------------------------------------------------\n// FE-13 apcli subcommand dispatcher (§4.9)\n// ---------------------------------------------------------------------------\n\n/**\n * Subcommand names that are registered regardless of the resolved visibility\n * mode's include/exclude filter. `exec` is the documented always-registered\n * escape hatch (spec §4.9) so that downstream callers can always invoke modules\n * by ID even when the apcli group is configured with a minimal surface.\n */\nconst _ALWAYS_REGISTERED: ReadonlySet<string> = new Set<string>([\"exec\"]);\n\ninterface _RegistrarEntry {\n  name: string;\n  requiresExecutor: boolean;\n  register: (\n    apcliGroup: Command,\n    registry: Registry | undefined,\n    executor: Executor | undefined,\n  ) => void;\n}\n\n/**\n * Central dispatcher for the 13 canonical apcli subcommands. Called once per\n * createCli invocation after the apcli Commander group is built. Honors\n * {@link ApcliGroup.resolveVisibility} for include/exclude modes, and skips\n * entries whose `requiresExecutor: true` flag is not satisfied.\n */\nfunction _registerApcliSubcommands(\n  apcliGroup: Command,\n  apcliCfg: ApcliGroup,\n  registry: Registry | undefined,\n  executor: Executor | undefined,\n  exposureFilter: ExposureFilter,\n): void {\n  // Standalone-mode fallback registry. Previously returned an empty list +\n  // null; that silently masked the \"no registry wired\" contract gap — users\n  // saw empty `apcli list` output with no clue the CLI was unwired. The\n  // erroring fallback below surfaces the gap with a clear message + exit code\n  // whenever list/describe actions actually reach into registry methods.\n  const emitUnwiredError = (): never => {\n    process.stderr.write(\n      \"Error: no apcore-js registry wired. In standalone mode, pass \" +\n        \"--extensions-dir <path> to enable module discovery.\\n\",\n    );\n    process.exit(EXIT_CODES.CONFIG_INVALID);\n  };\n  const effectiveRegistry: Registry = registry ?? {\n    listModules: () => emitUnwiredError(),\n    getModule: () => emitUnwiredError(),\n  };\n\n  const TABLE: _RegistrarEntry[] = [\n    { name: \"list\",              requiresExecutor: false, register: (g) => registerListCommand(g, effectiveRegistry, exposureFilter) },\n    { name: \"describe\",          requiresExecutor: false, register: (g) => registerDescribeCommand(g, effectiveRegistry) },\n    { name: \"exec\",              requiresExecutor: true,  register: (g, _r, ex) => registerExecCommand(g, effectiveRegistry, ex!) },\n    { name: \"validate\",          requiresExecutor: true,  register: (g, _r, ex) => registerValidateCommand(g, effectiveRegistry, ex!) },\n    { name: \"init\",              requiresExecutor: false, register: (g) => registerInitCommand(g) },\n    { name: \"health\",            requiresExecutor: true,  register: (g, _r, ex) => registerHealthCommand(g, ex!) },\n    { name: \"usage\",             requiresExecutor: true,  register: (g, _r, ex) => registerUsageCommand(g, ex!) },\n    { name: \"enable\",            requiresExecutor: true,  register: (g, _r, ex) => registerEnableCommand(g, ex!) },\n    { name: \"disable\",           requiresExecutor: true,  register: (g, _r, ex) => registerDisableCommand(g, ex!) },\n    { name: \"reload\",            requiresExecutor: true,  register: (g, _r, ex) => registerReloadCommand(g, ex!) },\n    { name: \"config\",            requiresExecutor: true,  register: (g, _r, ex) => registerConfigCommand(g, ex!) },\n    { name: \"completion\",        requiresExecutor: false, register: (g) => registerCompletionCommand(g) },\n    { name: \"describe-pipeline\", requiresExecutor: true,  register: (g, _r, ex) => registerPipelineCommand(g, ex!) },\n  ];\n\n  const mode = apcliCfg.resolveVisibility();\n  for (const entry of TABLE) {\n    // Determine whether this entry would be registered BEFORE short-circuiting\n    // on missing executor — otherwise _ALWAYS_REGISTERED never gets consulted\n    // for executor-required entries (e.g. \"exec\"), which violates spec §4.9.\n    let shouldRegister: boolean;\n    if (mode === \"all\" || mode === \"none\") {\n      // mode:\"none\" still registers all subcommands — the group itself is\n      // hidden, but subcommands remain individually reachable (spec §4.6).\n      shouldRegister = true;\n    } else {\n      shouldRegister =\n        _ALWAYS_REGISTERED.has(entry.name) || apcliCfg.isSubcommandIncluded(entry.name);\n    }\n    if (!shouldRegister) continue;\n\n    // Executor-required entry but no executor wired. Silent skip for ordinary\n    // entries — loud WARN for _ALWAYS_REGISTERED entries since the spec §4.9\n    // contract says they are always registered, and silently dropping them\n    // would mask a legitimate wiring gap for the caller.\n    if (entry.requiresExecutor && !executor) {\n      if (_ALWAYS_REGISTERED.has(entry.name)) {\n        logWarn(\n          `apcli.${entry.name} is in _ALWAYS_REGISTERED but no executor is wired — ` +\n            `subcommand unavailable. Pass executor to createCli() or avoid ${entry.name} invocations.`,\n        );\n      }\n      continue;\n    }\n\n    entry.register(apcliGroup, registry, executor);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// FE-13 §11.2 deprecation shims (standalone-mode only)\n// ---------------------------------------------------------------------------\n\n/**\n * Canonical list of root-level command names that were \"flat\" in pre-v0.7 and\n * moved under the `apcli` group in v0.7. A thin shim at the root forwards\n * invocations to the corresponding `apcli <name>` subcommand after printing a\n * deprecation warning. Removed in v0.8 per spec §11.3.\n */\nconst _DEPRECATED_ROOT_COMMANDS: readonly string[] = [\n  \"list\",\n  \"describe\",\n  \"exec\",\n  \"init\",\n  \"validate\",\n  \"health\",\n  \"usage\",\n  \"enable\",\n  \"disable\",\n  \"reload\",\n  \"config\",\n  \"completion\",\n  \"describe-pipeline\",\n] as const;\n\n/**\n * Register thin root-level deprecation shims for the 13 former built-in\n * commands. Each shim writes the spec §11.2 warning to stderr then forwards\n * to the matching `apcli <name>` subcommand, preserving positional args +\n * options via a direct `parseAsync` on the apcli subcommand.\n *\n * No-op in embedded mode (`registryInjected === true`) so integrators' end\n * users never see apcore-cli deprecation warnings for commands they were\n * never meant to know about.\n */\nfunction _registerDeprecationShims(\n  root: Command,\n  apcliGroup: Command,\n  registryInjected: boolean,\n  cliName: string,\n): void {\n  if (registryInjected) return;\n  for (const name of _DEPRECATED_ROOT_COMMANDS) {\n    const apcliSub = apcliGroup.commands.find((c) => c.name() === name);\n    if (!apcliSub) continue; // subcommand not registered (e.g. executor-required without executor)\n    if (root.commands.some((c) => c.name() === name)) continue; // collision guard\n\n    const shim = root\n      .command(name)\n      .description(`[DEPRECATED] Use '${cliName} apcli ${name}' instead.`)\n      .allowUnknownOption(true)\n      .allowExcessArguments(true)\n      .helpOption(false);\n    // Tag the shim so extraCommands collision detection can tell a shim apart\n    // from a user-registered command and drop the shim in favor of the user's\n    // extraCommand (with a WARN) rather than hard-failing with \"collides\".\n    (shim as unknown as Record<string, unknown>).__isDeprecationShim = true;\n    shim.action(async function (this: Command) {\n      process.stderr.write(\n        `WARNING: '${name}' as a root-level command is deprecated. ` +\n          `Use '${cliName} apcli ${name}' instead.\\n` +\n          `         Will be removed in v0.8. ` +\n          `See: https://aiperceivable.github.io/apcore-cli/features/builtin-group/#11-migration\\n`,\n      );\n      // Forward: reconstruct the tail from this shim's parsed args + the raw\n      // passthrough args Commander stashes when allowUnknownOption is on.\n      // This works for both real process.argv invocations and test-time\n      // `parseAsync([...], { from: \"user\" })` calls.\n      const tail = _collectShimForwardArgs(this);\n      await apcliSub.parseAsync(tail, { from: \"user\" });\n    });\n  }\n}\n\n/**\n * Collect the argv tail to forward from a shim to its apcli counterpart.\n * Uses Commander's own `.args` (positional + unknown flags that were left\n * intact because the shim has `allowUnknownOption(true)`). Falls back to\n * slicing `process.argv` from the shim name onward when `.args` is empty —\n * this preserves nested sub-subcommand paths such as `config get foo` in\n * real invocations where the shell supplied full argv.\n */\nfunction _collectShimForwardArgs(shim: Command): string[] {\n  const shimArgs = (shim.args ?? []).slice();\n  if (shimArgs.length > 0) return shimArgs;\n  const shimName = shim.name();\n  const idx = process.argv.indexOf(shimName);\n  if (idx < 0) return [];\n  return process.argv.slice(idx + 1);\n}\n\n// ---------------------------------------------------------------------------\n// applyToolkitIntegration\n// ---------------------------------------------------------------------------\n\n/**\n * Optionally apply apcore-toolkit features (DisplayResolver, RegistryWriter).\n *\n * Uses dynamic import so the dependency remains optional — if apcore-toolkit\n * is not installed, a warning is printed and the CLI continues without it.\n */\n/**\n * Module-level binding display overlay map: moduleId → resolved `display`\n * metadata (as produced by `DisplayResolver.resolve()`). Consulted by\n * `getDisplay()` when a `ModuleDescriptor`'s own `metadata.display` is absent.\n */\nconst bindingDisplayMap = new Map<string, Record<string, unknown>>();\n\n/**\n * Internal accessor for the binding display overlay map — used by\n * `display-helpers.ts#getDisplay` as a fallback when the descriptor itself\n * carries no resolved display metadata.\n */\nexport function lookupBindingDisplay(moduleId: string): Record<string, unknown> | undefined {\n  return bindingDisplayMap.get(moduleId);\n}\n\n/**\n * Clear the binding display overlay map. Primarily for tests.\n */\nexport function clearBindingDisplayMap(): void {\n  bindingDisplayMap.clear();\n}\n\nexport async function applyToolkitIntegration(\n  commandsDir?: string,\n  bindingPath?: string,\n): Promise<void> {\n  if (!commandsDir && !bindingPath) {\n    return;\n  }\n\n  let toolkit: Record<string, unknown>;\n  try {\n    // String indirection prevents bundlers from statically resolving the\n    // optional peer dependency at build time.\n    const toolkitModule = \"apcore-toolkit\";\n    toolkit = await import(/* @vite-ignore */ toolkitModule) as Record<string, unknown>;\n  } catch {\n    logWarn(\"apcore-toolkit not installed — toolkit features unavailable\");\n    return;\n  }\n\n  // ConventionScanner has no TypeScript equivalent (the Python adapter is\n  // pydantic-specific and does not port cleanly). See the upstream\n  // apcore-toolkit README for the tri-language parity note.\n  if (commandsDir) {\n    logWarn(\"Convention scanning not available in the TypeScript toolkit\");\n  }\n\n  if (bindingPath) {\n    try {\n      await loadBindingDisplayOverlay(toolkit, bindingPath);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      logWarn(`apcore-toolkit: failed to load binding '${bindingPath}': ${msg}`);\n    }\n  }\n}\n\n/**\n * Parse a `.binding.yaml` (or directory thereof) and populate the module-level\n * `bindingDisplayMap` with resolved display overlay entries. Uses the\n * apcore-toolkit `BindingLoader` + `DisplayResolver` pipeline so the overlay\n * produced here is identical to what apcore-toolkit's registry-writer would\n * emit at scan time.\n */\nasync function loadBindingDisplayOverlay(\n  toolkit: Record<string, unknown>,\n  bindingPath: string,\n): Promise<void> {\n  const BindingLoaderCtor = toolkit.BindingLoader as\n    | (new () => { load(path: string): unknown[] })\n    | undefined;\n  const DisplayResolverCtor = toolkit.DisplayResolver as\n    | (new () => { resolve(mods: unknown[], opts?: { bindingPath?: string }): unknown[] })\n    | undefined;\n\n  if (!BindingLoaderCtor || !DisplayResolverCtor) {\n    // apcore-toolkit < 0.5.0 (no BindingLoader) — silently skip the overlay.\n    return;\n  }\n\n  const loader = new BindingLoaderCtor();\n  const scanned = loader.load(bindingPath);\n  const resolver = new DisplayResolverCtor();\n  const resolved = resolver.resolve(scanned, { bindingPath });\n\n  for (const mod of resolved) {\n    if (!mod || typeof mod !== \"object\") continue;\n    const entry = mod as { moduleId?: unknown; metadata?: unknown };\n    const id = typeof entry.moduleId === \"string\" ? entry.moduleId : null;\n    if (!id) continue;\n    const meta = (entry.metadata as Record<string, unknown> | undefined) ?? {};\n    const display = meta.display;\n    if (display && typeof display === \"object\" && !Array.isArray(display)) {\n      bindingDisplayMap.set(id, display as Record<string, unknown>);\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// main\n// ---------------------------------------------------------------------------\n\n/**\n * Parse argv and run the CLI. Handles top-level error catching and exit codes.\n */\nexport function main(progName?: string): void {\n  verboseHelp = hasVerboseFlag();\n  const program = createCli(undefined, progName, verboseHelp);\n\n  try {\n    program.parse(process.argv);\n  } catch (error: unknown) {\n    if (error instanceof CommanderError) {\n      // Commander already printed the error message\n      process.exit(error.exitCode);\n    }\n    const code = exitCodeForError(error);\n    if (error instanceof Error) {\n      process.stderr.write(`Error: ${error.message}\\n`);\n    }\n    process.exit(code);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// buildModuleCommand\n// ---------------------------------------------------------------------------\n\n/**\n * Build a Commander Command for a single apcore module.\n *\n * Includes all 11 FE-11 options: --dry-run, --trace, --stream, --strategy,\n * --approval-timeout, --approval-token, --fields, and enhanced --format choices.\n */\nexport function buildModuleCommand(\n  moduleDef: ModuleDescriptor,\n  executor: Executor,\n  helpTextMaxLength = 1000,\n  cmdName?: string,\n  verbose = verboseHelp,\n): Command {\n  const moduleId = moduleDef.id;\n  let resolvedSchema: Record<string, unknown> = {};\n  let schemaOptions: OptionConfig[] = [];\n\n  // Resolve display overlay fields\n  const display = getDisplay(moduleDef);\n  const cliDisplay = (display.cli && typeof display.cli === \"object\" && !Array.isArray(display.cli))\n    ? (display.cli as Record<string, unknown>)\n    : {};\n  const effectiveCmdName: string = cmdName ?? (cliDisplay.alias as string | undefined) ?? moduleId;\n  const cmdHelp: string = (cliDisplay.description as string | undefined) ?? moduleDef.description;\n\n  // Resolve schema\n  const inputSchema = moduleDef.inputSchema;\n  if (inputSchema && typeof inputSchema === \"object\" && inputSchema.properties) {\n    try {\n      resolvedSchema = resolveRefs(inputSchema, 32, moduleId);\n    } catch {\n      resolvedSchema = inputSchema;\n    }\n    schemaOptions = schemaToCliOptions(resolvedSchema, helpTextMaxLength);\n  }\n\n  const cmd = new Command(effectiveCmdName).description(cmdHelp);\n\n  // Built-in options (hidden unless --verbose)\n  const inputOpt = new Option(\"--input <source>\", \"Read JSON input from a file path, or use '-' to read from stdin pipe\");\n  const yesOpt = new Option(\"-y, --yes\", \"Skip interactive approval prompts (for scripts and CI)\").default(false);\n  const largeInputOpt = new Option(\"--large-input\", \"Allow stdin input larger than 10MB (default limit protects against accidental pipes)\").default(false);\n  const formatOpt = new Option(\"--format <format>\", \"Output format: json, table, csv, yaml, jsonl.\")\n    .choices([\"json\", \"table\", \"csv\", \"yaml\", \"jsonl\"]);\n  const fieldsOpt = new Option(\"--fields <fields>\", \"Comma-separated dot-paths to select from the result (e.g., 'status,data.count').\");\n  // --sandbox is always hidden (not yet implemented)\n  const sandboxOpt = new Option(\"--sandbox\", \"Run module in an isolated subprocess with restricted filesystem and env access\").default(false).hideHelp();\n  // F1: --dry-run\n  const dryRunOpt = new Option(\"--dry-run\", \"Run preflight checks without executing the module. Shows validation results.\").default(false);\n  // F4: --trace\n  const traceOpt = new Option(\"--trace\", \"Show execution pipeline trace with per-step timing after the result.\").default(false);\n  // F6: --stream\n  const streamOpt = new Option(\"--stream\", \"Stream module output as JSONL (one JSON object per line, flushed immediately).\").default(false);\n  // F8: --strategy\n  const strategyOpt = new Option(\"--strategy <name>\", \"Execution pipeline strategy: standard (default), internal, testing, performance.\")\n    .choices([\"standard\", \"internal\", \"testing\", \"performance\", \"minimal\"]);\n  // F5: --approval-timeout, --approval-token\n  const approvalTimeoutOpt = new Option(\"--approval-timeout <seconds>\", \"Override approval prompt timeout in seconds (default: 60).\").argParser(parseInt);\n  const approvalTokenOpt = new Option(\"--approval-token <token>\", \"Resume a pending approval with the given token (for async approval flows).\");\n\n  if (!verbose) {\n    inputOpt.hideHelp();\n    yesOpt.hideHelp();\n    largeInputOpt.hideHelp();\n    formatOpt.hideHelp();\n    fieldsOpt.hideHelp();\n    dryRunOpt.hideHelp();\n    traceOpt.hideHelp();\n    streamOpt.hideHelp();\n    strategyOpt.hideHelp();\n    approvalTimeoutOpt.hideHelp();\n    approvalTokenOpt.hideHelp();\n  }\n\n  cmd.addOption(inputOpt);\n  cmd.addOption(yesOpt);\n  cmd.addOption(largeInputOpt);\n  cmd.addOption(formatOpt);\n  cmd.addOption(fieldsOpt);\n  cmd.addOption(sandboxOpt);\n  cmd.addOption(dryRunOpt);\n  cmd.addOption(traceOpt);\n  cmd.addOption(streamOpt);\n  cmd.addOption(strategyOpt);\n  cmd.addOption(approvalTimeoutOpt);\n  cmd.addOption(approvalTokenOpt);\n\n  // Help footer: verbose hint + optional docs link\n  const footerParts: string[] = [];\n  if (!verbose) {\n    footerParts.push(\"Use --verbose to show all options (including built-in apcore options).\");\n  }\n  if (docsUrl) {\n    footerParts.push(`Docs: ${docsUrl}/commands/${effectiveCmdName}`);\n  }\n  if (footerParts.length > 0) {\n    cmd.addHelpText(\"after\", \"\\n\" + footerParts.join(\"\\n\") + \"\\n\");\n  }\n\n  // Schema-generated options\n  for (const opt of schemaOptions) {\n    if (opt.parseArg) {\n      cmd.option(opt.flags, opt.description, opt.parseArg, opt.defaultValue);\n    } else {\n      cmd.option(opt.flags, opt.description, opt.defaultValue as string | boolean | undefined);\n    }\n  }\n\n  // Action callback\n  cmd.action(async (options: Record<string, unknown>) => {\n    // Pop built-in options\n    const stdinFlag = options.input as string | undefined;\n    const autoApprove = options.yes as boolean;\n    const largeInput = options.largeInput as boolean;\n    const outputFormat = options.format as string | undefined;\n    const outputFields = options.fields as string | undefined;\n    const sandboxEnabled = options.sandbox as boolean;\n    const dryRun = options.dryRun as boolean;\n    const traceFlag = options.trace as boolean;\n    const streamFlag = options.stream as boolean;\n    const strategyName = resolveStringOption(options.strategy, process.env.APCORE_CLI_STRATEGY);\n    const approvalTimeout = resolveIntOption(\n      options.approvalTimeout as number | undefined,\n      process.env.APCORE_CLI_APPROVAL_TIMEOUT,\n      60,\n    );\n    const approvalToken = options.approvalToken as string | undefined;\n\n    // Remove built-in keys from options to get schema kwargs\n    const schemaKwargs: Record<string, unknown> = {};\n    const builtinKeys = new Set([\n      \"input\", \"yes\", \"largeInput\", \"format\", \"fields\", \"sandbox\", \"verbose\",\n      \"dryRun\", \"trace\", \"stream\", \"strategy\", \"approvalTimeout\", \"approvalToken\",\n    ]);\n    for (const [k, v] of Object.entries(options)) {\n      if (!builtinKeys.has(k)) {\n        schemaKwargs[k] = v;\n      }\n    }\n\n    let merged: Record<string, unknown> = {};\n    const startTime = performance.now();\n\n    try {\n      // 1. Collect and merge input\n      merged = await collectInput(stdinFlag, schemaKwargs, largeInput);\n\n      // 2. Reconvert enum values\n      const reconverted = reconvertEnumValues(merged, schemaOptions);\n      merged = reconverted;\n\n      // -- Dry-run: preflight validation only, no execution (F1) --\n      if (dryRun) {\n        if (!executor.validate) {\n          process.stderr.write(\"Error: Executor does not support validate.\\n\");\n          process.exit(EXIT_CODES.MODULE_EXECUTE_ERROR);\n        }\n        const preflight = await executor.validate(moduleId, merged);\n        formatPreflightResult(preflight, outputFormat);\n        // --trace --dry-run: show pipeline preview\n        if (traceFlag) {\n          const pureSteps = new Set([\n            \"context_creation\", \"call_chain_guard\", \"module_lookup\", \"acl_check\", \"input_validation\",\n          ]);\n          const allSteps = [\n            \"context_creation\", \"call_chain_guard\", \"module_lookup\", \"acl_check\",\n            \"approval_gate\", \"middleware_before\", \"input_validation\", \"execute\",\n            \"output_validation\", \"middleware_after\", \"return_result\",\n          ];\n          process.stderr.write(\"\\nPipeline preview (dry-run):\\n\");\n          for (const s of allSteps) {\n            if (pureSteps.has(s)) {\n              process.stderr.write(`  \\u2713 ${s.padEnd(24)} (pure \\u2014 would execute)\\n`);\n            } else {\n              process.stderr.write(`  \\u25cb ${s.padEnd(24)} (impure \\u2014 skipped in dry-run)\\n`);\n            }\n          }\n        }\n        process.exit(preflight.valid ? 0 : firstFailedExitCode(preflight));\n      }\n\n      // -- Inject approval token if provided (F5) --\n      if (approvalToken) {\n        merged._approval_token = approvalToken;\n      }\n\n      // 3. Check approval\n      await checkApproval(moduleDef, autoApprove, approvalTimeout);\n\n      // 4. Execute with timing\n\n      // -- Streaming execution (F6) --\n      if (streamFlag) {\n        // Streaming always outputs JSONL; --format table is ignored (spec §3.6.2)\n        if (resolveFormat(outputFormat) === \"table\") {\n          process.stderr.write(\"Warning: Streaming mode always outputs JSONL; --format table is ignored.\\n\");\n        }\n        const annotations = moduleDef.annotations as Record<string, unknown> | undefined;\n        const isStreaming = annotations?.streaming === true;\n        if (!isStreaming) {\n          process.stderr.write(\n            `Warning: Module '${moduleId}' does not declare streaming support. Falling back to standard execution.\\n`,\n          );\n        }\n\n        if (isStreaming && executor.stream) {\n          let chunks = 0;\n          for await (const chunk of executor.stream(moduleId, merged)) {\n            chunks++;\n            process.stdout.write(JSON.stringify(chunk) + \"\\n\");\n            if (process.stderr.isTTY) {\n              process.stderr.write(`\\rStreaming ${moduleId}... (${chunks} chunks)`);\n            }\n          }\n          if (process.stderr.isTTY) {\n            process.stderr.write(\"\\n\");\n          }\n          const durationMs = Math.round(performance.now() - startTime);\n\n          // Audit log (success)\n          const { getAuditLogger } = await import(\"./security/audit.js\");\n          const auditLogger = getAuditLogger();\n          if (auditLogger) {\n            auditLogger.logExecution(moduleId, merged, \"success\", 0, durationMs);\n          }\n          return;\n        }\n        // else: fall through to normal execution\n      }\n\n      // -- Traced execution (F4) --\n      if (traceFlag && executor.callWithTrace) {\n        const [result, trace] = await executor.callWithTrace(\n          moduleId,\n          merged,\n          strategyName ? { strategy: strategyName } : undefined,\n        );\n        const durationMs = Math.round(performance.now() - startTime);\n\n        // Print result\n        const resolved = resolveFormat(outputFormat);\n        if (resolved === \"json\" || !process.stdout.isTTY) {\n          // Merge _trace into JSON output. JSON keys remain snake_case to\n          // match the cross-language CLI output contract; runtime reads use\n          // the camelCase shape returned by apcore-js PipelineTrace.\n          const traceData = {\n            strategy: trace.strategyName,\n            total_duration_ms: trace.totalDurationMs,\n            success: trace.success,\n            steps: trace.steps.map((s) => ({\n              name: s.name,\n              duration_ms: s.durationMs,\n              skipped: s.skipped,\n              ...(s.skipped ? { skip_reason: s.skipReason ?? null } : {}),\n            })),\n          };\n          let output: Record<string, unknown>;\n          if (typeof result === \"object\" && result !== null && !Array.isArray(result)) {\n            output = { ...(result as Record<string, unknown>), _trace: traceData };\n          } else {\n            output = { result, _trace: traceData };\n          }\n          process.stdout.write(JSON.stringify(output, null, 2) + \"\\n\");\n        } else {\n          formatExecResult(result, outputFormat, outputFields);\n          // Print trace to stderr\n          const stepCount = trace.steps.length;\n          process.stderr.write(\n            `\\nPipeline Trace (strategy: ${trace.strategyName}, ` +\n            `${stepCount} steps, ${trace.totalDurationMs.toFixed(1)}ms)\\n`,\n          );\n          for (const s of trace.steps) {\n            if (s.skipped) {\n              const reason = s.skipReason ?? \"n/a\";\n              process.stderr.write(`  \\u25cb ${s.name.padEnd(24)} ${\"\\u2014\".padStart(8)}  skipped (${reason})\\n`);\n            } else {\n              process.stderr.write(`  \\u2713 ${s.name.padEnd(24)} ${(s.durationMs.toFixed(1) + \"ms\").padStart(8)}\\n`);\n            }\n          }\n        }\n        // Audit log AFTER format (canonical ordering: format \\u2192 audit on success)\n        const { getAuditLogger: getAL2 } = await import(\"./security/audit.js\");\n        const al2 = getAL2();\n        if (al2) {\n          al2.logExecution(moduleId, merged, \"success\", 0, durationMs);\n        }\n        return;\n      }\n\n      // -- Standard execution (with optional strategy F8) --\n      let result: unknown;\n      if (strategyName && executor.callWithTrace) {\n        // Strategy requires callWithTrace to pass strategy param\n        const [res] = await executor.callWithTrace(\n          moduleId,\n          merged,\n          { strategy: strategyName },\n        );\n        result = res;\n        if (strategyName !== \"standard\" && process.stderr.isTTY) {\n          process.stderr.write(`Warning: Using '${strategyName}' strategy.\\n`);\n        }\n      } else {\n        const { Sandbox } = await import(\"./security/index.js\");\n        const sandbox = new Sandbox(sandboxEnabled);\n        result = await sandbox.execute(moduleId, merged, executor);\n      }\n      const durationMs = Math.round(performance.now() - startTime);\n\n      // 5. Format and print result first (canonical order: format → audit)\n      formatExecResult(result, outputFormat, outputFields);\n\n      // 6. Audit log (success) — called AFTER format so formatter exceptions\n      //    suppress the success entry (matches Python canonical ordering).\n      const { getAuditLogger } = await import(\"./security/audit.js\");\n      const auditLogger = getAuditLogger();\n      if (auditLogger) {\n        auditLogger.logExecution(moduleId, merged, \"success\", 0, durationMs);\n      }\n    } catch (err: unknown) {\n      // Enhanced error output (F3)\n      const exitCode = exitCodeForError(err);\n      const durationMs = Math.round(performance.now() - startTime);\n\n      // Audit log (error) with real elapsed duration_ms\n      try {\n        const { getAuditLogger } = await import(\"./security/audit.js\");\n        const auditLogger = getAuditLogger();\n        if (auditLogger) {\n          auditLogger.logExecution(moduleId, merged, \"error\", exitCode, durationMs);\n        }\n      } catch {\n        // Ignore audit failures during error handling\n      }\n\n      if (outputFormat === \"json\" || !process.stderr.isTTY) {\n        emitErrorJson(err, exitCode);\n      } else {\n        emitErrorTty(err, exitCode);\n      }\n      process.exit(exitCode);\n    }\n  });\n\n  return cmd;\n}\n\n// ---------------------------------------------------------------------------\n// validateModuleId\n// ---------------------------------------------------------------------------\n\n/**\n * Validate that a module ID conforms to the expected format.\n * Pattern: [a-z][a-z0-9_]*(.[a-z][a-z0-9_])* — max 192 chars.\n *\n * Length limit tracks PROTOCOL_SPEC §2.7 EBNF constraint #1 — bumped from\n * 128 to 192 in spec 1.6.0-draft to accommodate Java/.NET deep-namespace\n * FQN-derived IDs. Filesystem-safe (192 + \".binding.yaml\".length = 205 < 255).\n */\nexport function validateModuleId(moduleId: string): void {\n  if (moduleId.length > 192) {\n    process.stderr.write(\n      `Error: Invalid module ID format: '${moduleId}'. Maximum length is 192 characters.\\n`,\n    );\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n  if (!/^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*)*$/.test(moduleId)) {\n    process.stderr.write(\n      `Error: Invalid module ID format: '${moduleId}'.\\n`,\n    );\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// collectInput\n// ---------------------------------------------------------------------------\n\n/**\n * Collect module input from stdin and/or CLI keyword arguments.\n */\nexport async function collectInput(\n  stdinFlag?: string,\n  cliKwargs: Record<string, unknown> = {},\n  largeInput?: boolean,\n): Promise<Record<string, unknown>> {\n  // Remove null/undefined values from CLI kwargs\n  const cliKwargsNonNull: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(cliKwargs)) {\n    if (v !== null && v !== undefined) {\n      cliKwargsNonNull[k] = v;\n    }\n  }\n\n  if (!stdinFlag) {\n    return cliKwargsNonNull;\n  }\n\n  let raw: string;\n  let source: string;\n  if (stdinFlag === \"-\") {\n    raw = await readStdin();\n    source = \"STDIN\";\n  } else {\n    // File-path source (help text: \"JSON input file or '-' for stdin\")\n    source = `file '${stdinFlag}'`;\n    try {\n      raw = readFileSync(stdinFlag, \"utf-8\");\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      process.stderr.write(`Error: Could not read input ${source}: ${msg}\\n`);\n      process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n    }\n  }\n\n  const rawSize = Buffer.byteLength(raw, \"utf-8\");\n  if (rawSize > 10_485_760 && !largeInput) {\n    process.stderr.write(\n      `Error: ${source} input exceeds 10MB limit. Use --large-input to override.\\n`,\n    );\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n\n  if (!raw) {\n    return cliKwargsNonNull;\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    process.stderr.write(`Error: ${source} does not contain valid JSON.\\n`);\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n    process.stderr.write(\n      `Error: ${source} JSON must be an object, got ${Array.isArray(parsed) ? \"array\" : typeof parsed}.\\n`,\n    );\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n\n  // CLI flags override stdin/file for duplicate keys\n  return { ...(parsed as Record<string, unknown>), ...cliKwargsNonNull };\n}\n\n/**\n * Read all data from stdin with proper cleanup.\n */\nfunction readStdin(): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    const onData = (chunk: Buffer) => chunks.push(chunk);\n    const onEnd = () => {\n      cleanup();\n      resolve(Buffer.concat(chunks).toString(\"utf-8\"));\n    };\n    const onError = (err: Error) => {\n      cleanup();\n      reject(err);\n    };\n    const cleanup = () => {\n      process.stdin.removeListener(\"data\", onData);\n      process.stdin.removeListener(\"end\", onEnd);\n      process.stdin.removeListener(\"error\", onError);\n    };\n    process.stdin.on(\"data\", onData);\n    process.stdin.on(\"end\", onEnd);\n    process.stdin.on(\"error\", onError);\n    process.stdin.resume();\n  });\n}\n\n// ---------------------------------------------------------------------------\n// reconvertEnumValues\n// ---------------------------------------------------------------------------\n\n/**\n * Re-convert CLI string values back to their schema-typed equivalents\n * based on the option configs.\n */\nexport function reconvertEnumValues(\n  kwargs: Record<string, unknown>,\n  options: OptionConfig[],\n): Record<string, unknown> {\n  const result = { ...kwargs };\n  for (const opt of options) {\n    if (!opt.enumOriginalTypes) continue;\n    const paramName = opt.name;\n    if (!(paramName in result) || result[paramName] === null || result[paramName] === undefined) {\n      continue;\n    }\n    const strVal = String(result[paramName]);\n    const origType = opt.enumOriginalTypes[strVal];\n    if (origType === \"int\") {\n      result[paramName] = parseInt(strVal, 10);\n    } else if (origType === \"float\") {\n      result[paramName] = parseFloat(strVal);\n    } else if (origType === \"bool\") {\n      result[paramName] = strVal.toLowerCase() === \"true\";\n    }\n  }\n  return result;\n}\n","#!/usr/bin/env node\n/**\n * apcore-cli — Shebang entry point.\n *\n * Intercepts --internal-sandbox-runner before the normal CLI bootstrap so\n * that the sandbox child process can execute a module without initializing\n * the full CLI surface (extensions dir scanning, registry, etc.).\n */\n\nconst sandboxIdx = process.argv.indexOf(\"--internal-sandbox-runner\");\nif (sandboxIdx !== -1) {\n  const moduleId = process.argv[sandboxIdx + 1];\n  if (!moduleId) {\n    process.stderr.write(\"--internal-sandbox-runner requires a module_id argument.\\n\");\n    process.exit(1);\n  }\n  import(\"../src/security/sandbox.js\").then(({ runSandboxRunner }) => {\n    runSandboxRunner(moduleId).catch((err: unknown) => {\n      process.stderr.write(`sandbox runner fatal: ${err}\\n`);\n      process.exit(1);\n    });\n  });\n} else {\n  import(\"../src/main.js\").then(({ main }) => {\n    main(\"apcore-cli\");\n  });\n}\n"],"mappings":";;;;;;;;;;;;AACA,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAF9B;AAAA;AAAA;AAAA;AAAA;;;AC4GO,SAAS,iBAAiB,OAA0B;AACzD,MAAI,iBAAiB,sBAAsB;AACzC,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,iBAAiB,qBAAqB;AACxC,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,iBAAiB,qBAAqB;AACxC,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,iBAAiB,uBAAuB;AAC1C,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,iBAAiB,uBAAuB;AAC1C,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,iBAAiB,qBAAqB;AACxC,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,iBAAiB,sBAAsB;AACzC,WAAO,WAAW;AAAA,EACpB;AAGA,MAAI,iBAAiB,OAAO;AAC1B,UAAM,OAAQ,MAA6C;AAC3D,UAAM,UAAoC;AAAA,MACxC,kBAAkB,WAAW;AAAA,MAC7B,mBAAmB,WAAW;AAAA,MAC9B,iBAAiB,WAAW;AAAA,MAC5B,sBAAsB,WAAW;AAAA,MACjC,6BAA6B,WAAW;AAAA,MACxC,yBAAyB,WAAW;AAAA,MACpC,qBAAqB,WAAW;AAAA,MAChC,iBAAiB,WAAW;AAAA,MAC5B,kBAAkB,WAAW;AAAA,MAC7B,kBAAkB,WAAW;AAAA,MAC7B,kBAAkB,WAAW;AAAA,MAC7B,gBAAgB,WAAW;AAAA,MAC3B,sBAAsB,WAAW;AAAA,MACjC,gBAAgB,WAAW;AAAA,MAC3B,YAAY,WAAW;AAAA;AAAA,MAEvB,2BAA2B,WAAW;AAAA,MACtC,4BAA4B,WAAW;AAAA,MACvC,4BAA4B,WAAW;AAAA,MACvC,yBAAyB,WAAW;AAAA,MACpC,oBAAoB,WAAW;AAAA,MAC/B,mBAAmB,WAAW;AAAA,MAC9B,2BAA2B,WAAW;AAAA,IACxC;AACA,QAAI,QAAQ,QAAQ,SAAS;AAC3B,aAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AAEA,SAAO,WAAW;AACpB;AArKA,IAWa,sBAQA,qBAQA,uBAQA,sBAQA,qBAQA,uBAQA,qBAWA;AAtEb;AAAA;AAAA;AAAA;AAWO,IAAM,uBAAN,cAAmC,MAAM;AAAA,MAC9C,YAAY,UAAU,sBAAsB;AAC1C,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAGO,IAAM,sBAAN,cAAkC,MAAM;AAAA,MAC7C,YAAY,UAAU,yBAAyB;AAC7C,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAGO,IAAM,wBAAN,cAAoC,MAAM;AAAA,MAC/C,YAAY,UAAU,4BAA4B;AAChD,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAGO,IAAM,uBAAN,cAAmC,MAAM;AAAA,MAC9C,YAAY,UAAU,2BAA2B;AAC/C,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAGO,IAAM,sBAAN,cAAkC,MAAM;AAAA,MAC7C,YAAY,UAAU,mBAAmB;AACvC,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAGO,IAAM,wBAAN,cAAoC,MAAM;AAAA,MAC/C,YAAY,UAAU,4BAA4B;AAChD,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAGO,IAAM,sBAAN,cAAkC,MAAM;AAAA,MAC7C,YAAY,UAAU,oBAAoB;AACxC,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAMO,IAAM,aAAa;AAAA,MACxB,SAAS;AAAA,MACT,sBAAsB;AAAA,MACtB,gBAAgB;AAAA,MAChB,mBAAmB;AAAA,MACnB,kBAAkB;AAAA,MAClB,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,MACjB,sBAAsB;AAAA,MACtB,6BAA6B;AAAA,MAC7B,yBAAyB;AAAA,MACzB,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,MACrB,YAAY;AAAA;AAAA,MAEZ,2BAA2B;AAAA,MAC3B,4BAA4B;AAAA,MAC5B,4BAA4B;AAAA,MAC5B,yBAAyB;AAAA,MACzB,oBAAoB;AAAA,MACpB,mBAAmB;AAAA,MACnB,2BAA2B;AAAA,MAC3B,oBAAoB;AAAA,IACtB;AAAA;AAAA;;;AChGA;AAAA;AAAA;AAAA;AAAA;AAqJA,eAAsB,iBAAiB,UAAiC;AACtE,QAAM,iBAAiB,QAAQ,IAAI,0BAA0B;AAG7D,QAAM,SAAS,MAAM,OAAO,WAAW,EAAE,MAAM,MAAM;AACnD,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACD,MAAI,CAAC,OAAQ;AAEb,MAAI,YAAY;AAChB,mBAAiB,SAAS,QAAQ,OAAO;AACvC,iBAAa,MAAM,SAAS;AAAA,EAC9B;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,KAAK,MAAM,SAAS;AAAA,EAClC,QAAQ;AACN,YAAQ,OAAO,MAAM,kDAAkD;AACvE,YAAQ,KAAK,CAAC;AACd;AAAA,EACF;AAEA,QAAM,WAAW,IAAI,OAAO,SAAS,EAAE,eAAe,eAAe,CAAC;AACtE,QAAM,SAAS,SAAS;AACxB,QAAM,WAAW,IAAI,OAAO,SAAS,EAAE,SAAS,CAAC;AACjD,MAAI;AACF,UAAM,SAAS,MAAM,SAAS,KAAK,UAAU,SAAS;AACtD,YAAQ,OAAO,MAAM,KAAK,UAAU,MAAM,CAAC;AAC3C,YAAQ,KAAK,CAAC;AAAA,EAChB,SAAS,KAAc;AACrB,YAAQ,OAAO,MAAM,yBAAyB,GAAG;AAAA,CAAI;AACrD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;AAMA,SAAS,gBAAgB,QAAmC;AAC1D,QAAM,MAAyB,CAAC;AAChC,aAAW,OAAO,oBAAoB;AACpC,QAAI,QAAQ,IAAI,GAAG,EAAG,KAAI,GAAG,IAAI,QAAQ,IAAI,GAAG;AAAA,EAClD;AACA,aAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,QAAQ,GAAG,GAAG;AACpD,QACE,IAAI,WAAW,oBAAoB,KACnC,CAAC,IAAI,WAAW,mBAAmB,KACnC,CAAE,kBAAwC,SAAS,GAAG,GACtD;AACA,UAAI,GAAG,IAAI;AAAA,IACb;AAAA,EACF;AACA,MAAI,OAAO;AACX,MAAI,SAAS;AACb,SAAO;AACT;AAjNA,IAgBM,oBACA,sBACA,qBAEA,mBAEA,2BAcO;AApCb;AAAA;AAAA;AAAA;AAYA;AAIA,IAAM,qBAAqB,CAAC,QAAQ,QAAQ,QAAQ;AACpD,IAAM,uBAAuB;AAC7B,IAAM,sBAAsB;AAE5B,IAAM,oBAAuC,CAAC,qBAAqB;AAEnE,IAAM,4BAA4B,KAAK,OAAO;AAcvC,IAAM,UAAN,MAAc;AAAA,MACF;AAAA,MACA;AAAA,MAEjB,YAAY,UAAU,OAAO,iBAAiB,KAAK;AACjD,aAAK,UAAU;AACf,aAAK,iBAAiB;AAAA,MACxB;AAAA;AAAA;AAAA;AAAA,MAKA,MAAM,QACJ,UACA,WACA,UACkB;AAClB,YAAI,CAAC,KAAK,SAAS;AACjB,iBAAO,SAAS,QAAQ,UAAU,SAAS;AAAA,QAC7C;AACA,eAAO,KAAK,kBAAkB,UAAU,SAAS;AAAA,MACnD;AAAA,MAEA,MAAc,kBACZ,UACA,WACkB;AAClB,cAAM,EAAE,MAAM,IAAI,MAAM,OAAO,eAAoB;AACnD,cAAM,EAAE,OAAO,IAAI,MAAM,OAAO,IAAS;AACzC,cAAM,EAAE,MAAAA,MAAK,IAAI,MAAM,OAAO,MAAW;AACzC,cAAM,EAAE,aAAa,OAAO,IAAI,MAAM,OAAO,IAAS;AAEtD,cAAM,SAAS,YAAYA,MAAK,OAAO,GAAG,iBAAiB,CAAC;AAE5D,cAAM,MAAM,gBAAgB,MAAM;AAClC,cAAM,aAAa,QAAQ,KAAK,CAAC;AACjC,cAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,YAAY,6BAA6B,QAAQ,GAAG;AAAA,UACzF;AAAA,UACA,KAAK;AAAA,UACL,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAChC,CAAC;AAED,YAAI,SAAS;AACb,YAAI,SAAS;AACb,YAAI,aAAa;AACjB,YAAI,eAAe;AAEnB,cAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,wBAAc,MAAM;AACpB,cAAI,aAAa,2BAA2B;AAC1C,2BAAe;AACf,kBAAM,KAAK,SAAS;AACpB;AAAA,UACF;AACA,oBAAU,MAAM,SAAS;AAAA,QAC3B,CAAC;AACD,cAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,oBAAU,MAAM,SAAS;AAAA,QAC3B,CAAC;AAED,cAAM,MAAM,MAAM,KAAK,UAAU,SAAS,CAAC;AAC3C,cAAM,MAAM,IAAI;AAEhB,eAAO,IAAI,QAAiB,CAACC,UAAS,WAAW;AAC/C,gBAAM,QAAQ,WAAW,MAAM;AAC7B,kBAAM,KAAK,SAAS;AACpB;AAAA,cACE,IAAI;AAAA,gBACF,mBAAmB,QAAQ,qBAAqB,KAAK,cAAc;AAAA,cACrE;AAAA,YACF;AAAA,UACF,GAAG,KAAK,iBAAiB,GAAI;AAE7B,gBAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,yBAAa,KAAK;AAClB,gBAAI;AAAE,qBAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,YAAG,QAAQ;AAAA,YAAoB;AAEpF,gBAAI,cAAc;AAChB,qBAAO,IAAI,qBAAqB,mBAAmB,QAAQ,gCAAgC,CAAC;AAC5F;AAAA,YACF;AACA,gBAAI,SAAS,GAAG;AACd,qBAAO,IAAI;AAAA,gBACT,mBAAmB,QAAQ,sBAAsB,IAAI,IAAI,SAAS,YAAY,MAAM,KAAK,EAAE;AAAA,cAC7F,CAAC;AACD;AAAA,YACF;AACA,gBAAI;AACF,cAAAA,SAAQ,KAAK,MAAM,MAAM,CAAC;AAAA,YAC5B,QAAQ;AACN,qBAAO,IAAI;AAAA,gBACT,mBAAmB,QAAQ,+BAA+B,OAAO,MAAM,GAAG,GAAG,CAAC;AAAA,cAChF,CAAC;AAAA,YACH;AAAA,UACF,CAAC;AAED,gBAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,yBAAa,KAAK;AAClB,mBAAO,IAAI,qBAAqB,oCAAoC,IAAI,OAAO,EAAE,CAAC;AAAA,UACpF,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AAAA;AAAA;;;AC1HO,SAAS,YACd,QACA,WAAW,IACX,WAAW,IACc;AACzB,QAAM,SAAS,gBAAgB,MAAM;AACrC,QAAM,OAAQ,OAAO,SAAS,OAAO,eAAe,CAAC;AAIrD,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA,oBAAI,IAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAGA,SAAO,OAAO;AACd,SAAO,OAAO;AACd,SAAO;AACT;AAEA,SAAS,YACP,MACA,MACA,SACA,OACA,UACA,UACS;AACT,MAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG;AACpE,WAAO;AAAA,EACT;AAEA,QAAM,MAAM;AAGZ,MAAI,UAAU,KAAK;AACjB,UAAM,UAAU,IAAI;AAEpB,QAAI,SAAS,UAAU;AACrB,cAAQ,OAAO;AAAA,QACb,oDAAoD,QAAQ,gBAAgB,QAAQ;AAAA;AAAA,MACtF;AACA,cAAQ,KAAK,WAAW,mBAAmB;AAAA,IAC7C;AAEA,QAAI,QAAQ,IAAI,OAAO,GAAG;AACxB,cAAQ,OAAO;AAAA,QACb,uDAAuD,QAAQ,cAAc,OAAO;AAAA;AAAA,MACtF;AACA,cAAQ,KAAK,WAAW,mBAAmB;AAAA,IAC7C;AAGA,UAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,UAAM,MAAM,MAAM,MAAM,SAAS,CAAC;AAElC,QAAI,EAAE,OAAO,OAAO;AAClB,cAAQ,OAAO;AAAA,QACb,6BAA6B,OAAO,2BAA2B,QAAQ;AAAA;AAAA,MACzE;AACA,cAAQ,KAAK,WAAW,uBAAuB;AAAA,IACjD;AAEA,UAAM,aAAa,IAAI,IAAI,OAAO;AAClC,eAAW,IAAI,OAAO;AACtB,WAAO,YAAY,KAAK,GAAG,GAAG,MAAM,YAAY,QAAQ,GAAG,UAAU,QAAQ;AAAA,EAC/E;AAGA,MAAI,WAAW,OAAO,MAAM,QAAQ,IAAI,KAAK,GAAG;AAC9C,UAAM,SAAkC;AAAA,MACtC,YAAY,CAAC;AAAA,MACb,UAAU,CAAC;AAAA,IACb;AAIA,QAAI,OAAO,IAAI,eAAe,YAAY,IAAI,eAAe,MAAM;AACjE,aAAO,OAAO,OAAO,YAAuC,IAAI,UAAU;AAAA,IAC5E;AACA,QAAI,MAAM,QAAQ,IAAI,QAAQ,GAAG;AAC/B,MAAC,OAAO,SAAsB,KAAK,GAAI,IAAI,QAAqB;AAAA,IAClE;AACA,eAAW,aAAa,IAAI,OAAoB;AAC9C,YAAM,WAAW;AAAA,QACf;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACA,UAAI,SAAS,YAAY;AACvB,eAAO;AAAA,UACL,OAAO;AAAA,UACP,SAAS;AAAA,QACX;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,QAAQ,GAAG;AACpC,QAAC,OAAO,SAAsB,KAAK,GAAG,SAAS,QAAQ;AAAA,MACzD;AAAA,IACF;AAEA,WAAO,WAAW,CAAC,GAAG,IAAI,IAAI,OAAO,QAAoB,CAAC;AAE1D,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,UAAI,MAAM,WAAW,EAAE,KAAK,SAAS;AACnC,eAAO,CAAC,IAAI;AAAA,MACd;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAGA,aAAW,WAAW,CAAC,SAAS,OAAO,GAAG;AACxC,QAAI,WAAW,OAAO,MAAM,QAAQ,IAAI,OAAO,CAAC,GAAG;AACjD,YAAM,SAAkC;AAAA,QACtC,YAAY,CAAC;AAAA,QACb,UAAU,CAAC;AAAA,MACb;AACA,YAAM,kBAAiC,CAAC;AACxC,iBAAW,aAAa,IAAI,OAAO,GAAgB;AACjD,cAAM,WAAW;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACA,YAAI,SAAS,YAAY;AACvB,iBAAO;AAAA,YACL,OAAO;AAAA,YACP,SAAS;AAAA,UACX;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,SAAS,QAAQ,GAAG;AACpC,0BAAgB,KAAK,IAAI,IAAI,SAAS,QAAoB,CAAC;AAAA,QAC7D;AAAA,MACF;AAEA,UAAI,gBAAgB,SAAS,GAAG;AAC9B,YAAI,eAAe,gBAAgB,CAAC;AACpC,iBAAS,IAAI,GAAG,IAAI,gBAAgB,QAAQ,KAAK;AAC/C,yBAAe,IAAI;AAAA,YACjB,CAAC,GAAG,YAAY,EAAE,OAAO,CAAC,MAAM,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;AAAA,UAC3D;AAAA,QACF;AACA,eAAO,WAAW,CAAC,GAAG,YAAY;AAAA,MACpC,OAAO;AACL,eAAO,WAAW,CAAC;AAAA,MACrB;AAEA,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,YAAI,MAAM,WAAW,EAAE,KAAK,SAAS;AACnC,iBAAO,CAAC,IAAI;AAAA,QACd;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAGA,MAAI,gBAAgB,OAAO,OAAO,IAAI,eAAe,YAAY,IAAI,eAAe,MAAM;AACxF,UAAM,QAAQ,IAAI;AAClB,eAAW,CAAC,UAAU,UAAU,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1D,YAAM,QAAQ,IAAI;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAvMA;AAAA;AAAA;AAAA;AAMA;AAAA;AAAA;;;ACeO,SAAS,QAAQ,UAAkB,YAAiD;AACzF,QAAM,aAAa,WAAW;AAG9B,MACE,eAAe,aACd,SAAS,SAAS,OAAO,KAAK,WAAW,YAAY,MAAM,OAC5D;AACA,WAAO;AAAA,EACT;AAEA,QAAM,UAAsC;AAAA,IAC1C,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,OAAO;AAAA,EACT;AAEA,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AAEA,SAAO,QAAQ,UAAU,KAAK;AAChC;AAKO,SAAS,YAAY,YAAqC,YAAY,KAA0B;AACrG,MAAI,OAAO,WAAW,mBAAmB;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,MAAI,YAAY,KAAK,KAAK,SAAS,WAAW;AAC5C,WAAO,KAAK,MAAM,GAAG,YAAY,CAAC,IAAI;AAAA,EACxC;AACA,SAAO;AACT;AAiBO,SAAS,mBACd,QACA,gBAAgB,KACA;AAChB,QAAM,aAAc,OAAO,cAAc,CAAC;AAI1C,QAAM,eAAgB,OAAO,YAAY,CAAC;AAC1C,QAAM,UAA0B,CAAC;AACjC,QAAM,YAAoC,CAAC;AAE3C,aAAW,CAAC,UAAU,UAAU,KAAK,OAAO,QAAQ,UAAU,GAAG;AAC/D,UAAM,WAAW,OAAO,SAAS,QAAQ,MAAM,GAAG;AAGlD,QAAI,eAAe,IAAI,QAAQ,GAAG;AAChC,cAAQ,OAAO;AAAA,QACb,kCAAkC,QAAQ;AAAA;AAAA,MAC5C;AACA,cAAQ,KAAK,WAAW,iBAAiB;AAAA,IAC3C;AAGA,QAAI,YAAY,WAAW;AACzB,cAAQ,OAAO;AAAA,QACb,2CAA2C,QAAQ,UAAU,UAAU,QAAQ,CAAC,kBAAkB,QAAQ;AAAA;AAAA,MAC5G;AACA,cAAQ,KAAK,WAAW,iBAAiB;AAAA,IAC3C;AACA,cAAU,QAAQ,IAAI;AAEtB,UAAM,aAAa,QAAQ,UAAU,UAAU;AAC/C,UAAM,aAAa,aAAa,SAAS,QAAQ;AACjD,UAAM,WAAW,YAAY,YAAY,aAAa;AACtD,UAAM,WAAW,cACZ,WAAW,WAAW,MAAM,MAAM,eACnC,YAAY;AAChB,UAAM,eAAe,WAAW;AAEhC,QAAI,eAAe,cAAc;AAE/B,YAAM,WAAW,SAAS,QAAQ,MAAM,GAAG;AAM3C,YAAM,SAAS,QAAQ,QAAQ;AAC/B,UAAI,UAAU,WAAW;AACvB,gBAAQ,OAAO;AAAA,UACb,iDAAiD,QAAQ,qBAAqB,MAAM,wCAAwC,UAAU,MAAM,CAAC;AAAA;AAAA,QAC/I;AACA,gBAAQ,KAAK,WAAW,iBAAiB;AAAA,MAC3C;AACA,gBAAU,MAAM,IAAI;AACpB,YAAM,aAAc,WAAW,WAAuB;AACtD,cAAQ,KAAK;AAAA,QACX,MAAM;AAAA,QACN,OAAO,KAAK,QAAQ,UAAU,QAAQ;AAAA,QACtC,aAAa;AAAA,QACb,cAAc;AAAA,QACd,UAAU;AAAA,QACV,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,WAAW,UAAU,cAAc,MAAM,QAAQ,WAAW,IAAI,GAAG;AACjE,YAAM,aAAa,WAAW;AAC9B,UAAI,WAAW,WAAW,GAAG;AAE3B,gBAAQ,KAAK;AAAA,UACX,MAAM;AAAA,UACN,OAAO,GAAG,QAAQ;AAAA,UAClB,aAAa;AAAA,UACb;AAAA,UACA,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,OAAO;AACL,cAAM,eAAe,WAAW,IAAI,MAAM;AAC1C,cAAM,oBAA4C,CAAC;AACnD,mBAAW,KAAK,YAAY;AAC1B,cAAI,OAAO,MAAM,YAAY,OAAO,UAAU,CAAC,GAAG;AAChD,8BAAkB,OAAO,CAAC,CAAC,IAAI;AAAA,UACjC,WAAW,OAAO,MAAM,UAAU;AAChC,8BAAkB,OAAO,CAAC,CAAC,IAAI;AAAA,UACjC,WAAW,OAAO,MAAM,WAAW;AACjC,8BAAkB,OAAO,CAAC,CAAC,IAAI;AAAA,UACjC;AAAA,QACF;AACA,gBAAQ,KAAK;AAAA,UACX,MAAM;AAAA,UACN,OAAO,GAAG,QAAQ;AAAA,UAClB,aAAa;AAAA,UACb,cACE,iBAAiB,SAAY,OAAO,YAAY,IAAI;AAAA,UACtD,UAAU;AAAA,UACV,SAAS;AAAA,UACT,mBACE,OAAO,KAAK,iBAAiB,EAAE,SAAS,IACpC,oBACA;AAAA,QACR,CAAC;AAAA,MACH;AAAA,IACF,OAAO;AAEL,UAAI;AACJ,UAAI,eAAe,OAAO;AACxB,mBAAW,CAAC,MAAc;AACxB,gBAAM,IAAI,SAAS,GAAG,EAAE;AACxB,cAAI,MAAM,CAAC,EAAG,OAAM,IAAI,MAAM,oBAAoB,CAAC,EAAE;AACrD,iBAAO;AAAA,QACT;AAAA,MACF,WAAW,eAAe,SAAS;AACjC,mBAAW,CAAC,MAAc;AACxB,gBAAM,IAAI,WAAW,CAAC;AACtB,cAAI,MAAM,CAAC,EAAG,OAAM,IAAI,MAAM,mBAAmB,CAAC,EAAE;AACpD,iBAAO;AAAA,QACT;AAAA,MACF;AACA,cAAQ,KAAK;AAAA,QACX,MAAM;AAAA,QACN,OAAO,GAAG,QAAQ;AAAA,QAClB,aAAa;AAAA,QACb;AAAA,QACA,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAlNA,IAcM,cAwDA;AAtEN;AAAA;AAAA;AAAA;AAOA;AAOA,IAAM,eAAe,uBAAO,cAAc;AAwD1C,IAAM,iBAAiB,oBAAI,IAAI;AAAA,MAC7B;AAAA,MAAS;AAAA,MAAO;AAAA,MAAe;AAAA,MAAU;AAAA,MAAU;AAAA,MACnD;AAAA,MAAW;AAAA,MAAW;AAAA,MAAS;AAAA,MAAU;AAAA,MACzC;AAAA,MAAoB;AAAA,IACtB,CAAC;AAAA;AAAA;;;ACpED,YAAY,cAAc;AAW1B,SAAS,cACP,aACA,KACA,eAAwB,QACf;AACT,MAAI,CAAC,eAAe,OAAO,gBAAgB,SAAU,QAAO;AAC5D,QAAM,MAAM;AACZ,SAAO,OAAO,MAAM,IAAI,GAAG,IAAI;AACjC;AAMA,SAAS,qBAAyC;AAChD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,UAAa,QAAQ,GAAI,QAAO;AAC5C,QAAM,SAAS,SAAS,KAAK,EAAE;AAC/B,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,EAAG,QAAO;AACpD,SAAO;AACT;AA4EA,eAAsB,cACpB,WACA,aACA,SACe;AACf,QAAM,cAAc,UAAU;AAG9B,MAAI;AACJ,MAAI,UAAU,qBAAqB,QAAW;AAC5C,uBAAmB,UAAU;AAAA,EAC/B,WAAW,aAAa;AACtB,uBAAmB,cAAc,aAAa,qBAAqB,KAAK,MAAM;AAAA,EAChF,OAAO;AACL;AAAA,EACF;AAEA,MAAI,CAAC,kBAAkB;AACrB;AAAA,EACF;AAEA,QAAM,WAAW,UAAU;AAG3B,MAAI,aAAa;AACf;AAAA,EACF;AAGA,QAAM,SAAS,QAAQ,IAAI,2BAA2B;AACtD,MAAI,WAAW,KAAK;AAClB;AAAA,EACF;AACA,MAAI,WAAW,MAAM,WAAW,KAAK;AACnC,YAAQ,OAAO;AAAA,MACb,+CAA+C,MAAM;AAAA;AAAA,IACvD;AAAA,EACF;AAGA,MAAI,CAAC,QAAQ,MAAM,OAAO;AACxB,UAAM,IAAI;AAAA,MACR,WAAW,QAAQ;AAAA,IAErB;AAAA,EACF;AAGA,QAAM,mBAAmB,WAAW,mBAAmB,KAAK;AAC5D,QAAM,kBAAkB,WAAW,gBAAgB;AACrD;AAKA,eAAe,kBACb,WACA,SACe;AAEf,YAAU,KAAK,IAAI,GAAG,KAAK,IAAI,SAAS,IAAI,CAAC;AAE7C,QAAM,WAAW,UAAU;AAC3B,QAAM,cAAc,UAAU;AAC9B,QAAM,WACH,cACI,cAAc,aAAa,kBAAkB,IAC9C,WACJ,WAAW,QAAQ;AAErB,UAAQ,OAAO,MAAM,UAAU,IAAI;AAEnC,QAAM,KAAc,yBAAgB;AAAA,IAClC,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,EAClB,CAAC;AAED,MAAI;AAEJ,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,MAChC,IAAI,QAAgB,CAACC,aAAY;AAC/B,WAAG,SAAS,mBAAmB,CAAC,QAAQA,SAAQ,GAAG,CAAC;AAAA,MACtD,CAAC;AAAA,MACD,IAAI,QAAe,CAAC,GAAG,WAAW;AAChC,gBAAQ,WAAW,MAAM;AACvB,iBAAO,IAAI;AAAA,YACT,mCAAmC,OAAO;AAAA,UAC5C,CAAC;AAAA,QACH,GAAG,UAAU,GAAI;AAAA,MACnB,CAAC;AAAA,IACH,CAAC;AAGD,QAAI,MAAO,cAAa,KAAK;AAE7B,UAAM,aAAa,OAAO,KAAK,EAAE,YAAY;AAC7C,QAAI,eAAe,OAAO,eAAe,OAAO;AAC9C;AAAA,IACF;AAEA,UAAM,IAAI,oBAAoB,iBAAiB;AAAA,EACjD,SAAS,KAAK;AACZ,QAAI,MAAO,cAAa,KAAK;AAI7B,UAAM;AAAA,EACR,UAAE;AACA,OAAG,MAAM;AAAA,EACX;AACF;AAhOA,IAoDa;AApDb;AAAA;AAAA;AAAA;AAQA;AA4CO,IAAM,qBAAN,MAAyB;AAAA,MAC9B;AAAA,MACA;AAAA,MAEA,YAAY,cAAc,OAAO,SAAkB;AACjD,aAAK,cAAc;AACnB,cAAM,WAAW,WAAW,mBAAmB,KAAK;AACpD,aAAK,UAAU,KAAK,IAAI,GAAG,KAAK,IAAI,UAAU,IAAI,CAAC;AAAA,MACrD;AAAA,MAEA,MAAM,gBAAgB,SAAoE;AACxF,cAAM,WAAY,QAAQ,aAAwB;AAElD,YAAI,KAAK,aAAa;AACpB,iBAAO,EAAE,QAAQ,YAAY,aAAa,eAAe;AAAA,QAC3D;AAEA,cAAM,SAAS,QAAQ,IAAI,2BAA2B;AACtD,YAAI,WAAW,KAAK;AAClB,iBAAO,EAAE,QAAQ,YAAY,aAAa,mBAAmB;AAAA,QAC/D;AACA,YAAI,WAAW,MAAM,WAAW,KAAK;AACnC,kBAAQ,OAAO;AAAA,YACb,+CAA+C,MAAM;AAAA;AAAA,UACvD;AAAA,QACF;AAEA,YAAI,CAAC,QAAQ,MAAM,OAAO;AACxB,iBAAO,EAAE,QAAQ,YAAY,QAAQ,wCAAwC;AAAA,QAC/E;AAGA,cAAM,cAAc,QAAQ;AAC5B,cAAM,QAAS,aAAa,SAAqC,CAAC;AAClE,cAAM,UAAW,MAAM,oBAA+B,WAAW,QAAQ;AAEzE,gBAAQ,OAAO,MAAM,UAAU,IAAI;AACnC,YAAI;AACF,gBAAM,kBAAkB,EAAE,IAAI,SAAS,GAAuB,KAAK,OAAO;AAC1E,iBAAO,EAAE,QAAQ,YAAY,aAAa,WAAW;AAAA,QACvD,QAAQ;AACN,iBAAO,EAAE,QAAQ,YAAY,QAAQ,6BAA6B;AAAA,QACpE;AAAA,MACF;AAAA,MAEA,MAAM,cAAc,aAAuD;AACzE,eAAO,EAAE,QAAQ,YAAY,QAAQ,8CAA8C;AAAA,MACrF;AAAA,IACF;AAAA;AAAA;;;AC9FA,OAAO,UAAU;AASjB,SAAS,cAAc,OAAwB;AAC7C,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC1D,SAAO,OAAO,KAAK;AACrB;AASO,SAAS,cAAc,gBAAiC;AAC7D,MAAI,mBAAmB,QAAW;AAChC,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,OAAO,QAAQ,UAAU;AAC1C;AAKO,SAAS,SAAS,MAAc,YAAY,IAAY;AAC7D,MAAI,KAAK,UAAU,WAAW;AAC5B,WAAO;AAAA,EACT;AACA,SAAO,KAAK,MAAM,GAAG,YAAY,CAAC,IAAI;AACxC;AAKA,SAAS,YACP,SACA,MACQ;AAER,QAAM,YAAY,QAAQ;AAAA,IAAI,CAAC,GAAG,MAChC,KAAK,IAAI,EAAE,QAAQ,GAAG,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,IAAI,MAAM,CAAC;AAAA,EAC5D;AAEA,QAAMC,OAAM,UAAU,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI;AACzD,QAAM,aAAa,QAChB,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,UAAU,CAAC,CAAC,CAAC,EACpC,KAAK,IAAI;AACZ,QAAM,YAAY,KAAK;AAAA,IAAI,CAAC,QAC1B,IAAI,IAAI,CAAC,MAAM,OAAO,QAAQ,IAAI,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI;AAAA,EACnE;AAEA,SAAO,CAAC,YAAYA,MAAK,GAAG,SAAS,EAAE,KAAK,IAAI,IAAI;AACtD;AASO,SAAS,iBACd,SACA,QACA,YACA,WAAW,OACX,gBACM;AACN,MAAI,WAAW,SAAS;AACtB,QAAI,QAAQ,WAAW,KAAK,cAAc,WAAW,SAAS,GAAG;AAC/D,cAAQ,OAAO;AAAA,QACb,mCAAmC,WAAW,KAAK,IAAI,CAAC;AAAA;AAAA,MAC1D;AACA;AAAA,IACF;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,OAAO,MAAM,qBAAqB;AAC1C;AAAA,IACF;AAEA,UAAM,UAAU,CAAC,MAAM,eAAe,MAAM;AAC5C,QAAI,SAAU,SAAQ,KAAK,MAAM;AACjC,QAAI,eAAgB,SAAQ,KAAK,UAAU;AAC3C,UAAM,OAAO,QAAQ,IAAI,CAAC,MAAM;AAC9B,YAAM,OAAO,CAAC,EAAE,IAAI,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC;AAC1E,UAAI,UAAU;AACZ,cAAM,OAAQ,EAAyC;AACvD,aAAK,KAAK,OAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC;AAAA,MACzD;AACA,UAAI,gBAAgB;AAClB,aAAK,KAAK,eAAe,UAAU,EAAE,MAAM,EAAE,IAAI,WAAW,QAAQ;AAAA,MACtE;AACA,aAAO;AAAA,IACT,CAAC;AACD,YAAQ,OAAO,MAAM,YAAY,SAAS,IAAI,CAAC;AAAA,EACjD,WAAW,WAAW,QAAQ;AAC5B,UAAM,SAAS,QAAQ,IAAI,CAAC,MAAM;AAChC,YAAM,QAAiC;AAAA,QACrC,IAAI,EAAE;AAAA,QACN,aAAa,EAAE;AAAA,QACf,MAAM,EAAE,QAAQ,CAAC;AAAA,MACnB;AACA,UAAI,UAAU;AACZ,cAAM,OAAQ,EAAyC;AACvD,cAAM,mBAAmB,MAAM,QAAQ,IAAI,IAAI,KAAK,SAAS;AAAA,MAC/D;AACA,UAAI,gBAAgB;AAClB,cAAM,UAAU,eAAe,UAAU,EAAE,MAAM,EAAE;AAAA,MACrD;AACA,aAAO;AAAA,IACT,CAAC;AACD,YAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAAA,EAC7D;AACF;AASA,SAAS,kBACP,aACgC;AAChC,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI,OAAO,gBAAgB,YAAY,MAAM,QAAQ,WAAW,EAAG,QAAO;AAC1E,QAAM,SAAkC,CAAC;AACzC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,WAAsC,GAAG;AAC3E,QAAI,MAAM,QAAQ,MAAM,UAAa,MAAM,SAAS,MAAM,KAAK,EAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,IAAI;AACpG,aAAO,CAAC,IAAI;AAAA,IACd;AAAA,EACF;AACA,SAAO,OAAO,KAAK,MAAM,EAAE,SAAS,IAAI,SAAS;AACnD;AAKO,SAAS,mBACd,WACA,QACM;AACN,MAAI,WAAW,SAAS;AACtB,YAAQ,OAAO,MAAM;AAAA,UAAa,UAAU,EAAE;AAAA,CAAI;AAClD,YAAQ,OAAO,MAAM;AAAA;AAAA,IAAqB,UAAU,WAAW;AAAA,CAAI;AAEnE,QAAI,UAAU,eAAe,OAAO,KAAK,UAAU,WAAW,EAAE,SAAS,GAAG;AAC1E,cAAQ,OAAO,MAAM,mBAAmB;AACxC,cAAQ,OAAO,MAAM,KAAK,UAAU,UAAU,aAAa,MAAM,CAAC,IAAI,IAAI;AAAA,IAC5E;AAEA,QAAI,UAAU,gBAAgB,OAAO,KAAK,UAAU,YAAY,EAAE,SAAS,GAAG;AAC5E,cAAQ,OAAO,MAAM,oBAAoB;AACzC,cAAQ,OAAO,MAAM,KAAK,UAAU,UAAU,cAAc,MAAM,CAAC,IAAI,IAAI;AAAA,IAC7E;AAEA,UAAM,UAAU;AAAA,MACd,UAAU;AAAA,IACZ;AACA,QAAI,SAAS;AACX,cAAQ,OAAO,MAAM,kBAAkB;AACvC,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,gBAAQ,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC;AAAA,CAAI;AAAA,MACvC;AAAA,IACF;AAGA,UAAM,WAAW,UAAU;AAC3B,QAAI,UAAU;AACZ,YAAM,UAAmC,CAAC;AAC1C,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC7C,YAAI,EAAE,WAAW,IAAI,KAAK,EAAE,WAAW,IAAI,GAAG;AAC5C,kBAAQ,CAAC,IAAI;AAAA,QACf;AAAA,MACF;AACA,UAAI,OAAO,KAAK,OAAO,EAAE,SAAS,GAAG;AACnC,gBAAQ,OAAO,MAAM,yBAAyB;AAC9C,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,kBAAQ,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC;AAAA,CAAI;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAO,UAAU,QAAQ,CAAC;AAChC,QAAI,KAAK,SAAS,GAAG;AACnB,cAAQ,OAAO,MAAM;AAAA,QAAW,KAAK,KAAK,IAAI,CAAC;AAAA,CAAI;AAAA,IACrD;AAAA,EACF,WAAW,WAAW,QAAQ;AAC5B,UAAM,SAAkC;AAAA,MACtC,IAAI,UAAU;AAAA,MACd,aAAa,UAAU;AAAA,IACzB;AACA,QAAI,UAAU,YAAa,QAAO,eAAe,UAAU;AAC3D,QAAI,UAAU,aAAc,QAAO,gBAAgB,UAAU;AAE7D,UAAM,UAAU;AAAA,MACd,UAAU;AAAA,IACZ;AACA,QAAI,QAAS,QAAO,cAAc;AAElC,UAAM,OAAO,UAAU,QAAQ,CAAC;AAChC,QAAI,KAAK,SAAS,EAAG,QAAO,OAAO;AAGnC,UAAM,WAAW,UAAU;AAC3B,QAAI,UAAU;AACZ,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC7C,YAAI,EAAE,WAAW,IAAI,KAAK,EAAE,WAAW,IAAI,GAAG;AAC5C,iBAAO,CAAC,IAAI;AAAA,QACd;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAAA,EAC7D;AACF;AAUA,SAAS,aAAa,QAAiC,QAAyC;AAC9F,QAAM,WAAoC,CAAC;AAC3C,aAAW,KAAK,OAAO,MAAM,GAAG,GAAG;AACjC,UAAM,MAAM,EAAE,KAAK;AACnB,QAAI,MAAe;AACnB,eAAW,QAAQ,IAAI,MAAM,GAAG,GAAG;AACjC,UAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,GAAG;AACzD,cAAO,IAAgC,IAAI;AAAA,MAC7C,OAAO;AACL,cAAM;AACN;AAAA,MACF;AAAA,IACF;AACA,aAAS,GAAG,IAAI;AAAA,EAClB;AACA,SAAO;AACT;AAQO,SAAS,iBACd,QACA,QACA,QACM;AACN,MAAI,WAAW,QAAQ,WAAW,QAAW;AAC3C;AAAA,EACF;AAGA,MAAI,mBAAmB;AACvB,MAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,KAAK,WAAW,MAAM;AACrF,uBAAmB,aAAa,QAAmC,MAAM;AAAA,EAC3E;AAEA,QAAM,YAAY,cAAc,MAAM;AAEtC,MAAI,cAAc,OAAO;AACvB,QAAI,OAAO,qBAAqB,YAAY,CAAC,MAAM,QAAQ,gBAAgB,KAAK,qBAAqB,MAAM;AACzG,YAAM,MAAM;AACZ,YAAM,OAAO,OAAO,KAAK,GAAG;AAC5B,YAAM,SAAS,KAAK,IAAI,cAAc,EAAE,KAAK,GAAG;AAChD,YAAM,MAAM,KAAK,IAAI,CAAC,MAAM,eAAe,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG;AAC3E,cAAQ,OAAO,MAAM,SAAS,OAAO,MAAM,IAAI;AAAA,IACjD,WAAW,MAAM,QAAQ,gBAAgB,KAAK,iBAAiB,SAAS,KAAK,OAAO,iBAAiB,CAAC,MAAM,UAAU;AACpH,YAAM,OAAO,OAAO,KAAK,iBAAiB,CAAC,CAA4B;AACvE,YAAM,SAAS,KAAK,IAAI,cAAc,EAAE,KAAK,GAAG;AAChD,YAAM,OAAO,iBAAiB,IAAI,CAAC,SAAS;AAC1C,cAAM,MAAM;AACZ,eAAO,KAAK,IAAI,CAAC,MAAM,eAAe,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG;AAAA,MACxE,CAAC;AACD,cAAQ,OAAO,MAAM,SAAS,OAAO,KAAK,KAAK,IAAI,IAAI,IAAI;AAAA,IAC7D,OAAO;AACL,cAAQ,OAAO,MAAM,KAAK,UAAU,gBAAgB,IAAI,IAAI;AAAA,IAC9D;AAAA,EACF,WAAW,cAAc,QAAQ;AAG/B,YAAQ,OAAO,MAAM,KAAK,KAAK,kBAAkB,EAAE,WAAW,GAAG,CAAC,CAAC;AAAA,EACrE,WAAW,cAAc,SAAS;AAChC,QAAI,MAAM,QAAQ,gBAAgB,GAAG;AACnC,iBAAW,QAAQ,kBAAkB;AACnC,gBAAQ,OAAO,MAAM,KAAK,UAAU,IAAI,IAAI,IAAI;AAAA,MAClD;AAAA,IACF,OAAO;AACL,cAAQ,OAAO,MAAM,KAAK,UAAU,gBAAgB,IAAI,IAAI;AAAA,IAC9D;AAAA,EACF,WACE,cAAc,WACd,OAAO,qBAAqB,YAC5B,CAAC,MAAM,QAAQ,gBAAgB,GAC/B;AAEA,UAAM,UAAU,OAAO,QAAQ,gBAA2C;AAC1E,UAAM,UAAU,CAAC,OAAO,OAAO;AAC/B,UAAM,OAAO,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;AAC3D,YAAQ,OAAO,MAAM,YAAY,SAAS,IAAI,CAAC;AAAA,EACjD,WAAW,OAAO,qBAAqB,UAAU;AAC/C,YAAQ,OAAO,MAAM,KAAK,UAAU,kBAAkB,MAAM,CAAC,IAAI,IAAI;AAAA,EACvE,WAAW,OAAO,qBAAqB,UAAU;AAC/C,YAAQ,OAAO,MAAM,mBAAmB,IAAI;AAAA,EAC9C,OAAO;AACL,YAAQ,OAAO,MAAM,OAAO,gBAAgB,IAAI,IAAI;AAAA,EACtD;AACF;AAKA,SAAS,eAAe,OAAuB;AAC7C,MAAI,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,IAAI,KAAK,MAAM,SAAS,IAAI,GAAG;AAC9F,WAAO,MAAM,MAAM,QAAQ,MAAM,IAAI,IAAI;AAAA,EAC3C;AACA,SAAO;AACT;AASO,SAAS,sBAAsB,QAAyB,QAAuB;AACpF,QAAM,WAAW,cAAc,MAAM;AACrC,MAAI,aAAa,UAAU,CAAC,QAAQ,OAAO,OAAO;AAChD,UAAM,UAAmC;AAAA,MACvC,OAAO,OAAO;AAAA;AAAA;AAAA,MAGd,mBAAmB,OAAO;AAAA,MAC1B,QAAQ,OAAO,OAAO,IAAI,CAAC,MAAM;AAC/B,cAAM,QAAiC,EAAE,OAAO,EAAE,OAAO,QAAQ,EAAE,OAAO;AAC1E,YAAI,EAAE,UAAU,UAAa,EAAE,UAAU,MAAM;AAC7C,gBAAM,QAAQ,EAAE;AAAA,QAClB;AACA,YAAI,EAAE,YAAY,EAAE,SAAS,SAAS,GAAG;AACvC,gBAAM,WAAW,EAAE;AAAA,QACrB;AACA,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,YAAQ,OAAO,MAAM,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,IAAI;AAAA,EAC9D,OAAO;AAEL,eAAW,KAAK,OAAO,QAAQ;AAC7B,YAAM,eAAe,EAAE,UAAU,UAAU,KAAK;AAChD,UAAI;AACJ,UAAI,EAAE,UAAU,aAAa;AAC3B,cAAM;AAAA,MACR,WAAW,EAAE,QAAQ;AACnB,cAAM;AAAA,MACR,WAAW,EAAE,WAAW,OAAO;AAC7B,cAAM;AAAA,MACR,OAAO;AACL,cAAM;AAAA,MACR;AACA,UAAI,SAAS,KAAK,GAAG,IAAI,EAAE,MAAM,OAAO,EAAE,CAAC;AAC3C,UAAI,EAAE,OAAO;AACX,cAAM,SAAS,OAAO,EAAE,UAAU,WAAW,KAAK,UAAU,EAAE,KAAK,IAAI,OAAO,EAAE,KAAK;AACrF,kBAAU,IAAI,MAAM;AAAA,MACtB,WAAW,EAAE,UAAU,CAAC,aAAa;AACnC,kBAAU;AAAA,MACZ,WAAW,CAAC,EAAE,QAAQ;AACpB,kBAAU;AAAA,MACZ;AACA,cAAQ,OAAO,MAAM,SAAS,IAAI;AAClC,iBAAW,KAAK,EAAE,YAAY,CAAC,GAAG;AAChC,gBAAQ,OAAO,MAAM,gBAAgB,CAAC;AAAA,CAAI;AAAA,MAC5C;AAAA,IACF;AACA,UAAM,SAAS,OAAO,OAAO,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE;AACtD,UAAM,WAAW,OAAO,OAAO,OAAO,CAAC,KAAK,MAAM,OAAO,EAAE,UAAU,UAAU,IAAI,CAAC;AACpF,UAAM,MAAM,OAAO,QAAQ,SAAS;AACpC,YAAQ,OAAO,MAAM;AAAA,UAAa,GAAG,KAAK,MAAM,cAAc,QAAQ;AAAA,CAAgB;AAAA,EACxF;AACF;AAKO,SAAS,oBAAoB,QAAiC;AAGnE,QAAM,cAAsC;AAAA,IAC1C,WAAW,WAAW;AAAA,IACtB,eAAe,WAAW;AAAA,IAC1B,YAAY,WAAW;AAAA,IACvB,KAAK,WAAW;AAAA,IAChB,QAAQ,WAAW;AAAA,IACnB,UAAU,WAAW;AAAA,IACrB,kBAAkB,WAAW;AAAA,EAC/B;AACA,aAAW,SAAS,OAAO,QAAQ;AACjC,QAAI,CAAC,MAAM,QAAQ;AACjB,aAAO,YAAY,MAAM,KAAK,KAAK,WAAW;AAAA,IAChD;AAAA,EACF;AACA,SAAO,WAAW;AACpB;AAvaA;AAAA;AAAA;AAAA;AAOA;AAAA;AAAA;;;ACEO,SAAS,YAAY,OAAqB;AAC/C,QAAM,QAAQ,MAAM,YAAY;AAChC,MAAI,SAAS,QAAQ;AACnB,mBAAe;AAAA,EACjB;AACF;AAMA,SAAS,UAAU,OAA0B;AAC3C,SAAO,OAAO,KAAK,KAAK,OAAO,YAAY;AAC7C;AAUO,SAAS,KAAK,SAAuB;AAC1C,MAAI,UAAU,SAAS,EAAG,SAAQ,OAAO,MAAM,YAAY,OAAO;AAAA,CAAI;AACxE;AAlCA,IAIM,QAGF;AAPJ;AAAA;AAAA;AAAA;AAIA,IAAM,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,EAAE;AAGzD,IAAI,eAAyB;AAAA;AAAA;;;ACF7B,YAAY,QAAQ;AACpB,YAAYC,WAAU;AAQtB,SAAS,QAAW,IAAY,YAAoB,IAAa,SAAuB;AACtF,MAAI;AACF,WAAO,GAAG;AAAA,EACZ,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,OAAO,MAAM,oBAAoB,EAAE,IAAI,UAAU,KAAK,GAAG;AAAA,CAAI;AACrE,QAAI,WAAW,QAAQ,SAAS,GAAG;AACjC,cAAQ,OAAO;AAAA,