memeloop 0.2.2 → 0.2.4

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/orchestration/artifacts/verifierOnlyTransitions.ts","../src/orchestration/artifacts/artifactReviewWriter.ts","../src/orchestration/controllerRunner.ts","../src/orchestration/controllers/fleetRollout.ts","../src/orchestration/controlStore.ts","../src/orchestration/controllers/storageReplication.ts","../src/orchestration/controlStoreClient.ts","../src/orchestration/credentialGrantController.ts","../src/orchestration/drivers/controlStoreAuditTelemetryAdapter.ts","../src/orchestration/drivers/controlStorePolicyApprovalAdapter.ts","../src/orchestration/drivers/driverConformance.ts","../src/orchestration/drivers/driverConformanceFixtures.ts","../src/orchestration/drivers/externalDriver.ts","../src/orchestration/drivers/externalToolContract.ts","../src/orchestration/drivers/externalWorkloadContract.ts","../src/orchestration/drivers/localModelRegistration.ts","../src/orchestration/drivers/managedArtifactAdapter.ts","../src/orchestration/drivers/storageDriver.ts","../src/orchestration/drivers/managedStorageDriverAdapter.ts","../src/orchestration/drivers/managedToolExecutionRoute.ts","../src/orchestration/security/workerIdentity.ts","../src/orchestration/drivers/managedWorkerIdentityAdapter.ts","../src/orchestration/drivers/modelEndpointRegistrar.ts","../src/orchestration/drivers/modelGateway.ts","../src/orchestration/drivers/toolExecutionDriver.ts","../src/orchestration/externalOrchestrationController.ts","../src/orchestration/loopRuntimeDriver.ts","../src/orchestration/modelEndpointBindingController.ts","../src/orchestration/networkAttachmentController.ts","../src/orchestration/runVolumeController.ts","../src/orchestration/scheduler.ts","../src/orchestration/security/auditRecordAuthorizer.ts","../src/orchestration/security/credentialBroker.ts","../src/orchestration/security/identityLifecycle.ts","../src/orchestration/security/nodeTrustAdmission.ts","../src/orchestration/security/policyDecisionAuthorizer.ts","../src/orchestration/security/quarantineGateway.ts","../src/orchestration/security/workerProtocol.ts","../src/orchestration/security/workloadCapabilityGrant.ts","../src/orchestration/stores/quorumControlStore.ts","../src/orchestration/toolOperationController.ts","../src/orchestration/volumeClaimController.ts","../src/orchestration/workloadExecutionController.ts","../src/loopAPI/controlStoreLoopCheckpointStore.ts","../src/types.ts","../src/storage/conformance.ts","../src/storage/sessionStorage.ts","../src/agent/tiddlerTemplateConverter.ts","../src/network/gitProxyUrlPolicy.ts","../src/network/uri.ts","../src/device-network/agentRuntimeRpcHandler.ts","../src/device-network/peerDriverTransport.ts","../src/network/terminalNotifications.ts","../src/im/channelManager.ts","../src/im/imPlatformLimits.ts","../src/im/slashCommands.ts","../src/im/streamAgentReplyToIm.ts","../src/im/textRenderer.ts","../src/im/tools.ts","../src/tools/builtins/imBuiltinTools.ts","../src/tools/builtins/index.ts","../src/tools/parallelExecution.ts","../src/tools/schemaToToolContent.ts","../src/tools/defineTool.ts","../src/tools/hostAgentTools.ts","../src/tools/toolRegistry.ts"],"sourcesContent":["import type { ControlStoreAuthorizationRequest } from '../controlStore.js';\nimport type { ArtifactRecordResource, ArtifactRecordStatus, ArtifactReviewEvidence } from '../resources.js';\nimport { ARTIFACT_RECORD_KIND } from '../resources.js';\n\n/**\n * Verifier-only protected transitions for ArtifactRecord (plan 24.52).\n *\n * Artifact review evidence (scan, sanitize, verify) can only be appended by\n * verifier actors. Storage drivers, controllers, and workers cannot write\n * review outcomes or unquarantine artifacts. This ensures that trust\n * promotion is always grounded in an external, attested verification step.\n */\n\nexport interface VerifierOnlyTransitionOptions {\n  /** Actor ID prefix that identifies trusted verifiers. */\n  verifierActorPrefix?: string;\n  /** Allow quarantine by any actor (fail-safe). Default: true. */\n  allowAnyActorQuarantine?: boolean;\n}\n\nconst DEFAULT_VERIFIER_PREFIX = 'verifier/';\n\n/**\n * Create a ControlStore authorizer that enforces verifier-only transitions\n * for ArtifactRecord resources.\n *\n * Rules:\n * 1. Only verifier actors may append reviews or change quarantine status.\n * 2. Review evidence must be bound to the current content hash.\n * 3. Review evidence must record the verifier's actor ID.\n * 4. Quarantine is fail-safe: any actor may quarantine, but only verifiers\n *    may unquarantine (by appending a passing verify review).\n * 5. Non-verifier actors may still read and create ArtifactRecords.\n */\nexport function createVerifierOnlyAuthorizer(\n  options: VerifierOnlyTransitionOptions = {},\n): (request: ControlStoreAuthorizationRequest) => void {\n  const verifierPrefix = options.verifierActorPrefix ?? DEFAULT_VERIFIER_PREFIX;\n  const allowAnyActorQuarantine = options.allowAnyActorQuarantine ?? true;\n\n  return (request: ControlStoreAuthorizationRequest) => {\n    if (request.reference.kind !== ARTIFACT_RECORD_KIND) return;\n\n    const { actor, verb, current, proposedStatus } = request;\n\n    if (verb === 'create') {\n      // Creation is allowed for any actor; trust is set in spec at creation.\n      return;\n    }\n\n    if (verb === 'update-status' && current && proposedStatus) {\n      const currentStatus = current.status as ArtifactRecordStatus | undefined;\n      const proposed = proposedStatus as ArtifactRecordStatus;\n\n      const currentReviews = currentStatus?.reviews ?? [];\n      const proposedReviews = proposed.reviews ?? [];\n\n      // If no review changes and no quarantine change, allow.\n      const reviewsUnchanged = currentReviews.length === proposedReviews.length &&\n        currentReviews.every((review, index) => {\n          const proposedReview = proposedReviews[index];\n          return (\n            review.kind === proposedReview.kind &&\n            review.outcome === proposedReview.outcome &&\n            review.reviewer === proposedReview.reviewer &&\n            review.contentHash === proposedReview.contentHash &&\n            review.policyDigest === proposedReview.policyDigest &&\n            review.recordedAt === proposedReview.recordedAt &&\n            review.destinations.length === proposedReview.destinations.length &&\n            review.destinations.every((destination, destinationIndex) => destination === proposedReview.destinations[destinationIndex])\n          );\n        });\n      const currentQuarantined = currentStatus?.quarantined ?? false;\n      const proposedQuarantined = proposed.quarantined ?? false;\n      const quarantineUnchanged = currentQuarantined === proposedQuarantined &&\n        (currentStatus?.quarantineReason ?? '') === (proposed.quarantineReason ?? '');\n\n      if (reviewsUnchanged && quarantineUnchanged) {\n        return;\n      }\n\n      // Quarantine is fail-safe: any actor may quarantine.\n      const isQuarantineOnly = !currentStatus?.quarantined &&\n        proposed.quarantined === true &&\n        reviewsUnchanged;\n\n      if (isQuarantineOnly && allowAnyActorQuarantine) {\n        return;\n      }\n\n      // All other transitions require a verifier actor.\n      if (!actor.id.startsWith(verifierPrefix)) {\n        throw new Error(\n          `ArtifactRecord review and unquarantine transitions require a verifier actor (prefix: ${verifierPrefix}), got ${actor.id}`,\n        );\n      }\n\n      // New reviews must be appended, not modified or removed.\n      if (proposedReviews.length < currentReviews.length) {\n        throw new Error('ArtifactRecord reviews cannot be removed');\n      }\n      for (let index = 0; index < currentReviews.length; index += 1) {\n        if (currentReviews[index] !== proposedReviews[index]) {\n          throw new Error('ArtifactRecord reviews cannot be modified');\n        }\n      }\n\n      // Validate each new review.\n      const newReviews = proposedReviews.slice(currentReviews.length);\n      const artifact = current as unknown as ArtifactRecordResource;\n      for (const review of newReviews) {\n        validateReviewEvidence(review, artifact, actor.id);\n      }\n\n      return;\n    }\n  };\n}\n\nfunction validateReviewEvidence(\n  review: ArtifactReviewEvidence,\n  artifact: ArtifactRecordResource,\n  actorId: string,\n): void {\n  if (review.contentHash !== artifact.spec.contentHash) {\n    throw new Error(\n      `Review contentHash ${review.contentHash} does not match artifact contentHash ${artifact.spec.contentHash}`,\n    );\n  }\n  if (review.reviewer !== actorId) {\n    throw new Error(\n      `Review reviewer ${review.reviewer} must match the acting verifier ${actorId}`,\n    );\n  }\n  if (review.recordedAt.length === 0) {\n    throw new Error('Review must record recordedAt timestamp');\n  }\n}\n\n/**\n * Check whether an actor ID belongs to a verifier.\n */\nexport function isVerifierActor(actorId: string, verifierPrefix: string = DEFAULT_VERIFIER_PREFIX): boolean {\n  return actorId.startsWith(verifierPrefix);\n}\n","import type { OrchestrationResource } from '../client.js';\nimport type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport type { ArtifactRecordResource, ArtifactRecordStatus, ArtifactReviewEvidence } from '../resources.js';\nimport { ARTIFACT_RECORD_KIND } from '../resources.js';\nimport type { ArtifactReviewWriter } from './artifactTrust.js';\nimport { createVerifierOnlyAuthorizer } from './verifierOnlyTransitions.js';\n\n/**\n * ControlStore-backed ArtifactReviewWriter (plan 24.47).\n *\n * Every review append or quarantine goes through ControlStore.updateStatus,\n * protected by the verifier-only authorizer. The authorizer is injected so\n * callers in different hosts can wire the verifier actor prefix appropriate\n * to their trust model.\n */\n\nexport function createControlStoreArtifactReviewWriter(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  authorizer: ReturnType<typeof createVerifierOnlyAuthorizer> = createVerifierOnlyAuthorizer(),\n): ArtifactReviewWriter {\n  return {\n    async appendReview(_contentHash: string, evidence: ArtifactReviewEvidence) {\n      const current = await store.get({\n        kind: ARTIFACT_RECORD_KIND,\n        namespace: 'default',\n        name: evidence.contentHash,\n        apiVersion: 'execution.memeloop.io/v1alpha1',\n      }) as unknown as ArtifactRecordResource | null;\n\n      if (!current) {\n        throw new Error(`ArtifactRecord not found for contentHash ${evidence.contentHash}`);\n      }\n\n      const currentReviews = current.status?.reviews ?? [];\n      const proposedStatus: ArtifactRecordStatus = {\n        ...current.status,\n        reviews: [...currentReviews, evidence],\n      };\n\n      // Authorize: verifier-only transition.\n      authorizer({\n        actor,\n        verb: 'update-status',\n        reference: {\n          kind: ARTIFACT_RECORD_KIND,\n          namespace: 'default',\n          name: evidence.contentHash,\n          apiVersion: 'execution.memeloop.io/v1alpha1',\n        },\n        current: current as unknown as OrchestrationResource,\n        proposedStatus,\n      });\n\n      await store.updateStatus(\n        actor,\n        {\n          kind: ARTIFACT_RECORD_KIND,\n          namespace: current.metadata.namespace,\n          name: current.metadata.name,\n          apiVersion: current.apiVersion,\n        },\n        proposedStatus,\n        { resourceVersion: current.metadata.resourceVersion },\n      );\n    },\n\n    async quarantine(contentHash: string, reason: string) {\n      const current = await store.get({\n        kind: ARTIFACT_RECORD_KIND,\n        namespace: 'default',\n        name: contentHash,\n        apiVersion: 'execution.memeloop.io/v1alpha1',\n      }) as unknown as ArtifactRecordResource | null;\n\n      if (!current) {\n        throw new Error(`ArtifactRecord not found for contentHash ${contentHash}`);\n      }\n\n      const proposedStatus: ArtifactRecordStatus = {\n        ...current.status,\n        quarantined: true,\n        quarantineReason: reason,\n      };\n\n      // Authorize: any actor may quarantine (fail-safe).\n      authorizer({\n        actor,\n        verb: 'update-status',\n        reference: {\n          kind: ARTIFACT_RECORD_KIND,\n          namespace: 'default',\n          name: contentHash,\n          apiVersion: 'execution.memeloop.io/v1alpha1',\n        },\n        current: current as unknown as OrchestrationResource,\n        proposedStatus,\n      });\n\n      await store.updateStatus(\n        actor,\n        {\n          kind: ARTIFACT_RECORD_KIND,\n          namespace: current.metadata.namespace,\n          name: current.metadata.name,\n          apiVersion: current.apiVersion,\n        },\n        proposedStatus,\n        { resourceVersion: current.metadata.resourceVersion },\n      );\n    },\n  };\n}\n","import type { OrchestrationResource, OrchestrationResourceStatus } from './client.js';\nimport type { ControlStore, ControlStoreActor } from './controlStore.js';\n\nexport interface ControllerReconcileRequest<\n  TSpec = Record<string, unknown>,\n  TStatus = OrchestrationResourceStatus,\n> {\n  resource: OrchestrationResource<TSpec, TStatus>;\n  actor: ControlStoreActor;\n  leaseEpoch: string;\n  now: Date;\n}\n\nexport interface ControllerReconcileResult<\n  TStatus extends OrchestrationResourceStatus = OrchestrationResourceStatus,\n> {\n  /** New status to write; omit to leave status unchanged. */\n  status?: TStatus;\n  /** If true, the resource is ready; controller stops reconciling until it changes. */\n  ready?: boolean;\n  /** Optional requeue delay when the controller wants to try again later. */\n  requeueAfterMs?: number;\n}\n\nexport interface Controller<\n  TSpec = Record<string, unknown>,\n  TStatus extends OrchestrationResourceStatus = OrchestrationResourceStatus,\n> {\n  reconcile(request: ControllerReconcileRequest<TSpec, TStatus>): Promise<ControllerReconcileResult<TStatus>>;\n}\n\nexport interface ControllerRunnerOptions<\n  TSpec = Record<string, unknown>,\n  TStatus extends OrchestrationResourceStatus = OrchestrationResourceStatus,\n> {\n  /** Controller identity used for all ControlStore writes. */\n  actor: ControlStoreActor;\n  /** Lease name; controllers with the same name compete for the lease. */\n  leaseName: string;\n  /** Resource kind this controller reconciles (passed to ControlStore.watch). */\n  watchKind: string;\n  /** How long the lease is valid before it must be renewed. */\n  leaseTtlMs: number;\n  /** How often to renew the lease while running. */\n  leaseRenewIntervalMs?: number;\n  /** Initial backoff after a reconcile failure. */\n  retryBaseDelayMs?: number;\n  /** Maximum backoff after consecutive reconcile failures. */\n  retryMaxDelayMs?: number;\n  /** Filter which resources this controller reconciles. */\n  resourceFilter?: (resource: OrchestrationResource<TSpec, TStatus>) => boolean;\n  /** Injectable clock for deterministic tests. */\n  now?: () => Date;\n  /** Injectable sleep for deterministic tests. */\n  sleep?: (ms: number) => Promise<void>;\n}\n\nexport interface ControllerRunnerHandle {\n  /** Stop watching and release the lease. */\n  stop(): Promise<void>;\n  /** Wait until the runner has fully stopped. */\n  done(): Promise<void>;\n}\n\n/**\n * Restart-safe generic controller runner.\n *\n * Watches a ControlStore query, acquires a lease, and calls `controller.reconcile`\n * for each matching resource. On success it may update status and mark Ready.\n * On failure it retries with exponential backoff. If the process crashes, the\n * lease expires and another runner takes over; watch replay resumes from the\n * last acknowledged resource version.\n */\nexport async function createControllerRunner<\n  TSpec = Record<string, unknown>,\n  TStatus extends OrchestrationResourceStatus = OrchestrationResourceStatus,\n>(\n  store: ControlStore,\n  controller: Controller<TSpec, TStatus>,\n  options: ControllerRunnerOptions<TSpec, TStatus>,\n): Promise<ControllerRunnerHandle> {\n  const now = options.now ?? (() => new Date());\n  const sleep = options.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n  const leaseRenewInterval = options.leaseRenewIntervalMs ?? Math.max(1, Math.floor(options.leaseTtlMs / 3));\n  const retryBaseDelay = options.retryBaseDelayMs ?? 100;\n  const retryMaxDelay = options.retryMaxDelayMs ?? 30_000;\n\n  let stopped = false;\n  let currentLease: Awaited<ReturnType<ControlStore['acquireLease']>> | null = null;\n  const pendingRetries = new Map<string, ReturnType<typeof setTimeout>>();\n  let stopWatch: (() => void) | null = null;\n\n  // Acquire the lease before watching so a standby runner does not process\n  // stale events from before it became leader.\n  currentLease = await store.acquireLease(options.actor, {\n    name: options.leaseName,\n    holder: options.actor.id,\n    ttlMs: options.leaseTtlMs,\n  });\n\n  const stopPromise = (async () => {\n    if (stopped) {\n      await store.releaseLease(options.actor, currentLease).catch(() => undefined);\n      currentLease = null;\n      return;\n    }\n\n    const renewTimer = setInterval(async () => {\n      if (stopped || !currentLease) return;\n      try {\n        currentLease = await store.renewLease(options.actor, currentLease, options.leaseTtlMs);\n      } catch {\n        // Lost lease (or the store went away); stop reconciling and let\n        // another runner take over. Break the watch loop and stop renewing\n        // so a closed store does not leave a live timer behind.\n        stopped = true;\n        clearInterval(renewTimer);\n        stopWatch?.();\n      }\n    }, leaseRenewInterval);\n\n    const watcher = store.watch<TSpec, TStatus>(\n      { kind: options.watchKind },\n      { sendInitialEvents: true },\n    );\n    const iterator = watcher[Symbol.asyncIterator]();\n    stopWatch = () => void iterator.return?.();\n\n    try {\n      while (!stopped) {\n        const result = await iterator.next();\n        if (result.done === true || result.value === undefined) break;\n        const event = result.value;\n        if (event.type !== 'ADDED' && event.type !== 'MODIFIED') continue;\n\n        const resource = event.resource;\n        if (\n          options.resourceFilter &&\n          !options.resourceFilter(resource)\n        ) continue;\n\n        const key = `${resource.metadata.namespace}/${resource.metadata.name}`;\n        if (pendingRetries.has(key)) continue;\n\n        await reconcileWithRetry(key, resource);\n      }\n    } finally {\n      clearInterval(renewTimer);\n      for (const timer of pendingRetries.values()) clearTimeout(timer);\n      pendingRetries.clear();\n      if (currentLease) {\n        await store.releaseLease(options.actor, currentLease).catch(() => undefined);\n        currentLease = null;\n      }\n    }\n  })();\n\n  async function reconcileWithRetry(\n    key: string,\n    resource: OrchestrationResource<TSpec, TStatus>,\n    attempt = 0,\n  ): Promise<void> {\n    if (stopped || !currentLease) return;\n\n    try {\n      const result = await controller.reconcile({\n        resource,\n        actor: options.actor,\n        leaseEpoch: currentLease.epoch,\n        now: now(),\n      });\n\n      if (result.status && Object.keys(result.status).length > 0) {\n        await store.updateStatus(\n          options.actor,\n          {\n            apiVersion: resource.apiVersion,\n            kind: resource.kind,\n            namespace: resource.metadata.namespace,\n            name: resource.metadata.name,\n          },\n          result.status,\n          {\n            resourceVersion: resource.metadata.resourceVersion,\n          },\n        );\n      }\n\n      if (result.requeueAfterMs !== undefined && result.requeueAfterMs > 0) {\n        const timer = setTimeout(() => {\n          pendingRetries.delete(key);\n          if (!stopped) void regetAndReconcile(key, resource, 0);\n        }, result.requeueAfterMs);\n        pendingRetries.set(key, timer);\n      }\n    } catch {\n      const delay = Math.min(retryMaxDelay, retryBaseDelay * 2 ** attempt);\n      const timer = setTimeout(() => {\n        pendingRetries.delete(key);\n        if (!stopped) void regetAndReconcile(key, resource, attempt + 1);\n      }, delay);\n      pendingRetries.set(key, timer);\n    }\n  }\n\n  /**\n   * Requeue/retry must reconcile the CURRENT resource, not the snapshot the\n   * timer captured: controllers whose progress lives in status (e.g. fleet\n   * rollout batches) would otherwise reprocess the same stage forever and\n   * fail every status CAS against the newer resourceVersion.\n   */\n  async function regetAndReconcile(\n    key: string,\n    fallback: OrchestrationResource<TSpec, TStatus>,\n    attempt: number,\n  ): Promise<void> {\n    let current: OrchestrationResource<TSpec, TStatus> | null;\n    try {\n      current = await store.get<TSpec, TStatus>({\n        apiVersion: fallback.apiVersion,\n        kind: fallback.kind,\n        namespace: fallback.metadata.namespace,\n        name: fallback.metadata.name,\n      });\n    } catch {\n      // An unavailable current read is uncertainty, not permission to act on\n      // the captured snapshot. Retry the read with backoff and do no work\n      // until the authoritative resource can be observed again.\n      const delay = Math.min(retryMaxDelay, retryBaseDelay * 2 ** attempt);\n      const timer = setTimeout(() => {\n        pendingRetries.delete(key);\n        if (!stopped) void regetAndReconcile(key, fallback, attempt + 1);\n      }, delay);\n      pendingRetries.set(key, timer);\n      return;\n    }\n    // A deleted resource must never fall back to the stale snapshot: doing\n    // so can repeat a side effect after its cancellation/delete request.\n    if (!current) return;\n    await reconcileWithRetry(key, current, attempt);\n  }\n\n  return {\n    async stop() {\n      stopped = true;\n      stopWatch?.();\n      // Release the lease immediately; do not wait for a potentially stuck watch.\n      if (currentLease) {\n        await store.releaseLease(options.actor, currentLease).catch(() => undefined);\n        currentLease = null;\n      }\n      // Give the background loop a short grace period to clean up timers.\n      await Promise.race([\n        stopPromise.catch(() => undefined),\n        sleep(50),\n      ]);\n    },\n    done: () => stopPromise,\n  };\n}\n","import type { OrchestrationResource } from '../client.js';\nimport type { Controller, ControllerReconcileResult } from '../controllerRunner.js';\nimport type { ControlStore, ControlStoreActor } from '../controlStore.js';\n\nexport const FLEET_ROLLOUT_API_VERSION = 'fleet.memeloop.io/v1alpha1';\nexport const FLEET_ROLLOUT_KIND = 'FleetRollout';\n\nexport type RolloutStrategy = 'batch' | 'canary';\n\nexport interface FleetRolloutSpec {\n  /** Target resource kind to roll out (e.g. AgentWorkload). */\n  targetKind: string;\n  /** Target namespace. */\n  targetNamespace?: string;\n  /** Label selector for target resources. */\n  selector?: Record<string, string>;\n  /** Rollout strategy. */\n  strategy: RolloutStrategy;\n  /** Batch size for batch strategy. */\n  batchSize?: number;\n  /** Canary stages for canary strategy. */\n  canaryStages?: Array<{\n    weight: number;\n    pauseDurationMs?: number;\n  }>;\n  /** Maximum unavailable resources during rollout. */\n  maxUnavailable?: number;\n  /** Maximum surge resources during rollout. */\n  maxSurge?: number;\n  /** Maximum concurrent target updates (default: 1 = sequential). */\n  maxConcurrency?: number;\n  /** Rollout deadline in milliseconds. */\n  deadlineMs?: number;\n  /** Pause rollout on failure threshold. */\n  pauseOnFailureThreshold?: number;\n  /**\n   * Pause when at least this many targets report drift — the host observed\n   * their actual state diverging from the desired template (§8.4/§8.8).\n   */\n  pauseOnDriftThreshold?: number;\n  /**\n   * Pause when at least this many targets carry host-reported security\n   * findings (§8.8). Fail-safe recommendation: 1 (any finding pauses).\n   */\n  pauseOnSecurityThreshold?: number;\n  /** Automatically rollback updated targets when failure threshold is reached. */\n  autoRollback?: boolean;\n  /**\n   * Aggregate budget for the whole rollout (§8.8 cost threshold). Usage is\n   * metered from per-target update results; the rollout pauses between\n   * batches/stages once a limit is reached (overshoot is bounded by the\n   * in-flight batch).\n   */\n  budget?: {\n    maxTokens?: number;\n    maxCost?: number;\n  };\n  /**\n   * Per-run budget cap for a single target (§8: bounded per-run model\n   * budget). A target whose reported usage exceeds the cap counts as a\n   * failure with a budget reason.\n   */\n  perTargetBudget?: {\n    maxTokens?: number;\n    maxCost?: number;\n  };\n}\n\n/** Metered model usage reported by a target update (tokens/cost). */\nexport interface TargetUsage {\n  tokens?: number;\n  cost?: number;\n}\n\n/** Result of updating one target; usage feeds rollout budget accounting. */\nexport interface TargetUpdateResult {\n  usage?: TargetUsage;\n}\n\nexport interface RolloutEvidenceEntry {\n  resourceName: string;\n  outcome: 'success' | 'failure' | 'skipped';\n  message?: string;\n  timestamp: string;\n  /** Metered model usage for this target's run. */\n  usage?: TargetUsage;\n}\n\n/** Sum metered usage across evidence entries (idempotent accounting). */\nexport function sumEvidenceUsage(evidence: readonly RolloutEvidenceEntry[] | undefined): { tokens: number; cost: number } {\n  let tokens = 0;\n  let cost = 0;\n  for (const event of evidence ?? []) {\n    tokens += event.usage?.tokens ?? 0;\n    cost += event.usage?.cost ?? 0;\n  }\n  // Round float noise from per-target cost accumulation (deterministic status).\n  return { tokens: Math.round(tokens * 1e6) / 1e6, cost: Math.round(cost * 1e6) / 1e6 };\n}\n\nfunction budgetExceeded(budget: FleetRolloutSpec['budget'], consumed: { tokens: number; cost: number }): string | undefined {\n  if (!budget) return undefined;\n  if (budget.maxTokens !== undefined && consumed.tokens >= budget.maxTokens) {\n    return `tokens ${consumed.tokens} >= ${budget.maxTokens}`;\n  }\n  if (budget.maxCost !== undefined && consumed.cost >= budget.maxCost) {\n    return `cost ${consumed.cost} >= ${budget.maxCost}`;\n  }\n  return undefined;\n}\n\nfunction perTargetBudgetExceeded(cap: FleetRolloutSpec['perTargetBudget'], usage: TargetUsage | undefined): string | undefined {\n  if (!cap || !usage) return undefined;\n  if (cap.maxTokens !== undefined && (usage.tokens ?? 0) > cap.maxTokens) {\n    return `tokens ${usage.tokens} > per-run cap ${cap.maxTokens}`;\n  }\n  if (cap.maxCost !== undefined && (usage.cost ?? 0) > cap.maxCost) {\n    return `cost ${usage.cost} > per-run cap ${cap.maxCost}`;\n  }\n  return undefined;\n}\n\n/**\n * Process targets with bounded concurrency. Returns evidence for each target.\n * Targets exceeding the per-run budget cap are converted to failures (§8).\n */\nasync function processTargetsBounded(\n  targets: RolloutTarget[],\n  updateFunction: (target: RolloutTarget) => Promise<TargetUpdateResult | undefined>,\n  maxConcurrency: number,\n  now: () => Date,\n  perTargetBudget?: FleetRolloutSpec['perTargetBudget'],\n): Promise<RolloutEvidenceEntry[]> {\n  const results: RolloutEvidenceEntry[] = [];\n  const queue = [...targets];\n\n  async function worker(): Promise<void> {\n    while (queue.length > 0) {\n      const target = queue.shift()!;\n      try {\n        const result = await updateFunction(target);\n        const budgetViolation = perTargetBudgetExceeded(perTargetBudget, result?.usage);\n        if (budgetViolation) {\n          results.push({\n            resourceName: target.name,\n            outcome: 'failure',\n            message: `per-target budget exceeded: ${budgetViolation}`,\n            timestamp: now().toISOString(),\n            ...(result?.usage ? { usage: result.usage } : {}),\n          });\n        } else {\n          results.push({\n            resourceName: target.name,\n            outcome: 'success',\n            timestamp: now().toISOString(),\n            ...(result?.usage ? { usage: result.usage } : {}),\n          });\n        }\n      } catch (error) {\n        results.push({\n          resourceName: target.name,\n          outcome: 'failure',\n          message: error instanceof Error ? error.message : String(error),\n          timestamp: now().toISOString(),\n        });\n      }\n    }\n  }\n\n  const concurrency = Math.min(maxConcurrency, targets.length);\n  await Promise.all(Array.from({ length: concurrency }, () => worker()));\n  return results;\n}\n\nexport interface FleetRolloutStatus {\n  phase?: 'Pending' | 'Rolling' | 'Paused' | 'Completed' | 'Failed' | 'RolledBack';\n  currentBatch?: number;\n  currentCanaryStage?: number;\n  updatedReplicas?: number;\n  readyReplicas?: number;\n  availableReplicas?: number;\n  unavailableReplicas?: number;\n  observedGeneration?: number;\n  startedAt?: string;\n  completedAt?: string;\n  pausedAt?: string;\n  pauseReason?: string;\n  failedAt?: string;\n  failureReason?: string;\n  deadlineExceeded?: boolean;\n  rollbackReason?: string;\n  /** Aggregate metered usage across all processed targets (§8 cost). */\n  consumedBudget?: { tokens: number; cost: number };\n  evidence?: RolloutEvidenceEntry[];\n}\n\nexport type FleetRolloutResource = OrchestrationResource<FleetRolloutSpec>;\n\nexport interface RolloutTarget {\n  name: string;\n  namespace?: string;\n  generation: number;\n  available: boolean;\n  /** Host observation: actual state diverged from the desired template (§8.4). */\n  drifted?: boolean;\n  /** Host-reported security finding on this target (§8.8). */\n  securityFlagged?: boolean;\n}\n\nexport interface FleetRolloutControllerOptions {\n  actor: ControlStoreActor;\n  listTargets: (rollout: FleetRolloutResource) => Promise<RolloutTarget[]>;\n  updateTarget: (rollout: FleetRolloutResource, target: RolloutTarget) => Promise<TargetUpdateResult | undefined>;\n  rollbackTarget: (rollout: FleetRolloutResource, target: RolloutTarget) => Promise<void>;\n  now?: () => Date;\n}\n\n/**\n * Create a controller that manages FleetRollout resources.\n *\n * The controller implements batch and canary rollout strategies with\n * maxUnavailable, pause on failure, deadline, and rollback support.\n */\nexport function createFleetRolloutController(\n  _store: ControlStore,\n  options: FleetRolloutControllerOptions,\n): Controller<FleetRolloutSpec> {\n  const now = options.now ?? (() => new Date());\n\n  async function reconcileRollout(request: Parameters<Controller<FleetRolloutSpec>['reconcile']>[0]): Promise<ControllerReconcileResult> {\n    const rollout = request.resource as FleetRolloutResource;\n    const status: FleetRolloutStatus = rollout.status ?? {};\n    const spec = rollout.spec;\n\n    // Skip completed or failed rollouts.\n    if (status.phase === 'Completed' || status.phase === 'Failed' || status.phase === 'RolledBack') {\n      return { ready: true };\n    }\n\n    // Initialize rollout on first reconcile.\n    if (!status.phase) {\n      return {\n        status: {\n          ...status,\n          phase: 'Rolling',\n          currentBatch: 0,\n          currentCanaryStage: 0,\n          updatedReplicas: 0,\n          readyReplicas: 0,\n          availableReplicas: 0,\n          unavailableReplicas: 0,\n          startedAt: now().toISOString(),\n          evidence: [],\n        } as FleetRolloutStatus,\n        ready: false,\n      };\n    }\n\n    // Check deadline.\n    const deadlineMs: number | undefined = spec.deadlineMs;\n    const startedAt: string | undefined = status.startedAt;\n    if (deadlineMs && startedAt) {\n      const elapsed = now().getTime() - new Date(startedAt).getTime();\n      if (elapsed > deadlineMs) {\n        if (spec.autoRollback) {\n          const targets = await options.listTargets(rollout);\n          const updatedTargets = (status.evidence ?? [])\n            .filter((event) => event.outcome === 'success')\n            .map((event) => targets.find((t) => t.name === event.resourceName))\n            .filter((t): t is RolloutTarget => t !== undefined);\n          for (const target of updatedTargets) {\n            try {\n              await options.rollbackTarget(rollout, target);\n            } catch { /* best-effort */ }\n          }\n        }\n        return {\n          status: {\n            ...status,\n            phase: spec.autoRollback ? 'RolledBack' : 'Failed',\n            failedAt: now().toISOString(),\n            failureReason: 'rollout deadline exceeded',\n            deadlineExceeded: true,\n            rollbackReason: spec.autoRollback ? 'deadline exceeded' : undefined,\n          } as FleetRolloutStatus,\n          ready: true,\n        };\n      }\n    }\n\n    // Check pause.\n    if (status.phase === 'Paused') {\n      return { ready: true };\n    }\n\n    const targets = await options.listTargets(rollout);\n    const evidence: NonNullable<FleetRolloutStatus['evidence']> = status.evidence ?? [];\n\n    // Count current state.\n    const totalReplicas = targets.length;\n    const updatedReplicas = evidence.filter((event) => event.outcome === 'success').length;\n    const failedReplicas = evidence.filter((event) => event.outcome === 'failure').length;\n    const availableReplicas = targets.filter((t) => t.available).length;\n    const unavailableReplicas = totalReplicas - availableReplicas;\n\n    // §8.8 automatic pause thresholds: security first (fail-safe), then\n    // drift, then aggregate cost. These pause for human/verifier decision;\n    // autoRollback remains scoped to failure threshold and deadline.\n    const securityFlagged = targets.filter((t) => t.securityFlagged).length;\n    if (spec.pauseOnSecurityThreshold !== undefined && securityFlagged >= spec.pauseOnSecurityThreshold) {\n      return {\n        status: {\n          ...status,\n          phase: 'Paused',\n          pausedAt: now().toISOString(),\n          pauseReason: `security threshold exceeded: ${securityFlagged} flagged >= ${spec.pauseOnSecurityThreshold}`,\n          updatedReplicas,\n          readyReplicas: updatedReplicas,\n          availableReplicas,\n          unavailableReplicas,\n          evidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    const driftedCount = targets.filter((t) => t.drifted).length;\n    if (spec.pauseOnDriftThreshold !== undefined && driftedCount >= spec.pauseOnDriftThreshold) {\n      return {\n        status: {\n          ...status,\n          phase: 'Paused',\n          pausedAt: now().toISOString(),\n          pauseReason: `drift threshold exceeded: ${driftedCount} drifted >= ${spec.pauseOnDriftThreshold}`,\n          updatedReplicas,\n          readyReplicas: updatedReplicas,\n          availableReplicas,\n          unavailableReplicas,\n          evidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    const budgetViolation = budgetExceeded(spec.budget, sumEvidenceUsage(evidence));\n    if (budgetViolation) {\n      return {\n        status: {\n          ...status,\n          phase: 'Paused',\n          pausedAt: now().toISOString(),\n          pauseReason: `rollout budget exceeded: ${budgetViolation}`,\n          updatedReplicas,\n          readyReplicas: updatedReplicas,\n          availableReplicas,\n          unavailableReplicas,\n          evidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    // Enforce maxUnavailable: pause if too many targets are unavailable.\n    if (spec.maxUnavailable !== undefined && unavailableReplicas > spec.maxUnavailable) {\n      return {\n        status: {\n          ...status,\n          phase: 'Paused',\n          pausedAt: now().toISOString(),\n          pauseReason: `maxUnavailable exceeded: ${unavailableReplicas} unavailable > ${spec.maxUnavailable} max`,\n          updatedReplicas,\n          readyReplicas: updatedReplicas,\n          availableReplicas,\n          unavailableReplicas,\n          evidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    // Check pause on failure threshold.\n    if (spec.pauseOnFailureThreshold && failedReplicas >= spec.pauseOnFailureThreshold) {\n      if (spec.autoRollback) {\n        const updatedTargets = evidence\n          .filter((event) => event.outcome === 'success')\n          .map((event) => targets.find((t) => t.name === event.resourceName))\n          .filter((t): t is RolloutTarget => t !== undefined);\n        for (const target of updatedTargets) {\n          try {\n            await options.rollbackTarget(rollout, target);\n          } catch { /* best-effort */ }\n        }\n        return {\n          status: {\n            ...status,\n            phase: 'RolledBack',\n            pausedAt: now().toISOString(),\n            pauseReason: `failure threshold reached: ${failedReplicas} failures`,\n            rollbackReason: `auto-rollback: ${failedReplicas} failures`,\n            updatedReplicas: 0,\n            readyReplicas: 0,\n            availableReplicas,\n            unavailableReplicas,\n            evidence,\n          } as FleetRolloutStatus,\n          ready: true,\n        };\n      }\n      return {\n        status: {\n          ...status,\n          phase: 'Paused',\n          pausedAt: now().toISOString(),\n          pauseReason: `failure threshold reached: ${failedReplicas} failures`,\n          updatedReplicas,\n          readyReplicas: updatedReplicas,\n          availableReplicas,\n          unavailableReplicas,\n          evidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    // Determine next batch or canary stage.\n    if (spec.strategy === 'batch') {\n      const batchSize = spec.batchSize ?? 1;\n      const maxConcurrency = spec.maxConcurrency ?? 1;\n      const currentBatch: number = status.currentBatch ?? 0;\n      const batchStart = currentBatch * batchSize;\n      const batchEnd = Math.min(batchStart + batchSize, totalReplicas);\n\n      if (batchStart >= totalReplicas) {\n        // Rollout complete.\n        return {\n          status: {\n            ...status,\n            phase: 'Completed',\n            completedAt: now().toISOString(),\n            updatedReplicas,\n            readyReplicas: updatedReplicas,\n            availableReplicas,\n            unavailableReplicas,\n            evidence,\n          } as FleetRolloutStatus,\n          ready: true,\n        };\n      }\n\n      // Process next batch with bounded concurrency.\n      const batchTargets = targets.slice(batchStart, batchEnd);\n      const batchEvidence = await processTargetsBounded(\n        batchTargets,\n        (target) => options.updateTarget(rollout, target),\n        maxConcurrency,\n        now,\n        spec.perTargetBudget,\n      );\n      const newEvidence = [...evidence, ...batchEvidence];\n\n      const batchBudgetViolation = budgetExceeded(spec.budget, sumEvidenceUsage(newEvidence));\n      if (batchBudgetViolation) {\n        return {\n          status: {\n            ...status,\n            phase: 'Paused',\n            pausedAt: now().toISOString(),\n            pauseReason: `rollout budget exceeded: ${batchBudgetViolation}`,\n            updatedReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n            readyReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n            availableReplicas,\n            unavailableReplicas,\n            evidence: newEvidence,\n          } as FleetRolloutStatus,\n          ready: true,\n        };\n      }\n\n      const newFailedReplicas = newEvidence.filter((event) => event.outcome === 'failure').length;\n      if (spec.pauseOnFailureThreshold && newFailedReplicas >= spec.pauseOnFailureThreshold) {\n        if (spec.autoRollback) {\n          const updatedTargets = newEvidence\n            .filter((event) => event.outcome === 'success')\n            .map((event) => targets.find((t) => t.name === event.resourceName))\n            .filter((t): t is RolloutTarget => t !== undefined);\n          for (const target of updatedTargets) {\n            try {\n              await options.rollbackTarget(rollout, target);\n            } catch { /* best-effort */ }\n          }\n          return {\n            status: {\n              ...status,\n              phase: 'RolledBack',\n              pausedAt: now().toISOString(),\n              pauseReason: `failure threshold reached: ${newFailedReplicas} failures`,\n              rollbackReason: `auto-rollback: ${newFailedReplicas} failures`,\n              updatedReplicas: 0,\n              readyReplicas: 0,\n              availableReplicas,\n              unavailableReplicas,\n              evidence: newEvidence,\n            } as FleetRolloutStatus,\n            ready: true,\n          };\n        }\n        return {\n          status: {\n            ...status,\n            phase: 'Paused',\n            pausedAt: now().toISOString(),\n            pauseReason: `failure threshold reached: ${newFailedReplicas} failures`,\n            updatedReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n            readyReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n            availableReplicas,\n            unavailableReplicas,\n            evidence: newEvidence,\n          } as FleetRolloutStatus,\n          ready: true,\n        };\n      }\n\n      return {\n        status: {\n          ...status,\n          phase: 'Rolling',\n          currentBatch: currentBatch + 1,\n          updatedReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n          readyReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n          availableReplicas,\n          unavailableReplicas,\n          evidence: newEvidence,\n        } as FleetRolloutStatus,\n        ready: false,\n        requeueAfterMs: 1000,\n      };\n    }\n\n    // Canary strategy.\n    const stages = spec.canaryStages ?? [{ weight: 100 }];\n    const currentStage = status.currentCanaryStage ?? 0;\n\n    if (currentStage >= stages.length) {\n      return {\n        status: {\n          ...status,\n          phase: 'Completed',\n          completedAt: now().toISOString(),\n          updatedReplicas,\n          readyReplicas: updatedReplicas,\n          availableReplicas,\n          unavailableReplicas,\n          evidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    const stage = stages[currentStage];\n    const maxConcurrency = spec.maxConcurrency ?? 1;\n    const stageReplicas = Math.ceil((stage.weight / 100) * totalReplicas);\n    const stageTargets = targets.slice(0, stageReplicas).filter(\n      (t) => !evidence.some((event) => event.resourceName === t.name && event.outcome === 'success'),\n    );\n    const stageEvidence = await processTargetsBounded(\n      stageTargets,\n      (target) => options.updateTarget(rollout, target),\n      maxConcurrency,\n      now,\n      spec.perTargetBudget,\n    );\n    const newEvidence = [...evidence, ...stageEvidence];\n\n    const stageBudgetViolation = budgetExceeded(spec.budget, sumEvidenceUsage(newEvidence));\n    if (stageBudgetViolation) {\n      return {\n        status: {\n          ...status,\n          phase: 'Paused',\n          pausedAt: now().toISOString(),\n          pauseReason: `rollout budget exceeded: ${stageBudgetViolation}`,\n          updatedReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n          readyReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n          availableReplicas,\n          unavailableReplicas,\n          evidence: newEvidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    const stagePauseMs = stage.pauseDurationMs ?? 0;\n    return {\n      status: {\n        ...status,\n        phase: 'Rolling',\n        currentCanaryStage: currentStage + 1,\n        updatedReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n        readyReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n        availableReplicas,\n        unavailableReplicas,\n        evidence: newEvidence,\n      } as FleetRolloutStatus,\n      ready: false,\n      requeueAfterMs: stagePauseMs > 0 ? stagePauseMs : 1000,\n    };\n  }\n\n  return {\n    async reconcile(request): Promise<ControllerReconcileResult> {\n      const result = await reconcileRollout(request);\n      // Aggregate budget accounting is derived from evidence on every path so\n      // no return site can forget it (idempotent: recomputed, not accumulated).\n      if (result.status) {\n        result.status = {\n          ...result.status,\n          consumedBudget: sumEvidenceUsage((result.status as FleetRolloutStatus).evidence),\n        } as FleetRolloutStatus;\n      }\n      return result;\n    },\n  };\n}\n","import type {\n  OrchestrationDeleteOptions,\n  OrchestrationDeleteResult,\n  OrchestrationGetOptions,\n  OrchestrationListOptions,\n  OrchestrationResource,\n  OrchestrationResourceList,\n  OrchestrationResourceManifest,\n  OrchestrationResourceQuery,\n  OrchestrationResourceReference,\n  OrchestrationResourceStatus,\n  OrchestrationWatchEvent,\n  OrchestrationWatchOptions,\n} from './client.js';\n\nexport type ControlStoreVerb =\n  | 'create'\n  | 'apply'\n  | 'update-status'\n  | 'delete'\n  | 'acquire-lease'\n  | 'renew-lease'\n  | 'release-lease';\n\nexport interface ControlStoreActor {\n  id: string;\n  kind: 'controller' | 'verifier' | 'admin';\n  properties?: string[];\n}\n\nexport interface ControlStoreAuthorizationRequest {\n  actor: ControlStoreActor;\n  verb: ControlStoreVerb;\n  reference: OrchestrationResourceReference;\n  current?: OrchestrationResource;\n  proposedResource?: OrchestrationResourceManifest;\n  proposedStatus?: OrchestrationResourceStatus;\n}\n\nexport interface ControlStoreAuthorizer {\n  /** Must return synchronously so authorization and the protected write share one transaction. */\n  authorize(request: ControlStoreAuthorizationRequest): void;\n}\n\nexport interface ControlStoreCreateOptions {\n  idempotencyKey?: string;\n  dryRun?: boolean;\n}\n\nexport interface ControlStoreApplyOptions {\n  /** Required when changing an existing spec; omitted only for create/same-spec retry. */\n  resourceVersion?: string;\n  idempotencyKey?: string;\n  dryRun?: boolean;\n}\n\nexport interface ControlStoreStatusUpdateOptions {\n  /** Exact compare-and-swap precondition. */\n  resourceVersion: string;\n  idempotencyKey?: string;\n  dryRun?: boolean;\n}\n\nexport interface ControlLeaseRequest {\n  name: string;\n  holder: string;\n  ttlMs: number;\n}\n\nexport interface ControlLeaseIdentity {\n  name: string;\n  holder: string;\n  leaseId: string;\n  epoch: string;\n}\n\nexport interface ControlLeaseGrant extends ControlLeaseIdentity {\n  acquiredAt: string;\n  renewedAt: string;\n  expiresAt: string;\n  resourceVersion: string;\n}\n\nexport interface ControlStoreCompactionResult {\n  compactedThrough: string;\n  resourceVersion: string;\n}\n\nexport interface ControlStoreSnapshotResult {\n  resourceVersion: string;\n  createdAt: string;\n}\n\nexport interface ControlStoreHealth {\n  healthy: boolean;\n  resourceVersion: string;\n  detail?: string;\n}\n\n/**\n * Trusted controller-facing state store. Agent-facing clients never receive\n * status, lease, compaction, snapshot, or actor-selection capabilities.\n */\nexport interface ControlStore {\n  get<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n    reference: OrchestrationResourceReference,\n    options?: OrchestrationGetOptions,\n  ): Promise<OrchestrationResource<TSpec, TStatus> | null>;\n\n  list<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n    query: OrchestrationResourceQuery,\n    options?: OrchestrationListOptions,\n  ): Promise<OrchestrationResourceList<TSpec, TStatus>>;\n\n  watch<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n    query: OrchestrationResourceQuery,\n    options?: OrchestrationWatchOptions,\n  ): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>>;\n\n  create<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n    actor: ControlStoreActor,\n    resource: OrchestrationResourceManifest<TSpec>,\n    options?: ControlStoreCreateOptions,\n  ): Promise<OrchestrationResource<TSpec, TStatus>>;\n\n  apply<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n    actor: ControlStoreActor,\n    resource: OrchestrationResourceManifest<TSpec>,\n    options?: ControlStoreApplyOptions,\n  ): Promise<OrchestrationResource<TSpec, TStatus>>;\n\n  updateStatus<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n    actor: ControlStoreActor,\n    reference: OrchestrationResourceReference,\n    status: TStatus,\n    options: ControlStoreStatusUpdateOptions,\n  ): Promise<OrchestrationResource<TSpec, TStatus>>;\n\n  delete(\n    actor: ControlStoreActor,\n    reference: OrchestrationResourceReference,\n    options?: OrchestrationDeleteOptions,\n  ): Promise<OrchestrationDeleteResult>;\n\n  acquireLease(actor: ControlStoreActor, request: ControlLeaseRequest): Promise<ControlLeaseGrant>;\n  renewLease(actor: ControlStoreActor, identity: ControlLeaseIdentity, ttlMs: number): Promise<ControlLeaseGrant>;\n  releaseLease(actor: ControlStoreActor, identity: ControlLeaseIdentity): Promise<void>;\n\n  compact(throughResourceVersion: string): Promise<ControlStoreCompactionResult>;\n  snapshot(targetPath: string): Promise<ControlStoreSnapshotResult>;\n  getHealth(): Promise<ControlStoreHealth>;\n  close(): Promise<void>;\n}\n\n/** Key-order-independent structural form used by every ControlStore backend. */\nexport function canonicalControlStoreValue(value: unknown): string {\n  if (value === undefined) return 'undefined';\n  if (Array.isArray(value)) {\n    return `[${value.map(canonicalControlStoreValue).join(',')}]`;\n  }\n  if (value !== null && typeof value === 'object') {\n    return `{${\n      Object.entries(value as Record<string, unknown>)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([key, item]) => `${JSON.stringify(key)}:${canonicalControlStoreValue(item)}`)\n        .join(',')\n    }}`;\n  }\n  return JSON.stringify(value) ?? typeof value;\n}\n\nconst DECLARATIVE_METADATA_FIELDS = [\n  'labels',\n  'annotations',\n  'ownerReferences',\n  'finalizers',\n] as const;\n\n/** Whether an apply manifest is already represented by the stored resource. */\nexport function controlStoreApplyMatches(\n  current: OrchestrationResource,\n  proposed: OrchestrationResourceManifest,\n): boolean {\n  if (\n    canonicalControlStoreValue(current.spec) !==\n      canonicalControlStoreValue(proposed.spec)\n  ) {\n    return false;\n  }\n  return DECLARATIVE_METADATA_FIELDS.every((field) => {\n    const desired = proposed.metadata[field];\n    return desired === undefined ||\n      canonicalControlStoreValue(current.metadata[field]) ===\n        canonicalControlStoreValue(desired);\n  });\n}\n","import { OrchestrationError } from '../errors.js';\nimport type { NodeTrustClass } from '../resources.js';\nimport type { AgentVolumeReplicaStatus, AgentVolumeResource, StorageClassResource } from '../resources.js';\n\n/**\n * Replicated storage controller (plan 24.45).\n *\n * Pure decision logic plus a thin executor over an injected transport:\n * - Authoritative replicas are placed only on trusted nodes and spread across\n *   fault domains.\n * - Every replica's content hash is verified against the volume's contentHash\n *   (the source of truth); mismatches and unreadable replicas are rebuilt\n *   from the primary.\n * - Transfers originate only from the fenced primary; primary changes bump a\n *   monotonically increasing epoch so stale primaries cannot serve data.\n * - Loss and corruption converge to the desired replica count.\n */\n\nexport interface ReplicationNode {\n  nodeId: string;\n  faultDomain?: string;\n  trust: NodeTrustClass;\n}\n\n/**\n * Host-owned immutable point-in-time view of the fenced primary. The handle\n * is ephemeral authority and must never be persisted in ControlStore.\n */\nexport interface ReplicationSnapshot {\n  snapshotHandle: string;\n  contentHash: string;\n}\n\nexport interface ReplicationTransport {\n  /** Compute a replica's content hash from trusted storage; null when unreadable/missing. */\n  readReplicaHash(volume: AgentVolumeResource, nodeId: string): Promise<string | null>;\n  /**\n   * Atomically compare the previous fence and persist the newly elected\n   * primary fence. Repeating the exact same transition must succeed so a\n   * controller can recover when its subsequent ControlStore CAS loses a race.\n   */\n  commitPrimaryFence(\n    volume: AgentVolumeResource,\n    previous: { nodeId?: string; epoch: number },\n    next: { nodeId: string; epoch: number },\n  ): Promise<void>;\n  /**\n   * Capture a storage-native, internally verified immutable snapshot from the\n   * active primary. The transport must reject a stale epoch and make an exact\n   * retry idempotent.\n   */\n  capturePrimarySnapshot(\n    volume: AgentVolumeResource,\n    nodeId: string,\n    epoch: number,\n  ): Promise<ReplicationSnapshot>;\n  /**\n   * Idempotently transfer the exact captured snapshot, atomically rejecting\n   * an epoch that is not the active primary fence.\n   */\n  transferReplica(\n    volume: AgentVolumeResource,\n    snapshot: ReplicationSnapshot,\n    fromNodeId: string,\n    toNodeId: string,\n    epoch: number,\n  ): Promise<void>;\n  /** Idempotently release the ephemeral snapshot after reconciliation. */\n  releaseSnapshot(volume: AgentVolumeResource, snapshot: ReplicationSnapshot): Promise<void>;\n}\n\nexport interface ReplicationContext extends ReplicationTransport {\n  nodes: ReplicationNode[];\n  now?: () => string;\n}\n\nexport type ReplicationAction =\n  | { type: 'elect-primary'; nodeId: string; epoch: number }\n  | { type: 'mark-degraded'; nodeId: string; reason: string }\n  | { type: 'mark-offline'; nodeId: string }\n  | { type: 'place-replica'; nodeId: string; fromNodeId: string }\n  | { type: 'rebuild-replica'; nodeId: string; fromNodeId: string };\n\nexport interface ReplicationResult {\n  volume: AgentVolumeResource;\n  actions: ReplicationAction[];\n}\n\nfunction desiredFactor(storageClass: StorageClassResource): number {\n  return Math.max(1, storageClass.spec.replication?.factor ?? 1);\n}\n\n/**\n * Choose target nodes for new replicas, preferring fault domains not already\n * covered by existing replicas and skipping nodes that already host one.\n * Authoritative storage never uses restricted or quarantine nodes.\n */\nexport function planReplicaPlacement(\n  existing: AgentVolumeReplicaStatus[],\n  candidates: ReplicationNode[],\n  count: number,\n): ReplicationNode[] {\n  const usedNodes = new Set(existing.map((replica) => replica.nodeId));\n  const usedDomains = new Set(\n    existing\n      .map((replica) => candidates.find((node) => node.nodeId === replica.nodeId)?.faultDomain)\n      .filter((domain): domain is string => domain !== undefined),\n  );\n  const available = candidates.filter((node) => node.trust === 'trusted' && !usedNodes.has(node.nodeId));\n  const freshDomain = available.filter((node) => node.faultDomain !== undefined && !usedDomains.has(node.faultDomain));\n  const rest = available.filter((node) => !freshDomain.includes(node));\n  return [...freshDomain, ...rest].slice(0, count);\n}\n\n/**\n * Reconcile one volume to its desired replica state. Reads and verifies all\n * replicas, elects/fences a primary, rebuilds corrupt or lost replicas, and\n * converges to the class's desired factor when autoRebuild is enabled.\n */\nexport async function reconcileVolumeReplication(\n  volume: AgentVolumeResource,\n  storageClass: StorageClassResource,\n  context: ReplicationContext,\n): Promise<ReplicationResult> {\n  const now = context.now?.() ?? new Date().toISOString();\n  const actions: ReplicationAction[] = [];\n  const desired = desiredFactor(storageClass);\n  const status = volume.status ?? {};\n  const replicas: AgentVolumeReplicaStatus[] = [...(status.replicas ?? [])];\n  let contentHash = status.contentHash;\n  let primaryNodeId = status.primaryNodeId;\n  let primaryEpoch = status.primaryEpoch ?? 0;\n  let snapshot: ReplicationSnapshot | undefined;\n\n  async function electPrimary(nodeId: string): Promise<void> {\n    const previous = { ...(primaryNodeId ? { nodeId: primaryNodeId } : {}), epoch: primaryEpoch };\n    const next = { nodeId, epoch: primaryEpoch + 1 };\n    await context.commitPrimaryFence(volume, previous, next);\n    primaryNodeId = nodeId;\n    primaryEpoch = next.epoch;\n    actions.push({ type: 'elect-primary', nodeId, epoch: primaryEpoch });\n  }\n\n  // 1. Read every trusted replica. Non-trusted or missing nodes are never\n  //    candidates for authoritative data.\n  const hashes = new Map<string, string | null>();\n  for (const replica of replicas) {\n    const node = context.nodes.find((candidate) => candidate.nodeId === replica.nodeId);\n    hashes.set(replica.nodeId, node?.trust === 'trusted' ? await context.readReplicaHash(volume, replica.nodeId) : null);\n  }\n\n  // 2. Keep a readable fenced primary. After primary loss, only a replica\n  //    matching the last committed hash may be promoted. On bootstrap there is\n  //    no prior truth, so the first readable trusted replica becomes primary.\n  const existingPrimaryReadable = primaryNodeId !== undefined &&\n    Number.isSafeInteger(primaryEpoch) &&\n    primaryEpoch >= 1 &&\n    hashes.get(primaryNodeId) != null;\n  if (!existingPrimaryReadable) {\n    const candidate = replicas.find((replica) => {\n      const hash = hashes.get(replica.nodeId);\n      return hash != null && (!contentHash || hash === contentHash);\n    });\n    if (candidate) {\n      await electPrimary(candidate.nodeId);\n    } else {\n      primaryNodeId = undefined;\n    }\n  }\n\n  let operationFailed = false;\n  try {\n    // 3. The fenced primary's immutable native snapshot is the authority for\n    //    legitimate writes. This distinguishes a committed primary update\n    //    from a divergent secondary and binds every transfer to one version.\n    if (primaryNodeId) {\n      snapshot = await context.capturePrimarySnapshot(\n        volume,\n        primaryNodeId,\n        primaryEpoch,\n      );\n      if (\n        !snapshot.snapshotHandle ||\n        snapshot.snapshotHandle.length > 4096 ||\n        !snapshot.contentHash ||\n        snapshot.contentHash.length > 512\n      ) {\n        throw new OrchestrationError({\n          code: 'INVALID',\n          message: 'replication transport returned an invalid primary snapshot',\n          retryable: false,\n        });\n      }\n      contentHash = snapshot.contentHash;\n      hashes.set(primaryNodeId, contentHash);\n    }\n\n    // 4. Classify every replica against the captured primary snapshot.\n    for (const [index, replica] of replicas.entries()) {\n      const hash = hashes.get(replica.nodeId);\n      if (hash == null) {\n        if (replica.state !== 'offline') {\n          replicas[index] = { ...replica, state: 'offline', updatedAt: now };\n          actions.push({ type: 'mark-offline', nodeId: replica.nodeId });\n        }\n        continue;\n      }\n      if (contentHash && hash !== contentHash) {\n        if (replica.state !== 'degraded' || replica.contentHash !== hash) {\n          replicas[index] = { ...replica, state: 'degraded', contentHash: hash, updatedAt: now };\n          actions.push({ type: 'mark-degraded', nodeId: replica.nodeId, reason: 'content hash mismatch' });\n        }\n        continue;\n      }\n      if (replica.state !== 'healthy' || replica.contentHash !== hash) {\n        replicas[index] = { ...replica, state: 'healthy', contentHash: hash, updatedAt: now };\n      }\n    }\n\n    const healthyReplicas = () =>\n      replicas.filter(\n        (replica) =>\n          replica.state === 'healthy' &&\n          replica.contentHash === contentHash,\n      );\n\n    // 5. Rebuild divergent replicas from the exact captured snapshot.\n    if (\n      primaryNodeId &&\n      snapshot &&\n      storageClass.spec.replication?.autoRebuild !== false\n    ) {\n      for (const [index, replica] of replicas.entries()) {\n        if (replica.state !== 'degraded') continue;\n        replicas[index] = { ...replica, state: 'rebuilding', updatedAt: now };\n        actions.push({ type: 'rebuild-replica', nodeId: replica.nodeId, fromNodeId: primaryNodeId });\n        await context.transferReplica(\n          volume,\n          snapshot,\n          primaryNodeId,\n          replica.nodeId,\n          primaryEpoch,\n        );\n        const stored = await context.readReplicaHash(volume, replica.nodeId);\n        replicas[index] = stored === contentHash\n          ? { ...replicas[index], state: 'healthy', contentHash: stored, updatedAt: now }\n          : { ...replicas[index], state: 'degraded', ...(stored ? { contentHash: stored } : {}), updatedAt: now };\n      }\n    }\n\n    // 6. Place new replicas from that same immutable snapshot.\n    const hostingNodes = new Set(replicas.map((replica) => replica.nodeId));\n    const missing = desired - healthyReplicas().length -\n      replicas.filter((replica) => replica.state === 'rebuilding').length;\n    if (\n      primaryNodeId &&\n      snapshot &&\n      missing > 0 &&\n      storageClass.spec.replication?.autoRebuild !== false\n    ) {\n      const targets = planReplicaPlacement(replicas, context.nodes, missing);\n      for (const target of targets) {\n        if (hostingNodes.has(target.nodeId)) continue;\n        actions.push({ type: 'place-replica', nodeId: target.nodeId, fromNodeId: primaryNodeId });\n        await context.transferReplica(\n          volume,\n          snapshot,\n          primaryNodeId,\n          target.nodeId,\n          primaryEpoch,\n        );\n        const stored = await context.readReplicaHash(volume, target.nodeId);\n        replicas.push({\n          nodeId: target.nodeId,\n          state: stored === contentHash ? 'healthy' : 'degraded',\n          ...(stored ? { contentHash: stored } : {}),\n          updatedAt: now,\n        });\n        hostingNodes.add(target.nodeId);\n      }\n    }\n\n    const healthy = healthyReplicas().length;\n    const health = healthy >= desired\n      ? 'healthy'\n      : healthy > 0 || replicas.some((replica) => replica.state === 'rebuilding')\n      ? 'degraded'\n      : 'failed';\n\n    return {\n      volume: {\n        ...volume,\n        status: {\n          ...status,\n          replicas,\n          ...(contentHash ? { contentHash } : {}),\n          // Always overwrite: a lost primary must not linger in status.\n          primaryNodeId,\n          primaryEpoch,\n          health,\n        },\n      },\n      actions,\n    };\n  } catch (error) {\n    operationFailed = true;\n    throw error;\n  } finally {\n    if (snapshot) {\n      const release = context.releaseSnapshot(volume, snapshot);\n      if (operationFailed) {\n        await release.catch(() => undefined);\n      } else {\n        await release;\n      }\n    }\n  }\n}\n\nimport { createControllerRunner } from '../controllerRunner.js';\nimport { canonicalControlStoreValue, type ControlStore, type ControlStoreActor } from '../controlStore.js';\n\n/**\n * Dependencies for the replication controller beyond what ReplicationTransport covers.\n */\nexport interface ReplicationControllerDeps {\n  store: ControlStore;\n  getStorageClass: (volume: AgentVolumeResource) => Promise<StorageClassResource | null>;\n  listNodes: () => Promise<ReplicationNode[]>;\n  /**\n   * The transport must durably commit the elected epoch before accepting a\n   * transfer. ControlStore status is the observable mirror, not the native\n   * data-plane fencing authority.\n   */\n  transport: ReplicationTransport;\n  actor: ControlStoreActor;\n}\n\n/**\n * Create a controller runner that reconciles AgentVolume resources through\n * the pure reconcileVolumeReplication with a transport-owned primary fence.\n *\n * Each reconcile reads the latest volume from the store. The injected\n * transport durably commits a new primary epoch before any transfer can use\n * it. The resulting mirrored status is then written through `updateStatus`\n * with resourceVersion CAS; stale writes are retried by the runner.\n */\nexport function createReplicationController(deps: ReplicationControllerDeps) {\n  const { store, getStorageClass, listNodes, transport, actor } = deps;\n\n  return createControllerRunner(store, {\n    async reconcile(request) {\n      const volume = request.resource as unknown as AgentVolumeResource;\n\n      const storageClass = await getStorageClass(volume);\n      if (!storageClass) return { ready: true };\n\n      const nodes = await listNodes();\n\n      // Re-read current version for an accurate CAS token.\n      const current = (await store.get({\n        kind: volume.kind,\n        namespace: volume.metadata.namespace,\n        name: volume.metadata.name,\n        apiVersion: volume.apiVersion,\n      })) as unknown as AgentVolumeResource | null;\n      const reconciled = current ?? volume;\n\n      const context: ReplicationContext = {\n        nodes,\n        readReplicaHash: async (targetVolume, nodeId) => await transport.readReplicaHash(targetVolume, nodeId),\n        capturePrimarySnapshot: async (targetVolume, nodeId, epoch) => await transport.capturePrimarySnapshot(targetVolume, nodeId, epoch),\n        transferReplica: async (targetVolume, targetSnapshot, fromNodeId, toNodeId, epoch) => {\n          await transport.transferReplica(\n            targetVolume,\n            targetSnapshot,\n            fromNodeId,\n            toNodeId,\n            epoch,\n          );\n        },\n        commitPrimaryFence: async (targetVolume, previous, next) => {\n          await transport.commitPrimaryFence(targetVolume, previous, next);\n        },\n        releaseSnapshot: async (targetVolume, targetSnapshot) => {\n          await transport.releaseSnapshot(targetVolume, targetSnapshot);\n        },\n      };\n\n      const result = await reconcileVolumeReplication(reconciled, storageClass, context);\n      const nextStatus = result.volume.status ?? {};\n      if (\n        canonicalControlStoreValue(nextStatus) ===\n          canonicalControlStoreValue(reconciled.status ?? {})\n      ) {\n        return { ready: true };\n      }\n\n      // Return status so the controller runner CAS-commits it exactly once.\n      return { status: nextStatus };\n    },\n  }, {\n    actor,\n    leaseName: 'storage-replication',\n    watchKind: 'AgentVolume',\n    leaseTtlMs: 30_000,\n  });\n}\n","import type {\n  AgentOrchestrationCapabilities,\n  AgentOrchestrationClient,\n  OrchestrationApplyOptions,\n  OrchestrationDeleteOptions,\n  OrchestrationDeleteResult,\n  OrchestrationGetOptions,\n  OrchestrationListOptions,\n  OrchestrationResource,\n  OrchestrationResourceList,\n  OrchestrationResourceManifest,\n  OrchestrationResourceQuery,\n  OrchestrationResourceReference,\n  OrchestrationResourceStatus,\n  OrchestrationWatchEvent,\n  OrchestrationWatchOptions,\n} from './client.js';\nimport type { ControlStore, ControlStoreActor } from './controlStore.js';\n\n/**\n * ControlStore-backed AgentOrchestrationClient (plan 24.14).\n *\n * Adapts the trusted controller store to the Agent-facing facade so script\n * deployment (and later other facade consumers) can run against the real\n * store instead of test fakes. Actor identity is bound by the host at\n * construction; callers cannot choose it.\n *\n * Apply delegates to the store's atomic declarative update: create when\n * absent, return an equal spec idempotently, or CAS a changed desired spec\n * while preserving identity/status and advancing generation.\n */\n\nexport interface ControlStoreOrchestrationClientOptions {\n  /** Resource kinds reported by getCapabilities (default: workload-related kinds). */\n  resourceKinds?: string[];\n}\n\nconst DEFAULT_RESOURCE_KINDS = [\n  'AgentWorkload',\n  'AgentRun',\n  'ToolOperation',\n  'ArtifactRecord',\n  'ModelClass',\n  'ModelEndpoint',\n  'WorkloadCapabilityGrant',\n];\n\nexport function createControlStoreOrchestrationClient(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  options: ControlStoreOrchestrationClientOptions = {},\n): AgentOrchestrationClient {\n  const resourceKinds = options.resourceKinds ?? DEFAULT_RESOURCE_KINDS;\n\n  return {\n    async getCapabilities(): Promise<AgentOrchestrationCapabilities> {\n      return {\n        operations: ['apply', 'get', 'list', 'watch', 'delete'],\n        resourceKinds,\n        interfaces: ['resource'],\n      };\n    },\n\n    async apply<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      resource: OrchestrationResourceManifest<TSpec>,\n      applyOptions?: OrchestrationApplyOptions,\n    ): Promise<OrchestrationResource<TSpec, TStatus>> {\n      const reference: OrchestrationResourceReference = {\n        apiVersion: resource.apiVersion,\n        kind: resource.kind,\n        name: resource.metadata.name,\n        namespace: resource.metadata.namespace,\n      };\n      const existing = await store.get<TSpec, TStatus>(reference);\n      return store.apply(actor, resource, {\n        ...(existing ? { resourceVersion: existing.metadata.resourceVersion } : {}),\n        idempotencyKey: applyOptions?.idempotencyKey,\n        dryRun: applyOptions?.dryRun,\n      });\n    },\n\n    get<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      reference: OrchestrationResourceReference,\n      _options?: OrchestrationGetOptions,\n    ): Promise<OrchestrationResource<TSpec, TStatus> | null> {\n      return store.get<TSpec, TStatus>(reference);\n    },\n\n    list<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      _options?: OrchestrationListOptions,\n    ): Promise<OrchestrationResourceList<TSpec, TStatus>> {\n      return store.list<TSpec, TStatus>(query);\n    },\n\n    watch<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      watchOptions?: OrchestrationWatchOptions,\n    ): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>> {\n      return store.watch<TSpec, TStatus>(query, watchOptions);\n    },\n\n    delete(\n      reference: OrchestrationResourceReference,\n      deleteOptions?: OrchestrationDeleteOptions,\n    ): Promise<OrchestrationDeleteResult> {\n      return store.delete(actor, reference, deleteOptions);\n    },\n  };\n}\n","import type { Controller } from './controllerRunner.js';\nimport type { CredentialIssuePayload, CredentialManagementDriver } from './drivers/credentialManagement.js';\nimport type { DriverRequestEnvelope } from './drivers/driverRequest.js';\nimport type { CredentialGrantResource, CredentialGrantStatus } from './resources.js';\nimport type { CredentialBrokerDriver, CredentialGrantHandle } from './security/credentialBroker.js';\n\nexport interface CredentialBrokerEndpoint {\n  nodeId: string;\n  brokerClass: string;\n  healthy: boolean;\n  audiences: string[];\n  methods?: string[];\n  /** Exact targets or prefix patterns ending in `*`. */\n  targets?: string[];\n  activeGrants?: number;\n  maxGrants?: number;\n}\n\nexport interface CredentialGrantPlacementRequirements {\n  brokerClass?: string;\n  requiredNode?: string;\n  /** Host admission denial; binding becomes terminal Failed. */\n  denyReason?: string;\n}\n\nexport interface CredentialGrantBindingControllerOptions {\n  listBrokers(): Promise<CredentialBrokerEndpoint[]>;\n  requirementsForGrant?(\n    grant: CredentialGrantResource,\n  ): Promise<CredentialGrantPlacementRequirements>;\n  now?: () => Date;\n}\n\nfunction targetMatches(pattern: string, target: string): boolean {\n  return pattern.endsWith('*')\n    ? target.startsWith(pattern.slice(0, -1))\n    : pattern === target;\n}\n\n/** Independently selects a healthy broker that can honor the complete scope. */\nexport function createCredentialGrantBindingController(\n  options: CredentialGrantBindingControllerOptions,\n): Controller<CredentialGrantResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const grant = request.resource as CredentialGrantResource;\n      const status = grant.status ?? {};\n      if (status.phase && status.phase !== 'Pending') return { ready: true };\n      const requirements = await options.requirementsForGrant?.(grant) ?? {};\n      if (requirements.denyReason) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'FORBIDDEN',\n              message: requirements.denyReason,\n              retryable: false,\n            },\n          } satisfies CredentialGrantStatus,\n          ready: true,\n        };\n      }\n      const candidates = (await options.listBrokers()).filter((broker) =>\n        broker.healthy &&\n        (!requirements.requiredNode || broker.nodeId === requirements.requiredNode) &&\n        (!requirements.brokerClass || broker.brokerClass === requirements.brokerClass) &&\n        broker.audiences.includes(grant.spec.audience) &&\n        (!broker.methods?.length || broker.methods.includes(grant.spec.method)) &&\n        (!broker.targets?.length || broker.targets.some((pattern) => targetMatches(pattern, grant.spec.target))) &&\n        (broker.maxGrants === undefined || (broker.activeGrants ?? 0) < broker.maxGrants)\n      ).sort((left, right) =>\n        (left.activeGrants ?? 0) - (right.activeGrants ?? 0) ||\n        left.nodeId.localeCompare(right.nodeId) ||\n        left.brokerClass.localeCompare(right.brokerClass)\n      );\n      const selected = candidates[0];\n      const reconciledAt = now().toISOString();\n      if (!selected) {\n        const { assignedNode: _node, assignedBroker: _broker, binding: _binding, ...unbound } = status;\n        return {\n          status: {\n            ...unbound,\n            phase: 'Pending',\n            conditions: [{\n              type: 'CredentialBrokerScheduled',\n              status: 'False',\n              reason: 'NoEligibleBroker',\n              message: `no healthy credential broker satisfies '${grant.spec.audience}' / '${grant.spec.target}'`,\n              lastTransitionTime: reconciledAt,\n            }],\n          } satisfies CredentialGrantStatus,\n          requeueAfterMs: 1000,\n        };\n      }\n      if (\n        status.assignedNode === selected.nodeId &&\n        status.assignedBroker === selected.brokerClass &&\n        status.binding?.leaseEpoch === request.leaseEpoch\n      ) return { ready: true };\n      return {\n        status: {\n          ...status,\n          phase: 'Pending',\n          assignedNode: selected.nodeId,\n          assignedBroker: selected.brokerClass,\n          binding: { leaseEpoch: request.leaseEpoch, boundAt: reconciledAt },\n          conditions: [{\n            type: 'CredentialBrokerScheduled',\n            status: 'True',\n            reason: 'BrokerSelected',\n            message: `bound to '${selected.brokerClass}' on '${selected.nodeId}'`,\n            lastTransitionTime: reconciledAt,\n          }],\n        } satisfies CredentialGrantStatus,\n        ready: true,\n      };\n    },\n  };\n}\n\nexport interface CredentialHandleVault {\n  /** The token remains outside ControlStore; handleRef is safe to persist. */\n  put(handleReference: string, handle: CredentialGrantHandle): Promise<void>;\n  get(handleReference: string): Promise<CredentialGrantHandle | undefined>;\n  delete(handleReference: string): Promise<void>;\n}\n\nexport interface CredentialGrantExecutionControllerOptions {\n  nodeId: string;\n  getBroker(\n    brokerClass: string,\n    nodeId: string,\n  ): Promise<CredentialBrokerDriver | undefined>;\n  vault: CredentialHandleVault;\n  managed?: {\n    getDriver(\n      brokerClass: string,\n      nodeId: string,\n    ): Promise<CredentialManagementDriver | undefined>;\n    createIssueRequest(input: {\n      grant: CredentialGrantResource;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<CredentialIssuePayload>>;\n  };\n  now?: () => Date;\n}\n\n/** Persists a fencing claim before issuing a worker-visible credential. */\nexport function createCredentialGrantExecutionController(\n  options: CredentialGrantExecutionControllerOptions,\n): Controller<CredentialGrantResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const grant = request.resource as CredentialGrantResource;\n      const status = grant.status ?? {};\n      if (status.assignedNode !== options.nodeId || !status.assignedBroker || !status.binding) {\n        return { ready: true };\n      }\n      if (\n        status.phase === 'Issued' ||\n        status.phase === 'Renewed' ||\n        status.phase === 'Revoked' ||\n        status.phase === 'Expired' ||\n        status.phase === 'Failed'\n      ) return { ready: true };\n      const managedDriver = options.managed\n        ? await options.managed.getDriver(\n          status.assignedBroker,\n          options.nodeId,\n        )\n        : undefined;\n      const broker = managedDriver\n        ? undefined\n        : await options.getBroker(status.assignedBroker, options.nodeId);\n      if (!managedDriver && !broker) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNAVAILABLE',\n              message: `bound credential broker '${status.assignedBroker}' is unavailable`,\n              retryable: true,\n            },\n          } satisfies CredentialGrantStatus,\n          ready: true,\n        };\n      }\n      if (status.phase !== 'Issuing') {\n        return {\n          status: {\n            ...status,\n            phase: 'Issuing',\n            issuanceClaim: {\n              leaseEpoch: request.leaseEpoch,\n              claimedAt: now().toISOString(),\n            },\n          } satisfies CredentialGrantStatus,\n          requeueAfterMs: 1,\n        };\n      }\n      if (status.issuanceClaim?.leaseEpoch !== request.leaseEpoch) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNKNOWN_EFFECT',\n              message: 'controller epoch changed after credential issuance was claimed; refusing duplicate issuance',\n              retryable: false,\n            },\n          } satisfies CredentialGrantStatus,\n          ready: true,\n        };\n      }\n      const managedGrant = managedDriver && options.managed\n        ? await managedDriver.issue(\n          await options.managed.createIssueRequest({\n            grant,\n            actor: request.actor,\n            leaseEpoch: request.leaseEpoch,\n          }),\n        )\n        : undefined;\n      const handle = managedGrant\n        ? undefined\n        : await (broker as CredentialBrokerDriver).issue({\n          ...grant.spec,\n          grantId: grant.metadata.uid,\n        });\n      const handleReference = managedGrant?.grantHandle ??\n        `credential://${options.nodeId}/${grant.metadata.uid}`;\n      if (handle) await options.vault.put(handleReference, handle);\n      return {\n        status: {\n          ...status,\n          phase: 'Issued',\n          handleRef: handleReference,\n          issuedAt: managedGrant?.issuedAt ?? handle?.claims.issuedAt,\n          expiresAt: managedGrant?.expiresAt ?? handle?.claims.expiresAt,\n          exposure: 'worker-visible',\n          rotationRequired: true,\n          rotationReason: 'grant was issued for a worker; rotate the underlying credential after exposure',\n        } satisfies CredentialGrantStatus,\n        ready: true,\n      };\n    },\n  };\n}\n\nexport async function revokeCredentialGrant(\n  grant: CredentialGrantResource,\n  broker: CredentialBrokerDriver,\n  vault: CredentialHandleVault,\n): Promise<void> {\n  const handleReference = grant.status?.handleRef;\n  if (!handleReference) return;\n  const handle = await vault.get(handleReference);\n  broker.revoke(handle?.claims.grantId ?? grant.metadata.uid);\n  await vault.delete(handleReference);\n}\n\nexport interface CredentialGrantLifecycleControllerOptions {\n  nodeId: string;\n  getBroker(\n    brokerClass: string,\n    nodeId: string,\n  ): Promise<CredentialBrokerDriver | undefined>;\n  vault: CredentialHandleVault;\n  managed?: {\n    getDriver(\n      brokerClass: string,\n      nodeId: string,\n    ): Promise<CredentialManagementDriver | undefined>;\n    createRevokeRequest(input: {\n      grant: CredentialGrantResource;\n      grantHandle: string;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<{ grantHandle: string }>>;\n  };\n  isRunTerminal(grant: CredentialGrantResource): Promise<boolean>;\n  now?: () => Date;\n}\n\n/** Revokes issued grants on Run termination or expiry, including after restart. */\nexport function createCredentialGrantLifecycleController(\n  options: CredentialGrantLifecycleControllerOptions,\n): Controller<CredentialGrantResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const grant = request.resource as CredentialGrantResource;\n      const status = grant.status ?? {};\n      if (\n        status.assignedNode !== options.nodeId ||\n        !status.assignedBroker ||\n        (status.phase !== 'Issued' && status.phase !== 'Renewed')\n      ) return { ready: true };\n      const managedDriver = options.managed\n        ? await options.managed.getDriver(\n          status.assignedBroker,\n          options.nodeId,\n        )\n        : undefined;\n      const broker = managedDriver\n        ? undefined\n        : await options.getBroker(status.assignedBroker, options.nodeId);\n      if (!managedDriver && !broker) return { requeueAfterMs: 1000 };\n      const checkedAt = now();\n      const expired = !Number.isFinite(Date.parse(status.expiresAt ?? '')) ||\n        checkedAt.getTime() >= Date.parse(status.expiresAt ?? '');\n      const runTerminal = await options.isRunTerminal(grant);\n      if (!expired && !runTerminal) {\n        return {\n          requeueAfterMs: Math.max(\n            1,\n            Math.min(1000, Date.parse(status.expiresAt ?? '') - checkedAt.getTime()),\n          ),\n        };\n      }\n      if (managedDriver && options.managed && status.handleRef) {\n        await managedDriver.revoke(\n          await options.managed.createRevokeRequest({\n            grant,\n            grantHandle: status.handleRef,\n            actor: request.actor,\n            leaseEpoch: request.leaseEpoch,\n          }),\n        );\n      } else if (broker) {\n        await revokeCredentialGrant(grant, broker, options.vault);\n      }\n      return {\n        status: {\n          ...status,\n          phase: expired ? 'Expired' : 'Revoked',\n          revokedAt: checkedAt.toISOString(),\n        } satisfies CredentialGrantStatus,\n        ready: true,\n      };\n    },\n  };\n}\n","import type { ControlLeaseGrant, ControlStore } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport { AUDIT_RECORD_API_VERSION, AUDIT_RECORD_KIND, type AuditRecordResource, type AuditRecordSpec, createAuditRecordManifest } from '../resources.js';\nimport { containsSecrets } from '../security/secretRedaction.js';\n\nimport {\n  type AuditEffect,\n  type AuditProvenance,\n  type AuditTelemetryManagementDriver,\n  type AuditTelemetryRecord,\n  type AuditTelemetryRecordKind,\n} from './auditTelemetryManagement.js';\nimport { assertDriverRequestEnvelope, canonicalDriverValue, type DriverRequestEnvelope } from './driverRequest.js';\n\nconst SHA256 = /^sha256:[a-f0-9]{64}$/;\nconst FORBIDDEN_ATTRIBUTE = /(?:secret|token|password|credential|authorization|cookie|private[-_]?key)/i;\nconst RECORD_KINDS: AuditTelemetryRecordKind[] = [\n  'audit',\n  'event',\n  'metric',\n  'trace',\n];\n\ninterface CommonRecordPayload {\n  policyDigest: string;\n  effect: AuditEffect;\n  provenance: AuditProvenance;\n  attributes?: Record<string, string>;\n}\n\nexport interface ControlStoreAuditTelemetryAdapterOptions {\n  store: ControlStore;\n  name: string;\n  authorizeRequest(\n    request: DriverRequestEnvelope,\n  ): boolean | Promise<boolean>;\n  now?: () => Date;\n  maxRecordsPerResource?: number;\n  maxAttributes?: number;\n  persistence: 'host' | 'external';\n  threatAssumptions: string[];\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({\n    code: 'INVALID',\n    message,\n    retryable: false,\n  });\n}\n\nfunction boundedString(\n  value: unknown,\n  field: string,\n  maximum = 256,\n): string {\n  if (typeof value !== 'string' || !value || value.length > maximum) {\n    invalid(`managed audit ${field} is invalid`);\n  }\n  return value;\n}\n\nfunction exactFields(\n  value: unknown,\n  allowed: readonly string[],\n  location: string,\n): void {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    invalid(`managed audit ${location} must be an object`);\n  }\n  const unknown = Object.keys(value).filter((field) => !allowed.includes(field));\n  if (unknown.length > 0) {\n    invalid(\n      `managed audit ${location} contains unsupported fields: ${unknown.join(', ')}`,\n    );\n  }\n}\n\nasync function digest(value: unknown): Promise<string> {\n  const bytes = new TextEncoder().encode(canonicalDriverValue(value));\n  const result = await globalThis.crypto.subtle.digest('SHA-256', bytes);\n  return `sha256:${\n    [...new Uint8Array(result)]\n      .map((byte) => byte.toString(16).padStart(2, '0'))\n      .join('')\n  }`;\n}\n\nfunction recordName(idempotencyDigest: string): string {\n  return `audit-${idempotencyDigest.slice('sha256:'.length, 62)}`;\n}\n\nfunction publicRecord(resource: AuditRecordResource): AuditTelemetryRecord {\n  const spec = resource.spec;\n  return {\n    sequence: spec.sequence,\n    recordHandle: `audit-record:${resource.metadata.name}`,\n    resourceUid: spec.resourceUid,\n    kind: spec.recordKind,\n    receivedAt: spec.receivedAt,\n    actor: structuredClone(spec.actor),\n    policyDigest: spec.policyDigest,\n    capabilityDigest: spec.capabilityDigest,\n    effect: spec.effect,\n    provenance: structuredClone(spec.provenance),\n    attributes: structuredClone(spec.attributes),\n    data: structuredClone(spec.data),\n    ...(spec.previousDigest ? { previousDigest: spec.previousDigest } : {}),\n    recordDigest: spec.recordDigest,\n  };\n}\n\n/**\n * ControlStore-backed production audit sink. A short ControlStore lease\n * serializes a named stream across processes; immutable AuditRecord resources\n * retain idempotency, fencing, quota, and hash-chain evidence across restarts.\n */\nexport function createControlStoreAuditTelemetryAdapter(\n  options: ControlStoreAuditTelemetryAdapterOptions,\n): AuditTelemetryManagementDriver {\n  const now = options.now ?? (() => new Date());\n  const maxRecordsPerResource = options.maxRecordsPerResource ?? 10_000;\n  const maxAttributes = options.maxAttributes ?? 16;\n  const stream = boundedString(options.name, 'stream name', 128);\n  const holderNonce = new Uint8Array(16);\n  globalThis.crypto.getRandomValues(holderNonce);\n  const holder = `${stream}-${\n    [...holderNonce]\n      .map((byte) => byte.toString(16).padStart(2, '0'))\n      .join('')\n  }`;\n  const leaseName = `audit-${stream}`\n    .toLowerCase()\n    .replace(/[^a-z0-9.-]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .slice(0, 253);\n  if (\n    !options.threatAssumptions.length ||\n    !Number.isSafeInteger(maxRecordsPerResource) ||\n    maxRecordsPerResource < 1 ||\n    !Number.isSafeInteger(maxAttributes) ||\n    maxAttributes < 1\n  ) invalid('managed audit adapter options are invalid');\n\n  async function listStream(): Promise<AuditRecordResource[]> {\n    const result = await options.store.list<AuditRecordSpec>({\n      apiVersion: AUDIT_RECORD_API_VERSION,\n      kind: AUDIT_RECORD_KIND,\n    });\n    return (result.items as AuditRecordResource[])\n      .filter((item) => item.spec.stream === stream)\n      .sort((left, right) => left.spec.sequence - right.spec.sequence);\n  }\n\n  async function acquire(\n    actor: DriverRequestEnvelope['actor'],\n    deadline: string,\n  ): Promise<ControlLeaseGrant> {\n    let lastError: unknown;\n    for (let attempt = 0; attempt < 100 && now().getTime() < Date.parse(deadline); attempt += 1) {\n      try {\n        return await options.store.acquireLease(actor, {\n          name: leaseName,\n          holder,\n          ttlMs: 5000,\n        });\n      } catch (error) {\n        lastError = error;\n        if (\n          !(error instanceof OrchestrationError) ||\n          error.code !== 'CONFLICT'\n        ) throw error;\n        await new Promise<void>((resolve) => setTimeout(resolve, 10));\n      }\n    }\n    throw lastError instanceof OrchestrationError\n      ? lastError\n      : new OrchestrationError({\n        code: 'TIMEOUT',\n        message: 'managed audit append lock timed out',\n        retryable: true,\n      });\n  }\n\n  async function authorized<T>(\n    request: DriverRequestEnvelope<T>,\n    method: string,\n    fields: string[],\n  ): Promise<void> {\n    exactFields(request.payload, fields, `${method} payload`);\n    assertDriverRequestEnvelope(request, {\n      now,\n      requireFencing: true,\n      requireCapability: true,\n      expectedMethod: method,\n    });\n    if (!await options.authorizeRequest(request)) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed audit capability was rejected',\n        retryable: false,\n      });\n    }\n  }\n\n  function common(payload: CommonRecordPayload): {\n    policyDigest: string;\n    effect: AuditEffect;\n    provenance: AuditProvenance;\n    attributes: Record<string, string>;\n  } {\n    if (!SHA256.test(boundedString(payload.policyDigest, 'policyDigest', 80))) {\n      invalid('managed audit policyDigest must be canonical');\n    }\n    if (\n      ![\n        'read',\n        'create',\n        'update',\n        'delete',\n        'execute',\n        'decision',\n        'security',\n      ].includes(payload.effect)\n    ) invalid('managed audit effect is invalid');\n    const provenance = payload.provenance;\n    if (\n      !provenance ||\n      ![\n        'controller',\n        'gateway',\n        'driver',\n        'worker',\n        'operator',\n      ].includes(provenance.source)\n    ) invalid('managed audit provenance is invalid');\n    boundedString(provenance.producer, 'provenance producer');\n    if (provenance.subject !== undefined) {\n      boundedString(provenance.subject, 'provenance subject');\n    }\n    const attributes = payload.attributes ?? {};\n    if (Object.keys(attributes).length > maxAttributes) {\n      invalid('managed audit attribute quota exceeded');\n    }\n    for (const [key, value] of Object.entries(attributes)) {\n      if (\n        !key ||\n        key.length > 64 ||\n        FORBIDDEN_ATTRIBUTE.test(key) ||\n        typeof value !== 'string' ||\n        value.length > 256 ||\n        containsSecrets({ [key]: value })\n      ) invalid(`managed audit attribute '${key}' is invalid or sensitive`);\n    }\n    return {\n      policyDigest: payload.policyDigest,\n      effect: payload.effect,\n      provenance: structuredClone(provenance),\n      attributes: structuredClone(attributes),\n    };\n  }\n\n  async function verify(\n    records: AuditRecordResource[],\n  ): Promise<string | undefined> {\n    let previousDigest: string | undefined;\n    let sequence = 0;\n    for (const resource of records) {\n      const spec = resource.spec;\n      sequence += 1;\n      if (\n        spec.sequence !== sequence ||\n        spec.previousDigest !== previousDigest\n      ) {\n        throw new OrchestrationError({\n          code: 'INTERNAL',\n          message: `managed audit chain is broken at sequence ${spec.sequence}`,\n          retryable: false,\n        });\n      }\n      const { recordDigest, ...unsigned } = spec;\n      if (recordDigest !== await digest(unsigned)) {\n        throw new OrchestrationError({\n          code: 'INTERNAL',\n          message: `managed audit record ${spec.sequence} failed integrity verification`,\n          retryable: false,\n        });\n      }\n      previousDigest = spec.recordDigest;\n    }\n    return previousDigest;\n  }\n\n  async function append(\n    request: DriverRequestEnvelope<CommonRecordPayload>,\n    recordKind: AuditTelemetryRecordKind,\n    data: AuditTelemetryRecord['data'],\n  ): Promise<AuditTelemetryRecord> {\n    const metadata = common(request.payload);\n    const requestFingerprint = await digest(request.payload);\n    const idempotencyDigest = await digest({\n      stream,\n      resourceUid: request.resource.uid,\n      method: request.method,\n      idempotencyKey: request.idempotencyKey,\n    });\n    const name = recordName(idempotencyDigest);\n    const lease = await acquire(request.actor, request.deadline);\n    try {\n      const records = await listStream();\n      const chainHead = await verify(records);\n      const existing = records.find(\n        (item) => item.spec.idempotencyDigest === idempotencyDigest,\n      );\n      if (existing) {\n        if (existing.spec.requestFingerprint !== requestFingerprint) {\n          throw new OrchestrationError({\n            code: 'CONFLICT',\n            message: 'managed audit idempotency key was reused with different input',\n            retryable: false,\n          });\n        }\n        return publicRecord(existing);\n      }\n      const currentFence = records\n        .filter((item) => item.spec.resourceUid === request.resource.uid)\n        .reduce(\n          (maximum, item) => Math.max(maximum, item.spec.fencingEpoch),\n          0,\n        );\n      if ((request.fencingEpoch as number) < currentFence) {\n        throw new OrchestrationError({\n          code: 'STALE_EPOCH',\n          message: `stale managed audit fencing epoch ${request.fencingEpoch}; current epoch is ${currentFence}`,\n          retryable: false,\n        });\n      }\n      const resourceCount = records.filter(\n        (item) => item.spec.resourceUid === request.resource.uid,\n      ).length;\n      if (resourceCount >= maxRecordsPerResource) {\n        throw new OrchestrationError({\n          code: 'EXHAUSTED',\n          message: `managed audit quota of ${maxRecordsPerResource} records was exceeded`,\n          retryable: false,\n        });\n      }\n      const unsigned = {\n        sequence: records.length + 1,\n        resourceUid: request.resource.uid,\n        recordKind,\n        receivedAt: now().toISOString(),\n        actor: {\n          id: request.actor.id,\n          kind: request.actor.kind,\n        },\n        ...metadata,\n        capabilityDigest: await digest(request.capabilityHandleRef),\n        data,\n        ...(chainHead ? { previousDigest: chainHead } : {}),\n      };\n      const unsignedSpec = {\n        stream,\n        ...unsigned,\n        requestFingerprint,\n        idempotencyDigest,\n        fencingEpoch: request.fencingEpoch as number,\n      };\n      const spec: AuditRecordSpec = {\n        ...unsignedSpec,\n        recordDigest: await digest(unsignedSpec),\n      };\n      const created = await options.store.create<AuditRecordSpec>(\n        request.actor,\n        createAuditRecordManifest(name, spec),\n        { idempotencyKey: `audit-record:${idempotencyDigest}` },\n      ) as AuditRecordResource;\n      return publicRecord(created);\n    } finally {\n      await options.store.releaseLease(request.actor, lease).catch(() => undefined);\n    }\n  }\n\n  return {\n    async getCapabilities() {\n      return {\n        name: stream,\n        recordKinds: RECORD_KINDS,\n        appendOnly: true,\n        trustedReceiverTime: true,\n        tamperEvident: true,\n        maxRecordsPerResource,\n        maxAttributes,\n        persistence: options.persistence,\n        threatAssumptions: [...options.threatAssumptions],\n      };\n    },\n    async appendAudit(request) {\n      await authorized(request, 'audit.append', [\n        'policyDigest',\n        'effect',\n        'provenance',\n        'attributes',\n        'action',\n        'outcome',\n        'reasonCode',\n      ]);\n      const action = boundedString(request.payload.action, 'action');\n      if (!