QACb,kEAA6D,QAAQ,KAAK,IAAI,CAAC;AAAA;AAAA,MACjF;AAAA,IACF;AACA,YAAQ,KAAK,WAAW,oBAAoB;AAAA,EAC9C;AACF;AAyCA,SAAS,eAAe,UAAkB,SAAyC;AACjF,MAAI,SAAS;AACb,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAElD,aAAS,OAAO,MAAM,IAAI,GAAG,GAAG,EAAE,KAAK,KAAK;AAAA,EAC9C;AACA,SAAO;AACT;AAKO,SAAS,oBAAoB,KAAoB;AACtD,QAAM,YAAY,IAAI,QAAQ,MAAM,EAAE,YAAY,8BAA8B;AAEhF,YACG,QAAQ,oBAAoB,EAC5B,YAAY,6GAA6G,EACzH;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,gBAAgB,sDAAsD,EAC7E,OAAO,4BAA4B,uBAAuB,uBAAuB,EACjF,OAAO,CAAC,UAAkB,SAA+D;AAExF,UAAM,UAAU,SAAS,YAAY,GAAG;AACxC,UAAM,SAAS,WAAW,IAAI,SAAS,UAAU,GAAG,OAAO,IAAI;AAC/D,UAAM,WAAW,WAAW,IAAI,SAAS,UAAU,UAAU,CAAC,IAAI;AAElE,UAAM,QAAQ,KAAK;AACnB,UAAM,cAAc,KAAK;AAGzB,UAAM,MAAM,KAAK,QAAQ,UAAU,cAAc,eAAe,UAAU,YAAY,aAAa;AACnG,QAAI,IAAI,MAAW,SAAG,EAAE,SAAS,IAAI,KAAK,IAAI,MAAM,GAAG,EAAE,SAAS,IAAI,GAAG;AACvE,cAAQ,OAAO,MAAM;AAAA,CAAkE;AACvF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,8BAAsB,UAAU,QAAQ,UAAU,aAAa,GAAG;AAClE;AAAA,MACF,KAAK;AACH,+BAAuB,UAAU,QAAQ,UAAU,aAAa,GAAG;AACnE;AAAA,MACF,KAAK;AACH,4BAAoB,UAAU,QAAQ,UAAU,aAAa,GAAG;AAChE;AAAA,MACF;AACE,gBAAQ,OAAO,MAAM,yBAAyB,KAAK;AAAA,CAAK;AACxD,gBAAQ,KAAK,CAAC;AAAA,IAClB;AAAA,EACF,CAAC;AACL;AAEA,SAAS,sBACP,UACA,SACA,UACA,aACA,WACM;AACN,UAAQ,oBAAoB,WAAW,MAAS,aAAU,WAAW,EAAE,WAAW,KAAK,CAAC,CAAC;AACzF,QAAM,WAAW,SAAS,QAAQ,OAAO,GAAG,IAAI;AAChD,QAAM,WAAgB,WAAK,WAAW,QAAQ;AAE9C,QAAM,UAAU,WAAW;AAC3B,QAAM,UAAU,eAAe,oBAAoB;AAAA,IACjD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,UAAQ,cAAc,UAAU,MAAS,iBAAc,UAAU,OAAO,CAAC;AACzE,UAAQ,OAAO,MAAM,WAAW,QAAQ;AAAA,CAAI;AAC9C;AAEA,SAAS,uBACP,UACA,QACA,UACA,aACA,WACM;AAEN,QAAM,cAAc,OAAO,MAAM,GAAG;AACpC,QAAM,UAAU,YAAY,SAAS,IAC5B,WAAK,WAAW,GAAG,YAAY,MAAM,GAAG,EAAE,CAAC,IAChD;AACJ,UAAQ,oBAAoB,SAAS,MAAS,aAAU,SAAS,EAAE,WAAW,KAAK,CAAC,CAAC;AAErF,MAAI;AACJ,MAAI,YAAY,SAAS,GAAG;AAC1B,eAAW,YAAY,YAAY,SAAS,CAAC,IAAI;AAAA,EACnD,OAAO;AACL,eAAW,SAAS;AAAA,EACtB;AAEA,MAAI,WAAW,UAAU;AACvB,eAAW,SAAS;AAAA,EACtB;AACA,QAAM,WAAgB,WAAK,SAAS,QAAQ;AAE5C,QAAM,eAAe,SAAS,SAAS,GAAG,IACtC,6BAA6B,YAAY,CAAC,CAAC;AAAA,IAC3C;AAEJ,QAAM,UAAU,eAAe,qBAAqB;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,UAAQ,cAAc,UAAU,MAAS,iBAAc,UAAU,OAAO,CAAC;AACzE,UAAQ,OAAO,MAAM,WAAW,QAAQ;AAAA,CAAI;AAC9C;AAEA,SAAS,oBACP,UACA,QACA,UACA,aACA,WACM;AACN,QAAM,UAAoB,CAAC;AAC3B,UAAQ,oBAAoB,WAAW,MAAS,aAAU,WAAW,EAAE,WAAW,KAAK,CAAC,CAAC;AAEzF,QAAM,WAAgB,WAAK,WAAW,SAAS,QAAQ,OAAO,GAAG,IAAI,eAAe;AACpF,QAAM,SAAS,YAAY,MAAM,IAAI,QAAQ;AAE7C,QAAM,cAAc,eAAe,kBAAkB;AAAA,IACnD;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,UAAQ,cAAc,UAAU,MAAS,iBAAc,UAAU,WAAW,CAAC;AAC7E,UAAQ,KAAK,QAAQ;AACrB,UAAQ,OAAO,MAAM,WAAW,QAAQ;AAAA,CAAI;AAG5C,QAAM,UAAU;AAChB,UAAQ,oBAAoB,SAAS,MAAS,aAAU,SAAS,EAAE,WAAW,KAAK,CAAC,GAAG,OAAO;AAC9F,QAAM,UAAe,WAAK,SAAS,OAAO,QAAQ,OAAO,GAAG,IAAI,KAAK;AACrE,MAAI,CAAI,cAAW,OAAO,GAAG;AAC3B,UAAM,aACJ,mBAAmB,QAAQ;AAAA,QAClB,WAAW;AAAA;AAAA;AAAA;AAAA;AAItB,YAAQ,cAAc,SAAS,MAAS,iBAAc,SAAS,UAAU,GAAG,OAAO;AACnF,YAAQ,OAAO,MAAM,WAAW,OAAO;AAAA,CAAI;AAAA,EAC7C;AACF;AA/NA,IA6BM,oBAgBA,qBAWA;AAxDN;AAAA;AAAA;AAAA;AAOA;AAsBA,IAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgB3B,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAW5B,IAAM,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACrClB,SAAS,WAAW,YAAuD;AAChF,QAAM,WAAW,WAAW,YAAY,CAAC;AACzC,QAAM,UAAW,SAAqC;AACtD,MAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,GAAG;AACrE,WAAO;AAAA,EACT;AACA,QAAM,UAAU,qBAAqB,WAAW,EAAE;AAClD,SAAO,WAAW,CAAC;AACrB;AA3BA;AAAA;AAAA;AAAA;AAKA;AAAA;AAAA;;;ACCA,YAAYC,SAAQ;AACpB,SAAS,qBAAqB;AAC9B,OAAOC,WAAU;AA4EV,SAAS,0BAAgC;AAC9C,MAAI;AAKF,UAAM,cAAc,cAAc,YAAY,GAAG;AACjD,UAAM,EAAE,OAAO,IAAI,YAAY,WAAW;AAC1C,QAAI,OAAO,QAAQ,sBAAsB,YAAY;AACnD,aAAO,kBAAkB;AAAA,QACvB,MAAM;AAAA,QACN,WAAW;AAAA,QACX,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAtGA,IA4Ba,UAwBA,oBAkBP,qBAMA,qBAuCO;AAnHb;AAAA;AAAA;AAAA;AASA;AAmBO,IAAM,WAAoC;AAAA,MAC/C,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,MACjB,4BAA4B;AAAA;AAAA,MAE5B,wBAAwB;AAAA,MACxB,gBAAgB;AAAA,MAChB,mBAAmB;AAAA;AAAA,MAEnB,eAAe;AAAA,MACf,kBAAkB,CAAC;AAAA,MACnB,kBAAkB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,IAKrB;AAQO,IAAM,qBAA8C;AAAA,MACzD,oBAAoB;AAAA,MACpB,cAAc;AAAA,MACd,sBAAsB;AAAA,MACtB,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,UAAU;AAAA,MACV,aAAa;AAAA;AAAA,MAEb,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,QACV,SAAS,CAAC;AAAA,QACV,aAAa;AAAA,MACf;AAAA,IACF;AAGA,IAAM,sBAA8C;AAAA,MAClD,iCAAiC;AAAA,MACjC,2BAA2B;AAAA,MAC3B,mCAAmC;AAAA,MACnC,4BAA4B;AAAA,IAC9B;AACA,IAAM,sBAA8C,OAAO;AAAA,MACzD,OAAO,QAAQ,mBAAmB,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAAA,IAC5D;AAqCO,IAAM,iBAAN,MAAqB;AAAA,MACT;AAAA,MACA;AAAA,MACT,YAA4C;AAAA,MAC5C,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOlB,aAA6C;AAAA,MAErD,YAAY,UAAoC,YAAqB;AACnE,aAAK,WAAW,YAAY,CAAC;AAC7B,aAAK,aAAa,cAAc;AAAA,MAClC;AAAA;AAAA;AAAA;AAAA,MAKA,QAAQ,KAAa,SAAkB,QAA0B;AAW/D,YAAI,YAAY,UAAa,WAAW,KAAK,UAAU;AACrD,gBAAM,QAAQ,KAAK,SAAS,OAAO;AACnC,cAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,mBAAO;AAAA,UACT;AAAA,QACF;AAGA,YAAI,QAAQ;AACV,gBAAM,WAAW,QAAQ,IAAI,MAAM;AACnC,cAAI,aAAa,UAAa,aAAa,IAAI;AAC7C,mBAAO;AAAA,UACT;AAAA,QACF;AAGA,cAAM,YAAY,KAAK,gBAAgB,GAAG;AAC1C,YAAI,cAAc,QAAW;AAC3B,iBAAO;AAAA,QACT;AACA,cAAM,SAAS,oBAAoB,GAAG,KAAK,oBAAoB,GAAG;AAClE,YAAI,QAAQ;AACV,gBAAM,eAAe,KAAK,gBAAgB,MAAM;AAChD,cAAI,iBAAiB,QAAW;AAC9B,mBAAO;AAAA,UACT;AAAA,QACF;AAGA,eAAO,SAAS,GAAG;AAAA,MACrB;AAAA;AAAA;AAAA;AAAA,MAKQ,gBAAgB,KAAsB;AAC5C,YAAI,CAAC,KAAK,iBAAiB;AACzB,eAAK,YAAY,KAAK,eAAe;AACrC,eAAK,kBAAkB;AAAA,QACzB;AACA,YAAI,KAAK,cAAc,MAAM;AAC3B,iBAAO;AAAA,QACT;AACA,eAAO,KAAK,UAAU,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAqBA,cAAc,KAAsB;AAElC,YAAI,CAAC,KAAK,iBAAiB;AACzB,eAAK,YAAY,KAAK,eAAe;AACrC,eAAK,kBAAkB;AAAA,QACzB;AACA,YAAI,KAAK,cAAc,MAAM;AAC3B,iBAAO;AAAA,QACT;AACA,cAAM,QAAQ,IAAI,MAAM,GAAG;AAC3B,YAAI,MAAe,KAAK;AACxB,mBAAW,KAAK,OAAO;AACrB,cACE,OAAO,QACP,OAAO,QAAQ,YACf,CAAC,MAAM,QAAQ,GAAG,KAClB,KAAM,KACN;AACA,kBAAO,IAAgC,CAAC;AAAA,UAC1C,OAAO;AACL,mBAAO;AAAA,UACT;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA,MAKQ,iBAAiD;AACvD,YAAI;AACJ,YAAI;AACF,oBAAa,iBAAa,KAAK,YAAY,OAAO;AAAA,QACpD,SAAS,KAAc;AACrB,cAAI,eAAe,SAAS,UAAU,OAAO,IAAI,SAAS,UAAU;AAClE,mBAAO;AAAA,UACT;AACA;AAAA,YACE,uBAAuB,KAAK,UAAU;AAAA,UACxC;AACA,iBAAO;AAAA,QACT;AAEA,YAAI;AACJ,YAAI;AACF,mBAASA,MAAK,KAAK,OAAO;AAAA,QAC5B,QAAQ;AACN;AAAA,YACE,uBAAuB,KAAK,UAAU;AAAA,UACxC;AACA,iBAAO;AAAA,QACT;AAEA,YAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E;AAAA,YACE,uBAAuB,KAAK,UAAU;AAAA,UACxC;AACA,iBAAO;AAAA,QACT;AAGA,aAAK,aAAa;AAClB,eAAO,KAAK,YAAY,MAAiC;AAAA,MAC3D;AAAA;AAAA;AAAA;AAAA,MAKQ,YACN,GACA,SAAS,IACgB;AACzB,cAAM,SAAkC,CAAC;AACzC,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,CAAC,GAAG;AAC5C,gBAAM,UAAU,SAAS,GAAG,MAAM,IAAI,GAAG,KAAK;AAC9C,cACE,OAAO,UAAU,YACjB,UAAU,QACV,CAAC,MAAM,QAAQ,KAAK,GACpB;AACA,mBAAO;AAAA,cACL;AAAA,cACA,KAAK,YAAY,OAAkC,OAAO;AAAA,YAC5D;AAAA,UACF,OAAO;AACL,mBAAO,OAAO,IAAI;AAAA,UACpB;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;;;ACxSA,SAAS,iBAAiB;AAC1B,SAAS,SAAS,MAAM,cAAc;AAUtC,SAAS,iBAAiB,UAA0B;AAClD,SAAO,MAAM,SAAS,QAAQ,iBAAiB,GAAG;AACpD;AAKA,SAAS,WAAW,GAAmB;AACrC,SAAO,MAAM,EAAE,QAAQ,MAAM,OAAO,IAAI;AAC1C;AAaA,SAAS,0BAA0B,YAA2C;AAC5E,MAAI,CAAC,WAAY,QAAO,CAAC;AACzB,SAAO,WAAW,SACf,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAC7B,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AACxB;AAGA,SAAS,sBAAsB,SAA4B;AACzD,SAAO,QAAQ,SACZ,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAC7B,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AACxB;AAGA,SAAS,eAAe,SAAuC;AAC7D,SAAO,QAAQ,SAAS,KAAK,CAAC,MAAM,EAAE,KAAK,MAAM,OAAO;AAC1D;AAGA,SAAS,YAAY,KAAuB;AAC1C,QAAM,eAAe;AACrB,QAAM,kBAAkB;AACxB,MAAI,OAAO,aAAa,WAAW,WAAY,QAAO,CAAC,CAAC,aAAa,OAAO;AAC5E,SAAO,CAAC,CAAC,gBAAgB;AAC3B;AAEO,SAAS,uBACd,UACA,SACQ;AACR,QAAM,KAAK,iBAAiB,QAAQ;AACpC,QAAM,SAAS,WAAW,QAAQ;AAElC,QAAM,aAAa,UAAU,eAAe,OAAO,IAAI;AACvD,QAAM,eAAe,eAAe,UAAa,CAAC,YAAY,UAAU;AACxE,QAAM,WAAW,UACb,sBAAsB,OAAO,EAAE;AAAA,IAC7B,CAAC,MAAM,MAAM,WAAW;AAAA,EAC1B,IACA,CAAC;AACL,QAAM,YAAY,eAAe,0BAA0B,UAAU,IAAI,CAAC;AAE1E,QAAM,WAAW,SAAS,KAAK,GAAG;AAClC,QAAM,YAAY,UAAU,KAAK,GAAG;AAEpC,MAAI,OACF,GAAG,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAOY,QAAQ;AAAA;AAAA;AAAA;AAAA;AAI3B,MAAI,cAAc;AAChB,YACE;AAAA;AAAA;AAAA,gCAGiC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9C;AACA,UAAQ;AAAA,cAAuB,EAAE,IAAI,MAAM;AAAA;AAC3C,SAAO;AACT;AAEO,SAAS,sBACd,UACA,SACQ;AACR,QAAM,KAAK,iBAAiB,QAAQ;AACpC,QAAM,SAAS,WAAW,QAAQ;AAElC,QAAM,aAAa,UAAU,eAAe,OAAO,IAAI;AACvD,QAAM,eAAe,eAAe,UAAa,CAAC,YAAY,UAAU;AACxE,QAAM,WAAW,UACb,sBAAsB,OAAO,EAAE;AAAA,IAC7B,CAAC,MAAM,MAAM,WAAW;AAAA,EAC1B,IACA,CAAC;AACL,QAAM,YAAY,eAAe,0BAA0B,UAAU,IAAI,CAAC;AAE1E,QAAM,cAAc,SAAS,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI;AACxE,QAAM,eAAe,UAAU,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI;AAE1E,SACE,YAAY,QAAQ;AAAA;AAAA,EAEjB,EAAE;AAAA;AAAA;AAAA,KAGJ,cAAc,cAAc,OAAO,MACpC;AAAA;AAAA;AAAA,KAGC,eAAe,eAAe,OAAO,MACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qCAQsC,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,+CAKE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAO7C,EAAE,IAAI,MAAM;AAAA;AAE3B;AAEO,SAAS,uBACd,UACA,SACQ;AACR,QAAM,SAAS,WAAW,QAAQ;AAElC,QAAM,aAAa,UAAU,eAAe,OAAO,IAAI;AACvD,QAAM,eAAe,eAAe,UAAa,CAAC,YAAY,UAAU;AACxE,QAAM,WAAW,UACb,sBAAsB,OAAO,EAAE;AAAA,IAC7B,CAAC,MAAM,MAAM,WAAW;AAAA,EAC1B,IACA,CAAC;AACL,QAAM,YAAY,eAAe,0BAA0B,UAAU,IAAI,CAAC;AAE1E,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,0BAA0B,QAAQ,EAAE;AAC/C,aAAW,QAAQ,UAAU;AAC3B,UAAM;AAAA,MACJ,eAAe,MAAM,kCAAkC,IAAI,QAAQ,IAAI;AAAA,IACzE;AAAA,EACF;AACA,MAAI,gBAAgB,UAAU,SAAS,GAAG;AACxC,UAAM,KAAK,EAAE;AACb,eAAW,QAAQ,WAAW;AAC5B,YAAM;AAAA,QACJ,eAAe,MAAM,8CAA8C,IAAI,QAAQ,IAAI;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI,IAAI;AAC5B;AAOA,SAAS,WAAW,GAAmB;AACrC,SAAO,EAAE,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK,EAAE,QAAQ,MAAM,OAAO;AAC5E;AAMO,SAAS,oBACd,SACA,UACA,SACA,aACAC,UACQ;AACR,QAAM,OAAO,IAAI,KAAK;AACtB,QAAM,SAAQ,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAClD,QAAM,IAAc,CAAC;AAErB,QAAM,eAAe,eAAe,QAAQ,YAAY,KAAK,GAAG,QAAQ;AAExE,IAAE,KAAK,QAAQ,SAAS,YAAY,CAAC,UAAU,KAAK,MAAM,QAAQ,IAAI,OAAO,MAAM,QAAQ,UAAU;AAErG,IAAE,KAAK,UAAU;AACjB,IAAE,KAAK,GAAG,QAAQ,QAAQ,WAAW,YAAY,CAAC,EAAE;AAEpD,IAAE,KAAK,cAAc;AACrB,IAAE,KAAK,OAAO,QAAQ,6EAA6E;AAEnG,MAAI,cAAc;AAChB,MAAE,KAAK,iBAAiB;AACxB,MAAE,KAAK,WAAW,YAAY,CAAC;AAAA,EACjC;AAGA,QAAM,aAAa,KAAK,eAAe,OAAO,EAC3C,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,WAAW,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,EAAE,KAAK,EAAE,CAAC;AAC7F,MAAI,WAAW,SAAS,GAAG;AACzB,MAAE,KAAK,oBAAoB;AAC3B,eAAW,OAAO,YAAY;AAC5B,YAAM,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAC5D,QAAE,KAAK,KAAK;AACZ,QAAE,KAAK,OAAO,WAAW,IAAI,CAAC,MAAM;AACpC,UAAI,IAAI,YAAa,GAAE,KAAK,WAAW,IAAI,WAAW,CAAC;AAAA,IACzD;AAAA,EACF;AAGA,QAAM,cAAc,KAAK,gBAAgB,OAAO;AAChD,MAAI,YAAY,SAAS,GAAG;AAC1B,MAAE,KAAK,cAAc;AACrB,eAAW,OAAO,aAAa;AAC7B,UAAI,IAAI,KAAK,MAAM,OAAQ;AAE3B,YAAM,OAAO,KAAK,sBAAsB,GAAG;AAC3C,QAAE,KAAK,KAAK;AACZ,QAAE,KAAK,OAAO,QAAQ,IAAI,WAAW,IAAI,KAAK,CAAC,CAAC,MAAM;AACtD,UAAI,KAAM,GAAE,KAAK,WAAW,IAAI,CAAC;AAGjC,YAAM,UAAU,IAAI,KAAK;AACzB,YAAM,OAAO,QAAQ,eAAe,GAAG,EACpC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,SAAS,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,EAAE,KAAK,EAAE,CAAC;AAC/E,iBAAW,OAAO,MAAM;AACtB,cAAM,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAC5D,UAAE,KAAK,KAAK;AACZ,UAAE,KAAK,KAAK;AACZ,UAAE,KAAK,OAAO,WAAW,IAAI,CAAC,MAAM;AACpC,YAAI,IAAI,YAAa,GAAE,KAAK,WAAW,IAAI,WAAW,CAAC;AACvD,UAAE,KAAK,KAAK;AAAA,MACd;AAGA,YAAM,UAAU,QAAQ,gBAAgB,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,MAAM,MAAM;AAC9E,iBAAW,OAAO,SAAS;AACzB,cAAM,UAAU,KAAK,sBAAsB,GAAG;AAC9C,UAAE,KAAK,KAAK;AACZ,UAAE,KAAK,OAAO,QAAQ,IAAI,WAAW,IAAI,KAAK,CAAC,CAAC,IAAI,WAAW,IAAI,KAAK,CAAC,CAAC,MAAM;AAChF,YAAI,QAAS,GAAE,KAAK,WAAW,OAAO,CAAC;AACvC,cAAM,UAAU,QAAQ,eAAe,GAAG,EACvC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,SAAS,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,EAAE,KAAK,EAAE,CAAC;AAC/E,mBAAW,OAAO,SAAS;AACzB,gBAAM,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAC5D,YAAE,KAAK,KAAK;AACZ,YAAE,KAAK,KAAK;AACZ,YAAE,KAAK,OAAO,WAAW,IAAI,CAAC,MAAM;AACpC,cAAI,IAAI,YAAa,GAAE,KAAK,WAAW,IAAI,WAAW,CAAC;AACvD,YAAE,KAAK,KAAK;AAAA,QACd;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,IAAE,KAAK,iBAAiB;AACxB,IAAE,KAAK,KAAK;AACZ,IAAE,KAAK,gCAAgC;AACvC,IAAE,KAAK,0CAA0C;AACjD,IAAE,KAAK,KAAK;AACZ,IAAE,KAAK,iCAAiC;AACxC,IAAE,KAAK,8CAA8C;AACrD,IAAE,KAAK,KAAK;AACZ,IAAE,KAAK,kCAAkC;AACzC,IAAE,KAAK,8DAA8D;AAGrE,IAAE,KAAK,gBAAgB;AACvB,QAAM,YAAgC;AAAA,IACpC,CAAC,KAAK,UAAU;AAAA,IAChB,CAAC,KAAK,yBAAyB;AAAA,IAC/B,CAAC,KAAK,wCAAwC;AAAA,IAC9C,CAAC,MAAM,gDAAgD;AAAA,IACvD,CAAC,MAAM,sCAAsC;AAAA,IAC7C,CAAC,MAAM,+BAA+B;AAAA,IACtC,CAAC,MAAM,sBAAsB;AAAA,IAC7B,CAAC,MAAM,aAAa;AAAA,IACpB,CAAC,OAAO,6BAA6B;AAAA,EACvC;AACA,aAAW,CAAC,MAAM,OAAO,KAAK,WAAW;AACvC,MAAE,KAAK;AAAA,MAAY,IAAI;AAAA,EAAS,OAAO,EAAE;AAAA,EAC3C;AAEA,IAAE,KAAK,cAAc;AACrB,IAAE,KAAK,OAAO,QAAQ,qDAAqD;AAC3E,MAAIA,UAAS;AACX,MAAE,KAAK;AAAA,4BAAkC,WAAWA,QAAO,CAAC,MAAM;AAAA,EACpE;AAEA,SAAO,EAAE,KAAK,IAAI;AACpB;AAUO,SAAS,iBACd,SACA,UACA,SACA,aACAA,UACM;AAEN,QAAM,SAAS,IAAI,OAAO,SAAS,kDAAkD,EAAE,SAAS;AAChG,UAAQ,UAAU,MAAM;AAGxB,UAAQ,YAAY,aAAa,MAAM;AACrC,QAAI,QAAQ,KAAK,EAAE,KAAK;AACtB,YAAM,OAAO,oBAAoB,SAAS,UAAU,SAAS,aAAaA,QAAO,IAAI;AAIrF,UAAI,QAAQ,OAAO,OAAO;AAExB,cAAM,SAAiD;AAAA,UACrD,EAAE,KAAK,UAAU,MAAM,CAAC,IAAI,EAAE;AAAA,UAC9B,EAAE,KAAK,SAAU,MAAM,CAAC,QAAQ,QAAQ,EAAE;AAAA,QAC5C;AACA,YAAI,WAAW;AACf,mBAAW,EAAE,KAAK,KAAK,KAAK,QAAQ;AAClC,gBAAM,SAAS,UAAU,KAAK,MAAM;AAAA,YAClC,OAAO;AAAA,YACP,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,YAC9B,UAAU;AAAA,UACZ,CAAC;AACD,cAAI,OAAO,WAAW,KAAK,OAAO,QAAQ;AACxC,kBAAM,QAAQ,QAAQ,IAAI,SAAS;AACnC,kBAAM,cAAc,UAAU,OAAO,CAAC,IAAI,GAAG;AAAA,cAC3C,OAAO,OAAO;AAAA,cACd,OAAO,CAAC,QAAQ,WAAW,SAAS;AAAA,YACtC,CAAC;AACD,gBAAI,YAAY,WAAW,MAAM;AAC/B,yBAAW;AACX;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,UAAU;AACb,kBAAQ,OAAO,MAAM,IAAI;AAAA,QAC3B;AAAA,MACF,OAAO;AACL,gBAAQ,OAAO,MAAM,IAAI;AAAA,MAC3B;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAUA,SAAS,gBAAgB,MAAwB;AAC/C,MAAI,MAAe;AACnB,SAAO,IAAI,OAAQ,OAAM,IAAI;AAC7B,SAAO;AACT;AAUO,SAAS,0BAA0B,MAAqB;AAC7D,QAAM,gBAAgB,IAAI,QAAQ,YAAY,EAC3C,YAAY,4DAA4D,EACxE,SAAS,WAAW,gCAAgC,EACpD,OAAO,CAAC,UAAkB;AACzB,UAAM,cAAc,CAAC,QAAQ,OAAO,MAAM;AAC1C,QAAI,CAAC,YAAY,SAAS,KAAK,GAAG;AAChC,cAAQ,OAAO;AAAA,QACb,yBAAyB,KAAK;AAAA;AAAA,MAChC;AACA,cAAQ,KAAK,WAAW,iBAAiB;AAAA,IAC3C;AAEA,UAAM,OAAO,gBAAgB,IAAI;AACjC,UAAM,WAAW,KAAK,KAAK,KAAK;AAChC,UAAM,aAA2C;AAAA,MAC/C,MAAM,MAAM,uBAAuB,UAAU,IAAI;AAAA,MACjD,KAAK,MAAM,sBAAsB,UAAU,IAAI;AAAA,MAC/C,MAAM,MAAM,uBAAuB,UAAU,IAAI;AAAA,IACnD;AACA,YAAQ,OAAO,MAAM,WAAW,KAAK,EAAE,CAAC;AAAA,EAC1C,CAAC;AACH,OAAK,WAAW,aAAa;AAC/B;AA3bA;AAAA;AAAA;AAAA;AAQA;AAAA;AAAA;;;ACRA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,YAAY,YAAY;AACxB,YAAYC,SAAQ;AACpB,YAAY,QAAQ;AACpB,YAAYC,WAAU;AAgCf,SAAS,eAAe,aAAuC;AACpE,iBAAe;AACjB;AAKO,SAAS,iBAAqC;AACnD,SAAO;AACT;AAYO,SAAS,oBAAoB,OAAyB;AAC3D,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,mBAAmB;AAC9D,QAAM,MAAM;AACZ,QAAM,SAAkC,CAAC;AACzC,aAAW,OAAO,OAAO,KAAK,GAAG,EAAE,KAAK,GAAG;AACzC,WAAO,GAAG,IAAI,oBAAoB,IAAI,GAAG,CAAC;AAAA,EAC5C;AACA,SAAO;AACT;AAvEA,IAoCI,cAqCS;AAzEb;AAAA;AAAA;AAAA;AAUA;AA0BA,IAAI,eAAmC;AAqChC,IAAM,cAAN,MAAM,aAAY;AAAA,MACvB,OAAgB,eAAoB;AAAA,QAC/B,WAAQ;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,MAEiB;AAAA,MACT,qBAAqB;AAAA,MAE7B,YAAYA,OAAe;AACzB,aAAK,UAAUA,SAAQ,aAAY;AACnC,aAAK,gBAAgB;AAAA,MACvB;AAAA,MAEQ,kBAAwB;AAC9B,cAAM,MAAW,cAAQ,KAAK,OAAO;AACrC,YAAI;AACF,UAAG,cAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAGrC,cAAI;AAAE,YAAG,cAAU,KAAK,GAAK;AAAA,UAAG,QAAQ;AAAA,UAAoB;AAAA,QAC9D,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,MAEA,aACE,UACA,WACA,QACA,UACA,YACM;AACN,cAAM,QAAoB;AAAA,UACxB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,UAClC,MAAM,KAAK,QAAQ;AAAA,UACnB,WAAW;AAAA,UACX,YAAY,KAAK,UAAU,SAAS;AAAA,UACpC;AAAA,UACA,WAAW;AAAA,UACX,aAAa;AAAA,QACf;AACA,YAAI;AACF,UAAG,mBAAe,KAAK,SAAS,KAAK,UAAU,KAAK,IAAI,IAAI;AAE5D,cAAI;AAAE,YAAG,cAAU,KAAK,SAAS,GAAK;AAAA,UAAG,QAAQ;AAAA,UAAoB;AAAA,QACvE,SAAS,KAAK;AACZ,cAAI,CAAC,KAAK,oBAAoB;AAC5B,iBAAK,qBAAqB;AAC1B,iBAAQ,8BAA8B,GAAG,EAAE;AAAA,UAC7C;AAAA,QACF;AAAA,MACF;AAAA,MAEQ,UAAU,WAA4C;AAC5D,cAAM,OAAc,mBAAY,EAAE;AAClC,cAAM,UAAU,KAAK,UAAU,oBAAoB,SAAS,CAAC;AAC7D,eACG,kBAAW,QAAQ,EACnB,OAAO,OAAO,OAAO,CAAC,MAAM,OAAO,KAAK,SAAS,OAAO,CAAC,CAAC,CAAC,EAC3D,OAAO,KAAK;AAAA,MACjB;AAAA,MAEQ,UAAkB;AACxB,YAAI;AACF,iBAAU,YAAS,EAAE;AAAA,QACvB,QAAQ;AACN,iBAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,YAAY;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AAAA;AAAA;;;AC1IA,YAAYC,aAAY;AACxB,YAAYC,SAAQ;AAepB,eAAe,YAA0B;AACvC,MAAI,aAAc,QAAO;AACzB,MAAI;AAEF,mBAAe,MAAM,OAAO,QAAQ;AACpC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA/BA,IAYM,mBAGA,gBAMF,cAmCS;AAxDb;AAAA;AAAA;AAAA;AAQA;AACA;AAGA,IAAM,oBAAoB;AAG1B,IAAM,iBAAiB,OAAO,KAAK,sBAAsB;AAMzD,IAAI,eAAoB;AAmCjB,IAAM,kBAAN,MAAM,iBAAgB;AAAA,MAC3B,OAAgB,eAAe;AAAA;AAAA;AAAA,MAG/B,OAAe,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAgBpC,MAAM,MAAM,KAAa,OAAgC;AACvD,cAAM,SAAS,MAAM,UAAU;AAC/B,YAAI,QAAQ;AACV,cAAI;AACF,kBAAM,OAAO,YAAY,iBAAgB,cAAc,KAAK,KAAK;AACjE,mBAAO,WAAW,GAAG;AAAA,UACvB,SAAS,KAAK;AAKZ,kBAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC9D,kBAAM,IAAI;AAAA,cACR,oBAAoB,GAAG,oBAAoB,MAAM;AAAA,YAEnD;AAAA,UACF;AAAA,QACF;AACA,aAAQ,sDAAsD;AAC9D,cAAM,aAAa,KAAK,WAAW,KAAK;AACxC,eAAO,UAAU,WAAW,SAAS,QAAQ,CAAC;AAAA,MAChD;AAAA;AAAA;AAAA;AAAA,MAKA,MAAM,SAAS,aAAqB,KAA8B;AAChE,YAAI,YAAY,WAAW,UAAU,GAAG;AACtC,gBAAM,SAAS,MAAM,UAAU;AAC/B,cAAI,CAAC,QAAQ;AACX,kBAAM,IAAI;AAAA,cACR,6CAA6C,GAAG;AAAA,YAClD;AAAA,UACF;AACA,cAAI;AACF,kBAAM,SAAS,YAAY,MAAM,WAAW,MAAM;AAClD,kBAAM,SAAS,MAAM,OAAO;AAAA,cAC1B,iBAAgB;AAAA,cAChB;AAAA,YACF;AACA,gBAAI,WAAW,QAAQ,WAAW,QAAW;AAC3C,oBAAM,IAAI;AAAA,gBACR,gCAAgC,MAAM;AAAA,cACxC;AAAA,YACF;AACA,mBAAO;AAAA,UACT,SAAS,KAAK;AACZ,gBAAI,eAAe,sBAAuB,OAAM;AAChD,kBAAM,IAAI;AAAA,cACR,oCAAoC,GAAG;AAAA,YACzC;AAAA,UACF;AAAA,QACF;AAEA,YAAI,YAAY,WAAW,SAAS,GAAG;AACrC,gBAAM,OAAO,OAAO,KAAK,YAAY,MAAM,UAAU,MAAM,GAAG,QAAQ;AACtE,cAAI;AACF,mBAAO,KAAK,WAAW,IAAI;AAAA,UAC7B,QAAQ;AACN,kBAAM,IAAI;AAAA,cACR,0CAA0C,GAAG,+CAA+C,GAAG;AAAA,YACjG;AAAA,UACF;AAAA,QACF;AAEA,YAAI,YAAY,WAAW,MAAM,GAAG;AAClC,gBAAM,OAAO,OAAO,KAAK,YAAY,MAAM,OAAO,MAAM,GAAG,QAAQ;AACnE,cAAI;AACF,mBAAO,KAAK,aAAa,IAAI;AAAA,UAC/B,QAAQ;AACN,kBAAM,IAAI;AAAA,cACR,0CAA0C,GAAG,+CAA+C,GAAG;AAAA,YACjG;AAAA,UACF;AAAA,QACF;AAGA,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYQ,UAAU,MAAsB;AACtC,cAAM,aAAa,QAAQ,IAAI;AAC/B,YAAI,cAAc,WAAW,SAAS,GAAG;AACvC,iBAAc,mBAAW,YAAY,MAAM,mBAAmB,IAAI,QAAQ;AAAA,QAC5E;AACA,YAAI,CAAC,iBAAgB,oBAAoB;AACvC;AAAA,YACE;AAAA,UAKF;AACA,2BAAgB,qBAAqB;AAAA,QACvC;AACA,cAAMC,YAAc,aAAS;AAC7B,cAAM,WAAW,QAAQ,IAAI,QAAQ,QAAQ,IAAI,YAAY;AAC7D,cAAM,WAAW,GAAGA,SAAQ,IAAI,QAAQ;AACxC,eAAc,mBAAW,UAAU,MAAM,mBAAmB,IAAI,QAAQ;AAAA,MAC1E;AAAA,MAEQ,WAAW,WAA2B;AAC5C,cAAM,OAAc,oBAAY,EAAE;AAClC,cAAM,MAAM,KAAK,UAAU,IAAI;AAC/B,cAAM,QAAe,oBAAY,EAAE;AACnC,cAAM,SAAgB,uBAAe,eAAe,KAAK,KAAK;AAC9D,cAAM,KAAK,OAAO,OAAO;AAAA,UACvB,OAAO,OAAO,WAAW,OAAO;AAAA,UAChC,OAAO,MAAM;AAAA,QACf,CAAC;AACD,cAAM,MAAM,OAAO,WAAW;AAE9B,eAAO,OAAO,OAAO,CAAC,MAAM,OAAO,KAAK,EAAE,CAAC;AAAA,MAC7C;AAAA,MAEQ,WAAW,MAAsB;AACvC,cAAM,OAAO,KAAK,SAAS,GAAG,EAAE;AAChC,cAAM,QAAQ,KAAK,SAAS,IAAI,EAAE;AAClC,cAAM,MAAM,KAAK,SAAS,IAAI,EAAE;AAChC,cAAM,KAAK,KAAK,SAAS,EAAE;AAC3B,cAAM,MAAM,KAAK,UAAU,IAAI;AAC/B,cAAM,WAAkB,yBAAiB,eAAe,KAAK,KAAK;AAClE,iBAAS,WAAW,GAAG;AACvB,eAAO,OAAO,OAAO,CAAC,SAAS,OAAO,EAAE,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE,SAAS,OAAO;AAAA,MAChF;AAAA;AAAA,MAGQ,aAAa,MAAsB;AACzC,cAAM,QAAQ,KAAK,SAAS,GAAG,EAAE;AACjC,cAAM,MAAM,KAAK,SAAS,IAAI,EAAE;AAChC,cAAM,KAAK,KAAK,SAAS,EAAE;AAC3B,cAAMA,YAAc,aAAS;AAC7B,cAAM,WAAW,QAAQ,IAAI,QAAQ,QAAQ,IAAI,YAAY;AAC7D,cAAM,aAAa,QAAQ,IAAI;AAC/B,cAAM,YAAsB,aACxB,CAAC,YAAY,GAAGA,SAAQ,IAAI,QAAQ,EAAE,IACtC,CAAC,GAAGA,SAAQ,IAAI,QAAQ,EAAE;AAE9B,mBAAW,YAAY,WAAW;AAChC,qBAAW,cAAc,CAAC,KAAS,GAAO,GAAG;AAC3C,gBAAI;AACF,oBAAM,MAAa,mBAAW,UAAU,gBAAgB,YAAY,IAAI,QAAQ;AAChF,oBAAM,WAAkB,yBAAiB,eAAe,KAAK,KAAK;AAClE,uBAAS,WAAW,GAAG;AACvB,qBAAO,OAAO,OAAO,CAAC,SAAS,OAAO,EAAE,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE,SAAS,OAAO;AAAA,YAChF,QAAQ;AAAA,YAER;AAAA,UACF;AAAA,QACF;AACA,cAAM,IAAI,MAAM,+DAA+D;AAAA,MACjF;AAAA,IACF;AAAA;AAAA;;;AC9OA,IAiBa;AAjBb;AAAA;AAAA;AAAA;AAOA;AACA;AASO,IAAM,eAAN,MAAmB;AAAA,MACP;AAAA,MACA;AAAA,MAEjB,YAAY,QAAwB,WAA6B;AAC/D,aAAK,SAAS;AACd,aAAK,YAAY,aAAa,IAAI,gBAAgB;AAAA,MACpD;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,MAAM,YAAoC;AACxC,cAAM,SAAS,KAAK,OAAO;AAAA,UACzB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,YAAI,WAAW,QAAQ,WAAW,QAAW;AAC3C,iBAAO;AAAA,QACT;AACA,cAAM,YAAY,OAAO,MAAM;AAC/B,YAAI,UAAU,WAAW,UAAU,KAAK,UAAU,WAAW,MAAM,GAAG;AACpE,cAAI;AACF,mBAAO,MAAM,KAAK,UAAU,SAAS,WAAW,cAAc;AAAA,UAChE,SAAS,KAAK;AACZ,gBAAI,eAAe,uBAAuB;AACxC,oBAAM,IAAI;AAAA,gBACR;AAAA,cAEF;AAAA,YACF;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAcA,MAAM,oBACJ,SACiC;AACjC,cAAM,MAAM,MAAM,KAAK,UAAU;AACjC,YAAI,CAAC,KAAK;AACR,gBAAM,IAAI;AAAA,YACR;AAAA,UAEF;AAAA,QACF;AAGA,YAAI,SAAS,KAAK,GAAG,GAAG;AACtB,gBAAM,IAAI;AAAA,YACR;AAAA,UAEF;AAAA,QACF;AACA,gBAAQ,gBAAgB,UAAU,IAAI,KAAK,CAAC;AAC5C,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA,MAKA,eAAe,YAA0B;AACvC,YAAI,eAAe,OAAO,eAAe,KAAK;AAC5C,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA;AAAA;;;ACpGA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA;AACA;AACA;AACA;AAAA;AAAA;;;ACAA,SAAS,WAAAC,UAAS,UAAAC,eAAc;AAiBhC,SAAS,YAAY,KAAmB;AACtC,MAAI,CAAC,YAAY,KAAK,GAAG,GAAG;AAC1B,YAAQ,OAAO;AAAA,MACb,+BAA+B,GAAG;AAAA;AAAA,IACpC;AACA,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AACF;AAKA,SAAS,WAAW,OAAe,UAA8B;AAC/D,SAAO,SAAS,OAAO,CAAC,KAAK,CAAC;AAChC;AAKA,SAAS,kBAAkB,OAAe,UAA8B;AACtE,SAAO,SAAS,OAAO,CAAC,KAAK,CAAC;AAChC;AAKA,SAAS,kBAAkB,WAA6B,MAAuB;AAC7E,QAAM,cAAc,UAAU;AAC9B,MAAI,CAAC,eAAe,OAAO,gBAAgB,SAAU,QAAO;AAC5D,QAAM,MAAM;AAKZ,QAAM,MAA8B;AAAA,IAClC,eAAe;AAAA,IACf,qBAAqB;AAAA,IACrB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,cAAc;AAAA,IACd,aAAa;AAAA,EACf;AACA,QAAM,OAAO,IAAI,IAAI,KAAK;AAC1B,SAAO,IAAI,IAAI,MAAM;AACvB;AAKO,SAAS,oBACd,YACA,UACA,gBACM;AACN,QAAM,UAAU,IAAID,SAAQ,MAAM,EAC/B,YAAY,yCAAyC,EACrD,OAAO,eAAe,kDAAkD,YAAY,CAAC,CAAC,EACtF,OAAO,UAAU,iCAAiC,KAAK,EACvD,OAAO,qBAAqB,kBAAkB,MAAS,EACvD,OAAO,wBAAwB,kDAAkD,EACjF;AAAA,IACC,IAAIC,QAAO,qBAAqB,0BAA0B,EACvD,QAAQ,CAAC,WAAW,YAAY,KAAK,CAAC,EACtC,QAAQ,SAAS;AAAA,EACtB,EACC,OAAO,2BAA2B,sDAAsD,mBAAmB,CAAC,CAAC,EAC7G;AAAA,IACC,IAAIA,QAAO,kBAAkB,aAAa,EACvC,QAAQ,CAAC,MAAM,SAAS,UAAU,SAAS,CAAC,EAC5C,QAAQ,IAAI;AAAA,EACjB,EACC,OAAO,aAAa,uBAAuB,KAAK,EAChD,OAAO,gBAAgB,+BAA+B,KAAK,EAC3D,OAAO,UAAU,iCAAiC,KAAK,EACvD;AAAA,IACC,IAAIA,QAAO,qBAAqB,4BAA4B,EACzD,QAAQ,CAAC,WAAW,UAAU,KAAK,CAAC,EACpC,QAAQ,SAAS;AAAA,EACtB,EACC,OAAO,CAAC,SAYH;AAEJ,eAAW,KAAK,KAAK,KAAK;AACxB,kBAAY,CAAC;AAAA,IACf;AAEA,QAAI,UAA8B,CAAC;AACnC,eAAW,KAAK,SAAS,YAAY,GAAG;AACtC,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,QAAI,KAAK,IAAI,SAAS,GAAG;AACvB,YAAM,aAAa,IAAI,IAAI,KAAK,GAAG;AACnC,gBAAU,QAAQ,OAAO,CAAC,MAAM;AAC9B,cAAM,QAAQ,EAAE,QAAQ,CAAC;AACzB,eAAO,CAAC,GAAG,UAAU,EAAE,MAAM,CAAC,MAAM,MAAM,SAAS,CAAC,CAAC;AAAA,MACvD,CAAC;AAAA,IACH;AAGA,QAAI,KAAK,QAAQ;AACf,YAAM,QAAQ,KAAK,OAAO,YAAY;AACtC,gBAAU,QAAQ;AAAA,QAChB,CAAC,OACE,EAAE,MAAM,IAAI,YAAY,EAAE,SAAS,KAAK,MACxC,EAAE,eAAe,IAAI,YAAY,EAAE,SAAS,KAAK;AAAA,MACtD;AAAA,IACF;AAGA,QAAI,KAAK,WAAW,WAAW;AAC7B,gBAAU,QAAQ,OAAO,CAAC,MAAM;AAC9B,cAAM,UAAW,EAAyC;AAC1D,eAAO,YAAY;AAAA,MACrB,CAAC;AAAA,IACH,WAAW,KAAK,WAAW,YAAY;AACrC,gBAAU,QAAQ,OAAO,CAAC,MAAM;AAC9B,cAAM,UAAW,EAAyC;AAC1D,eAAO,YAAY;AAAA,MACrB,CAAC;AAAA,IACH;AAIA,QAAI,CAAC,KAAK,YAAY;AACpB,gBAAU,QAAQ,OAAO,CAAC,MAAM;AAC9B,cAAM,aAAc,EAAyC;AAC7D,eAAO,eAAe;AAAA,MACxB,CAAC;AAAA,IACH;AAGA,QAAI,KAAK,WAAW,SAAS,GAAG;AAC9B,iBAAW,WAAW,KAAK,YAAY;AACrC,kBAAU,QAAQ,OAAO,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAAA,MAC/D;AAAA,IACF;AAGA,QAAI,KAAK,SAAS,WAAW,KAAK,SAAS,YAAY,KAAK,SAAS,WAAW;AAC9E,cAAQ,OAAO;AAAA,QACb,6DAA6D,KAAK,IAAI;AAAA;AAAA,MACxE;AAAA,IACF;AACA,YAAQ,KAAK,CAAC,GAAG,OAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,EAAE,CAAC;AAC7D,QAAI,KAAK,SAAS;AAChB,cAAQ,QAAQ;AAAA,IAClB;AAGA,QAAI,kBAAkB;AACtB,QAAI,kBAAkB,KAAK,aAAa,OAAO;AAC7C,UAAI,KAAK,aAAa,WAAW;AAC/B,kBAAU,QAAQ,OAAO,CAAC,MAAM,eAAe,UAAU,EAAE,MAAM,EAAE,CAAC;AAAA,MACtE,WAAW,KAAK,aAAa,UAAU;AACrC,kBAAU,QAAQ,OAAO,CAAC,MAAM,CAAC,eAAe,UAAU,EAAE,MAAM,EAAE,CAAC;AAAA,MACvE;AAAA,IACF;AACA,QAAI,KAAK,aAAa,SAAS,gBAAgB;AAC7C,wBAAkB;AAAA,IACpB;AAEA,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,UAAM,gBAAgB,KAAK,IAAI,SAAS,IAAI,KAAK,MAAM;AACvD,qBAAiB,SAAS,KAAK,eAAe,KAAK,MAAM,kBAAkB,iBAAiB,MAAS;AAAA,EACvG,CAAC;AACH,aAAW,WAAW,OAAO;AAC/B;AAKO,SAAS,wBACd,YACA,UACM;AACN,QAAM,cAAc,IAAID,SAAQ,UAAU,EACvC,YAAY,sDAAsD,EAClE,SAAS,eAAe,uBAAuB,EAC/C,OAAO,qBAAqB,kBAAkB,MAAS,EACvD,OAAO,CAAC,UAAkB,SAA8B;AACvD,qBAAiB,QAAQ;AAEzB,UAAM,YAAY,SAAS,UAAU,QAAQ;AAC7C,QAAI,CAAC,WAAW;AACd,cAAQ,OAAO;AAAA,QACb,kBAAkB,QAAQ;AAAA;AAAA,MAC5B;AACA,cAAQ,KAAK,WAAW,gBAAgB;AAAA,IAC1C;AAEA,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,uBAAmB,WAAW,GAAG;AAAA,EACnC,CAAC;AACH,aAAW,WAAW,WAAW;AACnC;AAWO,SAAS,oBACd,YACA,UACA,UACM;AACN,QAAM,UAAU,IAAIA,SAAQ,MAAM,EAC/B,YAAY,yCAAyC,EACrD,SAAS,eAAe,sBAAsB,EAC9C,OAAO,qBAAqB,gDAAgD,EAC5E,OAAO,qBAAqB,sDAAsD,EAClF;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,aAAa,0DAA0D,KAAK,EACnF;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,aAAa,6DAA6D,KAAK,EACtF,OAAO,qBAAqB,4DAA4D,EACxF,OAAO,WAAW,iCAAiC,KAAK,EACxD,OAAO,aAAa,iDAAiD,KAAK,EAC1E,OAAO,YAAY,gDAAgD,KAAK,EACxE,OAAO,OACN,UACA,SAYG;AACH,qBAAiB,QAAQ;AAEzB,UAAM,YAAY,SAAS,UAAU,QAAQ;AAC7C,QAAI,CAAC,WAAW;AACd,cAAQ,OAAO,MAAM,kBAAkB,QAAQ;AAAA,CAAgB;AAC/D,cAAQ,KAAK,WAAW,gBAAgB;AAAA,IAC1C;AAKA,QAAI,SAAkC,CAAC;AACvC,QAAI,KAAK,UAAU,KAAK;AACtB,eAAS,MAAM,aAAa,KAAK,CAAC,GAAG,KAAK;AAAA,IAC5C,WAAW,KAAK,UAAU,QAAW;AACnC,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,KAAK,KAAK;AACpC,YAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,kBAAQ,OAAO,MAAM,0CAA0C;AAC/D,kBAAQ,KAAK,WAAW,iBAAiB;AAAA,QAC3C;AACA,iBAAS;AAAA,MACX,SAAS,KAAK;AACZ,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,gBAAQ,OAAO,MAAM,qCAAqC,GAAG;AAAA,CAAI;AACjE,gBAAQ,KAAK,WAAW,iBAAiB;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,YAAY,YAAY,IAAI;AAClC,QAAI;AACF,YAAM,cAAc,WAAW,KAAK,KAAK,KAAK,eAAe;AAG7D,UAAI,KAAK,QAAQ;AACf,YAAI,SAAS,UAAU;AACrB,gBAAM,YAAY,MAAM,SAAS,SAAS,UAAU,MAAM;AAC1D,gCAAsB,WAAW,KAAK,MAAM;AAAA,QAC9C,OAAO;AACL,kBAAQ,OAAO,MAAM,KAAK,UAAU,EAAE,OAAO,KAAK,CAAC,IAAI,IAAI;AAAA,QAC7D;AACA;AAAA,MACF;AAEA,UAAI;AACJ,UAAI,KAAK,YAAY,SAAS,eAAe;AAC3C,cAAM,CAAC,GAAG,IAAI,MAAM,SAAS,cAAc,UAAU,QAAQ,EAAE,UAAU,KAAK,SAAS,CAAC;AACxF,iBAAS;AAAA,MACX,OAAO;AACL,cAAM,EAAE,SAAAE,SAAQ,IAAI,MAAM;AAC1B,cAAM,UAAU,IAAIA,SAAQ,KAAK,OAAO;AACxC,iBAAS,MAAM,QAAQ,QAAQ,UAAU,QAAQ,QAAQ;AAAA,MAC3D;AACA,YAAM,aAAa,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;AAG3D,YAAM,MAAM,cAAc,KAAK,MAAM;AACrC,uBAAiB,QAAQ,KAAK,KAAK,MAAM;AAGzC,YAAM,cAAc,eAAe;AACnC,UAAI,aAAa;AACf,oBAAY,aAAa,UAAU,QAAQ,WAAW,GAAG,UAAU;AAAA,MACrE;AAAA,IACF,SAAS,KAAc;AACrB,YAAM,WAAW,iBAAiB,GAAG;AACrC,YAAM,aAAa,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;AAC3D,UAAI;AACF,cAAM,cAAc,eAAe;AACnC,YAAI,aAAa;AACf,sBAAY,aAAa,UAAU,QAAQ,SAAS,UAAU,UAAU;AAAA,QAC1E;AAAA,MACF,QAAQ;AAAA,MAER;AACA,cAAQ,OAAO,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,GAAG;AAAA,CAAI;AAC3E,cAAQ,KAAK,QAAQ;AAAA,IACvB;AAAA,EACF,CAAC;AACH,aAAW,WAAW,OAAO;AAC/B;AAKO,SAAS,wBACd,KACA,UACA,UACM;AACN,QAAM,cAAc,IAAIF,SAAQ,UAAU,EACvC,YAAY,kDAAkD,EAC9D,SAAS,eAAe,uBAAuB,EAC/C,OAAO,oBAAoB,mCAAmC,EAC9D,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OAAO,UAAkB,SAA8C;AAC7E,qBAAiB,QAAQ;AAEzB,UAAM,YAAY,SAAS,UAAU,QAAQ;AAC7C,QAAI,CAAC,WAAW;AACd,cAAQ,OAAO,MAAM,kBAAkB,QAAQ;AAAA,CAAgB;AAC/D,cAAQ,KAAK,WAAW,gBAAgB;AAAA,IAC1C;AAEA,UAAM,SAAS,KAAK,QAAQ,MAAM,aAAa,KAAK,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;AAEzE,QAAI,CAAC,SAAS,UAAU;AACtB,cAAQ,OAAO,MAAM,8CAA8C;AACnE,cAAQ,KAAK,WAAW,oBAAoB;AAAA,IAC9C;AAKA,QAAI;AACF,YAAM,YAAY,MAAM,SAAS,SAAS,UAAU,MAAM;AAC1D,4BAAsB,WAAW,KAAK,MAAM;AAC5C,cAAQ,KAAK,UAAU,QAAQ,IAAI,oBAAoB,SAAS,CAAC;AAAA,IACnE,SAAS,KAAc;AACrB,YAAM,WAAW,iBAAiB,GAAG;AACrC,UAAI;AACF,cAAM,cAAc,eAAe;AACnC,YAAI,aAAa;AACf,sBAAY,aAAa,UAAU,QAAQ,SAAS,UAAU,CAAC;AAAA,QACjE;AAAA,MACF,QAAQ;AAAA,MAER;AACA,cAAQ,OAAO,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,GAAG;AAAA,CAAI;AAC3E,cAAQ,KAAK,QAAQ;AAAA,IACvB;AAAA,EACF,CAAC;AACH,MAAI,WAAW,WAAW;AAC5B;AAlaA,IAwBM;AAxBN;AAAA;AAAA;AAAA;AAUA;AAEA;AACA;AACA;AAQA;AAEA,IAAM,cAAc;AAAA;AAAA;;;AChBpB,SAAS,WAAAG,gBAAe;AAaxB,eAAe,iBACb,UACA,UACA,QACkB;AAClB,MAAI,SAAS,MAAM;AACjB,WAAO,SAAS,KAAK,UAAU,MAAM;AAAA,EACvC;AACA,SAAO,SAAS,QAAQ,UAAU,MAAM;AAC1C;AASA,SAAS,WACP,aACA,KACA,WACM;AACN,MAAI,QAAQ,UAAU,CAAC,QAAQ,OAAO,OAAO;AAC3C,YAAQ,OAAO,MAAM,KAAK,UAAU,aAAa,MAAM,CAAC,IAAI,IAAI;AAAA,EAClE,OAAO;AACL,cAAU;AAAA,EACZ;AACF;AAKA,SAAS,iBAAiB,GAAmB;AAC3C,UAAQ,OAAO,MAAM,UAAU,aAAa,QAAQ,EAAE,UAAU,CAAC;AAAA,CAAI;AACrE,UAAQ,KAAK,iBAAiB,CAAC,CAAC;AAClC;AAOA,SAAS,uBAAuB,QAAuC;AACrE,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,UAAW,OAAO,WAAW,CAAC;AAEpC,MAAI,QAAQ,WAAW,GAAG;AACxB,YAAQ,OAAO,MAAM,qBAAqB;AAC1C;AAAA,EACF;AAEA,QAAM,QAAQ,QAAQ,iBAAiB,QAAQ;AAC/C,UAAQ,OAAO,MAAM,oBAAoB,KAAK;AAAA;AAAA,CAAe;AAC7D,UAAQ,OAAO,MAAM,KAAK,SAAS,OAAO,EAAE,CAAC,IAAI,SAAS,OAAO,EAAE,CAAC,IAAI,aAAa,OAAO,EAAE,CAAC;AAAA,CAAc;AAC7G,UAAQ,OAAO,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;AAAA,CAAI;AAElG,aAAW,KAAK,SAAS;AACvB,UAAM,MAAM,EAAE;AACd,UAAM,SAAS,MAAM,GAAG,IAAI,IAAI,KAAK,IAAI,SAAS,GAAG,MAAM;AAC3D,UAAM,OAAO,KAAK,EAAE,cAAwB,KAAK,KAAK,QAAQ,CAAC,CAAC;AAChE,YAAQ,OAAO;AAAA,MACb,KAAK,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,IAAI,MAAM;AAAA;AAAA,IACjG;AAAA,EACF;AAEA,QAAM,QAAkB,CAAC;AACzB,aAAW,OAAO,CAAC,WAAW,YAAY,OAAO,GAAG;AAClD,UAAM,QAAQ,QAAQ,GAAG;AACzB,QAAI,MAAO,OAAM,KAAK,GAAG,KAAK,IAAI,GAAG,EAAE;AAAA,EACzC;AACA,UAAQ,OAAO,MAAM;AAAA,WAAc,MAAM,KAAK,IAAI,KAAK,SAAS;AAAA,CAAI;AACtE;AAGA,SAAS,sBAAsB,QAAuC;AACpE,UAAQ,OAAO,MAAM,WAAW,OAAO,aAAa,GAAG;AAAA,CAAI;AAC3D,UAAQ,OAAO,MAAM,WAAW,OAAO,UAAU,SAAS;AAAA,CAAI;AAC9D,QAAM,QAAQ,OAAO,eAAyB;AAC9C,QAAM,SAAS,OAAO,eAAyB;AAC/C,QAAM,OAAO,OAAO,cAAwB;AAC5C,QAAM,MAAM,OAAO,kBAA4B;AAC/C,QAAM,MAAM,OAAO,kBAA4B;AAC/C,UAAQ,OAAO,MAAM,UAAU,MAAM,eAAe,CAAC,YAAY,OAAO,eAAe,CAAC,cAAc,OAAO,KAAK,QAAQ,CAAC,CAAC;AAAA,CAAgB;AAC5I,UAAQ,OAAO,MAAM,YAAY,IAAI,QAAQ,CAAC,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC;AAAA,CAAU;AAEnF,QAAM,SAAU,OAAO,iBAAiB,CAAC;AACzC,MAAI,OAAO,SAAS,GAAG;AACrB,YAAQ,OAAO,MAAM;AAAA,qBAAwB,OAAO,MAAM;AAAA,CAAM;AAChE,eAAW,KAAK,QAAQ;AACtB,YAAM,QAAQ,EAAE,SAAS;AACzB,YAAM,OAAO,EAAE,iBAAiB;AAChC,cAAQ,OAAO,MAAM,KAAK,OAAO,EAAE,QAAQ,GAAG,EAAE,OAAO,EAAE,CAAC,KAAK,KAAK,YAAY,IAAI;AAAA,CAAK;AAAA,IAC3F;AAAA,EACF;AACF;AAGA,SAAS,sBAAsB,QAAuC;AACpE,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,SAAS,OAAO,UAAU;AAEhC,MAAI,QAAQ,WAAW,GAAG;AACxB,YAAQ,OAAO,MAAM,4BAA4B,MAAM;AAAA,CAAK;AAC5D;AAAA,EACF;AAEA,UAAQ,OAAO,MAAM,uBAAuB,MAAM;AAAA;AAAA,CAAO;AACzD,UAAQ,OAAO,MAAM,KAAK,SAAS,OAAO,EAAE,CAAC,IAAI,QAAQ,SAAS,CAAC,CAAC,IAAI,SAAS,SAAS,CAAC,CAAC,IAAI,cAAc,SAAS,EAAE,CAAC,IAAI,QAAQ,SAAS,EAAE,CAAC;AAAA,CAAI;AACtJ,UAAQ,OAAO,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;AAAA,CAAI;AAElH,aAAW,KAAK,SAAS;AACvB,UAAM,MAAM,IAAK,EAAE,kBAA6B,GAAG,QAAQ,CAAC,CAAC;AAC7D,YAAQ,OAAO;AAAA,MACb,KAAK,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,IAAI,OAAQ,EAAE,cAAyB,CAAC,EAAE,SAAS,CAAC,CAAC,IACrF,OAAQ,EAAE,eAA0B,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,IAAI,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC;AAAA;AAAA,IACjH;AAAA,EACF;AAEA,QAAM,aAAc,OAAO,eAA0B,QAAQ,OAAO,CAAC,GAAG,MAAM,KAAM,EAAE,cAAyB,IAAI,CAAC;AACpH,QAAM,cAAe,OAAO,gBAA2B,QAAQ,OAAO,CAAC,GAAG,MAAM,KAAM,EAAE,eAA0B,IAAI,CAAC;AACvH,UAAQ,OAAO,MAAM;AAAA,SAAY,WAAW,eAAe,CAAC,YAAY,YAAY,eAAe,CAAC;AAAA,CAAW;AACjH;AASO,SAAS,sBAAsB,YAAqB,UAA0B;AACnF,QAAM,YAAY,IAAIA,SAAQ,QAAQ,EACnC,YAAY,wEAAwE,EACpF,SAAS,eAAe,+BAA+B,EACvD,OAAO,wBAAwB,yCAAyC,YAAY,IAAI,EACxF,OAAO,SAAS,4BAA4B,KAAK,EACjD,OAAO,oBAAoB,2CAA2C,UAAU,EAAE,EAClF,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OACN,UACA,SACG;AACH,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,QAAI;AACF,UAAI,UAAU;AACZ,cAAM,SAAS,MAAM,iBAAiB,UAAU,wBAAwB;AAAA,UACtE,WAAW;AAAA,UACX,aAAa,KAAK;AAAA,QACpB,CAAC;AACD,mBAAW,QAAQ,KAAK,MAAM,sBAAsB,MAAM,CAAC;AAAA,MAC7D,OAAO;AACL,cAAM,SAAS,MAAM,iBAAiB,UAAU,yBAAyB;AAAA,UACvE,sBAAsB,KAAK;AAAA,UAC3B,iBAAiB,KAAK;AAAA,QACxB,CAAC;AACD,mBAAW,QAAQ,KAAK,MAAM,uBAAuB,MAAM,CAAC;AAAA,MAC9D;AAAA,IACF,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,aAAW,WAAW,SAAS;AACjC;AAKO,SAAS,qBAAqB,YAAqB,UAA0B;AAClF,QAAM,WAAW,IAAIA,SAAQ,OAAO,EACjC,YAAY,2EAA2E,EACvF,SAAS,eAAe,8BAA8B,EACtD,OAAO,qBAAqB,kCAAkC,KAAK,EACnE,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OAAO,UAA8B,SAA8C;AACzF,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,QAAI;AACF,UAAI;AACJ,UAAI,UAAU;AACZ,iBAAS,MAAM,iBAAiB,UAAU,uBAAuB;AAAA,UAC/D,WAAW;AAAA,UACX,QAAQ,KAAK;AAAA,QACf,CAAC;AAAA,MACH,OAAO;AACL,iBAAS,MAAM,iBAAiB,UAAU,wBAAwB;AAAA,UAChE,QAAQ,KAAK;AAAA,QACf,CAAC;AAAA,MACH;AACA,iBAAW,QAAQ,KAAK,MAAM;AAC5B,YAAI,UAAU;AACZ,2BAAiB,QAAQ,GAAG;AAAA,QAC9B,OAAO;AACL,gCAAsB,MAAiC;AAAA,QACzD;AAAA,MACF,CAAC;AAAA,IACH,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,aAAW,WAAW,QAAQ;AAChC;AAKO,SAAS,sBAAsB,YAAqB,UAA0B;AACnF,QAAM,YAAY,IAAIA,SAAQ,QAAQ,EACnC,YAAY,sCAAsC,EAClD,SAAS,eAAe,qBAAqB,EAC7C,eAAe,qBAAqB,2CAA2C,EAC/E,OAAO,aAAa,oEAAoE,KAAK,EAC7F,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OAAO,UAAkB,SAA4D;AAC3F,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,QAAI;AACF,YAAM,SAAS,MAAM,iBAAiB,UAAU,iCAAiC;AAAA,QAC/E,WAAW;AAAA,QACX,SAAS;AAAA,QACT,QAAQ,KAAK;AAAA,MACf,CAAC;AACD,iBAAW,QAAQ,KAAK,MAAM;AAC5B,gBAAQ,OAAO,MAAM,WAAW,QAAQ;AAAA,YAAyB,KAAK,MAAM;AAAA,CAAI;AAAA,MAClF,CAAC;AAAA,IACH,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,aAAW,WAAW,SAAS;AACjC;AAKO,SAAS,uBAAuB,YAAqB,UAA0B;AACpF,QAAM,aAAa,IAAIA,SAAQ,SAAS,EACrC,YAAY,oEAAoE,EAChF,SAAS,eAAe,sBAAsB,EAC9C,eAAe,qBAAqB,4CAA4C,EAChF,OAAO,aAAa,oEAAoE,KAAK,EAC7F,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OAAO,UAAkB,SAA4D;AAC3F,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,QAAI;AACF,YAAM,SAAS,MAAM,iBAAiB,UAAU,iCAAiC;AAAA,QAC/E,WAAW;AAAA,QACX,SAAS;AAAA,QACT,QAAQ,KAAK;AAAA,MACf,CAAC;AACD,iBAAW,QAAQ,KAAK,MAAM;AAC5B,gBAAQ,OAAO,MAAM,WAAW,QAAQ;AAAA,YAA0B,KAAK,MAAM;AAAA,CAAI;AAAA,MACnF,CAAC;AAAA,IACH,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,aAAW,WAAW,UAAU;AAClC;AAKO,SAAS,sBAAsB,YAAqB,UAA0B;AACnF,QAAM,YAAY,IAAIA,SAAQ,QAAQ,EACnC,YAAY,gCAAgC,EAC5C,SAAS,eAAe,qBAAqB,EAC7C,eAAe,qBAAqB,yCAAyC,EAC7E,OAAO,aAAa,oEAAoE,KAAK,EAC7F,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OAAO,UAAkB,SAA4D;AAC3F,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,QAAI;AACF,YAAM,SAAS,MAAM,iBAAiB,UAAU,gCAAgC;AAAA,QAC9E,WAAW;AAAA,QACX,QAAQ,KAAK;AAAA,MACf,CAAC;AACD,iBAAW,QAAQ,KAAK,MAAM;AAC5B,cAAM,OAAO,OAAO,oBAAoB;AACxC,cAAM,SAAS,OAAO,eAAe;AACrC,cAAM,MAAM,OAAO,sBAAsB;AACzC,gBAAQ,OAAO,MAAM,WAAW,QAAQ;AAAA,CAAe;AACvD,gBAAQ,OAAO,MAAM,cAAc,IAAI,OAAO,MAAM;AAAA,CAAI;AACxD,gBAAQ,OAAO,MAAM,eAAe,GAAG;AAAA,CAAM;AAAA,MAC/C,CAAC;AAAA,IACH,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,aAAW,WAAW,SAAS;AACjC;AAWO,SAAS,sBAAsB,YAAqB,UAA0B;AACnF,QAAM,cAAc,IAAIA,SAAQ,QAAQ,EACrC,YAAY,uCAAuC;AAEtD,QAAM,eAAe,IAAIA,SAAQ,KAAK,EACnC,YAAY,6CAA6C,EACzD,SAAS,SAAS,8BAA8B,EAChD,OAAO,qBAAqB,kBAAkB,OAAO,EACrD,OAAO,OAAO,KAAa,SAA8B;AACxD,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,QAAI;AACF,YAAM,SAAS,MAAM,iBAAiB,UAAU,qBAAqB,EAAE,IAAI,CAAC;AAC5E,YAAM,QAAS,QAAoC,SAAS;AAC5D,iBAAW,EAAE,KAAK,MAAM,GAAG,KAAK,MAAM;AACpC,gBAAQ,OAAO,MAAM,GAAG,GAAG,MAAM,KAAK,UAAU,KAAK,CAAC;AAAA,CAAI;AAAA,MAC5D,CAAC;AAAA,IACH,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,cAAY,WAAW,YAAY;AAEnC,QAAM,eAAe,IAAIA,SAAQ,KAAK,EACnC,YAAY,yFAAyF,EACrG,SAAS,SAAS,8BAA8B,EAChD,SAAS,WAAW,WAAW,EAC/B,eAAe,qBAAqB,gDAAgD,EACpF,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OAAO,KAAa,OAAe,SAA8C;AACvF,UAAM,MAAM,cAAc,KAAK,MAAM;AAErC,QAAI;AACJ,QAAI;AACF,oBAAc,KAAK,MAAM,KAAK;AAAA,IAChC,QAAQ;AACN,oBAAc;AAAA,IAChB;AAEA,QAAI;AACF,YAAM,SAAS,MAAM,iBAAiB,UAAU,gCAAgC;AAAA,QAC9E;AAAA,QACA,OAAO;AAAA,QACP,QAAQ,KAAK;AAAA,MACf,CAAC;AACD,iBAAW,QAAQ,KAAK,MAAM;AAC5B,cAAM,MAAM,OAAO,aAAa;AAChC,cAAM,SAAS,OAAO,aAAa;AACnC,gBAAQ,OAAO,MAAM,mBAAmB,GAAG;AAAA,CAAI;AAC/C,gBAAQ,OAAO,MAAM,KAAK,KAAK,UAAU,GAAG,CAAC,OAAO,KAAK,UAAU,MAAM,CAAC;AAAA,CAAI;AAC9E,gBAAQ,OAAO,MAAM,aAAa,KAAK,MAAM;AAAA,CAAI;AAAA,MACnD,CAAC;AAAA,IACH,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,cAAY,WAAW,YAAY;AAEnC,aAAW,WAAW,WAAW;AACnC;AA1XA;AAAA;AAAA;AAAA;AAUA;AACA;AAAA;AAAA;;;ACPA,SAAS,WAAAC,UAAS,UAAAC,eAAc;AAuBhC,SAAS,mBACP,UACA,cACmD;AAEnD,MAAI,OAAO,SAAS,qBAAqB,YAAY;AACnD,QAAI;AACF,YAAM,UAAU,SAAS,iBAAiB;AAC1C,UAAI,WAAW,QAAQ,SAAS,cAAc;AAC5C,eAAO,EAAE,MAAM,SAAS,WAAW,KAAK;AAAA,MAC1C;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,QAAM,OAAQ,SAAkD;AAGhE,MAAI,QAAQ,OAAO,KAAK,mBAAmB,YAAY;AACrD,QAAI;AACF,YAAM,MAAM,KAAK,eAAe;AAChC,YAAM,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,SAAS,YAAY,KAAK;AACzD,aAAO,EAAE,MAAM,WAAW,MAAM;AAAA,IAClC,QAAQ;AACN,aAAO,EAAE,MAAM,MAAM,WAAW,MAAM;AAAA,IACxC;AAAA,EACF;AACA,SAAO,EAAE,MAAM,MAAM,WAAW,MAAM;AACxC;AA4DO,SAAS,wBAAwB,KAAc,UAA0B;AAC9E,QAAM,cAAc,IAAID,SAAQ,mBAAmB,EAChD,YAAY,mDAAmD,EAC/D;AAAA,IACC,IAAIC,QAAO,qBAAqB,2CAA2C,EACxE,QAAQ,CAAC,YAAY,YAAY,WAAW,eAAe,SAAS,CAAC,EACrE,QAAQ,UAAU;AAAA,EACvB,EACC,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,CAAC,SAAgD;AACvD,UAAM,MAAM,cAAc,KAAK,MAAM;AAIrC,UAAM,EAAE,MAAM,UAAU,IAAI,mBAAmB,UAAU,KAAK,QAAQ;AAEtE,QAAI,MAAM;AAIR,YAAM,gBAAgB,YAAa,SAAS,iBAAiB,SAAS,CAAC,IAAK,CAAC;AAC7E,YAAM,SAAS,aAAa,KAAK,IAAI,KAAK,KAAK,SAAS;AAExD,UAAI,QAAQ,UAAU,CAAC,QAAQ,OAAO,OAAO;AAC3C,cAAM,UAAU;AAAA,UACd,UAAU,KAAK;AAAA,UACf,YAAY,KAAK;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,OAAO,KAAK,UAAU,IAAI,CAAC,MAAM,MAAM;AACrC,kBAAM,WAAW,cAAc,CAAC;AAChC,mBAAO;AAAA,cACL,OAAO,IAAI;AAAA,cACX;AAAA,cACA,MAAM,UAAU,QAAQ;AAAA,cACxB,WAAW,UAAU,aAAa;AAAA,cAClC,YAAY,UAAU,aAAa;AAAA,YACrC;AAAA,UACF,CAAC;AAAA,QACH;AACA,gBAAQ,OAAO,MAAM,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,IAAI;AAAA,MAC9D,OAAO;AACL,gBAAQ,OAAO,MAAM,GAAG,MAAM;AAAA;AAAA,CAAM;AACpC,gBAAQ,OAAO,MAAM,KAAK,IAAI,OAAO,CAAC,CAAC,IAAI,OAAO,OAAO,EAAE,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,IAAI,YAAY,OAAO,EAAE,CAAC;AAAA,CAAY;AACtH,gBAAQ,OAAO,MAAM,KAAK,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;AAAA,CAAI;AACjH,iBAAS,IAAI,GAAG,IAAI,KAAK,UAAU,QAAQ,KAAK;AAC9C,gBAAM,WAAW,cAAc,CAAC;AAChC,gBAAM,OAAO,UAAU,OAAO,QAAQ;AACtC,gBAAM,YAAY,UAAU,cAAc,QAAQ,QAAQ;AAC1D,gBAAM,UAAU,UAAU,YAAY,GAAG,SAAS,SAAS,OAAO;AAClE,kBAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,IAAI,UAAU,OAAO,EAAE,CAAC,IAAI,OAAO;AAAA,CAAI;AAAA,QAC5I;AAAA,MACF;AACA;AAAA,IACF;AAGA,UAAM,QAAQ,aAAa,KAAK,QAAQ,KAAK,CAAC;AAC9C,UAAM,YAAY,oBAAI,IAAI;AAAA,MACxB;AAAA,MAAoB;AAAA,MAAoB;AAAA,MAAiB;AAAA,MAAa;AAAA,IACxE,CAAC;AACD,UAAM,eAAe,oBAAI,IAAI;AAAA,MAC3B;AAAA,MAAoB;AAAA,MAAiB;AAAA,MAAW;AAAA,IAClD,CAAC;AAED,QAAI,QAAQ,UAAU,CAAC,QAAQ,OAAO,OAAO;AAC3C,YAAM,UAAU;AAAA,QACd,UAAU,KAAK;AAAA,QACf,YAAY,MAAM;AAAA,QAClB,OAAO,MAAM,IAAI,CAAC,GAAG,OAAO;AAAA,UAC1B,OAAO,IAAI;AAAA,UACX,MAAM;AAAA,UACN,MAAM,UAAU,IAAI,CAAC;AAAA,UACrB,WAAW,CAAC,aAAa,IAAI,CAAC;AAAA,QAChC,EAAE;AAAA,MACJ;AACA,cAAQ,OAAO,MAAM,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,IAAI;AAAA,IAC9D,OAAO;AACL,cAAQ,OAAO,MAAM,aAAa,KAAK,QAAQ,KAAK,MAAM,MAAM;AAAA;AAAA,CAAa;AAC7E,cAAQ,OAAO,MAAM,KAAK,IAAI,OAAO,CAAC,CAAC,IAAI,OAAO,OAAO,EAAE,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,IAAI,YAAY,OAAO,EAAE,CAAC;AAAA,CAAY;AACtH,cAAQ,OAAO,MAAM,KAAK,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;AAAA,CAAI;AACjH,eAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAM,OAAO,UAAU,IAAI,MAAM,CAAC,CAAC,IAAI,QAAQ;AAC/C,cAAM,YAAY,aAAa,IAAI,MAAM,CAAC,CAAC,IAAI,OAAO;AACtD,gBAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,IAAI,UAAU,OAAO,EAAE,CAAC;AAAA,CAAW;AAAA,MAC/H;AAAA,IACF;AAAA,EACF,CAAC;AACH,MAAI,WAAW,WAAW;AAC5B;AA7MA,IA4DM;AA5DN;AAAA;AAAA;AAAA;AAMA;AAsDA,IAAM,eAAyC;AAAA,MAC7C,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,aAAa;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA;AAAA;;;AChHA,IA4Ca,sBAEP,kBAgBO,wBAoCA;AAlGb;AAAA;AAAA;AAAA;AAYA;AACA;AA+BO,IAAM,uBAA4C,oBAAI,IAAI,CAAC,OAAO,CAAC;AAE1E,IAAM,mBAAwC,oBAAI,IAAI;AAAA,MACpD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAWM,IAAM,yBAA8C,oBAAI,IAAI;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAsBM,IAAM,aAAN,MAAM,YAAW;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MAET,YAAY,MAAsB;AACxC,aAAK,QAAQ,KAAK;AAClB,aAAK,WAAW,KAAK;AACrB,aAAK,WAAW,KAAK;AACrB,aAAK,cAAc,KAAK;AACxB,aAAK,oBAAoB,KAAK;AAC9B,aAAK,iBAAiB,KAAK;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,OAAO,cACL,QACA,MACY;AACZ,eAAO,YAAW;AAAA,UAAO;AAAA,UAAQ;AAAA;AAAA,UAAwB;AAAA,QAAI;AAAA,MAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,OAAO,SACL,QACA,MACY;AACZ,eAAO,YAAW;AAAA,UAChB;AAAA,UACA;AAAA;AAAA,UACkB;AAAA,QACpB;AAAA,MACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,OAAO,YACL,QACA,MACqC;AACrC,YAAI,WAAW,QAAQ,WAAW,UAAa,OAAO,WAAW,aAAa,OAAO,WAAW,UAAU;AACxG,iBAAO,CAAC,MAAM,6DAA6D,OAAO,MAAM,EAAE;AAAA,QAC5F;AACA,YAAI,WAAW,QAAQ,WAAW,UAAa,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AACnG,gBAAM,OAAQ,OAAmC,MAAM;AACvD,cAAI,SAAS,UAAa,SAAS,MAAM;AACvC,kBAAM,aAAa,CAAC,OAAO,QAAQ,WAAW,SAAS;AACvD,gBAAI,OAAO,SAAS,YAAY,CAAC,WAAW,SAAS,IAAI,GAAG;AAC1D,qBAAO,CAAC,MAAM,wBAAwB,IAAI,iDAAiD;AAAA,YAC7F;AAAA,UACF;AAAA,QACF;AACA,eAAO,CAAC,YAAW,SAAS,QAAQ,IAAI,GAAG,IAAI;AAAA,MACjD;AAAA;AAAA;AAAA;AAAA,MAMA,OAAe,OACb,QACA,MACA,eACY;AAEZ,YAAI,WAAW,MAAM;AACnB,iBAAO,IAAI,YAAW;AAAA,YACpB,MAAM;AAAA,YACN,SAAS,CAAC;AAAA,YACV,SAAS,CAAC;AAAA,YACV,YAAY;AAAA,YACZ,kBAAkB,KAAK;AAAA,YACvB;AAAA,UACF,CAAC;AAAA,QACH;AACA,YAAI,WAAW,OAAO;AACpB,iBAAO,IAAI,YAAW;AAAA,YACpB,MAAM;AAAA,YACN,SAAS,CAAC;AAAA,YACV,SAAS,CAAC;AAAA,YACV,YAAY;AAAA,YACZ,kBAAkB,KAAK;AAAA,YACvB;AAAA,UACF,CAAC;AAAA,QACH;AAGA,YAAI,WAAW,UAAa,WAAW,MAAM;AAC3C,iBAAO,IAAI,YAAW;AAAA,YACpB,MAAM;AAAA,YACN,SAAS,CAAC;AAAA,YACV,SAAS,CAAC;AAAA,YACV,YAAY;AAAA,YACZ,kBAAkB,KAAK;AAAA,YACvB;AAAA,UACF,CAAC;AAAA,QACH;AAEA,YAAI,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAEvD,kBAAQ,OAAO;AAAA,YACb,wDAAwD,MAAM,QAAQ,MAAM,IAAI,UAAU,OAAO,MAAM;AAAA;AAAA,UACzG;AACA,kBAAQ,KAAK,WAAW,iBAAiB;AAAA,QAC3C;AAEA,cAAM,MAAM;AAGZ,YAAI;AACJ,YAAI,IAAI,SAAS,UAAa,IAAI,SAAS,MAAM;AAE/C,iBAAO;AAAA,QACT,WAAW,OAAO,IAAI,SAAS,UAAU;AACvC,kBAAQ,OAAO;AAAA,YACb,2CAA2C,OAAO,IAAI,IAAI;AAAA;AAAA,UAE5D;AACA,kBAAQ,KAAK,WAAW,iBAAiB;AAAA,QAC3C,WAAW,CAAC,iBAAiB,IAAI,IAAI,IAAI,GAAG;AAC1C,kBAAQ,OAAO;AAAA,YACb,sBAAsB,IAAI,IAAI;AAAA;AAAA,UAEhC;AACA,kBAAQ,KAAK,WAAW,iBAAiB;AAAA,QAC3C,OAAO;AACL,iBAAO,IAAI;AAAA,QACb;AAGA,cAAM,UAAU,YAAW,eAAe,IAAI,SAAS,SAAS;AAChE,cAAM,UAAU,YAAW,eAAe,IAAI,SAAS,SAAS;AAKhE,cAAM,gBACJ,IAAI,eAAe,SACf,IAAI,aACH,IAAgC,aAAa;AACpD,YAAI,aAAa;AACjB,YAAI,kBAAkB,QAAW;AAC/B,cAAI,OAAO,kBAAkB,WAAW;AACtC,yBAAa;AAAA,UACf,OAAO;AACL;AAAA,cACE,0CAA0C,OAAO,aAAa;AAAA,YAChE;AAAA,UACF;AAAA,QACF;AAEA,eAAO,IAAI,YAAW;AAAA,UACpB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,kBAAkB,KAAK;AAAA,UACvB;AAAA,QACF,CAAC;AAAA,MACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWA,OAAe,eAAe,KAAc,OAAyB;AACnE,YAAI,QAAQ,UAAa,QAAQ,KAAM,QAAO,CAAC;AAC/C,YAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACvB,eAAK,SAAS,KAAK,wBAAwB,OAAO,GAAG,aAAa;AAClE,iBAAO,CAAC;AAAA,QACV;AACA,cAAM,MAAgB,CAAC;AACvB,mBAAW,SAAS,KAAK;AACvB,cAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,gBAAI,CAAC,uBAAuB,IAAI,KAAK,GAAG;AACtC;AAAA,gBACE,6BAA6B,KAAK,QAAQ,KAAK;AAAA,cACjD;AAAA,YACF;AACA,gBAAI,KAAK,KAAK;AAAA,UAChB,OAAO;AACL,iBAAK,SAAS,KAAK,uCAAuC;AAAA,UAC5D;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAiBA,oBAA4D;AAE1D,YAAI,KAAK,kBAAkB,KAAK,UAAU,QAAQ;AAChD,iBAAO,KAAK;AAAA,QACd;AAGA,YAAI,CAAC,KAAK,aAAa;AACrB,gBAAM,UAAU,KAAK,UAAU,QAAQ,IAAI,gBAAgB;AAC3D,cAAI,YAAY,MAAM;AACpB,mBAAO;AAAA,UACT;AAAA,QACF;AAGA,YAAI,KAAK,UAAU,QAAQ;AACzB,iBAAO,KAAK;AAAA,QACd;AAGA,eAAO,KAAK,oBAAoB,SAAS;AAAA,MAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQA,qBAAqB,YAA6B;AAChD,cAAM,OAAO,KAAK,kBAAkB;AACpC,YAAI,SAAS,UAAW,QAAO,KAAK,SAAS,SAAS,UAAU;AAChE,YAAI,SAAS,UAAW,QAAO,CAAC,KAAK,SAAS,SAAS,UAAU;AACjE,cAAM,IAAI;AAAA,UACR,2CAA2C,IAAI;AAAA,QACjD;AAAA,MACF;AAAA;AAAA,MAGA,iBAA0B;AACxB,eAAO,KAAK,kBAAkB,MAAM;AAAA,MACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAcQ,UAAU,KAAgD;AAChE,YAAI,QAAQ,UAAa,QAAQ,GAAI,QAAO;AAC5C,cAAM,aAAa,IAAI,YAAY;AACnC,YAAI,eAAe,UAAU,eAAe,OAAO,eAAe,QAAQ;AACxE,iBAAO;AAAA,QACT;AACA,YACE,eAAe,UACf,eAAe,OACf,eAAe,SACf;AACA,iBAAO;AAAA,QACT;AACA;AAAA,UACE,mCAAmC,GAAG;AAAA,QAExC;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;;;AC1XA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uBAAuB,MAAM;AAClD;AASO,SAAS,eAAe,SAAyB;AACtD,QAAM,WAAW;AACjB,QAAM,UAAU,QAAQ,WAAW,MAAM,QAAQ;AACjD,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,QAAM,aAAa,MAAM,IAAI,CAAC,MAAM;AAClC,UAAM,WAAW,EAAE,WAAW,UAAU,IAAI;AAC5C,WAAO,YAAY,QAAQ;AAAA,EAC7B,CAAC;AACD,MAAI,QAAQ,WAAW,KAAK,OAAO;AACnC,UAAQ,MAAM,WAAW,UAAU,IAAI;AACvC,SAAO,IAAI,OAAO,IAAI,KAAK,GAAG;AAChC;AArCA,IAwDa;AAxDb;AAAA;AAAA;AAAA;AAQA;AAgDO,IAAM,iBAAN,MAAM,gBAAe;AAAA,MAC1B,OAAgB,cAAc,CAAC,OAAO,WAAW,WAAW,MAAM;AAAA,MAEzD;AAAA,MACQ;AAAA,MACA;AAAA,MAEjB,YAAY,OAAO,OAAO,SAAoB,SAAoB;AAOhE,YAAI,CAAC,gBAAe,YAAY,SAAS,IAAmD,GAAG;AAC7F,kBAAQ,OAAO;AAAA,YACb,yCAAyC,IAAI,+CAA0C,gBAAe,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA,UAC9H;AACA,iBAAO;AAAA,QACT;AACA,aAAK,QAAQ;AACb,cAAM,QAAQ,CAAC,QAAkB,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;AACjD,aAAK,mBAAmB,MAAM,WAAW,CAAC,CAAC,EAAE,IAAI,cAAc;AAC/D,aAAK,mBAAmB,MAAM,WAAW,CAAC,CAAC,EAAE,IAAI,cAAc;AAAA,MACjE;AAAA;AAAA,MAGA,UAAU,UAA2B;AACnC,YAAI,KAAK,UAAU,MAAO,QAAO;AACjC,YAAI,KAAK,UAAU,WAAW;AAC5B,iBAAO,KAAK,iBAAiB,KAAK,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC;AAAA,QAC7D;AACA,YAAI,KAAK,UAAU,WAAW;AAC5B,iBAAO,CAAC,KAAK,iBAAiB,KAAK,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC;AAAA,QAC9D;AACA,eAAO;AAAA,MACT;AAAA;AAAA,MAGA,cAAc,WAA2C;AACvD,cAAM,UAAoB,CAAC;AAC3B,cAAM,SAAmB,CAAC;AAC1B,mBAAW,OAAO,WAAW;AAC3B,WAAC,KAAK,UAAU,GAAG,IAAI,UAAU,QAAQ,KAAK,GAAG;AAAA,QACnD;AACA,eAAO,CAAC,SAAS,MAAM;AAAA,MACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,OAAO,WAAW,QAAiD;AACjE,cAAM,SAAS,OAAO,UAAU,CAAC;AACjC,YAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,eAAK,2DAA2D;AAChE,iBAAO,IAAI,gBAAe;AAAA,QAC5B;AAEA,cAAM,YAAY;AAClB,cAAM,OAAQ,UAAU,QAAmB;AAC3C,YAAI,CAAC,CAAC,OAAO,WAAW,SAAS,EAAE,SAAS,IAAI,GAAG;AACjD,gBAAM,IAAI;AAAA,YACR,yBAAyB,IAAI;AAAA,UAC/B;AAAA,QACF;AAEA,YAAI,UAAU,UAAU,WAAW,CAAC;AACpC,YAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,eAAK,qDAAqD;AAC1D,oBAAU,CAAC;AAAA,QACb;AAEA,YAAI,UAAU,UAAU,WAAW,CAAC;AACpC,YAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,eAAK,qDAAqD;AAC1D,oBAAU,CAAC;AAAA,QACb;AAEA,cAAM,aAAa,CAAC,KAAgB,UAA4B;AAC9D,gBAAM,SAAmB,CAAC;AAC1B,qBAAW,KAAK,KAAK;AACnB,gBAAI,CAAC,GAAG;AACN,mBAAK,2BAA2B,KAAK,aAAa;AAAA,YACpD,OAAO;AACL,qBAAO,KAAK,OAAO,CAAC,CAAC;AAAA,YACvB;AAAA,UACF;AACA,iBAAO;AAAA,QACT;AAEA,eAAO,IAAI;AAAA,UACT;AAAA,UACA,WAAW,SAAsB,SAAS;AAAA,UAC1C,WAAW,SAAsB,SAAS;AAAA,QAC5C;AAAA,MACF;AAAA,IACF;AAAA;AAAA;;;AC9HA,SAAS,gBAAgB,KAAc,SAA2C;AAChF,QAAM,MAAO,IAAsD;AACnE,QAAM,IAAI,MAAM,OAAO;AACvB,MAAI,OAAO,MAAM,WAAY,QAAO,EAAE,EAAE,OAAO,OAAO,SAAS,IAAI,CAAC;AACpE,SAAO,KAAK;AACd;AAEA,SAAS,sBAAsB,OAAuB;AACpD,SAAO,MACJ,QAAQ,uBAAuB,CAAC,GAAG,SAAS,IAAI,KAAK,YAAY,CAAC,GAAG,EACrE,QAAQ,yBAAyB,CAAC,GAAG,SAAS,IAAI,KAAK,YAAY,CAAC,GAAG;AAC5E;AAEA,SAAS,WAAW,KAAqB;AACvC,QAAM,QAAQ,sBAAsB,IAAI,KAAK;AAE7C,MAAI,CAAC,IAAI,SAAS,MAAM,WAAW,IAAI,EAAG,QAAO,SAAS;AAC1D,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAqB;AAC9C,MAAI,OAAO,IAAI;AACf,QAAM,IAAI,IAAI;AACd,MAAI,MAAM,UAAa,MAAM,SAAS,MAAM,MAAM,MAAM,MAAM;AAC5D,WAAO,GAAG,IAAI,cAAc,OAAO,CAAC,CAAC;AAAA,EACvC;AACA,SAAO;AACT;AAOA,SAAS,uBAAuB,MAAmC;AACjE,QAAM,WAAqB,CAAC;AAC5B,QAAM,cAAwB,CAAC;AAC/B,QAAM,OAAiB,CAAC;AACxB,aAAW,KAAK,MAAM;AACpB,QAAI,EAAE,SAAS,SAAU,UAAS,KAAK,CAAC;AAAA,aAC/B,EAAE,SAAS,YAAa,aAAY,KAAK,CAAC;AAAA,QAC9C,MAAK,KAAK,CAAC;AAAA,EAClB;AACA,SAAO,CAAC,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW;AAC9C;AAEO,SAAS,oBAAoB,KAAc,QAAsB;AACtE,QAAM,WAAqB,CAAC;AAE5B,QAAM,YAAY,gBAAgB,KAAK,WAAW;AAClD,MAAI,UAAW,UAAS,KAAK,SAAS;AAEtC,QAAM,OAAO,IAAI,YAAY;AAC7B,MAAI,KAAM,UAAS,KAAK,IAAI;AAE5B,QAAM,SAAS,gBAAgB,KAAK,QAAQ;AAC5C,MAAI,OAAQ,UAAS,KAAK,MAAM;AAEhC,QAAM,cAAc,uBAAuB,OAAO,eAAe,GAAG,CAAC;AACrE,QAAM,cAAc,OAAO,gBAAgB,GAAG;AAC9C,QAAM,OAAQ,IAEX,uBAAuB,CAAC;AAE3B,MAAI,QAAQ,UAAU,IAAI,KAAK,CAAC;AAChC,MAAI,YAAY,SAAS,EAAG,UAAS;AACrC,aAAW,KAAK,MAAM;AACpB,UAAM,IAAI,EAAE,KAAK,EAAE,YAAY;AAC/B,aAAS,EAAE,WAAW,KAAK,CAAC,MAAM,KAAK,CAAC;AAAA,EAC1C;AACA,MAAI,YAAY,SAAS,EAAG,UAAS;AACrC,WAAS,KAAK,KAAK;AAEnB,MAAI,YAAY,SAAS,GAAG;AAC1B,UAAM,QAAQ,YAAY,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AAC7C,UAAM,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;AAChD,UAAM,QAAQ,CAAC,WAAW;AAC1B,gBAAY,QAAQ,CAAC,KAAK,MAAM;AAC9B,YAAM,KAAK,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,EAAE;AAAA,IAC5D,CAAC;AACD,aAAS,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,EAChC;AAEA,MAAI,YAAY,SAAS,GAAG;AAC1B,UAAM,QAAQ,YAAY,IAAI,UAAU;AACxC,UAAM,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;AAChD,UAAM,QAAQ,CAAC,UAAU;AACzB,gBAAY,QAAQ,CAAC,KAAK,MAAM;AAC9B,YAAM,KAAK,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,kBAAkB,GAAG,CAAC,EAAE;AAAA,IACjE,CAAC;AACD,aAAS,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,EAChC;AAEA,QAAM,QAAQ,gBAAgB,KAAK,OAAO;AAC1C,MAAI,MAAO,UAAS,KAAK,KAAK;AAE9B,QAAM,WAAW,gBAAgB,KAAK,UAAU;AAChD,MAAI,SAAU,UAAS,KAAK,QAAQ;AAEpC,SAAO,SAAS,KAAK,MAAM,IAAI;AACjC;AAhIA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,iBAAAC,sBAAqB;AAC9B,YAAYC,WAAU;AACtB,SAAS,WAAAC,UAAS,gBAAgB,UAAAC,eAAc;AAwCzC,SAAS,eAAe,SAAwB;AACrD,gBAAc;AAChB;AAWO,SAAS,WAAW,KAA0B;AACnD,YAAU;AACZ;AAGA,SAAS,iBAA0B;AACjC,SAAO,QAAQ,KAAK,SAAS,WAAW;AAC1C;AAOO,SAAS,iBACd,UACA,UACA,cACQ;AACR,MAAI,aAAa,UAAa,OAAO,SAAS,QAAQ,KAAK,WAAW,GAAG;AACvE,WAAO;AAAA,EACT;AACA,MAAI,aAAa,UAAa,aAAa,IAAI;AAC7C,UAAM,SAAS,SAAS,UAAU,EAAE;AACpC,QAAI,OAAO,SAAS,MAAM,KAAK,SAAS,GAAG;AACzC,aAAO;AAAA,IACT;AACA,YAAQ,OAAO;AAAA,MACb,uCAAuC,QAAQ,oBAAoB,YAAY;AAAA;AAAA,IACjF;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,oBACd,UACA,UACoB;AACpB,MAAI,OAAO,aAAa,YAAY,aAAa,IAAI;AACnD,WAAO;AAAA,EACT;AACA,MAAI,aAAa,UAAa,aAAa,IAAI;AAC7C,WAAO;AAAA,EACT;AACA,SAAO;AACT;AA2CO,SAAS,cAAc,GAAY,UAAwB;AAChE,QAAM,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC;AACxD,QAAM,YAAY;AAClB,QAAM,OAAO,UAAU,QAAQ;AAC/B,QAAM,UAAmC;AAAA,IACvC,OAAO;AAAA,IACP;AAAA,IACA,SAAS,IAAI;AAAA,IACb,WAAW;AAAA,EACb;AACA,aAAW,SAAS,CAAC,WAAW,cAAc,eAAe,aAAa,cAAc,GAAG;AACzF,UAAM,MAAM,UAAU,KAAK;AAC3B,QAAI,QAAQ,UAAa,QAAQ,MAAM;AACrC,cAAQ,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACA,UAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,IAAI,IAAI;AACrD;AAKO,SAAS,aAAa,GAAY,UAAwB;AAC/D,QAAM,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC;AACxD,QAAM,YAAY;AAClB,QAAM,OAAO,UAAU;AACvB,QAAM,SAAS,OAAO,UAAU,IAAI,MAAM,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO;AAC/E,UAAQ,OAAO,MAAM,SAAS,IAAI;AAElC,QAAM,UAAU,UAAU;AAC1B,MAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,GAAG;AACrE,YAAQ,OAAO,MAAM,gBAAgB;AACrC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAkC,GAAG;AACvE,cAAQ,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC;AAAA,CAAI;AAAA,IACzC;AAAA,EACF;AAEA,QAAM,aAAa,UAAU;AAC7B,MAAI,YAAY;AACd,YAAQ,OAAO,MAAM;AAAA,gBAAmB,UAAU;AAAA,CAAI;AAAA,EACxD;AAEA,QAAM,YAAY,UAAU;AAC5B,MAAI,cAAc,UAAa,cAAc,MAAM;AACjD,UAAM,QAAQ,YAAY,QAAQ;AAClC,YAAQ,OAAO,MAAM,gBAAgB,KAAK;AAAA,CAAI;AAAA,EAChD;AAEA,UAAQ,OAAO,MAAM;AAAA,eAAkB,QAAQ;AAAA,CAAI;AACrD;AA2DO,SAAS,UACd,qBACA,UACA,UAAU,OACD;AAET,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,OAAO,wBAAwB,YAAY,wBAAwB,MAAM;AAC3E,oBAAgB,oBAAoB;AACpC,eAAW,oBAAoB,YAAY;AAC3C,cAAU,oBAAoB,WAAW;AACzC,UAAM,oBAAoB;AAC1B,eAAW,oBAAoB;AAC/B,eAAW,oBAAoB;AAC/B,oBAAgB,oBAAoB;AACpC,aAAS,oBAAoB;AAC7B,kBAAc,oBAAoB;AAAA,EACpC,OAAO;AACL,oBAAgB;AAAA,EAClB;AAEA,gBAAc;AAEd,0BAAwB;AAIxB,MAAI;AACF,UAAM,cAAc,IAAI,YAAY;AACpC,mBAAe,WAAW;AAAA,EAC5B,QAAQ;AAAA,EAER;AAGA,QAAM,mBAAmB,YAAiB,eAAS,QAAQ,KAAK,CAAC,KAAK,YAAY,KAAK;AAGvF,QAAM,cAAc,QAAQ,IAAI,4BAA4B,QAAQ,IAAI,wBAAwB;AAChG,cAAY,WAAW;AAGvB,MAAI,QAAQ,YAAY,WAAW;AACjC,YAAQ,OAAO,MAAM,2DAA2D;AAChF,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AAGA,MAAI,KAAK;AACP,eAAW,IAAI;AACf,eAAW,IAAI;AAAA,EACjB;AAGA,MAAI,YAAY,CAAC,UAAU;AACzB,YAAQ,OAAO,MAAM,iEAA4D;AACjF,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AASA,MAAI,YAAY,OAAQ,SAAgD,uBAAuB,YAAY;AACzG,QAAI;AACF,YAAM,UAAU,IAAI;AAAA;AAAA,QAAmC;AAAA,MAAK;AAC5D,MAAC,SAAqE,mBAAmB,OAAO;AAAA,IAClG,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,mBAAmB,aAAa;AAEtC,QAAM,UAAU,IAAID,SAAQ,gBAAgB,EACzC,aAAa,EACb,QAAQ,SAAS,iBAAiB,eAAe,EACjD,WAAW,cAAc,YAAY,EACrC,eAAe,kBAAkB,2DAA2D,EAC5F,YAAY,gEAA2D,EACvE,OAAO,uBAAuB,4CAA4C,SAAS,EACnF,OAAO,aAAa,qEAAqE;AAC5F,UAAQ,cAAc,EAAE,YAAY,oBAAoB,CAAC;AAGzD,MAAI,CAAC,kBAAkB;AACrB,YAAQ,OAAO,2BAA2B,8BAA8B;AACxE,YAAQ,OAAO,yBAAyB,6CAA6C;AACrF,YAAQ,OAAO,oBAAoB,0CAA0C;AAAA,EAC/E;AAMA,MAAI;AACJ,MAAI,uBAAuB,YAAY;AACrC,eAAW;AAAA,EACb,WAAW,gBAAgB,QAAW;AACpC,eAAW,WAAW,cAAc,aAAa,EAAE,iBAAiB,CAAC;AAAA,EACvE,OAAO;AACL,QAAI,UAAmB;AACvB,QAAI;AACF,YAAM,WAAW,IAAI,eAAe;AACpC,gBAAU,SAAS,cAAc,OAAO;AAAA,IAC1C,QAAQ;AACN,gBAAU;AAAA,IACZ;AACA,eAAW,WAAW,SAAS,SAAS,EAAE,iBAAiB,CAAC;AAAA,EAC9D;AAKA,QAAM,aAAa,QAChB,QAAQ,SAAS,EAAE,QAAQ,CAAC,SAAS,eAAe,EAAE,CAAC,EACvD,YAAY,8BAA8B;AAG7C,MAAI,UAAU;AACZ,IAAC,QAA+C,YAAY;AAC5D,QAAI,UAAU;AACZ,MAAC,QAA+C,YAAY;AAAA,IAC9D;AAAA,EACF,OAAO;AACL,UAAM,iBAAiB,iBAClB,QAAQ,IAAI,0BACZ;AACL,SAAK;AAAA,EACP;AAOA,MAAI;AACJ,MAAI;AACF,QAAI,kBAAkB,gBAAgB;AACpC,uBAAiB;AAAA,IACnB,WAAW,OAAO,WAAW,YAAY,WAAW,MAAM;AACxD,uBAAiB,eAAe,WAAW,EAAE,OAAO,CAAC;AAAA,IACvD,OAAO;AACL,uBAAiB,IAAI,eAAe;AAAA,IACtC;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,OAAO,MAAM,yCAAoC,GAAG;AAAA,CAAI;AAChE,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AAEA,4BAA0B,YAAY,UAAU,UAAU,UAAU,cAAc;AAKlF,4BAA0B,SAAS,YAAY,kBAAkB,gBAAgB;AAGjF,UAAQ,YAAY,SAAS;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI,CAAC;AAGZ,mBAAiB,SAAS,kBAAkB,OAAO;AAOnD,MAAI,iBAAiB,cAAc,SAAS,GAAG;AAC7C,eAAW,OAAO,eAAe;AAC/B,YAAM,UAAU,IAAI,KAAK;AACzB,UAAI,qBAAqB,IAAI,OAAO,GAAG;AACrC,gBAAQ,OAAO;AAAA,UACb,8BAA8B,OAAO;AAAA;AAAA,QACvC;AACA,gBAAQ,KAAK,WAAW,iBAAiB;AAAA,MAC3C;AACA,YAAM,WAAW,QAAQ,SAAS,KAAK,CAAC,MAAM,EAAE,KAAK,MAAM,OAAO;AAClE,UAAI,UAAU;AAKZ,cAAM,SACH,SAA0D,wBAAwB;AACrF,YAAI,QAAQ;AACV;AAAA,YACE,kBAAkB,OAAO;AAAA,UAE3B;AACA,gBAAM,OAAO,QAAQ;AACrB,gBAAM,MAAM,KAAK,QAAQ,QAAQ;AACjC,cAAI,OAAO,EAAG,MAAK,OAAO,KAAK,CAAC;AAAA,QAClC,OAAO;AACL,kBAAQ,OAAO;AAAA,YACb,8BAA8B,OAAO;AAAA;AAAA,UACvC;AACA,kBAAQ,KAAK,WAAW,iBAAiB;AAAA,QAC3C;AAAA,MACF;AACA,cAAQ,WAAW,GAAG;AAAA,IACxB;AAAA,EACF;AAIA,UAAQ,KAAK,aAAa,OAAO,gBAAgB;AAC/C,UAAM,OAAO,YAAY,KAAK;AAC9B,UAAM,cAAc,KAAK;AACzB,UAAM,cAAc,KAAK;AACzB,UAAM,wBAAwB,aAAa,WAAW;AAAA,EACxD,CAAC;AAED,SAAO;AACT;AA8BA,SAAS,0BACP,YACA,UACA,UACA,UACA,gBACM;AAMN,QAAM,mBAAmB,MAAa;AACpC,YAAQ,OAAO;AAAA,MACb;AAAA,IAEF;AACA,YAAQ,KAAK,WAAW,cAAc;AAAA,EACxC;AACA,QAAM,oBAA8B,YAAY;AAAA,IAC9C,aAAa,MAAM,iBAAiB;AAAA,IACpC,WAAW,MAAM,iBAAiB;AAAA,EACpC;AAEA,QAAM,QAA2B;AAAA,IAC/B,EAAE,MAAM,QAAqB,kBAAkB,OAAO,UAAU,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,cAAc,EAAE;AAAA,IACjI,EAAE,MAAM,YAAqB,kBAAkB,OAAO,UAAU,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,EAAE;AAAA,IACrH,EAAE,MAAM,QAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,oBAAoB,GAAG,mBAAmB,EAAG,EAAE;AAAA,IAC9H,EAAE,MAAM,YAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,wBAAwB,GAAG,mBAAmB,EAAG,EAAE;AAAA,IAClI,EAAE,MAAM,QAAqB,kBAAkB,OAAO,UAAU,CAAC,MAAM,oBAAoB,CAAC,EAAE;AAAA,IAC9F,EAAE,MAAM,UAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,sBAAsB,GAAG,EAAG,EAAE;AAAA,IAC7G,EAAE,MAAM,SAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,qBAAqB,GAAG,EAAG,EAAE;AAAA,IAC5G,EAAE,MAAM,UAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,sBAAsB,GAAG,EAAG,EAAE;AAAA,IAC7G,EAAE,MAAM,WAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,uBAAuB,GAAG,EAAG,EAAE;AAAA,IAC9G,EAAE,MAAM,UAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,sBAAsB,GAAG,EAAG,EAAE;AAAA,IAC7G,EAAE,MAAM,UAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,sBAAsB,GAAG,EAAG,EAAE;AAAA,IAC7G,EAAE,MAAM,cAAqB,kBAAkB,OAAO,UAAU,CAAC,MAAM,0BAA0B,CAAC,EAAE;AAAA,IACpG,EAAE,MAAM,qBAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,wBAAwB,GAAG,EAAG,EAAE;AAAA,EACjH;AAEA,QAAM,OAAO,SAAS,kBAAkB;AACxC,aAAW,SAAS,OAAO;AAIzB,QAAI;AACJ,QAAI,SAAS,SAAS,SAAS,QAAQ;AAGrC,uBAAiB;AAAA,IACnB,OAAO;AACL,uBACE,mBAAmB,IAAI,MAAM,IAAI,KAAK,SAAS,qBAAqB,MAAM,IAAI;AAAA,IAClF;AACA,QAAI,CAAC,eAAgB;AAMrB,QAAI,MAAM,oBAAoB,CAAC,UAAU;AACvC,UAAI,mBAAmB,IAAI,MAAM,IAAI,GAAG;AACtC;AAAA,UACE,SAAS,MAAM,IAAI,2HACgD,MAAM,IAAI;AAAA,QAC/E;AAAA,MACF;AACA;AAAA,IACF;AAEA,UAAM,SAAS,YAAY,UAAU,QAAQ;AAAA,EAC/C;AACF;AAsCA,SAAS,0BACP,MACA,YACA,kBACA,SACM;AACN,MAAI,iBAAkB;AACtB,aAAW,QAAQ,2BAA2B;AAC5C,UAAM,WAAW,WAAW,SAAS,KAAK,CAAC,MAAM,EAAE,KAAK,MAAM,IAAI;AAClE,QAAI,CAAC,SAAU;AACf,QAAI,KAAK,SAAS,KAAK,CAAC,MAAM,EAAE,KAAK,MAAM,IAAI,EAAG;AAElD,UAAM,OAAO,KACV,QAAQ,IAAI,EACZ,YAAY,qBAAqB,OAAO,UAAU,IAAI,YAAY,EAClE,mBAAmB,IAAI,EACvB,qBAAqB,IAAI,EACzB,WAAW,KAAK;AAInB,IAAC,KAA4C,sBAAsB;AACnE,SAAK,OAAO,iBAA+B;AACzC,cAAQ,OAAO;AAAA,QACb,aAAa,IAAI,iDACP,OAAO,UAAU,IAAI;AAAA;AAAA;AAAA,MAGjC;AAKA,YAAM,OAAO,wBAAwB,IAAI;AACzC,YAAM,SAAS,WAAW,MAAM,EAAE,MAAM,OAAO,CAAC;AAAA,IAClD,CAAC;AAAA,EACH;AACF;AAUA,SAAS,wBAAwB,MAAyB;AACxD,QAAM,YAAY,KAAK,QAAQ,CAAC,GAAG,MAAM;AACzC,MAAI,SAAS,SAAS,EAAG,QAAO;AAChC,QAAM,WAAW,KAAK,KAAK;AAC3B,QAAM,MAAM,QAAQ,KAAK,QAAQ,QAAQ;AACzC,MAAI,MAAM,EAAG,QAAO,CAAC;AACrB,SAAO,QAAQ,KAAK,MAAM,MAAM,CAAC;AACnC;AAwBO,SAAS,qBAAqB,UAAuD;AAC1F,SAAO,kBAAkB,IAAI,QAAQ;AACvC;AAKO,SAAS,yBAA+B;AAC7C,oBAAkB,MAAM;AAC1B;AAEA,eAAsB,wBACpB,aACA,aACe;AACf,MAAI,CAAC,eAAe,CAAC,aAAa;AAChC;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AAGF,UAAM,gBAAgB;AACtB,cAAU,MAAM;AAAA;AAAA,MAA0B;AAAA;AAAA,EAC5C,QAAQ;AACN,SAAQ,kEAA6D;AACrE;AAAA,EACF;AAKA,MAAI,aAAa;AACf,SAAQ,6DAA6D;AAAA,EACvE;AAEA,MAAI,aAAa;AACf,QAAI;AACF,YAAM,0BAA0B,SAAS,WAAW;AAAA,IACtD,SAAS,KAAK;AACZ,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,WAAQ,2CAA2C,WAAW,MAAM,GAAG,EAAE;AAAA,IAC3E;AAAA,EACF;AACF;AASA,eAAe,0BACb,SACA,aACe;AACf,QAAM,oBAAoB,QAAQ;AAGlC,QAAM,sBAAsB,QAAQ;AAIpC,MAAI,CAAC,qBAAqB,CAAC,qBAAqB;AAE9C;AAAA,EACF;AAEA,QAAM,SAAS,IAAI,kBAAkB;AACrC,QAAM,UAAU,OAAO,KAAK,WAAW;AACvC,QAAM,WAAW,IAAI,oBAAoB;AACzC,QAAM,WAAW,SAAS,QAAQ,SAAS,EAAE,YAAY,CAAC;AAE1D,aAAW,OAAO,UAAU;AAC1B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AACrC,UAAM,QAAQ;AACd,UAAM,KAAK,OAAO,MAAM,aAAa,WAAW,MAAM,WAAW;AACjE,QAAI,CAAC,GAAI;AACT,UAAM,OAAQ,MAAM,YAAoD,CAAC;AACzE,UAAM,UAAU,KAAK;AACrB,QAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,GAAG;AACrE,wBAAkB,IAAI,IAAI,OAAkC;AAAA,IAC9D;AAAA,EACF;AACF;AASO,SAAS,KAAK,UAAyB;AAC5C,gBAAc,eAAe;AAC7B,QAAM,UAAU,UAAU,QAAW,UAAU,WAAW;AAE1D,MAAI;AACF,YAAQ,MAAM,QAAQ,IAAI;AAAA,EAC5B,SAAS,OAAgB;AACvB,QAAI,iBAAiB,gBAAgB;AAEnC,cAAQ,KAAK,MAAM,QAAQ;AAAA,IAC7B;AACA,UAAM,OAAO,iBAAiB,KAAK;AACnC,QAAI,iBAAiB,OAAO;AAC1B,cAAQ,OAAO,MAAM,UAAU,MAAM,OAAO;AAAA,CAAI;AAAA,IAClD;AACA,YAAQ,KAAK,IAAI;AAAA,EACnB;AACF;AAYO,SAAS,mBACd,WACA,UACA,oBAAoB,KACpB,SACA,UAAU,aACD;AACT,QAAM,WAAW,UAAU;AAC3B,MAAI,iBAA0C,CAAC;AAC/C,MAAI,gBAAgC,CAAC;AAGrC,QAAM,UAAU,WAAW,SAAS;AACpC,QAAM,aAAc,QAAQ,OAAO,OAAO,QAAQ,QAAQ,YAAY,CAAC,MAAM,QAAQ,QAAQ,GAAG,IAC3F,QAAQ,MACT,CAAC;AACL,QAAM,mBAA2B,WAAY,WAAW,SAAgC;AACxF,QAAM,UAAmB,WAAW,eAAsC,UAAU;AAGpF,QAAM,cAAc,UAAU;AAC9B,MAAI,eAAe,OAAO,gBAAgB,YAAY,YAAY,YAAY;AAC5E,QAAI;AACF,uBAAiB,YAAY,aAAa,IAAI,QAAQ;AAAA,IACxD,QAAQ;AACN,uBAAiB;AAAA,IACnB;AACA,oBAAgB,mBAAmB,gBAAgB,iBAAiB;AAAA,EACtE;AAEA,QAAM,MAAM,IAAIA,SAAQ,gBAAgB,EAAE,YAAY,OAAO;AAG7D,QAAM,WAAW,IAAIC,QAAO,oBAAoB,sEAAsE;AACtH,QAAM,SAAS,IAAIA,QAAO,aAAa,wDAAwD,EAAE,QAAQ,KAAK;AAC9G,QAAM,gBAAgB,IAAIA,QAAO,iBAAiB,sFAAsF,EAAE,QAAQ,KAAK;AACvJ,QAAM,YAAY,IAAIA,QAAO,qBAAqB,+CAA+C,EAC9F,QAAQ,CAAC,QAAQ,SAAS,OAAO,QAAQ,OAAO,CAAC;AACpD,QAAM,YAAY,IAAIA,QAAO,qBAAqB,kFAAkF;AAEpI,QAAM,aAAa,IAAIA,QAAO,aAAa,gFAAgF,EAAE,QAAQ,KAAK,EAAE,SAAS;AAErJ,QAAM,YAAY,IAAIA,QAAO,aAAa,8EAA8E,EAAE,QAAQ,KAAK;AAEvI,QAAM,WAAW,IAAIA,QAAO,WAAW,sEAAsE,EAAE,QAAQ,KAAK;AAE5H,QAAM,YAAY,IAAIA,QAAO,YAAY,gFAAgF,EAAE,QAAQ,KAAK;AAExI,QAAM,cAAc,IAAIA,QAAO,qBAAqB,kFAAkF,EACnI,QAAQ,CAAC,YAAY,YAAY,WAAW,eAAe,SAAS,CAAC;AAExE,QAAM,qBAAqB,IAAIA,QAAO,gCAAgC,4DAA4D,EAAE,UAAU,QAAQ;AACtJ,QAAM,mBAAmB,IAAIA,QAAO,4BAA4B,4EAA4E;AAE5I,MAAI,CAAC,SAAS;AACZ,aAAS,SAAS;AAClB,WAAO,SAAS;AAChB,kBAAc,SAAS;AACvB,cAAU,SAAS;AACnB,cAAU,SAAS;AACnB,cAAU,SAAS;AACnB,aAAS,SAAS;AAClB,cAAU,SAAS;AACnB,gBAAY,SAAS;AACrB,uBAAmB,SAAS;AAC5B,qBAAiB,SAAS;AAAA,EAC5B;AAEA,MAAI,UAAU,QAAQ;AACtB,MAAI,UAAU,MAAM;AACpB,MAAI,UAAU,aAAa;AAC3B,MAAI,UAAU,SAAS;AACvB,MAAI,UAAU,SAAS;AACvB,MAAI,UAAU,UAAU;AACxB,MAAI,UAAU,SAAS;AACvB,MAAI,UAAU,QAAQ;AACtB,MAAI,UAAU,SAAS;AACvB,MAAI,UAAU,WAAW;AACzB,MAAI,UAAU,kBAAkB;AAChC,MAAI,UAAU,gBAAgB;AAG9B,QAAM,cAAwB,CAAC;AAC/B,MAAI,CAAC,SAAS;AACZ,gBAAY,KAAK,wEAAwE;AAAA,EAC3F;AACA,MAAI,SAAS;AACX,gBAAY,KAAK,SAAS,OAAO,aAAa,gBAAgB,EAAE;AAAA,EAClE;AACA,MAAI,YAAY,SAAS,GAAG;AAC1B,QAAI,YAAY,SAAS,OAAO,YAAY,KAAK,IAAI,IAAI,IAAI;AAAA,EAC/D;AAGA,aAAW,OAAO,eAAe;AAC/B,QAAI,IAAI,UAAU;AAChB,UAAI,OAAO,IAAI,OAAO,IAAI,aAAa,IAAI,UAAU,IAAI,YAAY;AAAA,IACvE,OAAO;AACL,UAAI,OAAO,IAAI,OAAO,IAAI,aAAa,IAAI,YAA4C;AAAA,IACzF;AAAA,EACF;AAGA,MAAI,OAAO,OAAO,YAAqC;AAErD,UAAM,YAAY,QAAQ;AAC1B,UAAM,cAAc,QAAQ;AAC5B,UAAM,aAAa,QAAQ;AAC3B,UAAM,eAAe,QAAQ;AAC7B,UAAM,eAAe,QAAQ;AAC7B,UAAM,iBAAiB,QAAQ;AAC/B,UAAM,SAAS,QAAQ;AACvB,UAAM,YAAY,QAAQ;AAC1B,UAAM,aAAa,QAAQ;AAC3B,UAAM,eAAe,oBAAoB,QAAQ,UAAU,QAAQ,IAAI,mBAAmB;AAC1F,UAAM,kBAAkB;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ,IAAI;AAAA,MACZ;AAAA,IACF;AACA,UAAM,gBAAgB,QAAQ;AAG9B,UAAM,eAAwC,CAAC;AAC/C,UAAM,cAAc,oBAAI,IAAI;AAAA,MAC1B;AAAA,MAAS;AAAA,MAAO;AAAA,MAAc;AAAA,MAAU;AAAA,MAAU;AAAA,MAAW;AAAA,MAC7D;AAAA,MAAU;AAAA,MAAS;AAAA,MAAU;AAAA,MAAY;AAAA,MAAmB;AAAA,IAC9D,CAAC;AACD,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,UAAI,CAAC,YAAY,IAAI,CAAC,GAAG;AACvB,qBAAa,CAAC,IAAI;AAAA,MACpB;AAAA,IACF;AAEA,QAAI,SAAkC,CAAC;AACvC,UAAM,YAAY,YAAY,IAAI;AAElC,QAAI;AAEF,eAAS,MAAM,aAAa,WAAW,cAAc,UAAU;AAG/D,YAAM,cAAc,oBAAoB,QAAQ,aAAa;AAC7D,eAAS;AAGT,UAAI,QAAQ;AACV,YAAI,CAAC,SAAS,UAAU;AACtB,kBAAQ,OAAO,MAAM,8CAA8C;AACnE,kBAAQ,KAAK,WAAW,oBAAoB;AAAA,QAC9C;AACA,cAAM,YAAY,MAAM,SAAS,SAAS,UAAU,MAAM;AAC1D,8BAAsB,WAAW,YAAY;AAE7C,YAAI,WAAW;AACb,gBAAM,YAAY,oBAAI,IAAI;AAAA,YACxB;AAAA,YAAoB;AAAA,YAAoB;AAAA,YAAiB;AAAA,YAAa;AAAA,UACxE,CAAC;AACD,gBAAM,WAAW;AAAA,YACf;AAAA,YAAoB;AAAA,YAAoB;AAAA,YAAiB;AAAA,YACzD;AAAA,YAAiB;AAAA,YAAqB;AAAA,YAAoB;AAAA,YAC1D;AAAA,YAAqB;AAAA,YAAoB;AAAA,UAC3C;AACA,kBAAQ,OAAO,MAAM,iCAAiC;AACtD,qBAAW,KAAK,UAAU;AACxB,gBAAI,UAAU,IAAI,CAAC,GAAG;AACpB,sBAAQ,OAAO,MAAM,YAAY,EAAE,OAAO,EAAE,CAAC;AAAA,CAAgC;AAAA,YAC/E,OAAO;AACL,sBAAQ,OAAO,MAAM,YAAY,EAAE,OAAO,EAAE,CAAC;AAAA,CAAuC;AAAA,YACtF;AAAA,UACF;AAAA,QACF;AACA,gBAAQ,KAAK,UAAU,QAAQ,IAAI,oBAAoB,SAAS,CAAC;AAAA,MACnE;AAGA,UAAI,eAAe;AACjB,eAAO,kBAAkB;AAAA,MAC3B;AAGA,YAAM,cAAc,WAAW,aAAa,eAAe;AAK3D,UAAI,YAAY;AAEd,YAAI,cAAc,YAAY,MAAM,SAAS;AAC3C,kBAAQ,OAAO,MAAM,4EAA4E;AAAA,QACnG;AACA,cAAM,cAAc,UAAU;AAC9B,cAAM,cAAc,aAAa,cAAc;AAC/C,YAAI,CAAC,aAAa;AAChB,kBAAQ,OAAO;AAAA,YACb,oBAAoB,QAAQ;AAAA;AAAA,UAC9B;AAAA,QACF;AAEA,YAAI,eAAe,SAAS,QAAQ;AAClC,cAAI,SAAS;AACb,2BAAiB,SAAS,SAAS,OAAO,UAAU,MAAM,GAAG;AAC3D;AACA,oBAAQ,OAAO,MAAM,KAAK,UAAU,KAAK,IAAI,IAAI;AACjD,gBAAI,QAAQ,OAAO,OAAO;AACxB,sBAAQ,OAAO,MAAM,eAAe,QAAQ,QAAQ,MAAM,UAAU;AAAA,YACtE;AAAA,UACF;AACA,cAAI,QAAQ,OAAO,OAAO;AACxB,oBAAQ,OAAO,MAAM,IAAI;AAAA,UAC3B;AACA,gBAAMC,cAAa,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;AAG3D,gBAAM,EAAE,gBAAAC,gBAAe,IAAI,MAAM;AACjC,gBAAMC,eAAcD,gBAAe;AACnC,cAAIC,cAAa;AACf,YAAAA,aAAY,aAAa,UAAU,QAAQ,WAAW,GAAGF,WAAU;AAAA,UACrE;AACA;AAAA,QACF;AAAA,MAEF;AAGA,UAAI,aAAa,SAAS,eAAe;AACvC,cAAM,CAACG,SAAQ,KAAK,IAAI,MAAM,SAAS;AAAA,UACrC;AAAA,UACA;AAAA,UACA,eAAe,EAAE,UAAU,aAAa,IAAI;AAAA,QAC9C;AACA,cAAMH,cAAa,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;AAG3D,cAAM,WAAW,cAAc,YAAY;AAC3C,YAAI,aAAa,UAAU,CAAC,QAAQ,OAAO,OAAO;AAIhD,gBAAM,YAAY;AAAA,YAChB,UAAU,MAAM;AAAA,YAChB,mBAAmB,MAAM;AAAA,YACzB,SAAS,MAAM;AAAA,YACf,OAAO,MAAM,MAAM,IAAI,CAAC,OAAO;AAAA,cAC7B,MAAM,EAAE;AAAA,cACR,aAAa,EAAE;AAAA,cACf,SAAS,EAAE;AAAA,cACX,GAAI,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,KAAK,IAAI,CAAC;AAAA,YAC3D,EAAE;AAAA,UACJ;AACA,cAAI;AACJ,cAAI,OAAOG,YAAW,YAAYA,YAAW,QAAQ,CAAC,MAAM,QAAQA,OAAM,GAAG;AAC3E,qBAAS,EAAE,GAAIA,SAAoC,QAAQ,UAAU;AAAA,UACvE,OAAO;AACL,qBAAS,EAAE,QAAAA,SAAQ,QAAQ,UAAU;AAAA,UACvC;AACA,kBAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAAA,QAC7D,OAAO;AACL,2BAAiBA,SAAQ,cAAc,YAAY;AAEnD,gBAAM,YAAY,MAAM,MAAM;AAC9B,kBAAQ,OAAO;AAAA,YACb;AAAA,4BAA+B,MAAM,YAAY,KAC9C,SAAS,WAAW,MAAM,gBAAgB,QAAQ,CAAC,CAAC;AAAA;AAAA,UACzD;AACA,qBAAW,KAAK,MAAM,OAAO;AAC3B,gBAAI,EAAE,SAAS;AACb,oBAAM,SAAS,EAAE,cAAc;AAC/B,sBAAQ,OAAO,MAAM,YAAY,EAAE,KAAK,OAAO,EAAE,CAAC,IAAI,SAAS,SAAS,CAAC,CAAC,cAAc,MAAM;AAAA,CAAK;AAAA,YACrG,OAAO;AACL,sBAAQ,OAAO,MAAM,YAAY,EAAE,KAAK,OAAO,EAAE,CAAC,KAAK,EAAE,WAAW,QAAQ,CAAC,IAAI,MAAM,SAAS,CAAC,CAAC;AAAA,CAAI;AAAA,YACxG;AAAA,UACF;AAAA,QACF;AAEA,cAAM,EAAE,gBAAgB,OAAO,IAAI,MAAM;AACzC,cAAM,MAAM,OAAO;AACnB,YAAI,KAAK;AACP,cAAI,aAAa,UAAU,QAAQ,WAAW,GAAGH,WAAU;AAAA,QAC7D;AACA;AAAA,MACF;AAGA,UAAI;AACJ,UAAI,gBAAgB,SAAS,eAAe;AAE1C,cAAM,CAAC,GAAG,IAAI,MAAM,SAAS;AAAA,UAC3B;AAAA,UACA;AAAA,UACA,EAAE,UAAU,aAAa;AAAA,QAC3B;AACA,iBAAS;AACT,YAAI,iBAAiB,cAAc,QAAQ,OAAO,OAAO;AACvD,kBAAQ,OAAO,MAAM,mBAAmB,YAAY;AAAA,CAAe;AAAA,QACrE;AAAA,MACF,OAAO;AACL,cAAM,EAAE,SAAAI,SAAQ,IAAI,MAAM;AAC1B,cAAM,UAAU,IAAIA,SAAQ,cAAc;AAC1C,iBAAS,MAAM,QAAQ,QAAQ,UAAU,QAAQ,QAAQ;AAAA,MAC3D;AACA,YAAM,aAAa,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;AAG3D,uBAAiB,QAAQ,cAAc,YAAY;AAInD,YAAM,EAAE,gBAAAH,gBAAe,IAAI,MAAM;AACjC,YAAM,cAAcA,gBAAe;AACnC,UAAI,aAAa;AACf,oBAAY,aAAa,UAAU,QAAQ,WAAW,GAAG,UAAU;AAAA,MACrE;AAAA,IACF,SAAS,KAAc;AAErB,YAAM,WAAW,iBAAiB,GAAG;AACrC,YAAM,aAAa,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;AAG3D,UAAI;AACF,cAAM,EAAE,gBAAAA,gBAAe,IAAI,MAAM;AACjC,cAAM,cAAcA,gBAAe;AACnC,YAAI,aAAa;AACf,sBAAY,aAAa,UAAU,QAAQ,SAAS,UAAU,UAAU;AAAA,QAC1E;AAAA,MACF,QAAQ;AAAA,MAER;AAEA,UAAI,iBAAiB,UAAU,CAAC,QAAQ,OAAO,OAAO;AACpD,sBAAc,KAAK,QAAQ;AAAA,MAC7B,OAAO;AACL,qBAAa,KAAK,QAAQ;AAAA,MAC5B;AACA,cAAQ,KAAK,QAAQ;AAAA,IACvB;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAcO,SAAS,iBAAiB,UAAwB;AACvD,MAAI,SAAS,SAAS,KAAK;AACzB,YAAQ,OAAO;AAAA,MACb,qCAAqC,QAAQ;AAAA;AAAA,IAC/C;AACA,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AACA,MAAI,CAAC,wCAAwC,KAAK,QAAQ,GAAG;AAC3D,YAAQ,OAAO;AAAA,MACb,qCAAqC,QAAQ;AAAA;AAAA,IAC/C;AACA,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AACF;AASA,eAAsB,aACpB,WACA,YAAqC,CAAC,GACtC,YACkC;AAElC,QAAM,mBAA4C,CAAC;AACnD,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC9C,QAAI,MAAM,QAAQ,MAAM,QAAW;AACjC,uBAAiB,CAAC,IAAI;AAAA,IACxB;AAAA,EACF;AAEA,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI,cAAc,KAAK;AACrB,UAAM,MAAM,UAAU;AACtB,aAAS;AAAA,EACX,OAAO;AAEL,aAAS,SAAS,SAAS;AAC3B,QAAI;AACF,YAAMN,cAAa,WAAW,OAAO;AAAA,IACvC,SAAS,KAAK;AACZ,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,cAAQ,OAAO,MAAM,+BAA+B,MAAM,KAAK,GAAG;AAAA,CAAI;AACtE,cAAQ,KAAK,WAAW,iBAAiB;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,WAAW,KAAK,OAAO;AAC9C,MAAI,UAAU,YAAc,CAAC,YAAY;AACvC,YAAQ,OAAO;AAAA,MACb,UAAU,MAAM;AAAA;AAAA,IAClB;AACA,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AAEA,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,YAAQ,OAAO,MAAM,UAAU,MAAM;AAAA,CAAiC;AACtE,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AAEA,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,YAAQ,OAAO;AAAA,MACb,UAAU,MAAM,gCAAgC,MAAM,QAAQ,MAAM,IAAI,UAAU,OAAO,MAAM;AAAA;AAAA,IACjG;AACA,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AAGA,SAAO,EAAE,GAAI,QAAoC,GAAG,iBAAiB;AACvE;AAKA,SAAS,YAA6B;AACpC,SAAO,IAAI,QAAQ,CAACU,UAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,UAAM,SAAS,CAAC,UAAkB,OAAO,KAAK,KAAK;AACnD,UAAM,QAAQ,MAAM;AAClB,cAAQ;AACR,MAAAA,SAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,OAAO,CAAC;AAAA,IACjD;AACA,UAAM,UAAU,CAAC,QAAe;AAC9B,cAAQ;AACR,aAAO,GAAG;AAAA,IACZ;AACA,UAAM,UAAU,MAAM;AACpB,cAAQ,MAAM,eAAe,QAAQ,MAAM;AAC3C,cAAQ,MAAM,eAAe,OAAO,KAAK;AACzC,cAAQ,MAAM,eAAe,SAAS,OAAO;AAAA,IAC/C;AACA,YAAQ,MAAM,GAAG,QAAQ,MAAM;AAC/B,YAAQ,MAAM,GAAG,OAAO,KAAK;AAC7B,YAAQ,MAAM,GAAG,SAAS,OAAO;AACjC,YAAQ,MAAM,OAAO;AAAA,EACvB,CAAC;AACH;AAUO,SAAS,oBACd,QACA,SACyB;AACzB,QAAM,SAAS,EAAE,GAAG,OAAO;AAC3B,aAAW,OAAO,SAAS;AACzB,QAAI,CAAC,IAAI,kBAAmB;AAC5B,UAAM,YAAY,IAAI;AACtB,QAAI,EAAE,aAAa,WAAW,OAAO,SAAS,MAAM,QAAQ,OAAO,SAAS,MAAM,QAAW;AAC3F;AAAA,IACF;AACA,UAAM,SAAS,OAAO,OAAO,SAAS,CAAC;AACvC,UAAM,WAAW,IAAI,kBAAkB,MAAM;AAC7C,QAAI,aAAa,OAAO;AACtB,aAAO,SAAS,IAAI,SAAS,QAAQ,EAAE;AAAA,IACzC,WAAW,aAAa,SAAS;AAC/B,aAAO,SAAS,IAAI,WAAW,MAAM;AAAA,IACvC,WAAW,aAAa,QAAQ;AAC9B,aAAO,SAAS,IAAI,OAAO,YAAY,MAAM;AAAA,IAC/C;AAAA,EACF;AACA,SAAO;AACT;AApzCA,IA8CMC,YAGK,aAQA,SA2DP,SAqYE,oBAsGA,2BAiGA;AAhsBN;AAAA;AAAA;AAAA;AAaA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAMA;AAQA;AACA;AAEA;AACA;AAEA;AAEA,IAAMA,aAAiB,cAAQV,eAAc,YAAY,GAAG,CAAC;AAGtD,IAAI,cAAc;AAQlB,IAAI,UAAyB;AA2DpC,IAAI,UAAU;AACd,QAAI;AACF,YAAM,MAAM,KAAK,MAAMD,cAAkB,cAAQW,YAAW,iBAAiB,GAAG,OAAO,CAAC;AACxF,gBAAU,IAAI;AAAA,IAChB,QAAQ;AAAA,IAER;AA+XA,IAAM,qBAA0C,oBAAI,IAAY,CAAC,MAAM,CAAC;AAsGxE,IAAM,4BAA+C;AAAA,MACnD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAmFA,IAAM,oBAAoB,oBAAI,IAAqC;AAAA;AAAA;;;AChsBnE;AASA,IAAM,aAAa,QAAQ,KAAK,QAAQ,2BAA2B;AACnE,IAAI,eAAe,IAAI;AACrB,QAAM,WAAW,QAAQ,KAAK,aAAa,CAAC;AAC5C,MAAI,CAAC,UAAU;AACb,YAAQ,OAAO,MAAM,4DAA4D;AACjF,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,kEAAqC,KAAK,CAAC,EAAE,kBAAAC,kBAAiB,MAAM;AAClE,IAAAA,kBAAiB,QAAQ,EAAE,MAAM,CAAC,QAAiB;AACjD,cAAQ,OAAO,MAAM,yBAAyB,GAAG;AAAA,CAAI;AACrD,cAAQ,KAAK,CAAC;AAAA,IAChB,CAAC;AAAA,EACH,CAAC;AACH,OAAO;AACL,4DAAyB,KAAK,CAAC,EAAE,MAAAC,MAAK,MAAM;AAC1C,IAAAA,MAAK,YAAY;AAAA,EACnB,CAAC;AACH;","names":["join","resolve","resolve","sep","path","fs","yaml","docsUrl","fs","path","crypto","os","hostname","Command","Option","Sandbox","Command","Command","Option","readFileSync","fileURLToPath","path","Command","Option","durationMs","getAuditLogger","auditLogger","result","Sandbox","resolve","__dirname","runSandboxRunner","main"]}
+{"version":3,"sources":["../../node_modules/.pnpm/tsup@8.5.1_postcss@8.5.8_typescript@5.9.3/node_modules/tsup/assets/esm_shims.js","../../src/errors.ts","../../src/security/sandbox.ts","../../src/ref-resolver.ts","../../src/logger.ts","../../src/schema-parser.ts","../../src/approval.ts","../../src/output.ts","../../src/init-cmd.ts","../../src/display-helpers.ts","../../src/config.ts","../../src/shell.ts","../../src/security/audit.ts","../../src/system-usage.ts","../../src/security/config-encryptor.ts","../../src/security/auth.ts","../../src/security/index.ts","../../src/discovery.ts","../../src/system-cmd.ts","../../src/strategy.ts","../../src/builtin-group.ts","../../src/exposure.ts","../../src/canonical-help.ts","../../src/validate.ts","../../src/main.ts","../../bin/apcore-cli.ts"],"sourcesContent":["// Shim globals in esm bundle\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nconst getFilename = () => fileURLToPath(import.meta.url)\nconst getDirname = () => path.dirname(getFilename())\n\nexport const __dirname = /* @__PURE__ */ getDirname()\nexport const __filename = /* @__PURE__ */ getFilename()\n","/**\n * Error classes and exit code mapping for apcore-cli.\n *\n * Protocol spec: Error handling & exit codes\n */\n\n// ---------------------------------------------------------------------------\n// Error classes\n// ---------------------------------------------------------------------------\n\n/** Thrown when the user does not approve module execution within the timeout. */\nexport class ApprovalTimeoutError extends Error {\n  constructor(message = \"Approval timed out\") {\n    super(message);\n    this.name = \"ApprovalTimeoutError\";\n  }\n}\n\n/** Thrown when API key authentication fails or is missing. */\nexport class AuthenticationError extends Error {\n  constructor(message = \"Authentication failed\") {\n    super(message);\n    this.name = \"AuthenticationError\";\n  }\n}\n\n/** Thrown when encrypted config cannot be decrypted. */\nexport class ConfigDecryptionError extends Error {\n  constructor(message = \"Config decryption failed\") {\n    super(message);\n    this.name = \"ConfigDecryptionError\";\n  }\n}\n\n/** Thrown when module execution fails. */\nexport class ModuleExecutionError extends Error {\n  constructor(message = \"Module execution failed\") {\n    super(message);\n    this.name = \"ModuleExecutionError\";\n  }\n}\n\n/** Thrown when approval is denied by the user. */\nexport class ApprovalDeniedError extends Error {\n  constructor(message = \"Approval denied\") {\n    super(message);\n    this.name = \"ApprovalDeniedError\";\n  }\n}\n\n/** Thrown when schema validation fails. */\nexport class SchemaValidationError extends Error {\n  constructor(message = \"Schema validation failed\") {\n    super(message);\n    this.name = \"SchemaValidationError\";\n  }\n}\n\n/** Thrown when a module is not found. */\nexport class ModuleNotFoundError extends Error {\n  constructor(message = \"Module not found\") {\n    super(message);\n    this.name = \"ModuleNotFoundError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Exit code map\n// ---------------------------------------------------------------------------\n\nexport const EXIT_CODES = {\n  SUCCESS: 0,\n  MODULE_EXECUTE_ERROR: 1,\n  MODULE_TIMEOUT: 1,\n  INVALID_CLI_INPUT: 2,\n  MODULE_NOT_FOUND: 44,\n  MODULE_LOAD_ERROR: 44,\n  MODULE_DISABLED: 44,\n  DEPENDENCY_NOT_FOUND: 44,\n  DEPENDENCY_VERSION_MISMATCH: 44,\n  SCHEMA_VALIDATION_ERROR: 45,\n  APPROVAL_DENIED: 46,\n  APPROVAL_TIMEOUT: 46,\n  CONFIG_NOT_FOUND: 47,\n  CONFIG_INVALID: 47,\n  SCHEMA_CIRCULAR_REF: 48,\n  ACL_DENIED: 77,\n  // Config Bus errors (apcore >= 0.15.0)\n  CONFIG_NAMESPACE_RESERVED: 78,\n  CONFIG_NAMESPACE_DUPLICATE: 78,\n  CONFIG_ENV_PREFIX_CONFLICT: 78,\n  CONFIG_ENV_MAP_CONFLICT: 78,\n  CONFIG_MOUNT_ERROR: 66,\n  CONFIG_BIND_ERROR: 65,\n  ERROR_FORMATTER_DUPLICATE: 70,\n  KEYBOARD_INTERRUPT: 130,\n} as const;\n\nexport type ExitCode = (typeof EXIT_CODES)[keyof typeof EXIT_CODES];\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Map a caught error to the appropriate process exit code.\n * Also checks for apcore error codes on the error object.\n */\nexport function exitCodeForError(error: unknown): ExitCode {\n  if (error instanceof ApprovalTimeoutError) {\n    return EXIT_CODES.APPROVAL_TIMEOUT;\n  }\n  if (error instanceof ApprovalDeniedError) {\n    return EXIT_CODES.APPROVAL_DENIED;\n  }\n  if (error instanceof AuthenticationError) {\n    return EXIT_CODES.ACL_DENIED;\n  }\n  if (error instanceof ConfigDecryptionError) {\n    return EXIT_CODES.CONFIG_INVALID;\n  }\n  if (error instanceof SchemaValidationError) {\n    return EXIT_CODES.SCHEMA_VALIDATION_ERROR;\n  }\n  if (error instanceof ModuleNotFoundError) {\n    return EXIT_CODES.MODULE_NOT_FOUND;\n  }\n  if (error instanceof ModuleExecutionError) {\n    return EXIT_CODES.MODULE_EXECUTE_ERROR;\n  }\n\n  // Check for apcore error codes on the error object\n  if (error instanceof Error) {\n    const code = (error as unknown as Record<string, unknown>).code as string | undefined;\n    const codeMap: Record<string, ExitCode> = {\n      MODULE_NOT_FOUND: EXIT_CODES.MODULE_NOT_FOUND,\n      MODULE_LOAD_ERROR: EXIT_CODES.MODULE_LOAD_ERROR,\n      MODULE_DISABLED: EXIT_CODES.MODULE_DISABLED,\n      DEPENDENCY_NOT_FOUND: EXIT_CODES.DEPENDENCY_NOT_FOUND,\n      DEPENDENCY_VERSION_MISMATCH: EXIT_CODES.DEPENDENCY_VERSION_MISMATCH,\n      SCHEMA_VALIDATION_ERROR: EXIT_CODES.SCHEMA_VALIDATION_ERROR,\n      SCHEMA_CIRCULAR_REF: EXIT_CODES.SCHEMA_CIRCULAR_REF,\n      APPROVAL_DENIED: EXIT_CODES.APPROVAL_DENIED,\n      APPROVAL_TIMEOUT: EXIT_CODES.APPROVAL_TIMEOUT,\n      APPROVAL_PENDING: EXIT_CODES.APPROVAL_DENIED,\n      CONFIG_NOT_FOUND: EXIT_CODES.CONFIG_NOT_FOUND,\n      CONFIG_INVALID: EXIT_CODES.CONFIG_INVALID,\n      MODULE_EXECUTE_ERROR: EXIT_CODES.MODULE_EXECUTE_ERROR,\n      MODULE_TIMEOUT: EXIT_CODES.MODULE_TIMEOUT,\n      ACL_DENIED: EXIT_CODES.ACL_DENIED,\n      // Config Bus errors (apcore >= 0.15.0)\n      CONFIG_NAMESPACE_RESERVED: EXIT_CODES.CONFIG_NAMESPACE_RESERVED,\n      CONFIG_NAMESPACE_DUPLICATE: EXIT_CODES.CONFIG_NAMESPACE_DUPLICATE,\n      CONFIG_ENV_PREFIX_CONFLICT: EXIT_CODES.CONFIG_ENV_PREFIX_CONFLICT,\n      CONFIG_ENV_MAP_CONFLICT: EXIT_CODES.CONFIG_ENV_MAP_CONFLICT,\n      CONFIG_MOUNT_ERROR: EXIT_CODES.CONFIG_MOUNT_ERROR,\n      CONFIG_BIND_ERROR: EXIT_CODES.CONFIG_BIND_ERROR,\n      ERROR_FORMATTER_DUPLICATE: EXIT_CODES.ERROR_FORMATTER_DUPLICATE,\n    };\n    if (code && code in codeMap) {\n      return codeMap[code];\n    }\n  }\n\n  return EXIT_CODES.MODULE_EXECUTE_ERROR;\n}\n","/**\n * Sandbox — Subprocess isolation for module execution.\n *\n * Protocol spec: Security — sandboxed execution (tech-design §8.6.4).\n *\n * Uses a re-exec model: spawns `node <this-binary> --internal-sandbox-runner\n * <module_id>` with a stripped environment and isolated HOME/TMPDIR.\n * The child reads JSON from stdin, runs the module via a fresh\n * Registry+Executor, and writes JSON to stdout.\n */\n\nimport type { Executor } from \"../cli.js\";\nimport { ModuleExecutionError } from \"../errors.js\";\n\n// Environment forwarding strategy: allow PATH, LANG, LC_ALL + all APCORE_*\n// except APCORE_AUTH_* (credentials must not cross the trust boundary).\nconst SANDBOX_ALLOW_KEYS = [\"PATH\", \"LANG\", \"LC_ALL\"];\nconst SANDBOX_ALLOW_PREFIX = \"APCORE_\";\nconst SANDBOX_DENY_PREFIX = \"APCORE_AUTH_\";\n// Explicit deny-list for known credential keys (defense-in-depth mirroring Rust).\nconst SANDBOX_DENY_KEYS: readonly string[] = [\"APCORE_AUTH_API_KEY\"];\n\nconst SANDBOX_DEFAULT_OUTPUT_SIZE_LIMIT = 64 * 1024 * 1024; // 64 MiB\n\n// ---------------------------------------------------------------------------\n// Sandbox\n// ---------------------------------------------------------------------------\n\n/**\n * Executes modules in an isolated subprocess to limit the blast radius\n * of untrusted or third-party modules.\n *\n * When disabled (the default), delegates directly to the Executor.\n * When enabled, spawns a restricted child process via re-exec with\n * `--internal-sandbox-runner <module_id>`.\n */\nexport class Sandbox {\n  /** Default post-capture stdout+stderr byte budget for sandboxed children. */\n  static readonly DEFAULT_MAX_OUTPUT_BYTES = SANDBOX_DEFAULT_OUTPUT_SIZE_LIMIT;\n\n  private readonly enabled: boolean;\n  private readonly timeoutSeconds: number;\n  private extensionsRoot: string | null = null;\n  private maxOutputBytes: number = SANDBOX_DEFAULT_OUTPUT_SIZE_LIMIT;\n\n  constructor(enabled = false, timeoutSeconds = 300) {\n    this.enabled = enabled;\n    this.timeoutSeconds = timeoutSeconds;\n  }\n\n  /**\n   * Set the extensions root that is forwarded to the sandboxed runner via\n   * `APCORE_EXTENSIONS_ROOT`. The path is resolved to absolute when injected\n   * so the child (whose cwd is the fresh sandbox tempdir) can locate modules.\n   *\n   * Builder-style — returns `this` so call sites can chain. Mirrors Python's\n   * `Sandbox.with_extensions_root` (D1-004 cross-SDK parity).\n   */\n  withExtensionsRoot(extensionsRoot: string | null): this {\n    this.extensionsRoot = extensionsRoot;\n    return this;\n  }\n\n  /**\n   * Cap the post-capture stdout+stderr byte budget for the sandboxed\n   * subprocess. Default: 64 MiB (`Sandbox.DEFAULT_MAX_OUTPUT_BYTES`).\n   *\n   * Builder-style — returns `this`. Mirrors Python's\n   * `Sandbox.with_max_output_bytes` (D1-004 cross-SDK parity).\n   */\n  withMaxOutputBytes(maxOutputBytes: number): this {\n    this.maxOutputBytes = maxOutputBytes;\n    return this;\n  }\n\n  /**\n   * Execute a module, optionally inside a sandboxed subprocess.\n   */\n  async execute(\n    moduleId: string,\n    inputData: Record<string, unknown>,\n    executor: Executor,\n  ): Promise<unknown> {\n    if (!this.enabled) {\n      return executor.execute(moduleId, inputData);\n    }\n    return this._sandboxedExecute(moduleId, inputData);\n  }\n\n  private async _sandboxedExecute(\n    moduleId: string,\n    inputData: Record<string, unknown>,\n  ): Promise<unknown> {\n    const { spawn } = await import(\"node:child_process\");\n    const { tmpdir } = await import(\"node:os\");\n    const { join } = await import(\"node:path\");\n    const { mkdtempSync, rmSync } = await import(\"node:fs\");\n\n    const tmpDir = mkdtempSync(join(tmpdir(), \"apcore_sandbox_\"));\n\n    const env = buildSandboxEnv(tmpDir);\n\n    // Resolve APCORE_EXTENSIONS_ROOT to absolute BEFORE forwarding into the\n    // child env. The child's cwd is the fresh tmpDir, so any relative path\n    // (default `./extensions` or user-provided `./relative/foo`) would\n    // otherwise resolve under the empty tmpDir → MODULE_NOT_FOUND.\n    //\n    // Precedence: explicit `withExtensionsRoot(...)` builder value wins over\n    // an inherited APCORE_EXTENSIONS_ROOT env var (mirrors Python parity).\n    const { resolve: resolvePath } = await import(\"node:path\");\n    if (this.extensionsRoot !== null) {\n      env.APCORE_EXTENSIONS_ROOT = resolvePath(this.extensionsRoot);\n    } else if (env.APCORE_EXTENSIONS_ROOT) {\n      env.APCORE_EXTENSIONS_ROOT = resolvePath(env.APCORE_EXTENSIONS_ROOT);\n    }\n    const binaryPath = process.argv[1];\n    const child = spawn(process.execPath, [binaryPath, \"--internal-sandbox-runner\", moduleId], {\n      env,\n      cwd: tmpDir,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    });\n\n    let stdout = \"\";\n    let stderr = \"\";\n    let stdoutBytes = 0;\n    let stderrBytes = 0;\n    let sizeExceeded = false;\n\n    const outputCap = this.maxOutputBytes;\n    child.stdout.on(\"data\", (chunk: Buffer) => {\n      if (sizeExceeded) return;\n      stdoutBytes += chunk.length;\n      if (stdoutBytes > outputCap) {\n        sizeExceeded = true;\n        child.kill(\"SIGKILL\");\n        return;\n      }\n      stdout += chunk.toString();\n    });\n    // stderr cap: hostile modules spamming stderr can OOM the parent\n    // without an upper bound. Apply the same per-stream ceiling as stdout\n    // (independent counter so each stream gets its full budget).\n    child.stderr.on(\"data\", (chunk: Buffer) => {\n      if (sizeExceeded) return;\n      stderrBytes += chunk.length;\n      if (stderrBytes > outputCap) {\n        sizeExceeded = true;\n        child.kill(\"SIGKILL\");\n        return;\n      }\n      stderr += chunk.toString();\n    });\n\n    child.stdin.write(JSON.stringify(inputData));\n    child.stdin.end();\n\n    return new Promise<unknown>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        child.kill(\"SIGKILL\");\n        reject(\n          new ModuleExecutionError(\n            `Sandbox module '${moduleId}' timed out after ${this.timeoutSeconds}s.`,\n          ),\n        );\n      }, this.timeoutSeconds * 1000);\n\n      child.on(\"close\", (code) => {\n        clearTimeout(timer);\n        try { rmSync(tmpDir, { recursive: true, force: true }); } catch { /* best-effort */ }\n\n        if (sizeExceeded) {\n          const limitMiB = Math.floor(outputCap / (1024 * 1024));\n          reject(new ModuleExecutionError(\n            `Sandbox module '${moduleId}' output exceeded ${limitMiB}MiB limit.`,\n          ));\n          return;\n        }\n        if (code !== 0) {\n          reject(new ModuleExecutionError(\n            `Sandbox module '${moduleId}' exited with code ${code}.${stderr ? ` stderr: ${stderr}` : \"\"}`,\n          ));\n          return;\n        }\n        try {\n          resolve(JSON.parse(stdout));\n        } catch {\n          reject(new ModuleExecutionError(\n            `Sandbox module '${moduleId}' returned non-JSON output: ${stdout.slice(0, 200)}`,\n          ));\n        }\n      });\n\n      child.on(\"error\", (err) => {\n        clearTimeout(timer);\n        reject(new ModuleExecutionError(`Failed to spawn sandbox process: ${err.message}`));\n      });\n    });\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Sandbox runner (invoked as a child process via --internal-sandbox-runner)\n// ---------------------------------------------------------------------------\n\n/**\n * Entry point for the sandbox child process.\n * Called when `--internal-sandbox-runner <module_id>` appears in argv.\n * Reads JSON from stdin, runs the module, writes JSON to stdout.\n */\nexport async function runSandboxRunner(moduleId: string): Promise<void> {\n  const extensionsRoot = process.env.APCORE_EXTENSIONS_ROOT ?? \"./extensions\";\n  // Dynamic import avoids circular deps and keeps the sandbox runner\n  // isolated from the host CLI initialization code.\n  const apcore = await import(\"apcore-js\").catch(() => {\n    process.stderr.write(\n      \"sandbox runner: apcore-js is not available in the sandboxed environment.\\n\",\n    );\n    process.exit(1);\n  });\n  if (!apcore) return;\n\n  let inputJson = \"\";\n  for await (const chunk of process.stdin) {\n    inputJson += chunk.toString();\n  }\n\n  let inputData: Record<string, unknown>;\n  try {\n    inputData = JSON.parse(inputJson);\n  } catch {\n    process.stderr.write(\"sandbox runner: failed to parse stdin as JSON.\\n\");\n    process.exit(1);\n    return;\n  }\n\n  const registry = new apcore.Registry({ extensionsDir: extensionsRoot });\n  await registry.discover();\n  const executor = new apcore.Executor({ registry });\n  try {\n    const result = await executor.call(moduleId, inputData);\n    process.stdout.write(JSON.stringify(result));\n    process.exit(0);\n  } catch (err: unknown) {\n    process.stderr.write(`sandbox runner error: ${err}\\n`);\n    process.exit(1);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nfunction buildSandboxEnv(tmpDir: string): NodeJS.ProcessEnv {\n  const env: NodeJS.ProcessEnv = {};\n  for (const key of SANDBOX_ALLOW_KEYS) {\n    if (process.env[key]) env[key] = process.env[key];\n  }\n  for (const [key, val] of Object.entries(process.env)) {\n    if (\n      key.startsWith(SANDBOX_ALLOW_PREFIX) &&\n      !key.startsWith(SANDBOX_DENY_PREFIX) &&\n      !(SANDBOX_DENY_KEYS as readonly string[]).includes(key)\n    ) {\n      env[key] = val;\n    }\n  }\n  env.HOME = tmpDir;\n  env.TMPDIR = tmpDir;\n  return env;\n}\n","/**\n * JSON Schema $ref resolver.\n *\n * Protocol spec: Schema resolution & $ref handling\n */\n\nimport { EXIT_CODES } from \"./errors.js\";\n\n// ---------------------------------------------------------------------------\n// resolveRefs\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve all $ref references in a JSON Schema.\n * Returns a fully inlined schema with $defs/definitions removed.\n */\nexport function resolveRefs(\n  schema: Record<string, unknown>,\n  maxDepth = 32,\n  moduleId = \"\",\n): Record<string, unknown> {\n  const cloned = structuredClone(schema);\n  const defs = (cloned.$defs ?? cloned.definitions ?? {}) as Record<\n    string,\n    unknown\n  >;\n  const result = resolveNode(\n    cloned,\n    defs,\n    new Set<string>(),\n    0,\n    maxDepth,\n    moduleId,\n  ) as Record<string, unknown>;\n\n  // Remove definition keys\n  delete result.$defs;\n  delete result.definitions;\n  return result;\n}\n\nfunction resolveNode(\n  node: unknown,\n  defs: Record<string, unknown>,\n  visited: Set<string>,\n  depth: number,\n  maxDepth: number,\n  moduleId: string,\n): unknown {\n  if (typeof node !== \"object\" || node === null || Array.isArray(node)) {\n    return node;\n  }\n\n  const obj = node as Record<string, unknown>;\n\n  // Handle $ref\n  if (\"$ref\" in obj) {\n    const refPath = obj.$ref as string;\n\n    if (depth >= maxDepth) {\n      process.stderr.write(\n        `Error: $ref resolution depth exceeded maximum of ${maxDepth} for module '${moduleId}'.\\n`,\n      );\n      process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);\n    }\n\n    if (visited.has(refPath)) {\n      process.stderr.write(\n        `Error: Circular $ref detected in schema for module '${moduleId}' at path '${refPath}'.\\n`,\n      );\n      process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);\n    }\n\n    // Parse ref target: extract key from \"#/$defs/Address\" → \"Address\"\n    const parts = refPath.split(\"/\");\n    const key = parts[parts.length - 1];\n\n    if (!(key in defs)) {\n      process.stderr.write(\n        `Error: Unresolvable $ref '${refPath}' in schema for module '${moduleId}'.\\n`,\n      );\n      process.exit(EXIT_CODES.SCHEMA_VALIDATION_ERROR);\n    }\n\n    const newVisited = new Set(visited);\n    newVisited.add(refPath);\n    return resolveNode(defs[key], defs, newVisited, depth + 1, maxDepth, moduleId);\n  }\n\n  // Handle allOf\n  if (\"allOf\" in obj && Array.isArray(obj.allOf)) {\n    const merged: Record<string, unknown> = {\n      properties: {},\n      required: [] as string[],\n    };\n    // Seed parent node's own properties/required BEFORE merging branches,\n    // so sibling fields are not silently dropped when a parent mixes\n    // top-level `properties` with `allOf` branches.\n    if (typeof obj.properties === \"object\" && obj.properties !== null) {\n      Object.assign(merged.properties as Record<string, unknown>, obj.properties);\n    }\n    if (Array.isArray(obj.required)) {\n      (merged.required as string[]).push(...(obj.required as string[]));\n    }\n    for (const subSchema of obj.allOf as unknown[]) {\n      const resolved = resolveNode(\n        subSchema,\n        defs,\n        visited,\n        depth + 1,\n        maxDepth,\n        moduleId,\n      ) as Record<string, unknown>;\n      if (resolved.properties) {\n        Object.assign(\n          merged.properties as Record<string, unknown>,\n          resolved.properties,\n        );\n      }\n      if (Array.isArray(resolved.required)) {\n        (merged.required as string[]).push(...resolved.required);\n      }\n    }\n    // Deduplicate required\n    merged.required = [...new Set(merged.required as string[])];\n    // Copy non-composition keys\n    for (const [k, v] of Object.entries(obj)) {\n      if (k !== \"allOf\" && !(k in merged)) {\n        merged[k] = v;\n      }\n    }\n    return merged;\n  }\n\n  // Handle anyOf / oneOf\n  for (const keyword of [\"anyOf\", \"oneOf\"]) {\n    if (keyword in obj && Array.isArray(obj[keyword])) {\n      const merged: Record<string, unknown> = {\n        properties: {},\n        required: [] as string[],\n      };\n      // Seed parent node's own properties first so sibling fields under a\n      // parent that mixes top-level `properties` with `anyOf`/`oneOf` are\n      // preserved (parity with allOf below). Audit D11-NEW-001 (2026-05-08).\n      if (typeof obj.properties === \"object\" && obj.properties !== null) {\n        Object.assign(merged.properties as Record<string, unknown>, obj.properties);\n      }\n      // Capture parent's sibling `required` BEFORE the branch loop. Per\n      // JSON Schema semantics, a parent's required applies in addition to\n      // the anyOf/oneOf branch intersection. Cross-SDK parity with Python\n      // ref_resolver.py:102. Audit D11-NEW-001 (2026-05-08).\n      const siblingRequired: string[] = Array.isArray(obj.required)\n        ? (obj.required as string[]).slice()\n        : [];\n      const allRequiredSets: Set<string>[] = [];\n      for (const subSchema of obj[keyword] as unknown[]) {\n        const resolved = resolveNode(\n          subSchema,\n          defs,\n          visited,\n          depth + 1,\n          maxDepth,\n          moduleId,\n        ) as Record<string, unknown>;\n        if (resolved.properties) {\n          Object.assign(\n            merged.properties as Record<string, unknown>,\n            resolved.properties,\n          );\n        }\n        if (Array.isArray(resolved.required)) {\n          allRequiredSets.push(new Set(resolved.required as string[]));\n        }\n      }\n      // Required = parent's sibling required ∪ intersection of all branches\n      // (deduplicated, preserving sibling-first order). Audit D11-NEW-001.\n      let branchRequired: string[] = [];\n      if (allRequiredSets.length > 0) {\n        let intersection = allRequiredSets[0];\n        for (let i = 1; i < allRequiredSets.length; i++) {\n          intersection = new Set(\n            [...intersection].filter((x) => allRequiredSets[i].has(x)),\n          );\n        }\n        branchRequired = [...intersection];\n      }\n      const seen = new Set<string>();\n      const combinedRequired: string[] = [];\n      for (const r of [...siblingRequired, ...branchRequired]) {\n        if (!seen.has(r)) {\n          seen.add(r);\n          combinedRequired.push(r);\n        }\n      }\n      merged.required = combinedRequired;\n      // Copy non-composition keys\n      for (const [k, v] of Object.entries(obj)) {\n        if (k !== keyword && !(k in merged)) {\n          merged[k] = v;\n        }\n      }\n      return merged;\n    }\n  }\n\n  // Recursively process nested properties.\n  // Audit D11-NEW-003 (2026-05-08): max_depth counts $ref hops only — plain\n  // nested-properties recursion does NOT increment `depth`. Aligned with\n  // Rust's interpretation of the spec (\"Maximum $ref resolution recursion\n  // depth\", schema-parser.md §Contract: resolve_refs).\n  if (\"properties\" in obj && typeof obj.properties === \"object\" && obj.properties !== null) {\n    const props = obj.properties as Record<string, unknown>;\n    for (const [propName, propSchema] of Object.entries(props)) {\n      props[propName] = resolveNode(\n        propSchema,\n        defs,\n        visited,\n        depth,\n        maxDepth,\n        moduleId,\n      );\n    }\n  }\n\n  return obj;\n}\n","/**\n * Simple structured logger respecting logging.level config.\n */\n\nconst LEVELS = { DEBUG: 0, INFO: 1, WARNING: 2, ERROR: 3 } as const;\ntype LogLevel = keyof typeof LEVELS;\n\nlet currentLevel: LogLevel = \"WARNING\";\n\nexport function setLogLevel(level: string): void {\n  const upper = level.toUpperCase();\n  if (upper in LEVELS) {\n    currentLevel = upper as LogLevel;\n  }\n}\n\nexport function getLogLevel(): LogLevel {\n  return currentLevel;\n}\n\nfunction shouldLog(level: LogLevel): boolean {\n  return LEVELS[level] >= LEVELS[currentLevel];\n}\n\nexport function debug(message: string): void {\n  if (shouldLog(\"DEBUG\")) process.stderr.write(`DEBUG: ${message}\\n`);\n}\n\nexport function info(message: string): void {\n  if (shouldLog(\"INFO\")) process.stderr.write(`INFO: ${message}\\n`);\n}\n\nexport function warn(message: string): void {\n  if (shouldLog(\"WARNING\")) process.stderr.write(`WARNING: ${message}\\n`);\n}\n\nexport function error(message: string): void {\n  if (shouldLog(\"ERROR\")) process.stderr.write(`ERROR: ${message}\\n`);\n}\n","/**\n * JSON Schema -> Commander options mapping.\n *\n * Protocol spec: Schema-driven argument parsing\n */\n\nimport type { OptionConfig } from \"./main.js\";\nimport { EXIT_CODES } from \"./errors.js\";\nimport { warn as logWarn } from \"./logger.js\";\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\n/** Sentinel type marker for boolean flags. */\nconst BOOLEAN_FLAG = Symbol(\"BOOLEAN_FLAG\");\n\ntype TypeResult = \"string\" | \"int\" | \"float\" | typeof BOOLEAN_FLAG | \"file\";\n\n/**\n * Map JSON Schema type to a type identifier.\n */\nexport function mapType(propName: string, propSchema: Record<string, unknown>): TypeResult {\n  const schemaType = propSchema.type as string | undefined;\n\n  // Check file convention\n  if (\n    schemaType === \"string\" &&\n    (propName.endsWith(\"_file\") || propSchema[\"x-cli-file\"] === true)\n  ) {\n    return \"file\";\n  }\n\n  const typeMap: Record<string, TypeResult> = {\n    string: \"string\",\n    integer: \"int\",\n    number: \"float\",\n    boolean: BOOLEAN_FLAG,\n    object: \"string\",\n    array: \"string\",\n  };\n\n  if (!schemaType) {\n    return \"string\";\n  }\n\n  return typeMap[schemaType] ?? \"string\";\n}\n\n/**\n * Extract help text from schema property, preferring x-llm-description.\n */\nexport function extractHelp(propSchema: Record<string, unknown>, maxLength = 1000): string | undefined {\n  let text = propSchema[\"x-llm-description\"] as string | undefined;\n  if (!text) {\n    text = propSchema.description as string | undefined;\n  }\n  if (!text) {\n    return undefined;\n  }\n  if (maxLength > 0 && text.length > maxLength) {\n    return text.slice(0, maxLength - 3) + \"...\";\n  }\n  return text;\n}\n\n// ---------------------------------------------------------------------------\n// schemaToCliOptions\n// ---------------------------------------------------------------------------\n\n/** Reserved CLI option names that cannot be used by schema properties. */\nconst RESERVED_NAMES = new Set([\n  \"input\", \"yes\", \"large_input\", \"format\", \"fields\", \"sandbox\",\n  \"verbose\", \"dry_run\", \"trace\", \"stream\", \"strategy\",\n  \"approval_timeout\", \"approval_token\",\n]);\n\n/**\n * Convert a JSON Schema `properties` object into an array of\n * Commander option configurations.\n */\nexport function schemaToCliOptions(\n  schema: Record<string, unknown>,\n  maxHelpLength = 1000,\n): OptionConfig[] {\n  const properties = (schema.properties ?? {}) as Record<\n    string,\n    Record<string, unknown>\n  >;\n  const requiredList = (schema.required ?? []) as string[];\n  const options: OptionConfig[] = [];\n  const flagNames: Record<string, string> = {};\n\n  // Cross-SDK parity (D11-W4): warn when a name appears in `required` but\n  // has no matching entry in `properties`. Mirrors Python schema_parser.py\n  // (lines 93-98) and Rust schema_parser.rs (lines 220-228); without this\n  // loop schemas like `{required: [\"foo\"]}` with no `properties.foo` parse\n  // silently in the TS SDK only.\n  for (const reqName of requiredList) {\n    if (!(reqName in properties)) {\n      logWarn(\n        `Required property '${reqName}' not found in properties, skipping.`,\n      );\n    }\n  }\n\n  for (const [propName, propSchema] of Object.entries(properties)) {\n    const flagName = \"--\" + propName.replace(/_/g, \"-\");\n\n    // Reserved name check (must precede collision check to match Python/Rust).\n    // Exit 48 (SCHEMA_CIRCULAR_REF — the protocol-spec slot for schema-validity\n    // errors) for cross-SDK parity with Python sys.exit(48) and Rust\n    // SchemaParserError::ReservedPropertyName → CliError::SchemaParserFailure.\n    // Audit D11-NEW-005 (2026-05-08).\n    if (RESERVED_NAMES.has(propName)) {\n      process.stderr.write(\n        `Error: Module schema property '${propName}' conflicts with a reserved CLI option name. Rename the property.\\n`,\n      );\n      process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);\n    }\n\n    // Collision detection — exit 48 per spec (docs/features/schema-parser.md\n    // Contract: schema_to_click_options Errors), matching Python sys.exit(48)\n    // at schema_parser.py:116. Audit D11-NEW-004 (2026-05-08).\n    if (flagName in flagNames) {\n      process.stderr.write(\n        `Error: Flag name collision: properties '${propName}' and '${flagNames[flagName]}' both map to '${flagName}'.\\n`,\n      );\n      process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);\n    }\n    flagNames[flagName] = propName;\n\n    const typeResult = mapType(propName, propSchema);\n    const isRequired = requiredList.includes(propName);\n    const helpBase = extractHelp(propSchema, maxHelpLength);\n    const helpText = isRequired\n      ? (helpBase ? helpBase + \" \" : \"\") + \"[required]\"\n      : helpBase ?? \"\";\n    const defaultValue = propSchema.default as unknown;\n\n    if (typeResult === BOOLEAN_FLAG) {\n      // Boolean flag pair: --flag/--no-flag\n      const flagBase = propName.replace(/_/g, \"-\");\n      // Cross-SDK parity (D11-005): Rust schema_parser.rs:272 also tracks\n      // the auto-generated `--no-<flag>` name in the collision map so a\n      // schema pairing a boolean ``force`` with a non-boolean ``no_force``\n      // is rejected at parse time. Without this, the second property\n      // silently shadows the negation flag.\n      const noFlag = `--no-${flagBase}`;\n      if (noFlag in flagNames) {\n        process.stderr.write(\n          `Error: Flag name collision: boolean property '${propName}' auto-generates '${noFlag}' which is already used by property '${flagNames[noFlag]}'.\\n`,\n        );\n        // Audit D11-NEW-004 (2026-05-08): exit 48 per spec, matching\n        // Python sys.exit(48) at schema_parser.py:137.\n        process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);\n      }\n      flagNames[noFlag] = propName;\n      const defaultVal = (propSchema.default as boolean) ?? false;\n      options.push({\n        name: propName,\n        flags: `--${flagBase}, --no-${flagBase}`,\n        description: helpText,\n        defaultValue: defaultVal,\n        required: isRequired,\n        isBooleanFlag: true,\n      });\n    } else if (\"enum\" in propSchema && Array.isArray(propSchema.enum)) {\n      const enumValues = propSchema.enum as unknown[];\n      if (enumValues.length === 0) {\n        // Empty enum — fall back to plain string option\n        options.push({\n          name: propName,\n          flags: `${flagName} <value>`,\n          description: helpText,\n          defaultValue,\n          required: isRequired,\n        });\n      } else {\n        const stringValues = enumValues.map(String);\n        const enumOriginalTypes: Record<string, string> = {};\n        for (const v of enumValues) {\n          if (typeof v === \"number\" && Number.isInteger(v)) {\n            enumOriginalTypes[String(v)] = \"int\";\n          } else if (typeof v === \"number\") {\n            enumOriginalTypes[String(v)] = \"float\";\n          } else if (typeof v === \"boolean\") {\n            enumOriginalTypes[String(v)] = \"bool\";\n          }\n        }\n        options.push({\n          name: propName,\n          flags: `${flagName} <value>`,\n          description: helpText,\n          defaultValue:\n            defaultValue !== undefined ? String(defaultValue) : undefined,\n          required: isRequired,\n          choices: stringValues,\n          enumOriginalTypes:\n            Object.keys(enumOriginalTypes).length > 0\n              ? enumOriginalTypes\n              : undefined,\n        });\n      }\n    } else {\n      // Standard option\n      let parseArg: ((value: string) => unknown) | undefined;\n      if (typeResult === \"int\") {\n        parseArg = (v: string) => {\n          const n = parseInt(v, 10);\n          if (isNaN(n)) throw new Error(`Invalid integer: ${v}`);\n          return n;\n        };\n      } else if (typeResult === \"float\") {\n        parseArg = (v: string) => {\n          const n = parseFloat(v);\n          if (isNaN(n)) throw new Error(`Invalid number: ${v}`);\n          return n;\n        };\n      }\n      options.push({\n        name: propName,\n        flags: `${flagName} <value>`,\n        description: helpText,\n        defaultValue,\n        required: isRequired,\n        parseArg,\n      });\n    }\n  }\n\n  return options;\n}\n","/**\n * Interactive approval prompts with timeout.\n *\n * Protocol spec: Approval workflow\n */\n\nimport * as readline from \"node:readline\";\nimport type { ModuleDescriptor } from \"./cli.js\";\nimport { ApprovalDeniedError, ApprovalTimeoutError } from \"./errors.js\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Get an annotation value from either a dict or an object.\n */\nfunction getAnnotation(\n  annotations: unknown,\n  key: string,\n  defaultValue: unknown = undefined,\n): unknown {\n  if (!annotations || typeof annotations !== \"object\") return defaultValue;\n  const ann = annotations as Record<string, unknown>;\n  return key in ann ? ann[key] : defaultValue;\n}\n\n/**\n * Read APCORE_CLI_APPROVAL_TIMEOUT env var (positive integer seconds).\n * Returns undefined on absent/empty/invalid values.\n */\nfunction readTimeoutFromEnv(): number | undefined {\n  const raw = process.env.APCORE_CLI_APPROVAL_TIMEOUT;\n  if (raw === undefined || raw === \"\") return undefined;\n  const parsed = parseInt(raw, 10);\n  if (!Number.isFinite(parsed) || parsed <= 0) return undefined;\n  return parsed;\n}\n\n// ---------------------------------------------------------------------------\n// CliApprovalHandler — implements apcore ApprovalHandler protocol (FE-11 §3.5)\n// ---------------------------------------------------------------------------\n\n/**\n * CLI ApprovalHandler that prompts in TTY, auto-denies in non-TTY.\n *\n * Implements the apcore ApprovalHandler protocol:\n * - `requestApproval(request) -> ApprovalResult`\n * - `checkApproval(approvalId) -> ApprovalResult`\n *\n * Pass to Executor via `executor.setApprovalHandler(handler)`.\n */\nexport class CliApprovalHandler {\n  autoApprove: boolean;\n  timeout: number;\n\n  constructor(autoApprove = false, timeout?: number) {\n    this.autoApprove = autoApprove;\n    const resolved = timeout ?? readTimeoutFromEnv() ?? 60;\n    this.timeout = Math.max(1, Math.min(resolved, 3600));\n  }\n\n  async requestApproval(request: Record<string, unknown>): Promise<Record<string, unknown>> {\n    const moduleId = (request.module_id as string) ?? \"unknown\";\n\n    if (this.autoApprove) {\n      return { status: \"approved\", approved_by: \"auto_approve\" };\n    }\n\n    const envVal = process.env.APCORE_CLI_AUTO_APPROVE ?? \"\";\n    if (envVal === \"1\") {\n      return { status: \"approved\", approved_by: \"env_auto_approve\" };\n    }\n    if (envVal !== \"\" && envVal !== \"1\") {\n      process.stderr.write(\n        `Warning: APCORE_CLI_AUTO_APPROVE is set to '${envVal}', expected '1'. Ignoring.\\n`,\n      );\n    }\n\n    if (!process.stdin.isTTY) {\n      return { status: \"rejected\", reason: \"Non-interactive session without --yes\" };\n    }\n\n    // TTY prompt\n    const annotations = request.annotations as Record<string, unknown> | undefined;\n    const extra = (annotations?.extra as Record<string, unknown>) ?? {};\n    const message = (extra.approval_message as string) ?? `Module '${moduleId}' requires approval to execute.`;\n\n    process.stderr.write(message + \"\\n\");\n    try {\n      await promptWithTimeout({ id: moduleId } as ModuleDescriptor, this.timeout);\n      return { status: \"approved\", approved_by: \"tty_user\" };\n    } catch {\n      return { status: \"rejected\", reason: \"User rejected or timed out\" };\n    }\n  }\n\n  async checkApproval(_approvalId: string): Promise<Record<string, unknown>> {\n    return { status: \"rejected\", reason: \"CLI does not support async approval polling\" };\n  }\n}\n\n// ---------------------------------------------------------------------------\n// checkApproval (legacy function wrapper)\n// ---------------------------------------------------------------------------\n\n/**\n * Check if module requires approval and handle accordingly.\n * Returns normally if approved (or approval not required).\n * Throws ApprovalDeniedError or ApprovalTimeoutError on denial/timeout so the\n * caller (buildModuleCommand action) can run audit flush and tear-down before\n * the process exits via the shared error path.\n */\nexport async function checkApproval(\n  moduleDef: ModuleDescriptor,\n  autoApprove: boolean,\n  timeout?: number,\n): Promise<void> {\n  const annotations = moduleDef.annotations;\n\n  // Check if approval is required\n  let requiresApproval: boolean;\n  if (moduleDef.requiresApproval !== undefined) {\n    requiresApproval = moduleDef.requiresApproval;\n  } else if (annotations) {\n    requiresApproval = getAnnotation(annotations, \"requires_approval\", false) === true;\n  } else {\n    return; // No annotations, no approval needed\n  }\n\n  if (!requiresApproval) {\n    return;\n  }\n\n  const moduleId = moduleDef.id;\n\n  // Bypass: autoApprove flag (highest priority)\n  if (autoApprove) {\n    return;\n  }\n\n  // Bypass: APCORE_CLI_AUTO_APPROVE env var\n  const envVal = process.env.APCORE_CLI_AUTO_APPROVE ?? \"\";\n  if (envVal === \"1\") {\n    return;\n  }\n  if (envVal !== \"\" && envVal !== \"1\") {\n    process.stderr.write(\n      `Warning: APCORE_CLI_AUTO_APPROVE is set to '${envVal}', expected '1'. Ignoring.\\n`,\n    );\n  }\n\n  // Non-TTY check — throw so caller can audit-flush before exit\n  if (!process.stdin.isTTY) {\n    throw new ApprovalDeniedError(\n      `Module '${moduleId}' requires approval but no interactive terminal is available. ` +\n        \"Use --yes or set APCORE_CLI_AUTO_APPROVE=1 to bypass.\",\n    );\n  }\n\n  // TTY prompt — throws on deny/timeout\n  const effectiveTimeout = timeout ?? readTimeoutFromEnv() ?? 60;\n  await promptWithTimeout(moduleDef, effectiveTimeout);\n}\n\n/**\n * Display approval prompt with timeout.\n */\nasync function promptWithTimeout(\n  moduleDef: ModuleDescriptor,\n  timeout: number,\n): Promise<void> {\n  // Clamp timeout\n  timeout = Math.max(1, Math.min(timeout, 3600));\n\n  const moduleId = moduleDef.id;\n  const annotations = moduleDef.annotations;\n  const message =\n    (annotations\n      ? (getAnnotation(annotations, \"approval_message\") as string | undefined)\n      : undefined) ??\n    `Module '${moduleId}' requires approval to execute.`;\n\n  process.stderr.write(message + \"\\n\");\n\n  const rl = readline.createInterface({\n    input: process.stdin,\n    output: process.stderr,\n  });\n\n  let timer: ReturnType<typeof setTimeout> | undefined;\n\n  try {\n    const answer = await Promise.race([\n      new Promise<string>((resolve) => {\n        rl.question(\"Proceed? [y/N] \", (ans) => resolve(ans));\n      }),\n      new Promise<never>((_, reject) => {\n        timer = setTimeout(() => {\n          reject(new ApprovalTimeoutError(\n            `Approval prompt timed out after ${timeout} seconds.`,\n          ));\n        }, timeout * 1000);\n      }),\n    ]);\n\n    // Clear the timeout — prompt resolved before timeout fired\n    if (timer) clearTimeout(timer);\n\n    const normalized = answer.trim().toLowerCase();\n    if (normalized === \"y\" || normalized === \"yes\") {\n      return;\n    }\n\n    throw new ApprovalDeniedError(\"Approval denied\");\n  } catch (err) {\n    if (timer) clearTimeout(timer);\n    // ApprovalTimeoutError and ApprovalDeniedError bubble up so the caller\n    // (buildModuleCommand action) can run AuditLogger flush / tear-down\n    // before the process-level error path exits via exitCodeForError.\n    throw err;\n  } finally {\n    rl.close();\n  }\n}\n","/**\n * TTY-adaptive output formatting (table/json/csv/yaml/jsonl/markdown/skill).\n *\n * Protocol spec: Output formatting (FE-08 / FE-09 enhanced)\n */\n\nimport yaml from \"js-yaml\";\nimport { EXIT_CODES } from \"./errors.js\";\nimport type { ModuleDescriptor, PreflightResult } from \"./cli.js\";\n\nconst TOOLKIT_MISSING_HINT =\n  \"The 'markdown' and 'skill' output formats require the apcore-toolkit \" +\n  \"peer dependency. Install with: npm install apcore-toolkit@^0.6\";\n\n/**\n * Adapt the registry's `ModuleDescriptor` to the toolkit's `ScannedModule`\n * shape so the surface-aware formatters (`formatModule` / `formatModules`)\n * can render it. Both shapes share most fields; the toolkit additionally\n * needs `target`, `suggestedAlias`, `warnings`, and `display`.\n */\nfunction descriptorToScanned(\n  m: ModuleDescriptor,\n): import(\"apcore-toolkit\").ScannedModule {\n  const metadata = (m.metadata ?? {}) as Record<string, unknown>;\n  const display = (metadata[\"display\"] ?? null) as\n    | Record<string, unknown>\n    | null;\n  return {\n    moduleId: m.id,\n    description: m.description ?? \"\",\n    inputSchema: (m.inputSchema ?? {}) as Record<string, unknown>,\n    outputSchema: (m.outputSchema ?? {}) as Record<string, unknown>,\n    tags: (m.tags ?? []) as readonly string[],\n    target: \"\",\n    version: \"1.0.0\",\n    annotations:\n      (m.annotations as unknown as import(\"apcore-toolkit\").ScannedModule[\"annotations\"]) ??\n      null,\n    documentation: null,\n    suggestedAlias: null,\n    examples: [],\n    metadata,\n    display,\n    warnings: [],\n  };\n}\n\n/**\n * Stringify a CSV cell value: scalars via String(), nested objects/arrays via\n * JSON.stringify so composite data survives a round-trip instead of rendering\n * as '[object Object]'.\n */\nfunction csvCellString(value: unknown): string {\n  if (value === null || value === undefined) return \"\";\n  if (typeof value === \"object\") return JSON.stringify(value);\n  return String(value);\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve output format with TTY-adaptive default.\n */\nexport function resolveFormat(explicitFormat?: string): string {\n  if (explicitFormat !== undefined) {\n    return explicitFormat;\n  }\n  return process.stdout.isTTY ? \"table\" : \"json\";\n}\n\n/**\n * Truncate text to maxLength, appending '...' if needed.\n */\nexport function truncate(text: string, maxLength = 80): string {\n  if (text.length <= maxLength) {\n    return text;\n  }\n  return text.slice(0, maxLength - 3) + \"...\";\n}\n\n/**\n * Render a simple plain-text table with column headers.\n */\nfunction formatTable(\n  headers: string[],\n  rows: string[][],\n): string {\n  // Calculate column widths\n  const colWidths = headers.map((h, i) =>\n    Math.max(h.length, ...rows.map((r) => (r[i] ?? \"\").length)),\n  );\n\n  const sep = colWidths.map((w) => \"-\".repeat(w)).join(\"  \");\n  const headerLine = headers\n    .map((h, i) => h.padEnd(colWidths[i]))\n    .join(\"  \");\n  const dataLines = rows.map((row) =>\n    row.map((cell, i) => (cell ?? \"\").padEnd(colWidths[i])).join(\"  \"),\n  );\n\n  return [headerLine, sep, ...dataLines].join(\"\\n\") + \"\\n\";\n}\n\n// ---------------------------------------------------------------------------\n// formatModuleList\n// ---------------------------------------------------------------------------\n\n/**\n * Format and print a list of modules.\n */\nexport async function formatModuleList(\n  modules: ModuleDescriptor[],\n  format: string,\n  filterTags?: string[],\n  showDeps = false,\n  exposureFilter?: { isExposed(moduleId: string): boolean },\n): Promise<void> {\n  if (format === \"table\") {\n    if (modules.length === 0 && filterTags && filterTags.length > 0) {\n      process.stdout.write(\n        `No modules found matching tags: ${filterTags.join(\", \")}.\\n`,\n      );\n      return;\n    }\n    if (modules.length === 0) {\n      process.stdout.write(\"No modules found.\\n\");\n      return;\n    }\n\n    const headers = [\"ID\", \"Description\", \"Tags\"];\n    if (showDeps) headers.push(\"Deps\");\n    if (exposureFilter) headers.push(\"Exposure\");\n    const rows = modules.map((m) => {\n      const base = [m.id, truncate(m.description, 80), (m.tags ?? []).join(\", \")];\n      if (showDeps) {\n        const deps = (m as unknown as Record<string, unknown>).dependencies;\n        base.push(String(Array.isArray(deps) ? deps.length : 0));\n      }\n      if (exposureFilter) {\n        base.push(exposureFilter.isExposed(m.id ?? \"\") ? \"\\u2713\" : \"\\u2014\");\n      }\n      return base;\n    });\n    process.stdout.write(formatTable(headers, rows));\n  } else if (format === \"json\") {\n    const result = modules.map((m) => {\n      const entry: Record<string, unknown> = {\n        id: m.id,\n        description: m.description,\n        tags: m.tags ?? [],\n      };\n      if (showDeps) {\n        const deps = (m as unknown as Record<string, unknown>).dependencies;\n        entry.dependency_count = Array.isArray(deps) ? deps.length : 0;\n      }\n      if (exposureFilter) {\n        entry.exposed = exposureFilter.isExposed(m.id ?? \"\");\n      }\n      return entry;\n    });\n    process.stdout.write(JSON.stringify(result, null, 2) + \"\\n\");\n  } else if (format === \"markdown\" || format === \"skill\") {\n    let toolkit: typeof import(\"apcore-toolkit\");\n    try {\n      toolkit = await import(\"apcore-toolkit\");\n    } catch {\n      throw new Error(TOOLKIT_MISSING_HINT);\n    }\n    const scanned = modules.map(descriptorToScanned);\n    process.stdout.write(\n      (toolkit.formatModules(scanned, { style: format, display: true }) as string) + \"\\n\",\n    );\n  }\n}\n\n// ---------------------------------------------------------------------------\n// formatModuleDetail\n// ---------------------------------------------------------------------------\n\n/**\n * Convert annotations to a plain dict, filtering out falsy/default values.\n */\nfunction annotationsToDict(\n  annotations: unknown,\n): Record<string, unknown> | null {\n  if (!annotations) return null;\n  if (typeof annotations !== \"object\" || Array.isArray(annotations)) return null;\n  const result: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(annotations as Record<string, unknown>)) {\n    if (v !== null && v !== undefined && v !== false && v !== 0 && !(Array.isArray(v) && v.length === 0)) {\n      result[k] = v;\n    }\n  }\n  return Object.keys(result).length > 0 ? result : null;\n}\n\n/**\n * Format and print full module metadata.\n */\nexport async function formatModuleDetail(\n  moduleDef: ModuleDescriptor,\n  format: string,\n): Promise<void> {\n  if (format === \"table\") {\n    process.stdout.write(`\\nModule: ${moduleDef.id}\\n`);\n    process.stdout.write(`\\nDescription:\\n  ${moduleDef.description}\\n`);\n\n    if (moduleDef.inputSchema && Object.keys(moduleDef.inputSchema).length > 0) {\n      process.stdout.write(\"\\nInput Schema:\\n\");\n      process.stdout.write(JSON.stringify(moduleDef.inputSchema, null, 2) + \"\\n\");\n    }\n\n    if (moduleDef.outputSchema && Object.keys(moduleDef.outputSchema).length > 0) {\n      process.stdout.write(\"\\nOutput Schema:\\n\");\n      process.stdout.write(JSON.stringify(moduleDef.outputSchema, null, 2) + \"\\n\");\n    }\n\n    const annDict = annotationsToDict(\n      moduleDef.annotations,\n    );\n    if (annDict) {\n      process.stdout.write(\"\\nAnnotations:\\n\");\n      for (const [k, v] of Object.entries(annDict)) {\n        process.stdout.write(`  ${k}: ${v}\\n`);\n      }\n    }\n\n    // Extension metadata (x- prefixed)\n    const metadata = moduleDef.metadata;\n    if (metadata) {\n      const xFields: Record<string, unknown> = {};\n      for (const [k, v] of Object.entries(metadata)) {\n        if (k.startsWith(\"x-\") || k.startsWith(\"x_\")) {\n          xFields[k] = v;\n        }\n      }\n      if (Object.keys(xFields).length > 0) {\n        process.stdout.write(\"\\nExtension Metadata:\\n\");\n        for (const [k, v] of Object.entries(xFields)) {\n          process.stdout.write(`  ${k}: ${v}\\n`);\n        }\n      }\n    }\n\n    const tags = moduleDef.tags ?? [];\n    if (tags.length > 0) {\n      process.stdout.write(`\\nTags: ${tags.join(\", \")}\\n`);\n    }\n  } else if (format === \"json\") {\n    const result: Record<string, unknown> = {\n      id: moduleDef.id,\n      description: moduleDef.description,\n    };\n    if (moduleDef.inputSchema) result.input_schema = moduleDef.inputSchema;\n    if (moduleDef.outputSchema) result.output_schema = moduleDef.outputSchema;\n\n    const annDict = annotationsToDict(\n      moduleDef.annotations,\n    );\n    if (annDict) result.annotations = annDict;\n\n    const tags = moduleDef.tags ?? [];\n    if (tags.length > 0) result.tags = tags;\n\n    // Extension metadata\n    const metadata = moduleDef.metadata;\n    if (metadata) {\n      for (const [k, v] of Object.entries(metadata)) {\n        if (k.startsWith(\"x-\") || k.startsWith(\"x_\")) {\n          result[k] = v;\n        }\n      }\n    }\n\n    process.stdout.write(JSON.stringify(result, null, 2) + \"\\n\");\n  } else if (format === \"markdown\" || format === \"skill\") {\n    let toolkit: typeof import(\"apcore-toolkit\");\n    try {\n      toolkit = await import(\"apcore-toolkit\");\n    } catch {\n      throw new Error(TOOLKIT_MISSING_HINT);\n    }\n    process.stdout.write(\n      (toolkit.formatModule(descriptorToScanned(moduleDef), { style: format, display: true }) as string) + \"\\n\",\n    );\n  }\n}\n\n// ---------------------------------------------------------------------------\n// formatExecResult\n// ---------------------------------------------------------------------------\n\n/**\n * Select fields from a result using dot-path notation.