['success', 'denied', 'failure'].includes(request.payload.outcome)) {\n        invalid('managed audit outcome is invalid');\n      }\n      if (request.payload.reasonCode !== undefined) {\n        boundedString(request.payload.reasonCode, 'reasonCode');\n      }\n      return append(request, 'audit', {\n        kind: 'audit',\n        action,\n        outcome: request.payload.outcome,\n        ...(request.payload.reasonCode\n          ? { reasonCode: request.payload.reasonCode }\n          : {}),\n      });\n    },\n    async emitEvent(request) {\n      await authorized(request, 'telemetry.emit-event', [\n        'policyDigest',\n        'effect',\n        'provenance',\n        'attributes',\n        'name',\n        'severity',\n      ]);\n      const name = boundedString(request.payload.name, 'event name');\n      if (\n        !['debug', 'info', 'warning', 'error', 'critical'].includes(\n          request.payload.severity,\n        )\n      ) invalid('managed audit event severity is invalid');\n      return append(request, 'event', {\n        kind: 'event',\n        name,\n        severity: request.payload.severity,\n      });\n    },\n    async emitMetric(request) {\n      await authorized(request, 'telemetry.emit-metric', [\n        'policyDigest',\n        'effect',\n        'provenance',\n        'attributes',\n        'name',\n        'value',\n        'unit',\n      ]);\n      const name = boundedString(request.payload.name, 'metric name');\n      const unit = boundedString(request.payload.unit, 'metric unit', 64);\n      if (!Number.isFinite(request.payload.value)) {\n        invalid('managed audit metric value must be finite');\n      }\n      return append(request, 'metric', {\n        kind: 'metric',\n        name,\n        value: request.payload.value,\n        unit,\n      });\n    },\n    async emitTrace(request) {\n      await authorized(request, 'telemetry.emit-trace', [\n        'policyDigest',\n        'effect',\n        'provenance',\n        'attributes',\n        'name',\n        'traceId',\n        'spanId',\n        'durationMs',\n        'status',\n      ]);\n      const name = boundedString(request.payload.name, 'trace name');\n      const traceId = boundedString(\n        request.payload.traceId,\n        'traceId',\n        128,\n      );\n      const spanId = boundedString(request.payload.spanId, 'spanId', 128);\n      if (\n        !Number.isFinite(request.payload.durationMs) ||\n        request.payload.durationMs < 0\n      ) invalid('managed audit trace duration must be non-negative');\n      if (!['ok', 'error'].includes(request.payload.status)) {\n        invalid('managed audit trace status is invalid');\n      }\n      return append(request, 'trace', {\n        kind: 'trace',\n        name,\n        traceId,\n        spanId,\n        durationMs: request.payload.durationMs,\n        status: request.payload.status,\n      });\n    },\n    async readRecords(request) {\n      await authorized(request, 'audit.read', [\n        'afterSequence',\n        'limit',\n        'kinds',\n      ]);\n      const afterSequence = request.payload.afterSequence ?? 0;\n      if (!Number.isSafeInteger(afterSequence) || afterSequence < 0) {\n        invalid('managed audit afterSequence is invalid');\n      }\n      if (\n        !Number.isSafeInteger(request.payload.limit) ||\n        request.payload.limit < 1 ||\n        request.payload.limit > 100\n      ) invalid('managed audit read limit must be between 1 and 100');\n      const kinds = request.payload.kinds;\n      if (\n        kinds !== undefined &&\n        (\n          !Array.isArray(kinds) ||\n          kinds.some((kind) => !RECORD_KINDS.includes(kind))\n        )\n      ) invalid('managed audit record kind filter is invalid');\n      const records = await listStream();\n      const chainHead = await verify(records);\n      const currentFence = records\n        .filter((item) => item.spec.resourceUid === request.resource.uid)\n        .reduce(\n          (maximum, item) => Math.max(maximum, item.spec.fencingEpoch),\n          0,\n        );\n      if ((request.fencingEpoch as number) < currentFence) {\n        throw new OrchestrationError({\n          code: 'STALE_EPOCH',\n          message: `stale managed audit fencing epoch ${request.fencingEpoch}; current epoch is ${currentFence}`,\n          retryable: false,\n        });\n      }\n      return {\n        records: records\n          .filter((item) =>\n            item.spec.resourceUid === request.resource.uid &&\n            item.spec.sequence > afterSequence &&\n            (!kinds || kinds.includes(item.spec.recordKind))\n          )\n          .slice(0, request.payload.limit)\n          .map(publicRecord),\n        ...(chainHead ? { chainHead } : {}),\n      };\n    },\n  };\n}\n","import type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport {\n  createPolicyDecisionManifest,\n  POLICY_DECISION_API_VERSION,\n  POLICY_DECISION_KIND,\n  type PolicyDecisionResource,\n  type PolicyDecisionSpec,\n  type PolicyDecisionStatus,\n} from '../resources.js';\n\nimport { assertDriverRequestEnvelope, canonicalDriverValue, type DriverRequestEnvelope } from './driverRequest.js';\nimport type { PolicyApprovalManagementDriver, PolicyDecision, PolicyDecisionKind } from './policyApprovalManagement.js';\n\nconst SHA256 = /^sha256:[a-f0-9]{64}$/;\n\nexport interface PolicyEvaluation {\n  outcome: 'allow' | 'deny';\n  reasons: string[];\n  obligations?: string[];\n}\n\ninterface PersistedPolicyEvaluation {\n  outcome: 'allow' | 'deny' | 'pending';\n  reasons: string[];\n  obligations?: string[];\n}\n\nexport interface ControlStorePolicyApprovalAdapterOptions {\n  store: ControlStore;\n  name: string;\n  authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;\n  evaluateResourceAdmission?(\n    request: Parameters<PolicyApprovalManagementDriver['admitResource']>[0],\n  ): PolicyEvaluation | Promise<PolicyEvaluation>;\n  evaluatePlacement?(\n    request: Parameters<PolicyApprovalManagementDriver['authorizePlacement']>[0],\n  ): PolicyEvaluation | Promise<PolicyEvaluation>;\n  evaluateToolOperation?(\n    request: Parameters<PolicyApprovalManagementDriver['authorizeToolOperation']>[0],\n    approval: PolicyDecision | undefined,\n  ): PolicyEvaluation | Promise<PolicyEvaluation>;\n  evaluateTransition?(\n    request: Parameters<PolicyApprovalManagementDriver['verifyTransition']>[0],\n  ): PolicyEvaluation | Promise<PolicyEvaluation>;\n  maxApprovalTtlMs?: number;\n  now?: () => Date;\n  persistence: 'host' | 'external';\n  threatAssumptions: string[];\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction unsupported(message: string): never {\n  throw new OrchestrationError({\n    code: 'UNSUPPORTED',\n    message,\n    retryable: false,\n  });\n}\n\nfunction exactFields(\n  payload: unknown,\n  allowed: readonly string[],\n  location: string,\n): void {\n  if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) {\n    invalid(`managed policy ${location} must be an object`);\n  }\n  const unknown = Object.keys(payload).filter((field) => !allowed.includes(field));\n  if (unknown.length > 0) {\n    invalid(`managed policy ${location} contains unsupported fields: ${unknown.join(', ')}`);\n  }\n}\n\nfunction boundedString(\n  value: unknown,\n  field: string,\n  maximum = 1024,\n): string {\n  if (typeof value !== 'string' || !value || value.length > maximum) {\n    invalid(`managed policy ${field} is invalid`);\n  }\n  return value;\n}\n\nfunction canonicalDigest(value: unknown): Promise<string> {\n  const bytes = new TextEncoder().encode(canonicalDriverValue(value));\n  return globalThis.crypto.subtle.digest('SHA-256', bytes).then((result) =>\n    `sha256:${\n      [...new Uint8Array(result)]\n        .map((byte) => byte.toString(16).padStart(2, '0'))\n        .join('')\n    }`\n  );\n}\n\nfunction assertDigest(value: unknown, field: string): string {\n  const digest = boundedString(value, field, 80);\n  if (!SHA256.test(digest)) invalid(`managed policy ${field} must be canonical`);\n  return digest;\n}\n\nfunction decisionName(fingerprintDigest: string): string {\n  return `decision-${fingerprintDigest.slice('sha256:'.length, 62)}`;\n}\n\nfunction handleName(handle: string): string {\n  const prefix = 'policy-decision:';\n  if (!handle.startsWith(prefix)) invalid('managed policy decision handle is invalid');\n  return boundedString(handle.slice(prefix.length), 'decision handle', 253);\n}\n\nfunction validateEvaluation(\n  value: PersistedPolicyEvaluation,\n): PersistedPolicyEvaluation {\n  if (\n    !value ||\n    !['allow', 'deny', 'pending'].includes(value.outcome) ||\n    !Array.isArray(value.reasons) ||\n    value.reasons.length < 1 ||\n    value.reasons.length > 16 ||\n    value.reasons.some((reason) => typeof reason !== 'string' || !reason || reason.length > 1024) ||\n    (value.obligations !== undefined &&\n      (\n        !Array.isArray(value.obligations) ||\n        value.obligations.length > 16 ||\n        value.obligations.some((obligation) =>\n          typeof obligation !== 'string' ||\n          !obligation ||\n          obligation.length > 1024\n        )\n      ))\n  ) invalid('managed policy evaluator returned invalid evidence');\n  return value;\n}\n\n/**\n * Durable production Policy/Approval adapter. Policy outcomes come only from\n * host-injected evaluators or authenticated admin/verifier requests; caller\n * payloads contain no allow bit.\n */\nexport function createControlStorePolicyApprovalAdapter(\n  options: ControlStorePolicyApprovalAdapterOptions,\n): PolicyApprovalManagementDriver {\n  const now = options.now ?? (() => new Date());\n  const maxApprovalTtlMs = options.maxApprovalTtlMs ?? 15 * 60_000;\n  if (\n    !options.name ||\n    !options.threatAssumptions.length ||\n    !Number.isSafeInteger(maxApprovalTtlMs) ||\n    maxApprovalTtlMs < 1\n  ) invalid('managed policy adapter options are invalid');\n\n  let mutations = Promise.resolve();\n\n  async function serialized<T>(operation: () => Promise<T>): Promise<T> {\n    const previous = mutations;\n    let release!: () => void;\n    mutations = new Promise<void>((resolve) => {\n      release = resolve;\n    });\n    await previous;\n    try {\n      return await operation();\n    } finally {\n      release();\n    }\n  }\n\n  async function authorize<T>(\n    request: DriverRequestEnvelope<T>,\n    method: string,\n    fields: string[],\n    actorKinds: ControlStoreActor['kind'][],\n  ): Promise<void> {\n    exactFields(request.payload, fields, `${method} payload`);\n    assertDriverRequestEnvelope(request, {\n      now,\n      requireFencing: true,\n      requireCapability: true,\n      expectedMethod: method,\n    });\n    if (!actorKinds.includes(request.actor.kind)) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: `managed policy actor kind '${request.actor.kind}' cannot call ${method}`,\n        retryable: false,\n      });\n    }\n    if (!await options.authorizeRequest(request)) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed policy capability was rejected',\n        retryable: false,\n      });\n    }\n    await rejectStaleFence(request);\n  }\n\n  async function resourceForHandle(\n    handle: string,\n    subjectUid: string,\n  ): Promise<PolicyDecisionResource> {\n    const resource = await options.store.get<PolicyDecisionSpec, PolicyDecisionStatus>({\n      apiVersion: POLICY_DECISION_API_VERSION,\n      kind: POLICY_DECISION_KIND,\n      name: handleName(handle),\n    }) as PolicyDecisionResource | null;\n    if (!resource) {\n      throw new OrchestrationError({\n        code: 'NOT_FOUND',\n        message: 'managed policy decision was not found',\n        retryable: false,\n      });\n    }\n    if (resource.spec.subjectRef.uid !== subjectUid) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed policy decision belongs to another resource',\n        retryable: false,\n      });\n    }\n    return resource;\n  }\n\n  function toDecision(resource: PolicyDecisionResource): PolicyDecision {\n    let status: PolicyDecisionStatus = resource.status ?? {\n      outcome: resource.spec.initialOutcome,\n      decidedBy: resource.spec.requestedBy,\n      decidedAt: resource.spec.decidedAt,\n      reasons: resource.spec.reasons,\n    };\n    if (\n      status.outcome === 'pending' &&\n      resource.spec.approval &&\n      Date.parse(resource.spec.approval.expiresAt) <= now().getTime()\n    ) {\n      status = {\n        outcome: 'deny',\n        decidedBy: resource.spec.requestedBy,\n        decidedAt: resource.spec.approval.expiresAt,\n        reasons: ['approval expired without an administrator resolution'],\n      };\n    }\n    return {\n      decisionHandle: `policy-decision:${resource.metadata.name}`,\n      resourceUid: resource.spec.subjectRef.uid,\n      kind: resource.spec.decisionKind,\n      outcome: status.outcome,\n      policyDigest: resource.spec.policyDigest,\n      inputDigest: resource.spec.inputDigest,\n      actorId: status.decidedBy,\n      reasons: status.reasons,\n      obligations: resource.spec.obligations,\n      decidedAt: status.decidedAt,\n      ...(resource.spec.approval\n        ? {\n          approval: {\n            ...resource.spec.approval,\n            ...(status.outcome !== 'pending'\n              ? {\n                decidedBy: status.decidedBy,\n                resolvedAt: status.decidedAt,\n                ...(status.resolutionInputDigest\n                  ? { resolutionInputDigest: status.resolutionInputDigest }\n                  : {}),\n              }\n              : {}),\n          },\n        }\n        : {}),\n    };\n  }\n\n  async function rejectStaleFence(\n    request: DriverRequestEnvelope,\n  ): Promise<void> {\n    const decisions = await options.store.list<PolicyDecisionSpec, PolicyDecisionStatus>({\n      apiVersion: POLICY_DECISION_API_VERSION,\n      kind: POLICY_DECISION_KIND,\n    });\n    const maximum = (decisions.items as PolicyDecisionResource[])\n      .filter((item) => item.spec.subjectRef.uid === request.resource.uid)\n      .reduce(\n        (value, item) => Math.max(value, item.spec.fencingEpoch),\n        0,\n      );\n    if ((request.fencingEpoch as number) < maximum) {\n      throw new OrchestrationError({\n        code: 'STALE_EPOCH',\n        message: `managed policy fencing epoch is stale; current epoch is ${maximum}`,\n        retryable: false,\n      });\n    }\n  }\n\n  async function persist(\n    request: DriverRequestEnvelope,\n    kind: PolicyDecisionKind,\n    policyDigest: string,\n    evaluation: PersistedPolicyEvaluation,\n    approval?: PolicyDecisionSpec['approval'],\n  ): Promise<PolicyDecision> {\n    assertDigest(policyDigest, 'policyDigest');\n    const normalized = validateEvaluation(evaluation);\n    return serialized(async () => {\n      await rejectStaleFence(request);\n      const inputDigest = await canonicalDigest(request.payload);\n      const requestFingerprint = await canonicalDigest({\n        method: request.method,\n        resource: request.resource,\n        fencingEpoch: request.fencingEpoch,\n        actor: request.actor,\n        session: request.session,\n        capabilityHandleRef: request.capabilityHandleRef,\n        payloadSchemaDigest: request.payloadSchemaDigest,\n        payload: request.payload,\n      });\n      const identityDigest = await canonicalDigest({\n        resourceUid: request.resource.uid,\n        method: request.method,\n        idempotencyKey: request.idempotencyKey,\n      });\n      const name = decisionName(identityDigest);\n      const existing = await options.store.get<PolicyDecisionSpec, PolicyDecisionStatus>({\n        apiVersion: POLICY_DECISION_API_VERSION,\n        kind: POLICY_DECISION_KIND,\n        name,\n      }) as PolicyDecisionResource | null;\n      if (existing) {\n        if (\n          existing.spec.requestFingerprint !== requestFingerprint ||\n          existing.spec.decisionKind !== kind\n        ) {\n          throw new OrchestrationError({\n            code: 'CONFLICT',\n            message: 'managed policy idempotency input drifted',\n            retryable: false,\n          });\n        }\n        return toDecision(existing);\n      }\n      const decidedAt = now().toISOString();\n      const manifest = createPolicyDecisionManifest(name, {\n        subjectRef: {\n          apiVersion: request.resource.apiVersion,\n          kind: request.resource.kind,\n          name: request.resource.name,\n          uid: request.resource.uid,\n          generation: request.resource.generation,\n        },\n        decisionKind: kind,\n        policyDigest,\n        inputDigest,\n        requestFingerprint,\n        idempotencyKey: request.idempotencyKey,\n        fencingEpoch: request.fencingEpoch as number,\n        requestedBy: request.actor.id,\n        reasons: normalized.reasons,\n        obligations: normalized.obligations ?? [],\n        decidedAt,\n        initialOutcome: normalized.outcome,\n        ...(approval ? { approval } : {}),\n      });\n      let created: PolicyDecisionResource;\n      try {\n        created = await options.store.create<PolicyDecisionSpec, PolicyDecisionStatus>(\n          request.actor,\n          manifest,\n          { idempotencyKey: `managed-policy:${identityDigest}` },\n        ) as PolicyDecisionResource;\n      } catch (error) {\n        const raced = await options.store.get<PolicyDecisionSpec, PolicyDecisionStatus>({\n          apiVersion: POLICY_DECISION_API_VERSION,\n          kind: POLICY_DECISION_KIND,\n          name,\n        }) as PolicyDecisionResource | null;\n        if (!raced || raced.spec.requestFingerprint !== requestFingerprint) throw error;\n        return toDecision(raced);\n      }\n      return toDecision(created);\n    });\n  }\n\n  const decisions: PolicyDecisionKind[] = ['approval'];\n  if (options.evaluateResourceAdmission) decisions.push('resource-admission');\n  if (options.evaluatePlacement) decisions.push('placement');\n  if (options.evaluateToolOperation) decisions.push('tool-operation');\n  if (options.evaluateTransition) decisions.push('transition');\n\n  return {\n    async getCapabilities() {\n      return {\n        name: options.name,\n        decisions: [...decisions],\n        defaultOutcome: 'deny',\n        supportsDurableApproval: true,\n        supportsExplanation: true,\n        persistence: options.persistence,\n        threatAssumptions: [...options.threatAssumptions],\n      };\n    },\n    async admitResource(request) {\n      await authorize(request, 'policy.admit-resource', [\n        'policyDigest',\n        'resourceApiVersion',\n        'resourceKind',\n      ], ['controller', 'admin']);\n      if (!options.evaluateResourceAdmission) {\n        unsupported('managed resource admission is not configured');\n      }\n      const policyDigest = assertDigest(request.payload.policyDigest, 'policyDigest');\n      boundedString(request.payload.resourceApiVersion, 'resourceApiVersion');\n      boundedString(request.payload.resourceKind, 'resourceKind');\n      const evaluation = await options.evaluateResourceAdmission(request);\n      return persist(request, 'resource-admission', policyDigest, evaluation);\n    },\n    async authorizePlacement(request) {\n      await authorize(request, 'policy.authorize-placement', [\n        'policyDigest',\n        'nodeId',\n        'nodeTrustClass',\n        'requiredTrustClass',\n        'attested',\n        'driverConformancePassed',\n      ], ['controller', 'admin']);\n      if (!options.evaluatePlacement) {\n        unsupported('managed placement authorization is not configured');\n      }\n      const policyDigest = assertDigest(request.payload.policyDigest, 'policyDigest');\n      boundedString(request.payload.nodeId, 'nodeId');\n      if (\n        !['trusted', 'restricted', 'quarantine'].includes(\n          request.payload.nodeTrustClass,\n        ) ||\n        !['trusted', 'restricted', 'quarantine'].includes(\n          request.payload.requiredTrustClass,\n        ) ||\n        typeof request.payload.attested !== 'boolean' ||\n        typeof request.payload.driverConformancePassed !== 'boolean'\n      ) invalid('managed placement payload is invalid');\n      const evaluation = await options.evaluatePlacement(request);\n      return persist(request, 'placement', policyDigest, evaluation);\n    },\n    async authorizeToolOperation(request) {\n      await authorize(request, 'policy.authorize-tool-operation', [\n        'policyDigest',\n        'toolName',\n        'effect',\n        'operationDigest',\n        'approvalDecisionHandle',\n      ], ['controller', 'admin']);\n      if (!options.evaluateToolOperation) {\n        unsupported('managed tool authorization is not configured');\n      }\n      const policyDigest = assertDigest(request.payload.policyDigest, 'policyDigest');\n      boundedString(request.payload.toolName, 'toolName');\n      const operationDigest = assertDigest(\n        request.payload.operationDigest,\n        'operationDigest',\n      );\n      if (\n        !['read', 'create', 'update', 'delete', 'execute', 'unknown'].includes(\n          request.payload.effect,\n        )\n      ) invalid('managed tool effect is invalid');\n      let approval: PolicyDecision | undefined;\n      if (request.payload.approvalDecisionHandle !== undefined) {\n        const resource = await resourceForHandle(\n          boundedString(\n            request.payload.approvalDecisionHandle,\n            'approvalDecisionHandle',\n          ),\n          request.resource.uid,\n        );\n        approval = toDecision(resource);\n        if (\n          approval.kind !== 'approval' ||\n          approval.outcome !== 'allow' ||\n          approval.policyDigest !== policyDigest ||\n          approval.approval?.subjectDigest !== operationDigest ||\n          Date.parse(approval.approval.expiresAt) <= now().getTime()\n        ) {\n          throw new OrchestrationError({\n            code: 'FORBIDDEN',\n            message: 'managed tool approval is invalid, expired, or cross-scoped',\n            retryable: false,\n          });\n        }\n      }\n      const evaluation = await options.evaluateToolOperation(request, approval);\n      return persist(request, 'tool-operation', policyDigest, evaluation);\n    },\n    async requestApproval(request) {\n      await authorize(request, 'policy.request-approval', [\n        'policyDigest',\n        'subjectKind',\n        'subjectDigest',\n        'reason',\n        'ttlMs',\n      ], ['controller', 'admin']);\n      const policyDigest = assertDigest(request.payload.policyDigest, 'policyDigest');\n      const subjectDigest = assertDigest(\n        request.payload.subjectDigest,\n        'subjectDigest',\n      );\n      if (\n        !['tool-operation', 'resource', 'placement', 'transition'].includes(\n          request.payload.subjectKind,\n        ) ||\n        !Number.isSafeInteger(request.payload.ttlMs) ||\n        request.payload.ttlMs < 1 ||\n        request.payload.ttlMs > maxApprovalTtlMs\n      ) invalid('managed approval request is invalid');\n      boundedString(request.payload.reason, 'reason');\n      const requestedAt = now();\n      return persist(\n        request,\n        'approval',\n        policyDigest,\n        {\n          outcome: 'pending',\n          reasons: ['approval awaits an authenticated administrator decision'],\n          obligations: ['deny if unresolved or expired'],\n        },\n        {\n          subjectDigest,\n          requestedBy: request.actor.id,\n          requestedAt: requestedAt.toISOString(),\n          expiresAt: new Date(\n            requestedAt.getTime() + request.payload.ttlMs,\n          ).toISOString(),\n        },\n      );\n    },\n    async resolveApproval(request) {\n      await authorize(request, 'policy.resolve-approval', [\n        'approvalDecisionHandle',\n        'outcome',\n        'reason',\n      ], ['admin']);\n      if (request.payload.outcome !== 'allow' && request.payload.outcome !== 'deny') {\n        invalid('managed approval resolution is invalid');\n      }\n      const reason = boundedString(request.payload.reason, 'reason');\n      return serialized(async () => {\n        await rejectStaleFence(request);\n        const resource = await resourceForHandle(\n          boundedString(\n            request.payload.approvalDecisionHandle,\n            'approvalDecisionHandle',\n          ),\n          request.resource.uid,\n        );\n        if (resource.spec.decisionKind !== 'approval' || !resource.spec.approval) {\n          invalid('managed policy decision is not an approval');\n        }\n        if (Date.parse(resource.spec.approval.expiresAt) <= now().getTime()) {\n          throw new OrchestrationError({\n            code: 'TIMEOUT',\n            message: 'managed approval expired before resolution',\n            retryable: false,\n          });\n        }\n        const resolutionInputDigest = await canonicalDigest(request.payload);\n        const currentOutcome = resource.status?.outcome ??\n          resource.spec.initialOutcome;\n        if (currentOutcome !== 'pending') {\n          if (\n            currentOutcome !== request.payload.outcome ||\n            resource.status?.resolutionInputDigest !== resolutionInputDigest\n          ) {\n            throw new OrchestrationError({\n              code: 'CONFLICT',\n              message: 'managed approval resolution is immutable',\n              retryable: false,\n            });\n          }\n          return toDecision(resource);\n        }\n        const status: PolicyDecisionStatus = {\n          outcome: request.payload.outcome,\n          decidedBy: request.actor.id,\n          decidedAt: now().toISOString(),\n          reasons: [reason],\n          resolutionInputDigest,\n        };\n        const updated = await options.store.updateStatus<\n          PolicyDecisionSpec\n        >(\n          request.actor,\n          {\n            apiVersion: POLICY_DECISION_API_VERSION,\n            kind: POLICY_DECISION_KIND,\n            name: resource.metadata.name,\n          },\n          status,\n          {\n            resourceVersion: resource.metadata.resourceVersion,\n            idempotencyKey: `managed-policy-resolve:${resource.metadata.uid}:${request.idempotencyKey}`,\n          },\n        ) as PolicyDecisionResource;\n        return toDecision(updated);\n      });\n    },\n    async verifyTransition(request) {\n      await authorize(request, 'policy.verify-transition', [\n        'policyDigest',\n        'transition',\n        'from',\n        'to',\n        'evidenceDigest',\n      ], ['verifier']);\n      if (!options.evaluateTransition) {\n        unsupported('managed transition verification is not configured');\n      }\n      const policyDigest = assertDigest(request.payload.policyDigest, 'policyDigest');\n      boundedString(request.payload.transition, 'transition');\n      boundedString(request.payload.from, 'from');\n      boundedString(request.payload.to, 'to');\n      assertDigest(request.payload.evidenceDigest, 'evidenceDigest');\n      const evaluation = await options.evaluateTransition(request);\n      return persist(request, 'transition', policyDigest, evaluation);\n    },\n    async explainDecision(request) {\n      await authorize(request, 'policy.explain-decision', ['decisionHandle'], [\n        'controller',\n        'verifier',\n        'admin',\n      ]);\n      const resource = await resourceForHandle(\n        boundedString(request.payload.decisionHandle, 'decisionHandle'),\n        request.resource.uid,\n      );\n      const decision = toDecision(resource);\n      return {\n        decision,\n        summary: `${decision.kind} ${decision.outcome}: ${decision.reasons.join('; ')}`,\n      };\n    },\n  };\n}\n","import type { ControlStoreActor } from '../controlStore.js';\nimport type { AgentWorkloadResource, InfrastructureDriverType, NetworkAttachmentStatus, ToolOperationResource } from '../resources.js';\nimport type { ExternalOrchestrationDriver } from './externalDriver.js';\nimport type { ModelGenerateRequest, ModelProviderDriver, ModelProviderHealth, ModelStreamChunk } from './modelProviderDriver.js';\nimport type { NetworkAttachRequest, NetworkDriver, NetworkDriverCapabilities, NetworkDriverHealth } from './networkDriver.js';\nimport type { ToolExecutionDriver } from './toolExecutionDriver.js';\n\nexport interface DriverManifest {\n  name: string;\n  version: string;\n  kind: InfrastructureDriverType;\n  capabilities: Record<string, boolean | string | number>;\n  supportsCancellation: boolean;\n  supportsBackpressure: boolean;\n  supportsAdoption: boolean;\n  supportsFencing: boolean;\n}\n\nexport interface DriverConformanceTest {\n  name: string;\n  description: string;\n  run: (driver: unknown) => Promise<void>;\n}\n\nexport interface DriverConformanceSuite {\n  interfaceKind: DriverManifest['kind'];\n  tests: DriverConformanceTest[];\n}\n\nexport interface FakeDriverOptions {\n  latencyMs?: number;\n  failureRate?: number;\n  supportsCancellation?: boolean;\n  supportsBackpressure?: boolean;\n  supportsAdoption?: boolean;\n  supportsFencing?: boolean;\n}\n\nasync function maybeFail(latency: number, failureRate: number): Promise<void> {\n  if (latency > 0) await new Promise((resolve) => setTimeout(resolve, latency));\n  if (Math.random() < failureRate) throw new Error('injected failure');\n}\n\n/**\n * Create a fake network driver for conformance testing.\n */\nexport function createFakeNetworkDriver(options: FakeDriverOptions = {}): NetworkDriver {\n  const latency = options.latencyMs ?? 0;\n  const failureRate = options.failureRate ?? 0;\n\n  return {\n    async getCapabilities(): Promise<NetworkDriverCapabilities> {\n      await maybeFail(latency, failureRate);\n      return {\n        name: 'fake-network-driver',\n        enforcedFeatures: ['egress'],\n        enforcementLevel: 'process',\n      };\n    },\n    async prepare(_request: NetworkAttachRequest): Promise<NetworkAttachmentStatus> {\n      await maybeFail(latency, failureRate);\n      return { handle: 'fake-handle' };\n    },\n    async check(_handle: string): Promise<NetworkAttachmentStatus | null> {\n      await maybeFail(latency, failureRate);\n      return { handle: 'fake-handle' };\n    },\n    async update(_handle: string, _request: NetworkAttachRequest): Promise<NetworkAttachmentStatus> {\n      await maybeFail(latency, failureRate);\n      return { handle: 'fake-handle' };\n    },\n    async resolveService(_name: string, _handle?: string): Promise<string | undefined> {\n      await maybeFail(latency, failureRate);\n      return undefined;\n    },\n    async release(_handle: string): Promise<void> {\n      await maybeFail(latency, failureRate);\n    },\n    async getHealth(): Promise<NetworkDriverHealth> {\n      await maybeFail(latency, failureRate);\n      return { healthy: true, checkedAt: new Date().toISOString() };\n    },\n  };\n}\n\n/**\n * Create a fake model provider driver for conformance testing.\n */\nexport function createFakeModelProviderDriver(options: FakeDriverOptions = {}): ModelProviderDriver {\n  const latency = options.latencyMs ?? 0;\n  const failureRate = options.failureRate ?? 0;\n\n  return {\n    async listModels() {\n      await maybeFail(latency, failureRate);\n      return [];\n    },\n    async getHealth(): Promise<ModelProviderHealth> {\n      await maybeFail(latency, failureRate);\n      return { healthy: true, checkedAt: new Date().toISOString() };\n    },\n    async *generate(_request: ModelGenerateRequest): AsyncIterable<ModelStreamChunk> {\n      await maybeFail(latency, failureRate);\n      yield { type: 'delta', delta: 'fake response' };\n    },\n  };\n}\n\n/**\n * Create a fake tool execution driver for conformance testing.\n */\nexport function createFakeToolExecutionDriver(options: FakeDriverOptions = {}): ToolExecutionDriver {\n  const latency = options.latencyMs ?? 0;\n  const failureRate = options.failureRate ?? 0;\n\n  return {\n    async execute(operation): Promise<ToolOperationResource> {\n      await maybeFail(latency, failureRate);\n      return {\n        ...operation,\n        status: { phase: 'Completed', startedAt: new Date().toISOString(), completedAt: new Date().toISOString() },\n      };\n    },\n  };\n}\n\n/**\n * Run a conformance suite against a driver.\n */\nexport async function runConformanceSuite(\n  suite: DriverConformanceSuite,\n  driver: unknown,\n): Promise<{ passed: number; failed: number; failures: Array<{ name: string; error: string }> }> {\n  const failures: Array<{ name: string; error: string }> = [];\n\n  for (const test of suite.tests) {\n    try {\n      await test.run(driver);\n    } catch (error) {\n      failures.push({\n        name: test.name,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n\n  return {\n    passed: suite.tests.length - failures.length,\n    failed: failures.length,\n    failures,\n  };\n}\n\n/**\n * Standard conformance tests for network drivers.\n */\nexport function createNetworkDriverConformanceSuite(): DriverConformanceSuite {\n  return {\n    interfaceKind: 'network',\n    tests: [\n      {\n        name: 'getCapabilities returns valid capabilities',\n        description: 'Driver must return its capability set',\n        run: async (driver) => {\n          const networkDriver = driver as NetworkDriver;\n          const capabilities = await networkDriver.getCapabilities();\n          if (!capabilities.name) throw new Error('name is required');\n          if (!capabilities.enforcementLevel) throw new Error('enforcementLevel is required');\n        },\n      },\n      {\n        name: 'prepare returns attachment status with handle',\n        description: 'Driver must prepare network for a workload',\n        run: async (driver) => {\n          const networkDriver = driver as NetworkDriver;\n          const result = await networkDriver.prepare({\n            attachment: {\n              apiVersion: 'network.memeloop.io/v1alpha1',\n              kind: 'NetworkAttachment',\n              metadata: { name: 'test', namespace: 'default', uid: 'uid-1', generation: 1, resourceVersion: '1', creationTimestamp: '2026-07-18T00:00:00.000Z' },\n              spec: { networkClassRef: { apiVersion: 'network.memeloop.io/v1alpha1', kind: 'NetworkClass', name: 'process' } },\n            },\n            networkClass: {\n              apiVersion: 'network.memeloop.io/v1alpha1',\n              kind: 'NetworkClass',\n              metadata: { name: 'process', namespace: 'default', uid: 'uid-2', generation: 1, resourceVersion: '1', creationTimestamp: '2026-07-18T00:00:00.000Z' },\n              spec: { driver: 'fake-network-driver', enforcement: 'best-effort' },\n            },\n            sandboxRef: 'sandbox-1',\n          });\n          if (!result.handle) throw new Error('prepare must return handle');\n        },\n      },\n      {\n        name: 'getHealth returns health status',\n        description: 'Driver must report its health',\n        run: async (driver) => {\n          const networkDriver = driver as NetworkDriver;\n          const health = await networkDriver.getHealth();\n          if (typeof health.healthy !== 'boolean') throw new Error('healthy is required');\n        },\n      },\n    ],\n  };\n}\n\n/**\n * Standard conformance tests for model provider drivers.\n */\nexport function createModelProviderDriverConformanceSuite(): DriverConformanceSuite {\n  return {\n    interfaceKind: 'model-provider',\n    tests: [\n      {\n        name: 'listModels returns model array',\n        description: 'Driver must list available models',\n        run: async (driver) => {\n          const modelDriver = driver as ModelProviderDriver;\n          const models = await modelDriver.listModels();\n          if (!Array.isArray(models)) throw new Error('listModels must return array');\n        },\n      },\n      {\n        name: 'getHealth returns health status',\n        description: 'Driver must report its health',\n        run: async (driver) => {\n          const modelDriver = driver as ModelProviderDriver;\n          const health = await modelDriver.getHealth();\n          if (typeof health.healthy !== 'boolean') throw new Error('healthy is required');\n        },\n      },\n    ],\n  };\n}\n\n/**\n * Standard conformance tests for tool execution drivers.\n */\nexport function createToolExecutionDriverConformanceSuite(): DriverConformanceSuite {\n  return {\n    interfaceKind: 'tool-execution',\n    tests: [\n      {\n        name: 'execute returns operation resource with status',\n        description: 'Driver must execute a tool operation',\n        run: async (driver) => {\n          const toolDriver = driver as ToolExecutionDriver;\n          const operation: ToolOperationResource = {\n            apiVersion: 'execution.memeloop.io/v1alpha1',\n            kind: 'ToolOperation',\n            metadata: { name: 'test', namespace: 'default', uid: 'uid-1', generation: 1, resourceVersion: '1', creationTimestamp: '2026-07-18T00:00:00.000Z' },\n            spec: { toolRef: { kind: 'Tool', name: 'test-tool' }, effect: 'execute' },\n          };\n          const result = await toolDriver.execute(operation);\n          if (!result.status) throw new Error('execute must return status');\n          if (!result.status.phase) throw new Error('status.phase is required');\n        },\n      },\n    ],\n  };\n}\n\n/**\n * Standard lifecycle and crash-adoption contract for optional external\n * orchestrators. Resource factories keep backend-specific runtime-image\n * annotations out of portable core while allowing this exact suite to run\n * against Swarm, Kubernetes, and future plugins.\n */\nexport function createExternalOrchestrationDriverConformanceSuite(options: {\n  createWorkload: (name: string) => AgentWorkloadResource;\n  createToolOperation: (name: string) => ToolOperationResource;\n  actor?: ControlStoreActor;\n}): DriverConformanceSuite {\n  const actor = options.actor ?? { id: 'controller/external-conformance', kind: 'controller' };\n  return {\n    interfaceKind: 'external-orchestrator',\n    tests: [\n      {\n        name: 'reports honest external orchestration capabilities and health',\n        description: 'Both independently managed resource kinds, adoption support, and health are explicit',\n        run: async (driver) => {\n          const external = driver as ExternalOrchestrationDriver;\n          const [capabilities, health] = await Promise.all([\n            external.getCapabilities(),\n            external.getHealth(),\n          ]);\n          for (const kind of ['AgentWorkload', 'ToolOperation'] as const) {\n            if (!capabilities.manages.includes(kind)) throw new Error(`capabilities do not manage ${kind}`);\n          }\n          if (!capabilities.supportsAdoption) throw new Error('crash-safe adoption is required');\n          if (typeof health.healthy !== 'boolean' || !health.checkedAt) throw new Error('invalid health result');\n        },\n      },\n      {\n        name: 'places, discovers, adopts, inspects, and stops a workload',\n        description: 'The workload lifecycle is independently addressable and duplicate UID placement is idempotent',\n        run: async (driver) => {\n          const external = driver as ExternalOrchestrationDriver;\n          const workload = options.createWorkload('external-conformance-workload');\n          const first = await external.placeWorkload(workload, actor);\n          if (!first.externalId) throw new Error('placement did not return externalId');\n          const second = await external.placeWorkload(workload, actor);\n          if (second.externalId !== first.externalId) throw new Error('duplicate workload UID was not adopted');\n          const status = await external.getWorkloadStatus(first.externalId);\n          if (status.externalId !== first.externalId) throw new Error('workload status identity mismatch');\n          const listed = await external.listWorkloads();\n          if (!listed.some((entry) => entry.externalId === first.externalId)) {\n            throw new Error('placed workload missing from listWorkloads');\n          }\n          await external.stopWorkload(first.externalId, actor);\n        },\n      },\n      {\n        name: 'executes, discovers, adopts, inspects, and cancels a tool operation',\n        description: 'The tool lifecycle is independently addressable and duplicate UID submission is idempotent',\n        run: async (driver) => {\n          const external = driver as ExternalOrchestrationDriver;\n          const operation = options.createToolOperation('external-conformance-tool');\n          const first = await external.executeToolOperation(operation, actor);\n          if (!first.externalId) throw new Error('execution did not return externalId');\n          const second = await external.executeToolOperation(operation, actor);\n          if (second.externalId !== first.externalId) throw new Error('duplicate tool UID was not adopted');\n          const status = await external.getToolOperationStatus(first.externalId);\n          if (status.externalId !== first.externalId) throw new Error('tool status identity mismatch');\n          const listed = await external.listToolOperations();\n          if (!listed.some((entry) => entry.externalId === first.externalId)) {\n            throw new Error('placed tool operation missing from listToolOperations');\n          }\n          await external.cancelToolOperation(first.externalId, actor);\n        },\n      },\n    ],\n  };\n}\n","/**\n * Plan 24.61: record/replay fixtures, capability negotiation, cancel/backpressure,\n * crash/adoption, idempotency/fencing, downgrade, and security conformance tests.\n *\n * These helpers are interface-agnostic: each takes the small set of driver\n * operations it needs, so the same suites apply to network, model-provider,\n * tool-execution, storage, and credential drivers.\n */\n\nimport type { DriverConformanceTest, DriverManifest } from './driverConformance.js';\n\n// ─── Assertion helpers (vitest-agnostic so suites run in any harness) ───\n\nasync function assertRejects(promise: Promise<unknown>, message: string): Promise<void> {\n  try {\n    await promise;\n  } catch {\n    return;\n  }\n  throw new Error(message);\n}\n\nasync function assertResolves(promise: Promise<unknown>, message: string): Promise<void> {\n  try {\n    await promise;\n  } catch (error) {\n    throw new Error(`${message}: ${error instanceof Error ? error.message : String(error)}`);\n  }\n}\n\n// ─── Record/Replay Fixtures ─────────────────────────────────────────\n\nexport interface RecordedInteraction {\n  method: string;\n  arguments: unknown[];\n  result?: unknown;\n  error?: string;\n  recordedAt: string;\n}\n\nexport interface DriverFixture {\n  name: string;\n  driverKind: DriverManifest['kind'];\n  interactions: RecordedInteraction[];\n}\n\n/**\n * Wrap a driver and record every method call into a fixture. The fixture can\n * be serialized to JSON and checked into the repo as a portable conformance\n * artifact.\n */\nexport function createRecordingDriver<T extends object>(driver: T, kind: DriverManifest['kind'], name: string): { driver: T; fixture: () => DriverFixture } {\n  const interactions: RecordedInteraction[] = [];\n  const proxy = new Proxy(driver, {\n    get(target, property, receiver) {\n      const value = Reflect.get(target, property, receiver);\n      if (typeof value !== 'function' || typeof property !== 'string') return value;\n      return async (...arguments_: unknown[]) => {\n        const recordedAt = new Date().toISOString();\n        try {\n          const result = await (value as (...arguments__: unknown[]) => Promise<unknown>).apply(target, arguments_);\n          interactions.push({ method: property, arguments: arguments_, result, recordedAt });\n          return result;\n        } catch (error) {\n          interactions.push({\n            method: property,\n            arguments: arguments_,\n            error: error instanceof Error ? error.message : String(error),\n            recordedAt,\n          });\n          throw error;\n        }\n      };\n    },\n  });\n  return {\n    driver: proxy,\n    fixture: () => ({ name, driverKind: kind, interactions: [...interactions] }),\n  };\n}\n\n/**\n * Create a driver that replays a recorded fixture. Each method call returns\n * the recorded result (or throws the recorded error) in order. A call that\n * does not match the next recorded interaction fails the replay.\n */\nexport function createReplayingDriver(fixture: DriverFixture): Record<string, unknown> {\n  let cursor = 0;\n  return new Proxy({} as Record<string, unknown>, {\n    get(_target, property) {\n      if (typeof property !== 'string') return undefined;\n      return async (..._arguments: unknown[]) => {\n        const interaction = fixture.interactions[cursor];\n        if (!interaction) {\n          throw new Error(`replay exhausted: no recorded interaction for ${property}`);\n        }\n        if (interaction.method !== property) {\n          throw new Error(`replay mismatch: expected ${interaction.method}, got ${property}`);\n        }\n        cursor += 1;\n        if (interaction.error) throw new Error(interaction.error);\n        return interaction.result;\n      };\n    },\n  });\n}\n\n// ─── Capability Negotiation ─────────────────────────────────────────\n\n/**\n * Verify a driver's reported capabilities satisfy the required capability set.\n * Returns the list of missing capabilities (empty when negotiation succeeds).\n */\nexport function negotiateCapabilities(\n  reported: Record<string, boolean | string | number>,\n  required: Record<string, boolean | string | number>,\n): string[] {\n  const missing: string[] = [];\n  for (const [key, value] of Object.entries(required)) {\n    if (reported[key] !== value) {\n      missing.push(key);\n    }\n  }\n  return missing;\n}\n\nexport function createCapabilityNegotiationTests(options: {\n  getCapabilities: (driver: unknown) => Promise<Record<string, boolean | string | number>>;\n  requiredCapabilities: Record<string, boolean | string | number>;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'capability negotiation succeeds for required set',\n      description: 'Driver-reported capabilities must cover every required capability',\n      run: async (driver) => {\n        const reported = await options.getCapabilities(driver);\n        const missing = negotiateCapabilities(reported, options.requiredCapabilities);\n        if (missing.length > 0) {\n          throw new Error(`missing required capabilities: ${missing.join(', ')}`);\n        }\n      },\n    },\n    {\n      name: 'capability negotiation rejects unsupported requirement',\n      description: 'Control plane must detect when a driver cannot satisfy a requirement',\n      run: async (driver) => {\n        const reported = await options.getCapabilities(driver);\n        const missing = negotiateCapabilities(reported, { 'definitely-unsupported-capability': true });\n        if (missing.length === 0) {\n          throw new Error('negotiation must report missing capabilities');\n        }\n      },\n    },\n  ];\n}\n\n// ─── Cancel / Backpressure ──────────────────────────────────────────\n\nexport function createCancellationTests(options: {\n  startLongOperation: (driver: unknown, signal: AbortSignal) => Promise<unknown>;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'cancellation aborts a long-running operation',\n      description: 'Aborting the signal must terminate the operation with a cancellation error',\n      run: async (driver) => {\n        const controller = new AbortController();\n        const pending = options.startLongOperation(driver, controller.signal);\n        controller.abort();\n        await assertRejects(pending, 'operation must reject when aborted');\n      },\n    },\n    {\n      name: 'unaborted long operation completes',\n      description: 'Control case: without abort, the operation completes normally',\n      run: async (driver) => {\n        const controller = new AbortController();\n        await assertResolves(options.startLongOperation(driver, controller.signal), 'operation must complete when not aborted');\n      },\n    },\n  ];\n}\n\nexport function createBackpressureTests(options: {\n  submit: (driver: unknown) => Promise<unknown>;\n  concurrencyLimit: number;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'backpressure rejects excess concurrent operations',\n      description: 'Driver must reject or queue operations beyond its concurrency limit',\n      run: async (driver) => {\n        const inFlight = Array.from({ length: options.concurrencyLimit + 5 }, () => options.submit(driver));\n        const results = await Promise.allSettled(inFlight);\n        const rejected = results.filter((result) => result.status === 'rejected');\n        // At least one submission beyond the limit must be rejected or all must complete.\n        if (rejected.length === 0 && results.length > options.concurrencyLimit * 4) {\n          throw new Error('driver accepted unbounded concurrency without backpressure');\n        }\n      },\n    },\n  ];\n}\n\n// ─── Crash / Adoption ───────────────────────────────────────────────\n\nexport function createAdoptionTests(options: {\n  createResource: (driver: unknown) => Promise<string>;\n  recreateDriver: () => unknown;\n  listResources: (driver: unknown) => Promise<string[]>;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'restarted driver adopts pre-crash resources',\n      description: 'A new driver instance must discover resources created before the crash',\n      run: async (driver) => {\n        const resourceId = await options.createResource(driver);\n        const restarted = options.recreateDriver();\n        const adopted = await options.listResources(restarted);\n        if (!adopted.includes(resourceId)) {\n          throw new Error(`restarted driver did not adopt resource ${resourceId}`);\n        }\n      },\n    },\n  ];\n}\n\n// ─── Idempotency / Fencing ──────────────────────────────────────────\n\nexport function createIdempotencyTests(options: {\n  submitWithIdempotencyKey: (driver: unknown, key: string) => Promise<unknown>;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'repeated submission with same idempotency key returns same result',\n      description: 'Duplicate submissions must not create duplicate side effects',\n      run: async (driver) => {\n        const key = `idem-${Date.now()}`;\n        const first = await options.submitWithIdempotencyKey(driver, key);\n        const second = await options.submitWithIdempotencyKey(driver, key);\n        if (JSON.stringify(first) !== JSON.stringify(second)) {\n          throw new Error('idempotent submissions returned different results');\n        }\n      },\n    },\n  ];\n}\n\nexport function createFencingTests(options: {\n  operateWithFence: (driver: unknown, fenceToken: number) => Promise<unknown>;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'stale fence token is rejected',\n      description: 'An operation carrying an older fence token must fail',\n      run: async (driver) => {\n        await options.operateWithFence(driver, 2);\n        await assertRejects(options.operateWithFence(driver, 1), 'stale fence token must be rejected');\n      },\n    },\n    {\n      name: 'monotonic fence tokens are accepted',\n      description: 'Operations with increasing fence tokens must succeed',\n      run: async (driver) => {\n        await options.operateWithFence(driver, 10);\n        await assertResolves(options.operateWithFence(driver, 11), 'monotonic fence token must be accepted');\n      },\n    },\n  ];\n}\n\n// ─── Downgrade ──────────────────────────────────────────────────────\n\nexport function createDowngradeTests(options: {\n  callWithVersion: (driver: unknown, version: string) => Promise<unknown>;\n  supportedVersion: string;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'unsupported newer version is rejected with explicit error',\n      description: 'Driver must fail closed when asked to speak a newer protocol version',\n      run: async (driver) => {\n        await assertRejects(options.callWithVersion(driver, 'v999'), 'unsupported version must be rejected');\n      },\n    },\n    {\n      name: 'supported version is accepted',\n      description: 'Control case: the supported protocol version works',\n      run: async (driver) => {\n        await assertResolves(options.callWithVersion(driver, options.supportedVersion), 'supported version must be accepted');\n      },\n    },\n  ];\n}\n\n// ─── Security ───────────────────────────────────────────────────────\n\nexport function createSecurityTests(options: {\n  callAsActor: (driver: unknown, actorId: string) => Promise<unknown>;\n  unauthorizedActorId: string;\n  authorizedActorId: string;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'unauthorized actor is rejected',\n      description: 'Driver must reject calls from actors without grants',\n      run: async (driver) => {\n        await assertRejects(options.callAsActor(driver, options.unauthorizedActorId), 'unauthorized actor must be rejected');\n      },\n    },\n    {\n      name: 'authorized actor is accepted',\n      description: 'Control case: an actor with grants succeeds',\n      run: async (driver) => {\n        await assertResolves(options.callAsActor(driver, options.authorizedActorId), 'authorized actor must be accepted');\n      },\n    },\n  ];\n}\n","import type { ControlStoreActor } from '../controlStore.js';\nimport { ORCHESTRATION_ERROR_CODES, type OrchestrationErrorData } from '../errors.js';\nimport type { AgentWorkloadResource, ToolOperationResource, ToolOperationResult } from '../resources.js';\nimport type { ExternalToolContract } from './externalToolContract.js';\nimport type { ExternalWorkloadRuntimeContract } from './externalWorkloadContract.js';\n\nconst RUNTIME_RESULT_PREFIX = 'MEMELOOP_RESULT ';\n\nexport interface ExternalRuntimeResult {\n  phase: 'Completed' | 'Failed' | 'Cancelled';\n  summary?: string;\n  result?: ToolOperationResult;\n  error?: OrchestrationErrorData;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction isOrchestrationErrorData(value: unknown): value is OrchestrationErrorData {\n  if (!isRecord(value)) return false;\n  return (\n    typeof value.code === 'string' &&\n    ORCHESTRATION_ERROR_CODES.includes(value.code as OrchestrationErrorData['code']) &&\n    typeof value.message === 'string' &&\n    typeof value.retryable === 'boolean' &&\n    (value.retryAfterMs === undefined ||\n      (typeof value.retryAfterMs === 'number' && Number.isFinite(value.retryAfterMs))) &&\n    (value.reason === undefined || typeof value.reason === 'string') &&\n    (value.details === undefined || isRecord(value.details))\n  );\n}\n\n/** Parse the last structured worker-result line from a bounded log tail. */\nexport function parseExternalRuntimeResult(logTail: string): ExternalRuntimeResult | undefined {\n  const offset = logTail.lastIndexOf(RUNTIME_RESULT_PREFIX);\n  if (offset < 0) return undefined;\n  const line = logTail\n    .slice(offset + RUNTIME_RESULT_PREFIX.length)\n    .split(/\\r?\\n/, 1)[0]\n    ?.trim();\n  if (!line) return undefined;\n  try {\n    const value = JSON.parse(line) as Record<string, unknown>;\n    if (!isRecord(value)) return undefined;\n    if (value.phase !== 'Completed' && value.phase !== 'Failed' && value.phase !== 'Cancelled') {\n      return undefined;\n    }\n    if (value.summary !== undefined && typeof value.summary !== 'string') return undefined;\n    if (\n      value.result !== undefined &&\n      (!isRecord(value.result) ||\n        (value.result.error !== undefined && !isOrchestrationErrorData(value.result.error)) ||\n        (value.result.evidenceRef !== undefined && typeof value.result.evidenceRef !== 'string'))\n    ) {\n      return undefined;\n    }\n    if (value.error !== undefined && !isOrchestrationErrorData(value.error)) return undefined;\n    return value as unknown as ExternalRuntimeResult;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * External orchestrator driver contract (24.62).\n *\n * Every external orchestrator (Docker Swarm, Kubernetes/K3s, Nomad, etc.)\n * implements this portable contract so that the memeloop control plane can\n * map AgentWorkload and ToolOperation resources without importing any\n * backend SDK into core or the default CLI.\n *\n * Driver packages (memeloop-swarm, memeloop-k8s, etc.) are separate optional\n * Node packages that import this contract from `memeloop` and register\n * themselves through the ControlStore's driver manifest system.\n */\n\nexport interface ExternalPlacementResult {\n  /** External orchestrator's native resource identifier (service name, pod name, job name). */\n  externalId: string;\n  /** The node where the workload or operation was placed. */\n  nodeName: string;\n  /** Provider-specific metadata (e.g. Docker service ID, K8s UID). */\n  providerMetadata?: Record<string, string>;\n}\n\nexport interface ExternalStatusResult {\n  externalId: string;\n  phase: 'Pending' | 'Running' | 'Succeeded' | 'Failed' | 'Cancelled' | 'Unknown';\n  message?: string;\n  /** Structured, validated `MEMELOOP_RESULT` recovered from the worker. */\n  runtimeResult?: ExternalRuntimeResult;\n  /** When the external orchestrator last reported this status. */\n  observedAt: string;\n  /** Resource usage reported by the external runtime. */\n  resources?: {\n    cpuCores?: number;\n    memoryBytes?: number;\n  };\n}\n\nexport interface ExternalDriverCapabilities {\n  name: string;\n  version: string;\n  /** What the driver manages: workloads, tool-operations, or both. */\n  manages: Array<'AgentWorkload' | 'ToolOperation'>;\n  /** Whether the driver supports co-located scheduling (workload + tool on same node). */\n  supportsColocation: boolean;\n  /**\n   * Whether repeated placement of the same immutable MemeLoop resource UID\n   * adopts the native object. Required for crash-safe controller recovery.\n   */\n  supportsAdoption: boolean;\n  /** Maximum concurrent workloads this driver can handle. */\n  maxConcurrency?: number;\n  /**\n   * Trusted tool/runtime contracts. Required for every externally placed\n   * ToolOperation; an empty/absent catalog makes tool placement fail closed.\n   */\n  toolContracts?: ExternalToolContract[];\n  /** Host-owned runtimeClass-to-container bindings for AgentWorkloads. */\n  workloadRuntimes?: ExternalWorkloadRuntimeContract[];\n}\n\nexport interface ExternalWorkloadPlacementContext {\n  /** Admitted source resolved from the content-addressed artifact store. */\n  scriptSource?: string;\n  /**\n   * Single-use worker bootstrap secret. Drivers must materialize it through\n   * their native secret mechanism as a read-only file, never argv, ordinary\n   * environment, labels, annotations, provider metadata, or ControlStore.\n   */\n  workerBootstrap?: ExternalWorkerBootstrapSecret;\n  /** Portable cancellation for placement requests. */\n  signal?: AbortSignal;\n}\n\nexport interface ExternalWorkerBootstrapSecret {\n  apiVersion: 'worker.memeloop.io/v1alpha1';\n  gatewayUrl: string;\n  gatewayPublicKey: string;\n  gatewayKeyFingerprint: string;\n  /** Optional PEM CA certificate for an internal HTTPS worker gateway. */\n  gatewayCaCertificate?: string;\n  enrollmentName: string;\n  bootstrapToken: string;\n}\n\n/**\n * Portable external orchestrator driver.\n *\n * Implementations translate between memeloop orchestration resources and\n * the external orchestrator's native API. The control plane never calls\n * Docker/K8s SDKs directly — it always goes through this contract.\n */\nexport interface ExternalOrchestrationDriver {\n  /** Return capabilities so the control plane knows what to route. */\n  getCapabilities(): Promise<ExternalDriverCapabilities>;\n\n  /** Place an AgentWorkload on the external orchestrator. */\n  placeWorkload(\n    workload: AgentWorkloadResource,\n    actor: ControlStoreActor,\n    context?: ExternalWorkloadPlacementContext,\n  ): Promise<ExternalPlacementResult>;\n\n  /** Get the current status of a placed workload. */\n  getWorkloadStatus(externalId: string): Promise<ExternalStatusResult>;\n\n  /** Stop and remove a placed workload. */\n  stopWorkload(externalId: string, actor: ControlStoreActor): Promise<void>;\n\n  /** Execute a ToolOperation on the external orchestrator. */\n  executeToolOperation(\n    operation: ToolOperationResource,\n    actor: ControlStoreActor,\n  ): Promise<ExternalPlacementResult>;\n\n  /** Get the current status of a tool operation execution. */\n  getToolOperationStatus(externalId: string): Promise<ExternalStatusResult>;\n\n  /** Cancel a running tool operation. */\n  cancelToolOperation(externalId: string, actor: ControlStoreActor): Promise<void>;\n\n  /** List all workloads currently managed by this driver. */\n  listWorkloads(): Promise<ExternalStatusResult[]>;\n\n  /** List all tool operations currently managed by this driver. */\n  listToolOperations(): Promise<ExternalStatusResult[]>;\n\n  /** Health check for the driver connection. */\n  getHealth(): Promise<{ healthy: boolean; detail?: string; checkedAt: string }>;\n}\n","import { Ajv, type ValidateFunction } from 'ajv';\nimport { Ajv2019 } from 'ajv/dist/2019.js';\nimport { Ajv2020 } from 'ajv/dist/2020.js';\n\nimport { OrchestrationError } from '../errors.js';\nimport type { ToolOperationEffect, ToolOperationResource } from '../resources.js';\n\nexport interface ExternalToolContract {\n  /** Exact portable tool identity implemented by the external runtime. */\n  kind: string;\n  name: string;\n  /** Host-authoritative effect. A caller cannot downgrade this value. */\n  effect: ToolOperationEffect;\n  /** Portable JSON Schema applied without coercion, defaults, or field removal. */\n  inputSchema: Record<string, unknown>;\n  /** Portable JSON Schema for the untrusted runtime's returned value. */\n  outputSchema: Record<string, unknown>;\n  /** Optional content digest callers may pin through `toolRef.schemaDigest`. */\n  schemaDigest?: string;\n  /** Host-owned hard resource ceiling for the one-shot executor. */\n  resources: {\n    cpuMillicores: number;\n    memoryBytes: number;\n  };\n  /** Exact immutable/tagged image references admitted to implement this contract. */\n  runtimeImages: string[];\n}\n\nconst validatorOptions = {\n  allErrors: true,\n  coerceTypes: false,\n  removeAdditional: false,\n  strict: false,\n  useDefaults: false,\n  validateFormats: false,\n} as const;\nconst TOOL_EFFECTS = new Set<ToolOperationEffect>([\n  'read',\n  'create',\n  'update',\n  'delete',\n  'execute',\n  'unknown',\n]);\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction compilerFor(schema: Record<string, unknown>): Ajv | Ajv2019 | Ajv2020 {\n  switch (schema.$schema) {\n    case undefined:\n    case 'http://json-schema.org/draft-07/schema#':\n    case 'https://json-schema.org/draft-07/schema#': {\n      return new Ajv(validatorOptions);\n    }\n    case 'https://json-schema.org/draft/2019-09/schema': {\n      return new Ajv2019(validatorOptions);\n    }\n    case 'https://json-schema.org/draft/2020-12/schema': {\n      return new Ajv2020(validatorOptions);\n    }\n    default: {\n      invalid(`external tool contract uses unsupported schema draft '${String(schema.$schema)}'`);\n    }\n  }\n}\n\nfunction compileSchema(\n  contract: ExternalToolContract,\n  schema: Record<string, unknown>,\n  direction: 'input' | 'output',\n): ValidateFunction {\n  if (\n    typeof contract.kind !== 'string' ||\n    contract.kind.length === 0 ||\n    typeof contract.name !== 'string' ||\n    contract.name.length === 0 ||\n    !TOOL_EFFECTS.has(contract.effect) ||\n    !Array.isArray(contract.runtimeImages) ||\n    contract.runtimeImages.length === 0 ||\n    contract.runtimeImages.some((image) => typeof image !== 'string' || image.length === 0) ||\n    !contract.resources ||\n    !Number.isSafeInteger(contract.resources.cpuMillicores) ||\n    contract.resources.cpuMillicores < 1 ||\n    !Number.isSafeInteger(contract.resources.memoryBytes) ||\n    contract.resources.memoryBytes < 1\n  ) {\n    invalid(`external tool contract '${contract.name}' is incomplete`);\n  }\n  try {\n    return compilerFor(schema).compile(schema);\n  } catch {\n    invalid(`external tool contract '${contract.name}' has an invalid ${direction} schema`);\n  }\n}\n\n/** Validate a driver-published catalog once at construction/discovery time. */\nexport function assertExternalToolContracts(\n  contracts: readonly ExternalToolContract[],\n): void {\n  const identities = new Set<string>();\n  for (const contract of contracts) {\n    if (contract === null || typeof contract !== 'object' || Array.isArray(contract)) {\n      invalid('external tool contract must be an object');\n    }\n    const identity = `${contract.kind}\\0${contract.name}`;\n    if (identities.has(identity)) {\n      invalid(`external tool contract '${contract.kind}/${contract.name}' is duplicated`);\n    }\n    identities.add(identity);\n    compileSchema(contract, contract.inputSchema, 'input');\n    compileSchema(contract, contract.outputSchema, 'output');\n  }\n}\n\n/**\n * Bind an externally placed operation to the driver/runtime's trusted\n * declaration before any native API call or adoption lookup.\n */\nexport function assertExternalToolOperationContract(\n  operation: ToolOperationResource,\n  contracts: readonly ExternalToolContract[] | undefined,\n  runtimeImage: string | undefined,\n): ExternalToolContract {\n  const matches = (contracts ?? []).filter((candidate) =>\n    candidate.kind === operation.spec.toolRef.kind &&\n    candidate.name === operation.spec.toolRef.name\n  );\n  if (matches.length !== 1) {\n    invalid(\n      `external tool '${operation.spec.toolRef.kind}/${operation.spec.toolRef.name}' has no unique trusted runtime contract`,\n    );\n  }\n  const contract = matches[0];\n  if (operation.spec.effect !== contract.effect) {\n    invalid(\n      `external tool '${contract.name}' effect '${operation.spec.effect}' does not match host contract '${contract.effect}'`,\n    );\n  }\n  if (\n    operation.spec.toolRef.schemaDigest !== undefined &&\n    operation.spec.toolRef.schemaDigest !== contract.schemaDigest\n  ) {\n    invalid(`external tool '${contract.name}' schema digest does not match the host contract`);\n  }\n  if (runtimeImage !== undefined && !contract.runtimeImages.includes(runtimeImage)) {\n    invalid(`runtime image '${runtimeImage}' is not admitted for external tool '${contract.name}'`);\n  }\n  const validate = compileSchema(contract, contract.inputSchema, 'input');\n  if (!validate(operation.spec.arguments ?? {})) {\n    invalid(`external tool '${contract.name}' arguments do not match the host contract`);\n  }\n  return contract;\n}\n\n/** Validate the value returned by an external runtime before persistence. */\nexport function assertExternalToolOperationResult(\n  contract: ExternalToolContract,\n  value: unknown,\n): void {\n  const validate = compileSchema(contract, contract.outputSchema, 'output');\n  if (!validate(value)) {\n    invalid(`external tool '${contract.name}' result does not match the host contract`);\n  }\n}\n\n/** Contracts implemented by the bundled minimal worker-runtime image. */\nexport function createMinimalExternalRuntimeToolContracts(runtimeImage: string): ExternalToolContract[] {\n  return [{\n    kind: 'Tool',\n    name: 'memeloop.runtime.health',\n    effect: 'read',\n    inputSchema: { type: 'object', additionalProperties: false },\n    outputSchema: {\n      type: 'object',\n      properties: { healthy: { type: 'boolean' } },\n      required: ['healthy'],\n      additionalProperties: false,\n    },\n    resources: { cpuMillicores: 500, memoryBytes: 256 * 1024 * 1024 },\n    runtimeImages: [runtimeImage],\n  }, {\n    kind: 'Tool',\n    name: 'memeloop.runtime.echo',\n    effect: 'read',\n    inputSchema: { type: 'object' },\n    outputSchema: { type: 'object' },\n    resources: { cpuMillicores: 500, memoryBytes: 256 * 1024 * 1024 },\n    runtimeImages: [runtimeImage],\n  }];\n}\n","import { OrchestrationError } from '../errors.js';\nimport type { AgentWorkloadResource } from '../resources.js';\nimport type { AgentWorkloadResourceRequirements } from '../resources.js';\n\nconst RUNTIME_IMAGE_ANNOTATION = 'memeloop.io/runtime-image';\nconst RUNTIME_COMMAND_ANNOTATION = 'memeloop.io/runtime-command';\nconst RUNTIME_ENV_ANNOTATION = 'memeloop.io/runtime-env';\nconst RUNTIME_CPU_ANNOTATION = 'memeloop.io/runtime-cpu';\nconst RUNTIME_MEMORY_ANNOTATION = 'memeloop.io/runtime-memory';\n\nexport interface ExternalWorkloadRuntimeContract {\n  /** Matches `AgentWorkload.spec.runtimeClass`; `default` matches omission. */\n  runtimeClass: string;\n  /** Host-selected image. Production deployments should pin a manifest digest. */\n  image: string;\n  /** Host-selected entrypoint override, if the image default is insufficient. */\n  command?: string[];\n  /** Host-selected non-secret container environment. */\n  environment?: Record<string, string>;\n  /** Default and maximum enforced CPU/memory allocation. */\n  resources: {\n    cpuMillicores: number;\n    memoryBytes: number;\n  };\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nexport function assertExternalWorkloadRuntimeContracts(\n  contracts: readonly ExternalWorkloadRuntimeContract[],\n): void {\n  const classes = new Set<string>();\n  for (const contract of contracts) {\n    if (contract === null || typeof contract !== 'object' || Array.isArray(contract)) {\n      invalid('external workload runtime contract must be an object');\n    }\n    if (\n      typeof contract.runtimeClass !== 'string' ||\n      contract.runtimeClass.length === 0 ||\n      typeof contract.image !== 'string' ||\n      contract.image.length === 0\n    ) {\n      invalid('external workload runtime contracts require runtimeClass and image');\n    }\n    if (\n      !Number.isSafeInteger(contract.resources?.cpuMillicores) ||\n      contract.resources.cpuMillicores < 1 ||\n      !Number.isSafeInteger(contract.resources?.memoryBytes) ||\n      contract.resources.memoryBytes < 1\n    ) {\n      invalid(\n        `external workload runtimeClass '${contract.runtimeClass}' requires positive safe CPU/memory limits`,\n      );\n    }\n    if (classes.has(contract.runtimeClass)) {\n      invalid(`external workload runtimeClass '${contract.runtimeClass}' is duplicated`);\n    }\n    classes.add(contract.runtimeClass);\n    if (\n      (\n        contract.command !== undefined &&\n        (\n          !Array.isArray(contract.command) ||\n          contract.command.some((argument) => typeof argument !== 'string')\n        )\n      ) ||\n      (\n        contract.environment !== undefined &&\n        !isRecord(contract.environment)\n      ) ||\n      Object.entries(contract.environment ?? {}).some(([key, value]) => !key || typeof value !== 'string' || key.startsWith('MEMELOOP_'))\n    ) {\n      invalid(`external workload runtimeClass '${contract.runtimeClass}' has invalid command or environment`);\n    }\n  }\n}\n\n/**\n * Resolve only host-published runtime configuration. Legacy annotations are\n * rejected because they let a workload replace the trusted worker process.\n */\nexport function resolveExternalWorkloadRuntime(\n  workload: AgentWorkloadResource,\n  contracts: readonly ExternalWorkloadRuntimeContract[] | undefined,\n): ExternalWorkloadRuntimeContract {\n  const annotations = workload.metadata.annotations;\n  if (\n    annotations?.[RUNTIME_IMAGE_ANNOTATION] !== undefined ||\n    annotations?.[RUNTIME_COMMAND_ANNOTATION] !== undefined ||\n    annotations?.[RUNTIME_ENV_ANNOTATION] !== undefined ||\n    annotations?.[RUNTIME_CPU_ANNOTATION] !== undefined ||\n    annotations?.[RUNTIME_MEMORY_ANNOTATION] !== undefined\n  ) {\n    invalid(\n      'AgentWorkload runtime image, command, container environment, and resources are host-owned; select spec.runtimeClass and spec.resources instead',\n    );\n  }\n  const runtimeClass = workload.spec.runtimeClass ?? 'default';\n  const matches = (contracts ?? []).filter((candidate) => candidate.runtimeClass === runtimeClass);\n  if (matches.length !== 1) {\n    invalid(`AgentWorkload runtimeClass '${runtimeClass}' has no unique trusted external runtime`);\n  }\n  return matches[0];\n}\n\n/** Apply host maxima and safe defaults to portable workload requirements. */\nexport function resolveExternalWorkloadResources(\n  workload: AgentWorkloadResource,\n  contract: ExternalWorkloadRuntimeContract,\n): AgentWorkloadResourceRequirements {\n  const requested = workload.spec.resources;\n  if (\n    (requested?.gpuCount ?? 0) > 0 ||\n    (requested?.diskBytes ?? 0) > 0 ||\n    (requested?.bandwidthKbps ?? 0) > 0\n  ) {\n    invalid(\n      `external runtimeClass '${contract.runtimeClass}' does not implement GPU, disk, or bandwidth isolation`,\n    );\n  }\n  const cpuMillicores = requested?.cpuMillicores ??\n    contract.resources.cpuMillicores;\n  const memoryBytes = requested?.memoryBytes ?? contract.resources.memoryBytes;\n  if (\n    !Number.isSafeInteger(cpuMillicores) ||\n    cpuMillicores < 1 ||\n    cpuMillicores > contract.resources.cpuMillicores ||\n    !Number.isSafeInteger(memoryBytes) ||\n    memoryBytes < 1 ||\n    memoryBytes > contract.resources.memoryBytes\n  ) {\n    invalid(\n      `AgentWorkload resources exceed the host contract for runtimeClass '${contract.runtimeClass}'`,\n    );\n  }\n  return { cpuMillicores, memoryBytes };\n}\n","import {\n  createModelClassManifest,\n  createModelEndpointManifest,\n  MODEL_CLASS_API_VERSION,\n  MODEL_CLASS_KIND,\n  type ModelClassManifest,\n  type ModelEndpointManifest,\n} from '../resources.js';\nimport type { ModelProviderDriver, ModelProviderHealth } from './modelProviderDriver.js';\n\n/**\n * Local model endpoint registration (plan 24.36).\n *\n * A worker advertises the models its ModelProviderDriver can serve as\n * ModelClass + ModelEndpoint manifests. Advertisement carries digest, health,\n * capacity, modalities, data policy, and node trust so the scheduler can\n * place model calls without contacting the node. Local model output is data\n * only — it can never authorize tool admission, which is host-bound.\n */\n\nexport interface LocalModelAdvertisementOptions {\n  nodeId: string;\n  trust: 'trusted' | 'restricted' | 'quarantine';\n  /** Prefix for opaque endpoint handles (default `local://<nodeId>`). */\n  endpointPrefix?: string;\n  capacity?: {\n    maxConcurrent?: number;\n    tokensPerMinute?: number;\n  };\n  dataPolicy?: {\n    classification?: string;\n    retention?: string;\n  };\n}\n\nexport interface LocalModelAdvertisement {\n  modelClasses: ModelClassManifest[];\n  endpoints: ModelEndpointManifest[];\n  health: ModelProviderHealth;\n}\n\nfunction sanitizeModelName(name: string): string {\n  return name.toLowerCase().replace(/[^a-z0-9.-]+/g, '-').replace(/^-+|-+$/g, '') || 'model';\n}\n\n/**\n * Build declarative manifests for every model the driver serves. Endpoint\n * handles are opaque (`<prefix>/<provider>/<model>`) and never embed\n * credentials or URLs.\n */\nexport async function describeLocalModelEndpoints(\n  driver: ModelProviderDriver,\n  options: LocalModelAdvertisementOptions,\n): Promise<LocalModelAdvertisement> {\n  const [models, health] = await Promise.all([driver.listModels(), driver.getHealth()]);\n  const prefix = options.endpointPrefix ?? `local://${options.nodeId}`;\n\n  const modelClasses: ModelClassManifest[] = [];\n  const endpoints: ModelEndpointManifest[] = [];\n\n  for (const model of models) {\n    const baseName = sanitizeModelName(`${model.provider}-${model.model}`);\n    modelClasses.push(createModelClassManifest(baseName, model));\n    endpoints.push(createModelEndpointManifest(`${baseName}-${sanitizeModelName(options.nodeId)}`, {\n      modelClassRef: { apiVersion: MODEL_CLASS_API_VERSION, kind: MODEL_CLASS_KIND, name: baseName },\n      ...(model.digest ? { modelDigest: model.digest } : {}),\n      nodeId: options.nodeId,\n      trust: options.trust,\n      endpoint: `${prefix}/${model.provider}/${model.model}`,\n      ...(options.capacity ? { capacity: options.capacity } : {}),\n      ...(options.dataPolicy ? { dataPolicy: options.dataPolicy } : {}),\n    }));\n  }\n\n  return { modelClasses, endpoints, health };\n}\n\nexport type ModelEndpointTrust = 'trusted' | 'restricted' | 'quarantine';\n\nconst TRUST_RANK: Record<ModelEndpointTrust, number> = {\n  quarantine: 0,\n  restricted: 1,\n  trusted: 2,\n};\n\nexport interface ModelSelectionRequirements {\n  /** Required ModelClass name. */\n  modelClassName: string;\n  /** Required model digest; endpoints with a mismatching digest are excluded. */\n  modelDigest?: string;\n  /** Minimum acceptable node trust (default `quarantine` — any node qualifies). */\n  minimumTrust?: ModelEndpointTrust;\n  /** Exclude endpoints whose status reports unhealthy (default true). */\n  requireHealthy?: boolean;\n  /** Required spare concurrency. */\n  minConcurrent?: number;\n}\n\nexport interface SelectableModelEndpoint {\n  manifest: ModelEndpointManifest;\n  status?: {\n    healthy?: boolean;\n  };\n}\n\n/**\n * Pick the best endpoint for a model call: filters by class name, digest,\n * trust, health, and capacity, then prefers the highest-capacity endpoint.\n * Returns null when nothing qualifies — the caller must surface a scheduling\n * failure rather than silently falling back to an unvetted endpoint.\n */\nexport function selectModelEndpoint(\n  endpoints: SelectableModelEndpoint[],\n  requirements: ModelSelectionRequirements,\n): ModelEndpointManifest | null {\n  const minimumTrustRank = TRUST_RANK[requirements.minimumTrust ?? 'quarantine'];\n  const requireHealthy = requirements.requireHealthy ?? true;\n\n  const candidates = endpoints.filter(({ manifest, status }) => {\n    if (manifest.spec.modelClassRef.name !== requirements.modelClassName) return false;\n    if (requirements.modelDigest && manifest.spec.modelDigest !== requirements.modelDigest) return false;\n    const trustRank = TRUST_RANK[manifest.spec.trust ?? 'quarantine'];\n    if (trustRank < minimumTrustRank) return false;\n    if (requireHealthy && status?.healthy === false) return false;\n    if (requirements.minConcurrent !== undefined) {\n      const capacity = manifest.spec.capacity?.maxConcurrent ?? 0;\n      if (capacity < requirements.minConcurrent) return false;\n    }\n    return true;\n  });\n\n  candidates.sort((a, b) => (b.manifest.spec.capacity?.maxConcurrent ?? 0) - (a.manifest.spec.capacity?.maxConcurrent ?? 0));\n\n  return candidates[0]?.manifest ?? null;\n}\n","import type { ArtifactDestinationPolicy } from '../artifacts/artifactTrust.js';\nimport { OrchestrationError } from '../errors.js';\n\nimport {\n  type ArtifactInspector,\n  type ArtifactManagementCapabilities,\n  type ArtifactManagementDriver,\n  type ArtifactManagementStateSnapshot,\n  createFakeArtifactManagementDriver,\n  type FakeArtifactManagementState,\n  snapshotArtifactManagementState,\n} from './artifactManagement.js';\nimport type { DriverRequestEnvelope } from './driverRequest.js';\n\nexport interface ManagedArtifactDriverAdapterOptions {\n  state: FakeArtifactManagementState;\n  inspector: ArtifactInspector;\n  authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;\n  persistState(snapshot: ArtifactManagementStateSnapshot): Promise<void>;\n  name: string;\n  maxArtifactBytes?: number;\n  inspectionIsolation: Exclude<\n    ArtifactManagementCapabilities['inspectionIsolation'],\n    'none'\n  >;\n  persistence: Exclude<ArtifactManagementCapabilities['persistence'], 'process'>;\n  reviewer?: string;\n  threatAssumptions: string[];\n  now?: () => Date;\n  destinationPolicies?: Partial<\n    Record<\n      import('../resources.js').ArtifactDestination,\n      ArtifactDestinationPolicy\n    >\n  >;\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction exactFields(\n  payload: unknown,\n  allowed: readonly string[],\n  location: string,\n): void {\n  if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) {\n    invalid(`managed artifact ${location} must be an object`);\n  }\n  const unknown = Object.keys(payload).filter((field) => !allowed.includes(field));\n  if (unknown.length > 0) {\n    invalid(\n      `managed artifact ${location} contains unsupported fields: ${unknown.join(', ')}`,\n    );\n  }\n}\n\nconst ARTIFACT_DESTINATIONS = new Set([\n  'prompt',\n  'volume',\n  'backup',\n  'knowledge',\n]);\n\nfunction validateReviewPayload(payload: {\n  policyDigest: string;\n  destinations: unknown;\n}): void {\n  if (!/^sha256:[a-f0-9]{64}$/.test(payload.policyDigest)) {\n    invalid('managed artifact policyDigest must be a canonical SHA-256 digest');\n  }\n  if (\n    !Array.isArray(payload.destinations) ||\n    payload.destinations.length < 1 ||\n    payload.destinations.length > ARTIFACT_DESTINATIONS.size ||\n    new Set(payload.destinations).size !== payload.destinations.length ||\n    payload.destinations.some((destination) =>\n      typeof destination !== 'string' ||\n      !ARTIFACT_DESTINATIONS.has(destination)\n    )\n  ) invalid('managed artifact destinations are invalid');\n}\n\n/**\n * Production boundary over the fully tested artifact state engine.\n *\n * Calls are serialized so an asynchronous isolated inspector cannot race\n * mutations. Every accepted request (including one that fails after fencing)\n * is flushed through the host's atomic persistence port before the lock is\n * released.\n */\nexport function createManagedArtifactDriverAdapter(\n  options: ManagedArtifactDriverAdapterOptions,\n): ArtifactManagementDriver {\n  if (\n    !options.name ||\n    !options.threatAssumptions.length\n  ) {\n    invalid(\n      'managed artifact adapter requires durable storage, isolated inspection, and threat assumptions',\n    );\n  }\n  const engine = createFakeArtifactManagementDriver({\n    state: options.state,\n    inspector: options.inspector,\n    reviewer: options.reviewer,\n    now: options.now,\n    maxArtifactBytes: options.maxArtifactBytes,\n    capabilities: {\n      name: options.name,\n      inspectionIsolation: options.inspectionIsolation,\n      persistence: options.persistence,\n      threatAssumptions: options.threatAssumptions,\n    },\n    destinationPolicies: options.destinationPolicies,\n  });\n\n  let tail: Promise<void> = Promise.resolve();\n\n  async function exclusive<T>(action: () => Promise<T>): Promise<T> {\n    let release!: () => void;\n    const previous = tail;\n    tail = new Promise<void>((resolve) => {\n      release = resolve;\n    });\n    await previous;\n    let result: T | undefined;\n    let operationError: unknown;\n    try {\n      result = await action();\n    } catch (error) {\n      operationError = error;\n    }\n    try {\n      await options.persistState(snapshotArtifactManagementState(options.state));\n    } catch (error) {\n      release();\n      throw new OrchestrationError({\n        code: 'UNKNOWN_EFFECT',\n        message: `artifact host state could not be durably committed: ${error instanceof Error ? error.message : String(error)}`,\n        retryable: false,\n      });\n    }\n    release();\n    if (operationError !== undefined) {\n      if (operationError instanceof Error) throw operationError;\n      throw new OrchestrationError({\n        code: 'INTERNAL',\n        message: 'artifact operation failed with a non-error value',\n        retryable: false,\n      });\n    }\n    return result as T;\n  }\n\n  async function authorize<T>(\n    request: DriverRequestEnvelope<T>,\n    fields: readonly string[],\n  ): Promise<void> {\n    exactFields(request.payload, fields, `${request.method} payload`);\n    if (!await options.authorizeRequest(request)) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed artifact capability was rejected',\n        retryable: false,\n      });\n    }\n  }\n\n  return {\n    getCapabilities: () => engine.getCapabilities(),\n    async put(request, content) {\n      await authorize(request, [\n        'expectedContentHash',\n        'mimeType',\n        'trust',\n        'producerRunUid',\n        'parentContentHashes',\n        'maxBytes',\n      ]);\n      if (\n        request.payload.expectedContentHash !== undefined &&\n        !/^sha256:[a-f0-9]{64}$/.test(request.payload.expectedContentHash)\n      ) invalid('managed artifact expectedContentHash is invalid');\n      if (\n        typeof request.payload.mimeType !== 'string' ||\n        request.payload.mimeType.length > 256 ||\n        !/^[a-z0-9!#$&^_.+-]+\\/[a-z0-9!#$&^_.+-]+$/i.test(\n          request.payload.mimeType,\n        )\n      ) invalid('managed artifact mimeType is invalid');\n      if (\n        request.payload.producerRunUid !== undefined &&\n        (\n          typeof request.payload.producerRunUid !== 'string' ||\n          !request.payload.producerRunUid ||\n          request.payload.producerRunUid.length > 256\n        )\n      ) invalid('managed artifact producerRunUid is invalid');\n      const parents = request.payload.parentContentHashes ?? [];\n      if (\n        !Array.isArray(parents) ||\n        parents.length > 64 ||\n        new Set(parents).size !== parents.length ||\n        parents.some((parent) =>\n          typeof parent !== 'string' ||\n          !/^sha256:[a-f0-9]{64}$/.test(parent)\n        )\n      ) invalid('managed artifact parentContentHashes are invalid');\n      return exclusive(() => engine.put(request, content));\n    },\n    async resolve(request) {\n      await authorize(request, ['contentHash']);\n      return exclusive(() => engine.resolve(request));\n    },\n    async *read(request) {\n      await authorize(request, ['artifactHandle']);\n      const chunks = await exclusive(async () => {\n        const values: Uint8Array[] = [];\n        for await (const chunk of engine.read(request)) values.push(chunk);\n        return values;\n      });\n      for (const chunk of chunks) yield chunk;\n    },\n    async scan(request) {\n      await authorize(request, [\n        'artifactHandle',\n        'policyDigest',\n        'destinations',\n      ]);\n      validateReviewPayload(request.payload);\n      return exclusive(() => engine.scan(request));\n    },\n    async sanitize(request) {\n      await authorize(request, [\n        'artifactHandle',\n        'outputResource',\n        'policyDigest',\n        'destinations',\n      ]);\n      exactFields(\n        request.payload.outputResource,\n        ['uid', 'name', 'generation'],\n        'sanitize outputResource',\n      );\n      validateReviewPayload(request.payload);\n      return exclusive(() => engine.sanitize(request));\n    },\n    async verify(request) {\n      await authorize(request, [\n        'artifactHandle',\n        'policyDigest',\n        'destinations',\n        'properties',\n      ]);\n      validateReviewPayload(request.payload);\n      if (\n        !Array.isArray(request.payload.properties) ||\n        request.payload.properties.length < 1 ||\n        request.payload.properties.length > 16 ||\n        new Set(request.payload.properties).size !==\n          request.payload.properties.length ||\n        request.payload.properties.some((property) =>\n          typeof property !== 'string' ||\n          !property ||\n          property.length > 128\n        )\n      ) invalid('managed artifact verification properties are invalid');\n      return exclusive(() => engine.verify(request));\n    },\n    async promote(request) {\n      await authorize(request, ['artifactHandle', 'destination']);\n      return exclusive(() => engine.promote(request));\n    },\n    async quarantine(request) {\n      await authorize(request, ['artifactHandle', 'reason']);\n      if (\n        typeof request.payload.reason !== 'string' ||\n        !request.payload.reason ||\n        request.payload.reason.length > 1024\n      ) invalid('managed artifact quarantine reason is invalid');\n      return exclusive(() => engine.quarantine(request));\n    },\n    async mount(request) {\n      await authorize(request, ['artifactHandle', 'destination']);\n      return exclusive(() => engine.mount(request));\n    },\n    async unmount(request) {\n      await authorize(request, ['mountHandle']);\n      return exclusive(() => engine.unmount(request));\n    },\n    async delete(request) {\n      await authorize(request, ['artifactHandle']);\n      return exclusive(() => engine.delete(request));\n    },\n  };\n}\n","import type { AgentVolumeClaimResource, AgentVolumeResource, StorageClassResource, VolumeAccessMode } from '../resources.js';\n\nexport interface StorageDriverCapabilities {\n  name: string;\n  accessModes: VolumeAccessMode[];\n  snapshots: boolean;\n  encryption: boolean;\n  /** The host stack has a wired replica transport/controller. */\n  replication?: boolean;\n  /** The host stack has a wired durable backup implementation. */\n  backup?: boolean;\n  maxVolumeBytes?: number;\n}\n\n/** Shared claim/class capability gate used at binding and immediately pre-effect. */\nexport function storageDriverSatisfiesClass(\n  capability: StorageDriverCapabilities,\n  claim: AgentVolumeClaimResource,\n  storageClass: StorageClassResource,\n): boolean {\n  const replicaFactor = storageClass.spec.replication?.factor ?? 1;\n  const backupRequested = storageClass.spec.backup?.schedule !== undefined ||\n    storageClass.spec.backup?.retentionCount !== undefined;\n  return capability.name === storageClass.spec.driver &&\n    capability.accessModes.includes(claim.spec.accessMode) &&\n    (!storageClass.spec.allowedAccessModes?.length ||\n      storageClass.spec.allowedAccessModes.includes(claim.spec.accessMode)) &&\n    (!claim.spec.dataSourceRef || capability.snapshots) &&\n    (!storageClass.spec.snapshotSupport || capability.snapshots) &&\n    (!storageClass.spec.encryption?.enabled || capability.encryption) &&\n    Number.isSafeInteger(replicaFactor) &&\n    replicaFactor >= 1 &&\n    (replicaFactor === 1 || capability.replication === true) &&\n    (!backupRequested || capability.backup === true) &&\n    (capability.maxVolumeBytes === undefined ||\n      (claim.spec.sizeBytes ?? 0) <= capability.maxVolumeBytes);\n}\n\nexport interface StorageProvisionRequest {\n  claim: AgentVolumeClaimResource;\n  storageClass: StorageClassResource;\n}\n\nexport interface StorageProvisionResult {\n  /** Opaque and stable for the claim UID. */\n  driverHandle: string;\n  capacityBytes?: number;\n  topology?: { nodeId?: string; zone?: string };\n}\n\nexport interface StoragePublishRequest {\n  volume: AgentVolumeResource;\n  nodeId: string;\n  workloadUid: string;\n  readOnly: boolean;\n}\n\nexport interface StoragePublishResult {\n  /** Opaque and stable for volume/workload/node. */\n  publishHandle: string;\n  /** Host path or runtime-native mount descriptor; never parsed by core. */\n  mountPath: string;\n}\n\n/** CSI-like host port. Provision/publish/delete/unpublish must be idempotent. */\nexport interface StorageDriver {\n  getCapabilities(): Promise<StorageDriverCapabilities>;\n  getHealth(): Promise<{ healthy: boolean; detail?: string; checkedAt: string }>;\n  provision(request: StorageProvisionRequest): Promise<StorageProvisionResult>;\n  delete(volume: AgentVolumeResource): Promise<void>;\n  publish(request: StoragePublishRequest): Promise<StoragePublishResult>;\n  getPublished(publishHandle: string): Promise<StoragePublishResult | undefined>;\n  unpublish(publishHandle: string): Promise<void>;\n}\n","import { OrchestrationError } from '../errors.js';\nimport type { AgentVolumeClaimResource, AgentVolumeResource, StorageClassResource } from '../resources.js';\n\nimport { assertDriverRequestEnvelope, canonicalDriverValue, type DriverRequestEnvelope } from './driverRequest.js';\nimport { type StorageDriver, storageDriverSatisfiesClass } from './storageDriver.js';\nimport type { ManagedVolumePublication, ManagedVolumeStage, StorageManagementDriver, StorageProvisionPayload } from './storageManagement.js';\n\ninterface StoredOperation {\n  fingerprint: string;\n  result?: string;\n}\n\nexport interface ManagedStorageAdapterStateStore {\n  get(key: string): Promise<unknown>;\n  put(key: string, value: unknown): Promise<void>;\n  delete(key: string): Promise<void>;\n}\n\nexport interface ManagedStorageDriverAdapterOptions {\n  authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;\n  resolveProvisionInput(\n    request: DriverRequestEnvelope<StorageProvisionPayload>,\n  ): Promise<{\n    claim: AgentVolumeClaimResource;\n    storageClass: StorageClassResource;\n  }>;\n  resolveVolume(\n    volumeHandle: string,\n    request: DriverRequestEnvelope,\n  ): Promise<AgentVolumeResource | undefined>;\n  stateStore?: ManagedStorageAdapterStateStore;\n  stableStageHandleFor?(\n    request: DriverRequestEnvelope<{ volumeHandle: string; nodeId: string }>,\n  ): string;\n  threatAssumptions: string[];\n  now?: () => Date;\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction unsupported(capability: string): never {\n  throw new OrchestrationError({\n    code: 'UNSUPPORTED',\n    message: `the narrow storage driver does not support ${capability}`,\n    retryable: false,\n  });\n}\n\nfunction fields(\n  value: unknown,\n  allowed: readonly string[],\n  location: string,\n): Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    invalid(`storage ${location} must be an object`);\n  }\n  const record = value as Record<string, unknown>;\n  const unknown = Object.keys(record).filter((key) => !allowed.includes(key));\n  if (unknown.length > 0) {\n    invalid(`storage ${location} contains unsupported fields: ${unknown.join(', ')}`);\n  }\n  return record;\n}\n\nfunction stringField(value: unknown, location: string): string {\n  if (typeof value !== 'string' || value.length === 0 || value.length > 2048) {\n    invalid(`storage ${location} must be a bounded non-empty string`);\n  }\n  return value;\n}\n\n/**\n * Production bridge for the existing CSI-like StorageDriver. Unsupported data\n * management operations fail explicitly instead of fabricating capabilities.\n */\nexport function createManagedStorageDriverAdapter(\n  driver: StorageDriver,\n  options: ManagedStorageDriverAdapterOptions,\n): StorageManagementDriver {\n  if (\n    typeof options.authorizeRequest !== 'function' ||\n    !options.threatAssumptions.length\n  ) invalid('managed storage adapter authority and threat assumptions are required');\n  const now = options.now ?? (() => new Date());\n  const processState = new Map<string, unknown>();\n  let nextStage = 1;\n\n  const getState = async <T>(key: string): Promise<T | undefined> =>\n    (options.stateStore\n      ? await options.stateStore.get(key)\n      : processState.get(key)) as T | undefined;\n  const putState = async (key: string, value: unknown): Promise<void> => {\n    if (options.stateStore) await options.stateStore.put(key, value);\n    else processState.set(key, value);\n  };\n  const deleteState = async (key: string): Promise<void> => {\n    if (options.stateStore) await options.stateStore.delete(key);\n    else processState.delete(key);\n  };\n\n  async function validate<T>(\n    request: DriverRequestEnvelope<T>,\n    method: string,\n  ): Promise<void> {\n    assertDriverRequestEnvelope(request, {\n      now,\n      requireFencing: true,\n      requireCapability: true,\n      expectedMethod: method,\n    });\n    if (!await options.authorizeRequest(request)) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'storage management capability was rejected',\n        retryable: false,\n      });\n    }\n    const fenceKey = `fence:${request.resource.uid}`;\n    const current = await getState<number>(fenceKey) ?? 