\n * E.g., fields=\"status,data.count\" selects those paths.\n */\nfunction selectFields(result: Record<string, unknown>, fields: string): Record<string, unknown> {\n  const selected: Record<string, unknown> = {};\n  for (const f of fields.split(\",\")) {\n    const key = f.trim();\n    let val: unknown = result;\n    for (const part of key.split(\".\")) {\n      if (val && typeof val === \"object\" && !Array.isArray(val)) {\n        val = (val as Record<string, unknown>)[part];\n      } else {\n        val = undefined;\n        break;\n      }\n    }\n    selected[key] = val;\n  }\n  return selected;\n}\n\n/**\n * Format and print module execution result.\n *\n * Supports formats: json, table, csv, yaml, jsonl.\n * The `fields` option allows dot-path field selection on dict results.\n */\nexport function formatExecResult(\n  result: unknown,\n  format?: string,\n  fields?: string,\n): void {\n  if (result === null || result === undefined) {\n    return;\n  }\n\n  // Apply field selection if specified\n  let effective_result = result;\n  if (fields && typeof result === \"object\" && !Array.isArray(result) && result !== null) {\n    effective_result = selectFields(result as Record<string, unknown>, fields);\n  }\n\n  const effective = resolveFormat(format);\n\n  if (effective === \"csv\") {\n    if (typeof effective_result === \"object\" && !Array.isArray(effective_result) && effective_result !== null) {\n      const obj = effective_result as Record<string, unknown>;\n      const keys = Object.keys(obj);\n      const header = keys.map(escapeCsvField).join(\",\");\n      const row = keys.map((k) => escapeCsvField(csvCellString(obj[k]))).join(\",\");\n      process.stdout.write(header + \"\\n\" + row + \"\\n\");\n    } else if (Array.isArray(effective_result) && effective_result.length > 0 && typeof effective_result[0] === \"object\") {\n      const keys = Object.keys(effective_result[0] as Record<string, unknown>);\n      const header = keys.map(escapeCsvField).join(\",\");\n      const rows = effective_result.map((item) => {\n        const obj = item as Record<string, unknown>;\n        return keys.map((k) => escapeCsvField(csvCellString(obj[k]))).join(\",\");\n      });\n      process.stdout.write(header + \"\\n\" + rows.join(\"\\n\") + \"\\n\");\n    } else {\n      process.stdout.write(JSON.stringify(effective_result) + \"\\n\");\n    }\n  } else if (effective === \"yaml\") {\n    // Use js-yaml to produce spec-conformant output for values containing\n    // special YAML characters (':', leading '-', '@', '#', CR/LF, etc.).\n    process.stdout.write(yaml.dump(effective_result, { lineWidth: -1 }));\n  } else if (effective === \"jsonl\") {\n    if (Array.isArray(effective_result)) {\n      for (const item of effective_result) {\n        process.stdout.write(JSON.stringify(item) + \"\\n\");\n      }\n    } else {\n      process.stdout.write(JSON.stringify(effective_result) + \"\\n\");\n    }\n  } else if (\n    effective === \"table\" &&\n    typeof effective_result === \"object\" &&\n    !Array.isArray(effective_result)\n  ) {\n    // Key-value table\n    const entries = Object.entries(effective_result as Record<string, unknown>);\n    const headers = [\"Key\", \"Value\"];\n    const rows = entries.map(([k, v]) => [String(k), String(v)]);\n    process.stdout.write(formatTable(headers, rows));\n  } else if (typeof effective_result === \"object\") {\n    process.stdout.write(JSON.stringify(effective_result, null, 2) + \"\\n\");\n  } else if (typeof effective_result === \"string\") {\n    process.stdout.write(effective_result + \"\\n\");\n  } else {\n    process.stdout.write(String(effective_result) + \"\\n\");\n  }\n}\n\n/**\n * Escape a CSV field value — wrap in quotes if it contains comma, quote, or newline.\n */\nfunction escapeCsvField(value: string): string {\n  if (value.includes(\",\") || value.includes('\"') || value.includes(\"\\n\") || value.includes(\"\\r\")) {\n    return '\"' + value.replace(/\"/g, '\"\"') + '\"';\n  }\n  return value;\n}\n\n// ---------------------------------------------------------------------------\n// formatPreflightResult\n// ---------------------------------------------------------------------------\n\n/**\n * Format and print a PreflightResult to stdout.\n *\n * @internal Cross-module helper consumed by main.ts and discovery.ts only.\n * Not part of the public package surface — `index.ts` does not re-export it.\n * Audit D1-W4 (2026-05-08).\n */\nexport function formatPreflightResult(result: PreflightResult, format?: string): void {\n  const resolved = resolveFormat(format);\n  if (resolved === \"json\" || !process.stdout.isTTY) {\n    const payload: Record<string, unknown> = {\n      valid: result.valid,\n      // JSON output key stays snake_case for cross-language CLI contract;\n      // runtime read uses camelCase to match apcore-js PreflightResult.\n      requires_approval: result.requiresApproval,\n      checks: result.checks.map((c) => {\n        const entry: Record<string, unknown> = { check: c.check, passed: c.passed };\n        if (c.error !== undefined && c.error !== null) {\n          entry.error = c.error;\n        }\n        if (c.warnings && c.warnings.length > 0) {\n          entry.warnings = c.warnings;\n        }\n        return entry;\n      }),\n    };\n    process.stdout.write(JSON.stringify(payload, null, 2) + \"\\n\");\n  } else {\n    // TTY table format\n    for (const c of result.checks) {\n      const hasWarnings = (c.warnings?.length ?? 0) > 0;\n      let sym: string;\n      if (c.passed && hasWarnings) {\n        sym = \"\\u26a0\"; // ⚠ passed with warnings\n      } else if (c.passed) {\n        sym = \"\\u2713\"; // ✓ passed\n      } else if (c.passed === false) {\n        sym = \"\\u2717\"; // ✗ failed\n      } else {\n        sym = \"\\u25cb\"; // ○ skipped\n      }\n      let status = `  ${sym} ${c.check.padEnd(20)}`;\n      if (c.error) {\n        const detail = typeof c.error === \"object\" ? JSON.stringify(c.error) : String(c.error);\n        status += ` ${detail}`;\n      } else if (c.passed && !hasWarnings) {\n        status += \" OK\";\n      } else if (!c.passed) {\n        status += \" Skipped\";\n      }\n      process.stdout.write(status + \"\\n\");\n      for (const w of c.warnings ?? []) {\n        process.stdout.write(`    Warning: ${w}\\n`);\n      }\n    }\n    const errors = result.checks.filter((c) => !c.passed).length;\n    const warnings = result.checks.reduce((sum, c) => sum + (c.warnings?.length ?? 0), 0);\n    const tag = result.valid ? \"PASS\" : \"FAIL\";\n    process.stdout.write(`\\nResult: ${tag} (${errors} error(s), ${warnings} warning(s))\\n`);\n  }\n}\n\n/**\n * Return the exit code for the first failed check in a PreflightResult.\n *\n * @internal Cross-module helper consumed by main.ts and discovery.ts only.\n * Not part of the public package surface — `index.ts` does not re-export it.\n * Audit D1-W4 (2026-05-08).\n */\nexport function firstFailedExitCode(result: PreflightResult): number {\n  // Map preflight-check names (apcore-js PROTOCOL_SPEC) to CLI exit codes.\n  // Symbolic references so renumbering in errors.ts EXIT_CODES stays in sync.\n  const checkToExit: Record<string, number> = {\n    module_id: EXIT_CODES.INVALID_CLI_INPUT,\n    module_lookup: EXIT_CODES.MODULE_NOT_FOUND,\n    call_chain: EXIT_CODES.MODULE_EXECUTE_ERROR,\n    acl: EXIT_CODES.ACL_DENIED,\n    schema: EXIT_CODES.SCHEMA_VALIDATION_ERROR,\n    approval: EXIT_CODES.APPROVAL_DENIED,\n    module_preflight: EXIT_CODES.MODULE_EXECUTE_ERROR,\n  };\n  for (const check of result.checks) {\n    if (!check.passed) {\n      return checkToExit[check.check] ?? EXIT_CODES.MODULE_EXECUTE_ERROR;\n    }\n  }\n  return EXIT_CODES.MODULE_EXECUTE_ERROR;\n}\n","/**\n * Init command — scaffold new apcore modules (Phase 1).\n */\n\nimport { Command } from \"commander\";\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { EXIT_CODES } from \"./errors.js\";\n\n/**\n * Wrap a filesystem operation and exit with MODULE_EXECUTE_ERROR on failure.\n * Unwrapped mkdirSync/writeFileSync would surface raw Node stack traces to the\n * user; this helper funnels them through the CLI's standard stderr/exit path.\n */\nfunction runFsOp<T>(op: string, targetPath: string, fn: () => T, partial?: string[]): T {\n  try {\n    return fn();\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    process.stderr.write(`Error: failed to ${op} ${targetPath}: ${msg}\\n`);\n    if (partial && partial.length > 0) {\n      process.stderr.write(\n        `  Partial scaffold left on disk — you may want to remove: ${partial.join(\", \")}\\n`,\n      );\n    }\n    process.exit(EXIT_CODES.MODULE_EXECUTE_ERROR);\n  }\n}\n\nconst DECORATOR_TEMPLATE = `\\\nimport { module } from \"apcore-js\";\nimport { Type } from \"@sinclair/typebox\";\n\nexport const {varName} = module({\n  id: \"{moduleId}\",\n  description: \"{description}\",\n  inputSchema: Type.Object({}),\n  outputSchema: Type.Object({ status: Type.String() }),\n  execute: (_inputs) => {\n    // TODO: implement\n    return { status: \"ok\" };\n  },\n});\n`;\n\nconst CONVENTION_TEMPLATE = `\\\n/**\n * {description}\n */\n{cliGroupLine}\nexport function {funcName}(): Record<string, unknown> {\n  // TODO: implement\n  return { status: \"ok\" };\n}\n`;\n\nconst BINDING_TEMPLATE = `\\\nspec_version: \"1.0\"\nbindings:\n  - module_id: \"{moduleId}\"\n    target: \"{target}\"\n    description: \"{description}\"\n    auto_schema: true\n`;\n\n/**\n * Simple template rendering: replaces {key} with values from the context.\n */\nfunction renderTemplate(template: string, context: Record<string, string>): string {\n  let result = template;\n  for (const [key, value] of Object.entries(context)) {\n    // Replace all occurrences of {key} with the value\n    result = result.split(`{${key}}`).join(value);\n  }\n  return result;\n}\n\n/**\n * Register the init command group on the CLI program.\n */\nexport function registerInitCommand(cli: Command): void {\n  const initGroup = cli.command(\"init\").description(\"Scaffold new apcore modules.\");\n\n  initGroup\n    .command(\"module <module-id>\")\n    .description(\"Create a new module from a template.\\n\\nMODULE_ID is the module identifier (e.g., ops.deploy, user.create).\")\n    .option(\n      \"--style <style>\",\n      \"Module style: decorator (@module), convention (plain function), or binding (YAML).\",\n      \"convention\",\n    )\n    .option(\"--dir <path>\", \"Output directory. Default: extensions/ or commands/.\")\n    .option(\"-d, --description <text>\", \"Module description.\", \"TODO: add description\")\n    .action((moduleId: string, opts: { style: string; dir?: string; description: string }) => {\n      // Parse module_id into parts\n      const lastDot = moduleId.lastIndexOf(\".\");\n      const prefix = lastDot >= 0 ? moduleId.substring(0, lastDot) : moduleId;\n      const funcName = lastDot >= 0 ? moduleId.substring(lastDot + 1) : moduleId;\n\n      const style = opts.style;\n      const description = opts.description;\n\n      // Validate --dir to prevent path traversal\n      const dir = opts.dir ?? (style === \"decorator\" ? \"extensions\" : style === \"binding\" ? \"bindings\" : \"commands\");\n      if (dir.split(path.sep).includes(\"..\") || dir.split(\"/\").includes(\"..\")) {\n        process.stderr.write(`Error: Output directory must not contain '..' path components.\\n`);\n        process.exit(2);\n      }\n\n      switch (style) {\n        case \"decorator\":\n          createDecoratorModule(moduleId, prefix, funcName, description, dir);\n          break;\n        case \"convention\":\n          createConventionModule(moduleId, prefix, funcName, description, dir);\n          break;\n        case \"binding\":\n          createBindingModule(moduleId, prefix, funcName, description, dir);\n          break;\n        default:\n          process.stderr.write(`Error: Unknown style '${style}'\\n`);\n          process.exit(2);\n      }\n    });\n}\n\nfunction createDecoratorModule(\n  moduleId: string,\n  _prefix: string,\n  funcName: string,\n  description: string,\n  outputDir: string,\n): void {\n  runFsOp(\"create directory\", outputDir, () => fs.mkdirSync(outputDir, { recursive: true }));\n  const filename = moduleId.replace(/\\./g, \"_\") + \".ts\";\n  const filepath = path.join(outputDir, filename);\n\n  const varName = funcName + \"Module\";\n  const content = renderTemplate(DECORATOR_TEMPLATE, {\n    moduleId,\n    varName,\n    funcName,\n    description,\n  });\n  runFsOp(\"write file\", filepath, () => fs.writeFileSync(filepath, content));\n  process.stdout.write(`Created ${filepath}\\n`);\n}\n\nfunction createConventionModule(\n  moduleId: string,\n  prefix: string,\n  funcName: string,\n  description: string,\n  outputDir: string,\n): void {\n  // If prefix has dots, create subdirectories\n  const prefixParts = prefix.split(\".\");\n  const dirPath = prefixParts.length > 1\n    ? path.join(outputDir, ...prefixParts.slice(0, -1))\n    : outputDir;\n  runFsOp(\"create directory\", dirPath, () => fs.mkdirSync(dirPath, { recursive: true }));\n\n  let filename: string;\n  if (prefixParts.length > 1) {\n    filename = prefixParts[prefixParts.length - 1] + \".ts\";\n  } else {\n    filename = prefix + \".ts\";\n  }\n  // If the file would be the same as the function name, use prefix as filename\n  if (prefix === funcName) {\n    filename = prefix + \".ts\";\n  }\n  const filepath = path.join(dirPath, filename);\n\n  const cliGroupLine = moduleId.includes(\".\")\n    ? `export const CLI_GROUP = \"${prefixParts[0]}\";\\n`\n    : \"\";\n\n  const content = renderTemplate(CONVENTION_TEMPLATE, {\n    funcName,\n    description,\n    cliGroupLine,\n  });\n  runFsOp(\"write file\", filepath, () => fs.writeFileSync(filepath, content));\n  process.stdout.write(`Created ${filepath}\\n`);\n}\n\nfunction createBindingModule(\n  moduleId: string,\n  prefix: string,\n  funcName: string,\n  description: string,\n  outputDir: string,\n): void {\n  const partial: string[] = [];\n  runFsOp(\"create directory\", outputDir, () => fs.mkdirSync(outputDir, { recursive: true }));\n\n  const yamlFile = path.join(outputDir, moduleId.replace(/\\./g, \"_\") + \".binding.yaml\");\n  const target = `commands.${prefix}:${funcName}`;\n\n  const yamlContent = renderTemplate(BINDING_TEMPLATE, {\n    moduleId,\n    target,\n    description,\n  });\n  runFsOp(\"write file\", yamlFile, () => fs.writeFileSync(yamlFile, yamlContent));\n  partial.push(yamlFile);\n  process.stdout.write(`Created ${yamlFile}\\n`);\n\n  // Also create the target function file\n  const baseSrc = \"commands\";\n  runFsOp(\"create directory\", baseSrc, () => fs.mkdirSync(baseSrc, { recursive: true }), partial);\n  const srcFile = path.join(baseSrc, prefix.replace(/\\./g, \"_\") + \".ts\");\n  if (!fs.existsSync(srcFile)) {\n    const srcContent =\n      `export function ${funcName}(): Record<string, unknown> {\\n` +\n      `  /** ${description} */\\n` +\n      \"  // TODO: implement\\n\" +\n      '  return { status: \"ok\" };\\n' +\n      \"}\\n\";\n    runFsOp(\"write file\", srcFile, () => fs.writeFileSync(srcFile, srcContent), partial);\n    process.stdout.write(`Created ${srcFile}\\n`);\n  }\n}\n","/**\n * Display overlay helpers — shared resolution logic for CLI surfaces.\n */\n\nimport type { ModuleDescriptor } from \"./cli.js\";\nimport { lookupBindingDisplay } from \"./main.js\";\n\n/**\n * Extract resolved display overlay from a ModuleDescriptor's metadata.\n *\n * Resolution order:\n *   1. `descriptor.metadata.display` — overlay already baked into the\n *      descriptor (e.g. applied by apcore-toolkit's RegistryWriter at\n *      discovery time).\n *   2. Binding display map — populated by\n *      `applyToolkitIntegration(undefined, bindingPath)` from a\n *      `.binding.yaml` supplied via `--binding`. Used as a fallback when\n *      the descriptor was registered without overlay metadata.\n */\nexport function getDisplay(descriptor: ModuleDescriptor): Record<string, unknown> {\n  const metadata = descriptor.metadata ?? {};\n  const display = (metadata as Record<string, unknown>).display;\n  if (display && typeof display === \"object\" && !Array.isArray(display)) {\n    return display as Record<string, unknown>;\n  }\n  const overlay = lookupBindingDisplay(descriptor.id);\n  return overlay ?? {};\n}\n\n/**\n * Return [displayName, description, tags] resolved from the display overlay.\n *\n * Falls back to scanner-provided values when no overlay is present.\n */\nexport function getCliDisplayFields(descriptor: ModuleDescriptor): [string, string, string[]] {\n  const display = getDisplay(descriptor);\n  const cli = (display.cli && typeof display.cli === \"object\" && !Array.isArray(display.cli))\n    ? (display.cli as Record<string, unknown>)\n    : {};\n  const name = (cli.alias as string | undefined)\n    ?? (display.alias as string | undefined)\n    ?? descriptor.id;\n  const desc = (cli.description as string | undefined) ?? descriptor.description;\n  const tags = (display.tags as string[] | undefined) ?? descriptor.tags ?? [];\n  return [name, desc, tags];\n}\n","/**\n * ConfigResolver — 4-tier config resolution (CLI flag > env > file > default).\n *\n * Protocol spec: Configuration resolution\n */\n\nimport * as fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport yaml from \"js-yaml\";\nimport { warn as logWarn } from \"./logger.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/**\n * Default configuration values.\n *\n * Audit D9 (config cleanup, v0.6.x): the entries `sandbox.enabled`,\n * `cli.auto_approve`, `cli.stdin_buffer_limit`, and the eight `apcore-cli.*`\n * namespace aliases were removed because no production code path reads\n * them via `resolve()`. Sandbox is configured via the `--sandbox` CLI flag,\n * auto-approve via `--yes`, the stdin buffer is hard-coded, and namespace\n * aliases are registered separately by `apcore-js`'s Config Bus when\n * `registerConfigNamespace()` runs at `createCli` startup. The cross-key\n * file-lookup mechanism (`NAMESPACE_TO_LEGACY` / `LEGACY_TO_NAMESPACE`)\n * still works regardless — it does not depend on these DEFAULTS entries.\n */\nexport const DEFAULTS: Record<string, unknown> = {\n  \"extensions.root\": \"./extensions\",\n  \"logging.level\": \"WARNING\",\n  \"cli.help_text_max_length\": 1000,\n  // FE-11 config keys\n  \"cli.approval_timeout\": 60,\n  \"cli.strategy\": \"standard\",\n  \"cli.group_depth\": 1,\n  // Exposure filtering (FE-12)\n  \"expose.mode\": \"all\",\n  \"expose.include\": [],\n  \"expose.exclude\": [],\n  // Builtin group visibility (FE-13) — apcli.* keys are NOT in DEFAULTS.\n  // The runtime reads them via resolveObject('apcli') (raw yaml walk) and\n  // does not use the flat-key resolve() path. Python and Rust have no such\n  // entries either. (D11-008 cleanup)\n};\n\n/**\n * Defaults published to the apcore-cli Config Bus namespace (apcore >= 0.15.0).\n *\n * Exported for testability. Mirrors the snake_case DEFAULTS entries, with\n * `apcli` expressed as a nested object (matches the natural yaml shape).\n */\nexport const NAMESPACE_DEFAULTS: Record<string, unknown> = {\n  stdin_buffer_limit: 10_485_760,\n  auto_approve: false,\n  help_text_max_length: 1000,\n  logging_level: \"WARNING\",\n  approval_timeout: 60,\n  strategy: \"standard\",\n  group_depth: 1,\n  // FE-13 — builtin group visibility configuration\n  apcli: {\n    mode: null,\n    include: [] as string[],\n    exclude: [] as string[],\n    disable_env: false,\n  },\n};\n\n/** Namespace key ↔ legacy key mapping for backward compatibility. */\nconst NAMESPACE_TO_LEGACY: Record<string, string> = {\n  \"apcore-cli.stdin_buffer_limit\": \"cli.stdin_buffer_limit\",\n  \"apcore-cli.auto_approve\": \"cli.auto_approve\",\n  \"apcore-cli.help_text_max_length\": \"cli.help_text_max_length\",\n  \"apcore-cli.logging_level\": \"logging.level\",\n};\nconst LEGACY_TO_NAMESPACE: Record<string, string> = Object.fromEntries(\n  Object.entries(NAMESPACE_TO_LEGACY).map(([k, v]) => [v, k]),\n);\n\n/**\n * Register the apcore-cli Config Bus namespace (apcore >= 0.15.0).\n * Safe to call even when apcore-js is unavailable or < 0.15.0.\n */\nexport function registerConfigNamespace(): void {\n  try {\n    // Use createRequire to load apcore-js from an ESM module without relying on\n    // tsup's `shims` option (which injects a `require` into the bundled output\n    // but not into vitest/tsx dev paths). Native `require()` at module scope is\n    // a ReferenceError in strict ESM and would silently no-op via the catch.\n    const nodeRequire = createRequire(import.meta.url);\n    const { Config } = nodeRequire(\"apcore-js\");\n    if (typeof Config?.registerNamespace === \"function\") {\n      Config.registerNamespace({\n        name: \"apcore-cli\",\n        envPrefix: \"APCORE_CLI\",\n        defaults: NAMESPACE_DEFAULTS,\n      });\n    }\n  } catch {\n    // apcore-js not installed or < 0.15.0 — graceful no-op\n  }\n}\n\n// ---------------------------------------------------------------------------\n// ConfigResolver\n// ---------------------------------------------------------------------------\n\n/**\n * Resolves configuration from four tiers (highest to lowest priority):\n *   1. CLI flags\n *   2. Environment variables\n *   3. Config file (YAML/JSON)\n *   4. Built-in defaults\n */\nexport class ConfigResolver {\n  private readonly cliFlags: Record<string, unknown>;\n  private readonly configPath: string;\n  private fileCache: Record<string, unknown> | null = null;\n  private fileCacheLoaded = false;\n  /**\n   * Raw parsed yaml root (pre-flatten). Populated alongside `fileCache`\n   * on load. Used by `resolveObject()` to walk nested paths without\n   * invoking `flattenDict` — see FE-13 spec §4.8 M1 note.\n   * `null` when no config file is present or parsing fails.\n   */\n  private _rawConfig: Record<string, unknown> | null = null;\n\n  constructor(cliFlags?: Record<string, unknown>, configPath?: string) {\n    this.cliFlags = cliFlags ?? {};\n    this.configPath = configPath ?? \"apcore.yaml\";\n  }\n\n  /**\n   * Resolve a single configuration key across all four tiers.\n   */\n  resolve(key: string, cliFlag?: string, envVar?: string): unknown {\n    // Tier 1: CLI flag\n    //\n    // Cross-SDK parity (D11-007, 2026-04-26): only consult `cliFlags` when\n    // the caller passed an explicit `cliFlag` argument. Previously this code\n    // used `cliFlag ?? key` which silently fell back to looking up the\n    // config key itself in the cliFlags map — a phantom Tier-1 lookup that\n    // could shadow file/default values when callers populated cliFlags with\n    // config-keyed entries. Python (config.py:66) and Rust (config.rs:119)\n    // skip Tier-1 entirely when the flag arg is None / missing; TS now\n    // matches.\n    if (cliFlag !== undefined && cliFlag in this.cliFlags) {\n      const value = this.cliFlags[cliFlag];\n      if (value !== null && value !== undefined) {\n        return value;\n      }\n    }\n\n    // Tier 2: Environment variable\n    if (envVar) {\n      const envValue = process.env[envVar];\n      if (envValue !== undefined && envValue !== \"\") {\n        return envValue;\n      }\n    }\n\n    // Tier 3: Config file (try both namespace and legacy keys)\n    const fileValue = this.resolveFromFile(key);\n    if (fileValue !== undefined) {\n      return fileValue;\n    }\n    const altKey = NAMESPACE_TO_LEGACY[key] ?? LEGACY_TO_NAMESPACE[key];\n    if (altKey) {\n      const altFileValue = this.resolveFromFile(altKey);\n      if (altFileValue !== undefined) {\n        return altFileValue;\n      }\n    }\n\n    // Tier 4: Defaults\n    return DEFAULTS[key];\n  }\n\n  /**\n   * Load a value from the config file using a dot-separated key path.\n   */\n  private resolveFromFile(key: string): unknown {\n    if (!this.fileCacheLoaded) {\n      this.fileCache = this.loadConfigFile();\n      this.fileCacheLoaded = true;\n    }\n    if (this.fileCache === null) {\n      return undefined;\n    }\n    return this.fileCache[key];\n  }\n\n  /**\n   * Resolve a configuration key to its raw nested value (FE-13).\n   *\n   * Unlike `resolve()`, this method does NOT flatten the yaml tree — it\n   * walks the dot-separated path directly against the parsed yaml root.\n   * This lets callers retrieve non-leaf structures (booleans, arrays,\n   * objects) such as the `apcli` visibility config, which is naturally\n   * shaped as a nested object in apcore.yaml.\n   *\n   * Semantics:\n   *   - Returns `null` when no config file is loaded or when the path is\n   *     not present / descends into a non-object node (including arrays).\n   *   - Returns the raw value (boolean / array / object / scalar) when the\n   *     full path resolves to a leaf or intermediate node.\n   *\n   * Intentionally DOES NOT consult DEFAULTS, env vars, or CLI flags — it is\n   * strictly a yaml-tree accessor. Scalar `resolve()` semantics are\n   * unaffected.\n   */\n  resolveObject(key: string): unknown {\n    // Ensure raw config is populated (lazy load parity with `resolve`).\n    if (!this.fileCacheLoaded) {\n      this.fileCache = this.loadConfigFile();\n      this.fileCacheLoaded = true;\n    }\n    if (this._rawConfig == null) {\n      return null;\n    }\n    const parts = key.split(\".\");\n    let cur: unknown = this._rawConfig;\n    for (const p of parts) {\n      if (\n        cur != null &&\n        typeof cur === \"object\" &&\n        !Array.isArray(cur) &&\n        p in (cur as Record<string, unknown>)\n      ) {\n        cur = (cur as Record<string, unknown>)[p];\n      } else {\n        return null;\n      }\n    }\n    return cur;\n  }\n\n  /**\n   * Load and flatten a YAML config file.\n   */\n  private loadConfigFile(): Record<string, unknown> | null {\n    let content: string;\n    try {\n      content = fs.readFileSync(this.configPath, \"utf-8\");\n    } catch (err: unknown) {\n      if (err instanceof Error && \"code\" in err && err.code === \"ENOENT\") {\n        return null;\n      }\n      logWarn(\n        `Configuration file '${this.configPath}' is malformed, using defaults.`,\n      );\n      return null;\n    }\n\n    let parsed: unknown;\n    try {\n      parsed = yaml.load(content);\n    } catch {\n      logWarn(\n        `Configuration file '${this.configPath}' is malformed, using defaults.`,\n      );\n      return null;\n    }\n\n    if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n      logWarn(\n        `Configuration file '${this.configPath}' is malformed, using defaults.`,\n      );\n      return null;\n    }\n\n    // Record the pre-flatten root for resolveObject() (FE-13).\n    this._rawConfig = parsed as Record<string, unknown>;\n    return this.flattenDict(parsed as Record<string, unknown>);\n  }\n\n  /**\n   * Flatten nested dict to dot-notation keys.\n   */\n  private flattenDict(\n    d: Record<string, unknown>,\n    prefix = \"\",\n  ): Record<string, unknown> {\n    const result: Record<string, unknown> = {};\n    for (const [key, value] of Object.entries(d)) {\n      const fullKey = prefix ? `${prefix}.${key}` : key;\n      if (\n        typeof value === \"object\" &&\n        value !== null &&\n        !Array.isArray(value)\n      ) {\n        Object.assign(\n          result,\n          this.flattenDict(value as Record<string, unknown>, fullKey),\n        );\n      } else {\n        result[fullKey] = value;\n      }\n    }\n    return result;\n  }\n}\n","/**\n * Shell completion + man page generation.\n *\n * Protocol spec: Shell integration\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { Command, Help, Option } from \"commander\";\nimport { EXIT_CODES } from \"./errors.js\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Convert a prog_name like 'my-tool' to a valid shell identifier '_my_tool'.\n */\nfunction makeFunctionName(progName: string): string {\n  return \"_\" + progName.replace(/[^a-zA-Z0-9]/g, \"_\");\n}\n\n/**\n * Shell-safe quoting.\n */\nfunction shellQuote(s: string): string {\n  return \"'\" + s.replace(/'/g, \"'\\\\''\") + \"'\";\n}\n\n// ---------------------------------------------------------------------------\n// Completion generators\n// ---------------------------------------------------------------------------\n\n/**\n * Enumerate non-hidden registered subcommands on the apcli Commander group.\n *\n * Per spec §4.13 (T-APCLI-40 regression guard): completion generation reads\n * Commander's registered set verbatim and MUST NOT re-invoke\n * `ApcliGroup.isSubcommandIncluded`. Registration time is the gate.\n */\nfunction enumerateApcliSubcommands(apcliGroup: Command | undefined): string[] {\n  if (!apcliGroup) return [];\n  return apcliGroup.commands\n    .filter((c) => !isCmdHidden(c))\n    .map((c) => c.name());\n}\n\n/** Enumerate non-hidden root-level subcommands on the program. */\nfunction enumerateRootCommands(program: Command): string[] {\n  return program.commands\n    .filter((c) => !isCmdHidden(c))\n    .map((c) => c.name());\n}\n\n/** Locate the apcli Commander subcommand if present. */\nfunction findApcliGroup(program: Command): Command | undefined {\n  return program.commands.find((c) => c.name() === \"apcli\");\n}\n\n/** Detect Commander command hidden flag across versions. */\nfunction isCmdHidden(cmd: Command): boolean {\n  const withHiddenFn = cmd as unknown as { hidden?: () => boolean };\n  const withHiddenField = cmd as unknown as { _hidden?: boolean };\n  if (typeof withHiddenFn.hidden === \"function\") return !!withHiddenFn.hidden();\n  return !!withHiddenField._hidden;\n}\n\nexport function generateBashCompletion(\n  progName: string,\n  program?: Command,\n): string {\n  const fn = makeFunctionName(progName);\n  const quoted = shellQuote(progName);\n\n  const apcliGroup = program ? findApcliGroup(program) : undefined;\n  const apcliVisible = apcliGroup !== undefined && !isCmdHidden(apcliGroup);\n  const rootCmds = program\n    ? enumerateRootCommands(program).filter(\n        (n) => n !== \"apcli\" || apcliVisible,\n      )\n    : [];\n  const apcliCmds = apcliVisible ? enumerateApcliSubcommands(apcliGroup) : [];\n\n  const rootOpts = rootCmds.join(\" \");\n  const apcliOpts = apcliCmds.join(\" \");\n\n  let body =\n    `${fn}() {\\n` +\n    `    local cur prev opts\\n` +\n    `    COMPREPLY=()\\n` +\n    `    cur=\"\\${COMP_WORDS[COMP_CWORD]}\"\\n` +\n    `    prev=\"\\${COMP_WORDS[COMP_CWORD-1]}\"\\n` +\n    `\\n` +\n    `    if [[ \\${COMP_CWORD} -eq 1 ]]; then\\n` +\n    `        opts=\"${rootOpts}\"\\n` +\n    `        COMPREPLY=( $(compgen -W \"\\${opts}\" -- \\${cur}) )\\n` +\n    `        return 0\\n` +\n    `    fi\\n`;\n  if (apcliVisible) {\n    body +=\n      `\\n` +\n      `    if [[ \\${COMP_CWORD} -eq 2 ]]; then\\n` +\n      `        if [[ \"\\${COMP_WORDS[1]}\" == \"apcli\" ]]; then\\n` +\n      `            local apcli_cmds=\"${apcliOpts}\"\\n` +\n      `            COMPREPLY=( $(compgen -W \"\\${apcli_cmds}\" -- \\${cur}) )\\n` +\n      `            return 0\\n` +\n      `        fi\\n` +\n      `    fi\\n`;\n  }\n  body += `}\\n` + `complete -F ${fn} ${quoted}\\n`;\n  return body;\n}\n\nexport function generateZshCompletion(\n  progName: string,\n  program?: Command,\n): string {\n  const fn = makeFunctionName(progName);\n  const quoted = shellQuote(progName);\n\n  const apcliGroup = program ? findApcliGroup(program) : undefined;\n  const apcliVisible = apcliGroup !== undefined && !isCmdHidden(apcliGroup);\n  const rootCmds = program\n    ? enumerateRootCommands(program).filter(\n        (n) => n !== \"apcli\" || apcliVisible,\n      )\n    : [];\n  const apcliCmds = apcliVisible ? enumerateApcliSubcommands(apcliGroup) : [];\n\n  const rootEntries = rootCmds.map((n) => `        '${n}:${n}'`).join(\"\\n\");\n  const apcliEntries = apcliCmds.map((n) => `        '${n}:${n}'`).join(\"\\n\");\n\n  return (\n    `#compdef ${progName}\\n` +\n    `\\n` +\n    `${fn}() {\\n` +\n    `    local -a commands\\n` +\n    `    commands=(\\n` +\n    (rootEntries ? rootEntries + \"\\n\" : \"\") +\n    `    )\\n` +\n    `    local -a apcli_cmds\\n` +\n    `    apcli_cmds=(\\n` +\n    (apcliEntries ? apcliEntries + \"\\n\" : \"\") +\n    `    )\\n` +\n    `\\n` +\n    `    _arguments -C \\\\\\n` +\n    `        '1:command:->command' \\\\\\n` +\n    `        '*::arg:->args'\\n` +\n    `\\n` +\n    `    case \"$state\" in\\n` +\n    `        command)\\n` +\n    `            _describe -t commands '${progName} commands' commands\\n` +\n    `            ;;\\n` +\n    `        args)\\n` +\n    `            case \"\\${words[1]}\" in\\n` +\n    `                apcli)\\n` +\n    `                    _describe -t apcli_cmds '${progName} apcli commands' apcli_cmds\\n` +\n    `                    ;;\\n` +\n    `            esac\\n` +\n    `            ;;\\n` +\n    `    esac\\n` +\n    `}\\n` +\n    `\\n` +\n    `compdef ${fn} ${quoted}\\n`\n  );\n}\n\nexport function generateFishCompletion(\n  progName: string,\n  program?: Command,\n): string {\n  const quoted = shellQuote(progName);\n\n  const apcliGroup = program ? findApcliGroup(program) : undefined;\n  const apcliVisible = apcliGroup !== undefined && !isCmdHidden(apcliGroup);\n  const rootCmds = program\n    ? enumerateRootCommands(program).filter(\n        (n) => n !== \"apcli\" || apcliVisible,\n      )\n    : [];\n  const apcliCmds = apcliVisible ? enumerateApcliSubcommands(apcliGroup) : [];\n\n  const lines: string[] = [];\n  lines.push(`# Fish completions for ${progName}`);\n  for (const name of rootCmds) {\n    lines.push(\n      `complete -c ${quoted} -n \"__fish_use_subcommand\" -a ${name} -d \"${name}\"`,\n    );\n  }\n  if (apcliVisible && apcliCmds.length > 0) {\n    lines.push(\"\");\n    for (const name of apcliCmds) {\n      lines.push(\n        `complete -c ${quoted} -n \"__fish_seen_subcommand_from apcli\" -a ${name} -d \"${name}\"`,\n      );\n    }\n  }\n  return lines.join(\"\\n\") + \"\\n\";\n}\n\n// ---------------------------------------------------------------------------\n// Program-wide man page generation\n// ---------------------------------------------------------------------------\n\n/** Escape a string for roff output. */\nfunction roffEscape(s: string): string {\n  return s.replace(/\\\\/g, \"\\\\\\\\\").replace(/-/g, \"\\\\-\").replace(/'/g, \"\\\\(aq\");\n}\n\n/**\n * Build a complete roff man page for the entire program.\n * Covers all registered commands including downstream business commands.\n */\nexport function buildProgramManPage(\n  program: Command,\n  progName: string,\n  version: string,\n  description?: string,\n  docsUrl?: string,\n): string {\n  const help = new Help();\n  const today = new Date().toISOString().slice(0, 10);\n  const s: string[] = [];\n\n  const resolvedDesc = description ?? program.description() ?? `${progName} CLI`;\n\n  s.push(`.TH \"${progName.toUpperCase()}\" \"1\" \"${today}\" \"${progName} ${version}\" \"${progName} Manual\"`);\n\n  s.push(\".SH NAME\");\n  s.push(`${progName} \\\\- ${roffEscape(resolvedDesc)}`);\n\n  s.push(\".SH SYNOPSIS\");\n  s.push(`\\\\fB${progName}\\\\fR [\\\\fIglobal\\\\-options\\\\fR] \\\\fIcommand\\\\fR [\\\\fIcommand\\\\-options\\\\fR]`);\n\n  if (resolvedDesc) {\n    s.push(\".SH DESCRIPTION\");\n    s.push(roffEscape(resolvedDesc));\n  }\n\n  // Global options\n  const globalOpts = help.visibleOptions(program)\n    .filter((o) => ![\"help\", \"version\", \"all\", \"man\"].includes(o.long?.replace(\"--\", \"\") ?? \"\"));\n  if (globalOpts.length > 0) {\n    s.push(\".SH GLOBAL OPTIONS\");\n    for (const opt of globalOpts) {\n      const flag = [opt.short, opt.long].filter(Boolean).join(\", \");\n      s.push(\".TP\");\n      s.push(`\\\\fB${roffEscape(flag)}\\\\fR`);\n      if (opt.description) s.push(roffEscape(opt.description));\n    }\n  }\n\n  // Commands\n  const allCommands = help.visibleCommands(program);\n  if (allCommands.length > 0) {\n    s.push(\".SH COMMANDS\");\n    for (const cmd of allCommands) {\n      if (cmd.name() === \"help\") continue;\n\n      const desc = help.subcommandDescription(cmd);\n      s.push(\".TP\");\n      s.push(`\\\\fB${progName} ${roffEscape(cmd.name())}\\\\fR`);\n      if (desc) s.push(roffEscape(desc));\n\n      // Command options\n      const cmdHelp = new Help();\n      const opts = cmdHelp.visibleOptions(cmd)\n        .filter((o) => ![\"help\", \"version\"].includes(o.long?.replace(\"--\", \"\") ?? \"\"));\n      for (const opt of opts) {\n        const flag = [opt.short, opt.long].filter(Boolean).join(\", \");\n        s.push(\".RS\");\n        s.push(\".TP\");\n        s.push(`\\\\fB${roffEscape(flag)}\\\\fR`);\n        if (opt.description) s.push(roffEscape(opt.description));\n        s.push(\".RE\");\n      }\n\n      // Nested subcommands (e.g., series init, asset add)\n      const subCmds = cmdHelp.visibleCommands(cmd).filter((c) => c.name() !== \"help\");\n      for (const sub of subCmds) {\n        const subDesc = help.subcommandDescription(sub);\n        s.push(\".TP\");\n        s.push(`\\\\fB${progName} ${roffEscape(cmd.name())} ${roffEscape(sub.name())}\\\\fR`);\n        if (subDesc) s.push(roffEscape(subDesc));\n        const subOpts = cmdHelp.visibleOptions(sub)\n          .filter((o) => ![\"help\", \"version\"].includes(o.long?.replace(\"--\", \"\") ?? \"\"));\n        for (const opt of subOpts) {\n          const flag = [opt.short, opt.long].filter(Boolean).join(\", \");\n          s.push(\".RS\");\n          s.push(\".TP\");\n          s.push(`\\\\fB${roffEscape(flag)}\\\\fR`);\n          if (opt.description) s.push(roffEscape(opt.description));\n          s.push(\".RE\");\n        }\n      }\n    }\n  }\n\n  // Environment\n  s.push(\".SH ENVIRONMENT\");\n  s.push(\".TP\");\n  s.push(\"\\\\fBAPCORE_EXTENSIONS_ROOT\\\\fR\");\n  s.push(\"Path to the apcore extensions directory.\");\n  s.push(\".TP\");\n  s.push(\"\\\\fBAPCORE_CLI_AUTO_APPROVE\\\\fR\");\n  s.push(\"Set to \\\\fB1\\\\fR to bypass approval prompts.\");\n  s.push(\".TP\");\n  s.push(\"\\\\fBAPCORE_CLI_LOGGING_LEVEL\\\\fR\");\n  s.push(\"CLI\\\\-specific logging verbosity (DEBUG|INFO|WARNING|ERROR).\");\n\n  // Exit codes\n  s.push(\".SH EXIT CODES\");\n  const exitCodes: [string, string][] = [\n    [\"0\", \"Success.\"],\n    [\"1\", \"Module execution error.\"],\n    [\"2\", \"Invalid CLI input or missing argument.\"],\n    [\"44\", \"Module not found, disabled, or failed to load.\"],\n    [\"45\", \"Input failed JSON Schema validation.\"],\n    [\"46\", \"Approval denied or timed out.\"],\n    [\"47\", \"Configuration error.\"],\n    [\"77\", \"ACL denied.\"],\n    [\"130\", \"Cancelled by user (SIGINT).\"],\n  ];\n  for (const [code, meaning] of exitCodes) {\n    s.push(`.TP\\n\\\\fB${code}\\\\fR\\n${meaning}`);\n  }\n\n  s.push(\".SH SEE ALSO\");\n  s.push(`\\\\fB${progName} \\\\-\\\\-help \\\\-\\\\-verbose\\\\fR for full option list.`);\n  if (docsUrl) {\n    s.push(`.PP\\nFull documentation at \\\\fI${roffEscape(docsUrl)}\\\\fR`);\n  }\n\n  return s.join(\"\\n\");\n}\n\n/**\n * Configure --help --man support on a Commander program.\n * When --man is passed with --help, outputs a complete roff man page\n * covering all registered commands (including downstream business commands).\n *\n * Usage in downstream projects:\n *   configureManHelp(program, 'reach', '0.2.0', 'ReachForge: The Social Influence Engine', 'https://reachforge.dev/docs');\n */\nexport function configureManHelp(\n  program: Command,\n  progName: string,\n  version: string,\n  description?: string,\n  docsUrl?: string,\n): void {\n  // Add --man as a hidden option\n  const manOpt = new Option(\"--man\", \"Output man page in roff format (use with --help)\").hideHelp();\n  program.addOption(manOpt);\n\n  // Intercept help to output roff when --man is set\n  program.addHelpText(\"beforeAll\", () => {\n    if (program.opts().man) {\n      const roff = buildProgramManPage(program, progName, version, description, docsUrl) + \"\\n\";\n\n      // If stdout is a TTY, render through a pager; otherwise output raw roff\n      // (allows piping/redirection like `reach --help --man > reach.1`)\n      if (process.stdout.isTTY) {\n        // Try mandoc first (available on macOS/BSD), then groff, then fall back to raw output\n        const pagers: Array<{ cmd: string; args: string[] }> = [\n          { cmd: \"mandoc\", args: [\"-a\"] },\n          { cmd: \"groff\",  args: [\"-man\", \"-Tutf8\"] },\n        ];\n        let rendered = false;\n        for (const { cmd, args } of pagers) {\n          const result = spawnSync(cmd, args, {\n            input: roff,\n            stdio: [\"pipe\", \"pipe\", \"pipe\"],\n            encoding: \"utf-8\",\n          });\n          if (result.status === 0 && result.stdout) {\n            const pager = process.env.PAGER || \"less\";\n            const pagerResult = spawnSync(pager, [\"-R\"], {\n              input: result.stdout,\n              stdio: [\"pipe\", \"inherit\", \"inherit\"],\n            });\n            if (pagerResult.status !== null) {\n              rendered = true;\n              break;\n            }\n          }\n        }\n        if (!rendered) {\n          process.stdout.write(roff);\n        }\n      } else {\n        process.stdout.write(roff);\n      }\n      process.exit(0);\n    }\n    return \"\";\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Command registration\n// ---------------------------------------------------------------------------\n\n/**\n * Locate the root Commander program by walking the parent chain from `host`.\n * When `host` is the root itself, returns `host`.\n */\nfunction findRootProgram(host: Command): Command {\n  let cur: Command = host;\n  while (cur.parent) cur = cur.parent;\n  return cur;\n}\n\n/**\n * Register the `completion` subcommand on `host` (typically the apcli group\n * per spec §4.1, or the root program during the transition period).\n *\n * The completion-script generator enumerates the actually-registered set of\n * subcommands from the root program's Commander tree at generation time\n * (spec §4.13).\n */\nexport function registerCompletionCommand(host: Command): void {\n  const completionCmd = new Command(\"completion\")\n    .description(\"Generate a shell completion script and print it to stdout.\")\n    .argument(\"<shell>\", \"Shell type: bash, zsh, or fish\")\n    .action((shell: string) => {\n      const validShells = [\"bash\", \"zsh\", \"fish\"];\n      if (!validShells.includes(shell)) {\n        process.stderr.write(\n          `Error: Unknown shell '${shell}'. Expected: bash, zsh, or fish.\\n`,\n        );\n        process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n      }\n\n      const root = findRootProgram(host);\n      const resolved = root.name() || \"apcore-cli\";\n      const generators: Record<string, () => string> = {\n        bash: () => generateBashCompletion(resolved, root),\n        zsh: () => generateZshCompletion(resolved, root),\n        fish: () => generateFishCompletion(resolved, root),\n      };\n      process.stdout.write(generators[shell]());\n    });\n  host.addCommand(completionCmd);\n}\n\n// registerShellCommands was removed in FE-13 create-cli-integration.\n// Call registerCompletionCommand directly (typically from the apcli group\n// dispatcher) and configureManHelp at the root program to get --help --man.\n","/**\n * AuditLogger — JSONL audit trail.\n *\n * Protocol spec: Security — audit logging\n */\n\nimport * as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport { warn as logWarn } from \"../logger.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\ntype ExecutionStatus = \"success\" | \"error\";\n\ninterface AuditEntry {\n  timestamp: string;\n  user: string;\n  module_id: string;\n  input_hash: string;\n  status: ExecutionStatus;\n  exit_code: number;\n  duration_ms: number;\n}\n\n// ---------------------------------------------------------------------------\n// AuditLogger\n// ---------------------------------------------------------------------------\n\n/**\n * Appends structured JSONL entries to an audit log file for every module\n * execution, supporting compliance and debugging.\n */\nlet _auditLogger: AuditLogger | null = null;\n\n/**\n * Set the module-level audit logger instance.\n */\nexport function setAuditLogger(auditLogger: AuditLogger | null): void {\n  _auditLogger = auditLogger;\n}\n\n/**\n * Get the current module-level audit logger instance.\n */\nexport function getAuditLogger(): AuditLogger | null {\n  return _auditLogger;\n}\n\n/**\n * Produce a stable, key-order-independent JSON serialization at every nesting\n * level. Used by AuditLogger.hashInput to guarantee that logically-equal\n * inputs hash identically (modulo salt) regardless of source key ordering,\n * and that inputs differing only in nested fields produce distinct canonical\n * bytes.\n *\n * Exported for testability — do not rely on this as a general-purpose helper;\n * only AuditLogger's hash path is a supported caller.\n */\nexport function canonicalizeForHash(value: unknown): unknown {\n  if (value === null || typeof value !== \"object\") return value;\n  if (Array.isArray(value)) return value.map(canonicalizeForHash);\n  const src = value as Record<string, unknown>;\n  const sorted: Record<string, unknown> = {};\n  for (const key of Object.keys(src).sort()) {\n    sorted[key] = canonicalizeForHash(src[key]);\n  }\n  return sorted;\n}\n\nexport class AuditLogger {\n  static readonly DEFAULT_PATH = path.join(\n    os.homedir(),\n    \".apcore-cli\",\n    \"audit.jsonl\",\n  );\n\n  private readonly logPath: string;\n  private writeFailureWarned = false;\n\n  constructor(path?: string) {\n    this.logPath = path ?? AuditLogger.DEFAULT_PATH;\n    this.ensureDirectory();\n  }\n\n  private ensureDirectory(): void {\n    const dir = path.dirname(this.logPath);\n    try {\n      fs.mkdirSync(dir, { recursive: true });\n      // Restrict to owner-only on Unix so audit log is not enumerable by\n      // other local UIDs on shared systems (mirrors Rust's 0o700 hardening).\n      try { fs.chmodSync(dir, 0o700); } catch { /* best-effort */ }\n    } catch {\n      // Silently ignore — we'll handle write errors in logExecution\n    }\n  }\n\n  logExecution(\n    moduleId: string,\n    inputData: Record<string, unknown>,\n    status: ExecutionStatus,\n    exitCode: number,\n    durationMs: number,\n  ): void {\n    const entry: AuditEntry = {\n      timestamp: new Date().toISOString(),\n      user: this.getUser(),\n      module_id: moduleId,\n      input_hash: this.hashInput(inputData),\n      status,\n      exit_code: exitCode,\n      duration_ms: durationMs,\n    };\n    try {\n      fs.appendFileSync(this.logPath, JSON.stringify(entry) + \"\\n\");\n      // Restrict to owner read/write (mirrors Rust's 0o600 hardening).\n      try { fs.chmodSync(this.logPath, 0o600); } catch { /* best-effort */ }\n    } catch (err) {\n      if (!this.writeFailureWarned) {\n        this.writeFailureWarned = true;\n        logWarn(`Could not write audit log: ${err}`);\n      }\n    }\n  }\n\n  private hashInput(inputData: Record<string, unknown>): string {\n    const salt = crypto.randomBytes(16);\n    const payload = JSON.stringify(canonicalizeForHash(inputData));\n    return crypto\n      .createHash(\"sha256\")\n      .update(Buffer.concat([salt, Buffer.from(payload, \"utf-8\")]))\n      .digest(\"hex\");\n  }\n\n  private getUser(): string {\n    try {\n      return os.userInfo().username;\n    } catch {\n      // Spec security.md (D11-W1): canonical fallback chain is\n      //   getlogin → pwd.getpwuid(getuid).pw_name → USER → LOGNAME → USERNAME → unknown\n      // os.userInfo() collapses the first two POSIX steps in Node; the env-var\n      // tail must include LOGNAME between USER and USERNAME for cross-SDK parity.\n      return (\n        process.env.USER ??\n        process.env.LOGNAME ??\n        process.env.USERNAME ??\n        \"unknown\"\n      );\n    }\n  }\n}\n","/**\n * system.usage aggregator — reads ~/.apcore-cli/audit.jsonl and groups by\n * module_id.\n *\n * Implements the `system.usage.summary` data pipeline described in\n * aiperceivable/apcore-cli#17:\n *\n *   Read audit.jsonl\n *     -> filter by time period (timestamp >= now - period; default 24h)\n *     -> group by module_id\n *     -> aggregate: calls, errors, avg latency_ms\n *\n * Module-protocol registration of `system.usage.summary` and\n * `system.usage.module` as registry-callable built-ins is tracked as a\n * follow-up; today the readers are invoked directly by the discovery layer.\n */\n\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\n\nexport interface UsageSummary {\n  module_id: string;\n  calls: number;\n  errors: number;\n  latency_ms: number;\n}\n\nexport type UsagePeriod = \"1h\" | \"24h\" | \"7d\" | \"30d\";\n\nconst PERIOD_TO_MS: Record<UsagePeriod, number> = {\n  \"1h\": 60 * 60 * 1000,\n  \"24h\": 24 * 60 * 60 * 1000,\n  \"7d\": 7 * 24 * 60 * 60 * 1000,\n  \"30d\": 30 * 24 * 60 * 60 * 1000,\n};\n\nconst DEFAULT_AUDIT_PATH = path.join(\n  os.homedir(),\n  \".apcore-cli\",\n  \"audit.jsonl\",\n);\n\n/**\n * Aggregate the audit log per-module over the given period.\n *\n * Returns an empty Map when the log is missing or empty — callers are\n * expected to fall back to id-sort with a visible message in that case.\n */\nexport function computeSummary(\n  options: { auditPath?: string; period?: UsagePeriod; now?: Date } = {},\n): Map<string, UsageSummary> {\n  const auditPath = options.auditPath ?? DEFAULT_AUDIT_PATH;\n  const period: UsagePeriod = options.period ?? \"24h\";\n  const cutoff = (options.now ?? new Date()).getTime() - PERIOD_TO_MS[period];\n\n  if (!fs.existsSync(auditPath)) {\n    return new Map();\n  }\n\n  let raw: string;\n  try {\n    raw = fs.readFileSync(auditPath, \"utf-8\");\n  } catch {\n    return new Map();\n  }\n\n  const counts = new Map<string, number>();\n  const errors = new Map<string, number>();\n  const latencySum = new Map<string, number>();\n\n  for (const line of raw.split(\"\\n\")) {\n    const trimmed = line.trim();\n    if (!trimmed) continue;\n    let entry: Record<string, unknown>;\n    try {\n      entry = JSON.parse(trimmed) as Record<string, unknown>;\n    } catch {\n      // Tolerate a partial last line from a crashed write rather than\n      // failing the sort (audit log is append-only JSONL).\n      continue;\n    }\n    const ts = typeof entry.timestamp === \"string\"\n      ? Date.parse(entry.timestamp)\n      : NaN;\n    if (Number.isNaN(ts) || ts < cutoff) continue;\n    const moduleId = typeof entry.module_id === \"string\" ? entry.module_id : null;\n    if (!moduleId) continue;\n    counts.set(moduleId, (counts.get(moduleId) ?? 0) + 1);\n    if (entry.status === \"error\") {\n      errors.set(moduleId, (errors.get(moduleId) ?? 0) + 1);\n    }\n    const duration = entry.duration_ms;\n    if (typeof duration === \"number\") {\n      latencySum.set(moduleId, (latencySum.get(moduleId) ?? 0) + duration);\n    }\n  }\n\n  const out = new Map<string, UsageSummary>();\n  for (const [id, calls] of counts) {\n    out.set(id, {\n      module_id: id,\n      calls,\n      errors: errors.get(id) ?? 0,\n      latency_ms: calls > 0 ? (latencySum.get(id) ?? 0) / calls : 0,\n    });\n  }\n  return out;\n}\n\n/**\n * Sort `modules` in place by `calls` | `errors` | `latency` using audit-log\n * data. Returns whether real usage data was used; when false, callers should\n * surface a visible message that explains the fallback (issue #17 AC).\n *\n * @param modules    Array of objects exposing an `id` (or `module_id`) field.\n * @param field      One of `calls`, `errors`, `latency`.\n * @param reverse    Defaults to true (descending — biggest first).\n */\nexport function sortModulesByUsage<T extends { id?: string; module_id?: string }>(\n  modules: T[],\n  field: \"calls\" | \"errors\" | \"latency\",\n  options: { reverse?: boolean; auditPath?: string; period?: UsagePeriod } = {},\n): { used: boolean } {\n  const reverse = options.reverse ?? true;\n  const summary = computeSummary({\n    auditPath: options.auditPath,\n    period: options.period,\n  });\n\n  if (summary.size === 0) {\n    modules.sort((a, b) => (a.id ?? a.module_id ?? \"\").localeCompare(b.id ?? b.module_id ?? \"\"));\n    if (reverse) modules.reverse();\n    return { used: false };\n  }\n\n  const key = (m: T): number => {\n    const id = m.id ?? m.module_id ?? \"\";\n    const s = summary.get(id);\n    if (!s) return 0;\n    return field === \"latency\" ? s.latency_ms : (field === \"calls\" ? s.calls : s.errors);\n  };\n\n  modules.sort((a, b) => {\n    const diff = key(a) - key(b);\n    if (diff !== 0) return reverse ? -diff : diff;\n    // Stable secondary sort by id for deterministic output when counts tie.\n    return (a.id ?? a.module_id ?? \"\").localeCompare(b.id ?? b.module_id ?? \"\");\n  });\n  return { used: true };\n}\n","/**\n * ConfigEncryptor — Keyring + AES-256-GCM fallback.\n *\n * Protocol spec: Security — config encryption\n */\n\nimport * as crypto from \"node:crypto\";\nimport * as os from \"node:os\";\nimport { ConfigDecryptionError } from \"../errors.js\";\nimport { warn as logWarn } from \"../logger.js\";\n\n// PBKDF2-HMAC-SHA256 iteration count — follows OWASP 2024+ minimum for SHA-256.\nconst PBKDF2_ITERATIONS = 600_000;\n\n// Static salt used only for backward-compatible reads of legacy enc: (v1) values.\nconst V1_STATIC_SALT = Buffer.from(\"apcore-cli-config-v1\");\n\n// ---------------------------------------------------------------------------\n// Keytar dynamic import helper\n// ---------------------------------------------------------------------------\n\nlet keytarModule: any = null; // eslint-disable-line @typescript-eslint/no-explicit-any\nasync function getKeytar(): Promise<any> { // eslint-disable-line @typescript-eslint/no-explicit-any\n  if (keytarModule) return keytarModule;\n  try {\n    // @ts-expect-error — keytar is an optional peer dependency\n    keytarModule = await import(\"keytar\");\n    return keytarModule;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Test-only seam: inject a stand-in `keytar` module so unit tests can\n * exercise reachable-but-failing keyring paths (D10-003 regression\n * coverage). Pass `null` to clear and fall back to real-keytar discovery\n * on the next call. Production code MUST NOT call this.\n */\nexport function _setKeytarForTesting(mod: unknown): void { // eslint-disable-line @typescript-eslint/no-explicit-any\n  keytarModule = mod;\n}\n\n// ---------------------------------------------------------------------------\n// ConfigEncryptor\n// ---------------------------------------------------------------------------\n\n/**\n * Encrypts and decrypts configuration values. Prefers OS keyring for key\n * storage, falling back to AES-256-GCM with a key derived from\n * APCORE_CLI_CONFIG_PASSPHRASE when set, or from hostname+username\n * (obfuscation-only) as a last resort.\n *\n * Wire format v2: enc:v2:<base64(salt(16)+nonce(12)+tag(16)+ciphertext)>\n * Legacy format:  enc:<base64(nonce(12)+tag(16)+ciphertext)>  (read-only)\n */\nexport class ConfigEncryptor {\n  static readonly SERVICE_NAME = \"apcore-cli\";\n  // One-shot flag so the \"obfuscation only\" warning fires exactly once\n  // per process instead of once per encrypt/decrypt call.\n  private static weakFallbackWarned = false;\n\n  /**\n   * Encrypt and store a configuration value.\n   *\n   * Cross-SDK contract (D10-003, 2026-04-26): when the OS keyring is\n   * detected as available but `setPassword` then throws (locked keyring,\n   * transient backend failure, permission revoked, etc.), the error is\n   * propagated wrapped in a `ConfigDecryptionError`. Previously TS\n   * caught the exception and silently fell through to AES file encryption\n   * — a quiet downgrade that surprised users who expected a hard failure.\n   * Python lets the keyring exception propagate raw; Rust returns\n   * `ConfigDecryptionError::KeyringError`. The fall-through to AES is\n   * still reached when `getKeytar()` returns `null` (keyring\n   * genuinely unavailable on this platform / install).\n   */\n  async store(key: string, value: string): Promise<string> {\n    const keytar = await getKeytar();\n    if (keytar) {\n      try {\n        await keytar.setPassword(ConfigEncryptor.SERVICE_NAME, key, value);\n        return `keyring:${key}`;\n      } catch (err) {\n        // Reachable but rejected the write — surface the error rather\n        // than downgrading to file encryption. Use the existing\n        // ConfigDecryptionError class so callers handling either store\n        // or retrieve failures can keep a single catch.\n        const detail = err instanceof Error ? err.message : String(err);\n        throw new ConfigDecryptionError(\n          `Failed to store '${key}' in OS keyring: ${detail}. ` +\n            `Unset APCORE_CLI_CONFIG_PASSPHRASE-aware backends or unlock the keyring before retrying.`,\n        );\n      }\n    }\n    logWarn(\"OS keyring unavailable. Using file-based encryption.\");\n    const ciphertext = this.aesEncrypt(value);\n    return `enc:v2:${ciphertext.toString(\"base64\")}`;\n  }\n\n  /**\n   * Retrieve and decrypt a configuration value.\n   */\n  async retrieve(configValue: string, key: string): Promise<string> {\n    if (configValue.startsWith(\"keyring:\")) {\n      const keytar = await getKeytar();\n      if (!keytar) {\n        throw new ConfigDecryptionError(\n          `Keyring module not available to retrieve '${key}'.`,\n        );\n      }\n      try {\n        const refKey = configValue.slice(\"keyring:\".length);\n        const result = await keytar.getPassword(\n          ConfigEncryptor.SERVICE_NAME,\n          refKey,\n        );\n        if (result === null || result === undefined) {\n          throw new ConfigDecryptionError(\n            `Keyring entry not found for '${refKey}'.