0;\n    const fence = request.fencingEpoch as number;\n    if (fence < current) {\n      throw new OrchestrationError({\n        code: 'STALE_EPOCH',\n        message: `stale storage fencing epoch ${fence}; current epoch is ${current}`,\n        retryable: false,\n      });\n    }\n    if (fence > current) await putState(fenceKey, fence);\n  }\n\n  function operationKey(request: DriverRequestEnvelope): string {\n    return `operation:${request.resource.uid}:${request.method}:${request.idempotencyKey}`;\n  }\n\n  function fingerprint(request: DriverRequestEnvelope): string {\n    return canonicalDriverValue({\n      resource: request.resource,\n      run: request.run,\n      actor: request.actor,\n      payloadSchemaDigest: request.payloadSchemaDigest,\n      payload: request.payload,\n    });\n  }\n\n  async function previous(\n    request: DriverRequestEnvelope,\n  ): Promise<StoredOperation | undefined> {\n    const operation = await getState<StoredOperation>(operationKey(request));\n    if (operation && operation.fingerprint !== fingerprint(request)) {\n      throw new OrchestrationError({\n        code: 'CONFLICT',\n        message: 'storage idempotency key was reused with different input',\n        retryable: false,\n      });\n    }\n    return operation;\n  }\n\n  async function remember(\n    request: DriverRequestEnvelope,\n    result?: string,\n  ): Promise<void> {\n    await putState(\n      operationKey(request),\n      {\n        fingerprint: fingerprint(request),\n        ...(result ? { result } : {}),\n      } satisfies StoredOperation,\n    );\n  }\n\n  const stageKey = (handle: string) => `stage:${handle}`;\n  const publicationKey = (handle: string) => `publication:${handle}`;\n  const volumeStagesKey = (handle: string) => `volume-stages:${handle}`;\n  const activePublicationKey = (handle: string) => `stage-active-publication:${handle}`;\n\n  return {\n    async getCapabilities() {\n      const capabilities = await driver.getCapabilities();\n      return {\n        name: capabilities.name,\n        controllerService: true,\n        nodeService: true,\n        accessModes: [...capabilities.accessModes],\n        supportsSnapshots: false,\n        supportsExpansion: false,\n        supportsReplication: false,\n        supportsBackup: false,\n        persistence: options.stateStore ? 'host' : 'process',\n        threatAssumptions: [...options.threatAssumptions],\n      };\n    },\n    async provision(request) {\n      await validate(request, 'storage.provision');\n      fields(request.payload, [\n        'capacityBytes',\n        'accessMode',\n        'storageClass',\n        'replicaCount',\n      ], 'provision payload');\n      if (\n        !Number.isSafeInteger(request.payload.capacityBytes) ||\n        request.payload.capacityBytes < 1 ||\n        !Number.isSafeInteger(request.payload.replicaCount) ||\n        request.payload.replicaCount !== 1\n      ) invalid('narrow storage provisioning requires positive capacity and replicaCount 1');\n      stringField(request.payload.storageClass, 'provision storageClass');\n      const prior = await previous(request);\n      const { claim, storageClass } = await options.resolveProvisionInput(request);\n      if (\n        claim.metadata.uid !== request.resource.uid ||\n        claim.spec.accessMode !== request.payload.accessMode ||\n        (claim.spec.sizeBytes ?? 1) !== request.payload.capacityBytes ||\n        storageClass.metadata.name !== request.payload.storageClass ||\n        claim.spec.storageClassRef.apiVersion !== storageClass.apiVersion ||\n        claim.spec.storageClassRef.kind !== storageClass.kind ||\n        claim.spec.storageClassRef.name !== storageClass.metadata.name\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'resolved storage claim/class differs from the managed request',\n          retryable: false,\n        });\n      }\n      const capabilities = await driver.getCapabilities();\n      if (!storageDriverSatisfiesClass(capabilities, claim, storageClass)) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: `storage driver '${capabilities.name}' does not satisfy the resolved claim and StorageClass`,\n          retryable: false,\n        });\n      }\n      if (prior?.result) {\n        const volume = await options.resolveVolume(prior.result, request);\n        if (volume) {\n          if (\n            volume.spec.driverHandle !== prior.result ||\n            volume.spec.claimRef?.uid !== claim.metadata.uid ||\n            volume.spec.storageClassRef.apiVersion !== storageClass.apiVersion ||\n            volume.spec.storageClassRef.kind !== storageClass.kind ||\n            volume.spec.storageClassRef.name !== storageClass.metadata.name ||\n            !volume.spec.accessModes?.includes(request.payload.accessMode) ||\n            (volume.spec.capacityBytes ?? 0) < request.payload.capacityBytes\n          ) {\n            throw new OrchestrationError({\n              code: 'CONFLICT',\n              message: 'adopted storage volume differs from the authorized claim and class',\n              retryable: false,\n            });\n          }\n          return {\n            volumeHandle: prior.result,\n            resourceUid: request.resource.uid,\n            capacityBytes: volume.spec.capacityBytes ?? request.payload.capacityBytes,\n            accessMode: request.payload.accessMode,\n            fencingEpoch: request.fencingEpoch as number,\n            phase: 'Available',\n          };\n        }\n      }\n      const provisioned = await driver.provision({ claim, storageClass });\n      const volumeHandle = stringField(\n        provisioned.driverHandle,\n        'provision result driverHandle',\n      );\n      const capacityBytes = provisioned.capacityBytes ??\n        request.payload.capacityBytes;\n      if (\n        !Number.isSafeInteger(capacityBytes) ||\n        capacityBytes < request.payload.capacityBytes\n      ) {\n        throw new OrchestrationError({\n          code: 'UNKNOWN_EFFECT',\n          message: 'storage driver provisioned a volume with invalid or insufficient capacity',\n          retryable: false,\n        });\n      }\n      await remember(request, volumeHandle);\n      return {\n        volumeHandle,\n        resourceUid: request.resource.uid,\n        capacityBytes,\n        accessMode: request.payload.accessMode,\n        fencingEpoch: request.fencingEpoch as number,\n        phase: 'Available',\n      };\n    },\n    async deleteVolume(request) {\n      await validate(request, 'storage.delete');\n      fields(request.payload, ['volumeHandle'], 'delete payload');\n      const volumeHandle = stringField(request.payload.volumeHandle, 'delete volumeHandle');\n      if (await previous(request)) return;\n      const stages = await getState<string[]>(volumeStagesKey(volumeHandle)) ?? [];\n      if (stages.length > 0) {\n        throw new OrchestrationError({\n          code: 'CONFLICT',\n          message: 'storage volume must be unstaged before deletion',\n          retryable: false,\n        });\n      }\n      const volume = await options.resolveVolume(volumeHandle, request);\n      if (volume) await driver.delete(volume);\n      await remember(request);\n    },\n    async createSnapshot(request) {\n      await validate(request, 'storage.snapshot.create');\n      fields(request.payload, ['volumeHandle'], 'snapshot payload');\n      return unsupported('snapshots');\n    },\n    async restoreSnapshot(request) {\n      await validate(request, 'storage.snapshot.restore');\n      fields(request.payload, ['snapshotHandle', 'capacityBytes'], 'restore payload');\n      return unsupported('snapshot restore');\n    },\n    async expand(request) {\n      await validate(request, 'storage.expand');\n      fields(request.payload, ['volumeHandle', 'capacityBytes'], 'expand payload');\n      return unsupported('volume expansion');\n    },\n    async getReplicaHealth(request) {\n      await validate(request, 'storage.replica.health');\n      fields(request.payload, ['volumeHandle'], 'replica-health payload');\n      return unsupported('replication');\n    },\n    async rebuildReplica(request) {\n      await validate(request, 'storage.replica.rebuild');\n      fields(request.payload, ['volumeHandle', 'replicaCount'], 'replica-rebuild payload');\n      return unsupported('replication');\n    },\n    async createBackup(request) {\n      await validate(request, 'storage.backup.create');\n      fields(request.payload, ['volumeHandle'], 'backup payload');\n      return unsupported('backups');\n    },\n    async stage(request) {\n      await validate(request, 'storage.stage');\n      fields(request.payload, ['volumeHandle', 'nodeId'], 'stage payload');\n      stringField(request.payload.volumeHandle, 'stage volumeHandle');\n      stringField(request.payload.nodeId, 'stage nodeId');\n      const prior = await previous(request);\n      if (prior?.result) {\n        const stage = await getState<ManagedVolumeStage>(stageKey(prior.result));\n        if (stage) return stage;\n      }\n      const volume = await options.resolveVolume(request.payload.volumeHandle, request);\n      if (!volume) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: `storage volume '${request.payload.volumeHandle}' was not found`,\n          retryable: false,\n        });\n      }\n      if (\n        volume.spec.topology?.nodeId &&\n        volume.spec.topology.nodeId !== request.payload.nodeId\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: `storage volume cannot be staged on node '${request.payload.nodeId}'`,\n          retryable: false,\n        });\n      }\n      const stageHandle = options.stableStageHandleFor?.(request) ??\n        `managed-storage-stage:${nextStage++}`;\n      const stage: ManagedVolumeStage = {\n        stageHandle,\n        volumeHandle: request.payload.volumeHandle,\n        resourceUid: request.resource.uid,\n        nodeId: request.payload.nodeId,\n      };\n      const collision = await getState<ManagedVolumeStage>(stageKey(stageHandle));\n      if (\n        collision &&\n        canonicalDriverValue(collision) !== canonicalDriverValue(stage)\n      ) {\n        throw new OrchestrationError({\n          code: 'CONFLICT',\n          message: 'storage stage handle collided across resources or volumes',\n          retryable: false,\n        });\n      }\n      await putState(stageKey(stageHandle), stage);\n      const stages = await getState<string[]>(\n        volumeStagesKey(request.payload.volumeHandle),\n      ) ?? [];\n      if (!stages.includes(stageHandle)) {\n        await putState(\n          volumeStagesKey(request.payload.volumeHandle),\n          [...stages, stageHandle],\n        );\n      }\n      await remember(request, stageHandle);\n      return stage;\n    },\n    async publish(request) {\n      await validate(request, 'storage.publish');\n      fields(request.payload, [\n        'stageHandle',\n        'workloadUid',\n        'readOnly',\n      ], 'publish payload');\n      stringField(request.payload.stageHandle, 'publish stageHandle');\n      stringField(request.payload.workloadUid, 'publish workloadUid');\n      if (typeof request.payload.readOnly !== 'boolean') {\n        invalid('storage publish readOnly must be boolean');\n      }\n      const prior = await previous(request);\n      if (prior?.result) {\n        const publication = await getState<ManagedVolumePublication>(\n          publicationKey(prior.result),\n        );\n        if (publication) return publication;\n      }\n      const stage = await getState<ManagedVolumeStage>(\n        stageKey(request.payload.stageHandle),\n      );\n      if (!stage || stage.resourceUid !== request.resource.uid) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'storage stage handle is unavailable or belongs to another resource',\n          retryable: false,\n        });\n      }\n      const volume = await options.resolveVolume(stage.volumeHandle, request);\n      if (!volume) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: `storage volume '${stage.volumeHandle}' was not found`,\n          retryable: false,\n        });\n      }\n      if (\n        volume.spec.accessModes?.length === 1 &&\n        volume.spec.accessModes[0] === 'ReadOnlyMany' &&\n        !request.payload.readOnly\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'read-only storage volume cannot be published writable',\n          retryable: false,\n        });\n      }\n      const published = await driver.publish({\n        volume,\n        nodeId: stage.nodeId,\n        workloadUid: request.payload.workloadUid,\n        readOnly: request.payload.readOnly,\n      });\n      const publication: ManagedVolumePublication = {\n        publishHandle: published.publishHandle,\n        stageHandle: stage.stageHandle,\n        resourceUid: request.resource.uid,\n        workloadUid: request.payload.workloadUid,\n        readOnly: request.payload.readOnly,\n      };\n      const collision = await getState<ManagedVolumePublication>(\n        publicationKey(publication.publishHandle),\n      );\n      if (\n        collision &&\n        canonicalDriverValue(collision) !== canonicalDriverValue(publication)\n      ) {\n        await driver.unpublish(publication.publishHandle);\n        throw new OrchestrationError({\n          code: 'CONFLICT',\n          message: 'storage publication handle collided across scopes',\n          retryable: false,\n        });\n      }\n      await putState(publicationKey(publication.publishHandle), publication);\n      await putState(\n        activePublicationKey(stage.stageHandle),\n        publication.publishHandle,\n      );\n      await remember(request, publication.publishHandle);\n      return publication;\n    },\n    async unpublish(request) {\n      await validate(request, 'storage.unpublish');\n      fields(request.payload, ['publishHandle'], 'unpublish payload');\n      const handle = stringField(request.payload.publishHandle, 'unpublish publishHandle');\n      if (await previous(request)) return;\n      const publication = await getState<ManagedVolumePublication>(\n        publicationKey(handle),\n      );\n      if (publication && publication.resourceUid !== request.resource.uid) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'storage publication belongs to another resource',\n          retryable: false,\n        });\n      }\n      await driver.unpublish(handle);\n      await deleteState(publicationKey(handle));\n      if (publication) {\n        await deleteState(activePublicationKey(publication.stageHandle));\n      }\n      await remember(request);\n    },\n    async unstage(request) {\n      await validate(request, 'storage.unstage');\n      fields(request.payload, ['stageHandle'], 'unstage payload');\n      const handle = stringField(request.payload.stageHandle, 'unstage stageHandle');\n      if (await previous(request)) return;\n      const stage = await getState<ManagedVolumeStage>(stageKey(handle));\n      if (stage && stage.resourceUid !== request.resource.uid) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'storage stage belongs to another resource',\n          retryable: false,\n        });\n      }\n      if (await getState<string>(activePublicationKey(handle))) {\n        throw new OrchestrationError({\n          code: 'CONFLICT',\n          message: 'storage publication must be removed before unstage',\n          retryable: false,\n        });\n      }\n      await deleteState(stageKey(handle));\n      if (stage) {\n        const stages = await getState<string[]>(\n          volumeStagesKey(stage.volumeHandle),\n        ) ?? [];\n        const remaining = stages.filter((item) => item !== handle);\n        if (remaining.length > 0) {\n          await putState(volumeStagesKey(stage.volumeHandle), remaining);\n        } else {\n          await deleteState(volumeStagesKey(stage.volumeHandle));\n        }\n      }\n      await remember(request);\n    },\n    async getStats(request) {\n      await validate(request, 'storage.stats');\n      fields(request.payload, ['publishHandle'], 'stats payload');\n      return unsupported('volume statistics');\n    },\n  };\n}\n","import { getToolMetadata, getToolParameterSchema, toolSchemaToJsonSchema } from '../../tools/schemaRegistry.js';\nimport type { IToolRegistry } from '../../types.js';\nimport type { ControllerReconcileRequest } from '../controllerRunner.js';\nimport { OrchestrationError } from '../errors.js';\nimport type { ToolOperationApprovalEvidence, ToolOperationEffect, ToolOperationResource, ToolRiskLevel } from '../resources.js';\n\nimport { canonicalDriverValue, type DriverRequestEnvelope } from './driverRequest.js';\nimport type { ToolExecutionDriver } from './toolExecutionDriver.js';\nimport { createFakeToolManagementDriver, createFakeToolManagementState, type ManagedToolDescriptor, type ToolManagementDriver } from './toolManagement.js';\n\nasync function digest(value: unknown): Promise<string> {\n  const bytes = new TextEncoder().encode(canonicalDriverValue(value));\n  const result = await globalThis.crypto.subtle.digest('SHA-256', bytes);\n  return `sha256:${\n    [...new Uint8Array(result)]\n      .map((byte) => byte.toString(16).padStart(2, '0'))\n      .join('')\n  }`;\n}\n\nfunction riskForEffect(effect: ToolOperationEffect): ToolRiskLevel {\n  switch (effect) {\n    case 'read': {\n      return 'medium';\n    }\n    case 'create':\n    case 'update': {\n      return 'high';\n    }\n    case 'delete':\n    case 'execute':\n    case 'unknown': {\n      return 'critical';\n    }\n  }\n}\n\n/** Build content-addressed descriptors from the schemas actually registered by the host. */\nexport async function createManagedToolDescriptors(\n  registry: IToolRegistry,\n  nodeId: string,\n): Promise<ManagedToolDescriptor[]> {\n  const descriptors: ManagedToolDescriptor[] = [];\n  for (const name of [...registry.listTools()].sort()) {\n    const registeredSchema = registry.getToolParameterSchema\n      ? registry.getToolParameterSchema(name)\n      : getToolParameterSchema(name);\n    if (registeredSchema === undefined) {\n      // Legacy host tools without a portable schema are not safe to expose\n      // through the managed catalog. They remain available to their owning\n      // host, but cannot be prepared or executed as managed operations.\n      continue;\n    }\n    const inputSchema = toolSchemaToJsonSchema(registeredSchema);\n    const outputSchema: Record<string, unknown> = {};\n    const schemaDigest = await digest({ inputSchema, outputSchema });\n    const metadata = getToolMetadata(name);\n    const target = `local-tool://${encodeURIComponent(nodeId)}/${encodeURIComponent(name)}`;\n    const effect = registry.getToolEffect?.(name) ?? 'execute';\n    descriptors.push({\n      name,\n      version: `1.0.0-${effect}`,\n      description: metadata?.description ?? `Host-registered tool ${name}`,\n      inputSchema,\n      outputSchema,\n      schemaDigest,\n      effect,\n      risk: riskForEffect(effect),\n      targets: [target],\n      supportsIdempotency: effect === 'read',\n      supportsFencing: true,\n      supportsEvidence: true,\n    });\n  }\n  return descriptors;\n}\n\nexport interface ManagedToolPolicyDecision {\n  handle: string;\n  policyDigest: string;\n  approval?: ToolOperationApprovalEvidence;\n}\n\nexport interface ManagedToolExecutionRouteOptions {\n  descriptors: ManagedToolDescriptor[];\n  resolveOperation(resourceUid: string): Promise<ToolOperationResource | undefined>;\n  authorizeOperation(\n    operation: ToolOperationResource,\n    signal?: AbortSignal,\n  ): Promise<ManagedToolPolicyDecision>;\n  authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;\n  createRequest<T>(input: {\n    method: string;\n    payload: T;\n    operation: ToolOperationResource;\n    actor: ControllerReconcileRequest['actor'];\n    leaseEpoch: string;\n    idempotencyKey: string;\n    payloadFields: string[];\n  }): DriverRequestEnvelope<T>;\n  name: string;\n  maxOutputBytes?: number;\n  maxOutputChunks?: number;\n  now?: () => Date;\n  threatAssumptions: string[];\n}\n\nexport interface ManagedToolExecutionRoute {\n  managementDriver: ToolManagementDriver;\n  executionDriver: ToolExecutionDriver;\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction exactFields(payload: unknown, allowed: readonly string[], location: string): void {\n  if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) {\n    invalid(`managed tool ${location} must be an object`);\n  }\n  const unknown = Object.keys(payload).filter((field) => !allowed.includes(field));\n  if (unknown.length > 0) {\n    invalid(`managed tool ${location} contains unsupported fields: ${unknown.join(', ')}`);\n  }\n}\n\n/**\n * Round-trip the existing ToolExecutionDriver through the complete managed\n * lifecycle while keeping live results and approval evidence host-local.\n */\nexport function createManagedToolExecutionRoute(\n  narrowDriver: ToolExecutionDriver,\n  options: ManagedToolExecutionRouteOptions,\n): ManagedToolExecutionRoute {\n  if (!options.descriptors.length || !options.threatAssumptions.length) {\n    invalid('managed tool route requires a non-empty catalog and threat assumptions');\n  }\n  const pendingDecisions = new Map<string, ManagedToolPolicyDecision>();\n  const approvalEvidence = new Map<string, ToolOperationApprovalEvidence>();\n  const state = createFakeToolManagementState();\n  const engine = createFakeToolManagementDriver({\n    state,\n    now: options.now,\n    tools: options.descriptors,\n    maxOutputBytes: options.maxOutputBytes,\n    maxOutputChunks: options.maxOutputChunks,\n    capabilities: {\n      name: options.name,\n      persistence: 'process',\n      threatAssumptions: options.threatAssumptions,\n    },\n    async verifyPolicyDecision(input) {\n      const operation = await options.resolveOperation(input.resourceUid);\n      const pending = pendingDecisions.get(input.resourceUid);\n      if (\n        !operation ||\n        !pending ||\n        pending.handle !== input.handle ||\n        pending.policyDigest !== input.policyDigest ||\n        operation.spec.toolRef.name !== input.tool.name ||\n        operation.spec.effect !== input.tool.effect ||\n        !input.tool.targets.includes(input.target)\n      ) {\n        return false;\n      }\n      if (pending.approval) {\n        approvalEvidence.set(input.resourceUid, pending.approval);\n      }\n      return true;\n    },\n    async *executor(descriptor, _target, arguments_, signal, resourceUid) {\n      if (!resourceUid) invalid('managed tool executor has no resource identity');\n      const operation = await options.resolveOperation(resourceUid);\n      if (\n        !operation ||\n        operation.spec.toolRef.name !== descriptor.name ||\n        operation.spec.effect !== descriptor.effect ||\n        canonicalDriverValue(operation.spec.arguments ?? {}) !== canonicalDriverValue(arguments_)\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'resolved ToolOperation differs from the managed invocation',\n          retryable: false,\n        });\n      }\n      const approval = approvalEvidence.get(resourceUid);\n      const executed = await narrowDriver.execute(\n        approval\n          ? {\n            ...operation,\n            status: { ...operation.status, approval },\n          }\n          : operation,\n        { signal },\n      );\n      yield JSON.stringify(executed);\n    },\n  });\n\n  async function authorize<T>(\n    request: DriverRequestEnvelope<T>,\n    fields: readonly string[],\n  ): Promise<void> {\n    exactFields(request.payload, fields, `${request.method} payload`);\n    if (!(await options.authorizeRequest(request))) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed tool capability was rejected',\n        retryable: false,\n      });\n    }\n  }\n\n  const managementDriver: ToolManagementDriver = {\n    getCapabilities: () => engine.getCapabilities(),\n    async discover(request) {\n      await authorize(request, ['namePrefix']);\n      return engine.discover(request);\n    },\n    async describe(request) {\n      await authorize(request, ['name', 'version', 'catalogDigest']);\n      return engine.describe(request);\n    },\n    async prepare(request) {\n      await authorize(request, [\n        'name',\n        'version',\n        'schemaDigest',\n        'catalogDigest',\n        'target',\n        'effect',\n        'operationIdempotencyKey',\n      ]);\n      return engine.prepare(request);\n    },\n    async authorize(request) {\n      await authorize(request, [\n        'preparationHandle',\n        'policyDecisionHandle',\n        'policyDigest',\n        'ttlMs',\n      ]);\n      return engine.authorize(request);\n    },\n    async *invoke(request, invokeOptions) {\n      await authorize(request, ['preparationHandle', 'authorizationHandle', 'arguments']);\n      yield* engine.invoke(request, invokeOptions);\n    },\n    async inspect(request) {\n      await authorize(request, ['executionHandle', 'preparationHandle']);\n      return engine.inspect(request);\n    },\n    async reconcileUnknownEffect(request) {\n      await authorize(request, ['executionHandle', 'resultObserved', 'evidenceDigest']);\n      return engine.reconcileUnknownEffect(request);\n    },\n    async collectEvidence(request) {\n      await authorize(request, ['executionHandle']);\n      return engine.collectEvidence(request);\n    },\n    async cleanup(request) {\n      await authorize(request, ['preparationHandle', 'executionHandle']);\n      return engine.cleanup(request);\n    },\n  };\n\n  const executionDriver: ToolExecutionDriver = {\n    async execute(operation, executionOptions = {}) {\n      const actor = executionOptions.actor;\n      const leaseEpoch = executionOptions.leaseEpoch;\n      if (!actor || !leaseEpoch) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'managed tool execution requires controller actor and fencing epoch',\n          retryable: false,\n        });\n      }\n      const request = <T>(method: string, payload: T, suffix: string, payloadFields: string[]) =>\n        options.createRequest({\n          method,\n          payload,\n          operation,\n          actor,\n          leaseEpoch,\n          idempotencyKey: `${operation.metadata.uid}:${suffix}`,\n          payloadFields,\n        });\n      const snapshot = await managementDriver.discover(\n        request('tool.discover', {}, 'discover', ['namePrefix']),\n      );\n      const descriptor = snapshot.tools.find(\n        (candidate) =>\n          candidate.name === operation.spec.toolRef.name &&\n          candidate.effect === operation.spec.effect,\n      );\n      if (!descriptor) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: 'managed tool descriptor was not found',\n          retryable: false,\n        });\n      }\n      if (\n        operation.spec.toolRef.schemaDigest &&\n        operation.spec.toolRef.schemaDigest !== descriptor.schemaDigest\n      ) {\n        throw new OrchestrationError({\n          code: 'CONFLICT',\n          message: 'ToolOperation schema digest differs from the managed catalog',\n          retryable: false,\n        });\n      }\n      const preparation = await managementDriver.prepare(\n        request(\n          'tool.prepare',\n          {\n            name: descriptor.name,\n            version: descriptor.version,\n            schemaDigest: descriptor.schemaDigest,\n            catalogDigest: snapshot.catalogDigest,\n            target: descriptor.targets[0],\n            effect: descriptor.effect,\n            ...(operation.spec.idempotencyKey && descriptor.supportsIdempotency\n              ? { operationIdempotencyKey: operation.spec.idempotencyKey }\n              : {}),\n          },\n          'prepare',\n          [\n            'name',\n            'version',\n            'schemaDigest',\n            'catalogDigest',\n            'target',\n            'effect',\n            'operationIdempotencyKey',\n          ],\n        ),\n      );\n      const policy = await options.authorizeOperation(operation, executionOptions.signal);\n      pendingDecisions.set(operation.metadata.uid, policy);\n      const authorization = await managementDriver\n        .authorize(\n          request(\n            'tool.authorize',\n            {\n              preparationHandle: preparation.preparationHandle,\n              policyDecisionHandle: policy.handle,\n              policyDigest: policy.policyDigest,\n              ttlMs: Math.min(60_000, Math.max(1, operation.spec.timeoutMs ?? 30_000)),\n            },\n            'authorize',\n            ['preparationHandle', 'policyDecisionHandle', 'policyDigest', 'ttlMs'],\n          ),\n        )\n        .finally(() => {\n          pendingDecisions.delete(operation.metadata.uid);\n        });\n      try {\n        const chunks: string[] = [];\n        let executionHandle: string | undefined;\n        for await (\n          const chunk of managementDriver.invoke(\n            request(\n              'tool.invoke',\n              {\n                preparationHandle: preparation.preparationHandle,\n                authorizationHandle: authorization.authorizationHandle,\n                arguments: operation.spec.arguments ?? {},\n              },\n              'invoke',\n              ['preparationHandle', 'authorizationHandle', 'arguments'],\n            ),\n            { signal: executionOptions.signal },\n          )\n        ) {\n          executionHandle = chunk.executionHandle;\n          if (!chunk.final) chunks.push(chunk.data);\n        }\n        if (!executionHandle || chunks.length !== 1) {\n          invalid('managed narrow tool execution returned an invalid result stream');\n        }\n        const executed = JSON.parse(chunks[0]) as ToolOperationResource;\n        const evidence = await managementDriver.collectEvidence(\n          request('tool.collect-evidence', { executionHandle }, 'evidence', ['executionHandle']),\n        );\n        await managementDriver.cleanup(\n          request(\n            'tool.cleanup',\n            {\n              preparationHandle: preparation.preparationHandle,\n              executionHandle,\n            },\n            'cleanup',\n            ['preparationHandle', 'executionHandle'],\n          ),\n        );\n        return {\n          ...executed,\n          status: {\n            ...executed.status,\n            result: {\n              ...executed.status?.result,\n              evidenceRef: evidence.outputDigest,\n            },\n          },\n        };\n      } finally {\n        approvalEvidence.delete(operation.metadata.uid);\n      }\n    },\n  };\n\n  return { managementDriver, executionDriver };\n}\n","import type { OrchestrationResource, OrchestrationResourceStatus } from '../client.js';\nimport type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport type { NodeTrustClass } from '../resources.js';\nimport type { WorkerProtocolMethod, WorkerRunBinding } from './workerProtocol.js';\n\nexport const WORKER_ENROLLMENT_API_VERSION = 'security.memeloop.io/v1alpha1';\nexport const WORKER_ENROLLMENT_KIND = 'WorkerEnrollment';\n\nexport const WORKER_SESSION_API_VERSION = 'security.memeloop.io/v1alpha1';\nexport const WORKER_SESSION_KIND = 'WorkerSession';\n\n/**\n * WorkerEnrollment: one-time bootstrap record for a worker identity.\n * Created by a trusted controller or admin; never by the worker itself.\n */\nexport interface WorkerEnrollmentSpec {\n  /** Node this worker is enrolled on. */\n  nodeRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n    namespace?: string;\n  };\n  /** Trust class assigned at enrollment time; immutable after creation. */\n  trustClass: NodeTrustClass;\n  /** Pinned gateway URL and public-key fingerprint known before bootstrap. */\n  expectedGateway: string;\n  gatewayKeyFingerprint: string;\n  /** Narrow protocol/session scope fixed by the trusted enrolling actor. */\n  audience: string;\n  allowedProtocol: string;\n  run: WorkerRunBinding;\n  policyDigest: string;\n  allowedMethods: WorkerProtocolMethod[];\n  allowedTargets?: string[];\n  /** One-time bootstrap token hash; the raw token is only shown once. */\n  bootstrapTokenHash: string;\n  /** Enrolling actor (controller or admin). */\n  enrolledBy: string;\n  /** Expiry of the enrollment record itself. */\n  expiresAt: string;\n}\n\nexport interface WorkerEnrollmentStatus extends OrchestrationResourceStatus {\n  phase?: 'Pending' | 'Bound' | 'Expired' | 'Revoked';\n  /** Fingerprint of the worker's ephemeral public key, set after binding. */\n  workerKeyFingerprint?: string;\n  boundAt?: string;\n  revokedAt?: string;\n  revokeReason?: string;\n}\n\n/**\n * WorkerSession: ephemeral identity session bound to a worker key.\n * Created after a worker proves possession of the bootstrap token.\n */\nexport interface WorkerSessionSpec {\n  enrollmentRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n    namespace?: string;\n  };\n  /** Fingerprint of the worker's ephemeral public key. */\n  workerKeyFingerprint: string;\n  /** Encoded ephemeral public key used for per-message signature checks. */\n  workerPublicKey: string;\n  audience: string;\n  allowedProtocol: string;\n  run: WorkerRunBinding;\n  policyDigest: string;\n  allowedMethods: WorkerProtocolMethod[];\n  allowedTargets?: string[];\n  /** Session TTL in milliseconds. */\n  ttlMs: number;\n}\n\nexport interface WorkerSessionStatus extends OrchestrationResourceStatus {\n  phase?: 'Active' | 'Expired' | 'Revoked';\n  issuedAt?: string;\n  expiresAt?: string;\n  lastProofAt?: string;\n  revokedAt?: string;\n  revokeReason?: string;\n  /** Durable replay fence for the dedicated worker protocol. */\n  lastSequence?: number;\n  /** Bounded recent nonce window; sequence remains the primary fence. */\n  recentNonces?: string[];\n}\n\nexport type WorkerEnrollmentResource = Omit<OrchestrationResource<WorkerEnrollmentSpec>, 'status'> & {\n  status?: WorkerEnrollmentStatus;\n};\n\nexport type WorkerSessionResource = Omit<OrchestrationResource<WorkerSessionSpec>, 'status'> & {\n  status?: WorkerSessionStatus;\n};\n\nexport interface BindWorkerSessionRequest {\n  /** Raw, single-use bootstrap token. It must never be persisted or logged. */\n  bootstrapToken: string;\n  /** Fingerprint of the ephemeral public key proved by the worker. */\n  workerKeyFingerprint: string;\n  /** Encoded ephemeral public key; public, but never worker-selected authority. */\n  workerPublicKey: string;\n  /** Pinned gateway identity serving this bootstrap request. */\n  gatewayKeyFingerprint: string;\n  /** Gateway-issued one-time challenge and the worker's signature over it. */\n  proof: { challenge: string; signature: string };\n  /** Requested session lifetime. It is capped by the enrollment expiry. */\n  ttlMs: number;\n  /**\n   * Host cryptographic verifier. Core deliberately does not prescribe a\n   * password-hash implementation; the verifier compares the raw token with\n   * the enrollment's persisted hash in constant-time.\n   */\n  verifyBootstrapToken: (token: string, expectedHash: string) => Promise<boolean> | boolean;\n  /** Verify key fingerprint and proof-of-possession, consuming the challenge. */\n  verifyWorkerProof: (request: {\n    enrollmentName: string;\n    workerKeyFingerprint: string;\n    workerPublicKey: string;\n    challenge: string;\n    signature: string;\n  }) => Promise<boolean> | boolean;\n}\n\nexport function createWorkerEnrollmentManifest(\n  name: string,\n  spec: WorkerEnrollmentSpec,\n): { apiVersion: string; kind: string; metadata: { name: string }; spec: WorkerEnrollmentSpec } {\n  return {\n    apiVersion: WORKER_ENROLLMENT_API_VERSION,\n    kind: WORKER_ENROLLMENT_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function createWorkerSessionManifest(\n  name: string,\n  spec: WorkerSessionSpec,\n): { apiVersion: string; kind: string; metadata: { name: string }; spec: WorkerSessionSpec } {\n  return {\n    apiVersion: WORKER_SESSION_API_VERSION,\n    kind: WORKER_SESSION_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isWorkerEnrollment(resource: OrchestrationResource<unknown, unknown>): resource is WorkerEnrollmentResource {\n  return resource.kind === WORKER_ENROLLMENT_KIND;\n}\n\nexport function isWorkerSession(resource: OrchestrationResource<unknown, unknown>): resource is WorkerSessionResource {\n  return resource.kind === WORKER_SESSION_KIND;\n}\n\n/**\n * Enroll a new worker: create a WorkerEnrollment with a one-time bootstrap token.\n * Only callable by trusted controller or admin actors.\n */\nexport async function enrollWorker(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  name: string,\n  spec: WorkerEnrollmentSpec,\n): Promise<WorkerEnrollmentResource> {\n  if (actor.kind !== 'controller' && actor.kind !== 'admin') {\n    throw new Error('Worker enrollment requires controller or admin actor');\n  }\n  const manifest = createWorkerEnrollmentManifest(name, spec);\n  const resource = await store.create(actor, manifest);\n  return resource as WorkerEnrollmentResource;\n}\n\n/**\n * Bind a worker to its enrollment: the worker proves possession of the\n * bootstrap token and receives a WorkerSession with an ephemeral identity.\n */\nexport async function bindWorkerSession(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  enrollmentName: string,\n  request: BindWorkerSessionRequest,\n  now: () => Date = () => new Date(),\n): Promise<WorkerSessionResource> {\n  if (actor.kind !== 'controller' && actor.kind !== 'admin') {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'Worker session binding requires controller or admin actor',\n      retryable: false,\n    });\n  }\n  if (\n    !request.bootstrapToken ||\n    !request.workerKeyFingerprint ||\n    !request.workerPublicKey ||\n    !request.gatewayKeyFingerprint ||\n    !request.proof.challenge ||\n    !request.proof.signature ||\n    !Number.isFinite(request.ttlMs) ||\n    request.ttlMs <= 0\n  ) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: 'Worker session binding requires a bootstrap token, worker key fingerprint, and positive TTL',\n      retryable: false,\n    });\n  }\n\n  const enrollmentResource = await store.get<WorkerEnrollmentSpec>({\n    apiVersion: WORKER_ENROLLMENT_API_VERSION,\n    kind: WORKER_ENROLLMENT_KIND,\n    name: enrollmentName,\n  });\n  const enrollment = enrollmentResource as WorkerEnrollmentResource | null;\n  if (!enrollment) {\n    throw new OrchestrationError({\n      code: 'NOT_FOUND',\n      message: `WorkerEnrollment '${enrollmentName}' not found`,\n      retryable: false,\n    });\n  }\n  const currentTime = now();\n  const enrollmentExpiry = new Date(enrollment.spec.expiresAt);\n  if (!Number.isFinite(enrollmentExpiry.getTime()) || enrollmentExpiry <= currentTime) {\n    throw new OrchestrationError({\n      code: 'TIMEOUT',\n      message: `WorkerEnrollment '${enrollmentName}' has expired`,\n      retryable: false,\n    });\n  }\n  if (enrollment.status?.phase === 'Revoked' || enrollment.status?.phase === 'Expired') {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `WorkerEnrollment '${enrollmentName}' is not active`,\n      retryable: false,\n    });\n  }\n  if (enrollment.spec.gatewayKeyFingerprint !== request.gatewayKeyFingerprint) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'Worker enrollment gateway key does not match the serving gateway',\n      retryable: false,\n    });\n  }\n  if (\n    enrollment.status?.phase === 'Bound' &&\n    enrollment.status.workerKeyFingerprint !== request.workerKeyFingerprint\n  ) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `WorkerEnrollment '${enrollmentName}' has already been consumed`,\n      retryable: false,\n    });\n  }\n  if (!await request.verifyBootstrapToken(request.bootstrapToken, enrollment.spec.bootstrapTokenHash)) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'Worker bootstrap token is invalid',\n      retryable: false,\n    });\n  }\n  if (\n    !await request.verifyWorkerProof({\n      enrollmentName,\n      workerKeyFingerprint: request.workerKeyFingerprint,\n      workerPublicKey: request.workerPublicKey,\n      challenge: request.proof.challenge,\n      signature: request.proof.signature,\n    })\n  ) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'Worker bootstrap proof-of-possession is invalid',\n      retryable: false,\n    });\n  }\n\n  if (enrollment.status?.phase !== 'Bound') {\n    const boundStatus: WorkerEnrollmentStatus = {\n      phase: 'Bound',\n      workerKeyFingerprint: request.workerKeyFingerprint,\n      boundAt: currentTime.toISOString(),\n    };\n    await store.updateStatus(\n      actor,\n      {\n        apiVersion: WORKER_ENROLLMENT_API_VERSION,\n        kind: WORKER_ENROLLMENT_KIND,\n        name: enrollmentName,\n      },\n      boundStatus,\n      { resourceVersion: enrollment.metadata.resourceVersion },\n    );\n  }\n\n  // Stable identity makes a controller crash after the enrollment fence\n  // recoverable without creating a second session.\n  const sessionName = `session-${enrollment.metadata.uid}`;\n  const existingSessionResource = await store.get<WorkerSessionSpec>({\n    apiVersion: WORKER_SESSION_API_VERSION,\n    kind: WORKER_SESSION_KIND,\n    name: sessionName,\n  });\n  const existingSession = existingSessionResource as WorkerSessionResource | null;\n  if (existingSession) {\n    if (existingSession.spec.workerKeyFingerprint !== request.workerKeyFingerprint) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: `WorkerEnrollment '${enrollmentName}' session identity does not match`,\n        retryable: false,\n      });\n    }\n    return existingSession;\n  }\n\n  const ttlMs = Math.min(request.ttlMs, enrollmentExpiry.getTime() - currentTime.getTime());\n  const manifest = createWorkerSessionManifest(sessionName, {\n    enrollmentRef: {\n      apiVersion: WORKER_ENROLLMENT_API_VERSION,\n      kind: WORKER_ENROLLMENT_KIND,\n      name: enrollmentName,\n    },\n    workerKeyFingerprint: request.workerKeyFingerprint,\n    workerPublicKey: request.workerPublicKey,\n    audience: enrollment.spec.audience,\n    allowedProtocol: enrollment.spec.allowedProtocol,\n    run: enrollment.spec.run,\n    policyDigest: enrollment.spec.policyDigest,\n    allowedMethods: enrollment.spec.allowedMethods,\n    ...(enrollment.spec.allowedTargets ? { allowedTargets: enrollment.spec.allowedTargets } : {}),\n    ttlMs,\n  });\n  const resource = await store.create(actor, manifest);\n  const session = resource as WorkerSessionResource;\n\n  // Update session status to Active.\n  const issuedAt = currentTime.toISOString();\n  const expiresAt = new Date(currentTime.getTime() + ttlMs).toISOString();\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-arguments -- required for correct status type inference\n  await store.updateStatus<WorkerSessionSpec, WorkerSessionStatus>(\n    actor,\n    { apiVersion: WORKER_SESSION_API_VERSION, kind: WORKER_SESSION_KIND, name: sessionName },\n    {\n      phase: 'Active',\n      issuedAt,\n      expiresAt,\n      lastProofAt: issuedAt,\n    },\n    { resourceVersion: session.metadata.resourceVersion },\n  );\n\n  return {\n    ...session,\n    status: {\n      phase: 'Active',\n      issuedAt,\n      expiresAt,\n      lastProofAt: issuedAt,\n    } as WorkerSessionStatus,\n  };\n}\n\n/**\n * Revoke a worker session, preventing further use of the ephemeral identity.\n */\nexport async function revokeWorkerSession(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  sessionName: string,\n  reason: string,\n  now: () => Date = () => new Date(),\n): Promise<void> {\n  const session = await store.get<WorkerSessionSpec>({\n    apiVersion: WORKER_SESSION_API_VERSION,\n    kind: WORKER_SESSION_KIND,\n    name: sessionName,\n  });\n  if (!session) {\n    throw new Error(`WorkerSession ${sessionName} not found`);\n  }\n  await store.updateStatus(\n    actor,\n    { apiVersion: WORKER_SESSION_API_VERSION, kind: WORKER_SESSION_KIND, name: sessionName },\n    {\n      phase: 'Revoked',\n      revokedAt: now().toISOString(),\n      revokeReason: reason,\n    },\n    { resourceVersion: session.metadata.resourceVersion },\n  );\n}\n\n/**\n * Check whether a worker session is currently valid (active and not expired).\n */\nexport function isWorkerSessionValid(session: WorkerSessionResource, now: Date = new Date()): boolean {\n  const status = session.status;\n  if (status?.phase !== 'Active') return false;\n  const expiresAt = status.expiresAt;\n  if (!expiresAt) return false;\n  return new Date(expiresAt) > now;\n}\n","import type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport {\n  bindWorkerSession as bindNarrowWorkerSession,\n  type BindWorkerSessionRequest,\n  revokeWorkerSession,\n  WORKER_ENROLLMENT_API_VERSION,\n  WORKER_ENROLLMENT_KIND,\n  WORKER_SESSION_API_VERSION,\n  WORKER_SESSION_KIND,\n  type WorkerEnrollmentResource,\n  type WorkerSessionResource,\n  type WorkerSessionSpec,\n} from '../security/workerIdentity.js';\n\nimport { assertDriverRequestEnvelope, canonicalDriverValue, type DriverRequestEnvelope } from './driverRequest.js';\nimport type {\n  AttestedIdentity,\n  IdentityAttestationManagementDriver,\n  IdentityChallenge,\n  IdentityEnrollment,\n  IdentityInspection,\n  IdentitySession,\n} from './identityAttestationManagement.js';\n\nconst WORKER_ATTESTATION_FORMAT = 'worker-ed25519-bootstrap/v1';\n\nexport interface ManagedWorkerIdentityRequestFactoryInput<T> {\n  method: string;\n  payload: T;\n  enrollment: WorkerEnrollmentResource;\n  actor: ControlStoreActor;\n  idempotencyKey: string;\n  payloadFields: string[];\n}\n\nexport interface ManagedWorkerIdentityAdapterOptions {\n  store: ControlStore;\n  actor: ControlStoreActor;\n  authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;\n  createRequest<T>(\n    input: ManagedWorkerIdentityRequestFactoryInput<T>,\n  ): DriverRequestEnvelope<T>;\n  maxChallengeTtlMs?: number;\n  maxSessionTtlMs?: number;\n  now?: () => Date;\n  name: string;\n  threatAssumptions: string[];\n}\n\nexport interface ManagedWorkerIdentityRoute {\n  driver: IdentityAttestationManagementDriver;\n  bindWorkerSession(\n    enrollmentName: string,\n    request: BindWorkerSessionRequest,\n  ): Promise<WorkerSessionResource>;\n}\n\ninterface PendingBinding {\n  enrollment: WorkerEnrollmentResource;\n  request: BindWorkerSessionRequest;\n  channelBinding: string;\n  proofDigest: string;\n  evidenceDigest: string;\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction unsupported(message: string): never {\n  throw new OrchestrationError({\n    code: 'UNSUPPORTED',\n    message,\n    retryable: false,\n  });\n}\n\nasync function digest(value: unknown): Promise<string> {\n  const bytes = new TextEncoder().encode(canonicalDriverValue(value));\n  const result = await globalThis.crypto.subtle.digest('SHA-256', bytes);\n  return `sha256:${\n    [...new Uint8Array(result)]\n      .map((byte) => byte.toString(16).padStart(2, '0'))\n      .join('')\n  }`;\n}\n\nfunction exactFields(\n  payload: unknown,\n  allowed: readonly string[],\n  location: string,\n): void {\n  if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) {\n    invalid(`managed worker identity ${location} must be an object`);\n  }\n  const unknown = Object.keys(payload).filter((field) => !allowed.includes(field));\n  if (unknown.length > 0) {\n    invalid(\n      `managed worker identity ${location} contains unsupported fields: ${unknown.join(', ')}`,\n    );\n  }\n}\n\nfunction requireBoundedString(\n  value: unknown,\n  field: string,\n  maximum = 1024,\n): string {\n  if (\n    typeof value !== 'string' ||\n    !value ||\n    value.length > maximum\n  ) invalid(`managed worker identity ${field} is invalid`);\n  return value;\n}\n\n/**\n * Put the existing one-time WorkerEnrollment/WorkerSession Ed25519 flow behind\n * the general Identity/Attestation contract without claiming hardware\n * attestation or crash-persistent pending proof material.\n */\nexport function createManagedWorkerIdentityAdapter(\n  options: ManagedWorkerIdentityAdapterOptions,\n): ManagedWorkerIdentityRoute {\n  const now = options.now ?? (() => new Date());\n  const maxChallengeTtlMs = options.maxChallengeTtlMs ?? 60_000;\n  const maxSessionTtlMs = options.maxSessionTtlMs ?? 60 * 60_000;\n  if (\n    !options.name ||\n    !options.threatAssumptions.length ||\n    !Number.isSafeInteger(maxChallengeTtlMs) ||\n    maxChallengeTtlMs < 1 ||\n    !Number.isSafeInteger(maxSessionTtlMs) ||\n    maxSessionTtlMs < 1\n  ) invalid('managed worker identity adapter options are invalid');\n\n  const enrollments = new Map<string, IdentityEnrollment>();\n  const challenges = new Map<string, IdentityChallenge>();\n  const identities = new Map<string, AttestedIdentity>();\n  const sessions = new Map<string, IdentitySession>();\n  const pending = new Map<string, PendingBinding>();\n  const active = new Set<string>();\n  const fences = new Map<string, number>();\n  const idempotency = new Map<string, string>();\n\n  async function enrollmentFor(\n    request: DriverRequestEnvelope,\n  ): Promise<WorkerEnrollmentResource> {\n    if (\n      request.resource.apiVersion !== WORKER_ENROLLMENT_API_VERSION ||\n      request.resource.kind !== WORKER_ENROLLMENT_KIND\n    ) invalid('managed worker identity resource kind is invalid');\n    const resource = await options.store.get({\n      apiVersion: WORKER_ENROLLMENT_API_VERSION,\n      kind: WORKER_ENROLLMENT_KIND,\n      name: request.resource.name,\n    }) as WorkerEnrollmentResource | null;\n    if (\n      !resource ||\n      resource.metadata.uid !== request.resource.uid ||\n      resource.metadata.generation !== request.resource.generation\n    ) {\n      throw new OrchestrationError({\n        code: resource ? 'CONFLICT' : 'NOT_FOUND',\n        message: 'managed worker enrollment identity changed or disappeared',\n        retryable: false,\n      });\n    }\n    return resource;\n  }\n\n  async function authorize<T>(\n    request: DriverRequestEnvelope<T>,\n    method: string,\n    fields: string[],\n  ): Promise<WorkerEnrollmentResource> {\n    exactFields(request.payload, fields, `${method} payload`);\n    assertDriverRequestEnvelope(request, {\n      now,\n      requireFencing: true,\n      requireCapability: true,\n      expectedMethod: method,\n    });\n    if (\n      request.actor.id !== options.actor.id ||\n      request.actor.kind !== options.actor.kind\n    ) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed worker identity actor was rejected',\n        retryable: false,\n      });\n    }\n    if (!await options.authorizeRequest(request)) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed worker identity capability was rejected',\n        retryable: false,\n      });\n    }\n    const resource = await enrollmentFor(request);\n    const idempotencyKey = `${request.resource.uid}:${method}:${request.idempotencyKey}`;\n    const fingerprint = canonicalDriverValue({\n      resource: request.resource,\n      fencingEpoch: request.fencingEpoch,\n      actor: request.actor,\n      session: request.session,\n      capabilityHandleRef: request.capabilityHandleRef,\n      payloadSchemaDigest: request.payloadSchemaDigest,\n      payload: request.payload,\n    });\n    const previous = idempotency.get(idempotencyKey);\n    if (previous !== undefined && previous !== fingerprint) {\n      throw new OrchestrationError({\n        code: 'CONFLICT',\n        message: `managed worker identity ${method} idempotency input drifted`,\n        retryable: false,\n      });\n    }\n    idempotency.set(idempotencyKey, fingerprint);\n    const fence = request.fencingEpoch;\n    if (!Number.isSafeInteger(fence) || (fence as number) < 1) {\n      invalid('managed worker identity fencing epoch is invalid');\n    }\n    const current = fences.get(request.resource.uid) ?? 0;\n    if ((fence as number) < current) {\n      throw new OrchestrationError({\n        code: 'STALE_EPOCH',\n        message: 'managed worker identity fencing epoch is stale',\n        retryable: false,\n      });\n    }\n    fences.set(request.resource.uid, fence as number);\n    return resource;\n  }\n\n  function owned<T extends { resourceUid: string }>(\n    values: Map<string, T>,\n    handle: string,\n    resourceUid: string,\n    kind: string,\n  ): T {\n    const value = values.get(handle);\n    if (!value) {\n      throw new OrchestrationError({\n        code: 'NOT_FOUND',\n        message: `managed worker ${kind} handle was not found`,\n        retryable: false,\n      });\n    }\n    if (value.resourceUid !== resourceUid) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: `managed worker ${kind} belongs to another resource`,\n        retryable: false,\n      });\n    }\n    return value;\n  }\n\n  const driver: IdentityAttestationManagementDriver = {\n    async getCapabilities() {\n      return {\n        name: options.name,\n        identityDomains: ['enrollment'],\n        attestationFormats: [WORKER_ATTESTATION_FORMAT],\n        supportsProofOfPossession: true,\n        supportsChannelBinding: true,\n        supportsRotation: false,\n        maxChallengeTtlMs,\n        maxSessionTtlMs,\n        persistence: 'process',\n        threatAssumptions: options.threatAssumptions,\n      };\n    },\n    async enroll(request) {\n      const resource = await authorize(request, 'identity.enroll', [\n        'domain',\n        'subject',\n        'trustClass',\n        'bootstrapKeyFingerprint',\n        'ttlMs',\n      ]);\n      if (\n        request.payload.domain !== 'enrollment' ||\n        request.payload.subject !== resource.metadata.name ||\n        request.payload.trustClass !== resource.spec.trustClass ||\n        request.payload.bootstrapKeyFingerprint !==\n          resource.spec.bootstrapTokenHash\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'managed enrollment payload differs from WorkerEnrollment',\n          retryable: false,\n        });\n      }\n      const remaining = Date.parse(resource.spec.expiresAt) - now().getTime();\n      if (\n        !Number.isSafeInteger(remaining) ||\n        remaining < 1 ||\n        !Number.isSafeInteger(request.payload.ttlMs) ||\n        request.payload.ttlMs < 1 ||\n        request.payload.ttlMs > maxSessionTtlMs\n      ) invalid('managed enrollment is expired or its requested TTL is invalid');\n      const value: IdentityEnrollment = {\n        enrollmentHandle: `worker-enrollment:${resource.metadata.uid}`,\n        resourceUid: resource.metadata.uid,\n        domain: 'enrollment',\n        subject: resource.metadata.name,\n        trustClass: resource.spec.trustClass,\n        bootstrapKeyFingerprint: resource.spec.bootstrapTokenHash,\n        expiresAt: resource.spec.expiresAt,\n        consumed: resource.status?.phase === 'Bound',\n        revoked: resource.status?.phase === 'Revoked' ||\n          resource.status?.phase === 'Expired',\n      };\n      enrollments.set(value.enrollmentHandle, value);\n      return structuredClone(value);\n    },\n    async challenge(request) {\n      const resource = await authorize(request, 'identity.challenge', [\n        'enrollmentHandle',\n        'channelBinding',\n        'ttlMs',\n      ]);\n      const enrollment = owned(\n        enrollments,\n        requireBoundedString(\n          request.payload.enrollmentHandle,\n          'enrollmentHandle',\n        ),\n        resource.metadata.uid,\n        'enrollment',\n      );\n      const binding = pending.get(resource.metadata.uid);\n      if (\n        !binding ||\n        binding.channelBinding !== request.payload.channelBinding ||\n        enrollment.revoked ||\n        Date.parse(enrollment.expiresAt) <= now().getTime()\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'managed worker challenge has no active host binding',\n          retryable: false,\n        });\n      }\n      if (\n        !Number.isSafeInteger(request.payload.ttlMs) ||\n        request.payload.ttlMs < 1 ||\n        request.payload.ttlMs > maxChallengeTtlMs\n      ) invalid('managed worker challenge TTL is invalid');\n      const handle = `worker-challenge:${resource.metadata.uid}:${binding.request.workerKeyFingerprint}`;\n      const challenge: IdentityChallenge = {\n        challengeHandle: handle,\n        enrollmentHandle: enrollment.enrollmentHandle,\n        resourceUid: resource.metadata.uid,\n        nonce: binding.evidenceDigest,\n        channelBinding: binding.channelBinding,\n        expiresAt: new Date(\n          Math.min(\n            now().getTime() + request.payload.ttlMs,\n            Date.parse(resource.spec.expiresAt),\n          ),\n        ).toISOString(),\n        consumed: false,\n      };\n      challenges.set(handle, challenge);\n      return structuredClone(challenge);\n    },\n    async attest(request) {\n      const resource = await authorize(request, 'identity.attest', [\n        'challengeHandle',\n        'publicKeyFingerprint',\n        'channelBinding',\n        'attestation',\n        'proof',\n      ]);\n      exactFields(\n        request.payload.attestation,\n        ['format', 'evidenceDigest'],\n        'attestation',\n      );\n      const challenge = owned(\n        challenges,\n        requireBoundedString(\n          request.payload.challengeHandle,\n          'challengeHandle',\n        ),\n        resource.metadata.uid,\n        'challenge',\n      );\n      const binding = pending.get(resource.metadata.uid);\n      if (\n        !binding ||\n        challenge.consumed ||\n        Date.parse(challenge.expiresAt) <= now().getTime() ||\n        request.payload.publicKeyFingerprint !==\n          binding.request.workerKeyFingerprint ||\n        request.payload.channelBinding !== binding.channelBinding ||\n        request.payload.attestation?.format !== WORKER_ATTESTATION_FORMAT ||\n        request.payload.attestation?.evidenceDigest !== binding.evidenceDigest ||\n        request.payload.proof !== binding.proofDigest\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'managed worker attestation binding is invalid',\n          retryable: false,\n        });\n      }\n      if (\n        !await binding.request.verifyBootstrapToken(\n          binding.request.bootstrapToken,\n          resource.spec.bootstrapTokenHash,\n        ) ||\n        !await binding.request.verifyWorkerProof({\n          enrollmentName: resource.metadata.name,\n          workerKeyFingerprint: binding.request.workerKeyFingerprint,\n          workerPublicKey: binding.request.workerPublicKey,\n          challenge: binding.request.proof.challenge,\n          signature: binding.request.proof.signature,\n        })\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'managed worker proof of possession was rejected',\n          retryable: false,\n        });\n      }\n      challenge.consumed = true;\n      const identity: AttestedIdentity = {\n        identityHandle: `worker-identity:${resource.metadata.uid}:${binding.request.workerKeyFingerprint}`,\n        resourceUid: resource.metadata.uid,\n        domain: 'enrollment',\n        subject: resource.metadata.name,\n        trustClass: resource.spec.trustClass,\n        keyFingerprint: binding.request.workerKeyFingerprint,\n        channelBinding: binding.channelBinding,\n        attestationFormat: WORKER_ATTESTATION_FORMAT,\n        evidenceDigest: binding.evidenceDigest,\n        issuedAt: now().toISOString(),\n        revoked: false,\n      };\n      identities.set(identity.identityHandle, identity);\n      return structuredClone(identity);\n    },\n    async issueSession(request) {\n      const resource = await authorize(request, 'identity.issue-session', [\n        'identityHandle',\n        'domain',\n        'audience',\n        'channelBinding',\n        'ttlMs',\n      ]);\n      const identity = owned(\n        identities,\n        requireBoundedString(request.payload.identityHandle, 'identityHandle'),\n        resource.metadata.uid,\n        'identity',\n      );\n      const binding = pending.get(resource.metadata.uid);\n      if (\n        !binding ||\n        identity.revoked ||\n        request.payload.domain !== 'enrollment' ||\n        request.payload.audience !== resource.spec.audience ||\n        request.payload.channelBinding !== identity.channelBinding ||\n        !Number.isSafeInteger(request.payload.ttlMs) ||\n        request.payload.ttlMs < 1 ||\n        request.payload.ttlMs > maxSessionTtlMs\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'managed worker session scope is invalid',\n          retryable: false,\n        });\n      }\n      const workerSession = await bindNarrowWorkerSession(\n        options.store,\n        options.actor,\n        resource.metadata.name,\n        {\n          ...binding.request,\n          ttlMs: request.payload.ttlMs,\n          // Attest already consumed the host's one-time verifiers. The narrow\n          // store function still rechecks all durable resource/session scope.\n          verifyBootstrapToken: () => true,\n          verifyWorkerProof: () => true,\n        },\n        now,\n      );\n      if (\n        workerSession.status?.phase !== 'Active' ||\n        !workerSession.status.issuedAt ||\n        !workerSession.status.expiresAt\n      ) {\n        throw new OrchestrationError({\n          code: 'UNKNOWN_EFFECT',\n          message: 'managed worker session was not durably activated',\n          retryable: false,\n        });\n      }\n      const session: IdentitySession = {\n        sessionHandle: `worker-session:${workerSession.metadata.name}`,\n        identityHandle: identity.identityHandle,\n        resourceUid: resource.metadata.uid,\n        domain: 'enrollment',\n        audience: workerSession.spec.audience,\n        channelBinding: identity.channelBinding,\n        issuedAt: workerSession.status.issuedAt,\n        expiresAt: workerSession.status.expiresAt,\n        revoked: false,\n      };\n      sessions.set(session.sessionHandle, session);\n      return structuredClone(session);\n    },\n    async rotate(request) {\n      await authorize(request, 'identity.rotate', [\n        'identityHandle',\n        'newKeyFingerprint',\n        'channelBinding',\n        'proof',\n      ]);\n      unsupported(\n        'WorkerSession uses ephemeral Ed25519 keys; in-place identity rotation is unsupported, create a new enrollment',\n      );\n    },\n    async revoke(request) {\n      const resource = await authorize(request, 'identity.revoke', [\n        'identityHandle',\n        'reason',\n      ]);\n      const identity = owned(\n        identities,\n        requireBoundedString(request.payload.identityHandle, 'identityHandle'),\n        resource.metadata.uid,\n        'identity',\n      );\n      const reason = requireBoundedString(request.payload.reason, 'reason');\n      const session = [...sessions.values()].find(\n        (candidate) => candidate.identityHandle === identity.identityHandle,\n      );\n      if (session) {\n        await revokeWorkerSession(\n          options.store,\n          options.actor,\n          session.sessionHandle.slice('worker-session:'.length),\n          reason,\n          now,\n        );\n        session.revoked = true;\n      }\n      identity.revoked = true;\n      identity.revokeReason = reason;\n      return structuredClone(identity);\n    },\n    async inspect(request) {\n      const resource = await authorize(request, 'identity.inspect', ['handle']);\n      const handle = requireBoundedString(request.payload.handle, 'handle');\n      const candidates: Array<IdentityInspection | undefined> = [\n        enrollments.get(handle)\n          ? { kind: 'enrollment', value: enrollments.get(handle)! }\n          : undefined,\n        challenges.get(handle)\n          ? { kind: 'challenge', value: challenges.get(handle)! }\n          : undefined,\n        identities.get(handle)\n          ? { kind: 'identity', value: identities.get(handle)! }\n          : undefined,\n        sessions.get(handle)\n          ? { kind: 'session', value: sessions.get(handle)! }\n          : undefined,\n      ];\n      const found = candidates.find(\n        (candidate) => candidate?.value.resourceUid === resource.metadata.uid,\n      );\n      return found ? structuredClone(found) : undefined;\n    },\n  };\n\n  return {\n    driver,\n    async bindWorkerSession(enrollmentName, request) {\n      const enrollment = await options.store.get({\n        apiVersion: WORKER_ENROLLMENT_API_VERSION,\n        kind: WORKER_ENROLLMENT_KIND,\n        name: enrollmentName,\n      }) as WorkerEnrollmentResource | null;\n      if (!enrollment) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: `WorkerEnrollment '${enrollmentName}' not found`,\n          retryable: false,\n        });\n      }\n      if (\n        !request.bootstrapToken ||\n        request.bootstrapToken.length > 4096 ||\n        !request.workerKeyFingerprint ||\n        request.workerKeyFingerprint.length > 512 ||\n        !request.workerPublicKey ||\n        request.workerPublicKey.length > 16 * 1024 ||\n        !request.gatewayKeyFingerprint ||\n        request.gatewayKeyFingerprint.length > 512 ||\n        !request.proof.challenge ||\n        request.proof.challenge.length > 16 * 1024 ||\n        !request.proof.signature ||\n        request.proof.signature.length > 16 * 1024 ||\n        !Number.isSafeInteger(request.ttlMs) ||\n        request.ttlMs < 1\n      ) invalid('managed worker binding request is invalid or too large');\n      const remainingAtStart = Date.parse(enrollment.spec.expiresAt) -\n        now().getTime();\n      if (!Number.isSafeInteger(remainingAtStart) || remainingAtStart < 1) {\n        throw new OrchestrationError({\n          code: 'TIMEOUT',\n          message: `WorkerEnrollment '${enrollmentName}' has expired`,\n          retryable: false,\n        });\n      }\n      if (active.has(enrollment.metadata.uid)) {\n        throw new OrchestrationError({\n          code: 'CONFLICT',\n          message: `WorkerEnrollment '${enrollmentName}' is already binding`,\n          retryable: true,\n        });\n      }\n      active.add(enrollment.metadata.uid);\n      try {\n        const channelBinding = await digest({\n          gatewayKeyFingerprint: request.gatewayKeyFingerprint,\n          audience: enrollment.spec.audience,\n          workerKeyFingerprint: request.workerKeyFingerprint,\n        });\n        const proofDigest = await digest({\n          signature: request.proof.signature,\n        });\n        const evidenceDigest = await digest({\n          challenge: request.proof.challenge,\n          signature: request.proof.signature,\n          workerPublicKey: request.workerPublicKey,\n          channelBinding,\n        });\n        pending.set(enrollment.metadata.uid, {\n          enrollment,\n          request,\n          channelBinding,\n          proofDigest,\n          evidenceDigest,\n        });\n        const call = <T>(\n          method: string,\n          payload: T,\n          suffix: string,\n          payloadFields: string[],\n        ) =>\n          options.createRequest({\n            method,\n            payload,\n            enrollment,\n            actor: options.actor,\n            idempotencyKey: `${enrollment.metadata.uid}:${suffix}:${request.workerKeyFingerprint}`,\n            payloadFields,\n          });\n        const expiration = Date.parse(enrollment.spec.expiresAt);\n        const remaining = expiration - now().getTime();\n        if (!Number.isSafeInteger(remaining) || remaining < 1) {\n          throw new OrchestrationError({\n            code: 'TIMEOUT',\n            message: `WorkerEnrollment '${enrollmentName}' expired during binding`,\n            retryable: false,\n          });\n        }\n        const managedEnrollment = await driver.enroll(call(\n          'identity.enroll',\n          {\n            domain: 'enrollment' as const,\n            subject: enrollment.metadata.name,\n            trustClass: enrollment.spec.trustClass,\n            bootstrapKeyFingerprint: enrollment.spec.bootstrapTokenHash,\n            // The durable absolute expiresAt remains authoritative. Using the\n            // configured bound keeps retries stable across elapsed time and\n            // across ControlStore/adapter clock implementations.\n            ttlMs: maxSessionTtlMs,\n          },\n          'enroll',\n          [\n            'domain',\n            'subject',\n            'trustClass',\n            'bootstrapKeyFingerprint',\n            'ttlMs',\n          ],\n        ));\n        const challenge = await driver.challenge(call(\n          'identity.challenge',\n          {\n            enrollmentHandle: managedEnrollment.enrollmentHandle,\n            channelBinding,\n            ttlMs: maxChallengeTtlMs,\n          },\n          'challenge',\n          ['enrollmentHandle', 'channelBinding', 'ttlMs'],\n        ));\n        const identity = await driver.attest(call(\n          'identity.attest',\n          {\n            challengeHandle: challenge.challengeHandle,\n            publicKeyFingerprint: request.workerKeyFingerprint,\n            channelBinding,\n            attestation: {\n              format: WORKER_ATTESTATION_FORMAT,\n              evidenceDigest,\n            },\n            proof: proofDigest,\n          },\n          'attest',\n          [\n            'challengeHandle',\n            'publicKeyFingerprint',\n            'channelBinding',\n            'attestation',\n            'proof',\n          ],\n        ));\n        await driver.issueSession(call(\n          'identity.issue-session',\n          {\n            identityHandle: identity.identityHandle,\n            domain: 'enrollment' as const,\n            audience: enrollment.spec.audience,\n            channelBinding,\n            ttlMs: Math.min(request.ttlMs, maxSessionTtlMs),\n          },\n          'issue-session',\n          [\n            'identityHandle',\n            'domain',\n            'audience',\n            'channelBinding',\n            'ttlMs',\n          ],\n        ));\n        const session = await options.store.get<WorkerSessionSpec>({\n          apiVersion: WORKER_SESSION_API_VERSION,\n          kind: WORKER_SESSION_KIND,\n          name: `session-${enrollment.metadata.uid}`,\n        }) as WorkerSessionResource | null;\n        if (!session) {\n          throw new OrchestrationError({\n            code: 'UNKNOWN_EFFECT',\n            message: 'managed worker session was issued but could not be observed',\n            retryable: false,\n          });\n        }\n        return session;\n      } finally {\n        pending.delete(enrollment.metadata.uid);\n        active.delete(enrollment.metadata.uid);\n      }\n    },\n  };\n}\n","import type { OrchestrationResourceReference } from '../client.js';\nimport type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport { MODEL_CLASS_API_VERSION, MODEL_CLASS_KIND, MODEL_ENDPOINT_API_VERSION, MODEL_ENDPOINT_KIND, type ModelEndpointStatus } from '../resources.js';\nimport { describeLocalModelEndpoints, type LocalModelAdvertisementOptions } from './localModelRegistration.js';\nimport type { ModelProviderDriver } from './modelProviderDriver.js';\n\n/**\n * ModelEndpoint registration heartbeat (plan 24.36).\n *\n * A node runs one registrar per ModelProviderDriver. Each heartbeat tick\n * re-describes the driver's models, upserts ModelClass/ModelEndpoint\n * resources into the ControlStore, and refreshes endpoint `status.healthy`\n * and `status.heartbeat` so the scheduler can place model calls on live\n * endpoints. Endpoints the driver stops serving are deleted; when the driver\n * cannot be interrogated or the registrar stops, owned endpoints are marked\n * unhealthy (fail-safe: never advertise a possibly-dead model as healthy).\n *\n * The actor identity is host-bound; scripts and model output cannot choose\n * it. Endpoint specs are immutable here because ControlStore intentionally\n * exposes no spec-update verb — identity changes require delete + recreate.\n */\n\nexport interface ModelEndpointRegistrarOptions {\n  /** Host-bound actor identity used for every ControlStore write. */\n  actor: ControlStoreActor;\n  /** Advertisement identity/policy (nodeId, trust, capacity, data policy). */\n  advertisement: LocalModelAdvertisementOptions;\n  /** Heartbeat interval in milliseconds (default 30_000). */\n  heartbeatIntervalMs?: number;\n  /** CAS attempts per status write before giving up (default 3). */\n  statusWriteAttempts?: number;\n  /** Start the background loop immediately (default true). */\n  autoStart?: boolean;\n  /** Injectable clock for deterministic tests. */\n  now?: () => Date;\n  /** Injectable sleep for deterministic tests. */\n  sleep?: (ms: number) => Promise<void>;\n  /** Observes swallowed tick errors; the loop keeps running regardless. */\n  onError?: (error: unknown) => void;\n}\n\nexport interface ModelEndpointRegistrarHandle {\n  /** Run one registration + heartbeat pass (serialized with the loop). */\n  refresh(): Promise<void>;\n  /** Stop the loop and mark owned endpoints unhealthy (best-effort). */\n  stop(): Promise<void>;\n}\n\nexport function createModelEndpointRegistrar(\n  store: ControlStore,\n  driver: ModelProviderDriver,\n  options: ModelEndpointRegistrarOptions,\n): ModelEndpointRegistrarHandle {\n  const now = options.now ?? (() => new Date());\n  const sleep = options.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n  const intervalMs = options.heartbeatIntervalMs ?? 30_000;\n  const statusWriteAttempts = options.statusWriteAttempts ?? 3;\n  const onError = options.onError ?? ((): void => {});\n\n  const ownedEndpoints = new Map<string, OrchestrationResourceReference>();\n  let stopped = false;\n  let inFlight: Promise<void> = Promise.resolve();\n\n  async function writeEndpointStatus(\n    reference: OrchestrationResourceReference,\n    patch: Pick<ModelEndpointStatus, 'healthy' | 'heartbeat'>,\n  ): Promise<void> {\n    for (let attempt = 0; attempt < statusWriteAttempts; attempt += 1) {\n      const current = await store.get(reference);\n      if (!current) return; // Deleted concurrently; nothing to refresh.\n      try {\n        await store.updateStatus(\n          options.actor,\n          reference,\n          { ...current.status, ...patch },\n          { resourceVersion: current.metadata.resourceVersion },\n        );\n        return;\n      } catch (error) {\n        if (error instanceof OrchestrationError && error.code === 'CONFLICT') continue;\n        throw error;\n      }\n    }\n    throw new OrchestrationError({\n      code: 'CONFLICT',\n      message: `endpoint '${reference.name}' status update exceeded ${statusWriteAttempts} CAS attempts`,\n      retryable: true,\n    });\n  }\n\n  async function markAllOwned(healthy: boolean): Promise<void> {\n    for (const reference of ownedEndpoints.values()) {\n      try {\n        await writeEndpointStatus(reference, { healthy, heartbeat: now().toISOString() });\n      } catch (error) {\n        onError(error);\n      }\n    }\n  }\n\n  async function refreshOnce(): Promise<void> {\n    let advertisement;\n    try {\n      advertisement = await describeLocalModelEndpoints(driver, options.advertisement);\n    } catch (error) {\n      // Fail-safe: a driver we cannot interrogate must not keep advertising\n      // healthy endpoints.\n      onError(error);\n      await markAllOwned(false);\n      return;\n    }\n\n    for (const classManifest of advertisement.modelClasses) {\n      const reference: OrchestrationResourceReference = {\n        apiVersion: MODEL_CLASS_API_VERSION,\n        kind: MODEL_CLASS_KIND,\n        name: classManifest.metadata.name,\n      };\n      try {\n        if (!(await store.get(reference))) {\n          await store.create(options.actor, classManifest);\n        }\n      } catch (error) {\n        onError(error);\n      }\n    }\n\n    const seen = new Set<string>();\n    for (const endpointManifest of advertisement.endpoints) {\n      const name = endpointManifest.metadata.name;\n      if (!name) continue;\n      const reference: OrchestrationResourceReference = {\n        apiVersion: MODEL_ENDPOINT_API_VERSION,\n        kind: MODEL_ENDPOINT_KIND,\n        name,\n      };\n      seen.add(name);\n      try {\n        if (!(await store.get(reference))) {\n          await store.create(options.actor, endpointManifest);\n        }\n        ownedEndpoints.set(name, reference);\n        await writeEndpointStatus(reference, {\n          healthy: advertisement.health.healthy,\n          heartbeat: now().toISOString(),\n        });\n      } catch (error) {\n        onError(error);\n      }\n    }\n\n    // Prune endpoints the driver no longer serves.\n    for (const [name, reference] of [...ownedEndpoints]) {\n      if (seen.has(name)) continue;\n      try {\n        await store.delete(options.actor, reference);\n      } catch (error) {\n        onError(error);\n      }\n      ownedEndpoints.delete(name);\n    }\n  }\n\n  function runRefresh(): Promise<void> {\n    inFlight = inFlight.then(() => refreshOnce()).catch(onError);\n    return inFlight;\n  }\n\n  if (options.autoStart ?? true) {\n    void (async () => {\n      while (!stopped) {\n        await runRefresh();\n        if (stopped) break;\n        await sleep(intervalMs);\n      }\n    })().catch(onError);\n  }\n\n  return {\n    refresh: runRefresh,\n    async stop() {\n      stopped = true;\n      await inFlight.catch(() => undefined);\n      await markAllOwned(false);\n    },\n  };\n}\n","import type { OrchestrationOwnerReference } from '../client.js';\nimport { OrchestrationError } from '../errors.js';\nimport type { OrchestrationErrorData } from '../errors.js';\nimport type { ModelCallRecordSpec, ModelCallRecordStatus } from '../resources.js';\nimport type { ModelClassSpec } from '../resources.js';\nimport type { ModelAccessHandleBroker, ModelAccessHandleClaims } from '../security/modelAccessHandle.js';\nimport type { ModelProviderHealth } from './modelProviderDriver.js';\nimport type { ModelGenerateRequest, ModelStreamChunk } from './modelProviderDriver.js';\n\n/**\n * ModelGateway (plan §12, §21.3): the trusted model path.\n *\n * The gateway holds no provider credential itself — it guards an\n * `ModelGatewayExecutor` (host-provided, e.g. the legacy provider adapter)\n * that performs the actual call with host-held keys. Workers present a\n * short-lived `ModelAccessHandle` (24.34) instead of a provider key; the\n * gateway verifies Run/model/audience/expiry/proof-of-possession and\n * enforces per-Run token, cost, concurrency, and request-rate budgets at\n * the gateway (§12.4 — not only in the worker). Every call produces a\n * `ModelCallRecord` (24.32) via the injected recorder.\n *\n * Secret discipline (§12.4): handle tokens, prompts, and model output are\n * never written to records, logs, or thrown error details.\n */\n\nexport interface ModelGatewayGenerateRequest extends ModelGenerateRequest {\n  /** Opaque ModelAccessHandle token presented by the caller. Never recorded. */\n  accessHandle: string;\n  /** Presented worker key fingerprint for the proof-of-possession check. */\n  workerKey?: string;\n}\n\nexport interface ModelGatewayCallRecord {\n  /** ModelCallRecord correlation id (ModelGenerateRequest.callId). */\n  callId: string;\n  spec: ModelCallRecordSpec;\n  status: ModelCallRecordStatus;\n}\n\n/** Audit port; hosts persist ModelCallRecord resources (e.g. ControlStore). */\nexport interface ModelGatewayRecorder {\n  recordCall(record: ModelGatewayCallRecord): Promise<void> | void;\n}\n\n/** Performs the actual provider call with host-held credentials. */\nexport interface ModelGatewayExecutor {\n  listModels?(): Promise<ModelClassSpec[]>;\n  getHealth?(): Promise<ModelProviderHealth>;\n  generate(request: ModelGenerateRequest): AsyncIterable<ModelStreamChunk>;\n  cancel?(callId: string): Promise<void>;\n}\n\nexport interface ModelGatewayOptions {\n  /** Handle issuer/verifier (24.34). */\n  broker: ModelAccessHandleBroker;\n  /** Host provider executor holding the real credentials. */\n  executor: ModelGatewayExecutor;\n  /** Audit recorder for ModelCallRecords; recording failures never break calls. */\n  recorder?: ModelGatewayRecorder;\n  /** Host-asserted caller identity stamped on records (never self-reported). */\n  caller?: string;\n  /** Required handle audience (defaults to the broker's audience). */\n  audience?: string;\n  /** Cost charged per token (input + output) when the stream reports usage. */\n  costPerToken?: number;\n  /** Currency stamped on recorded usage. */\n  currency?: string;\n  /** Sliding-window request rate limit per handle (requests/second). */\n  maxRequestsPerSecond?: number;\n  /** Sink for non-fatal gateway errors (e.g. recorder failures). */\n  onError?: (error: unknown) => void;\n  now?: () => Date;\n}\n\nexport interface ModelGateway {\n  listModels(): Promise<ModelClassSpec[]>;\n  getHealth(): Promise<ModelProviderHealth>;\n  generate(request: ModelGatewayGenerateRequest): AsyncIterable<ModelStreamChunk>;\n  /** Abort an in-flight call (e.g. Run cancellation). */\n  cancel(callId: string): Promise<void>;\n  /** Revoke a handle immediately (Run completion, cancellation, policy change). */\n  revokeHandle(handleId: string): void;\n  /** Revoke every handle the gateway has verified for the given Run name. */\n  revokeRunHandles(runName: string): void;\n}\n\nexport function createModelGateway(options: ModelGatewayOptions): ModelGateway {\n  const now = options.now ?? (() => new Date());\n  const onError = options.onError ?? (() => {});\n  const costPerToken = options.costPerToken ?? 0;\n\n  /** In-flight calls by callId. */\n  const inFlight = new Map<string, { handleId: string }>();\n  /** handleId → run name, for revokeRunHandles (§12.1 step 6). */\n  const seenHandles = new Map<string, string | undefined>();\n  /** Per-handle request timestamps for the sliding-window rate limit. */\n  const requestLog = new Map<string, number[]>();\n\n  function checkRateLimit(handleId: string): void {\n    const limit = options.maxRequestsPerSecond;\n    if (!limit) return;\n    const at = now().getTime();\n    const windowStart = at - 1000;\n    const log = (requestLog.get(handleId) ?? []).filter((timestamp) => timestamp >= windowStart);\n    if (log.length >= limit) {\n      const retryAfterMs = Math.max(1, log[0] + 1000 - at);\n      throw new OrchestrationError({\n        code: 'EXHAUSTED',\n        message: `model gateway request rate limit exceeded (${limit}/s)`,\n        retryable: true,\n        retryAfterMs,\n      });\n    }\n    log.push(at);\n    requestLog.set(handleId, log);\n  }\n\n  async function verifyRequest(request: ModelGatewayGenerateRequest): Promise<ModelAccessHandleClaims> {\n    const claims = await options.broker.verifyModelAccessHandle(request.accessHandle, {\n      ...(options.audience !== undefined ? { audience: options.audience } : {}),\n      ...(request.workerKey !== undefined ? { workerKey: request.workerKey } : {}),\n    });\n    // PoP: a key-bound handle must be presented with a key; the broker only\n    // compares when both sides exist, so the gateway closes the gap.\n    if (claims.workerKey && !request.workerKey) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'model access handle requires proof-of-possession of the bound worker key',\n        retryable: false,\n      });\n    }\n    if (\n      claims.modelClassRef.apiVersion !== request.modelClassRef.apiVersion ||\n      claims.modelClassRef.kind !== request.modelClassRef.kind ||\n      claims.modelClassRef.name !== request.modelClassRef.name\n    ) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'handle model class identity does not match the gateway request',\n        retryable: false,\n      });\n    }\n    if (claims.modelDigest && request.modelDigest !== claims.modelDigest) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'handle requires its bound model digest on the gateway request',\n        retryable: false,\n      });\n    }\n    checkRateLimit(claims.handleId);\n    const concurrent = [...inFlight.values()].filter((entry) => entry.handleId === claims.handleId).length;\n    const maxConcurrent = claims.budget?.maxConcurrent;\n    if (maxConcurrent !== undefined && concurrent >= maxConcurrent) {\n      throw new OrchestrationError({\n        code: 'EXHAUSTED',\n        message: `model gateway concurrency budget exceeded (${maxConcurrent} in-flight)`,\n        retryable: true,\n        retryAfterMs: 100,\n      });\n    }\n    return claims;\n  }\n\n  function buildRecord(\n    request: ModelGatewayGenerateRequest,\n    claims: ModelAccessHandleClaims,\n    status: ModelCallRecordStatus,\n  ): ModelGatewayCallRecord {\n    const runReference: OrchestrationOwnerReference | undefined = claims.runRef\n      ? {\n        apiVersion: claims.runRef.apiVersion,\n        kind: claims.runRef.kind,\n        name: claims.runRef.name,\n        // ModelAccessHandle claims allow an absent uid; the record schema\n        // requires one, so fall back to the empty marker.\n        uid: claims.runRef.uid ?? '',\n      }\n      : undefined;\n    // §12.4: the record carries identity, policy, usage, and latency — never\n    // the handle token, prompts, or model output.\n    return {\n      callId: request.callId,\n      spec: {\n        modelClassRef: claims.modelClassRef,\n        ...((claims.modelDigest ?? request.modelDigest) !== undefined\n          ? { modelDigest: claims.modelDigest ?? request.modelDigest }\n          : {}),\n        ...(runReference ? { runRef: runReference } : {}),\n        ...(claims.attempt !== undefined ? { runAttempt: claims.attempt } : {}),\n        ...(options.caller !== undefined ? { caller: options.caller } : {}),\n        accessHandleRef: claims.handleId,\n        ...(claims.policyDigest !== undefined ? { policyDigest: claims.policyDigest } : {}),\n        ...(request.inputClassification !== undefined ? { inputClassification: request.inputClassification } : {}),\n      },\n      status,\n    };\n  }\n\n  async function record(record: ModelGatewayCallRecord): Promise<void> {\n    try {\n      await options.recorder?.recordCall(record);\n    } catch (error) {\n      onError(error);\n    }\n  }\n\n  async function* generate(request: ModelGatewayGenerateRequest): AsyncIterable<ModelStreamChunk> {\n    const startedAt = now();\n    const claims = await verifyRequest(request);\n    seenHandles.set(claims.handleId, claims.runRef?.name);\n    inFlight.set(request.callId, { handleId: claims.handleId });\n\n    // Clamp the output cap to the handle's remaining output budget so the\n    // executor never produces beyond the budget by construction.\n    const maxOutputTokens = claims.budget?.maxOutputTokens;\n    const effectiveRequest: ModelGenerateRequest = {\n      ...request,\n      ...(maxOutputTokens !== undefined\n        ? { maxOutputTokens: Math.min(request.maxOutputTokens ?? maxOutputTokens, maxOutputTokens) }\n        : {}),\n    };\n\n    let inputTokens = 0;\n    let outputTokens = 0;\n    let phase: ModelCallRecordStatus['phase'] = 'Completed';\n    let failure: OrchestrationErrorData | undefined;\n\n    try {\n      for await (const chunk of options.executor.generate(effectiveRequest)) {\n        if (chunk.type === 'usage') {\n          // Usage chunks are cumulative; take the max to tolerate duplicates.\n          inputTokens = Math.max(inputTokens, chunk.usage?.inputTokens ?? 0);\n          outputTokens = Math.max(outputTokens, chunk.usage?.outputTokens ?? 0);\n          const cost = (inputTokens + outputTokens) * costPerToken;\n          const overInput = claims.budget?.maxInputTokens !== undefined && inputTokens > claims.budget.maxInputTokens;\n          const overOutput = claims.budget?.maxOutputTokens !== undefined && outputTokens > claims.budget.maxOutputTokens;\n          const overCost = claims.budget?.maxCost !== undefined && cost > claims.budget.maxCost;\n          if (overInput || overOutput || overCost) {\n            phase = 'Failed';\n            failure = {\n              code: 'EXHAUSTED',\n              message: 'model access handle budget exceeded at gateway',\n              retryable: false,\n            };\n            await options.executor.cancel?.(request.callId);\n            yield { type: 'error', error: failure };\n            return;\n          }\n          continue;\n        }\n        if (chunk.type === 'error') {\n          phase = chunk.error?.code === 'CANCELLED' ? 'Cancelled' : 'Failed';\n          failure = chunk.error as OrchestrationErrorData;\n        }\n        yield chunk;\n      }\n      if (phase === 'Completed' && request.signal?.aborted) {\n        phase = 'Cancelled';\n      }\n    } catch (error) {\n      phase = 'Failed';\n      failure = error instanceof OrchestrationError\n        ? { code: error.code, message: error.message, retryable: error.retryable }\n        : { code: 'INTERNAL', message: error instanceof Error ? error.message : String(error), retryable: false };\n      throw error;\n    } finally {\n      inFlight.delete(request.callId);\n      const completedAt = now();\n      await record(buildRecord(request, claims, {\n        phase,\n        usage: {\n          inputTokens,\n          outputTokens,\n          cost: (inputTokens + outputTokens) * costPerToken,\n          ...(options.currency !== undefined ? { currency: options.currency } : {}),\n        },\n        latencyMs: completedAt.getTime() - startedAt.getTime(),\n        startedAt: startedAt.toISOString(),\n        completedAt: completedAt.toISOString(),\n        ...(failure ? { error: failure } : {}),\n      }));\n    }\n  }\n\n  return {\n    async listModels() {\n      if (!options.executor.listModels) return [];\n      return options.executor.listModels();\n    },\n    async getHealth() {\n      if (options.executor.getHealth) return options.executor.getHealth();\n      return { healthy: true, detail: 'model gateway', checkedAt: now().toISOString() };\n    },\n    generate,\n    async cancel(callId: string) {\n      await options.executor.cancel?.(callId);\n    },\n    revokeHandle(handleId: string) {\n      options.broker.revokeModelAccessHandle(handleId);\n      for (const [callId, entry] of inFlight) {\n        if (entry.handleId === handleId) void options.executor.cancel?.(callId);\n      }\n    },\n    revokeRunHandles(runName: string) {\n      for (const [handleId, handleRun] of seenHandles) {\n        if (handleRun === runName) {\n          options.broker.revokeModelAccessHandle(handleId);\n          for (const [callId, entry] of inFlight) {\n            if (entry.handleId === handleId) void options.executor.cancel?.(callId);\n          }\n        }\n      }\n    },\n  };\n}\n\n// ─── Loop-side adapter: ILLMProvider over the gateway ─────────────────\n\nimport type { ILLMProvider } from '../../types.js';\nimport type { ModelAccessHandleBudget } from '../security/modelAccessHandle.js';\nimport type { ModelGenerateMessage } from './modelProviderDriver.js';\n\nexport interface GatewayMediatedLLMProviderOptions {\n  gateway: ModelGateway;\n  broker: ModelAccessHandleBroker;\n  /** ModelClass the loops are bound to; handles are issued for this model. */\n  modelClassRef: ModelAccessHandleClaims['modelClassRef'];\n  modelDigest?: string;\n  /** Admission/policy snapshot digest bound into every issued handle. */\n  policyDigest?: string;\n  /** Worker key fingerprint bound into issued handles (PoP). */\n  workerKey?: string;\n  /** Static Run binding, or derive one per chat request (e.g. workload runs). */\n  runRef?: ModelAccessHandleClaims['runRef'];\n  /** Immutable AgentRun attempt bound into issued handles. */\n  attempt?: number;\n  runRefForRequest?: (request: unknown) => ModelAccessHandleClaims['runRef'] | undefined;\n  /** Budget stamped into every issued handle (enforced at the gateway). */\n  budget?: ModelAccessHandleBudget;\n  /** Per-call handle TTL in milliseconds (broker default applies when unset). */\n  handleTtlMs?: number;\n  /** Display name/model for the ILLMProvider surface. */\n  name?: string;\n  modelId?: string;\n  model?: unknown;\n  /** Customize callId derivation (default: conversationId + sequence). */\n  callIdForRequest?: (request: unknown, sequence: number) => string;\n}\n\n/**\n * Route legacy loop model calls through the ModelGateway (plan §12.1, 24.35):\n * loops keep the `ILLMProvider` surface, but every `chat()` issues a\n * short-lived handle, streams through the gateway's verification, budget\n * enforcement, and audit, and revokes the handle when the call ends (§12.1\n * step 6). No provider key exists on this path by construction.\n */\nexport function createGatewayMediatedLLMProvider(options: GatewayMediatedLLMProviderOptions): ILLMProvider {\n  let sequence = 0;\n  return {\n    name: options.name ?? 'model-gateway',\n    modelId: options.modelId ??\n      (typeof options.model === 'string' ? options.model : options.modelClassRef.name),\n    model: options.model,\n    chat(request: unknown) {\n      const record = (request ?? {}) as { conversationId?: unknown; messages?: unknown; signal?: AbortSignal };\n      sequence += 1;\n      const conversationId = typeof record.conversationId === 'string' ? record.conversationId : 'anonymous';\n      const callId = options.callIdForRequest?.(request, sequence) ?? `chat-${conversationId}-${sequence}`;\n      const messages = (Array.isArray(record.messages) ? record.messages : []) as ModelGenerateMessage[];\n      const runReference = options.runRefForRequest?.(request) ?? options.runRef;\n\n      return (async function*(): AsyncGenerator<string, void, unknown> {\n        const handle = await options.broker.issueModelAccessHandle({\n          modelClassRef: options.modelClassRef,\n          ...(options.modelDigest !== undefined ? { modelDigest: options.modelDigest } : {}),\n          ...(options.policyDigest !== undefined ? { policyDigest: options.policyDigest } : {}),\n          ...(runReference ? { runRef: runReference } : {}),\n          ...(runReference && options.attempt !== undefined\n            ? { attempt: options.attempt }\n            : {}),\n          ...(options.workerKey !== undefined ? { workerKey: options.workerKey } : {}),\n          ...(options.budget !== undefined ? { budget: options.budget } : {}),\n          ...(options.handleTtlMs !== undefined ? { ttlMs: options.handleTtlMs } : {}),\n        });\n        try {\n          for await (\n            const chunk of options.gateway.generate({\n              callId,\n              modelClassRef: options.modelClassRef,\n              ...(options.modelDigest !== undefined ? { modelDigest: options.modelDigest } : {}),\n              messages,\n              accessHandle: handle.token,\n              ...(options.workerKey !== undefined ? { workerKey: options.workerKey } : {}),\n              ...(record.signal !== undefined ? { signal: record.signal } : {}),\n            })\n          ) {\n            if (chunk.type === 'delta' && chunk.delta !== undefined) {\n              yield chunk.delta;\n            } else if (chunk.type === 'error') {\n              throw new OrchestrationError(\n                (chunk.error as OrchestrationErrorData | undefined) ?? {\n                  code: 'INTERNAL',\n                  message: 'model gateway call failed',\n                  retryable: false,\n                },\n              );\n            }\n          }\n        } finally {\n          // §12.1 step 6: the handle dies with the call.\n          options.broker.revokeModelAccessHandle(handle.claims.handleId);\n        }\n      })();\n    },\n  };\n}\n","import type { BuiltinToolContext, BuiltinToolImpl } from '../../tools/builtins/types.js';\nimport type { IToolRegistry } from '../../types.js';\nimport type { ControlStoreActor } from '../controlStore.js';\nimport type { ToolOperationApprovalEvidence, ToolOperationResource, ToolOperationResult, ToolOperationStatus } from '../resources.js';\nimport { evaluateToolAdmission, type ToolAdmissionPolicy } from '../security/admission.js';\n\nexport interface ToolExecutionDriver {\n  execute(\n    operation: ToolOperationResource,\n    options?: {\n      signal?: AbortSignal;\n      /** Required by managed routes; ignored by legacy narrow drivers. */\n      actor?: ControlStoreActor;\n      leaseEpoch?: string;\n    },\n  ): Promise<ToolOperationResource>;\n}\n\nexport type ToolOperationApprovalDecision = ToolOperationApprovalEvidence;\n\nexport interface ToolOperationApprovalRequest {\n  operation: ToolOperationResource;\n  /** Trusted policy explanation; never interpreted as authority by itself. */\n  reason?: string;\n  signal?: AbortSignal;\n}\n\n/** Host-owned approval boundary. Implementations bind authenticated users and durable audit. */\nexport interface ToolOperationApprovalBroker {\n  requestApproval(request: ToolOperationApprovalRequest): Promise<ToolOperationApprovalDecision>;\n}\n\nexport interface InProcessToolExecutionDriverOptions {\n  context: BuiltinToolContext;\n  /**\n   * Host-bound trusted admission policy. Enforced before approval checks and\n   * tool lookup; the model, scripts, and agent configuration cannot override\n   * it. Denied operations fail with `FORBIDDEN` and are still audited.\n   */\n  admission?: ToolAdmissionPolicy;\n  approvalBroker?: ToolOperationApprovalBroker;\n  auditor?: (\n    operation: ToolOperationResource,\n    result: ToolOperationResult,\n  ) => Promise<void> | void;\n  maxOutputLength?: number;\n}\n\nfunction isAsyncIterable(value: unknown): value is AsyncIterable<unknown> {\n  return value != null && typeof value === 'object' && Symbol.asyncIterator in value;\n}\n\nfunction normalizeToolResult(value: unknown, maxOutputLength?: number): { text: string; structured?: unknown } {\n  if (typeof value === 'string') {\n    const text = maxOutputLength && value.length > maxOutputLength ? `${value.slice(0, maxOutputLength)}...` : value;\n    return { text };\n  }\n  if (value && typeof value === 'object') {\n    let text = '';\n    if ('summary' in value && typeof value.summary === 'string') {\n      text = value.summary;\n    } else if ('result' in value && typeof value.result === 'string') {\n      text = value.result;\n    } else {\n      text = JSON.stringify(value);\n    }\n    const truncated = maxOutputLength && text.length > maxOutputLength ? `${text.slice(0, maxOutputLength)}...` : text;\n    return { text: truncated, structured: value };\n  }\n  return { text: String(value) };\n}\n\nexport function createInProcessToolExecutionDriver(\n  registry: IToolRegistry,\n  options: InProcessToolExecutionDriverOptions,\n): ToolExecutionDriver {\n  async function execute(\n    operation: ToolOperationResource,\n    executionOptions: {\n      signal?: AbortSignal;\n      actor?: ControlStoreActor;\n      leaseEpoch?: string;\n    } = {},\n  ): Promise<ToolOperationResource> {\n    const startedAt = new Date().toISOString();\n    const toolId = operation.spec.toolRef.name;\n\n    const pendingStatus: ToolOperationStatus = {\n      ...operation.status,\n      phase: 'Running',\n      startedAt,\n      attempts: (operation.status?.attempts ?? 0) + 1,\n    };\n    const runningOperation: ToolOperationResource = { ...operation, status: pendingStatus };\n    let approval: ToolOperationStatus['approval'];\n\n    function operationWithApproval(): ToolOperationResource {\n      if (!approval) return runningOperation;\n      return {\n        ...runningOperation,\n        status: {\n          ...runningOperation.status,\n          approval,\n        },\n      };\n    }\n\n    if (executionOptions.signal?.aborted) {\n      return failed({\n        error: {\n          code: 'CANCELLED',\n          message: 'ToolOperation cancelled before admission',\n          retryable: false,\n        },\n      });\n    }\n\n    async function audit(\n      auditedOperation: ToolOperationResource,\n      result: ToolOperationResult,\n    ): Promise<void> {\n      try {\n        await options.auditor?.(auditedOperation, result);\n      } catch {\n        // Audit sink failure is reported by the host sink and must not replace\n        // the durable ToolOperation result.\n      }\n    }\n\n    async function failed(\n      result: ToolOperationResult,\n    ): Promise<ToolOperationResource> {\n      const auditedOperation = operationWithApproval();\n      await audit(auditedOperation, result);\n      return {\n        ...auditedOperation,\n        status: {\n          ...auditedOperation.status,\n          phase: 'Failed',\n          result,\n          completedAt: new Date().toISOString(),\n        },\n      };\n    }\n\n    let approvalReason: string | undefined;\n    if (options.admission) {\n      const decision = evaluateToolAdmission(options.admission, operation);\n      if (decision.action === 'deny') {\n        return failed({\n          error: {\n            code: 'FORBIDDEN',\n            message: decision.reason ?? `ToolOperation denied by trusted admission policy (${decision.source})`,\n            retryable: false,\n            details: { admissionSource: decision.source },\n          },\n        });\n      }\n      if (decision.action === 'require-approval') {\n        approvalReason = decision.reason ??\n          `ToolOperation requires approval (${decision.source})`;\n      }\n    }\n\n    if (operation.spec.policy?.requireApproval) {\n      approvalReason ??= 'ToolOperation policy requires approval';\n    }\n\n    if (approvalReason) {\n      if (!options.approvalBroker) {\n        return failed({\n          error: {\n            code: 'FORBIDDEN',\n            message: `${approvalReason}; no trusted approval broker is configured`,\n            retryable: false,\n          },\n        });\n      }\n      try {\n        const decision = await options.approvalBroker.requestApproval({\n          operation: runningOperation,\n          reason: approvalReason,\n          signal: executionOptions.signal,\n        });\n        if (\n          !decision.approvalId ||\n          !decision.actor ||\n          !decision.decidedAt ||\n          (decision.decision !== 'allow' && decision.decision !== 'deny') ||\n          Number.isNaN(Date.parse(decision.decidedAt))\n        ) {\n          return await failed({\n            error: {\n              code: 'FORBIDDEN',\n              message: 'Trusted approval broker returned invalid evidence',\n              retryable: false,\n            },\n          });\n        }\n        approval = decision;\n        if (executionOptions.signal?.aborted) {\n          return await failed({\n            error: {\n              code: 'CANCELLED',\n              message: 'ToolOperation approval was cancelled',\n              retryable: false,\n            },\n          });\n        }\n        if (decision.decision !== 'allow') {\n          return await failed({\n            error: {\n              code: 'FORBIDDEN',\n              message: decision.reason ?? 'ToolOperation approval was denied',\n              retryable: false,\n            },\n          });\n        }\n      } catch {\n        return failed({\n          error: {\n            code: executionOptions.signal?.aborted\n              ? 'CANCELLED'\n              : 'FORBIDDEN',\n            message: executionOptions.signal?.aborted\n              ? 'ToolOperation approval was cancelled'\n              : 'Trusted approval broker failed closed',\n            retryable: false,\n          },\n        });\n      }\n    }\n\n    const tool = registry.getTool(toolId);\n    if (typeof tool !== 'function') {\n      return failed({\n        error: { code: 'UNSUPPORTED', message: `Tool \"${toolId}\" is not available as a function executor`, retryable: false },\n      });\n    }\n\n    try {\n      const impl = tool as BuiltinToolImpl;\n      const executionContext: BuiltinToolContext = executionOptions.signal\n        ? { ...options.context, operationSignal: executionOptions.signal }\n        : options.context;\n      const raw = await impl(operation.spec.arguments ?? {}, executionContext);\n      let value: unknown;\n      if (isAsyncIterable(raw)) {\n        const chunks: unknown[] = [];\n        const iterator = raw[Symbol.asyncIterator]();\n        try {\n          while (true) {\n            if (executionOptions.signal?.aborted) {\n              throw new DOMException('ToolOperation cancelled', 'AbortError');\n            }\n            const item = await iterator.next();\n            if (item.done) break;\n            chunks.push(item.value);\n          }\n        } finally {\n          await iterator.return?.();\n        }\n        value = chunks;\n      } else {\n        value = raw;\n      }\n\n      const { text, structured } = normalizeToolResult(value, options.maxOutputLength);\n      const result: ToolOperationResult = { value: structured ?? text };\n      const auditedOperation = operationWithApproval();\n      await audit(auditedOperation, result);\n      return {\n        ...auditedOperation,\n        status: {\n          ...auditedOperation.status,\n          phase: 'Completed',\n          result,\n          completedAt: new Date().toISOString(),\n        },\n      };\n    } catch (error) {\n      const aborted = executionOptions.signal?.aborted;\n      const message = aborted\n        ? 'ToolOperation cancelled'\n        : error instanceof Error\n        ? error.message\n        : String(error);\n      return failed({\n        error: {\n          code: aborted ? 'CANCELLED' : 'INTERNAL',\n          message,\n          retryable: false,\n        },\n      });\n    }\n  }\n\n  return { execute };\n}\n","import type { OrchestrationResource, OrchestrationResourceReference, OrchestrationResourceStatus } from './client.js';\nimport type { ControlStore, ControlStoreActor } from './controlStore.js';\nimport type { ExternalDriverCapabilities, ExternalOrchestrationDriver, ExternalStatusResult, ExternalWorkerBootstrapSecret } from './drivers/externalDriver.js';\nimport { assertExternalToolOperationContract, assertExternalToolOperationResult, type ExternalToolContract } from './drivers/externalToolContract.js';\nimport { resolveExternalWorkloadResources, resolveExternalWorkloadRuntime } from './drivers/externalWorkloadContract.js';\nimport { OrchestrationError } from './errors.js';\nimport {\n  AGENT_RUN_API_VERSION,\n  AGENT_RUN_KIND,\n  AGENT_WORKLOAD_API_VERSION,\n  AGENT_WORKLOAD_KIND,\n  type AgentRunStatus,\n  type AgentWorkloadResource,\n  type AgentWorkloadStatus,\n  createAgentRunManifest,\n  TOOL_OPERATION_API_VERSION,\n  TOOL_OPERATION_KIND,\n  type ToolOperationResource,\n  type ToolOperationStatus,\n} from './resources.js';\nimport { redactSecrets } from './security/secretRedaction.js';\n\nexport interface RegisteredExternalOrchestrationDriver {\n  name: string;\n  driver: ExternalOrchestrationDriver;\n  capabilities: ExternalDriverCapabilities;\n}\n\nexport interface ExternalOrchestrationControllerOptions {\n  actor: ControlStoreActor;\n  drivers: RegisteredExternalOrchestrationDriver[];\n  pollIntervalMs?: number;\n  statusWriteAttempts?: number;\n  sleep?: (ms: number) => Promise<void>;\n  now?: () => Date;\n  /** Resolve admitted script content without persisting it in ControlStore. */\n  resolveScriptSource?: (scriptReference: string) => Promise<string | undefined>;\n  /** Create a short-lived, single-use bootstrap secret at placement time. */\n  createWorkerBootstrap?: (\n    workload: AgentWorkloadResource,\n    runReference: OrchestrationResourceReference,\n  ) => Promise<ExternalWorkerBootstrapSecret | undefined>;\n  /**\n   * Host-bound policy/approval authority for external tool effects. The\n   * controller fails closed when this hook is absent.\n   */\n  authorizeToolOperation?: (\n    operation: ToolOperationResource,\n    signal?: AbortSignal,\n  ) => Promise<{ approval?: NonNullable<ToolOperationStatus['approval']> }>;\n  /**\n   * Host-bound admission for external workload placement. The returned\n   * durable decision identity is persisted before the native side effect.\n   */\n  authorizeWorkloadPlacement?: (\n    workload: AgentWorkloadResource,\n    driver: RegisteredExternalOrchestrationDriver,\n    signal?: AbortSignal,\n  ) => Promise<{ decisionHandle: string; policyDigest: string }>;\n  onError?: (error: unknown) => void;\n}\n\nexport interface ExternalOrchestrationControllerHandle {\n  stop(): Promise<void>;\n}\n\ntype RoutedResource = AgentWorkloadResource | ToolOperationResource;\n\n/**\n * Reconcile explicitly external AgentWorkloads and ToolOperations through\n * registered optional drivers. Placement identity is persisted before status\n * polling, so controller restart adopts the native resource rather than\n * creating a second effect. Driver implementations must make placement\n * idempotent by MemeLoop resource UID.\n */\nexport function createExternalOrchestrationController(\n  store: ControlStore,\n  options: ExternalOrchestrationControllerOptions,\n): ExternalOrchestrationControllerHandle {\n  const drivers = new Map(options.drivers.map((entry) => [entry.name, entry]));\n  const pollIntervalMs = options.pollIntervalMs ?? 1000;\n  const statusWriteAttempts = options.statusWriteAttempts ?? 3;\n  const sleep = options.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n  const now = options.now ?? (() => new Date());\n  const onError = options.onError ?? ((): void => {});\n  const active = new Set<string>();\n  const activeByDriver = new Map<string, number>();\n  const watchAbort = new AbortController();\n  let stopped = false;\n\n  async function acquireDriverSlot(entry: RegisteredExternalOrchestrationDriver): Promise<boolean> {\n    const limit = entry.capabilities.maxConcurrency;\n    while (!stopped) {\n      const current = activeByDriver.get(entry.name) ?? 0;\n      if (limit === undefined || current < limit) {\n        activeByDriver.set(entry.name, current + 1);\n        return true;\n      }\n      await sleep(pollIntervalMs);\n    }\n    return false;\n  }\n\n  function releaseDriverSlot(name: string): void {\n    const current = activeByDriver.get(name) ?? 0;\n    if (current <= 1) activeByDriver.delete(name);\n    else activeByDriver.set(name, current - 1);\n  }\n\n  function referenceOf(resource: RoutedResource): OrchestrationResourceReference {\n    return {\n      apiVersion: resource.apiVersion,\n      kind: resource.kind,\n      name: resource.metadata.name,\n      namespace: resource.metadata.namespace,\n    };\n  }\n\n  function routeOf(resource: RoutedResource): string | undefined {\n    return resource.kind === AGENT_WORKLOAD_KIND\n      ? (resource as AgentWorkloadResource).spec.placement?.orchestrator\n      : (resource as ToolOperationResource).spec.placement?.orchestrator;\n  }\n\n  function runReferenceOf(workload: AgentWorkloadResource): OrchestrationResourceReference {\n    return {\n      apiVersion: AGENT_RUN_API_VERSION,\n      kind: AGENT_RUN_KIND,\n      name: `${workload.metadata.name}-run`,\n      namespace: workload.metadata.namespace,\n    };\n  }\n\n  async function ensureRun(workload: AgentWorkloadResource): Promise<OrchestrationResourceReference> {\n    const reference = runReferenceOf(workload);\n    if (await store.get(reference)) return reference;\n    const manifest = createAgentRunManifest(reference.name!, {\n      workloadRef: {\n        apiVersion: workload.apiVersion,\n        kind: workload.kind,\n        name: workload.metadata.name,\n        namespace: workload.metadata.namespace,\n        uid: workload.metadata.uid,\n      },\n    });\n    manifest.metadata.namespace = workload.metadata.namespace;\n    try {\n      await store.create(options.actor, manifest);\n    } catch (error) {\n      if (!(error instanceof OrchestrationError) || error.code !== 'CONFLICT') throw error;\n    }\n    return reference;\n  }\n\n  async function updateStatus<TStatus extends OrchestrationResourceStatus>(\n    reference: OrchestrationResourceReference,\n    patch: (current: TStatus | undefined) => TStatus,\n  ): Promise<void> {\n    for (let attempt = 0; attempt < statusWriteAttempts; attempt += 1) {\n      const current = await store.get<Record<string, unknown>, TStatus>(reference);\n      if (!current) return;\n      try {\n        await store.updateStatus(options.actor, reference, patch(current.status), {\n          resourceVersion: current.metadata.resourceVersion,\n        });\n        return;\n      } catch (error) {\n        if (error instanceof OrchestrationError && error.code === 'CONFLICT') continue;\n        throw error;\n      }\n    }\n    throw new OrchestrationError({\n      code: 'CONFLICT',\n      message: `external status update for '${reference.name ?? ''}' exceeded ${statusWriteAttempts} CAS attempts`,\n      retryable: true,\n    });\n  }\n\n  function findDriver(resource: RoutedResource): RegisteredExternalOrchestrationDriver {\n    const selected = routeOf(resource);\n    const entry = selected ? drivers.get(selected) : undefined;\n    if (!entry) {\n      throw new OrchestrationError({\n        code: 'NOT_FOUND',\n        message: `external orchestrator '${selected ?? ''}' is not registered`,\n        retryable: false,\n      });\n    }\n    if (!entry.capabilities.manages.includes(resource.kind as 'AgentWorkload' | 'ToolOperation')) {\n      throw new OrchestrationError({\n        code: 'UNSUPPORTED',\n        message: `external orchestrator '${selected}' does not manage ${resource.kind}`,\n        retryable: false,\n      });\n    }\n    if (!entry.capabilities.supportsAdoption) {\n      throw new OrchestrationError({\n        code: 'UNSUPPORTED',\n        message: `external orchestrator '${selected}' cannot safely adopt placement after controller restart`,\n        retryable: false,\n      });\n    }\n    return entry;\n  }\n\n  async function fail(resource: RoutedResource, error: unknown): Promise<void> {\n    const message = redactSecrets(error instanceof Error ? error.message : String(error));\n    if (resource.kind === AGENT_WORKLOAD_KIND) {\n      await updateStatus<AgentRunStatus>(runReferenceOf(resource as AgentWorkloadResource), () => ({\n        phase: 'Failed',\n        summary: message,\n        exitCode: 1,\n      }));\n      await updateStatus<AgentWorkloadStatus>(referenceOf(resource), (current) => ({\n        ...current,\n        phase: 'Failed',\n        lastRunResult: message,\n      }));\n    } else {\n      await updateStatus<ToolOperationStatus>(referenceOf(resource), (current) => ({\n        ...current,\n        phase: 'Failed',\n        result: {\n          error: {\n            code: error instanceof OrchestrationError ? error.code : 'INTERNAL',\n            message,\n            retryable: error instanceof OrchestrationError ? error.retryable : false,\n          },\n        },\n        completedAt: now().toISOString(),\n      }));\n    }\n  }\n\n  async function reflectWorkloadStatus(\n    resource: AgentWorkloadResource,\n    external: ExternalStatusResult,\n  ): Promise<boolean> {\n    const terminal = external.phase === 'Succeeded' || external.phase === 'Failed' || external.phase === 'Cancelled';\n    const missingResult = external.phase === 'Succeeded' && external.runtimeResult === undefined;\n    const resultPhase = missingResult ? 'Failed' : external.runtimeResult?.phase;\n    const succeeded = external.phase === 'Succeeded' && resultPhase === 'Completed';\n    const cancelled = external.phase === 'Cancelled' || resultPhase === 'Cancelled';\n    const message = redactSecrets(\n      external.runtimeResult?.summary ??\n        external.runtimeResult?.error?.message ??\n        (missingResult ? 'external runtime completed without a valid MEMELOOP_RESULT' : external.message),\n    );\n    const runReference = runReferenceOf(resource);\n    await updateStatus<AgentRunStatus>(runReference, () => ({\n      phase: succeeded\n        ? 'Completed'\n        : cancelled\n        ? 'Cancelled'\n        : terminal\n        ? 'Failed'\n        : 'Running',\n      ...(message !== undefined ? { summary: message } : {}),\n      ...(terminal ? { exitCode: succeeded ? 0 : 1 } : {}),\n    }));\n    await updateStatus<AgentWorkloadStatus>(referenceOf(resource), (current) => ({\n      ...current,\n      phase: succeeded\n        ? 'Completed'\n        : terminal\n        ? 'Failed'\n        : external.phase === 'Pending'\n        ? 'Scheduling'\n        : 'Running',\n      ...(message !== undefined ? { lastRunResult: message } : {}),\n    }));\n    return terminal;\n  }\n\n  async function reflectToolStatus(\n    resource: ToolOperationResource,\n    external: ExternalStatusResult,\n    contract: ExternalToolContract,\n  ): Promise<boolean> {\n    const terminal = external.phase === 'Succeeded' || external.phase === 'Failed' || external.phase === 'Cancelled';\n    const missingResult = external.phase === 'Succeeded' && external.runtimeResult === undefined;\n    const resultPhase = missingResult ? 'Failed' : external.runtimeResult?.phase;\n    const succeeded = external.phase === 'Succeeded' && resultPhase === 'Completed';\n    const cancelled = external.phase === 'Cancelled' || resultPhase === 'Cancelled';\n    const externalResult = succeeded && external.runtimeResult?.result\n      ? redactSecrets(external.runtimeResult.result)\n      : undefined;\n    if (succeeded) {\n      assertExternalToolOperationResult(\n        contract,\n        external.runtimeResult?.result?.value,\n      );\n    }\n    const error = external.runtimeResult?.error ?? (missingResult\n      ? { code: 'INVALID', message: 'external runtime completed without a valid MEMELOOP_RESULT', retryable: false }\n      : external.phase === 'Failed'\n      ? { code: 'INTERNAL', message: external.message ?? 'external tool operation failed', retryable: false }\n      : undefined);\n    await updateStatus<ToolOperationStatus>(referenceOf(resource), (current) => ({\n      ...current,\n      phase: succeeded\n        ? 'Completed'\n        : cancelled\n        ? 'Cancelled'\n        : terminal\n        ? 'Failed'\n        : external.phase === 'Pending'\n        ? 'Pending'\n        : 'Running',\n      ...(externalResult ? { result: externalResult } : error ? { result: { error: redactSecrets(error) } } : {}),\n      ...(terminal ? { completedAt: now().toISOString() } : {}),\n    }));\n    return terminal;\n  }\n\n  async function reconcileWorkload(resource: AgentWorkloadResource): Promise<void> {\n    const entry = findDriver(resource);\n    const runtime = resolveExternalWorkloadRuntime(\n      resource,\n      entry.capabilities.workloadRuntimes,\n    );\n    resolveExternalWorkloadResources(resource, runtime);\n    const reference = referenceOf(resource);\n    const runReference = await ensureRun(resource);\n    const latest = await store.get(reference) as unknown as AgentWorkloadResource | null;\n    let externalId = latest?.status?.externalId ?? resource.status?.externalId;\n    if (!externalId) {\n      if (!options.authorizeWorkloadPlacement) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'external AgentWorkload has no host-bound placement authority',\n          retryable: false,\n        });\n      }\n      const authorization = await options.authorizeWorkloadPlacement(resource, entry);\n      const health = await entry.driver.getHealth();\n      if (!health.healthy) {\n        throw new OrchestrationError({ code: 'UNAVAILABLE', message: `external orchestrator '${entry.name}' is unhealthy`, retryable: true });\n      }\n      await updateStatus<AgentWorkloadStatus>(reference, (current) => ({\n        ...current,\n        phase: 'Scheduling',\n        assignedDriver: entry.name,\n        runs: [runReference],\n        placementDecisionRef: authorization.decisionHandle,\n        placementPolicyDigest: authorization.policyDigest,\n      }));\n      let scriptSource: string | undefined;\n      if (resource.spec.scriptReference) {\n        scriptSource = await options.resolveScriptSource?.(resource.spec.scriptReference);\n        if (scriptSource === undefined) {\n          throw new OrchestrationError({\n            code: 'NOT_FOUND',\n            message: `script artifact '${resource.spec.scriptReference}' is unavailable for external placement`,\n            retryable: false,\n          });\n        }\n      }\n      const workerBootstrap = await options.createWorkerBootstrap?.(resource, runReference);\n      const placed = await entry.driver.placeWorkload(resource, options.actor, {\n        ...(scriptSource !== undefined ? { scriptSource } : {}),\n        ...(workerBootstrap !== undefined ? { workerBootstrap } : {}),\n      });\n      externalId = placed.externalId;\n      await updateStatus<AgentWorkloadStatus>(reference, (current) => ({\n        ...current,\n        phase: 'Running',\n        assignedDriver: entry.name,\n        assignedNode: placed.nodeName,\n        externalId: placed.externalId,\n        runs: [runReference],\n        ...(placed.providerMetadata ? { externalMetadata: placed.providerMetadata } : {}),\n      }));\n      await updateStatus<AgentRunStatus>(runReference, () => ({ phase: 'Running' }));\n    }\n    while (!stopped) {\n      const external = await entry.driver.getWorkloadStatus(externalId);\n      if (await reflectWorkloadStatus(resource, external)) return;\n      await sleep(pollIntervalMs);\n    }\n  }\n\n  async function reconcileToolOperation(resource: ToolOperationResource): Promise<void> {\n    const entry = findDriver(resource);\n    const runtimeImage = resource.metadata.annotations?.['memeloop.io/runtime-image'];\n    const contract = assertExternalToolOperationContract(\n      resource,\n      entry.capabilities.toolContracts,\n      runtimeImage,\n    );\n    const reference = referenceOf(resource);\n    const latest = await store.get(reference) as unknown as ToolOperationResource | null;\n    let externalId = latest?.status?.externalId ?? resource.status?.externalId;\n    if (!externalId) {\n      const health = await entry.driver.getHealth();\n      if (!health.healthy) {\n        throw new OrchestrationError({ code: 'UNAVAILABLE', message: `external orchestrator '${entry.name}' is unhealthy`, retryable: true });\n      }\n      await updateStatus<ToolOperationStatus>(reference, (current) => ({\n        ...current,\n        phase: 'Pending',\n        assignedDriver: entry.name,\n      }));\n      if (!options.authorizeToolOperation) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'external ToolOperation has no host-bound policy authority',\n          retryable: false,\n        });\n      }\n      const authorization = await options.authorizeToolOperation(resource);\n      if (authorization.approval) {\n        await updateStatus<ToolOperationStatus>(reference, (current) => ({\n          ...current,\n          approval: authorization.approval,\n        }));\n      }\n      const placed = await entry.driver.executeToolOperation(resource, options.actor);\n      externalId = placed.externalId;\n      await updateStatus<ToolOperationStatus>(reference, (current) => ({\n        ...current,\n        phase: 'Running',\n        assignedDriver: entry.name,\n        assignedNode: placed.nodeName,\n        externalId: placed.externalId,\n        startedAt: current?.startedAt ?? now().toISOString(),\n        ...(placed.providerMetadata ? { externalMetadata: placed.providerMetadata } : {}),\n      }));\n    }\n    while (!stopped) {\n      const external = await entry.driver.getToolOperationStatus(externalId);\n      if (await reflectToolStatus(resource, external, contract)) return;\n      await sleep(pollIntervalMs);\n    }\n  }\n\n  function maybeStart(resource: OrchestrationResource): void {\n    const routed = resource as RoutedResource;\n    if (!routeOf(routed)) return;\n    const phase = routed.status?.phase;\n    if (phase === 'Completed' || phase === 'Failed' || phase === 'Cancelled') return;\n    if (active.has(routed.metadata.uid)) return;\n    active.add(routed.metadata.uid);\n    void (async () => {\n      let slot: string | undefined;\n      try {\n        const entry = findDriver(routed);\n        if (!await acquireDriverSlot(entry)) return;\n        slot = entry.name;\n      } catch (error) {\n        onError(error);\n        await fail(routed, error).catch(onError);\n        return;\n      }\n      try {\n        while (!stopped) {\n          try {\n            if (routed.kind === AGENT_WORKLOAD_KIND) {\n              await reconcileWorkload(routed as AgentWorkloadResource);\n            } else {\n              await reconcileToolOperation(routed as ToolOperationResource);\n            }\n            return;\n          } catch (error) {\n            onError(error);\n            if (!(error instanceof OrchestrationError) || !error.retryable) {\n              await fail(routed, error).catch(onError);\n              return;\n            }\n            // Retriable backend/transport failures must not turn a declared\n            // workload into a permanent failure. Placement retries are safe\n            // because external drivers adopt by immutable resource UID.\n            await sleep(pollIntervalMs);\n          }\n        }\n      } finally {\n        if (slot) releaseDriverSlot(slot);\n      }\n    })().finally(() => active.delete(routed.metadata.uid));\n  }\n\n  async function cancelDeleted(resource: RoutedResource): Promise<void> {\n    const driverName = resource.status?.assignedDriver ?? routeOf(resource);\n    const externalId = resource.status?.externalId;\n    if (!driverName || !externalId) return;\n    const entry = drivers.get(driverName);\n    if (!entry) return;\n    if (resource.kind === AGENT_WORKLOAD_KIND) {\n      await entry.driver.stopWorkload(externalId, options.actor);\n    } else {\n      await entry.driver.cancelToolOperation(externalId, options.actor);\n    }\n  }\n\n  async function runKind(apiVersion: string, kind: string): Promise<void> {\n    while (!stopped) {\n      try {\n        // Subscribe before listing. ControlStore implementations buffer watch\n        // events, closing the otherwise dangerous list→watch race where a\n        // resource created between those operations would never reconcile.\n        const iterator = store.watch(\n          { apiVersion, kind },\n          { signal: watchAbort.signal },\n        )[Symbol.asyncIterator]();\n        const existing = await store.list({ apiVersion, kind });\n        for (const resource of existing.items) maybeStart(resource);\n        while (!stopped) {\n          const next = await iterator.next();\n          if (next.done) break;\n          const event = next.value;\n          if (stopped) break;\n          if (event.type === 'DELETED') {\n            await cancelDeleted(event.resource as RoutedResource).catch(onError);\n          } else if (event.type === 'ADDED' || event.type === 'MODIFIED') {\n            maybeStart(event.resource);\n          }\n        }\n      } catch (error) {\n        onError(error);\n      }\n      if (!stopped) await sleep(1000);\n    }\n  }\n\n  const watchers = [\n    runKind(AGENT_WORKLOAD_API_VERSION, AGENT_WORKLOAD_KIND),\n    runKind(TOOL_OPERATION_API_VERSION, TOOL_OPERATION_KIND),\n  ];\n  for (const watcher of watchers) void watcher.catch(onError);\n\n  return {\n    async stop() {\n      stopped = true;\n      watchAbort.abort();\n      // Some third-party ControlStore watches cannot interrupt an already\n      // pending `next()`. Give conforming stores time to observe the signal\n      // without letting runtime shutdown hang forever.\n      await Promise.race([\n        Promise.allSettled(watchers),\n        new Promise<void>((resolve) => setTimeout(resolve, 50)),\n      ]);\n    },\n  };\n}\n","import type { LoopProfile } from '../loopAPI/types.js';\nimport type { AgentFrameworkContext, ILLMProvider } from '../types.js';\n\nimport { OrchestrationError } from './errors.js';\nimport type { AgentRunResource, AgentWorkloadResource, ModelEndpointResource, NetworkAttachmentResource } from './resources.js';\nimport { BUILTIN_RUNTIME_CLASSES, type RuntimeClassSpec } from './scripts/scriptRuntime.js';\n\n/**\n * Loop Runtime Driver (plan §10.2, Phase 4.2).\n *\n * The cognition-plane counterpart of the tool execution driver (24.28): a\n * LoopRuntimeDriver starts an AgentLoopRun-equivalent execution for a bound\n * AgentWorkload and reports a terminal outcome. The in-process\n * implementation runs the loop in the current process through the existing\n * profile/script machinery — the same contracts apply as for remote drivers\n * (no authorization bypass; scripts re-pass the host load gate on import).\n */\n\nexport interface LoopRunStartRequest {\n  /** Bound workload being executed. */\n  workload: AgentWorkloadResource;\n  /** AgentRun resource tracking this attempt. */\n  run: AgentRunResource;\n  /** Fenced ModelEndpoint selected independently for this run. */\n  modelEndpoint?: ModelEndpointResource;\n  /** Independently bound and prepared network attachment for this run. */\n  networkAttachment?: NetworkAttachmentResource;\n  /** Ephemeral host-resolved mounts; never persisted in ControlStore. */\n  volumeMounts?: Array<{\n    name: string;\n    mountPath: string;\n    readOnly: boolean;\n  }>;\n  /**\n   * Script source resolved by the host for `spec.scriptReference` workloads.\n   * The driver re-admits it through the host script load gate before import.\n   */\n  scriptSource?: string;\n  /** Message delivered to the loop as its input. */\n  message?: string;\n}\n\nexport interface LoopRunOutcome {\n  phase: 'Completed' | 'Failed' | 'Cancelled';\n  summary?: string;\n  error?: {\n    code: string;\n    message: string;\n    retryable: boolean;\n  };\n}\n\nexport interface LoopRunHandle {\n  /** Terminal outcome of the run. */\n  wait(): Promise<LoopRunOutcome>;\n  /** Request cancellation; the loop observes it through the cancellation set. */\n  cancel(): Promise<void>;\n}\n\nexport interface LoopRuntimeDriver {\n  start(request: LoopRunStartRequest): Promise<LoopRunHandle>;\n}\n\nexport interface InProcessLoopRuntimeDriverOptions {\n  /**\n   * Resolve a provider for an independently placed endpoint. Downstream hosts\n   * use this port for remote ModelGateway transports. Returning undefined\n   * fails closed.\n   */\n  resolveModelProvider?: (\n    endpoint: ModelEndpointResource,\n    request: LoopRunStartRequest,\n  ) => Promise<ILLMProvider | undefined>;\n}\n\nfunction toErrorData(error: unknown): { code: string; message: string; retryable: boolean } {\n  if (error instanceof OrchestrationError) {\n    return { code: error.code, message: error.message, retryable: error.retryable };\n  }\n  return {\n    code: 'INTERNAL',\n    message: error instanceof Error ? error.message : String(error),\n    retryable: false,\n  };\n}\n\n/** Extract text from a loop step; tolerates raw string yields (AgentAgent runScript passes them through unwrapped). */\nfunction extractMessageText(step: unknown): string {\n  if (typeof step === 'string') return step;\n  if (step && typeof step === 'object') {\n    const record = step as { type?: unknown; data?: unknown };\n    if (record.type === 'message' && typeof record.data === 'string') return record.data;\n  }\n  return '';\n}\n\n/**\n * In-process LoopRuntimeDriver: executes profile workloads through the\n * definition store and script workloads through a synthesized AgentAgent\n * profile whose source was resolved (and admitted) upstream.\n */\nexport function createInProcessLoopRuntimeDriver(\n  context: AgentFrameworkContext,\n  options: InProcessLoopRuntimeDriverOptions = {},\n): LoopRuntimeDriver {\n  return {\n    async start(request) {\n      const { workload, run } = request;\n      const conversationId = `looprun:${run.metadata.namespace ?? 'default'}:${run.metadata.name}`;\n      const message = request.message ?? workload.metadata.name;\n      let executionContext = context;\n\n      if (\n        request.networkAttachment ||\n        workload.spec.networkPolicy?.networkClass ||\n        request.volumeMounts?.length ||\n        workload.spec.storagePolicy?.volumes?.length\n      ) {\n        throw new OrchestrationError({\n          code: 'UNSUPPORTED',\n          message: `in-process workload '${workload.metadata.name}' cannot consume isolated network/volume dependencies`,\n          retryable: false,\n        });\n      }\n\n      if (workload.spec.modelPolicy?.modelClass) {\n        const endpoint = request.modelEndpoint;\n        if (\n          !endpoint ||\n          run.status?.assignedModelEndpoint?.uid !== endpoint.metadata.uid ||\n          endpoint.spec.modelClassRef.name !== workload.spec.modelPolicy.modelClass\n        ) {\n          throw new OrchestrationError({\n            code: 'INVALID',\n            message: `run '${run.metadata.name}' has no valid fenced ModelEndpoint binding`,\n            retryable: false,\n          });\n        }\n        if (options.resolveModelProvider) {\n          const provider = await options.resolveModelProvider(endpoint, request);\n          if (!provider) {\n            throw new OrchestrationError({\n              code: 'UNAVAILABLE',\n              message: `ModelEndpoint '${endpoint.metadata.name}' has no reachable provider transport`,\n              retryable: true,\n            });\n          }\n          executionContext = { ...context, llmProvider: provider };\n        } else if (endpoint.spec.nodeId !== workload.status?.assignedNode) {\n          throw new OrchestrationError({\n            code: 'UNSUPPORTED',\n            message: `remote ModelEndpoint '${endpoint.metadata.name}' requires a host ModelGateway transport`,\n            retryable: false,\n          });\n        }\n      }\n\n      // Lazy import: a top-level value import of runtime.js creates a module\n      // initialization cycle (orchestration/index → loopRuntimeDriver →\n      // runtime → builtinLoopsPlugin → agent-agent-loop → orchestration).\n      const { createAgentLoopRunner, createAgentLoopScriptRunner } = await import('../runtime.js');\n\n      let runner: ((input: { conversationId: string; message: string }) => AsyncIterable<unknown>) | null = null;\n\n      if (workload.spec.scriptReference) {\n        if (!request.scriptSource) {\n          throw new OrchestrationError({\n            code: 'INVALID',\n            message: `workload '${workload.metadata.name}' has scriptReference '${workload.spec.scriptReference}' but no script source was resolved`,\n            retryable: false,\n          });\n        }\n        const profile: LoopProfile = {\n          id: `workload:${workload.metadata.name}`,\n          name: workload.metadata.name,\n          description: 'AgentWorkload script execution',\n          loopId: 'agent-agent-loop',\n          scriptReference: { kind: 'source', source: request.scriptSource },\n        };\n        runner = await createAgentLoopScriptRunner(executionContext, profile, conversationId);\n      } else if (workload.spec.profileId) {\n        runner = await createAgentLoopRunner(executionContext, { definitionId: workload.spec.profileId, conversationId });\n      } else {\n        throw new OrchestrationError({\n          code: 'INVALID',\n          message: `workload '${workload.metadata.name}' has neither scriptReference nor profileId`,\n          retryable: false,\n        });\n      }\n\n      if (!runner) {\n        throw new OrchestrationError({\n          code: 'INVALID',\n          message: `no loop runner for workload '${workload.metadata.name}' (profile '${workload.spec.profileId ?? ''}' not found)`,\n          retryable: false,\n        });\n      }\n\n      const waitPromise = (async (): Promise<LoopRunOutcome> => {\n        try {\n          let summary = '';\n          for await (const step of runner({ conversationId, message })) {\n            summary += extractMessageText(step);\n          }\n          if (executionContext.conversationCancellation?.has(conversationId)) {\n            executionContext.conversationCancellation.delete(conversationId);\n            return { phase: 'Cancelled', summary };\n          }\n          return { phase: 'Completed', summary };\n        } catch (error) {\n          return { phase: 'Failed', error: toErrorData(error) };\n        }\n      })();\n\n      return {\n        wait: () => waitPromise,\n        async cancel() {\n          executionContext.conversationCancellation?.add(conversationId);\n        },\n      };\n    },\n  };\n}\n\n// ─── RuntimeClass routing ─────────────────────────────────────────────\n\nexport interface RuntimeClassRoutingDriverOptions {\n  /**\n   * Driver for profile workloads and for script workloads whose RuntimeClass\n   * declares `isolation: 'none'`.\n   */\n  inProcessDriver: LoopRuntimeDriver;\n  /**\n   * Driver for script workloads whose RuntimeClass declares\n   * `isolation: 'process'` (all built-in classes do). When absent, such\n   * workloads fail closed with UNSUPPORTED rather than silently running\n   * in-process (plan 24.18: declared isolation must be real).\n   */\n  processDriver?: LoopRuntimeDriver;\n  /** RuntimeClass specs by name (defaults to the built-in classes). */\n  runtimeClasses?: Record<string, RuntimeClassSpec>;\n}\n\n/**\n * Route a bound workload to the driver that honors its declared RuntimeClass\n * isolation. Unknown or missing classes fail closed — admission (plan 24.18)\n * assigns a RuntimeClass before scheduling, and there is no silent fallback\n * to a weaker isolation level.\n */\nexport function createRuntimeClassRoutingDriver(options: RuntimeClassRoutingDriverOptions): LoopRuntimeDriver {\n  const runtimeClasses = options.runtimeClasses ?? BUILTIN_RUNTIME_CLASSES;\n\n  function resolveDriver(workload: AgentWorkloadResource): LoopRuntimeDriver {\n    if (!workload.spec.scriptReference) {\n      // Profile workloads run host-trusted definitions in-process.\n      return options.inProcessDriver;\n    }\n    const className = workload.spec.runtimeClass;\n    if (!className) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: `script workload '${workload.metadata.name}' has no runtimeClass; admission (plan 24.18) must assign one before scheduling`,\n        retryable: false,\n      });\n    }\n    const spec = runtimeClasses[className];\n    if (!spec) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: `script workload '${workload.metadata.name}' references unknown RuntimeClass '${className}' — fail-closed, no silent fallback (plan 24.18)`,\n        retryable: false,\n      });\n    }\n    if (spec.isolation === 'none') return options.inProcessDriver;\n    if (spec.isolation === 'process') {\n      if (!options.processDriver) {\n        throw new OrchestrationError({\n          code: 'UNSUPPORTED',\n          message: `RuntimeClass '${className}' declares process isolation but no process LoopRuntimeDriver is configured`,\n          retryable: false,\n        });\n      }\n      return options.processDriver;\n    }\n    throw new OrchestrationError({\n      code: 'UNSUPPORTED',\n      message: `RuntimeClass '${className}' declares '${spec.isolation}' isolation; no LoopRuntimeDriver provides it`,\n      retryable: false,\n    });\n  }\n\n  return {\n    async start(request) {\n      return resolveDriver(request.workload).start(request);\n    },\n  };\n}\n","import type { Controller } from './controllerRunner.js';\nimport type { ControlStoreActor } from './controlStore.js';\nimport type { AgentRunResource, AgentRunStatus, AgentWorkloadResource, DataClassification, ModelClassResource, ModelEndpointResource, NodeTrustClass } from './resources.js';\n\nexport interface ModelEndpointBindingControllerOptions {\n  actor: ControlStoreActor;\n  getWorkload(run: AgentRunResource): Promise<AgentWorkloadResource | null>;\n  listEndpoints(): Promise<ModelEndpointResource[]>;\n  getModelClass(endpoint: ModelEndpointResource): Promise<ModelClassResource | null>;\n  /** Existing bindings used as conservative live capacity reservations. */\n  listRuns?: () => Promise<AgentRunResource[]>;\n  /** Maximum endpoint heartbeat age accepted for placement (default 90s). */\n  endpointHeartbeatTtlMs?: number;\n  /** Clock used only for the persisted binding timestamp. */\n  now?: () => Date;\n}\n\nconst TRUST_RANK: Record<NodeTrustClass, number> = {\n  quarantine: 0,\n  restricted: 1,\n  trusted: 2,\n};\n\nconst CLASSIFICATION_RANK: Record<DataClassification, number> = {\n  public: 0,\n  internal: 1,\n  confidential: 2,\n  restricted: 3,\n};\n\nconst DEFAULT_ENDPOINT_CLASSIFICATION: Record<NodeTrustClass, DataClassification> = {\n  quarantine: 'public',\n  restricted: 'internal',\n  trusted: 'restricted',\n};\n\ninterface Candidate {\n  endpoint: ModelEndpointResource;\n  modelClass: ModelClassResource;\n  score: number;\n}\n\nfunction endpointReference(endpoint: ModelEndpointResource): NonNullable<AgentRunStatus['assignedModelEndpoint']> {\n  return {\n    apiVersion: endpoint.apiVersion,\n    kind: endpoint.kind,\n    name: endpoint.metadata.name,\n    ...(endpoint.metadata.namespace !== undefined ? { namespace: endpoint.metadata.namespace } : {}),\n    uid: endpoint.metadata.uid,\n  };\n}\n\nfunction schedulingCondition(message: string, lastTransitionTime: string) {\n  return {\n    type: 'ModelEndpointScheduled',\n    status: 'False' as const,\n    reason: 'NoEligibleEndpoint',\n    message,\n    lastTransitionTime,\n  };\n}\n\nfunction sameCondition(status: AgentRunStatus, message: string): boolean {\n  const condition = status.conditions?.find((item) => item.type === 'ModelEndpointScheduled');\n  return condition?.status === 'False' &&\n    condition.reason === 'NoEligibleEndpoint' &&\n    condition.message === message;\n}\n\nasync function candidatesFor(\n  workload: AgentWorkloadResource,\n  endpoints: ModelEndpointResource[],\n  getModelClass: ModelEndpointBindingControllerOptions['getModelClass'],\n  nowMs: number,\n  heartbeatTtlMs: number,\n): Promise<Candidate[]> {\n  const requiredClass = workload.spec.modelPolicy?.modelClass;\n  if (!requiredClass) return [];\n  const requiredTrust = workload.spec.trust ?? 'restricted';\n  const requiredClassification = workload.spec.placement?.dataClassification ?? 'internal';\n  const allowedResidencies = workload.spec.placement?.dataResidency;\n  const allowedModelNames = workload.spec.modelPolicy?.allowedModelNames;\n  const candidates: Candidate[] = [];\n\n  for (const endpoint of endpoints) {\n    if (endpoint.spec.modelClassRef.name !== requiredClass) continue;\n    if (endpoint.status?.healthy !== true) continue;\n    const heartbeatAt = Date.parse(endpoint.status.heartbeat ?? '');\n    if (!Number.isFinite(heartbeatAt) || nowMs - heartbeatAt > heartbeatTtlMs) continue;\n    const trust = endpoint.spec.trust ?? 'quarantine';\n    if (TRUST_RANK[trust] < TRUST_RANK[requiredTrust]) continue;\n    const maxConcurrent = endpoint.spec.capacity?.maxConcurrent ?? 0;\n    const spare = maxConcurrent - (endpoint.status.activeCalls ?? 0);\n    if (spare < 1) continue;\n    const endpointClassification = endpoint.spec.dataPolicy?.classification as DataClassification | undefined ??\n      DEFAULT_ENDPOINT_CLASSIFICATION[trust];\n    if (\n      !(endpointClassification in CLASSIFICATION_RANK) ||\n      CLASSIFICATION_RANK[requiredClassification] > CLASSIFICATION_RANK[endpointClassification]\n    ) {\n      continue;\n    }\n\n    const modelClass = await getModelClass(endpoint);\n    if (!modelClass) continue;\n    if (modelClass.spec.digest && endpoint.spec.modelDigest !== modelClass.spec.digest) continue;\n    if (allowedModelNames?.length && !allowedModelNames.includes(modelClass.spec.model)) continue;\n    if (\n      allowedResidencies?.length &&\n      (!modelClass.spec.dataResidency || !allowedResidencies.includes(modelClass.spec.dataResidency))\n    ) {\n      continue;\n    }\n\n    const locality = endpoint.spec.nodeId === workload.status?.assignedNode ? 1000 : 0;\n    candidates.push({ endpoint, modelClass, score: locality + spare });\n  }\n\n  return candidates.sort((left, right) =>\n    right.score - left.score ||\n    left.endpoint.metadata.name.localeCompare(right.endpoint.metadata.name)\n  );\n}\n\n/**\n * Independently binds a Pending AgentRun to a live ModelEndpoint. The\n * controller re-evaluates every hard policy requirement itself and persists\n * the lease epoch before workload execution may consume the endpoint.\n */\nexport function createModelEndpointBindingController(\n  options: ModelEndpointBindingControllerOptions,\n): Controller<AgentRunResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  const endpointHeartbeatTtlMs = options.endpointHeartbeatTtlMs ?? 90_000;\n  return {\n    async reconcile(request) {\n      const run = request.resource as AgentRunResource;\n      const status = run.status ?? {};\n      const reconciledAtDate = now();\n      const reconciledAt = reconciledAtDate.toISOString();\n      if (status.phase && status.phase !== 'Pending') return { ready: true };\n\n      const workload = await options.getWorkload(run);\n      if (!workload) {\n        const message = 'referenced AgentWorkload is unavailable';\n        return {\n          ...(sameCondition(status, message)\n            ? {}\n            : {\n              status: {\n                ...status,\n                conditions: [\n                  ...(status.conditions ?? []).filter((item) => item.type !== 'ModelEndpointScheduled'),\n                  schedulingCondition(message, reconciledAt),\n                ],\n              } satisfies AgentRunStatus,\n            }),\n          requeueAfterMs: 1000,\n        };\n      }\n      if (!workload.spec.modelPolicy?.modelClass) return { ready: true };\n\n      const reservations = new Map<string, number>();\n      for (const other of await options.listRuns?.() ?? []) {\n        if (other.metadata.uid === run.metadata.uid) continue;\n        if (\n          other.status?.phase === 'Completed' ||\n          other.status?.phase === 'Failed' ||\n          other.status?.phase === 'Cancelled'\n        ) continue;\n        const endpointUid = other.status?.assignedModelEndpoint?.uid;\n        if (endpointUid) reservations.set(endpointUid, (reservations.get(endpointUid) ?? 0) + 1);\n      }\n      const endpoints = (await options.listEndpoints()).map((endpoint) => ({\n        ...endpoint,\n        status: {\n          ...endpoint.status,\n          activeCalls: (endpoint.status?.activeCalls ?? 0) +\n            (reservations.get(endpoint.metadata.uid) ?? 0),\n        },\n      }));\n      const candidates = await candidatesFor(\n        workload,\n        endpoints,\n        (endpoint) => options.getModelClass(endpoint),\n        reconciledAtDate.getTime(),\n        endpointHeartbeatTtlMs,\n      );\n      const selected = candidates[0]?.endpoint;\n      if (!selected) {\n        const message = `no healthy endpoint satisfies model class '${workload.spec.modelPolicy.modelClass}'`;\n        const {\n          assignedModelEndpoint: _assignedModelEndpoint,\n          modelBinding: _modelBinding,\n          ...unboundStatus\n        } = status;\n        return {\n          ...(sameCondition(status, message) && !status.assignedModelEndpoint\n            ? {}\n            : {\n              status: {\n                ...unboundStatus,\n                phase: 'Pending',\n                conditions: [\n                  ...(status.conditions ?? []).filter((item) => item.type !== 'ModelEndpointScheduled'),\n                  schedulingCondition(message, reconciledAt),\n                ],\n              } satisfies AgentRunStatus,\n            }),\n          requeueAfterMs: 1000,\n        };\n      }\n\n      if (\n        status.assignedModelEndpoint?.uid === selected.metadata.uid &&\n        status.modelBinding?.endpointResourceVersion === selected.metadata.resourceVersion &&\n        status.modelBinding.leaseEpoch === request.leaseEpoch\n      ) {\n        return { ready: true };\n      }\n      return {\n        status: {\n          ...status,\n          phase: 'Pending',\n          assignedModelEndpoint: endpointReference(selected),\n          modelBinding: {\n            leaseEpoch: request.leaseEpoch,\n            endpointResourceVersion: selected.metadata.resourceVersion,\n            boundAt: reconciledAt,\n          },\n          conditions: [\n            ...(status.conditions ?? []).filter((item) => item.type !== 'ModelEndpointScheduled'),\n            {\n              type: 'ModelEndpointScheduled',\n              status: 'True',\n              reason: 'EndpointSelected',\n              message: `bound to ModelEndpoint '${selected.metadata.name}'`,\n              lastTransitionTime: reconciledAt,\n            },\n          ],\n        } satisfies AgentRunStatus,\n        ready: true,\n      };\n    },\n  };\n}\n","import type { Controller } from './controllerRunner.js';\nimport type { DriverRequestEnvelope } from './drivers/driverRequest.js';\nimport type { NetworkDriver, NetworkDriverCapabilities } from './drivers/networkDriver.js';\nimport { canDriverSatisfyClass } from './drivers/networkDriver.js';\nimport type { NetworkManagementDriver, NetworkPreparePayload } from './drivers/networkManagement.js';\nimport type { AgentWorkloadResource, NetworkAttachmentResource, NetworkClassResource } from './resources.js';\n\nexport interface NetworkAttachmentNode {\n  nodeId: string;\n  healthy: boolean;\n  capabilities: NetworkDriverCapabilities[];\n  /** Conservative number of attachments not yet reflected by the driver. */\n  activeAttachments?: number;\n  maxAttachments?: number;\n}\n\nexport interface NetworkAttachmentBindingControllerOptions {\n  getNetworkClass(attachment: NetworkAttachmentResource): Promise<NetworkClassResource | null>;\n  getWorkload?(attachment: NetworkAttachmentResource): Promise<AgentWorkloadResource | null>;\n  listNodes(): Promise<NetworkAttachmentNode[]>;\n  now?: () => Date;\n}\n\nfunction falseCondition(message: string, time: string) {\n  return {\n    type: 'NetworkScheduled',\n    status: 'False' as const,\n    reason: 'NoEligibleNetworkDriver',\n    message,\n    lastTransitionTime: time,\n  };\n}\n\n/**\n * Selects the node-local NetworkDriver independently from workload execution.\n * NetworkClass capability checks are hard filters; best-effort degradation is\n * allowed only when the class itself explicitly opts into it.\n */\nexport function createNetworkAttachmentBindingController(\n  options: NetworkAttachmentBindingControllerOptions,\n): Controller<NetworkAttachmentResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const attachment = request.resource as NetworkAttachmentResource;\n      const status = attachment.status ?? {};\n      if (status.phase && status.phase !== 'Pending') return { ready: true };\n      const reconciledAt = now().toISOString();\n      const networkClass = await options.getNetworkClass(attachment);\n      if (!networkClass) {\n        return {\n          status: {\n            ...status,\n            phase: 'Pending',\n            conditions: [falseCondition('referenced NetworkClass is unavailable', reconciledAt)],\n          },\n          requeueAfterMs: 1000,\n        };\n      }\n\n      const workload = await options.getWorkload?.(attachment);\n      const requiredNode = attachment.spec.nodeId ?? workload?.status?.assignedNode;\n      const candidates = (await options.listNodes()).flatMap((node) => {\n        if (!node.healthy || (requiredNode && node.nodeId !== requiredNode)) return [];\n        if (\n          node.maxAttachments !== undefined &&\n          (node.activeAttachments ?? 0) >= node.maxAttachments\n        ) return [];\n        const capability = node.capabilities.find(\n          (candidate) => candidate.name === networkClass.spec.driver,\n        );\n        if (!capability || !canDriverSatisfyClass(capability, networkClass).satisfied) return [];\n        return [{ node, capability }];\n      }).sort((left, right) =>\n        (left.node.activeAttachments ?? 0) - (right.node.activeAttachments ?? 0) ||\n        left.node.nodeId.localeCompare(right.node.nodeId)\n      );\n\n      const selected = candidates[0];\n      if (!selected) {\n        const message = `no healthy driver satisfies NetworkClass '${networkClass.metadata.name}'`;\n        const { assignedNode: _node, assignedDriver: _driver, binding: _binding, ...unbound } = status;\n        return {\n          status: {\n            ...unbound,\n            phase: 'Pending',\n            conditions: [falseCondition(message, reconciledAt)],\n          },\n          requeueAfterMs: 1000,\n        };\n      }\n      if (\n        status.assignedNode === selected.node.nodeId &&\n        status.assignedDriver === selected.capability.name &&\n        status.binding?.leaseEpoch === request.leaseEpoch &&\n        status.binding.networkClassResourceVersion === networkClass.metadata.resourceVersion\n      ) {\n        return { ready: true };\n      }\n      return {\n        status: {\n          ...status,\n          phase: 'Pending',\n          assignedNode: selected.node.nodeId,\n          assignedDriver: selected.capability.name,\n          binding: {\n            leaseEpoch: request.leaseEpoch,\n            networkClassResourceVersion: networkClass.metadata.resourceVersion,\n            boundAt: reconciledAt,\n          },\n          conditions: [{\n            type: 'NetworkScheduled',\n            status: 'True',\n            reason: 'DriverSelected',\n            message: `bound to driver '${selected.capability.name}' on node '${selected.node.nodeId}'`,\n            lastTransitionTime: reconciledAt,\n          }],\n        },\n        ready: true,\n      };\n    },\n  };\n}\n\nexport interface NetworkAttachmentExecutionControllerOptions {\n  nodeId: string;\n  getNetworkClass(attachment: NetworkAttachmentResource): Promise<NetworkClassResource | null>;\n  getDriver(name: string): Promise<NetworkDriver | undefined>;\n  sandboxRef?(attachment: NetworkAttachmentResource): Promise<string>;\n  managed?: {\n    getDriver(name: string): Promise<NetworkManagementDriver | undefined>;\n    createPrepareRequest(input: {\n      attachment: NetworkAttachmentResource;\n      networkClass: NetworkClassResource;\n      sandboxHandle: string;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<NetworkPreparePayload>>;\n    createReleaseRequest(input: {\n      attachment: NetworkAttachmentResource;\n      networkHandle: string;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<{ networkHandle: string }>>;\n  };\n  now?: () => Date;\n}\n\n/**\n * Executes a bound attachment on its selected node. prepare() implementations\n * must be idempotent for an attachment UID. The persisted Preparing claim\n * prevents a new controller epoch from repeating a possibly completed effect.\n */\nexport function createNetworkAttachmentExecutionController(\n  options: NetworkAttachmentExecutionControllerOptions,\n): Controller<NetworkAttachmentResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const attachment = request.resource as NetworkAttachmentResource;\n      const status = attachment.status ?? {};\n      if (status.assignedNode !== options.nodeId || !status.assignedDriver || !status.binding) {\n        return { ready: true };\n      }\n      if (status.phase === 'Failed' || status.phase === 'Detached') {\n        return { ready: true };\n      }\n      if (status.phase === 'Attached' && !status.releaseRequestedAt) return { ready: true };\n      const driver = await options.getDriver(status.assignedDriver);\n      if (!driver) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNAVAILABLE',\n              message: `bound network driver '${status.assignedDriver}' is unavailable`,\n              retryable: true,\n            },\n          },\n          ready: true,\n        };\n      }\n      if (status.phase === 'Attached' && status.releaseRequestedAt) {\n        if (!status.handle) {\n          return {\n            status: {\n              ...status,\n              phase: 'Failed',\n              error: {\n                code: 'INVALID',\n                message: 'attached network resource has no driver handle to release',\n                retryable: false,\n              },\n            },\n            ready: true,\n          };\n        }\n        if (options.managed) {\n          const managedDriver = await options.managed.getDriver(status.assignedDriver);\n          if (!managedDriver) {\n            return {\n              status: {\n                ...status,\n                phase: 'Failed',\n                error: {\n                  code: 'UNAVAILABLE',\n                  message: `bound managed network driver '${status.assignedDriver}' is unavailable`,\n                  retryable: true,\n                },\n              },\n              ready: true,\n            };\n          }\n          await managedDriver.releaseNetwork(\n            await options.managed.createReleaseRequest({\n              attachment,\n              networkHandle: status.handle,\n              actor: request.actor,\n              leaseEpoch: request.leaseEpoch,\n            }),\n          );\n        } else {\n          await driver.release(status.handle);\n        }\n        return {\n          status: {\n            ...status,\n            phase: 'Detached',\n            detachedAt: now().toISOString(),\n          },\n          ready: true,\n        };\n      }\n      const networkClass = await options.getNetworkClass(attachment);\n      if (\n        !networkClass ||\n        networkClass.metadata.resourceVersion !== status.binding.networkClassResourceVersion\n      ) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'CONFLICT',\n              message: 'NetworkClass changed after attachment binding; a fresh attachment is required',\n              retryable: false,\n            },\n          },\n          ready: true,\n        };\n      }\n      const capabilities = await driver.getCapabilities();\n      const health = await driver.getHealth();\n      const satisfaction = canDriverSatisfyClass(capabilities, networkClass);\n      if (\n        !health.healthy ||\n        capabilities.name !== status.assignedDriver ||\n        !satisfaction.satisfied\n      ) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNAVAILABLE',\n              message: satisfaction.reason ?? health.detail ?? 'network driver is unhealthy',\n              retryable: true,\n            },\n          },\n          ready: true,\n        };\n      }\n\n      const claimedAt = now().toISOString();\n      if (status.phase !== 'Preparing') {\n        return {\n          status: {\n            ...status,\n            phase: 'Preparing',\n            executionClaim: { leaseEpoch: request.leaseEpoch, claimedAt },\n          },\n          requeueAfterMs: 1,\n        };\n      }\n      if (status.executionClaim?.leaseEpoch !== request.leaseEpoch) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNKNOWN_EFFECT',\n              message: 'controller epoch changed after network prepare was claimed; refusing duplicate attachment',\n              retryable: false,\n            },\n          },\n          ready: true,\n        };\n      }\n\n      const sandboxHandle = await options.sandboxRef?.(attachment) ??\n        `workload:${attachment.spec.workloadRef?.uid ?? attachment.metadata.uid}`;\n      const managed = options.managed;\n      const prepared = managed\n        ? await (async () => {\n          const managedDriver = await managed.getDriver(status.assignedDriver as string);\n          if (!managedDriver) {\n            return {\n              phase: 'Failed' as const,\n              error: {\n                code: 'UNAVAILABLE' as const,\n                message: `bound managed network driver '${status.assignedDriver}' is unavailable`,\n                retryable: true,\n              },\n            };\n          }\n          const managedStatus = await managedDriver.prepareNetwork(\n            await managed.createPrepareRequest({\n              attachment,\n              networkClass,\n              sandboxHandle,\n              actor: request.actor,\n              leaseEpoch: request.leaseEpoch,\n            }),\n          );\n          return {\n            phase: 'Attached' as const,\n            handle: managedStatus.networkHandle,\n            ...(managedStatus.degradedFeatures.length > 0\n              ? { degraded: managedStatus.degradedFeatures }\n              : {}),\n            attachedAt: managedStatus.updatedAt,\n          };\n        })()\n        : await driver.prepare({\n          attachment,\n          networkClass,\n          sandboxRef: sandboxHandle,\n        });\n      return {\n        status: {\n          ...status,\n          ...prepared,\n          assignedNode: status.assignedNode,\n          assignedDriver: status.assignedDriver,\n          binding: status.binding,\n          executionClaim: status.executionClaim,\n        },\n        ready: prepared.phase === 'Attached' || prepared.phase === 'Failed',\n        ...(prepared.phase === 'Pending' ? { requeueAfterMs: 1000 } : {}),\n      };\n    },\n  };\n}\n","import type { Controller } from './controllerRunner.js';\nimport type { DriverRequestEnvelope } from './drivers/driverRequest.js';\nimport type { StorageDriver } from './drivers/storageDriver.js';\nimport type { StorageManagementDriver } from './drivers/storageManagement.js';\nimport { OrchestrationError } from './errors.js';\nimport type { AgentRunResource, AgentRunStatus, AgentVolumeClaimResource, AgentVolumeResource, AgentWorkloadResource } from './resources.js';\n\nexport interface RunVolumeControllerOptions {\n  nodeId: string;\n  getWorkload(run: AgentRunResource): Promise<AgentWorkloadResource | null>;\n  getClaim(name: string, namespace?: string): Promise<AgentVolumeClaimResource | null>;\n  getVolume(claim: AgentVolumeClaimResource): Promise<AgentVolumeResource | null>;\n  getDriver(name: string): Promise<StorageDriver | undefined>;\n  managed?: {\n    getDriver(name: string): Promise<StorageManagementDriver | undefined>;\n    createStageRequest(input: {\n      run: AgentRunResource;\n      volume: AgentVolumeResource;\n      nodeId: string;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<{ volumeHandle: string; nodeId: string }>>;\n    createPublishRequest(input: {\n      run: AgentRunResource;\n      stageHandle: string;\n      workloadUid: string;\n      readOnly: boolean;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<\n      DriverRequestEnvelope<{\n        stageHandle: string;\n        workloadUid: string;\n        readOnly: boolean;\n      }>\n    >;\n    createUnpublishRequest(input: {\n      run: AgentRunResource;\n      publishHandle: string;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<{ publishHandle: string }>>;\n    createUnstageRequest(input: {\n      run: AgentRunResource;\n      stageHandle: string;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<{ stageHandle: string }>>;\n  };\n  recordPublished?(\n    volume: AgentVolumeResource,\n    workload: AgentWorkloadResource,\n    nodeId: string,\n  ): Promise<void>;\n  recordUnpublished?(\n    volume: AgentVolumeResource,\n    workload: AgentWorkloadResource,\n    nodeId: string,\n  ): Promise<void>;\n  now?: () => Date;\n}\n\n/** Publishes independently provisioned claims to a bound Run's workload node. */\nexport function createRunVolumeController(\n  options: RunVolumeControllerOptions,\n): Controller<AgentRunResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const run = request.resource as AgentRunResource;\n      const status = run.status ?? {};\n      const workload = await options.getWorkload(run);\n      if (!workload || workload.status?.assignedNode !== options.nodeId) return { ready: true };\n      const requested = workload.spec.storagePolicy?.volumes ?? [];\n      if (requested.length === 0) return { ready: true };\n\n      if (\n        (status.volumePhase === 'Ready' || status.volumePhase === 'Publishing') &&\n        status.volumeReleaseRequestedAt\n      ) {\n        return {\n          status: { ...status, volumePhase: 'Releasing' } satisfies AgentRunStatus,\n          requeueAfterMs: 1,\n        };\n      }\n      if (status.volumePhase === 'Releasing') {\n        for (const binding of status.volumeBindings ?? []) {\n          const managedDriver = options.managed\n            ? await options.managed.getDriver(binding.assignedDriver)\n            : undefined;\n          if (managedDriver && options.managed && binding.stageHandle) {\n            await managedDriver.unpublish(\n              await options.managed.createUnpublishRequest({\n                run,\n                publishHandle: binding.publishHandle,\n                actor: request.actor,\n                leaseEpoch: request.leaseEpoch,\n              }),\n            );\n            await managedDriver.unstage(\n              await options.managed.createUnstageRequest({\n                run,\n                stageHandle: binding.stageHandle,\n                actor: request.actor,\n                leaseEpoch: request.leaseEpoch,\n              }),\n            );\n          } else {\n            const driver = await options.getDriver(binding.assignedDriver);\n            if (!driver) {\n              throw new OrchestrationError({\n                code: 'UNAVAILABLE',\n                message: `storage driver '${binding.assignedDriver}' unavailable during unpublish`,\n                retryable: true,\n              });\n            }\n            await driver.unpublish(binding.publishHandle);\n          }\n          const claim = await options.getClaim(binding.claimRef.name, run.metadata.namespace);\n          const volume = claim ? await options.getVolume(claim) : null;\n          if (volume) await options.recordUnpublished?.(volume, workload, options.nodeId);\n        }\n        return {\n          status: { ...status, volumePhase: 'Released' } satisfies AgentRunStatus,\n          ready: true,\n        };\n      }\n      if (\n        status.volumePhase === 'Ready' ||\n        status.volumePhase === 'Released' ||\n        status.volumePhase === 'Failed'\n      ) return { ready: true };\n\n      const resolved: Array<{\n        name: string;\n        claim: AgentVolumeClaimResource;\n        volume: AgentVolumeResource;\n        driver: StorageDriver;\n        readOnly: boolean;\n      }> = [];\n      for (const request_ of requested) {\n        const claim = await options.getClaim(request_.claimRef, run.metadata.namespace);\n        if (!claim) return { requeueAfterMs: 1000 };\n        if (claim.status?.phase === 'Failed' || claim.status?.phase === 'Lost') {\n          return {\n            status: {\n              ...status,\n              volumePhase: 'Failed',\n              volumeError: {\n                code: 'UNAVAILABLE',\n                message: `volume claim '${request_.claimRef}' is ${claim.status.phase}`,\n                retryable: false,\n              },\n            } satisfies AgentRunStatus,\n            ready: true,\n          };\n        }\n        if (\n          claim.status?.phase !== 'Bound' ||\n          claim.status.assignedNode !== options.nodeId ||\n          !claim.status.assignedDriver\n        ) return { requeueAfterMs: 1000 };\n        const volume = await options.getVolume(claim);\n        if (!volume || volume.metadata.uid !== claim.status.volumeRef?.uid) {\n          return { requeueAfterMs: 1000 };\n        }\n        const driver = await options.getDriver(claim.status.assignedDriver);\n        if (!driver) return { requeueAfterMs: 1000 };\n        resolved.push({\n          name: request_.name,\n          claim,\n          volume,\n          driver,\n          readOnly: claim.spec.accessMode === 'ReadOnlyMany',\n        });\n      }\n\n      if (status.volumePhase !== 'Publishing') {\n        return {\n          status: {\n            ...status,\n            volumePhase: 'Publishing',\n            volumePublishClaim: {\n              leaseEpoch: request.leaseEpoch,\n              claimedAt: now().toISOString(),\n            },\n          } satisfies AgentRunStatus,\n          requeueAfterMs: 1,\n        };\n      }\n      if (status.volumePublishClaim?.leaseEpoch !== request.leaseEpoch) {\n        return {\n          status: {\n            ...status,\n            volumePhase: 'Failed',\n            volumeError: {\n              code: 'UNKNOWN_EFFECT',\n              message: 'controller epoch changed after volume publication was claimed',\n              retryable: false,\n            },\n          } satisfies AgentRunStatus,\n          ready: true,\n        };\n      }\n\n      const bindings = [...(status.volumeBindings ?? [])];\n      const next = resolved.find((item) => !bindings.some((binding) => binding.name === item.name));\n      if (next) {\n        const managedDriver = options.managed\n          ? await options.managed.getDriver(next.claim.status!.assignedDriver!)\n          : undefined;\n        const stage = managedDriver && options.managed\n          ? await managedDriver.stage(\n            await options.managed.createStageRequest({\n              run,\n              volume: next.volume,\n              nodeId: options.nodeId,\n              actor: request.actor,\n              leaseEpoch: request.leaseEpoch,\n            }),\n          )\n          : undefined;\n        const managedPublication = managedDriver && options.managed && stage\n          ? await managedDriver.publish(\n            await options.managed.createPublishRequest({\n              run,\n              stageHandle: stage.stageHandle,\n              workloadUid: workload.metadata.uid,\n              readOnly: next.readOnly,\n              actor: request.actor,\n              leaseEpoch: request.leaseEpoch,\n            }),\n          )\n          : undefined;\n        const published = managedPublication ?? await next.driver.publish({\n          volume: next.volume,\n          nodeId: options.nodeId,\n          workloadUid: workload.metadata.uid,\n          readOnly: next.readOnly,\n        });\n        await options.recordPublished?.(next.volume, workload, options.nodeId);\n        bindings.push({\n          name: next.name,\n          claimRef: { name: next.claim.metadata.name, uid: next.claim.metadata.uid },\n          volumeRef: { name: next.volume.metadata.name, uid: next.volume.metadata.uid },\n          assignedDriver: next.claim.status!.assignedDriver!,\n          assignedNode: options.nodeId,\n          ...(stage ? { stageHandle: stage.stageHandle } : {}),\n          publishHandle: published.publishHandle,\n          readOnly: next.readOnly,\n        });\n        return {\n          status: {\n            ...status,\n            volumePhase: 'Publishing',\n            volumeBindings: bindings,\n          } satisfies AgentRunStatus,\n          requeueAfterMs: 1,\n        };\n      }\n      return {\n        status: {\n          ...status,\n          volumePhase: 'Ready',\n          volumeBindings: bindings,\n        } satisfies AgentRunStatus,\n        ready: true,\n      };\n    },\n  };\n}\n","import type { Controller, ControllerReconcileResult } from './controllerRunner.js';\nimport type { ControlStore, ControlStoreActor } from './controlStore.js';\nimport type { AgentWorkloadResource, AgentWorkloadStatus, DataClassification, NodeTrustClass } from './resources.js';\n\nexport interface SchedulerNode {\n  name: string;\n  trustClass: NodeTrustClass;\n  faultDomain: string;\n  /** Explicit false removes the node from scheduling immediately. */\n  healthy?: boolean;\n  /** When reported, the node must include `worker` to accept workloads. */\n  roles?: string[];\n  /** Trusted verifier assessment, never a worker self-report. */\n  attested?: boolean;\n  /** Host registry confirms every selected driver has passing conformance evidence. */\n  driverConformancePassed?: boolean;\n  capacity?: {\n    cpuMillicores?: number;\n    memoryBytes?: number;\n    gpuCount?: number;\n    diskBytes?: number;\n    bandwidthKbps?: number;\n  };\n  labels?: Record<string, string>;\n  /** Taints that repel workloads unless they explicitly tolerate them. */\n  taints?: string[];\n  /**\n   * Maximum data classification this node is allowed to process.\n   * Defaults to 'restricted' for trusted, 'internal' for restricted, 'public' for quarantine.\n   */\n  maxDataClassification?: DataClassification;\n  /** Residency labels in which this node may process data. */\n  dataResidency?: string[];\n  /** Runtime classes backed by an admitted runtime driver on this node. */\n  availableRuntimeClasses?: string[];\n  /** Healthy tool executor classes available on this node. */\n  availableToolClasses?: string[];\n  /** Available model endpoints on this node (by model class name). */\n  availableModelClasses?: string[];\n  /** Network classes and the boundary/egress modes they can enforce. */\n  networkCapabilities?: Array<{\n    networkClass: string;\n    enforcementLevel: 'none' | 'process' | 'namespace' | 'host' | 'external';\n    egress?: Array<'none' | 'same-node' | 'restricted' | 'open'>;\n  }>;\n  /** Storage classes provisionable or publishable on this node. */\n  availableStorageClasses?: string[];\n  /** Existing claims local/publishable to this node. */\n  availableVolumeClaims?: string[];\n  /** Credential broker capabilities; these are policy metadata, never handles. */\n  credentialCapabilities?: Array<{\n    brokerClass: string;\n    audiences?: string[];\n    targets?: string[];\n  }>;\n  /** Content-addressed data already present on this node, used only for scoring. */\n  localArtifactReferences?: string[];\n  localCheckpointReferences?: string[];\n  /** Active target count for each rollout batch on this fault domain. */\n  rolloutLoad?: Record<string, number>;\n  /** Spare concurrency slots. */\n  spareConcurrency?: number;\n}\n\nexport interface SchedulingDecision {\n  nodeName: string;\n  score: number;\n  reasons: string[];\n}\n\nexport interface Scheduler {\n  schedule(\n    workload: AgentWorkloadResource,\n    nodes: SchedulerNode[],\n  ): SchedulingDecision | null;\n}\n\nexport interface BindingControllerOptions {\n  actor: ControlStoreActor;\n  scheduler: Scheduler;\n  listNodes: () => Promise<SchedulerNode[]>;\n  authorizePlacement?(input: {\n    workload: AgentWorkloadResource;\n    node: SchedulerNode;\n    actor: ControlStoreActor;\n    leaseEpoch: string;\n  }): Promise<{\n    outcome: 'allow' | 'deny';\n    decisionHandle: string;\n    policyDigest: string;\n    reasons: string[];\n  }>;\n}\n\n/** Trust rank: higher = more trusted. */\nconst TRUST_RANK: Record<NodeTrustClass, number> = {\n  quarantine: 0,\n  restricted: 1,\n  trusted: 2,\n};\n\n/** Data classification rank: higher = more sensitive. */\nconst CLASSIFICATION_RANK: Record<DataClassification, number> = {\n  public: 0,\n  internal: 1,\n  confidential: 2,\n  restricted: 3,\n};\n\nconst DEFAULT_MAX_CLASSIFICATION: Record<NodeTrustClass, DataClassification> = {\n  trusted: 'restricted',\n  restricted: 'internal',\n  quarantine: 'public',\n};\n\nconst NETWORK_ENFORCEMENT_RANK = {\n  none: 0,\n  process: 1,\n  namespace: 2,\n  host: 3,\n  external: 4,\n} as const;\n\n/**\n * Determine the minimum node trust class required for a workload.\n *\n * Per §7.2 and §23, restricted nodes are the preferred fleet-worker class.\n * Quarantine workloads (trust='quarantine') must only run on quarantine nodes.\n * Workloads with no trust specified default to 'restricted' (allowed on\n * restricted or trusted nodes).\n */\nfunction resolveMinTrustClass(workload: AgentWorkloadResource): NodeTrustClass {\n  return workload.spec.trust ?? 'restricted';\n}\n\ninterface NodeEligibility {\n  eligible: boolean;\n  reasons: string[];\n  rejection?: string;\n}\n\nfunction reject(rejection: string): NodeEligibility {\n  return { eligible: false, reasons: [], rejection };\n}\n\n/**\n * Evaluate every hard placement requirement in one place. The binding\n * controller calls this again after a Scheduler decision, so a custom\n * scheduler cannot bypass security/capability admission.\n */\nfunction evaluateNodeEligibility(\n  workload: AgentWorkloadResource,\n  node: SchedulerNode,\n): NodeEligibility {\n  const placement = workload.spec.placement ?? {};\n  const reasons: string[] = [];\n  const minTrust = resolveMinTrustClass(workload);\n  const workloadClassification = placement.dataClassification ?? 'internal';\n\n  if (node.healthy === false) return reject('node is unhealthy');\n  if (node.roles && !node.roles.includes('worker')) return reject('node does not advertise the worker role');\n  if (placement.requireAttestation && node.attested !== true) {\n    return reject('verified node attestation is required');\n  }\n  if (placement.requiredNode && node.name !== placement.requiredNode) return reject('requiredNode does not match');\n  if (placement.nodeSelector) {\n    const matches = Object.entries(placement.nodeSelector).every(\n      ([key, value]) => node.labels?.[key] === value,\n    );\n    if (!matches) return reject('nodeSelector does not match');\n    reasons.push('matches nodeSelector');\n  }\n  if (placement.antiAffinity?.includes(node.faultDomain)) {\n    return reject(`fault domain ${node.faultDomain} is excluded by anti-affinity`);\n  }\n\n  if (minTrust === 'quarantine') {\n    if (node.trustClass !== 'quarantine') return reject('quarantine isolation requires a quarantine node');\n    reasons.push('quarantine isolation match');\n  } else {\n    if (node.trustClass === 'quarantine') return reject('non-quarantine workload cannot use quarantine node');\n    if (TRUST_RANK[node.trustClass] < TRUST_RANK[minTrust]) {\n      return reject(`trust class ${node.trustClass} is below ${minTrust}`);\n    }\n    reasons.push(`trust: ${node.trustClass} ≥ ${minTrust}`);\n  }\n\n  const nodeMaxClass = node.maxDataClassification ?? DEFAULT_MAX_CLASSIFICATION[node.trustClass];\n  if (CLASSIFICATION_RANK[workloadClassification] > CLASSIFICATION_RANK[nodeMaxClass]) {\n    return reject(`data classification ${workloadClassification} exceeds ${nodeMaxClass}`);\n  }\n  reasons.push(`data: ${workloadClassification} ≤ ${nodeMaxClass}`);\n  if (placement.dataResidency?.length) {\n    if (!node.dataResidency?.some((residency) => placement.dataResidency?.includes(residency))) {\n      return reject('data residency does not match');\n    }\n    reasons.push('data residency match');\n  }\n\n  if (node.taints?.length) {\n    const tolerations = placement.tolerations ?? [];\n    const untolerated = node.taints.filter((taint) => !tolerations.includes(taint));\n    if (untolerated.length) return reject(`untolerated taints: ${untolerated.join(', ')}`);\n    reasons.push('taints tolerated');\n  }\n\n  if (workload.spec.runtimeClass) {\n    if (!node.availableRuntimeClasses?.includes(workload.spec.runtimeClass)) {\n      return reject(`runtime class ${workload.spec.runtimeClass} is unavailable`);\n    }\n    reasons.push(`runtime class ${workload.spec.runtimeClass} available`);\n  }\n  const requiredToolClasses = workload.spec.toolPolicy?.requiredToolClasses ?? [];\n  const missingToolClass = requiredToolClasses.find(\n    (toolClass) => !node.availableToolClasses?.includes(toolClass),\n  );\n  if (missingToolClass) return reject(`tool class ${missingToolClass} is unavailable`);\n  if (requiredToolClasses.length) reasons.push('required tool classes available');\n\n  const requiredModelClass = workload.spec.modelPolicy?.modelClass;\n  if (requiredModelClass) {\n    if (!node.availableModelClasses?.includes(requiredModelClass)) {\n      return reject(`model class ${requiredModelClass} is unavailable`);\n    }\n    reasons.push(`model class ${requiredModelClass} available`);\n  }\n\n  const networkPolicy = workload.spec.networkPolicy;\n  if (networkPolicy?.networkClass) {\n    const capability = node.networkCapabilities?.find(\n      (candidate) => candidate.networkClass === networkPolicy.networkClass,\n    );\n    if (!capability) return reject(`network class ${networkPolicy.networkClass} is unavailable`);\n    const minimum = networkPolicy.minimumEnforcement ?? 'none';\n    if (NETWORK_ENFORCEMENT_RANK[capability.enforcementLevel] < NETWORK_ENFORCEMENT_RANK[minimum]) {\n      return reject(`network enforcement ${capability.enforcementLevel} is below ${minimum}`);\n    }\n    if (networkPolicy.egress && !capability.egress?.includes(networkPolicy.egress)) {\n      return reject(`network egress mode ${networkPolicy.egress} is unavailable`);\n    }\n    reasons.push(`network class ${networkPolicy.networkClass} enforceable`);\n  }\n\n  const storagePolicy = workload.spec.storagePolicy;\n  if (\n    storagePolicy?.storageClass &&\n    !node.availableStorageClasses?.includes(storagePolicy.storageClass)\n  ) {\n    return reject(`storage class ${storagePolicy.storageClass} is unavailable`);\n  }\n  const missingClaim = storagePolicy?.volumes?.find(\n    (volume) => !node.availableVolumeClaims?.includes(volume.claimRef),\n  );\n  if (missingClaim) return reject(`volume claim ${missingClaim.claimRef} is unavailable`);\n  if (storagePolicy?.storageClass || storagePolicy?.volumes?.length) {\n    reasons.push('storage requirements available');\n  }\n\n  const credentialPolicy = workload.spec.credentialPolicy;\n  if (credentialPolicy) {\n    const capability = node.credentialCapabilities?.find(\n      (candidate) =>\n        !credentialPolicy.brokerClass ||\n        candidate.brokerClass === credentialPolicy.brokerClass,\n    );\n    if (!capability) return reject('required credential broker is unavailable');\n    const missingAudience = credentialPolicy.audiences?.find(\n      (audience) => !capability.audiences?.includes(audience),\n    );\n    if (missingAudience) return reject(`credential audience ${missingAudience} is unavailable`);\n    const missingTarget = credentialPolicy.targets?.find(\n      (target) => !capability.targets?.includes(target),\n    );\n    if (missingTarget) return reject(`credential target ${missingTarget} is unavailable`);\n    reasons.push('credential broker requirements available');\n  }\n\n  const requirements = workload.spec.resources;\n  if (requirements) {\n    const dimensions: Array<[keyof NonNullable<typeof requirements>, string]> = [\n      ['cpuMillicores', 'CPU'],\n      ['memoryBytes', 'memory'],\n      ['gpuCount', 'GPU'],\n      ['diskBytes', 'disk'],\n      ['bandwidthKbps', 'bandwidth'],\n    ];\n    for (const [key, label] of dimensions) {\n      const requested = requirements[key];\n      if (requested === undefined) continue;\n      if (!Number.isFinite(requested) || requested < 0) return reject(`${label} request is invalid`);\n      if ((node.capacity?.[key] ?? 0) < requested) return reject(`insufficient ${label} capacity`);\n    }\n    reasons.push('resource requests fit');\n  }\n\n  const rollout = placement.rollout;\n  if (rollout) {\n    if (rollout.excludedFaultDomains?.includes(node.faultDomain)) {\n      return reject(`fault domain ${node.faultDomain} is excluded from rollout batch`);\n    }\n    const current = node.rolloutLoad?.[rollout.batchId] ?? 0;\n    if (\n      rollout.maxConcurrentPerFaultDomain !== undefined &&\n      current >= rollout.maxConcurrentPerFaultDomain\n    ) {\n      return reject(`rollout batch ${rollout.batchId} reached its fault-domain limit`);\n    }\n    reasons.push(`rollout batch ${rollout.batchId} admitted`);\n  }\n\n  return { eligible: true, reasons };\n}\n\n/**\n * Upsert the `Scheduled` condition so requesters can watch readiness through\n * the standard condition-wait path (plan 24.14).\n */\nfunction withScheduledCondition(\n  status: AgentWorkloadStatus,\n  conditionStatus: 'True' | 'False',\n  reason: string,\n  now: Date,\n): AgentWorkloadStatus {\n  const conditions = (status.conditions ?? []).filter((condition) => condition.type !== 'Scheduled');\n  conditions.push({ type: 'Scheduled', status: conditionStatus, reason, lastTransitionTime: now.toISOString() });\n  return { ...status, conditions };\n}\n\n/**\n * Create a controller that binds AgentWorkloads to Nodes.\n *\n * The controller watches AgentWorkloads in Pending phase, runs the scheduler\n * to select a node, and updates the workload status with the binding through\n * ControlStore CAS. The lease epoch is included in the status update for\n * fencing.\n *\n * Per §7.2 and §23, restricted nodes are the preferred fleet-worker class and\n * are allowed for ordinary worker workloads. Only quarantine-designated\n * workloads may run on quarantine nodes.\n */\nexport function createBindingController(\n  _store: ControlStore,\n  options: BindingControllerOptions,\n): Controller<AgentWorkloadResource['spec']> {\n  return {\n    async reconcile(request): Promise<ControllerReconcileResult> {\n      const workload = request.resource as AgentWorkloadResource;\n      const status = workload.status ?? {};\n\n      // External placement is explicit and owned by the external\n      // orchestration controller. Never race it with the local node binder.\n      if (workload.spec.placement?.orchestrator) {\n        return { ready: true };\n      }\n\n      // Skip workloads that are already bound or completed.\n      if (status.phase !== 'Pending' && status.phase !== undefined) {\n        return { ready: true };\n      }\n\n      const nodes = await options.listNodes();\n      const decision = options.scheduler.schedule(workload, nodes);\n\n      if (!decision) {\n        return {\n          status: withScheduledCondition(\n            {\n              ...status,\n              phase: 'Failed',\n              lastRunResult: 'no suitable node found',\n            } as AgentWorkloadStatus,\n            'False',\n            'NoSuitableNode',\n            request.now,\n          ),\n          ready: true,\n        };\n      }\n\n      const node = nodes.find((n) => n.name === decision.nodeName);\n      const eligibility = node ? evaluateNodeEligibility(workload, node) : reject('selected node does not exist');\n      if (!eligibility.eligible) {\n        return {\n          status: withScheduledCondition(\n            {\n              ...status,\n              phase: 'Failed',\n              lastRunResult: `node ${decision.nodeName} rejected before bind: ${eligibility.rejection}`,\n            } as AgentWorkloadStatus,\n            'False',\n            'BindingAdmissionRejected',\n            request.now,\n          ),\n          ready: true,\n        };\n      }\n\n      const policyDecision = options.authorizePlacement\n        ? await options.authorizePlacement({\n          workload,\n          node: node as SchedulerNode,\n          actor: request.actor,\n          leaseEpoch: request.leaseEpoch,\n        })\n        : undefined;\n      if (policyDecision?.outcome === 'deny') {\n        return {\n          status: withScheduledCondition(\n            {\n              ...status,\n              phase: 'Failed',\n              placementDecisionRef: policyDecision.decisionHandle,\n              placementPolicyDigest: policyDecision.policyDigest,\n              lastRunResult: `node ${decision.nodeName} denied by trusted placement policy: ${policyDecision.reasons.join('; ')}`,\n            } as AgentWorkloadStatus,\n            'False',\n            'PlacementPolicyDenied',\n            request.now,\n          ),\n          ready: true,\n        };\n      }\n\n      return {\n        status: withScheduledCondition(\n          {\n            ...status,\n            phase: 'Scheduling',\n            assignedNode: decision.nodeName,\n            ...(policyDecision\n              ? {\n                placementDecisionRef: policyDecision.decisionHandle,\n                placementPolicyDigest: policyDecision.policyDigest,\n              }\n              : {}),\n            lastRunResult: `bound to ${decision.nodeName} (score: ${decision.score}, lease: ${request.leaseEpoch})`,\n          } as AgentWorkloadStatus,\n          'True',\n          `BoundTo ${decision.nodeName}`,\n          request.now,\n        ),\n        ready: true,\n      };\n    },\n  };\n}\n\n/**\n * Capacity scheduler with trust, data-classification, taint/toleration,\n * model-capability, and anti-affinity filters.\n *\n * Trust filtering (§7.2, §23):\n * - Restricted nodes are allowed for ordinary/restricted workloads.\n * - Quarantine nodes are only candidates for quarantine-designated workloads.\n * - Trusted nodes are always eligible (unless filtered by other criteria).\n *\n * Data classification filtering:\n * - Workloads with sensitive data are not scheduled on nodes whose\n *   `maxDataClassification` is lower than the workload's classification.\n * - Quarantine nodes default to `public`-only.\n *\n * Scoring favors trusted nodes, higher capacity, and data locality.\n */\nexport function createCapacityScheduler(): Scheduler {\n  return {\n    schedule(workload, nodes) {\n      const placement = workload.spec.placement ?? {};\n      const candidates: Array<{ node: SchedulerNode; score: number; reasons: string[] }> = [];\n\n      for (const node of nodes) {\n        const eligibility = evaluateNodeEligibility(workload, node);\n        if (!eligibility.eligible) continue;\n        const reasons = eligibility.reasons;\n\n        // ── Score: available capacity (higher is better) ──\n        const cpu = node.capacity?.cpuMillicores ?? 0;\n        const memory = node.capacity?.memoryBytes ?? 0;\n        let score = cpu + Math.floor(memory / (1024 * 1024));\n        reasons.push(`capacity score: ${score}`);\n\n        // ── Score: trust bonus (prefer higher trust) ──\n        score += TRUST_RANK[node.trustClass] * 500;\n        if (node.trustClass === 'trusted') {\n          reasons.push('trusted node bonus');\n        } else if (node.trustClass === 'restricted') {\n          reasons.push('restricted node eligible');\n        }\n\n        // ── Score: spare concurrency bonus ──\n        if (node.spareConcurrency && node.spareConcurrency > 0) {\n          score += Math.min(node.spareConcurrency * 10, 200);\n          reasons.push(`spare concurrency: ${node.spareConcurrency}`);\n        }\n\n        if (placement.preferredNode === node.name) {\n          score += 300;\n          reasons.push('preferred node locality');\n        }\n        const localArtifacts = workload.spec.artifactReferences?.filter(\n          (reference) => node.localArtifactReferences?.includes(reference),\n        ).length ?? 0;\n        if (localArtifacts) {\n          score += localArtifacts * 100;\n          reasons.push(`${localArtifacts} local artifact(s)`);\n        }\n        if (\n          workload.spec.checkpointReference &&\n          node.localCheckpointReferences?.includes(workload.spec.checkpointReference)\n        ) {\n          score += 200;\n          reasons.push('checkpoint local');\n        }\n\n        candidates.push({ node, score, reasons });\n      }\n\n      if (candidates.length === 0) return null;\n\n      candidates.sort((a, b) => b.score - a.score);\n      const best = candidates[0];\n      return {\n        nodeName: best.node.name,\n        score: best.score,\n        reasons: best.reasons,\n      };\n    },\n  };\n}\n","import type { ControlStoreAuthorizationRequest } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport { AUDIT_RECORD_KIND, type AuditRecordSpec } from '../resources.js';\nimport { containsSecrets } from './secretRedaction.js';\n\nconst SHA256 = /^sha256:[a-f0-9]{64}$/;\nconst FORBIDDEN_ATTRIBUTE = /(?:secret|token|password|credential|authorization|cookie|private[-_]?key)/i;\nconst SPEC_FIELDS = new Set([\n  'stream',\n  'sequence',\n  'resourceUid',\n  'recordKind',\n  'receivedAt',\n  'actor',\n  'policyDigest',\n  'capabilityDigest',\n  'effect',\n  'provenance',\n  'attributes',\n  'data',\n  'previousDigest',\n  'recordDigest',\n  'requestFingerprint',\n  'idempotencyDigest',\n  'fencingEpoch',\n]);\n\nfunction forbidden(message: string): never {\n  throw new OrchestrationError({\n    code: 'FORBIDDEN',\n    message,\n    retryable: false,\n  });\n}\n\n/**\n * Enforce AuditRecord append-only semantics in the protected ControlStore\n * write transaction. Only the actor stamped into immutable evidence may\n * create it; no status, apply, delete, or resource lease mutation is valid.