`,\n          );\n        }\n        return result;\n      } catch (err) {\n        if (err instanceof ConfigDecryptionError) throw err;\n        throw new ConfigDecryptionError(\n          `Failed to retrieve from keyring: ${err}`,\n        );\n      }\n    }\n\n    if (configValue.startsWith(\"enc:v2:\")) {\n      const data = Buffer.from(configValue.slice(\"enc:v2:\".length), \"base64\");\n      try {\n        return this.aesDecrypt(data);\n      } catch {\n        throw new ConfigDecryptionError(\n          `Failed to decrypt configuration value '${key}'. Re-configure with 'apcore-cli config set ${key}'.`,\n        );\n      }\n    }\n\n    if (configValue.startsWith(\"enc:\")) {\n      const data = Buffer.from(configValue.slice(\"enc:\".length), \"base64\");\n      try {\n        return this.aesDecryptV1(data);\n      } catch {\n        throw new ConfigDecryptionError(\n          `Failed to decrypt configuration value '${key}'. Re-configure with 'apcore-cli config set ${key}'.`,\n        );\n      }\n    }\n\n    // Unrecognized prefix — return as-is\n    return configValue;\n  }\n\n  // Derive an AES-256 key with a provided salt (v2 format).\n  //\n  // Order of preference:\n  //   1. APCORE_CLI_CONFIG_PASSPHRASE env var — a real secret supplied by\n  //      the user; produces a key an attacker with filesystem read cannot\n  //      reconstruct without also knowing the passphrase.\n  //   2. hostname + username — obfuscation-only derivation for backward\n  //      compatibility. Emits a loud stderr warning on first use so\n  //      operators know the stored value is NOT protected against a\n  //      filesystem-read attacker.\n  private deriveKey(salt: Buffer): Buffer {\n    const passphrase = process.env.APCORE_CLI_CONFIG_PASSPHRASE;\n    if (passphrase && passphrase.length > 0) {\n      return crypto.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, 32, \"sha256\");\n    }\n    if (!ConfigEncryptor.weakFallbackWarned) {\n      logWarn(\n        \"APCORE_CLI_CONFIG_PASSPHRASE is not set. The `enc:v2:` fallback uses a key \" +\n          \"derived from hostname+username (non-secret inputs) and is OBFUSCATION \" +\n          \"ONLY — an attacker with filesystem read access can reconstruct the key. \" +\n          \"Set APCORE_CLI_CONFIG_PASSPHRASE or ensure the OS keyring is available \" +\n          \"for real encryption.\",\n      );\n      ConfigEncryptor.weakFallbackWarned = true;\n    }\n    const hostname = os.hostname();\n    const username = process.env.USER ?? process.env.USERNAME ?? \"unknown\";\n    const material = `${hostname}:${username}`;\n    return crypto.pbkdf2Sync(material, salt, PBKDF2_ITERATIONS, 32, \"sha256\");\n  }\n\n  private aesEncrypt(plaintext: string): Buffer {\n    const salt = crypto.randomBytes(16);\n    const key = this.deriveKey(salt);\n    const nonce = crypto.randomBytes(12);\n    const cipher = crypto.createCipheriv(\"aes-256-gcm\", key, nonce);\n    const ct = Buffer.concat([\n      cipher.update(plaintext, \"utf-8\"),\n      cipher.final(),\n    ]);\n    const tag = cipher.getAuthTag();\n    // Wire format v2: salt(16) + nonce(12) + tag(16) + ciphertext\n    return Buffer.concat([salt, nonce, tag, ct]);\n  }\n\n  private aesDecrypt(data: Buffer): string {\n    const salt = data.subarray(0, 16);\n    const nonce = data.subarray(16, 28);\n    const tag = data.subarray(28, 44);\n    const ct = data.subarray(44);\n    const key = this.deriveKey(salt);\n    const decipher = crypto.createDecipheriv(\"aes-256-gcm\", key, nonce);\n    decipher.setAuthTag(tag);\n    return Buffer.concat([decipher.update(ct), decipher.final()]).toString(\"utf-8\");\n  }\n\n  /** Decrypt legacy v1-format values: nonce(12)+tag(16)+ct, static salt. */\n  private aesDecryptV1(data: Buffer): string {\n    const nonce = data.subarray(0, 12);\n    const tag = data.subarray(12, 28);\n    const ct = data.subarray(28);\n    const hostname = os.hostname();\n    const username = process.env.USER ?? process.env.USERNAME ?? \"unknown\";\n    const passphrase = process.env.APCORE_CLI_CONFIG_PASSPHRASE;\n    const materials: string[] = passphrase\n      ? [passphrase, `${hostname}:${username}`]\n      : [`${hostname}:${username}`];\n\n    for (const material of materials) {\n      for (const iterations of [600_000, 100_000]) {\n        try {\n          const key = crypto.pbkdf2Sync(material, V1_STATIC_SALT, iterations, 32, \"sha256\");\n          const decipher = crypto.createDecipheriv(\"aes-256-gcm\", key, nonce);\n          decipher.setAuthTag(tag);\n          return Buffer.concat([decipher.update(ct), decipher.final()]).toString(\"utf-8\");\n        } catch {\n          // try next combination\n        }\n      }\n    }\n    throw new Error(\"v1 decryption failed with all material+iteration combinations\");\n  }\n}\n","/**\n * AuthProvider — API key auth with keyring/encrypted storage.\n *\n * Protocol spec: Security — authentication\n */\n\nimport type { ConfigResolver } from \"../config.js\";\nimport { AuthenticationError, ConfigDecryptionError } from \"../errors.js\";\nimport { ConfigEncryptor } from \"./config-encryptor.js\";\n\n// ---------------------------------------------------------------------------\n// AuthProvider\n// ---------------------------------------------------------------------------\n\n/**\n * Manages API key retrieval and request authentication.\n */\nexport class AuthProvider {\n  private readonly config: ConfigResolver;\n  private readonly encryptor: ConfigEncryptor;\n\n  constructor(config: ConfigResolver, encryptor?: ConfigEncryptor) {\n    this.config = config;\n    this.encryptor = encryptor ?? new ConfigEncryptor();\n  }\n\n  /**\n   * Retrieve the API key from the configured sources.\n   * Handles keyring: and enc: prefixes via ConfigEncryptor.\n   */\n  async getApiKey(): Promise<string | null> {\n    const result = this.config.resolve(\n      \"auth.api_key\",\n      \"--api-key\",\n      \"APCORE_AUTH_API_KEY\",\n    );\n    if (result === null || result === undefined) {\n      return null;\n    }\n    const strResult = String(result);\n    if (strResult.startsWith(\"keyring:\") || strResult.startsWith(\"enc:\")) {\n      try {\n        return await this.encryptor.retrieve(strResult, \"auth.api_key\");\n      } catch (err) {\n        if (err instanceof ConfigDecryptionError) {\n          throw new AuthenticationError(\n            \"Failed to decrypt stored API key. \" +\n              \"Re-configure with 'apcore-cli config set auth.api_key'.\",\n          );\n        }\n        throw err;\n      }\n    }\n    return strResult;\n  }\n\n  /**\n   * Add authentication headers to an outgoing request.\n   *\n   * Cross-SDK contract (D10-002, 2026-04-26): the input `headers` object\n   * is mutated **in place** and the same reference is returned. Callers\n   * that share the headers reference (the documented pattern in\n   * apcore-cli/docs/features/security.md §AuthProvider) can read\n   * `headers.Authorization` after the call without re-binding the\n   * return value. Python and Rust both mutate-and-return; TS previously\n   * spread into a new object, which silently broke shared-reference\n   * callers.\n   */\n  async authenticateRequest(\n    headers: Record<string, string>,\n  ): Promise<Record<string, string>> {\n    const key = await this.getApiKey();\n    if (!key) {\n      throw new AuthenticationError(\n        \"Remote registry requires authentication. \" +\n          \"Set --api-key, APCORE_AUTH_API_KEY, or auth.api_key in config.\",\n      );\n    }\n    // Reject keys with CR/LF — a stray clipboard newline produces a confusing\n    // HTTP error; failing early with a clear message is safer.\n    if (/[\\r\\n]/.test(key)) {\n      throw new AuthenticationError(\n        \"Malformed API key: contains invalid characters (CR/LF). \" +\n          \"Re-configure with 'apcore-cli config set auth.api_key'.\",\n      );\n    }\n    headers.Authorization = `Bearer ${key.trim()}`;\n    return headers;\n  }\n\n  /**\n   * Handle an HTTP response status code for auth-related errors.\n   */\n  handleResponse(statusCode: number): void {\n    if (statusCode === 401 || statusCode === 403) {\n      throw new AuthenticationError(\n        \"Authentication failed. Verify your API key.\",\n      );\n    }\n  }\n}\n","/**\n * Security module re-exports.\n *\n * Protocol spec: Security subsystem\n */\n\nexport { AuditLogger, setAuditLogger, getAuditLogger } from \"./audit.js\";\nexport { AuthProvider } from \"./auth.js\";\nexport { ConfigEncryptor } from \"./config-encryptor.js\";\nexport { Sandbox } from \"./sandbox.js\";\n","/**\n * Discovery commands — list, describe, exec, validate (FE-04, FE-11, FE-13).\n *\n * Protocol spec: Module discovery & introspection\n *\n * FE-13 (builtin-group): these registrars attach per-subcommand to an\n * `apcli` Commander sub-group rather than to the root program.\n */\n\nimport { Command, Option } from \"commander\";\nimport { checkApproval } from \"./approval.js\";\nimport type { Executor, ModuleDescriptor, Registry } from \"./cli.js\";\nimport { EXIT_CODES, exitCodeForError } from \"./errors.js\";\nimport { validateModuleId, collectInput } from \"./main.js\";\nimport {\n  formatExecResult,\n  formatModuleDetail,\n  formatModuleList,\n  formatPreflightResult,\n  firstFailedExitCode,\n  resolveFormat,\n} from \"./output.js\";\nimport { getAuditLogger } from \"./security/audit.js\";\nimport { sortModulesByUsage } from \"./system-usage.js\";\n\nconst TAG_PATTERN = /^[a-z][a-z0-9_-]*$/;\n\nfunction validateTag(tag: string): void {\n  if (!TAG_PATTERN.test(tag)) {\n    process.stderr.write(\n      `Error: Invalid tag format: '${tag}'. Tags must match [a-z][a-z0-9_-]*.\\n`,\n    );\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n}\n\n/**\n * Collect repeated --tag options into an array.\n */\nfunction collectTag(value: string, previous: string[]): string[] {\n  return previous.concat([value]);\n}\n\n/**\n * Collect repeated --annotation options into an array.\n */\nfunction collectAnnotation(value: string, previous: string[]): string[] {\n  return previous.concat([value]);\n}\n\n/**\n * Get an annotation value from a module descriptor.\n */\nfunction getAnnotationFlag(moduleDef: ModuleDescriptor, flag: string): boolean {\n  const annotations = moduleDef.annotations;\n  if (!annotations || typeof annotations !== \"object\") return false;\n  const ann = annotations as Record<string, unknown>;\n  // Map CLI flag names to annotation property names.\n  // Keep in sync with apcore ModuleAnnotations: the 6 pre-0.19.0 boolean\n  // fields plus `paginated` (added in apcore 0.19.0). Parity with\n  // ../apcore-cli-python/src/apcore_cli/discovery.py `_ann_map`.\n  const map: Record<string, string> = {\n    \"destructive\": \"destructive\",\n    \"requires-approval\": \"requires_approval\",\n    \"readonly\": \"readonly\",\n    \"streaming\": \"streaming\",\n    \"cacheable\": \"cacheable\",\n    \"idempotent\": \"idempotent\",\n    \"paginated\": \"paginated\",\n  };\n  const attr = map[flag] ?? flag;\n  return ann[attr] === true;\n}\n\n/**\n * Register the `list` subcommand on the given group (FE-13).\n */\nexport function registerListCommand(\n  apcliGroup: Command,\n  registry: Registry,\n  exposureFilter?: import(\"./exposure.js\").ExposureFilter,\n): void {\n  const listCmd = new Command(\"list\")\n    .description(\"List available modules in the registry.\")\n    .option(\"--tag <tag>\", \"Filter modules by tag (AND logic). Repeatable.\", collectTag, [])\n    .option(\"--flat\", \"Show flat list (no grouping).\", false)\n    .addOption(\n      new Option(\"--format <format>\", \"Output format.\")\n        .choices([\"table\", \"json\", \"csv\", \"yaml\", \"jsonl\", \"markdown\", \"skill\"]),\n    )\n    .option(\"-s, --search <query>\", \"Filter by substring match on ID and description.\")\n    .addOption(\n      new Option(\"--status <status>\", \"Filter by module status.\")\n        .choices([\"enabled\", \"disabled\", \"all\"])\n        .default(\"enabled\"),\n    )\n    .option(\"-a, --annotation <flag>\", \"Filter by annotation flag (AND logic). Repeatable.\", collectAnnotation, [])\n    .addOption(\n      new Option(\"--sort <field>\", \"Sort order.\")\n        .choices([\"id\", \"calls\", \"errors\", \"latency\"])\n        .default(\"id\"),\n    )\n    .option(\"--reverse\", \"Reverse sort order.\", false)\n    .option(\"--deprecated\", \"Include deprecated modules.\", false)\n    .option(\"--deps\", \"Show dependency count column.\", false)\n    .addOption(\n      new Option(\"--exposure <mode>\", \"Filter by exposure status.\")\n        .choices([\"exposed\", \"hidden\", \"all\"])\n        .default(\"exposed\"),\n    )\n    .action((opts: {\n      tag: string[];\n      flat: boolean;\n      format?: string;\n      search?: string;\n      status: string;\n      annotation: string[];\n      sort: string;\n      reverse: boolean;\n      deprecated: boolean;\n      deps: boolean;\n      exposure: string;\n    }) => {\n      // Validate tags\n      for (const t of opts.tag) {\n        validateTag(t);\n      }\n\n      let modules: ModuleDescriptor[] = [];\n      for (const m of registry.listModules()) {\n        modules.push(m);\n      }\n\n      // Tag filter (AND logic)\n      if (opts.tag.length > 0) {\n        const filterTags = new Set(opts.tag);\n        modules = modules.filter((m) => {\n          const mTags = m.tags ?? [];\n          return [...filterTags].every((t) => mTags.includes(t));\n        });\n      }\n\n      // Search filter (case-insensitive substring on id + description)\n      if (opts.search) {\n        const query = opts.search.toLowerCase();\n        modules = modules.filter(\n          (m) =>\n            (m.id ?? \"\").toLowerCase().includes(query) ||\n            (m.description ?? \"\").toLowerCase().includes(query),\n        );\n      }\n\n      // Status filter\n      if (opts.status === \"enabled\") {\n        modules = modules.filter((m) => {\n          const enabled = (m as unknown as Record<string, unknown>).enabled;\n          return enabled !== false;\n        });\n      } else if (opts.status === \"disabled\") {\n        modules = modules.filter((m) => {\n          const enabled = (m as unknown as Record<string, unknown>).enabled;\n          return enabled === false;\n        });\n      }\n      // \"all\": no filter\n\n      // Deprecated filter (excluded by default)\n      if (!opts.deprecated) {\n        modules = modules.filter((m) => {\n          const deprecated = (m as unknown as Record<string, unknown>).deprecated;\n          return deprecated !== true;\n        });\n      }\n\n      // Annotation filter (AND logic)\n      if (opts.annotation.length > 0) {\n        for (const annFlag of opts.annotation) {\n          modules = modules.filter((m) => getAnnotationFlag(m, annFlag));\n        }\n      }\n\n      // Sort — usage-based sorts read aggregates from the audit log\n      // (issue #17). Falls back to id-sort with a visible note if the log\n      // has no entries in the default 24h window.\n      if (opts.sort === \"calls\" || opts.sort === \"errors\" || opts.sort === \"latency\") {\n        const { used } = sortModulesByUsage(modules, opts.sort, { reverse: !opts.reverse });\n        if (!used) {\n          process.stderr.write(\n            `note: no usage data available for --sort ${opts.sort}; sorted by id. ` +\n            \"Run some modules first to populate ~/.apcore-cli/audit.jsonl.\\n\",\n          );\n        }\n      } else {\n        modules.sort((a, b) => (a.id ?? \"\").localeCompare(b.id ?? \"\"));\n        if (opts.reverse) {\n          modules.reverse();\n        }\n      }\n\n      // Exposure filter (FE-12)\n      let showExposureCol = false;\n      if (exposureFilter && opts.exposure !== \"all\") {\n        if (opts.exposure === \"exposed\") {\n          modules = modules.filter((m) => exposureFilter.isExposed(m.id ?? \"\"));\n        } else if (opts.exposure === \"hidden\") {\n          modules = modules.filter((m) => !exposureFilter.isExposed(m.id ?? \"\"));\n        }\n      }\n      if (opts.exposure === \"all\" && exposureFilter) {\n        showExposureCol = true;\n      }\n\n      const fmt = resolveFormat(opts.format);\n      const filterTagsArg = opts.tag.length > 0 ? opts.tag : undefined;\n      void formatModuleList(modules, fmt, filterTagsArg, opts.deps, showExposureCol ? exposureFilter : undefined);\n    });\n  apcliGroup.addCommand(listCmd);\n}\n\n/**\n * Register the `describe` subcommand on the given group (FE-13).\n */\nexport function registerDescribeCommand(\n  apcliGroup: Command,\n  registry: Registry,\n): void {\n  const describeCmd = new Command(\"describe\")\n    .description(\"Show metadata, schema, and annotations for a module.\")\n    .argument(\"<module-id>\", \"Module ID to describe\")\n    .addOption(\n      new Option(\"--format <format>\", \"Output format.\")\n        .choices([\"table\", \"json\", \"csv\", \"yaml\", \"jsonl\", \"markdown\", \"skill\"]),\n    )\n    .action((moduleId: string, opts: { format?: string }) => {\n      validateModuleId(moduleId);\n\n      const moduleDef = registry.getModule(moduleId);\n      if (!moduleDef) {\n        process.stderr.write(\n          `Error: Module '${moduleId}' not found.\\n`,\n        );\n        process.exit(EXIT_CODES.MODULE_NOT_FOUND);\n      }\n\n      const fmt = resolveFormat(opts.format);\n      void formatModuleDetail(moduleDef, fmt);\n    });\n  apcliGroup.addCommand(describeCmd);\n}\n\n/**\n * Register the `exec` subcommand on the given group (FE-13).\n *\n * Generic dispatch: `apcli exec <module-id> [--format fmt] [--input json]`.\n * Unlike the per-module commands built by `buildModuleCommand`, this command\n * does not derive options from the module's input schema — inputs are passed\n * as a JSON object via `--input`. This mirrors the apcli-flavoured generic\n * dispatch contract in the builtin-group feature spec.\n */\nexport function registerExecCommand(\n  apcliGroup: Command,\n  registry: Registry,\n  executor: Executor,\n): void {\n  const execCmd = new Command(\"exec\")\n    .description(\"Execute a module by ID with JSON input.\")\n    .argument(\"<module-id>\", \"Module ID to execute\")\n    .option(\"--format <format>\", \"Output format (json, table, csv, yaml, jsonl).\")\n    .option(\"--fields <fields>\", \"Comma-separated dot-paths to select from the result.\")\n    .option(\n      \"--input <json>\",\n      \"JSON object passed as input to the module. Use '-' to read JSON from stdin.\",\n    )\n    .option(\"-y, --yes\", \"Auto-approve if the module declares requires_approval.\", false)\n    .option(\n      \"--approval-timeout <seconds>\",\n      \"Seconds to wait for interactive approval.\",\n      parseInt,\n    )\n    .option(\"--sandbox\", \"Run module in an isolated subprocess with restricted env.\", false)\n    .option(\"--strategy <name>\", \"Execution strategy (standard, parallel, sequential, etc.).\")\n    .option(\"--trace\", \"Enable pipeline trace output.\", false)\n    .option(\"--dry-run\", \"Validate inputs without executing the module.\", false)\n    .option(\"--stream\", \"Stream output as JSONL instead of buffering.\", false)\n    .action(async (\n      moduleId: string,\n      opts: {\n        format?: string;\n        fields?: string;\n        input?: string;\n        yes: boolean;\n        approvalTimeout?: number;\n        sandbox: boolean;\n        strategy?: string;\n        trace: boolean;\n        dryRun: boolean;\n        stream: boolean;\n      },\n    ) => {\n      validateModuleId(moduleId);\n\n      const moduleDef = registry.getModule(moduleId);\n      if (!moduleDef) {\n        process.stderr.write(`Error: Module '${moduleId}' not found.\\n`);\n        process.exit(EXIT_CODES.MODULE_NOT_FOUND);\n      }\n\n      // Parse --input. Distinguish between a stdin marker (\"-\") — delegated\n      // to collectInput — and an inline JSON literal, which we parse directly\n      // here since collectInput only treats \"-\" specially.\n      let merged: Record<string, unknown> = {};\n      if (opts.input === \"-\") {\n        merged = await collectInput(\"-\", {}, false);\n      } else if (opts.input !== undefined) {\n        try {\n          const parsed = JSON.parse(opts.input);\n          if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n            process.stderr.write(\"Error: --input JSON must be an object.\\n\");\n            process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n          }\n          merged = parsed as Record<string, unknown>;\n        } catch (err) {\n          const msg = err instanceof Error ? err.message : String(err);\n          process.stderr.write(`Error: --input is not valid JSON: ${msg}\\n`);\n          process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n        }\n      }\n\n      const startTime = performance.now();\n      try {\n        await checkApproval(moduleDef, opts.yes, opts.approvalTimeout);\n\n        // --dry-run: validate without executing\n        if (opts.dryRun) {\n          if (executor.validate) {\n            const preflight = await executor.validate(moduleId, merged);\n            formatPreflightResult(preflight, opts.format);\n          } else {\n            process.stdout.write(JSON.stringify({ valid: true }) + \"\\n\");\n          }\n          return;\n        }\n\n        let result: unknown;\n        if (opts.strategy && executor.callWithTrace) {\n          const [res] = await executor.callWithTrace(moduleId, merged, { strategy: opts.strategy });\n          result = res;\n        } else {\n          const { Sandbox } = await import(\"./security/index.js\");\n          const sandbox = new Sandbox(opts.sandbox);\n          result = await sandbox.execute(moduleId, merged, executor);\n        }\n        const durationMs = Math.round(performance.now() - startTime);\n\n        // Format output first (canonical ordering: format → audit on success)\n        const fmt = resolveFormat(opts.format);\n        formatExecResult(result, fmt, opts.fields);\n\n        // Audit success AFTER format so a formatter exception suppresses the entry\n        const auditLogger = getAuditLogger();\n        if (auditLogger) {\n          auditLogger.logExecution(moduleId, merged, \"success\", 0, durationMs);\n        }\n      } catch (err: unknown) {\n        const exitCode = exitCodeForError(err);\n        const durationMs = Math.round(performance.now() - startTime);\n        try {\n          const auditLogger = getAuditLogger();\n          if (auditLogger) {\n            auditLogger.logExecution(moduleId, merged, \"error\", exitCode, durationMs);\n          }\n        } catch {\n          // Ignore audit failures during error handling\n        }\n        process.stderr.write(`Error: ${err instanceof Error ? err.message : err}\\n`);\n        process.exit(exitCode);\n      }\n    });\n  apcliGroup.addCommand(execCmd);\n}\n\n/**\n * Register the standalone validate command.\n */\nexport function registerValidateCommand(\n  cli: Command,\n  registry: Registry,\n  executor: Executor,\n): void {\n  const validateCmd = new Command(\"validate\")\n    .description(\"Run preflight checks without executing a module.\")\n    .argument(\"<module-id>\", \"Module ID to validate\")\n    .option(\"--input <source>\", \"JSON input file or '-' for stdin.\")\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (moduleId: string, opts: { input?: string; format?: string }) => {\n      validateModuleId(moduleId);\n\n      const moduleDef = registry.getModule(moduleId);\n      if (!moduleDef) {\n        process.stderr.write(`Error: Module '${moduleId}' not found.\\n`);\n        process.exit(EXIT_CODES.MODULE_NOT_FOUND);\n      }\n\n      const merged = opts.input ? await collectInput(opts.input, {}, false) : {};\n\n      if (!executor.validate) {\n        process.stderr.write(\"Error: Executor does not support validate.\\n\");\n        process.exit(EXIT_CODES.MODULE_EXECUTE_ERROR);\n      }\n\n      // Mirror buildModuleCommand's dry-run path: no approval gate (preflight\n      // does not execute), but audit-log exceptions so scripted callers\n      // always produce a trail even on failed validation (main.ts:1151-1159).\n      try {\n        const preflight = await executor.validate(moduleId, merged);\n        formatPreflightResult(preflight, opts.format);\n        process.exit(preflight.valid ? 0 : firstFailedExitCode(preflight));\n      } catch (err: unknown) {\n        const exitCode = exitCodeForError(err);\n        try {\n          const auditLogger = getAuditLogger();\n          if (auditLogger) {\n            auditLogger.logExecution(moduleId, merged, \"error\", exitCode, 0);\n          }\n        } catch {\n          // Ignore audit failures during error handling\n        }\n        process.stderr.write(`Error: ${err instanceof Error ? err.message : err}\\n`);\n        process.exit(exitCode);\n      }\n    });\n  cli.addCommand(validateCmd);\n}\n\n// registerDiscoveryCommands was removed in FE-13 create-cli-integration.\n// Call registerListCommand + registerDescribeCommand directly.\n","/**\n * System management commands — health, usage, enable, disable, reload, config (FE-11 F2).\n *\n * Each registrar delegates to the corresponding system.* module via the\n * executor. The six registrars are pure attach-only operations and are\n * dispatched by `createCli()`'s FE-13 apcli group integration.\n */\n\nimport { Command } from \"commander\";\nimport { checkApproval } from \"./approval.js\";\nimport type { Executor, ModuleDescriptor } from \"./cli.js\";\nimport { exitCodeForError } from \"./errors.js\";\nimport { formatExecResult, resolveFormat } from \"./output.js\";\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Call a system module via executor.call() when available, falling back to\n * executor.execute() otherwise.\n */\nasync function callSystemModule(\n  executor: Executor,\n  moduleId: string,\n  inputs: Record<string, unknown>,\n): Promise<unknown> {\n  if (executor.call) {\n    return executor.call(moduleId, inputs);\n  }\n  return executor.execute(moduleId, inputs);\n}\n\n/**\n * Emit a result as JSON when in non-TTY or when the caller requested\n * JSON format, otherwise invoke the TTY render callback. The callback\n * closes over the caller's local state (moduleId, opts.reason, etc.) so\n * each registrar can render its own TTY shape without threading those\n * values through this helper.\n */\nfunction emitResult(\n  jsonPayload: unknown,\n  fmt: string,\n  ttyRender: () => void,\n): void {\n  if (fmt === \"json\" || !process.stdout.isTTY) {\n    process.stdout.write(JSON.stringify(jsonPayload, null, 2) + \"\\n\");\n  } else {\n    ttyRender();\n  }\n}\n\n// Exit code mapped from the error's class / apcore `.code` via exitCodeForError\n// so scripted callers can distinguish ACL_DENIED (77) from MODULE_NOT_FOUND (44)\n// from generic MODULE_EXECUTE_ERROR (1).\nfunction emitErrorAndExit(e: unknown): never {\n  process.stderr.write(`Error: ${e instanceof Error ? e.message : e}\\n`);\n  process.exit(exitCodeForError(e));\n}\n\n/**\n * Run the client-side approval gate for a mutating system command.\n *\n * Mirrors Python ``_check_system_approval`` (system_cmd.py:36) and Rust\n * ``require_approval_for_system_command`` (system_cmd.rs:294). Audit\n * D11-B-001 (2026-05-08): the prior version of this file exposed `--yes`\n * but never called ``checkApproval``, leaving the operator-confirmation\n * contract (FR-SYSCMD-013) entirely dependent on server-side enforcement.\n *\n * Synthesises a minimal ``ModuleDescriptor`` with\n * ``annotations.requires_approval = true`` so ``checkApproval`` runs the\n * same TTY-prompt / non-TTY-deny / env-var-bypass logic used by the main\n * exec dispatcher. ``ApprovalDeniedError`` / ``ApprovalTimeoutError``\n * propagate to ``emitErrorAndExit`` which maps them to exit 46 via\n * ``exitCodeForError``.\n */\nasync function requireApprovalForSystemCommand(\n  moduleId: string,\n  autoApprove: boolean,\n): Promise<void> {\n  const syntheticModuleDef: ModuleDescriptor = {\n    id: moduleId,\n    name: moduleId,\n    description: `system command: ${moduleId}`,\n    annotations: { requires_approval: true },\n  };\n  await checkApproval(syntheticModuleDef, autoApprove, undefined);\n}\n\n// ---------------------------------------------------------------------------\n// TTY formatters (pre-split shape, unchanged)\n// ---------------------------------------------------------------------------\n\n/** Render health summary as TTY text. */\nfunction formatHealthSummaryTty(result: Record<string, unknown>): void {\n  const summary = (result.summary ?? {}) as Record<string, unknown>;\n  const modules = (result.modules ?? []) as Record<string, unknown>[];\n\n  if (modules.length === 0) {\n    process.stdout.write(\"No modules found.\\n\");\n    return;\n  }\n\n  const total = summary.total_modules ?? modules.length;\n  process.stdout.write(`Health Overview (${total} modules)\\n\\n`);\n  process.stdout.write(`  ${\"Module\".padEnd(28)} ${\"Status\".padEnd(12)} ${\"Error Rate\".padEnd(12)} Top Error\\n`);\n  process.stdout.write(`  ${\"-\".repeat(28)} ${\"-\".repeat(12)} ${\"-\".repeat(12)} ${\"-\".repeat(20)}\\n`);\n\n  for (const m of modules) {\n    const top = m.top_error as Record<string, unknown> | undefined;\n    const topStr = top ? `${top.code} (${top.count ?? \"?\"})` : \"—\";\n    const rate = `${((m.error_rate as number ?? 0) * 100).toFixed(1)}%`;\n    process.stdout.write(\n      `  ${String(m.module_id).padEnd(28)} ${String(m.status).padEnd(12)} ${rate.padEnd(12)} ${topStr}\\n`,\n    );\n  }\n\n  const parts: string[] = [];\n  for (const key of [\"healthy\", \"degraded\", \"error\"]) {\n    const count = summary[key] as number | undefined;\n    if (count) parts.push(`${count} ${key}`);\n  }\n  process.stdout.write(`\\nSummary: ${parts.join(\", \") || \"no data\"}\\n`);\n}\n\n/** Render single-module health detail. */\nfunction formatHealthModuleTty(result: Record<string, unknown>): void {\n  process.stdout.write(`Module: ${result.module_id ?? \"?\"}\\n`);\n  process.stdout.write(`Status: ${result.status ?? \"unknown\"}\\n`);\n  const total = result.total_calls as number ?? 0;\n  const errors = result.error_count as number ?? 0;\n  const rate = result.error_rate as number ?? 0;\n  const avg = result.avg_latency_ms as number ?? 0;\n  const p99 = result.p99_latency_ms as number ?? 0;\n  process.stdout.write(`Calls: ${total.toLocaleString()} total | ${errors.toLocaleString()} errors | ${(rate * 100).toFixed(1)}% error rate\\n`);\n  process.stdout.write(`Latency: ${avg.toFixed(0)}ms avg | ${p99.toFixed(0)}ms p99\\n`);\n\n  const recent = (result.recent_errors ?? []) as Record<string, unknown>[];\n  if (recent.length > 0) {\n    process.stdout.write(`\\nRecent Errors (top ${recent.length}):\\n`);\n    for (const e of recent) {\n      const count = e.count ?? \"?\";\n      const last = e.last_occurred ?? \"?\";\n      process.stdout.write(`  ${String(e.code ?? \"?\").padEnd(24)} x${count}  (last: ${last})\\n`);\n    }\n  }\n}\n\n/** Render usage summary as TTY text. */\nfunction formatUsageSummaryTty(result: Record<string, unknown>): void {\n  const modules = (result.modules ?? []) as Record<string, unknown>[];\n  const period = result.period ?? \"?\";\n\n  if (modules.length === 0) {\n    process.stdout.write(`No usage data for period ${period}.\\n`);\n    return;\n  }\n\n  process.stdout.write(`Usage Summary (last ${period})\\n\\n`);\n  process.stdout.write(`  ${\"Module\".padEnd(24)} ${\"Calls\".padStart(8)} ${\"Errors\".padStart(8)} ${\"Avg Latency\".padStart(12)} ${\"Trend\".padStart(10)}\\n`);\n  process.stdout.write(`  ${\"-\".repeat(24)} ${\"-\".repeat(8)} ${\"-\".repeat(8)} ${\"-\".repeat(12)} ${\"-\".repeat(10)}\\n`);\n\n  for (const m of modules) {\n    const avg = `${((m.avg_latency_ms as number) ?? 0).toFixed(0)}ms`;\n    process.stdout.write(\n      `  ${String(m.module_id).padEnd(24)} ${String((m.call_count as number) ?? 0).padStart(8)} ` +\n      `${String((m.error_count as number) ?? 0).padStart(8)} ${avg.padStart(12)} ${String(m.trend ?? \"\").padStart(10)}\\n`,\n    );\n  }\n\n  const totalCalls = (result.total_calls as number) ?? modules.reduce((s, m) => s + ((m.call_count as number) ?? 0), 0);\n  const totalErrors = (result.total_errors as number) ?? modules.reduce((s, m) => s + ((m.error_count as number) ?? 0), 0);\n  process.stdout.write(`\\nTotal: ${totalCalls.toLocaleString()} calls | ${totalErrors.toLocaleString()} errors\\n`);\n}\n\n// ---------------------------------------------------------------------------\n// Per-subcommand registrars (FE-13)\n// ---------------------------------------------------------------------------\n\n/**\n * Attach the `health` subcommand to the passed apcliGroup.\n */\nexport function registerHealthCommand(apcliGroup: Command, executor: Executor): void {\n  const healthCmd = new Command(\"health\")\n    .description(\"Show module health status. Optionally specify a module ID for details.\")\n    .argument(\"[module-id]\", \"Module ID for detailed health\")\n    .option(\"--threshold <number>\", \"Error rate threshold (default: 0.01).\", parseFloat, 0.01)\n    .option(\"--all\", \"Include healthy modules.\", false)\n    .option(\"--errors <count>\", \"Max recent errors (module detail only).\", parseInt, 10)\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (\n      moduleId: string | undefined,\n      opts: { threshold: number; all: boolean; errors: number; format?: string },\n    ) => {\n      const fmt = resolveFormat(opts.format);\n      try {\n        if (moduleId) {\n          const result = await callSystemModule(executor, \"system.health.module\", {\n            module_id: moduleId,\n            error_limit: opts.errors,\n          }) as Record<string, unknown>;\n          emitResult(result, fmt, () => formatHealthModuleTty(result));\n        } else {\n          const result = await callSystemModule(executor, \"system.health.summary\", {\n            error_rate_threshold: opts.threshold,\n            include_healthy: opts.all,\n          }) as Record<string, unknown>;\n          emitResult(result, fmt, () => formatHealthSummaryTty(result));\n        }\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  apcliGroup.addCommand(healthCmd);\n}\n\n/**\n * Attach the `usage` subcommand to the passed apcliGroup.\n */\nexport function registerUsageCommand(apcliGroup: Command, executor: Executor): void {\n  const usageCmd = new Command(\"usage\")\n    .description(\"Show module usage statistics. Optionally specify a module ID for details.\")\n    .argument(\"[module-id]\", \"Module ID for detailed usage\")\n    .option(\"--period <period>\", \"Time window: 1h, 24h, 7d, 30d.\", \"24h\")\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (moduleId: string | undefined, opts: { period: string; format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n      try {\n        let result: unknown;\n        if (moduleId) {\n          result = await callSystemModule(executor, \"system.usage.module\", {\n            module_id: moduleId,\n            period: opts.period,\n          });\n        } else {\n          result = await callSystemModule(executor, \"system.usage.summary\", {\n            period: opts.period,\n          });\n        }\n        emitResult(result, fmt, () => {\n          if (moduleId) {\n            formatExecResult(result, fmt);\n          } else {\n            formatUsageSummaryTty(result as Record<string, unknown>);\n          }\n        });\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  apcliGroup.addCommand(usageCmd);\n}\n\n/**\n * Attach the `enable` subcommand to the passed apcliGroup.\n */\nexport function registerEnableCommand(apcliGroup: Command, executor: Executor): void {\n  const enableCmd = new Command(\"enable\")\n    .description(\"Enable a disabled module at runtime.\")\n    .argument(\"<module-id>\", \"Module ID to enable\")\n    .requiredOption(\"--reason <reason>\", \"Reason for enabling (required for audit).\")\n    .option(\"-y, --yes\", \"Skip approval prompt (audit D11-B-001 cross-SDK parity).\", false)\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (moduleId: string, opts: { reason: string; yes: boolean; format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n      try {\n        await requireApprovalForSystemCommand(\"system.control.toggle_feature\", opts.yes);\n        const result = await callSystemModule(executor, \"system.control.toggle_feature\", {\n          module_id: moduleId,\n          enabled: true,\n          reason: opts.reason,\n        }) as Record<string, unknown>;\n        emitResult(result, fmt, () => {\n          process.stdout.write(`Module '${moduleId}' enabled.\\n  Reason: ${opts.reason}\\n`);\n        });\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  apcliGroup.addCommand(enableCmd);\n}\n\n/**\n * Attach the `disable` subcommand to the passed apcliGroup.\n */\nexport function registerDisableCommand(apcliGroup: Command, executor: Executor): void {\n  const disableCmd = new Command(\"disable\")\n    .description(\"Disable a module at runtime (calls are rejected until re-enabled).\")\n    .argument(\"<module-id>\", \"Module ID to disable\")\n    .requiredOption(\"--reason <reason>\", \"Reason for disabling (required for audit).\")\n    .option(\"-y, --yes\", \"Skip approval prompt (audit D11-B-001 cross-SDK parity).\", false)\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (moduleId: string, opts: { reason: string; yes: boolean; format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n      try {\n        await requireApprovalForSystemCommand(\"system.control.toggle_feature\", opts.yes);\n        const result = await callSystemModule(executor, \"system.control.toggle_feature\", {\n          module_id: moduleId,\n          enabled: false,\n          reason: opts.reason,\n        }) as Record<string, unknown>;\n        emitResult(result, fmt, () => {\n          process.stdout.write(`Module '${moduleId}' disabled.\\n  Reason: ${opts.reason}\\n`);\n        });\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  apcliGroup.addCommand(disableCmd);\n}\n\n/**\n * Attach the `reload` subcommand to the passed apcliGroup.\n */\nexport function registerReloadCommand(apcliGroup: Command, executor: Executor): void {\n  const reloadCmd = new Command(\"reload\")\n    .description(\"Hot-reload a module from disk.\")\n    .argument(\"<module-id>\", \"Module ID to reload\")\n    .requiredOption(\"--reason <reason>\", \"Reason for reload (required for audit).\")\n    .option(\"-y, --yes\", \"Skip approval prompt (audit D11-B-001 cross-SDK parity).\", false)\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (moduleId: string, opts: { reason: string; yes: boolean; format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n      try {\n        await requireApprovalForSystemCommand(\"system.control.reload_module\", opts.yes);\n        const result = await callSystemModule(executor, \"system.control.reload_module\", {\n          module_id: moduleId,\n          reason: opts.reason,\n        }) as Record<string, unknown>;\n        emitResult(result, fmt, () => {\n          const prev = result.previous_version ?? \"?\";\n          const newVer = result.new_version ?? \"?\";\n          const dur = result.reload_duration_ms ?? \"?\";\n          process.stdout.write(`Module '${moduleId}' reloaded.\\n`);\n          process.stdout.write(`  Version: ${prev} -> ${newVer}\\n`);\n          process.stdout.write(`  Duration: ${dur}ms\\n`);\n        });\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  apcliGroup.addCommand(reloadCmd);\n}\n\n/**\n * Attach the `config` subcommand (with `get` and `set` children) to the\n * passed apcliGroup.\n *\n * Signature note: config reads/writes go through `executor.call()` to\n * `system.config.get` / `system.control.update_config`, so this registrar\n * takes an {@link Executor} (not a Registry). The FE-13 dispatcher table\n * entry for `config` sets `requiresExecutor: true` accordingly.\n */\nexport function registerConfigCommand(apcliGroup: Command, executor: Executor): void {\n  const configGroup = new Command(\"config\")\n    .description(\"Read or update runtime configuration.\");\n\n  const configGetCmd = new Command(\"get\")\n    .description(\"Read a configuration value by dot-path key.\")\n    .argument(\"<key>\", \"Configuration key (dot-path)\")\n    .option(\"--format <format>\", \"Output format.\", \"table\")\n    .action(async (key: string, opts: { format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n      try {\n        const result = await callSystemModule(executor, \"system.config.get\", { key });\n        const value = (result as Record<string, unknown>)?.value ?? result;\n        emitResult({ key, value }, fmt, () => {\n          process.stdout.write(`${key} = ${JSON.stringify(value)}\\n`);\n        });\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  configGroup.addCommand(configGetCmd);\n\n  const configSetCmd = new Command(\"set\")\n    .description(\"Update a runtime configuration value (audit-logged; client-side approval gate applies).\")\n    .argument(\"<key>\", \"Configuration key (dot-path)\")\n    .argument(\"<value>\", \"New value\")\n    .requiredOption(\"--reason <reason>\", \"Reason for config change (required for audit).\")\n    .option(\"-y, --yes\", \"Skip approval prompt (audit D11-B-001 cross-SDK parity).\", false)\n    .option(\"--format <format>\", \"Output format.\")\n    .action(async (key: string, value: string, opts: { reason: string; yes: boolean; format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n      // Attempt to parse value as JSON for typed values\n      let parsedValue: unknown;\n      try {\n        parsedValue = JSON.parse(value);\n      } catch {\n        parsedValue = value;\n      }\n\n      try {\n        await requireApprovalForSystemCommand(\"system.control.update_config\", opts.yes);\n        const result = await callSystemModule(executor, \"system.control.update_config\", {\n          key,\n          value: parsedValue,\n          reason: opts.reason,\n        }) as Record<string, unknown>;\n        emitResult(result, fmt, () => {\n          const old = result.old_value ?? \"?\";\n          const newVal = result.new_value ?? \"?\";\n          process.stdout.write(`Config updated: ${key}\\n`);\n          process.stdout.write(`  ${JSON.stringify(old)} -> ${JSON.stringify(newVal)}\\n`);\n          process.stdout.write(`  Reason: ${opts.reason}\\n`);\n        });\n      } catch (e) {\n        emitErrorAndExit(e);\n      }\n    });\n  configGroup.addCommand(configSetCmd);\n\n  apcliGroup.addCommand(configGroup);\n}\n\n// registerSystemCommands was removed in FE-13 create-cli-integration.\n// createCli() now dispatches the six per-subcommand registrars directly via\n// the `_registerApcliSubcommands` table in src/main.ts.\n","/**\n * Pipeline strategy commands — describe-pipeline (FE-11 F8).\n */\n\nimport { Command, Option } from \"commander\";\nimport type { Executor, StrategyInfo } from \"./cli.js\";\nimport { resolveFormat } from \"./output.js\";\n\n/**\n * Look up `StrategyInfo` for an arbitrary strategy name.\n *\n * apcore-js exposes two introspection entry points:\n *   - `Executor.listStrategies()` (static): returns info for all globally\n *     registered strategies.\n *   - `executor.describePipeline()` (instance, no args): returns info for\n *     the executor's *currently-set* strategy only.\n *\n * To describe a non-current strategy we need the static `listStrategies`.\n * We reach it via the runtime constructor of the executor instance so the\n * CLI does not have to directly import the apcore-js `Executor` class\n * (preserves the loose structural contract used elsewhere in this package).\n *\n * Returns `{ info, isCurrent }` so the caller does not need a second\n * `describePipeline()` invocation to ask the same \"is this the current\n * strategy?\" question — only the current strategy exposes step-level\n * metadata (`executor.currentStrategy.steps`).\n */\nfunction lookupStrategyInfo(\n  executor: Executor,\n  strategyName: string,\n): { info: StrategyInfo | null; isCurrent: boolean } {\n  // 1. Is the requested strategy the executor's current one?\n  if (typeof executor.describePipeline === \"function\") {\n    try {\n      const current = executor.describePipeline();\n      if (current && current.name === strategyName) {\n        return { info: current, isCurrent: true };\n      }\n    } catch {\n      // Fall through to the static lookup.\n    }\n  }\n\n  // 2. Walk the static registry via the constructor.\n  const ctor = (executor as unknown as { constructor?: unknown }).constructor as\n    | { listStrategies?: () => StrategyInfo[] }\n    | undefined;\n  if (ctor && typeof ctor.listStrategies === \"function\") {\n    try {\n      const all = ctor.listStrategies();\n      const info = all.find((s) => s.name === strategyName) ?? null;\n      return { info, isCurrent: false };\n    } catch {\n      return { info: null, isCurrent: false };\n    }\n  }\n  return { info: null, isCurrent: false };\n}\n\n/** Preset pipeline steps for each strategy. */\nconst PRESET_STEPS: Record<string, string[]> = {\n  standard: [\n    \"context_creation\",\n    \"call_chain_guard\",\n    \"module_lookup\",\n    \"acl_check\",\n    \"approval_gate\",\n    \"middleware_before\",\n    \"input_validation\",\n    \"execute\",\n    \"output_validation\",\n    \"middleware_after\",\n    \"return_result\",\n  ],\n  internal: [\n    \"context_creation\",\n    \"call_chain_guard\",\n    \"module_lookup\",\n    \"middleware_before\",\n    \"input_validation\",\n    \"execute\",\n    \"output_validation\",\n    \"middleware_after\",\n    \"return_result\",\n  ],\n  testing: [\n    \"context_creation\",\n    \"module_lookup\",\n    \"middleware_before\",\n    \"input_validation\",\n    \"execute\",\n    \"output_validation\",\n    \"middleware_after\",\n    \"return_result\",\n  ],\n  performance: [\n    \"context_creation\",\n    \"call_chain_guard\",\n    \"module_lookup\",\n    \"acl_check\",\n    \"approval_gate\",\n    \"input_validation\",\n    \"execute\",\n    \"output_validation\",\n    \"return_result\",\n  ],\n  minimal: [\n    \"context_creation\",\n    \"module_lookup\",\n    \"execute\",\n    \"return_result\",\n  ],\n};\n\n/**\n * Register the describe-pipeline command.\n */\nexport function registerPipelineCommand(cli: Command, executor: Executor): void {\n  const pipelineCmd = new Command(\"describe-pipeline\")\n    .description(\"Show the execution pipeline steps for a strategy.\")\n    .addOption(\n      new Option(\"--strategy <name>\", \"Strategy to describe (default: standard).\")\n        .choices([\"standard\", \"internal\", \"testing\", \"performance\", \"minimal\"])\n        .default(\"standard\"),\n    )\n    .option(\"--format <format>\", \"Output format.\")\n    .action((opts: { strategy: string; format?: string }) => {\n      const fmt = resolveFormat(opts.format);\n\n      // Look up info for the requested strategy (current strategy via\n      // describePipeline(), arbitrary strategy via Executor.listStrategies()).\n      const { info, isCurrent } = lookupStrategyInfo(executor, opts.strategy);\n\n      if (info) {\n        // Step metadata (pure/removable/timeoutMs) is only available for the\n        // executor's *current* strategy via `currentStrategy.steps` — other\n        // registered strategies expose only their `StrategyInfo` summary.\n        const strategySteps = isCurrent ? (executor.currentStrategy?.steps ?? []) : [];\n        const header = `Pipeline: ${info.name} (${info.stepCount} steps)`;\n\n        if (fmt === \"json\" || !process.stdout.isTTY) {\n          const payload = {\n            strategy: info.name,\n            step_count: info.stepCount,\n            description: info.description,\n            steps: info.stepNames.map((name, i) => {\n              const stepMeta = strategySteps[i];\n              return {\n                index: i + 1,\n                name,\n                pure: stepMeta?.pure ?? false,\n                removable: stepMeta?.removable ?? true,\n                timeout_ms: stepMeta?.timeoutMs ?? null,\n              };\n            }),\n          };\n          process.stdout.write(JSON.stringify(payload, null, 2) + \"\\n\");\n        } else {\n          process.stdout.write(`${header}\\n\\n`);\n          process.stdout.write(`  ${\"#\".padEnd(4)} ${\"Step\".padEnd(28)} ${\"Pure\".padEnd(6)} ${\"Removable\".padEnd(11)} Timeout\\n`);\n          process.stdout.write(`  ${\"-\".repeat(4)} ${\"-\".repeat(28)} ${\"-\".repeat(6)} ${\"-\".repeat(11)} ${\"-\".repeat(8)}\\n`);\n          for (let i = 0; i < info.stepNames.length; i++) {\n            const stepMeta = strategySteps[i];\n            const pure = stepMeta?.pure ? \"yes\" : \"no\";\n            const removable = stepMeta?.removable !== false ? \"yes\" : \"no\";\n            const timeout = stepMeta?.timeoutMs ? `${stepMeta.timeoutMs}ms` : \"\\u2014\";\n            process.stdout.write(`  ${String(i + 1).padEnd(4)} ${info.stepNames[i].padEnd(28)} ${pure.padEnd(6)} ${removable.padEnd(11)} ${timeout}\\n`);\n          }\n        }\n        return;\n      }\n\n      // Fall back to static preset info for known strategies.\n      const steps = PRESET_STEPS[opts.strategy] ?? [];\n      const pureSteps = new Set([\n        \"context_creation\", \"call_chain_guard\", \"module_lookup\", \"acl_check\", \"input_validation\",\n      ]);\n      const nonRemovable = new Set([\n        \"context_creation\", \"module_lookup\", \"execute\", \"return_result\",\n      ]);\n\n      if (fmt === \"json\" || !process.stdout.isTTY) {\n        const payload = {\n          strategy: opts.strategy,\n          step_count: steps.length,\n          steps: steps.map((s, i) => ({\n            index: i + 1,\n            name: s,\n            pure: pureSteps.has(s),\n            removable: !nonRemovable.has(s),\n          })),\n        };\n        process.stdout.write(JSON.stringify(payload, null, 2) + \"\\n\");\n      } else {\n        process.stdout.write(`Pipeline: ${opts.strategy} (${steps.length} steps)\\n\\n`);\n        process.stdout.write(`  ${\"#\".padEnd(4)} ${\"Step\".padEnd(28)} ${\"Pure\".padEnd(6)} ${\"Removable\".padEnd(11)} Timeout\\n`);\n        process.stdout.write(`  ${\"-\".repeat(4)} ${\"-\".repeat(28)} ${\"-\".repeat(6)} ${\"-\".repeat(11)} ${\"-\".repeat(8)}\\n`);\n        for (let i = 0; i < steps.length; i++) {\n          const pure = pureSteps.has(steps[i]) ? \"yes\" : \"no\";\n          const removable = nonRemovable.has(steps[i]) ? \"no\" : \"yes\";\n          process.stdout.write(`  ${String(i + 1).padEnd(4)} ${steps[i].padEnd(28)} ${pure.padEnd(6)} ${removable.padEnd(11)} \\u2014\\n`);\n        }\n      }\n    });\n  cli.addCommand(pipelineCmd);\n}\n","/**\n * Built-in Command Group (FE-13).\n *\n * Encapsulates visibility resolution and subcommand filtering for the\n * reserved `apcli` group. Instantiated once by createCli() and attached\n * to the root command.\n *\n * Shape mirrors `src/exposure.ts` ExposureFilter: private constructor,\n * named static factories, and a small set of predicate methods.\n * See the feature spec §4.2–4.7 for authoritative semantics.\n */\n\nimport { EXIT_CODES } from \"./errors.js\";\nimport { warn } from \"./logger.js\";\n\n// ---------------------------------------------------------------------------\n// Errors\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown for invalid built-in apcli group configuration (e.g. invalid\n * `builtinGroupName` regex match). Cross-SDK parity with Rust's\n * `ApcliGroupError` (D1-info-1, 2026-05-08).\n *\n * Extends `Error` so existing `catch (e)` blocks continue to work via\n * `instanceof Error`; callers that want to distinguish apcli config\n * errors from generic errors can switch on `instanceof ApcliGroupError`.\n */\nexport class ApcliGroupError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ApcliGroupError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Types & constants\n// ---------------------------------------------------------------------------\n\n/**\n * Resolved visibility mode.\n *\n * `\"auto\"` is an internal sentinel — it is never returned from\n * {@link ApcliGroup.resolveVisibility} and is rejected when supplied via\n * user config (CliConfig or apcore.yaml).\n */\nexport type ApcliMode = \"auto\" | \"all\" | \"none\" | \"include\" | \"exclude\";\n\n/**\n * User-facing apcli config shape.\n *\n * Boolean shorthand maps to `{mode: \"all\"}` / `{mode: \"none\"}`.\n * Object form rejects `\"auto\"` per spec §4.2 (internal sentinel only).\n */\nexport type ApcliConfig =\n  | boolean\n  | {\n      mode?: Exclude<ApcliMode, \"auto\">;\n      include?: string[];\n      exclude?: string[];\n      disableEnv?: boolean;\n    };\n\n/**\n * Default name of the built-in command group. Overridable per ApcliGroup\n * instance via the `name` constructor option, or via createCli's\n * `builtinGroupName` option. Cross-SDK parity with Python\n * `DEFAULT_BUILTIN_GROUP_NAME` (2026-05-08).\n */\nexport const DEFAULT_BUILTIN_GROUP_NAME = \"apcli\";\n\n/**\n * Set of group names reserved by apcore-cli when no rename is configured.\n * Default mirrors {@link DEFAULT_BUILTIN_GROUP_NAME}; when `builtinGroupName`\n * is overridden the live reserved set is `new Set([apcliGroup.name])` and\n * is applied per-instance during the cli.ts collision check.\n */\nexport const RESERVED_GROUP_NAMES: ReadonlySet<string> = new Set([DEFAULT_BUILTIN_GROUP_NAME]);\n\n/**\n * Module-level mutable cache of the current effective reserved-group set,\n * set by {@link setReservedGroupNames} from createCli once the renamed\n * builtin-group name is resolved. Defaults to {@link RESERVED_GROUP_NAMES}.\n *\n * Cross-SDK parity (2026-05-08): mirrors the per-instance\n * `_reserved_group_names` field on Python `GroupedModuleGroup`. The\n * TypeScript port keeps the data at module scope because the collision\n * check (`assertNotReserved` in cli.ts) is a free function rather than a\n * method on the LazyModuleGroup, and threading state through every\n * call-site would be more invasive than the rename feature itself.\n */\nlet _effectiveReservedNames: ReadonlySet<string> = RESERVED_GROUP_NAMES;\n\n/**\n * Returns the effective reserved-group set. Defaults to {@link RESERVED_GROUP_NAMES};\n * after {@link setReservedGroupNames} runs (called by createCli when a custom\n * `builtinGroupName` is in effect), returns `new Set([apcliCfg.name])`.\n */\nexport function getReservedGroupNames(): ReadonlySet<string> {\n  return _effectiveReservedNames;\n}\n\n/**\n * Replace the effective reserved-group set with `names`. Called by createCli\n * after the ApcliGroup is built so the cli.ts collision check sees the\n * renamed group's name. Pass {@link RESERVED_GROUP_NAMES} (or\n * `new Set([DEFAULT_BUILTIN_GROUP_NAME])`) to reset.\n */\nexport function setReservedGroupNames(names: ReadonlySet<string>): void {\n  _effectiveReservedNames = names;\n}\n\n/**\n * Validate a candidate built-in-group name. Mirrors the regex used for\n * business-module group names downstream so a renamed built-in cannot be\n * silently shadowed by a regex-matching business module.\n */\nconst _NAME_REGEX = /^[a-z][a-z0-9_-]*$/;\nfunction _validateBuiltinGroupName(name: string): void {\n  if (!name || !_NAME_REGEX.test(name)) {\n    throw new ApcliGroupError(\n      `builtinGroupName ${JSON.stringify(name)} must match /^[a-z][a-z0-9_-]*$/ ` +\n        \"(non-empty, lowercase, alphanumeric + '_' / '-', leading letter).\",\n    );\n  }\n}\n\nconst VALID_USER_MODES: ReadonlySet<string> = new Set([\n  \"all\",\n  \"none\",\n  \"include\",\n  \"exclude\",\n]);\n\n/**\n * Canonical set of apcli subcommand names.\n *\n * Declarative mirror of the registration TABLE in `src/main.ts`\n * (`_registerApcliSubcommands`). Used by `_normalizeList` to warn on\n * unknown entries in include/exclude lists (spec §7 error table / T-APCLI-25).\n *\n * Keep in sync with main.ts TABLE if subcommands are added or removed.\n */\nexport const APCLI_SUBCOMMAND_NAMES: ReadonlySet<string> = new Set([\n  \"list\",\n  \"describe\",\n  \"exec\",\n  \"validate\",\n  \"init\",\n  \"health\",\n  \"usage\",\n  \"enable\",\n  \"disable\",\n  \"reload\",\n  \"config\",\n  \"completion\",\n  \"describe-pipeline\",\n]);\n\n// ---------------------------------------------------------------------------\n// ApcliGroup\n// ---------------------------------------------------------------------------\n\ninterface ApcliGroupInit {\n  mode: ApcliMode;\n  include: string[];\n  exclude: string[];\n  disableEnv: boolean;\n  registryInjected: boolean;\n  fromCliConfig: boolean;\n  name: string;\n}\n\n/**\n * Visibility configuration for the built-in `apcli` command group.\n *\n * Instantiated via {@link ApcliGroup.fromCliConfig} (Tier 1) or\n * {@link ApcliGroup.fromYaml} (Tier 3). The constructor is private to\n * preserve the Tier-1-vs-Tier-3 flag distinction.\n */\nexport class ApcliGroup {\n  private readonly _mode: ApcliMode;\n  private readonly _include: string[];\n  private readonly _exclude: string[];\n  private readonly _disableEnv: boolean;\n  private readonly _registryInjected: boolean;\n  private readonly _fromCliConfig: boolean;\n  private readonly _name: string;\n\n  private constructor(init: ApcliGroupInit) {\n    this._mode = init.mode;\n    this._include = init.include;\n    this._exclude = init.exclude;\n    this._disableEnv = init.disableEnv;\n    this._registryInjected = init.registryInjected;\n    this._fromCliConfig = init.fromCliConfig;\n    this._name = init.name;\n  }\n\n  /**\n   * Resolved name for the built-in command group (default `\"apcli\"`).\n   * Overridable via createCli's `builtinGroupName` option for downstream\n   * branded CLIs that want a custom namespace. Cross-SDK parity with\n   * Python `ApcliGroup.name` (2026-05-08).\n   */\n  get name(): string {\n    return this._name;\n  }\n\n  /**\n   * Tier 1 constructor — config came from `createCli({ apcli })`.\n   *\n   * A non-auto mode from this tier wins over env var and yaml.\n   */\n  static fromCliConfig(\n    config: ApcliConfig | undefined,\n    opts: { registryInjected: boolean; name?: string },\n  ): ApcliGroup {\n    return ApcliGroup._build(config, opts, /*fromCliConfig*/ true);\n  }\n\n  /**\n   * Tier 3 constructor — config came from `apcore.yaml`.\n   *\n   * Env var (Tier 2) may override the yaml-supplied mode.\n   */\n  static fromYaml(\n    config: unknown,\n    opts: { registryInjected: boolean; name?: string },\n  ): ApcliGroup {\n    // Lenient shape handling per features/builtin-group.md §4.2:\n    // \"On unexpected `config` type: returns ApcliGroup(mode='auto') after\n    // logging WARNING.\" Python implements this; the TS path previously\n    // hard-exited via _build → process.exit, breaking spec parity (A-D-006).\n    if (\n      config !== null &&\n      config !== undefined &&\n      typeof config !