\n */\nexport function createAuditRecordAuthorizer(): (\n  request: ControlStoreAuthorizationRequest,\n) => void {\n  return (request) => {\n    if (request.reference.kind !== AUDIT_RECORD_KIND) return;\n    if (request.verb !== 'create') {\n      forbidden('AuditRecord resources are append-only');\n    }\n    const spec = request.proposedResource?.spec as AuditRecordSpec | undefined;\n    const attributes = spec?.attributes;\n    const attributeEntries = attributes &&\n        typeof attributes === 'object' &&\n        !Array.isArray(attributes)\n      ? Object.entries(attributes)\n      : [];\n    const data = spec?.data as Record<string, unknown> | undefined;\n    const expectedDataFields = data?.kind === 'audit'\n      ? ['kind', 'action', 'outcome', 'reasonCode']\n      : data?.kind === 'event'\n      ? ['kind', 'name', 'severity']\n      : data?.kind === 'metric'\n      ? ['kind', 'name', 'value', 'unit']\n      : data?.kind === 'trace'\n      ? ['kind', 'name', 'traceId', 'spanId', 'durationMs', 'status']\n      : [];\n    const dataMatchesKind = Boolean(\n      data &&\n        data.kind === spec?.recordKind &&\n        Object.keys(data).every((field) => expectedDataFields.includes(field)) &&\n        (\n          (data.kind === 'audit' &&\n            typeof data.action === 'string' &&\n            ['success', 'denied', 'failure'].includes(String(data.outcome))) ||\n          (data.kind === 'event' &&\n            typeof data.name === 'string' &&\n            ['debug', 'info', 'warning', 'error', 'critical'].includes(\n              String(data.severity),\n            )) ||\n          (data.kind === 'metric' &&\n            typeof data.name === 'string' &&\n            typeof data.value === 'number' &&\n            Number.isFinite(data.value) &&\n            typeof data.unit === 'string') ||\n          (data.kind === 'trace' &&\n            typeof data.name === 'string' &&\n            typeof data.traceId === 'string' &&\n            typeof data.spanId === 'string' &&\n            typeof data.durationMs === 'number' &&\n            Number.isFinite(data.durationMs) &&\n            data.durationMs >= 0 &&\n            ['ok', 'error'].includes(String(data.status)))\n        ),\n    );\n    if (\n      !spec ||\n      Object.keys(spec).some((field) => !SPEC_FIELDS.has(field)) ||\n      spec.actor?.id !== request.actor.id ||\n      spec.actor?.kind !== request.actor.kind ||\n      !spec.stream ||\n      spec.stream.length > 128 ||\n      !Number.isSafeInteger(spec.sequence) ||\n      spec.sequence < 1 ||\n      !spec.resourceUid ||\n      Number.isNaN(Date.parse(spec.receivedAt)) ||\n      !['audit', 'event', 'metric', 'trace'].includes(spec.recordKind) ||\n      !dataMatchesKind ||\n      Object.values(data ?? {}).some(\n        (value) => typeof value === 'string' && value.length > 256,\n      ) ||\n      !spec.provenance ||\n      !['controller', 'gateway', 'driver', 'worker', 'operator'].includes(\n        spec.provenance.source,\n      ) ||\n      !spec.provenance.producer ||\n      spec.provenance.producer.length > 256 ||\n      (spec.provenance.subject !== undefined &&\n        (\n          typeof spec.provenance.subject !== 'string' ||\n          !spec.provenance.subject ||\n          spec.provenance.subject.length > 256\n        )) ||\n      ![\n        'read',\n        'create',\n        'update',\n        'delete',\n        'execute',\n        'decision',\n        'security',\n      ].includes(spec.effect) ||\n      !attributes ||\n      typeof attributes !== 'object' ||\n      Array.isArray(attributes) ||\n      attributeEntries.length > 64 ||\n      attributeEntries.some(([key, value]) =>\n        !key ||\n        key.length > 64 ||\n        FORBIDDEN_ATTRIBUTE.test(key) ||\n        typeof value !== 'string' ||\n        value.length > 256 ||\n        containsSecrets({ [key]: value })\n      ) ||\n      !Number.isSafeInteger(spec.fencingEpoch) ||\n      spec.fencingEpoch < 1 ||\n      !SHA256.test(spec.policyDigest) ||\n      !SHA256.test(spec.capabilityDigest) ||\n      !SHA256.test(spec.recordDigest) ||\n      !SHA256.test(spec.requestFingerprint) ||\n      !SHA256.test(spec.idempotencyDigest) ||\n      (spec.previousDigest !== undefined && !SHA256.test(spec.previousDigest)) ||\n      request.reference.name !==\n        `audit-${spec.idempotencyDigest.slice('sha256:'.length, 62)}`\n    ) {\n      forbidden('AuditRecord creation evidence is invalid');\n    }\n  };\n}\n","import { OrchestrationError } from '../errors.js';\nimport { base64UrlDecode, base64UrlEncode, type ModelHandleSigner } from './modelAccessHandle.js';\n\n/**\n * CredentialGrant broker contract (plan 24.46).\n *\n * Generalizes the ModelAccessHandle pattern to arbitrary scoped credentials\n * (tool operations, SSH, cloud APIs, model access). Every grant is bound to\n * Run/attempt/worker key/target/method/audience/policy digest/expiry, and the\n * broker records exposure and post-task rotation requirements. Grants resolve\n * to opaque handles; raw secret material never appears here — the broker only\n * signs and verifies scoped claims.\n */\n\nexport interface CredentialGrantScope {\n  runRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n    uid: string;\n  };\n  attempt: number;\n  /** Fingerprint of the worker's ephemeral public key (proof-of-possession binding). */\n  workerKey: string;\n  target: string;\n  method: string;\n  audience: string;\n  policyDigest: string;\n}\n\nexport interface CredentialGrantProof {\n  /** Broker-issued, one-time challenge identifier. */\n  challengeId: string;\n  signature: Uint8Array;\n}\n\nexport interface CredentialProofVerifier {\n  /** Verify the worker signature and atomically consume the challenge. */\n  verifyAndConsume(request: {\n    workerKey: string;\n    grantId: string;\n    audience: string;\n    proof: CredentialGrantProof;\n  }): Promise<boolean>;\n}\n\nexport interface CredentialGrantVerification extends CredentialGrantScope {\n  proof: CredentialGrantProof;\n}\n\nexport interface CredentialGrantClaims extends CredentialGrantScope {\n  grantId: string;\n  issuedAt: string;\n  expiresAt: string;\n  renewedAt?: string;\n}\n\nexport interface CredentialGrantHandle {\n  /** Opaque token presented to the target driver. */\n  token: string;\n  claims: CredentialGrantClaims;\n}\n\nexport interface CredentialGrantInspection {\n  grantId: string;\n  scope: CredentialGrantScope;\n  issuedAt: string;\n  expiresAt: string;\n  revoked: boolean;\n  expired: boolean;\n  /** Exposure assessment used to decide post-task rotation. */\n  exposure: 'none' | 'worker-visible' | 'potentially-exposed';\n  rotationRequired: boolean;\n  rotationReason?: string;\n}\n\nexport interface IssueCredentialGrantRequest extends CredentialGrantScope {\n  grantId?: string;\n  ttlMs?: number;\n}\n\nexport interface CredentialBrokerDriver {\n  issue(request: IssueCredentialGrantRequest): Promise<CredentialGrantHandle>;\n  /** Renew an unexpired, unrevoked grant; returns a new token with a fresh expiry. */\n  renew(token: string, options?: { ttlMs?: number; now?: () => Date }): Promise<CredentialGrantHandle>;\n  revoke(grantId: string): void;\n  inspect(token: string): Promise<CredentialGrantInspection>;\n  /** Verify the token's entire scope and the worker's proof of possession. */\n  verify(token: string, requirements: CredentialGrantVerification): Promise<CredentialGrantClaims>;\n}\n\nconst TOKEN_PREFIX = 'mlcg1';\nconst DEFAULT_TTL_MS = 15 * 60 * 1000;\nconst MAX_TTL_MS = 60 * 60 * 1000;\n\nexport interface InMemoryCredentialBrokerOptions {\n  signer: ModelHandleSigner;\n  proofVerifier: CredentialProofVerifier;\n  defaultTtlMs?: number;\n  maxTtlMs?: number;\n  now?: () => Date;\n}\n\nlet grantCounter = 0;\n\nexport function createInMemoryCredentialBroker(options: InMemoryCredentialBrokerOptions): CredentialBrokerDriver {\n  const now = options.now ?? (() => new Date());\n  const defaultTtl = options.defaultTtlMs ?? DEFAULT_TTL_MS;\n  const maxTtl = options.maxTtlMs ?? MAX_TTL_MS;\n  const encoder = new TextEncoder();\n  const decoder = new TextDecoder();\n  const revoked = new Set<string>();\n  /** Grants issued to workers are worker-visible and need rotation after the task. */\n  const workerVisible = new Set<string>();\n\n  function assertScope(request: CredentialGrantScope): void {\n    if (!request.runRef.uid || !request.runRef.name || !request.runRef.apiVersion || !request.runRef.kind) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant Run identity is required', retryable: false });\n    }\n    if (!Number.isInteger(request.attempt) || request.attempt < 1) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant attempt must be a positive integer', retryable: false });\n    }\n    if (!request.workerKey) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant worker key is required', retryable: false });\n    }\n    if (!request.target) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant target is required', retryable: false });\n    }\n    if (!request.method) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant method is required', retryable: false });\n    }\n    if (!request.audience) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant audience is required', retryable: false });\n    }\n    if (!request.policyDigest) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant policy digest is required', retryable: false });\n    }\n  }\n\n  async function sign(claims: CredentialGrantClaims): Promise<CredentialGrantHandle> {\n    const payload = encoder.encode(JSON.stringify(claims));\n    const signature = await options.signer.sign(payload);\n    return { token: `${TOKEN_PREFIX}.${base64UrlEncode(payload)}.${base64UrlEncode(signature)}`, claims };\n  }\n\n  async function parseAndVerify(token: string): Promise<CredentialGrantClaims> {\n    const parts = token.split('.');\n    if (parts.length !== 3 || parts[0] !== TOKEN_PREFIX) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'malformed credential grant', retryable: false });\n    }\n    const payload = base64UrlDecode(parts[1]);\n    const signature = base64UrlDecode(parts[2]);\n    if (!(await options.signer.verify(payload, signature))) {\n      throw new OrchestrationError({ code: 'FORBIDDEN', message: 'credential grant signature invalid', retryable: false });\n    }\n    let claims: CredentialGrantClaims;\n    try {\n      claims = JSON.parse(decoder.decode(payload)) as CredentialGrantClaims;\n    } catch {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant payload invalid', retryable: false });\n    }\n    return claims;\n  }\n\n  function assertUsable(claims: CredentialGrantClaims, at: Date): void {\n    if (revoked.has(claims.grantId)) {\n      throw new OrchestrationError({ code: 'FORBIDDEN', message: 'credential grant revoked', retryable: false, details: { grantId: claims.grantId } });\n    }\n    if (at.getTime() >= Date.parse(claims.expiresAt)) {\n      throw new OrchestrationError({ code: 'TIMEOUT', message: 'credential grant expired', retryable: false, details: { expiresAt: claims.expiresAt } });\n    }\n  }\n\n  return {\n    async issue(request) {\n      assertScope(request);\n      const issuedAt = now();\n      const ttl = Math.min(request.ttlMs ?? defaultTtl, maxTtl);\n      if (ttl <= 0) {\n        throw new OrchestrationError({ code: 'INVALID', message: 'credential grant ttl must be positive', retryable: false });\n      }\n      grantCounter += 1;\n      const claims: CredentialGrantClaims = {\n        grantId: request.grantId ?? `mlcg-${issuedAt.getTime().toString(36)}-${grantCounter.toString(36)}`,\n        runRef: request.runRef,\n        attempt: request.attempt,\n        workerKey: request.workerKey,\n        target: request.target,\n        method: request.method,\n        audience: request.audience,\n        policyDigest: request.policyDigest,\n        issuedAt: issuedAt.toISOString(),\n        expiresAt: new Date(issuedAt.getTime() + ttl).toISOString(),\n      };\n      workerVisible.add(claims.grantId);\n      return sign(claims);\n    },\n\n    async renew(token, renewOptions = {}) {\n      const claims = await parseAndVerify(token);\n      assertUsable(claims, renewOptions.now?.() ?? now());\n      const renewedAt = renewOptions.now?.() ?? now();\n      const ttl = Math.min(renewOptions.ttlMs ?? defaultTtl, maxTtl);\n      return sign({\n        ...claims,\n        renewedAt: renewedAt.toISOString(),\n        expiresAt: new Date(renewedAt.getTime() + ttl).toISOString(),\n      });\n    },\n\n    revoke(grantId) {\n      revoked.add(grantId);\n    },\n\n    async inspect(token) {\n      const claims = await parseAndVerify(token);\n      const expired = now().getTime() >= Date.parse(claims.expiresAt);\n      const isRevoked = revoked.has(claims.grantId);\n      const exposure = workerVisible.has(claims.grantId) ? 'worker-visible' : 'none';\n      return {\n        grantId: claims.grantId,\n        scope: {\n          runRef: claims.runRef,\n          attempt: claims.attempt,\n          workerKey: claims.workerKey,\n          target: claims.target,\n          method: claims.method,\n          audience: claims.audience,\n          policyDigest: claims.policyDigest,\n        },\n        issuedAt: claims.issuedAt,\n        expiresAt: claims.expiresAt,\n        revoked: isRevoked,\n        expired,\n        exposure,\n        rotationRequired: exposure !== 'none' || isRevoked,\n        ...(exposure !== 'none' ? { rotationReason: 'grant was visible to a worker; rotate the underlying credential after the task' } : {}),\n      };\n    },\n\n    async verify(token, requirements) {\n      const claims = await parseAndVerify(token);\n      assertUsable(claims, now());\n      if (\n        claims.runRef.apiVersion !== requirements.runRef.apiVersion ||\n        claims.runRef.kind !== requirements.runRef.kind ||\n        claims.runRef.name !== requirements.runRef.name ||\n        claims.runRef.uid !== requirements.runRef.uid ||\n        claims.attempt !== requirements.attempt ||\n        claims.policyDigest !== requirements.policyDigest\n      ) {\n        throw new OrchestrationError({ code: 'FORBIDDEN', message: 'credential grant Run or policy scope mismatch', retryable: false });\n      }\n      if (claims.target !== requirements.target) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: `credential grant target mismatch: expected '${requirements.target}'`,\n          retryable: false,\n        });\n      }\n      if (claims.method !== requirements.method) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: `credential grant method mismatch: expected '${requirements.method}'`,\n          retryable: false,\n        });\n      }\n      if (claims.audience !== requirements.audience) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: `credential grant audience mismatch: expected '${requirements.audience}'`,\n          retryable: false,\n        });\n      }\n      if (claims.workerKey !== requirements.workerKey) {\n        throw new OrchestrationError({ code: 'FORBIDDEN', message: 'credential grant worker key mismatch', retryable: false });\n      }\n      if (\n        !(await options.proofVerifier.verifyAndConsume({\n          workerKey: claims.workerKey,\n          grantId: claims.grantId,\n          audience: claims.audience,\n          proof: requirements.proof,\n        }))\n      ) {\n        throw new OrchestrationError({ code: 'FORBIDDEN', message: 'credential grant proof of possession invalid', retryable: false });\n      }\n      return claims;\n    },\n  };\n}\n","import type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport type { WorkerEnrollmentResource, WorkerSessionResource } from './workerIdentity.js';\nimport { isWorkerSessionValid, WORKER_ENROLLMENT_API_VERSION, WORKER_ENROLLMENT_KIND, WORKER_SESSION_API_VERSION, WORKER_SESSION_KIND } from './workerIdentity.js';\n\nexport type IdentityRevocationReason = 'security-incident' | 'credential-rotation' | 'policy-violation' | 'manual';\n\nexport interface IdentityRevocationRecord {\n  enrollmentName: string;\n  sessionNames: string[];\n  reason: IdentityRevocationReason;\n  revokedBy: string;\n  revokedAt: string;\n  evidence?: string;\n}\n\nexport interface IdentityPromotionRequest {\n  /** The quarantine enrollment to promote from. */\n  sourceEnrollmentName: string;\n  /** New trust class for the promoted identity. */\n  targetTrustClass: 'trusted' | 'restricted';\n  /** Evidence from trusted verification (e.g. reimage attestation). */\n  verificationEvidence: string;\n  /** Verifier actor ID that performed the verification. */\n  verifiedBy: string;\n  /** Approval actor ID that authorized the promotion. */\n  approvedBy: string;\n}\n\n/**\n * Permanently revoke a quarantine identity and all its sessions.\n * Once revoked, the identity cannot be re-enabled; promotion requires\n * creating a new enrollment through trusted verification.\n */\nexport async function revokeQuarantineIdentity(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  enrollmentName: string,\n  reason: IdentityRevocationReason,\n  evidence?: string,\n  now: () => Date = () => new Date(),\n): Promise<IdentityRevocationRecord> {\n  if (actor.kind !== 'controller' && actor.kind !== 'admin') {\n    throw new Error('Identity revocation requires controller or admin actor');\n  }\n\n  // Get the enrollment.\n  const enrollment = await store.get({\n    apiVersion: WORKER_ENROLLMENT_API_VERSION,\n    kind: WORKER_ENROLLMENT_KIND,\n    name: enrollmentName,\n  }) as WorkerEnrollmentResource | null;\n\n  if (!enrollment) {\n    throw new Error(`WorkerEnrollment ${enrollmentName} not found`);\n  }\n\n  // Only quarantine identities can be permanently revoked through this path.\n  if (enrollment.spec.trustClass !== 'quarantine') {\n    throw new Error(\n      `Only quarantine identities can be permanently revoked; ${enrollmentName} has trust class ${enrollment.spec.trustClass}`,\n    );\n  }\n\n  // Find all active sessions for this enrollment.\n  const sessions = await store.list({\n    kind: WORKER_SESSION_KIND,\n  });\n  const currentTime = now();\n  const activeSessions = (sessions.items as unknown as WorkerSessionResource[]).filter(\n    (session) =>\n      session.spec.enrollmentRef.name === enrollmentName &&\n      isWorkerSessionValid(session, currentTime),\n  );\n\n  // Revoke all active sessions.\n  const revokedAt = now().toISOString();\n  for (const session of activeSessions) {\n    await store.updateStatus(\n      actor,\n      { apiVersion: WORKER_SESSION_API_VERSION, kind: WORKER_SESSION_KIND, name: session.metadata.name },\n      {\n        phase: 'Revoked',\n        revokedAt,\n        revokeReason: `enrollment revoked: ${reason}`,\n      },\n      { resourceVersion: session.metadata.resourceVersion },\n    );\n  }\n\n  // Mark the enrollment itself as revoked.\n  await store.updateStatus(\n    actor,\n    { apiVersion: WORKER_ENROLLMENT_API_VERSION, kind: WORKER_ENROLLMENT_KIND, name: enrollmentName },\n    {\n      phase: 'Revoked',\n      revokedAt,\n      revokeReason: reason,\n    },\n    { resourceVersion: enrollment.metadata.resourceVersion },\n  );\n\n  return {\n    enrollmentName,\n    sessionNames: activeSessions.map((session) => session.metadata.name),\n    reason,\n    revokedBy: actor.id,\n    revokedAt,\n    evidence,\n  };\n}\n\n/**\n * Promote a quarantine identity to a new ordinary identity after trusted\n * verification. The old quarantine enrollment is permanently revoked, and a\n * new enrollment is created with the target trust class.\n */\nexport async function promoteIdentity(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  request: IdentityPromotionRequest,\n  now: () => Date = () => new Date(),\n): Promise<WorkerEnrollmentResource> {\n  if (actor.kind !== 'controller' && actor.kind !== 'admin') {\n    throw new Error('Identity promotion requires controller or admin actor');\n  }\n\n  // Get the source enrollment.\n  const source = await store.get({\n    apiVersion: WORKER_ENROLLMENT_API_VERSION,\n    kind: WORKER_ENROLLMENT_KIND,\n    name: request.sourceEnrollmentName,\n  }) as WorkerEnrollmentResource | null;\n\n  if (!source) {\n    throw new Error(`WorkerEnrollment ${request.sourceEnrollmentName} not found`);\n  }\n\n  if (source.spec.trustClass !== 'quarantine') {\n    throw new Error(\n      `Only quarantine identities can be promoted; ${request.sourceEnrollmentName} has trust class ${source.spec.trustClass}`,\n    );\n  }\n\n  // Permanently revoke the old quarantine identity.\n  await revokeQuarantineIdentity(\n    store,\n    actor,\n    request.sourceEnrollmentName,\n    'security-incident',\n    `promoted to new identity with evidence: ${request.verificationEvidence}`,\n    now,\n  );\n\n  // Create a new enrollment with the target trust class.\n  const newEnrollmentName = `${request.sourceEnrollmentName}-promoted-${Date.now()}`;\n  const manifest = {\n    apiVersion: WORKER_ENROLLMENT_API_VERSION,\n    kind: WORKER_ENROLLMENT_KIND,\n    metadata: { name: newEnrollmentName },\n    spec: {\n      nodeRef: source.spec.nodeRef,\n      trustClass: request.targetTrustClass,\n      bootstrapTokenHash: source.spec.bootstrapTokenHash,\n      enrolledBy: request.approvedBy,\n      expiresAt: new Date(now().getTime() + 24 * 60 * 60 * 1000).toISOString(),\n    },\n  };\n\n  const resource = await store.create(actor, manifest);\n  return resource as WorkerEnrollmentResource;\n}\n\n/**\n * Check whether an identity is permanently revoked.\n */\nexport async function isIdentityRevoked(\n  store: ControlStore,\n  enrollmentName: string,\n): Promise<boolean> {\n  const enrollment = await store.get({\n    apiVersion: WORKER_ENROLLMENT_API_VERSION,\n    kind: WORKER_ENROLLMENT_KIND,\n    name: enrollmentName,\n  }) as WorkerEnrollmentResource | null;\n\n  return enrollment?.status?.phase === 'Revoked';\n}\n","import type { ControlStoreAuthorizationRequest } from '../controlStore.js';\nimport type { NodeTrustClass } from '../resources.js';\n\nexport const NODE_API_VERSION = 'memeloop/v1';\nexport const NODE_KIND = 'Node';\n\nexport interface NodeSpec {\n  nodeId: string;\n  faultDomain: string;\n  capacity?: {\n    cpuMillicores?: number;\n    memoryBytes?: number;\n    gpuCount?: number;\n  };\n  labels?: Record<string, string>;\n}\n\nexport interface NodeStatus {\n  trustClass: NodeTrustClass;\n  trustEvidence?: string;\n  trustVerifiedBy?: string;\n  trustVerifiedAt?: string;\n  conditions?: Array<{\n    type: string;\n    status: 'True' | 'False' | 'Unknown';\n    reason: string;\n    lastTransitionTime: string;\n  }>;\n}\n\n/**\n * Roles that a restricted or quarantine node must never hold.\n */\nconst FORBIDDEN_ROLES_FOR_UNTRUSTED = new Set([\n  'controller',\n  'voter',\n  'scheduler',\n  'plugin-host',\n  'control-store-client',\n  'storage-replica',\n]);\n\n/**\n * Create a ControlStore authorizer that enforces immutable Node trust admission.\n *\n * Rules:\n * 1. Node trustClass can only be set at creation time in spec.\n * 2. After creation, trustClass can only be changed by a verifier actor\n *    providing signed evidence, and only through status updates.\n * 3. A node cannot modify its own trustClass.\n * 4. Restricted/quarantine nodes cannot acquire leases for forbidden roles.\n * 5. Any attempt to use a self-report or label update to change trustClass\n *    is rejected.\n */\nexport function createNodeTrustAuthorizer(): (request: ControlStoreAuthorizationRequest) => void {\n  return (request: ControlStoreAuthorizationRequest) => {\n    if (request.reference.kind !== NODE_KIND) return;\n\n    const { actor, verb, current, proposedStatus } = request;\n\n    // Rule: only allow create, update-status, delete for Node resources.\n    if (verb === 'create') {\n      // At creation, trustClass must be explicitly set in spec.\n      // This is checked by the caller; the authorizer just ensures the\n      // resource kind is Node.\n      return;\n    }\n\n    if (verb === 'update-status' && current && proposedStatus) {\n      const currentStatus = current.status as NodeStatus | undefined;\n      const proposedNodeStatus = proposedStatus as NodeStatus;\n\n      // If trustClass is not changing, allow.\n      if (currentStatus?.trustClass === proposedNodeStatus.trustClass) {\n        return;\n      }\n\n      // Trust class is changing. Only verifier actors may change it.\n      if (actor.kind !== 'verifier') {\n        throw new Error(\n          `Node trust class can only be changed by verifier actors, not ${actor.kind}`,\n        );\n      }\n\n      // The verifier must provide evidence.\n      if (!proposedNodeStatus.trustEvidence || proposedNodeStatus.trustEvidence.length === 0) {\n        throw new Error('Node trust class change requires trustEvidence');\n      }\n\n      // The verifier must record its identity.\n      if (!proposedNodeStatus.trustVerifiedBy || proposedNodeStatus.trustVerifiedBy !== actor.id) {\n        throw new Error(\n          `Node trust class change must record trustVerifiedBy matching the actor id ${actor.id}`,\n        );\n      }\n\n      return;\n    }\n\n    if (verb === 'acquire-lease' || verb === 'renew-lease') {\n      // Restricted/quarantine nodes cannot hold forbidden roles.\n      // The lease name encodes the role, e.g. \"controller/storage\" or \"scheduler/main\".\n      const leaseName = request.reference.name ?? '';\n      const nodeTrust = (current?.status as NodeStatus | undefined)?.trustClass;\n      if (nodeTrust === 'restricted' || nodeTrust === 'quarantine') {\n        for (const role of FORBIDDEN_ROLES_FOR_UNTRUSTED) {\n          if (leaseName.startsWith(role)) {\n            throw new Error(\n              `Node with trust class ${nodeTrust} cannot acquire lease for forbidden role ${role}`,\n            );\n          }\n        }\n      }\n      return;\n    }\n  };\n}\n\n/**\n * Validate that a Node resource's spec does not attempt to self-assert\n * trust status through labels or annotations.\n */\nexport function validateNodeSpec(spec: NodeSpec): void {\n  if (spec.labels) {\n    const forbiddenLabels = ['trust-class', 'trustClass', 'node-trust'];\n    for (const label of forbiddenLabels) {\n      if (label in spec.labels) {\n        throw new Error(\n          `Node spec cannot self-assert trust through label ${label}; trust is managed through status by verifier actors`,\n        );\n      }\n    }\n  }\n}\n\n/**\n * Check whether a node with the given trust class is allowed to perform\n * a sensitive role. This is a pure function for use by schedulers and\n * admission controllers outside the ControlStore authorizer.\n */\nexport function isNodeAllowedForRole(trustClass: NodeTrustClass, role: string): boolean {\n  if (trustClass === 'trusted') return true;\n  return !FORBIDDEN_ROLES_FOR_UNTRUSTED.has(role);\n}\n","import type { ControlStoreAuthorizationRequest } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport { POLICY_DECISION_KIND, type PolicyDecisionResource, type PolicyDecisionSpec, type PolicyDecisionStatus } from '../resources.js';\n\nfunction forbidden(message: string): never {\n  throw new OrchestrationError({\n    code: 'FORBIDDEN',\n    message,\n    retryable: false,\n  });\n}\n\n/**\n * Protect durable PolicyDecision evidence in the same ControlStore\n * transaction as its write. Decisions are create-only; only an authenticated\n * admin may resolve the status of a pending approval.\n */\nexport function createPolicyDecisionAuthorizer(): (\n  request: ControlStoreAuthorizationRequest,\n) => void {\n  return (request) => {\n    if (request.reference.kind !== POLICY_DECISION_KIND) return;\n\n    if (request.verb === 'create') {\n      const spec = request.proposedResource?.spec as\n        | PolicyDecisionSpec\n        | undefined;\n      if (\n        !spec ||\n        spec.requestedBy !== request.actor.id ||\n        (\n          spec.decisionKind === 'transition'\n            ? request.actor.kind !== 'verifier'\n            : request.actor.kind !== 'controller' &&\n              request.actor.kind !== 'admin'\n        ) ||\n        (\n          spec.decisionKind === 'approval' &&\n          spec.initialOutcome !== 'pending'\n        ) ||\n        (\n          spec.decisionKind !== 'approval' &&\n          spec.initialOutcome === 'pending'\n        )\n      ) {\n        forbidden('PolicyDecision creation actor or initial outcome is invalid');\n      }\n      return;\n    }\n\n    if (request.verb === 'update-status') {\n      const current = request.current as PolicyDecisionResource | undefined;\n      const proposed = request.proposedStatus as\n        | PolicyDecisionStatus\n        | undefined;\n      if (\n        !current ||\n        current.spec.decisionKind !== 'approval' ||\n        current.spec.initialOutcome !== 'pending' ||\n        request.actor.kind !== 'admin' ||\n        !proposed ||\n        (proposed.outcome !== 'allow' && proposed.outcome !== 'deny') ||\n        proposed.decidedBy !== request.actor.id ||\n        !proposed.decidedAt ||\n        !proposed.resolutionInputDigest ||\n        !Array.isArray(proposed.reasons) ||\n        proposed.reasons.length !== 1\n      ) {\n        forbidden(\n          'only an authenticated admin may resolve a pending PolicyDecision approval',\n        );\n      }\n      const currentStatus = current.status;\n      if (\n        currentStatus &&\n        (\n          currentStatus.outcome !== proposed.outcome ||\n          currentStatus.decidedBy !== proposed.decidedBy ||\n          currentStatus.decidedAt !== proposed.decidedAt ||\n          currentStatus.resolutionInputDigest !==\n            proposed.resolutionInputDigest ||\n          currentStatus.reasons[0] !== proposed.reasons[0]\n        )\n      ) {\n        forbidden('PolicyDecision approval resolution is immutable');\n      }\n      return;\n    }\n\n    forbidden('PolicyDecision resources cannot be applied, deleted, or leased');\n  };\n}\n","import type { OrchestrationErrorData } from '../errors.js';\n\n/**\n * Quarantine gateway request mediation (plan 24.40).\n *\n * All checks run on the trusted gateway side, outside worker control. The\n * gateway is the worker's only network endpoint — it never receives ordinary\n * peer topology, sync, or device-directory access through this channel. Every\n * outbound request is validated for method, scheme, port, host allowlist,\n * SSRF (literal and DNS-resolved private addresses), redirect targets, body\n * size, per-method limits, and per-worker rate limits; revoked workers are\n * rejected before any validation.\n */\n\nexport interface QuarantineGatewayPolicy {\n  /** Allowed HTTP methods (default GET/HEAD/POST). */\n  allowedMethods?: string[];\n  /** Allowed URL schemes (default ['https']). */\n  allowedSchemes?: string[];\n  /** Allowed ports (default [443]). */\n  allowedPorts?: number[];\n  /** Hostname suffix allowlist; when set, only matching hosts pass. */\n  allowedHosts?: string[];\n  /** Allow private/loopback/link-local targets (default false — SSRF blocked). */\n  allowPrivateNetworks?: boolean;\n  /** Maximum followed redirects, each re-validated (default 0). */\n  maxRedirects?: number;\n  /** Global request body cap in bytes (default 1 MiB). */\n  maxBodyBytes?: number;\n  /** Per-method overrides. */\n  methodLimits?: Record<string, {\n    maxBodyBytes?: number;\n    requestsPerMinute?: number;\n  }>;\n  /** Default per-worker+method rate limit (default 60/minute). */\n  defaultRateLimitPerMinute?: number;\n  /** Response body cap in bytes for the executor (default 8 MiB). */\n  maxResponseBytes?: number;\n}\n\nexport interface GatewayHttpRequest {\n  workerId: string;\n  method: string;\n  url: string;\n  /** Declared request body size in bytes (0/undefined for bodyless). */\n  bodyBytes?: number;\n}\n\nexport interface GatewayValidationContext {\n  /** Injected DNS resolver returning IP literals for a hostname. */\n  resolveHostname?: (hostname: string) => Promise<string[]>;\n  /** Trusted revocation check for worker sessions. */\n  isRevoked?: (workerId: string) => boolean;\n  /** Rate limiter state; one shared limiter per gateway. */\n  rateLimiter?: GatewayRateLimiter;\n  now?: () => number;\n}\n\nexport type GatewayValidationResult =\n  | { ok: true; normalizedUrl: string; hostname: string; addresses: string[] }\n  | { ok: false; error: OrchestrationErrorData };\n\nfunction denied(code: OrchestrationErrorData['code'], message: string, details?: Record<string, unknown>): GatewayValidationResult {\n  return { ok: false, error: { code, message, retryable: code === 'EXHAUSTED' || code === 'UNAVAILABLE', ...(details ? { details } : {}) } };\n}\n\nconst IPV4_PATTERN = /^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/;\n\n/** True when the IP literal is loopback, private, link-local, or otherwise non-public. */\nexport function isPrivateIp(address: string): boolean {\n  const v4 = IPV4_PATTERN.exec(address);\n  if (v4) {\n    const [a, b] = [Number(v4[1]), Number(v4[2])];\n    if (a > 255 || b > 255) return true;\n    if (a === 0 || a === 10 || a === 127) return true;\n    if (a === 169 && b === 254) return true;\n    if (a === 172 && b >= 16 && b <= 31) return true;\n    if (a === 192 && b === 168) return true;\n    if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT\n    if (a >= 224) return true; // multicast/reserved/broadcast\n    return false;\n  }\n  const normalized = address.toLowerCase().replace(/^\\[|\\]$/g, '');\n  if (normalized === '::1' || normalized === '::') return true;\n  if (normalized.startsWith('fe80:')) return true;\n  if (normalized.startsWith('fc') || normalized.startsWith('fd')) return true;\n  if (normalized.startsWith('::ffff:')) {\n    // IPv4-mapped IPv6; URL parsers may normalize the dotted quad to hex.\n    const rest = normalized.slice('::ffff:'.length);\n    if (IPV4_PATTERN.test(rest)) return isPrivateIp(rest);\n    const groups = rest.split(':');\n    if (groups.length === 2) {\n      const hi = Number.parseInt(groups[0], 16);\n      const lo = Number.parseInt(groups[1], 16);\n      if (!Number.isNaN(hi) && !Number.isNaN(lo)) {\n        return isPrivateIp(`${(hi >> 8) & 255}.${hi & 255}.${(lo >> 8) & 255}.${lo & 255}`);\n      }\n    }\n    // Unparseable mapped form — fail closed.\n    return true;\n  }\n  return false;\n}\n\nfunction isIpLiteral(hostname: string): boolean {\n  return IPV4_PATTERN.test(hostname) || hostname.includes(':');\n}\n\nfunction hostMatchesAllowlist(hostname: string, allowlist: string[]): boolean {\n  const lower = hostname.toLowerCase();\n  return allowlist.some((entry) => {\n    const suffix = entry.toLowerCase();\n    return lower === suffix || lower.endsWith(`.${suffix}`);\n  });\n}\n\nexport interface GatewayRateLimiter {\n  /** True when the request is within budget; false when limited. */\n  consume(key: string, perMinute: number): boolean;\n}\n\n/** Token-bucket rate limiter with an injectable clock (trusted-side state). */\nexport function createGatewayRateLimiter(now: () => number = () => Date.now()): GatewayRateLimiter {\n  const buckets = new Map<string, { tokens: number; refilledAt: number }>();\n  return {\n    consume(key, perMinute) {\n      if (perMinute <= 0) return false;\n      const at = now();\n      const bucket = buckets.get(key) ?? { tokens: perMinute, refilledAt: at };\n      const elapsedMinutes = Math.max(0, (at - bucket.refilledAt) / 60_000);\n      const tokens = Math.min(perMinute, bucket.tokens + elapsedMinutes * perMinute);\n      if (tokens < 1) {\n        buckets.set(key, { tokens, refilledAt: at });\n        return false;\n      }\n      buckets.set(key, { tokens: tokens - 1, refilledAt: at });\n      return true;\n    },\n  };\n}\n\n/** Revocation list for quarantine worker sessions (trusted-side state). */\nexport function createWorkerRevocationList(): { revoke(workerId: string): void; isRevoked(workerId: string): boolean } {\n  const revoked = new Set<string>();\n  return {\n    revoke(workerId) {\n      revoked.add(workerId);\n    },\n    isRevoked(workerId) {\n      return revoked.has(workerId);\n    },\n  };\n}\n\nconst DEFAULT_METHODS = ['GET', 'HEAD', 'POST'];\nconst DEFAULT_SCHEMES = ['https'];\nconst DEFAULT_PORTS = [443];\nconst DEFAULT_MAX_BODY = 1024 * 1024;\nconst DEFAULT_RATE_PER_MINUTE = 60;\n\n/**\n * Validate one gateway request. Order matters: revocation first, then cheap\n * syntactic checks, then SSRF (literal before DNS), then rate limits, so a\n * revoked or malformed request never costs a DNS lookup.\n */\nexport async function validateGatewayRequest(\n  request: GatewayHttpRequest,\n  policy: QuarantineGatewayPolicy,\n  context: GatewayValidationContext = {},\n): Promise<GatewayValidationResult> {\n  if (context.isRevoked?.(request.workerId)) {\n    return denied('FORBIDDEN', `worker '${request.workerId}' is revoked`);\n  }\n\n  const method = request.method.toUpperCase();\n  const allowedMethods = policy.allowedMethods ?? DEFAULT_METHODS;\n  if (!allowedMethods.includes(method)) {\n    return denied('FORBIDDEN', `method '${method}' is not allowed`, { allowedMethods });\n  }\n\n  let url: URL;\n  try {\n    url = new URL(request.url);\n  } catch {\n    return denied('INVALID', `url '${request.url}' cannot be parsed`);\n  }\n\n  const scheme = url.protocol.replace(/:$/, '').toLowerCase();\n  const allowedSchemes = policy.allowedSchemes ?? DEFAULT_SCHEMES;\n  if (!allowedSchemes.includes(scheme)) {\n    return denied('FORBIDDEN', `scheme '${scheme}' is not allowed`, { allowedSchemes });\n  }\n\n  const port = url.port ? Number(url.port) : (scheme === 'https' ? 443 : 80);\n  const allowedPorts = policy.allowedPorts ?? DEFAULT_PORTS;\n  if (!allowedPorts.includes(port)) {\n    return denied('FORBIDDEN', `port ${port} is not allowed`, { allowedPorts });\n  }\n\n  const hostname = url.hostname.toLowerCase();\n  if (policy.allowedHosts && !hostMatchesAllowlist(hostname, policy.allowedHosts)) {\n    return denied('FORBIDDEN', `host '${hostname}' is not in the allowlist`);\n  }\n\n  let addresses: string[] = [];\n  if (isIpLiteral(hostname)) {\n    addresses = [hostname.replace(/^\\[|\\]$/g, '')];\n    if (!policy.allowPrivateNetworks && isPrivateIp(hostname)) {\n      return denied('FORBIDDEN', `target '${hostname}' is a private or non-public address`);\n    }\n  } else if (context.resolveHostname) {\n    try {\n      addresses = await context.resolveHostname(hostname);\n    } catch {\n      return denied('UNAVAILABLE', `hostname '${hostname}' could not be resolved`);\n    }\n    if (addresses.length === 0) {\n      return denied('UNAVAILABLE', `hostname '${hostname}' resolved to no addresses`);\n    }\n    if (!policy.allowPrivateNetworks) {\n      const privateAddress = addresses.find((address) => isPrivateIp(address));\n      if (privateAddress) {\n        return denied('FORBIDDEN', `hostname '${hostname}' resolves to private address ${privateAddress}`);\n      }\n    }\n  }\n\n  const methodLimit = policy.methodLimits?.[method];\n  const maxBody = methodLimit?.maxBodyBytes ?? policy.maxBodyBytes ?? DEFAULT_MAX_BODY;\n  if ((request.bodyBytes ?? 0) > maxBody) {\n    return denied('INVALID', `request body ${request.bodyBytes} bytes exceeds limit ${maxBody}`, { maxBodyBytes: maxBody });\n  }\n\n  const perMinute = methodLimit?.requestsPerMinute ?? policy.defaultRateLimitPerMinute ?? DEFAULT_RATE_PER_MINUTE;\n  const limiter = context.rateLimiter;\n  if (limiter && !limiter.consume(`${request.workerId}:${method}`, perMinute)) {\n    return denied('EXHAUSTED', `rate limit exceeded for worker '${request.workerId}' method '${method}'`, { requestsPerMinute: perMinute });\n  }\n\n  return { ok: true, normalizedUrl: url.toString(), hostname, addresses };\n}\n\n/** Validate a redirect target with the same policy; redirect chains are bounded by the caller. */\nexport async function validateRedirectTarget(\n  request: Omit<GatewayHttpRequest, 'method' | 'bodyBytes'> & { method?: string },\n  location: string,\n  policy: QuarantineGatewayPolicy,\n  context: GatewayValidationContext = {},\n): Promise<GatewayValidationResult> {\n  return validateGatewayRequest(\n    { workerId: request.workerId, method: request.method ?? 'GET', url: location, bodyBytes: 0 },\n    policy,\n    context,\n  );\n}\n","import { OrchestrationError, type OrchestrationErrorData } from '../errors.js';\n\n/**\n * Dedicated outbound worker protocol (plan §13).\n *\n * This protocol is deliberately smaller than ResourceClient. A worker can\n * interact only with its own assignment/run through method-specific gateway\n * handlers; it cannot list/watch control state, acquire leases, discover\n * peers, or mutate Node/verification/promotion resources.\n */\n\nexport const WORKER_PROTOCOL_VERSION = 'worker.memeloop.io/v1alpha1';\n\nexport const WORKER_PROTOCOL_METHODS = [\n  'assignment.pull',\n  'assignment.ack',\n  'session.heartbeat',\n  'event.submit',\n  'capability.request',\n  'artifact.upload',\n  'operation.complete',\n  'operation.fail',\n  'operation.cancel',\n] as const;\n\nexport type WorkerProtocolMethod = typeof WORKER_PROTOCOL_METHODS[number];\n\nexport interface WorkerRunBinding {\n  uid: string;\n  attempt: number;\n  epoch: number;\n}\n\nexport interface WorkerProtocolRequest {\n  apiVersion: typeof WORKER_PROTOCOL_VERSION;\n  requestId: string;\n  sessionName: string;\n  sequence: number;\n  nonce: string;\n  deadline: string;\n  audience: string;\n  run: WorkerRunBinding;\n  method: WorkerProtocolMethod;\n  target: string;\n  policyDigest: string;\n  payload: unknown;\n  /** Signature over canonicalWorkerProtocolRequestBytes(request). */\n  signature: string;\n}\n\nexport type WorkerProtocolResponse =\n  | {\n    apiVersion: typeof WORKER_PROTOCOL_VERSION;\n    requestId: string;\n    ok: true;\n    payload: unknown;\n    receivedAt: string;\n  }\n  | {\n    apiVersion: typeof WORKER_PROTOCOL_VERSION;\n    requestId: string;\n    ok: false;\n    error: OrchestrationErrorData;\n    receivedAt: string;\n  };\n\nexport interface WorkerBootstrapSessionDescriptor {\n  apiVersion: typeof WORKER_PROTOCOL_VERSION;\n  sessionName: string;\n  audience: string;\n  expiresAt: string;\n  run: WorkerRunBinding;\n  policyDigest: string;\n  allowedMethods: WorkerProtocolMethod[];\n  allowedTargets?: string[];\n  workerKeyFingerprint: string;\n  gatewayKeyFingerprint: string;\n  issuedAt: string;\n}\n\nexport interface SignedWorkerBootstrapSessionDescriptor extends WorkerBootstrapSessionDescriptor {\n  /** Gateway signature over canonicalWorkerBootstrapDescriptorBytes(...). */\n  gatewaySignature: string;\n}\n\nexport interface WorkerGatewaySession {\n  name: string;\n  workerKeyFingerprint: string;\n  workerPublicKey: string;\n  audience: string;\n  protocol: typeof WORKER_PROTOCOL_VERSION;\n  expiresAt: string;\n  revoked: boolean;\n  run: WorkerRunBinding;\n  policyDigest: string;\n  allowedMethods: WorkerProtocolMethod[];\n  allowedTargets?: string[];\n}\n\nexport interface WorkerProtocolReplayProtector {\n  /**\n   * Atomically accept exactly the next sequence and a fresh nonce.\n   * Production implementations must persist this state; returning false\n   * fails closed on replay, gaps, or uncertain state.\n   */\n  consume(sessionName: string, sequence: number, nonce: string): Promise<boolean>;\n}\n\nexport interface WorkerProtocolGatewayOptions {\n  resolveSession: (sessionName: string) => Promise<WorkerGatewaySession | undefined>;\n  replayProtector: WorkerProtocolReplayProtector;\n  verifySignature: (request: {\n    session: WorkerGatewaySession;\n    message: Uint8Array;\n    signature: string;\n  }) => Promise<boolean>;\n  dispatch: (request: {\n    requestId: string;\n    session: WorkerGatewaySession;\n    method: WorkerProtocolMethod;\n    target: string;\n    payload: unknown;\n    signal: AbortSignal;\n  }) => Promise<unknown>;\n  now?: () => Date;\n  maxClockSkewMs?: number;\n  maxRequestsPerMinute?: number;\n  methodPayloadLimits?: Partial<Record<WorkerProtocolMethod, number>>;\n  maxResponseBytes?: number;\n  onAudit?: (event: WorkerProtocolAuditEvent) => Promise<void> | void;\n  /** Trusted host diagnostics; never serialized to the worker response. */\n  onError?: (error: unknown) => void;\n}\n\nexport interface WorkerProtocolAuditEvent {\n  requestId: string;\n  sessionName: string;\n  method: string;\n  target: string;\n  /** Policy snapshot from the verified request/session binding. */\n  policyDigest: string;\n  accepted: boolean;\n  code?: OrchestrationErrorData['code'];\n  receivedAt: string;\n}\n\nconst DEFAULT_PAYLOAD_LIMITS: Record<WorkerProtocolMethod, number> = {\n  'assignment.pull': 1024,\n  'assignment.ack': 4096,\n  'session.heartbeat': 4096,\n  'event.submit': 64 * 1024,\n  'capability.request': 32 * 1024,\n  'artifact.upload': 1024 * 1024,\n  'operation.complete': 64 * 1024,\n  'operation.fail': 32 * 1024,\n  'operation.cancel': 4096,\n};\n\nconst DEFAULT_MAX_RESPONSE_BYTES = 1024 * 1024;\nconst DEFAULT_RATE_PER_MINUTE = 120;\nconst DEFAULT_MAX_CLOCK_SKEW_MS = 30_000;\nconst encoder = new TextEncoder();\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction canonicalize(value: unknown): string {\n  if (value === null || typeof value === 'boolean' || typeof value === 'string') return JSON.stringify(value);\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) throw new Error('non-finite number');\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) return `[${value.map(canonicalize).join(',')}]`;\n  if (isRecord(value)) {\n    const entries = Object.entries(value)\n      .filter(([, item]) => item !== undefined)\n      .sort(([left], [right]) => left.localeCompare(right))\n      .map(([key, item]) => `${JSON.stringify(key)}:${canonicalize(item)}`);\n    return `{${entries.join(',')}}`;\n  }\n  throw new Error('worker protocol values must be JSON-compatible');\n}\n\n/** Canonical bytes signed by the worker; excludes only the signature field. */\nexport function canonicalWorkerProtocolRequestBytes(\n  request: Omit<WorkerProtocolRequest, 'signature'> | WorkerProtocolRequest,\n): Uint8Array {\n  const { signature: _signature, ...unsigned } = request as WorkerProtocolRequest;\n  return encoder.encode(canonicalize(unsigned));\n}\n\n/** Canonical bytes signed by the pinned gateway after enrollment. */\nexport function canonicalWorkerBootstrapDescriptorBytes(\n  descriptor: WorkerBootstrapSessionDescriptor | SignedWorkerBootstrapSessionDescriptor,\n): Uint8Array {\n  const { gatewaySignature: _gatewaySignature, ...unsigned } = descriptor as SignedWorkerBootstrapSessionDescriptor;\n  return encoder.encode(canonicalize(unsigned));\n}\n\nfunction byteSize(value: unknown): number {\n  return encoder.encode(canonicalize(value)).byteLength;\n}\n\nfunction protocolError(\n  code: OrchestrationErrorData['code'],\n  message: string,\n  retryable = false,\n): OrchestrationError {\n  return new OrchestrationError({ code, message, retryable });\n}\n\nfunction validateShape(request: WorkerProtocolRequest): void {\n  if (request.apiVersion !== WORKER_PROTOCOL_VERSION) {\n    throw protocolError('UNSUPPORTED', `worker protocol '${String(request.apiVersion)}' is not supported`);\n  }\n  if (\n    !request.requestId ||\n    !request.sessionName ||\n    !Number.isSafeInteger(request.sequence) ||\n    request.sequence < 1 ||\n    !/^[A-Za-z0-9_-]{16,128}$/.test(request.nonce) ||\n    !request.audience ||\n    !request.target ||\n    !request.policyDigest ||\n    !request.signature\n  ) {\n    throw protocolError('INVALID', 'worker protocol request envelope is malformed');\n  }\n  if (\n    !request.run?.uid ||\n    !Number.isSafeInteger(request.run.attempt) ||\n    request.run.attempt < 1 ||\n    !Number.isSafeInteger(request.run.epoch) ||\n    request.run.epoch < 1\n  ) {\n    throw protocolError('INVALID', 'worker protocol Run binding is malformed');\n  }\n  if (!WORKER_PROTOCOL_METHODS.includes(request.method)) {\n    throw protocolError('FORBIDDEN', `worker protocol method '${request.method}' is not allowed`);\n  }\n}\n\nfunction sameRun(left: WorkerRunBinding, right: WorkerRunBinding): boolean {\n  return left.uid === right.uid && left.attempt === right.attempt && left.epoch === right.epoch;\n}\n\nfunction asError(error: unknown): OrchestrationErrorData {\n  if (error instanceof OrchestrationError) {\n    const publicMessage: Partial<Record<OrchestrationErrorData['code'], string>> = {\n      INVALID: 'worker gateway request is invalid',\n      FORBIDDEN: 'worker gateway request was denied',\n      NOT_FOUND: 'worker gateway target is unavailable',\n      UNSUPPORTED: 'worker gateway request is unsupported',\n      TIMEOUT: 'worker gateway request expired',\n      CONFLICT: 'worker gateway request conflicts with session state',\n      EXHAUSTED: 'worker gateway request exceeded a limit',\n      INTERNAL: 'worker gateway request failed',\n      UNAVAILABLE: 'worker gateway is unavailable',\n    };\n    return {\n      code: error.code,\n      message: publicMessage[error.code] ?? 'worker gateway request failed',\n      retryable: error.retryable,\n      ...(error.retryAfterMs !== undefined ? { retryAfterMs: error.retryAfterMs } : {}),\n    };\n  }\n  return { code: 'INTERNAL', message: 'worker gateway request failed', retryable: false };\n}\n\n/**\n * Create the trusted-side protocol gateway. Session resolution, signature\n * verification, replay state, and effects are all injected host ports.\n */\nexport function createWorkerProtocolGateway(options: WorkerProtocolGatewayOptions): {\n  handle(request: WorkerProtocolRequest, signal?: AbortSignal): Promise<WorkerProtocolResponse>;\n} {\n  const now = options.now ?? (() => new Date());\n  const maxClockSkewMs = options.maxClockSkewMs ?? DEFAULT_MAX_CLOCK_SKEW_MS;\n  const rateLimit = options.maxRequestsPerMinute ?? DEFAULT_RATE_PER_MINUTE;\n  const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;\n  const requestLog = new Map<string, number[]>();\n\n  async function audit(\n    request: Pick<WorkerProtocolRequest, 'requestId' | 'sessionName' | 'method' | 'target' | 'policyDigest'>,\n    accepted: boolean,\n    receivedAt: string,\n    code?: OrchestrationErrorData['code'],\n  ): Promise<void> {\n    try {\n      await options.onAudit?.({\n        requestId: request.requestId,\n        sessionName: request.sessionName,\n        method: request.method,\n        target: request.target,\n        policyDigest: request.policyDigest,\n        accepted,\n        ...(code ? { code } : {}),\n        receivedAt,\n      });\n    } catch {\n      // Audit storage failure must not leak request payloads or replace the\n      // original protocol result. Hosts should alert through their sink.\n    }\n  }\n\n  return {\n    async handle(request, signal = new AbortController().signal) {\n      const received = now();\n      const receivedAt = received.toISOString();\n      try {\n        validateShape(request);\n        const deadline = new Date(request.deadline);\n        if (!Number.isFinite(deadline.getTime()) || deadline.getTime() < received.getTime()) {\n          throw protocolError('TIMEOUT', 'worker protocol request deadline has expired');\n        }\n        if (deadline.getTime() - received.getTime() > maxClockSkewMs) {\n          throw protocolError('INVALID', 'worker protocol request deadline is outside the allowed window');\n        }\n        const payloadLimit = options.methodPayloadLimits?.[request.method] ?? DEFAULT_PAYLOAD_LIMITS[request.method];\n        if (byteSize(request.payload) > payloadLimit) {\n          throw protocolError('INVALID', `worker protocol payload exceeds ${payloadLimit} bytes`);\n        }\n\n        const session = await options.resolveSession(request.sessionName);\n        if (!session || session.revoked) throw protocolError('FORBIDDEN', 'worker session is unavailable or revoked');\n        if (session.protocol !== WORKER_PROTOCOL_VERSION) throw protocolError('UNSUPPORTED', 'worker session protocol is not supported');\n        if (new Date(session.expiresAt).getTime() <= received.getTime()) {\n          throw protocolError('TIMEOUT', 'worker session has expired');\n        }\n        if (\n          session.audience !== request.audience ||\n          session.policyDigest !== request.policyDigest ||\n          !sameRun(session.run, request.run)\n        ) {\n          throw protocolError('FORBIDDEN', 'worker request scope does not match its session');\n        }\n        if (!session.allowedMethods.includes(request.method)) {\n          throw protocolError('FORBIDDEN', `worker session does not allow '${request.method}'`);\n        }\n        if (session.allowedTargets && !session.allowedTargets.includes(request.target)) {\n          throw protocolError('FORBIDDEN', `worker session does not allow target '${request.target}'`);\n        }\n        if (\n          !await options.verifySignature({\n            session,\n            message: canonicalWorkerProtocolRequestBytes(request),\n            signature: request.signature,\n          })\n        ) {\n          throw protocolError('FORBIDDEN', 'worker request signature is invalid');\n        }\n        if (!await options.replayProtector.consume(session.name, request.sequence, request.nonce)) {\n          throw protocolError('CONFLICT', 'worker request sequence or nonce was already consumed');\n        }\n\n        const windowStart = received.getTime() - 60_000;\n        const log = (requestLog.get(session.name) ?? []).filter((time) => time >= windowStart);\n        if (log.length >= rateLimit) {\n          throw new OrchestrationError({\n            code: 'EXHAUSTED',\n            message: 'worker protocol session rate limit exceeded',\n            retryable: true,\n            retryAfterMs: Math.max(1, log[0] + 60_000 - received.getTime()),\n          });\n        }\n        log.push(received.getTime());\n        requestLog.set(session.name, log);\n\n        const payload = await options.dispatch({\n          requestId: request.requestId,\n          session,\n          method: request.method,\n          target: request.target,\n          payload: request.payload,\n          signal,\n        });\n        if (byteSize(payload) > maxResponseBytes) {\n          throw protocolError('EXHAUSTED', `worker protocol response exceeds ${maxResponseBytes} bytes`);\n        }\n        await audit(request, true, receivedAt);\n        return {\n          apiVersion: WORKER_PROTOCOL_VERSION,\n          requestId: request.requestId,\n          ok: true,\n          payload,\n          receivedAt,\n        };\n      } catch (error) {\n        options.onError?.(error);\n        const data = asError(error);\n        await audit(request, false, receivedAt, data.code);\n        return {\n          apiVersion: WORKER_PROTOCOL_VERSION,\n          requestId: typeof request?.requestId === 'string' ? request.requestId : '',\n          ok: false,\n          error: data,\n          receivedAt,\n        };\n      }\n    },\n  };\n}\n\n/** In-memory replay fixture. Production gateways must use durable state. */\nexport function createInMemoryWorkerReplayProtector(): WorkerProtocolReplayProtector {\n  const states = new Map<string, { sequence: number; nonces: Set<string> }>();\n  return {\n    async consume(sessionName, sequence, nonce) {\n      const state = states.get(sessionName);\n      if ((!state && sequence !== 1) || (state && sequence !== state.sequence + 1) || state?.nonces.has(nonce)) {\n        return false;\n      }\n      const nonces = state?.nonces ?? new Set<string>();\n      nonces.add(nonce);\n      states.set(sessionName, { sequence, nonces });\n      return true;\n    },\n  };\n}\n","import type { OrchestrationResource, OrchestrationResourceStatus } from '../client.js';\nimport type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport type { WorkerGatewaySession, WorkerProtocolMethod, WorkerRunBinding } from './workerProtocol.js';\n\nexport const WORKLOAD_CAPABILITY_GRANT_API_VERSION = 'security.memeloop.io/v1alpha1';\nexport const WORKLOAD_CAPABILITY_GRANT_KIND = 'WorkloadCapabilityGrant';\n\nexport interface WorkloadCapabilityBudget {\n  maxRequests: number;\n  maxInputBytes?: number;\n  maxOutputBytes?: number;\n  maxTokens?: number;\n  maxCost?: number;\n}\n\nexport interface WorkloadCapabilityGrantSpec {\n  /** Stable identity included in the signed claims; must equal metadata.name. */\n  grantId: string;\n  sessionRef: {\n    apiVersion: string;\n    kind: 'WorkerSession';\n    name: string;\n  };\n  run: WorkerRunBinding;\n  workerKeyFingerprint: string;\n  /** Pinned gateway/channel identity, never a worker-provided label. */\n  channelBinding: string;\n  audience: string;\n  protocol: string;\n  protocolMethod: WorkerProtocolMethod;\n  capability: string;\n  target: string;\n  policyDigest: string;\n  budget: WorkloadCapabilityBudget;\n  issuedAt: string;\n  expiresAt: string;\n  issuedBy: string;\n  /** Gateway signature over canonicalWorkloadCapabilityGrantBytes(spec). */\n  signature: string;\n}\n\nexport interface WorkloadCapabilityGrantStatus extends OrchestrationResourceStatus {\n  phase?: 'Authorized' | 'Consumed' | 'Revoked' | 'Expired' | 'Failed';\n  consumedAt?: string;\n  revokedAt?: string;\n  reason?: string;\n}\n\nexport type WorkloadCapabilityGrantResource =\n  & Omit<\n    OrchestrationResource<WorkloadCapabilityGrantSpec>,\n    'status'\n  >\n  & {\n    status?: WorkloadCapabilityGrantStatus;\n  };\n\nexport interface IssueWorkloadCapabilityGrantRequest {\n  grantId: string;\n  session: WorkerGatewaySession;\n  channelBinding: string;\n  protocolMethod: WorkerProtocolMethod;\n  capability: string;\n  target: string;\n  budget: WorkloadCapabilityBudget;\n  ttlMs: number;\n}\n\nexport interface WorkloadCapabilityGrantRequirements {\n  grantId: string;\n  sessionName: string;\n  run: WorkerRunBinding;\n  workerKeyFingerprint: string;\n  channelBinding: string;\n  audience: string;\n  protocol: string;\n  protocolMethod: WorkerProtocolMethod;\n  capability: string;\n  target: string;\n  policyDigest: string;\n}\n\nconst encoder = new TextEncoder();\n\nfunction canonicalize(value: unknown): string {\n  if (value === null || typeof value === 'boolean' || typeof value === 'string') {\n    return JSON.stringify(value);\n  }\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) throw new Error('non-finite number');\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) return `[${value.map(canonicalize).join(',')}]`;\n  if (value && typeof value === 'object') {\n    return `{${\n      Object.entries(value)\n        .filter(([, item]) => item !== undefined)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([key, item]) => `${JSON.stringify(key)}:${canonicalize(item)}`)\n        .join(',')\n    }}`;\n  }\n  throw new Error('capability grant values must be JSON-compatible');\n}\n\nexport function canonicalWorkloadCapabilityGrantBytes(\n  spec: WorkloadCapabilityGrantSpec | Omit<WorkloadCapabilityGrantSpec, 'signature'>,\n): Uint8Array {\n  const { signature: _signature, ...claims } = spec as WorkloadCapabilityGrantSpec;\n  return encoder.encode(canonicalize(claims));\n}\n\nexport function createWorkloadCapabilityGrantManifest(\n  name: string,\n  spec: WorkloadCapabilityGrantSpec,\n): {\n  apiVersion: typeof WORKLOAD_CAPABILITY_GRANT_API_VERSION;\n  kind: typeof WORKLOAD_CAPABILITY_GRANT_KIND;\n  metadata: { name: string };\n  spec: WorkloadCapabilityGrantSpec;\n} {\n  return {\n    apiVersion: WORKLOAD_CAPABILITY_GRANT_API_VERSION,\n    kind: WORKLOAD_CAPABILITY_GRANT_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isWorkloadCapabilityGrant(\n  resource: { apiVersion?: string; kind?: string },\n): resource is WorkloadCapabilityGrantResource {\n  return resource.apiVersion === WORKLOAD_CAPABILITY_GRANT_API_VERSION &&\n    resource.kind === WORKLOAD_CAPABILITY_GRANT_KIND;\n}\n\nfunction assertBudget(budget: WorkloadCapabilityBudget): void {\n  if (!Number.isSafeInteger(budget.maxRequests) || budget.maxRequests < 1) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: 'capability grant maxRequests must be a positive integer',\n      retryable: false,\n    });\n  }\n  for (const [name, value] of Object.entries(budget)) {\n    if (value !== undefined && (!Number.isFinite(value) || value < 0)) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: `capability grant budget '${name}' must be finite and non-negative`,\n        retryable: false,\n      });\n    }\n  }\n}\n\n/** Issue and durably record one host-authorized capability grant. */\nexport async function issueWorkloadCapabilityGrant(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  request: IssueWorkloadCapabilityGrantRequest,\n  sign: (message: Uint8Array) => Promise<string> | string,\n  now: () => Date = () => new Date(),\n): Promise<WorkloadCapabilityGrantResource> {\n  if (actor.kind !== 'controller' && actor.kind !== 'admin') {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'workload capability grants require a trusted controller or admin',\n      retryable: false,\n    });\n  }\n  const issuedAt = now();\n  const sessionExpiry = new Date(request.session.expiresAt);\n  if (\n    request.session.revoked ||\n    !Number.isFinite(sessionExpiry.getTime()) ||\n    sessionExpiry <= issuedAt ||\n    !request.grantId ||\n    !request.channelBinding ||\n    !request.capability ||\n    !request.target ||\n    !Number.isFinite(request.ttlMs) ||\n    request.ttlMs <= 0\n  ) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'capability grant request or worker session is not usable',\n      retryable: false,\n    });\n  }\n  if (\n    !request.session.allowedMethods.includes(request.protocolMethod) ||\n    (request.session.allowedTargets &&\n      !request.session.allowedTargets.includes(request.target))\n  ) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'capability grant exceeds the worker session scope',\n      retryable: false,\n    });\n  }\n  assertBudget(request.budget);\n  const expiresAt = new Date(\n    Math.min(sessionExpiry.getTime(), issuedAt.getTime() + request.ttlMs),\n  ).toISOString();\n  const unsigned: Omit<WorkloadCapabilityGrantSpec, 'signature'> = {\n    grantId: request.grantId,\n    sessionRef: {\n      apiVersion: 'security.memeloop.io/v1alpha1',\n      kind: 'WorkerSession',\n      name: request.session.name,\n    },\n    run: request.session.run,\n    workerKeyFingerprint: request.session.workerKeyFingerprint,\n    channelBinding: request.channelBinding,\n    audience: request.session.audience,\n    protocol: request.session.protocol,\n    protocolMethod: request.protocolMethod,\n    capability: request.capability,\n    target: request.target,\n    policyDigest: request.session.policyDigest,\n    budget: request.budget,\n    issuedAt: issuedAt.toISOString(),\n    expiresAt,\n    issuedBy: actor.id,\n  };\n  const signature = await sign(canonicalWorkloadCapabilityGrantBytes(unsigned));\n  if (!signature) {\n    throw new OrchestrationError({\n      code: 'INTERNAL',\n      message: 'capability grant signer returned no signature',\n      retryable: false,\n    });\n  }\n  const created = await store.create(\n    actor,\n    createWorkloadCapabilityGrantManifest(request.grantId, {\n      ...unsigned,\n      signature,\n    }),\n  ) as WorkloadCapabilityGrantResource;\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-arguments -- required for the grant-specific status shape\n  const active = await store.updateStatus<WorkloadCapabilityGrantSpec, WorkloadCapabilityGrantStatus>(\n    actor,\n    {\n      apiVersion: WORKLOAD_CAPABILITY_GRANT_API_VERSION,\n      kind: WORKLOAD_CAPABILITY_GRANT_KIND,\n      name: request.grantId,\n    },\n    { phase: 'Authorized' },\n    { resourceVersion: created.metadata.resourceVersion },\n  );\n  return active as WorkloadCapabilityGrantResource;\n}\n\n/** Verify signature, expiry, lifecycle, and every authority-bearing claim. */\nexport async function verifyWorkloadCapabilityGrant(\n  grant: WorkloadCapabilityGrantResource,\n  requirements: WorkloadCapabilityGrantRequirements,\n  verify: (message: Uint8Array, signature: string) => Promise<boolean> | boolean,\n  now: () => Date = () => new Date(),\n): Promise<void> {\n  const spec = grant.spec;\n  const issuedAt = new Date(spec.issuedAt).getTime();\n  const expiresAt = new Date(spec.expiresAt).getTime();\n  const currentTime = now().getTime();\n  const exact = grant.metadata.name === requirements.grantId &&\n    spec.grantId === requirements.grantId &&\n    spec.sessionRef.name === requirements.sessionName &&\n    spec.run.uid === requirements.run.uid &&\n    spec.run.attempt === requirements.run.attempt &&\n    spec.run.epoch === requirements.run.epoch &&\n    spec.workerKeyFingerprint === requirements.workerKeyFingerprint &&\n    spec.channelBinding === requirements.channelBinding &&\n    spec.audience === requirements.audience &&\n    spec.protocol === requirements.protocol &&\n    spec.protocolMethod === requirements.protocolMethod &&\n    spec.capability === requirements.capability &&\n    spec.target === requirements.target &&\n    spec.policyDigest === requirements.policyDigest;\n  if (\n    !exact ||\n    grant.status?.phase !== 'Authorized' ||\n    !Number.isFinite(issuedAt) ||\n    !Number.isFinite(expiresAt) ||\n    issuedAt > currentTime ||\n    expiresAt <= currentTime ||\n    expiresAt <= issuedAt ||\n    !await verify(canonicalWorkloadCapabilityGrantBytes(spec), spec.signature)\n  ) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'workload capability grant verification failed',\n      retryable: false,\n    });\n  }\n  assertBudget(spec.budget);\n}\n\n/** Atomically consume a single-use grant before invoking the capability. */\nexport async function consumeWorkloadCapabilityGrant(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  grant: WorkloadCapabilityGrantResource,\n  now: () => Date = () => new Date(),\n): Promise<WorkloadCapabilityGrantResource> {\n  if (grant.status?.phase !== 'Authorized' || grant.spec.budget.maxRequests !== 1) {\n    throw new OrchestrationError({\n      code: 'CONFLICT',\n      message: 'workload capability grant is not a fresh single-use authorization',\n      retryable: false,\n    });\n  }\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-arguments -- required for the grant-specific status shape\n  return await store.updateStatus<WorkloadCapabilityGrantSpec, WorkloadCapabilityGrantStatus>(\n    actor,\n    {\n      apiVersion: WORKLOAD_CAPABILITY_GRANT_API_VERSION,\n      kind: WORKLOAD_CAPABILITY_GRANT_KIND,\n      name: grant.metadata.name,\n    },\n    { ...grant.status, phase: 'Consumed', consumedAt: now().toISOString() },\n    { resourceVersion: grant.metadata.resourceVersion },\n  ) as WorkloadCapabilityGrantResource;\n}\n","import type {\n  OrchestrationDeleteOptions,\n  OrchestrationDeleteResult,\n  OrchestrationResource,\n  OrchestrationResourceList,\n  OrchestrationResourceManifest,\n  OrchestrationResourceQuery,\n  OrchestrationResourceReference,\n  OrchestrationResourceStatus,\n  OrchestrationResourceWatchEvent,\n  OrchestrationWatchEvent,\n  OrchestrationWatchOptions,\n} from '../client.js';\nimport type {\n  ControlLeaseGrant,\n  ControlLeaseIdentity,\n  ControlLeaseRequest,\n  ControlStore,\n  ControlStoreActor,\n  ControlStoreApplyOptions,\n  ControlStoreAuthorizer,\n  ControlStoreCompactionResult,\n  ControlStoreCreateOptions,\n  ControlStoreHealth,\n  ControlStoreSnapshotResult,\n  ControlStoreStatusUpdateOptions,\n} from '../controlStore.js';\nimport { canonicalControlStoreValue, controlStoreApplyMatches } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\n\n// ─── Quorum Types ────────────────────────────────────────────────────────\n\nexport interface QuorumMember {\n  id: string;\n  peerUrls: string[];\n  isLearner: boolean;\n}\n\nexport interface QuorumTopology {\n  members: QuorumMember[];\n  leaderId?: string;\n  term: number;\n}\n\n// ─── Internal State ──────────────────────────────────────────────────────\n\ninterface StoredResource {\n  resource: OrchestrationResource;\n  revision: number;\n  deleted: boolean;\n}\n\ninterface LeaseEntry {\n  holder: string;\n  leaseId: string;\n  epoch: string;\n  acquiredAt: number;\n  renewedAt: number;\n  expiresAt: number;\n}\n\n/**\n * Serializable point-in-time state of a QuorumControlStore. Portable core\n * cannot write files, so persistence flows through `exportSnapshot()` /\n * `restoreSnapshot()`; the host decides where bytes live. Live leases and\n * their timers are ephemeral and intentionally excluded; per-name fencing\n * epochs are preserved so a restored store never re-issues epoch 1.\n */\nexport interface QuorumControlStoreSnapshot {\n  revision: number;\n  compactedRevision?: number;\n  term: number;\n  voters: string[];\n  learners: string[];\n  quorumSize: number;\n  leaseEpochs: Record<string, number>;\n  resources: Array<{\n    key: string;\n    resource: OrchestrationResource;\n    revision: number;\n    deleted: boolean;\n  }>;\n  idempotency?: Array<{\n    key: string;\n    requestDigest: string;\n    response: unknown;\n  }>;\n  watchEvents?: Array<{\n    key: string;\n    event: OrchestrationResourceWatchEvent;\n  }>;\n  createdAt: string;\n}\n\ninterface WatchSubscription {\n  query: OrchestrationResourceQuery;\n  sinceRevision: number;\n  /** Deliver a matched event; the iterator buffers events between next() calls. */\n  push: (event: OrchestrationWatchEvent) => void;\n  /** Resolve a pending next() with done (store close / iterator return). */\n  close: () => void;\n}\n\ninterface WatchHistoryEntry {\n  key: string;\n  event: OrchestrationResourceWatchEvent;\n}\n\n// ─── Config ──────────────────────────────────────────────────────────────\n\nexport interface QuorumControlStoreOptions {\n  memberId: string;\n  isLearner?: boolean;\n  authorizer?: ControlStoreAuthorizer;\n  quorumSize?: number;\n  voters?: string[];\n  /** Retained resumable resource events before automatic compaction. */\n  maxWatchEvents?: number;\n}\n\n/**\n * In-process quorum ControlStore (plan 24.59).\n *\n * Implements full ControlStore semantics: multi-voter consensus, learner\n * replication, CAS updates, lease management with epochs, watch subscriptions\n * with revision tracking, compaction, and snapshot. Loss-of-quorum writes\n * are rejected with UNAVAILABLE.\n *\n * A production etcd-backed adapter is planned as a separate package.\n */\nexport class QuorumControlStore implements ControlStore {\n  private isLearner: boolean;\n  private readonly authorizer?: ControlStoreAuthorizer;\n  private quorumSize: number;\n  private readonly voters: Set<string>;\n  private readonly learners = new Set<string>();\n  private readonly memberId: string;\n\n  private readonly data = new Map<string, StoredResource>();\n  private readonly idempotency = new Map<string, {\n    requestDigest: string;\n    response: unknown;\n  }>();\n  private revision = 0;\n  private readonly leases = new Map<string, LeaseEntry>();\n  /** Monotonic fencing epoch per lease name; survives release/expiry and restore. */\n  private readonly leaseEpochs = new Map<string, number>();\n  private readonly watchers = new Map<number, WatchSubscription>();\n  private watcherIdSeq = 0;\n  private readonly watchHistory: WatchHistoryEntry[] = [];\n  private compactedRevision = 0;\n  private readonly maxWatchEvents: number;\n  private readonly leaseTimers = new Map<string, ReturnType<typeof setInterval>>();\n  private closed = false;\n  private term = 1;\n\n  public constructor(options: QuorumControlStoreOptions) {\n    this.memberId = options.memberId;\n    this.isLearner = options.isLearner ?? false;\n    this.authorizer = options.authorizer;\n    this.voters = new Set(options.voters ?? [options.memberId]);\n    this.quorumSize = options.quorumSize ?? Math.max(1, Math.floor(this.voters.size / 2) + 1);\n    this.maxWatchEvents = options.maxWatchEvents ?? 10_000;\n    if (!Number.isSafeInteger(this.maxWatchEvents) || this.maxWatchEvents < 1) {\n      throw new Error('maxWatchEvents must be a positive safe integer');\n    }\n  }\n\n  // ─── Helpers ────────────────────────────────────────────────────────\n\n  private nextRevision(): number {\n    this.revision += 1;\n    return this.revision;\n  }\n\n  private manifestKey(m: OrchestrationResourceManifest): string {\n    const ns = m.metadata.namespace ?? 'default';\n    return `${m.apiVersion}/${m.kind}/${ns}/${m.metadata.name ?? ''}`;\n  }\n\n  private refKey(r: OrchestrationResourceReference): string {\n    const ns = r.namespace ?? 'default';\n    return `${r.apiVersion}/${r.kind}/${ns}/${r.name ?? ''}`;\n  }\n\n  private queryPrefix(q: OrchestrationResourceQuery): string {\n    const ns = q.namespace ?? '';\n    if (q.apiVersion && ns) return `${q.apiVersion}/${q.kind}/${ns}/`;\n    if (q.apiVersion) return `${q.apiVersion}/${q.kind}/`;\n    return '';\n  }\n\n  private matchQuery(key: string, q: OrchestrationResourceQuery): boolean {\n    // apiVersion contains '/' (e.g. models.memeloop.io/v1alpha1), so the key\n    // cannot be parsed by fixed segment indices; match by prefix instead.\n    if (q.apiVersion) {\n      if (!key.startsWith(`${q.apiVersion}/${q.kind}/`)) return false;\n      if (q.namespace) {\n        return key.slice(`${q.apiVersion}/${q.kind}/`.length).startsWith(`${q.namespace}/`);\n      }\n      return true;\n    }\n    if (!key.includes(`/${q.kind}/`)) return false;\n    if (q.namespace && !key.includes(`/${q.kind}/${q.namespace}/`)) return false;\n    return true;\n  }\n\n  private checkQuorum(action: string): void {\n    if (this.closed) throw new Error('store is closed');\n    if (this.voters.size < this.quorumSize) {\n      throw new OrchestrationError({ code: 'UNAVAILABLE', message: `${action}: loss of quorum`, retryable: true });\n    }\n  }\n\n  private notify(key: string, resource: OrchestrationResource, type: OrchestrationResourceWatchEvent['type']): void {\n    const rv = Number(resource.metadata.resourceVersion);\n    const event = {\n      type,\n      resourceVersion: resource.metadata.resourceVersion,\n      resource: structuredClone(resource),\n    } as OrchestrationResourceWatchEvent;\n    this.watchHistory.push({ key, event });\n    while (this.watchHistory.length > this.maxWatchEvents) {\n      const removed = this.watchHistory.shift();\n      if (removed) {\n        this.compactedRevision = Math.max(\n          this.compactedRevision,\n          Number(removed.event.resourceVersion),\n        );\n      }\n    }\n    for (const sub of this.watchers.values()) {\n      if (!key.startsWith(this.queryPrefix(sub.query))) continue;\n      if (!this.matchQuery(key, sub.query)) continue;\n      if (rv <= sub.sinceRevision) continue;\n      sub.sinceRevision = rv;\n      sub.push(structuredClone(event));\n    }\n  }\n\n  // ─── CRUD ───────────────────────────────────────────────────────────\n\n  public async get<TSpec, TStatus>(reference: OrchestrationResourceReference): Promise<OrchestrationResource<TSpec, TStatus> | null> {\n    const s = this.data.get(this.refKey(reference));\n    if (!s || s.deleted) return null;\n    return structuredClone(s.resource) as unknown as OrchestrationResource<TSpec, TStatus>;\n  }\n\n  public async list<TSpec, TStatus>(query: OrchestrationResourceQuery): Promise<OrchestrationResourceList<TSpec, TStatus>> {\n    const items: Array<OrchestrationResource<TSpec, TStatus>> = [];\n    for (const [key, s] of this.data) {\n      if (s.deleted) continue;\n      if (!this.matchQuery(key, query)) continue;\n      items.push(structuredClone(s.resource) as unknown as OrchestrationResource<TSpec, TStatus>);\n    }\n    return { items, resourceVersion: String(this.revision) };\n  }\n\n  public watch<TSpec, TStatus>(\n    query: OrchestrationResourceQuery,\n    options: OrchestrationWatchOptions = {},\n  ): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>> {\n    // eslint-disable-next-line @typescript-eslint/no-this-alias\n    const self = this;\n    let done = false;\n    return {\n      [Symbol.asyncIterator]() {\n        // Buffered subscription: events arriving between next() calls are\n        // queued, so back-to-back writes are never lost (the previous\n        // one-shot subscription dropped events in the re-registration gap).\n        const buffer: Array<OrchestrationWatchEvent<TSpec, TStatus>> = [];\n        let waiting: ((result: IteratorResult<OrchestrationWatchEvent<TSpec, TStatus>>) => void) | null = null;\n        const id = self.watcherIdSeq++;\n        const snapshotRevision = self.revision;\n        const requestedRevision = options.resourceVersion === undefined\n          ? snapshotRevision\n          : Number(options.resourceVersion);\n        if (\n          !Number.isSafeInteger(requestedRevision) ||\n          requestedRevision < 0 ||\n          requestedRevision > snapshotRevision\n        ) {\n          buffer.push({\n            type: 'ERROR',\n            resourceVersion: String(snapshotRevision),\n            terminal: true,\n            error: {\n              code: 'INVALID',\n              message: `invalid watch resourceVersion '${String(options.resourceVersion)}'`,\n              retryable: false,\n            },\n          });\n          done = true;\n        } else if (requestedRevision < self.compactedRevision) {\n          buffer.push({\n            type: 'ERROR',\n            resourceVersion: String(self.compactedRevision),\n            terminal: true,\n            error: {\n              code: 'WATCH_COMPACTED',\n              message: `resourceVersion ${requestedRevision} was compacted`,\n              retryable: true,\n            },\n          });\n          done = true;\n        }\n        if (!done && options.sendInitialEvents) {\n          for (const [key, stored] of self.data) {\n            if (\n              stored.deleted ||\n              stored.revision > snapshotRevision ||\n              !self.matchQuery(key, query)\n            ) continue;\n            buffer.push({\n              type: 'ADDED',\n              resourceVersion: stored.resource.metadata.resourceVersion,\n              resource: structuredClone(stored.resource),\n            } as OrchestrationWatchEvent<TSpec, TStatus>);\n          }\n          buffer.push({\n            type: 'BOOKMARK',\n            resourceVersion: String(snapshotRevision),\n          });\n        } else if (!done && options.resourceVersion !== undefined) {\n          for (const entry of self.watchHistory) {\n            const revision = Number(entry.event.resourceVersion);\n            if (\n              revision <= requestedRevision ||\n              revision > snapshotRevision ||\n              !self.matchQuery(entry.key, query)\n            ) continue;\n            buffer.push(\n              structuredClone(entry.event) as OrchestrationWatchEvent<TSpec, TStatus>,\n            );\n          }\n        }\n        let timeout: ReturnType<typeof setTimeout> | undefined;\n        const finishWaiting = (): void => {\n          const resolve = waiting;\n          waiting = null;\n          resolve?.({ done: true, value: undefined });\n        };\n        const close = (): void => {\n          done = true;\n          if (timeout) clearTimeout(timeout);\n          options.signal?.removeEventListener('abort', close);\n          finishWaiting();\n          self.watchers.delete(id);\n        };\n        if (!done) {\n          self.watchers.set(id, {\n            query,\n            sinceRevision: snapshotRevision,\n            push: (event) => {\n              if (waiting) {\n                const resolve = waiting;\n                waiting = null;\n                resolve({ done: false, value: event as OrchestrationWatchEvent<TSpec, TStatus> });\n              } else {\n                buffer.push(event as OrchestrationWatchEvent<TSpec, TStatus>);\n              }\n            },\n            close,\n          });\n        }\n        options.signal?.addEventListener('abort', close, { once: true });\n        if (options.signal?.aborted) close();\n        if (!done && options.timeoutMs !== undefined) {\n          timeout = setTimeout(close, Math.max(0, options.timeoutMs));\n        }\n        return {\n          async next(): Promise<IteratorResult<OrchestrationWatchEvent<TSpec, TStatus>>> {\n            const buffered = buffer.shift();\n            if (buffered !== undefined) return { done: false, value: buffered };\n            if (done || self.closed) return { done: true, value: undefined };\n            return new Promise((resolve) => {\n              waiting = resolve;\n            });\n          },\n          async return() {\n            close();\n            return { done: true, value: undefined };\n          },\n        };\n      },\n    };\n  }\n\n  public async create<TSpec, TStatus>(\n    actor: ControlStoreActor,\n    resource: OrchestrationResourceManifest<TSpec>,\n    options?: ControlStoreCreateOptions,\n  ): Promise<OrchestrationResource<TSpec, TStatus>> {\n    this.checkQuorum('create');\n    const key = this.manifestKey(resource as OrchestrationResourceManifest);\n\n    const requestDigest = canonicalControlStoreValue({ actor, resource });\n    if (options?.idempotencyKey) {\n      const replay = this.idempotency.get(`create:${options.idempotencyKey}`);\n      if (replay) {\n        if (replay.requestDigest !== requestDigest) {\n          throw new OrchestrationError({\n            code: 'CONFLICT',\n            message: 'idempotency key was reused for another create request',\n            retryable: false,\n          });\n        }\n        return structuredClone(replay.response) as OrchestrationResource<TSpec, TStatus>;\n      }\n    }\n\n    if (this.data.has(key)) {\n      throw new OrchestrationError({ code: 'CONFLICT', message: `resource ${key} already exists`, retryable: false });\n    }\n\n    this.authorizer?.authorize({\n      actor,\n      verb: 'create',\n      reference: {\n        apiVersion: resource.apiVersion,\n        kind: resource.kind,\n        name: resource.metadata.name,\n        namespace: resource.metadata.namespace,\n      },\n      proposedResource: resource as OrchestrationResourceManifest,\n    });\n    const rv = options?.dryRun ? this.revision : this.nextRevision();\n    const uid = `${resource.kind}-${resource.metadata.namespace ?? 'default'}-${resource.metadata.name ?? ''}-${rv}`;\n    const result: OrchestrationResource = {\n      apiVersion: resource.apiVersion,\n      kind: resource.kind,\n      metadata: {\n        name: resource.metadata.name ?? '',\n        namespace: resource.metadata.namespace ?? 'default',\n        uid,\n        generation: 1,\n        resourceVersion: String(rv),\n        creationTimestamp: new Date().toISOString(),\n        labels: resource.metadata.labels,\n        annotations: resource.metadata.annotations,\n        ownerReferences: resource.metadata.ownerReferences,\n        finalizers: resource.metadata.finalizers,\n      },\n      spec: resource.spec as Record<string, unknown>,\n    };\n\n    if (!options?.dryRun) {\n      this.data.set(key, { resource: result, revision: rv, deleted: false });\n      if (options?.idempotencyKey) {\n        this.idempotency.set(`create:${options.idempotencyKey}`, {\n          requestDigest,\n          response: structuredClone(result),\n        });\n      }\n      this.notify(key, result, 'ADDED');\n    }\n    return result as unknown as OrchestrationResource<TSpec, TStatus>;\n  }\n\n  public async apply<TSpec, TStatus>(\n    actor: ControlStoreActor,\n    resource: OrchestrationResourceManifest<TSpec>,\n    options: ControlStoreApplyOptions = {},\n  ): Promise<OrchestrationResource<TSpec, TStatus>> {\n    this.checkQuorum('apply');\n    const key = this.manifestKey(resource as OrchestrationResourceManifest);\n    const idempotencyKey = options.idempotencyKey\n      ? `apply:${options.idempotencyKey}`\n      : undefined;\n    const fingerprint = canonicalControlStoreValue({ actor, resource });\n    if (idempotencyKey) {\n      const replay = this.idempotency.get(idempotencyKey);\n      if (replay) {\n        if (replay.requestDigest !== fingerprint) {\n          throw new OrchestrationError({\n            code: 'CONFLICT',\n            message: 'idempotency key was reused for another apply request',\n            retryable: false,\n          });\n        }\n        return structuredClone(replay.response) as OrchestrationResource<TSpec, TStatus>;\n      }\n    }\n    const stored = this.data.get(key);\n    if (!stored || stored.deleted) {\n      const created = await this.create<TSpec, TStatus>(actor, resource, {\n        ...(options.dryRun !== undefined ? { dryRun: options.dryRun } : {}),\n      });\n      if (idempotencyKey && !options.dryRun) {\n        this.idempotency.set(idempotencyKey, {\n          requestDigest: fingerprint,\n          response: structuredClone(created) as unknown as OrchestrationResource,\n        });\n      }\n      return created;\n    }\n    if (\n      controlStoreApplyMatches(\n        stored.resource,\n        resource as OrchestrationResourceManifest,\n      )\n    ) {\n      if (idempotencyKey && !options.dryRun) {\n        this.idempotency.set(idempotencyKey, {\n          requestDigest: fingerprint,\n          response: structuredClone(stored.resource),\n        });\n      }\n      return structuredClone(stored.resource) as unknown as OrchestrationResource<TSpec, TStatus>;\n    }\n    if (\n      !options.resourceVersion ||\n      options.resourceVersion !== stored.resource.metadata.resourceVersion\n    ) {\n      throw new OrchestrationError({\n        code: 'CONFLICT',\n        message: 'apply resourceVersion precondition failed',\n        retryable: true,\n      });\n    }\n    if (this.authorizer) {\n      this.authorizer.authorize({\n        actor,\n        verb: 'apply',\n        reference: {\n          apiVersion: resource.apiVersion,\n          kind: resource.kind,\n          name: resource.metadata.name,\n          namespace: resource.metadata.namespace,\n        },\n        current: stored.resource,\n        proposedResource: resource as OrchestrationResourceManifest,\n      });\n    }\n    const rv = options.dryRun ? this.revision : this.nextRevision();\n    const specChanged = canonicalControlStoreValue(stored.resource.spec) !==\n      canonicalControlStoreValue(resource.spec);\n    const updated: OrchestrationResource = {\n      ...stored.resource,\n      metadata: {\n        ...stored.resource.metadata,\n        ...structuredClone(resource.metadata),\n        name: stored.resource.metadata.name,\n        namespace: stored.resource.metadata.namespace,\n        uid: stored.resource.metadata.uid,\n        generation: stored.resource.metadata.generation + (specChanged ? 1 : 0),\n        resourceVersion: String(rv),\n        creationTimestamp: stored.resource.metadata.creationTimestamp,\n      },\n      spec: structuredClone(resource.spec) as Record<string, unknown>,\n    };\n    if (!options.dryRun) {\n      this.data.set(key, { resource: updated, revision: rv, deleted: false });\n      if (idempotencyKey) {\n        this.idempotency.set(idempotencyKey, {\n          requestDigest: fingerprint,\n          response: structuredClone(updated),\n        });\n      }\n      this.notify(key, updated, 'MODIFIED');\n    }\n    return structuredClone(updated) as unknown as OrchestrationResource<TSpec, TStatus>;\n  }\n\n  public async updateStatus<TSpec, TStatus>(\n    actor: ControlStoreActor,\n    reference: OrchestrationResourceReference,\n    status: TStatus,\n    options: ControlStoreStatusUpdateOptions,\n  ): Promise<OrchestrationResource<TSpec, TStatus>> {\n    this.checkQuorum('updateStatus');\n    const key = this.refKey(reference);\n    const requestDigest = canonicalControlStoreValue({\n      actor,\n      reference,\n      status,\n      resourceVersion: options.resourceVersion,\n    });\n    const idempotencyKey = options.idempotencyKey\n      ? `status:${options.idempotencyKey}`\n      : undefined;\n    if (idempotencyKey) {\n      const replay = this.idempotency.get(idempotencyKey);\n      if (replay) {\n        if (replay.requestDigest !== requestDigest) {\n          throw new OrchestrationError({\n            code: 'CONFLICT',\n            message: 'idempotency key was reused for another status request',\n            retryable: false,\n          });\n        }\n        return structuredClone(replay.response) as OrchestrationResource<TSpec, TStatus>;\n      }\n    }\n    const stored = this.data.get(key);\n    if (!stored || stored.deleted) {\n      throw new OrchestrationError({ code: 'NOT_FOUND', message: `resource ${key} not found`, retryable: false });\n    }\n\n    if (this.authorizer) {\n      this.authorizer.authorize({\n        actor,\n        verb: 'update-status',\n        reference,\n        current: stored.resource,\n        proposedStatus: status as unknown as OrchestrationResourceStatus,\n      });\n    }\n\n    if (options.resourceVersion && stored.resource.metadata.resourceVersion !== options.resourceVersion) {\n      throw new OrchestrationError({\n        code: 'CONFLICT',\n        message: `CAS conflict: expected ${options.resourceVersion}, got ${stored.resource.metadata.resourceVersion}`,\n        retryable: true,\n      });\n    }\n\n    const rv = options.dryRun ? this.revision : this.nextRevision();\n    const updated: OrchestrationResource = {\n      ...stored.resource,\n      status: status as unknown as OrchestrationResourceStatus,\n      metadata: {\n        ...stored.resource.metadata,\n        resourceVersion: String(rv),\n      },\n    };\n    if (!options.dryRun) {\n      this.data.set(key, { resource: updated, revision: rv, deleted: false });\n      if (idempotencyKey) {\n        this.idempotency.set(idempotencyKey, {\n          requestDigest,\n          response: structuredClone(updated),\n        });\n      }\n      this.notify(key, updated, 'MODIFIED');\n    }\n    return structuredClone(updated) as OrchestrationResource<TSpec, TStatus>;\n  }\n\n  public async delete(\n    actor: ControlStoreActor,\n    reference: OrchestrationResourceReference,\n    options: OrchestrationDeleteOptions = {},\n  ): Promise<OrchestrationDeleteResult> {\n    this.checkQuorum('delete');\n    const key = this.refKey(reference);\n    const requestDigest = canonicalControlStoreValue({\n      actor,\n      reference,\n      preconditions: options.preconditions,\n      propagationPolicy: options.propagationPolicy,\n    });\n    const idempotencyKey = options.idempotencyKey\n      ? `delete:${options.idempotencyKey}`\n      : undefined;\n    if (idempotencyKey) {\n      const replay = this.idempotency.get(idempotencyKey);\n      if (replay) {\n        if (replay.requestDigest !== requestDigest) {\n          throw new OrchestrationError({\n            code: 'CONFLICT',\n            message: 'idempotency key was reused for another delete request',\n            retryable: false,\n          });\n        }\n        return structuredClone(replay.response) as OrchestrationDeleteResult;\n      }\n    }\n    const stored = this.data.get(key);\n    if (!stored || stored.deleted) return { accepted: false, reference };\n\n    const preconditions = options.preconditions;\n    if (\n      (preconditions?.uid !== undefined &&\n        preconditions.uid !== stored.resource.metadata.uid) ||\n      (preconditions?.resourceVersion !== undefined &&\n        preconditions.resourceVersion !== stored.resource.metadata.resourceVersion) ||\n      (preconditions?.generation !== undefined &&\n        preconditions.generation !== stored.resource.metadata.generation)\n    ) {\n      throw new OrchestrationError({\n        code: 'CONFLICT',\n        message: 'delete precondition failed',\n        retryable: true,\n      });\n    }\n    this.authorizer?.authorize({\n      actor,\n      verb: 'delete',\n      reference,\n      current: stored.resource,\n    });\n\n    const pending = (stored.resource.metadata.finalizers?.length ?? 0) > 0;\n    const alreadyPending = pending && stored.resource.metadata.deletionTimestamp !== undefined;\n    const rv = options.dryRun || alreadyPending\n      ? this.revision\n      : this.nextRevision();\n    const deleted: OrchestrationResource = {\n      ...stored.resource,\n      metadata: {\n        ...stored.resource.metadata,\n        resourceVersion: String(rv),\n        ...(pending && !alreadyPending\n          ? { deletionTimestamp: new Date().toISOString() }\n          : {}),\n      },\n    };\n    const result: OrchestrationDeleteResult = { accepted: true, reference };\n    if (!options.dryRun) {\n      if (!alreadyPending) {\n        this.data.set(key, {\n          resource: deleted,\n          revision: rv,\n          deleted: !pending,\n        });\n      }\n      if (idempotencyKey) {\n        this.idempotency.set(idempotencyKey, {\n          requestDigest,\n          response: structuredClone(result),\n        });\n      }\n      if (!alreadyPending) {\n        this.notify(key, deleted, pending ? 'MODIFIED' : 'DELETED');\n      }\n    }\n    return result;\n  }\n\n  // ─── Leases ──────────────────────────────────────────────────────────\n\n  public async acquireLease(actor: ControlStoreActor, request: ControlLeaseRequest): Promise<ControlLeaseGrant> {\n    this.checkQuorum('acquireLease');\n    if (\n      !request.name ||\n      !request.holder ||\n      !Number.isSafeInteger(request.ttlMs) ||\n      request.ttlMs <= 0\n    ) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: 'lease name, holder, and positive ttlMs are required',\n        retryable: false,\n      });\n    }\n    this.authorizer?.authorize({\n      actor,\n      verb: 'acquire-lease',\n      reference: this.leaseReference(request.name),\n    });\n    const existing = this.leases.get(request.name);\n    if (existing && Date.now() < existing.expiresAt) {\n      throw new OrchestrationError({ code: 'CONFLICT', message: `lease ${request.name} held by ${existing.holder}`, retryable: true });\n    }\n    this.clearLeaseTimer(request.name);\n\n    const leaseId = `lease-${request.name}-${request.holder}-${Date.now().toString(36)}`;\n    const rv = this.nextRevision();\n    const now = Date.now();\n    // Fencing epochs are monotonic per lease name across holders, releases,\n    // and expiries — a stale holder's epoch is permanently unusable.\n    const epoch = (this.leaseEpochs.get(request.name) ?? 0) + 1;\n    this.leaseEpochs.set(request.name, epoch);\n    this.leases.set(request.name, {\n      holder: request.holder,\n      leaseId,\n      epoch: String(epoch),\n      acquiredAt: now,\n      renewedAt: now,\n      expiresAt: now + request.ttlMs,\n    });\n    this.leaseTimers.set(\n      request.name,\n      setInterval(() => {\n        this.expireLease(request.name);\n      }, Math.min(request.ttlMs, 30_000)),\n    );\n\n    return {\n      name: request.name,\n      holder: request.holder,\n      leaseId,\n      epoch: String(epoch),\n      acquiredAt: new Date().toISOString(),\n      renewedAt: new Date().toISOString(),\n      expiresAt: new Date(now + request.ttlMs).toISOString(),\n      resourceVersion: String(rv),\n    };\n  }\n\n  public async renewLease(actor: ControlStoreActor, id: ControlLeaseIdentity, ttlMs: number): Promise<ControlLeaseGrant> {\n    this.checkQuorum('renewLease');\n    if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: 'positive lease ttlMs is required',\n        retryable: false,\n      });\n    }\n    this.authorizer?.authorize({\n      actor,\n      verb: 'renew-lease',\n      reference: this.leaseReference(id.name),\n    });\n    const existing = this.leases.get(id.name);\n\n    const now = Date.now();\n    if (\n      !existing ||\n      existing.holder !== id.holder ||\n      existing.leaseId !== id.leaseId ||\n      id.epoch !== existing.epoch ||\n      existing.expiresAt <= now\n    ) {\n      throw new OrchestrationError({\n        code: 'STALE_EPOCH',\n        message: `lease ${id.name} identity is stale`,\n        retryable: false,\n      });\n    }\n    existing.renewedAt = now;\n    existing.expiresAt = now + ttlMs;\n    return {\n      name: id.name,\n      holder: existing.holder,\n      leaseId: existing.leaseId,\n      epoch: existing.epoch,\n      acquiredAt: new Date(existing.acquiredAt).toISOString(),\n      renewedAt: new Date(existing.renewedAt).toISOString(),\n      expiresAt: new Date(existing.expiresAt).toISOString(),\n      resourceVersion: String(this.nextRevision()),\n    };\n  }\n\n  public async releaseLease(actor: ControlStoreActor, id: ControlLeaseIdentity): Promise<void> {\n    this.checkQuorum('releaseLease');\n    this.authorizer?.authorize({\n      actor,\n      verb: 'release-lease',\n      reference: this.leaseReference(id.name),\n    });\n    const existing = this.leases.get(id.name);\n    if (\n      !existing ||\n      existing.holder !== id.holder ||\n      existing.leaseId !== id.leaseId ||\n      existing.epoch !== id.epoch\n    ) {\n      throw new OrchestrationError({\n        code: 'STALE_EPOCH',\n        message: `lease ${id.name} identity is stale`,\n        retryable: false,\n      });\n    }\n    this.leases.delete(id.name);\n    this.clearLeaseTimer(id.name);\n  }\n\n  // ─── Maintenance ─────────────────────────────────────────────────────\n\n  public async compact(throughResourceVersion: string): Promise<ControlStoreCompactionResult> {\n    const target = Number(throughResourceVersion);\n    if (!Number.isSafeInteger(target) || target < 0 || target > this.revision) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: `invalid compaction resourceVersion '${throughResourceVersion}'`,\n        retryable: false,\n      });\n    }\n    this.compactedRevision = Math.max(this.compactedRevision, target);\n    for (let index = this.watchHistory.length - 1; index >= 0; index -= 1) {\n      if (Number(this.watchHistory[index].event.resourceVersion) <= target) {\n        this.watchHistory.splice(index, 1);\n      }\n    }\n    for (const [key, s] of this.data) {\n      if (s.deleted && s.revision <= target) this.data.delete(key);\n    }\n    return { compactedThrough: String(target), resourceVersion: String(this.revision) };\n  }\n\n  public async snapshot(_targetPath: string): Promise<ControlStoreSnapshotResult> {\n    // Portable core cannot write files; hosts persist the bytes returned by\n    // exportSnapshot(). This method only reports the snapshot point.\n    return { resourceVersion: String(this.revision), createdAt: new Date().toISOString() };\n  }\n\n  /** Serialize the full store state. Excludes live leases/timers; preserves fencing epochs. */\n  public exportSnapshot(): QuorumControlStoreSnapshot {\n    return {\n      revision: this.revision,\n      compactedRevision: this.compactedRevision,\n      term: this.term,\n      voters: [...this.voters],\n      learners: [...this.learners],\n      quorumSize: this.quorumSize,\n      leaseEpochs: Object.fromEntries(this.leaseEpochs),\n      resources: [...this.data.entries()].map(([key, entry]) => ({\n        key,\n        resource: structuredClone(entry.resource),\n        revision: entry.revision,\n        deleted: entry.deleted,\n      })),\n      idempotency: [...this.idempotency.entries()].map(([key, entry]) => ({\n        key,\n        requestDigest: entry.requestDigest,\n        response: structuredClone(entry.response),\n      })),\n      watchEvents: this.watchHistory.map((entry) => ({\n        key: entry.key,\n        event: structuredClone(entry.event),\n      })),\n      createdAt: new Date().toISOString(),\n    };\n  }\n\n  /** Replace the store state with a snapshot previously produced by exportSnapshot(). */\n  public restoreSnapshot(snapshot: QuorumControlStoreSnapshot): void {\n    if (this.closed) throw new Error('store is closed');\n    this.data.clear();\n    for (const entry of snapshot.resources) {\n      if (entry.key.startsWith('__idem__')) continue;\n      this.data.set(entry.key, {\n        resource: structuredClone(entry.resource),\n        revision: entry.revision,\n        deleted: entry.deleted,\n      });\n    }\n    this.idempotency.clear();\n    for (const entry of snapshot.idempotency ?? []) {\n      this.idempotency.set(entry.key, {\n        requestDigest: entry.requestDigest,\n        response: structuredClone(entry.response),\n      });\n    }\n    this.revision = snapshot.revision;\n    this.compactedRevision = snapshot.compactedRevision ?? 0;\n    this.watchHistory.splice(\n      0,\n      this.watchHistory.length,\n      ...(snapshot.watchEvents ?? []).map((entry) => ({\n        key: entry.key,\n        event: structuredClone(entry.event),\n      })),\n    );\n    this.term = snapshot.term;\n    this.voters.clear();\n    for (const id of snapshot.voters) this.voters.add(id);\n    this.learners.clear();\n    for (const id of snapshot.learners) this.learners.add(id);\n    this.quorumSize = snapshot.quorumSize;\n    this.leaseEpochs.clear();\n    for (const [name, epoch] of Object.entries(snapshot.leaseEpochs)) {\n      this.leaseEpochs.set(name, epoch);\n    }\n    // Live leases are not restored; any holder from before the snapshot must\n    // re-acquire and will receive a higher fencing epoch.\n    for (const name of [...this.leases.keys()]) {\n      this.leases.delete(name);\n      this.clearLeaseTimer(name);\n    }\n  }\n\n  public async getHealth(): Promise<ControlStoreHealth> {\n    return { healthy: this.voters.size >= this.quorumSize && !this.closed, resourceVersion: String(this.revision) };\n  }\n\n  public async close(): Promise<void> {\n    this.closed = true;\n    for (const [, t] of this.leaseTimers) clearInterval(t);\n    this.leaseTimers.clear();\n    for (const sub of this.watchers.values()) sub.close();\n    this.watchers.clear();\n  }\n\n  // ─── Topology ────────────────────────────────────────────────────────\n\n  public async getTopology(): Promise<QuorumTopology> {\n    const members: QuorumMember[] = [\n      ...[...this.voters].map((id): QuorumMember => ({ id, peerUrls: [], isLearner: id === this.memberId ? this.isLearner : false })),\n      ...[...this.learners].filter((id) => !this.voters.has(id)).map((id): QuorumMember => ({ id, peerUrls: [], isLearner: true })),\n    ];\n    const healthy = this.voters.size >= this.quorumSize && !this.closed;\n    return { members, leaderId: healthy ? this.memberId : undefined, term: this.term };\n  }\n\n  /** Recompute quorum as a majority of the current voter set (etcd semantics). */\n  private recomputeQuorum(): void {\n    this.quorumSize = Math.max(1, Math.floor(this.voters.size / 2) + 1);\n  }\n\n  private leaseReference(name: string): OrchestrationResourceReference {\n    return {\n      apiVersion: 'coordination.memeloop.io/v1alpha1',\n      kind: 'ControlLease',\n      namespace: 'system',\n      name,\n    };\n  }\n\n  public async addVoter(m: QuorumMember): Promise<void> {\n    this.learners.delete(m.id);\n    this.voters.add(m.id);\n    this.recomputeQuorum();\n    this.term += 1;\n  }\n\n  public async removeVoter(id: string): Promise<void> {\n    if (!this.voters.has(id)) return;\n    if (this.voters.size <= 1) {\n      throw new OrchestrationError({ code: 'INVALID', message: `removeVoter: cannot remove the last voter '${id}'`, retryable: false });\n    }\n    this.voters.delete(id);\n    this.recomputeQuorum();\n    this.term += 1;\n    this.checkQuorum('removeVoter');\n  }\n\n  /**\n   * Add an observer that receives no vote and does not count toward quorum\n   * (§17.3: a second node starts as observer, never a fragile two-voter\n   * configuration; promotion is an explicit later step).\n   */\n  public async addLearner(m: QuorumMember): Promise<void> {\n    if (this.voters.has(m.id)) return;\n    this.learners.add(m.id);\n  }\n\n  public async removeLearner(id: string): Promise<void> {\n    this.learners.delete(id);\n  }\n\n  public async promoteLearner(id: string): Promise<void> {\n    this.learners.delete(id);\n    this.voters.add(id);\n    if (id === this.memberId) this.isLearner = false;\n    this.recomputeQuorum();\n    this.term += 1;\n  }\n\n  // ─── Private ─────────────────────────────────────────────────────────\n\n  private expireLease(name: string): void {\n    const entry = this.leases.get(name);\n    if (entry && Date.now() >= entry.expiresAt) {\n      this.leases.delete(name);\n      this.clearLeaseTimer(name);\n    }\n  }\n\n  private clearLeaseTimer(name: string): void {\n    const t = this.leaseTimers.get(name);\n    if (t) {\n      clearInterval(t);\n      this.leaseTimers.delete(name);\n    }\n  }\n}\n","import type { Controller, ControllerReconcileResult } from './controllerRunner.js';\nimport type { ControlStoreActor } from './controlStore.js';\nimport type { ToolExecutionDriver } from './drivers/toolExecutionDriver.js';\nimport { toOrchestrationErrorData } from './errors.js';\nimport {\n  type NodeTrustClass,\n  TOOL_EXECUTOR_API_VERSION,\n  TOOL_EXECUTOR_KIND,\n  type ToolExecutorResource,\n  type ToolOperationResource,\n  type ToolOperationStatus,\n} from './resources.js';\nimport { redactSecrets } from './security/secretRedaction.js';\n\nconst TRUST_RANK: Record<NodeTrustClass, number> = {\n  quarantine: 0,\n  restricted: 1,\n  trusted: 2,\n};\n\nconst TERMINAL_PHASES = new Set(['Completed', 'Failed', 'Cancelled']);\n\nexport interface ToolExecutorSelection {\n  executor: ToolExecutorResource;\n  nodeId: string;\n  score: number;\n  reasons: string[];\n}\n\n/** Select a healthy, schema-compatible executor without loading its implementation. */\nexport function selectToolExecutor(\n  operation: ToolOperationResource,\n  executors: ToolExecutorResource[],\n): ToolExecutorSelection | null {\n  const placement = operation.spec.placement ?? {};\n  const minimumTrust = placement.minimumTrust ?? 'restricted';\n  const candidates: ToolExecutorSelection[] = [];\n\n  for (const executor of executors) {\n    const nodeId = executor.spec.nodeId;\n    if (!nodeId || executor.status?.healthy === false) continue;\n    if (placement.requiredNode && placement.requiredNode !== nodeId) continue;\n    if (\n      placement.nodeSelector && !Object.entries(placement.nodeSelector).every(\n        ([key, value]) => executor.spec.selectors?.[key] === value,\n      )\n    ) continue;\n    const trust = executor.spec.trust ?? 'quarantine';\n    if (TRUST_RANK[trust] < TRUST_RANK[minimumTrust]) continue;\n\n    const capability = executor.spec.capabilities.find((candidate) =>\n      candidate.toolClassRef.name === operation.spec.toolRef.name &&\n      (candidate.effects ?? ['execute']).includes(operation.spec.effect) &&\n      (!operation.spec.toolRef.schemaDigest ||\n        candidate.schemaDigest === operation.spec.toolRef.schemaDigest) &&\n      candidate.health?.healthy !== false\n    );\n    if (!capability) continue;\n\n    const maximum = capability.capacity?.maxConcurrent ?? 1;\n    const queued = capability.capacity?.queueDepth ?? 0;\n    const spare = maximum - queued;\n    if (spare <= 0) continue;\n    let score = spare * 100 + TRUST_RANK[trust] * 10;\n    const reasons = [`schema ${capability.schemaDigest}`, `spare capacity ${spare}`];\n    if (placement.preferredNode === nodeId) {\n      score += 1000;\n      reasons.push('preferred node');\n    }\n    candidates.push({ executor, nodeId, score, reasons });\n  }\n\n  candidates.sort((left, right) =>\n    right.score - left.score ||\n    (left.executor.metadata.name ?? '').localeCompare(right.executor.metadata.name ?? '')\n  );\n  return candidates[0] ?? null;\n}\n\nexport interface ToolOperationBindingControllerOptions {\n  actor: ControlStoreActor;\n  listExecutors: () => Promise<ToolExecutorResource[]>;\n  retryAfterMs?: number;\n}\n\nfunction withScheduledCondition(\n  status: ToolOperationStatus,\n  conditionStatus: 'True' | 'False',\n  reason: string,\n  now: Date,\n): ToolOperationStatus {\n  const conditions = (status.conditions ?? []).filter((condition) => condition.type !== 'Scheduled');\n  conditions.push({\n    type: 'Scheduled',\n    status: conditionStatus,\n    reason,\n    lastTransitionTime: now.toISOString(),\n  });\n  return { ...status, conditions };\n}\n\n/**\n * Independently bind pending ToolOperations to declarative ToolExecutors.\n * Explicit external-orchestrator operations remain owned by that controller.\n */\nexport function createToolOperationBindingController(\n  options: ToolOperationBindingControllerOptions,\n): Controller<ToolOperationResource['spec']> {\n  return {\n    async reconcile(request): Promise<ControllerReconcileResult> {\n      const operation = request.resource as ToolOperationResource;\n      const status = operation.status ?? {};\n      if (\n        operation.spec.placement?.orchestrator ||\n        TERMINAL_PHASES.has(status.phase ?? '') ||\n        status.phase === 'Running' ||\n        status.assignedExecutor\n      ) {\n        return { ready: true };\n      }\n\n      const selected = selectToolExecutor(operation, await options.listExecutors());\n      if (!selected) {\n        return {\n          status: withScheduledCondition(\n            { ...status, phase: 'Pending' },\n            'False',\n            'NoSuitableExecutor',\n            request.now,\n          ),\n          ready: false,\n          requeueAfterMs: options.retryAfterMs ?? 1000,\n        };\n      }\n\n      const executor = selected.executor;\n      return {\n        status: withScheduledCondition(\n          {\n            ...status,\n            phase: 'Pending',\n            assignedNode: selected.nodeId,\n            assignedDriver: executor.metadata.name,\n            assignedExecutor: {\n              apiVersion: TOOL_EXECUTOR_API_VERSION,\n              kind: TOOL_EXECUTOR_KIND,\n              name: executor.metadata.name,\n              namespace: executor.metadata.namespace,\n              uid: executor.metadata.uid,\n            },\n          },\n          'True',\n          `BoundTo ${executor.metadata.name}`,\n          request.now,\n        ),\n        ready: true,\n      };\n    },\n  };\n}\n\nexport interface ToolOperationExecutionControllerOptions {\n  actor: ControlStoreActor;\n  nodeId: string;\n  driver: ToolExecutionDriver;\n}\n\nfunction unknownEffectStatus(\n  status: ToolOperationStatus,\n  now: Date,\n  message = 'tool executor fencing epoch changed after execution was claimed; effect requires external verification',\n): ToolOperationStatus {\n  const action = 'verification-required';\n  const conditions = (status.conditions ?? []).filter((condition) => condition.type !== 'EffectUnknown');\n  conditions.push({\n    type: 'EffectUnknown',\n    status: 'True',\n    reason: action,\n    lastTransitionTime: now.toISOString(),\n  });\n  return {\n    ...status,\n    phase: 'Failed',\n    completedAt: now.toISOString(),\n    result: {\n      error: {\n        code: 'UNKNOWN_EFFECT',\n        message,\n        retryable: false,\n        reason: action,\n      },\n    },\n    conditions,\n  };\n}\n\nexport interface ToolOperationExecutionController extends Controller<ToolOperationResource['spec']> {\n  /** Cooperatively abort one currently executing operation. */\n  cancel(operation: Pick<ToolOperationResource, 'metadata'>): boolean;\n  /** Abort all local effects during runtime shutdown. */\n  cancelAll(): number;\n  /** Diagnostic count only; no operation inputs/results are exposed. */\n  activeCount(): number;\n}\n\nfunction operationKey(operation: Pick<ToolOperationResource, 'metadata'>): string {\n  return operation.metadata.uid ??\n    `${operation.metadata.namespace ?? 'default'}/${operation.metadata.name ?? ''}`;\n}\n\n/**\n * Execute operations assigned to one node. Claiming and effect execution are\n * deliberately separate reconciles so the claim is durable before any side\n * effect starts.\n */\nexport function createToolOperationExecutionController(\n  options: ToolOperationExecutionControllerOptions,\n): ToolOperationExecutionController {\n  const active = new Map<string, {\n    controller: AbortController;\n    reason: 'cancelled' | 'timeout';\n  }>();\n\n  const controller: ToolOperationExecutionController = {\n    cancel(operation) {\n      const current = active.get(operationKey(operation));\n      if (!current) return false;\n      current.reason = 'cancelled';\n      current.controller.abort();\n      return true;\n    },\n    cancelAll() {\n      const count = active.size;\n      for (const current of active.values()) {\n        current.reason = 'cancelled';\n        current.controller.abort();\n      }\n      return count;\n    },\n    activeCount: () => active.size,\n    async reconcile(request): Promise<ControllerReconcileResult> {\n      const operation = request.resource as ToolOperationResource;\n      const status = operation.status ?? {};\n      if (\n        operation.spec.placement?.orchestrator ||\n        TERMINAL_PHASES.has(status.phase ?? '') ||\n        status.assignedNode !== options.nodeId\n      ) {\n        return { ready: true };\n      }\n\n      if ((status.phase ?? 'Pending') === 'Pending') {\n        return {\n          status: {\n            ...status,\n            phase: 'Running',\n            startedAt: status.startedAt ?? request.now.toISOString(),\n            executionClaim: {\n              leaseEpoch: request.leaseEpoch,\n              claimedAt: request.now.toISOString(),\n            },\n          } as ToolOperationStatus,\n          ready: false,\n        };\n      }\n\n      if (status.phase !== 'Running' || !status.executionClaim) return { ready: true };\n      if (status.executionClaim.leaseEpoch !== request.leaseEpoch) {\n        if (operation.spec.effect === 'read') {\n          return {\n            status: {\n              ...status,\n              phase: 'Pending',\n              executionClaim: undefined,\n            } as ToolOperationStatus,\n            ready: false,\n          };\n        }\n        return { status: unknownEffectStatus(status, request.now), ready: true };\n      }\n\n      const key = operationKey(operation);\n      const abortController = new AbortController();\n      const activeExecution: {\n        controller: AbortController;\n        reason: 'cancelled' | 'timeout';\n      } = { controller: abortController, reason: 'cancelled' };\n      active.set(key, activeExecution);\n      const timeoutMs = operation.spec.timeoutMs;\n      const timeout = timeoutMs !== undefined && timeoutMs > 0\n        ? setTimeout(() => {\n          activeExecution.reason = 'timeout';\n          abortController.abort();\n        }, timeoutMs)\n        : undefined;\n      const execution = options.driver.execute(operation, {\n        signal: abortController.signal,\n        actor: request.actor,\n        leaseEpoch: request.leaseEpoch,\n      }).then(\n        (executed) => ({ kind: 'executed' as const, executed }),\n        (error: unknown) => ({ kind: 'error' as const, error }),\n      );\n      const aborted = new Promise<{ kind: 'aborted' }>((resolve) => {\n        abortController.signal.addEventListener(\n          'abort',\n          () => {\n            resolve({ kind: 'aborted' });\n          },\n          { once: true },\n        );\n      });\n      const outcome = await Promise.race([execution, aborted]);\n      if (timeout !== undefined) clearTimeout(timeout);\n      active.delete(key);\n\n      if (outcome.kind === 'aborted') {\n        // Observe eventual driver settlement to prevent an unhandled rejection;\n        // terminal state is decided now so an uncooperative tool cannot hang\n        // the controller indefinitely.\n        void execution.then(() => undefined);\n        if (operation.spec.effect !== 'read') {\n          return {\n            status: unknownEffectStatus(\n              status,\n              request.now,\n              `tool operation ${activeExecution.reason} after its effect started; external verification is required`,\n            ),\n            ready: true,\n          };\n        }\n        const timedOut = activeExecution.reason === 'timeout';\n        return {\n          status: {\n            ...status,\n            phase: timedOut ? 'Failed' : 'Cancelled',\n            completedAt: request.now.toISOString(),\n            result: {\n              error: {\n                code: timedOut ? 'TIMEOUT' : 'CANCELLED',\n                message: timedOut ? 'ToolOperation timed out' : 'ToolOperation cancelled',\n                retryable: timedOut,\n              },\n            },\n          } as ToolOperationStatus,\n          ready: true,\n        };\n      }\n\n      if (outcome.kind === 'executed') {\n        return {\n          status: {\n            ...outcome.executed.status,\n            assignedDriver: status.assignedDriver,\n            assignedNode: status.assignedNode,\n            assignedExecutor: status.assignedExecutor,\n            executionClaim: status.executionClaim,\n          } as ToolOperationStatus,\n          ready: true,\n        };\n      }\n\n      return {\n        status: {\n          ...status,\n          phase: 'Failed',\n          completedAt: request.now.toISOString(),\n          result: {\n            error: redactSecrets(toOrchestrationErrorData(outcome.error)),\n          },\n        } as ToolOperationStatus,\n        ready: true,\n      };\n    },\n  };\n  return controller;\n}\n","import type { Controller } from './controllerRunner.js';\nimport type { DriverRequestEnvelope } from './drivers/driverRequest.js';\nimport { type StorageDriver, type StorageDriverCapabilities, storageDriverSatisfiesClass, type StorageProvisionResult } from './drivers/storageDriver.js';\nimport type { StorageManagementDriver, StorageProvisionPayload } from './drivers/storageManagement.js';\nimport type { AgentVolumeClaimResource, AgentVolumeClaimStatus, AgentVolumeResource, NodeTrustClass, StorageClassResource } from './resources.js';\n\nexport interface StorageDriverEndpoint {\n  nodeId: string;\n  healthy: boolean;\n  capabilities: StorageDriverCapabilities[];\n  trust: NodeTrustClass;\n  labels?: Record<string, string>;\n  activeVolumes?: number;\n  maxVolumes?: number;\n  availableBytes?: number;\n}\n\nexport interface VolumeClaimBindingControllerOptions {\n  getStorageClass(claim: AgentVolumeClaimResource): Promise<StorageClassResource | null>;\n  listDrivers(): Promise<StorageDriverEndpoint[]>;\n  requiredNodeForClaim?(claim: AgentVolumeClaimResource): Promise<string | undefined>;\n  now?: () => Date;\n}\n\n/** Independently binds a claim to a healthy provisioner endpoint. */\nexport function createVolumeClaimBindingController(\n  options: VolumeClaimBindingControllerOptions,\n): Controller<AgentVolumeClaimResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const claim = request.resource as AgentVolumeClaimResource;\n      const status = claim.status ?? {};\n      if (status.phase && status.phase !== 'Pending') return { ready: true };\n      const storageClass = await options.getStorageClass(claim);\n      const reconciledAt = now().toISOString();\n      if (!storageClass) {\n        return {\n          status: {\n            ...status,\n            phase: 'Pending',\n            conditions: [{\n              type: 'VolumeScheduled',\n              status: 'False',\n              reason: 'StorageClassUnavailable',\n              message: 'referenced StorageClass is unavailable',\n              lastTransitionTime: reconciledAt,\n            }],\n          } satisfies AgentVolumeClaimStatus,\n          requeueAfterMs: 1000,\n        };\n      }\n      const requiredNode = await options.requiredNodeForClaim?.(claim);\n      const candidates = (await options.listDrivers()).flatMap((endpoint) => {\n        if (\n          !endpoint.healthy ||\n          endpoint.trust !== 'trusted' ||\n          (requiredNode && endpoint.nodeId !== requiredNode)\n        ) return [];\n        if (\n          endpoint.maxVolumes !== undefined &&\n          (endpoint.activeVolumes ?? 0) >= endpoint.maxVolumes\n        ) return [];\n        if (\n          endpoint.availableBytes !== undefined &&\n          (claim.spec.sizeBytes ?? 0) > endpoint.availableBytes\n        ) return [];\n        if (\n          claim.spec.selector &&\n          Object.entries(claim.spec.selector).some(([key, value]) => endpoint.labels?.[key] !== value)\n        ) return [];\n        const capability = endpoint.capabilities.find((item) => storageDriverSatisfiesClass(item, claim, storageClass));\n        return capability ? [{ endpoint, capability }] : [];\n      }).sort((left, right) =>\n        (left.endpoint.activeVolumes ?? 0) - (right.endpoint.activeVolumes ?? 0) ||\n        left.endpoint.nodeId.localeCompare(right.endpoint.nodeId)\n      );\n      const selected = candidates[0];\n      if (!selected) {\n        const { assignedNode: _node, assignedDriver: _driver, binding: _binding, ...unbound } = status;\n        return {\n          status: {\n            ...unbound,\n            phase: 'Pending',\n            conditions: [{\n              type: 'VolumeScheduled',\n              status: 'False',\n              reason: 'NoEligibleStorageDriver',\n              message: `no healthy driver satisfies StorageClass '${storageClass.metadata.name}'`,\n              lastTransitionTime: reconciledAt,\n            }],\n          } satisfies AgentVolumeClaimStatus,\n          requeueAfterMs: 1000,\n        };\n      }\n      if (\n        status.assignedNode === selected.endpoint.nodeId &&\n        status.assignedDriver === selected.capability.name &&\n        status.binding?.leaseEpoch === request.leaseEpoch &&\n        status.binding.storageClassResourceVersion === storageClass.metadata.resourceVersion\n      ) return { ready: true };\n      return {\n        status: {\n          ...status,\n          phase: 'Pending',\n          assignedNode: selected.endpoint.nodeId,\n          assignedDriver: selected.capability.name,\n          binding: {\n            leaseEpoch: request.leaseEpoch,\n            storageClassResourceVersion: storageClass.metadata.resourceVersion,\n            boundAt: reconciledAt,\n          },\n          conditions: [{\n            type: 'VolumeScheduled',\n            status: 'True',\n            reason: 'StorageDriverSelected',\n            message: `bound to '${selected.capability.name}' on '${selected.endpoint.nodeId}'`,\n            lastTransitionTime: reconciledAt,\n          }],\n        } satisfies AgentVolumeClaimStatus,\n        ready: true,\n      };\n    },\n  };\n}\n\nexport interface VolumeClaimExecutionControllerOptions {\n  nodeId: string;\n  getStorageClass(claim: AgentVolumeClaimResource): Promise<StorageClassResource | null>;\n  getDriver(name: string): Promise<StorageDriver | undefined>;\n  managed?: {\n    getDriver(name: string): Promise<StorageManagementDriver | undefined>;\n    createProvisionRequest(input: {\n      claim: AgentVolumeClaimResource;\n      storageClass: StorageClassResource;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<StorageProvisionPayload>>;\n  };\n  ensureVolume(\n    claim: AgentVolumeClaimResource,\n    storageClass: StorageClassResource,\n    provisioned: StorageProvisionResult,\n  ): Promise<AgentVolumeResource>;\n  now?: () => Date;\n}\n\n/** Persists a fencing claim before idempotent volume provisioning. */\nexport function createVolumeClaimExecutionController(\n  options: VolumeClaimExecutionControllerOptions,\n): Controller<AgentVolumeClaimResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const claim = request.resource as AgentVolumeClaimResource;\n      const status = claim.status ?? {};\n      if (status.assignedNode !== options.nodeId || !status.assignedDriver || !status.binding) {\n        return { ready: true };\n      }\n      if (status.phase === 'Bound' || status.phase === 'Lost' || status.phase === 'Failed') {\n        return { ready: true };\n      }\n      const storageClass = await options.getStorageClass(claim);\n      if (\n        !storageClass ||\n        storageClass.metadata.resourceVersion !== status.binding.storageClassResourceVersion\n      ) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'CONFLICT',\n              message: 'StorageClass changed after claim binding',\n              retryable: false,\n            },\n          } satisfies AgentVolumeClaimStatus,\n          ready: true,\n        };\n      }\n      const driver = await options.getDriver(status.assignedDriver);\n      if (!driver || !(await driver.getHealth()).healthy) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNAVAILABLE',\n              message: `bound storage driver '${status.assignedDriver}' is unavailable`,\n              retryable: true,\n            },\n          } satisfies AgentVolumeClaimStatus,\n          ready: true,\n        };\n      }\n      if (status.phase !== 'Provisioning') {\n        return {\n          status: {\n            ...status,\n            phase: 'Provisioning',\n            provisionClaim: {\n              leaseEpoch: request.leaseEpoch,\n              claimedAt: now().toISOString(),\n            },\n          } satisfies AgentVolumeClaimStatus,\n          requeueAfterMs: 1,\n        };\n      }\n      if (status.provisionClaim?.leaseEpoch !== request.leaseEpoch) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNKNOWN_EFFECT',\n              message: 'controller epoch changed after volume provisioning was claimed',\n              retryable: false,\n            },\n          } satisfies AgentVolumeClaimStatus,\n          ready: true,\n        };\n      }\n      const capability = await driver.getCapabilities();\n      if (!storageDriverSatisfiesClass(capability, claim, storageClass)) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'FORBIDDEN',\n              message: 'storage driver no longer satisfies the bound claim',\n              retryable: false,\n            },\n          } satisfies AgentVolumeClaimStatus,\n          ready: true,\n        };\n      }\n      const managedDriver = options.managed\n        ? await options.managed.getDriver(status.assignedDriver)\n        : undefined;\n      const managedVolume = managedDriver && options.managed\n        ? await managedDriver.provision(\n          await options.managed.createProvisionRequest({\n            claim,\n            storageClass,\n            actor: request.actor,\n            leaseEpoch: request.leaseEpoch,\n          }),\n        )\n        : undefined;\n      const provisioned = managedVolume\n        ? {\n          driverHandle: managedVolume.volumeHandle,\n          capacityBytes: managedVolume.capacityBytes,\n          topology: { nodeId: options.nodeId },\n        }\n        : await driver.provision({ claim, storageClass });\n      const volume = await options.ensureVolume(claim, storageClass, provisioned);\n      return {\n        status: {\n          ...status,\n          phase: 'Bound',\n          volumeRef: {\n            apiVersion: volume.apiVersion,\n            kind: volume.kind,\n            name: volume.metadata.name,\n            uid: volume.metadata.uid,\n          },\n        } satisfies AgentVolumeClaimStatus,\n        ready: true,\n      };\n    },\n  };\n}\n","import type { OrchestrationResource, OrchestrationResourceReference, OrchestrationResourceStatus } from './client.js';\nimport type { ControlStore, ControlStoreActor } from './controlStore.js';\nimport { OrchestrationError } from './errors.js';\nimport type { LoopRuntimeDriver } from './loopRuntimeDriver.js';\nimport {\n  AGENT_RUN_API_VERSION,\n  AGENT_RUN_KIND,\n  AGENT_WORKLOAD_API_VERSION,\n  AGENT_WORKLOAD_KIND,\n  type AgentRunResource,\n  type AgentRunStatus,\n  type AgentWorkloadResource,\n  type AgentWorkloadStatus,\n  createAgentRunManifest,\n  createNetworkAttachmentManifest,\n  MODEL_ENDPOINT_API_VERSION,\n  MODEL_ENDPOINT_KIND,\n  type ModelEndpointResource,\n  NETWORK_ATTACHMENT_API_VERSION,\n  NETWORK_ATTACHMENT_KIND,\n  type NetworkAttachmentResource,\n  type NetworkAttachmentStatus,\n  type NetworkClassResource,\n} from './resources.js';\n\n/**\n * Workload execution controller (Phase 4.2 / plan 24.14).\n *\n * Watches AgentWorkloads, and for each one the binding controller (24.56)\n * has scheduled onto THIS node (`status.phase === 'Scheduling'` with\n * `status.assignedNode === nodeId`), creates an AgentRun and executes it\n * through the injected LoopRuntimeDriver. Terminal outcomes are written to\n * both the run and the workload. Deleting a running workload cancels its\n * execution. Executions on other nodes are ignored — remote nodes run their\n * own controller instance.\n */\n\nexport interface WorkloadExecutionControllerOptions {\n  /** Host-bound actor identity for all ControlStore writes. */\n  actor: ControlStoreActor;\n  /** Only execute workloads bound to this node name. */\n  nodeId: string;\n  /** Stable only for this daemon lifetime; changes after restart. */\n  controllerInstanceId?: string;\n  /** Resolve a `spec.scriptReference` (content digest) to admitted source. */\n  resolveScriptSource?: (scriptReference: string) => Promise<string | undefined>;\n  /** Message delivered to the loop (default: workload name). */\n  messageForWorkload?: (workload: AgentWorkloadResource) => string;\n  /** CAS attempts per status write (default 3). */\n  statusWriteAttempts?: number;\n  /** Maximum wait for an independently scheduled ModelEndpoint (default 30s). */\n  modelBindingTimeoutMs?: number;\n  /** Maximum wait for an independently prepared NetworkAttachment (default 30s). */\n  networkAttachmentTimeoutMs?: number;\n  /** Maximum wait for independently published volumes (default 30s). */\n  volumeBindingTimeoutMs?: number;\n  /** Resolve publish handles into ephemeral host mount paths. */\n  resolveVolumeMounts?: (\n    workload: AgentWorkloadResource,\n    run: AgentRunResource,\n  ) => Promise<NonNullable<import('./loopRuntimeDriver.js').LoopRunStartRequest['volumeMounts']>>;\n  /** Poll interval while waiting for model binding (default 25ms). */\n  dependencyPollIntervalMs?: number;\n  /** Revalidate selected endpoint heartbeat age before launch (default 90s). */\n  modelEndpointHeartbeatTtlMs?: number;\n  /** Injectable sleep for watch-retry backoff in tests. */\n  sleep?: (ms: number) => Promise<void>;\n  /** Observes swallowed errors; the controller keeps watching regardless. */\n  onError?: (error: unknown) => void;\n}\n\nexport interface WorkloadExecutionControllerHandle {\n  stop(): Promise<void>;\n}\n\nconst TERMINAL_RUN_PHASES = new Set(['Completed', 'Failed', 'Cancelled']);\nlet controllerInstanceCounter = 0;\n\nexport function createWorkloadExecutionController(\n  store: ControlStore,\n  driver: LoopRuntimeDriver,\n  options: WorkloadExecutionControllerOptions,\n): WorkloadExecutionControllerHandle {\n  const sleep = options.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n  const statusWriteAttempts = options.statusWriteAttempts ?? 3;\n  const modelBindingTimeoutMs = options.modelBindingTimeoutMs ?? 30_000;\n  const networkAttachmentTimeoutMs = options.networkAttachmentTimeoutMs ?? 30_000;\n  const volumeBindingTimeoutMs = options.volumeBindingTimeoutMs ?? 30_000;\n  const dependencyPollIntervalMs = options.dependencyPollIntervalMs ?? 25;\n  const modelEndpointHeartbeatTtlMs = options.modelEndpointHeartbeatTtlMs ?? 90_000;\n  const onError = options.onError ?? ((): void => {});\n  controllerInstanceCounter += 1;\n  const controllerInstanceId = options.controllerInstanceId ??\n    `${options.nodeId}:${Date.now()}:${controllerInstanceCounter}`;\n  if (!controllerInstanceId) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: 'workload execution controller instance identity is required',\n      retryable: false,\n    });\n  }\n  const active = new Map<string, { cancel(): Promise<void> }>();\n  let stopped = false;\n\n  async function updateStatusWithRetry<TStatus extends OrchestrationResourceStatus>(\n    reference: OrchestrationResourceReference,\n    patch: (current: TStatus | undefined) => TStatus,\n  ): Promise<void> {\n    for (let attempt = 0; attempt < statusWriteAttempts; attempt += 1) {\n      const current = await store.get<Record<string, unknown>, TStatus>(reference);\n      if (!current) return; // Deleted concurrently.\n      try {\n        await store.updateStatus(options.actor, reference, patch(current.status), {\n          resourceVersion: current.metadata.resourceVersion,\n        });\n        return;\n      } catch (error) {\n        if (error instanceof OrchestrationError && error.code === 'CONFLICT') continue;\n        throw error;\n      }\n    }\n    throw new OrchestrationError({\n      code: 'CONFLICT',\n      message: `status update for '${reference.name ?? ''}' exceeded ${statusWriteAttempts} CAS attempts`,\n      retryable: true,\n    });\n  }\n\n  function workloadReference(workload: AgentWorkloadResource): OrchestrationResourceReference {\n    return {\n      apiVersion: AGENT_WORKLOAD_API_VERSION,\n      kind: AGENT_WORKLOAD_KIND,\n      name: workload.metadata.name,\n      namespace: workload.metadata.namespace,\n    };\n  }\n\n  function assertCanonicalRunBinding(\n    workload: AgentWorkloadResource,\n    run: AgentRunResource,\n  ): void {\n    const reference = run.spec.workloadRef;\n    const workloadNamespace = workload.metadata.namespace ?? 'default';\n    const referenceNamespace = reference.namespace ?? run.metadata.namespace ?? 'default';\n    if (\n      reference.apiVersion !== AGENT_WORKLOAD_API_VERSION ||\n      reference.kind !== AGENT_WORKLOAD_KIND ||\n      reference.name !== workload.metadata.name ||\n      referenceNamespace !== workloadNamespace ||\n      reference.uid !== workload.metadata.uid ||\n      run.spec.promptReference !== undefined ||\n      run.spec.retry !== undefined ||\n      run.spec.timeoutMs !== undefined\n    ) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: `pre-existing AgentRun '${run.metadata.name}' does not exactly match controller-owned workload '${workload.metadata.name}'`,\n        retryable: false,\n      });\n    }\n  }\n\n  async function claimRuntimeExecution(\n    reference: OrchestrationResourceReference,\n  ): Promise<AgentRunResource | null> {\n    for (let attempt = 0; attempt < statusWriteAttempts; attempt += 1) {\n      const current = await store.get<\n        AgentRunResource['spec'],\n        AgentRunResource['status']\n      >(reference) as AgentRunResource | null;\n      if (!current) return null;\n      // Another daemon already crossed the durable pre-effect boundary.\n      // Never overwrite its claim, even after a CAS retry.\n      if (current.status?.runtimeExecutionClaim) return null;\n      try {\n        return await store.updateStatus<\n          AgentRunResource['spec'],\n          AgentRunResource['status']\n        >(\n          options.actor,\n          reference,\n          {\n            ...current.status,\n            phase: 'Starting',\n            runtimeExecutionClaim: {\n              controllerInstanceId,\n              claimedAt: new Date().toISOString(),\n            },\n          },\n          { resourceVersion: current.metadata.resourceVersion },\n        ) as AgentRunResource;\n      } catch (error) {\n        if (error instanceof OrchestrationError && error.code === 'CONFLICT') {\n          continue;\n        }\n        throw error;\n      }\n    }\n    throw new OrchestrationError({\n      code: 'CONFLICT',\n      message: `runtime execution claim for '${reference.name ?? ''}' exceeded ${statusWriteAttempts} CAS attempts`,\n      retryable: true,\n    });\n  }\n\n  async function waitForModelBinding(\n    workload: AgentWorkloadResource,\n    runReference: OrchestrationResourceReference,\n  ): Promise<{ run: AgentRunResource; endpoint?: ModelEndpointResource }> {\n    const deadline = Date.now() + modelBindingTimeoutMs;\n    for (;;) {\n      if (stopped) {\n        throw new OrchestrationError({\n          code: 'CANCELLED',\n          message: 'workload execution controller stopped while awaiting dependencies',\n          retryable: false,\n        });\n      }\n      const current = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(\n        runReference,\n      ) as AgentRunResource | null;\n      if (!current) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: `AgentRun '${runReference.name ?? ''}' was deleted while awaiting dependencies`,\n          retryable: false,\n        });\n      }\n      if (!workload.spec.modelPolicy?.modelClass) return { run: current };\n      const binding = current.status?.assignedModelEndpoint;\n      if (binding) {\n        const endpoint = await store.get<ModelEndpointResource['spec'], ModelEndpointResource['status']>({\n          apiVersion: binding.apiVersion || MODEL_ENDPOINT_API_VERSION,\n          kind: binding.kind || MODEL_ENDPOINT_KIND,\n          name: binding.name,\n          namespace: binding.namespace,\n        }) as ModelEndpointResource | null;\n        if (\n          endpoint &&\n          endpoint.metadata.uid === binding.uid &&\n          endpoint.status?.healthy === true &&\n          Number.isFinite(Date.parse(endpoint.status.heartbeat ?? '')) &&\n          Date.now() - Date.parse(endpoint.status.heartbeat ?? '') <= modelEndpointHeartbeatTtlMs &&\n          endpoint.spec.modelClassRef.name === workload.spec.modelPolicy.modelClass\n        ) {\n          return { run: current, endpoint };\n        }\n      }\n      if (Date.now() >= deadline) {\n        throw new OrchestrationError({\n          code: 'TIMEOUT',\n          message: `AgentRun '${current.metadata.name}' did not receive a healthy ModelEndpoint binding within ${modelBindingTimeoutMs}ms`,\n          retryable: true,\n        });\n      }\n      await sleep(dependencyPollIntervalMs);\n    }\n  }\n\n  async function ensureNetworkAttachment(\n    workload: AgentWorkloadResource,\n    runReference: OrchestrationResourceReference,\n    runUid: string,\n  ): Promise<NetworkAttachmentResource | undefined> {\n    const networkClassName = workload.spec.networkPolicy?.networkClass;\n    if (!networkClassName) return undefined;\n    const attachmentName = `${runReference.name ?? workload.metadata.name}-network`;\n    const reference: OrchestrationResourceReference = {\n      apiVersion: NETWORK_ATTACHMENT_API_VERSION,\n      kind: NETWORK_ATTACHMENT_KIND,\n      name: attachmentName,\n      namespace: workload.metadata.namespace,\n    };\n    let attachment = await store.get<\n      NetworkAttachmentResource['spec'],\n      NetworkAttachmentResource['status']\n    >(reference) as NetworkAttachmentResource | null;\n    if (!attachment) {\n      const manifest = createNetworkAttachmentManifest(attachmentName, {\n        networkClassRef: {\n          apiVersion: 'network.memeloop.io/v1alpha1',\n          kind: 'NetworkClass',\n          name: networkClassName,\n        },\n        workloadRef: {\n          apiVersion: workload.apiVersion,\n          kind: workload.kind,\n          name: workload.metadata.name,\n          uid: workload.metadata.uid,\n        },\n        runRef: {\n          apiVersion: runReference.apiVersion,\n          kind: runReference.kind,\n          name: runReference.name as string,\n          uid: runUid,\n          controller: true,\n        },\n        nodeId: options.nodeId,\n      });\n      manifest.metadata.namespace = workload.metadata.namespace;\n      attachment = await store.create(options.actor, manifest) as unknown as NetworkAttachmentResource;\n    }\n    await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n      ...current,\n      networkAttachmentRef: {\n        apiVersion: attachment.apiVersion,\n        kind: attachment.kind,\n        name: attachment.metadata.name,\n        ...(attachment.metadata.namespace ? { namespace: attachment.metadata.namespace } : {}),\n        uid: attachment.metadata.uid,\n      },\n    }));\n\n    const deadline = Date.now() + networkAttachmentTimeoutMs;\n    for (;;) {\n      if (stopped) {\n        throw new OrchestrationError({\n          code: 'CANCELLED',\n          message: 'workload execution controller stopped while awaiting network attachment',\n          retryable: false,\n        });\n      }\n      const current = await store.get<\n        NetworkAttachmentResource['spec'],\n        NetworkAttachmentResource['status']\n      >(reference) as NetworkAttachmentResource | null;\n      if (!current || current.metadata.uid !== attachment.metadata.uid) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: `NetworkAttachment '${attachmentName}' disappeared before workload launch`,\n          retryable: false,\n        });\n      }\n      if (current.status?.phase === 'Failed') {\n        throw new OrchestrationError({\n          code: current.status.error?.code ?? 'UNAVAILABLE',\n          message: current.status.error?.message ?? `NetworkAttachment '${attachmentName}' failed`,\n          retryable: current.status.error?.retryable ?? false,\n        });\n      }\n      if (current.status?.phase === 'Attached' && current.status.handle) {\n        const networkClass = await store.get<\n          NetworkClassResource['spec'],\n          NetworkClassResource['status']\n        >(current.spec.networkClassRef) as NetworkClassResource | null;\n        if (\n          networkClass &&\n          current.status.binding?.networkClassResourceVersion === networkClass.metadata.resourceVersion &&\n          current.status.assignedNode === options.nodeId &&\n          current.status.assignedDriver === networkClass.spec.driver\n        ) {\n          return current;\n        }\n      }\n      if (Date.now() >= deadline) {\n        throw new OrchestrationError({\n          code: 'TIMEOUT',\n          message: `NetworkAttachment '${attachmentName}' was not ready within ${networkAttachmentTimeoutMs}ms`,\n          retryable: true,\n        });\n      }\n      await sleep(dependencyPollIntervalMs);\n    }\n  }\n\n  async function waitForVolumeBindings(\n    workload: AgentWorkloadResource,\n    runReference: OrchestrationResourceReference,\n  ): Promise<{\n    run: AgentRunResource;\n    mounts?: NonNullable<import('./loopRuntimeDriver.js').LoopRunStartRequest['volumeMounts']>;\n  }> {\n    const expected = workload.spec.storagePolicy?.volumes ?? [];\n    if (expected.length === 0) {\n      const run = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(\n        runReference,\n      ) as AgentRunResource;\n      return { run };\n    }\n    const deadline = Date.now() + volumeBindingTimeoutMs;\n    for (;;) {\n      if (stopped) {\n        throw new OrchestrationError({\n          code: 'CANCELLED',\n          message: 'workload execution controller stopped while awaiting volumes',\n          retryable: false,\n        });\n      }\n      const run = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(\n        runReference,\n      ) as AgentRunResource | null;\n      if (!run) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: `AgentRun '${runReference.name ?? ''}' disappeared while awaiting volumes`,\n          retryable: false,\n        });\n      }\n      if (run.status?.volumePhase === 'Failed') {\n        throw new OrchestrationError(\n          run.status.volumeError ?? {\n            code: 'UNAVAILABLE',\n            message: 'volume publication failed',\n            retryable: false,\n          },\n        );\n      }\n      const bindingNames = new Set(run.status?.volumeBindings?.map((item) => item.name));\n      if (\n        run.status?.volumePhase === 'Ready' &&\n        expected.every((item) => bindingNames.has(item.name))\n      ) {\n        if (!options.resolveVolumeMounts) {\n          throw new OrchestrationError({\n            code: 'UNSUPPORTED',\n            message: 'host cannot resolve published volume handles',\n            retryable: false,\n          });\n        }\n        return { run, mounts: await options.resolveVolumeMounts(workload, run) };\n      }\n      if (Date.now() >= deadline) {\n        throw new OrchestrationError({\n          code: 'TIMEOUT',\n          message: `AgentRun '${run.metadata.name}' volumes were not ready within ${volumeBindingTimeoutMs}ms`,\n          retryable: true,\n        });\n      }\n      await sleep(dependencyPollIntervalMs);\n    }\n  }\n\n  async function requestDependencyRelease(\n    runReference: OrchestrationResourceReference,\n  ): Promise<void> {\n    const run = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(\n      runReference,\n    ) as AgentRunResource | null;\n    if (!run) return;\n    const requestedAt = new Date().toISOString();\n    const attachment = run.status?.networkAttachmentRef;\n    if (attachment) {\n      await updateStatusWithRetry<NetworkAttachmentStatus>(\n        {\n          apiVersion: attachment.apiVersion,\n          kind: attachment.kind,\n          name: attachment.name,\n          namespace: attachment.namespace,\n        },\n        (current) => ({\n          ...current,\n          releaseRequestedAt: requestedAt,\n        }),\n      );\n    }\n    if (\n      run.status?.volumePhase === 'Ready' ||\n      run.status?.volumePhase === 'Publishing'\n    ) {\n      await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n        ...current,\n        volumeReleaseRequestedAt: requestedAt,\n      }));\n    }\n  }\n\n  async function execute(workload: AgentWorkloadResource): Promise<void> {\n    const workloadReference_ = workloadReference(workload);\n    const runName = `${workload.metadata.name}-run`;\n    const runReference: OrchestrationResourceReference = {\n      apiVersion: AGENT_RUN_API_VERSION,\n      kind: AGENT_RUN_KIND,\n      name: runName,\n      namespace: workload.metadata.namespace,\n    };\n    let runtimeClaimed = false;\n\n    try {\n      // Resolve script source for artifact-backed workloads.\n      let scriptSource: string | undefined;\n      if (workload.spec.scriptReference) {\n        scriptSource = await options.resolveScriptSource?.(workload.spec.scriptReference);\n        if (!scriptSource) {\n          await updateStatusWithRetry<AgentWorkloadStatus>(workloadReference_, (current) => ({\n            ...current,\n            phase: 'Failed',\n            lastRunResult: `script artifact '${workload.spec.scriptReference}' unavailable`,\n          }));\n          return;\n        }\n      }\n\n      // Create (or adopt, after a controller restart) the AgentRun.\n      let run = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(runReference) as AgentRunResource | null;\n      if (!run) {\n        const manifest = createAgentRunManifest(runName, {\n          workloadRef: {\n            apiVersion: AGENT_WORKLOAD_API_VERSION,\n            kind: AGENT_WORKLOAD_KIND,\n            name: workload.metadata.name,\n            namespace: workload.metadata.namespace,\n            uid: workload.metadata.uid,\n          },\n        });\n        manifest.metadata.namespace = workload.metadata.namespace;\n        try {\n          run = await store.create(\n            options.actor,\n            manifest,\n          ) as unknown as AgentRunResource;\n        } catch (error) {\n          if (!(error instanceof OrchestrationError) || error.code !== 'CONFLICT') {\n            throw error;\n          }\n          // A competing controller may have created the deterministic Run.\n          run = await store.get<\n            AgentRunResource['spec'],\n            AgentRunResource['status']\n          >(runReference) as AgentRunResource | null;\n          if (!run) throw error;\n        }\n      }\n      assertCanonicalRunBinding(workload, run);\n      if (run.status?.phase && TERMINAL_RUN_PHASES.has(run.status.phase)) {\n        // Previous attempt finished; mirror the outcome and stop.\n        const terminalStatus = run.status;\n        await updateStatusWithRetry<AgentWorkloadStatus>(workloadReference_, (current) => ({\n          ...current,\n          phase: terminalStatus.phase === 'Completed' ? 'Completed' : 'Failed',\n          lastRunResult: terminalStatus.summary,\n        }));\n        return;\n      }\n\n      const [dependencies, networkAttachment, volumeDependencies] = await Promise.all([\n        waitForModelBinding(workload, runReference),\n        ensureNetworkAttachment(workload, runReference, run.metadata.uid),\n        waitForVolumeBindings(workload, runReference),\n      ]);\n      run = volumeDependencies.run;\n      // ensureNetworkAttachment may have added the durable reference.\n      run = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(\n        runReference,\n      ) as AgentRunResource ?? run;\n\n      await updateStatusWithRetry<AgentWorkloadStatus>(workloadReference_, (current) => ({\n        ...current,\n        phase: 'Running',\n        runs: [runReference],\n      }));\n      const claimedRun = await claimRuntimeExecution(runReference);\n      if (!claimedRun) return;\n      runtimeClaimed = true;\n      run = claimedRun;\n      const handle = await driver.start({\n        workload,\n        run,\n        ...(dependencies.endpoint ? { modelEndpoint: dependencies.endpoint } : {}),\n        ...(networkAttachment ? { networkAttachment } : {}),\n        ...(volumeDependencies.mounts ? { volumeMounts: volumeDependencies.mounts } : {}),\n        scriptSource,\n        message: options.messageForWorkload?.(workload) ?? workload.metadata.name,\n      });\n      active.set(workload.metadata.uid, handle);\n      await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n        ...current,\n        phase: 'Running',\n      }));\n      const outcome = await handle.wait();\n\n      await requestDependencyRelease(runReference);\n\n      await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n        ...current,\n        phase: outcome.phase,\n        summary: outcome.summary ?? outcome.error?.message,\n        exitCode: outcome.phase === 'Completed' ? 0 : 1,\n      }));\n      await updateStatusWithRetry<AgentWorkloadStatus>(workloadReference_, (current) => ({\n        ...current,\n        phase: outcome.phase === 'Completed' ? 'Completed' : 'Failed',\n        lastRunResult: outcome.summary ?? outcome.error?.message,\n      }));\n    } catch (error) {\n      await requestDependencyRelease(runReference).catch(onError);\n      const cause = error instanceof Error ? error.message : String(error);\n      const message = runtimeClaimed\n        ? `UNKNOWN_EFFECT: runtime execution failed after the durable pre-effect claim; verify external state before retrying: ${cause}`\n        : cause;\n      await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n        ...current,\n        ...(current?.phase && TERMINAL_RUN_PHASES.has(current.phase)\n          ? {}\n          : {\n            phase: 'Failed' as const,\n            summary: message,\n            exitCode: 1,\n          }),\n      })).catch(onError);\n      if (stopped) return;\n      onError(error);\n      await updateStatusWithRetry<AgentWorkloadStatus>(workloadReference_, (current) => ({\n        ...current,\n        phase: 'Failed',\n        lastRunResult: message,\n      })).catch(onError);\n    } finally {\n      active.delete(workload.metadata.uid);\n    }\n  }\n\n  async function recoverRunning(workload: AgentWorkloadResource): Promise<void> {\n    const runReference: OrchestrationResourceReference = {\n      apiVersion: AGENT_RUN_API_VERSION,\n      kind: AGENT_RUN_KIND,\n      name: `${workload.metadata.name}-run`,\n      namespace: workload.metadata.namespace,\n    };\n    try {\n      const run = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(\n        runReference,\n      ) as AgentRunResource | null;\n      if (run) {\n        try {\n          assertCanonicalRunBinding(workload, run);\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n            ...current,\n            phase: 'Failed',\n            summary: message,\n            exitCode: 1,\n          }));\n          await updateStatusWithRetry<AgentWorkloadStatus>(\n            workloadReference(workload),\n            (current) => ({\n              ...current,\n              phase: 'Failed',\n              lastRunResult: message,\n            }),\n          );\n          onError(error);\n          return;\n        }\n      }\n      if (!run || !run.status?.phase || run.status.phase === 'Pending') {\n        // The previous daemon stopped before persisting its pre-effect claim.\n        // No runtime side effect was authorized, so this instance may resume.\n        await execute(workload);\n        return;\n      }\n      if (TERMINAL_RUN_PHASES.has(run.status.phase)) {\n        await requestDependencyRelease(runReference);\n        await updateStatusWithRetry<AgentWorkloadStatus>(\n          workloadReference(workload),\n          (current) => ({\n            ...current,\n            phase: run.status?.phase === 'Completed' ? 'Completed' : 'Failed',\n            lastRunResult: run.status?.summary,\n          }),\n        );\n        return;\n      }\n\n      const message = `UNKNOWN_EFFECT: AgentRun '${run.metadata.name}' was left ${run.status.phase} ` +\n        `by controller '${run.status.runtimeExecutionClaim?.controllerInstanceId ?? 'unknown'}'; ` +\n        'the configured LoopRuntimeDriver cannot safely adopt it';\n      await requestDependencyRelease(runReference);\n      await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n        ...current,\n        phase: 'Failed',\n        summary: message,\n        exitCode: 1,\n      }));\n      await updateStatusWithRetry<AgentWorkloadStatus>(\n        workloadReference(workload),\n        (current) => ({\n          ...current,\n          phase: 'Failed',\n          lastRunResult: message,\n        }),\n      );\n    } catch (error) {\n      onError(error);\n    } finally {\n      active.delete(workload.metadata.uid);\n    }\n  }\n\n  function maybeStart(resource: OrchestrationResource): void {\n    const workload = resource as AgentWorkloadResource;\n    const status = workload.status;\n    if (\n      !status ||\n      (status.phase !== 'Scheduling' && status.phase !== 'Running')\n    ) return;\n    if (status.assignedNode !== options.nodeId) return;\n    if (active.has(workload.metadata.uid)) return;\n    active.set(workload.metadata.uid, { cancel: async () => {} });\n    if (status.phase === 'Running') {\n      void recoverRunning(workload);\n    } else {\n      void execute(workload).catch(onError);\n    }\n  }\n\n  void (async () => {\n    while (!stopped) {\n      try {\n        for await (\n          const event of store.watch(\n            { apiVersion: AGENT_WORKLOAD_API_VERSION, kind: AGENT_WORKLOAD_KIND },\n            { sendInitialEvents: true },\n          )\n        ) {\n          if (stopped) break;\n          if (event.type === 'ADDED' || event.type === 'MODIFIED') {\n            maybeStart(event.resource);\n          } else if (event.type === 'DELETED') {\n            const workload = event.resource as AgentWorkloadResource;\n            await active.get(workload.metadata.uid)?.cancel().catch(onError);\n          }\n        }\n      } catch (error) {\n        onError(error);\n      }\n      if (!stopped) await sleep(1000);\n    }\n  })().catch(onError);\n\n  return {\n    async stop() {\n      stopped = true;\n      for (const handle of active.values()) {\n        await handle.cancel().catch(() => undefined);\n      }\n    },\n  };\n}\n","import type { OrchestrationResource, OrchestrationResourceManifest } from '../orchestration/client.js';\nimport type { ControlStore, ControlStoreActor } from '../orchestration/controlStore.js';\nimport { OrchestrationError } from '../orchestration/errors.js';\nimport type { LoopScriptCheckpointStore } from './types.js';\n\nexport const LOOP_CHECKPOINT_API_VERSION = 'loops.memeloop.io/v1alpha1';\nexport const LOOP_CHECKPOINT_KIND = 'LoopCheckpoint';\n\nexport interface LoopCheckpointSpec {\n  conversationId: string;\n  key: string;\n  result: unknown;\n  /** SHA-256 hex digest of the serialised result. Verified on load. */\n  digest: string;\n  createdAt: string;\n}\n\nexport type LoopCheckpointResource = OrchestrationResource<LoopCheckpointSpec>;\n\nfunction checkpointName(key: string): string {\n  return encodeURIComponent(key);\n}\n\nasync function computeDigest(data: unknown): Promise<string> {\n  const json = JSON.stringify(data);\n  const encoded = new TextEncoder().encode(json);\n  const hash = await crypto.subtle.digest('SHA-256', encoded);\n  return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, '0')).join('');\n}\n\nexport function createControlStoreLoopCheckpointStore(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  now: () => Date = () => new Date(),\n): LoopScriptCheckpointStore {\n  return {\n    async saveCheckpoint(conversationId, key, result) {\n      const reference = {\n        apiVersion: LOOP_CHECKPOINT_API_VERSION,\n        kind: LOOP_CHECKPOINT_KIND,\n        namespace: conversationId,\n        name: checkpointName(key),\n      };\n      const existing = await store.get<LoopCheckpointSpec>(reference);\n      if (existing) return;\n      const cloned = structuredClone(result);\n      const digest = await computeDigest(cloned);\n      const manifest: OrchestrationResourceManifest<LoopCheckpointSpec> = {\n        apiVersion: LOOP_CHECKPOINT_API_VERSION,\n        kind: LOOP_CHECKPOINT_KIND,\n        metadata: { namespace: conversationId, name: checkpointName(key) },\n        spec: { conversationId, key, result: cloned, digest, createdAt: now().toISOString() },\n      };\n      try {\n        await store.create(actor, manifest, { idempotencyKey: `loop-checkpoint:${conversationId}:${key}` });\n      } catch (error) {\n        if (!(error instanceof OrchestrationError) || error.code !== 'CONFLICT') throw error;\n      }\n    },\n\n    async loadCheckpoint<T>(conversationId: string, key: string): Promise<T | undefined> {\n      const checkpoint = await store.get<LoopCheckpointSpec>({\n        apiVersion: LOOP_CHECKPOINT_API_VERSION,\n        kind: LOOP_CHECKPOINT_KIND,\n        namespace: conversationId,\n        name: checkpointName(key),\n      });\n      if (!checkpoint) return undefined;\n      const expectedDigest = checkpoint.spec.digest;\n      const actualDigest = await computeDigest(checkpoint.spec.result);\n      if (actualDigest !== expectedDigest) return undefined;\n      return structuredClone(checkpoint.spec.result) as T;\n    },\n  };\n}\n","import type { AgentDefinition } from './agent/types.js';\nimport type { ChatMessage } from './conversation/index.js';\nimport type { AgentOrchestrationClient, NodeTrustClass, ScriptDeploymentClientConfig, ToolOperationEffect } from './orchestration/index.js';\nimport type { AgentFrameworkConfig } from './promptUtilities/types.js';\nimport type { IAgentStorage } from './storage/interface.js';\nimport type { ConversationMeta } from './sync/protocol.js';\n\nimport type { AgentLoopGenerator, AgentLoopInput, AgentLoopRuntime, AgentLoopScriptPolicy } from './loopAPI/types.js';\nimport type { LoopScriptCheckpointStore } from './loopAPI/types.js';\nimport type { ControlStore } from './orchestration/controlStore.js';\nimport type { CheckpointStore } from './storage/sessionStorage.js';\n\n// Storage types are defined once in `storage/ports.ts` (narrow ports) and\n// composed in `storage/interface.ts`; re-exported here for compatibility.\nexport type { ConversationQueryMode, GetMessagesOptions, IAgentStorage, ListConversationsOptions } from './storage/interface.js';\n\nexport interface MemeLoopLogger {\n  debug?(message: string, ...arguments_: unknown[]): void;\n  info?(message: string, ...arguments_: unknown[]): void;\n  warn?(message: string, ...arguments_: unknown[]): void;\n  error?(message: string, ...arguments_: unknown[]): void;\n}\n\nexport interface ILLMProvider {\n  name: string;\n  /**\n   * Serializable default model identity used by orchestration resources.\n   * `model` may be an SDK object or factory and must never be persisted.\n   */\n  modelId?: string;\n  model?: unknown;\n\n  chat(request: unknown): AsyncIterable<unknown> | Promise<unknown>;\n}\n\n/* eslint-disable @typescript-eslint/no-redundant-type-constituents */\nexport interface IToolRegistry {\n  registerTool(\n    id: string,\n    impl: unknown,\n    parameterSchema?: unknown,\n    effect?: ToolOperationEffect,\n  ): void;\n  getTool(id: string): unknown | undefined;\n  listTools(): string[];\n  /**\n   * Instance-local schema lookup. Managed catalogs use this when available so\n   * one embedded runtime cannot inherit another runtime's process-global schema.\n   */\n  getToolParameterSchema?: (id: string) => unknown | undefined;\n  /** Host-authoritative effect classification; omitted tools default to conservative execute. */\n  getToolEffect?: (id: string) => ToolOperationEffect | undefined;\n  /** Prompt-concat plugin registry, isolated per runtime. Falls back to the process-level default registry. */\n  getPromptPlugins?: () => Map<\n    string,\n    (hooks: import('./tools/types.js').PromptConcatHooks) => void\n  >;\n}\n\nexport interface IChatSyncAdapter {\n  start(): Promise<void>;\n  stop(): Promise<void>;\n}\n\nexport interface INetworkService {\n  start(): Promise<void>;\n  stop(): Promise<void>;\n}\n\nexport interface AgentToolLoopOptions {\n  /** Maximum LLM-to-tool round-trips. `0` means unlimited, still capped internally. */\n  maxIterations?: number;\n  /** Whether to parse `<tool_use>` / `<function_call>` and execute through `IToolRegistry` (default true). */\n  enableToolLoop?: boolean;\n  /** Cancellation check, e.g. when the user stops a run. */\n  isCancelled?: (conversationId: string) => boolean;\n  /** Attachment injection for promptConcat, aligned with `PromptConcatOptions`. */\n  readAttachmentFile?: (path: string) => Promise<Uint8Array>;\n  /** Omit history older than this many milliseconds when building LLM input. `0` disables trimming. */\n  maxHistoryAgeMs?: number;\n  /**\n   * When `defineTool` / plugins are configured, fall back to `IToolRegistry` for tool calls not handled by `onResponseComplete`.\n   */\n  fallbackRegistryTools?: boolean;\n  /**\n   * Tool permission rules (default allow).\n   * Supports wildcards such as \"terminal.*\" and \"file.read\".\n   */\n  toolPermissions?: {\n    default?: 'allow' | 'ask' | 'deny';\n    rules?: Array<{ pattern: string; action: 'allow' | 'ask' | 'deny' }>;\n    perAgent?: Record<\n      string,\n      {\n        default?: 'allow' | 'ask' | 'deny';\n        rules?: Array<{ pattern: string; action: 'allow' | 'ask' | 'deny' }>;\n      }\n    >;\n  };\n  /** Threshold for repeated identical tool+input calls (default 3). */\n  doomLoopThreshold?: number;\n  /**\n   * Timeout for a single ToolOperation executed through the orchestration\n   * facade (default 60_000ms). Covers the full lifecycle from apply until a\n   * terminal phase, including scheduling and remote execution.\n   */\n  toolOperationTimeoutMs?: number;\n  /**\n   * Host-bound trust class of the node running this loop. Restricted and\n   * quarantine nodes default the model-facing tool permission layer to deny\n   * when no explicit wildcard rule exists. Bound by the host at assembly\n   * time; never self-reported by the workload or model.\n   */\n  trustClass?: NodeTrustClass;\n  /** History compaction window: keep the most recent N turns plus the last user message. */\n  contextCompaction?: { maxMessages?: number; replayLastUserMessage?: boolean };\n  /**\n   * Auto-compaction: when message count exceeds threshold, summarizes old\n   * conversation turns via truncation or LLM summarization. Default: disabled.\n   */\n  autoCompact?: {\n    /** Trigger compaction when message count exceeds this (default: 50) */\n    threshold?: number;\n    /** Number of recent turns to preserve (default: 4) */\n    recentTurnsToKeep?: number;\n    /** Maximum token estimate before compaction; 0 disables token-based compaction */\n    maxTokens?: number;\n  };\n  /** Session checkpoint: save conversation history after each turn for resume. */\n  sessionCheckpoint?: {\n    /** Enable checkpoint saves. Default: false. */\n    enabled?: boolean;\n    /** Store provided by the runtime host. */\n    store?: CheckpointStore;\n    /** Custom checkpoint directory (default: ~/.memeloop/sessions/) */\n    directory?: string;\n  };\n  /**\n   * After a tool returns `__memeloopToolResult.awaitSessionId`, AgentToolLoop waits here before the next LLM round.\n   */\n  waitForTerminalSession?: (sessionId: string) => Promise<{\n    exitCode: number | null;\n    truncatedOutput: string;\n  }>;\n}\n\nexport interface AgentFrameworkContext {\n  storage: IAgentStorage;\n  llmProvider: ILLMProvider;\n  tools: IToolRegistry;\n  syncAdapters: IChatSyncAdapter[];\n  network: INetworkService;\n  /** Policy-scoped declarative manager facade shared by Agent loops and Agent-facing tools. */\n  orchestration?: AgentOrchestrationClient;\n  /**\n   * Host-bound script deployment configuration (plan 24.14). Loop runtimes\n   * build a `ctx.scriptClient` from it; scripts never see the raw config,\n   * so trust class and interface ceilings stay host-controlled.\n   */\n  scriptDeployment?: ScriptDeploymentClientConfig;\n  /** Trusted controller state store; Agent-facing loop scripts receive only its checkpoint adapter. */\n  controlStore?: ControlStore;\n  /** Durable milestones used by script-backed loops such as quality-gate. */\n  loopCheckpoints?: LoopScriptCheckpointStore;\n  /** Let host runtimes preserve platform-specific message aliases/metadata while core owns the loop. */\n  normalizeMessage?: (message: ChatMessage) => ChatMessage;\n  /**\n   * Notify a host about an in-memory streaming message. The core invokes this\n   * with the same message ID used for the immutable final persisted message.\n   */\n  onTransientMessage?: (message: ChatMessage) => void | Promise<void>;\n\n  /** AgentToolLoop ReAct behavior, migrated from the TidGi-Desktop agentToolLoop integration. */\n  agentToolLoop?: AgentToolLoopOptions;\n  /**\n   * Host-injected runner used by `createMemeLoopRuntime` after a user sends a message.\n   */\n  runAgentToolLoop?: (input: AgentLoopInput) => AgentLoopGenerator;\n  /** Run a child agent for orchestration loops such as AgentAgentLoop. */\n  runChildAgent?: AgentLoopRuntime['runChildAgent'];\n  /** Policy for loading script-backed loops. Defaults to bundled scripts + import specifiers only. */\n  loopScriptPolicy?: AgentLoopScriptPolicy;\n  /**\n   * Build the agent view supplied to defineTool hooks for a conversation.\n   */\n  resolveAgentRuntimeView?: (\n    conversationId: string,\n    messages: ChatMessage[],\n  ) => Promise<AgentInstanceModel>;\n  /** Current agent view for defineTool / TidGi compatibility. */\n  agent?: { id: string; messages: ChatMessage[] };\n  /** Persist a `ChatMessage` if the runtime host supplies this hook. */\n  persistAgentMessage?: (message: ChatMessage) => Promise<void>;\n  /** Cancellation markers written by `createMemeLoopRuntime`. */\n  conversationCancellation?: Set<string>;\n  /** Resolve an AgentDefinition from host-specific sources. */\n  resolveAgentDefinition?: (definitionId: string) => Promise<AgentDefinition | null>;\n  /** Fallback logger used when the host does not inject one. */\n  logger?: MemeLoopLogger;\n  /** TidGi defineTool compatibility: legacy plugins call this without arguments. */\n  isCancelled?: () => boolean;\n}\n\nexport type AgentInstanceState =\n  | 'submitted'\n  | 'working'\n  | 'input-required'\n  | 'completed'\n  | 'canceled'\n  | 'failed'\n  | 'unknown';\n\nexport interface AgentInstanceLatestStatus {\n  state: AgentInstanceState;\n  message?: ChatMessage;\n  /** Human-readable sub-status for the header — shown while agent is working. */\n  progress?: string;\n  created?: Date;\n  modified?: Date;\n}\n\nexport interface AgentInstanceModel extends Omit<AgentDefinition, 'name'> {\n  agentDefId: string;\n  name?: string;\n  agentFrameworkConfig?: AgentFrameworkConfig;\n  messages: ChatMessage[];\n  status: AgentInstanceLatestStatus;\n  created: Date;\n  modified?: Date;\n  closed?: boolean;\n  volatile?: boolean;\n  isDelegatedAgentRun?: boolean;\n  parentAgentRunId?: string;\n}\n\nexport type { AgentInstanceModel as AgentInstance };\n\nexport function isUserInitiatedConversation(meta: ConversationMeta): boolean {\n  return meta.isUserInitiated;\n}\n\nexport function createInstanceDeltaFromDefinition(\n  definition: AgentDefinition,\n  overrides: Partial<AgentDefinition>,\n): Partial<AgentDefinition> {\n  const delta: Partial<AgentDefinition> = {};\n  for (const key of Object.keys(overrides) as Array<Extract<keyof AgentDefinition, string>>) {\n    const value = overrides[key];\n    if (value !== undefined && value !== definition[key]) {\n      (delta as Record<string, unknown>)[key] = value;\n    }\n  }\n  return delta;\n}\n","import { type AttachmentReference, createChatMessage } from '../conversation/index.js';\n\nimport type { FullAgentStorage } from './ports.js';\n\n/**\n * Storage conformance suite (plan 24.43).\n *\n * Host-agnostic behavioral checks every logical storage driver must pass.\n * Run it in the host's own test setup (`runStorageConformance` returns a\n * report; `assertStorageConformance` throws on the first failure summary).\n * Drivers that implement only a subset of ports can run the relevant checks\n * via `checks` filtering.\n */\n\nexport interface StorageConformanceFailure {\n  check: string;\n  message: string;\n}\n\nexport interface StorageConformanceReport {\n  checks: number;\n  passed: number;\n  failures: StorageConformanceFailure[];\n}\n\nexport const STORAGE_CONFORMANCE_CHECKS = [\n  'append-and-read-messages',\n  'insert-if-absent-dedupes',\n  'conversation-metadata-round-trip',\n  'list-conversations',\n  'attachment-round-trip',\n  'missing-definition-returns-null',\n] as const;\n\nexport type StorageConformanceCheck = (typeof STORAGE_CONFORMANCE_CHECKS)[number];\n\nfunction bytesEqual(a: Uint8Array, b: Uint8Array): boolean {\n  return a.length === b.length && a.every((byte, index) => byte === b[index]);\n}\n\nexport async function runStorageConformance(\n  storage: FullAgentStorage,\n  options: { conversationId?: string; checks?: readonly StorageConformanceCheck[] } = {},\n): Promise<StorageConformanceReport> {\n  const conversationId = options.conversationId ?? `conformance-${Date.now().toString(36)}`;\n  const enabled = new Set(options.checks ?? STORAGE_CONFORMANCE_CHECKS);\n  const failures: StorageConformanceFailure[] = [];\n  let checks = 0;\n\n  async function run(name: StorageConformanceCheck, body: () => Promise<void>): Promise<void> {\n    if (!enabled.has(name)) return;\n    checks += 1;\n    try {\n      await body();\n    } catch (error) {\n      failures.push({ check: name, message: error instanceof Error ? error.message : String(error) });\n    }\n  }\n\n  function expect(condition: boolean, message: string): void {\n    if (!condition) throw new Error(message);\n  }\n\n  await run('append-and-read-messages', async () => {\n    const first = createChatMessage({ messageId: `${conversationId}:m1`, conversationId, role: 'user', content: 'hello', lamportClock: 1 });\n    const second = createChatMessage({ messageId: `${conversationId}:m2`, conversationId, role: 'assistant', content: 'world', lamportClock: 2 });\n    await storage.appendMessage(first);\n    await storage.appendMessage(second);\n    const messages = await storage.getMessages(conversationId, { mode: 'full-content' });\n    const ids = messages.map((message) => message.messageId);\n    expect(ids.includes(first.messageId) && ids.includes(second.messageId), `expected both messages, got ${ids.join(',')}`);\n    const roundTrip = messages.find((message) => message.messageId === first.messageId);\n    expect(roundTrip?.content === 'hello', 'message content must round-trip');\n  });\n\n  await run('insert-if-absent-dedupes', async () => {\n    const message = createChatMessage({ messageId: `${conversationId}:dup`, conversationId, role: 'user', content: 'once', lamportClock: 3 });\n    await storage.insertMessagesIfAbsent([message]);\n    await storage.insertMessagesIfAbsent([message]);\n    const messages = await storage.getMessages(conversationId, { mode: 'full-content' });\n    const occurrences = messages.filter((entry) => entry.messageId === message.messageId);\n    expect(occurrences.length === 1, `expected exactly one copy, got ${occurrences.length}`);\n  });\n\n  await run('conversation-metadata-round-trip', async () => {\n    await storage.upsertConversationMetadata({\n      conversationId,\n      title: 'conformance',\n      lastMessagePreview: '',\n      lastMessageTimestamp: Date.now(),\n      messageCount: 0,\n      originNodeId: 'local',\n      originClock: 1,\n      definitionId: 'conformance-agent',\n      isUserInitiated: true,\n    });\n    const meta = await storage.getConversationMeta(conversationId);\n    expect(meta != null, 'getConversationMeta must return the upserted row');\n    expect(meta?.definitionId === 'conformance-agent', 'metadata fields must round-trip');\n  });\n\n  await run('list-conversations', async () => {\n    const conversations = await storage.listConversations();\n    expect(\n      conversations.some((meta) => meta.conversationId === conversationId),\n      'listConversations must include the written conversation',\n    );\n  });\n\n  await run('attachment-round-trip', async () => {\n    const bytes = new TextEncoder().encode('conformance-blob-payload');\n    const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes);\n    const contentHash = `sha256:${[...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, '0')).join('')}`;\n    const reference: AttachmentReference = {\n      contentHash,\n      filename: 'payload.bin',\n      mimeType: 'application/octet-stream',\n      size: bytes.byteLength,\n    };\n    await storage.saveAttachment(reference, bytes);\n    const stored = await storage.getAttachment(reference.contentHash);\n    expect(stored != null, 'getAttachment must return the saved reference');\n    if (typeof storage.readAttachmentData === 'function') {\n      const data = await storage.readAttachmentData(reference.contentHash);\n      expect(data != null && bytesEqual(data, bytes), 'attachment bytes must round-trip as Uint8Array');\n    }\n  });\n\n  await run('missing-definition-returns-null', async () => {\n    const missing = await storage.getAgentDefinition(`${conversationId}:missing`);\n    expect(missing === null, 'getAgentDefinition must return null for unknown ids');\n  });\n\n  return { checks, passed: checks - failures.length, failures };\n}\n\nexport async function assertStorageConformance(\n  storage: FullAgentStorage,\n  options: { conversationId?: string; checks?: readonly StorageConformanceCheck[] } = {},\n): Promise<void> {\n  const report = await runStorageConformance(storage, options);\n  if (report.failures.length > 0) {\n    const summary = report.failures.map((failure) => `${failure.check}: ${failure.message}`).join('; ');\n    throw new Error(`storage conformance failed (${report.passed}/${report.checks}): ${summary}`);\n  }\n}\n","import type { ChatMessage } from '../conversation/index.js';\n\nexport interface CheckpointRecord {\n  conversationId: string;\n  messages: ChatMessage[];\n  savedAt: string;\n  messageCount: number;\n  lastMessagePreview: string;\n}\n\nexport interface CheckpointSummary {\n  conversationId: string;\n  savedAt: string;\n  messageCount: number;\n  lastMessagePreview: string;\n}\n\nexport interface CheckpointStore {\n  saveCheckpoint(conversationId: string, messages: ChatMessage[]): Promise<CheckpointRecord>;\n  loadCheckpoint(conversationId: string): Promise<CheckpointRecord | null>;\n  listCheckpoints(): Promise<CheckpointSummary[]>;\n  deleteCheckpoint(conversationId: string): Promise<boolean>;\n}\n\nexport interface SessionStorageOptions {\n  records?: CheckpointRecord[];\n}\n\nexport function createCheckpointRecord(\n  conversationId: string,\n  messages: ChatMessage[],\n  savedAt = new Date().toISOString(),\n): CheckpointRecord {\n  const lastMessage = messages[messages.length - 1];\n  const preview = lastMessage && typeof lastMessage.content === 'string' ? lastMessage.content.slice(0, 200) : '';\n\n  return {\n    conversationId,\n    messages: [...messages],\n    savedAt,\n    messageCount: messages.length,\n    lastMessagePreview: preview,\n  };\n}\n\nexport function parseCheckpointRecord(raw: string): CheckpointRecord | null {\n  try {\n    const record = JSON.parse(raw) as unknown;\n    return isCheckpointRecord(record) ? record : null;\n  } catch {\n    return null;\n  }\n}\n\nexport function serializeCheckpointRecord(record: CheckpointRecord): string {\n  return JSON.stringify(record, null, 2);\n}\n\nexport class InMemoryCheckpointStore implements CheckpointStore {\n  private readonly records = new Map<string, CheckpointRecord>();\n\n  constructor(options: SessionStorageOptions = {}) {\n    for (const record of options.records ?? []) {\n      this.records.set(record.conversationId, cloneCheckpointRecord(record));\n    }\n  }\n\n  async saveCheckpoint(conversationId: string, messages: ChatMessage[]): Promise<CheckpointRecord> {\n    const record = createCheckpointRecord(conversationId, messages);\n    this.records.set(conversationId, cloneCheckpointRecord(record));\n    return cloneCheckpointRecord(record);\n  }\n\n  async loadCheckpoint(conversationId: string): Promise<CheckpointRecord | null> {\n    const record = this.records.get(conversationId);\n    return record ? cloneCheckpointRecord(record) : null;\n  }\n\n  async listCheckpoints(): Promise<CheckpointSummary[]> {\n    return [...this.records.values()]\n      .map(toCheckpointSummary)\n      .sort((a, b) => b.savedAt.localeCompare(a.savedAt));\n  }\n\n  async deleteCheckpoint(conversationId: string): Promise<boolean> {\n    return this.records.delete(conversationId);\n  }\n}\n\nexport class SessionStorage extends InMemoryCheckpointStore {}\n\nfunction isCheckpointRecord(record: unknown): record is CheckpointRecord {\n  if (!record || typeof record !== 'object') return false;\n  const candidate = record as Record<string, unknown>;\n  return (\n    typeof candidate.conversationId === 'string' &&\n    Array.isArray(candidate.messages) &&\n    typeof candidate.savedAt === 'string' &&\n    typeof candidate.messageCount === 'number' &&\n    typeof candidate.lastMessagePreview === 'string'\n  );\n}\n\nfunction cloneCheckpointRecord(record: CheckpointRecord): CheckpointRecord {\n  return {\n    ...record,\n    messages: [...record.messages],\n  };\n}\n\nfunction toCheckpointSummary(record: CheckpointRecord): CheckpointSummary {\n  return {\n    conversationId: record.conversationId,\n    savedAt: record.savedAt,\n    messageCount: record.messageCount,\n    lastMessagePreview: record.lastMessagePreview,\n  };\n}\n","/**\n * Convert TiddlyWiki tiddler fields into memeloop AgentDefinition.\n *\n * Tiddlers tagged `$:/tags/AI/Template` carry agent configuration in their text field (JSON).\n * This pure function handles the parsing and field mapping.\n */\nimport type { AgentDefinition } from '../agent/types.js';\nimport type { AgentFrameworkConfig, PromptNode, PromptPluginConfig } from '../promptUtilities/types.js';\n\n/** Minimal tiddler fields shape consumed by the converter. */\nexport interface TiddlerFieldsForAgent {\n  title: string;\n  text?: string;\n  caption?: string;\n  description?: string;\n  avatar_url?: string;\n  handler_id?: string;\n  agentFrameworkID?: string;\n  ai_api_config?: string | Record<string, unknown>;\n  agent_tools?: string | unknown[];\n}\n\n/**\n * Validate and convert a wiki tiddler to an AgentDefinition.\n * Returns null if the tiddler cannot be parsed.\n */\nexport function tiddlerToAgentDefinition(\n  tiddler: TiddlerFieldsForAgent,\n  workspaceName?: string,\n): AgentDefinition | null {\n  if (!tiddler || !tiddler.title || typeof tiddler.text !== 'string') return null;\n\n  let agentFrameworkConfig: Record<string, unknown>;\n  try {\n    const parsed = JSON.parse(tiddler.text) as unknown;\n    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {\n      return null;\n    }\n    agentFrameworkConfig = parsed as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n\n  const getString = (field: unknown, fallback = ''): string =>\n    typeof field === 'string'\n      ? field\n      : field && typeof field === 'object'\n      ? JSON.stringify(field)\n      : fallback;\n\n  const parseJSON = (field: unknown): Record<string, unknown> | unknown[] | undefined => {\n    if (typeof field === 'string') {\n      try {\n        const parsed = JSON.parse(field) as unknown;\n        if (typeof parsed === 'object' && parsed !== null) {\n          return parsed as Record<string, unknown> | unknown[];\n        }\n      } catch {\n        /* ignore */\n      }\n    }\n    return undefined;\n  };\n\n  const id = `wiki-template-${getString(tiddler.title).replace(/[^a-zA-Z0-9-_]/g, '-')}`;\n  const name = getString(tiddler.caption) || getString(tiddler.title);\n  const description = getString(tiddler.description) || `Agent template from ${workspaceName || 'wiki'}`;\n\n  const modelConfigRaw = parseJSON(tiddler.ai_api_config);\n  const rawAsRecord = modelConfigRaw && typeof modelConfigRaw === 'object' && !Array.isArray(modelConfigRaw)\n    ? modelConfigRaw\n    : undefined;\n  const modelConfig = rawAsRecord\n    ? {\n      provider: typeof rawAsRecord.provider === 'string' ? rawAsRecord.provider : '',\n      model: typeof rawAsRecord.model === 'string' ? rawAsRecord.model : '',\n    }\n    : undefined;\n\n  const toolsRaw = parseJSON(tiddler.agent_tools);\n  const toolNames = Array.isArray(toolsRaw)\n    ? (toolsRaw as Array<Record<string, unknown>>)\n      .filter((t) => typeof t?.toolId === 'string')\n      .map((t) => String(t.toolId))\n    : [];\n\n  return {\n    id,\n    name,\n    description,\n    systemPrompt: '',\n    tools: toolNames,\n    modelConfig,\n    // Keep the original config as promptSchema for the UI editor\n    promptSchema: agentFrameworkConfig,\n    agentFrameworkConfig: {\n      prompts: Array.isArray(agentFrameworkConfig.prompts)\n        ? (agentFrameworkConfig.prompts as PromptNode[])\n        : [],\n      plugins: Array.isArray(agentFrameworkConfig.plugins)\n        ? (agentFrameworkConfig.plugins as PromptPluginConfig[])\n        : [],\n      response: Array.isArray(agentFrameworkConfig.response)\n        ? agentFrameworkConfig.response\n        : undefined,\n    } as AgentFrameworkConfig,\n    version: '1',\n  };\n}\n","/**\n * Git HTTP 反向代理目标校验：降低 SSRF 风险（内网/metadata 等）。\n * 仍依赖 getBackendUrl 返回可信基础 URL；此处拦截明显危险的解析结果。\n */\n\nfunction ipv4Parts(host: string): number[] | null {\n  const m = /^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/.exec(host);\n  if (!m) return null;\n  return m.slice(1, 5).map((x) => Number(x));\n}\n\nfunction isPrivateOrLoopbackIpv4(host: string): boolean {\n  const p = ipv4Parts(host);\n  if (!p || p.some((n) => n > 255)) return false;\n  const [a, b] = p;\n  if (a === 127 || a === 0) return true;\n  if (a === 10) return true;\n  if (a === 172 && b >= 16 && b <= 31) return true;\n  if (a === 192 && b === 168) return true;\n  if (a === 169 && b === 254) return true;\n  return false;\n}\n\n/** 若目标 URL 不允许作为 Git 代理上游，返回简短原因；否则 null。 */\nexport function gitProxyTargetBlockReason(url: URL): string | null {\n  if (url.username || url.password) {\n    return 'credentials_in_url';\n  }\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') {\n    return 'unsupported_protocol';\n  }\n  const host = url.hostname.toLowerCase();\n  if (\n    host === 'localhost' ||\n    host.endsWith('.localhost') ||\n    host === '0.0.0.0' ||\n    host === '[::]' ||\n    host === '::'\n  ) {\n    return 'loopback_or_wildcard';\n  }\n  if (host.startsWith('127.')) {\n    return 'loopback_ipv4';\n  }\n  if (isPrivateOrLoopbackIpv4(host)) {\n    return 'private_ipv4';\n  }\n  if (host.includes(':') && !host.startsWith('[')) {\n    const lower = host.toLowerCase();\n    if (lower.startsWith('fe80:') || lower.startsWith('fc') || lower.startsWith('fd')) {\n      return 'private_ipv6';\n    }\n    if (lower === '::1') {\n      return 'loopback_ipv6';\n    }\n  }\n  if (host.startsWith('[') && host.endsWith(']')) {\n    const inner = host.slice(1, -1).toLowerCase();\n    if (inner === '::1' || inner.startsWith('fe80:') || inner.startsWith('fc') || inner.startsWith('fd')) {\n      return 'blocked_ipv6_literal';\n    }\n  }\n  const h = host.replace(/^\\[|\\]$/g, '').toLowerCase();\n  if (h === 'metadata.google.internal' || h.endsWith('.internal')) {\n    return 'internal_hostname';\n  }\n  return null;\n}\n","/**\n * memeloop:// URI scheme for cross-node references (e.g. file.read without inlining bytes).\n * Format: memeloop://node/<nodeId>/file/<pathSegments...>\n * Path segments are percent-encoded per RFC 3986.\n */\n\nexport type MemeloopUriKind = 'file';\n\nexport interface ParsedMemeloopFileUri {\n  scheme: 'memeloop';\n  kind: 'file';\n  nodeId: string;\n  /** Logical path on the holding node (slashes preserved, not leading slash). */\n  filePath: string;\n}\n\nexport type ParsedMemeloopUri = ParsedMemeloopFileUri;\n\nconst PREFIX = 'memeloop://node/';\n\n/**\n * Build `memeloop://node/<nodeId>/file/<encodedPath>` for a file on a node.\n */\nexport function buildMemeloopFileUri(nodeId: string, filePath: string): string {\n  const normalized = filePath.replace(/^\\/+/, '');\n  const segments = normalized.split('/').filter(Boolean).map(encodeURIComponent);\n  return `memeloop://node/${encodeURIComponent(nodeId)}/file/${segments.join('/')}`;\n}\n\n/** Alias for {@link buildMemeloopFileUri} (plan §22.2 / §16.8 `buildMemeloopUri`). */\nexport const buildMemeloopUri = buildMemeloopFileUri;\n\n/**\n * Parse a memeloop URI. Currently only `.../file/...` is supported.\n */\nexport function parseMemeloopUri(uri: string): ParsedMemeloopUri | null {\n  const u = uri.trim();\n  if (!u.startsWith(PREFIX)) return null;\n  const rest = u.slice(PREFIX.length);\n  const slash = rest.indexOf('/');\n  if (slash <= 0) return null;\n  let nodeId: string;\n  try {\n    nodeId = decodeURIComponent(rest.slice(0, slash));\n  } catch {\n    return null;\n  }\n  const afterNode = rest.slice(slash + 1);\n  if (!afterNode.startsWith('file/')) return null;\n  const pathPart = afterNode.slice('file/'.length);\n  if (pathPart.length === 0) {\n    return { scheme: 'memeloop', kind: 'file', nodeId, filePath: '' };\n  }\n  try {\n    const filePath = pathPart.split('/').map(decodeURIComponent).join('/');\n    return { scheme: 'memeloop', kind: 'file', nodeId, filePath };\n  } catch {\n    return null;\n  }\n}\n","import type { AgentDefinition } from '../agent/types.js';\nimport type { ChatMessage } from '../conversation/index.js';\nimport type { MemeLoopRuntime } from '../runtime.js';\nimport type { ConversationMeta } from '../sync/protocol.js';\nimport type { IAgentStorage } from '../types.js';\nimport type { DeviceRpcHandler } from './types.js';\n\nexport interface AgentRuntimeDeviceRpcHandlerOptions {\n  runtime: Pick<MemeLoopRuntime, 'createAgent' | 'sendMessage' | 'cancelAgent'>;\n  storage: IAgentStorage;\n  getAgentDefinitions?: () => AgentDefinition[] | Promise<AgentDefinition[]>;\n  localNodeId?: string;\n}\n\nexport function createAgentRuntimeDeviceRpcHandler(options: AgentRuntimeDeviceRpcHandlerOptions): DeviceRpcHandler {\n  return async ({ method, parameters }) => {\n    switch (method) {\n      case 'memeloop.agent.getDefinitions':\n        return { definitions: await options.getAgentDefinitions?.() ?? [] };\n      case 'memeloop.agent.create': {\n        const rpcParameters = objectParameter(parameters);\n        return options.runtime.createAgent({\n          definitionId: stringParameter(rpcParameters, 'definitionId'),\n          initialMessage: optionalStringParameter(rpcParameters, 'initialMessage'),\n        });\n      }\n      case 'memeloop.agent.send': {\n        const rpcParameters = objectParameter(parameters);\n        await options.runtime.sendMessage({\n          conversationId: stringParameter(rpcParameters, 'conversationId'),\n          message: stringParameter(rpcParameters, 'message'),\n          definitionId: optionalStringParameter(rpcParameters, 'definitionId'),\n          userMessage: chatMessageParameter(rpcParameters, 'userMessage'),\n          resumeSession: chatMessageArrayParameter(rpcParameters, 'resumeSession'),\n        });\n        return { ok: true };\n      }\n      case 'memeloop.agent.runTurn': {\n        const rpcParameters = objectParameter(parameters);\n        const conversationId = stringParameter(rpcParameters, 'conversationId');\n        const definitionId = stringParameter(rpcParameters, 'definitionId');\n        await upsertConversationForRemoteTurn({\n          storage: options.storage,\n          conversationId,\n          definitionId,\n          conversation: conversationMetaParameter(rpcParameters, 'conversation'),\n          localNodeId: options.localNodeId,\n        });\n        await options.runtime.sendMessage({\n          conversationId,\n          definitionId,\n          message: stringParameter(rpcParameters, 'message'),\n          userMessage: chatMessageParameter(rpcParameters, 'userMessage'),\n          resumeSession: chatMessageArrayParameter(rpcParameters, 'resumeSession'),\n        });\n        return { ok: true, conversationId };\n      }\n      case 'memeloop.agent.cancel': {\n        const rpcParameters = objectParameter(parameters);\n        await options.runtime.cancelAgent(stringParameter(rpcParameters, 'conversationId'));\n        return { ok: true };\n      }\n      case 'memeloop.chat.pullAgentRunLog': {\n        const rpcParameters = objectParameter(parameters);\n        const conversationId = stringParameter(rpcParameters, 'conversationId');\n        const known = new Set(stringArrayParameter(rpcParameters, 'knownMessageIds'));\n        const messages = await options.storage.getMessages(conversationId, { mode: 'full-content' });\n        return { messages: messages.filter((message) => !known.has(message.messageId)) };\n      }\n      default:\n        throw new Error(`rpc_method_not_found:${method}`);\n    }\n  };\n}\n\nasync function upsertConversationForRemoteTurn(input: {\n  storage: IAgentStorage;\n  conversationId: string;\n  definitionId: string;\n  conversation?: ConversationMeta;\n  localNodeId?: string;\n}): Promise<void> {\n  if (input.conversation) {\n    await input.storage.upsertConversationMetadata(input.conversation);\n    return;\n  }\n  const existing = await input.storage.getConversationMeta(input.conversationId).catch(() => null);\n  if (existing) return;\n  const now = Date.now();\n  await input.storage.upsertConversationMetadata({\n    conversationId: input.conversationId,\n    title: input.definitionId,\n    lastMessagePreview: '',\n    lastMessageTimestamp: now,\n    messageCount: 0,\n    originNodeId: input.localNodeId ?? 