== \"boolean\" &&\n      (typeof config !== \"object\" || Array.isArray(config))\n    ) {\n      const got = Array.isArray(config) ? \"array\" : typeof config;\n      warn(\n        `apcore.yaml apcli has unexpected type ${got}; using auto-detect.`,\n      );\n      return ApcliGroup._build(undefined, opts, /*fromCliConfig*/ false);\n    }\n    return ApcliGroup._build(\n      config as ApcliConfig | undefined,\n      opts,\n      /*fromCliConfig*/ false,\n    );\n  }\n\n  /**\n   * Non-panicking Tier 3 factory (A-001 parity with Rust's `try_from_yaml`).\n   * Returns `[instance, null]` on success or `[null, errorMessage]` on invalid input.\n   * Use this in programmatic contexts where throwing/exiting is unwanted.\n   */\n  static tryFromYaml(\n    config: unknown,\n    opts: { registryInjected: boolean; name?: string },\n  ): [ApcliGroup, null] | [null, string] {\n    // Shape rejection. Note: `typeof [] === 'object'`, so arrays must be\n    // excluded explicitly — otherwise they fall through to fromYaml() which\n    // process.exit()s, violating the non-panicking contract (A-D-005).\n    if (\n      config !== null &&\n      config !== undefined &&\n      typeof config !== \"boolean\" &&\n      (typeof config !== \"object\" || Array.isArray(config))\n    ) {\n      const got = Array.isArray(config) ? \"array\" : typeof config;\n      return [\n        null,\n        `apcore.yaml 'apcli:' must be a bool, object, or null; got ${got}`,\n      ];\n    }\n    if (config !== null && config !== undefined && typeof config === \"object\" && !Array.isArray(config)) {\n      const mode = (config as Record<string, unknown>)[\"mode\"];\n      if (mode !== undefined && mode !== null) {\n        const validModes = [\"all\", \"none\", \"include\", \"exclude\"];\n        if (typeof mode !== \"string\" || !validModes.includes(mode)) {\n          return [null, `Invalid apcli mode: '${mode}'. Must be one of: all, none, include, exclude.`];\n        }\n      }\n    }\n    return [ApcliGroup.fromYaml(config, opts), null];\n  }\n\n  // -------------------------------------------------------------------------\n  // Internal builder — shared by both factories\n  // -------------------------------------------------------------------------\n\n  private static _build(\n    config: ApcliConfig | undefined,\n    opts: { registryInjected: boolean; name?: string },\n    fromCliConfig: boolean,\n  ): ApcliGroup {\n    // Resolve the built-in-group name. Validation runs once here so all\n    // construction paths share the same shell-safe regex check.\n    const name = opts.name ?? DEFAULT_BUILTIN_GROUP_NAME;\n    _validateBuiltinGroupName(name);\n\n    // Boolean shorthand → normalized object form.\n    if (config === true) {\n      return new ApcliGroup({\n        mode: \"all\",\n        include: [],\n        exclude: [],\n        disableEnv: false,\n        registryInjected: opts.registryInjected,\n        fromCliConfig,\n        name,\n      });\n    }\n    if (config === false) {\n      return new ApcliGroup({\n        mode: \"none\",\n        include: [],\n        exclude: [],\n        disableEnv: false,\n        registryInjected: opts.registryInjected,\n        fromCliConfig,\n        name,\n      });\n    }\n\n    // Missing / nullish → auto-detect (mode left as internal sentinel).\n    if (config === undefined || config === null) {\n      return new ApcliGroup({\n        mode: \"auto\",\n        include: [],\n        exclude: [],\n        disableEnv: false,\n        registryInjected: opts.registryInjected,\n        fromCliConfig,\n        name,\n      });\n    }\n\n    if (typeof config !== \"object\" || Array.isArray(config)) {\n      // Unexpected shape — refuse to silently coerce.\n      process.stderr.write(\n        `Error: apcli config must be a boolean or object; got ${Array.isArray(config) ? \"array\" : typeof config}.\\n`,\n      );\n      process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n    }\n\n    const cfg = config as Record<string, unknown>;\n\n    // Mode validation. `\"auto\"` and unknown values are rejected.\n    let mode: ApcliMode;\n    if (cfg.mode === undefined || cfg.mode === null) {\n      // Object form without mode (e.g. `{disableEnv: true}`) → mode auto.\n      mode = \"auto\";\n    } else if (typeof cfg.mode !== \"string\") {\n      process.stderr.write(\n        `Error: apcli.mode must be a string; got ${typeof cfg.mode}. ` +\n          `Expected one of all|none|include|exclude.\\n`,\n      );\n      process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n    } else if (!VALID_USER_MODES.has(cfg.mode)) {\n      process.stderr.write(\n        `Error: apcli.mode '${cfg.mode}' is invalid. ` +\n          `Expected one of all|none|include|exclude.\\n`,\n      );\n      process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n    } else {\n      mode = cfg.mode as ApcliMode;\n    }\n\n    // include / exclude lists — warn on non-array, keep entries as-is.\n    const include = ApcliGroup._normalizeList(cfg.include, \"include\");\n    const exclude = ApcliGroup._normalizeList(cfg.exclude, \"exclude\");\n\n    // disableEnv — accept both camelCase (JS object literal) and snake_case\n    // (yaml-per-spec §4.2 / §10.3). Must be boolean; warn + treat as false\n    // otherwise.\n    const rawDisableEnv =\n      cfg.disableEnv !== undefined\n        ? cfg.disableEnv\n        : (cfg as Record<string, unknown>)[\"disable_env\"];\n    let disableEnv = false;\n    if (rawDisableEnv !== undefined) {\n      if (typeof rawDisableEnv === \"boolean\") {\n        disableEnv = rawDisableEnv;\n      } else {\n        warn(\n          `apcli.disable_env must be boolean; got ${typeof rawDisableEnv}. Treating as false.`,\n        );\n      }\n    }\n\n    return new ApcliGroup({\n      mode,\n      include,\n      exclude,\n      disableEnv,\n      registryInjected: opts.registryInjected,\n      fromCliConfig,\n      name,\n    });\n  }\n\n  /**\n   * Normalize an include/exclude list. Non-array → warn and return [].\n   *\n   * Unknown but well-formed entries emit a WARNING (spec §7 error table,\n   * T-APCLI-25) but are retained in the returned list for forward-compat —\n   * if apcore-cli later adds a subcommand named `foo`, existing configs\n   * continue to work without a config change. At runtime, unknown names\n   * simply never match any registered subcommand.\n   */\n  private static _normalizeList(raw: unknown, label: string): string[] {\n    if (raw === undefined || raw === null) return [];\n    if (!Array.isArray(raw)) {\n      warn(`apcli.${label} must be a list; got ${typeof raw}. Ignoring.`);\n      return [];\n    }\n    const out: string[] = [];\n    for (const entry of raw) {\n      if (typeof entry === \"string\" && entry.length > 0) {\n        if (!APCLI_SUBCOMMAND_NAMES.has(entry)) {\n          warn(\n            `Unknown apcli subcommand '${entry}' in ${label} list — ignoring.`,\n          );\n        }\n        out.push(entry);\n      } else {\n        warn(`apcli.${label} contains non-string entry; skipping.`);\n      }\n    }\n    return out;\n  }\n\n  // -------------------------------------------------------------------------\n  // Public API\n  // -------------------------------------------------------------------------\n\n  /**\n   * Resolve effective visibility mode after applying tier precedence.\n   *\n   * Returns one of `\"all\" | \"none\" | \"include\" | \"exclude\"` — never `\"auto\"`.\n   *\n   * Tier order (spec §4.4):\n   *   1. CliConfig non-auto wins outright.\n   *   2. `APCORE_CLI_APCLI` env var (unless sealed by disableEnv).\n   *   3. yaml non-auto.\n   *   4. Auto-detect from registryInjected.\n   */\n  resolveVisibility(): \"all\" | \"none\" | \"include\" | \"exclude\" {\n    // Tier 1 — CliConfig non-auto.\n    if (this._fromCliConfig && this._mode !== \"auto\") {\n      return this._mode;\n    }\n\n    // Tier 2 — env var (unless sealed).\n    if (!this._disableEnv) {\n      const envMode = this._parseEnv(process.env.APCORE_CLI_APCLI);\n      if (envMode !== null) {\n        return envMode;\n      }\n    }\n\n    // Tier 3 — yaml non-auto.\n    if (this._mode !== \"auto\") {\n      return this._mode;\n    }\n\n    // Tier 4 — auto-detect.\n    return this._registryInjected ? \"none\" : \"all\";\n  }\n\n  /**\n   * True iff `subcommand` passes the include/exclude filter.\n   *\n   * Callers MUST first check {@link resolveVisibility} — this method throws\n   * under modes `\"all\"` or `\"none\"` (caller bug per spec §4.6).\n   */\n  isSubcommandIncluded(subcommand: string): boolean {\n    const mode = this.resolveVisibility();\n    if (mode === \"include\") return this._include.includes(subcommand);\n    if (mode === \"exclude\") return !this._exclude.includes(subcommand);\n    throw new Error(\n      `isSubcommandIncluded called under mode '${mode}'; caller should bypass.`,\n    );\n  }\n\n  /** True iff the `apcli` group itself should appear in root `--help`. */\n  isGroupVisible(): boolean {\n    return this.resolveVisibility() !== \"none\";\n  }\n\n  // -------------------------------------------------------------------------\n  // Env parser (Tier 2) — co-located per spec §4.4\n  // -------------------------------------------------------------------------\n\n  /**\n   * Parse APCORE_CLI_APCLI. Case-insensitive.\n   *\n   * - `show` / `1` / `true` → `\"all\"`\n   * - `hide` / `0` / `false` → `\"none\"`\n   * - Empty / unset → `null`\n   * - Anything else → warn and return `null`\n   */\n  private _parseEnv(raw: string | undefined): \"all\" | \"none\" | null {\n    if (raw === undefined || raw === \"\") return null;\n    // Spec invariant 2 (features/builtin-group.md): env-var parser is\n    // case-insensitive and trim-on-read. Trim before lowercase so values\n    // like \"  all  \" or \"\\tshow\\n\" resolve correctly across SDKs.\n    const normalized = raw.trim().toLowerCase();\n    if (normalized === \"\") return null;\n    if (normalized === \"show\" || normalized === \"1\" || normalized === \"true\") {\n      return \"all\";\n    }\n    if (\n      normalized === \"hide\" ||\n      normalized === \"0\" ||\n      normalized === \"false\"\n    ) {\n      return \"none\";\n    }\n    warn(\n      `Unknown APCORE_CLI_APCLI value '${raw}', ignoring. ` +\n        `Expected: show, hide, 1, 0, true, false.`,\n    );\n    return null;\n  }\n}\n","/**\n * Module Exposure Filtering (FE-12).\n *\n * Provides declarative control over which discovered modules are exposed\n * as CLI commands. Supports three modes: all, include (whitelist), and\n * exclude (blacklist) with glob-pattern matching on module IDs.\n */\n\nimport { warn } from \"./logger.js\";\n\n// ---------------------------------------------------------------------------\n// Glob pattern compiler\n// ---------------------------------------------------------------------------\n\n/** Escape special regex characters in a string. */\nfunction escapeRegex(str: string): string {\n  return str.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\n/**\n * Compile a glob pattern to a regex.\n *\n * - `*` matches a single dotted segment (no dots): `[^.]*`\n * - `**` matches across segments (any characters including dots): `.+`\n * - Literal text is matched exactly via regex escaping.\n */\nexport function compilePattern(pattern: string): RegExp {\n  const sentinel = \"\\x00GLOB\\x00\";\n  const escaped = pattern.replaceAll(\"**\", sentinel);\n  const parts = escaped.split(\"*\");\n  const regexParts = parts.map((p) => {\n    const restored = p.replaceAll(sentinel, \"**\");\n    return escapeRegex(restored);\n  });\n  let regex = regexParts.join(\"[^.]*\");\n  regex = regex.replaceAll(\"\\\\*\\\\*\", \".+\");\n  return new RegExp(`^${regex}$`);\n}\n\n/** Test whether a moduleId matches a glob pattern. */\nexport function globMatch(moduleId: string, pattern: string): boolean {\n  return compilePattern(pattern).test(moduleId);\n}\n\n// ---------------------------------------------------------------------------\n// ExposureFilter\n// ---------------------------------------------------------------------------\n\n/**\n * Determines which modules are exposed as CLI commands.\n *\n * Filtering modes:\n * - `all`: every discovered module becomes a CLI command (default).\n * - `include`: only modules matching at least one include pattern are exposed.\n * - `exclude`: all modules are exposed except those matching any exclude pattern.\n */\nexport class ExposureFilter {\n  static readonly VALID_MODES = [\"all\", \"include\", \"exclude\", \"none\"] as const;\n\n  readonly _mode: string;\n  private readonly _compiledInclude: RegExp[];\n  private readonly _compiledExclude: RegExp[];\n\n  constructor(mode = \"all\", include?: string[], exclude?: string[]) {\n    // Cross-SDK parity with apcore-cli-rust/src/exposure.rs:70 (D11-008):\n    // unknown mode values clamp to \"none\" with a warning so consumers that\n    // introspect ``filter.mode`` see a consistent string across the three\n    // SDKs. Runtime exposure decision is unchanged (isExposed already\n    // fail-closes on unknown modes via its default-false branch); the\n    // clamp aligns the persisted state.\n    if (!ExposureFilter.VALID_MODES.includes(mode as (typeof ExposureFilter.VALID_MODES)[number])) {\n      process.stderr.write(\n        `Warning: Unknown ExposureFilter mode '${mode}' — defaulting to 'none'. Valid modes: ${ExposureFilter.VALID_MODES.join(\", \")}.\\n`,\n      );\n      mode = \"none\";\n    }\n    this._mode = mode;\n    const dedup = (arr: string[]) => [...new Set(arr)];\n    this._compiledInclude = dedup(include ?? []).map(compilePattern);\n    this._compiledExclude = dedup(exclude ?? []).map(compilePattern);\n  }\n\n  /** Return true if the module should be exposed as a CLI command. */\n  isExposed(moduleId: string): boolean {\n    if (this._mode === \"all\") return true;\n    if (this._mode === \"include\") {\n      return this._compiledInclude.some((rx) => rx.test(moduleId));\n    }\n    if (this._mode === \"exclude\") {\n      return !this._compiledExclude.some((rx) => rx.test(moduleId));\n    }\n    return false;\n  }\n\n  /** Partition moduleIds into [exposed, hidden] lists. */\n  filterModules(moduleIds: string[]): [string[], string[]] {\n    const exposed: string[] = [];\n    const hidden: string[] = [];\n    for (const mid of moduleIds) {\n      (this.isExposed(mid) ? exposed : hidden).push(mid);\n    }\n    return [exposed, hidden];\n  }\n\n  /**\n   * Create an ExposureFilter from a parsed config dict.\n   *\n   * Expected: `{ expose: { mode: \"include\", include: [\"admin.*\"] } }`\n   */\n  static fromConfig(config: Record<string, unknown>): ExposureFilter {\n    const expose = config.expose ?? {};\n    if (typeof expose !== \"object\" || expose === null || Array.isArray(expose)) {\n      warn(\"Invalid 'expose' config (expected dict), using mode: all.\");\n      return new ExposureFilter();\n    }\n\n    const exposeObj = expose as Record<string, unknown>;\n    const mode = (exposeObj.mode as string) ?? \"all\";\n    if (![\"all\", \"include\", \"exclude\"].includes(mode)) {\n      throw new Error(\n        `Invalid expose mode: '${mode}'. Must be one of: all, include, exclude.`,\n      );\n    }\n\n    let include = exposeObj.include ?? [];\n    if (!Array.isArray(include)) {\n      warn(\"Invalid 'expose.include' (expected list), ignoring.\");\n      include = [];\n    }\n\n    let exclude = exposeObj.exclude ?? [];\n    if (!Array.isArray(exclude)) {\n      warn(\"Invalid 'expose.exclude' (expected list), ignoring.\");\n      exclude = [];\n    }\n\n    const filterList = (arr: unknown[], label: string): string[] => {\n      const result: string[] = [];\n      for (const p of arr) {\n        if (!p) {\n          warn(`Empty pattern in expose.${label}, skipping.`);\n        } else {\n          result.push(String(p));\n        }\n      }\n      return result;\n    };\n\n    return new ExposureFilter(\n      mode,\n      filterList(include as unknown[], \"include\"),\n      filterList(exclude as unknown[], \"exclude\"),\n    );\n  }\n}\n","/**\n * Canonical help formatter — clap/GNU-style output shared across the\n * apcore-cli SDK family (TS, Python, Rust).\n *\n * Conventions:\n *   - Description before Usage\n *   - `Usage: <prog> [OPTIONS] [COMMAND]` (uppercase)\n *   - `Commands:` section before `Options:`\n *   - `<UPPER>` placeholders\n *   - `[default: VALUE]` (brackets, no quotes)\n *   - `-h, --help` → \"Print help\", `-V, --version` → \"Print version\"\n *   - Long-only options indented 4 extra spaces so `--long` aligns with\n *     `-s, --long` rows\n */\n\nimport type { Command, Help, Option } from \"commander\";\n\ntype HelpTextSection =\n  | string\n  | ((ctx: { error: boolean; command: Command }) => string);\n\ninterface CommandHelpTextBag {\n  beforeAll?: HelpTextSection;\n  before?: HelpTextSection;\n  after?: HelpTextSection;\n  afterAll?: HelpTextSection;\n}\n\nfunction resolveHelpText(cmd: Command, section: keyof CommandHelpTextBag): string {\n  const bag = (cmd as unknown as { _helpText?: CommandHelpTextBag })._helpText;\n  const v = bag?.[section];\n  if (typeof v === \"function\") return v({ error: false, command: cmd });\n  return v ?? \"\";\n}\n\nfunction uppercasePlaceholders(flags: string): string {\n  return flags\n    .replace(/<([a-zA-Z0-9_-]+)>/g, (_, name) => `<${name.toUpperCase()}>`)\n    .replace(/\\[([a-zA-Z0-9_-]+)\\]/g, (_, name) => `[${name.toUpperCase()}]`);\n}\n\nfunction optionTerm(opt: Option): string {\n  const flags = uppercasePlaceholders(opt.flags);\n  // Align long-only options with short+long rows: \"  -s, --long\" vs \"      --long\"\n  if (!opt.short && flags.startsWith(\"--\")) return \"    \" + flags;\n  return flags;\n}\n\nfunction optionDescription(opt: Option): string {\n  let desc = opt.description;\n  const d = opt.defaultValue;\n  if (d !== undefined && d !== false && d !== \"\" && d !== null) {\n    desc = `${desc} [default: ${String(d)}]`;\n  }\n  return desc;\n}\n\n/**\n * Move `-h, --help` and `-V, --version` to the end of the options list so\n * they always render last (clap convention), regardless of registration\n * order inside `createCli`.\n */\nfunction reorderHelpVersionLast(opts: readonly Option[]): Option[] {\n  const helpOpts: Option[] = [];\n  const versionOpts: Option[] = [];\n  const rest: Option[] = [];\n  for (const o of opts) {\n    if (o.long === \"--help\") helpOpts.push(o);\n    else if (o.long === \"--version\") versionOpts.push(o);\n    else rest.push(o);\n  }\n  return [...rest, ...helpOpts, ...versionOpts];\n}\n\nexport function canonicalFormatHelp(cmd: Command, helper: Help): string {\n  const sections: string[] = [];\n\n  const beforeAll = resolveHelpText(cmd, \"beforeAll\");\n  if (beforeAll) sections.push(beforeAll);\n\n  const desc = cmd.description();\n  if (desc) sections.push(desc);\n\n  const before = resolveHelpText(cmd, \"before\");\n  if (before) sections.push(before);\n\n  const visibleOpts = reorderHelpVersionLast(helper.visibleOptions(cmd));\n  const visibleCmds = helper.visibleCommands(cmd);\n  const args = (cmd as unknown as {\n    registeredArguments?: Array<{ name: () => string; required: boolean }>;\n  }).registeredArguments ?? [];\n\n  let usage = `Usage: ${cmd.name()}`;\n  if (visibleOpts.length > 0) usage += \" [OPTIONS]\";\n  for (const a of args) {\n    const n = a.name().toUpperCase();\n    usage += a.required ? ` <${n}>` : ` [${n}]`;\n  }\n  if (visibleCmds.length > 0) usage += \" [COMMAND]\";\n  sections.push(usage);\n\n  if (visibleCmds.length > 0) {\n    const terms = visibleCmds.map((c) => c.name());\n    const w = Math.max(...terms.map((t) => t.length));\n    const lines = [\"Commands:\"];\n    visibleCmds.forEach((sub, i) => {\n      lines.push(`  ${terms[i].padEnd(w)}  ${sub.description()}`);\n    });\n    sections.push(lines.join(\"\\n\"));\n  }\n\n  if (visibleOpts.length > 0) {\n    const terms = visibleOpts.map(optionTerm);\n    const w = Math.max(...terms.map((t) => t.length));\n    const lines = [\"Options:\"];\n    visibleOpts.forEach((opt, i) => {\n      lines.push(`  ${terms[i].padEnd(w)}  ${optionDescription(opt)}`);\n    });\n    sections.push(lines.join(\"\\n\"));\n  }\n\n  const after = resolveHelpText(cmd, \"after\");\n  if (after) sections.push(after);\n\n  const afterAll = resolveHelpText(cmd, \"afterAll\");\n  if (afterAll) sections.push(afterAll);\n\n  return sections.join(\"\\n\\n\") + \"\\n\";\n}\n","/**\n * Module-ID validation.\n *\n * Mirrors `apcore-cli-python/src/apcore_cli/validate.py` and\n * `apcore-cli-rust/src/validate.rs` so embedders comparing the three SDKs\n * find the helper at the same path in each tree (audit D8-W2).\n */\n\nimport { EXIT_CODES } from \"./errors.js\";\n\n/** Module-ID syntax: dot-separated lowercase segments, each `[a-z][a-z0-9_]*`. */\nconst MODULE_ID_PATTERN = /^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*)*$/;\n\n/**\n * Maximum allowed module-ID length in characters.\n *\n * Tracks PROTOCOL_SPEC §2.7 EBNF constraint #1 — bumped from 128 to 192 in\n * spec 1.6.0-draft to accommodate Java/.NET deep-namespace FQN-derived IDs.\n * Filesystem-safe (192 + \".binding.yaml\".length = 205 < 255).\n */\nexport const MAX_MODULE_ID_LENGTH = 192;\n\n/**\n * Validate that a module ID conforms to the expected format.\n *\n * Pattern: `[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*)*` — max 192 chars.\n *\n * On invalid input, writes a human-readable error to stderr and calls\n * `process.exit(EXIT_CODES.INVALID_CLI_INPUT)`. Cross-SDK parity with Python\n * `apcore_cli.validate.validate_module_id` and Rust `validate_module_id`.\n */\nexport function validateModuleId(moduleId: string): void {\n  if (moduleId.length > MAX_MODULE_ID_LENGTH) {\n    process.stderr.write(\n      `Error: Invalid module ID format: '${moduleId}'. Maximum length is ${MAX_MODULE_ID_LENGTH} characters.\\n`,\n    );\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n  if (!MODULE_ID_PATTERN.test(moduleId)) {\n    process.stderr.write(\n      `Error: Invalid module ID format: '${moduleId}'.\\n`,\n    );\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n}\n","/**\n * CLI entry point — createCli / main equivalents.\n *\n * Protocol spec: CLI bootstrapping & command registration\n * Implements: F1 (dry-run), F3 (enhanced errors), F4 (trace),\n * F5 (approval handler), F6 (stream), F8 (strategy), F9 (output formats),\n * F11 (extra commands)\n */\n\nimport { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\nimport * as path from \"node:path\";\nimport { Command, CommanderError, Option } from \"commander\";\nimport { EXIT_CODES, exitCodeForError } from \"./errors.js\";\nimport { resolveRefs } from \"./ref-resolver.js\";\nimport { schemaToCliOptions } from \"./schema-parser.js\";\nimport { checkApproval } from \"./approval.js\";\nimport { formatExecResult, formatPreflightResult, firstFailedExitCode, resolveFormat } from \"./output.js\";\nimport { setLogLevel, warn as logWarn } from \"./logger.js\";\nimport { registerInitCommand } from \"./init-cmd.js\";\nimport { getDisplay } from \"./display-helpers.js\";\nimport { ConfigResolver, registerConfigNamespace } from \"./config.js\";\nimport { CliApprovalHandler } from \"./approval.js\";\nimport { configureManHelp, registerCompletionCommand } from \"./shell.js\";\nimport {\n  registerDescribeCommand,\n  registerExecCommand,\n  registerListCommand,\n  registerValidateCommand,\n} from \"./discovery.js\";\nimport {\n  registerConfigCommand,\n  registerDisableCommand,\n  registerEnableCommand,\n  registerHealthCommand,\n  registerReloadCommand,\n  registerUsageCommand,\n} from \"./system-cmd.js\";\nimport { registerPipelineCommand } from \"./strategy.js\";\nimport { ApcliGroup, setReservedGroupNames } from \"./builtin-group.js\";\nimport type { ApcliConfig } from \"./builtin-group.js\";\nimport { ExposureFilter } from \"./exposure.js\";\nimport { AuditLogger, setAuditLogger } from \"./security/audit.js\";\nimport type { Executor, ModuleDescriptor, Registry } from \"./cli.js\";\nimport { canonicalFormatHelp } from \"./canonical-help.js\";\n\nconst __dirname = path.dirname(fileURLToPath(import.meta.url));\n\n/**\n * Whether --verbose was passed (controls help detail level).\n *\n * Module-private mutable flag. The setter `setVerboseHelp` is the sanctioned\n * public API; raw `let`-binding access from outside this module is an audit\n * violation (D9-W1) and unstable across bundlers.\n */\nlet verboseHelp = false;\n\n/** Set the verbose help flag. When false, built-in options are hidden from help. */\nexport function setVerboseHelp(verbose: boolean): void {\n  verboseHelp = verbose;\n}\n\n/**\n * Base URL for online documentation. Null means no docs link shown.\n *\n * Module-private. Use the setter `setDocsUrl` from outside this module.\n */\nlet docsUrl: string | null = null;\n\n/**\n * Set the base URL for online documentation links shown in help and man pages.\n * Pass null to disable. Command-level help appends `/commands/{name}` automatically.\n *\n * @example setDocsUrl(\"https://docs.apcore.dev/cli\");\n */\nexport function setDocsUrl(url: string | null): void {\n  docsUrl = url;\n}\n\n/** Check if --verbose is present in process.argv (pre-parse, before Commander). */\nfunction hasVerboseFlag(): boolean {\n  return process.argv.includes(\"--verbose\");\n}\n\n/**\n * Resolve a positive-integer option: CLI flag > env var > default.\n * Invalid env values (non-integer, zero, negative) are ignored with a warning\n * so users aren't silently downgraded to the default.\n */\nexport function resolveIntOption(\n  cliValue: number | undefined,\n  envValue: string | undefined,\n  defaultValue: number,\n): number {\n  if (cliValue !== undefined && Number.isFinite(cliValue) && cliValue > 0) {\n    return cliValue;\n  }\n  if (envValue !== undefined && envValue !== \"\") {\n    const parsed = parseInt(envValue, 10);\n    if (Number.isFinite(parsed) && parsed > 0) {\n      return parsed;\n    }\n    process.stderr.write(\n      `Warning: invalid integer env value '${envValue}'; using default ${defaultValue}.\\n`,\n    );\n  }\n  return defaultValue;\n}\n\n/**\n * Resolve a string option: CLI flag > env var > undefined.\n * Empty strings are treated as absent.\n */\nexport function resolveStringOption(\n  cliValue: unknown,\n  envValue: string | undefined,\n): string | undefined {\n  if (typeof cliValue === \"string\" && cliValue !== \"\") {\n    return cliValue;\n  }\n  if (envValue !== undefined && envValue !== \"\") {\n    return envValue;\n  }\n  return undefined;\n}\n\nlet VERSION = \"0.0.0\";\ntry {\n  const pkg = JSON.parse(readFileSync(path.resolve(__dirname, \"../package.json\"), \"utf-8\"));\n  VERSION = pkg.version;\n} catch {\n  // Bundled environments (e.g., Bun compile) may not have package.json accessible\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** Configuration for a single Commander option derived from a JSON Schema property. */\nexport interface OptionConfig {\n  /** The property name from the schema. */\n  name: string;\n  /** Commander flags string (e.g. \"--my-flag <value>\" or \"--flag, --no-flag\"). */\n  flags: string;\n  /** Help text for the option. */\n  description: string;\n  /** Default value. */\n  defaultValue?: unknown;\n  /** Whether the field is required (for display only). */\n  required: boolean;\n  /** Enum choices (string values). */\n  choices?: string[];\n  /** Whether this is a boolean flag pair (--flag/--no-flag). */\n  isBooleanFlag?: boolean;\n  /** Maps string enum value → original type name (\"int\", \"float\", \"bool\"). */\n  enumOriginalTypes?: Record<string, string>;\n  /** Parser function for Commander (e.g. parseInt, parseFloat). */\n  parseArg?: (value: string) => unknown;\n}\n\n// ---------------------------------------------------------------------------\n// Enhanced error output (F3)\n// ---------------------------------------------------------------------------\n\n/**\n * Emit structured JSON error to stderr for AI agents.\n *\n * Module-private. The only consumer is buildModuleCommand's action handler\n * within this same file (audit D9-W2).\n */\nfunction emitErrorJson(e: unknown, exitCode: number): void {\n  const err = e instanceof Error ? e : new Error(String(e));\n  const errRecord = err as unknown as Record<string, unknown>;\n  const code = errRecord.code ?? \"UNKNOWN\";\n  const payload: Record<string, unknown> = {\n    error: true,\n    code,\n    message: err.message,\n    exit_code: exitCode,\n  };\n  for (const field of [\"details\", \"suggestion\", \"ai_guidance\", \"retryable\", \"user_fixable\"]) {\n    const val = errRecord[field];\n    if (val !== undefined && val !== null) {\n      payload[field] = val;\n    }\n  }\n  process.stderr.write(JSON.stringify(payload) + \"\\n\");\n}\n\n/**\n * Emit human-readable error to stderr with guidance fields.\n *\n * Module-private. The only consumer is buildModuleCommand's action handler\n * within this same file (audit D9-W2).\n */\nfunction emitErrorTty(e: unknown, exitCode: number): void {\n  const err = e instanceof Error ? e : new Error(String(e));\n  const errRecord = err as unknown as Record<string, unknown>;\n  const code = errRecord.code;\n  const header = code ? `Error [${code}]: ${err.message}` : `Error: ${err.message}`;\n  process.stderr.write(header + \"\\n\");\n\n  const details = errRecord.details;\n  if (details && typeof details === \"object\" && !Array.isArray(details)) {\n    process.stderr.write(\"\\n  Details:\\n\");\n    for (const [k, v] of Object.entries(details as Record<string, unknown>)) {\n      process.stderr.write(`    ${k}: ${v}\\n`);\n    }\n  }\n\n  const suggestion = errRecord.suggestion;\n  if (suggestion) {\n    process.stderr.write(`\\n  Suggestion: ${suggestion}\\n`);\n  }\n\n  const retryable = errRecord.retryable;\n  if (retryable !== undefined && retryable !== null) {\n    const label = retryable ? \"Yes\" : \"No (same input will fail again)\";\n    process.stderr.write(`  Retryable: ${label}\\n`);\n  }\n\n  process.stderr.write(`\\n  Exit code: ${exitCode}\\n`);\n}\n\n// ---------------------------------------------------------------------------\n// createCli\n// ---------------------------------------------------------------------------\n\n/**\n * APCore unified client facade (apcore-js >= 0.18.0).\n * Exposes registry and executor as top-level properties.\n */\nexport interface APCore {\n  registry: Registry;\n  executor: Executor;\n}\n\n/** Options for createCli. */\nexport interface CreateCliOptions {\n  extensionsDir?: string;\n  progName?: string;\n  verbose?: boolean;\n  /**\n   * APCore unified client instance (apcore-js >= 0.18.0).\n   * Mutually exclusive with registry/executor — providing app alongside\n   * either of those will throw.\n   */\n  app?: APCore;\n  /** Pre-populated Registry instance. Skips filesystem discovery when provided. */\n  registry?: Registry;\n  /** Pre-built Executor instance. Used alongside registry. */\n  executor?: Executor;\n  /** Extra commands to register after built-in commands (FE-11 F11). */\n  extraCommands?: Command[];\n  /** Exposure filter config or instance (FE-12). */\n  expose?: Record<string, unknown> | import(\"./exposure.js\").ExposureFilter;\n  /** Path to convention-based commands directory (apcore-toolkit ConventionScanner). */\n  commandsDir?: string;\n  /** Path to binding.yaml for display overlay (apcore-toolkit DisplayResolver). */\n  bindingPath?: string;\n  /**\n   * Optional allowlist of module-path prefixes forwarded to\n   * apcore-toolkit's `RegistryWriter.write` when registering convention-scanned\n   * or binding-loaded modules. When set, the writer rejects any `target:`\n   * path outside the listed prefixes — mitigates arbitrary-code-execution via\n   * forged binding YAML (e.g. `target: \"os:system\"`).\n   *\n   * Mirrors the Python SDK's `allowed_prefixes` kwarg\n   * (apcore-cli-python/src/apcore_cli/factory.py).\n   */\n  allowedPrefixes?: string[];\n  /**\n   * Built-in apcli group configuration (FE-13).\n   *\n   * Accepts:\n   *  - `true` / `false` (shorthand for `{mode: \"all\"}` / `{mode: \"none\"}`)\n   *  - A config object (see {@link ApcliConfig})\n   *  - A pre-built {@link ApcliGroup} instance (Tier 1 override)\n   *\n   * When absent, Tier 3 (apcore.yaml `apcli:` block) is consulted, falling\n   * back to auto-detect: standalone → visible, embedded → hidden.\n   */\n  apcli?: ApcliConfig | ApcliGroup;\n  /**\n   * Override the name of the built-in command group (default `\"apcli\"`).\n   * Downstream branded CLIs that want their built-ins under a custom\n   * namespace (e.g. `mycorp-cli admin health`) pass a different value\n   * here. Must match `/^[a-z][a-z0-9_-]*$/` — non-empty, lowercase,\n   * alphanumeric + `_` / `-`. Invalid values cause exit code 2.\n   *\n   * Note: env var `APCORE_CLI_APCLI` and config keys `apcli.*` remain\n   * stable regardless of this rename — they are apcore-cli-internal\n   * toggles, not user-facing. Mirrors Python\n   * `create_cli(builtin_group_name=)`. Cross-SDK parity: 2026-05-08.\n   */\n  builtinGroupName?: string;\n  /**\n   * Host application version printed by `-V, --version`.\n   *\n   * When omitted, the `--version` flag is NOT registered — embedded CLIs\n   * that do not opt in will not surface the SDK's own version. The\n   * standalone `apcore-cli` binary entry point passes its package version\n   * explicitly (see `main()`).\n   */\n  version?: string;\n  /**\n   * Top-level CLI description shown at the head of `--help`. Defaults to\n   * `${progName} CLI` when omitted, so embedded CLIs do not leak the\n   * \"apcore\" framework name into their own help output.\n   */\n  description?: string;\n}\n\n/**\n * Build and return the top-level Commander program.\n *\n * @param extensionsDirOrOpts  Path to extensions directory, or a CreateCliOptions object.\n * @param progName       Program name shown in help (default: apcore-cli)\n * @param verbose        Show verbose help output\n */\nexport function createCli(\n  extensionsDirOrOpts?: string | CreateCliOptions,\n  progName?: string,\n  verbose = false,\n): Command {\n  // Normalise overloaded first argument.\n  let extensionsDir: string | undefined;\n  let registry: Registry | undefined;\n  let executor: Executor | undefined;\n  let extraCommands: Command[] | undefined;\n  let app: APCore | undefined;\n  let expose: Record<string, unknown> | import(\"./exposure.js\").ExposureFilter | undefined;\n  let apcliOption: ApcliConfig | ApcliGroup | undefined;\n  let appVersion: string | undefined;\n  let appDescription: string | undefined;\n  let allowedPrefixes: string[] | undefined;\n  let builtinGroupName: string | undefined;\n  if (typeof extensionsDirOrOpts === \"object\" && extensionsDirOrOpts !== null) {\n    extensionsDir = extensionsDirOrOpts.extensionsDir;\n    progName = extensionsDirOrOpts.progName ?? progName;\n    verbose = extensionsDirOrOpts.verbose ?? verbose;\n    app = extensionsDirOrOpts.app;\n    registry = extensionsDirOrOpts.registry;\n    executor = extensionsDirOrOpts.executor;\n    extraCommands = extensionsDirOrOpts.extraCommands;\n    expose = extensionsDirOrOpts.expose;\n    apcliOption = extensionsDirOrOpts.apcli;\n    appVersion = extensionsDirOrOpts.version;\n    appDescription = extensionsDirOrOpts.description;\n    builtinGroupName = extensionsDirOrOpts.builtinGroupName;\n    allowedPrefixes = extensionsDirOrOpts.allowedPrefixes;\n  } else {\n    extensionsDir = extensionsDirOrOpts;\n  }\n\n  verboseHelp = verbose;\n  // Register Config Bus namespace (apcore >= 0.15.0)\n  registerConfigNamespace();\n\n  // Initialize audit logger (parity with apcore-cli-python __main__.py).\n  // Silently disabled if initialization fails (e.g., unwritable audit path).\n  try {\n    const auditLogger = new AuditLogger();\n    setAuditLogger(auditLogger);\n  } catch {\n    // audit logging unavailable — non-fatal\n  }\n\n  // Resolve program name\n  const resolvedProgName = progName ?? path.basename(process.argv[1] ?? \"apcore-cli\") ?? \"apcore-cli\";\n\n  // Resolve log level\n  const cliLogLevel = process.env.APCORE_CLI_LOGGING_LEVEL ?? process.env.APCORE_LOGGING_LEVEL ?? \"WARNING\";\n  setLogLevel(cliLogLevel);\n\n  // Validate parameter combination: app is mutually exclusive with registry/executor.\n  if (app && (registry || executor)) {\n    process.stderr.write(\"Error: app is mutually exclusive with registry/executor\\n\");\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n\n  // Extract registry/executor from APCore unified client when provided.\n  if (app) {\n    registry = app.registry;\n    executor = app.executor;\n  }\n\n  // Validate parameter combination: executor without registry is invalid.\n  if (executor && !registry) {\n    process.stderr.write(\"Error: executor requires registry — pass both or neither\\n\");\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n\n  // Wire CliApprovalHandler to the executor (FE-11 §3.5) so module calls that\n  // set `requires_approval: true` route through the interactive CLI prompt\n  // (or auto-approve when APCORE_CLI_AUTO_APPROVE=1). Parity with\n  // ../apcore-cli-python/src/apcore_cli/factory.py:315-327 — previously the\n  // TypeScript CliApprovalHandler class was exported but never plugged in,\n  // so requires_approval modules were rejected by the built-in gate even\n  // though the CLI had its own interactive handler ready to use.\n  if (executor && typeof (executor as unknown as Record<string, unknown>).setApprovalHandler === \"function\") {\n    try {\n      const handler = new CliApprovalHandler(/*autoApprove*/ false);\n      (executor as unknown as { setApprovalHandler: (h: unknown) => void }).setApprovalHandler(handler);\n    } catch {\n      // Non-fatal: handler wiring failed; built-in gate still applies.\n    }\n  }\n\n  const registryInjected = registry !== undefined;\n\n  const program = new Command(resolvedProgName)\n    .exitOverride()\n    .helpOption(\"-h, --help\", \"Print help\")\n    .addHelpCommand(\"help [command]\", \"Print this message or the help of the given subcommand(s)\")\n    .description(appDescription ?? `${resolvedProgName} CLI`)\n    .option(\"--log-level <level>\", \"Logging level (DEBUG|INFO|WARNING|ERROR)\", \"WARNING\")\n    .option(\"--verbose\", \"Show all options in help output (including built-in options)\");\n  if (appVersion) {\n    program.version(appVersion, \"-V, --version\", \"Print version\");\n  }\n  program.configureHelp({ formatHelp: canonicalFormatHelp });\n\n  // Discovery flags are standalone-only (FE-13 T-APCLI-27/28).\n  if (!registryInjected) {\n    program.option(\"--extensions-dir <path>\", \"Path to extensions directory\");\n    program.option(\"--commands-dir <path>\", \"Path to convention-based commands directory\");\n    program.option(\"--binding <path>\", \"Path to binding.yaml for display overlay\");\n  }\n\n  // Build ApcliGroup via 3-source dispatch (FE-13 §4.8):\n  //   1) Pre-built ApcliGroup instance (pass-through)\n  //   2) CliConfig boolean/object (Tier 1, fromCliConfig)\n  //   3) Tier 3 yaml via ConfigResolver.resolveObject (fromYaml)\n  let apcliCfg: ApcliGroup;\n  try {\n    if (apcliOption instanceof ApcliGroup) {\n      // Pre-built ApcliGroup wins; surface a conflict if the caller also\n      // passed builtinGroupName with a different value.\n      if (\n        builtinGroupName !== undefined\n        && builtinGroupName !== \"apcli\"\n        && apcliOption.name !== builtinGroupName\n      ) {\n        throw new Error(\n          `builtinGroupName=${JSON.stringify(builtinGroupName)} conflicts with `\n            + `the name on the supplied ApcliGroup (${JSON.stringify(apcliOption.name)}). Pass only one.`,\n        );\n      }\n      apcliCfg = apcliOption;\n    } else if (apcliOption !== undefined) {\n      apcliCfg = ApcliGroup.fromCliConfig(apcliOption, {\n        registryInjected,\n        name: builtinGroupName,\n      });\n    } else {\n      let yamlVal: unknown = null;\n      try {\n        const resolver = new ConfigResolver();\n        yamlVal = resolver.resolveObject(\"apcli\");\n      } catch {\n        yamlVal = null;\n      }\n      apcliCfg = ApcliGroup.fromYaml(yamlVal, {\n        registryInjected,\n        name: builtinGroupName,\n      });\n    }\n  } catch (e) {\n    // ApcliGroup name validation failure or conflict — exit 2.\n    process.stderr.write(`Error: ${e instanceof Error ? e.message : String(e)}\\n`);\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n\n  // Sync the module-level reserved-group cache so cli.ts's `assertNotReserved`\n  // and `listCommands` filter against the live (possibly renamed) name. Reset\n  // to the default afterwards is the createCli caller's responsibility — in\n  // practice processes invoke createCli once at startup, so this is fine.\n  setReservedGroupNames(new Set([apcliCfg.name]));\n\n  // Construct the apcli sub-group. Hidden when visibility resolves to \"none\".\n  // Group name resolves from `apcliCfg.name` so downstream branded CLIs\n  // that overrode `builtinGroupName` see their custom namespace.\n  const apcliGroup = program\n    .command(apcliCfg.name, { hidden: !apcliCfg.isGroupVisible() })\n    .description(\"Built-in commands\");\n\n  // Dispatch the 13-entry subcommand registrar table (FE-13 §4.9).\n  if (registry) {\n    (program as unknown as Record<string, unknown>)._registry = registry;\n    if (executor) {\n      (program as unknown as Record<string, unknown>)._executor = executor;\n    }\n  } else {\n    const resolvedExtDir = extensionsDir\n      ?? process.env.APCORE_EXTENSIONS_ROOT\n      ?? \"./extensions\";\n    void resolvedExtDir; // Will be used when apcore-js registry is wired\n  }\n\n  // Build exposure filter (FE-12) BEFORE the apcli dispatcher table so\n  // registerListCommand can consult the filter for --exposure. fromConfig\n  // throws on malformed shape (e.g. { mode: \"bogus\" }) — catch and exit with\n  // INVALID_CLI_INPUT so the caller sees a friendly message and the documented\n  // exit code, matching ApcliGroup._build's contract (review fix #1).\n  let exposureFilter: ExposureFilter;\n  try {\n    if (expose instanceof ExposureFilter) {\n      exposureFilter = expose;\n    } else if (typeof expose === \"object\" && expose !== null) {\n      exposureFilter = ExposureFilter.fromConfig({ expose });\n    } else {\n      exposureFilter = new ExposureFilter();\n    }\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    process.stderr.write(`Error: invalid 'expose' option — ${msg}\\n`);\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n\n  _registerApcliSubcommands(apcliGroup, apcliCfg, registry, executor, exposureFilter);\n\n  // Footer hints for discoverability\n  program.addHelpText(\"after\", [\n    \"\",\n    \"Use --help --verbose to show all options (including built-in options).\",\n    \"Use --help --man to display a formatted man page.\",\n  ].join(\"\\n\"));\n\n  // Register --help --man support (stays at root — spec §4.1).\n  // The man page reflects the host app's version when supplied; otherwise\n  // falls back to the SDK version so the manpage still has a stamp.\n  configureManHelp(program, resolvedProgName, appVersion ?? VERSION);\n\n  // Register extra commands (F11) — validate no name collisions with live\n  // Commander tree (root + apcli group subcommands). FE-13 moved the old\n  // per-command constant into a live-tree walk; collision detection now\n  // reads the actual program shape. Reserved-name (`apcli`) and\n  // live-collision cases are hard exit 2 (FE-13 §4.10 / §7 FR-13-09).\n  if (extraCommands && extraCommands.length > 0) {\n    // Reserved-name set follows the resolved built-in-group name, not the\n    // static default. When a downstream branded CLI renames the group via\n    // `builtinGroupName`, an extraCommands entry that shadows the renamed\n    // group is the same kind of collision and is rejected here.\n    const _reservedForExtra: ReadonlySet<string> = new Set([apcliCfg.name]);\n    for (const cmd of extraCommands) {\n      const cmdName = cmd.name();\n      if (_reservedForExtra.has(cmdName)) {\n        process.stderr.write(\n          `Error: extraCommands name '${cmdName}' is reserved\\n`,\n        );\n        process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n      }\n      const existing = program.commands.find((c) => c.name() === cmdName);\n      if (existing) {\n        process.stderr.write(\n          `Error: extraCommands name '${cmdName}' collides with an existing command\\n`,\n        );\n        process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n      }\n      program.addCommand(cmd);\n    }\n  }\n\n  // Hook to apply optional toolkit integration before command execution.\n  // Commander actions are async, so we can set up toolkit state lazily.\n  program.hook(\"preAction\", async (thisCommand) => {\n    const opts = thisCommand.opts();\n    const commandsDir = opts.commandsDir as string | undefined;\n    const bindingPath = opts.binding as string | undefined;\n    await applyToolkitIntegration(commandsDir, bindingPath, { allowedPrefixes });\n  });\n\n  return program;\n}\n\n// ---------------------------------------------------------------------------\n// FE-13 apcli subcommand dispatcher (§4.9)\n// ---------------------------------------------------------------------------\n\n/**\n * Subcommand names that are registered regardless of the resolved visibility\n * mode's include/exclude filter. `exec` is the documented always-registered\n * escape hatch (spec §4.9) so that downstream callers can always invoke modules\n * by ID even when the apcli group is configured with a minimal surface.\n */\nconst _ALWAYS_REGISTERED: ReadonlySet<string> = new Set<string>([\"exec\"]);\n\ninterface _RegistrarEntry {\n  name: string;\n  requiresExecutor: boolean;\n  register: (\n    apcliGroup: Command,\n    registry: Registry | undefined,\n    executor: Executor | undefined,\n  ) => void;\n}\n\n/**\n * Central dispatcher for the 13 canonical apcli subcommands. Called once per\n * createCli invocation after the apcli Commander group is built. Honors\n * {@link ApcliGroup.resolveVisibility} for include/exclude modes, and skips\n * entries whose `requiresExecutor: true` flag is not satisfied.\n */\nfunction _registerApcliSubcommands(\n  apcliGroup: Command,\n  apcliCfg: ApcliGroup,\n  registry: Registry | undefined,\n  executor: Executor | undefined,\n  exposureFilter: ExposureFilter,\n): void {\n  // Standalone-mode fallback registry. Previously returned an empty list +\n  // null; that silently masked the \"no registry wired\" contract gap — users\n  // saw empty `apcli list` output with no clue the CLI was unwired. The\n  // erroring fallback below surfaces the gap with a clear message + exit code\n  // whenever list/describe actions actually reach into registry methods.\n  const emitUnwiredError = (): never => {\n    process.stderr.write(\n      \"Error: no apcore-js registry wired. In standalone mode, pass \" +\n        \"--extensions-dir <path> to enable module discovery.\\n\",\n    );\n    process.exit(EXIT_CODES.CONFIG_INVALID);\n  };\n  const effectiveRegistry: Registry = registry ?? {\n    listModules: () => emitUnwiredError(),\n    getModule: () => emitUnwiredError(),\n  };\n\n  const TABLE: _RegistrarEntry[] = [\n    { name: \"list\",              requiresExecutor: false, register: (g) => registerListCommand(g, effectiveRegistry, exposureFilter) },\n    { name: \"describe\",          requiresExecutor: false, register: (g) => registerDescribeCommand(g, effectiveRegistry) },\n    { name: \"exec\",              requiresExecutor: true,  register: (g, _r, ex) => registerExecCommand(g, effectiveRegistry, ex!) },\n    { name: \"validate\",          requiresExecutor: true,  register: (g, _r, ex) => registerValidateCommand(g, effectiveRegistry, ex!) },\n    { name: \"init\",              requiresExecutor: false, register: (g) => registerInitCommand(g) },\n    { name: \"health\",            requiresExecutor: true,  register: (g, _r, ex) => registerHealthCommand(g, ex!) },\n    { name: \"usage\",             requiresExecutor: true,  register: (g, _r, ex) => registerUsageCommand(g, ex!) },\n    { name: \"enable\",            requiresExecutor: true,  register: (g, _r, ex) => registerEnableCommand(g, ex!) },\n    { name: \"disable\",           requiresExecutor: true,  register: (g, _r, ex) => registerDisableCommand(g, ex!) },\n    { name: \"reload\",            requiresExecutor: true,  register: (g, _r, ex) => registerReloadCommand(g, ex!) },\n    { name: \"config\",            requiresExecutor: true,  register: (g, _r, ex) => registerConfigCommand(g, ex!) },\n    { name: \"completion\",        requiresExecutor: false, register: (g) => registerCompletionCommand(g) },\n    { name: \"describe-pipeline\", requiresExecutor: true,  register: (g, _r, ex) => registerPipelineCommand(g, ex!) },\n  ];\n\n  const mode = apcliCfg.resolveVisibility();\n  for (const entry of TABLE) {\n    // Determine whether this entry would be registered BEFORE short-circuiting\n    // on missing executor — otherwise _ALWAYS_REGISTERED never gets consulted\n    // for executor-required entries (e.g. \"exec\"), which violates spec §4.9.\n    let shouldRegister: boolean;\n    if (mode === \"all\" || mode === \"none\") {\n      // mode:\"none\" still registers all subcommands — the group itself is\n      // hidden, but subcommands remain individually reachable (spec §4.6).\n      shouldRegister = true;\n    } else {\n      shouldRegister =\n        _ALWAYS_REGISTERED.has(entry.name) || apcliCfg.isSubcommandIncluded(entry.name);\n    }\n    if (!shouldRegister) continue;\n\n    // Executor-required entry but no executor wired. Silent skip for ordinary\n    // entries — loud WARN for _ALWAYS_REGISTERED entries since the spec §4.9\n    // contract says they are always registered, and silently dropping them\n    // would mask a legitimate wiring gap for the caller.\n    if (entry.requiresExecutor && !executor) {\n      if (_ALWAYS_REGISTERED.has(entry.name)) {\n        logWarn(\n          `apcli.${entry.name} is in _ALWAYS_REGISTERED but no executor is wired — ` +\n            `subcommand unavailable. Pass executor to createCli() or avoid ${entry.name} invocations.`,\n        );\n      }\n      continue;\n    }\n\n    entry.register(apcliGroup, registry, executor);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// applyToolkitIntegration\n// ---------------------------------------------------------------------------\n\n/**\n * Optionally apply apcore-toolkit features (DisplayResolver, RegistryWriter).\n *\n * Uses dynamic import so the dependency remains optional — if apcore-toolkit\n * is not installed, a warning is printed and the CLI continues without it.\n */\n/**\n * Module-level binding display overlay map: moduleId → resolved `display`\n * metadata (as produced by `DisplayResolver.resolve()`). Consulted by\n * `getDisplay()` when a `ModuleDescriptor`'s own `metadata.display` is absent.\n */\nconst bindingDisplayMap = new Map<string, Record<string, unknown>>();\n\n/**\n * Internal accessor for the binding display overlay map — used by\n * `display-helpers.ts#getDisplay` as a fallback when the descriptor itself\n * carries no resolved display metadata.\n */\nexport function lookupBindingDisplay(moduleId: string): Record<string, unknown> | undefined {\n  return bindingDisplayMap.get(moduleId);\n}\n\n/**\n * Clear the binding display overlay map. Primarily for tests.\n */\nexport function clearBindingDisplayMap(): void {\n  bindingDisplayMap.clear();\n}\n\n/** Options bag for {@link applyToolkitIntegration}. */\nexport interface ApplyToolkitIntegrationOptions {\n  /**\n   * Allowlist of module-path prefixes forwarded to apcore-toolkit's\n   * `RegistryWriter.write` when registering scanned/loaded modules. Mirrors\n   * the Python factory's `allowed_prefixes` kwarg.\n   */\n  allowedPrefixes?: string[];\n}\n\nexport async function applyToolkitIntegration(\n  commandsDir?: string,\n  bindingPath?: string,\n  options: ApplyToolkitIntegrationOptions = {},\n): Promise<void> {\n  if (!commandsDir && !bindingPath) {\n    return;\n  }\n\n  let toolkit: Record<string, unknown>;\n  try {\n    // String indirection prevents bundlers from statically resolving the\n    // optional peer dependency at build time.\n    const toolkitModule = \"apcore-toolkit\";\n    toolkit = await import(/* @vite-ignore */ toolkitModule) as Record<string, unknown>;\n  } catch {\n    logWarn(\"apcore-toolkit not installed — toolkit features unavailable\");\n    return;\n  }\n\n  // ConventionScanner has no TypeScript equivalent (the Python adapter is\n  // pydantic-specific and does not port cleanly). See the upstream\n  // apcore-toolkit README for the tri-language parity note.\n  if (commandsDir) {\n    logWarn(\"Convention scanning not available in the TypeScript toolkit\");\n  }\n\n  if (bindingPath) {\n    try {\n      await loadBindingDisplayOverlay(toolkit, bindingPath, options.allowedPrefixes);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      logWarn(`apcore-toolkit: failed to load binding '${bindingPath}': ${msg}`);\n    }\n  }\n}\n\n/**\n * Parse a `.binding.yaml` (or directory thereof) and populate the module-level\n * `bindingDisplayMap` with resolved display overlay entries. Uses the\n * apcore-toolkit `BindingLoader` + `DisplayResolver` pipeline so the overlay\n * produced here is identical to what apcore-toolkit's registry-writer would\n * emit at scan time.\n */\nasync function loadBindingDisplayOverlay(\n  toolkit: Record<string, unknown>,\n  bindingPath: string,\n  allowedPrefixes?: string[],\n): Promise<void> {\n  const BindingLoaderCtor = toolkit.BindingLoader as\n    | (new () => { load(path: string): unknown[] })\n    | undefined;\n  const DisplayResolverCtor = toolkit.DisplayResolver as\n    | (new () => { resolve(mods: unknown[], opts?: { bindingPath?: string }): unknown[] })\n    | undefined;\n\n  if (!BindingLoaderCtor || !DisplayResolverCtor) {\n    // apcore-toolkit < 0.5.0 (no BindingLoader) — silently skip the overlay.\n    return;\n  }\n\n  const loader = new BindingLoaderCtor();\n  const scanned = loader.load(bindingPath);\n  const resolver = new DisplayResolverCtor();\n  const resolved = resolver.resolve(scanned, { bindingPath });\n\n  // Mirrors Python's RegistryWriter `allowed_prefixes` gate: any entry whose\n  // `target:` path is outside the allowlist is dropped before its display\n  // overlay reaches the runtime — the TS overlay path doesn't go through\n  // RegistryWriter, so we apply the same check inline.\n  const prefixes = allowedPrefixes && allowedPrefixes.length > 0 ? allowedPrefixes : null;\n  const isTargetAllowed = (target: unknown): boolean => {\n    if (!prefixes) return true;\n    if (typeof target !== \"string\" || target.length === 0) return true;\n    return prefixes.some((p) => target.startsWith(p));\n  };\n\n  for (const mod of resolved) {\n    if (!mod || typeof mod !== \"object\") continue;\n    const entry = mod as { moduleId?: unknown; metadata?: unknown; target?: unknown };\n    const id = typeof entry.moduleId === \"string\" ? entry.moduleId : null;\n    if (!id) continue;\n    if (!isTargetAllowed(entry.target)) {\n      logWarn(\n        `apcore-toolkit: dropped binding entry '${id}' — target '${String(entry.target)}' ` +\n          `is outside allowedPrefixes`,\n      );\n      continue;\n    }\n    const meta = (entry.metadata as Record<string, unknown> | undefined) ?? {};\n    const display = meta.display;\n    if (display && typeof display === \"object\" && !Array.isArray(display)) {\n      bindingDisplayMap.set(id, display as Record<string, unknown>);\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// main\n// ---------------------------------------------------------------------------\n\n/**\n * Parse argv and run the CLI. Handles top-level error catching and exit codes.\n */\nexport function main(progName?: string): void {\n  verboseHelp = hasVerboseFlag();\n  // Standalone bin entry: SDK version IS the app version. Pass it through\n  // explicitly so createCli registers --version (which is intentionally\n  // gated on opts.version for embedded callers — see issue #18).\n  const program = createCli({\n    progName,\n    verbose: verboseHelp,\n    version: VERSION,\n    description: `${progName ?? \"apcore-cli\"} — execute apcore modules from the command line`,\n  });\n\n  try {\n    program.parse(process.argv);\n  } catch (error: unknown) {\n    if (error instanceof CommanderError) {\n      // Commander already printed the error message\n      process.exit(error.exitCode);\n    }\n    const code = exitCodeForError(error);\n    if (error instanceof Error) {\n      process.stderr.write(`Error: ${error.message}\\n`);\n    }\n    process.exit(code);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// buildModuleCommand\n// ---------------------------------------------------------------------------\n\n/**\n * Build a Commander Command for a single apcore module.\n *\n * Includes all 11 FE-11 options: --dry-run, --trace, --stream, --strategy,\n * --approval-timeout, --approval-token, --fields, and enhanced --format choices.\n */\nexport function buildModuleCommand(\n  moduleDef: ModuleDescriptor,\n  executor: Executor,\n  helpTextMaxLength = 1000,\n  cmdName?: string,\n  verbose = verboseHelp,\n): Command {\n  const moduleId = moduleDef.id;\n  let resolvedSchema: Record<string, unknown> = {};\n  let schemaOptions: OptionConfig[] = [];\n\n  // Resolve display overlay fields\n  const display = getDisplay(moduleDef);\n  const cliDisplay = (display.cli && typeof display.cli === \"object\" && !Array.isArray(display.cli))\n    ? (display.cli as Record<string, unknown>)\n    : {};\n  const effectiveCmdName: string = cmdName ?? (cliDisplay.alias as string | undefined) ?? moduleId;\n  const cmdHelp: string = (cliDisplay.description as string | undefined) ?? moduleDef.description;\n\n  // Resolve schema\n  const inputSchema = moduleDef.inputSchema;\n  if (inputSchema && typeof inputSchema === \"object\" && inputSchema.properties) {\n    try {\n      resolvedSchema = resolveRefs(inputSchema, 32, moduleId);\n    } catch {\n      resolvedSchema = inputSchema;\n    }\n    schemaOptions = schemaToCliOptions(resolvedSchema, helpTextMaxLength);\n  }\n\n  const cmd = new Command(effectiveCmdName).description(cmdHelp);\n\n  // Built-in options (hidden unless --verbose)\n  const inputOpt = new Option(\"--input <source>\", \"Read JSON input from a file path, or use '-' to read from stdin pipe\");\n  const yesOpt = new Option(\"-y, --yes\", \"Skip interactive approval prompts (for scripts and CI)\").default(false);\n  const largeInputOpt = new Option(\"--large-input\", \"Allow stdin input larger than 10MB (default limit protects against accidental pipes)\").default(false);\n  const formatOpt = new Option(\"--format <format>\", \"Output format: json, table, csv, yaml, jsonl.\")\n    .choices([\"json\", \"table\", \"csv\", \"yaml\", \"jsonl\"]);\n  const fieldsOpt = new Option(\"--fields <fields>\", \"Comma-separated dot-paths to select from the result (e.g., 'status,data.count').\");\n  // --sandbox is always hidden (not yet implemented)\n  const sandboxOpt = new Option(\"--sandbox\", \"Run module in an isolated subprocess with restricted filesystem and env access\").default(false).hideHelp();\n  // F1: --dry-run\n  const dryRunOpt = new Option(\"--dry-run\", \"Run preflight checks without executing the module. Shows validation results.\").default(false);\n  // F4: --trace\n  const traceOpt = new Option(\"--trace\", \"Show execution pipeline trace with per-step timing after the result.\").default(false);\n  // F6: --stream\n  const streamOpt = new Option(\"--stream\", \"Stream module output as JSONL (one JSON object per line, flushed immediately).\").default(false);\n  // F8: --strategy\n  const strategyOpt = new Option(\"--strategy <name>\", \"Execution pipeline strategy: standard (default), internal, testing, performance.\")\n    .choices([\"standard\", \"internal\", \"testing\", \"performance\", \"minimal\"]);\n  // F5: --approval-timeout, --approval-token\n  const approvalTimeoutOpt = new Option(\"--approval-timeout <seconds>\", \"Override approval prompt timeout in seconds (default: 60).\").argParser(parseInt);\n  const approvalTokenOpt = new Option(\"--approval-token <token>\", \"Resume a pending approval with the given token (for async approval flows).\");\n\n  if (!verbose) {\n    inputOpt.hideHelp();\n    yesOpt.hideHelp();\n    largeInputOpt.hideHelp();\n    formatOpt.hideHelp();\n    fieldsOpt.hideHelp();\n    dryRunOpt.hideHelp();\n    traceOpt.hideHelp();\n    streamOpt.hideHelp();\n    strategyOpt.hideHelp();\n    approvalTimeoutOpt.hideHelp();\n    approvalTokenOpt.hideHelp();\n  }\n\n  cmd.addOption(inputOpt);\n  cmd.addOption(yesOpt);\n  cmd.addOption(largeInputOpt);\n  cmd.addOption(formatOpt);\n  cmd.addOption(fieldsOpt);\n  cmd.addOption(sandboxOpt);\n  cmd.addOption(dryRunOpt);\n  cmd.addOption(traceOpt);\n  cmd.addOption(streamOpt);\n  cmd.addOption(strategyOpt);\n  cmd.addOption(approvalTimeoutOpt);\n  cmd.addOption(approvalTokenOpt);\n\n  // Help footer: verbose hint + optional docs link\n  const footerParts: string[] = [];\n  if (!verbose) {\n    footerParts.push(\"Use --verbose to show all options (including built-in apcore options).\");\n  }\n  if (docsUrl) {\n    footerParts.push(`Docs: ${docsUrl}/commands/${effectiveCmdName}`);\n  }\n  if (footerParts.length > 0) {\n    cmd.addHelpText(\"after\", \"\\n\" + footerParts.join(\"\\n\") + \"\\n\");\n  }\n\n  // Schema-generated options\n  for (const opt of schemaOptions) {\n    if (opt.parseArg) {\n      cmd.option(opt.flags, opt.description, opt.parseArg, opt.defaultValue);\n    } else {\n      cmd.option(opt.flags, opt.description, opt.defaultValue as string | boolean | undefined);\n    }\n  }\n\n  // Action callback\n  cmd.action(async (options: Record<string, unknown>) => {\n    // Pop built-in options\n    const stdinFlag = options.input as string | undefined;\n    const autoApprove = options.yes as boolean;\n    const largeInput = options.largeInput as boolean;\n    const outputFormat = options.format as string | undefined;\n    const outputFields = options.fields as string | undefined;\n    const sandboxEnabled = options.sandbox as boolean;\n    const dryRun = options.dryRun as boolean;\n    const traceFlag = options.trace as boolean;\n    const streamFlag = options.stream as boolean;\n    const strategyName = resolveStringOption(options.strategy, process.env.APCORE_CLI_STRATEGY);\n    const approvalTimeout = resolveIntOption(\n      options.approvalTimeout as number | undefined,\n      process.env.APCORE_CLI_APPROVAL_TIMEOUT,\n      60,\n    );\n    const approvalToken = options.approvalToken as string | undefined;\n\n    // Remove built-in keys from options to get schema kwargs\n    const schemaKwargs: Record<string, unknown> = {};\n    const builtinKeys = new Set([\n      \"input\", \"yes\", \"largeInput\", \"format\", \"fields\", \"sandbox\", \"verbose\",\n      \"dryRun\", \"trace\", \"stream\", \"strategy\", \"approvalTimeout\", \"approvalToken\",\n    ]);\n    for (const [k, v] of Object.entries(options)) {\n      if (!builtinKeys.has(k)) {\n        schemaKwargs[k] = v;\n      }\n    }\n\n    let merged: Record<string, unknown> = {};\n    const startTime = performance.now();\n\n    try {\n      // 1. Collect and merge input\n      merged = await collectInput(stdinFlag, schemaKwargs, largeInput);\n\n      // 2. Reconvert enum values\n      const reconverted = reconvertEnumValues(merged, schemaOptions);\n      merged = reconverted;\n\n      // -- Dry-run: preflight validation only, no execution (F1) --\n      if (dryRun) {\n        if (!executor.validate) {\n          process.stderr.write(\"Error: Executor does not support validate.\\n\");\n          process.exit(EXIT_CODES.MODULE_EXECUTE_ERROR);\n        }\n        const preflight = await executor.validate(moduleId, merged);\n        formatPreflightResult(preflight, outputFormat);\n        // --trace --dry-run: show pipeline preview\n        if (traceFlag) {\n          const pureSteps = new Set([\n            \"context_creation\", \"call_chain_guard\", \"module_lookup\", \"acl_check\", \"input_validation\",\n          ]);\n          const allSteps = [\n            \"context_creation\", \"call_chain_guard\", \"module_lookup\", \"acl_check\",\n            \"approval_gate\", \"middleware_before\", \"input_validation\", \"execute\",\n            \"output_validation\", \"middleware_after\", \"return_result\",\n          ];\n          process.stderr.write(\"\\nPipeline preview (dry-run):\\n\");\n          for (const s of allSteps) {\n            if (pureSteps.has(s)) {\n              process.stderr.write(`  \\u2713 ${s.padEnd(24)} (pure \\u2014 would execute)\\n`);\n            } else {\n              process.stderr.write(`  \\u25cb ${s.padEnd(24)} (impure \\u2014 skipped in dry-run)\\n`);\n            }\n          }\n        }\n        process.exit(preflight.valid ? 0 : firstFailedExitCode(preflight));\n      }\n\n      // -- Inject approval token if provided (F5) --\n      if (approvalToken) {\n        merged._approval_token = approvalToken;\n      }\n\n      // 3. Check approval\n      await checkApproval(moduleDef, autoApprove, approvalTimeout);\n\n      // 4. Execute with timing\n\n      // -- Streaming execution (F6) --\n      if (streamFlag) {\n        // Streaming always outputs JSONL; --format table is ignored (spec §3.6.2)\n        if (resolveFormat(outputFormat) === \"table\") {\n          process.stderr.write(\"Warning: Streaming mode always outputs JSONL; --format table is ignored.\\n\");\n        }\n        const annotations = moduleDef.annotations as Record<string, unknown> | undefined;\n        const isStreaming = annotations?.streaming === true;\n        if (!isStreaming) {\n          process.stderr.write(\n            `Warning: Module '${moduleId}' does not declare streaming support. Falling back to standard execution.\\n`,\n          );\n        }\n\n        if (isStreaming && executor.stream) {\n          let chunks = 0;\n          for await (const chunk of executor.stream(moduleId, merged)) {\n            chunks++;\n            process.stdout.write(JSON.stringify(chunk) + \"\\n\");\n            if (process.stderr.isTTY) {\n              process.stderr.write(`\\rStreaming ${moduleId}... (${chunks} chunks)`);\n            }\n          }\n          if (process.stderr.isTTY) {\n            process.stderr.write(\"\\n\");\n          }\n          const durationMs = Math.round(performance.now() - startTime);\n\n          // Audit log (success)\n          const { getAuditLogger } = await import(\"./security/audit.js\");\n          const auditLogger = getAuditLogger();\n          if (auditLogger) {\n            auditLogger.logExecution(moduleId, merged, \"success\", 0, durationMs);\n          }\n          return;\n        }\n        // else: fall through to normal execution\n      }\n\n      // -- Traced execution (F4) --\n      if (traceFlag && executor.callWithTrace) {\n        const [result, trace] = await executor.callWithTrace(\n          moduleId,\n          merged,\n          strategyName ? { strategy: strategyName } : undefined,\n        );\n        const durationMs = Math.round(performance.now() - startTime);\n\n        // Print result\n        const resolved = resolveFormat(outputFormat);\n        if (resolved === \"json\" || !process.stdout.isTTY) {\n          // Merge _trace into JSON output. JSON keys remain snake_case to\n          // match the cross-language CLI output contract; runtime reads use\n          // the camelCase shape returned by apcore-js PipelineTrace.\n          const traceData = {\n            strategy: trace.strategyName,\n            total_duration_ms: trace.totalDurationMs,\n            success: trace.success,\n            steps: trace.steps.map((s) => ({\n              name: s.name,\n              duration_ms: s.durationMs,\n              skipped: s.skipped,\n              ...(s.skipped ? { skip_reason: s.skipReason ?? null } : {}),\n            })),\n          };\n          let output: Record<string, unknown>;\n          if (typeof result === \"object\" && result !== null && !Array.isArray(result)) {\n            output = { ...(result as Record<string, unknown>), _trace: traceData };\n          } else {\n            output = { result, _trace: traceData };\n          }\n          process.stdout.write(JSON.stringify(output, null, 2) + \"\\n\");\n        } else {\n          formatExecResult(result, outputFormat, outputFields);\n          // Print trace to stderr\n          const stepCount = trace.steps.length;\n          process.stderr.write(\n            `\\nPipeline Trace (strategy: ${trace.strategyName}, ` +\n            `${stepCount} steps, ${trace.totalDurationMs.toFixed(1)}ms)\\n`,\n          );\n          for (const s of trace.steps) {\n            if (s.skipped) {\n              const reason = s.skipReason ?? \"n/a\";\n              process.stderr.write(`  \\u25cb ${s.name.padEnd(24)} ${\"\\u2014\".padStart(8)}  skipped (${reason})\\n`);\n            } else {\n              process.stderr.write(`  \\u2713 ${s.name.padEnd(24)} ${(s.durationMs.toFixed(1) + \"ms\").padStart(8)}\\n`);\n            }\n          }\n        }\n        // Audit log AFTER format (canonical ordering: format \\u2192 audit on success)\n        const { getAuditLogger: getAL2 } = await import(\"./security/audit.js\");\n        const al2 = getAL2();\n        if (al2) {\n          al2.logExecution(moduleId, merged, \"success\", 0, durationMs);\n        }\n        return;\n      }\n\n      // -- Standard execution (with optional strategy F8) --\n      let result: unknown;\n      if (strategyName && executor.callWithTrace) {\n        // Strategy requires callWithTrace to pass strategy param\n        const [res] = await executor.callWithTrace(\n          moduleId,\n          merged,\n          { strategy: strategyName },\n        );\n        result = res;\n        if (strategyName !== \"standard\" && process.stderr.isTTY) {\n          process.stderr.write(`Warning: Using '${strategyName}' strategy.\\n`);\n        }\n      } else {\n        const { Sandbox } = await import(\"./security/index.js\");\n        const sandbox = new Sandbox(sandboxEnabled);\n        result = await sandbox.execute(moduleId, merged, executor);\n      }\n      const durationMs = Math.round(performance.now() - startTime);\n\n      // 5. Format and print result first (canonical order: format → audit)\n      formatExecResult(result, outputFormat, outputFields);\n\n      // 6. Audit log (success) — called AFTER format so formatter exceptions\n      //    suppress the success entry (matches Python canonical ordering).\n      const { getAuditLogger } = await import(\"./security/audit.js\");\n      const auditLogger = getAuditLogger();\n      if (auditLogger) {\n        auditLogger.logExecution(moduleId, merged, \"success\", 0, durationMs);\n      }\n    } catch (err: unknown) {\n      // Enhanced error output (F3)\n      const exitCode = exitCodeForError(err);\n      const durationMs = Math.round(performance.now() - startTime);\n\n      // Audit log (error) with real elapsed duration_ms\n      try {\n        const { getAuditLogger } = await import(\"./security/audit.js\");\n        const auditLogger = getAuditLogger();\n        if (auditLogger) {\n          auditLogger.logExecution(moduleId, merged, \"error\", exitCode, durationMs);\n        }\n      } catch {\n        // Ignore audit failures during error handling\n      }\n\n      if (outputFormat === \"json\" || !process.stderr.isTTY) {\n        emitErrorJson(err, exitCode);\n      } else {\n        emitErrorTty(err, exitCode);\n      }\n      process.exit(exitCode);\n    }\n  });\n\n  return cmd;\n}\n\n// ---------------------------------------------------------------------------\n// validateModuleId — see src/validate.ts (extracted to mirror Python/Rust layout, audit D8-W2)\n// ---------------------------------------------------------------------------\n\nexport { validateModuleId } from \"./validate.js\";\n\n// ---------------------------------------------------------------------------\n// collectInput\n// ---------------------------------------------------------------------------\n\n/**\n * Collect module input from stdin and/or CLI keyword arguments.\n */\nexport async function collectInput(\n  stdinFlag?: string,\n  cliKwargs: Record<string, unknown> = {},\n  largeInput?: boolean,\n): Promise<Record<string, unknown>> {\n  // Remove null/undefined values from CLI kwargs\n  const cliKwargsNonNull: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(cliKwargs)) {\n    if (v !== null && v !== undefined) {\n      cliKwargsNonNull[k] = v;\n    }\n  }\n\n  if (!stdinFlag) {\n    return cliKwargsNonNull;\n  }\n\n  let raw: string;\n  let source: string;\n  if (stdinFlag === \"-\") {\n    raw = await readStdin();\n    source = \"STDIN\";\n  } else {\n    // File-path source (help text: \"JSON input file or '-' for stdin\")\n    source = `file '${stdinFlag}'`;\n    try {\n      raw = readFileSync(stdinFlag, \"utf-8\");\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      process.stderr.write(`Error: Could not read input ${source}: ${msg}\\n`);\n      process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n    }\n  }\n\n  const rawSize = Buffer.byteLength(raw, \"utf-8\");\n  if (rawSize > 10_485_760 && !largeInput) {\n    process.stderr.write(\n      `Error: ${source} input exceeds 10MB limit. Use --large-input to override.\\n`,\n    );\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n\n  if (!raw) {\n    return cliKwargsNonNull;\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    process.stderr.write(`Error: ${source} does not contain valid JSON.\\n`);\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n    process.stderr.write(\n      `Error: ${source} JSON must be an object, got ${Array.isArray(parsed) ? \"array\" : typeof parsed}.\\n`,\n    );\n    process.exit(EXIT_CODES.INVALID_CLI_INPUT);\n  }\n\n  // CLI flags override stdin/file for duplicate keys\n  return { ...(parsed as Record<string, unknown>), ...cliKwargsNonNull };\n}\n\n/**\n * Read all data from stdin with proper cleanup.\n */\nfunction readStdin(): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    const onData = (chunk: Buffer) => chunks.push(chunk);\n    const onEnd = () => {\n      cleanup();\n      resolve(Buffer.concat(chunks).toString(\"utf-8\"));\n    };\n    const onError = (err: Error) => {\n      cleanup();\n      reject(err);\n    };\n    const cleanup = () => {\n      process.stdin.removeListener(\"data\", onData);\n      process.stdin.removeListener(\"end\", onEnd);\n      process.stdin.removeListener(\"error\", onError);\n    };\n    process.stdin.on(\"data\", onData);\n    process.stdin.on(\"end\", onEnd);\n    process.stdin.on(\"error\", onError);\n    process.stdin.resume();\n  });\n}\n\n// ---------------------------------------------------------------------------\n// reconvertEnumValues\n// ---------------------------------------------------------------------------\n\n/**\n * Re-convert CLI string values back to their schema-typed equivalents\n * based on the option configs.\n */\nexport function reconvertEnumValues(\n  kwargs: Record<string, unknown>,\n  options: OptionConfig[],\n): Record<string, unknown> {\n  const result = { ...kwargs };\n  for (const opt of options) {\n    if (!opt.enumOriginalTypes) continue;\n    const paramName = opt.name;\n    if (!(paramName in result) || result[paramName] === null || result[paramName] === undefined) {\n      continue;\n    }\n    const strVal = String(result[paramName]);\n    const origType = opt.enumOriginalTypes[strVal];\n    if (origType === \"int\") {\n      result[paramName] = parseInt(strVal, 10);\n    } else if (origType === \"float\") {\n      result[paramName] = parseFloat(strVal);\n    } else if (origType === \"bool\") {\n      result[paramName] = strVal.toLowerCase() === \"true\";\n    }\n  }\n  return result;\n}\n","#!/usr/bin/env node\n/**\n * apcore-cli — Shebang entry point.\n *\n * Intercepts --internal-sandbox-runner before the normal CLI bootstrap so\n * that the sandbox child process can execute a module without initializing\n * the full CLI surface (extensions dir scanning, registry, etc.).\n */\n\nconst sandboxIdx = process.argv.indexOf(\"--internal-sandbox-runner\");\nif (sandboxIdx !== -1) {\n  const moduleId = process.argv[sandboxIdx + 1];\n  if (!moduleId) {\n    process.stderr.write(\"--internal-sandbox-runner requires a module_id argument.\\n\");\n    process.exit(1);\n  }\n  import(\"../src/security/sandbox.js\").then(({ runSandboxRunner }) => {\n    runSandboxRunner(moduleId).catch((err: unknown) => {\n      process.stderr.write(`sandbox runner fatal: ${err}\\n`);\n      process.exit(1);\n    });\n  });\n} else {\n  import(\"../src/main.js\").then(({ main }) => {\n    main(\"apcore-cli\");\n  });\n}\n"],"mappings":";;;;;;;;;;;;AACA,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAF9B;AAAA;AAAA;AAAA;AAAA;;;AC4GO,SAAS,iBAAiB,OAA0B;AACzD,MAAI,iBAAiB,sBAAsB;AACzC,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,iBAAiB,qBAAqB;AACxC,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,iBAAiB,qBAAqB;AACxC,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,iBAAiB,uBAAuB;AAC1C,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,iBAAiB,uBAAuB;AAC1C,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,iBAAiB,qBAAqB;AACxC,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,iBAAiB,sBAAsB;AACzC,WAAO,WAAW;AAAA,EACpB;AAGA,MAAI,iBAAiB,OAAO;AAC1B,UAAM,OAAQ,MAA6C;AAC3D,UAAM,UAAoC;AAAA,MACxC,kBAAkB,WAAW;AAAA,MAC7B,mBAAmB,WAAW;AAAA,MAC9B,iBAAiB,WAAW;AAAA,MAC5B,sBAAsB,WAAW;AAAA,MACjC,6BAA6B,WAAW;AAAA,MACxC,yBAAyB,WAAW;AAAA,MACpC,qBAAqB,WAAW;AAAA,MAChC,iBAAiB,WAAW;AAAA,MAC5B,kBAAkB,WAAW;AAAA,MAC7B,kBAAkB,WAAW;AAAA,MAC7B,kBAAkB,WAAW;AAAA,MAC7B,gBAAgB,WAAW;AAAA,MAC3B,sBAAsB,WAAW;AAAA,MACjC,gBAAgB,WAAW;AAAA,MAC3B,YAAY,WAAW;AAAA;AAAA,MAEvB,2BAA2B,WAAW;AAAA,MACtC,4BAA4B,WAAW;AAAA,MACvC,4BAA4B,WAAW;AAAA,MACvC,yBAAyB,WAAW;AAAA,MACpC,oBAAoB,WAAW;AAAA,MAC/B,mBAAmB,WAAW;AAAA,MAC9B,2BAA2B,WAAW;AAAA,IACxC;AACA,QAAI,QAAQ,QAAQ,SAAS;AAC3B,aAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AAEA,SAAO,WAAW;AACpB;AArKA,IAWa,sBAQA,qBAQA,uBAQA,sBAQA,qBAQA,uBAQA,qBAWA;AAtEb;AAAA;AAAA;AAAA;AAWO,IAAM,uBAAN,cAAmC,MAAM;AAAA,MAC9C,YAAY,UAAU,sBAAsB;AAC1C,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAGO,IAAM,sBAAN,cAAkC,MAAM;AAAA,MAC7C,YAAY,UAAU,yBAAyB;AAC7C,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAGO,IAAM,wBAAN,cAAoC,MAAM;AAAA,MAC/C,YAAY,UAAU,4BAA4B;AAChD,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAGO,IAAM,uBAAN,cAAmC,MAAM;AAAA,MAC9C,YAAY,UAAU,2BAA2B;AAC/C,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAGO,IAAM,sBAAN,cAAkC,MAAM;AAAA,MAC7C,YAAY,UAAU,mBAAmB;AACvC,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAGO,IAAM,wBAAN,cAAoC,MAAM;AAAA,MAC/C,YAAY,UAAU,4BAA4B;AAChD,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAGO,IAAM,sBAAN,cAAkC,MAAM;AAAA,MAC7C,YAAY,UAAU,oBAAoB;AACxC,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAMO,IAAM,aAAa;AAAA,MACxB,SAAS;AAAA,MACT,sBAAsB;AAAA,MACtB,gBAAgB;AAAA,MAChB,mBAAmB;AAAA,MACnB,kBAAkB;AAAA,MAClB,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,MACjB,sBAAsB;AAAA,MACtB,6BAA6B;AAAA,MAC7B,yBAAyB;AAAA,MACzB,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,MACrB,YAAY;AAAA;AAAA,MAEZ,2BAA2B;AAAA,MAC3B,4BAA4B;AAAA,MAC5B,4BAA4B;AAAA,MAC5B,yBAAyB;AAAA,MACzB,oBAAoB;AAAA,MACpB,mBAAmB;AAAA,MACnB,2BAA2B;AAAA,MAC3B,oBAAoB;AAAA,IACtB;AAAA;AAAA;;;AChGA;AAAA;AAAA;AAAA;AAAA;AAiNA,eAAsB,iBAAiB,UAAiC;AACtE,QAAM,iBAAiB,QAAQ,IAAI,0BAA0B;AAG7D,QAAM,SAAS,MAAM,OAAO,WAAW,EAAE,MAAM,MAAM;AACnD,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACD,MAAI,CAAC,OAAQ;AAEb,MAAI,YAAY;AAChB,mBAAiB,SAAS,QAAQ,OAAO;AACvC,iBAAa,MAAM,SAAS;AAAA,EAC9B;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,KAAK,MAAM,SAAS;AAAA,EAClC,QAAQ;AACN,YAAQ,OAAO,MAAM,kDAAkD;AACvE,YAAQ,KAAK,CAAC;AACd;AAAA,EACF;AAEA,QAAM,WAAW,IAAI,OAAO,SAAS,EAAE,eAAe,eAAe,CAAC;AACtE,QAAM,SAAS,SAAS;AACxB,QAAM,WAAW,IAAI,OAAO,SAAS,EAAE,SAAS,CAAC;AACjD,MAAI;AACF,UAAM,SAAS,MAAM,SAAS,KAAK,UAAU,SAAS;AACtD,YAAQ,OAAO,MAAM,KAAK,UAAU,MAAM,CAAC;AAC3C,YAAQ,KAAK,CAAC;AAAA,EAChB,SAAS,KAAc;AACrB,YAAQ,OAAO,MAAM,yBAAyB,GAAG;AAAA,CAAI;AACrD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;AAMA,SAAS,gBAAgB,QAAmC;AAC1D,QAAM,MAAyB,CAAC;AAChC,aAAW,OAAO,oBAAoB;AACpC,QAAI,QAAQ,IAAI,GAAG,EAAG,KAAI,GAAG,IAAI,QAAQ,IAAI,GAAG;AAAA,EAClD;AACA,aAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,QAAQ,GAAG,GAAG;AACpD,QACE,IAAI,WAAW,oBAAoB,KACnC,CAAC,IAAI,WAAW,mBAAmB,KACnC,CAAE,kBAAwC,SAAS,GAAG,GACtD;AACA,UAAI,GAAG,IAAI;AAAA,IACb;AAAA,EACF;AACA,MAAI,OAAO;AACX,MAAI,SAAS;AACb,SAAO;AACT;AA7QA,IAgBM,oBACA,sBACA,qBAEA,mBAEA,mCAcO;AApCb;AAAA;AAAA;AAAA;AAYA;AAIA,IAAM,qBAAqB,CAAC,QAAQ,QAAQ,QAAQ;AACpD,IAAM,uBAAuB;AAC7B,IAAM,sBAAsB;AAE5B,IAAM,oBAAuC,CAAC,qBAAqB;AAEnE,IAAM,oCAAoC,KAAK,OAAO;AAc/C,IAAM,UAAN,MAAc;AAAA;AAAA,MAEnB,OAAgB,2BAA2B;AAAA,MAE1B;AAAA,MACA;AAAA,MACT,iBAAgC;AAAA,MAChC,iBAAyB;AAAA,MAEjC,YAAY,UAAU,OAAO,iBAAiB,KAAK;AACjD,aAAK,UAAU;AACf,aAAK,iBAAiB;AAAA,MACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAUA,mBAAmB,gBAAqC;AACtD,aAAK,iBAAiB;AACtB,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASA,mBAAmB,gBAA8B;AAC/C,aAAK,iBAAiB;AACtB,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA,MAKA,MAAM,QACJ,UACA,WACA,UACkB;AAClB,YAAI,CAAC,KAAK,SAAS;AACjB,iBAAO,SAAS,QAAQ,UAAU,SAAS;AAAA,QAC7C;AACA,eAAO,KAAK,kBAAkB,UAAU,SAAS;AAAA,MACnD;AAAA,MAEA,MAAc,kBACZ,UACA,WACkB;AAClB,cAAM,EAAE,MAAM,IAAI,MAAM,OAAO,eAAoB;AACnD,cAAM,EAAE,OAAO,IAAI,MAAM,OAAO,IAAS;AACzC,cAAM,EAAE,MAAAA,MAAK,IAAI,MAAM,OAAO,MAAW;AACzC,cAAM,EAAE,aAAa,OAAO,IAAI,MAAM,OAAO,IAAS;AAEtD,cAAM,SAAS,YAAYA,MAAK,OAAO,GAAG,iBAAiB,CAAC;AAE5D,cAAM,MAAM,gBAAgB,MAAM;AASlC,cAAM,EAAE,SAAS,YAAY,IAAI,MAAM,OAAO,MAAW;AACzD,YAAI,KAAK,mBAAmB,MAAM;AAChC,cAAI,yBAAyB,YAAY,KAAK,cAAc;AAAA,QAC9D,WAAW,IAAI,wBAAwB;AACrC,cAAI,yBAAyB,YAAY,IAAI,sBAAsB;AAAA,QACrE;AACA,cAAM,aAAa,QAAQ,KAAK,CAAC;AACjC,cAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,YAAY,6BAA6B,QAAQ,GAAG;AAAA,UACzF;AAAA,UACA,KAAK;AAAA,UACL,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAChC,CAAC;AAED,YAAI,SAAS;AACb,YAAI,SAAS;AACb,YAAI,cAAc;AAClB,YAAI,cAAc;AAClB,YAAI,eAAe;AAEnB,cAAM,YAAY,KAAK;AACvB,cAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,cAAI,aAAc;AAClB,yBAAe,MAAM;AACrB,cAAI,cAAc,WAAW;AAC3B,2BAAe;AACf,kBAAM,KAAK,SAAS;AACpB;AAAA,UACF;AACA,oBAAU,MAAM,SAAS;AAAA,QAC3B,CAAC;AAID,cAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,cAAI,aAAc;AAClB,yBAAe,MAAM;AACrB,cAAI,cAAc,WAAW;AAC3B,2BAAe;AACf,kBAAM,KAAK,SAAS;AACpB;AAAA,UACF;AACA,oBAAU,MAAM,SAAS;AAAA,QAC3B,CAAC;AAED,cAAM,MAAM,MAAM,KAAK,UAAU,SAAS,CAAC;AAC3C,cAAM,MAAM,IAAI;AAEhB,eAAO,IAAI,QAAiB,CAACC,UAAS,WAAW;AAC/C,gBAAM,QAAQ,WAAW,MAAM;AAC7B,kBAAM,KAAK,SAAS;AACpB;AAAA,cACE,IAAI;AAAA,gBACF,mBAAmB,QAAQ,qBAAqB,KAAK,cAAc;AAAA,cACrE;AAAA,YACF;AAAA,UACF,GAAG,KAAK,iBAAiB,GAAI;AAE7B,gBAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,yBAAa,KAAK;AAClB,gBAAI;AAAE,qBAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,YAAG,QAAQ;AAAA,YAAoB;AAEpF,gBAAI,cAAc;AAChB,oBAAM,WAAW,KAAK,MAAM,aAAa,OAAO,KAAK;AACrD,qBAAO,IAAI;AAAA,gBACT,mBAAmB,QAAQ,qBAAqB,QAAQ;AAAA,cAC1D,CAAC;AACD;AAAA,YACF;AACA,gBAAI,SAAS,GAAG;AACd,qBAAO,IAAI;AAAA,gBACT,mBAAmB,QAAQ,sBAAsB,IAAI,IAAI,SAAS,YAAY,MAAM,KAAK,EAAE;AAAA,cAC7F,CAAC;AACD;AAAA,YACF;AACA,gBAAI;AACF,cAAAA,SAAQ,KAAK,MAAM,MAAM,CAAC;AAAA,YAC5B,QAAQ;AACN,qBAAO,IAAI;AAAA,gBACT,mBAAmB,QAAQ,+BAA+B,OAAO,MAAM,GAAG,GAAG,CAAC;AAAA,cAChF,CAAC;AAAA,YACH;AAAA,UACF,CAAC;AAED,gBAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,yBAAa,KAAK;AAClB,mBAAO,IAAI,qBAAqB,oCAAoC,IAAI,OAAO,EAAE,CAAC;AAAA,UACpF,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AAAA;AAAA;;;ACtLO,SAAS,YACd,QACA,WAAW,IACX,WAAW,IACc;AACzB,QAAM,SAAS,gBAAgB,MAAM;AACrC,QAAM,OAAQ,OAAO,SAAS,OAAO,eAAe,CAAC;AAIrD,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA,oBAAI,IAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAGA,SAAO,OAAO;AACd,SAAO,OAAO;AACd,SAAO;AACT;AAEA,SAAS,YACP,MACA,MACA,SACA,OACA,UACA,UACS;AACT,MAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG;AACpE,WAAO;AAAA,EACT;AAEA,QAAM,MAAM;AAGZ,MAAI,UAAU,KAAK;AACjB,UAAM,UAAU,IAAI;AAEpB,QAAI,SAAS,UAAU;AACrB,cAAQ,OAAO;AAAA,QACb,oDAAoD,QAAQ,gBAAgB,QAAQ;AAAA;AAAA,MACtF;AACA,cAAQ,KAAK,WAAW,mBAAmB;AAAA,IAC7C;AAEA,QAAI,QAAQ,IAAI,OAAO,GAAG;AACxB,cAAQ,OAAO;AAAA,QACb,uDAAuD,QAAQ,cAAc,OAAO;AAAA;AAAA,MACtF;AACA,cAAQ,KAAK,WAAW,mBAAmB;AAAA,IAC7C;AAGA,UAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,UAAM,MAAM,MAAM,MAAM,SAAS,CAAC;AAElC,QAAI,EAAE,OAAO,OAAO;AAClB,cAAQ,OAAO;AAAA,QACb,6BAA6B,OAAO,2BAA2B,QAAQ;AAAA;AAAA,MACzE;AACA,cAAQ,KAAK,WAAW,uBAAuB;AAAA,IACjD;AAEA,UAAM,aAAa,IAAI,IAAI,OAAO;AAClC,eAAW,IAAI,OAAO;AACtB,WAAO,YAAY,KAAK,GAAG,GAAG,MAAM,YAAY,QAAQ,GAAG,UAAU,QAAQ;AAAA,EAC/E;AAGA,MAAI,WAAW,OAAO,MAAM,QAAQ,IAAI,KAAK,GAAG;AAC9C,UAAM,SAAkC;AAAA,MACtC,YAAY,CAAC;AAAA,MACb,UAAU,CAAC;AAAA,IACb;AAIA,QAAI,OAAO,IAAI,eAAe,YAAY,IAAI,eAAe,MAAM;AACjE,aAAO,OAAO,OAAO,YAAuC,IAAI,UAAU;AAAA,IAC5E;AACA,QAAI,MAAM,QAAQ,IAAI,QAAQ,GAAG;AAC/B,MAAC,OAAO,SAAsB,KAAK,GAAI,IAAI,QAAqB;AAAA,IAClE;AACA,eAAW,aAAa,IAAI,OAAoB;AAC9C,YAAM,WAAW;AAAA,QACf;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACA,UAAI,SAAS,YAAY;AACvB,eAAO;AAAA,UACL,OAAO;AAAA,UACP,SAAS;AAAA,QACX;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,QAAQ,GAAG;AACpC,QAAC,OAAO,SAAsB,KAAK,GAAG,SAAS,QAAQ;AAAA,MACzD;AAAA,IACF;AAEA,WAAO,WAAW,CAAC,GAAG,IAAI,IAAI,OAAO,QAAoB,CAAC;AAE1D,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,UAAI,MAAM,WAAW,EAAE,KAAK,SAAS;AACnC,eAAO,CAAC,IAAI;AAAA,MACd;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAGA,aAAW,WAAW,CAAC,SAAS,OAAO,GAAG;AACxC,QAAI,WAAW,OAAO,MAAM,QAAQ,IAAI,OAAO,CAAC,GAAG;AACjD,YAAM,SAAkC;AAAA,QACtC,YAAY,CAAC;AAAA,QACb,UAAU,CAAC;AAAA,MACb;AAIA,UAAI,OAAO,IAAI,eAAe,YAAY,IAAI,eAAe,MAAM;AACjE,eAAO,OAAO,OAAO,YAAuC,IAAI,UAAU;AAAA,MAC5E;AAKA,YAAM,kBAA4B,MAAM,QAAQ,IAAI,QAAQ,IACvD,IAAI,SAAsB,MAAM,IACjC,CAAC;AACL,YAAM,kBAAiC,CAAC;AACxC,iBAAW,aAAa,IAAI,OAAO,GAAgB;AACjD,cAAM,WAAW;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,QACF;AACA,YAAI,SAAS,YAAY;AACvB,iBAAO;AAAA,YACL,OAAO;AAAA,YACP,SAAS;AAAA,UACX;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,SAAS,QAAQ,GAAG;AACpC,0BAAgB,KAAK,IAAI,IAAI,SAAS,QAAoB,CAAC;AAAA,QAC7D;AAAA,MACF;AAGA,UAAI,iBAA2B,CAAC;AAChC,UAAI,gBAAgB,SAAS,GAAG;AAC9B,YAAI,eAAe,gBAAgB,CAAC;AACpC,iBAAS,IAAI,GAAG,IAAI,gBAAgB,QAAQ,KAAK;AAC/C,yBAAe,IAAI;AAAA,YACjB,CAAC,GAAG,YAAY,EAAE,OAAO,CAAC,MAAM,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;AAAA,UAC3D;AAAA,QACF;AACA,yBAAiB,CAAC,GAAG,YAAY;AAAA,MACnC;AACA,YAAM,OAAO,oBAAI,IAAY;AAC7B,YAAM,mBAA6B,CAAC;AACpC,iBAAW,KAAK,CAAC,GAAG,iBAAiB,GAAG,cAAc,GAAG;AACvD,YAAI,CAAC,KAAK,IAAI,CAAC,GAAG;AAChB,eAAK,IAAI,CAAC;AACV,2BAAiB,KAAK,CAAC;AAAA,QACzB;AAAA,MACF;AACA,aAAO,WAAW;AAElB,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,YAAI,MAAM,WAAW,EAAE,KAAK,SAAS;AACnC,iBAAO,CAAC,IAAI;AAAA,QACd;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAOA,MAAI,gBAAgB,OAAO,OAAO,IAAI,eAAe,YAAY,IAAI,eAAe,MAAM;AACxF,UAAM,QAAQ,IAAI;AAClB,eAAW,CAAC,UAAU,UAAU,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1D,YAAM,QAAQ,IAAI;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAjOA;AAAA;AAAA;AAAA;AAMA;AAAA;AAAA;;;ACGO,SAAS,YAAY,OAAqB;AAC/C,QAAM,QAAQ,MAAM,YAAY;AAChC,MAAI,SAAS,QAAQ;AACnB,mBAAe;AAAA,EACjB;AACF;AAMA,SAAS,UAAU,OAA0B;AAC3C,SAAO,OAAO,KAAK,KAAK,OAAO,YAAY;AAC7C;AAUO,SAAS,KAAK,SAAuB;AAC1C,MAAI,UAAU,SAAS,EAAG,SAAQ,OAAO,MAAM,YAAY,OAAO;AAAA,CAAI;AACxE;AAlCA,IAIM,QAGF;AAPJ;AAAA;AAAA;AAAA;AAIA,IAAM,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,EAAE;AAGzD,IAAI,eAAyB;AAAA;AAAA;;;ACetB,SAAS,QAAQ,UAAkB,YAAiD;AACzF,QAAM,aAAa,WAAW;AAG9B,MACE,eAAe,aACd,SAAS,SAAS,OAAO,KAAK,WAAW,YAAY,MAAM,OAC5D;AACA,WAAO;AAAA,EACT;AAEA,QAAM,UAAsC;AAAA,IAC1C,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,OAAO;AAAA,EACT;AAEA,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AAEA,SAAO,QAAQ,UAAU,KAAK;AAChC;AAKO,SAAS,YAAY,YAAqC,YAAY,KAA0B;AACrG,MAAI,OAAO,WAAW,mBAAmB;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,MAAI,YAAY,KAAK,KAAK,SAAS,WAAW;AAC5C,WAAO,KAAK,MAAM,GAAG,YAAY,CAAC,IAAI;AAAA,EACxC;AACA,SAAO;AACT;AAiBO,SAAS,mBACd,QACA,gBAAgB,KACA;AAChB,QAAM,aAAc,OAAO,cAAc,CAAC;AAI1C,QAAM,eAAgB,OAAO,YAAY,CAAC;AAC1C,QAAM,UAA0B,CAAC;AACjC,QAAM,YAAoC,CAAC;AAO3C,aAAW,WAAW,cAAc;AAClC,QAAI,EAAE,WAAW,aAAa;AAC5B;AAAA,QACE,sBAAsB,OAAO;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAEA,aAAW,CAAC,UAAU,UAAU,KAAK,OAAO,QAAQ,UAAU,GAAG;AAC/D,UAAM,WAAW,OAAO,SAAS,QAAQ,MAAM,GAAG;AAOlD,QAAI,eAAe,IAAI,QAAQ,GAAG;AAChC,cAAQ,OAAO;AAAA,QACb,kCAAkC,QAAQ;AAAA;AAAA,MAC5C;AACA,cAAQ,KAAK,WAAW,mBAAmB;AAAA,IAC7C;AAKA,QAAI,YAAY,WAAW;AACzB,cAAQ,OAAO;AAAA,QACb,2CAA2C,QAAQ,UAAU,UAAU,QAAQ,CAAC,kBAAkB,QAAQ;AAAA;AAAA,MAC5G;AACA,cAAQ,KAAK,WAAW,mBAAmB;AAAA,IAC7C;AACA,cAAU,QAAQ,IAAI;AAEtB,UAAM,aAAa,QAAQ,UAAU,UAAU;AAC/C,UAAM,aAAa,aAAa,SAAS,QAAQ;AACjD,UAAM,WAAW,YAAY,YAAY,aAAa;AACtD,UAAM,WAAW,cACZ,WAAW,WAAW,MAAM,MAAM,eACnC,YAAY;AAChB,UAAM,eAAe,WAAW;AAEhC,QAAI,eAAe,cAAc;AAE/B,YAAM,WAAW,SAAS,QAAQ,MAAM,GAAG;AAM3C,YAAM,SAAS,QAAQ,QAAQ;AAC/B,UAAI,UAAU,WAAW;AACvB,gBAAQ,OAAO;AAAA,UACb,iDAAiD,QAAQ,qBAAqB,MAAM,wCAAwC,UAAU,MAAM,CAAC;AAAA;AAAA,QAC/I;AAGA,gBAAQ,KAAK,WAAW,mBAAmB;AAAA,MAC7C;AACA,gBAAU,MAAM,IAAI;AACpB,YAAM,aAAc,WAAW,WAAuB;AACtD,cAAQ,KAAK;AAAA,QACX,MAAM;AAAA,QACN,OAAO,KAAK,QAAQ,UAAU,QAAQ;AAAA,QACtC,aAAa;AAAA,QACb,cAAc;AAAA,QACd,UAAU;AAAA,QACV,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,WAAW,UAAU,cAAc,MAAM,QAAQ,WAAW,IAAI,GAAG;AACjE,YAAM,aAAa,WAAW;AAC9B,UAAI,WAAW,WAAW,GAAG;AAE3B,gBAAQ,KAAK;AAAA,UACX,MAAM;AAAA,UACN,OAAO,GAAG,QAAQ;AAAA,UAClB,aAAa;AAAA,UACb;AAAA,UACA,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,OAAO;AACL,cAAM,eAAe,WAAW,IAAI,MAAM;AAC1C,cAAM,oBAA4C,CAAC;AACnD,mBAAW,KAAK,YAAY;AAC1B,cAAI,OAAO,MAAM,YAAY,OAAO,UAAU,CAAC,GAAG;AAChD,8BAAkB,OAAO,CAAC,CAAC,IAAI;AAAA,UACjC,WAAW,OAAO,MAAM,UAAU;AAChC,8BAAkB,OAAO,CAAC,CAAC,IAAI;AAAA,UACjC,WAAW,OAAO,MAAM,WAAW;AACjC,8BAAkB,OAAO,CAAC,CAAC,IAAI;AAAA,UACjC;AAAA,QACF;AACA,gBAAQ,KAAK;AAAA,UACX,MAAM;AAAA,UACN,OAAO,GAAG,QAAQ;AAAA,UAClB,aAAa;AAAA,UACb,cACE,iBAAiB,SAAY,OAAO,YAAY,IAAI;AAAA,UACtD,UAAU;AAAA,UACV,SAAS;AAAA,UACT,mBACE,OAAO,KAAK,iBAAiB,EAAE,SAAS,IACpC,oBACA;AAAA,QACR,CAAC;AAAA,MACH;AAAA,IACF,OAAO;AAEL,UAAI;AACJ,UAAI,eAAe,OAAO;AACxB,mBAAW,CAAC,MAAc;AACxB,gBAAM,IAAI,SAAS,GAAG,EAAE;AACxB,cAAI,MAAM,CAAC,EAAG,OAAM,IAAI,MAAM,oBAAoB,CAAC,EAAE;AACrD,iBAAO;AAAA,QACT;AAAA,MACF,WAAW,eAAe,SAAS;AACjC,mBAAW,CAAC,MAAc;AACxB,gBAAM,IAAI,WAAW,CAAC;AACtB,cAAI,MAAM,CAAC,EAAG,OAAM,IAAI,MAAM,mBAAmB,CAAC,EAAE;AACpD,iBAAO;AAAA,QACT;AAAA,MACF;AACA,cAAQ,KAAK;AAAA,QACX,MAAM;AAAA,QACN,OAAO,GAAG,QAAQ;AAAA,QAClB,aAAa;AAAA,QACb;AAAA,QACA,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAxOA,IAeM,cAwDA;AAvEN;AAAA;AAAA;AAAA;AAOA;AACA;AAOA,IAAM,eAAe,uBAAO,cAAc;AAwD1C,IAAM,iBAAiB,oBAAI,IAAI;AAAA,MAC7B;AAAA,MAAS;AAAA,MAAO;AAAA,MAAe;AAAA,MAAU;AAAA,MAAU;AAAA,MACnD;AAAA,MAAW;AAAA,MAAW;AAAA,MAAS;AAAA,MAAU;AAAA,MACzC;AAAA,MAAoB;AAAA,IACtB,CAAC;AAAA;AAAA;;;ACrED,YAAY,cAAc;AAW1B,SAAS,cACP,aACA,KACA,eAAwB,QACf;AACT,MAAI,CAAC,eAAe,OAAO,gBAAgB,SAAU,QAAO;AAC5D,QAAM,MAAM;AACZ,SAAO,OAAO,MAAM,IAAI,GAAG,IAAI;AACjC;AAMA,SAAS,qBAAyC;AAChD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,UAAa,QAAQ,GAAI,QAAO;AAC5C,QAAM,SAAS,SAAS,KAAK,EAAE;AAC/B,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,EAAG,QAAO;AACpD,SAAO;AACT;AA4EA,eAAsB,cACpB,WACA,aACA,SACe;AACf,QAAM,cAAc,UAAU;AAG9B,MAAI;AACJ,MAAI,UAAU,qBAAqB,QAAW;AAC5C,uBAAmB,UAAU;AAAA,EAC/B,WAAW,aAAa;AACtB,uBAAmB,cAAc,aAAa,qBAAqB,KAAK,MAAM;AAAA,EAChF,OAAO;AACL;AAAA,EACF;AAEA,MAAI,CAAC,kBAAkB;AACrB;AAAA,EACF;AAEA,QAAM,WAAW,UAAU;AAG3B,MAAI,aAAa;AACf;AAAA,EACF;AAGA,QAAM,SAAS,QAAQ,IAAI,2BAA2B;AACtD,MAAI,WAAW,KAAK;AAClB;AAAA,EACF;AACA,MAAI,WAAW,MAAM,WAAW,KAAK;AACnC,YAAQ,OAAO;AAAA,MACb,+CAA+C,MAAM;AAAA;AAAA,IACvD;AAAA,EACF;AAGA,MAAI,CAAC,QAAQ,MAAM,OAAO;AACxB,UAAM,IAAI;AAAA,MACR,WAAW,QAAQ;AAAA,IAErB;AAAA,EACF;AAGA,QAAM,mBAAmB,WAAW,mBAAmB,KAAK;AAC5D,QAAM,kBAAkB,WAAW,gBAAgB;AACrD;AAKA,eAAe,kBACb,WACA,SACe;AAEf,YAAU,KAAK,IAAI,GAAG,KAAK,IAAI,SAAS,IAAI,CAAC;AAE7C,QAAM,WAAW,UAAU;AAC3B,QAAM,cAAc,UAAU;AAC9B,QAAM,WACH,cACI,cAAc,aAAa,kBAAkB,IAC9C,WACJ,WAAW,QAAQ;AAErB,UAAQ,OAAO,MAAM,UAAU,IAAI;AAEnC,QAAM,KAAc,yBAAgB;AAAA,IAClC,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,EAClB,CAAC;AAED,MAAI;AAEJ,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,MAChC,IAAI,QAAgB,CAACC,aAAY;AAC/B,WAAG,SAAS,mBAAmB,CAAC,QAAQA,SAAQ,GAAG,CAAC;AAAA,MACtD,CAAC;AAAA,MACD,IAAI,QAAe,CAAC,GAAG,WAAW;AAChC,gBAAQ,WAAW,MAAM;AACvB,iBAAO,IAAI;AAAA,YACT,mCAAmC,OAAO;AAAA,UAC5C,CAAC;AAAA,QACH,GAAG,UAAU,GAAI;AAAA,MACnB,CAAC;AAAA,IACH,CAAC;AAGD,QAAI,MAAO,cAAa,KAAK;AAE7B,UAAM,aAAa,OAAO,KAAK,EAAE,YAAY;AAC7C,QAAI,eAAe,OAAO,eAAe,OAAO;AAC9C;AAAA,IACF;AAEA,UAAM,IAAI,oBAAoB,iBAAiB;AAAA,EACjD,SAAS,KAAK;AACZ,QAAI,MAAO,cAAa,KAAK;AAI7B,UAAM;AAAA,EACR,UAAE;AACA,OAAG,MAAM;AAAA,EACX;AACF;AAhOA,IAoDa;AApDb;AAAA;AAAA;AAAA;AAQA;AA4CO,IAAM,qBAAN,MAAyB;AAAA,MAC9B;AAAA,MACA;AAAA,MAEA,YAAY,cAAc,OAAO,SAAkB;AACjD,aAAK,cAAc;AACnB,cAAM,WAAW,WAAW,mBAAmB,KAAK;AACpD,aAAK,UAAU,KAAK,IAAI,GAAG,KAAK,IAAI,UAAU,IAAI,CAAC;AAAA,MACrD;AAAA,MAEA,MAAM,gBAAgB,SAAoE;AACxF,cAAM,WAAY,QAAQ,aAAwB;AAElD,YAAI,KAAK,aAAa;AACpB,iBAAO,EAAE,QAAQ,YAAY,aAAa,eAAe;AAAA,QAC3D;AAEA,cAAM,SAAS,QAAQ,IAAI,2BAA2B;AACtD,YAAI,WAAW,KAAK;AAClB,iBAAO,EAAE,QAAQ,YAAY,aAAa,mBAAmB;AAAA,QAC/D;AACA,YAAI,WAAW,MAAM,WAAW,KAAK;AACnC,kBAAQ,OAAO;AAAA,YACb,+CAA+C,MAAM;AAAA;AAAA,UACvD;AAAA,QACF;AAEA,YAAI,CAAC,QAAQ,MAAM,OAAO;AACxB,iBAAO,EAAE,QAAQ,YAAY,QAAQ,wCAAwC;AAAA,QAC/E;AAGA,cAAM,cAAc,QAAQ;AAC5B,cAAM,QAAS,aAAa,SAAqC,CAAC;AAClE,cAAM,UAAW,MAAM,oBAA+B,WAAW,QAAQ;AAEzE,gBAAQ,OAAO,MAAM,UAAU,IAAI;AACnC,YAAI;AACF,gBAAM,kBAAkB,EAAE,IAAI,SAAS,GAAuB,KAAK,OAAO;AAC1E,iBAAO,EAAE,QAAQ,YAAY,aAAa,WAAW;AAAA,QACvD,QAAQ;AACN,iBAAO,EAAE,QAAQ,YAAY,QAAQ,6BAA6B;AAAA,QACpE;AAAA,MACF;AAAA,MAEA,MAAM,cAAc,aAAuD;AACzE,eAAO,EAAE,QAAQ,YAAY,QAAQ,8CAA8C;AAAA,MACrF;AAAA,IACF;AAAA;AAAA;;;AC9FA,OAAO,UAAU;AAcjB,SAAS,oBACP,GACwC;AACxC,QAAM,WAAY,EAAE,YAAY,CAAC;AACjC,QAAM,UAAW,SAAS,SAAS,KAAK;AAGxC,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,IACZ,aAAa,EAAE,eAAe;AAAA,IAC9B,aAAc,EAAE,eAAe,CAAC;AAAA,IAChC,cAAe,EAAE,gBAAgB,CAAC;AAAA,IAClC,MAAO,EAAE,QAAQ,CAAC;AAAA,IAClB,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,aACG,EAAE,eACH;AAAA,IACF,eAAe;AAAA,IACf,gBAAgB;AAAA,IAChB,UAAU,CAAC;AAAA,IACX;AAAA,IACA;AAAA,IACA,UAAU,CAAC;AAAA,EACb;AACF;AAOA,SAAS,cAAc,OAAwB;AAC7C,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC1D,SAAO,OAAO,KAAK;AACrB;AASO,SAAS,cAAc,gBAAiC;AAC7D,MAAI,mBAAmB,QAAW;AAChC,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,OAAO,QAAQ,UAAU;AAC1C;AAKO,SAAS,SAAS,MAAc,YAAY,IAAY;AAC7D,MAAI,KAAK,UAAU,WAAW;AAC5B,WAAO;AAAA,EACT;AACA,SAAO,KAAK,MAAM,GAAG,YAAY,CAAC,IAAI;AACxC;AAKA,SAAS,YACP,SACA,MACQ;AAER,QAAM,YAAY,QAAQ;AAAA,IAAI,CAAC,GAAG,MAChC,KAAK,IAAI,EAAE,QAAQ,GAAG,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,IAAI,MAAM,CAAC;AAAA,EAC5D;AAEA,QAAMC,OAAM,UAAU,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI;AACzD,QAAM,aAAa,QAChB,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,UAAU,CAAC,CAAC,CAAC,EACpC,KAAK,IAAI;AACZ,QAAM,YAAY,KAAK;AAAA,IAAI,CAAC,QAC1B,IAAI,IAAI,CAAC,MAAM,OAAO,QAAQ,IAAI,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI;AAAA,EACnE;AAEA,SAAO,CAAC,YAAYA,MAAK,GAAG,SAAS,EAAE,KAAK,IAAI,IAAI;AACtD;AASA,eAAsB,iBACpB,SACA,QACA,YACA,WAAW,OACX,gBACe;AACf,MAAI,WAAW,SAAS;AACtB,QAAI,QAAQ,WAAW,KAAK,cAAc,WAAW,SAAS,GAAG;AAC/D,cAAQ,OAAO;AAAA,QACb,mCAAmC,WAAW,KAAK,IAAI,CAAC;AAAA;AAAA,MAC1D;AACA;AAAA,IACF;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,OAAO,MAAM,qBAAqB;AAC1C;AAAA,IACF;AAEA,UAAM,UAAU,CAAC,MAAM,eAAe,MAAM;AAC5C,QAAI,SAAU,SAAQ,KAAK,MAAM;AACjC,QAAI,eAAgB,SAAQ,KAAK,UAAU;AAC3C,UAAM,OAAO,QAAQ,IAAI,CAAC,MAAM;AAC9B,YAAM,OAAO,CAAC,EAAE,IAAI,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC;AAC1E,UAAI,UAAU;AACZ,cAAM,OAAQ,EAAyC;AACvD,aAAK,KAAK,OAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC;AAAA,MACzD;AACA,UAAI,gBAAgB;AAClB,aAAK,KAAK,eAAe,UAAU,EAAE,MAAM,EAAE,IAAI,WAAW,QAAQ;AAAA,MACtE;AACA,aAAO;AAAA,IACT,CAAC;AACD,YAAQ,OAAO,MAAM,YAAY,SAAS,IAAI,CAAC;AAAA,EACjD,WAAW,WAAW,QAAQ;AAC5B,UAAM,SAAS,QAAQ,IAAI,CAAC,MAAM;AAChC,YAAM,QAAiC;AAAA,QACrC,IAAI,EAAE;AAAA,QACN,aAAa,EAAE;AAAA,QACf,MAAM,EAAE,QAAQ,CAAC;AAAA,MACnB;AACA,UAAI,UAAU;AACZ,cAAM,OAAQ,EAAyC;AACvD,cAAM,mBAAmB,MAAM,QAAQ,IAAI,IAAI,KAAK,SAAS;AAAA,MAC/D;AACA,UAAI,gBAAgB;AAClB,cAAM,UAAU,eAAe,UAAU,EAAE,MAAM,EAAE;AAAA,MACrD;AACA,aAAO;AAAA,IACT,CAAC;AACD,YAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAAA,EAC7D,WAAW,WAAW,cAAc,WAAW,SAAS;AACtD,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,OAAO,gBAAgB;AAAA,IACzC,QAAQ;AACN,YAAM,IAAI,MAAM,oBAAoB;AAAA,IACtC;AACA,UAAM,UAAU,QAAQ,IAAI,mBAAmB;AAC/C,YAAQ,OAAO;AAAA,MACZ,QAAQ,cAAc,SAAS,EAAE,OAAO,QAAQ,SAAS,KAAK,CAAC,IAAe;AAAA,IACjF;AAAA,EACF;AACF;AASA,SAAS,kBACP,aACgC;AAChC,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI,OAAO,gBAAgB,YAAY,MAAM,QAAQ,WAAW,EAAG,QAAO;AAC1E,QAAM,SAAkC,CAAC;AACzC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,WAAsC,GAAG;AAC3E,QAAI,MAAM,QAAQ,MAAM,UAAa,MAAM,SAAS,MAAM,KAAK,EAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,IAAI;AACpG,aAAO,CAAC,IAAI;AAAA,IACd;AAAA,EACF;AACA,SAAO,OAAO,KAAK,MAAM,EAAE,SAAS,IAAI,SAAS;AACnD;AAKA,eAAsB,mBACpB,WACA,QACe;AACf,MAAI,WAAW,SAAS;AACtB,YAAQ,OAAO,MAAM;AAAA,UAAa,UAAU,EAAE;AAAA,CAAI;AAClD,YAAQ,OAAO,MAAM;AAAA;AAAA,IAAqB,UAAU,WAAW;AAAA,CAAI;AAEnE,QAAI,UAAU,eAAe,OAAO,KAAK,UAAU,WAAW,EAAE,SAAS,GAAG;AAC1E,cAAQ,OAAO,MAAM,mBAAmB;AACxC,cAAQ,OAAO,MAAM,KAAK,UAAU,UAAU,aAAa,MAAM,CAAC,IAAI,IAAI;AAAA,IAC5E;AAEA,QAAI,UAAU,gBAAgB,OAAO,KAAK,UAAU,YAAY,EAAE,SAAS,GAAG;AAC5E,cAAQ,OAAO,MAAM,oBAAoB;AACzC,cAAQ,OAAO,MAAM,KAAK,UAAU,UAAU,cAAc,MAAM,CAAC,IAAI,IAAI;AAAA,IAC7E;AAEA,UAAM,UAAU;AAAA,MACd,UAAU;AAAA,IACZ;AACA,QAAI,SAAS;AACX,cAAQ,OAAO,MAAM,kBAAkB;AACvC,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,gBAAQ,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC;AAAA,CAAI;AAAA,MACvC;AAAA,IACF;AAGA,UAAM,WAAW,UAAU;AAC3B,QAAI,UAAU;AACZ,YAAM,UAAmC,CAAC;AAC1C,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC7C,YAAI,EAAE,WAAW,IAAI,KAAK,EAAE,WAAW,IAAI,GAAG;AAC5C,kBAAQ,CAAC,IAAI;AAAA,QACf;AAAA,MACF;AACA,UAAI,OAAO,KAAK,OAAO,EAAE,SAAS,GAAG;AACnC,gBAAQ,OAAO,MAAM,yBAAyB;AAC9C,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,kBAAQ,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC;AAAA,CAAI;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAO,UAAU,QAAQ,CAAC;AAChC,QAAI,KAAK,SAAS,GAAG;AACnB,cAAQ,OAAO,MAAM;AAAA,QAAW,KAAK,KAAK,IAAI,CAAC;AAAA,CAAI;AAAA,IACrD;AAAA,EACF,WAAW,WAAW,QAAQ;AAC5B,UAAM,SAAkC;AAAA,MACtC,IAAI,UAAU;AAAA,MACd,aAAa,UAAU;AAAA,IACzB;AACA,QAAI,UAAU,YAAa,QAAO,eAAe,UAAU;AAC3D,QAAI,UAAU,aAAc,QAAO,gBAAgB,UAAU;AAE7D,UAAM,UAAU;AAAA,MACd,UAAU;AAAA,IACZ;AACA,QAAI,QAAS,QAAO,cAAc;AAElC,UAAM,OAAO,UAAU,QAAQ,CAAC;AAChC,QAAI,KAAK,SAAS,EAAG,QAAO,OAAO;AAGnC,UAAM,WAAW,UAAU;AAC3B,QAAI,UAAU;AACZ,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC7C,YAAI,EAAE,WAAW,IAAI,KAAK,EAAE,WAAW,IAAI,GAAG;AAC5C,iBAAO,CAAC,IAAI;AAAA,QACd;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAAA,EAC7D,WAAW,WAAW,cAAc,WAAW,SAAS;AACtD,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,OAAO,gBAAgB;AAAA,IACzC,QAAQ;AACN,YAAM,IAAI,MAAM,oBAAoB;AAAA,IACtC;AACA,YAAQ,OAAO;AAAA,MACZ,QAAQ,aAAa,oBAAoB,SAAS,GAAG,EAAE,OAAO,QAAQ,SAAS,KAAK,CAAC,IAAe;AAAA,IACvG;AAAA,EACF;AACF;AAUA,SAAS,aAAa,QAAiC,QAAyC;AAC9F,QAAM,WAAoC,CAAC;AAC3C,aAAW,KAAK,OAAO,MAAM,GAAG,GAAG;AACjC,UAAM,MAAM,EAAE,KAAK;AACnB,QAAI,MAAe;AACnB,eAAW,QAAQ,IAAI,MAAM,GAAG,GAAG;AACjC,UAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,GAAG;AACzD,cAAO,IAAgC,IAAI;AAAA,MAC7C,OAAO;AACL,cAAM;AACN;AAAA,MACF;AAAA,IACF;AACA,aAAS,GAAG,IAAI;AAAA,EAClB;AACA,SAAO;AACT;AAQO,SAAS,iBACd,QACA,QACA,QACM;AACN,MAAI,WAAW,QAAQ,WAAW,QAAW;AAC3C;AAAA,EACF;AAGA,MAAI,mBAAmB;AACvB,MAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,KAAK,WAAW,MAAM;AACrF,uBAAmB,aAAa,QAAmC,MAAM;AAAA,EAC3E;AAEA,QAAM,YAAY,cAAc,MAAM;AAEtC,MAAI,cAAc,OAAO;AACvB,QAAI,OAAO,qBAAqB,YAAY,CAAC,MAAM,QAAQ,gBAAgB,KAAK,qBAAqB,MAAM;AACzG,YAAM,MAAM;AACZ,YAAM,OAAO,OAAO,KAAK,GAAG;AAC5B,YAAM,SAAS,KAAK,IAAI,cAAc,EAAE,KAAK,GAAG;AAChD,YAAM,MAAM,KAAK,IAAI,CAAC,MAAM,eAAe,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG;AAC3E,cAAQ,OAAO,MAAM,SAAS,OAAO,MAAM,IAAI;AAAA,IACjD,WAAW,MAAM,QAAQ,gBAAgB,KAAK,iBAAiB,SAAS,KAAK,OAAO,iBAAiB,CAAC,MAAM,UAAU;AACpH,YAAM,OAAO,OAAO,KAAK,iBAAiB,CAAC,CAA4B;AACvE,YAAM,SAAS,KAAK,IAAI,cAAc,EAAE,KAAK,GAAG;AAChD,YAAM,OAAO,iBAAiB,IAAI,CAAC,SAAS;AAC1C,cAAM,MAAM;AACZ,eAAO,KAAK,IAAI,CAAC,MAAM,eAAe,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG;AAAA,MACxE,CAAC;AACD,cAAQ,OAAO,MAAM,SAAS,OAAO,KAAK,KAAK,IAAI,IAAI,IAAI;AAAA,IAC7D,OAAO;AACL,cAAQ,OAAO,MAAM,KAAK,UAAU,gBAAgB,IAAI,IAAI;AAAA,IAC9D;AAAA,EACF,WAAW,cAAc,QAAQ;AAG/B,YAAQ,OAAO,MAAM,KAAK,KAAK,kBAAkB,EAAE,WAAW,GAAG,CAAC,CAAC;AAAA,EACrE,WAAW,cAAc,SAAS;AAChC,QAAI,MAAM,QAAQ,gBAAgB,GAAG;AACnC,iBAAW,QAAQ,kBAAkB;AACnC,gBAAQ,OAAO,MAAM,KAAK,UAAU,IAAI,IAAI,IAAI;AAAA,MAClD;AAAA,IACF,OAAO;AACL,cAAQ,OAAO,MAAM,KAAK,UAAU,gBAAgB,IAAI,IAAI;AAAA,IAC9D;AAAA,EACF,WACE,cAAc,WACd,OAAO,qBAAqB,YAC5B,CAAC,MAAM,QAAQ,gBAAgB,GAC/B;AAEA,UAAM,UAAU,OAAO,QAAQ,gBAA2C;AAC1E,UAAM,UAAU,CAAC,OAAO,OAAO;AAC/B,UAAM,OAAO,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;AAC3D,YAAQ,OAAO,MAAM,YAAY,SAAS,IAAI,CAAC;AAAA,EACjD,WAAW,OAAO,qBAAqB,UAAU;AAC/C,YAAQ,OAAO,MAAM,KAAK,UAAU,kBAAkB,MAAM,CAAC,IAAI,IAAI;AAAA,EACvE,WAAW,OAAO,qBAAqB,UAAU;AAC/C,YAAQ,OAAO,MAAM,mBAAmB,IAAI;AAAA,EAC9C,OAAO;AACL,YAAQ,OAAO,MAAM,OAAO,gBAAgB,IAAI,IAAI;AAAA,EACtD;AACF;AAKA,SAAS,eAAe,OAAuB;AAC7C,MAAI,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,IAAI,KAAK,MAAM,SAAS,IAAI,GAAG;AAC9F,WAAO,MAAM,MAAM,QAAQ,MAAM,IAAI,IAAI;AAAA,EAC3C;AACA,SAAO;AACT;AAaO,SAAS,sBAAsB,QAAyB,QAAuB;AACpF,QAAM,WAAW,cAAc,MAAM;AACrC,MAAI,aAAa,UAAU,CAAC,QAAQ,OAAO,OAAO;AAChD,UAAM,UAAmC;AAAA,MACvC,OAAO,OAAO;AAAA;AAAA;AAAA,MAGd,mBAAmB,OAAO;AAAA,MAC1B,QAAQ,OAAO,OAAO,IAAI,CAAC,MAAM;AAC/B,cAAM,QAAiC,EAAE,OAAO,EAAE,OAAO,QAAQ,EAAE,OAAO;AAC1E,YAAI,EAAE,UAAU,UAAa,EAAE,UAAU,MAAM;AAC7C,gBAAM,QAAQ,EAAE;AAAA,QAClB;AACA,YAAI,EAAE,YAAY,EAAE,SAAS,SAAS,GAAG;AACvC,gBAAM,WAAW,EAAE;AAAA,QACrB;AACA,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,YAAQ,OAAO,MAAM,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,IAAI;AAAA,EAC9D,OAAO;AAEL,eAAW,KAAK,OAAO,QAAQ;AAC7B,YAAM,eAAe,EAAE,UAAU,UAAU,KAAK;AAChD,UAAI;AACJ,UAAI,EAAE,UAAU,aAAa;AAC3B,cAAM;AAAA,MACR,WAAW,EAAE,QAAQ;AACnB,cAAM;AAAA,MACR,WAAW,EAAE,WAAW,OAAO;AAC7B,cAAM;AAAA,MACR,OAAO;AACL,cAAM;AAAA,MACR;AACA,UAAI,SAAS,KAAK,GAAG,IAAI,EAAE,MAAM,OAAO,EAAE,CAAC;AAC3C,UAAI,EAAE,OAAO;AACX,cAAM,SAAS,OAAO,EAAE,UAAU,WAAW,KAAK,UAAU,EAAE,KAAK,IAAI,OAAO,EAAE,KAAK;AACrF,kBAAU,IAAI,MAAM;AAAA,MACtB,WAAW,EAAE,UAAU,CAAC,aAAa;AACnC,kBAAU;AAAA,MACZ,WAAW,CAAC,EAAE,QAAQ;AACpB,kBAAU;AAAA,MACZ;AACA,cAAQ,OAAO,MAAM,SAAS,IAAI;AAClC,iBAAW,KAAK,EAAE,YAAY,CAAC,GAAG;AAChC,gBAAQ,OAAO,MAAM,gBAAgB,CAAC;AAAA,CAAI;AAAA,MAC5C;AAAA,IACF;AACA,UAAM,SAAS,OAAO,OAAO,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE;AACtD,UAAM,WAAW,OAAO,OAAO,OAAO,CAAC,KAAK,MAAM,OAAO,EAAE,UAAU,UAAU,IAAI,CAAC;AACpF,UAAM,MAAM,OAAO,QAAQ,SAAS;AACpC,YAAQ,OAAO,MAAM;AAAA,UAAa,GAAG,KAAK,MAAM,cAAc,QAAQ;AAAA,CAAgB;AAAA,EACxF;AACF;AASO,SAAS,oBAAoB,QAAiC;AAGnE,QAAM,cAAsC;AAAA,IAC1C,WAAW,WAAW;AAAA,IACtB,eAAe,WAAW;AAAA,IAC1B,YAAY,WAAW;AAAA,IACvB,KAAK,WAAW;AAAA,IAChB,QAAQ,WAAW;AAAA,IACnB,UAAU,WAAW;AAAA,IACrB,kBAAkB,WAAW;AAAA,EAC/B;AACA,aAAW,SAAS,OAAO,QAAQ;AACjC,QAAI,CAAC,MAAM,QAAQ;AACjB,aAAO,YAAY,MAAM,KAAK,KAAK,WAAW;AAAA,IAChD;AAAA,EACF;AACA,SAAO,WAAW;AACpB;AAzeA,IAUM;AAVN;AAAA;AAAA;AAAA;AAOA;AAGA,IAAM,uBACJ;AAAA;AAAA;;;ACNF,YAAY,QAAQ;AACpB,YAAYC,WAAU;AAQtB,SAAS,QAAW,IAAY,YAAoB,IAAa,SAAuB;AACtF,MAAI;AACF,WAAO,GAAG;AAAA,EACZ,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,OAAO,MAAM,oBAAoB,EAAE,IAAI,UAAU,KAAK,GAAG;AAAA,CAAI;AACrE,QAAI,WAAW,QAAQ,SAAS,GAAG;AACjC,cAAQ,OAAO;AAAA,QACb,kEAA6D,QAAQ,KAAK,IAAI,CAAC;AAAA;AAAA,MACjF;AAAA,IACF;AACA,YAAQ,KAAK,WAAW,oBAAoB;AAAA,EAC9C;AACF;AAyCA,SAAS,eAAe,UAAkB,SAAyC;AACjF,MAAI,SAAS;AACb,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAElD,aAAS,OAAO,MAAM,IAAI,GAAG,GAAG,EAAE,KAAK,KAAK;AAAA,EAC9C;AACA,SAAO;AACT;AAKO,SAAS,oBAAoB,KAAoB;AACtD,QAAM,YAAY,IAAI,QAAQ,MAAM,EAAE,YAAY,8BAA8B;AAEhF,YACG,QAAQ,oBAAoB,EAC5B,YAAY,6GAA6G,EACzH;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,gBAAgB,sDAAsD,EAC7E,OAAO,4BAA4B,uBAAuB,uBAAuB,EACjF,OAAO,CAAC,UAAkB,SAA+D;AAExF,UAAM,UAAU,SAAS,YAAY,GAAG;AACxC,UAAM,SAAS,WAAW,IAAI,SAAS,UAAU,GAAG,OAAO,IAAI;AAC/D,UAAM,WAAW,WAAW,IAAI,SAAS,UAAU,UAAU,CAAC,IAAI;AAElE,UAAM,QAAQ,KAAK;AACnB,UAAM,cAAc,KAAK;AAGzB,UAAM,MAAM,KAAK,QAAQ,UAAU,cAAc,eAAe,UAAU,YAAY,aAAa;AACnG,QAAI,IAAI,MAAW,SAAG,EAAE,SAAS,IAAI,KAAK,IAAI,MAAM,GAAG,EAAE,SAAS,IAAI,GAAG;AACvE,cAAQ,OAAO,MAAM;AAAA,CAAkE;AACvF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,8BAAsB,UAAU,QAAQ,UAAU,aAAa,GAAG;AAClE;AAAA,MACF,KAAK;AACH,+BAAuB,UAAU,QAAQ,UAAU,aAAa,GAAG;AACnE;AAAA,MACF,KAAK;AACH,4BAAoB,UAAU,QAAQ,UAAU,aAAa,GAAG;AAChE;AAAA,MACF;AACE,gBAAQ,OAAO,MAAM,yBAAyB,KAAK;AAAA,CAAK;AACxD,gBAAQ,KAAK,CAAC;AAAA,IAClB;AAAA,EACF,CAAC;AACL;AAEA,SAAS,sBACP,UACA,SACA,UACA,aACA,WACM;AACN,UAAQ,oBAAoB,WAAW,MAAS,aAAU,WAAW,EAAE,WAAW,KAAK,CAAC,CAAC;AACzF,QAAM,WAAW,SAAS,QAAQ,OAAO,GAAG,IAAI;AAChD,QAAM,WAAgB,WAAK,WAAW,QAAQ;AAE9C,QAAM,UAAU,WAAW;AAC3B,QAAM,UAAU,eAAe,oBAAoB;AAAA,IACjD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,UAAQ,cAAc,UAAU,MAAS,iBAAc,UAAU,OAAO,CAAC;AACzE,UAAQ,OAAO,MAAM,WAAW,QAAQ;AAAA,CAAI;AAC9C;AAEA,SAAS,uBACP,UACA,QACA,UACA,aACA,WACM;AAEN,QAAM,cAAc,OAAO,MAAM,GAAG;AACpC,QAAM,UAAU,YAAY,SAAS,IAC5B,WAAK,WAAW,GAAG,YAAY,MAAM,GAAG,EAAE,CAAC,IAChD;AACJ,UAAQ,oBAAoB,SAAS,MAAS,aAAU,SAAS,EAAE,WAAW,KAAK,CAAC,CAAC;AAErF,MAAI;AACJ,MAAI,YAAY,SAAS,GAAG;AAC1B,eAAW,YAAY,YAAY,SAAS,CAAC,IAAI;AAAA,EACnD,OAAO;AACL,eAAW,SAAS;AAAA,EACtB;AAEA,MAAI,WAAW,UAAU;AACvB,eAAW,SAAS;AAAA,EACtB;AACA,QAAM,WAAgB,WAAK,SAAS,QAAQ;AAE5C,QAAM,eAAe,SAAS,SAAS,GAAG,IACtC,6BAA6B,YAAY,CAAC,CAAC;AAAA,IAC3C;AAEJ,QAAM,UAAU,eAAe,qBAAqB;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,UAAQ,cAAc,UAAU,MAAS,iBAAc,UAAU,OAAO,CAAC;AACzE,UAAQ,OAAO,MAAM,WAAW,QAAQ;AAAA,CAAI;AAC9C;AAEA,SAAS,oBACP,UACA,QACA,UACA,aACA,WACM;AACN,QAAM,UAAoB,CAAC;AAC3B,UAAQ,oBAAoB,WAAW,MAAS,aAAU,WAAW,EAAE,WAAW,KAAK,CAAC,CAAC;AAEzF,QAAM,WAAgB,WAAK,WAAW,SAAS,QAAQ,OAAO,GAAG,IAAI,eAAe;AACpF,QAAM,SAAS,YAAY,MAAM,IAAI,QAAQ;AAE7C,QAAM,cAAc,eAAe,kBAAkB;AAAA,IACnD;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,UAAQ,cAAc,UAAU,MAAS,iBAAc,UAAU,WAAW,CAAC;AAC7E,UAAQ,KAAK,QAAQ;AACrB,UAAQ,OAAO,MAAM,WAAW,QAAQ;AAAA,CAAI;AAG5C,QAAM,UAAU;AAChB,UAAQ,oBAAoB,SAAS,MAAS,aAAU,SAAS,EAAE,WAAW,KAAK,CAAC,GAAG,OAAO;AAC9F,QAAM,UAAe,WAAK,SAAS,OAAO,QAAQ,OAAO,GAAG,IAAI,KAAK;AACrE,MAAI,CAAI,cAAW,OAAO,GAAG;AAC3B,UAAM,aACJ,mBAAmB,QAAQ;AAAA,QAClB,WAAW;AAAA;AAAA;AAAA;AAAA;AAItB,YAAQ,cAAc,SAAS,MAAS,iBAAc,SAAS,UAAU,GAAG,OAAO;AACnF,YAAQ,OAAO,MAAM,WAAW,OAAO;AAAA,CAAI;AAAA,EAC7C;AACF;AA/NA,IA6BM,oBAgBA,qBAWA;AAxDN;AAAA;AAAA;AAAA;AAOA;AAsBA,IAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgB3B,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAW5B,IAAM,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACrClB,SAAS,WAAW,YAAuD;AAChF,QAAM,WAAW,WAAW,YAAY,CAAC;AACzC,QAAM,UAAW,SAAqC;AACtD,MAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,GAAG;AACrE,WAAO;AAAA,EACT;AACA,QAAM,UAAU,qBAAqB,WAAW,EAAE;AAClD,SAAO,WAAW,CAAC;AACrB;AA3BA;AAAA;AAAA;AAAA;AAKA;AAAA;AAAA;;;ACCA,YAAYC,SAAQ;AACpB,SAAS,qBAAqB;AAC9B,OAAOC,WAAU;AA4EV,SAAS,0BAAgC;AAC9C,MAAI;AAKF,UAAM,cAAc,cAAc,YAAY,GAAG;AACjD,UAAM,EAAE,OAAO,IAAI,YAAY,WAAW;AAC1C,QAAI,OAAO,QAAQ,sBAAsB,YAAY;AACnD,aAAO,kBAAkB;AAAA,QACvB,MAAM;AAAA,QACN,WAAW;AAAA,QACX,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAtGA,IA4Ba,UAwBA,oBAkBP,qBAMA,qBAuCO;AAnHb;AAAA;AAAA;AAAA;AASA;AAmBO,IAAM,WAAoC;AAAA,MAC/C,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,MACjB,4BAA4B;AAAA;AAAA,MAE5B,wBAAwB;AAAA,MACxB,gBAAgB;AAAA,MAChB,mBAAmB;AAAA;AAAA,MAEnB,eAAe;AAAA,MACf,kBAAkB,CAAC;AAAA,MACnB,kBAAkB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,IAKrB;AAQO,IAAM,qBAA8C;AAAA,MACzD,oBAAoB;AAAA,MACpB,cAAc;AAAA,MACd,sBAAsB;AAAA,MACtB,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,UAAU;AAAA,MACV,aAAa;AAAA;AAAA,MAEb,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,QACV,SAAS,CAAC;AAAA,QACV,aAAa;AAAA,MACf;AAAA,IACF;AAGA,IAAM,sBAA8C;AAAA,MAClD,iCAAiC;AAAA,MACjC,2BAA2B;AAAA,MAC3B,mCAAmC;AAAA,MACnC,4BAA4B;AAAA,IAC9B;AACA,IAAM,sBAA8C,OAAO;AAAA,MACzD,OAAO,QAAQ,mBAAmB,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAAA,IAC5D;AAqCO,IAAM,iBAAN,MAAqB;AAAA,MACT;AAAA,MACA;AAAA,MACT,YAA4C;AAAA,MAC5C,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOlB,aAA6C;AAAA,MAErD,YAAY,UAAoC,YAAqB;AACnE,aAAK,WAAW,YAAY,CAAC;AAC7B,aAAK,aAAa,cAAc;AAAA,MAClC;AAAA;AAAA;AAAA;AAAA,MAKA,QAAQ,KAAa,SAAkB,QAA0B;AAW/D,YAAI,YAAY,UAAa,WAAW,KAAK,UAAU;AACrD,gBAAM,QAAQ,KAAK,SAAS,OAAO;AACnC,cAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,mBAAO;AAAA,UACT;AAAA,QACF;AAGA,YAAI,QAAQ;AACV,gBAAM,WAAW,QAAQ,IAAI,MAAM;AACnC,cAAI,aAAa,UAAa,aAAa,IAAI;AAC7C,mBAAO;AAAA,UACT;AAAA,QACF;AAGA,cAAM,YAAY,KAAK,gBAAgB,GAAG;AAC1C,YAAI,cAAc,QAAW;AAC3B,iBAAO;AAAA,QACT;AACA,cAAM,SAAS,oBAAoB,GAAG,KAAK,oBAAoB,GAAG;AAClE,YAAI,QAAQ;AACV,gBAAM,eAAe,KAAK,gBAAgB,MAAM;AAChD,cAAI,iBAAiB,QAAW;AAC9B,mBAAO;AAAA,UACT;AAAA,QACF;AAGA,eAAO,SAAS,GAAG;AAAA,MACrB;AAAA;AAAA;AAAA;AAAA,MAKQ,gBAAgB,KAAsB;AAC5C,YAAI,CAAC,KAAK,iBAAiB;AACzB,eAAK,YAAY,KAAK,eAAe;AACrC,eAAK,kBAAkB;AAAA,QACzB;AACA,YAAI,KAAK,cAAc,MAAM;AAC3B,iBAAO;AAAA,QACT;AACA,eAAO,KAAK,UAAU,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAqBA,cAAc,KAAsB;AAElC,YAAI,CAAC,KAAK,iBAAiB;AACzB,eAAK,YAAY,KAAK,eAAe;AACrC,eAAK,kBAAkB;AAAA,QACzB;AACA,YAAI,KAAK,cAAc,MAAM;AAC3B,iBAAO;AAAA,QACT;AACA,cAAM,QAAQ,IAAI,MAAM,GAAG;AAC3B,YAAI,MAAe,KAAK;AACxB,mBAAW,KAAK,OAAO;AACrB,cACE,OAAO,QACP,OAAO,QAAQ,YACf,CAAC,MAAM,QAAQ,GAAG,KAClB,KAAM,KACN;AACA,kBAAO,IAAgC,CAAC;AAAA,UAC1C,OAAO;AACL,mBAAO;AAAA,UACT;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA,MAKQ,iBAAiD;AACvD,YAAI;AACJ,YAAI;AACF,oBAAa,iBAAa,KAAK,YAAY,OAAO;AAAA,QACpD,SAAS,KAAc;AACrB,cAAI,eAAe,SAAS,UAAU,OAAO,IAAI,SAAS,UAAU;AAClE,mBAAO;AAAA,UACT;AACA;AAAA,YACE,uBAAuB,KAAK,UAAU;AAAA,UACxC;AACA,iBAAO;AAAA,QACT;AAEA,YAAI;AACJ,YAAI;AACF,mBAASA,MAAK,KAAK,OAAO;AAAA,QAC5B,QAAQ;AACN;AAAA,YACE,uBAAuB,KAAK,UAAU;AAAA,UACxC;AACA,iBAAO;AAAA,QACT;AAEA,YAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E;AAAA,YACE,uBAAuB,KAAK,UAAU;AAAA,UACxC;AACA,iBAAO;AAAA,QACT;AAGA,aAAK,aAAa;AAClB,eAAO,KAAK,YAAY,MAAiC;AAAA,MAC3D;AAAA;AAAA;AAAA;AAAA,MAKQ,YACN,GACA,SAAS,IACgB;AACzB,cAAM,SAAkC,CAAC;AACzC,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,CAAC,GAAG;AAC5C,gBAAM,UAAU,SAAS,GAAG,MAAM,IAAI,GAAG,KAAK;AAC9C,cACE,OAAO,UAAU,YACjB,UAAU,QACV,CAAC,MAAM,QAAQ,KAAK,GACpB;AACA,mBAAO;AAAA,cACL;AAAA,cACA,KAAK,YAAY,OAAkC,OAAO;AAAA,YAC5D;AAAA,UACF,OAAO;AACL,mBAAO,OAAO,IAAI;AAAA,UACpB;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;;;ACxSA,SAAS,iBAAiB;AAC1B,SAAS,SAAS,MAAM,cAAc;AAUtC,SAAS,iBAAiB,UAA0B;AAClD,SAAO,MAAM,SAAS,QAAQ,iBAAiB,GAAG;AACpD;AAKA,SAAS,WAAW,GAAmB;AACrC,SAAO,MAAM,EAAE,QAAQ,MAAM,OAAO,IAAI;AAC1C;AAaA,SAAS,0BAA0B,YAA2C;AAC5E,MAAI,CAAC,WAAY,QAAO,CAAC;AACzB,SAAO,WAAW,SACf,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAC7B,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AACxB;AAGA,SAAS,sBAAsB,SAA4B;AACzD,SAAO,QAAQ,SACZ,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAC7B,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AACxB;AAGA,SAAS,eAAe,SAAuC;AAC7D,SAAO,QAAQ,SAAS,KAAK,CAAC,MAAM,EAAE,KAAK,MAAM,OAAO;AAC1D;AAGA,SAAS,YAAY,KAAuB;AAC1C,QAAM,eAAe;AACrB,QAAM,kBAAkB;AACxB,MAAI,OAAO,aAAa,WAAW,WAAY,QAAO,CAAC,CAAC,aAAa,OAAO;AAC5E,SAAO,CAAC,CAAC,gBAAgB;AAC3B;AAEO,SAAS,uBACd,UACA,SACQ;AACR,QAAM,KAAK,iBAAiB,QAAQ;AACpC,QAAM,SAAS,WAAW,QAAQ;AAElC,QAAM,aAAa,UAAU,eAAe,OAAO,IAAI;AACvD,QAAM,eAAe,eAAe,UAAa,CAAC,YAAY,UAAU;AACxE,QAAM,WAAW,UACb,sBAAsB,OAAO,EAAE;AAAA,IAC7B,CAAC,MAAM,MAAM,WAAW;AAAA,EAC1B,IACA,CAAC;AACL,QAAM,YAAY,eAAe,0BAA0B,UAAU,IAAI,CAAC;AAE1E,QAAM,WAAW,SAAS,KAAK,GAAG;AAClC,QAAM,YAAY,UAAU,KAAK,GAAG;AAEpC,MAAI,OACF,GAAG,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAOY,QAAQ;AAAA;AAAA;AAAA;AAAA;AAI3B,MAAI,cAAc;AAChB,YACE;AAAA;AAAA;AAAA,gCAGiC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9C;AACA,UAAQ;AAAA,cAAuB,EAAE,IAAI,MAAM;AAAA;AAC3C,SAAO;AACT;AAEO,SAAS,sBACd,UACA,SACQ;AACR,QAAM,KAAK,iBAAiB,QAAQ;AACpC,QAAM,SAAS,WAAW,QAAQ;AAElC,QAAM,aAAa,UAAU,eAAe,OAAO,IAAI;AACvD,QAAM,eAAe,eAAe,UAAa,CAAC,YAAY,UAAU;AACxE,QAAM,WAAW,UACb,sBAAsB,OAAO,EAAE;AAAA,IAC7B,CAAC,MAAM,MAAM,WAAW;AAAA,EAC1B,IACA,CAAC;AACL,QAAM,YAAY,eAAe,0BAA0B,UAAU,IAAI,CAAC;AAE1E,QAAM,cAAc,SAAS,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI;AACxE,QAAM,eAAe,UAAU,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI;AAE1E,SACE,YAAY,QAAQ;AAAA;AAAA,EAEjB,EAAE;AAAA;AAAA;AAAA,KAGJ,cAAc,cAAc,OAAO,MACpC;AAAA;AAAA;AAAA,KAGC,eAAe,eAAe,OAAO,MACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qCAQsC,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,+CAKE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAO7C,EAAE,IAAI,MAAM;AAAA;AAE3B;AAEO,SAAS,uBACd,UACA,SACQ;AACR,QAAM,SAAS,WAAW,QAAQ;AAElC,QAAM,aAAa,UAAU,eAAe,OAAO,IAAI;AACvD,QAAM,eAAe,eAAe,UAAa,CAAC,YAAY,UAAU;AACxE,QAAM,WAAW,UACb,sBAAsB,OAAO,EAAE;AAAA,IAC7B,CAAC,MAAM,MAAM,WAAW;AAAA,EAC1B,IACA,CAAC;AACL,QAAM,YAAY,eAAe,0BAA0B,UAAU,IAAI,CAAC;AAE1E,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,0BAA0B,QAAQ,EAAE;AAC/C,aAAW,QAAQ,UAAU;AAC3B,UAAM;AAAA,MACJ,eAAe,MAAM,kCAAkC,IAAI,QAAQ,IAAI;AAAA,IACzE;AAAA,EACF;AACA,MAAI,gBAAgB,UAAU,SAAS,GAAG;AACxC,UAAM,KAAK,EAAE;AACb,eAAW,QAAQ,WAAW;AAC5B,YAAM;AAAA,QACJ,eAAe,MAAM,8CAA8C,IAAI,QAAQ,IAAI;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI,IAAI;AAC5B;AAOA,SAAS,WAAW,GAAmB;AACrC,SAAO,EAAE,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK,EAAE,QAAQ,MAAM,OAAO;AAC5E;AAMO,SAAS,oBACd,SACA,UACA,SACA,aACAC,UACQ;AACR,QAAM,OAAO,IAAI,KAAK;AACtB,QAAM,SAAQ,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAClD,QAAM,IAAc,CAAC;AAErB,QAAM,eAAe,eAAe,QAAQ,YAAY,KAAK,GAAG,QAAQ;AAExE,IAAE,KAAK,QAAQ,SAAS,YAAY,CAAC,UAAU,KAAK,MAAM,QAAQ,IAAI,OAAO,MAAM,QAAQ,UAAU;AAErG,IAAE,KAAK,UAAU;AACjB,IAAE,KAAK,GAAG,QAAQ,QAAQ,WAAW,YAAY,CAAC,EAAE;AAEpD,IAAE,KAAK,cAAc;AACrB,IAAE,KAAK,OAAO,QAAQ,6EAA6E;AAEnG,MAAI,cAAc;AAChB,MAAE,KAAK,iBAAiB;AACxB,MAAE,KAAK,WAAW,YAAY,CAAC;AAAA,EACjC;AAGA,QAAM,aAAa,KAAK,eAAe,OAAO,EAC3C,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,WAAW,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,EAAE,KAAK,EAAE,CAAC;AAC7F,MAAI,WAAW,SAAS,GAAG;AACzB,MAAE,KAAK,oBAAoB;AAC3B,eAAW,OAAO,YAAY;AAC5B,YAAM,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAC5D,QAAE,KAAK,KAAK;AACZ,QAAE,KAAK,OAAO,WAAW,IAAI,CAAC,MAAM;AACpC,UAAI,IAAI,YAAa,GAAE,KAAK,WAAW,IAAI,WAAW,CAAC;AAAA,IACzD;AAAA,EACF;AAGA,QAAM,cAAc,KAAK,gBAAgB,OAAO;AAChD,MAAI,YAAY,SAAS,GAAG;AAC1B,MAAE,KAAK,cAAc;AACrB,eAAW,OAAO,aAAa;AAC7B,UAAI,IAAI,KAAK,MAAM,OAAQ;AAE3B,YAAM,OAAO,KAAK,sBAAsB,GAAG;AAC3C,QAAE,KAAK,KAAK;AACZ,QAAE,KAAK,OAAO,QAAQ,IAAI,WAAW,IAAI,KAAK,CAAC,CAAC,MAAM;AACtD,UAAI,KAAM,GAAE,KAAK,WAAW,IAAI,CAAC;AAGjC,YAAM,UAAU,IAAI,KAAK;AACzB,YAAM,OAAO,QAAQ,eAAe,GAAG,EACpC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,SAAS,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,EAAE,KAAK,EAAE,CAAC;AAC/E,iBAAW,OAAO,MAAM;AACtB,cAAM,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAC5D,UAAE,KAAK,KAAK;AACZ,UAAE,KAAK,KAAK;AACZ,UAAE,KAAK,OAAO,WAAW,IAAI,CAAC,MAAM;AACpC,YAAI,IAAI,YAAa,GAAE,KAAK,WAAW,IAAI,WAAW,CAAC;AACvD,UAAE,KAAK,KAAK;AAAA,MACd;AAGA,YAAM,UAAU,QAAQ,gBAAgB,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,MAAM,MAAM;AAC9E,iBAAW,OAAO,SAAS;AACzB,cAAM,UAAU,KAAK,sBAAsB,GAAG;AAC9C,UAAE,KAAK,KAAK;AACZ,UAAE,KAAK,OAAO,QAAQ,IAAI,WAAW,IAAI,KAAK,CAAC,CAAC,IAAI,WAAW,IAAI,KAAK,CAAC,CAAC,MAAM;AAChF,YAAI,QAAS,GAAE,KAAK,WAAW,OAAO,CAAC;AACvC,cAAM,UAAU,QAAQ,eAAe,GAAG,EACvC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,SAAS,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,EAAE,KAAK,EAAE,CAAC;AAC/E,mBAAW,OAAO,SAAS;AACzB,gBAAM,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAC5D,YAAE,KAAK,KAAK;AACZ,YAAE,KAAK,KAAK;AACZ,YAAE,KAAK,OAAO,WAAW,IAAI,CAAC,MAAM;AACpC,cAAI,IAAI,YAAa,GAAE,KAAK,WAAW,IAAI,WAAW,CAAC;AACvD,YAAE,KAAK,KAAK;AAAA,QACd;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,IAAE,KAAK,iBAAiB;AACxB,IAAE,KAAK,KAAK;AACZ,IAAE,KAAK,gCAAgC;AACvC,IAAE,KAAK,0CAA0C;AACjD,IAAE,KAAK,KAAK;AACZ,IAAE,KAAK,iCAAiC;AACxC,IAAE,KAAK,8CAA8C;AACrD,IAAE,KAAK,KAAK;AACZ,IAAE,KAAK,kCAAkC;AACzC,IAAE,KAAK,8DAA8D;AAGrE,IAAE,KAAK,gBAAgB;AACvB,QAAM,YAAgC;AAAA,IACpC,CAAC,KAAK,UAAU;AAAA,IAChB,CAAC,KAAK,yBAAyB;AAAA,IAC/B,CAAC,KAAK,wCAAwC;AAAA,IAC9C,CAAC,MAAM,gDAAgD;AAAA,IACvD,CAAC,MAAM,sCAAsC;AAAA,IAC7C,CAAC,MAAM,+BAA+B;AAAA,IACtC,CAAC,MAAM,sBAAsB;AAAA,IAC7B,CAAC,MAAM,aAAa;AAAA,IACpB,CAAC,OAAO,6BAA6B;AAAA,EACvC;AACA,aAAW,CAAC,MAAM,OAAO,KAAK,WAAW;AACvC,MAAE,KAAK;AAAA,MAAY,IAAI;AAAA,EAAS,OAAO,EAAE;AAAA,EAC3C;AAEA,IAAE,KAAK,cAAc;AACrB,IAAE,KAAK,OAAO,QAAQ,qDAAqD;AAC3E,MAAIA,UAAS;AACX,MAAE,KAAK;AAAA,4BAAkC,WAAWA,QAAO,CAAC,MAAM;AAAA,EACpE;AAEA,SAAO,EAAE,KAAK,IAAI;AACpB;AAUO,SAAS,iBACd,SACA,UACA,SACA,aACAA,UACM;AAEN,QAAM,SAAS,IAAI,OAAO,SAAS,kDAAkD,EAAE,SAAS;AAChG,UAAQ,UAAU,MAAM;AAGxB,UAAQ,YAAY,aAAa,MAAM;AACrC,QAAI,QAAQ,KAAK,EAAE,KAAK;AACtB,YAAM,OAAO,oBAAoB,SAAS,UAAU,SAAS,aAAaA,QAAO,IAAI;AAIrF,UAAI,QAAQ,OAAO,OAAO;AAExB,cAAM,SAAiD;AAAA,UACrD,EAAE,KAAK,UAAU,MAAM,CAAC,IAAI,EAAE;AAAA,UAC9B,EAAE,KAAK,SAAU,MAAM,CAAC,QAAQ,QAAQ,EAAE;AAAA,QAC5C;AACA,YAAI,WAAW;AACf,mBAAW,EAAE,KAAK,KAAK,KAAK,QAAQ;AAClC,gBAAM,SAAS,UAAU,KAAK,MAAM;AAAA,YAClC,OAAO;AAAA,YACP,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,YAC9B,UAAU;AAAA,UACZ,CAAC;AACD,cAAI,OAAO,WAAW,KAAK,OAAO,QAAQ;AACxC,kBAAM,QAAQ,QAAQ,IAAI,SAAS;AACnC,kBAAM,cAAc,UAAU,OAAO,CAAC,IAAI,GAAG;AAAA,cAC3C,OAAO,OAAO;AAAA,cACd,OAAO,CAAC,QAAQ,WAAW,SAAS;AAAA,YACtC,CAAC;AACD,gBAAI,YAAY,WAAW,MAAM;AAC/B,yBAAW;AACX;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,UAAU;AACb,kBAAQ,OAAO,MAAM,IAAI;AAAA,QAC3B;AAAA,MACF,OAAO;AACL,gBAAQ,OAAO,MAAM,IAAI;AAAA,MAC3B;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAUA,SAAS,gBAAgB,MAAwB;AAC/C,MAAI,MAAe;AACnB,SAAO,IAAI,OAAQ,OAAM,IAAI;AAC7B,SAAO;AACT;AAUO,SAAS,0BAA0B,MAAqB;AAC7D,QAAM,gBAAgB,IAAI,QAAQ,YAAY,EAC3C,YAAY,4DAA4D,EACxE,SAAS,WAAW,gCAAgC,EACpD,OAAO,CAAC,UAAkB;AACzB,UAAM,cAAc,CAAC,QAAQ,OAAO,MAAM;AAC1C,QAAI,CAAC,YAAY,SAAS,KAAK,GAAG;AAChC,cAAQ,OAAO;AAAA,QACb,yBAAyB,KAAK;AAAA;AAAA,MAChC;AACA,cAAQ,KAAK,WAAW,iBAAiB;AAAA,IAC3C;AAEA,UAAM,OAAO,gBAAgB,IAAI;AACjC,UAAM,WAAW,KAAK,KAAK,KAAK;AAChC,UAAM,aAA2C;AAAA,MAC/C,MAAM,MAAM,uBAAuB,UAAU,IAAI;AAAA,MACjD,KAAK,MAAM,sBAAsB,UAAU,IAAI;AAAA,MAC/C,MAAM,MAAM,uBAAuB,UAAU,IAAI;AAAA,IACnD;AACA,YAAQ,OAAO,MAAM,WAAW,KAAK,EAAE,CAAC;AAAA,EAC1C,CAAC;AACH,OAAK,WAAW,aAAa;AAC/B;AA3bA;AAAA;AAAA;AAAA;AAQA;AAAA;AAAA;;;ACRA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,YAAY,YAAY;AACxB,YAAYC,SAAQ;AACpB,YAAY,QAAQ;AACpB,YAAYC,WAAU;AAgCf,SAAS,eAAe,aAAuC;AACpE,iBAAe;AACjB;AAKO,SAAS,iBAAqC;AACnD,SAAO;AACT;AAYO,SAAS,oBAAoB,OAAyB;AAC3D,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,mBAAmB;AAC9D,QAAM,MAAM;AACZ,QAAM,SAAkC,CAAC;AACzC,aAAW,OAAO,OAAO,KAAK,GAAG,EAAE,KAAK,GAAG;AACzC,WAAO,GAAG,IAAI,oBAAoB,IAAI,GAAG,CAAC;AAAA,EAC5C;AACA,SAAO;AACT;AAvEA,IAoCI,cAqCS;AAzEb;AAAA;AAAA;AAAA;AAUA;AA0BA,IAAI,eAAmC;AAqChC,IAAM,cAAN,MAAM,aAAY;AAAA,MACvB,OAAgB,eAAoB;AAAA,QAC/B,WAAQ;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,MAEiB;AAAA,MACT,qBAAqB;AAAA,MAE7B,YAAYA,OAAe;AACzB,aAAK,UAAUA,SAAQ,aAAY;AACnC,aAAK,gBAAgB;AAAA,MACvB;AAAA,MAEQ,kBAAwB;AAC9B,cAAM,MAAW,cAAQ,KAAK,OAAO;AACrC,YAAI;AACF,UAAG,cAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAGrC,cAAI;AAAE,YAAG,cAAU,KAAK,GAAK;AAAA,UAAG,QAAQ;AAAA,UAAoB;AAAA,QAC9D,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,MAEA,aACE,UACA,WACA,QACA,UACA,YACM;AACN,cAAM,QAAoB;AAAA,UACxB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,UAClC,MAAM,KAAK,QAAQ;AAAA,UACnB,WAAW;AAAA,UACX,YAAY,KAAK,UAAU,SAAS;AAAA,UACpC;AAAA,UACA,WAAW;AAAA,UACX,aAAa;AAAA,QACf;AACA,YAAI;AACF,UAAG,mBAAe,KAAK,SAAS,KAAK,UAAU,KAAK,IAAI,IAAI;AAE5D,cAAI;AAAE,YAAG,cAAU,KAAK,SAAS,GAAK;AAAA,UAAG,QAAQ;AAAA,UAAoB;AAAA,QACvE,SAAS,KAAK;AACZ,cAAI,CAAC,KAAK,oBAAoB;AAC5B,iBAAK,qBAAqB;AAC1B,iBAAQ,8BAA8B,GAAG,EAAE;AAAA,UAC7C;AAAA,QACF;AAAA,MACF;AAAA,MAEQ,UAAU,WAA4C;AAC5D,cAAM,OAAc,mBAAY,EAAE;AAClC,cAAM,UAAU,KAAK,UAAU,oBAAoB,SAAS,CAAC;AAC7D,eACG,kBAAW,QAAQ,EACnB,OAAO,OAAO,OAAO,CAAC,MAAM,OAAO,KAAK,SAAS,OAAO,CAAC,CAAC,CAAC,EAC3D,OAAO,KAAK;AAAA,MACjB;AAAA,MAEQ,UAAkB;AACxB,YAAI;AACF,iBAAU,YAAS,EAAE;AAAA,QACvB,QAAQ;AAKN,iBACE,QAAQ,IAAI,QACZ,QAAQ,IAAI,WACZ,QAAQ,IAAI,YACZ;AAAA,QAEJ;AAAA,MACF;AAAA,IACF;AAAA;AAAA;;;ACxIA,YAAYC,SAAQ;AACpB,YAAYC,SAAQ;AACpB,YAAYC,WAAU;AA8Bf,SAAS,eACd,UAAoE,CAAC,GAC1C;AAC3B,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,SAAsB,QAAQ,UAAU;AAC9C,QAAM,UAAU,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ,IAAI,aAAa,MAAM;AAE1E,MAAI,CAAI,eAAW,SAAS,GAAG;AAC7B,WAAO,oBAAI,IAAI;AAAA,EACjB;AAEA,MAAI;AACJ,MAAI;AACF,UAAS,iBAAa,WAAW,OAAO;AAAA,EAC1C,QAAQ;AACN,WAAO,oBAAI,IAAI;AAAA,EACjB;AAEA,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,aAAa,oBAAI,IAAoB;AAE3C,aAAW,QAAQ,IAAI,MAAM,IAAI,GAAG;AAClC,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,CAAC,QAAS;AACd,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,OAAO;AAAA,IAC5B,QAAQ;AAGN;AAAA,IACF;AACA,UAAM,KAAK,OAAO,MAAM,cAAc,WAClC,KAAK,MAAM,MAAM,SAAS,IAC1B;AACJ,QAAI,OAAO,MAAM,EAAE,KAAK,KAAK,OAAQ;AACrC,UAAM,WAAW,OAAO,MAAM,cAAc,WAAW,MAAM,YAAY;AACzE,QAAI,CAAC,SAAU;AACf,WAAO,IAAI,WAAW,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAC;AACpD,QAAI,MAAM,WAAW,SAAS;AAC5B,aAAO,IAAI,WAAW,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAC;AAAA,IACtD;AACA,UAAM,WAAW,MAAM;AACvB,QAAI,OAAO,aAAa,UAAU;AAChC,iBAAW,IAAI,WAAW,WAAW,IAAI,QAAQ,KAAK,KAAK,QAAQ;AAAA,IACrE;AAAA,EACF;AAEA,QAAM,MAAM,oBAAI,IAA0B;AAC1C,aAAW,CAAC,IAAI,KAAK,KAAK,QAAQ;AAChC,QAAI,IAAI,IAAI;AAAA,MACV,WAAW;AAAA,MACX;AAAA,MACA,QAAQ,OAAO,IAAI,EAAE,KAAK;AAAA,MAC1B,YAAY,QAAQ,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,QAAQ;AAAA,IAC9D,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAWO,SAAS,mBACd,SACA,OACA,UAA2E,CAAC,GACzD;AACnB,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,UAAU,eAAe;AAAA,IAC7B,WAAW,QAAQ;AAAA,IACnB,QAAQ,QAAQ;AAAA,EAClB,CAAC;AAED,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ,KAAK,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,aAAa,IAAI,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAC3F,QAAI,QAAS,SAAQ,QAAQ;AAC7B,WAAO,EAAE,MAAM,MAAM;AAAA,EACvB;AAEA,QAAM,MAAM,CAAC,MAAiB;AAC5B,UAAM,KAAK,EAAE,MAAM,EAAE,aAAa;AAClC,UAAM,IAAI,QAAQ,IAAI,EAAE;AACxB,QAAI,CAAC,EAAG,QAAO;AACf,WAAO,UAAU,YAAY,EAAE,aAAc,UAAU,UAAU,EAAE,QAAQ,EAAE;AAAA,EAC/E;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM;AACrB,UAAM,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC;AAC3B,QAAI,SAAS,EAAG,QAAO,UAAU,CAAC,OAAO;AAEzC,YAAQ,EAAE,MAAM,EAAE,aAAa,IAAI,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE;AAAA,EAC5E,CAAC;AACD,SAAO,EAAE,MAAM,KAAK;AACtB;AAtJA,IA8BM,cAOA;AArCN;AAAA;AAAA;AAAA;AA8BA,IAAM,eAA4C;AAAA,MAChD,MAAM,KAAK,KAAK;AAAA,MAChB,OAAO,KAAK,KAAK,KAAK;AAAA,MACtB,MAAM,IAAI,KAAK,KAAK,KAAK;AAAA,MACzB,OAAO,KAAK,KAAK,KAAK,KAAK;AAAA,IAC7B;AAEA,IAAM,qBAA0B;AAAA,MAC3B,YAAQ;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA;AAAA;;;ACnCA,YAAYC,aAAY;AACxB,YAAYC,SAAQ;AAepB,eAAe,YAA0B;AACvC,MAAI,aAAc,QAAO;AACzB,MAAI;AAEF,mBAAe,MAAM,OAAO,QAAQ;AACpC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA/BA,IAYM,mBAGA,gBAMF,cAmCS;AAxDb;AAAA;AAAA;AAAA;AAQA;AACA;AAGA,IAAM,oBAAoB;AAG1B,IAAM,iBAAiB,OAAO,KAAK,sBAAsB;AAMzD,IAAI,eAAoB;AAmCjB,IAAM,kBAAN,MAAM,iBAAgB;AAAA,MAC3B,OAAgB,eAAe;AAAA;AAAA;AAAA,MAG/B,OAAe,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAgBpC,MAAM,MAAM,KAAa,OAAgC;AACvD,cAAM,SAAS,MAAM,UAAU;AAC/B,YAAI,QAAQ;AACV,cAAI;AACF,kBAAM,OAAO,YAAY,iBAAgB,cAAc,KAAK,KAAK;AACjE,mBAAO,WAAW,GAAG;AAAA,UACvB,SAAS,KAAK;AAKZ,kBAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC9D,kBAAM,IAAI;AAAA,cACR,oBAAoB,GAAG,oBAAoB,MAAM;AAAA,YAEnD;AAAA,UACF;AAAA,QACF;AACA,aAAQ,sDAAsD;AAC9D,cAAM,aAAa,KAAK,WAAW,KAAK;AACxC,eAAO,UAAU,WAAW,SAAS,QAAQ,CAAC;AAAA,MAChD;AAAA;AAAA;AAAA;AAAA,MAKA,MAAM,SAAS,aAAqB,KAA8B;AAChE,YAAI,YAAY,WAAW,UAAU,GAAG;AACtC,gBAAM,SAAS,MAAM,UAAU;AAC/B,cAAI,CAAC,QAAQ;AACX,kBAAM,IAAI;AAAA,cACR,6CAA6C,GAAG;AAAA,YAClD;AAAA,UACF;AACA,cAAI;AACF,kBAAM,SAAS,YAAY,MAAM,WAAW,MAAM;AAClD,kBAAM,SAAS,MAAM,OAAO;AAAA,cAC1B,iBAAgB;AAAA,cAChB;AAAA,YACF;AACA,gBAAI,WAAW,QAAQ,WAAW,QAAW;AAC3C,oBAAM,IAAI;AAAA,gBACR,gCAAgC,MAAM;AAAA,cACxC;AAAA,YACF;AACA,mBAAO;AAAA,UACT,SAAS,KAAK;AACZ,gBAAI,eAAe,sBAAuB,OAAM;AAChD,kBAAM,IAAI;AAAA,cACR,oCAAoC,GAAG;AAAA,YACzC;AAAA,UACF;AAAA,QACF;AAEA,YAAI,YAAY,WAAW,SAAS,GAAG;AACrC,gBAAM,OAAO,OAAO,KAAK,YAAY,MAAM,UAAU,MAAM,GAAG,QAAQ;AACtE,cAAI;AACF,mBAAO,KAAK,WAAW,IAAI;AAAA,UAC7B,QAAQ;AACN,kBAAM,IAAI;AAAA,cACR,0CAA0C,GAAG,+CAA+C,GAAG;AAAA,YACjG;AAAA,UACF;AAAA,QACF;AAEA,YAAI,YAAY,WAAW,MAAM,GAAG;AAClC,gBAAM,OAAO,OAAO,KAAK,YAAY,MAAM,OAAO,MAAM,GAAG,QAAQ;AACnE,cAAI;AACF,mBAAO,KAAK,aAAa,IAAI;AAAA,UAC/B,QAAQ;AACN,kBAAM,IAAI;AAAA,cACR,0CAA0C,GAAG,+CAA+C,GAAG;AAAA,YACjG;AAAA,UACF;AAAA,QACF;AAGA,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYQ,UAAU,MAAsB;AACtC,cAAM,aAAa,QAAQ,IAAI;AAC/B,YAAI,cAAc,WAAW,SAAS,GAAG;AACvC,iBAAc,mBAAW,YAAY,MAAM,mBAAmB,IAAI,QAAQ;AAAA,QAC5E;AACA,YAAI,CAAC,iBAAgB,oBAAoB;AACvC;AAAA,YACE;AAAA,UAKF;AACA,2BAAgB,qBAAqB;AAAA,QACvC;AACA,cAAMC,YAAc,aAAS;AAC7B,cAAM,WAAW,QAAQ,IAAI,QAAQ,QAAQ,IAAI,YAAY;AAC7D,cAAM,WAAW,GAAGA,SAAQ,IAAI,QAAQ;AACxC,eAAc,mBAAW,UAAU,MAAM,mBAAmB,IAAI,QAAQ;AAAA,MAC1E;AAAA,MAEQ,WAAW,WAA2B;AAC5C,cAAM,OAAc,oBAAY,EAAE;AAClC,cAAM,MAAM,KAAK,UAAU,IAAI;AAC/B,cAAM,QAAe,oBAAY,EAAE;AACnC,cAAM,SAAgB,uBAAe,eAAe,KAAK,KAAK;AAC9D,cAAM,KAAK,OAAO,OAAO;AAAA,UACvB,OAAO,OAAO,WAAW,OAAO;AAAA,UAChC,OAAO,MAAM;AAAA,QACf,CAAC;AACD,cAAM,MAAM,OAAO,WAAW;AAE9B,eAAO,OAAO,OAAO,CAAC,MAAM,OAAO,KAAK,EAAE,CAAC;AAAA,MAC7C;AAAA,MAEQ,WAAW,MAAsB;AACvC,cAAM,OAAO,KAAK,SAAS,GAAG,EAAE;AAChC,cAAM,QAAQ,KAAK,SAAS,IAAI,EAAE;AAClC,cAAM,MAAM,KAAK,SAAS,IAAI,EAAE;AAChC,cAAM,KAAK,KAAK,SAAS,EAAE;AAC3B,cAAM,MAAM,KAAK,UAAU,IAAI;AAC/B,cAAM,WAAkB,yBAAiB,eAAe,KAAK,KAAK;AAClE,iBAAS,WAAW,GAAG;AACvB,eAAO,OAAO,OAAO,CAAC,SAAS,OAAO,EAAE,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE,SAAS,OAAO;AAAA,MAChF;AAAA;AAAA,MAGQ,aAAa,MAAsB;AACzC,cAAM,QAAQ,KAAK,SAAS,GAAG,EAAE;AACjC,cAAM,MAAM,KAAK,SAAS,IAAI,EAAE;AAChC,cAAM,KAAK,KAAK,SAAS,EAAE;AAC3B,cAAMA,YAAc,aAAS;AAC7B,cAAM,WAAW,QAAQ,IAAI,QAAQ,QAAQ,IAAI,YAAY;AAC7D,cAAM,aAAa,QAAQ,IAAI;AAC/B,cAAM,YAAsB,aACxB,CAAC,YAAY,GAAGA,SAAQ,IAAI,QAAQ,EAAE,IACtC,CAAC,GAAGA,SAAQ,IAAI,QAAQ,EAAE;AAE9B,mBAAW,YAAY,WAAW;AAChC,qBAAW,cAAc,CAAC,KAAS,GAAO,GAAG;AAC3C,gBAAI;AACF,oBAAM,MAAa,mBAAW,UAAU,gBAAgB,YAAY,IAAI,QAAQ;AAChF,oBAAM,WAAkB,yBAAiB,eAAe,KAAK,KAAK;AAClE,uBAAS,WAAW,GAAG;AACvB,qBAAO,OAAO,OAAO,CAAC,SAAS,OAAO,EAAE,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE,SAAS,OAAO;AAAA,YAChF,QAAQ;AAAA,YAER;AAAA,UACF;AAAA,QACF;AACA,cAAM,IAAI,MAAM,+DAA+D;AAAA,MACjF;AAAA,IACF;AAAA;AAAA;;;AC9OA,IAiBa;AAjBb;AAAA;AAAA;AAAA;AAOA;AACA;AASO,IAAM,eAAN,MAAmB;AAAA,MACP;AAAA,MACA;AAAA,MAEjB,YAAY,QAAwB,WAA6B;AAC/D,aAAK,SAAS;AACd,aAAK,YAAY,aAAa,IAAI,gBAAgB;AAAA,MACpD;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,MAAM,YAAoC;AACxC,cAAM,SAAS,KAAK,OAAO;AAAA,UACzB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,YAAI,WAAW,QAAQ,WAAW,QAAW;AAC3C,iBAAO;AAAA,QACT;AACA,cAAM,YAAY,OAAO,MAAM;AAC/B,YAAI,UAAU,WAAW,UAAU,KAAK,UAAU,WAAW,MAAM,GAAG;AACpE,cAAI;AACF,mBAAO,MAAM,KAAK,UAAU,SAAS,WAAW,cAAc;AAAA,UAChE,SAAS,KAAK;AACZ,gBAAI,eAAe,uBAAuB;AACxC,oBAAM,IAAI;AAAA,gBACR;AAAA,cAEF;AAAA,YACF;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAcA,MAAM,oBACJ,SACiC;AACjC,cAAM,MAAM,MAAM,KAAK,UAAU;AACjC,YAAI,CAAC,KAAK;AACR,gBAAM,IAAI;AAAA,YACR;AAAA,UAEF;AAAA,QACF;AAGA,YAAI,SAAS,KAAK,GAAG,GAAG;AACtB,gBAAM,IAAI;AAAA,YACR;AAAA,UAEF;AAAA,QACF;AACA,gBAAQ,gBAAgB,UAAU,IAAI,KAAK,CAAC;AAC5C,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA,MAKA,eAAe,YAA0B;AACvC,YAAI,eAAe,OAAO,eAAe,KAAK;AAC5C,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA;AAAA;;;ACpGA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA;AACA;AACA;AACA;AAAA;AAAA;;;ACAA,SAAS,WAAAC,UAAS,UAAAC,eAAc;AAkBhC,SAAS,YAAY,KAAmB;AACtC,MAAI,CAAC,YAAY,KAAK,GAAG,GAAG;AAC1B,YAAQ,OAAO;AAAA,MACb,+BAA+B,GAAG;AAAA;AAAA,IACpC;AACA,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AACF;AAKA,SAAS,WAAW,OAAe,UAA8B;AAC/D,SAAO,SAAS,OAAO,CAAC,KAAK,CAAC;AAChC;AAKA,SAAS,kBAAkB,OAAe,UAA8B;AACtE,SAAO,SAAS,OAAO,CAAC,KAAK,CAAC;AAChC;AAKA,SAAS,kBAAkB,WAA6B,MAAuB;AAC7E,QAAM,cAAc,UAAU;AAC9B,MAAI,CAAC,eAAe,OAAO,gBAAgB,SAAU,QAAO;AAC5D,QAAM,MAAM;AAKZ,QAAM,MAA8B;AAAA,IAClC,eAAe;AAAA,IACf,qBAAqB;AAAA,IACrB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,cAAc;AAAA,IACd,aAAa;AAAA,EACf;AACA,QAAM,OAAO,IAAI,IAAI,KAAK;AAC1B,SAAO,IAAI,IAAI,MAAM;AACvB;AAKO,SAAS,oBACd,YACA,UACA,gBACM;AACN,QAAM,UAAU,IAAID,SAAQ,MAAM,EAC/B,YAAY,yCAAyC,EACrD,OAAO,eAAe,kDAAkD,YAAY,CAAC,CAAC,EACtF,OAAO,UAAU,iCAAiC,KAAK,EACvD;AAAA,IACC,IAAIC,QAAO,qBAAqB,gBAAgB,EAC7C,QAAQ,CAAC,SAAS,QAAQ,OAAO,QAAQ,SAAS,YAAY,OAAO,CAAC;AAAA,EAC3E,EACC,OAAO,wBAAwB,kDAAkD,EACjF;AAAA,IACC,IAAIA,QAAO,qBAAqB,0BAA0B,EACvD,QAAQ,CAAC,WAAW,YAAY,KAAK,CAAC,EACtC,QAAQ,SAAS;AAAA,EACtB,EACC,OAAO,2BAA2B,sDAAsD,mBAAmB,CAAC,CAAC,EAC7G;AAAA,IACC,IAAIA,QAAO,kBAAkB,aAAa,EACvC,QAAQ,CAAC,MAAM,SAAS,UAAU,SAAS,CAAC,EAC5C,QAAQ,IAAI;AAAA,EACjB,EACC,OAAO,aAAa,uBAAuB,KAAK,EAChD,OAAO,gBAAgB,+BAA+B,KAAK,EAC3D,OAAO,UAAU,iCAAiC,KAAK,EACvD;AAAA,IACC,IAAIA,QAAO,qBAAqB,4BAA4B,EACzD,QAAQ,CAAC,WAAW,UAAU,KAAK,CAAC,EACpC,QAAQ,SAAS;AAAA,EACtB,EACC,OAAO,CAAC,SAYH;AAEJ,eAAW,KAAK,KAAK,KAAK;AACxB,kBAAY,CAAC;AAAA,IACf;AAEA,QAAI,UAA8B,CAAC;AACnC,eAAW,KAAK,SAAS,YAAY,GAAG;AACtC,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,QAAI,KAAK,IAAI,SAAS,GAAG;AACvB,YAAM,aAAa,IAAI,IAAI,KAAK,GAAG;AACnC,gBAAU,QAAQ,OAAO,CAAC,MAAM;AAC9B,cAAM,QAAQ,EAAE,QAAQ,CAAC;AACzB,eAAO,CAAC,GAAG,UAAU,EAAE,MAAM,CAAC,MAAM,MAAM,SAAS,CAAC,CAAC;AAAA,MACvD,CAAC;AAAA,IACH;AAGA,QAAI,KAAK,QAAQ;AACf,YAAM,QAAQ,KAAK,OAAO,YAAY;AACtC,gBAAU,QAAQ;AAAA,QAChB,CAAC,OACE,EAAE,MAAM,IAAI,YAAY,EAAE,SAAS,KAAK,MACxC,EAAE,eAAe,IAAI,YAAY,EAAE,SAAS,KAAK;AAAA,MACtD;AAAA,IACF;AAGA,QAAI,KAAK,WAAW,WAAW;AAC7B,gBAAU,QAAQ,OAAO,CAAC,MAAM;AAC9B,cAAM,UAAW,EAAyC;AAC1D,eAAO,YAAY;AAAA,MACrB,CAAC;AAAA,IACH,WAAW,KAAK,WAAW,YAAY;AACrC,gBAAU,QAAQ,OAAO,CAAC,MAAM;AAC9B,cAAM,UAAW,EAAyC;AAC1D,eAAO,YAAY;AAAA,MACrB,CAAC;AAAA,IACH;AAIA,QAAI,CAAC,KAAK,YAAY;AACpB,gBAAU,QAAQ,OAAO,CAAC,MAAM;AAC9B,cAAM,aAAc,EAAyC;AAC7D,eAAO,eAAe;AAAA,MACxB,CAAC;AAAA,IACH;AAGA,QAAI,KAAK,WAAW,SAAS,GAAG;AAC9B,iBAAW,WAAW,KAAK,YAAY;AACrC,kBAAU,QAAQ,OAAO,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAAA,MAC/D;AAAA,IACF;AAKA,QAAI,KAAK,SAAS,WAAW,KAAK,SAAS,YAAY,KAAK,SAAS,WAAW;AAC9E,YAAM,EAAE,KAAK,IAAI,mBAAmB,SAAS,KAAK,MAAM,EAAE,SAAS,CAAC,KAAK,QAAQ,CAAC;AAClF,UAAI,CAAC,MAAM;AACT,gBAAQ,OAAO;AAAA,UACb,4CAA4C,KAAK,IAAI;AAAA;AAAA,QAEvD;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,KAAK,CAAC,GAAG,OAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,EAAE,CAAC;AAC7D,UAAI,KAAK,SAAS;AAChB,gBAAQ,QAAQ;AAAA,MAClB;AAAA,IACF;AAGA,QAAI,kBAAkB;AACtB,QAAI,kBAAkB,KAAK,aAAa,OAAO;AAC7C,UAAI,KAAK,aAAa,WAAW;AAC/B,kBAAU,QAAQ,OAAO,CAAC,MAAM,eAAe,UAAU,EAAE,MAAM,EAAE,CAAC;AAAA,MACtE,WAAW,KAAK,aAAa,UAAU;AACrC,kBAAU,QAAQ,OAAO,CAAC,MAAM,CAAC,eAAe,UAAU,EAAE,MAAM,EAAE,CAAC;AAAA,MACvE;AAAA,IACF;AACA,QAAI,KAAK,aAAa,SAAS,gBAAgB;AAC7C,wBAAkB;AAAA,IACpB;AAEA,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,UAAM,gBAAgB,KAAK,IAAI,SAAS,IAAI,KAAK,MAAM;AACvD,SAAK,iBAAiB,SAAS,KAAK,eAAe,KAAK,MAAM,kBAAkB,iBAAiB,MAAS;AAAA,EAC5G,CAAC;AACH,aAAW,WAAW,OAAO;AAC/B;AAKO,SAAS,wBACd,YACA,UACM;AACN,QAAM,cAAc,IAAID,SAAQ,UAAU,EACvC,YAAY,sDAAsD,EAClE,SAAS,eAAe,uBAAuB,EAC/C;AAAA,IACC,IAAIC,QAAO,qBAAqB,gBAAgB,EAC7C,QAAQ,CAAC,SAAS,QAAQ,OAAO,QAAQ,SAAS,YAAY,OAAO,CAAC;AAAA,EAC3E,EACC,OAAO,CAAC,UAAkB,SAA8B;AACvD,qBAAiB,QAAQ;AAEzB,UAAM,YAAY,SAAS,UAAU,QAAQ;AAC7C,QAAI,CAAC,WAAW;AACd,cAAQ,OAAO;AAAA,QACb,kBAAkB,QAAQ;AAAA;AAAA,MAC5B;AACA,cAAQ,KAAK,WAAW,gBAAgB;AAAA,IAC1C;AAEA,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,SAAK,mBAAmB,WAAW,GAAG;AAAA,EACxC,CAAC;AACH,aAAW,WAAW,WAAW;AACnC;AAWO,SAAS,oBACd,YACA,UACA,UACM;AACN,QAAM,UAAU,IAAID,SAAQ,MAAM,EAC/B,YAAY,yCAAyC,EACrD,SAAS,eAAe,sBAAsB,EAC9C,OAAO,qBAAqB,gDAAgD,EAC5E,OAAO,qBAAqB,sDAAsD,EAClF;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,aAAa,0DAA0D,KAAK,EACnF;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,aAAa,6DAA6D,KAAK,EACtF,OAAO,qBAAqB,4DAA4D,EACxF,OAAO,WAAW,iCAAiC,KAAK,EACxD,OAAO,aAAa,iDAAiD,KAAK,EAC1E,OAAO,YAAY,gDAAgD,KAAK,EACxE,OAAO,OACN,UACA,SAYG;AACH,qBAAiB,QAAQ;AAEzB,UAAM,YAAY,SAAS,UAAU,QAAQ;AAC7C,QAAI,CAAC,WAAW;AACd,cAAQ,OAAO,MAAM,kBAAkB,QAAQ;AAAA,CAAgB;AAC/D,cAAQ,KAAK,WAAW,gBAAgB;AAAA,IAC1C;AAKA,QAAI,SAAkC,CAAC;AACvC,QAAI,KAAK,UAAU,KAAK;AACtB,eAAS,MAAM,aAAa,KAAK,CAAC,GAAG,KAAK;AAAA,IAC5C,WAAW,KAAK,UAAU,QAAW;AACnC,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,KAAK,KAAK;AACpC,YAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,kBAAQ,OAAO,MAAM,0CAA0C;AAC/D,kBAAQ,KAAK,WAAW,iBAAiB;AAAA,QAC3C;AACA,iBAAS;AAAA,MACX,SAAS,KAAK;AACZ,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,gBAAQ,OAAO,MAAM,qCAAqC,GAAG;AAAA,CAAI;AACjE,gBAAQ,KAAK,WAAW,iBAAiB;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,YAAY,YAAY,IAAI;AAClC,QAAI;AACF,YAAM,cAAc,WAAW,KAAK,KAAK,KAAK,eAAe;AAG7D,UAAI,KAAK,QAAQ;AACf,YAAI,SAAS,UAAU;AACrB,gBAAM,YAAY,MAAM,SAAS,SAAS,UAAU,MAAM;AAC1D,gCAAsB,WAAW,KAAK,MAAM;AAAA,QAC9C,OAAO;AACL,kBAAQ,OAAO,MAAM,KAAK,UAAU,EAAE,OAAO,KAAK,CAAC,IAAI,IAAI;AAAA,QAC7D;AACA;AAAA,MACF;AAEA,UAAI;AACJ,UAAI,KAAK,YAAY,SAAS,eAAe;AAC3C,cAAM,CAAC,GAAG,IAAI,MAAM,SAAS,cAAc,UAAU,QAAQ,EAAE,UAAU,KAAK,SAAS,CAAC;AACxF,iBAAS;AAAA,MACX,OAAO;AACL,cAAM,EAAE,SAAAE,SAAQ,IAAI,MAAM;AAC1B,cAAM,UAAU,IAAIA,SAAQ,KAAK,OAAO;AACxC,iBAAS,MAAM,QAAQ,QAAQ,UAAU,QAAQ,QAAQ;AAAA,MAC3D;AACA,YAAM,aAAa,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;AAG3D,YAAM,MAAM,cAAc,KAAK,MAAM;AACrC,uBAAiB,QAAQ,KAAK,KAAK,MAAM;AAGzC,YAAM,cAAc,eAAe;AACnC,UAAI,aAAa;AACf,oBAAY,aAAa,UAAU,QAAQ,WAAW,GAAG,UAAU;AAAA,MACrE;AAAA,IACF,SAAS,KAAc;AACrB,YAAM,WAAW,iBAAiB,GAAG;AACrC,YAAM,aAAa,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;AAC3D,UAAI;AACF,cAAM,cAAc,eAAe;AACnC,YAAI,aAAa;AACf,sBAAY,aAAa,UAAU,QAAQ,SAAS,UAAU,UAAU;AAAA,QAC1E;AAAA,MACF,QAAQ;AAAA,MAER;AACA,cAAQ,OAAO,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,GAAG;AAAA,CAAI;AAC3E,cAAQ,KAAK,QAAQ;AAAA,IACvB;AAAA,EACF,CAAC;AACH,aAAW,WAAW,OAAO;AAC/B;AAKO,SAAS,wBACd,KACA,UACA,UACM;AACN,QAAM,cAAc,IAAIF,SAAQ,UAAU,EACvC,YAAY,kDAAkD,EAC9D,SAAS,eAAe,uBAAuB,EAC/C,OAAO,oBAAoB,mCAAmC,EAC9D,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OAAO,UAAkB,SAA8C;AAC7E,qBAAiB,QAAQ;AAEzB,UAAM,YAAY,SAAS,UAAU,QAAQ;AAC7C,QAAI,CAAC,WAAW;AACd,cAAQ,OAAO,MAAM,kBAAkB,QAAQ;AAAA,CAAgB;AAC/D,cAAQ,KAAK,WAAW,gBAAgB;AAAA,IAC1C;AAEA,UAAM,SAAS,KAAK,QAAQ,MAAM,aAAa,KAAK,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;AAEzE,QAAI,CAAC,SAAS,UAAU;AACtB,cAAQ,OAAO,MAAM,8CAA8C;AACnE,cAAQ,KAAK,WAAW,oBAAoB;AAAA,IAC9C;AAKA,QAAI;AACF,YAAM,YAAY,MAAM,SAAS,SAAS,UAAU,MAAM;AAC1D,4BAAsB,WAAW,KAAK,MAAM;AAC5C,cAAQ,KAAK,UAAU,QAAQ,IAAI,oBAAoB,SAAS,CAAC;AAAA,IACnE,SAAS,KAAc;AACrB,YAAM,WAAW,iBAAiB,GAAG;AACrC,UAAI;AACF,cAAM,cAAc,eAAe;AACnC,YAAI,aAAa;AACf,sBAAY,aAAa,UAAU,QAAQ,SAAS,UAAU,CAAC;AAAA,QACjE;AAAA,MACF,QAAQ;AAAA,MAER;AACA,cAAQ,OAAO,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,GAAG;AAAA,CAAI;AAC3E,cAAQ,KAAK,QAAQ;AAAA,IACvB;AAAA,EACF,CAAC;AACH,MAAI,WAAW,WAAW;AAC5B;AAhbA,IAyBM;AAzBN;AAAA;AAAA;AAAA;AAUA;AAEA;AACA;AACA;AAQA;AACA;AAEA,IAAM,cAAc;AAAA;AAAA;;;ACjBpB,SAAS,WAAAG,gBAAe;AAcxB,eAAe,iBACb,UACA,UACA,QACkB;AAClB,MAAI,SAAS,MAAM;AACjB,WAAO,SAAS,KAAK,UAAU,MAAM;AAAA,EACvC;AACA,SAAO,SAAS,QAAQ,UAAU,MAAM;AAC1C;AASA,SAAS,WACP,aACA,KACA,WACM;AACN,MAAI,QAAQ,UAAU,CAAC,QAAQ,OAAO,OAAO;AAC3C,YAAQ,OAAO,MAAM,KAAK,UAAU,aAAa,MAAM,CAAC,IAAI,IAAI;AAAA,EAClE,OAAO;AACL,cAAU;AAAA,EACZ;AACF;AAKA,SAAS,iBAAiB,GAAmB;AAC3C,UAAQ,OAAO,MAAM,UAAU,aAAa,QAAQ,EAAE,UAAU,CAAC;AAAA,CAAI;AACrE,UAAQ,KAAK,iBAAiB,CAAC,CAAC;AAClC;AAkBA,eAAe,gCACb,UACA,aACe;AACf,QAAM,qBAAuC;AAAA,IAC3C,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aAAa,mBAAmB,QAAQ;AAAA,IACxC,aAAa,EAAE,mBAAmB,KAAK;AAAA,EACzC;AACA,QAAM,cAAc,oBAAoB,aAAa,MAAS;AAChE;AAOA,SAAS,uBAAuB,QAAuC;AACrE,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,UAAW,OAAO,WAAW,CAAC;AAEpC,MAAI,QAAQ,WAAW,GAAG;AACxB,YAAQ,OAAO,MAAM,qBAAqB;AAC1C;AAAA,EACF;AAEA,QAAM,QAAQ,QAAQ,iBAAiB,QAAQ;AAC/C,UAAQ,OAAO,MAAM,oBAAoB,KAAK;AAAA;AAAA,CAAe;AAC7D,UAAQ,OAAO,MAAM,KAAK,SAAS,OAAO,EAAE,CAAC,IAAI,SAAS,OAAO,EAAE,CAAC,IAAI,aAAa,OAAO,EAAE,CAAC;AAAA,CAAc;AAC7G,UAAQ,OAAO,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;AAAA,CAAI;AAElG,aAAW,KAAK,SAAS;AACvB,UAAM,MAAM,EAAE;AACd,UAAM,SAAS,MAAM,GAAG,IAAI,IAAI,KAAK,IAAI,SAAS,GAAG,MAAM;AAC3D,UAAM,OAAO,KAAK,EAAE,cAAwB,KAAK,KAAK,QAAQ,CAAC,CAAC;AAChE,YAAQ,OAAO;AAAA,MACb,KAAK,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,IAAI,MAAM;AAAA;AAAA,IACjG;AAAA,EACF;AAEA,QAAM,QAAkB,CAAC;AACzB,aAAW,OAAO,CAAC,WAAW,YAAY,OAAO,GAAG;AAClD,UAAM,QAAQ,QAAQ,GAAG;AACzB,QAAI,MAAO,OAAM,KAAK,GAAG,KAAK,IAAI,GAAG,EAAE;AAAA,EACzC;AACA,UAAQ,OAAO,MAAM;AAAA,WAAc,MAAM,KAAK,IAAI,KAAK,SAAS;AAAA,CAAI;AACtE;AAGA,SAAS,sBAAsB,QAAuC;AACpE,UAAQ,OAAO,MAAM,WAAW,OAAO,aAAa,GAAG;AAAA,CAAI;AAC3D,UAAQ,OAAO,MAAM,WAAW,OAAO,UAAU,SAAS;AAAA,CAAI;AAC9D,QAAM,QAAQ,OAAO,eAAyB;AAC9C,QAAM,SAAS,OAAO,eAAyB;AAC/C,QAAM,OAAO,OAAO,cAAwB;AAC5C,QAAM,MAAM,OAAO,kBAA4B;AAC/C,QAAM,MAAM,OAAO,kBAA4B;AAC/C,UAAQ,OAAO,MAAM,UAAU,MAAM,eAAe,CAAC,YAAY,OAAO,eAAe,CAAC,cAAc,OAAO,KAAK,QAAQ,CAAC,CAAC;AAAA,CAAgB;AAC5I,UAAQ,OAAO,MAAM,YAAY,IAAI,QAAQ,CAAC,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC;AAAA,CAAU;AAEnF,QAAM,SAAU,OAAO,iBAAiB,CAAC;AACzC,MAAI,OAAO,SAAS,GAAG;AACrB,YAAQ,OAAO,MAAM;AAAA,qBAAwB,OAAO,MAAM;AAAA,CAAM;AAChE,eAAW,KAAK,QAAQ;AACtB,YAAM,QAAQ,EAAE,SAAS;AACzB,YAAM,OAAO,EAAE,iBAAiB;AAChC,cAAQ,OAAO,MAAM,KAAK,OAAO,EAAE,QAAQ,GAAG,EAAE,OAAO,EAAE,CAAC,KAAK,KAAK,YAAY,IAAI;AAAA,CAAK;AAAA,IAC3F;AAAA,EACF;AACF;AAGA,SAAS,sBAAsB,QAAuC;AACpE,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,SAAS,OAAO,UAAU;AAEhC,MAAI,QAAQ,WAAW,GAAG;AACxB,YAAQ,OAAO,MAAM,4BAA4B,MAAM;AAAA,CAAK;AAC5D;AAAA,EACF;AAEA,UAAQ,OAAO,MAAM,uBAAuB,MAAM;AAAA;AAAA,CAAO;AACzD,UAAQ,OAAO,MAAM,KAAK,SAAS,OAAO,EAAE,CAAC,IAAI,QAAQ,SAAS,CAAC,CAAC,IAAI,SAAS,SAAS,CAAC,CAAC,IAAI,cAAc,SAAS,EAAE,CAAC,IAAI,QAAQ,SAAS,EAAE,CAAC;AAAA,CAAI;AACtJ,UAAQ,OAAO,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;AAAA,CAAI;AAElH,aAAW,KAAK,SAAS;AACvB,UAAM,MAAM,IAAK,EAAE,kBAA6B,GAAG,QAAQ,CAAC,CAAC;AAC7D,YAAQ,OAAO;AAAA,MACb,KAAK,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,IAAI,OAAQ,EAAE,cAAyB,CAAC,EAAE,SAAS,CAAC,CAAC,IACrF,OAAQ,EAAE,eAA0B,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,IAAI,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC;AAAA;AAAA,IACjH;AAAA,EACF;AAEA,QAAM,aAAc,OAAO,eAA0B,QAAQ,OAAO,CAAC,GAAG,MAAM,KAAM,EAAE,cAAyB,IAAI,CAAC;AACpH,QAAM,cAAe,OAAO,gBAA2B,QAAQ,OAAO,CAAC,GAAG,MAAM,KAAM,EAAE,eAA0B,IAAI,CAAC;AACvH,UAAQ,OAAO,MAAM;AAAA,SAAY,WAAW,eAAe,CAAC,YAAY,YAAY,eAAe,CAAC;AAAA,CAAW;AACjH;AASO,SAAS,sBAAsB,YAAqB,UAA0B;AACnF,QAAM,YAAY,IAAIA,SAAQ,QAAQ,EACnC,YAAY,wEAAwE,EACpF,SAAS,eAAe,+BAA+B,EACvD,OAAO,wBAAwB,yCAAyC,YAAY,IAAI,EACxF,OAAO,SAAS,4BAA4B,KAAK,EACjD,OAAO,oBAAoB,2CAA2C,UAAU,EAAE,EAClF,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OACN,UACA,SACG;AACH,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,QAAI;AACF,UAAI,UAAU;AACZ,cAAM,SAAS,MAAM,iBAAiB,UAAU,wBAAwB;AAAA,UACtE,WAAW;AAAA,UACX,aAAa,KAAK;AAAA,QACpB,CAAC;AACD,mBAAW,QAAQ,KAAK,MAAM,sBAAsB,MAAM,CAAC;AAAA,MAC7D,OAAO;AACL,cAAM,SAAS,MAAM,iBAAiB,UAAU,yBAAyB;AAAA,UACvE,sBAAsB,KAAK;AAAA,UAC3B,iBAAiB,KAAK;AAAA,QACxB,CAAC;AACD,mBAAW,QAAQ,KAAK,MAAM,uBAAuB,MAAM,CAAC;AAAA,MAC9D;AAAA,IACF,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,aAAW,WAAW,SAAS;AACjC;AAKO,SAAS,qBAAqB,YAAqB,UAA0B;AAClF,QAAM,WAAW,IAAIA,SAAQ,OAAO,EACjC,YAAY,2EAA2E,EACvF,SAAS,eAAe,8BAA8B,EACtD,OAAO,qBAAqB,kCAAkC,KAAK,EACnE,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OAAO,UAA8B,SAA8C;AACzF,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,QAAI;AACF,UAAI;AACJ,UAAI,UAAU;AACZ,iBAAS,MAAM,iBAAiB,UAAU,uBAAuB;AAAA,UAC/D,WAAW;AAAA,UACX,QAAQ,KAAK;AAAA,QACf,CAAC;AAAA,MACH,OAAO;AACL,iBAAS,MAAM,iBAAiB,UAAU,wBAAwB;AAAA,UAChE,QAAQ,KAAK;AAAA,QACf,CAAC;AAAA,MACH;AACA,iBAAW,QAAQ,KAAK,MAAM;AAC5B,YAAI,UAAU;AACZ,2BAAiB,QAAQ,GAAG;AAAA,QAC9B,OAAO;AACL,gCAAsB,MAAiC;AAAA,QACzD;AAAA,MACF,CAAC;AAAA,IACH,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,aAAW,WAAW,QAAQ;AAChC;AAKO,SAAS,sBAAsB,YAAqB,UAA0B;AACnF,QAAM,YAAY,IAAIA,SAAQ,QAAQ,EACnC,YAAY,sCAAsC,EAClD,SAAS,eAAe,qBAAqB,EAC7C,eAAe,qBAAqB,2CAA2C,EAC/E,OAAO,aAAa,4DAA4D,KAAK,EACrF,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OAAO,UAAkB,SAA4D;AAC3F,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,QAAI;AACF,YAAM,gCAAgC,iCAAiC,KAAK,GAAG;AAC/E,YAAM,SAAS,MAAM,iBAAiB,UAAU,iCAAiC;AAAA,QAC/E,WAAW;AAAA,QACX,SAAS;AAAA,QACT,QAAQ,KAAK;AAAA,MACf,CAAC;AACD,iBAAW,QAAQ,KAAK,MAAM;AAC5B,gBAAQ,OAAO,MAAM,WAAW,QAAQ;AAAA,YAAyB,KAAK,MAAM;AAAA,CAAI;AAAA,MAClF,CAAC;AAAA,IACH,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,aAAW,WAAW,SAAS;AACjC;AAKO,SAAS,uBAAuB,YAAqB,UAA0B;AACpF,QAAM,aAAa,IAAIA,SAAQ,SAAS,EACrC,YAAY,oEAAoE,EAChF,SAAS,eAAe,sBAAsB,EAC9C,eAAe,qBAAqB,4CAA4C,EAChF,OAAO,aAAa,4DAA4D,KAAK,EACrF,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OAAO,UAAkB,SAA4D;AAC3F,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,QAAI;AACF,YAAM,gCAAgC,iCAAiC,KAAK,GAAG;AAC/E,YAAM,SAAS,MAAM,iBAAiB,UAAU,iCAAiC;AAAA,QAC/E,WAAW;AAAA,QACX,SAAS;AAAA,QACT,QAAQ,KAAK;AAAA,MACf,CAAC;AACD,iBAAW,QAAQ,KAAK,MAAM;AAC5B,gBAAQ,OAAO,MAAM,WAAW,QAAQ;AAAA,YAA0B,KAAK,MAAM;AAAA,CAAI;AAAA,MACnF,CAAC;AAAA,IACH,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,aAAW,WAAW,UAAU;AAClC;AAKO,SAAS,sBAAsB,YAAqB,UAA0B;AACnF,QAAM,YAAY,IAAIA,SAAQ,QAAQ,EACnC,YAAY,gCAAgC,EAC5C,SAAS,eAAe,qBAAqB,EAC7C,eAAe,qBAAqB,yCAAyC,EAC7E,OAAO,aAAa,4DAA4D,KAAK,EACrF,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OAAO,UAAkB,SAA4D;AAC3F,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,QAAI;AACF,YAAM,gCAAgC,gCAAgC,KAAK,GAAG;AAC9E,YAAM,SAAS,MAAM,iBAAiB,UAAU,gCAAgC;AAAA,QAC9E,WAAW;AAAA,QACX,QAAQ,KAAK;AAAA,MACf,CAAC;AACD,iBAAW,QAAQ,KAAK,MAAM;AAC5B,cAAM,OAAO,OAAO,oBAAoB;AACxC,cAAM,SAAS,OAAO,eAAe;AACrC,cAAM,MAAM,OAAO,sBAAsB;AACzC,gBAAQ,OAAO,MAAM,WAAW,QAAQ;AAAA,CAAe;AACvD,gBAAQ,OAAO,MAAM,cAAc,IAAI,OAAO,MAAM;AAAA,CAAI;AACxD,gBAAQ,OAAO,MAAM,eAAe,GAAG;AAAA,CAAM;AAAA,MAC/C,CAAC;AAAA,IACH,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,aAAW,WAAW,SAAS;AACjC;AAWO,SAAS,sBAAsB,YAAqB,UAA0B;AACnF,QAAM,cAAc,IAAIA,SAAQ,QAAQ,EACrC,YAAY,uCAAuC;AAEtD,QAAM,eAAe,IAAIA,SAAQ,KAAK,EACnC,YAAY,6CAA6C,EACzD,SAAS,SAAS,8BAA8B,EAChD,OAAO,qBAAqB,kBAAkB,OAAO,EACrD,OAAO,OAAO,KAAa,SAA8B;AACxD,UAAM,MAAM,cAAc,KAAK,MAAM;AACrC,QAAI;AACF,YAAM,SAAS,MAAM,iBAAiB,UAAU,qBAAqB,EAAE,IAAI,CAAC;AAC5E,YAAM,QAAS,QAAoC,SAAS;AAC5D,iBAAW,EAAE,KAAK,MAAM,GAAG,KAAK,MAAM;AACpC,gBAAQ,OAAO,MAAM,GAAG,GAAG,MAAM,KAAK,UAAU,KAAK,CAAC;AAAA,CAAI;AAAA,MAC5D,CAAC;AAAA,IACH,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,cAAY,WAAW,YAAY;AAEnC,QAAM,eAAe,IAAIA,SAAQ,KAAK,EACnC,YAAY,yFAAyF,EACrG,SAAS,SAAS,8BAA8B,EAChD,SAAS,WAAW,WAAW,EAC/B,eAAe,qBAAqB,gDAAgD,EACpF,OAAO,aAAa,4DAA4D,KAAK,EACrF,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,OAAO,KAAa,OAAe,SAA4D;AACrG,UAAM,MAAM,cAAc,KAAK,MAAM;AAErC,QAAI;AACJ,QAAI;AACF,oBAAc,KAAK,MAAM,KAAK;AAAA,IAChC,QAAQ;AACN,oBAAc;AAAA,IAChB;AAEA,QAAI;AACF,YAAM,gCAAgC,gCAAgC,KAAK,GAAG;AAC9E,YAAM,SAAS,MAAM,iBAAiB,UAAU,gCAAgC;AAAA,QAC9E;AAAA,QACA,OAAO;AAAA,QACP,QAAQ,KAAK;AAAA,MACf,CAAC;AACD,iBAAW,QAAQ,KAAK,MAAM;AAC5B,cAAM,MAAM,OAAO,aAAa;AAChC,cAAM,SAAS,OAAO,aAAa;AACnC,gBAAQ,OAAO,MAAM,mBAAmB,GAAG;AAAA,CAAI;AAC/C,gBAAQ,OAAO,MAAM,KAAK,KAAK,UAAU,GAAG,CAAC,OAAO,KAAK,UAAU,MAAM,CAAC;AAAA,CAAI;AAC9E,gBAAQ,OAAO,MAAM,aAAa,KAAK,MAAM;AAAA,CAAI;AAAA,MACnD,CAAC;AAAA,IACH,SAAS,GAAG;AACV,uBAAiB,CAAC;AAAA,IACpB;AAAA,EACF,CAAC;AACH,cAAY,WAAW,YAAY;AAEnC,aAAW,WAAW,WAAW;AACnC;AA7ZA;AAAA;AAAA;AAAA;AASA;AAEA;AACA;AAAA;AAAA;;;ACRA,SAAS,WAAAC,UAAS,UAAAC,eAAc;AAuBhC,SAAS,mBACP,UACA,cACmD;AAEnD,MAAI,OAAO,SAAS,qBAAqB,YAAY;AACnD,QAAI;AACF,YAAM,UAAU,SAAS,iBAAiB;AAC1C,UAAI,WAAW,QAAQ,SAAS,cAAc;AAC5C,eAAO,EAAE,MAAM,SAAS,WAAW,KAAK;AAAA,MAC1C;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,QAAM,OAAQ,SAAkD;AAGhE,MAAI,QAAQ,OAAO,KAAK,mBAAmB,YAAY;AACrD,QAAI;AACF,YAAM,MAAM,KAAK,eAAe;AAChC,YAAM,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,SAAS,YAAY,KAAK;AACzD,aAAO,EAAE,MAAM,WAAW,MAAM;AAAA,IAClC,QAAQ;AACN,aAAO,EAAE,MAAM,MAAM,WAAW,MAAM;AAAA,IACxC;AAAA,EACF;AACA,SAAO,EAAE,MAAM,MAAM,WAAW,MAAM;AACxC;AA4DO,SAAS,wBAAwB,KAAc,UAA0B;AAC9E,QAAM,cAAc,IAAID,SAAQ,mBAAmB,EAChD,YAAY,mDAAmD,EAC/D;AAAA,IACC,IAAIC,QAAO,qBAAqB,2CAA2C,EACxE,QAAQ,CAAC,YAAY,YAAY,WAAW,eAAe,SAAS,CAAC,EACrE,QAAQ,UAAU;AAAA,EACvB,EACC,OAAO,qBAAqB,gBAAgB,EAC5C,OAAO,CAAC,SAAgD;AACvD,UAAM,MAAM,cAAc,KAAK,MAAM;AAIrC,UAAM,EAAE,MAAM,UAAU,IAAI,mBAAmB,UAAU,KAAK,QAAQ;AAEtE,QAAI,MAAM;AAIR,YAAM,gBAAgB,YAAa,SAAS,iBAAiB,SAAS,CAAC,IAAK,CAAC;AAC7E,YAAM,SAAS,aAAa,KAAK,IAAI,KAAK,KAAK,SAAS;AAExD,UAAI,QAAQ,UAAU,CAAC,QAAQ,OAAO,OAAO;AAC3C,cAAM,UAAU;AAAA,UACd,UAAU,KAAK;AAAA,UACf,YAAY,KAAK;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,OAAO,KAAK,UAAU,IAAI,CAAC,MAAM,MAAM;AACrC,kBAAM,WAAW,cAAc,CAAC;AAChC,mBAAO;AAAA,cACL,OAAO,IAAI;AAAA,cACX;AAAA,cACA,MAAM,UAAU,QAAQ;AAAA,cACxB,WAAW,UAAU,aAAa;AAAA,cAClC,YAAY,UAAU,aAAa;AAAA,YACrC;AAAA,UACF,CAAC;AAAA,QACH;AACA,gBAAQ,OAAO,MAAM,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,IAAI;AAAA,MAC9D,OAAO;AACL,gBAAQ,OAAO,MAAM,GAAG,MAAM;AAAA;AAAA,CAAM;AACpC,gBAAQ,OAAO,MAAM,KAAK,IAAI,OAAO,CAAC,CAAC,IAAI,OAAO,OAAO,EAAE,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,IAAI,YAAY,OAAO,EAAE,CAAC;AAAA,CAAY;AACtH,gBAAQ,OAAO,MAAM,KAAK,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;AAAA,CAAI;AACjH,iBAAS,IAAI,GAAG,IAAI,KAAK,UAAU,QAAQ,KAAK;AAC9C,gBAAM,WAAW,cAAc,CAAC;AAChC,gBAAM,OAAO,UAAU,OAAO,QAAQ;AACtC,gBAAM,YAAY,UAAU,cAAc,QAAQ,QAAQ;AAC1D,gBAAM,UAAU,UAAU,YAAY,GAAG,SAAS,SAAS,OAAO;AAClE,kBAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,IAAI,UAAU,OAAO,EAAE,CAAC,IAAI,OAAO;AAAA,CAAI;AAAA,QAC5I;AAAA,MACF;AACA;AAAA,IACF;AAGA,UAAM,QAAQ,aAAa,KAAK,QAAQ,KAAK,CAAC;AAC9C,UAAM,YAAY,oBAAI,IAAI;AAAA,MACxB;AAAA,MAAoB;AAAA,MAAoB;AAAA,MAAiB;AAAA,MAAa;AAAA,IACxE,CAAC;AACD,UAAM,eAAe,oBAAI,IAAI;AAAA,MAC3B;AAAA,MAAoB;AAAA,MAAiB;AAAA,MAAW;AAAA,IAClD,CAAC;AAED,QAAI,QAAQ,UAAU,CAAC,QAAQ,OAAO,OAAO;AAC3C,YAAM,UAAU;AAAA,QACd,UAAU,KAAK;AAAA,QACf,YAAY,MAAM;AAAA,QAClB,OAAO,MAAM,IAAI,CAAC,GAAG,OAAO;AAAA,UAC1B,OAAO,IAAI;AAAA,UACX,MAAM;AAAA,UACN,MAAM,UAAU,IAAI,CAAC;AAAA,UACrB,WAAW,CAAC,aAAa,IAAI,CAAC;AAAA,QAChC,EAAE;AAAA,MACJ;AACA,cAAQ,OAAO,MAAM,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,IAAI;AAAA,IAC9D,OAAO;AACL,cAAQ,OAAO,MAAM,aAAa,KAAK,QAAQ,KAAK,MAAM,MAAM;AAAA;AAAA,CAAa;AAC7E,cAAQ,OAAO,MAAM,KAAK,IAAI,OAAO,CAAC,CAAC,IAAI,OAAO,OAAO,EAAE,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,IAAI,YAAY,OAAO,EAAE,CAAC;AAAA,CAAY;AACtH,cAAQ,OAAO,MAAM,KAAK,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;AAAA,CAAI;AACjH,eAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAM,OAAO,UAAU,IAAI,MAAM,CAAC,CAAC,IAAI,QAAQ;AAC/C,cAAM,YAAY,aAAa,IAAI,MAAM,CAAC,CAAC,IAAI,OAAO;AACtD,gBAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,IAAI,UAAU,OAAO,EAAE,CAAC;AAAA,CAAW;AAAA,MAC/H;AAAA,IACF;AAAA,EACF,CAAC;AACH,MAAI,WAAW,WAAW;AAC5B;AA7MA,IA4DM;AA5DN;AAAA;AAAA;AAAA;AAMA;AAsDA,IAAM,eAAyC;AAAA,MAC7C,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,aAAa;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA;AAAA;;;ACJO,SAAS,sBAAsB,OAAkC;AACtE,4BAA0B;AAC5B;AAQA,SAAS,0BAA0B,MAAoB;AACrD,MAAI,CAAC,QAAQ,CAAC,YAAY,KAAK,IAAI,GAAG;AACpC,UAAM,IAAI;AAAA,MACR,oBAAoB,KAAK,UAAU,IAAI,CAAC;AAAA,IAE1C;AAAA,EACF;AACF;AA7HA,IA4Ba,iBAyCA,4BAQA,sBAcT,yBA0BE,aAUA,kBAgBO,wBAqCA;AApLb;AAAA;AAAA;AAAA;AAYA;AACA;AAeO,IAAM,kBAAN,cAA8B,MAAM;AAAA,MACzC,YAAY,SAAiB;AAC3B,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAoCO,IAAM,6BAA6B;AAQnC,IAAM,uBAA4C,oBAAI,IAAI,CAAC,0BAA0B,CAAC;AAc7F,IAAI,0BAA+C;AA0BnD,IAAM,cAAc;AAUpB,IAAM,mBAAwC,oBAAI,IAAI;AAAA,MACpD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAWM,IAAM,yBAA8C,oBAAI,IAAI;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAuBM,IAAM,aAAN,MAAM,YAAW;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MAET,YAAY,MAAsB;AACxC,aAAK,QAAQ,KAAK;AAClB,aAAK,WAAW,KAAK;AACrB,aAAK,WAAW,KAAK;AACrB,aAAK,cAAc,KAAK;AACxB,aAAK,oBAAoB,KAAK;AAC9B,aAAK,iBAAiB,KAAK;AAC3B,aAAK,QAAQ,KAAK;AAAA,MACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQA,IAAI,OAAe;AACjB,eAAO,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,OAAO,cACL,QACA,MACY;AACZ,eAAO,YAAW;AAAA,UAAO;AAAA,UAAQ;AAAA;AAAA,UAAwB;AAAA,QAAI;AAAA,MAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,OAAO,SACL,QACA,MACY;AAKZ,YACE,WAAW,QACX,WAAW,UACX,OAAO,WAAW,cACjB,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,IACnD;AACA,gBAAM,MAAM,MAAM,QAAQ,MAAM,IAAI,UAAU,OAAO;AACrD;AAAA,YACE,yCAAyC,GAAG;AAAA,UAC9C;AACA,iBAAO,YAAW;AAAA,YAAO;AAAA,YAAW;AAAA;AAAA,YAAwB;AAAA,UAAK;AAAA,QACnE;AACA,eAAO,YAAW;AAAA,UAChB;AAAA,UACA;AAAA;AAAA,UACkB;AAAA,QACpB;AAAA,MACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,OAAO,YACL,QACA,MACqC;AAIrC,YACE,WAAW,QACX,WAAW,UACX,OAAO,WAAW,cACjB,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,IACnD;AACA,gBAAM,MAAM,MAAM,QAAQ,MAAM,IAAI,UAAU,OAAO;AACrD,iBAAO;AAAA,YACL;AAAA,YACA,6DAA6D,GAAG;AAAA,UAClE;AAAA,QACF;AACA,YAAI,WAAW,QAAQ,WAAW,UAAa,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AACnG,gBAAM,OAAQ,OAAmC,MAAM;AACvD,cAAI,SAAS,UAAa,SAAS,MAAM;AACvC,kBAAM,aAAa,CAAC,OAAO,QAAQ,WAAW,SAAS;AACvD,gBAAI,OAAO,SAAS,YAAY,CAAC,WAAW,SAAS,IAAI,GAAG;AAC1D,qBAAO,CAAC,MAAM,wBAAwB,IAAI,iDAAiD;AAAA,YAC7F;AAAA,UACF;AAAA,QACF;AACA,eAAO,CAAC,YAAW,SAAS,QAAQ,IAAI,GAAG,IAAI;AAAA,MACjD;AAAA;AAAA;AAAA;AAAA,MAMA,OAAe,OACb,QACA,MACA,eACY;AAGZ,cAAM,OAAO,KAAK,QAAQ;AAC1B,kCAA0B,IAAI;AAG9B,YAAI,WAAW,MAAM;AACnB,iBAAO,IAAI,YAAW;AAAA,YACpB,MAAM;AAAA,YACN,SAAS,CAAC;AAAA,YACV,SAAS,CAAC;AAAA,YACV,YAAY;AAAA,YACZ,kBAAkB,KAAK;AAAA,YACvB;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AACA,YAAI,WAAW,OAAO;AACpB,iBAAO,IAAI,YAAW;AAAA,YACpB,MAAM;AAAA,YACN,SAAS,CAAC;AAAA,YACV,SAAS,CAAC;AAAA,YACV,YAAY;AAAA,YACZ,kBAAkB,KAAK;AAAA,YACvB;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AAGA,YAAI,WAAW,UAAa,WAAW,MAAM;AAC3C,iBAAO,IAAI,YAAW;AAAA,YACpB,MAAM;AAAA,YACN,SAAS,CAAC;AAAA,YACV,SAAS,CAAC;AAAA,YACV,YAAY;AAAA,YACZ,kBAAkB,KAAK;AAAA,YACvB;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AAEA,YAAI,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAEvD,kBAAQ,OAAO;AAAA,YACb,wDAAwD,MAAM,QAAQ,MAAM,IAAI,UAAU,OAAO,MAAM;AAAA;AAAA,UACzG;AACA,kBAAQ,KAAK,WAAW,iBAAiB;AAAA,QAC3C;AAEA,cAAM,MAAM;AAGZ,YAAI;AACJ,YAAI,IAAI,SAAS,UAAa,IAAI,SAAS,MAAM;AAE/C,iBAAO;AAAA,QACT,WAAW,OAAO,IAAI,SAAS,UAAU;AACvC,kBAAQ,OAAO;AAAA,YACb,2CAA2C,OAAO,IAAI,IAAI;AAAA;AAAA,UAE5D;AACA,kBAAQ,KAAK,WAAW,iBAAiB;AAAA,QAC3C,WAAW,CAAC,iBAAiB,IAAI,IAAI,IAAI,GAAG;AAC1C,kBAAQ,OAAO;AAAA,YACb,sBAAsB,IAAI,IAAI;AAAA;AAAA,UAEhC;AACA,kBAAQ,KAAK,WAAW,iBAAiB;AAAA,QAC3C,OAAO;AACL,iBAAO,IAAI;AAAA,QACb;AAGA,cAAM,UAAU,YAAW,eAAe,IAAI,SAAS,SAAS;AAChE,cAAM,UAAU,YAAW,eAAe,IAAI,SAAS,SAAS;AAKhE,cAAM,gBACJ,IAAI,eAAe,SACf,IAAI,aACH,IAAgC,aAAa;AACpD,YAAI,aAAa;AACjB,YAAI,kBAAkB,QAAW;AAC/B,cAAI,OAAO,kBAAkB,WAAW;AACtC,yBAAa;AAAA,UACf,OAAO;AACL;AAAA,cACE,0CAA0C,OAAO,aAAa;AAAA,YAChE;AAAA,UACF;AAAA,QACF;AAEA,eAAO,IAAI,YAAW;AAAA,UACpB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,kBAAkB,KAAK;AAAA,UACvB;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWA,OAAe,eAAe,KAAc,OAAyB;AACnE,YAAI,QAAQ,UAAa,QAAQ,KAAM,QAAO,CAAC;AAC/C,YAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACvB,eAAK,SAAS,KAAK,wBAAwB,OAAO,GAAG,aAAa;AAClE,iBAAO,CAAC;AAAA,QACV;AACA,cAAM,MAAgB,CAAC;AACvB,mBAAW,SAAS,KAAK;AACvB,cAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,gBAAI,CAAC,uBAAuB,IAAI,KAAK,GAAG;AACtC;AAAA,gBACE,6BAA6B,KAAK,QAAQ,KAAK;AAAA,cACjD;AAAA,YACF;AACA,gBAAI,KAAK,KAAK;AAAA,UAChB,OAAO;AACL,iBAAK,SAAS,KAAK,uCAAuC;AAAA,UAC5D;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAiBA,oBAA4D;AAE1D,YAAI,KAAK,kBAAkB,KAAK,UAAU,QAAQ;AAChD,iBAAO,KAAK;AAAA,QACd;AAGA,YAAI,CAAC,KAAK,aAAa;AACrB,gBAAM,UAAU,KAAK,UAAU,QAAQ,IAAI,gBAAgB;AAC3D,cAAI,YAAY,MAAM;AACpB,mBAAO;AAAA,UACT;AAAA,QACF;AAGA,YAAI,KAAK,UAAU,QAAQ;AACzB,iBAAO,KAAK;AAAA,QACd;AAGA,eAAO,KAAK,oBAAoB,SAAS;AAAA,MAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQA,qBAAqB,YAA6B;AAChD,cAAM,OAAO,KAAK,kBAAkB;AACpC,YAAI,SAAS,UAAW,QAAO,KAAK,SAAS,SAAS,UAAU;AAChE,YAAI,SAAS,UAAW,QAAO,CAAC,KAAK,SAAS,SAAS,UAAU;AACjE,cAAM,IAAI;AAAA,UACR,2CAA2C,IAAI;AAAA,QACjD;AAAA,MACF;AAAA;AAAA,MAGA,iBAA0B;AACxB,eAAO,KAAK,kBAAkB,MAAM;AAAA,MACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAcQ,UAAU,KAAgD;AAChE,YAAI,QAAQ,UAAa,QAAQ,GAAI,QAAO;AAI5C,cAAM,aAAa,IAAI,KAAK,EAAE,YAAY;AAC1C,YAAI,eAAe,GAAI,QAAO;AAC9B,YAAI,eAAe,UAAU,eAAe,OAAO,eAAe,QAAQ;AACxE,iBAAO;AAAA,QACT;AACA,YACE,eAAe,UACf,eAAe,OACf,eAAe,SACf;AACA,iBAAO;AAAA,QACT;AACA;AAAA,UACE,mCAAmC,GAAG;AAAA,QAExC;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;;;ACjgBA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uBAAuB,MAAM;AAClD;AASO,SAAS,eAAe,SAAyB;AACtD,QAAM,WAAW;AACjB,QAAM,UAAU,QAAQ,WAAW,MAAM,QAAQ;AACjD,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,QAAM,aAAa,MAAM,IAAI,CAAC,MAAM;AAClC,UAAM,WAAW,EAAE,WAAW,UAAU,IAAI;AAC5C,WAAO,YAAY,QAAQ;AAAA,EAC7B,CAAC;AACD,MAAI,QAAQ,WAAW,KAAK,OAAO;AACnC,UAAQ,MAAM,WAAW,UAAU,IAAI;AACvC,SAAO,IAAI,OAAO,IAAI,KAAK,GAAG;AAChC;AArCA,IAwDa;AAxDb;AAAA;AAAA;AAAA;AAQA;AAgDO,IAAM,iBAAN,MAAM,gBAAe;AAAA,MAC1B,OAAgB,cAAc,CAAC,OAAO,WAAW,WAAW,MAAM;AAAA,MAEzD;AAAA,MACQ;AAAA,MACA;AAAA,MAEjB,YAAY,OAAO,OAAO,SAAoB,SAAoB;AAOhE,YAAI,CAAC,gBAAe,YAAY,SAAS,IAAmD,GAAG;AAC7F,kBAAQ,OAAO;AAAA,YACb,yCAAyC,IAAI,+CAA0C,gBAAe,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA,UAC9H;AACA,iBAAO;AAAA,QACT;AACA,aAAK,QAAQ;AACb,cAAM,QAAQ,CAAC,QAAkB,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;AACjD,aAAK,mBAAmB,MAAM,WAAW,CAAC,CAAC,EAAE,IAAI,cAAc;AAC/D,aAAK,mBAAmB,MAAM,WAAW,CAAC,CAAC,EAAE,IAAI,cAAc;AAAA,MACjE;AAAA;AAAA,MAGA,UAAU,UAA2B;AACnC,YAAI,KAAK,UAAU,MAAO,QAAO;AACjC,YAAI,KAAK,UAAU,WAAW;AAC5B,iBAAO,KAAK,iBAAiB,KAAK,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC;AAAA,QAC7D;AACA,YAAI,KAAK,UAAU,WAAW;AAC5B,iBAAO,CAAC,KAAK,iBAAiB,KAAK,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC;AAAA,QAC9D;AACA,eAAO;AAAA,MACT;AAAA;AAAA,MAGA,cAAc,WAA2C;AACvD,cAAM,UAAoB,CAAC;AAC3B,cAAM,SAAmB,CAAC;AAC1B,mBAAW,OAAO,WAAW;AAC3B,WAAC,KAAK,UAAU,GAAG,IAAI,UAAU,QAAQ,KAAK,GAAG;AAAA,QACnD;AACA,eAAO,CAAC,SAAS,MAAM;AAAA,MACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,OAAO,WAAW,QAAiD;AACjE,cAAM,SAAS,OAAO,UAAU,CAAC;AACjC,YAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,eAAK,2DAA2D;AAChE,iBAAO,IAAI,gBAAe;AAAA,QAC5B;AAEA,cAAM,YAAY;AAClB,cAAM,OAAQ,UAAU,QAAmB;AAC3C,YAAI,CAAC,CAAC,OAAO,WAAW,SAAS,EAAE,SAAS,IAAI,GAAG;AACjD,gBAAM,IAAI;AAAA,YACR,yBAAyB,IAAI;AAAA,UAC/B;AAAA,QACF;AAEA,YAAI,UAAU,UAAU,WAAW,CAAC;AACpC,YAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,eAAK,qDAAqD;AAC1D,oBAAU,CAAC;AAAA,QACb;AAEA,YAAI,UAAU,UAAU,WAAW,CAAC;AACpC,YAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,eAAK,qDAAqD;AAC1D,oBAAU,CAAC;AAAA,QACb;AAEA,cAAM,aAAa,CAAC,KAAgB,UAA4B;AAC9D,gBAAM,SAAmB,CAAC;AAC1B,qBAAW,KAAK,KAAK;AACnB,gBAAI,CAAC,GAAG;AACN,mBAAK,2BAA2B,KAAK,aAAa;AAAA,YACpD,OAAO;AACL,qBAAO,KAAK,OAAO,CAAC,CAAC;AAAA,YACvB;AAAA,UACF;AACA,iBAAO;AAAA,QACT;AAEA,eAAO,IAAI;AAAA,UACT;AAAA,UACA,WAAW,SAAsB,SAAS;AAAA,UAC1C,WAAW,SAAsB,SAAS;AAAA,QAC5C;AAAA,MACF;AAAA,IACF;AAAA;AAAA;;;AC9HA,SAAS,gBAAgB,KAAc,SAA2C;AAChF,QAAM,MAAO,IAAsD;AACnE,QAAM,IAAI,MAAM,OAAO;AACvB,MAAI,OAAO,MAAM,WAAY,QAAO,EAAE,EAAE,OAAO,OAAO,SAAS,IAAI,CAAC;AACpE,SAAO,KAAK;AACd;AAEA,SAAS,sBAAsB,OAAuB;AACpD,SAAO,MACJ,QAAQ,uBAAuB,CAAC,GAAG,SAAS,IAAI,KAAK,YAAY,CAAC,GAAG,EACrE,QAAQ,yBAAyB,CAAC,GAAG,SAAS,IAAI,KAAK,YAAY,CAAC,GAAG;AAC5E;AAEA,SAAS,WAAW,KAAqB;AACvC,QAAM,QAAQ,sBAAsB,IAAI,KAAK;AAE7C,MAAI,CAAC,IAAI,SAAS,MAAM,WAAW,IAAI,EAAG,QAAO,SAAS;AAC1D,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAqB;AAC9C,MAAI,OAAO,IAAI;AACf,QAAM,IAAI,IAAI;AACd,MAAI,MAAM,UAAa,MAAM,SAAS,MAAM,MAAM,MAAM,MAAM;AAC5D,WAAO,GAAG,IAAI,cAAc,OAAO,CAAC,CAAC;AAAA,EACvC;AACA,SAAO;AACT;AAOA,SAAS,uBAAuB,MAAmC;AACjE,QAAM,WAAqB,CAAC;AAC5B,QAAM,cAAwB,CAAC;AAC/B,QAAM,OAAiB,CAAC;AACxB,aAAW,KAAK,MAAM;AACpB,QAAI,EAAE,SAAS,SAAU,UAAS,KAAK,CAAC;AAAA,aAC/B,EAAE,SAAS,YAAa,aAAY,KAAK,CAAC;AAAA,QAC9C,MAAK,KAAK,CAAC;AAAA,EAClB;AACA,SAAO,CAAC,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW;AAC9C;AAEO,SAAS,oBAAoB,KAAc,QAAsB;AACtE,QAAM,WAAqB,CAAC;AAE5B,QAAM,YAAY,gBAAgB,KAAK,WAAW;AAClD,MAAI,UAAW,UAAS,KAAK,SAAS;AAEtC,QAAM,OAAO,IAAI,YAAY;AAC7B,MAAI,KAAM,UAAS,KAAK,IAAI;AAE5B,QAAM,SAAS,gBAAgB,KAAK,QAAQ;AAC5C,MAAI,OAAQ,UAAS,KAAK,MAAM;AAEhC,QAAM,cAAc,uBAAuB,OAAO,eAAe,GAAG,CAAC;AACrE,QAAM,cAAc,OAAO,gBAAgB,GAAG;AAC9C,QAAM,OAAQ,IAEX,uBAAuB,CAAC;AAE3B,MAAI,QAAQ,UAAU,IAAI,KAAK,CAAC;AAChC,MAAI,YAAY,SAAS,EAAG,UAAS;AACrC,aAAW,KAAK,MAAM;AACpB,UAAM,IAAI,EAAE,KAAK,EAAE,YAAY;AAC/B,aAAS,EAAE,WAAW,KAAK,CAAC,MAAM,KAAK,CAAC;AAAA,EAC1C;AACA,MAAI,YAAY,SAAS,EAAG,UAAS;AACrC,WAAS,KAAK,KAAK;AAEnB,MAAI,YAAY,SAAS,GAAG;AAC1B,UAAM,QAAQ,YAAY,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AAC7C,UAAM,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;AAChD,UAAM,QAAQ,CAAC,WAAW;AAC1B,gBAAY,QAAQ,CAAC,KAAK,MAAM;AAC9B,YAAM,KAAK,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,EAAE;AAAA,IAC5D,CAAC;AACD,aAAS,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,EAChC;AAEA,MAAI,YAAY,SAAS,GAAG;AAC1B,UAAM,QAAQ,YAAY,IAAI,UAAU;AACxC,UAAM,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;AAChD,UAAM,QAAQ,CAAC,UAAU;AACzB,gBAAY,QAAQ,CAAC,KAAK,MAAM;AAC9B,YAAM,KAAK,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,kBAAkB,GAAG,CAAC,EAAE;AAAA,IACjE,CAAC;AACD,aAAS,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,EAChC;AAEA,QAAM,QAAQ,gBAAgB,KAAK,OAAO;AAC1C,MAAI,MAAO,UAAS,KAAK,KAAK;AAE9B,QAAM,WAAW,gBAAgB,KAAK,UAAU;AAChD,MAAI,SAAU,UAAS,KAAK,QAAQ;AAEpC,SAAO,SAAS,KAAK,MAAM,IAAI;AACjC;AAhIA;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC+BO,SAAS,iBAAiB,UAAwB;AACvD,MAAI,SAAS,SAAS,sBAAsB;AAC1C,YAAQ,OAAO;AAAA,MACb,qCAAqC,QAAQ,wBAAwB,oBAAoB;AAAA;AAAA,IAC3F;AACA,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AACA,MAAI,CAAC,kBAAkB,KAAK,QAAQ,GAAG;AACrC,YAAQ,OAAO;AAAA,MACb,qCAAqC,QAAQ;AAAA;AAAA,IAC/C;AACA,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AACF;AA5CA,IAWM,mBASO;AApBb;AAAA;AAAA;AAAA;AAQA;AAGA,IAAM,oBAAoB;AASnB,IAAM,uBAAuB;AAAA;AAAA;;;ACpBpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,iBAAAC,sBAAqB;AAC9B,YAAYC,WAAU;AACtB,SAAS,WAAAC,UAAS,gBAAgB,UAAAC,eAAc;AA8CzC,SAAS,eAAe,SAAwB;AACrD,gBAAc;AAChB;AAeO,SAAS,WAAW,KAA0B;AACnD,YAAU;AACZ;AAGA,SAAS,iBAA0B;AACjC,SAAO,QAAQ,KAAK,SAAS,WAAW;AAC1C;AAOO,SAAS,iBACd,UACA,UACA,cACQ;AACR,MAAI,aAAa,UAAa,OAAO,SAAS,QAAQ,KAAK,WAAW,GAAG;AACvE,WAAO;AAAA,EACT;AACA,MAAI,aAAa,UAAa,aAAa,IAAI;AAC7C,UAAM,SAAS,SAAS,UAAU,EAAE;AACpC,QAAI,OAAO,SAAS,MAAM,KAAK,SAAS,GAAG;AACzC,aAAO;AAAA,IACT;AACA,YAAQ,OAAO;AAAA,MACb,uCAAuC,QAAQ,oBAAoB,YAAY;AAAA;AAAA,IACjF;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,oBACd,UACA,UACoB;AACpB,MAAI,OAAO,aAAa,YAAY,aAAa,IAAI;AACnD,WAAO;AAAA,EACT;AACA,MAAI,aAAa,UAAa,aAAa,IAAI;AAC7C,WAAO;AAAA,EACT;AACA,SAAO;AACT;AA8CA,SAAS,cAAc,GAAY,UAAwB;AACzD,QAAM,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC;AACxD,QAAM,YAAY;AAClB,QAAM,OAAO,UAAU,QAAQ;AAC/B,QAAM,UAAmC;AAAA,IACvC,OAAO;AAAA,IACP;AAAA,IACA,SAAS,IAAI;AAAA,IACb,WAAW;AAAA,EACb;AACA,aAAW,SAAS,CAAC,WAAW,cAAc,eAAe,aAAa,cAAc,GAAG;AACzF,UAAM,MAAM,UAAU,KAAK;AAC3B,QAAI,QAAQ,UAAa,QAAQ,MAAM;AACrC,cAAQ,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACA,UAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,IAAI,IAAI;AACrD;AAQA,SAAS,aAAa,GAAY,UAAwB;AACxD,QAAM,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC;AACxD,QAAM,YAAY;AAClB,QAAM,OAAO,UAAU;AACvB,QAAM,SAAS,OAAO,UAAU,IAAI,MAAM,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO;AAC/E,UAAQ,OAAO,MAAM,SAAS,IAAI;AAElC,QAAM,UAAU,UAAU;AAC1B,MAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,GAAG;AACrE,YAAQ,OAAO,MAAM,gBAAgB;AACrC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAkC,GAAG;AACvE,cAAQ,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC;AAAA,CAAI;AAAA,IACzC;AAAA,EACF;AAEA,QAAM,aAAa,UAAU;AAC7B,MAAI,YAAY;AACd,YAAQ,OAAO,MAAM;AAAA,gBAAmB,UAAU;AAAA,CAAI;AAAA,EACxD;AAEA,QAAM,YAAY,UAAU;AAC5B,MAAI,cAAc,UAAa,cAAc,MAAM;AACjD,UAAM,QAAQ,YAAY,QAAQ;AAClC,YAAQ,OAAO,MAAM,gBAAgB,KAAK;AAAA,CAAI;AAAA,EAChD;AAEA,UAAQ,OAAO,MAAM;AAAA,eAAkB,QAAQ;AAAA,CAAI;AACrD;AAkGO,SAAS,UACd,qBACA,UACA,UAAU,OACD;AAET,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,OAAO,wBAAwB,YAAY,wBAAwB,MAAM;AAC3E,oBAAgB,oBAAoB;AACpC,eAAW,oBAAoB,YAAY;AAC3C,cAAU,oBAAoB,WAAW;AACzC,UAAM,oBAAoB;AAC1B,eAAW,oBAAoB;AAC/B,eAAW,oBAAoB;AAC/B,oBAAgB,oBAAoB;AACpC,aAAS,oBAAoB;AAC7B,kBAAc,oBAAoB;AAClC,iBAAa,oBAAoB;AACjC,qBAAiB,oBAAoB;AACrC,uBAAmB,oBAAoB;AACvC,sBAAkB,oBAAoB;AAAA,EACxC,OAAO;AACL,oBAAgB;AAAA,EAClB;AAEA,gBAAc;AAEd,0BAAwB;AAIxB,MAAI;AACF,UAAM,cAAc,IAAI,YAAY;AACpC,mBAAe,WAAW;AAAA,EAC5B,QAAQ;AAAA,EAER;AAGA,QAAM,mBAAmB,YAAiB,eAAS,QAAQ,KAAK,CAAC,KAAK,YAAY,KAAK;AAGvF,QAAM,cAAc,QAAQ,IAAI,4BAA4B,QAAQ,IAAI,wBAAwB;AAChG,cAAY,WAAW;AAGvB,MAAI,QAAQ,YAAY,WAAW;AACjC,YAAQ,OAAO,MAAM,2DAA2D;AAChF,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AAGA,MAAI,KAAK;AACP,eAAW,IAAI;AACf,eAAW,IAAI;AAAA,EACjB;AAGA,MAAI,YAAY,CAAC,UAAU;AACzB,YAAQ,OAAO,MAAM,iEAA4D;AACjF,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AASA,MAAI,YAAY,OAAQ,SAAgD,uBAAuB,YAAY;AACzG,QAAI;AACF,YAAM,UAAU,IAAI;AAAA;AAAA,QAAmC;AAAA,MAAK;AAC5D,MAAC,SAAqE,mBAAmB,OAAO;AAAA,IAClG,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,mBAAmB,aAAa;AAEtC,QAAM,UAAU,IAAID,SAAQ,gBAAgB,EACzC,aAAa,EACb,WAAW,cAAc,YAAY,EACrC,eAAe,kBAAkB,2DAA2D,EAC5F,YAAY,kBAAkB,GAAG,gBAAgB,MAAM,EACvD,OAAO,uBAAuB,4CAA4C,SAAS,EACnF,OAAO,aAAa,8DAA8D;AACrF,MAAI,YAAY;AACd,YAAQ,QAAQ,YAAY,iBAAiB,eAAe;AAAA,EAC9D;AACA,UAAQ,cAAc,EAAE,YAAY,oBAAoB,CAAC;AAGzD,MAAI,CAAC,kBAAkB;AACrB,YAAQ,OAAO,2BAA2B,8BAA8B;AACxE,YAAQ,OAAO,yBAAyB,6CAA6C;AACrF,YAAQ,OAAO,oBAAoB,0CAA0C;AAAA,EAC/E;AAMA,MAAI;AACJ,MAAI;AACF,QAAI,uBAAuB,YAAY;AAGrC,UACE,qBAAqB,UAClB,qBAAqB,WACrB,YAAY,SAAS,kBACxB;AACA,cAAM,IAAI;AAAA,UACR,oBAAoB,KAAK,UAAU,gBAAgB,CAAC,wDACR,KAAK,UAAU,YAAY,IAAI,CAAC;AAAA,QAC9E;AAAA,MACF;AACA,iBAAW;AAAA,IACb,WAAW,gBAAgB,QAAW;AACpC,iBAAW,WAAW,cAAc,aAAa;AAAA,QAC/C;AAAA,QACA,MAAM;AAAA,MACR,CAAC;AAAA,IACH,OAAO;AACL,UAAI,UAAmB;AACvB,UAAI;AACF,cAAM,WAAW,IAAI,eAAe;AACpC,kBAAU,SAAS,cAAc,OAAO;AAAA,MAC1C,QAAQ;AACN,kBAAU;AAAA,MACZ;AACA,iBAAW,WAAW,SAAS,SAAS;AAAA,QACtC;AAAA,QACA,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF,SAAS,GAAG;AAEV,YAAQ,OAAO,MAAM,UAAU,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,CAAI;AAC7E,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AAMA,wBAAsB,oBAAI,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;AAK9C,QAAM,aAAa,QAChB,QAAQ,SAAS,MAAM,EAAE,QAAQ,CAAC,SAAS,eAAe,EAAE,CAAC,EAC7D,YAAY,mBAAmB;AAGlC,MAAI,UAAU;AACZ,IAAC,QAA+C,YAAY;AAC5D,QAAI,UAAU;AACZ,MAAC,QAA+C,YAAY;AAAA,IAC9D;AAAA,EACF,OAAO;AACL,UAAM,iBAAiB,iBAClB,QAAQ,IAAI,0BACZ;AACL,SAAK;AAAA,EACP;AAOA,MAAI;AACJ,MAAI;AACF,QAAI,kBAAkB,gBAAgB;AACpC,uBAAiB;AAAA,IACnB,WAAW,OAAO,WAAW,YAAY,WAAW,MAAM;AACxD,uBAAiB,eAAe,WAAW,EAAE,OAAO,CAAC;AAAA,IACvD,OAAO;AACL,uBAAiB,IAAI,eAAe;AAAA,IACtC;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,OAAO,MAAM,yCAAoC,GAAG;AAAA,CAAI;AAChE,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AAEA,4BAA0B,YAAY,UAAU,UAAU,UAAU,cAAc;AAGlF,UAAQ,YAAY,SAAS;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI,CAAC;AAKZ,mBAAiB,SAAS,kBAAkB,cAAc,OAAO;AAOjE,MAAI,iBAAiB,cAAc,SAAS,GAAG;AAK7C,UAAM,oBAAyC,oBAAI,IAAI,CAAC,SAAS,IAAI,CAAC;AACtE,eAAW,OAAO,eAAe;AAC/B,YAAM,UAAU,IAAI,KAAK;AACzB,UAAI,kBAAkB,IAAI,OAAO,GAAG;AAClC,gBAAQ,OAAO;AAAA,UACb,8BAA8B,OAAO;AAAA;AAAA,QACvC;AACA,gBAAQ,KAAK,WAAW,iBAAiB;AAAA,MAC3C;AACA,YAAM,WAAW,QAAQ,SAAS,KAAK,CAAC,MAAM,EAAE,KAAK,MAAM,OAAO;AAClE,UAAI,UAAU;AACZ,gBAAQ,OAAO;AAAA,UACb,8BAA8B,OAAO;AAAA;AAAA,QACvC;AACA,gBAAQ,KAAK,WAAW,iBAAiB;AAAA,MAC3C;AACA,cAAQ,WAAW,GAAG;AAAA,IACxB;AAAA,EACF;AAIA,UAAQ,KAAK,aAAa,OAAO,gBAAgB;AAC/C,UAAM,OAAO,YAAY,KAAK;AAC9B,UAAM,cAAc,KAAK;AACzB,UAAM,cAAc,KAAK;AACzB,UAAM,wBAAwB,aAAa,aAAa,EAAE,gBAAgB,CAAC;AAAA,EAC7E,CAAC;AAED,SAAO;AACT;AA8BA,SAAS,0BACP,YACA,UACA,UACA,UACA,gBACM;AAMN,QAAM,mBAAmB,MAAa;AACpC,YAAQ,OAAO;AAAA,MACb;AAAA,IAEF;AACA,YAAQ,KAAK,WAAW,cAAc;AAAA,EACxC;AACA,QAAM,oBAA8B,YAAY;AAAA,IAC9C,aAAa,MAAM,iBAAiB;AAAA,IACpC,WAAW,MAAM,iBAAiB;AAAA,EACpC;AAEA,QAAM,QAA2B;AAAA,IAC/B,EAAE,MAAM,QAAqB,kBAAkB,OAAO,UAAU,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,cAAc,EAAE;AAAA,IACjI,EAAE,MAAM,YAAqB,kBAAkB,OAAO,UAAU,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,EAAE;AAAA,IACrH,EAAE,MAAM,QAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,oBAAoB,GAAG,mBAAmB,EAAG,EAAE;AAAA,IAC9H,EAAE,MAAM,YAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,wBAAwB,GAAG,mBAAmB,EAAG,EAAE;AAAA,IAClI,EAAE,MAAM,QAAqB,kBAAkB,OAAO,UAAU,CAAC,MAAM,oBAAoB,CAAC,EAAE;AAAA,IAC9F,EAAE,MAAM,UAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,sBAAsB,GAAG,EAAG,EAAE;AAAA,IAC7G,EAAE,MAAM,SAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,qBAAqB,GAAG,EAAG,EAAE;AAAA,IAC5G,EAAE,MAAM,UAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,sBAAsB,GAAG,EAAG,EAAE;AAAA,IAC7G,EAAE,MAAM,WAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,uBAAuB,GAAG,EAAG,EAAE;AAAA,IAC9G,EAAE,MAAM,UAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,sBAAsB,GAAG,EAAG,EAAE;AAAA,IAC7G,EAAE,MAAM,UAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,sBAAsB,GAAG,EAAG,EAAE;AAAA,IAC7G,EAAE,MAAM,cAAqB,kBAAkB,OAAO,UAAU,CAAC,MAAM,0BAA0B,CAAC,EAAE;AAAA,IACpG,EAAE,MAAM,qBAAqB,kBAAkB,MAAO,UAAU,CAAC,GAAG,IAAI,OAAO,wBAAwB,GAAG,EAAG,EAAE;AAAA,EACjH;AAEA,QAAM,OAAO,SAAS,kBAAkB;AACxC,aAAW,SAAS,OAAO;AAIzB,QAAI;AACJ,QAAI,SAAS,SAAS,SAAS,QAAQ;AAGrC,uBAAiB;AAAA,IACnB,OAAO;AACL,uBACE,mBAAmB,IAAI,MAAM,IAAI,KAAK,SAAS,qBAAqB,MAAM,IAAI;AAAA,IAClF;AACA,QAAI,CAAC,eAAgB;AAMrB,QAAI,MAAM,oBAAoB,CAAC,UAAU;AACvC,UAAI,mBAAmB,IAAI,MAAM,IAAI,GAAG;AACtC;AAAA,UACE,SAAS,MAAM,IAAI,2HACgD,MAAM,IAAI;AAAA,QAC/E;AAAA,MACF;AACA;AAAA,IACF;AAEA,UAAM,SAAS,YAAY,UAAU,QAAQ;AAAA,EAC/C;AACF;AAwBO,SAAS,qBAAqB,UAAuD;AAC1F,SAAO,kBAAkB,IAAI,QAAQ;AACvC;AAKO,SAAS,yBAA+B;AAC7C,oBAAkB,MAAM;AAC1B;AAYA,eAAsB,wBACpB,aACA,aACA,UAA0C,CAAC,GAC5B;AACf,MAAI,CAAC,eAAe,CAAC,aAAa;AAChC;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AAGF,UAAM,gBAAgB;AACtB,cAAU,MAAM;AAAA;AAAA,MAA0B;AAAA;AAAA,EAC5C,QAAQ;AACN,SAAQ,kEAA6D;AACrE;AAAA,EACF;AAKA,MAAI,aAAa;AACf,SAAQ,6DAA6D;AAAA,EACvE;AAEA,MAAI,aAAa;AACf,QAAI;AACF,YAAM,0BAA0B,SAAS,aAAa,QAAQ,eAAe;AAAA,IAC/E,SAAS,KAAK;AACZ,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,WAAQ,2CAA2C,WAAW,MAAM,GAAG,EAAE;AAAA,IAC3E;AAAA,EACF;AACF;AASA,eAAe,0BACb,SACA,aACA,iBACe;AACf,QAAM,oBAAoB,QAAQ;AAGlC,QAAM,sBAAsB,QAAQ;AAIpC,MAAI,CAAC,qBAAqB,CAAC,qBAAqB;AAE9C;AAAA,EACF;AAEA,QAAM,SAAS,IAAI,kBAAkB;AACrC,QAAM,UAAU,OAAO,KAAK,WAAW;AACvC,QAAM,WAAW,IAAI,oBAAoB;AACzC,QAAM,WAAW,SAAS,QAAQ,SAAS,EAAE,YAAY,CAAC;AAM1D,QAAM,WAAW,mBAAmB,gBAAgB,SAAS,IAAI,kBAAkB;AACnF,QAAM,kBAAkB,CAAC,WAA6B;AACpD,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,EAAG,QAAO;AAC9D,WAAO,SAAS,KAAK,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAAA,EAClD;AAEA,aAAW,OAAO,UAAU;AAC1B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AACrC,UAAM,QAAQ;AACd,UAAM,KAAK,OAAO,MAAM,aAAa,WAAW,MAAM,WAAW;AACjE,QAAI,CAAC,GAAI;AACT,QAAI,CAAC,gBAAgB,MAAM,MAAM,GAAG;AAClC;AAAA,QACE,0CAA0C,EAAE,oBAAe,OAAO,MAAM,MAAM,CAAC;AAAA,MAEjF;AACA;AAAA,IACF;AACA,UAAM,OAAQ,MAAM,YAAoD,CAAC;AACzE,UAAM,UAAU,KAAK;AACrB,QAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,GAAG;AACrE,wBAAkB,IAAI,IAAI,OAAkC;AAAA,IAC9D;AAAA,EACF;AACF;AASO,SAAS,KAAK,UAAyB;AAC5C,gBAAc,eAAe;AAI7B,QAAM,UAAU,UAAU;AAAA,IACxB;AAAA,IACA,SAAS;AAAA,IACT,SAAS;AAAA,IACT,aAAa,GAAG,YAAY,YAAY;AAAA,EAC1C,CAAC;AAED,MAAI;AACF,YAAQ,MAAM,QAAQ,IAAI;AAAA,EAC5B,SAAS,OAAgB;AACvB,QAAI,iBAAiB,gBAAgB;AAEnC,cAAQ,KAAK,MAAM,QAAQ;AAAA,IAC7B;AACA,UAAM,OAAO,iBAAiB,KAAK;AACnC,QAAI,iBAAiB,OAAO;AAC1B,cAAQ,OAAO,MAAM,UAAU,MAAM,OAAO;AAAA,CAAI;AAAA,IAClD;AACA,YAAQ,KAAK,IAAI;AAAA,EACnB;AACF;AAYO,SAAS,mBACd,WACA,UACA,oBAAoB,KACpB,SACA,UAAU,aACD;AACT,QAAM,WAAW,UAAU;AAC3B,MAAI,iBAA0C,CAAC;AAC/C,MAAI,gBAAgC,CAAC;AAGrC,QAAM,UAAU,WAAW,SAAS;AACpC,QAAM,aAAc,QAAQ,OAAO,OAAO,QAAQ,QAAQ,YAAY,CAAC,MAAM,QAAQ,QAAQ,GAAG,IAC3F,QAAQ,MACT,CAAC;AACL,QAAM,mBAA2B,WAAY,WAAW,SAAgC;AACxF,QAAM,UAAmB,WAAW,eAAsC,UAAU;AAGpF,QAAM,cAAc,UAAU;AAC9B,MAAI,eAAe,OAAO,gBAAgB,YAAY,YAAY,YAAY;AAC5E,QAAI;AACF,uBAAiB,YAAY,aAAa,IAAI,QAAQ;AAAA,IACxD,QAAQ;AACN,uBAAiB;AAAA,IACnB;AACA,oBAAgB,mBAAmB,gBAAgB,iBAAiB;AAAA,EACtE;AAEA,QAAM,MAAM,IAAIA,SAAQ,gBAAgB,EAAE,YAAY,OAAO;AAG7D,QAAM,WAAW,IAAIC,QAAO,oBAAoB,sEAAsE;AACtH,QAAM,SAAS,IAAIA,QAAO,aAAa,wDAAwD,EAAE,QAAQ,KAAK;AAC9G,QAAM,gBAAgB,IAAIA,QAAO,iBAAiB,sFAAsF,EAAE,QAAQ,KAAK;AACvJ,QAAM,YAAY,IAAIA,QAAO,qBAAqB,+CAA+C,EAC9F,QAAQ,CAAC,QAAQ,SAAS,OAAO,QAAQ,OAAO,CAAC;AACpD,QAAM,YAAY,IAAIA,QAAO,qBAAqB,kFAAkF;AAEpI,QAAM,aAAa,IAAIA,QAAO,aAAa,gFAAgF,EAAE,QAAQ,KAAK,EAAE,SAAS;AAErJ,QAAM,YAAY,IAAIA,QAAO,aAAa,8EAA8E,EAAE,QAAQ,KAAK;AAEvI,QAAM,WAAW,IAAIA,QAAO,WAAW,sEAAsE,EAAE,QAAQ,KAAK;AAE5H,QAAM,YAAY,IAAIA,QAAO,YAAY,gFAAgF,EAAE,QAAQ,KAAK;AAExI,QAAM,cAAc,IAAIA,QAAO,qBAAqB,kFAAkF,EACnI,QAAQ,CAAC,YAAY,YAAY,WAAW,eAAe,SAAS,CAAC;AAExE,QAAM,qBAAqB,IAAIA,QAAO,gCAAgC,4DAA4D,EAAE,UAAU,QAAQ;AACtJ,QAAM,mBAAmB,IAAIA,QAAO,4BAA4B,4EAA4E;AAE5I,MAAI,CAAC,SAAS;AACZ,aAAS,SAAS;AAClB,WAAO,SAAS;AAChB,kBAAc,SAAS;AACvB,cAAU,SAAS;AACnB,cAAU,SAAS;AACnB,cAAU,SAAS;AACnB,aAAS,SAAS;AAClB,cAAU,SAAS;AACnB,gBAAY,SAAS;AACrB,uBAAmB,SAAS;AAC5B,qBAAiB,SAAS;AAAA,EAC5B;AAEA,MAAI,UAAU,QAAQ;AACtB,MAAI,UAAU,MAAM;AACpB,MAAI,UAAU,aAAa;AAC3B,MAAI,UAAU,SAAS;AACvB,MAAI,UAAU,SAAS;AACvB,MAAI,UAAU,UAAU;AACxB,MAAI,UAAU,SAAS;AACvB,MAAI,UAAU,QAAQ;AACtB,MAAI,UAAU,SAAS;AACvB,MAAI,UAAU,WAAW;AACzB,MAAI,UAAU,kBAAkB;AAChC,MAAI,UAAU,gBAAgB;AAG9B,QAAM,cAAwB,CAAC;AAC/B,MAAI,CAAC,SAAS;AACZ,gBAAY,KAAK,wEAAwE;AAAA,EAC3F;AACA,MAAI,SAAS;AACX,gBAAY,KAAK,SAAS,OAAO,aAAa,gBAAgB,EAAE;AAAA,EAClE;AACA,MAAI,YAAY,SAAS,GAAG;AAC1B,QAAI,YAAY,SAAS,OAAO,YAAY,KAAK,IAAI,IAAI,IAAI;AAAA,EAC/D;AAGA,aAAW,OAAO,eAAe;AAC/B,QAAI,IAAI,UAAU;AAChB,UAAI,OAAO,IAAI,OAAO,IAAI,aAAa,IAAI,UAAU,IAAI,YAAY;AAAA,IACvE,OAAO;AACL,UAAI,OAAO,IAAI,OAAO,IAAI,aAAa,IAAI,YAA4C;AAAA,IACzF;AAAA,EACF;AAGA,MAAI,OAAO,OAAO,YAAqC;AAErD,UAAM,YAAY,QAAQ;AAC1B,UAAM,cAAc,QAAQ;AAC5B,UAAM,aAAa,QAAQ;AAC3B,UAAM,eAAe,QAAQ;AAC7B,UAAM,eAAe,QAAQ;AAC7B,UAAM,iBAAiB,QAAQ;AAC/B,UAAM,SAAS,QAAQ;AACvB,UAAM,YAAY,QAAQ;AAC1B,UAAM,aAAa,QAAQ;AAC3B,UAAM,eAAe,oBAAoB,QAAQ,UAAU,QAAQ,IAAI,mBAAmB;AAC1F,UAAM,kBAAkB;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ,IAAI;AAAA,MACZ;AAAA,IACF;AACA,UAAM,gBAAgB,QAAQ;AAG9B,UAAM,eAAwC,CAAC;AAC/C,UAAM,cAAc,oBAAI,IAAI;AAAA,MAC1B;AAAA,MAAS;AAAA,MAAO;AAAA,MAAc;AAAA,MAAU;AAAA,MAAU;AAAA,MAAW;AAAA,MAC7D;AAAA,MAAU;AAAA,MAAS;AAAA,MAAU;AAAA,MAAY;AAAA,MAAmB;AAAA,IAC9D,CAAC;AACD,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,UAAI,CAAC,YAAY,IAAI,CAAC,GAAG;AACvB,qBAAa,CAAC,IAAI;AAAA,MACpB;AAAA,IACF;AAEA,QAAI,SAAkC,CAAC;AACvC,UAAM,YAAY,YAAY,IAAI;AAElC,QAAI;AAEF,eAAS,MAAM,aAAa,WAAW,cAAc,UAAU;AAG/D,YAAM,cAAc,oBAAoB,QAAQ,aAAa;AAC7D,eAAS;AAGT,UAAI,QAAQ;AACV,YAAI,CAAC,SAAS,UAAU;AACtB,kBAAQ,OAAO,MAAM,8CAA8C;AACnE,kBAAQ,KAAK,WAAW,oBAAoB;AAAA,QAC9C;AACA,cAAM,YAAY,MAAM,SAAS,SAAS,UAAU,MAAM;AAC1D,8BAAsB,WAAW,YAAY;AAE7C,YAAI,WAAW;AACb,gBAAM,YAAY,oBAAI,IAAI;AAAA,YACxB;AAAA,YAAoB;AAAA,YAAoB;AAAA,YAAiB;AAAA,YAAa;AAAA,UACxE,CAAC;AACD,gBAAM,WAAW;AAAA,YACf;AAAA,YAAoB;AAAA,YAAoB;AAAA,YAAiB;AAAA,YACzD;AAAA,YAAiB;AAAA,YAAqB;AAAA,YAAoB;AAAA,YAC1D;AAAA,YAAqB;AAAA,YAAoB;AAAA,UAC3C;AACA,kBAAQ,OAAO,MAAM,iCAAiC;AACtD,qBAAW,KAAK,UAAU;AACxB,gBAAI,UAAU,IAAI,CAAC,GAAG;AACpB,sBAAQ,OAAO,MAAM,YAAY,EAAE,OAAO,EAAE,CAAC;AAAA,CAAgC;AAAA,YAC/E,OAAO;AACL,sBAAQ,OAAO,MAAM,YAAY,EAAE,OAAO,EAAE,CAAC;AAAA,CAAuC;AAAA,YACtF;AAAA,UACF;AAAA,QACF;AACA,gBAAQ,KAAK,UAAU,QAAQ,IAAI,oBAAoB,SAAS,CAAC;AAAA,MACnE;AAGA,UAAI,eAAe;AACjB,eAAO,kBAAkB;AAAA,MAC3B;AAGA,YAAM,cAAc,WAAW,aAAa,eAAe;AAK3D,UAAI,YAAY;AAEd,YAAI,cAAc,YAAY,MAAM,SAAS;AAC3C,kBAAQ,OAAO,MAAM,4EAA4E;AAAA,QACnG;AACA,cAAM,cAAc,UAAU;AAC9B,cAAM,cAAc,aAAa,cAAc;AAC/C,YAAI,CAAC,aAAa;AAChB,kBAAQ,OAAO;AAAA,YACb,oBAAoB,QAAQ;AAAA;AAAA,UAC9B;AAAA,QACF;AAEA,YAAI,eAAe,SAAS,QAAQ;AAClC,cAAI,SAAS;AACb,2BAAiB,SAAS,SAAS,OAAO,UAAU,MAAM,GAAG;AAC3D;AACA,oBAAQ,OAAO,MAAM,KAAK,UAAU,KAAK,IAAI,IAAI;AACjD,gBAAI,QAAQ,OAAO,OAAO;AACxB,sBAAQ,OAAO,MAAM,eAAe,QAAQ,QAAQ,MAAM,UAAU;AAAA,YACtE;AAAA,UACF;AACA,cAAI,QAAQ,OAAO,OAAO;AACxB,oBAAQ,OAAO,MAAM,IAAI;AAAA,UAC3B;AACA,gBAAMC,cAAa,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;AAG3D,gBAAM,EAAE,gBAAAC,gBAAe,IAAI,MAAM;AACjC,gBAAMC,eAAcD,gBAAe;AACnC,cAAIC,cAAa;AACf,YAAAA,aAAY,aAAa,UAAU,QAAQ,WAAW,GAAGF,WAAU;AAAA,UACrE;AACA;AAAA,QACF;AAAA,MAEF;AAGA,UAAI,aAAa,SAAS,eAAe;AACvC,cAAM,CAACG,SAAQ,KAAK,IAAI,MAAM,SAAS;AAAA,UACrC;AAAA,UACA;AAAA,UACA,eAAe,EAAE,UAAU,aAAa,IAAI;AAAA,QAC9C;AACA,cAAMH,cAAa,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;AAG3D,cAAM,WAAW,cAAc,YAAY;AAC3C,YAAI,aAAa,UAAU,CAAC,QAAQ,OAAO,OAAO;AAIhD,gBAAM,YAAY;AAAA,YAChB,UAAU,MAAM;AAAA,YAChB,mBAAmB,MAAM;AAAA,YACzB,SAAS,MAAM;AAAA,YACf,OAAO,MAAM,MAAM,IAAI,CAAC,OAAO;AAAA,cAC7B,MAAM,EAAE;AAAA,cACR,aAAa,EAAE;AAAA,cACf,SAAS,EAAE;AAAA,cACX,GAAI,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,KAAK,IAAI,CAAC;AAAA,YAC3D,EAAE;AAAA,UACJ;AACA,cAAI;AACJ,cAAI,OAAOG,YAAW,YAAYA,YAAW,QAAQ,CAAC,MAAM,QAAQA,OAAM,GAAG;AAC3E,qBAAS,EAAE,GAAIA,SAAoC,QAAQ,UAAU;AAAA,UACvE,OAAO;AACL,qBAAS,EAAE,QAAAA,SAAQ,QAAQ,UAAU;AAAA,UACvC;AACA,kBAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAAA,QAC7D,OAAO;AACL,2BAAiBA,SAAQ,cAAc,YAAY;AAEnD,gBAAM,YAAY,MAAM,MAAM;AAC9B,kBAAQ,OAAO;AAAA,YACb;AAAA,4BAA+B,MAAM,YAAY,KAC9C,SAAS,WAAW,MAAM,gBAAgB,QAAQ,CAAC,CAAC;AAAA;AAAA,UACzD;AACA,qBAAW,KAAK,MAAM,OAAO;AAC3B,gBAAI,EAAE,SAAS;AACb,oBAAM,SAAS,EAAE,cAAc;AAC/B,sBAAQ,OAAO,MAAM,YAAY,EAAE,KAAK,OAAO,EAAE,CAAC,IAAI,SAAS,SAAS,CAAC,CAAC,cAAc,MAAM;AAAA,CAAK;AAAA,YACrG,OAAO;AACL,sBAAQ,OAAO,MAAM,YAAY,EAAE,KAAK,OAAO,EAAE,CAAC,KAAK,EAAE,WAAW,QAAQ,CAAC,IAAI,MAAM,SAAS,CAAC,CAAC;AAAA,CAAI;AAAA,YACxG;AAAA,UACF;AAAA,QACF;AAEA,cAAM,EAAE,gBAAgB,OAAO,IAAI,MAAM;AACzC,cAAM,MAAM,OAAO;AACnB,YAAI,KAAK;AACP,cAAI,aAAa,UAAU,QAAQ,WAAW,GAAGH,WAAU;AAAA,QAC7D;AACA;AAAA,MACF;AAGA,UAAI;AACJ,UAAI,gBAAgB,SAAS,eAAe;AAE1C,cAAM,CAAC,GAAG,IAAI,MAAM,SAAS;AAAA,UAC3B;AAAA,UACA;AAAA,UACA,EAAE,UAAU,aAAa;AAAA,QAC3B;AACA,iBAAS;AACT,YAAI,iBAAiB,cAAc,QAAQ,OAAO,OAAO;AACvD,kBAAQ,OAAO,MAAM,mBAAmB,YAAY;AAAA,CAAe;AAAA,QACrE;AAAA,MACF,OAAO;AACL,cAAM,EAAE,SAAAI,SAAQ,IAAI,MAAM;AAC1B,cAAM,UAAU,IAAIA,SAAQ,cAAc;AAC1C,iBAAS,MAAM,QAAQ,QAAQ,UAAU,QAAQ,QAAQ;AAAA,MAC3D;AACA,YAAM,aAAa,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;AAG3D,uBAAiB,QAAQ,cAAc,YAAY;AAInD,YAAM,EAAE,gBAAAH,gBAAe,IAAI,MAAM;AACjC,YAAM,cAAcA,gBAAe;AACnC,UAAI,aAAa;AACf,oBAAY,aAAa,UAAU,QAAQ,WAAW,GAAG,UAAU;AAAA,MACrE;AAAA,IACF,SAAS,KAAc;AAErB,YAAM,WAAW,iBAAiB,GAAG;AACrC,YAAM,aAAa,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;AAG3D,UAAI;AACF,cAAM,EAAE,gBAAAA,gBAAe,IAAI,MAAM;AACjC,cAAM,cAAcA,gBAAe;AACnC,YAAI,aAAa;AACf,sBAAY,aAAa,UAAU,QAAQ,SAAS,UAAU,UAAU;AAAA,QAC1E;AAAA,MACF,QAAQ;AAAA,MAER;AAEA,UAAI,iBAAiB,UAAU,CAAC,QAAQ,OAAO,OAAO;AACpD,sBAAc,KAAK,QAAQ;AAAA,MAC7B,OAAO;AACL,qBAAa,KAAK,QAAQ;AAAA,MAC5B;AACA,cAAQ,KAAK,QAAQ;AAAA,IACvB;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAeA,eAAsB,aACpB,WACA,YAAqC,CAAC,GACtC,YACkC;AAElC,QAAM,mBAA4C,CAAC;AACnD,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC9C,QAAI,MAAM,QAAQ,MAAM,QAAW;AACjC,uBAAiB,CAAC,IAAI;AAAA,IACxB;AAAA,EACF;AAEA,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI,cAAc,KAAK;AACrB,UAAM,MAAM,UAAU;AACtB,aAAS;AAAA,EACX,OAAO;AAEL,aAAS,SAAS,SAAS;AAC3B,QAAI;AACF,YAAMN,cAAa,WAAW,OAAO;AAAA,IACvC,SAAS,KAAK;AACZ,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,cAAQ,OAAO,MAAM,+BAA+B,MAAM,KAAK,GAAG;AAAA,CAAI;AACtE,cAAQ,KAAK,WAAW,iBAAiB;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,WAAW,KAAK,OAAO;AAC9C,MAAI,UAAU,YAAc,CAAC,YAAY;AACvC,YAAQ,OAAO;AAAA,MACb,UAAU,MAAM;AAAA;AAAA,IAClB;AACA,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AAEA,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,YAAQ,OAAO,MAAM,UAAU,MAAM;AAAA,CAAiC;AACtE,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AAEA,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,YAAQ,OAAO;AAAA,MACb,UAAU,MAAM,gCAAgC,MAAM,QAAQ,MAAM,IAAI,UAAU,OAAO,MAAM;AAAA;AAAA,IACjG;AACA,YAAQ,KAAK,WAAW,iBAAiB;AAAA,EAC3C;AAGA,SAAO,EAAE,GAAI,QAAoC,GAAG,iBAAiB;AACvE;AAKA,SAAS,YAA6B;AACpC,SAAO,IAAI,QAAQ,CAACU,UAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,UAAM,SAAS,CAAC,UAAkB,OAAO,KAAK,KAAK;AACnD,UAAM,QAAQ,MAAM;AAClB,cAAQ;AACR,MAAAA,SAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,OAAO,CAAC;AAAA,IACjD;AACA,UAAM,UAAU,CAAC,QAAe;AAC9B,cAAQ;AACR,aAAO,GAAG;AAAA,IACZ;AACA,UAAM,UAAU,MAAM;AACpB,cAAQ,MAAM,eAAe,QAAQ,MAAM;AAC3C,cAAQ,MAAM,eAAe,OAAO,KAAK;AACzC,cAAQ,MAAM,eAAe,SAAS,OAAO;AAAA,IAC/C;AACA,YAAQ,MAAM,GAAG,QAAQ,MAAM;AAC/B,YAAQ,MAAM,GAAG,OAAO,KAAK;AAC7B,YAAQ,MAAM,GAAG,SAAS,OAAO;AACjC,YAAQ,MAAM,OAAO;AAAA,EACvB,CAAC;AACH;AAUO,SAAS,oBACd,QACA,SACyB;AACzB,QAAM,SAAS,EAAE,GAAG,OAAO;AAC3B,aAAW,OAAO,SAAS;AACzB,QAAI,CAAC,IAAI,kBAAmB;AAC5B,UAAM,YAAY,IAAI;AACtB,QAAI,EAAE,aAAa,WAAW,OAAO,SAAS,MAAM,QAAQ,OAAO,SAAS,MAAM,QAAW;AAC3F;AAAA,IACF;AACA,UAAM,SAAS,OAAO,OAAO,SAAS,CAAC;AACvC,UAAM,WAAW,IAAI,kBAAkB,MAAM;AAC7C,QAAI,aAAa,OAAO;AACtB,aAAO,SAAS,IAAI,SAAS,QAAQ,EAAE;AAAA,IACzC,WAAW,aAAa,SAAS;AAC/B,aAAO,SAAS,IAAI,WAAW,MAAM;AAAA,IACvC,WAAW,aAAa,QAAQ;AAC9B,aAAO,SAAS,IAAI,OAAO,YAAY,MAAM;AAAA,IAC/C;AAAA,EACF;AACA,SAAO;AACT;AA1zCA,IA8CMC,YASF,aAYA,SA2DA,SA4cE,oBA2GA;AArrBN;AAAA;AAAA;AAAA;AAaA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAMA;AAQA;AACA;AAEA;AACA;AAEA;AA2oCA;AAzoCA,IAAMA,aAAiB,cAAQV,eAAc,YAAY,GAAG,CAAC;AAS7D,IAAI,cAAc;AAYlB,IAAI,UAAyB;AA2D7B,IAAI,UAAU;AACd,QAAI;AACF,YAAM,MAAM,KAAK,MAAMD,cAAkB,cAAQW,YAAW,iBAAiB,GAAG,OAAO,CAAC;AACxF,gBAAU,IAAI;AAAA,IAChB,QAAQ;AAAA,IAER;AAscA,IAAM,qBAA0C,oBAAI,IAAY,CAAC,MAAM,CAAC;AA2GxE,IAAM,oBAAoB,oBAAI,IAAqC;AAAA;AAAA;;;ACrrBnE;AASA,IAAM,aAAa,QAAQ,KAAK,QAAQ,2BAA2B;AACnE,IAAI,eAAe,IAAI;AACrB,QAAM,WAAW,QAAQ,KAAK,aAAa,CAAC;AAC5C,MAAI,CAAC,UAAU;AACb,YAAQ,OAAO,MAAM,4DAA4D;AACjF,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,kEAAqC,KAAK,CAAC,EAAE,kBAAAC,kBAAiB,MAAM;AAClE,IAAAA,kBAAiB,QAAQ,EAAE,MAAM,CAAC,QAAiB;AACjD,cAAQ,OAAO,MAAM,yBAAyB,GAAG;AAAA,CAAI;AACrD,cAAQ,KAAK,CAAC;AAAA,IAChB,CAAC;AAAA,EACH,CAAC;AACH,OAAO;AACL,4DAAyB,KAAK,CAAC,EAAE,MAAAC,MAAK,MAAM;AAC1C,IAAAA,MAAK,YAAY;AAAA,EACnB,CAAC;AACH;","names":["join","resolve","resolve","sep","path","fs","yaml","docsUrl","fs","path","fs","os","path","crypto","os","hostname","Command","Option","Sandbox","Command","Command","Option","readFileSync","fileURLToPath","path","Command","Option","durationMs","getAuditLogger","auditLogger","result","Sandbox","resolve","__dirname","runSandboxRunner","main"]}