'remote',\n    originClock: 1,\n    definitionId: input.definitionId,\n    isUserInitiated: true,\n  });\n}\n\nfunction objectParameter(value: unknown): Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) throw new Error('invalid_rpc_params');\n  return value as Record<string, unknown>;\n}\n\nfunction stringParameter(parameters: Record<string, unknown>, key: string): string {\n  const value = parameters[key];\n  if (typeof value !== 'string' || value.length === 0) throw new Error('invalid_rpc_params');\n  return value;\n}\n\nfunction optionalStringParameter(parameters: Record<string, unknown>, key: string): string | undefined {\n  const value = parameters[key];\n  if (value === undefined) return undefined;\n  if (typeof value !== 'string') throw new Error('invalid_rpc_params');\n  return value;\n}\n\nfunction stringArrayParameter(parameters: Record<string, unknown>, key: string): string[] {\n  const value = parameters[key];\n  if (value === undefined) return [];\n  if (!Array.isArray(value)) throw new Error('invalid_rpc_params');\n  return value.filter((item): item is string => typeof item === 'string');\n}\n\nfunction chatMessageParameter(parameters: Record<string, unknown>, key: string): ChatMessage | undefined {\n  const value = parameters[key];\n  if (value === undefined) return undefined;\n  if (!isChatMessage(value)) throw new Error('invalid_rpc_params');\n  return value;\n}\n\nfunction chatMessageArrayParameter(parameters: Record<string, unknown>, key: string): ChatMessage[] | undefined {\n  const value = parameters[key];\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value)) throw new Error('invalid_rpc_params');\n  return value.filter(isChatMessage);\n}\n\nfunction conversationMetaParameter(parameters: Record<string, unknown>, key: string): ConversationMeta | undefined {\n  const value = parameters[key];\n  if (value === undefined) return undefined;\n  if (!isConversationMetaLike(value)) throw new Error('invalid_rpc_params');\n  return value;\n}\n\nfunction isChatMessage(value: unknown): value is ChatMessage {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  return (\n    typeof record.messageId === 'string' &&\n    typeof record.conversationId === 'string' &&\n    typeof record.originNodeId === 'string' &&\n    typeof record.timestamp === 'number' &&\n    typeof record.lamportClock === 'number' &&\n    typeof record.role === 'string' &&\n    typeof record.content === 'string'\n  );\n}\n\nfunction isConversationMetaLike(value: unknown): value is ConversationMeta {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  return (\n    typeof record.conversationId === 'string' &&\n    typeof record.title === 'string' &&\n    typeof record.lastMessageTimestamp === 'number' &&\n    typeof record.messageCount === 'number' &&\n    typeof record.originNodeId === 'string' &&\n    typeof record.originClock === 'number' &&\n    typeof record.definitionId === 'string' &&\n    typeof record.isUserInitiated === 'boolean'\n  );\n}\n","import type { DeviceRpcHandler } from './types.js';\n\nexport const PEER_DRIVER_PROTOCOL_VERSION = 'memeloop-peer-driver/v2';\n\nexport type PeerDriverScope = 'runtime' | 'model' | 'tool';\n\nexport interface PeerDriverAssignment {\n  /** Protocol version for forward compatibility. */\n  version: typeof PEER_DRIVER_PROTOCOL_VERSION;\n  /** Scoped driver domain. */\n  scope: PeerDriverScope;\n  /** Assignment ID for idempotency and tracking. */\n  assignmentId: string;\n  /** Target operation within the scope. */\n  operation: string;\n  /** Operation parameters. */\n  parameters: unknown;\n  /** Optional timeout in milliseconds. */\n  timeoutMs?: number;\n}\n\nexport interface PeerDriverStatus {\n  version: typeof PEER_DRIVER_PROTOCOL_VERSION;\n  assignmentId: string;\n  state: 'accepted' | 'running' | 'completed' | 'failed';\n  result?: unknown;\n  error?: string;\n  completedAt?: string;\n}\n\nexport interface PeerDriverTransportOptions {\n  /** Send a raw RPC to a peer. */\n  sendRpc: (peerId: string, method: string, parameters: unknown) => Promise<unknown>;\n  /** Default timeout for assignments. */\n  defaultTimeoutMs?: number;\n}\n\nexport interface PeerDriverRequestContext {\n  /** Authenticated transport identity; never sourced from request parameters. */\n  remotePeerId: string;\n}\n\nconst IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;\nconst MAX_ASSIGNMENT_ID_LENGTH = 256;\nconst MAX_OPERATION_LENGTH = 128;\nconst MAX_PARAMETERS_BYTES = 1024 * 1024;\nconst MAX_TIMEOUT_MS = 10 * 60_000;\nconst STATUS_STATES = new Set<PeerDriverStatus['state']>([\n  'accepted',\n  'running',\n  'completed',\n  'failed',\n]);\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction assertIdentifier(value: unknown, field: string, maximumLength: number): asserts value is string {\n  if (\n    typeof value !== 'string' ||\n    value.length < 1 ||\n    value.length > maximumLength ||\n    !IDENTIFIER_PATTERN.test(value)\n  ) {\n    throw new Error(`Invalid peer driver ${field}`);\n  }\n}\n\nfunction assertBoundedJson(value: unknown, field: string): void {\n  let encoded: string;\n  try {\n    encoded = JSON.stringify(value);\n  } catch {\n    throw new Error(`Invalid peer driver ${field}`);\n  }\n  if (encoded === undefined || new TextEncoder().encode(encoded).byteLength > MAX_PARAMETERS_BYTES) {\n    throw new Error(`Peer driver ${field} exceeds ${MAX_PARAMETERS_BYTES} bytes`);\n  }\n}\n\nfunction assertAssignment(value: unknown): asserts value is PeerDriverAssignment {\n  if (!isRecord(value)) throw new Error('Invalid peer driver assignment');\n  if (value.version !== PEER_DRIVER_PROTOCOL_VERSION) {\n    throw new Error(`Unsupported peer driver protocol version: ${String(value.version)}`);\n  }\n  if (value.scope !== 'runtime' && value.scope !== 'model' && value.scope !== 'tool') {\n    throw new Error('Invalid peer driver scope');\n  }\n  assertIdentifier(value.assignmentId, 'assignmentId', MAX_ASSIGNMENT_ID_LENGTH);\n  assertIdentifier(value.operation, 'operation', MAX_OPERATION_LENGTH);\n  if (\n    value.timeoutMs !== undefined &&\n    (typeof value.timeoutMs !== 'number' ||\n      !Number.isSafeInteger(value.timeoutMs) ||\n      value.timeoutMs < 1 ||\n      value.timeoutMs > MAX_TIMEOUT_MS)\n  ) {\n    throw new Error('Invalid peer driver timeoutMs');\n  }\n  if (!('parameters' in value)) throw new Error('Invalid peer driver parameters');\n  assertBoundedJson(value.parameters, 'parameters');\n}\n\nfunction assertAssignmentReference(value: unknown): asserts value is {\n  version: typeof PEER_DRIVER_PROTOCOL_VERSION;\n  assignmentId: string;\n} {\n  if (!isRecord(value)) throw new Error('Invalid peer driver assignment reference');\n  if (value.version !== PEER_DRIVER_PROTOCOL_VERSION) {\n    throw new Error(`Unsupported peer driver protocol version: ${String(value.version)}`);\n  }\n  assertIdentifier(value.assignmentId, 'assignmentId', MAX_ASSIGNMENT_ID_LENGTH);\n}\n\nfunction assertStatus(value: unknown, assignmentId: string): asserts value is PeerDriverStatus {\n  if (\n    !isRecord(value) ||\n    value.version !== PEER_DRIVER_PROTOCOL_VERSION ||\n    value.assignmentId !== assignmentId ||\n    !STATUS_STATES.has(value.state as PeerDriverStatus['state']) ||\n    (value.error !== undefined &&\n      (typeof value.error !== 'string' || value.error.length > 4096)) ||\n    (value.completedAt !== undefined &&\n      (typeof value.completedAt !== 'string' || !Number.isFinite(Date.parse(value.completedAt))))\n  ) {\n    throw new Error('Invalid peer driver status response');\n  }\n  if ('result' in value) assertBoundedJson(value.result, 'result');\n}\n\n/**\n * Create a scoped peer driver transport that exchanges versioned assignments\n * and status through the device network. LLMs and callers use scoped\n * operations (runtime/model/tool) instead of raw node IDs and RPC methods.\n */\nexport function createPeerDriverTransport(options: PeerDriverTransportOptions) {\n  async function submitAssignment(\n    peerId: string,\n    assignment: Omit<PeerDriverAssignment, 'version'>,\n  ): Promise<PeerDriverStatus> {\n    const versionedAssignment: PeerDriverAssignment = {\n      version: PEER_DRIVER_PROTOCOL_VERSION,\n      ...assignment,\n    };\n    assertAssignment(versionedAssignment);\n\n    const result = await options.sendRpc(\n      peerId,\n      `${PEER_DRIVER_PROTOCOL_VERSION}/submit`,\n      versionedAssignment,\n    );\n    assertStatus(result, assignment.assignmentId);\n    return result;\n  }\n\n  async function getAssignmentStatus(\n    peerId: string,\n    assignmentId: string,\n  ): Promise<PeerDriverStatus> {\n    assertIdentifier(assignmentId, 'assignmentId', MAX_ASSIGNMENT_ID_LENGTH);\n    const result = await options.sendRpc(\n      peerId,\n      `${PEER_DRIVER_PROTOCOL_VERSION}/status`,\n      { version: PEER_DRIVER_PROTOCOL_VERSION, assignmentId },\n    );\n    assertStatus(result, assignmentId);\n    return result;\n  }\n\n  async function cancelAssignment(\n    peerId: string,\n    assignmentId: string,\n  ): Promise<PeerDriverStatus> {\n    assertIdentifier(assignmentId, 'assignmentId', MAX_ASSIGNMENT_ID_LENGTH);\n    const result = await options.sendRpc(\n      peerId,\n      `${PEER_DRIVER_PROTOCOL_VERSION}/cancel`,\n      { version: PEER_DRIVER_PROTOCOL_VERSION, assignmentId },\n    );\n    assertStatus(result, assignmentId);\n    return result;\n  }\n\n  return {\n    submitAssignment,\n    getAssignmentStatus,\n    cancelAssignment,\n  };\n}\n\n/**\n * Create a DeviceRpcHandler that routes scoped driver protocol calls to the\n * appropriate local handlers.\n */\nexport function createPeerDriverRpcHandler(handlers: {\n  onSubmit?: (\n    assignment: PeerDriverAssignment,\n    context: PeerDriverRequestContext,\n  ) => Promise<PeerDriverStatus>;\n  onStatus?: (\n    assignmentId: string,\n    context: PeerDriverRequestContext,\n  ) => Promise<PeerDriverStatus>;\n  onCancel?: (\n    assignmentId: string,\n    context: PeerDriverRequestContext,\n  ) => Promise<PeerDriverStatus>;\n}): DeviceRpcHandler {\n  return async (input) => {\n    const { method, parameters } = input;\n    const context: PeerDriverRequestContext = { remotePeerId: input.remotePeerId };\n\n    if (method === `${PEER_DRIVER_PROTOCOL_VERSION}/submit`) {\n      assertAssignment(parameters);\n      if (!handlers.onSubmit) {\n        throw new Error('No submit handler registered');\n      }\n      const result = await handlers.onSubmit(parameters, context);\n      assertStatus(result, parameters.assignmentId);\n      return result;\n    }\n\n    if (method === `${PEER_DRIVER_PROTOCOL_VERSION}/status`) {\n      assertAssignmentReference(parameters);\n      if (!handlers.onStatus) {\n        throw new Error('No status handler registered');\n      }\n      const result = await handlers.onStatus(parameters.assignmentId, context);\n      assertStatus(result, parameters.assignmentId);\n      return result;\n    }\n\n    if (method === `${PEER_DRIVER_PROTOCOL_VERSION}/cancel`) {\n      assertAssignmentReference(parameters);\n      if (!handlers.onCancel) {\n        throw new Error('No cancel handler registered');\n      }\n      const result = await handlers.onCancel(parameters.assignmentId, context);\n      assertStatus(result, parameters.assignmentId);\n      return result;\n    }\n\n    throw new Error('Unknown peer driver protocol method: ' + method);\n  };\n}\n","export const MEMELOOP_TERMINAL_OUTPUT_NOTIFICATION = 'memeloop.terminal.output.delta' as const;\n\nexport type MemeloopTerminalOutputNotificationMethod = typeof MEMELOOP_TERMINAL_OUTPUT_NOTIFICATION;\n","import type { IMChannelBinding } from './protocol.js';\n\nimport type { IIMAdapter, ImAgentDriver, ImInboundMessage } from './interface.js';\n\n/**\n * 管理 IM 用户与会话的绑定；可选 `storage` 使用 IAgentStorage 的 IM 绑定持久化。\n */\nexport class IMChannelManager {\n  private readonly bindings = new Map<string, IMChannelBinding>();\n\n  constructor(\n    private readonly storage?: {\n      getImBinding?(c: string, u: string): Promise<IMChannelBinding | null>;\n      setImBinding?(r: IMChannelBinding): Promise<void>;\n    },\n  ) {}\n\n  private key(channelId: string, imUserId: string): string {\n    return `${channelId}::${imUserId}`;\n  }\n\n  async getBinding(channelId: string, imUserId: string): Promise<IMChannelBinding | undefined> {\n    const k = this.key(channelId, imUserId);\n    if (this.storage?.getImBinding) {\n      const row = await this.storage.getImBinding(channelId, imUserId);\n      if (row) {\n        this.bindings.set(k, row);\n        return row;\n      }\n    }\n    return this.bindings.get(k);\n  }\n\n  async setBinding(record: IMChannelBinding): Promise<void> {\n    this.bindings.set(this.key(record.channelId, record.imUserId), record);\n    if (this.storage?.setImBinding) {\n      await this.storage.setImBinding(record);\n    }\n  }\n\n  /**\n   * 处理入站文本：无 binding 时创建会话并发送首条用户消息。\n   */\n  async dispatchInbound(\n    message: ImInboundMessage,\n    driver: ImAgentDriver,\n    options: { defaultDefinitionId: string },\n  ): Promise<{ conversationId: string }> {\n    const existing = await this.getBinding(message.channelId, message.imUserId);\n    if (existing) {\n      await driver.sendMessage({\n        conversationId: existing.activeConversationId,\n        message: message.text,\n      });\n      return { conversationId: existing.activeConversationId };\n    }\n    const definitionId = options.defaultDefinitionId;\n    const { conversationId } = await driver.createAgent({\n      definitionId,\n      initialMessage: message.text,\n    });\n    await this.setBinding({\n      channelId: message.channelId,\n      imUserId: message.imUserId,\n      activeConversationId: conversationId,\n      createdAt: Date.now(),\n      defaultDefinitionId: definitionId,\n    });\n    return { conversationId };\n  }\n\n  async switchConversation(\n    channelId: string,\n    imUserId: string,\n    conversationId: string,\n  ): Promise<void> {\n    const current = await this.getBinding(channelId, imUserId);\n    if (current) {\n      await this.setBinding({ ...current, activeConversationId: conversationId });\n    } else {\n      await this.setBinding({\n        channelId,\n        imUserId,\n        activeConversationId: conversationId,\n        createdAt: Date.now(),\n      });\n    }\n  }\n}\n\nexport function pickAdapter(adapters: IIMAdapter[], platform: string): IIMAdapter | undefined {\n  return adapters.find((a) => a.platform === platform);\n}\n","/** Plan §20.6.1 — chunk assistant text before sending to IM APIs. */\nexport function imPlatformMaxMessageChars(platform: string): number {\n  switch (platform) {\n    case 'telegram':\n      return 4096;\n    case 'discord':\n      return 2000;\n    case 'lark':\n      return 4096;\n    case 'wecom':\n      return 2048;\n    case 'slack':\n      return 4000;\n    case 'qq':\n      return 4500;\n    default:\n      return 3500;\n  }\n}\n","import type { MemeLoopRuntime } from '../runtime.js';\nimport type { IAgentStorage } from '../storage/interface.js';\n\nimport type { IMChannelManager } from './channelManager.js';\nimport type { ImAgentDriver } from './interface.js';\n\nexport interface ImSlashCommandContext {\n  rawText: string;\n  channelId: string;\n  imUserId: string;\n  manager: IMChannelManager;\n  storage: IAgentStorage;\n  driver: ImAgentDriver;\n  runtime: MemeLoopRuntime;\n  defaultDefinitionId: string;\n}\n\n/**\n * Plan §20.6.4 — parse `/list`, `/switch`, `/new`, `/agent`, `/status`, `/cancel` locally (no LLM).\n */\nexport async function tryHandleImSlashCommand(context: ImSlashCommandContext): Promise<{\n  handled: boolean;\n  messages: string[];\n}> {\n  const t = context.rawText.trim();\n  if (!t.startsWith('/') || t.startsWith('//') || t.length < 2) {\n    return { handled: false, messages: [] };\n  }\n  const parts = t.slice(1).split(/\\s+/).filter(Boolean);\n  const cmd = (parts[0] ?? '').toLowerCase();\n  const rest = parts.slice(1).join(' ').trim();\n\n  const binding = await context.manager.getBinding(context.channelId, context.imUserId);\n  const ok = (lines: string[]) => ({ handled: true as const, messages: lines });\n\n  if (cmd === 'list') {\n    const list = await context.storage.listConversations({ limit: 50 });\n    if (list.length === 0) return ok(['（暂无会话）']);\n    const body = list.map(\n      (c, index) => `${index + 1}. ${c.title || c.conversationId} — ${c.conversationId.slice(0, 14)}…`,\n    );\n    return ok(['可切换会话：', ...body.map((l) => `• ${l}`)]);\n  }\n\n  if (cmd === 'switch') {\n    if (!binding) return ok(['当前无绑定会话，先用 /new 创建。']);\n    const list = await context.storage.listConversations({ limit: 50 });\n    const argument = rest.trim();\n    if (!argument) return ok(['用法：/switch <编号或 conversationId>']);\n    const n = parseInt(argument, 10);\n    let targetId: string | undefined;\n    if (!Number.isNaN(n) && n >= 1 && n <= list.length) {\n      targetId = list[n - 1]?.conversationId;\n    } else {\n      targetId = list.find(\n        (c) => c.conversationId === argument || c.conversationId.includes(argument),\n      )?.conversationId;\n    }\n    if (!targetId) return ok([`未找到会话：${argument}`]);\n    await context.manager.switchConversation(context.channelId, context.imUserId, targetId);\n    return ok([`已切换到：${targetId}`]);\n  }\n\n  if (cmd === 'new' || cmd === 'agent') {\n    const definitionId = rest || context.defaultDefinitionId;\n    const { conversationId } = await context.driver.createAgent({ definitionId });\n    await context.manager.setBinding({\n      channelId: context.channelId,\n      imUserId: context.imUserId,\n      activeConversationId: conversationId,\n      createdAt: Date.now(),\n      defaultDefinitionId: definitionId,\n    });\n    return ok([`已新建并绑定会话。\\nID：\\`${conversationId}\\`\\n发送消息即可开始。`]);\n  }\n\n  if (cmd === 'status') {\n    if (!binding) return ok(['无活跃 IM 绑定。']);\n    const meta = await context.storage.getConversationMeta(binding.activeConversationId);\n    return ok([\n      `会话：${binding.activeConversationId}`,\n      `定义：${meta?.definitionId ?? '?'}`,\n      `消息数：${meta?.messageCount ?? '?'}`,\n    ]);\n  }\n\n  if (cmd === 'cancel') {\n    if (!binding) return ok(['无会话可取消。']);\n    await context.runtime.cancelAgent(binding.activeConversationId);\n    return ok(['已请求取消当前任务。']);\n  }\n\n  return { handled: false, messages: [] };\n}\n","import type { MemeLoopRuntime } from '../runtime.js';\n\nimport { imPlatformMaxMessageChars } from './imPlatformLimits.js';\nimport type { TextMessageRenderer } from './textRenderer.js';\n\nexport type ImStreamFlush = (text: string) => Promise<void>;\n\nfunction stringifyImValue(value: unknown): string {\n  if (value == null) return '';\n  if (typeof value === 'string') return value;\n  if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') {\n    return String(value);\n  }\n  try {\n    return JSON.stringify(value);\n  } catch {\n    return '[unserializable value]';\n  }\n}\n\n/**\n * Subscribe to `runtime` agent updates and forward assistant text + light tool summaries to IM,\n * flushing when the buffer reaches the platform limit (plan §20.6.1).\n */\nexport async function streamRuntimeAgentReplyToIm(options: {\n  runtime: MemeLoopRuntime;\n  conversationId: string;\n  platform: string;\n  renderer: TextMessageRenderer;\n  flush: ImStreamFlush;\n}): Promise<void> {\n  const max = imPlatformMaxMessageChars(options.platform);\n  let buf = '';\n\n  const sendSlice = async (force: boolean): Promise<void> => {\n    if (buf.length === 0) return;\n    if (force) {\n      while (buf.length > 0) {\n        const take = Math.min(max, buf.length);\n        const chunk = buf.slice(0, take);\n        buf = buf.slice(take);\n        if (chunk.trim().length > 0) await options.flush(chunk);\n      }\n      return;\n    }\n    while (buf.length >= max) {\n      const chunk = buf.slice(0, max);\n      buf = buf.slice(max);\n      await options.flush(chunk);\n    }\n  };\n\n  await new Promise<void>((resolve, reject) => {\n    const off = options.runtime.subscribeToUpdates(options.conversationId, (u: unknown) => {\n      const o = u as { type?: string; step?: { type?: string; data?: unknown } };\n      if (o.type === 'agent-done') {\n        void sendSlice(true)\n          .then(() => {\n            off();\n            resolve();\n          })\n          .catch(reject);\n        return;\n      }\n      if (o.type === 'agent-error') {\n        off();\n        reject(new Error((o as { error?: string }).error ?? 'agent-error'));\n        return;\n      }\n      if (o.type === 'agent-step' && o.step?.type === 'message') {\n        const stepData = o.step.data;\n        let piece = '';\n        if (typeof stepData === 'string') piece = stepData;\n        else if (stepData != null && typeof stepData === 'object' && 'content' in stepData) {\n          const content = (stepData as { content?: unknown }).content;\n          piece = stringifyImValue(content);\n        } else piece = stringifyImValue(stepData);\n        buf += piece;\n        void sendSlice(false);\n      }\n      if (o.type === 'agent-step' && o.step?.type === 'tool') {\n        const td = o.step.data as {\n          toolId?: string;\n          parameters?: unknown;\n          result?: unknown;\n          isError?: boolean;\n        };\n        const id = td.toolId;\n        if (!id) return;\n        if (id === 'ask-question') {\n          const p = td.parameters as {\n            question?: string;\n            options?: Array<{ label: string }>;\n          };\n          const q = typeof p?.question === 'string' ? p.question : '';\n          const optLabels = p?.options\n            ?.map((o) => o.label)\n            .filter((x): x is string => typeof x === 'string');\n          const askText = options.renderer.renderAskQuestion(q, optLabels);\n          buf += (buf && !buf.endsWith('\\n') ? '\\n' : '') + askText + '\\n';\n          void sendSlice(true);\n          return;\n        }\n        if (td.isError) {\n          buf += (buf && !buf.endsWith('\\n') ? '\\n' : '') +\n            options.renderer.renderError(stringifyImValue(td.result) || 'tool error') +\n            '\\n';\n          void sendSlice(false);\n          return;\n        }\n        const callLine = options.renderer.renderToolCallSummary(id, td.parameters ?? {});\n        const resultLine = options.renderer.renderToolResultSummary(id, td.result ?? null);\n        buf += (buf && !buf.endsWith('\\n') ? '\\n' : '') +\n          callLine +\n          (resultLine ? `\\n${resultLine}` : '') +\n          '\\n';\n        void sendSlice(false);\n      }\n    });\n  });\n}\n","import type { IIMMessageRenderer } from './interface.js';\n\n/** 通用文本/Markdown 友好输出（IM 端以纯文本展示） */\nexport class TextMessageRenderer implements IIMMessageRenderer {\n  renderPlainText(content: string): string {\n    return content.trim();\n  }\n\n  renderToolCallSummary(toolName: string, arguments_: unknown): string {\n    const s = (() => {\n      try {\n        const index = JSON.stringify(arguments_);\n        if (!index || index === '{}') return '';\n        return index.length > 120 ? `${index.slice(0, 117)}…` : index;\n      } catch {\n        return '';\n      }\n    })();\n    return s ? `🔧 ${toolName}: ${s}` : `🔧 ${toolName}`;\n  }\n\n  renderToolResultSummary(toolName: string, result: unknown): string | null {\n    // IM 默认隐藏工具结果细节：只给一个轻量摘要，避免刷屏。\n    if (result == null) return `✅ ${toolName}: done`;\n    if (typeof result === 'string') {\n      const t = result.trim();\n      if (!t) return `✅ ${toolName}: done`;\n      return `✅ ${toolName}: ${t.length > 120 ? `${t.slice(0, 117)}…` : t}`;\n    }\n    if (typeof result === 'object') {\n      const keys = Object.keys(result as Record<string, unknown>);\n      if (keys.length === 0) return `✅ ${toolName}: done`;\n      return `✅ ${toolName}: {${keys.slice(0, 6).join(', ')}${keys.length > 6 ? ', …' : ''}}`;\n    }\n    if (typeof result === 'symbol') return `✅ ${toolName}: ${result.toString()}`;\n    if (typeof result === 'function') return `✅ ${toolName}: [function]`;\n    if (typeof result === 'number' || typeof result === 'boolean' || typeof result === 'bigint') {\n      return `✅ ${toolName}: ${String(result)}`;\n    }\n    return `✅ ${toolName}: done`;\n  }\n\n  renderToolApproval(toolName: string, arguments_: unknown): string {\n    return `⏸ 需要审批执行工具：${toolName}\\n参数：\\n\\`\\`\\`json\\n${JSON.stringify(arguments_, null, 2)}\\n\\`\\`\\`\\n回复 Y 同意 / N 拒绝`;\n  }\n\n  renderAskQuestion(question: string, options?: string[]): string {\n    const lines = options?.length\n      ? [`❓ ${question}`, ...options.map((o, index) => `${index + 1}. ${o}`)]\n      : [`❓ ${question}`];\n    return lines.join('\\n');\n  }\n\n  renderThinking(_content: string): string | null {\n    return null;\n  }\n\n  renderError(error: string): string {\n    return `⚠️ 错误：${error}`;\n  }\n\n  renderTodoList(todos: Array<{ id: string; text: string; done?: boolean }>): string {\n    return ['📋 Todo', ...todos.map((t) => `${t.done ? '[x]' : '[ ]'} ${t.text}`)].join('\\n');\n  }\n}\n","import type { IMChannelManager } from './channelManager.js';\nimport type { ImAgentDriver } from './interface.js';\n\n/**\n * IM 会话控制工具（计划 20.4）：在带 IM binding 的会话中注入。\n * 这里仅导出工具 schema 描述，实际注册由上层 ToolRegistry 完成。\n */\nexport const imToolDefinitions = [\n  {\n    name: 'im.listConversations',\n    description: '列出可切换的会话（由 memeloop-cli registerImSessionTools 注册，仅 IM 来源会话可用）。',\n  },\n  {\n    name: 'im.switchConversation',\n    description: '切换当前 IM 用户绑定的活跃会话。参数：{ conversationId: string }',\n  },\n  {\n    name: 'im.newConversation',\n    description: '创建新会话并切换绑定。参数：{ definitionId?: string }',\n  },\n  {\n    name: 'im.summarizeHistory',\n    description: '返回当前会话最近消息的纯文本摘要（规则拼接，非 LLM）。参数：{ maxMessages?: number }',\n  },\n] as const;\n\nexport interface ImToolsRuntime {\n  channelId: string;\n  imUserId: string;\n  manager: IMChannelManager;\n  driver: ImAgentDriver;\n  defaultDefinitionId: string;\n}\n\n/** 供工具实现层调用的命令式 API（避免在 core 内耦合 defineTool） */\nexport async function imSwitchConversation(rt: ImToolsRuntime, conversationId: string): Promise<void> {\n  await rt.manager.switchConversation(rt.channelId, rt.imUserId, conversationId);\n}\n","import { z } from 'zod';\n\nimport type { IMChannelManager } from '../../im/channelManager.js';\nimport type { MemeLoopRuntime } from '../../runtime.js';\nimport type { IToolRegistry } from '../../types.js';\nimport type { BuiltinToolContext } from './types.js';\n\nimport { registerToolParameterSchema } from '../schemaRegistry.js';\n\nexport const IM_SESSION_TOOL_IDS = [\n  'im.listConversations',\n  'im.switchConversation',\n  'im.newConversation',\n  'im.summarizeHistory',\n] as const;\n\nconst listSchema = z.object({});\n\nconst switchSchema = z.object({\n  conversationId: z.string().min(1),\n});\n\nconst newSchema = z.object({\n  definitionId: z.string().min(1).optional(),\n});\n\nconst summarizeSchema = z.object({\n  maxMessages: z.number().int().positive().max(200).optional(),\n});\n\nexport interface ImSessionBuiltinRegistration {\n  imChannelManager: IMChannelManager;\n  getMemeLoopRuntime: () => MemeLoopRuntime;\n}\n\nfunction error(message: string): { error: string } {\n  return { error: message };\n}\n\nasync function requireImSource(\n  context: BuiltinToolContext,\n  conversationId: string,\n): Promise<{ channelId: string; imUserId: string; platform: string } | { error: string }> {\n  const meta = await context.storage.getConversationMeta(conversationId);\n  const sc = meta?.sourceChannel;\n  if (!sc) {\n    return { error: 'im_tools_only_in_im_session' };\n  }\n  return { channelId: sc.channelId, imUserId: sc.imUserId, platform: sc.platform };\n}\n\nexport async function imListConversationsImpl(\n  arguments_: Record<string, unknown>,\n  context: BuiltinToolContext,\n  _reg: ImSessionBuiltinRegistration,\n): Promise<{ result: string } | { error: string }> {\n  const parsed = listSchema.safeParse(arguments_);\n  if (!parsed.success) return error('invalid_args');\n  const cid = context.activeToolConversationId;\n  if (!cid) return error('no_active_conversation');\n  const source = await requireImSource(context, cid);\n  if ('error' in source) return source;\n  const all = await context.storage.listConversations({});\n  if (all.length === 0) return { result: '（暂无会话）' };\n  const sorted = [...all].sort((a, b) => b.lastMessageTimestamp - a.lastMessageTimestamp);\n  const lines = sorted.map((m, index) => {\n    const title = m.title || m.conversationId;\n    const t = new Date(m.lastMessageTimestamp).toISOString();\n    return `${index + 1}. ${title}\\n   id: ${m.conversationId}\\n   def: ${m.definitionId} | ${t}`;\n  });\n  return { result: `可切换的会话：\\n${lines.join('\\n')}` };\n}\n\nexport async function imSwitchConversationImpl(\n  arguments_: Record<string, unknown>,\n  context: BuiltinToolContext,\n  reg: ImSessionBuiltinRegistration,\n): Promise<{ result: string } | { error: string }> {\n  const parsed = switchSchema.safeParse(arguments_);\n  if (!parsed.success) return error('invalid_args');\n  const cid = context.activeToolConversationId;\n  if (!cid) return error('no_active_conversation');\n  const source = await requireImSource(context, cid);\n  if ('error' in source) return source;\n  await reg.imChannelManager.switchConversation(\n    source.channelId,\n    source.imUserId,\n    parsed.data.conversationId,\n  );\n  return { result: `已切换到会话：${parsed.data.conversationId}` };\n}\n\nexport async function imNewConversationImpl(\n  arguments_: Record<string, unknown>,\n  context: BuiltinToolContext,\n  reg: ImSessionBuiltinRegistration,\n): Promise<{ result: string } | { error: string }> {\n  const parsed = newSchema.safeParse(arguments_);\n  if (!parsed.success) return error('invalid_args');\n  const cid = context.activeToolConversationId;\n  if (!cid) return error('no_active_conversation');\n  const source = await requireImSource(context, cid);\n  if ('error' in source) return source;\n  const current = await reg.imChannelManager.getBinding(source.channelId, source.imUserId);\n  const definitionId = parsed.data.definitionId?.trim() ||\n    current?.defaultDefinitionId ||\n    'memeloop:general-assistant';\n  const rt = reg.getMemeLoopRuntime();\n  const { conversationId } = await rt.createAgent({ definitionId, initialMessage: '' });\n  await reg.imChannelManager.setBinding({\n    channelId: source.channelId,\n    imUserId: source.imUserId,\n    activeConversationId: conversationId,\n    createdAt: Date.now(),\n    defaultDefinitionId: definitionId,\n  });\n  const meta = await context.storage.getConversationMeta(conversationId);\n  if (meta) {\n    await context.storage.upsertConversationMetadata({\n      ...meta,\n      sourceChannel: {\n        channelId: source.channelId,\n        platform: source.platform,\n        imUserId: source.imUserId,\n      },\n    });\n  }\n  return {\n    result: `已新建并切换到会话：${conversationId}\\ndefinition: ${definitionId}\\n请让用户发送下一条消息以开始对话。`,\n  };\n}\n\nexport async function imSummarizeHistoryImpl(\n  arguments_: Record<string, unknown>,\n  context: BuiltinToolContext,\n  _reg: ImSessionBuiltinRegistration,\n): Promise<{ result: string } | { error: string }> {\n  const parsed = summarizeSchema.safeParse(arguments_);\n  if (!parsed.success) return error('invalid_args');\n  const cid = context.activeToolConversationId;\n  if (!cid) return error('no_active_conversation');\n  const source = await requireImSource(context, cid);\n  if ('error' in source) return source;\n  void source;\n  const max = parsed.data.maxMessages ?? 40;\n  const msgs = await context.storage.getMessages(cid, { mode: 'full-content' });\n  const tail = msgs.slice(-max);\n  if (tail.length === 0) return { result: '（当前会话尚无消息）' };\n  const lines = tail.map(\n    (m) => `[${m.role}] ${m.content.slice(0, 2000)}${m.content.length > 2000 ? '…' : ''}`,\n  );\n  return {\n    result: `最近 ${tail.length} 条消息摘要（供 IM 上下文）：\\n${lines.join('\\n---\\n')}`,\n  };\n}\n\n/**\n * 注册 IM 会话专用工具（需节点传入 `imChannelManager` 与 `getMemeLoopRuntime`）。\n */\nexport function registerImSessionBuiltinTools(\n  registry: IToolRegistry,\n  context: BuiltinToolContext,\n  reg: ImSessionBuiltinRegistration,\n): void {\n  const bound = (function_: typeof imListConversationsImpl) => (arguments_: Record<string, unknown>) => function_(arguments_, context, reg);\n\n  registry.registerTool(\n    'im.listConversations',\n    bound(imListConversationsImpl),\n    listSchema,\n    'read',\n  );\n  registry.registerTool(\n    'im.switchConversation',\n    bound(imSwitchConversationImpl),\n    switchSchema,\n    'update',\n  );\n  registry.registerTool(\n    'im.newConversation',\n    bound(imNewConversationImpl),\n    newSchema,\n    'create',\n  );\n  registry.registerTool(\n    'im.summarizeHistory',\n    bound(imSummarizeHistoryImpl),\n    summarizeSchema,\n    'update',\n  );\n\n  registerToolParameterSchema('im.listConversations', listSchema, {\n    displayName: 'IM: list conversations',\n    description: 'List conversations the user can switch to (IM sessions only).',\n  });\n  registerToolParameterSchema('im.switchConversation', switchSchema, {\n    displayName: 'IM: switch conversation',\n    description: 'Switch this IM user binding to another conversationId.',\n  });\n  registerToolParameterSchema('im.newConversation', newSchema, {\n    displayName: 'IM: new conversation',\n    description: 'Create a new agent conversation and bind this IM user to it.',\n  });\n  registerToolParameterSchema('im.summarizeHistory', summarizeSchema, {\n    displayName: 'IM: summarize history',\n    description: 'Return a plain-text digest of recent messages in the current conversation.',\n  });\n}\n","import { BUILTIN_TOOL_PLUGIN_IDS, registerBuiltinToolPlugins } from '../../loopAPI/plugins/builtinToolsPlugin.js';\nimport { getLoopRegistry } from '../../loopAPI/registry.js';\nimport { registerBuiltinPromptPlugins } from '../../promptUtilities/builtinPromptPlugins.js';\nimport type { IToolRegistry } from '../../types.js';\nimport { pluginRegistry } from '../pluginRegistry.js';\nimport type { BuiltinToolContext } from './types.js';\n\nexport { ASK_QUESTION_TOOL_ID, askQuestionConfigSchema, askQuestionImpl } from './askQuestion.js';\nexport { ASK_USER_QUESTION_TOOL_ID, askUserQuestionConfigSchema, askUserQuestionImpl } from './askUserQuestion.js';\nexport { IM_SESSION_TOOL_IDS, type ImSessionBuiltinRegistration, registerImSessionBuiltinTools } from './imBuiltinTools.js';\nexport { getMcpClientToolId, mcpClientConfigSchema, mcpClientImpl } from './mcpClient.js';\nexport { getMcpForwardToolId, mcpForwardConfigSchema, mcpForwardImpl } from './mcpForward.js';\nexport { ORCHESTRATION_TOOL_ID, orchestrationConfigSchema, orchestrationImpl } from './orchestration.js';\nexport { resolveQuestionAnswer } from './questionWaitRegistry.js';\nexport { getRemoteAgentToolId, remoteAgentConfigSchema, remoteAgentImpl, remoteAgentListImpl } from './remoteAgent.js';\nexport { getSpawnAgentToolId, spawnAgentConfigSchema, spawnAgentImpl } from './spawnAgent.js';\nexport { getTaskToolId, taskToolConfigSchema, taskToolImpl } from './task.js';\nexport { __clearTodoStore, TODO_WRITE_TOOL_ID, todoWriteConfigSchema, todoWriteImpl } from './todoWrite.js';\nexport type { BuiltinToolContext, BuiltinToolImpl } from './types.js';\n\n/**\n * Register framework-level builtin tools (agent orchestration, user interaction, MCP).\n *\n * Environment-specific tools (bash, file*, grep, glob, git, webFetch, webSearch, lsp)\n * must be registered by the host environment (e.g. memeloop-cli via registerNodeEnvironmentTools).\n */\nexport function registerBuiltinTools(registry: IToolRegistry, context: BuiltinToolContext): void {\n  const promptDestination = registry.getPromptPlugins?.();\n  if (promptDestination) {\n    for (const [id, tool] of pluginRegistry) {\n      promptDestination.set(id, tool);\n    }\n    registerBuiltinPromptPlugins(promptDestination);\n  } else {\n    registerBuiltinPromptPlugins();\n  }\n\n  registerBuiltinToolPlugins();\n  getLoopRegistry().installPluginsForLoop('*', { ...context, toolRegistry: registry }, [\n    ...BUILTIN_TOOL_PLUGIN_IDS,\n  ]);\n}\n","/**\n * TidGi `parallelExecution.ts` 迁移。\n */\nimport type { ToolCallingMatch } from '../promptUtilities/responsePatternUtility.js';\nimport type { ToolExecutionResult } from './defineToolTypes.js';\n\nconst DEFAULT_TOOL_TIMEOUT_MS = 30_000;\nconst DEFAULT_BATCH_TIMEOUT_MS = 120_000;\n\nexport interface ToolCallEntry {\n  call: ToolCallingMatch & { found: true };\n  executor: (parameters: Record<string, unknown>) => Promise<ToolExecutionResult>;\n  timeoutMs?: number;\n}\n\nexport interface ToolCallResult {\n  call: ToolCallingMatch & { found: true };\n  status: 'fulfilled' | 'rejected' | 'timeout';\n  result?: ToolExecutionResult;\n  error?: string;\n}\n\nasync function executeWithTimeout(entry: ToolCallEntry): Promise<ToolCallResult> {\n  const timeoutMs = entry.timeoutMs ?? DEFAULT_TOOL_TIMEOUT_MS;\n\n  return new Promise<ToolCallResult>((resolve) => {\n    let settled = false;\n\n    const timer = timeoutMs > 0\n      ? setTimeout(() => {\n        if (!settled) {\n          settled = true;\n          resolve({\n            call: entry.call,\n            status: 'timeout',\n            error: `Tool \"${entry.call.toolId}\" timed out after ${timeoutMs}ms`,\n          });\n        }\n      }, timeoutMs)\n      : undefined;\n\n    entry\n      .executor(entry.call.parameters ?? {})\n      .then((result) => {\n        if (!settled) {\n          settled = true;\n          if (timer) clearTimeout(timer);\n          resolve({ call: entry.call, status: 'fulfilled', result });\n        }\n      })\n      .catch((error: unknown) => {\n        if (!settled) {\n          settled = true;\n          if (timer) clearTimeout(timer);\n          resolve({\n            call: entry.call,\n            status: 'rejected',\n            result: {\n              success: false,\n              error: error instanceof Error ? error.message : String(error),\n            },\n            error: error instanceof Error ? error.message : String(error),\n          });\n        }\n      });\n  });\n}\n\nexport async function executeToolCallsParallel(\n  entries: ToolCallEntry[],\n  batchTimeoutMs: number = DEFAULT_BATCH_TIMEOUT_MS,\n): Promise<ToolCallResult[]> {\n  if (entries.length === 0) return [];\n  if (entries.length === 1) {\n    return [await executeWithTimeout(entries[0])];\n  }\n\n  const promises = entries.map((entry) => executeWithTimeout(entry));\n\n  if (batchTimeoutMs > 0) {\n    const batchTimer = new Promise<ToolCallResult[]>((resolve) => {\n      setTimeout(() => {\n        resolve(\n          entries.map((entry) => ({\n            call: entry.call,\n            status: 'timeout' as const,\n            error: `Batch timeout: ${batchTimeoutMs}ms exceeded`,\n          })),\n        );\n      }, batchTimeoutMs);\n    });\n\n    return Promise.race([Promise.all(promises), batchTimer]);\n  }\n\n  return Promise.all(promises);\n}\n\nexport async function executeToolCallsSequential(\n  entries: ToolCallEntry[],\n): Promise<ToolCallResult[]> {\n  const results: ToolCallResult[] = [];\n  for (const entry of entries) {\n    results.push(await executeWithTimeout(entry));\n  }\n  return results;\n}\n","/**\n * Generate tool description for prompt injection from zod v4 schema definitions.\n */\nimport type { z } from 'zod';\n\nimport { toolSchemaToJsonSchema } from './schemaRegistry.js';\n\nexport function schemaToToolContent(schema: z.ZodType) {\n  const jsonSchema = toolSchemaToJsonSchema(schema);\n\n  // zod v4 stores title/description/examples in .meta()\n  const meta = Array.isArray((schema as unknown as { meta?: Array<Record<string, unknown>> }).meta)\n    ? (schema as unknown as { meta?: Array<Record<string, unknown>> }).meta?.[0]\n    : undefined;\n\n  const title = (meta?.title as string) || (jsonSchema.title as string) || 'tool';\n  const description = (meta?.description as string) ||\n    (schema as unknown as { description?: string }).description ||\n    (jsonSchema.description as string) ||\n    '';\n  const examples = (meta?.examples as Array<Record<string, unknown>>) ||\n    (jsonSchema.examples as Array<Record<string, unknown>>) ||\n    [];\n\n  const props = jsonSchema.properties as Record<string, unknown> | undefined;\n  const requiredArray = Array.isArray(jsonSchema.required) ? (jsonSchema.required as string[]) : [];\n\n  let parameterLines = '';\n  if (props) {\n    parameterLines = Object.entries(props)\n      .map(([key, value]) => {\n        const p = value as Record<string, unknown> | undefined;\n        const type = (p?.type as string) || 'string';\n        const desc = (p?.description as string) || (p?.title as string) || '';\n        const required = requiredArray.includes(key) ? 'required' : 'optional';\n        return `- ${key} (${type}, ${required}): ${desc}`;\n      })\n      .join('\\n');\n  }\n\n  const exampleSection = examples\n    .map((example) => `- <tool_use name=\"${title}\">${JSON.stringify(example)}</tool_use>`)\n    .join('\\n');\n\n  return `\\n## ${title}\\n**Description**: ${description}\\n**Parameters**:\\n${parameterLines}\\n\\n**Examples**:\\n${exampleSection}\\n`;\n}\n","/**\n * TidGi `defineTool.ts` 逐行迁移；持久化改为 `AgentFrameworkContext.persistAgentMessage`（memeloop）。\n */\nimport type { z } from 'zod';\n\nimport { type ChatMessage, createChatMessage } from '../conversation/index.js';\nimport { findPromptById } from '../promptUtilities/promptConcat.js';\nimport { matchAllToolCallings, TOOL_PARAMETER_PARSE_ERROR_KEY } from '../promptUtilities/responsePatternUtility.js';\nimport type { ToolCallingMatch } from '../promptUtilities/responsePatternUtility.js';\nimport type { IPrompt } from '../promptUtilities/types.js';\nimport { evaluateApproval, requestApproval } from './approval.js';\nimport type {\n  AddToolResultOptions,\n  InjectContentOptions,\n  InjectToolListOptions,\n  PostProcessHandlerContext,\n  ResponseHandlerContext,\n  ToolDefinition,\n  ToolExecutionResult,\n  ToolHandlerContext,\n} from './defineToolTypes.js';\nimport { executeToolCallsParallel, executeToolCallsSequential } from './parallelExecution.js';\nimport { getActivePluginRegistry } from './pluginRegistry.js';\nimport { schemaToToolContent } from './schemaToToolContent.js';\nimport type { AIResponseContext, PostProcessContext, PromptConcatHookContext, PromptConcatTool } from './types.js';\n\nconst MAX_TOOL_RESULT_CHARS = 32_000;\n\nconst logger = {\n  debug: (..._a: unknown[]) => {},\n  warn: (...a: unknown[]) => {\n    console.warn('[memeloop.defineTool]', ...a);\n  },\n  error: (...a: unknown[]) => {\n    console.error('[memeloop.defineTool]', ...a);\n  },\n};\n\nexport type {\n  AddToolResultOptions,\n  InjectContentOptions,\n  InjectToolListOptions,\n  PostProcessHandlerContext,\n  ResponseHandlerContext,\n  ToolDefinition,\n  ToolExecutionResult,\n  ToolHandlerContext,\n} from './defineToolTypes.js';\n\nexport function defineTool<\n  TConfigSchema extends z.ZodType,\n  TLLMToolSchemas extends Record<string, z.ZodType> = Record<string, z.ZodType>,\n>(\n  definition: ToolDefinition<TConfigSchema, TLLMToolSchemas>,\n): {\n  tool: PromptConcatTool;\n  toolId: string;\n  configSchema: TConfigSchema;\n  llmToolSchemas: TLLMToolSchemas | undefined;\n  displayName: string;\n  description: string;\n} {\n  const {\n    toolId,\n    configSchema,\n    llmToolSchemas,\n    onProcessPrompts,\n    onResponseComplete,\n    onPostProcess,\n  } = definition;\n  const parameterKey = `${toolId}Param`;\n\n  const tool: PromptConcatTool = (hooks) => {\n    if (onProcessPrompts) {\n      hooks.processPrompts.tapAsync(`${toolId}-processPrompts`, async (context, callback) => {\n        try {\n          const { toolConfig, prompts, messages, agentFrameworkContext } = context as PromptConcatHookContext;\n\n          if (toolConfig.toolId !== toolId) {\n            callback();\n            return;\n          }\n\n          if (toolConfig.enabled === false) {\n            callback();\n            return;\n          }\n\n          const rawConfig: unknown = toolConfig[parameterKey];\n          if (!rawConfig) {\n            callback();\n            return;\n          }\n\n          const config = configSchema.parse(rawConfig) as z.infer<TConfigSchema>;\n\n          const handlerContext: ToolHandlerContext<TConfigSchema> = {\n            config,\n            toolConfig,\n            prompts: prompts,\n            messages,\n            agentFrameworkContext,\n\n            findPrompt: (id: string) => findPromptById(prompts, id),\n\n            injectToolList: (options: InjectToolListOptions) => {\n              const target = findPromptById(prompts, options.targetId);\n              if (!target) {\n                logger.warn(`Target prompt not found for tool list injection`, {\n                  targetId: options.targetId,\n                  toolId,\n                });\n                return;\n              }\n\n              const schemas = options.toolSchemas ?? (llmToolSchemas ? Object.values(llmToolSchemas) : []);\n              const toolContent = schemas.map((schema) => schemaToToolContent(schema)).join('\\n\\n');\n\n              const pluginIndex = (context as PromptConcatHookContext).pluginIndex;\n              const source = pluginIndex !== undefined ? ['plugins', toolConfig.id] : undefined;\n\n              const toolPrompt: IPrompt = {\n                id: `${toolId}-tool-list-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`,\n                text: toolContent,\n                caption: options.caption ?? `${definition.displayName} Tools`,\n                enabled: true,\n                source,\n              };\n\n              if (options.position === 'child') {\n                if (!target.prompt.children) {\n                  target.prompt.children = [];\n                }\n                target.prompt.children.push(toolPrompt);\n              } else if (options.position === 'before') {\n                target.parent.splice(target.index, 0, toolPrompt);\n              } else {\n                target.parent.splice(target.index + 1, 0, toolPrompt);\n              }\n            },\n\n            injectContent: (options: InjectContentOptions) => {\n              const target = findPromptById(prompts, options.targetId);\n              if (!target) {\n                logger.warn(`Target prompt not found for content injection`, {\n                  targetId: options.targetId,\n                  toolId,\n                });\n                return;\n              }\n\n              const pluginIndex = (context as PromptConcatHookContext).pluginIndex;\n              const source = pluginIndex !== undefined ? ['plugins', toolConfig.id] : undefined;\n\n              const contentPrompt: IPrompt = {\n                id: options.id ??\n                  `${toolId}-content-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`,\n                text: options.content,\n                caption: options.caption ?? 'Injected Content',\n                enabled: true,\n                source,\n              };\n\n              if (options.position === 'child') {\n                if (!target.prompt.children) {\n                  target.prompt.children = [];\n                }\n                target.prompt.children.push(contentPrompt);\n              } else if (options.position === 'before') {\n                target.parent.splice(target.index, 0, contentPrompt);\n              } else {\n                target.parent.splice(target.index + 1, 0, contentPrompt);\n              }\n            },\n          };\n\n          await onProcessPrompts(handlerContext);\n          callback();\n        } catch (error) {\n          logger.error(`Error in ${toolId} processPrompts handler`, error);\n          callback();\n        }\n      });\n    }\n\n    if (onResponseComplete) {\n      hooks.responseComplete.tapAsync(`${toolId}-responseComplete`, async (context, callback) => {\n        try {\n          const {\n            agentFrameworkContext,\n            response,\n            agentFrameworkConfig,\n            requestId,\n            toolConfig: directToolConfig,\n          } = context as AIResponseContext & {\n            toolConfig?: PromptConcatHookContext['toolConfig'];\n            actions?: { yieldNextRoundTo?: 'human' | 'self' };\n          };\n\n          const configuredToolConfig = agentFrameworkConfig?.plugins?.find(\n            (p) => p.toolId === toolId,\n          );\n          const ourToolConfig = configuredToolConfig ??\n            (directToolConfig?.toolId === toolId ? directToolConfig : undefined);\n\n          if (!ourToolConfig) {\n            callback();\n            return;\n          }\n\n          if (ourToolConfig.enabled === false) {\n            callback();\n            return;\n          }\n\n          if (response.status !== 'done' || !response.content) {\n            callback();\n            return;\n          }\n\n          const { calls: allCalls, parallel: isParallel } = matchAllToolCallings(response.content);\n          const toolCall = allCalls.length > 0 ? allCalls[0] : null;\n\n          const rawConfig: unknown = ourToolConfig[parameterKey];\n          let config: z.infer<TConfigSchema> | undefined;\n          if (rawConfig) {\n            try {\n              config = configSchema.parse(rawConfig) as z.infer<TConfigSchema>;\n            } catch (parseError) {\n              logger.warn(`Failed to parse config for ${toolId}`, parseError);\n            }\n          }\n\n          const persist = agentFrameworkContext.persistAgentMessage;\n\n          const handlerContext: ResponseHandlerContext<TConfigSchema, TLLMToolSchemas> = {\n            config,\n            toolConfig: ourToolConfig,\n            messages: agentFrameworkContext.agent.messages,\n            agentFrameworkContext,\n            response,\n            toolCall,\n            allToolCalls: allCalls,\n            isParallel,\n            agentFrameworkConfig,\n            hooks,\n            requestId,\n\n            findPrompt: () => undefined,\n\n            injectToolList: () => {\n              logger.warn('injectToolList is not available in response phase');\n            },\n\n            injectContent: () => {\n              logger.warn('injectContent is not available in response phase');\n            },\n\n            executeToolCall: async <TToolName extends keyof TLLMToolSchemas>(\n              toolName: TToolName,\n              executor: (\n                parameters: z.infer<TLLMToolSchemas[TToolName]>,\n              ) => Promise<ToolExecutionResult>,\n            ): Promise<boolean> => {\n              const toolNameString = String(toolName);\n              if (!toolCall || toolCall.toolId !== toolNameString) {\n                return false;\n              }\n\n              const toolSchema = llmToolSchemas?.[toolName];\n              if (!toolSchema) {\n                logger.error(`No schema found for tool: ${toolNameString}`);\n                return false;\n              }\n\n              try {\n                const parameterParseError = toolCall.parameters[\n                  TOOL_PARAMETER_PARSE_ERROR_KEY\n                ];\n                if (typeof parameterParseError === 'string') {\n                  throw new Error(parameterParseError);\n                }\n                const validatedParameters = toolSchema.parse(toolCall.parameters) as z.infer<\n                  TLLMToolSchemas[TToolName]\n                >;\n\n                const approvalConfig = ourToolConfig.approval;\n                const decision = evaluateApproval(\n                  approvalConfig,\n                  toolNameString,\n                  validatedParameters as Record<string, unknown>,\n                );\n                if (decision === 'deny') {\n                  handlerContext.addToolResult({\n                    toolName: toolNameString,\n                    parameters: validatedParameters,\n                    result: 'Tool execution denied by approval policy.',\n                    isError: true,\n                    duration: 2,\n                  });\n                  handlerContext.yieldToSelf();\n                  return true;\n                }\n                if (decision === 'pending') {\n                  const approvalId = `approval-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`;\n                  const userDecision = await requestApproval({\n                    approvalId,\n                    agentId: agentFrameworkContext.agent.id,\n                    toolName: toolNameString,\n                    parameters: validatedParameters as Record<string, unknown>,\n                    originalText: toolCall.originalText,\n                    created: new Date(),\n                  });\n                  if (userDecision === 'deny') {\n                    handlerContext.addToolResult({\n                      toolName: toolNameString,\n                      parameters: validatedParameters,\n                      result: 'Tool execution denied by user.',\n                      isError: true,\n                      duration: 2,\n                    });\n                    handlerContext.yieldToSelf();\n                    return true;\n                  }\n                }\n\n                const result = await executor(validatedParameters);\n\n                const toolResultDuration = (config as { toolResultDuration?: number } | undefined)?.toolResultDuration ?? 1;\n                handlerContext.addToolResult({\n                  toolName: toolNameString,\n                  parameters: validatedParameters,\n                  result: result.success\n                    ? (result.data ?? 'Success')\n                    : (result.error ?? 'Unknown error'),\n                  isError: !result.success,\n                  duration: toolResultDuration,\n                });\n\n                handlerContext.yieldToSelf();\n\n                await hooks.toolExecuted.promise({\n                  agentFrameworkContext,\n                  toolResult: result,\n                  toolInfo: {\n                    toolId: toolNameString,\n                    parameters: validatedParameters as Record<string, unknown>,\n                    originalText: toolCall.originalText,\n                  },\n                  requestId,\n                });\n\n                return true;\n              } catch (error) {\n                logger.error(`Tool execution failed: ${toolNameString}`, error);\n\n                handlerContext.addToolResult({\n                  toolName: toolNameString,\n                  parameters: toolCall.parameters,\n                  result: error instanceof Error ? error.message : String(error),\n                  isError: true,\n                  duration: 2,\n                });\n\n                handlerContext.yieldToSelf();\n\n                await hooks.toolExecuted.promise({\n                  agentFrameworkContext,\n                  toolResult: {\n                    success: false,\n                    error: error instanceof Error ? error.message : String(error),\n                  },\n                  toolInfo: {\n                    toolId: toolNameString,\n                    parameters: toolCall.parameters || {},\n                  },\n                });\n\n                return true;\n              }\n            },\n\n            addToolResult: (options: AddToolResultOptions) => {\n              let resultContent = options.result;\n              if (resultContent.length > MAX_TOOL_RESULT_CHARS) {\n                const truncated = resultContent.slice(0, MAX_TOOL_RESULT_CHARS);\n                resultContent = `${truncated}\\n\\n[... truncated — result was ${options.result.length} chars, showing first ${MAX_TOOL_RESULT_CHARS}]`;\n              }\n\n              const payload: unknown = (() => {\n                try {\n                  return JSON.parse(resultContent) as unknown;\n                } catch {\n                  return undefined;\n                }\n              })();\n\n              const toolResultMessage: ChatMessage = createChatMessage({\n                messageId: `tool-result-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`,\n                conversationId: agentFrameworkContext.agent.id,\n                originNodeId: 'local',\n                lamportClock: 0,\n                role: 'tool',\n                parts: [{\n                  type: 'tool-result',\n                  toolName: options.toolName,\n                  parameters: options.parameters,\n                  result: resultContent,\n                  isError: options.isError ?? false,\n                  payload,\n                }],\n                duration: options.duration ?? 1,\n                metadata: {\n                  isToolResult: true,\n                  isError: options.isError ?? false,\n                  toolId: options.toolName,\n                  toolParameters: options.parameters,\n                  isPersisted: false,\n                  isComplete: true,\n                },\n              });\n\n              agentFrameworkContext.agent.messages.push(toolResultMessage);\n\n              const aiMessages = agentFrameworkContext.agent.messages.filter(\n                (m) => m.role === 'assistant',\n              );\n              if (aiMessages.length > 0) {\n                const latestAiMessage = aiMessages[aiMessages.length - 1];\n                if (\n                  latestAiMessage.content === response.content &&\n                  !latestAiMessage.metadata?.containsToolCall\n                ) {\n                  latestAiMessage.duration = 1;\n                  latestAiMessage.metadata = {\n                    ...latestAiMessage.metadata,\n                    containsToolCall: true,\n                    toolId: options.toolName,\n                    isPersisted: true,\n                  };\n\n                  if (persist) {\n                    void (async () => {\n                      try {\n                        await persist(latestAiMessage);\n                      } catch (error) {\n                        logger.warn('Failed to persist AI message with tool call', {\n                          error,\n                          messageId: latestAiMessage.messageId,\n                        });\n                      }\n                    })();\n                  }\n                }\n              }\n\n              if (persist) {\n                void (async () => {\n                  try {\n                    await persist(toolResultMessage);\n                    toolResultMessage.metadata = {\n                      ...toolResultMessage.metadata,\n                      isPersisted: true,\n                    };\n                  } catch (error) {\n                    logger.warn('Failed to persist tool result', {\n                      error,\n                      messageId: toolResultMessage.messageId,\n                    });\n                  }\n                })();\n              }\n            },\n\n            yieldToSelf: () => {\n              const context_ = context as { actions?: { yieldNextRoundTo?: 'human' | 'self' } };\n              if (!context_.actions) {\n                context_.actions = {};\n              }\n              context_.actions.yieldNextRoundTo = 'self';\n            },\n\n            yieldToHuman: () => {\n              const context_ = context as { actions?: { yieldNextRoundTo?: 'human' | 'self' } };\n              if (!context_.actions) {\n                context_.actions = {};\n              }\n              context_.actions.yieldNextRoundTo = 'human';\n            },\n\n            executeAllMatchingToolCalls: async <TToolName extends keyof TLLMToolSchemas>(\n              toolName: TToolName,\n              executor: (\n                parameters: z.infer<TLLMToolSchemas[TToolName]>,\n              ) => Promise<ToolExecutionResult>,\n              options?: { timeoutMs?: number },\n            ): Promise<number> => {\n              const toolNameString = String(toolName);\n              const matchingCalls = allCalls.filter((call) => call.toolId === toolNameString);\n              if (matchingCalls.length === 0) return 0;\n\n              const toolSchema = llmToolSchemas?.[toolName];\n              if (!toolSchema) {\n                logger.error(`No schema found for tool: ${toolNameString}`);\n                return 0;\n              }\n\n              const toolResultDuration = (config as { toolResultDuration?: number } | undefined)?.toolResultDuration ?? 1;\n\n              const entries: Array<{\n                call: ToolCallingMatch & { found: true };\n                executor: (parameters: Record<string, unknown>) => Promise<ToolExecutionResult>;\n                timeoutMs?: number;\n              }> = [];\n\n              const approvalConfig = ourToolConfig.approval;\n              const batchDecision = evaluateApproval(\n                approvalConfig,\n                toolNameString,\n                matchingCalls[0]?.parameters ?? {},\n              );\n              if (batchDecision === 'deny') {\n                for (const call of matchingCalls) {\n                  handlerContext.addToolResult({\n                    toolName: toolNameString,\n                    parameters: call.parameters,\n                    result: 'Tool execution denied by approval policy.',\n                    isError: true,\n                    duration: toolResultDuration,\n                  });\n                }\n                handlerContext.yieldToSelf();\n                return matchingCalls.length;\n              }\n              if (batchDecision === 'pending') {\n                const approvalId = `approval-batch-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`;\n                const userDecision = await requestApproval({\n                  approvalId,\n                  agentId: agentFrameworkContext.agent.id,\n                  toolName: toolNameString,\n                  parameters: {\n                    _batchSize: matchingCalls.length,\n                    _firstCallParams: matchingCalls[0]?.parameters,\n                  },\n                  created: new Date(),\n                });\n                if (userDecision === 'deny') {\n                  for (const call of matchingCalls) {\n                    handlerContext.addToolResult({\n                      toolName: toolNameString,\n                      parameters: call.parameters,\n                      result: 'Tool execution denied by user.',\n                      isError: true,\n                      duration: toolResultDuration,\n                    });\n                  }\n                  handlerContext.yieldToSelf();\n                  return matchingCalls.length;\n                }\n              }\n\n              for (const call of matchingCalls) {\n                try {\n                  const validatedParameters = toolSchema.parse(call.parameters) as z.infer<\n                    TLLMToolSchemas[TToolName]\n                  >;\n                  entries.push({\n                    call,\n                    executor: async () => executor(validatedParameters),\n                    timeoutMs: options?.timeoutMs,\n                  });\n                } catch (validationError) {\n                  handlerContext.addToolResult({\n                    toolName: toolNameString,\n                    parameters: call.parameters,\n                    result: `Parameter validation failed: ${validationError instanceof Error ? validationError.message : String(validationError)}`,\n                    isError: true,\n                    duration: toolResultDuration,\n                  });\n                }\n              }\n\n              if (entries.length === 0) return matchingCalls.length;\n\n              let results: Array<{\n                call: ToolCallingMatch & { found: true };\n                status: string;\n                result?: ToolExecutionResult;\n                error?: string;\n              }>;\n              if (isParallel) {\n                results = await executeToolCallsParallel(entries);\n              } else {\n                results = await executeToolCallsSequential(entries);\n              }\n\n              for (const result of results) {\n                const isError = result.status !== 'fulfilled' ||\n                  (result.result !== undefined && !result.result.success);\n                const resultText = result.status === 'timeout'\n                  ? (result.error ?? 'Tool execution timed out')\n                  : result.status === 'rejected'\n                  ? (result.error ?? 'Tool execution failed')\n                  : result.result?.success\n                  ? (result.result.data ?? 'Success')\n                  : (result.result?.error ?? 'Unknown error');\n\n                handlerContext.addToolResult({\n                  toolName: toolNameString,\n                  parameters: result.call.parameters,\n                  result: resultText,\n                  isError,\n                  duration: toolResultDuration,\n                });\n\n                await hooks.toolExecuted.promise({\n                  agentFrameworkContext,\n                  toolResult: result.result ?? { success: false, error: resultText },\n                  toolInfo: {\n                    toolId: toolNameString,\n                    parameters: result.call.parameters ?? {},\n                    originalText: result.call.originalText,\n                  },\n                  requestId,\n                });\n              }\n\n              handlerContext.yieldToSelf();\n              return matchingCalls.length;\n            },\n          };\n\n          await onResponseComplete(handlerContext);\n          callback();\n        } catch (error) {\n          logger.error(`Error in ${toolId} responseComplete handler`, error);\n          callback();\n        }\n      });\n    }\n\n    if (onPostProcess) {\n      hooks.postProcess.tapAsync(\n        `${toolId}-postProcess`,\n        async (context: PostProcessContext, callback) => {\n          try {\n            const { toolConfig, prompts, messages, agentFrameworkContext, llmResponse, responses } = context;\n\n            if (toolConfig.toolId !== toolId) {\n              callback();\n              return;\n            }\n\n            if (toolConfig.enabled === false) {\n              callback();\n              return;\n            }\n\n            const rawConfig: unknown = toolConfig[parameterKey];\n            if (!rawConfig) {\n              callback();\n              return;\n            }\n\n            const config = configSchema.parse(rawConfig) as z.infer<TConfigSchema>;\n\n            const handlerContext: PostProcessHandlerContext<TConfigSchema> = {\n              config,\n              toolConfig,\n              prompts: prompts,\n              messages,\n              agentFrameworkContext,\n              llmResponse,\n              responses,\n\n              findPrompt: (id: string) => findPromptById(prompts, id),\n\n              injectToolList: () => {\n                logger.warn('injectToolList is not recommended in postProcess phase');\n              },\n\n              injectContent: () => {\n                logger.warn('injectContent is not recommended in postProcess phase');\n              },\n            };\n\n            await onPostProcess(handlerContext);\n            callback();\n          } catch (error) {\n            logger.error(`Error in ${toolId} postProcess handler`, error);\n            callback();\n          }\n        },\n      );\n    }\n  };\n\n  getActivePluginRegistry().set(toolId, tool);\n\n  return {\n    tool,\n    toolId,\n    configSchema,\n    llmToolSchemas,\n    displayName: definition.displayName,\n    description: definition.description,\n  };\n}\n","/**\n * Host agent tool configuration → prompt plugin mapping.\n * Every host (Desktop, CLI, Cloud) that defines agent tools needs this merge logic.\n * Defined once in memeloop so each host doesn't reimplement it.\n */\n\nimport type { AgentDefinitionToolConfig } from '../agent/types.js';\nimport type { AgentFrameworkConfig, PromptPluginConfig } from '../promptUtilities/types.js';\n\nexport type HostAgentToolConfig = AgentDefinitionToolConfig;\n\nfunction isPluginConfig(value: unknown): value is Record<string, unknown> & { toolId?: string } {\n  return typeof value === 'object' && value !== null;\n}\n\nexport function mergeAgentToolsIntoFrameworkConfig(\n  frameworkConfig: AgentFrameworkConfig | undefined,\n  agentTools: HostAgentToolConfig[] | undefined,\n): AgentFrameworkConfig {\n  const baseConfig = { ...(frameworkConfig ?? {}) };\n  const rawPlugins = Array.isArray(baseConfig.plugins) ? baseConfig.plugins : [];\n  const pluginByToolId = new Map<string, Record<string, unknown>>();\n  const pluginWithoutToolId: unknown[] = [];\n\n  for (const plugin of rawPlugins) {\n    if (isPluginConfig(plugin) && typeof plugin.toolId === 'string' && plugin.toolId.length > 0) {\n      pluginByToolId.set(plugin.toolId, plugin);\n    } else {\n      pluginWithoutToolId.push(plugin);\n    }\n  }\n\n  for (const tool of agentTools ?? []) {\n    if (!tool.toolId) continue;\n    pluginByToolId.set(tool.toolId, {\n      id: `${tool.toolId}-agent-tool`,\n      toolId: tool.toolId,\n      enabled: tool.enabled ?? true,\n      ...(tool.parameters ?? {}),\n    });\n  }\n\n  return {\n    ...baseConfig,\n    prompts: Array.isArray(baseConfig.prompts) ? baseConfig.prompts : [],\n    response: Array.isArray(baseConfig.response) ? baseConfig.response : undefined,\n    plugins: [...pluginWithoutToolId, ...pluginByToolId.values()] as PromptPluginConfig[],\n  };\n}\n","/**\n * Tool definition registry.\n * Converted from module-level singletons to an instance class for test isolation\n * and multi-runtime support.\n */\nimport type { z } from 'zod';\n\nimport { defineTool } from './defineTool.js';\nimport type { DefinedTool, ToolDefinition } from './defineToolTypes.js';\nimport { registerToolParameterSchema } from './schemaRegistry.js';\n\n/**\n * Instance-level tool definition registry.\n */\nexport class ToolDefinitionRegistry {\n  private readonly registry = new Map<string, DefinedTool>();\n\n  registerToolDefinition<\n    TConfigSchema extends z.ZodType,\n    TLLMToolSchemas extends Record<string, z.ZodType>,\n  >(definition: ToolDefinition<TConfigSchema, TLLMToolSchemas>): DefinedTool<TConfigSchema, TLLMToolSchemas> {\n    const toolDefinition = defineTool(definition);\n\n    registerToolParameterSchema(toolDefinition.toolId, toolDefinition.configSchema as object, {\n      displayName: toolDefinition.displayName,\n      description: toolDefinition.description,\n    });\n\n    this.registry.set(toolDefinition.toolId, toolDefinition as DefinedTool);\n    return toolDefinition as DefinedTool<TConfigSchema, TLLMToolSchemas>;\n  }\n\n  getAllToolDefinitions(): Map<string, DefinedTool> {\n    return this.registry;\n  }\n\n  getToolDefinition(toolId: string): DefinedTool | undefined {\n    return this.registry.get(toolId);\n  }\n}\n\n// ─── Default global instance + backward-compatible function exports ───\n\nconst defaultToolDefinitionRegistry = new ToolDefinitionRegistry();\n\nexport function getDefaultToolDefinitionRegistry(): ToolDefinitionRegistry {\n  return defaultToolDefinitionRegistry;\n}\n\nexport function registerToolDefinition<\n  TConfigSchema extends z.ZodType,\n  TLLMToolSchemas extends Record<string, z.ZodType>,\n>(definition: ToolDefinition<TConfigSchema, TLLMToolSchemas>): DefinedTool<TConfigSchema, TLLMToolSchemas> {\n  return defaultToolDefinitionRegistry.registerToolDefinition(definition);\n}\n\nexport function getAllToolDefinitions(): Map<string, DefinedTool> {\n  return defaultToolDefinitionRegistry.getAllToolDefinitions();\n}\n\nexport function getToolDefinition(toolId: string): DefinedTool | undefined {\n  return defaultToolDefinitionRegistry.getToolDefinition(toolId);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoBA,IAAM,0BAA0B;AAczB,SAAS,6BACd,UAAyC,CAAC,GACW;AACrD,QAAM,iBAAiB,QAAQ,uBAAuB;AACtD,QAAM,0BAA0B,QAAQ,2BAA2B;AAEnE,SAAO,CAAC,YAA8C;AACpD,QAAI,QAAQ,UAAU,SAAS,qBAAsB;AAErD,UAAM,EAAE,OAAO,MAAM,SAAS,eAAe,IAAI;AAEjD,QAAI,SAAS,UAAU;AAErB;AAAA,IACF;AAEA,QAAI,SAAS,mBAAmB,WAAW,gBAAgB;AACzD,YAAM,gBAAgB,QAAQ;AAC9B,YAAM,WAAW;AAEjB,YAAM,iBAAiB,eAAe,WAAW,CAAC;AAClD,YAAM,kBAAkB,SAAS,WAAW,CAAC;AAG7C,YAAM,mBAAmB,eAAe,WAAW,gBAAgB,UACjE,eAAe,MAAM,CAAC,QAAQ,UAAU;AACtC,cAAM,iBAAiB,gBAAgB,KAAK;AAC5C,eACE,OAAO,SAAS,eAAe,QAC/B,OAAO,YAAY,eAAe,WAClC,OAAO,aAAa,eAAe,YACnC,OAAO,gBAAgB,eAAe,eACtC,OAAO,iBAAiB,eAAe,gBACvC,OAAO,eAAe,eAAe,cACrC,OAAO,aAAa,WAAW,eAAe,aAAa,UAC3D,OAAO,aAAa,MAAM,CAAC,aAAa,qBAAqB,gBAAgB,eAAe,aAAa,gBAAgB,CAAC;AAAA,MAE9H,CAAC;AACH,YAAM,qBAAqB,eAAe,eAAe;AACzD,YAAM,sBAAsB,SAAS,eAAe;AACpD,YAAM,sBAAsB,uBAAuB,wBAChD,eAAe,oBAAoB,SAAS,SAAS,oBAAoB;AAE5E,UAAI,oBAAoB,qBAAqB;AAC3C;AAAA,MACF;AAGA,YAAM,mBAAmB,CAAC,eAAe,eACvC,SAAS,gBAAgB,QACzB;AAEF,UAAI,oBAAoB,yBAAyB;AAC/C;AAAA,MACF;AAGA,UAAI,CAAC,MAAM,GAAG,WAAW,cAAc,GAAG;AACxC,cAAM,IAAI;AAAA,UACR,wFAAwF,cAAc,UAAU,MAAM,EAAE;AAAA,QAC1H;AAAA,MACF;AAGA,UAAI,gBAAgB,SAAS,eAAe,QAAQ;AAClD,cAAM,IAAI,MAAM,0CAA0C;AAAA,MAC5D;AACA,eAAS,QAAQ,GAAG,QAAQ,eAAe,QAAQ,SAAS,GAAG;AAC7D,YAAI,eAAe,KAAK,MAAM,gBAAgB,KAAK,GAAG;AACpD,gBAAM,IAAI,MAAM,2CAA2C;AAAA,QAC7D;AAAA,MACF;AAGA,YAAM,aAAa,gBAAgB,MAAM,eAAe,MAAM;AAC9D,YAAM,WAAW;AACjB,iBAAW,UAAU,YAAY;AAC/B,+BAAuB,QAAQ,UAAU,MAAM,EAAE;AAAA,MACnD;AAEA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,uBACP,QACA,UACA,SACM;AACN,MAAI,OAAO,gBAAgB,SAAS,KAAK,aAAa;AACpD,UAAM,IAAI;AAAA,MACR,sBAAsB,OAAO,WAAW,wCAAwC,SAAS,KAAK,WAAW;AAAA,IAC3G;AAAA,EACF;AACA,MAAI,OAAO,aAAa,SAAS;AAC/B,UAAM,IAAI;AAAA,MACR,mBAAmB,OAAO,QAAQ,mCAAmC,OAAO;AAAA,IAC9E;AAAA,EACF;AACA,MAAI,OAAO,WAAW,WAAW,GAAG;AAClC,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACF;AAKO,SAAS,gBAAgB,SAAiB,iBAAyB,yBAAkC;AAC1G,SAAO,QAAQ,WAAW,cAAc;AAC1C;;;AChIO,SAAS,uCACd,OACA,OACA,aAA8D,6BAA6B,GACrE;AACtB,SAAO;AAAA,IACL,MAAM,aAAa,cAAsB,UAAkC;AACzE,YAAM,UAAU,MAAM,MAAM,IAAI;AAAA,QAC9B,MAAM;AAAA,QACN,WAAW;AAAA,QACX,MAAM,SAAS;AAAA,QACf,YAAY;AAAA,MACd,CAAC;AAED,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,4CAA4C,SAAS,WAAW,EAAE;AAAA,MACpF;AAEA,YAAM,iBAAiB,QAAQ,QAAQ,WAAW,CAAC;AACnD,YAAM,iBAAuC;AAAA,QAC3C,GAAG,QAAQ;AAAA,QACX,SAAS,CAAC,GAAG,gBAAgB,QAAQ;AAAA,MACvC;AAGA,iBAAW;AAAA,QACT;AAAA,QACA,MAAM;AAAA,QACN,WAAW;AAAA,UACT,MAAM;AAAA,UACN,WAAW;AAAA,UACX,MAAM,SAAS;AAAA,UACf,YAAY;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAED,YAAM,MAAM;AAAA,QACV;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,WAAW,QAAQ,SAAS;AAAA,UAC5B,MAAM,QAAQ,SAAS;AAAA,UACvB,YAAY,QAAQ;AAAA,QACtB;AAAA,QACA;AAAA,QACA,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,MACtD;AAAA,IACF;AAAA,IAEA,MAAM,WAAW,aAAqB,QAAgB;AACpD,YAAM,UAAU,MAAM,MAAM,IAAI;AAAA,QAC9B,MAAM;AAAA,QACN,WAAW;AAAA,QACX,MAAM;AAAA,QACN,YAAY;AAAA,MACd,CAAC;AAED,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,4CAA4C,WAAW,EAAE;AAAA,MAC3E;AAEA,YAAM,iBAAuC;AAAA,QAC3C,GAAG,QAAQ;AAAA,QACX,aAAa;AAAA,QACb,kBAAkB;AAAA,MACpB;AAGA,iBAAW;AAAA,QACT;AAAA,QACA,MAAM;AAAA,QACN,WAAW;AAAA,UACT,MAAM;AAAA,UACN,WAAW;AAAA,UACX,MAAM;AAAA,UACN,YAAY;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAED,YAAM,MAAM;AAAA,QACV;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,WAAW,QAAQ,SAAS;AAAA,UAC5B,MAAM,QAAQ,SAAS;AAAA,UACvB,YAAY,QAAQ;AAAA,QACtB;AAAA,QACA;AAAA,QACA,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,MACtD;AAAA,IACF;AAAA,EACF;AACF;;;ACvCA,eAAsB,uBAIpB,OACA,YACA,SACiC;AACjC,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,QAAQ,QAAQ,UAAU,CAAC,OAAe,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAChG,QAAM,qBAAqB,QAAQ,wBAAwB,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,aAAa,CAAC,CAAC;AACzG,QAAM,iBAAiB,QAAQ,oBAAoB;AACnD,QAAM,gBAAgB,QAAQ,mBAAmB;AAEjD,MAAI,UAAU;AACd,MAAI,eAAyE;AAC7E,QAAM,iBAAiB,oBAAI,IAA2C;AACtE,MAAI,YAAiC;AAIrC,iBAAe,MAAM,MAAM,aAAa,QAAQ,OAAO;AAAA,IACrD,MAAM,QAAQ;AAAA,IACd,QAAQ,QAAQ,MAAM;AAAA,IACtB,OAAO,QAAQ;AAAA,EACjB,CAAC;AAED,QAAM,eAAe,YAAY;AAC/B,QAAI,SAAS;AACX,YAAM,MAAM,aAAa,QAAQ,OAAO,YAAY,EAAE,MAAM,MAAM,MAAS;AAC3E,qBAAe;AACf;AAAA,IACF;AAEA,UAAM,aAAa,YAAY,YAAY;AACzC,UAAI,WAAW,CAAC,aAAc;AAC9B,UAAI;AACF,uBAAe,MAAM,MAAM,WAAW,QAAQ,OAAO,cAAc,QAAQ,UAAU;AAAA,MACvF,QAAQ;AAIN,kBAAU;AACV,sBAAc,UAAU;AACxB,oBAAY;AAAA,MACd;AAAA,IACF,GAAG,kBAAkB;AAErB,UAAM,UAAU,MAAM;AAAA,MACpB,EAAE,MAAM,QAAQ,UAAU;AAAA,MAC1B,EAAE,mBAAmB,KAAK;AAAA,IAC5B;AACA,UAAM,WAAW,QAAQ,OAAO,aAAa,EAAE;AAC/C,gBAAY,MAAM,KAAK,SAAS,SAAS;AAEzC,QAAI;AACF,aAAO,CAAC,SAAS;AACf,cAAM,SAAS,MAAM,SAAS,KAAK;AACnC,YAAI,OAAO,SAAS,QAAQ,OAAO,UAAU,OAAW;AACxD,cAAM,QAAQ,OAAO;AACrB,YAAI,MAAM,SAAS,WAAW,MAAM,SAAS,WAAY;AAEzD,cAAM,WAAW,MAAM;AACvB,YACE,QAAQ,kBACR,CAAC,QAAQ,eAAe,QAAQ,EAChC;AAEF,cAAM,MAAM,GAAG,SAAS,SAAS,SAAS,IAAI,SAAS,SAAS,IAAI;AACpE,YAAI,eAAe,IAAI,GAAG,EAAG;AAE7B,cAAM,mBAAmB,KAAK,QAAQ;AAAA,MACxC;AAAA,IACF,UAAE;AACA,oBAAc,UAAU;AACxB,iBAAW,SAAS,eAAe,OAAO,EAAG,cAAa,KAAK;AAC/D,qBAAe,MAAM;AACrB,UAAI,cAAc;AAChB,cAAM,MAAM,aAAa,QAAQ,OAAO,YAAY,EAAE,MAAM,MAAM,MAAS;AAC3E,uBAAe;AAAA,MACjB;AAAA,IACF;AAAA,EACF,GAAG;AAEH,iBAAe,mBACb,KACA,UACA,UAAU,GACK;AACf,QAAI,WAAW,CAAC,aAAc;AAE9B,QAAI;AACF,YAAM,SAAS,MAAM,WAAW,UAAU;AAAA,QACxC;AAAA,QACA,OAAO,QAAQ;AAAA,QACf,YAAY,aAAa;AAAA,QACzB,KAAK,IAAI;AAAA,MACX,CAAC;AAED,UAAI,OAAO,UAAU,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,GAAG;AAC1D,cAAM,MAAM;AAAA,UACV,QAAQ;AAAA,UACR;AAAA,YACE,YAAY,SAAS;AAAA,YACrB,MAAM,SAAS;AAAA,YACf,WAAW,SAAS,SAAS;AAAA,YAC7B,MAAM,SAAS,SAAS;AAAA,UAC1B;AAAA,UACA,OAAO;AAAA,UACP;AAAA,YACE,iBAAiB,SAAS,SAAS;AAAA,UACrC;AAAA,QACF;AAAA,MACF;AAEA,UAAI,OAAO,mBAAmB,UAAa,OAAO,iBAAiB,GAAG;AACpE,cAAM,QAAQ,WAAW,MAAM;AAC7B,yBAAe,OAAO,GAAG;AACzB,cAAI,CAAC,QAAS,MAAK,kBAAkB,KAAK,UAAU,CAAC;AAAA,QACvD,GAAG,OAAO,cAAc;AACxB,uBAAe,IAAI,KAAK,KAAK;AAAA,MAC/B;AAAA,IACF,QAAQ;AACN,YAAM,QAAQ,KAAK,IAAI,eAAe,iBAAiB,KAAK,OAAO;AACnE,YAAM,QAAQ,WAAW,MAAM;AAC7B,uBAAe,OAAO,GAAG;AACzB,YAAI,CAAC,QAAS,MAAK,kBAAkB,KAAK,UAAU,UAAU,CAAC;AAAA,MACjE,GAAG,KAAK;AACR,qBAAe,IAAI,KAAK,KAAK;AAAA,IAC/B;AAAA,EACF;AAQA,iBAAe,kBACb,KACA,UACA,SACe;AACf,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,MAAM,IAAoB;AAAA,QACxC,YAAY,SAAS;AAAA,QACrB,MAAM,SAAS;AAAA,QACf,WAAW,SAAS,SAAS;AAAA,QAC7B,MAAM,SAAS,SAAS;AAAA,MAC1B,CAAC;AAAA,IACH,QAAQ;AAIN,YAAM,QAAQ,KAAK,IAAI,eAAe,iBAAiB,KAAK,OAAO;AACnE,YAAM,QAAQ,WAAW,MAAM;AAC7B,uBAAe,OAAO,GAAG;AACzB,YAAI,CAAC,QAAS,MAAK,kBAAkB,KAAK,UAAU,UAAU,CAAC;AAAA,MACjE,GAAG,KAAK;AACR,qBAAe,IAAI,KAAK,KAAK;AAC7B;AAAA,IACF;AAGA,QAAI,CAAC,QAAS;AACd,UAAM,mBAAmB,KAAK,SAAS,OAAO;AAAA,EAChD;AAEA,SAAO;AAAA,IACL,MAAM,OAAO;AACX,gBAAU;AACV,kBAAY;AAEZ,UAAI,cAAc;AAChB,cAAM,MAAM,aAAa,QAAQ,OAAO,YAAY,EAAE,MAAM,MAAM,MAAS;AAC3E,uBAAe;AAAA,MACjB;AAEA,YAAM,QAAQ,KAAK;AAAA,QACjB,YAAY,MAAM,MAAM,MAAS;AAAA,QACjC,MAAM,EAAE;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,MAAM,MAAM;AAAA,EACd;AACF;;;AC/PO,IAAM,4BAA4B;AAClC,IAAM,qBAAqB;AAoF3B,SAAS,iBAAiB,UAAyF;AACxH,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,SAAS,YAAY,CAAC,GAAG;AAClC,cAAU,MAAM,OAAO,UAAU;AACjC,YAAQ,MAAM,OAAO,QAAQ;AAAA,EAC/B;AAEA,SAAO,EAAE,QAAQ,KAAK,MAAM,SAAS,GAAG,IAAI,KAAK,MAAM,KAAK,MAAM,OAAO,GAAG,IAAI,IAAI;AACtF;AAEA,SAAS,eAAe,QAAoC,UAAgE;AAC1H,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,cAAc,UAAa,SAAS,UAAU,OAAO,WAAW;AACzE,WAAO,UAAU,SAAS,MAAM,OAAO,OAAO,SAAS;AAAA,EACzD;AACA,MAAI,OAAO,YAAY,UAAa,SAAS,QAAQ,OAAO,SAAS;AACnE,WAAO,QAAQ,SAAS,IAAI,OAAO,OAAO,OAAO;AAAA,EACnD;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,KAA0C,OAAoD;AAC7H,MAAI,CAAC,OAAO,CAAC,MAAO,QAAO;AAC3B,MAAI,IAAI,cAAc,WAAc,MAAM,UAAU,KAAK,IAAI,WAAW;AACtE,WAAO,UAAU,MAAM,MAAM,kBAAkB,IAAI,SAAS;AAAA,EAC9D;AACA,MAAI,IAAI,YAAY,WAAc,MAAM,QAAQ,KAAK,IAAI,SAAS;AAChE,WAAO,QAAQ,MAAM,IAAI,kBAAkB,IAAI,OAAO;AAAA,EACxD;AACA,SAAO;AACT;AAMA,eAAe,sBACb,SACA,gBACA,gBACA,KACA,iBACiC;AACjC,QAAM,UAAkC,CAAC;AACzC,QAAM,QAAQ,CAAC,GAAG,OAAO;AAEzB,iBAAe,SAAwB;AACrC,WAAO,MAAM,SAAS,GAAG;AACvB,YAAM,SAAS,MAAM,MAAM;AAC3B,UAAI;AACF,cAAM,SAAS,MAAM,eAAe,MAAM;AAC1C,cAAM,kBAAkB,wBAAwB,iBAAiB,QAAQ,KAAK;AAC9E,YAAI,iBAAiB;AACnB,kBAAQ,KAAK;AAAA,YACX,cAAc,OAAO;AAAA,YACrB,SAAS;AAAA,YACT,SAAS,+BAA+B,eAAe;AAAA,YACvD,WAAW,IAAI,EAAE,YAAY;AAAA,YAC7B,GAAI,QAAQ,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,UACjD,CAAC;AAAA,QACH,OAAO;AACL,kBAAQ,KAAK;AAAA,YACX,cAAc,OAAO;AAAA,YACrB,SAAS;AAAA,YACT,WAAW,IAAI,EAAE,YAAY;AAAA,YAC7B,GAAI,QAAQ,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,UACjD,CAAC;AAAA,QACH;AAAA,MACF,SAASA,QAAO;AACd,gBAAQ,KAAK;AAAA,UACX,cAAc,OAAO;AAAA,UACrB,SAAS;AAAA,UACT,SAASA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,UAC9D,WAAW,IAAI,EAAE,YAAY;AAAA,QAC/B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,KAAK,IAAI,gBAAgB,QAAQ,MAAM;AAC3D,QAAM,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ,YAAY,GAAG,MAAM,OAAO,CAAC,CAAC;AACrE,SAAO;AACT;AAmDO,SAAS,6BACd,QACA,SAC8B;AAC9B,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAE3C,iBAAe,iBAAiB,SAAuG;AACrI,UAAM,UAAU,QAAQ;AACxB,UAAM,SAA6B,QAAQ,UAAU,CAAC;AACtD,UAAM,OAAO,QAAQ;AAGrB,QAAI,OAAO,UAAU,eAAe,OAAO,UAAU,YAAY,OAAO,UAAU,cAAc;AAC9F,aAAO,EAAE,OAAO,KAAK;AAAA,IACvB;AAGA,QAAI,CAAC,OAAO,OAAO;AACjB,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,cAAc;AAAA,UACd,oBAAoB;AAAA,UACpB,iBAAiB;AAAA,UACjB,eAAe;AAAA,UACf,mBAAmB;AAAA,UACnB,qBAAqB;AAAA,UACrB,WAAW,IAAI,EAAE,YAAY;AAAA,UAC7B,UAAU,CAAC;AAAA,QACb;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAGA,UAAM,aAAiC,KAAK;AAC5C,UAAM,YAAgC,OAAO;AAC7C,QAAI,cAAc,WAAW;AAC3B,YAAM,UAAU,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,QAAQ;AAC9D,UAAI,UAAU,YAAY;AACxB,YAAI,KAAK,cAAc;AACrB,gBAAMC,WAAU,MAAM,QAAQ,YAAY,OAAO;AACjD,gBAAM,kBAAkB,OAAO,YAAY,CAAC,GACzC,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAC7C,IAAI,CAAC,UAAUA,SAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM,YAAY,CAAC,EACjE,OAAO,CAAC,MAA0B,MAAM,MAAS;AACpD,qBAAW,UAAU,gBAAgB;AACnC,gBAAI;AACF,oBAAM,QAAQ,eAAe,SAAS,MAAM;AAAA,YAC9C,QAAQ;AAAA,YAAoB;AAAA,UAC9B;AAAA,QACF;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO,KAAK,eAAe,eAAe;AAAA,YAC1C,UAAU,IAAI,EAAE,YAAY;AAAA,YAC5B,eAAe;AAAA,YACf,kBAAkB;AAAA,YAClB,gBAAgB,KAAK,eAAe,sBAAsB;AAAA,UAC5D;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAGA,QAAI,OAAO,UAAU,UAAU;AAC7B,aAAO,EAAE,OAAO,KAAK;AAAA,IACvB;AAEA,UAAM,UAAU,MAAM,QAAQ,YAAY,OAAO;AACjD,UAAM,WAAwD,OAAO,YAAY,CAAC;AAGlF,UAAM,gBAAgB,QAAQ;AAC9B,UAAM,kBAAkB,SAAS,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAChF,UAAM,iBAAiB,SAAS,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAC/E,UAAM,oBAAoB,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE;AAC7D,UAAM,sBAAsB,gBAAgB;AAK5C,UAAM,kBAAkB,QAAQ,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE;AACjE,QAAI,KAAK,6BAA6B,UAAa,mBAAmB,KAAK,0BAA0B;AACnG,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,UAAU,IAAI,EAAE,YAAY;AAAA,UAC5B,aAAa,gCAAgC,eAAe,eAAe,KAAK,wBAAwB;AAAA,UACxG;AAAA,UACA,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,QAAQ,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;AACtD,QAAI,KAAK,0BAA0B,UAAa,gBAAgB,KAAK,uBAAuB;AAC1F,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,UAAU,IAAI,EAAE,YAAY;AAAA,UAC5B,aAAa,6BAA6B,YAAY,eAAe,KAAK,qBAAqB;AAAA,UAC/F;AAAA,UACA,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,kBAAkB,eAAe,KAAK,QAAQ,iBAAiB,QAAQ,CAAC;AAC9E,QAAI,iBAAiB;AACnB,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,UAAU,IAAI,EAAE,YAAY;AAAA,UAC5B,aAAa,4BAA4B,eAAe;AAAA,UACxD;AAAA,UACA,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,KAAK,mBAAmB,UAAa,sBAAsB,KAAK,gBAAgB;AAClF,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,UAAU,IAAI,EAAE,YAAY;AAAA,UAC5B,aAAa,4BAA4B,mBAAmB,kBAAkB,KAAK,cAAc;AAAA,UACjG;AAAA,UACA,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,KAAK,2BAA2B,kBAAkB,KAAK,yBAAyB;AAClF,UAAI,KAAK,cAAc;AACrB,cAAM,iBAAiB,SACpB,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAC7C,IAAI,CAAC,UAAU,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM,YAAY,CAAC,EACjE,OAAO,CAAC,MAA0B,MAAM,MAAS;AACpD,mBAAW,UAAU,gBAAgB;AACnC,cAAI;AACF,kBAAM,QAAQ,eAAe,SAAS,MAAM;AAAA,UAC9C,QAAQ;AAAA,UAAoB;AAAA,QAC9B;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,UAAU,IAAI,EAAE,YAAY;AAAA,YAC5B,aAAa,8BAA8B,cAAc;AAAA,YACzD,gBAAgB,kBAAkB,cAAc;AAAA,YAChD,iBAAiB;AAAA,YACjB,eAAe;AAAA,YACf;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,UAAU,IAAI,EAAE,YAAY;AAAA,UAC5B,aAAa,8BAA8B,cAAc;AAAA,UACzD;AAAA,UACA,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,KAAK,aAAa,SAAS;AAC7B,YAAM,YAAY,KAAK,aAAa;AACpC,YAAMC,kBAAiB,KAAK,kBAAkB;AAC9C,YAAM,eAAuB,OAAO,gBAAgB;AACpD,YAAM,aAAa,eAAe;AAClC,YAAM,WAAW,KAAK,IAAI,aAAa,WAAW,aAAa;AAE/D,UAAI,cAAc,eAAe;AAE/B,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,aAAa,IAAI,EAAE,YAAY;AAAA,YAC/B;AAAA,YACA,eAAe;AAAA,YACf;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAGA,YAAM,eAAe,QAAQ,MAAM,YAAY,QAAQ;AACvD,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA,CAAC,WAAW,QAAQ,aAAa,SAAS,MAAM;AAAA,QAChDA;AAAA,QACA;AAAA,QACA,KAAK;AAAA,MACP;AACA,YAAMC,eAAc,CAAC,GAAG,UAAU,GAAG,aAAa;AAElD,YAAM,uBAAuB,eAAe,KAAK,QAAQ,iBAAiBA,YAAW,CAAC;AACtF,UAAI,sBAAsB;AACxB,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,UAAU,IAAI,EAAE,YAAY;AAAA,YAC5B,aAAa,4BAA4B,oBAAoB;AAAA,YAC7D,iBAAiBA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,YAC5E,eAAeA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,YAC1E;AAAA,YACA;AAAA,YACA,UAAUA;AAAA,UACZ;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,YAAM,oBAAoBA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AACrF,UAAI,KAAK,2BAA2B,qBAAqB,KAAK,yBAAyB;AACrF,YAAI,KAAK,cAAc;AACrB,gBAAM,iBAAiBA,aACpB,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAC7C,IAAI,CAAC,UAAU,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM,YAAY,CAAC,EACjE,OAAO,CAAC,MAA0B,MAAM,MAAS;AACpD,qBAAW,UAAU,gBAAgB;AACnC,gBAAI;AACF,oBAAM,QAAQ,eAAe,SAAS,MAAM;AAAA,YAC9C,QAAQ;AAAA,YAAoB;AAAA,UAC9B;AACA,iBAAO;AAAA,YACL,QAAQ;AAAA,cACN,GAAG;AAAA,cACH,OAAO;AAAA,cACP,UAAU,IAAI,EAAE,YAAY;AAAA,cAC5B,aAAa,8BAA8B,iBAAiB;AAAA,cAC5D,gBAAgB,kBAAkB,iBAAiB;AAAA,cACnD,iBAAiB;AAAA,cACjB,eAAe;AAAA,cACf;AAAA,cACA;AAAA,cACA,UAAUA;AAAA,YACZ;AAAA,YACA,OAAO;AAAA,UACT;AAAA,QACF;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,UAAU,IAAI,EAAE,YAAY;AAAA,YAC5B,aAAa,8BAA8B,iBAAiB;AAAA,YAC5D,iBAAiBA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,YAC5E,eAAeA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,YAC1E;AAAA,YACA;AAAA,YACA,UAAUA;AAAA,UACZ;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,cAAc,eAAe;AAAA,UAC7B,iBAAiBA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,UAC5E,eAAeA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,UAC1E;AAAA,UACA;AAAA,UACA,UAAUA;AAAA,QACZ;AAAA,QACA,OAAO;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,IACF;AAGA,UAAM,SAAS,KAAK,gBAAgB,CAAC,EAAE,QAAQ,IAAI,CAAC;AACpD,UAAM,eAAe,OAAO,sBAAsB;AAElD,QAAI,gBAAgB,OAAO,QAAQ;AACjC,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,aAAa,IAAI,EAAE,YAAY;AAAA,UAC/B;AAAA,UACA,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,QAAQ,OAAO,YAAY;AACjC,UAAM,iBAAiB,KAAK,kBAAkB;AAC9C,UAAM,gBAAgB,KAAK,KAAM,MAAM,SAAS,MAAO,aAAa;AACpE,UAAM,eAAe,QAAQ,MAAM,GAAG,aAAa,EAAE;AAAA,MACnD,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,UAAU,MAAM,iBAAiB,EAAE,QAAQ,MAAM,YAAY,SAAS;AAAA,IAC/F;AACA,UAAM,gBAAgB,MAAM;AAAA,MAC1B;AAAA,MACA,CAAC,WAAW,QAAQ,aAAa,SAAS,MAAM;AAAA,MAChD;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP;AACA,UAAM,cAAc,CAAC,GAAG,UAAU,GAAG,aAAa;AAElD,UAAM,uBAAuB,eAAe,KAAK,QAAQ,iBAAiB,WAAW,CAAC;AACtF,QAAI,sBAAsB;AACxB,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,UAAU,IAAI,EAAE,YAAY;AAAA,UAC5B,aAAa,4BAA4B,oBAAoB;AAAA,UAC7D,iBAAiB,YAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,UAC5E,eAAe,YAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,UAC1E;AAAA,UACA;AAAA,UACA,UAAU;AAAA,QACZ;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,MAAM,mBAAmB;AAC9C,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,GAAG;AAAA,QACH,OAAO;AAAA,QACP,oBAAoB,eAAe;AAAA,QACnC,iBAAiB,YAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,QAC5E,eAAe,YAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,QAC1E;AAAA,QACA;AAAA,QACA,UAAU;AAAA,MACZ;AAAA,MACA,OAAO;AAAA,MACP,gBAAgB,eAAe,IAAI,eAAe;AAAA,IACpD;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,SAA6C;AAC3D,YAAM,SAAS,MAAM,iBAAiB,OAAO;AAG7C,UAAI,OAAO,QAAQ;AACjB,eAAO,SAAS;AAAA,UACd,GAAG,OAAO;AAAA,UACV,gBAAgB,iBAAkB,OAAO,OAA8B,QAAQ;AAAA,QACjF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACndO,SAAS,2BAA2B,OAAwB;AACjE,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,IAAI,MAAM,IAAI,0BAA0B,EAAE,KAAK,GAAG,CAAC;AAAA,EAC5D;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,WAAO,IACL,OAAO,QAAQ,KAAgC,EAC5C,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,2BAA2B,IAAI,CAAC,EAAE,EACjF,KAAK,GAAG,CACb;AAAA,EACF;AACA,SAAO,KAAK,UAAU,KAAK,KAAK,OAAO;AACzC;AAEA,IAAM,8BAA8B;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,SAAS,yBACd,SACA,UACS;AACT,MACE,2BAA2B,QAAQ,IAAI,MACrC,2BAA2B,SAAS,IAAI,GAC1C;AACA,WAAO;AAAA,EACT;AACA,SAAO,4BAA4B,MAAM,CAAC,UAAU;AAClD,UAAM,UAAU,SAAS,SAAS,KAAK;AACvC,WAAO,YAAY,UACjB,2BAA2B,QAAQ,SAAS,KAAK,CAAC,MAChD,2BAA2B,OAAO;AAAA,EACxC,CAAC;AACH;;;AC3GA,SAAS,cAAc,cAA4C;AACjE,SAAO,KAAK,IAAI,GAAG,aAAa,KAAK,aAAa,UAAU,CAAC;AAC/D;AAOO,SAAS,qBACd,UACA,YACA,OACmB;AACnB,QAAM,YAAY,IAAI,IAAI,SAAS,IAAI,CAAC,YAAY,QAAQ,MAAM,CAAC;AACnE,QAAM,cAAc,IAAI;AAAA,IACtB,SACG,IAAI,CAAC,YAAY,WAAW,KAAK,CAAC,SAAS,KAAK,WAAW,QAAQ,MAAM,GAAG,WAAW,EACvF,OAAO,CAAC,WAA6B,WAAW,MAAS;AAAA,EAC9D;AACA,QAAM,YAAY,WAAW,OAAO,CAAC,SAAS,KAAK,UAAU,aAAa,CAAC,UAAU,IAAI,KAAK,MAAM,CAAC;AACrG,QAAM,cAAc,UAAU,OAAO,CAAC,SAAS,KAAK,gBAAgB,UAAa,CAAC,YAAY,IAAI,KAAK,WAAW,CAAC;AACnH,QAAM,OAAO,UAAU,OAAO,CAAC,SAAS,CAAC,YAAY,SAAS,IAAI,CAAC;AACnE,SAAO,CAAC,GAAG,aAAa,GAAG,IAAI,EAAE,MAAM,GAAG,KAAK;AACjD;AAOA,eAAsB,2BACpB,QACA,cACA,SAC4B;AAC5B,QAAM,MAAM,QAAQ,MAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AACtD,QAAM,UAA+B,CAAC;AACtC,QAAM,UAAU,cAAc,YAAY;AAC1C,QAAM,SAAS,OAAO,UAAU,CAAC;AACjC,QAAM,WAAuC,CAAC,GAAI,OAAO,YAAY,CAAC,CAAE;AACxE,MAAI,cAAc,OAAO;AACzB,MAAI,gBAAgB,OAAO;AAC3B,MAAI,eAAe,OAAO,gBAAgB;AAC1C,MAAI;AAEJ,iBAAe,aAAa,QAA+B;AACzD,UAAM,WAAW,EAAE,GAAI,gBAAgB,EAAE,QAAQ,cAAc,IAAI,CAAC,GAAI,OAAO,aAAa;AAC5F,UAAM,OAAO,EAAE,QAAQ,OAAO,eAAe,EAAE;AAC/C,UAAM,QAAQ,mBAAmB,QAAQ,UAAU,IAAI;AACvD,oBAAgB;AAChB,mBAAe,KAAK;AACpB,YAAQ,KAAK,EAAE,MAAM,iBAAiB,QAAQ,OAAO,aAAa,CAAC;AAAA,EACrE;AAIA,QAAM,SAAS,oBAAI,IAA2B;AAC9C,aAAW,WAAW,UAAU;AAC9B,UAAM,OAAO,QAAQ,MAAM,KAAK,CAAC,cAAc,UAAU,WAAW,QAAQ,MAAM;AAClF,WAAO,IAAI,QAAQ,QAAQ,MAAM,UAAU,YAAY,MAAM,QAAQ,gBAAgB,QAAQ,QAAQ,MAAM,IAAI,IAAI;AAAA,EACrH;AAKA,QAAM,0BAA0B,kBAAkB,UAChD,OAAO,cAAc,YAAY,KACjC,gBAAgB,KAChB,OAAO,IAAI,aAAa,KAAK;AAC/B,MAAI,CAAC,yBAAyB;AAC5B,UAAM,YAAY,SAAS,KAAK,CAAC,YAAY;AAC3C,YAAM,OAAO,OAAO,IAAI,QAAQ,MAAM;AACtC,aAAO,QAAQ,SAAS,CAAC,eAAe,SAAS;AAAA,IACnD,CAAC;AACD,QAAI,WAAW;AACb,YAAM,aAAa,UAAU,MAAM;AAAA,IACrC,OAAO;AACL,sBAAgB;AAAA,IAClB;AAAA,EACF;AAEA,MAAI,kBAAkB;AACtB,MAAI;AAIF,QAAI,eAAe;AACjB,iBAAW,MAAM,QAAQ;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,UACE,CAAC,SAAS,kBACV,SAAS,eAAe,SAAS,QACjC,CAAC,SAAS,eACV,SAAS,YAAY,SAAS,KAC9B;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,oBAAc,SAAS;AACvB,aAAO,IAAI,eAAe,WAAW;AAAA,IACvC;AAGA,eAAW,CAAC,OAAO,OAAO,KAAK,SAAS,QAAQ,GAAG;AACjD,YAAM,OAAO,OAAO,IAAI,QAAQ,MAAM;AACtC,UAAI,QAAQ,MAAM;AAChB,YAAI,QAAQ,UAAU,WAAW;AAC/B,mBAAS,KAAK,IAAI,EAAE,GAAG,SAAS,OAAO,WAAW,WAAW,IAAI;AACjE,kBAAQ,KAAK,EAAE,MAAM,gBAAgB,QAAQ,QAAQ,OAAO,CAAC;AAAA,QAC/D;AACA;AAAA,MACF;AACA,UAAI,eAAe,SAAS,aAAa;AACvC,YAAI,QAAQ,UAAU,cAAc,QAAQ,gBAAgB,MAAM;AAChE,mBAAS,KAAK,IAAI,EAAE,GAAG,SAAS,OAAO,YAAY,aAAa,MAAM,WAAW,IAAI;AACrF,kBAAQ,KAAK,EAAE,MAAM,iBAAiB,QAAQ,QAAQ,QAAQ,QAAQ,wBAAwB,CAAC;AAAA,QACjG;AACA;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,aAAa,QAAQ,gBAAgB,MAAM;AAC/D,iBAAS,KAAK,IAAI,EAAE,GAAG,SAAS,OAAO,WAAW,aAAa,MAAM,WAAW,IAAI;AAAA,MACtF;AAAA,IACF;AAEA,UAAM,kBAAkB,MACtB,SAAS;AAAA,MACP,CAAC,YACC,QAAQ,UAAU,aAClB,QAAQ,gBAAgB;AAAA,IAC5B;AAGF,QACE,iBACA,YACA,aAAa,KAAK,aAAa,gBAAgB,OAC/C;AACA,iBAAW,CAAC,OAAO,OAAO,KAAK,SAAS,QAAQ,GAAG;AACjD,YAAI,QAAQ,UAAU,WAAY;AAClC,iBAAS,KAAK,IAAI,EAAE,GAAG,SAAS,OAAO,cAAc,WAAW,IAAI;AACpE,gBAAQ,KAAK,EAAE,MAAM,mBAAmB,QAAQ,QAAQ,QAAQ,YAAY,cAAc,CAAC;AAC3F,cAAM,QAAQ;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR;AAAA,QACF;AACA,cAAM,SAAS,MAAM,QAAQ,gBAAgB,QAAQ,QAAQ,MAAM;AACnE,iBAAS,KAAK,IAAI,WAAW,cACzB,EAAE,GAAG,SAAS,KAAK,GAAG,OAAO,WAAW,aAAa,QAAQ,WAAW,IAAI,IAC5E,EAAE,GAAG,SAAS,KAAK,GAAG,OAAO,YAAY,GAAI,SAAS,EAAE,aAAa,OAAO,IAAI,CAAC,GAAI,WAAW,IAAI;AAAA,MAC1G;AAAA,IACF;AAGA,UAAM,eAAe,IAAI,IAAI,SAAS,IAAI,CAAC,YAAY,QAAQ,MAAM,CAAC;AACtE,UAAM,UAAU,UAAU,gBAAgB,EAAE,SAC1C,SAAS,OAAO,CAAC,YAAY,QAAQ,UAAU,YAAY,EAAE;AAC/D,QACE,iBACA,YACA,UAAU,KACV,aAAa,KAAK,aAAa,gBAAgB,OAC/C;AACA,YAAM,UAAU,qBAAqB,UAAU,QAAQ,OAAO,OAAO;AACrE,iBAAW,UAAU,SAAS;AAC5B,YAAI,aAAa,IAAI,OAAO,MAAM,EAAG;AACrC,gBAAQ,KAAK,EAAE,MAAM,iBAAiB,QAAQ,OAAO,QAAQ,YAAY,cAAc,CAAC;AACxF,cAAM,QAAQ;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO;AAAA,UACP;AAAA,QACF;AACA,cAAM,SAAS,MAAM,QAAQ,gBAAgB,QAAQ,OAAO,MAAM;AAClE,iBAAS,KAAK;AAAA,UACZ,QAAQ,OAAO;AAAA,UACf,OAAO,WAAW,cAAc,YAAY;AAAA,UAC5C,GAAI,SAAS,EAAE,aAAa,OAAO,IAAI,CAAC;AAAA,UACxC,WAAW;AAAA,QACb,CAAC;AACD,qBAAa,IAAI,OAAO,MAAM;AAAA,MAChC;AAAA,IACF;AAEA,UAAM,UAAU,gBAAgB,EAAE;AAClC,UAAM,SAAS,WAAW,UACtB,YACA,UAAU,KAAK,SAAS,KAAK,CAAC,YAAY,QAAQ,UAAU,YAAY,IACxE,aACA;AAEJ,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,GAAG;AAAA,QACH,QAAQ;AAAA,UACN,GAAG;AAAA,UACH;AAAA,UACA,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA;AAAA,UAErC;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAASC,QAAO;AACd,sBAAkB;AAClB,UAAMA;AAAA,EACR,UAAE;AACA,QAAI,UAAU;AACZ,YAAM,UAAU,QAAQ,gBAAgB,QAAQ,QAAQ;AACxD,UAAI,iBAAiB;AACnB,cAAM,QAAQ,MAAM,MAAM,MAAS;AAAA,MACrC,OAAO;AACL,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AA8BO,SAAS,4BAA4B,MAAiC;AAC3E,QAAM,EAAE,OAAO,iBAAiB,WAAW,WAAW,MAAM,IAAI;AAEhE,SAAO,uBAAuB,OAAO;AAAA,IACnC,MAAM,UAAU,SAAS;AACvB,YAAM,SAAS,QAAQ;AAEvB,YAAM,eAAe,MAAM,gBAAgB,MAAM;AACjD,UAAI,CAAC,aAAc,QAAO,EAAE,OAAO,KAAK;AAExC,YAAM,QAAQ,MAAM,UAAU;AAG9B,YAAM,UAAW,MAAM,MAAM,IAAI;AAAA,QAC/B,MAAM,OAAO;AAAA,QACb,WAAW,OAAO,SAAS;AAAA,QAC3B,MAAM,OAAO,SAAS;AAAA,QACtB,YAAY,OAAO;AAAA,MACrB,CAAC;AACD,YAAM,aAAa,WAAW;AAE9B,YAAM,UAA8B;AAAA,QAClC;AAAA,QACA,iBAAiB,OAAO,cAAc,WAAW,MAAM,UAAU,gBAAgB,cAAc,MAAM;AAAA,QACrG,wBAAwB,OAAO,cAAc,QAAQ,UAAU,MAAM,UAAU,uBAAuB,cAAc,QAAQ,KAAK;AAAA,QACjI,iBAAiB,OAAO,cAAc,gBAAgB,YAAY,UAAU,UAAU;AACpF,gBAAM,UAAU;AAAA,YACd;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,QACA,oBAAoB,OAAO,cAAc,UAAU,SAAS;AAC1D,gBAAM,UAAU,mBAAmB,cAAc,UAAU,IAAI;AAAA,QACjE;AAAA,QACA,iBAAiB,OAAO,cAAc,mBAAmB;AACvD,gBAAM,UAAU,gBAAgB,cAAc,cAAc;AAAA,QAC9D;AAAA,MACF;AAEA,YAAM,SAAS,MAAM,2BAA2B,YAAY,cAAc,OAAO;AACjF,YAAM,aAAa,OAAO,OAAO,UAAU,CAAC;AAC5C,UACE,2BAA2B,UAAU,MACnC,2BAA2B,WAAW,UAAU,CAAC,CAAC,GACpD;AACA,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AAGA,aAAO,EAAE,QAAQ,WAAW;AAAA,IAC9B;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IACA,WAAW;AAAA,IACX,WAAW;AAAA,IACX,YAAY;AAAA,EACd,CAAC;AACH;;;AClXA,IAAM,yBAAyB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,sCACd,OACA,OACA,UAAkD,CAAC,GACzB;AAC1B,QAAM,gBAAgB,QAAQ,iBAAiB;AAE/C,SAAO;AAAA,IACL,MAAM,kBAA2D;AAC/D,aAAO;AAAA,QACL,YAAY,CAAC,SAAS,OAAO,QAAQ,SAAS,QAAQ;AAAA,QACtD;AAAA,QACA,YAAY,CAAC,UAAU;AAAA,MACzB;AAAA,IACF;AAAA,IAEA,MAAM,MACJ,UACA,cACgD;AAChD,YAAM,YAA4C;AAAA,QAChD,YAAY,SAAS;AAAA,QACrB,MAAM,SAAS;AAAA,QACf,MAAM,SAAS,SAAS;AAAA,QACxB,WAAW,SAAS,SAAS;AAAA,MAC/B;AACA,YAAM,WAAW,MAAM,MAAM,IAAoB,SAAS;AAC1D,aAAO,MAAM,MAAM,OAAO,UAAU;AAAA,QAClC,GAAI,WAAW,EAAE,iBAAiB,SAAS,SAAS,gBAAgB,IAAI,CAAC;AAAA,QACzE,gBAAgB,cAAc;AAAA,QAC9B,QAAQ,cAAc;AAAA,MACxB,CAAC;AAAA,IACH;AAAA,IAEA,IACE,WACA,UACuD;AACvD,aAAO,MAAM,IAAoB,SAAS;AAAA,IAC5C;AAAA,IAEA,KACE,OACA,UACoD;AACpD,aAAO,MAAM,KAAqB,KAAK;AAAA,IACzC;AAAA,IAEA,MACE,OACA,cACwD;AACxD,aAAO,MAAM,MAAsB,OAAO,YAAY;AAAA,IACxD;AAAA,IAEA,OACE,WACA,eACoC;AACpC,aAAO,MAAM,OAAO,OAAO,WAAW,aAAa;AAAA,IACrD;AAAA,EACF;AACF;;;AC5EA,SAAS,cAAc,SAAiB,QAAyB;AAC/D,SAAO,QAAQ,SAAS,GAAG,IACvB,OAAO,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC,IACtC,YAAY;AAClB;AAGO,SAAS,uCACd,SAC6C;AAC7C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,QAAQ,QAAQ;AACtB,YAAM,SAAS,MAAM,UAAU,CAAC;AAChC,UAAI,OAAO,SAAS,OAAO,UAAU,UAAW,QAAO,EAAE,OAAO,KAAK;AACrE,YAAM,eAAe,MAAM,QAAQ,uBAAuB,KAAK,KAAK,CAAC;AACrE,UAAI,aAAa,YAAY;AAC3B,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,aAAa;AAAA,cACtB,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,cAAc,MAAM,QAAQ,YAAY,GAAG;AAAA,QAAO,CAAC,WACvD,OAAO,YACN,CAAC,aAAa,gBAAgB,OAAO,WAAW,aAAa,kBAC7D,CAAC,aAAa,eAAe,OAAO,gBAAgB,aAAa,gBAClE,OAAO,UAAU,SAAS,MAAM,KAAK,QAAQ,MAC5C,CAAC,OAAO,SAAS,UAAU,OAAO,QAAQ,SAAS,MAAM,KAAK,MAAM,OACpE,CAAC,OAAO,SAAS,UAAU,OAAO,QAAQ,KAAK,CAAC,YAAY,cAAc,SAAS,MAAM,KAAK,MAAM,CAAC,OACrG,OAAO,cAAc,WAAc,OAAO,gBAAgB,KAAK,OAAO;AAAA,MACzE,EAAE;AAAA,QAAK,CAAC,MAAM,WACX,KAAK,gBAAgB,MAAM,MAAM,gBAAgB,MAClD,KAAK,OAAO,cAAc,MAAM,MAAM,KACtC,KAAK,YAAY,cAAc,MAAM,WAAW;AAAA,MAClD;AACA,YAAM,WAAW,WAAW,CAAC;AAC7B,YAAM,eAAe,IAAI,EAAE,YAAY;AACvC,UAAI,CAAC,UAAU;AACb,cAAM,EAAE,cAAc,OAAO,gBAAgB,SAAS,SAAS,UAAU,GAAG,QAAQ,IAAI;AACxF,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,YAAY,CAAC;AAAA,cACX,MAAM;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,SAAS,2CAA2C,MAAM,KAAK,QAAQ,QAAQ,MAAM,KAAK,MAAM;AAAA,cAChG,oBAAoB;AAAA,YACtB,CAAC;AAAA,UACH;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UACE,OAAO,iBAAiB,SAAS,UACjC,OAAO,mBAAmB,SAAS,eACnC,OAAO,SAAS,eAAe,QAAQ,WACvC,QAAO,EAAE,OAAO,KAAK;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,cAAc,SAAS;AAAA,UACvB,gBAAgB,SAAS;AAAA,UACzB,SAAS,EAAE,YAAY,QAAQ,YAAY,SAAS,aAAa;AAAA,UACjE,YAAY,CAAC;AAAA,YACX,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,SAAS,aAAa,SAAS,WAAW,SAAS,SAAS,MAAM;AAAA,YAClE,oBAAoB;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AA+BO,SAAS,yCACd,SAC6C;AAC7C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,QAAQ,QAAQ;AACtB,YAAM,SAAS,MAAM,UAAU,CAAC;AAChC,UAAI,OAAO,iBAAiB,QAAQ,UAAU,CAAC,OAAO,kBAAkB,CAAC,OAAO,SAAS;AACvF,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,UACE,OAAO,UAAU,YACjB,OAAO,UAAU,aACjB,OAAO,UAAU,aACjB,OAAO,UAAU,aACjB,OAAO,UAAU,SACjB,QAAO,EAAE,OAAO,KAAK;AACvB,YAAM,gBAAgB,QAAQ,UAC1B,MAAM,QAAQ,QAAQ;AAAA,QACtB,OAAO;AAAA,QACP,QAAQ;AAAA,MACV,IACE;AACJ,YAAM,SAAS,gBACX,SACA,MAAM,QAAQ,UAAU,OAAO,gBAAgB,QAAQ,MAAM;AACjE,UAAI,CAAC,iBAAiB,CAAC,QAAQ;AAC7B,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,4BAA4B,OAAO,cAAc;AAAA,cAC1D,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,OAAO,UAAU,WAAW;AAC9B,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,eAAe;AAAA,cACb,YAAY,QAAQ;AAAA,cACpB,WAAW,IAAI,EAAE,YAAY;AAAA,YAC/B;AAAA,UACF;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UAAI,OAAO,eAAe,eAAe,QAAQ,YAAY;AAC3D,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,eAAe,iBAAiB,QAAQ,UAC1C,MAAM,cAAc;AAAA,QACpB,MAAM,QAAQ,QAAQ,mBAAmB;AAAA,UACvC;AAAA,UACA,OAAO,QAAQ;AAAA,UACf,YAAY,QAAQ;AAAA,QACtB,CAAC;AAAA,MACH,IACE;AACJ,YAAM,SAAS,eACX,SACA,MAAO,OAAkC,MAAM;AAAA,QAC/C,GAAG,MAAM;AAAA,QACT,SAAS,MAAM,SAAS;AAAA,MAC1B,CAAC;AACH,YAAM,kBAAkB,cAAc,eACpC,gBAAgB,QAAQ,MAAM,IAAI,MAAM,SAAS,GAAG;AACtD,UAAI,OAAQ,OAAM,QAAQ,MAAM,IAAI,iBAAiB,MAAM;AAC3D,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,WAAW;AAAA,UACX,UAAU,cAAc,YAAY,QAAQ,OAAO;AAAA,UACnD,WAAW,cAAc,aAAa,QAAQ,OAAO;AAAA,UACrD,UAAU;AAAA,UACV,kBAAkB;AAAA,UAClB,gBAAgB;AAAA,QAClB;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,sBACpB,OACA,QACA,OACe;AACf,QAAM,kBAAkB,MAAM,QAAQ;AACtC,MAAI,CAAC,gBAAiB;AACtB,QAAM,SAAS,MAAM,MAAM,IAAI,eAAe;AAC9C,SAAO,OAAO,QAAQ,OAAO,WAAW,MAAM,SAAS,GAAG;AAC1D,QAAM,MAAM,OAAO,eAAe;AACpC;AA0BO,SAAS,yCACd,SAC6C;AAC7C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,QAAQ,QAAQ;AACtB,YAAM,SAAS,MAAM,UAAU,CAAC;AAChC,UACE,OAAO,iBAAiB,QAAQ,UAChC,CAAC,OAAO,kBACP,OAAO,UAAU,YAAY,OAAO,UAAU,UAC/C,QAAO,EAAE,OAAO,KAAK;AACvB,YAAM,gBAAgB,QAAQ,UAC1B,MAAM,QAAQ,QAAQ;AAAA,QACtB,OAAO;AAAA,QACP,QAAQ;AAAA,MACV,IACE;AACJ,YAAM,SAAS,gBACX,SACA,MAAM,QAAQ,UAAU,OAAO,gBAAgB,QAAQ,MAAM;AACjE,UAAI,CAAC,iBAAiB,CAAC,OAAQ,QAAO,EAAE,gBAAgB,IAAK;AAC7D,YAAM,YAAY,IAAI;AACtB,YAAM,UAAU,CAAC,OAAO,SAAS,KAAK,MAAM,OAAO,aAAa,EAAE,CAAC,KACjE,UAAU,QAAQ,KAAK,KAAK,MAAM,OAAO,aAAa,EAAE;AAC1D,YAAM,cAAc,MAAM,QAAQ,cAAc,KAAK;AACrD,UAAI,CAAC,WAAW,CAAC,aAAa;AAC5B,eAAO;AAAA,UACL,gBAAgB,KAAK;AAAA,YACnB;AAAA,YACA,KAAK,IAAI,KAAM,KAAK,MAAM,OAAO,aAAa,EAAE,IAAI,UAAU,QAAQ,CAAC;AAAA,UACzE;AAAA,QACF;AAAA,MACF;AACA,UAAI,iBAAiB,QAAQ,WAAW,OAAO,WAAW;AACxD,cAAM,cAAc;AAAA,UAClB,MAAM,QAAQ,QAAQ,oBAAoB;AAAA,YACxC;AAAA,YACA,aAAa,OAAO;AAAA,YACpB,OAAO,QAAQ;AAAA,YACf,YAAY,QAAQ;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,MACF,WAAW,QAAQ;AACjB,cAAM,sBAAsB,OAAO,QAAQ,QAAQ,KAAK;AAAA,MAC1D;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO,UAAU,YAAY;AAAA,UAC7B,WAAW,UAAU,YAAY;AAAA,QACnC;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AC7UA,IAAM,SAAS;AACf,IAAM,sBAAsB;AAC5B,IAAM,eAA2C;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAsBA,SAAS,QAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,cACP,OACA,OACA,UAAU,KACF;AACR,MAAI,OAAO,UAAU,YAAY,CAAC,SAAS,MAAM,SAAS,SAAS;AACjE,YAAQ,iBAAiB,KAAK,aAAa;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,YACP,OACA,SACA,UACM;AACN,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,YAAQ,iBAAiB,QAAQ,oBAAoB;AAAA,EACvD;AACA,QAAM,UAAU,OAAO,KAAK,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,SAAS,KAAK,CAAC;AAC7E,MAAI,QAAQ,SAAS,GAAG;AACtB;AAAA,MACE,iBAAiB,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC9E;AAAA,EACF;AACF;AAEA,eAAe,OAAO,OAAiC;AACrD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,qBAAqB,KAAK,CAAC;AAClE,QAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,KAAK;AACrE,SAAO,UACL,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,EACvB,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE,CACZ;AACF;AAEA,SAAS,WAAW,mBAAmC;AACrD,SAAO,SAAS,kBAAkB,MAAM,UAAU,QAAQ,EAAE,CAAC;AAC/D;AAEA,SAAS,aAAa,UAAqD;AACzE,QAAM,OAAO,SAAS;AACtB,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf,cAAc,gBAAgB,SAAS,SAAS,IAAI;AAAA,IACpD,aAAa,KAAK;AAAA,IAClB,MAAM,KAAK;AAAA,IACX,YAAY,KAAK;AAAA,IACjB,OAAO,gBAAgB,KAAK,KAAK;AAAA,IACjC,cAAc,KAAK;AAAA,IACnB,kBAAkB,KAAK;AAAA,IACvB,QAAQ,KAAK;AAAA,IACb,YAAY,gBAAgB,KAAK,UAAU;AAAA,IAC3C,YAAY,gBAAgB,KAAK,UAAU;AAAA,IAC3C,MAAM,gBAAgB,KAAK,IAAI;AAAA,IAC/B,GAAI,KAAK,iBAAiB,EAAE,gBAAgB,KAAK,eAAe,IAAI,CAAC;AAAA,IACrE,cAAc,KAAK;AAAA,EACrB;AACF;AAOO,SAAS,wCACd,SACgC;AAChC,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,wBAAwB,QAAQ,yBAAyB;AAC/D,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,SAAS,cAAc,QAAQ,MAAM,eAAe,GAAG;AAC7D,QAAM,cAAc,IAAI,WAAW,EAAE;AACrC,aAAW,OAAO,gBAAgB,WAAW;AAC7C,QAAM,SAAS,GAAG,MAAM,IACtB,CAAC,GAAG,WAAW,EACZ,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE,CACZ;AACA,QAAM,YAAY,SAAS,MAAM,GAC9B,YAAY,EACZ,QAAQ,iBAAiB,GAAG,EAC5B,QAAQ,YAAY,EAAE,EACtB,MAAM,GAAG,GAAG;AACf,MACE,CAAC,QAAQ,kBAAkB,UAC3B,CAAC,OAAO,cAAc,qBAAqB,KAC3C,wBAAwB,KACxB,CAAC,OAAO,cAAc,aAAa,KACnC,gBAAgB,EAChB,SAAQ,2CAA2C;AAErD,iBAAe,aAA6C;AAC1D,UAAM,SAAS,MAAM,QAAQ,MAAM,KAAsB;AAAA,MACvD,YAAY;AAAA,MACZ,MAAM;AAAA,IACR,CAAC;AACD,WAAQ,OAAO,MACZ,OAAO,CAAC,SAAS,KAAK,KAAK,WAAW,MAAM,EAC5C,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,WAAW,MAAM,KAAK,QAAQ;AAAA,EACnE;AAEA,iBAAe,QACb,OACA,UAC4B;AAC5B,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,OAAO,IAAI,EAAE,QAAQ,IAAI,KAAK,MAAM,QAAQ,GAAG,WAAW,GAAG;AAC3F,UAAI;AACF,eAAO,MAAM,QAAQ,MAAM,aAAa,OAAO;AAAA,UAC7C,MAAM;AAAA,UACN;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AAAA,MACH,SAASC,QAAO;AACd,oBAAYA;AACZ,YACE,EAAEA,kBAAiB,uBACnBA,OAAM,SAAS,WACf,OAAMA;AACR,cAAM,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,MAC9D;AAAA,IACF;AACA,UAAM,qBAAqB,qBACvB,YACA,IAAI,mBAAmB;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACL;AAEA,iBAAe,WACb,SACA,QACAC,SACe;AACf,gBAAY,QAAQ,SAASA,SAAQ,GAAG,MAAM,UAAU;AACxD,gCAA4B,SAAS;AAAA,MACnC;AAAA,MACA,gBAAgB;AAAA,MAChB,mBAAmB;AAAA,MACnB,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAC5C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,WAAS,OAAO,SAKd;AACA,QAAI,CAAC,OAAO,KAAK,cAAc,QAAQ,cAAc,gBAAgB,EAAE,CAAC,GAAG;AACzE,cAAQ,8CAA8C;AAAA,IACxD;AACA,QACE,CAAC;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,SAAS,QAAQ,MAAM,EACzB,SAAQ,iCAAiC;AAC3C,UAAM,aAAa,QAAQ;AAC3B,QACE,CAAC,cACD,CAAC;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,SAAS,WAAW,MAAM,EAC5B,SAAQ,qCAAqC;AAC/C,kBAAc,WAAW,UAAU,qBAAqB;AACxD,QAAI,WAAW,YAAY,QAAW;AACpC,oBAAc,WAAW,SAAS,oBAAoB;AAAA,IACxD;AACA,UAAM,aAAa,QAAQ,cAAc,CAAC;AAC1C,QAAI,OAAO,KAAK,UAAU,EAAE,SAAS,eAAe;AAClD,cAAQ,wCAAwC;AAAA,IAClD;AACA,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,UACE,CAAC,OACD,IAAI,SAAS,MACb,oBAAoB,KAAK,GAAG,KAC5B,OAAO,UAAU,YACjB,MAAM,SAAS,OACf,gBAAgB,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,EAChC,SAAQ,4BAA4B,GAAG,2BAA2B;AAAA,IACtE;AACA,WAAO;AAAA,MACL,cAAc,QAAQ;AAAA,MACtB,QAAQ,QAAQ;AAAA,MAChB,YAAY,gBAAgB,UAAU;AAAA,MACtC,YAAY,gBAAgB,UAAU;AAAA,IACxC;AAAA,EACF;AAEA,iBAAe,OACb,SAC6B;AAC7B,QAAI;AACJ,QAAI,WAAW;AACf,eAAW,YAAY,SAAS;AAC9B,YAAM,OAAO,SAAS;AACtB,kBAAY;AACZ,UACE,KAAK,aAAa,YAClB,KAAK,mBAAmB,gBACxB;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,6CAA6C,KAAK,QAAQ;AAAA,UACnE,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,EAAE,cAAc,GAAG,SAAS,IAAI;AACtC,UAAI,iBAAiB,MAAM,OAAO,QAAQ,GAAG;AAC3C,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,wBAAwB,KAAK,QAAQ;AAAA,UAC9C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,uBAAiB,KAAK;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,OACb,SACA,YACA,MAC+B;AAC/B,UAAM,WAAW,OAAO,QAAQ,OAAO;AACvC,UAAM,qBAAqB,MAAM,OAAO,QAAQ,OAAO;AACvD,UAAM,oBAAoB,MAAM,OAAO;AAAA,MACrC;AAAA,MACA,aAAa,QAAQ,SAAS;AAAA,MAC9B,QAAQ,QAAQ;AAAA,MAChB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,UAAM,OAAO,WAAW,iBAAiB;AACzC,UAAM,QAAQ,MAAM,QAAQ,QAAQ,OAAO,QAAQ,QAAQ;AAC3D,QAAI;AACF,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,YAAY,MAAM,OAAO,OAAO;AACtC,YAAM,WAAW,QAAQ;AAAA,QACvB,CAAC,SAAS,KAAK,KAAK,sBAAsB;AAAA,MAC5C;AACA,UAAI,UAAU;AACZ,YAAI,SAAS,KAAK,uBAAuB,oBAAoB;AAC3D,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,aAAa,QAAQ;AAAA,MAC9B;AACA,YAAM,eAAe,QAClB,OAAO,CAAC,SAAS,KAAK,KAAK,gBAAgB,QAAQ,SAAS,GAAG,EAC/D;AAAA,QACC,CAAC,SAAS,SAAS,KAAK,IAAI,SAAS,KAAK,KAAK,YAAY;AAAA,QAC3D;AAAA,MACF;AACF,UAAK,QAAQ,eAA0B,cAAc;AACnD,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,qCAAqC,QAAQ,YAAY,sBAAsB,YAAY;AAAA,UACpG,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,gBAAgB,QAAQ;AAAA,QAC5B,CAAC,SAAS,KAAK,KAAK,gBAAgB,QAAQ,SAAS;AAAA,MACvD,EAAE;AACF,UAAI,iBAAiB,uBAAuB;AAC1C,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,0BAA0B,qBAAqB;AAAA,UACxD,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,WAAW;AAAA,QACf,UAAU,QAAQ,SAAS;AAAA,QAC3B,aAAa,QAAQ,SAAS;AAAA,QAC9B;AAAA,QACA,YAAY,IAAI,EAAE,YAAY;AAAA,QAC9B,OAAO;AAAA,UACL,IAAI,QAAQ,MAAM;AAAA,UAClB,MAAM,QAAQ,MAAM;AAAA,QACtB;AAAA,QACA,GAAG;AAAA,QACH,kBAAkB,MAAM,OAAO,QAAQ,mBAAmB;AAAA,QAC1D;AAAA,QACA,GAAI,YAAY,EAAE,gBAAgB,UAAU,IAAI,CAAC;AAAA,MACnD;AACA,YAAM,eAAe;AAAA,QACnB;AAAA,QACA,GAAG;AAAA,QACH;AAAA,QACA;AAAA,QACA,cAAc,QAAQ;AAAA,MACxB;AACA,YAAM,OAAwB;AAAA,QAC5B,GAAG;AAAA,QACH,cAAc,MAAM,OAAO,YAAY;AAAA,MACzC;AACA,YAAM,UAAU,MAAM,QAAQ,MAAM;AAAA,QAClC,QAAQ;AAAA,QACR,0BAA0B,MAAM,IAAI;AAAA,QACpC,EAAE,gBAAgB,gBAAgB,iBAAiB,GAAG;AAAA,MACxD;AACA,aAAO,aAAa,OAAO;AAAA,IAC7B,UAAE;AACA,YAAM,QAAQ,MAAM,aAAa,QAAQ,OAAO,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,IAC9E;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,qBAAqB;AAAA,QACrB,eAAe;AAAA,QACf;AAAA,QACA;AAAA,QACA,aAAa,QAAQ;AAAA,QACrB,mBAAmB,CAAC,GAAG,QAAQ,iBAAiB;AAAA,MAClD;AAAA,IACF;AAAA,IACA,MAAM,YAAY,SAAS;AACzB,YAAM,WAAW,SAAS,gBAAgB;AAAA,QACxC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,SAAS,cAAc,QAAQ,QAAQ,QAAQ,QAAQ;AAC7D,UAAI,CAAC,CAAC,WAAW,UAAU,SAAS,EAAE,SAAS,QAAQ,QAAQ,OAAO,GAAG;AACvE,gBAAQ,kCAAkC;AAAA,MAC5C;AACA,UAAI,QAAQ,QAAQ,eAAe,QAAW;AAC5C,sBAAc,QAAQ,QAAQ,YAAY,YAAY;AAAA,MACxD;AACA,aAAO,OAAO,SAAS,SAAS;AAAA,QAC9B,MAAM;AAAA,QACN;AAAA,QACA,SAAS,QAAQ,QAAQ;AAAA,QACzB,GAAI,QAAQ,QAAQ,aAChB,EAAE,YAAY,QAAQ,QAAQ,WAAW,IACzC,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AAAA,IACA,MAAM,UAAU,SAAS;AACvB,YAAM,WAAW,SAAS,wBAAwB;AAAA,QAChD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,OAAO,cAAc,QAAQ,QAAQ,MAAM,YAAY;AAC7D,UACE,CAAC,CAAC,SAAS,QAAQ,WAAW,SAAS,UAAU,EAAE;AAAA,QACjD,QAAQ,QAAQ;AAAA,MAClB,EACA,SAAQ,yCAAyC;AACnD,aAAO,OAAO,SAAS,SAAS;AAAA,QAC9B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,QAAQ,QAAQ;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,IACA,MAAM,WAAW,SAAS;AACxB,YAAM,WAAW,SAAS,yBAAyB;AAAA,QACjD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,OAAO,cAAc,QAAQ,QAAQ,MAAM,aAAa;AAC9D,YAAM,OAAO,cAAc,QAAQ,QAAQ,MAAM,eAAe,EAAE;AAClE,UAAI,CAAC,OAAO,SAAS,QAAQ,QAAQ,KAAK,GAAG;AAC3C,gBAAQ,2CAA2C;AAAA,MACrD;AACA,aAAO,OAAO,SAAS,UAAU;AAAA,QAC/B,MAAM;AAAA,QACN;AAAA,QACA,OAAO,QAAQ,QAAQ;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,MAAM,UAAU,SAAS;AACvB,YAAM,WAAW,SAAS,wBAAwB;AAAA,QAChD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,OAAO,cAAc,QAAQ,QAAQ,MAAM,YAAY;AAC7D,YAAM,UAAU;AAAA,QACd,QAAQ,QAAQ;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AACA,YAAM,SAAS,cAAc,QAAQ,QAAQ,QAAQ,UAAU,GAAG;AAClE,UACE,CAAC,OAAO,SAAS,QAAQ,QAAQ,UAAU,KAC3C,QAAQ,QAAQ,aAAa,EAC7B,SAAQ,mDAAmD;AAC7D,UAAI,CAAC,CAAC,MAAM,OAAO,EAAE,SAAS,QAAQ,QAAQ,MAAM,GAAG;AACrD,gBAAQ,uCAAuC;AAAA,MACjD;AACA,aAAO,OAAO,SAAS,SAAS;AAAA,QAC9B,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,QAAQ,QAAQ;AAAA,QAC5B,QAAQ,QAAQ,QAAQ;AAAA,MAC1B,CAAC;AAAA,IACH;AAAA,IACA,MAAM,YAAY,SAAS;AACzB,YAAM,WAAW,SAAS,cAAc;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,gBAAgB,QAAQ,QAAQ,iBAAiB;AACvD,UAAI,CAAC,OAAO,cAAc,aAAa,KAAK,gBAAgB,GAAG;AAC7D,gBAAQ,wCAAwC;AAAA,MAClD;AACA,UACE,CAAC,OAAO,cAAc,QAAQ,QAAQ,KAAK,KAC3C,QAAQ,QAAQ,QAAQ,KACxB,QAAQ,QAAQ,QAAQ,IACxB,SAAQ,oDAAoD;AAC9D,YAAM,QAAQ,QAAQ,QAAQ;AAC9B,UACE,UAAU,WAER,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,SAAS,IAAI,CAAC,GAEnD,SAAQ,6CAA6C;AACvD,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,YAAY,MAAM,OAAO,OAAO;AACtC,YAAM,eAAe,QAClB,OAAO,CAAC,SAAS,KAAK,KAAK,gBAAgB,QAAQ,SAAS,GAAG,EAC/D;AAAA,QACC,CAAC,SAAS,SAAS,KAAK,IAAI,SAAS,KAAK,KAAK,YAAY;AAAA,QAC3D;AAAA,MACF;AACF,UAAK,QAAQ,eAA0B,cAAc;AACnD,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,qCAAqC,QAAQ,YAAY,sBAAsB,YAAY;AAAA,UACpG,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,SAAS,QACN;AAAA,UAAO,CAAC,SACP,KAAK,KAAK,gBAAgB,QAAQ,SAAS,OAC3C,KAAK,KAAK,WAAW,kBACpB,CAAC,SAAS,MAAM,SAAS,KAAK,KAAK,UAAU;AAAA,QAChD,EACC,MAAM,GAAG,QAAQ,QAAQ,KAAK,EAC9B,IAAI,YAAY;AAAA,QACnB,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACF;;;AC1hBA,IAAMC,UAAS;AAqCf,SAASC,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAAS,YAAY,SAAwB;AAC3C,QAAM,IAAI,mBAAmB;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAASC,aACP,SACA,SACA,UACM;AACN,MAAI,YAAY,QAAQ,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AAC7E,IAAAD,SAAQ,kBAAkB,QAAQ,oBAAoB;AAAA,EACxD;AACA,QAAM,UAAU,OAAO,KAAK,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,SAAS,KAAK,CAAC;AAC/E,MAAI,QAAQ,SAAS,GAAG;AACtB,IAAAA,SAAQ,kBAAkB,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,EACzF;AACF;AAEA,SAASE,eACP,OACA,OACA,UAAU,MACF;AACR,MAAI,OAAO,UAAU,YAAY,CAAC,SAAS,MAAM,SAAS,SAAS;AACjE,IAAAF,SAAQ,kBAAkB,KAAK,aAAa;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAiC;AACxD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,qBAAqB,KAAK,CAAC;AAClE,SAAO,WAAW,OAAO,OAAO,OAAO,WAAW,KAAK,EAAE;AAAA,IAAK,CAAC,WAC7D,UACE,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,EACvB,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE,CACZ;AAAA,EACF;AACF;AAEA,SAAS,aAAa,OAAgB,OAAuB;AAC3D,QAAMG,UAASD,eAAc,OAAO,OAAO,EAAE;AAC7C,MAAI,CAACH,QAAO,KAAKI,OAAM,EAAG,CAAAH,SAAQ,kBAAkB,KAAK,oBAAoB;AAC7E,SAAOG;AACT;AAEA,SAAS,aAAa,mBAAmC;AACvD,SAAO,YAAY,kBAAkB,MAAM,UAAU,QAAQ,EAAE,CAAC;AAClE;AAEA,SAAS,WAAW,QAAwB;AAC1C,QAAM,SAAS;AACf,MAAI,CAAC,OAAO,WAAW,MAAM,EAAG,CAAAH,SAAQ,2CAA2C;AACnF,SAAOE,eAAc,OAAO,MAAM,OAAO,MAAM,GAAG,mBAAmB,GAAG;AAC1E;AAEA,SAAS,mBACP,OAC2B;AAC3B,MACE,CAAC,SACD,CAAC,CAAC,SAAS,QAAQ,SAAS,EAAE,SAAS,MAAM,OAAO,KACpD,CAAC,MAAM,QAAQ,MAAM,OAAO,KAC5B,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,SAAS,MACvB,MAAM,QAAQ,KAAK,CAAC,WAAW,OAAO,WAAW,YAAY,CAAC,UAAU,OAAO,SAAS,IAAI,KAC3F,MAAM,gBAAgB,WAEnB,CAAC,MAAM,QAAQ,MAAM,WAAW,KAChC,MAAM,YAAY,SAAS,MAC3B,MAAM,YAAY;AAAA,IAAK,CAAC,eACtB,OAAO,eAAe,YACtB,CAAC,cACD,WAAW,SAAS;AAAA,EACtB,GAEJ,CAAAF,SAAQ,oDAAoD;AAC9D,SAAO;AACT;AAOO,SAAS,wCACd,SACgC;AAChC,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,mBAAmB,QAAQ,oBAAoB,KAAK;AAC1D,MACE,CAAC,QAAQ,QACT,CAAC,QAAQ,kBAAkB,UAC3B,CAAC,OAAO,cAAc,gBAAgB,KACtC,mBAAmB,EACnB,CAAAA,SAAQ,4CAA4C;AAEtD,MAAI,YAAY,QAAQ,QAAQ;AAEhC,iBAAe,WAAc,WAAyC;AACpE,UAAM,WAAW;AACjB,QAAI;AACJ,gBAAY,IAAI,QAAc,CAAC,YAAY;AACzC,gBAAU;AAAA,IACZ,CAAC;AACD,UAAM;AACN,QAAI;AACF,aAAO,MAAM,UAAU;AAAA,IACzB,UAAE;AACA,cAAQ;AAAA,IACV;AAAA,EACF;AAEA,iBAAe,UACb,SACA,QACAI,SACA,YACe;AACf,IAAAH,aAAY,QAAQ,SAASG,SAAQ,GAAG,MAAM,UAAU;AACxD,gCAA4B,SAAS;AAAA,MACnC;AAAA,MACA,gBAAgB;AAAA,MAChB,mBAAmB;AAAA,MACnB,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,WAAW,SAAS,QAAQ,MAAM,IAAI,GAAG;AAC5C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,8BAA8B,QAAQ,MAAM,IAAI,iBAAiB,MAAM;AAAA,QAChF,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,CAAC,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAC5C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,UAAM,iBAAiB,OAAO;AAAA,EAChC;AAEA,iBAAe,kBACb,QACA,YACiC;AACjC,UAAM,WAAW,MAAM,QAAQ,MAAM,IAA8C;AAAA,MACjF,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,WAAW,MAAM;AAAA,IACzB,CAAC;AACD,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,SAAS,KAAK,WAAW,QAAQ,YAAY;AAC/C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,WAAS,WAAW,UAAkD;AACpE,QAAI,SAA+B,SAAS,UAAU;AAAA,MACpD,SAAS,SAAS,KAAK;AAAA,MACvB,WAAW,SAAS,KAAK;AAAA,MACzB,WAAW,SAAS,KAAK;AAAA,MACzB,SAAS,SAAS,KAAK;AAAA,IACzB;AACA,QACE,OAAO,YAAY,aACnB,SAAS,KAAK,YACd,KAAK,MAAM,SAAS,KAAK,SAAS,SAAS,KAAK,IAAI,EAAE,QAAQ,GAC9D;AACA,eAAS;AAAA,QACP,SAAS;AAAA,QACT,WAAW,SAAS,KAAK;AAAA,QACzB,WAAW,SAAS,KAAK,SAAS;AAAA,QAClC,SAAS,CAAC,sDAAsD;AAAA,MAClE;AAAA,IACF;AACA,WAAO;AAAA,MACL,gBAAgB,mBAAmB,SAAS,SAAS,IAAI;AAAA,MACzD,aAAa,SAAS,KAAK,WAAW;AAAA,MACtC,MAAM,SAAS,KAAK;AAAA,MACpB,SAAS,OAAO;AAAA,MAChB,cAAc,SAAS,KAAK;AAAA,MAC5B,aAAa,SAAS,KAAK;AAAA,MAC3B,SAAS,OAAO;AAAA,MAChB,SAAS,OAAO;AAAA,MAChB,aAAa,SAAS,KAAK;AAAA,MAC3B,WAAW,OAAO;AAAA,MAClB,GAAI,SAAS,KAAK,WACd;AAAA,QACA,UAAU;AAAA,UACR,GAAG,SAAS,KAAK;AAAA,UACjB,GAAI,OAAO,YAAY,YACnB;AAAA,YACA,WAAW,OAAO;AAAA,YAClB,YAAY,OAAO;AAAA,YACnB,GAAI,OAAO,wBACP,EAAE,uBAAuB,OAAO,sBAAsB,IACtD,CAAC;AAAA,UACP,IACE,CAAC;AAAA,QACP;AAAA,MACF,IACE,CAAC;AAAA,IACP;AAAA,EACF;AAEA,iBAAe,iBACb,SACe;AACf,UAAMC,aAAY,MAAM,QAAQ,MAAM,KAA+C;AAAA,MACnF,YAAY;AAAA,MACZ,MAAM;AAAA,IACR,CAAC;AACD,UAAM,UAAWA,WAAU,MACxB,OAAO,CAAC,SAAS,KAAK,KAAK,WAAW,QAAQ,QAAQ,SAAS,GAAG,EAClE;AAAA,MACC,CAAC,OAAO,SAAS,KAAK,IAAI,OAAO,KAAK,KAAK,YAAY;AAAA,MACvD;AAAA,IACF;AACF,QAAK,QAAQ,eAA0B,SAAS;AAC9C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,2DAA2D,OAAO;AAAA,QAC3E,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,iBAAe,QACb,SACA,MACA,cACA,YACA,UACyB;AACzB,iBAAa,cAAc,cAAc;AACzC,UAAM,aAAa,mBAAmB,UAAU;AAChD,WAAO,WAAW,YAAY;AAC5B,YAAM,iBAAiB,OAAO;AAC9B,YAAM,cAAc,MAAM,gBAAgB,QAAQ,OAAO;AACzD,YAAM,qBAAqB,MAAM,gBAAgB;AAAA,QAC/C,QAAQ,QAAQ;AAAA,QAChB,UAAU,QAAQ;AAAA,QAClB,cAAc,QAAQ;AAAA,QACtB,OAAO,QAAQ;AAAA,QACf,SAAS,QAAQ;AAAA,QACjB,qBAAqB,QAAQ;AAAA,QAC7B,qBAAqB,QAAQ;AAAA,QAC7B,SAAS,QAAQ;AAAA,MACnB,CAAC;AACD,YAAM,iBAAiB,MAAM,gBAAgB;AAAA,QAC3C,aAAa,QAAQ,SAAS;AAAA,QAC9B,QAAQ,QAAQ;AAAA,QAChB,gBAAgB,QAAQ;AAAA,MAC1B,CAAC;AACD,YAAM,OAAO,aAAa,cAAc;AACxC,YAAM,WAAW,MAAM,QAAQ,MAAM,IAA8C;AAAA,QACjF,YAAY;AAAA,QACZ,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AACD,UAAI,UAAU;AACZ,YACE,SAAS,KAAK,uBAAuB,sBACrC,SAAS,KAAK,iBAAiB,MAC/B;AACA,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,WAAW,QAAQ;AAAA,MAC5B;AACA,YAAM,YAAY,IAAI,EAAE,YAAY;AACpC,YAAM,WAAW,6BAA6B,MAAM;AAAA,QAClD,YAAY;AAAA,UACV,YAAY,QAAQ,SAAS;AAAA,UAC7B,MAAM,QAAQ,SAAS;AAAA,UACvB,MAAM,QAAQ,SAAS;AAAA,UACvB,KAAK,QAAQ,SAAS;AAAA,UACtB,YAAY,QAAQ,SAAS;AAAA,QAC/B;AAAA,QACA,cAAc;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,QACA,gBAAgB,QAAQ;AAAA,QACxB,cAAc,QAAQ;AAAA,QACtB,aAAa,QAAQ,MAAM;AAAA,QAC3B,SAAS,WAAW;AAAA,QACpB,aAAa,WAAW,eAAe,CAAC;AAAA,QACxC;AAAA,QACA,gBAAgB,WAAW;AAAA,QAC3B,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC,CAAC;AACD,UAAI;AACJ,UAAI;AACF,kBAAU,MAAM,QAAQ,MAAM;AAAA,UAC5B,QAAQ;AAAA,UACR;AAAA,UACA,EAAE,gBAAgB,kBAAkB,cAAc,GAAG;AAAA,QACvD;AAAA,MACF,SAASC,QAAO;AACd,cAAM,QAAQ,MAAM,QAAQ,MAAM,IAA8C;AAAA,UAC9E,YAAY;AAAA,UACZ,MAAM;AAAA,UACN;AAAA,QACF,CAAC;AACD,YAAI,CAAC,SAAS,MAAM,KAAK,uBAAuB,mBAAoB,OAAMA;AAC1E,eAAO,WAAW,KAAK;AAAA,MACzB;AACA,aAAO,WAAW,OAAO;AAAA,IAC3B,CAAC;AAAA,EACH;AAEA,QAAM,YAAkC,CAAC,UAAU;AACnD,MAAI,QAAQ,0BAA2B,WAAU,KAAK,oBAAoB;AAC1E,MAAI,QAAQ,kBAAmB,WAAU,KAAK,WAAW;AACzD,MAAI,QAAQ,sBAAuB,WAAU,KAAK,gBAAgB;AAClE,MAAI,QAAQ,mBAAoB,WAAU,KAAK,YAAY;AAE3D,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,aAAO;AAAA,QACL,MAAM,QAAQ;AAAA,QACd,WAAW,CAAC,GAAG,SAAS;AAAA,QACxB,gBAAgB;AAAA,QAChB,yBAAyB;AAAA,QACzB,qBAAqB;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,mBAAmB,CAAC,GAAG,QAAQ,iBAAiB;AAAA,MAClD;AAAA,IACF;AAAA,IACA,MAAM,cAAc,SAAS;AAC3B,YAAM,UAAU,SAAS,yBAAyB;AAAA,QAChD;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,CAAC,cAAc,OAAO,CAAC;AAC1B,UAAI,CAAC,QAAQ,2BAA2B;AACtC,oBAAY,8CAA8C;AAAA,MAC5D;AACA,YAAM,eAAe,aAAa,QAAQ,QAAQ,cAAc,cAAc;AAC9E,MAAAJ,eAAc,QAAQ,QAAQ,oBAAoB,oBAAoB;AACtE,MAAAA,eAAc,QAAQ,QAAQ,cAAc,cAAc;AAC1D,YAAM,aAAa,MAAM,QAAQ,0BAA0B,OAAO;AAClE,aAAO,QAAQ,SAAS,sBAAsB,cAAc,UAAU;AAAA,IACxE;AAAA,IACA,MAAM,mBAAmB,SAAS;AAChC,YAAM,UAAU,SAAS,8BAA8B;AAAA,QACrD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,CAAC,cAAc,OAAO,CAAC;AAC1B,UAAI,CAAC,QAAQ,mBAAmB;AAC9B,oBAAY,mDAAmD;AAAA,MACjE;AACA,YAAM,eAAe,aAAa,QAAQ,QAAQ,cAAc,cAAc;AAC9E,MAAAA,eAAc,QAAQ,QAAQ,QAAQ,QAAQ;AAC9C,UACE,CAAC,CAAC,WAAW,cAAc,YAAY,EAAE;AAAA,QACvC,QAAQ,QAAQ;AAAA,MAClB,KACA,CAAC,CAAC,WAAW,cAAc,YAAY,EAAE;AAAA,QACvC,QAAQ,QAAQ;AAAA,MAClB,KACA,OAAO,QAAQ,QAAQ,aAAa,aACpC,OAAO,QAAQ,QAAQ,4BAA4B,UACnD,CAAAF,SAAQ,sCAAsC;AAChD,YAAM,aAAa,MAAM,QAAQ,kBAAkB,OAAO;AAC1D,aAAO,QAAQ,SAAS,aAAa,cAAc,UAAU;AAAA,IAC/D;AAAA,IACA,MAAM,uBAAuB,SAAS;AACpC,YAAM,UAAU,SAAS,mCAAmC;AAAA,QAC1D;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,CAAC,cAAc,OAAO,CAAC;AAC1B,UAAI,CAAC,QAAQ,uBAAuB;AAClC,oBAAY,8CAA8C;AAAA,MAC5D;AACA,YAAM,eAAe,aAAa,QAAQ,QAAQ,cAAc,cAAc;AAC9E,MAAAE,eAAc,QAAQ,QAAQ,UAAU,UAAU;AAClD,YAAM,kBAAkB;AAAA,QACtB,QAAQ,QAAQ;AAAA,QAChB;AAAA,MACF;AACA,UACE,CAAC,CAAC,QAAQ,UAAU,UAAU,UAAU,WAAW,SAAS,EAAE;AAAA,QAC5D,QAAQ,QAAQ;AAAA,MAClB,EACA,CAAAF,SAAQ,gCAAgC;AAC1C,UAAI;AACJ,UAAI,QAAQ,QAAQ,2BAA2B,QAAW;AACxD,cAAM,WAAW,MAAM;AAAA,UACrBE;AAAA,YACE,QAAQ,QAAQ;AAAA,YAChB;AAAA,UACF;AAAA,UACA,QAAQ,SAAS;AAAA,QACnB;AACA,mBAAW,WAAW,QAAQ;AAC9B,YACE,SAAS,SAAS,cAClB,SAAS,YAAY,WACrB,SAAS,iBAAiB,gBAC1B,SAAS,UAAU,kBAAkB,mBACrC,KAAK,MAAM,SAAS,SAAS,SAAS,KAAK,IAAI,EAAE,QAAQ,GACzD;AACA,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,YAAM,aAAa,MAAM,QAAQ,sBAAsB,SAAS,QAAQ;AACxE,aAAO,QAAQ,SAAS,kBAAkB,cAAc,UAAU;AAAA,IACpE;AAAA,IACA,MAAM,gBAAgB,SAAS;AAC7B,YAAM,UAAU,SAAS,2BAA2B;AAAA,QAClD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,CAAC,cAAc,OAAO,CAAC;AAC1B,YAAM,eAAe,aAAa,QAAQ,QAAQ,cAAc,cAAc;AAC9E,YAAM,gBAAgB;AAAA,QACpB,QAAQ,QAAQ;AAAA,QAChB;AAAA,MACF;AACA,UACE,CAAC,CAAC,kBAAkB,YAAY,aAAa,YAAY,EAAE;AAAA,QACzD,QAAQ,QAAQ;AAAA,MAClB,KACA,CAAC,OAAO,cAAc,QAAQ,QAAQ,KAAK,KAC3C,QAAQ,QAAQ,QAAQ,KACxB,QAAQ,QAAQ,QAAQ,iBACxB,CAAAF,SAAQ,qCAAqC;AAC/C,MAAAE,eAAc,QAAQ,QAAQ,QAAQ,QAAQ;AAC9C,YAAM,cAAc,IAAI;AACxB,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,UACE,SAAS;AAAA,UACT,SAAS,CAAC,yDAAyD;AAAA,UACnE,aAAa,CAAC,+BAA+B;AAAA,QAC/C;AAAA,QACA;AAAA,UACE;AAAA,UACA,aAAa,QAAQ,MAAM;AAAA,UAC3B,aAAa,YAAY,YAAY;AAAA,UACrC,WAAW,IAAI;AAAA,YACb,YAAY,QAAQ,IAAI,QAAQ,QAAQ;AAAA,UAC1C,EAAE,YAAY;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,gBAAgB,SAAS;AAC7B,YAAM,UAAU,SAAS,2BAA2B;AAAA,QAClD;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,CAAC,OAAO,CAAC;AACZ,UAAI,QAAQ,QAAQ,YAAY,WAAW,QAAQ,QAAQ,YAAY,QAAQ;AAC7E,QAAAF,SAAQ,wCAAwC;AAAA,MAClD;AACA,YAAM,SAASE,eAAc,QAAQ,QAAQ,QAAQ,QAAQ;AAC7D,aAAO,WAAW,YAAY;AAC5B,cAAM,iBAAiB,OAAO;AAC9B,cAAM,WAAW,MAAM;AAAA,UACrBA;AAAA,YACE,QAAQ,QAAQ;AAAA,YAChB;AAAA,UACF;AAAA,UACA,QAAQ,SAAS;AAAA,QACnB;AACA,YAAI,SAAS,KAAK,iBAAiB,cAAc,CAAC,SAAS,KAAK,UAAU;AACxE,UAAAF,SAAQ,4CAA4C;AAAA,QACtD;AACA,YAAI,KAAK,MAAM,SAAS,KAAK,SAAS,SAAS,KAAK,IAAI,EAAE,QAAQ,GAAG;AACnE,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,cAAM,wBAAwB,MAAM,gBAAgB,QAAQ,OAAO;AACnE,cAAM,iBAAiB,SAAS,QAAQ,WACtC,SAAS,KAAK;AAChB,YAAI,mBAAmB,WAAW;AAChC,cACE,mBAAmB,QAAQ,QAAQ,WACnC,SAAS,QAAQ,0BAA0B,uBAC3C;AACA,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AACA,iBAAO,WAAW,QAAQ;AAAA,QAC5B;AACA,cAAM,SAA+B;AAAA,UACnC,SAAS,QAAQ,QAAQ;AAAA,UACzB,WAAW,QAAQ,MAAM;AAAA,UACzB,WAAW,IAAI,EAAE,YAAY;AAAA,UAC7B,SAAS,CAAC,MAAM;AAAA,UAChB;AAAA,QACF;AACA,cAAM,UAAU,MAAM,QAAQ,MAAM;AAAA,UAGlC,QAAQ;AAAA,UACR;AAAA,YACE,YAAY;AAAA,YACZ,MAAM;AAAA,YACN,MAAM,SAAS,SAAS;AAAA,UAC1B;AAAA,UACA;AAAA,UACA;AAAA,YACE,iBAAiB,SAAS,SAAS;AAAA,YACnC,gBAAgB,0BAA0B,SAAS,SAAS,GAAG,IAAI,QAAQ,cAAc;AAAA,UAC3F;AAAA,QACF;AACA,eAAO,WAAW,OAAO;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,IACA,MAAM,iBAAiB,SAAS;AAC9B,YAAM,UAAU,SAAS,4BAA4B;AAAA,QACnD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,CAAC,UAAU,CAAC;AACf,UAAI,CAAC,QAAQ,oBAAoB;AAC/B,oBAAY,mDAAmD;AAAA,MACjE;AACA,YAAM,eAAe,aAAa,QAAQ,QAAQ,cAAc,cAAc;AAC9E,MAAAE,eAAc,QAAQ,QAAQ,YAAY,YAAY;AACtD,MAAAA,eAAc,QAAQ,QAAQ,MAAM,MAAM;AAC1C,MAAAA,eAAc,QAAQ,QAAQ,IAAI,IAAI;AACtC,mBAAa,QAAQ,QAAQ,gBAAgB,gBAAgB;AAC7D,YAAM,aAAa,MAAM,QAAQ,mBAAmB,OAAO;AAC3D,aAAO,QAAQ,SAAS,cAAc,cAAc,UAAU;AAAA,IAChE;AAAA,IACA,MAAM,gBAAgB,SAAS;AAC7B,YAAM,UAAU,SAAS,2BAA2B,CAAC,gBAAgB,GAAG;AAAA,QACtE;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,WAAW,MAAM;AAAA,QACrBA,eAAc,QAAQ,QAAQ,gBAAgB,gBAAgB;AAAA,QAC9D,QAAQ,SAAS;AAAA,MACnB;AACA,YAAM,WAAW,WAAW,QAAQ;AACpC,aAAO;AAAA,QACL;AAAA,QACA,SAAS,GAAG,SAAS,IAAI,IAAI,SAAS,OAAO,KAAK,SAAS,QAAQ,KAAK,IAAI,CAAC;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;;;AC9lBA,eAAe,UAAU,SAAiB,aAAoC;AAC5E,MAAI,UAAU,EAAG,OAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,OAAO,CAAC;AAC5E,MAAI,KAAK,OAAO,IAAI,YAAa,OAAM,IAAI,MAAM,kBAAkB;AACrE;AAKO,SAAS,wBAAwB,UAA6B,CAAC,GAAkB;AACtF,QAAM,UAAU,QAAQ,aAAa;AACrC,QAAM,cAAc,QAAQ,eAAe;AAE3C,SAAO;AAAA,IACL,MAAM,kBAAsD;AAC1D,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,kBAAkB,CAAC,QAAQ;AAAA,QAC3B,kBAAkB;AAAA,MACpB;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,UAAkE;AAC9E,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO,EAAE,QAAQ,cAAc;AAAA,IACjC;AAAA,IACA,MAAM,MAAM,SAA0D;AACpE,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO,EAAE,QAAQ,cAAc;AAAA,IACjC;AAAA,IACA,MAAM,OAAO,SAAiB,UAAkE;AAC9F,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO,EAAE,QAAQ,cAAc;AAAA,IACjC;AAAA,IACA,MAAM,eAAe,OAAe,SAA+C;AACjF,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,QAAQ,SAAgC;AAC5C,YAAM,UAAU,SAAS,WAAW;AAAA,IACtC;AAAA,IACA,MAAM,YAA0C;AAC9C,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO,EAAE,SAAS,MAAM,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,IAC9D;AAAA,EACF;AACF;AAKO,SAAS,8BAA8B,UAA6B,CAAC,GAAwB;AAClG,QAAM,UAAU,QAAQ,aAAa;AACrC,QAAM,cAAc,QAAQ,eAAe;AAE3C,SAAO;AAAA,IACL,MAAM,aAAa;AACjB,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO,CAAC;AAAA,IACV;AAAA,IACA,MAAM,YAA0C;AAC9C,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO,EAAE,SAAS,MAAM,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,IAC9D;AAAA,IACA,OAAO,SAAS,UAAiE;AAC/E,YAAM,UAAU,SAAS,WAAW;AACpC,YAAM,EAAE,MAAM,SAAS,OAAO,gBAAgB;AAAA,IAChD;AAAA,EACF;AACF;AAKO,SAAS,8BAA8B,UAA6B,CAAC,GAAwB;AAClG,QAAM,UAAU,QAAQ,aAAa;AACrC,QAAM,cAAc,QAAQ,eAAe;AAE3C,SAAO;AAAA,IACL,MAAM,QAAQ,WAA2C;AACvD,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ,EAAE,OAAO,aAAa,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,cAAa,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,MAC3G;AAAA,IACF;AAAA,EACF;AACF;AAKA,eAAsB,oBACpB,OACA,QAC+F;AAC/F,QAAM,WAAmD,CAAC;AAE1D,aAAW,QAAQ,MAAM,OAAO;AAC9B,QAAI;AACF,YAAM,KAAK,IAAI,MAAM;AAAA,IACvB,SAASK,QAAO;AACd,eAAS,KAAK;AAAA,QACZ,MAAM,KAAK;AAAA,QACX,OAAOA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,MAAM,MAAM,SAAS,SAAS;AAAA,IACtC,QAAQ,SAAS;AAAA,IACjB;AAAA,EACF;AACF;AAKO,SAAS,sCAA8D;AAC5E,SAAO;AAAA,IACL,eAAe;AAAA,IACf,OAAO;AAAA,MACL;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,gBAAgB;AACtB,gBAAM,eAAe,MAAM,cAAc,gBAAgB;AACzD,cAAI,CAAC,aAAa,KAAM,OAAM,IAAI,MAAM,kBAAkB;AAC1D,cAAI,CAAC,aAAa,iBAAkB,OAAM,IAAI,MAAM,8BAA8B;AAAA,QACpF;AAAA,MACF;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,gBAAgB;AACtB,gBAAM,SAAS,MAAM,cAAc,QAAQ;AAAA,YACzC,YAAY;AAAA,cACV,YAAY;AAAA,cACZ,MAAM;AAAA,cACN,UAAU,EAAE,MAAM,QAAQ,WAAW,WAAW,KAAK,SAAS,YAAY,GAAG,iBAAiB,KAAK,mBAAmB,2BAA2B;AAAA,cACjJ,MAAM,EAAE,iBAAiB,EAAE,YAAY,gCAAgC,MAAM,gBAAgB,MAAM,UAAU,EAAE;AAAA,YACjH;AAAA,YACA,cAAc;AAAA,cACZ,YAAY;AAAA,cACZ,MAAM;AAAA,cACN,UAAU,EAAE,MAAM,WAAW,WAAW,WAAW,KAAK,SAAS,YAAY,GAAG,iBAAiB,KAAK,mBAAmB,2BAA2B;AAAA,cACpJ,MAAM,EAAE,QAAQ,uBAAuB,aAAa,cAAc;AAAA,YACpE;AAAA,YACA,YAAY;AAAA,UACd,CAAC;AACD,cAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,4BAA4B;AAAA,QAClE;AAAA,MACF;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,gBAAgB;AACtB,gBAAM,SAAS,MAAM,cAAc,UAAU;AAC7C,cAAI,OAAO,OAAO,YAAY,UAAW,OAAM,IAAI,MAAM,qBAAqB;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAKO,SAAS,4CAAoE;AAClF,SAAO;AAAA,IACL,eAAe;AAAA,IACf,OAAO;AAAA,MACL;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,cAAc;AACpB,gBAAM,SAAS,MAAM,YAAY,WAAW;AAC5C,cAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,MAAM,8BAA8B;AAAA,QAC5E;AAAA,MACF;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,cAAc;AACpB,gBAAM,SAAS,MAAM,YAAY,UAAU;AAC3C,cAAI,OAAO,OAAO,YAAY,UAAW,OAAM,IAAI,MAAM,qBAAqB;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAKO,SAAS,4CAAoE;AAClF,SAAO;AAAA,IACL,eAAe;AAAA,IACf,OAAO;AAAA,MACL;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,aAAa;AACnB,gBAAM,YAAmC;AAAA,YACvC,YAAY;AAAA,YACZ,MAAM;AAAA,YACN,UAAU,EAAE,MAAM,QAAQ,WAAW,WAAW,KAAK,SAAS,YAAY,GAAG,iBAAiB,KAAK,mBAAmB,2BAA2B;AAAA,YACjJ,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,YAAY,GAAG,QAAQ,UAAU;AAAA,UAC1E;AACA,gBAAM,SAAS,MAAM,WAAW,QAAQ,SAAS;AACjD,cAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,4BAA4B;AAChE,cAAI,CAAC,OAAO,OAAO,MAAO,OAAM,IAAI,MAAM,0BAA0B;AAAA,QACtE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAQO,SAAS,kDAAkD,SAIvC;AACzB,QAAM,QAAQ,QAAQ,SAAS,EAAE,IAAI,mCAAmC,MAAM,aAAa;AAC3F,SAAO;AAAA,IACL,eAAe;AAAA,IACf,OAAO;AAAA,MACL;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,WAAW;AACjB,gBAAM,CAAC,cAAc,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,YAC/C,SAAS,gBAAgB;AAAA,YACzB,SAAS,UAAU;AAAA,UACrB,CAAC;AACD,qBAAW,QAAQ,CAAC,iBAAiB,eAAe,GAAY;AAC9D,gBAAI,CAAC,aAAa,QAAQ,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,8BAA8B,IAAI,EAAE;AAAA,UAChG;AACA,cAAI,CAAC,aAAa,iBAAkB,OAAM,IAAI,MAAM,iCAAiC;AACrF,cAAI,OAAO,OAAO,YAAY,aAAa,CAAC,OAAO,UAAW,OAAM,IAAI,MAAM,uBAAuB;AAAA,QACvG;AAAA,MACF;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,WAAW;AACjB,gBAAM,WAAW,QAAQ,eAAe,+BAA+B;AACvE,gBAAM,QAAQ,MAAM,SAAS,cAAc,UAAU,KAAK;AAC1D,cAAI,CAAC,MAAM,WAAY,OAAM,IAAI,MAAM,qCAAqC;AAC5E,gBAAM,SAAS,MAAM,SAAS,cAAc,UAAU,KAAK;AAC3D,cAAI,OAAO,eAAe,MAAM,WAAY,OAAM,IAAI,MAAM,wCAAwC;AACpG,gBAAM,SAAS,MAAM,SAAS,kBAAkB,MAAM,UAAU;AAChE,cAAI,OAAO,eAAe,MAAM,WAAY,OAAM,IAAI,MAAM,mCAAmC;AAC/F,gBAAM,SAAS,MAAM,SAAS,cAAc;AAC5C,cAAI,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,eAAe,MAAM,UAAU,GAAG;AAClE,kBAAM,IAAI,MAAM,4CAA4C;AAAA,UAC9D;AACA,gBAAM,SAAS,aAAa,MAAM,YAAY,KAAK;AAAA,QACrD;AAAA,MACF;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,WAAW;AACjB,gBAAM,YAAY,QAAQ,oBAAoB,2BAA2B;AACzE,gBAAM,QAAQ,MAAM,SAAS,qBAAqB,WAAW,KAAK;AAClE,cAAI,CAAC,MAAM,WAAY,OAAM,IAAI,MAAM,qCAAqC;AAC5E,gBAAM,SAAS,MAAM,SAAS,qBAAqB,WAAW,KAAK;AACnE,cAAI,OAAO,eAAe,MAAM,WAAY,OAAM,IAAI,MAAM,oCAAoC;AAChG,gBAAM,SAAS,MAAM,SAAS,uBAAuB,MAAM,UAAU;AACrE,cAAI,OAAO,eAAe,MAAM,WAAY,OAAM,IAAI,MAAM,+BAA+B;AAC3F,gBAAM,SAAS,MAAM,SAAS,mBAAmB;AACjD,cAAI,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,eAAe,MAAM,UAAU,GAAG;AAClE,kBAAM,IAAI,MAAM,uDAAuD;AAAA,UACzE;AACA,gBAAM,SAAS,oBAAoB,MAAM,YAAY,KAAK;AAAA,QAC5D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;AChUA,eAAe,cAAc,SAA2B,SAAgC;AACtF,MAAI;AACF,UAAM;AAAA,EACR,QAAQ;AACN;AAAA,EACF;AACA,QAAM,IAAI,MAAM,OAAO;AACzB;AAEA,eAAe,eAAe,SAA2B,SAAgC;AACvF,MAAI;AACF,UAAM;AAAA,EACR,SAASC,QAAO;AACd,UAAM,IAAI,MAAM,GAAG,OAAO,KAAKA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK,CAAC,EAAE;AAAA,EACzF;AACF;AAuBO,SAAS,sBAAwC,QAAW,MAA8B,MAA2D;AAC1J,QAAM,eAAsC,CAAC;AAC7C,QAAM,QAAQ,IAAI,MAAM,QAAQ;AAAA,IAC9B,IAAI,QAAQ,UAAU,UAAU;AAC9B,YAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,QAAQ;AACpD,UAAI,OAAO,UAAU,cAAc,OAAO,aAAa,SAAU,QAAO;AACxE,aAAO,UAAU,eAA0B;AACzC,cAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC1C,YAAI;AACF,gBAAM,SAAS,MAAO,MAA0D,MAAM,QAAQ,UAAU;AACxG,uBAAa,KAAK,EAAE,QAAQ,UAAU,WAAW,YAAY,QAAQ,WAAW,CAAC;AACjF,iBAAO;AAAA,QACT,SAASA,QAAO;AACd,uBAAa,KAAK;AAAA,YAChB,QAAQ;AAAA,YACR,WAAW;AAAA,YACX,OAAOA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,YAC5D;AAAA,UACF,CAAC;AACD,gBAAMA;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,SAAS,OAAO,EAAE,MAAM,YAAY,MAAM,cAAc,CAAC,GAAG,YAAY,EAAE;AAAA,EAC5E;AACF;AAOO,SAAS,sBAAsB,SAAiD;AACrF,MAAI,SAAS;AACb,SAAO,IAAI,MAAM,CAAC,GAA8B;AAAA,IAC9C,IAAI,SAAS,UAAU;AACrB,UAAI,OAAO,aAAa,SAAU,QAAO;AACzC,aAAO,UAAU,eAA0B;AACzC,cAAM,cAAc,QAAQ,aAAa,MAAM;AAC/C,YAAI,CAAC,aAAa;AAChB,gBAAM,IAAI,MAAM,iDAAiD,QAAQ,EAAE;AAAA,QAC7E;AACA,YAAI,YAAY,WAAW,UAAU;AACnC,gBAAM,IAAI,MAAM,6BAA6B,YAAY,MAAM,SAAS,QAAQ,EAAE;AAAA,QACpF;AACA,kBAAU;AACV,YAAI,YAAY,MAAO,OAAM,IAAI,MAAM,YAAY,KAAK;AACxD,eAAO,YAAY;AAAA,MACrB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAQO,SAAS,sBACd,UACA,UACU;AACV,QAAM,UAAoB,CAAC;AAC3B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,QAAI,SAAS,GAAG,MAAM,OAAO;AAC3B,cAAQ,KAAK,GAAG;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,iCAAiC,SAGrB;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,WAAW,MAAM,QAAQ,gBAAgB,MAAM;AACrD,cAAM,UAAU,sBAAsB,UAAU,QAAQ,oBAAoB;AAC5E,YAAI,QAAQ,SAAS,GAAG;AACtB,gBAAM,IAAI,MAAM,kCAAkC,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,QACxE;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,WAAW,MAAM,QAAQ,gBAAgB,MAAM;AACrD,cAAM,UAAU,sBAAsB,UAAU,EAAE,qCAAqC,KAAK,CAAC;AAC7F,YAAI,QAAQ,WAAW,GAAG;AACxB,gBAAM,IAAI,MAAM,8CAA8C;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAIO,SAAS,wBAAwB,SAEZ;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,aAAa,IAAI,gBAAgB;AACvC,cAAM,UAAU,QAAQ,mBAAmB,QAAQ,WAAW,MAAM;AACpE,mBAAW,MAAM;AACjB,cAAM,cAAc,SAAS,oCAAoC;AAAA,MACnE;AAAA,IACF;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,aAAa,IAAI,gBAAgB;AACvC,cAAM,eAAe,QAAQ,mBAAmB,QAAQ,WAAW,MAAM,GAAG,0CAA0C;AAAA,MACxH;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,wBAAwB,SAGZ;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,WAAW,MAAM,KAAK,EAAE,QAAQ,QAAQ,mBAAmB,EAAE,GAAG,MAAM,QAAQ,OAAO,MAAM,CAAC;AAClG,cAAM,UAAU,MAAM,QAAQ,WAAW,QAAQ;AACjD,cAAM,WAAW,QAAQ,OAAO,CAAC,WAAW,OAAO,WAAW,UAAU;AAExE,YAAI,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,mBAAmB,GAAG;AAC1E,gBAAM,IAAI,MAAM,4DAA4D;AAAA,QAC9E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAIO,SAAS,oBAAoB,SAIR;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,aAAa,MAAM,QAAQ,eAAe,MAAM;AACtD,cAAM,YAAY,QAAQ,eAAe;AACzC,cAAM,UAAU,MAAM,QAAQ,cAAc,SAAS;AACrD,YAAI,CAAC,QAAQ,SAAS,UAAU,GAAG;AACjC,gBAAM,IAAI,MAAM,2CAA2C,UAAU,EAAE;AAAA,QACzE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAIO,SAAS,uBAAuB,SAEX;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,MAAM,QAAQ,KAAK,IAAI,CAAC;AAC9B,cAAM,QAAQ,MAAM,QAAQ,yBAAyB,QAAQ,GAAG;AAChE,cAAM,SAAS,MAAM,QAAQ,yBAAyB,QAAQ,GAAG;AACjE,YAAI,KAAK,UAAU,KAAK,MAAM,KAAK,UAAU,MAAM,GAAG;AACpD,gBAAM,IAAI,MAAM,mDAAmD;AAAA,QACrE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,mBAAmB,SAEP;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,QAAQ,iBAAiB,QAAQ,CAAC;AACxC,cAAM,cAAc,QAAQ,iBAAiB,QAAQ,CAAC,GAAG,oCAAoC;AAAA,MAC/F;AAAA,IACF;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,QAAQ,iBAAiB,QAAQ,EAAE;AACzC,cAAM,eAAe,QAAQ,iBAAiB,QAAQ,EAAE,GAAG,wCAAwC;AAAA,MACrG;AAAA,IACF;AAAA,EACF;AACF;AAIO,SAAS,qBAAqB,SAGT;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,cAAc,QAAQ,gBAAgB,QAAQ,MAAM,GAAG,sCAAsC;AAAA,MACrG;AAAA,IACF;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,eAAe,QAAQ,gBAAgB,QAAQ,QAAQ,gBAAgB,GAAG,oCAAoC;AAAA,MACtH;AAAA,IACF;AAAA,EACF;AACF;AAIO,SAAS,oBAAoB,SAIR;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,cAAc,QAAQ,YAAY,QAAQ,QAAQ,mBAAmB,GAAG,qCAAqC;AAAA,MACrH;AAAA,IACF;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,eAAe,QAAQ,YAAY,QAAQ,QAAQ,iBAAiB,GAAG,mCAAmC;AAAA,MAClH;AAAA,IACF;AAAA,EACF;AACF;;;ACxTA,IAAM,wBAAwB;AAS9B,SAAS,SAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,yBAAyB,OAAiD;AACjF,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAC7B,SACE,OAAO,MAAM,SAAS,YACtB,0BAA0B,SAAS,MAAM,IAAsC,KAC/E,OAAO,MAAM,YAAY,YACzB,OAAO,MAAM,cAAc,cAC1B,MAAM,iBAAiB,UACrB,OAAO,MAAM,iBAAiB,YAAY,OAAO,SAAS,MAAM,YAAY,OAC9E,MAAM,WAAW,UAAa,OAAO,MAAM,WAAW,cACtD,MAAM,YAAY,UAAa,SAAS,MAAM,OAAO;AAE1D;AAGO,SAAS,2BAA2B,SAAoD;AAC7F,QAAM,SAAS,QAAQ,YAAY,qBAAqB;AACxD,MAAI,SAAS,EAAG,QAAO;AACvB,QAAM,OAAO,QACV,MAAM,SAAS,sBAAsB,MAAM,EAC3C,MAAM,SAAS,CAAC,EAAE,CAAC,GAClB,KAAK;AACT,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,UAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAC7B,QAAI,MAAM,UAAU,eAAe,MAAM,UAAU,YAAY,MAAM,UAAU,aAAa;AAC1F,aAAO;AAAA,IACT;AACA,QAAI,MAAM,YAAY,UAAa,OAAO,MAAM,YAAY,SAAU,QAAO;AAC7E,QACE,MAAM,WAAW,WAChB,CAAC,SAAS,MAAM,MAAM,KACpB,MAAM,OAAO,UAAU,UAAa,CAAC,yBAAyB,MAAM,OAAO,KAAK,KAChF,MAAM,OAAO,gBAAgB,UAAa,OAAO,MAAM,OAAO,gBAAgB,WACjF;AACA,aAAO;AAAA,IACT;AACA,QAAI,MAAM,UAAU,UAAa,CAAC,yBAAyB,MAAM,KAAK,EAAG,QAAO;AAChF,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC9DA,SAAS,WAAkC;AAC3C,SAAS,eAAe;AACxB,SAAS,eAAe;AA0BxB,IAAM,mBAAmB;AAAA,EACvB,WAAW;AAAA,EACX,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,iBAAiB;AACnB;AACA,IAAM,eAAe,oBAAI,IAAyB;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAASC,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAAS,YAAY,QAA0D;AAC7E,UAAQ,OAAO,SAAS;AAAA,IACtB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,4CAA4C;AAC/C,aAAO,IAAI,IAAI,gBAAgB;AAAA,IACjC;AAAA,IACA,KAAK,gDAAgD;AACnD,aAAO,IAAI,QAAQ,gBAAgB;AAAA,IACrC;AAAA,IACA,KAAK,gDAAgD;AACnD,aAAO,IAAI,QAAQ,gBAAgB;AAAA,IACrC;AAAA,IACA,SAAS;AACP,MAAAA,SAAQ,yDAAyD,OAAO,OAAO,OAAO,CAAC,GAAG;AAAA,IAC5F;AAAA,EACF;AACF;AAEA,SAAS,cACP,UACA,QACA,WACkB;AAClB,MACE,OAAO,SAAS,SAAS,YACzB,SAAS,KAAK,WAAW,KACzB,OAAO,SAAS,SAAS,YACzB,SAAS,KAAK,WAAW,KACzB,CAAC,aAAa,IAAI,SAAS,MAAM,KACjC,CAAC,MAAM,QAAQ,SAAS,aAAa,KACrC,SAAS,cAAc,WAAW,KAClC,SAAS,cAAc,KAAK,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,WAAW,CAAC,KACtF,CAAC,SAAS,aACV,CAAC,OAAO,cAAc,SAAS,UAAU,aAAa,KACtD,SAAS,UAAU,gBAAgB,KACnC,CAAC,OAAO,cAAc,SAAS,UAAU,WAAW,KACpD,SAAS,UAAU,cAAc,GACjC;AACA,IAAAA,SAAQ,2BAA2B,SAAS,IAAI,iBAAiB;AAAA,EACnE;AACA,MAAI;AACF,WAAO,YAAY,MAAM,EAAE,QAAQ,MAAM;AAAA,EAC3C,QAAQ;AACN,IAAAA,SAAQ,2BAA2B,SAAS,IAAI,oBAAoB,SAAS,SAAS;AAAA,EACxF;AACF;AAGO,SAAS,4BACd,WACM;AACN,QAAM,aAAa,oBAAI,IAAY;AACnC,aAAW,YAAY,WAAW;AAChC,QAAI,aAAa,QAAQ,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,GAAG;AAChF,MAAAA,SAAQ,0CAA0C;AAAA,IACpD;AACA,UAAM,WAAW,GAAG,SAAS,IAAI,KAAK,SAAS,IAAI;AACnD,QAAI,WAAW,IAAI,QAAQ,GAAG;AAC5B,MAAAA,SAAQ,2BAA2B,SAAS,IAAI,IAAI,SAAS,IAAI,iBAAiB;AAAA,IACpF;AACA,eAAW,IAAI,QAAQ;AACvB,kBAAc,UAAU,SAAS,aAAa,OAAO;AACrD,kBAAc,UAAU,SAAS,cAAc,QAAQ;AAAA,EACzD;AACF;AAMO,SAAS,oCACd,WACA,WACA,cACsB;AACtB,QAAM,WAAW,aAAa,CAAC,GAAG;AAAA,IAAO,CAAC,cACxC,UAAU,SAAS,UAAU,KAAK,QAAQ,QAC1C,UAAU,SAAS,UAAU,KAAK,QAAQ;AAAA,EAC5C;AACA,MAAI,QAAQ,WAAW,GAAG;AACxB,IAAAA;AAAA,MACE,kBAAkB,UAAU,KAAK,QAAQ,IAAI,IAAI,UAAU,KAAK,QAAQ,IAAI;AAAA,IAC9E;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,CAAC;AAC1B,MAAI,UAAU,KAAK,WAAW,SAAS,QAAQ;AAC7C,IAAAA;AAAA,MACE,kBAAkB,SAAS,IAAI,aAAa,UAAU,KAAK,MAAM,mCAAmC,SAAS,MAAM;AAAA,IACrH;AAAA,EACF;AACA,MACE,UAAU,KAAK,QAAQ,iBAAiB,UACxC,UAAU,KAAK,QAAQ,iBAAiB,SAAS,cACjD;AACA,IAAAA,SAAQ,kBAAkB,SAAS,IAAI,kDAAkD;AAAA,EAC3F;AACA,MAAI,iBAAiB,UAAa,CAAC,SAAS,cAAc,SAAS,YAAY,GAAG;AAChF,IAAAA,SAAQ,kBAAkB,YAAY,wCAAwC,SAAS,IAAI,GAAG;AAAA,EAChG;AACA,QAAM,WAAW,cAAc,UAAU,SAAS,aAAa,OAAO;AACtE,MAAI,CAAC,SAAS,UAAU,KAAK,aAAa,CAAC,CAAC,GAAG;AAC7C,IAAAA,SAAQ,kBAAkB,SAAS,IAAI,4CAA4C;AAAA,EACrF;AACA,SAAO;AACT;AAGO,SAAS,kCACd,UACA,OACM;AACN,QAAM,WAAW,cAAc,UAAU,SAAS,cAAc,QAAQ;AACxE,MAAI,CAAC,SAAS,KAAK,GAAG;AACpB,IAAAA,SAAQ,kBAAkB,SAAS,IAAI,2CAA2C;AAAA,EACpF;AACF;AAGO,SAAS,0CAA0C,cAA8C;AACtG,SAAO,CAAC;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,aAAa,EAAE,MAAM,UAAU,sBAAsB,MAAM;AAAA,IAC3D,cAAc;AAAA,MACZ,MAAM;AAAA,MACN,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,EAAE;AAAA,MAC3C,UAAU,CAAC,SAAS;AAAA,MACpB,sBAAsB;AAAA,IACxB;AAAA,IACA,WAAW,EAAE,eAAe,KAAK,aAAa,MAAM,OAAO,KAAK;AAAA,IAChE,eAAe,CAAC,YAAY;AAAA,EAC9B,GAAG;AAAA,IACD,MAAM;AAAA,IACN,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,aAAa,EAAE,MAAM,SAAS;AAAA,IAC9B,cAAc,EAAE,MAAM,SAAS;AAAA,IAC/B,WAAW,EAAE,eAAe,KAAK,aAAa,MAAM,OAAO,KAAK;AAAA,IAChE,eAAe,CAAC,YAAY;AAAA,EAC9B,CAAC;AACH;;;AC3LA,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAC/B,IAAM,4BAA4B;AAkBlC,SAASC,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAASC,UAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEO,SAAS,uCACd,WACM;AACN,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,YAAY,WAAW;AAChC,QAAI,aAAa,QAAQ,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,GAAG;AAChF,MAAAD,SAAQ,sDAAsD;AAAA,IAChE;AACA,QACE,OAAO,SAAS,iBAAiB,YACjC,SAAS,aAAa,WAAW,KACjC,OAAO,SAAS,UAAU,YAC1B,SAAS,MAAM,WAAW,GAC1B;AACA,MAAAA,SAAQ,oEAAoE;AAAA,IAC9E;AACA,QACE,CAAC,OAAO,cAAc,SAAS,WAAW,aAAa,KACvD,SAAS,UAAU,gBAAgB,KACnC,CAAC,OAAO,cAAc,SAAS,WAAW,WAAW,KACrD,SAAS,UAAU,cAAc,GACjC;AACA,MAAAA;AAAA,QACE,mCAAmC,SAAS,YAAY;AAAA,MAC1D;AAAA,IACF;AACA,QAAI,QAAQ,IAAI,SAAS,YAAY,GAAG;AACtC,MAAAA,SAAQ,mCAAmC,SAAS,YAAY,iBAAiB;AAAA,IACnF;AACA,YAAQ,IAAI,SAAS,YAAY;AACjC,QAEI,SAAS,YAAY,WAEnB,CAAC,MAAM,QAAQ,SAAS,OAAO,KAC/B,SAAS,QAAQ,KAAK,CAAC,aAAa,OAAO,aAAa,QAAQ,MAIlE,SAAS,gBAAgB,UACzB,CAACC,UAAS,SAAS,WAAW,KAEhC,OAAO,QAAQ,SAAS,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,OAAO,UAAU,YAAY,IAAI,WAAW,WAAW,CAAC,GAClI;AACA,MAAAD,SAAQ,mCAAmC,SAAS,YAAY,sCAAsC;AAAA,IACxG;AAAA,EACF;AACF;AAMO,SAAS,+BACd,UACA,WACiC;AACjC,QAAM,cAAc,SAAS,SAAS;AACtC,MACE,cAAc,wBAAwB,MAAM,UAC5C,cAAc,0BAA0B,MAAM,UAC9C,cAAc,sBAAsB,MAAM,UAC1C,cAAc,sBAAsB,MAAM,UAC1C,cAAc,yBAAyB,MAAM,QAC7C;AACA,IAAAA;AAAA,MACE;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,SAAS,KAAK,gBAAgB;AACnD,QAAM,WAAW,aAAa,CAAC,GAAG,OAAO,CAAC,cAAc,UAAU,iBAAiB,YAAY;AAC/F,MAAI,QAAQ,WAAW,GAAG;AACxB,IAAAA,SAAQ,+BAA+B,YAAY,0CAA0C;AAAA,EAC/F;AACA,SAAO,QAAQ,CAAC;AAClB;AAGO,SAAS,iCACd,UACA,UACmC;AACnC,QAAM,YAAY,SAAS,KAAK;AAChC,OACG,WAAW,YAAY,KAAK,MAC5B,WAAW,aAAa,KAAK,MAC7B,WAAW,iBAAiB,KAAK,GAClC;AACA,IAAAA;AAAA,MACE,0BAA0B,SAAS,YAAY;AAAA,IACjD;AAAA,EACF;AACA,QAAM,gBAAgB,WAAW,iBAC/B,SAAS,UAAU;AACrB,QAAM,cAAc,WAAW,eAAe,SAAS,UAAU;AACjE,MACE,CAAC,OAAO,cAAc,aAAa,KACnC,gBAAgB,KAChB,gBAAgB,SAAS,UAAU,iBACnC,CAAC,OAAO,cAAc,WAAW,KACjC,cAAc,KACd,cAAc,SAAS,UAAU,aACjC;AACA,IAAAA;AAAA,MACE,sEAAsE,SAAS,YAAY;AAAA,IAC7F;AAAA,EACF;AACA,SAAO,EAAE,eAAe,YAAY;AACtC;;;ACrGA,SAAS,kBAAkB,MAAsB;AAC/C,SAAO,KAAK,YAAY,EAAE,QAAQ,iBAAiB,GAAG,EAAE,QAAQ,YAAY,EAAE,KAAK;AACrF;AAOA,eAAsB,4BACpB,QACA,SACkC;AAClC,QAAM,CAAC,QAAQ,MAAM,IAAI,MAAM,QAAQ,IAAI,CAAC,OAAO,WAAW,GAAG,OAAO,UAAU,CAAC,CAAC;AACpF,QAAM,SAAS,QAAQ,kBAAkB,WAAW,QAAQ,MAAM;AAElE,QAAM,eAAqC,CAAC;AAC5C,QAAM,YAAqC,CAAC;AAE5C,aAAW,SAAS,QAAQ;AAC1B,UAAM,WAAW,kBAAkB,GAAG,MAAM,QAAQ,IAAI,MAAM,KAAK,EAAE;AACrE,iBAAa,KAAK,yBAAyB,UAAU,KAAK,CAAC;AAC3D,cAAU,KAAK,4BAA4B,GAAG,QAAQ,IAAI,kBAAkB,QAAQ,MAAM,CAAC,IAAI;AAAA,MAC7F,eAAe,EAAE,YAAY,yBAAyB,MAAM,kBAAkB,MAAM,SAAS;AAAA,MAC7F,GAAI,MAAM,SAAS,EAAE,aAAa,MAAM,OAAO,IAAI,CAAC;AAAA,MACpD,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,UAAU,GAAG,MAAM,IAAI,MAAM,QAAQ,IAAI,MAAM,KAAK;AAAA,MACpD,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,MACzD,GAAI,QAAQ,aAAa,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;AAAA,IACjE,CAAC,CAAC;AAAA,EACJ;AAEA,SAAO,EAAE,cAAc,WAAW,OAAO;AAC3C;AAIA,IAAM,aAAiD;AAAA,EACrD,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS;AACX;AA4BO,SAAS,oBACd,WACA,cAC8B;AAC9B,QAAM,mBAAmB,WAAW,aAAa,gBAAgB,YAAY;AAC7E,QAAM,iBAAiB,aAAa,kBAAkB;AAEtD,QAAM,aAAa,UAAU,OAAO,CAAC,EAAE,UAAU,OAAO,MAAM;AAC5D,QAAI,SAAS,KAAK,cAAc,SAAS,aAAa,eAAgB,QAAO;AAC7E,QAAI,aAAa,eAAe,SAAS,KAAK,gBAAgB,aAAa,YAAa,QAAO;AAC/F,UAAM,YAAY,WAAW,SAAS,KAAK,SAAS,YAAY;AAChE,QAAI,YAAY,iBAAkB,QAAO;AACzC,QAAI,kBAAkB,QAAQ,YAAY,MAAO,QAAO;AACxD,QAAI,aAAa,kBAAkB,QAAW;AAC5C,YAAM,WAAW,SAAS,KAAK,UAAU,iBAAiB;AAC1D,UAAI,WAAW,aAAa,cAAe,QAAO;AAAA,IACpD;AACA,WAAO;AAAA,EACT,CAAC;AAED,aAAW,KAAK,CAAC,GAAG,OAAO,EAAE,SAAS,KAAK,UAAU,iBAAiB,MAAM,EAAE,SAAS,KAAK,UAAU,iBAAiB,EAAE;AAEzH,SAAO,WAAW,CAAC,GAAG,YAAY;AACpC;;;ACjGA,SAASE,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAASC,aACP,SACA,SACA,UACM;AACN,MAAI,YAAY,QAAQ,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AAC7E,IAAAD,SAAQ,oBAAoB,QAAQ,oBAAoB;AAAA,EAC1D;AACA,QAAM,UAAU,OAAO,KAAK,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,SAAS,KAAK,CAAC;AAC/E,MAAI,QAAQ,SAAS,GAAG;AACtB,IAAAA;AAAA,MACE,oBAAoB,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,CAAC;AAAA,IACjF;AAAA,EACF;AACF;AAEA,IAAM,wBAAwB,oBAAI,IAAI;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,sBAAsB,SAGtB;AACP,MAAI,CAAC,wBAAwB,KAAK,QAAQ,YAAY,GAAG;AACvD,IAAAA,SAAQ,kEAAkE;AAAA,EAC5E;AACA,MACE,CAAC,MAAM,QAAQ,QAAQ,YAAY,KACnC,QAAQ,aAAa,SAAS,KAC9B,QAAQ,aAAa,SAAS,sBAAsB,QACpD,IAAI,IAAI,QAAQ,YAAY,EAAE,SAAS,QAAQ,aAAa,UAC5D,QAAQ,aAAa;AAAA,IAAK,CAAC,gBACzB,OAAO,gBAAgB,YACvB,CAAC,sBAAsB,IAAI,WAAW;AAAA,EACxC,EACA,CAAAA,SAAQ,2CAA2C;AACvD;AAUO,SAAS,mCACd,SAC0B;AAC1B,MACE,CAAC,QAAQ,QACT,CAAC,QAAQ,kBAAkB,QAC3B;AACA,IAAAA;AAAA,MACE;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,mCAAmC;AAAA,IAChD,OAAO,QAAQ;AAAA,IACf,WAAW,QAAQ;AAAA,IACnB,UAAU,QAAQ;AAAA,IAClB,KAAK,QAAQ;AAAA,IACb,kBAAkB,QAAQ;AAAA,IAC1B,cAAc;AAAA,MACZ,MAAM,QAAQ;AAAA,MACd,qBAAqB,QAAQ;AAAA,MAC7B,aAAa,QAAQ;AAAA,MACrB,mBAAmB,QAAQ;AAAA,IAC7B;AAAA,IACA,qBAAqB,QAAQ;AAAA,EAC/B,CAAC;AAED,MAAI,OAAsB,QAAQ,QAAQ;AAE1C,iBAAe,UAAa,QAAsC;AAChE,QAAI;AACJ,UAAM,WAAW;AACjB,WAAO,IAAI,QAAc,CAAC,YAAY;AACpC,gBAAU;AAAA,IACZ,CAAC;AACD,UAAM;AACN,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,OAAO;AAAA,IACxB,SAASE,QAAO;AACd,uBAAiBA;AAAA,IACnB;AACA,QAAI;AACF,YAAM,QAAQ,aAAa,gCAAgC,QAAQ,KAAK,CAAC;AAAA,IAC3E,SAASA,QAAO;AACd,cAAQ;AACR,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,uDAAuDA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK,CAAC;AAAA,QACtH,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,YAAQ;AACR,QAAI,mBAAmB,QAAW;AAChC,UAAI,0BAA0B,MAAO,OAAM;AAC3C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,UACb,SACAC,SACe;AACf,IAAAF,aAAY,QAAQ,SAASE,SAAQ,GAAG,QAAQ,MAAM,UAAU;AAChE,QAAI,CAAC,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAC5C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,iBAAiB,MAAM,OAAO,gBAAgB;AAAA,IAC9C,MAAM,IAAI,SAAS,SAAS;AAC1B,YAAM,UAAU,SAAS;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,UACE,QAAQ,QAAQ,wBAAwB,UACxC,CAAC,wBAAwB,KAAK,QAAQ,QAAQ,mBAAmB,EACjE,CAAAH,SAAQ,iDAAiD;AAC3D,UACE,OAAO,QAAQ,QAAQ,aAAa,YACpC,QAAQ,QAAQ,SAAS,SAAS,OAClC,CAAC,4CAA4C;AAAA,QAC3C,QAAQ,QAAQ;AAAA,MAClB,EACA,CAAAA,SAAQ,sCAAsC;AAChD,UACE,QAAQ,QAAQ,mBAAmB,WAEjC,OAAO,QAAQ,QAAQ,mBAAmB,YAC1C,CAAC,QAAQ,QAAQ,kBACjB,QAAQ,QAAQ,eAAe,SAAS,KAE1C,CAAAA,SAAQ,4CAA4C;AACtD,YAAM,UAAU,QAAQ,QAAQ,uBAAuB,CAAC;AACxD,UACE,CAAC,MAAM,QAAQ,OAAO,KACtB,QAAQ,SAAS,MACjB,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,UAClC,QAAQ;AAAA,QAAK,CAAC,WACZ,OAAO,WAAW,YAClB,CAAC,wBAAwB,KAAK,MAAM;AAAA,MACtC,EACA,CAAAA,SAAQ,kDAAkD;AAC5D,aAAO,UAAU,MAAM,OAAO,IAAI,SAAS,OAAO,CAAC;AAAA,IACrD;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,UAAU,SAAS,CAAC,aAAa,CAAC;AACxC,aAAO,UAAU,MAAM,OAAO,QAAQ,OAAO,CAAC;AAAA,IAChD;AAAA,IACA,OAAO,KAAK,SAAS;AACnB,YAAM,UAAU,SAAS,CAAC,gBAAgB,CAAC;AAC3C,YAAM,SAAS,MAAM,UAAU,YAAY;AACzC,cAAM,SAAuB,CAAC;AAC9B,yBAAiB,SAAS,OAAO,KAAK,OAAO,EAAG,QAAO,KAAK,KAAK;AACjE,eAAO;AAAA,MACT,CAAC;AACD,iBAAW,SAAS,OAAQ,OAAM;AAAA,IACpC;AAAA,IACA,MAAM,KAAK,SAAS;AAClB,YAAM,UAAU,SAAS;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,4BAAsB,QAAQ,OAAO;AACrC,aAAO,UAAU,MAAM,OAAO,KAAK,OAAO,CAAC;AAAA,IAC7C;AAAA,IACA,MAAM,SAAS,SAAS;AACtB,YAAM,UAAU,SAAS;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,MAAAC;AAAA,QACE,QAAQ,QAAQ;AAAA,QAChB,CAAC,OAAO,QAAQ,YAAY;AAAA,QAC5B;AAAA,MACF;AACA,4BAAsB,QAAQ,OAAO;AACrC,aAAO,UAAU,MAAM,OAAO,SAAS,OAAO,CAAC;AAAA,IACjD;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,UAAU,SAAS;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,4BAAsB,QAAQ,OAAO;AACrC,UACE,CAAC,MAAM,QAAQ,QAAQ,QAAQ,UAAU,KACzC,QAAQ,QAAQ,WAAW,SAAS,KACpC,QAAQ,QAAQ,WAAW,SAAS,MACpC,IAAI,IAAI,QAAQ,QAAQ,UAAU,EAAE,SAClC,QAAQ,QAAQ,WAAW,UAC7B,QAAQ,QAAQ,WAAW;AAAA,QAAK,CAAC,aAC/B,OAAO,aAAa,YACpB,CAAC,YACD,SAAS,SAAS;AAAA,MACpB,EACA,CAAAD,SAAQ,sDAAsD;AAChE,aAAO,UAAU,MAAM,OAAO,OAAO,OAAO,CAAC;AAAA,IAC/C;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,UAAU,SAAS,CAAC,kBAAkB,aAAa,CAAC;AAC1D,aAAO,UAAU,MAAM,OAAO,QAAQ,OAAO,CAAC;AAAA,IAChD;AAAA,IACA,MAAM,WAAW,SAAS;AACxB,YAAM,UAAU,SAAS,CAAC,kBAAkB,QAAQ,CAAC;AACrD,UACE,OAAO,QAAQ,QAAQ,WAAW,YAClC,CAAC,QAAQ,QAAQ,UACjB,QAAQ,QAAQ,OAAO,SAAS,KAChC,CAAAA,SAAQ,+CAA+C;AACzD,aAAO,UAAU,MAAM,OAAO,WAAW,OAAO,CAAC;AAAA,IACnD;AAAA,IACA,MAAM,MAAM,SAAS;AACnB,YAAM,UAAU,SAAS,CAAC,kBAAkB,aAAa,CAAC;AAC1D,aAAO,UAAU,MAAM,OAAO,MAAM,OAAO,CAAC;AAAA,IAC9C;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,UAAU,SAAS,CAAC,aAAa,CAAC;AACxC,aAAO,UAAU,MAAM,OAAO,QAAQ,OAAO,CAAC;AAAA,IAChD;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,UAAU,SAAS,CAAC,gBAAgB,CAAC;AAC3C,aAAO,UAAU,MAAM,OAAO,OAAO,OAAO,CAAC;AAAA,IAC/C;AAAA,EACF;AACF;;;ACzRO,SAAS,4BACd,YACA,OACA,cACS;AACT,QAAM,gBAAgB,aAAa,KAAK,aAAa,UAAU;AAC/D,QAAM,kBAAkB,aAAa,KAAK,QAAQ,aAAa,UAC7D,aAAa,KAAK,QAAQ,mBAAmB;AAC/C,SAAO,WAAW,SAAS,aAAa,KAAK,UAC3C,WAAW,YAAY,SAAS,MAAM,KAAK,UAAU,MACpD,CAAC,aAAa,KAAK,oBAAoB,UACtC,aAAa,KAAK,mBAAmB,SAAS,MAAM,KAAK,UAAU,OACpE,CAAC,MAAM,KAAK,iBAAiB,WAAW,eACxC,CAAC,aAAa,KAAK,mBAAmB,WAAW,eACjD,CAAC,aAAa,KAAK,YAAY,WAAW,WAAW,eACtD,OAAO,cAAc,aAAa,KAClC,iBAAiB,MAChB,kBAAkB,KAAK,WAAW,gBAAgB,UAClD,CAAC,mBAAmB,WAAW,WAAW,UAC1C,WAAW,mBAAmB,WAC5B,MAAM,KAAK,aAAa,MAAM,WAAW;AAChD;;;ACEA,SAASI,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAASC,aAAY,YAA2B;AAC9C,QAAM,IAAI,mBAAmB;AAAA,IAC3B,MAAM;AAAA,IACN,SAAS,8CAA8C,UAAU;AAAA,IACjE,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,OACP,OACA,SACA,UACyB;AACzB,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,IAAAD,SAAQ,WAAW,QAAQ,oBAAoB;AAAA,EACjD;AACA,QAAM,SAAS;AACf,QAAM,UAAU,OAAO,KAAK,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;AAC1E,MAAI,QAAQ,SAAS,GAAG;AACtB,IAAAA,SAAQ,WAAW,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,EAClF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAgB,UAA0B;AAC7D,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM;AAC1E,IAAAA,SAAQ,WAAW,QAAQ,qCAAqC;AAAA,EAClE;AACA,SAAO;AACT;AAMO,SAAS,kCACd,QACA,SACyB;AACzB,MACE,OAAO,QAAQ,qBAAqB,cACpC,CAAC,QAAQ,kBAAkB,OAC3B,CAAAA,SAAQ,uEAAuE;AACjF,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,eAAe,oBAAI,IAAqB;AAC9C,MAAI,YAAY;AAEhB,QAAM,WAAW,OAAU,QACxB,QAAQ,aACL,MAAM,QAAQ,WAAW,IAAI,GAAG,IAChC,aAAa,IAAI,GAAG;AAC1B,QAAM,WAAW,OAAO,KAAa,UAAkC;AACrE,QAAI,QAAQ,WAAY,OAAM,QAAQ,WAAW,IAAI,KAAK,KAAK;AAAA,QAC1D,cAAa,IAAI,KAAK,KAAK;AAAA,EAClC;AACA,QAAM,cAAc,OAAO,QAA+B;AACxD,QAAI,QAAQ,WAAY,OAAM,QAAQ,WAAW,OAAO,GAAG;AAAA,QACtD,cAAa,OAAO,GAAG;AAAA,EAC9B;AAEA,iBAAe,SACb,SACA,QACe;AACf,gCAA4B,SAAS;AAAA,MACnC;AAAA,MACA,gBAAgB;AAAA,MAChB,mBAAmB;AAAA,MACnB,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAC5C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,UAAM,WAAW,SAAS,QAAQ,SAAS,GAAG;AAC9C,UAAM,UAAU,MAAM,SAAiB,QAAQ,KAAK;AACpD,UAAM,QAAQ,QAAQ;AACtB,QAAI,QAAQ,SAAS;AACnB,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,+BAA+B,KAAK,sBAAsB,OAAO;AAAA,QAC1E,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,QAAS,OAAM,SAAS,UAAU,KAAK;AAAA,EACrD;AAEA,WAASE,cAAa,SAAwC;AAC5D,WAAO,aAAa,QAAQ,SAAS,GAAG,IAAI,QAAQ,MAAM,IAAI,QAAQ,cAAc;AAAA,EACtF;AAEA,WAAS,YAAY,SAAwC;AAC3D,WAAO,qBAAqB;AAAA,MAC1B,UAAU,QAAQ;AAAA,MAClB,KAAK,QAAQ;AAAA,MACb,OAAO,QAAQ;AAAA,MACf,qBAAqB,QAAQ;AAAA,MAC7B,SAAS,QAAQ;AAAA,IACnB,CAAC;AAAA,EACH;AAEA,iBAAe,SACb,SACsC;AACtC,UAAM,YAAY,MAAM,SAA0BA,cAAa,OAAO,CAAC;AACvE,QAAI,aAAa,UAAU,gBAAgB,YAAY,OAAO,GAAG;AAC/D,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,SACb,SACA,QACe;AACf,UAAM;AAAA,MACJA,cAAa,OAAO;AAAA,MACpB;AAAA,QACE,aAAa,YAAY,OAAO;AAAA,QAChC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,CAAC,WAAmB,SAAS,MAAM;AACpD,QAAM,iBAAiB,CAAC,WAAmB,eAAe,MAAM;AAChE,QAAM,kBAAkB,CAAC,WAAmB,iBAAiB,MAAM;AACnE,QAAM,uBAAuB,CAAC,WAAmB,4BAA4B,MAAM;AAEnF,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,aAAO;AAAA,QACL,MAAM,aAAa;AAAA,QACnB,mBAAmB;AAAA,QACnB,aAAa;AAAA,QACb,aAAa,CAAC,GAAG,aAAa,WAAW;AAAA,QACzC,mBAAmB;AAAA,QACnB,mBAAmB;AAAA,QACnB,qBAAqB;AAAA,QACrB,gBAAgB;AAAA,QAChB,aAAa,QAAQ,aAAa,SAAS;AAAA,QAC3C,mBAAmB,CAAC,GAAG,QAAQ,iBAAiB;AAAA,MAClD;AAAA,IACF;AAAA,IACA,MAAM,UAAU,SAAS;AACvB,YAAM,SAAS,SAAS,mBAAmB;AAC3C,aAAO,QAAQ,SAAS;AAAA,QACtB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,mBAAmB;AACtB,UACE,CAAC,OAAO,cAAc,QAAQ,QAAQ,aAAa,KACnD,QAAQ,QAAQ,gBAAgB,KAChC,CAAC,OAAO,cAAc,QAAQ,QAAQ,YAAY,KAClD,QAAQ,QAAQ,iBAAiB,EACjC,CAAAF,SAAQ,2EAA2E;AACrF,kBAAY,QAAQ,QAAQ,cAAc,wBAAwB;AAClE,YAAM,QAAQ,MAAM,SAAS,OAAO;AACpC,YAAM,EAAE,OAAO,aAAa,IAAI,MAAM,QAAQ,sBAAsB,OAAO;AAC3E,UACE,MAAM,SAAS,QAAQ,QAAQ,SAAS,OACxC,MAAM,KAAK,eAAe,QAAQ,QAAQ,eACzC,MAAM,KAAK,aAAa,OAAO,QAAQ,QAAQ,iBAChD,aAAa,SAAS,SAAS,QAAQ,QAAQ,gBAC/C,MAAM,KAAK,gBAAgB,eAAe,aAAa,cACvD,MAAM,KAAK,gBAAgB,SAAS,aAAa,QACjD,MAAM,KAAK,gBAAgB,SAAS,aAAa,SAAS,MAC1D;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,UAAI,CAAC,4BAA4B,cAAc,OAAO,YAAY,GAAG;AACnE,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,mBAAmB,aAAa,IAAI;AAAA,UAC7C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,OAAO,QAAQ;AACjB,cAAM,SAAS,MAAM,QAAQ,cAAc,MAAM,QAAQ,OAAO;AAChE,YAAI,QAAQ;AACV,cACE,OAAO,KAAK,iBAAiB,MAAM,UACnC,OAAO,KAAK,UAAU,QAAQ,MAAM,SAAS,OAC7C,OAAO,KAAK,gBAAgB,eAAe,aAAa,cACxD,OAAO,KAAK,gBAAgB,SAAS,aAAa,QAClD,OAAO,KAAK,gBAAgB,SAAS,aAAa,SAAS,QAC3D,CAAC,OAAO,KAAK,aAAa,SAAS,QAAQ,QAAQ,UAAU,MAC5D,OAAO,KAAK,iBAAiB,KAAK,QAAQ,QAAQ,eACnD;AACA,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AACA,iBAAO;AAAA,YACL,cAAc,MAAM;AAAA,YACpB,aAAa,QAAQ,SAAS;AAAA,YAC9B,eAAe,OAAO,KAAK,iBAAiB,QAAQ,QAAQ;AAAA,YAC5D,YAAY,QAAQ,QAAQ;AAAA,YAC5B,cAAc,QAAQ;AAAA,YACtB,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AACA,YAAM,cAAc,MAAM,OAAO,UAAU,EAAE,OAAO,aAAa,CAAC;AAClE,YAAM,eAAe;AAAA,QACnB,YAAY;AAAA,QACZ;AAAA,MACF;AACA,YAAM,gBAAgB,YAAY,iBAChC,QAAQ,QAAQ;AAClB,UACE,CAAC,OAAO,cAAc,aAAa,KACnC,gBAAgB,QAAQ,QAAQ,eAChC;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,SAAS,YAAY;AACpC,aAAO;AAAA,QACL;AAAA,QACA,aAAa,QAAQ,SAAS;AAAA,QAC9B;AAAA,QACA,YAAY,QAAQ,QAAQ;AAAA,QAC5B,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,MAAM,aAAa,SAAS;AAC1B,YAAM,SAAS,SAAS,gBAAgB;AACxC,aAAO,QAAQ,SAAS,CAAC,cAAc,GAAG,gBAAgB;AAC1D,YAAM,eAAe,YAAY,QAAQ,QAAQ,cAAc,qBAAqB;AACpF,UAAI,MAAM,SAAS,OAAO,EAAG;AAC7B,YAAM,SAAS,MAAM,SAAmB,gBAAgB,YAAY,CAAC,KAAK,CAAC;AAC3E,UAAI,OAAO,SAAS,GAAG;AACrB,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,MAAM,QAAQ,cAAc,cAAc,OAAO;AAChE,UAAI,OAAQ,OAAM,OAAO,OAAO,MAAM;AACtC,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,IACA,MAAM,eAAe,SAAS;AAC5B,YAAM,SAAS,SAAS,yBAAyB;AACjD,aAAO,QAAQ,SAAS,CAAC,cAAc,GAAG,kBAAkB;AAC5D,aAAOC,aAAY,WAAW;AAAA,IAChC;AAAA,IACA,MAAM,gBAAgB,SAAS;AAC7B,YAAM,SAAS,SAAS,0BAA0B;AAClD,aAAO,QAAQ,SAAS,CAAC,kBAAkB,eAAe,GAAG,iBAAiB;AAC9E,aAAOA,aAAY,kBAAkB;AAAA,IACvC;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,SAAS,SAAS,gBAAgB;AACxC,aAAO,QAAQ,SAAS,CAAC,gBAAgB,eAAe,GAAG,gBAAgB;AAC3E,aAAOA,aAAY,kBAAkB;AAAA,IACvC;AAAA,IACA,MAAM,iBAAiB,SAAS;AAC9B,YAAM,SAAS,SAAS,wBAAwB;AAChD,aAAO,QAAQ,SAAS,CAAC,cAAc,GAAG,wBAAwB;AAClE,aAAOA,aAAY,aAAa;AAAA,IAClC;AAAA,IACA,MAAM,eAAe,SAAS;AAC5B,YAAM,SAAS,SAAS,yBAAyB;AACjD,aAAO,QAAQ,SAAS,CAAC,gBAAgB,cAAc,GAAG,yBAAyB;AACnF,aAAOA,aAAY,aAAa;AAAA,IAClC;AAAA,IACA,MAAM,aAAa,SAAS;AAC1B,YAAM,SAAS,SAAS,uBAAuB;AAC/C,aAAO,QAAQ,SAAS,CAAC,cAAc,GAAG,gBAAgB;AAC1D,aAAOA,aAAY,SAAS;AAAA,IAC9B;AAAA,IACA,MAAM,MAAM,SAAS;AACnB,YAAM,SAAS,SAAS,eAAe;AACvC,aAAO,QAAQ,SAAS,CAAC,gBAAgB,QAAQ,GAAG,eAAe;AACnE,kBAAY,QAAQ,QAAQ,cAAc,oBAAoB;AAC9D,kBAAY,QAAQ,QAAQ,QAAQ,cAAc;AAClD,YAAM,QAAQ,MAAM,SAAS,OAAO;AACpC,UAAI,OAAO,QAAQ;AACjB,cAAME,SAAQ,MAAM,SAA6B,SAAS,MAAM,MAAM,CAAC;AACvE,YAAIA,OAAO,QAAOA;AAAA,MACpB;AACA,YAAM,SAAS,MAAM,QAAQ,cAAc,QAAQ,QAAQ,cAAc,OAAO;AAChF,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,mBAAmB,QAAQ,QAAQ,YAAY;AAAA,UACxD,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UACE,OAAO,KAAK,UAAU,UACtB,OAAO,KAAK,SAAS,WAAW,QAAQ,QAAQ,QAChD;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,4CAA4C,QAAQ,QAAQ,MAAM;AAAA,UAC3E,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,cAAc,QAAQ,uBAAuB,OAAO,KACxD,yBAAyB,WAAW;AACtC,YAAM,QAA4B;AAAA,QAChC;AAAA,QACA,cAAc,QAAQ,QAAQ;AAAA,QAC9B,aAAa,QAAQ,SAAS;AAAA,QAC9B,QAAQ,QAAQ,QAAQ;AAAA,MAC1B;AACA,YAAM,YAAY,MAAM,SAA6B,SAAS,WAAW,CAAC;AAC1E,UACE,aACA,qBAAqB,SAAS,MAAM,qBAAqB,KAAK,GAC9D;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,SAAS,WAAW,GAAG,KAAK;AAC3C,YAAM,SAAS,MAAM;AAAA,QACnB,gBAAgB,QAAQ,QAAQ,YAAY;AAAA,MAC9C,KAAK,CAAC;AACN,UAAI,CAAC,OAAO,SAAS,WAAW,GAAG;AACjC,cAAM;AAAA,UACJ,gBAAgB,QAAQ,QAAQ,YAAY;AAAA,UAC5C,CAAC,GAAG,QAAQ,WAAW;AAAA,QACzB;AAAA,MACF;AACA,YAAM,SAAS,SAAS,WAAW;AACnC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,SAAS,SAAS,iBAAiB;AACzC,aAAO,QAAQ,SAAS;AAAA,QACtB;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,iBAAiB;AACpB,kBAAY,QAAQ,QAAQ,aAAa,qBAAqB;AAC9D,kBAAY,QAAQ,QAAQ,aAAa,qBAAqB;AAC9D,UAAI,OAAO,QAAQ,QAAQ,aAAa,WAAW;AACjD,QAAAH,SAAQ,0CAA0C;AAAA,MACpD;AACA,YAAM,QAAQ,MAAM,SAAS,OAAO;AACpC,UAAI,OAAO,QAAQ;AACjB,cAAMI,eAAc,MAAM;AAAA,UACxB,eAAe,MAAM,MAAM;AAAA,QAC7B;AACA,YAAIA,aAAa,QAAOA;AAAA,MAC1B;AACA,YAAM,QAAQ,MAAM;AAAA,QAClB,SAAS,QAAQ,QAAQ,WAAW;AAAA,MACtC;AACA,UAAI,CAAC,SAAS,MAAM,gBAAgB,QAAQ,SAAS,KAAK;AACxD,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,MAAM,QAAQ,cAAc,MAAM,cAAc,OAAO;AACtE,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,mBAAmB,MAAM,YAAY;AAAA,UAC9C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UACE,OAAO,KAAK,aAAa,WAAW,KACpC,OAAO,KAAK,YAAY,CAAC,MAAM,kBAC/B,CAAC,QAAQ,QAAQ,UACjB;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,YAAY,MAAM,OAAO,QAAQ;AAAA,QACrC;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,aAAa,QAAQ,QAAQ;AAAA,QAC7B,UAAU,QAAQ,QAAQ;AAAA,MAC5B,CAAC;AACD,YAAM,cAAwC;AAAA,QAC5C,eAAe,UAAU;AAAA,QACzB,aAAa,MAAM;AAAA,QACnB,aAAa,QAAQ,SAAS;AAAA,QAC9B,aAAa,QAAQ,QAAQ;AAAA,QAC7B,UAAU,QAAQ,QAAQ;AAAA,MAC5B;AACA,YAAM,YAAY,MAAM;AAAA,QACtB,eAAe,YAAY,aAAa;AAAA,MAC1C;AACA,UACE,aACA,qBAAqB,SAAS,MAAM,qBAAqB,WAAW,GACpE;AACA,cAAM,OAAO,UAAU,YAAY,aAAa;AAChD,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,eAAe,YAAY,aAAa,GAAG,WAAW;AACrE,YAAM;AAAA,QACJ,qBAAqB,MAAM,WAAW;AAAA,QACtC,YAAY;AAAA,MACd;AACA,YAAM,SAAS,SAAS,YAAY,aAAa;AACjD,aAAO;AAAA,IACT;AAAA,IACA,MAAM,UAAU,SAAS;AACvB,YAAM,SAAS,SAAS,mBAAmB;AAC3C,aAAO,QAAQ,SAAS,CAAC,eAAe,GAAG,mBAAmB;AAC9D,YAAM,SAAS,YAAY,QAAQ,QAAQ,eAAe,yBAAyB;AACnF,UAAI,MAAM,SAAS,OAAO,EAAG;AAC7B,YAAM,cAAc,MAAM;AAAA,QACxB,eAAe,MAAM;AAAA,MACvB;AACA,UAAI,eAAe,YAAY,gBAAgB,QAAQ,SAAS,KAAK;AACnE,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,OAAO,UAAU,MAAM;AAC7B,YAAM,YAAY,eAAe,MAAM,CAAC;AACxC,UAAI,aAAa;AACf,cAAM,YAAY,qBAAqB,YAAY,WAAW,CAAC;AAAA,MACjE;AACA,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,SAAS,SAAS,iBAAiB;AACzC,aAAO,QAAQ,SAAS,CAAC,aAAa,GAAG,iBAAiB;AAC1D,YAAM,SAAS,YAAY,QAAQ,QAAQ,aAAa,qBAAqB;AAC7E,UAAI,MAAM,SAAS,OAAO,EAAG;AAC7B,YAAM,QAAQ,MAAM,SAA6B,SAAS,MAAM,CAAC;AACjE,UAAI,SAAS,MAAM,gBAAgB,QAAQ,SAAS,KAAK;AACvD,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,MAAM,SAAiB,qBAAqB,MAAM,CAAC,GAAG;AACxD,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,YAAY,SAAS,MAAM,CAAC;AAClC,UAAI,OAAO;AACT,cAAM,SAAS,MAAM;AAAA,UACnB,gBAAgB,MAAM,YAAY;AAAA,QACpC,KAAK,CAAC;AACN,cAAM,YAAY,OAAO,OAAO,CAAC,SAAS,SAAS,MAAM;AACzD,YAAI,UAAU,SAAS,GAAG;AACxB,gBAAM,SAAS,gBAAgB,MAAM,YAAY,GAAG,SAAS;AAAA,QAC/D,OAAO;AACL,gBAAM,YAAY,gBAAgB,MAAM,YAAY,CAAC;AAAA,QACvD;AAAA,MACF;AACA,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,IACA,MAAM,SAAS,SAAS;AACtB,YAAM,SAAS,SAAS,eAAe;AACvC,aAAO,QAAQ,SAAS,CAAC,eAAe,GAAG,eAAe;AAC1D,aAAOH,aAAY,mBAAmB;AAAA,IACxC;AAAA,EACF;AACF;;;ACnhBA,eAAeI,QAAO,OAAiC;AACrD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,qBAAqB,KAAK,CAAC;AAClE,QAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,KAAK;AACrE,SAAO,UACL,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,EACvB,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE,CACZ;AACF;AAEA,SAAS,cAAc,QAA4C;AACjE,UAAQ,QAAQ;AAAA,IACd,KAAK,QAAQ;AACX,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AAAA,IACL,KAAK,UAAU;AACb,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,WAAW;AACd,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAGA,eAAsB,6BACpB,UACA,QACkC;AAClC,QAAM,cAAuC,CAAC;AAC9C,aAAW,QAAQ,CAAC,GAAG,SAAS,UAAU,CAAC,EAAE,KAAK,GAAG;AACnD,UAAM,mBAAmB,SAAS,yBAC9B,SAAS,uBAAuB,IAAI,IACpC,uBAAuB,IAAI;AAC/B,QAAI,qBAAqB,QAAW;AAIlC;AAAA,IACF;AACA,UAAM,cAAc,uBAAuB,gBAAgB;AAC3D,UAAM,eAAwC,CAAC;AAC/C,UAAM,eAAe,MAAMA,QAAO,EAAE,aAAa,aAAa,CAAC;AAC/D,UAAM,WAAW,gBAAgB,IAAI;AACrC,UAAM,SAAS,gBAAgB,mBAAmB,MAAM,CAAC,IAAI,mBAAmB,IAAI,CAAC;AACrF,UAAM,SAAS,SAAS,gBAAgB,IAAI,KAAK;AACjD,gBAAY,KAAK;AAAA,MACf;AAAA,MACA,SAAS,SAAS,MAAM;AAAA,MACxB,aAAa,UAAU,eAAe,wBAAwB,IAAI;AAAA,MAClE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,cAAc,MAAM;AAAA,MAC1B,SAAS,CAAC,MAAM;AAAA,MAChB,qBAAqB,WAAW;AAAA,MAChC,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,IACpB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAqCA,SAASC,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAASC,aAAY,SAAkB,SAA4B,UAAwB;AACzF,MAAI,YAAY,QAAQ,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AAC7E,IAAAD,SAAQ,gBAAgB,QAAQ,oBAAoB;AAAA,EACtD;AACA,QAAM,UAAU,OAAO,KAAK,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,SAAS,KAAK,CAAC;AAC/E,MAAI,QAAQ,SAAS,GAAG;AACtB,IAAAA,SAAQ,gBAAgB,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,EACvF;AACF;AAMO,SAAS,gCACd,cACA,SAC2B;AAC3B,MAAI,CAAC,QAAQ,YAAY,UAAU,CAAC,QAAQ,kBAAkB,QAAQ;AACpE,IAAAA,SAAQ,wEAAwE;AAAA,EAClF;AACA,QAAM,mBAAmB,oBAAI,IAAuC;AACpE,QAAM,mBAAmB,oBAAI,IAA2C;AACxE,QAAM,QAAQ,8BAA8B;AAC5C,QAAM,SAAS,+BAA+B;AAAA,IAC5C;AAAA,IACA,KAAK,QAAQ;AAAA,IACb,OAAO,QAAQ;AAAA,IACf,gBAAgB,QAAQ;AAAA,IACxB,iBAAiB,QAAQ;AAAA,IACzB,cAAc;AAAA,MACZ,MAAM,QAAQ;AAAA,MACd,aAAa;AAAA,MACb,mBAAmB,QAAQ;AAAA,IAC7B;AAAA,IACA,MAAM,qBAAqB,OAAO;AAChC,YAAM,YAAY,MAAM,QAAQ,iBAAiB,MAAM,WAAW;AAClE,YAAM,UAAU,iBAAiB,IAAI,MAAM,WAAW;AACtD,UACE,CAAC,aACD,CAAC,WACD,QAAQ,WAAW,MAAM,UACzB,QAAQ,iBAAiB,MAAM,gBAC/B,UAAU,KAAK,QAAQ,SAAS,MAAM,KAAK,QAC3C,UAAU,KAAK,WAAW,MAAM,KAAK,UACrC,CAAC,MAAM,KAAK,QAAQ,SAAS,MAAM,MAAM,GACzC;AACA,eAAO;AAAA,MACT;AACA,UAAI,QAAQ,UAAU;AACpB,yBAAiB,IAAI,MAAM,aAAa,QAAQ,QAAQ;AAAA,MAC1D;AACA,aAAO;AAAA,IACT;AAAA,IACA,OAAO,SAAS,YAAY,SAAS,YAAY,QAAQ,aAAa;AACpE,UAAI,CAAC,YAAa,CAAAA,SAAQ,gDAAgD;AAC1E,YAAM,YAAY,MAAM,QAAQ,iBAAiB,WAAW;AAC5D,UACE,CAAC,aACD,UAAU,KAAK,QAAQ,SAAS,WAAW,QAC3C,UAAU,KAAK,WAAW,WAAW,UACrC,qBAAqB,UAAU,KAAK,aAAa,CAAC,CAAC,MAAM,qBAAqB,UAAU,GACxF;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,WAAW,iBAAiB,IAAI,WAAW;AACjD,YAAM,WAAW,MAAM,aAAa;AAAA,QAClC,WACI;AAAA,UACA,GAAG;AAAA,UACH,QAAQ,EAAE,GAAG,UAAU,QAAQ,SAAS;AAAA,QAC1C,IACE;AAAA,QACJ,EAAE,OAAO;AAAA,MACX;AACA,YAAM,KAAK,UAAU,QAAQ;AAAA,IAC/B;AAAA,EACF,CAAC;AAED,iBAAe,UACb,SACAE,SACe;AACf,IAAAD,aAAY,QAAQ,SAASC,SAAQ,GAAG,QAAQ,MAAM,UAAU;AAChE,QAAI,CAAE,MAAM,QAAQ,iBAAiB,OAAO,GAAI;AAC9C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,mBAAyC;AAAA,IAC7C,iBAAiB,MAAM,OAAO,gBAAgB;AAAA,IAC9C,MAAM,SAAS,SAAS;AACtB,YAAM,UAAU,SAAS,CAAC,YAAY,CAAC;AACvC,aAAO,OAAO,SAAS,OAAO;AAAA,IAChC;AAAA,IACA,MAAM,SAAS,SAAS;AACtB,YAAM,UAAU,SAAS,CAAC,QAAQ,WAAW,eAAe,CAAC;AAC7D,aAAO,OAAO,SAAS,OAAO;AAAA,IAChC;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,UAAU,SAAS;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,aAAO,OAAO,QAAQ,OAAO;AAAA,IAC/B;AAAA,IACA,MAAM,UAAU,SAAS;AACvB,YAAM,UAAU,SAAS;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,aAAO,OAAO,UAAU,OAAO;AAAA,IACjC;AAAA,IACA,OAAO,OAAO,SAAS,eAAe;AACpC,YAAM,UAAU,SAAS,CAAC,qBAAqB,uBAAuB,WAAW,CAAC;AAClF,aAAO,OAAO,OAAO,SAAS,aAAa;AAAA,IAC7C;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,UAAU,SAAS,CAAC,mBAAmB,mBAAmB,CAAC;AACjE,aAAO,OAAO,QAAQ,OAAO;AAAA,IAC/B;AAAA,IACA,MAAM,uBAAuB,SAAS;AACpC,YAAM,UAAU,SAAS,CAAC,mBAAmB,kBAAkB,gBAAgB,CAAC;AAChF,aAAO,OAAO,uBAAuB,OAAO;AAAA,IAC9C;AAAA,IACA,MAAM,gBAAgB,SAAS;AAC7B,YAAM,UAAU,SAAS,CAAC,iBAAiB,CAAC;AAC5C,aAAO,OAAO,gBAAgB,OAAO;AAAA,IACvC;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,UAAU,SAAS,CAAC,qBAAqB,iBAAiB,CAAC;AACjE,aAAO,OAAO,QAAQ,OAAO;AAAA,IAC/B;AAAA,EACF;AAEA,QAAM,kBAAuC;AAAA,IAC3C,MAAM,QAAQ,WAAW,mBAAmB,CAAC,GAAG;AAC9C,YAAM,QAAQ,iBAAiB;AAC/B,YAAM,aAAa,iBAAiB;AACpC,UAAI,CAAC,SAAS,CAAC,YAAY;AACzB,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,UAAU,CAAI,QAAgB,SAAY,QAAgB,kBAC9D,QAAQ,cAAc;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,gBAAgB,GAAG,UAAU,SAAS,GAAG,IAAI,MAAM;AAAA,QACnD;AAAA,MACF,CAAC;AACH,YAAM,WAAW,MAAM,iBAAiB;AAAA,QACtC,QAAQ,iBAAiB,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC;AAAA,MACzD;AACA,YAAM,aAAa,SAAS,MAAM;AAAA,QAChC,CAAC,cACC,UAAU,SAAS,UAAU,KAAK,QAAQ,QAC1C,UAAU,WAAW,UAAU,KAAK;AAAA,MACxC;AACA,UAAI,CAAC,YAAY;AACf,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UACE,UAAU,KAAK,QAAQ,gBACvB,UAAU,KAAK,QAAQ,iBAAiB,WAAW,cACnD;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,cAAc,MAAM,iBAAiB;AAAA,QACzC;AAAA,UACE;AAAA,UACA;AAAA,YACE,MAAM,WAAW;AAAA,YACjB,SAAS,WAAW;AAAA,YACpB,cAAc,WAAW;AAAA,YACzB,eAAe,SAAS;AAAA,YACxB,QAAQ,WAAW,QAAQ,CAAC;AAAA,YAC5B,QAAQ,WAAW;AAAA,YACnB,GAAI,UAAU,KAAK,kBAAkB,WAAW,sBAC5C,EAAE,yBAAyB,UAAU,KAAK,eAAe,IACzD,CAAC;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAS,MAAM,QAAQ,mBAAmB,WAAW,iBAAiB,MAAM;AAClF,uBAAiB,IAAI,UAAU,SAAS,KAAK,MAAM;AACnD,YAAM,gBAAgB,MAAM,iBACzB;AAAA,QACC;AAAA,UACE;AAAA,UACA;AAAA,YACE,mBAAmB,YAAY;AAAA,YAC/B,sBAAsB,OAAO;AAAA,YAC7B,cAAc,OAAO;AAAA,YACrB,OAAO,KAAK,IAAI,KAAQ,KAAK,IAAI,GAAG,UAAU,KAAK,aAAa,GAAM,CAAC;AAAA,UACzE;AAAA,UACA;AAAA,UACA,CAAC,qBAAqB,wBAAwB,gBAAgB,OAAO;AAAA,QACvE;AAAA,MACF,EACC,QAAQ,MAAM;AACb,yBAAiB,OAAO,UAAU,SAAS,GAAG;AAAA,MAChD,CAAC;AACH,UAAI;AACF,cAAM,SAAmB,CAAC;AAC1B,YAAI;AACJ,yBACQ,SAAS,iBAAiB;AAAA,UAC9B;AAAA,YACE;AAAA,YACA;AAAA,cACE,mBAAmB,YAAY;AAAA,cAC/B,qBAAqB,cAAc;AAAA,cACnC,WAAW,UAAU,KAAK,aAAa,CAAC;AAAA,YAC1C;AAAA,YACA;AAAA,YACA,CAAC,qBAAqB,uBAAuB,WAAW;AAAA,UAC1D;AAAA,UACA,EAAE,QAAQ,iBAAiB,OAAO;AAAA,QACpC,GACA;AACA,4BAAkB,MAAM;AACxB,cAAI,CAAC,MAAM,MAAO,QAAO,KAAK,MAAM,IAAI;AAAA,QAC1C;AACA,YAAI,CAAC,mBAAmB,OAAO,WAAW,GAAG;AAC3C,UAAAF,SAAQ,iEAAiE;AAAA,QAC3E;AACA,cAAM,WAAW,KAAK,MAAM,OAAO,CAAC,CAAC;AACrC,cAAM,WAAW,MAAM,iBAAiB;AAAA,UACtC,QAAQ,yBAAyB,EAAE,gBAAgB,GAAG,YAAY,CAAC,iBAAiB,CAAC;AAAA,QACvF;AACA,cAAM,iBAAiB;AAAA,UACrB;AAAA,YACE;AAAA,YACA;AAAA,cACE,mBAAmB,YAAY;AAAA,cAC/B;AAAA,YACF;AAAA,YACA;AAAA,YACA,CAAC,qBAAqB,iBAAiB;AAAA,UACzC;AAAA,QACF;AACA,eAAO;AAAA,UACL,GAAG;AAAA,UACH,QAAQ;AAAA,YACN,GAAG,SAAS;AAAA,YACZ,QAAQ;AAAA,cACN,GAAG,SAAS,QAAQ;AAAA,cACpB,aAAa,SAAS;AAAA,YACxB;AAAA,UACF;AAAA,QACF;AAAA,MACF,UAAE;AACA,yBAAiB,OAAO,UAAU,SAAS,GAAG;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,kBAAkB,gBAAgB;AAC7C;;;ACvZO,IAAM,gCAAgC;AACtC,IAAM,yBAAyB;AAE/B,IAAM,6BAA6B;AACnC,IAAM,sBAAsB;AAsH5B,SAAS,+BACd,MACA,MAC8F;AAC9F,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,4BACd,MACA,MAC2F;AAC3F,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,mBAAmB,UAAyF;AAC1H,SAAO,SAAS,SAAS;AAC3B;AAEO,SAAS,gBAAgB,UAAsF;AACpH,SAAO,SAAS,SAAS;AAC3B;AAMA,eAAsB,aACpB,OACA,OACA,MACA,MACmC;AACnC,MAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,SAAS;AACzD,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,QAAM,WAAW,+BAA+B,MAAM,IAAI;AAC1D,QAAM,WAAW,MAAM,MAAM,OAAO,OAAO,QAAQ;AACnD,SAAO;AACT;AAMA,eAAsB,kBACpB,OACA,OACA,gBACA,SACA,MAAkB,MAAM,oBAAI,KAAK,GACD;AAChC,MAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,SAAS;AACzD,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MACE,CAAC,QAAQ,kBACT,CAAC,QAAQ,wBACT,CAAC,QAAQ,mBACT,CAAC,QAAQ,yBACT,CAAC,QAAQ,MAAM,aACf,CAAC,QAAQ,MAAM,aACf,CAAC,OAAO,SAAS,QAAQ,KAAK,KAC9B,QAAQ,SAAS,GACjB;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,QAAM,qBAAqB,MAAM,MAAM,IAA0B;AAAA,IAC/D,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACD,QAAM,aAAa;AACnB,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,qBAAqB,cAAc;AAAA,MAC5C,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,QAAM,cAAc,IAAI;AACxB,QAAM,mBAAmB,IAAI,KAAK,WAAW,KAAK,SAAS;AAC3D,MAAI,CAAC,OAAO,SAAS,iBAAiB,QAAQ,CAAC,KAAK,oBAAoB,aAAa;AACnF,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,qBAAqB,cAAc;AAAA,MAC5C,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MAAI,WAAW,QAAQ,UAAU,aAAa,WAAW,QAAQ,UAAU,WAAW;AACpF,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,qBAAqB,cAAc;AAAA,MAC5C,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MAAI,WAAW,KAAK,0BAA0B,QAAQ,uBAAuB;AAC3E,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MACE,WAAW,QAAQ,UAAU,WAC7B,WAAW,OAAO,yBAAyB,QAAQ,sBACnD;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,qBAAqB,cAAc;AAAA,MAC5C,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MAAI,CAAC,MAAM,QAAQ,qBAAqB,QAAQ,gBAAgB,WAAW,KAAK,kBAAkB,GAAG;AACnG,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MACE,CAAC,MAAM,QAAQ,kBAAkB;AAAA,IAC/B;AAAA,IACA,sBAAsB,QAAQ;AAAA,IAC9B,iBAAiB,QAAQ;AAAA,IACzB,WAAW,QAAQ,MAAM;AAAA,IACzB,WAAW,QAAQ,MAAM;AAAA,EAC3B,CAAC,GACD;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,MAAI,WAAW,QAAQ,UAAU,SAAS;AACxC,UAAM,cAAsC;AAAA,MAC1C,OAAO;AAAA,MACP,sBAAsB,QAAQ;AAAA,MAC9B,SAAS,YAAY,YAAY;AAAA,IACnC;AACA,UAAM,MAAM;AAAA,MACV;AAAA,MACA;AAAA,QACE,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,iBAAiB,WAAW,SAAS,gBAAgB;AAAA,IACzD;AAAA,EACF;AAIA,QAAM,cAAc,WAAW,WAAW,SAAS,GAAG;AACtD,QAAM,0BAA0B,MAAM,MAAM,IAAuB;AAAA,IACjE,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACD,QAAM,kBAAkB;AACxB,MAAI,iBAAiB;AACnB,QAAI,gBAAgB,KAAK,yBAAyB,QAAQ,sBAAsB;AAC9E,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,qBAAqB,cAAc;AAAA,QAC5C,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,KAAK,IAAI,QAAQ,OAAO,iBAAiB,QAAQ,IAAI,YAAY,QAAQ,CAAC;AACxF,QAAM,WAAW,4BAA4B,aAAa;AAAA,IACxD,eAAe;AAAA,MACb,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAAA,IACA,sBAAsB,QAAQ;AAAA,IAC9B,iBAAiB,QAAQ;AAAA,IACzB,UAAU,WAAW,KAAK;AAAA,IAC1B,iBAAiB,WAAW,KAAK;AAAA,IACjC,KAAK,WAAW,KAAK;AAAA,IACrB,cAAc,WAAW,KAAK;AAAA,IAC9B,gBAAgB,WAAW,KAAK;AAAA,IAChC,GAAI,WAAW,KAAK,iBAAiB,EAAE,gBAAgB,WAAW,KAAK,eAAe,IAAI,CAAC;AAAA,IAC3F;AAAA,EACF,CAAC;AACD,QAAM,WAAW,MAAM,MAAM,OAAO,OAAO,QAAQ;AACnD,QAAM,UAAU;AAGhB,QAAM,WAAW,YAAY,YAAY;AACzC,QAAM,YAAY,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,EAAE,YAAY;AAEtE,QAAM,MAAM;AAAA,IACV;AAAA,IACA,EAAE,YAAY,4BAA4B,MAAM,qBAAqB,MAAM,YAAY;AAAA,IACvF;AAAA,MACE,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA,aAAa;AAAA,IACf;AAAA,IACA,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,EACtD;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ;AAAA,MACN,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA,aAAa;AAAA,IACf;AAAA,EACF;AACF;AAKA,eAAsB,oBACpB,OACA,OACA,aACA,QACA,MAAkB,MAAM,oBAAI,KAAK,GAClB;AACf,QAAM,UAAU,MAAM,MAAM,IAAuB;AAAA,IACjD,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,iBAAiB,WAAW,YAAY;AAAA,EAC1D;AACA,QAAM,MAAM;AAAA,IACV;AAAA,IACA,EAAE,YAAY,4BAA4B,MAAM,qBAAqB,MAAM,YAAY;AAAA,IACvF;AAAA,MACE,OAAO;AAAA,MACP,WAAW,IAAI,EAAE,YAAY;AAAA,MAC7B,cAAc;AAAA,IAChB;AAAA,IACA,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,EACtD;AACF;AAKO,SAAS,qBAAqB,SAAgC,MAAY,oBAAI,KAAK,GAAY;AACpG,QAAM,SAAS,QAAQ;AACvB,MAAI,QAAQ,UAAU,SAAU,QAAO;AACvC,QAAM,YAAY,OAAO;AACzB,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,IAAI,KAAK,SAAS,IAAI;AAC/B;;;AC7XA,IAAM,4BAA4B;AAyClC,SAASG,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAASC,aAAY,SAAwB;AAC3C,QAAM,IAAI,mBAAmB;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AACH;AAEA,eAAeC,QAAO,OAAiC;AACrD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,qBAAqB,KAAK,CAAC;AAClE,QAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,KAAK;AACrE,SAAO,UACL,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,EACvB,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE,CACZ;AACF;AAEA,SAASC,aACP,SACA,SACA,UACM;AACN,MAAI,YAAY,QAAQ,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AAC7E,IAAAH,SAAQ,2BAA2B,QAAQ,oBAAoB;AAAA,EACjE;AACA,QAAM,UAAU,OAAO,KAAK,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,SAAS,KAAK,CAAC;AAC/E,MAAI,QAAQ,SAAS,GAAG;AACtB,IAAAA;AAAA,MACE,2BAA2B,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,CAAC;AAAA,IACxF;AAAA,EACF;AACF;AAEA,SAAS,qBACP,OACA,OACA,UAAU,MACF;AACR,MACE,OAAO,UAAU,YACjB,CAAC,SACD,MAAM,SAAS,QACf,CAAAA,SAAQ,2BAA2B,KAAK,aAAa;AACvD,SAAO;AACT;AAOO,SAAS,mCACd,SAC4B;AAC5B,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,oBAAoB,QAAQ,qBAAqB;AACvD,QAAM,kBAAkB,QAAQ,mBAAmB,KAAK;AACxD,MACE,CAAC,QAAQ,QACT,CAAC,QAAQ,kBAAkB,UAC3B,CAAC,OAAO,cAAc,iBAAiB,KACvC,oBAAoB,KACpB,CAAC,OAAO,cAAc,eAAe,KACrC,kBAAkB,EAClB,CAAAA,SAAQ,qDAAqD;AAE/D,QAAM,cAAc,oBAAI,IAAgC;AACxD,QAAM,aAAa,oBAAI,IAA+B;AACtD,QAAM,aAAa,oBAAI,IAA8B;AACrD,QAAM,WAAW,oBAAI,IAA6B;AAClD,QAAM,UAAU,oBAAI,IAA4B;AAChD,QAAM,SAAS,oBAAI,IAAY;AAC/B,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,cAAc,oBAAI,IAAoB;AAE5C,iBAAe,cACb,SACmC;AACnC,QACE,QAAQ,SAAS,eAAe,iCAChC,QAAQ,SAAS,SAAS,uBAC1B,CAAAA,SAAQ,kDAAkD;AAC5D,UAAM,WAAW,MAAM,QAAQ,MAAM,IAAI;AAAA,MACvC,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,QAAQ,SAAS;AAAA,IACzB,CAAC;AACD,QACE,CAAC,YACD,SAAS,SAAS,QAAQ,QAAQ,SAAS,OAC3C,SAAS,SAAS,eAAe,QAAQ,SAAS,YAClD;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM,WAAW,aAAa;AAAA,QAC9B,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,UACb,SACA,QACAI,SACmC;AACnC,IAAAD,aAAY,QAAQ,SAASC,SAAQ,GAAG,MAAM,UAAU;AACxD,gCAA4B,SAAS;AAAA,MACnC;AAAA,MACA,gBAAgB;AAAA,MAChB,mBAAmB;AAAA,MACnB,gBAAgB;AAAA,IAClB,CAAC;AACD,QACE,QAAQ,MAAM,OAAO,QAAQ,MAAM,MACnC,QAAQ,MAAM,SAAS,QAAQ,MAAM,MACrC;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,CAAC,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAC5C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,UAAM,WAAW,MAAM,cAAc,OAAO;AAC5C,UAAM,iBAAiB,GAAG,QAAQ,SAAS,GAAG,IAAI,MAAM,IAAI,QAAQ,cAAc;AAClF,UAAM,cAAc,qBAAqB;AAAA,MACvC,UAAU,QAAQ;AAAA,MAClB,cAAc,QAAQ;AAAA,MACtB,OAAO,QAAQ;AAAA,MACf,SAAS,QAAQ;AAAA,MACjB,qBAAqB,QAAQ;AAAA,MAC7B,qBAAqB,QAAQ;AAAA,MAC7B,SAAS,QAAQ;AAAA,IACnB,CAAC;AACD,UAAM,WAAW,YAAY,IAAI,cAAc;AAC/C,QAAI,aAAa,UAAa,aAAa,aAAa;AACtD,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,2BAA2B,MAAM;AAAA,QAC1C,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,gBAAY,IAAI,gBAAgB,WAAW;AAC3C,UAAM,QAAQ,QAAQ;AACtB,QAAI,CAAC,OAAO,cAAc,KAAK,KAAM,QAAmB,GAAG;AACzD,MAAAJ,SAAQ,kDAAkD;AAAA,IAC5D;AACA,UAAM,UAAU,OAAO,IAAI,QAAQ,SAAS,GAAG,KAAK;AACpD,QAAK,QAAmB,SAAS;AAC/B,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO,IAAI,QAAQ,SAAS,KAAK,KAAe;AAChD,WAAO;AAAA,EACT;AAEA,WAAS,MACP,QACA,QACA,aACA,MACG;AACH,UAAM,QAAQ,OAAO,IAAI,MAAM;AAC/B,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,kBAAkB,IAAI;AAAA,QAC/B,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,MAAM,gBAAgB,aAAa;AACrC,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,kBAAkB,IAAI;AAAA,QAC/B,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,QAAM,SAA8C;AAAA,IAClD,MAAM,kBAAkB;AACtB,aAAO;AAAA,QACL,MAAM,QAAQ;AAAA,QACd,iBAAiB,CAAC,YAAY;AAAA,QAC9B,oBAAoB,CAAC,yBAAyB;AAAA,QAC9C,2BAA2B;AAAA,QAC3B,wBAAwB;AAAA,QACxB,kBAAkB;AAAA,QAClB;AAAA,QACA;AAAA,QACA,aAAa;AAAA,QACb,mBAAmB,QAAQ;AAAA,MAC7B;AAAA,IACF;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,WAAW,MAAM,UAAU,SAAS,mBAAmB;AAAA,QAC3D;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,UACE,QAAQ,QAAQ,WAAW,gBAC3B,QAAQ,QAAQ,YAAY,SAAS,SAAS,QAC9C,QAAQ,QAAQ,eAAe,SAAS,KAAK,cAC7C,QAAQ,QAAQ,4BACd,SAAS,KAAK,oBAChB;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,YAAY,KAAK,MAAM,SAAS,KAAK,SAAS,IAAI,IAAI,EAAE,QAAQ;AACtE,UACE,CAAC,OAAO,cAAc,SAAS,KAC/B,YAAY,KACZ,CAAC,OAAO,cAAc,QAAQ,QAAQ,KAAK,KAC3C,QAAQ,QAAQ,QAAQ,KACxB,QAAQ,QAAQ,QAAQ,gBACxB,CAAAA,SAAQ,+DAA+D;AACzE,YAAM,QAA4B;AAAA,QAChC,kBAAkB,qBAAqB,SAAS,SAAS,GAAG;AAAA,QAC5D,aAAa,SAAS,SAAS;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,SAAS,SAAS;AAAA,QAC3B,YAAY,SAAS,KAAK;AAAA,QAC1B,yBAAyB,SAAS,KAAK;AAAA,QACvC,WAAW,SAAS,KAAK;AAAA,QACzB,UAAU,SAAS,QAAQ,UAAU;AAAA,QACrC,SAAS,SAAS,QAAQ,UAAU,aAClC,SAAS,QAAQ,UAAU;AAAA,MAC/B;AACA,kBAAY,IAAI,MAAM,kBAAkB,KAAK;AAC7C,aAAO,gBAAgB,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,UAAU,SAAS;AACvB,YAAM,WAAW,MAAM,UAAU,SAAS,sBAAsB;AAAA,QAC9D;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,aAAa;AAAA,QACjB;AAAA,QACA;AAAA,UACE,QAAQ,QAAQ;AAAA,UAChB;AAAA,QACF;AAAA,QACA,SAAS,SAAS;AAAA,QAClB;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,IAAI,SAAS,SAAS,GAAG;AACjD,UACE,CAAC,WACD,QAAQ,mBAAmB,QAAQ,QAAQ,kBAC3C,WAAW,WACX,KAAK,MAAM,WAAW,SAAS,KAAK,IAAI,EAAE,QAAQ,GAClD;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UACE,CAAC,OAAO,cAAc,QAAQ,QAAQ,KAAK,KAC3C,QAAQ,QAAQ,QAAQ,KACxB,QAAQ,QAAQ,QAAQ,kBACxB,CAAAA,SAAQ,yCAAyC;AACnD,YAAM,SAAS,oBAAoB,SAAS,SAAS,GAAG,IAAI,QAAQ,QAAQ,oBAAoB;AAChG,YAAM,YAA+B;AAAA,QACnC,iBAAiB;AAAA,QACjB,kBAAkB,WAAW;AAAA,QAC7B,aAAa,SAAS,SAAS;AAAA,QAC/B,OAAO,QAAQ;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,WAAW,IAAI;AAAA,UACb,KAAK;AAAA,YACH,IAAI,EAAE,QAAQ,IAAI,QAAQ,QAAQ;AAAA,YAClC,KAAK,MAAM,SAAS,KAAK,SAAS;AAAA,UACpC;AAAA,QACF,EAAE,YAAY;AAAA,QACd,UAAU;AAAA,MACZ;AACA,iBAAW,IAAI,QAAQ,SAAS;AAChC,aAAO,gBAAgB,SAAS;AAAA,IAClC;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,WAAW,MAAM,UAAU,SAAS,mBAAmB;AAAA,QAC3D;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,MAAAG;AAAA,QACE,QAAQ,QAAQ;AAAA,QAChB,CAAC,UAAU,gBAAgB;AAAA,QAC3B;AAAA,MACF;AACA,YAAM,YAAY;AAAA,QAChB;AAAA,QACA;AAAA,UACE,QAAQ,QAAQ;AAAA,UAChB;AAAA,QACF;AAAA,QACA,SAAS,SAAS;AAAA,QAClB;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,IAAI,SAAS,SAAS,GAAG;AACjD,UACE,CAAC,WACD,UAAU,YACV,KAAK,MAAM,UAAU,SAAS,KAAK,IAAI,EAAE,QAAQ,KACjD,QAAQ,QAAQ,yBACd,QAAQ,QAAQ,wBAClB,QAAQ,QAAQ,mBAAmB,QAAQ,kBAC3C,QAAQ,QAAQ,aAAa,WAAW,6BACxC,QAAQ,QAAQ,aAAa,mBAAmB,QAAQ,kBACxD,QAAQ,QAAQ,UAAU,QAAQ,aAClC;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UACE,CAAC,MAAM,QAAQ,QAAQ;AAAA,QACrB,QAAQ,QAAQ;AAAA,QAChB,SAAS,KAAK;AAAA,MAChB,KACA,CAAC,MAAM,QAAQ,QAAQ,kBAAkB;AAAA,QACvC,gBAAgB,SAAS,SAAS;AAAA,QAClC,sBAAsB,QAAQ,QAAQ;AAAA,QACtC,iBAAiB,QAAQ,QAAQ;AAAA,QACjC,WAAW,QAAQ,QAAQ,MAAM;AAAA,QACjC,WAAW,QAAQ,QAAQ,MAAM;AAAA,MACnC,CAAC,GACD;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,gBAAU,WAAW;AACrB,YAAM,WAA6B;AAAA,QACjC,gBAAgB,mBAAmB,SAAS,SAAS,GAAG,IAAI,QAAQ,QAAQ,oBAAoB;AAAA,QAChG,aAAa,SAAS,SAAS;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,SAAS,SAAS;AAAA,QAC3B,YAAY,SAAS,KAAK;AAAA,QAC1B,gBAAgB,QAAQ,QAAQ;AAAA,QAChC,gBAAgB,QAAQ;AAAA,QACxB,mBAAmB;AAAA,QACnB,gBAAgB,QAAQ;AAAA,QACxB,UAAU,IAAI,EAAE,YAAY;AAAA,QAC5B,SAAS;AAAA,MACX;AACA,iBAAW,IAAI,SAAS,gBAAgB,QAAQ;AAChD,aAAO,gBAAgB,QAAQ;AAAA,IACjC;AAAA,IACA,MAAM,aAAa,SAAS;AAC1B,YAAM,WAAW,MAAM,UAAU,SAAS,0BAA0B;AAAA,QAClE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,WAAW;AAAA,QACf;AAAA,QACA,qBAAqB,QAAQ,QAAQ,gBAAgB,gBAAgB;AAAA,QACrE,SAAS,SAAS;AAAA,QAClB;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,IAAI,SAAS,SAAS,GAAG;AACjD,UACE,CAAC,WACD,SAAS,WACT,QAAQ,QAAQ,WAAW,gBAC3B,QAAQ,QAAQ,aAAa,SAAS,KAAK,YAC3C,QAAQ,QAAQ,mBAAmB,SAAS,kBAC5C,CAAC,OAAO,cAAc,QAAQ,QAAQ,KAAK,KAC3C,QAAQ,QAAQ,QAAQ,KACxB,QAAQ,QAAQ,QAAQ,iBACxB;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,gBAAgB,MAAM;AAAA,QAC1B,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,SAAS,SAAS;AAAA,QAClB;AAAA,UACE,GAAG,QAAQ;AAAA,UACX,OAAO,QAAQ,QAAQ;AAAA;AAAA;AAAA,UAGvB,sBAAsB,MAAM;AAAA,UAC5B,mBAAmB,MAAM;AAAA,QAC3B;AAAA,QACA;AAAA,MACF;AACA,UACE,cAAc,QAAQ,UAAU,YAChC,CAAC,cAAc,OAAO,YACtB,CAAC,cAAc,OAAO,WACtB;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,UAA2B;AAAA,QAC/B,eAAe,kBAAkB,cAAc,SAAS,IAAI;AAAA,QAC5D,gBAAgB,SAAS;AAAA,QACzB,aAAa,SAAS,SAAS;AAAA,QAC/B,QAAQ;AAAA,QACR,UAAU,cAAc,KAAK;AAAA,QAC7B,gBAAgB,SAAS;AAAA,QACzB,UAAU,cAAc,OAAO;AAAA,QAC/B,WAAW,cAAc,OAAO;AAAA,QAChC,SAAS;AAAA,MACX;AACA,eAAS,IAAI,QAAQ,eAAe,OAAO;AAC3C,aAAO,gBAAgB,OAAO;AAAA,IAChC;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,UAAU,SAAS,mBAAmB;AAAA,QAC1C;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,MAAAF;AAAA,QACE;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,WAAW,MAAM,UAAU,SAAS,mBAAmB;AAAA,QAC3D;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,WAAW;AAAA,QACf;AAAA,QACA,qBAAqB,QAAQ,QAAQ,gBAAgB,gBAAgB;AAAA,QACrE,SAAS,SAAS;AAAA,QAClB;AAAA,MACF;AACA,YAAM,SAAS,qBAAqB,QAAQ,QAAQ,QAAQ,QAAQ;AACpE,YAAM,UAAU,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE;AAAA,QACrC,CAAC,cAAc,UAAU,mBAAmB,SAAS;AAAA,MACvD;AACA,UAAI,SAAS;AACX,cAAM;AAAA,UACJ,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ,cAAc,MAAM,kBAAkB,MAAM;AAAA,UACpD;AAAA,UACA;AAAA,QACF;AACA,gBAAQ,UAAU;AAAA,MACpB;AACA,eAAS,UAAU;AACnB,eAAS,eAAe;AACxB,aAAO,gBAAgB,QAAQ;AAAA,IACjC;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,WAAW,MAAM,UAAU,SAAS,oBAAoB,CAAC,QAAQ,CAAC;AACxE,YAAM,SAAS,qBAAqB,QAAQ,QAAQ,QAAQ,QAAQ;AACpE,YAAM,aAAoD;AAAA,QACxD,YAAY,IAAI,MAAM,IAClB,EAAE,MAAM,cAAc,OAAO,YAAY,IAAI,MAAM,EAAG,IACtD;AAAA,QACJ,WAAW,IAAI,MAAM,IACjB,EAAE,MAAM,aAAa,OAAO,WAAW,IAAI,MAAM,EAAG,IACpD;AAAA,QACJ,WAAW,IAAI,MAAM,IACjB,EAAE,MAAM,YAAY,OAAO,WAAW,IAAI,MAAM,EAAG,IACnD;AAAA,QACJ,SAAS,IAAI,MAAM,IACf,EAAE,MAAM,WAAW,OAAO,SAAS,IAAI,MAAM,EAAG,IAChD;AAAA,MACN;AACA,YAAM,QAAQ,WAAW;AAAA,QACvB,CAAC,cAAc,WAAW,MAAM,gBAAgB,SAAS,SAAS;AAAA,MACpE;AACA,aAAO,QAAQ,gBAAgB,KAAK,IAAI;AAAA,IAC1C;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,kBAAkB,gBAAgB,SAAS;AAC/C,YAAM,aAAa,MAAM,QAAQ,MAAM,IAAI;AAAA,QACzC,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,MAAM;AAAA,MACR,CAAC;AACD,UAAI,CAAC,YAAY;AACf,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,qBAAqB,cAAc;AAAA,UAC5C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UACE,CAAC,QAAQ,kBACT,QAAQ,eAAe,SAAS,QAChC,CAAC,QAAQ,wBACT,QAAQ,qBAAqB,SAAS,OACtC,CAAC,QAAQ,mBACT,QAAQ,gBAAgB,SAAS,KAAK,QACtC,CAAC,QAAQ,yBACT,QAAQ,sBAAsB,SAAS,OACvC,CAAC,QAAQ,MAAM,aACf,QAAQ,MAAM,UAAU,SAAS,KAAK,QACtC,CAAC,QAAQ,MAAM,aACf,QAAQ,MAAM,UAAU,SAAS,KAAK,QACtC,CAAC,OAAO,cAAc,QAAQ,KAAK,KACnC,QAAQ,QAAQ,EAChB,CAAAD,SAAQ,wDAAwD;AAClE,YAAM,mBAAmB,KAAK,MAAM,WAAW,KAAK,SAAS,IAC3D,IAAI,EAAE,QAAQ;AAChB,UAAI,CAAC,OAAO,cAAc,gBAAgB,KAAK,mBAAmB,GAAG;AACnE,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,qBAAqB,cAAc;AAAA,UAC5C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,OAAO,IAAI,WAAW,SAAS,GAAG,GAAG;AACvC,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,qBAAqB,cAAc;AAAA,UAC5C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,aAAO,IAAI,WAAW,SAAS,GAAG;AAClC,UAAI;AACF,cAAM,iBAAiB,MAAME,QAAO;AAAA,UAClC,uBAAuB,QAAQ;AAAA,UAC/B,UAAU,WAAW,KAAK;AAAA,UAC1B,sBAAsB,QAAQ;AAAA,QAChC,CAAC;AACD,cAAM,cAAc,MAAMA,QAAO;AAAA,UAC/B,WAAW,QAAQ,MAAM;AAAA,QAC3B,CAAC;AACD,cAAM,iBAAiB,MAAMA,QAAO;AAAA,UAClC,WAAW,QAAQ,MAAM;AAAA,UACzB,WAAW,QAAQ,MAAM;AAAA,UACzB,iBAAiB,QAAQ;AAAA,UACzB;AAAA,QACF,CAAC;AACD,gBAAQ,IAAI,WAAW,SAAS,KAAK;AAAA,UACnC;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AACD,cAAM,OAAO,CACX,QACA,SACA,QACA,kBAEA,QAAQ,cAAc;AAAA,UACpB;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO,QAAQ;AAAA,UACf,gBAAgB,GAAG,WAAW,SAAS,GAAG,IAAI,MAAM,IAAI,QAAQ,oBAAoB;AAAA,UACpF;AAAA,QACF,CAAC;AACH,cAAM,aAAa,KAAK,MAAM,WAAW,KAAK,SAAS;AACvD,cAAM,YAAY,aAAa,IAAI,EAAE,QAAQ;AAC7C,YAAI,CAAC,OAAO,cAAc,SAAS,KAAK,YAAY,GAAG;AACrD,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,qBAAqB,cAAc;AAAA,YAC5C,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,cAAM,oBAAoB,MAAM,OAAO,OAAO;AAAA,UAC5C;AAAA,UACA;AAAA,YACE,QAAQ;AAAA,YACR,SAAS,WAAW,SAAS;AAAA,YAC7B,YAAY,WAAW,KAAK;AAAA,YAC5B,yBAAyB,WAAW,KAAK;AAAA;AAAA;AAAA;AAAA,YAIzC,OAAO;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF,CAAC;AACD,cAAM,YAAY,MAAM,OAAO,UAAU;AAAA,UACvC;AAAA,UACA;AAAA,YACE,kBAAkB,kBAAkB;AAAA,YACpC;AAAA,YACA,OAAO;AAAA,UACT;AAAA,UACA;AAAA,UACA,CAAC,oBAAoB,kBAAkB,OAAO;AAAA,QAChD,CAAC;AACD,cAAM,WAAW,MAAM,OAAO,OAAO;AAAA,UACnC;AAAA,UACA;AAAA,YACE,iBAAiB,UAAU;AAAA,YAC3B,sBAAsB,QAAQ;AAAA,YAC9B;AAAA,YACA,aAAa;AAAA,cACX,QAAQ;AAAA,cACR;AAAA,YACF;AAAA,YACA,OAAO;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF,CAAC;AACD,cAAM,OAAO,aAAa;AAAA,UACxB;AAAA,UACA;AAAA,YACE,gBAAgB,SAAS;AAAA,YACzB,QAAQ;AAAA,YACR,UAAU,WAAW,KAAK;AAAA,YAC1B;AAAA,YACA,OAAO,KAAK,IAAI,QAAQ,OAAO,eAAe;AAAA,UAChD;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF,CAAC;AACD,cAAM,UAAU,MAAM,QAAQ,MAAM,IAAuB;AAAA,UACzD,YAAY;AAAA,UACZ,MAAM;AAAA,UACN,MAAM,WAAW,WAAW,SAAS,GAAG;AAAA,QAC1C,CAAC;AACD,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO;AAAA,MACT,UAAE;AACA,gBAAQ,OAAO,WAAW,SAAS,GAAG;AACtC,eAAO,OAAO,WAAW,SAAS,GAAG;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AACF;;;AC1sBO,SAAS,6BACd,OACA,QACA,SAC8B;AAC9B,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,QAAQ,QAAQ,UAAU,CAAC,OAAe,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAChG,QAAM,aAAa,QAAQ,uBAAuB;AAClD,QAAM,sBAAsB,QAAQ,uBAAuB;AAC3D,QAAM,UAAU,QAAQ,YAAY,MAAY;AAAA,EAAC;AAEjD,QAAM,iBAAiB,oBAAI,IAA4C;AACvE,MAAI,UAAU;AACd,MAAI,WAA0B,QAAQ,QAAQ;AAE9C,iBAAe,oBACb,WACA,OACe;AACf,aAAS,UAAU,GAAG,UAAU,qBAAqB,WAAW,GAAG;AACjE,YAAM,UAAU,MAAM,MAAM,IAAI,SAAS;AACzC,UAAI,CAAC,QAAS;AACd,UAAI;AACF,cAAM,MAAM;AAAA,UACV,QAAQ;AAAA,UACR;AAAA,UACA,EAAE,GAAG,QAAQ,QAAQ,GAAG,MAAM;AAAA,UAC9B,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,QACtD;AACA;AAAA,MACF,SAASG,QAAO;AACd,YAAIA,kBAAiB,sBAAsBA,OAAM,SAAS,WAAY;AACtE,cAAMA;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,aAAa,UAAU,IAAI,4BAA4B,mBAAmB;AAAA,MACnF,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,iBAAe,aAAa,SAAiC;AAC3D,eAAW,aAAa,eAAe,OAAO,GAAG;AAC/C,UAAI;AACF,cAAM,oBAAoB,WAAW,EAAE,SAAS,WAAW,IAAI,EAAE,YAAY,EAAE,CAAC;AAAA,MAClF,SAASA,QAAO;AACd,gBAAQA,MAAK;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,cAA6B;AAC1C,QAAI;AACJ,QAAI;AACF,sBAAgB,MAAM,4BAA4B,QAAQ,QAAQ,aAAa;AAAA,IACjF,SAASA,QAAO;AAGd,cAAQA,MAAK;AACb,YAAM,aAAa,KAAK;AACxB;AAAA,IACF;AAEA,eAAW,iBAAiB,cAAc,cAAc;AACtD,YAAM,YAA4C;AAAA,QAChD,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,MAAM,cAAc,SAAS;AAAA,MAC/B;AACA,UAAI;AACF,YAAI,CAAE,MAAM,MAAM,IAAI,SAAS,GAAI;AACjC,gBAAM,MAAM,OAAO,QAAQ,OAAO,aAAa;AAAA,QACjD;AAAA,MACF,SAASA,QAAO;AACd,gBAAQA,MAAK;AAAA,MACf;AAAA,IACF;AAEA,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,oBAAoB,cAAc,WAAW;AACtD,YAAM,OAAO,iBAAiB,SAAS;AACvC,UAAI,CAAC,KAAM;AACX,YAAM,YAA4C;AAAA,QAChD,YAAY;AAAA,QACZ,MAAM;AAAA,QACN;AAAA,MACF;AACA,WAAK,IAAI,IAAI;AACb,UAAI;AACF,YAAI,CAAE,MAAM,MAAM,IAAI,SAAS,GAAI;AACjC,gBAAM,MAAM,OAAO,QAAQ,OAAO,gBAAgB;AAAA,QACpD;AACA,uBAAe,IAAI,MAAM,SAAS;AAClC,cAAM,oBAAoB,WAAW;AAAA,UACnC,SAAS,cAAc,OAAO;AAAA,UAC9B,WAAW,IAAI,EAAE,YAAY;AAAA,QAC/B,CAAC;AAAA,MACH,SAASA,QAAO;AACd,gBAAQA,MAAK;AAAA,MACf;AAAA,IACF;AAGA,eAAW,CAAC,MAAM,SAAS,KAAK,CAAC,GAAG,cAAc,GAAG;AACnD,UAAI,KAAK,IAAI,IAAI,EAAG;AACpB,UAAI;AACF,cAAM,MAAM,OAAO,QAAQ,OAAO,SAAS;AAAA,MAC7C,SAASA,QAAO;AACd,gBAAQA,MAAK;AAAA,MACf;AACA,qBAAe,OAAO,IAAI;AAAA,IAC5B;AAAA,EACF;AAEA,WAAS,aAA4B;AACnC,eAAW,SAAS,KAAK,MAAM,YAAY,CAAC,EAAE,MAAM,OAAO;AAC3D,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,aAAa,MAAM;AAC7B,UAAM,YAAY;AAChB,aAAO,CAAC,SAAS;AACf,cAAM,WAAW;AACjB,YAAI,QAAS;AACb,cAAM,MAAM,UAAU;AAAA,MACxB;AAAA,IACF,GAAG,EAAE,MAAM,OAAO;AAAA,EACpB;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM,OAAO;AACX,gBAAU;AACV,YAAM,SAAS,MAAM,MAAM,MAAS;AACpC,YAAM,aAAa,KAAK;AAAA,IAC1B;AAAA,EACF;AACF;;;ACrGO,SAAS,mBAAmB,SAA4C;AAC7E,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,UAAU,QAAQ,YAAY,MAAM;AAAA,EAAC;AAC3C,QAAM,eAAe,QAAQ,gBAAgB;AAG7C,QAAM,WAAW,oBAAI,IAAkC;AAEvD,QAAM,cAAc,oBAAI,IAAgC;AAExD,QAAM,aAAa,oBAAI,IAAsB;AAE7C,WAAS,eAAe,UAAwB;AAC9C,UAAM,QAAQ,QAAQ;AACtB,QAAI,CAAC,MAAO;AACZ,UAAM,KAAK,IAAI,EAAE,QAAQ;AACzB,UAAM,cAAc,KAAK;AACzB,UAAM,OAAO,WAAW,IAAI,QAAQ,KAAK,CAAC,GAAG,OAAO,CAAC,cAAc,aAAa,WAAW;AAC3F,QAAI,IAAI,UAAU,OAAO;AACvB,YAAM,eAAe,KAAK,IAAI,GAAG,IAAI,CAAC,IAAI,MAAO,EAAE;AACnD,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,8CAA8C,KAAK;AAAA,QAC5D,WAAW;AAAA,QACX;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI,KAAK,EAAE;AACX,eAAW,IAAI,UAAU,GAAG;AAAA,EAC9B;AAEA,iBAAe,cAAc,SAAwE;AACnG,UAAM,SAAS,MAAM,QAAQ,OAAO,wBAAwB,QAAQ,cAAc;AAAA,MAChF,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,MACvE,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,IAC5E,CAAC;AAGD,QAAI,OAAO,aAAa,CAAC,QAAQ,WAAW;AAC1C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QACE,OAAO,cAAc,eAAe,QAAQ,cAAc,cAC1D,OAAO,cAAc,SAAS,QAAQ,cAAc,QACpD,OAAO,cAAc,SAAS,QAAQ,cAAc,MACpD;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,OAAO,eAAe,QAAQ,gBAAgB,OAAO,aAAa;AACpE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,mBAAe,OAAO,QAAQ;AAC9B,UAAM,aAAa,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,MAAM,aAAa,OAAO,QAAQ,EAAE;AAChG,UAAM,gBAAgB,OAAO,QAAQ;AACrC,QAAI,kBAAkB,UAAa,cAAc,eAAe;AAC9D,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,8CAA8C,aAAa;AAAA,QACpE,WAAW;AAAA,QACX,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,WAAS,YACP,SACA,QACA,QACwB;AACxB,UAAM,eAAwD,OAAO,SACjE;AAAA,MACA,YAAY,OAAO,OAAO;AAAA,MAC1B,MAAM,OAAO,OAAO;AAAA,MACpB,MAAM,OAAO,OAAO;AAAA;AAAA;AAAA,MAGpB,KAAK,OAAO,OAAO,OAAO;AAAA,IAC5B,IACE;AAGJ,WAAO;AAAA,MACL,QAAQ,QAAQ;AAAA,MAChB,MAAM;AAAA,QACJ,eAAe,OAAO;AAAA,QACtB,IAAK,OAAO,eAAe,QAAQ,iBAAiB,SAChD,EAAE,aAAa,OAAO,eAAe,QAAQ,YAAY,IACzD,CAAC;AAAA,QACL,GAAI,eAAe,EAAE,QAAQ,aAAa,IAAI,CAAC;AAAA,QAC/C,GAAI,OAAO,YAAY,SAAY,EAAE,YAAY,OAAO,QAAQ,IAAI,CAAC;AAAA,QACrE,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,QACjE,iBAAiB,OAAO;AAAA,QACxB,GAAI,OAAO,iBAAiB,SAAY,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,QACjF,GAAI,QAAQ,wBAAwB,SAAY,EAAE,qBAAqB,QAAQ,oBAAoB,IAAI,CAAC;AAAA,MAC1G;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,OAAOC,SAA+C;AACnE,QAAI;AACF,YAAM,QAAQ,UAAU,WAAWA,OAAM;AAAA,IAC3C,SAASC,QAAO;AACd,cAAQA,MAAK;AAAA,IACf;AAAA,EACF;AAEA,kBAAgB,SAAS,SAAuE;AAC9F,UAAM,YAAY,IAAI;AACtB,UAAM,SAAS,MAAM,cAAc,OAAO;AAC1C,gBAAY,IAAI,OAAO,UAAU,OAAO,QAAQ,IAAI;AACpD,aAAS,IAAI,QAAQ,QAAQ,EAAE,UAAU,OAAO,SAAS,CAAC;AAI1D,UAAM,kBAAkB,OAAO,QAAQ;AACvC,UAAM,mBAAyC;AAAA,MAC7C,GAAG;AAAA,MACH,GAAI,oBAAoB,SACpB,EAAE,iBAAiB,KAAK,IAAI,QAAQ,mBAAmB,iBAAiB,eAAe,EAAE,IACzF,CAAC;AAAA,IACP;AAEA,QAAI,cAAc;AAClB,QAAI,eAAe;AACnB,QAAI,QAAwC;AAC5C,QAAI;AAEJ,QAAI;AACF,uBAAiB,SAAS,QAAQ,SAAS,SAAS,gBAAgB,GAAG;AACrE,YAAI,MAAM,SAAS,SAAS;AAE1B,wBAAc,KAAK,IAAI,aAAa,MAAM,OAAO,eAAe,CAAC;AACjE,yBAAe,KAAK,IAAI,cAAc,MAAM,OAAO,gBAAgB,CAAC;AACpE,gBAAM,QAAQ,cAAc,gBAAgB;AAC5C,gBAAM,YAAY,OAAO,QAAQ,mBAAmB,UAAa,cAAc,OAAO,OAAO;AAC7F,gBAAM,aAAa,OAAO,QAAQ,oBAAoB,UAAa,eAAe,OAAO,OAAO;AAChG,gBAAM,WAAW,OAAO,QAAQ,YAAY,UAAa,OAAO,OAAO,OAAO;AAC9E,cAAI,aAAa,cAAc,UAAU;AACvC,oBAAQ;AACR,sBAAU;AAAA,cACR,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,kBAAM,QAAQ,SAAS,SAAS,QAAQ,MAAM;AAC9C,kBAAM,EAAE,MAAM,SAAS,OAAO,QAAQ;AACtC;AAAA,UACF;AACA;AAAA,QACF;AACA,YAAI,MAAM,SAAS,SAAS;AAC1B,kBAAQ,MAAM,OAAO,SAAS,cAAc,cAAc;AAC1D,oBAAU,MAAM;AAAA,QAClB;AACA,cAAM;AAAA,MACR;AACA,UAAI,UAAU,eAAe,QAAQ,QAAQ,SAAS;AACpD,gBAAQ;AAAA,MACV;AAAA,IACF,SAASA,QAAO;AACd,cAAQ;AACR,gBAAUA,kBAAiB,qBACvB,EAAE,MAAMA,OAAM,MAAM,SAASA,OAAM,SAAS,WAAWA,OAAM,UAAU,IACvE,EAAE,MAAM,YAAY,SAASA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK,GAAG,WAAW,MAAM;AAC1G,YAAMA;AAAA,IACR,UAAE;AACA,eAAS,OAAO,QAAQ,MAAM;AAC9B,YAAM,cAAc,IAAI;AACxB,YAAM,OAAO,YAAY,SAAS,QAAQ;AAAA,QACxC;AAAA,QACA,OAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA,OAAO,cAAc,gBAAgB;AAAA,UACrC,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,QACzE;AAAA,QACA,WAAW,YAAY,QAAQ,IAAI,UAAU,QAAQ;AAAA,QACrD,WAAW,UAAU,YAAY;AAAA,QACjC,aAAa,YAAY,YAAY;AAAA,QACrC,GAAI,UAAU,EAAE,OAAO,QAAQ,IAAI,CAAC;AAAA,MACtC,CAAC,CAAC;AAAA,IACJ;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,aAAa;AACjB,UAAI,CAAC,QAAQ,SAAS,WAAY,QAAO,CAAC;AAC1C,aAAO,QAAQ,SAAS,WAAW;AAAA,IACrC;AAAA,IACA,MAAM,YAAY;AAChB,UAAI,QAAQ,SAAS,UAAW,QAAO,QAAQ,SAAS,UAAU;AAClE,aAAO,EAAE,SAAS,MAAM,QAAQ,iBAAiB,WAAW,IAAI,EAAE,YAAY,EAAE;AAAA,IAClF;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAgB;AAC3B,YAAM,QAAQ,SAAS,SAAS,MAAM;AAAA,IACxC;AAAA,IACA,aAAa,UAAkB;AAC7B,cAAQ,OAAO,wBAAwB,QAAQ;AAC/C,iBAAW,CAAC,QAAQ,KAAK,KAAK,UAAU;AACtC,YAAI,MAAM,aAAa,SAAU,MAAK,QAAQ,SAAS,SAAS,MAAM;AAAA,MACxE;AAAA,IACF;AAAA,IACA,iBAAiB,SAAiB;AAChC,iBAAW,CAAC,UAAU,SAAS,KAAK,aAAa;AAC/C,YAAI,cAAc,SAAS;AACzB,kBAAQ,OAAO,wBAAwB,QAAQ;AAC/C,qBAAW,CAAC,QAAQ,KAAK,KAAK,UAAU;AACtC,gBAAI,MAAM,aAAa,SAAU,MAAK,QAAQ,SAAS,SAAS,MAAM;AAAA,UACxE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AA0CO,SAAS,iCAAiC,SAA0D;AACzG,MAAI,WAAW;AACf,SAAO;AAAA,IACL,MAAM,QAAQ,QAAQ;AAAA,IACtB,SAAS,QAAQ,YACd,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ,QAAQ,cAAc;AAAA,IAC7E,OAAO,QAAQ;AAAA,IACf,KAAK,SAAkB;AACrB,YAAM,SAAU,WAAW,CAAC;AAC5B,kBAAY;AACZ,YAAM,iBAAiB,OAAO,OAAO,mBAAmB,WAAW,OAAO,iBAAiB;AAC3F,YAAM,SAAS,QAAQ,mBAAmB,SAAS,QAAQ,KAAK,QAAQ,cAAc,IAAI,QAAQ;AAClG,YAAM,WAAY,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAW,CAAC;AACtE,YAAM,eAAe,QAAQ,mBAAmB,OAAO,KAAK,QAAQ;AAEpE,cAAQ,mBAAyD;AAC/D,cAAM,SAAS,MAAM,QAAQ,OAAO,uBAAuB;AAAA,UACzD,eAAe,QAAQ;AAAA,UACvB,GAAI,QAAQ,gBAAgB,SAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,UAChF,GAAI,QAAQ,iBAAiB,SAAY,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;AAAA,UACnF,GAAI,eAAe,EAAE,QAAQ,aAAa,IAAI,CAAC;AAAA,UAC/C,GAAI,gBAAgB,QAAQ,YAAY,SACpC,EAAE,SAAS,QAAQ,QAAQ,IAC3B,CAAC;AAAA,UACL,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,UAC1E,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,UACjE,GAAI,QAAQ,gBAAgB,SAAY,EAAE,OAAO,QAAQ,YAAY,IAAI,CAAC;AAAA,QAC5E,CAAC;AACD,YAAI;AACF,2BACQ,SAAS,QAAQ,QAAQ,SAAS;AAAA,YACtC;AAAA,YACA,eAAe,QAAQ;AAAA,YACvB,GAAI,QAAQ,gBAAgB,SAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,YAChF;AAAA,YACA,cAAc,OAAO;AAAA,YACrB,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,YAC1E,GAAI,OAAO,WAAW,SAAY,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,UACjE,CAAC,GACD;AACA,gBAAI,MAAM,SAAS,WAAW,MAAM,UAAU,QAAW;AACvD,oBAAM,MAAM;AAAA,YACd,WAAW,MAAM,SAAS,SAAS;AACjC,oBAAM,IAAI;AAAA,gBACP,MAAM,SAAgD;AAAA,kBACrD,MAAM;AAAA,kBACN,SAAS;AAAA,kBACT,WAAW;AAAA,gBACb;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF,UAAE;AAEA,kBAAQ,OAAO,wBAAwB,OAAO,OAAO,QAAQ;AAAA,QAC/D;AAAA,MACF,GAAG;AAAA,IACL;AAAA,EACF;AACF;;;AC/WA,SAAS,gBAAgB,OAAiD;AACxE,SAAO,SAAS,QAAQ,OAAO,UAAU,YAAY,OAAO,iBAAiB;AAC/E;AAEA,SAAS,oBAAoB,OAAgB,iBAAkE;AAC7G,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,OAAO,mBAAmB,MAAM,SAAS,kBAAkB,GAAG,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ;AAC3G,WAAO,EAAE,KAAK;AAAA,EAChB;AACA,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,QAAI,OAAO;AACX,QAAI,aAAa,SAAS,OAAO,MAAM,YAAY,UAAU;AAC3D,aAAO,MAAM;AAAA,IACf,WAAW,YAAY,SAAS,OAAO,MAAM,WAAW,UAAU;AAChE,aAAO,MAAM;AAAA,IACf,OAAO;AACL,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AACA,UAAM,YAAY,mBAAmB,KAAK,SAAS,kBAAkB,GAAG,KAAK,MAAM,GAAG,eAAe,CAAC,QAAQ;AAC9G,WAAO,EAAE,MAAM,WAAW,YAAY,MAAM;AAAA,EAC9C;AACA,SAAO,EAAE,MAAM,OAAO,KAAK,EAAE;AAC/B;AAEO,SAAS,mCACd,UACA,SACqB;AACrB,iBAAe,QACb,WACA,mBAII,CAAC,GAC2B;AAChC,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,UAAM,SAAS,UAAU,KAAK,QAAQ;AAEtC,UAAM,gBAAqC;AAAA,MACzC,GAAG,UAAU;AAAA,MACb,OAAO;AAAA,MACP;AAAA,MACA,WAAW,UAAU,QAAQ,YAAY,KAAK;AAAA,IAChD;AACA,UAAM,mBAA0C,EAAE,GAAG,WAAW,QAAQ,cAAc;AACtF,QAAI;AAEJ,aAAS,wBAA+C;AACtD,UAAI,CAAC,SAAU,QAAO;AACtB,aAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ;AAAA,UACN,GAAG,iBAAiB;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,iBAAiB,QAAQ,SAAS;AACpC,aAAO,OAAO;AAAA,QACZ,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,MACF,CAAC;AAAA,IACH;AAEA,mBAAe,MACb,kBACA,QACe;AACf,UAAI;AACF,cAAM,QAAQ,UAAU,kBAAkB,MAAM;AAAA,MAClD,QAAQ;AAAA,MAGR;AAAA,IACF;AAEA,mBAAe,OACb,QACgC;AAChC,YAAM,mBAAmB,sBAAsB;AAC/C,YAAM,MAAM,kBAAkB,MAAM;AACpC,aAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ;AAAA,UACN,GAAG,iBAAiB;AAAA,UACpB,OAAO;AAAA,UACP;AAAA,UACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACtC;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACJ,QAAI,QAAQ,WAAW;AACrB,YAAM,WAAW,sBAAsB,QAAQ,WAAW,SAAS;AACnE,UAAI,SAAS,WAAW,QAAQ;AAC9B,eAAO,OAAO;AAAA,UACZ,OAAO;AAAA,YACL,MAAM;AAAA,YACN,SAAS,SAAS,UAAU,qDAAqD,SAAS,MAAM;AAAA,YAChG,WAAW;AAAA,YACX,SAAS,EAAE,iBAAiB,SAAS,OAAO;AAAA,UAC9C;AAAA,QACF,CAAC;AAAA,MACH;AACA,UAAI,SAAS,WAAW,oBAAoB;AAC1C,yBAAiB,SAAS,UACxB,oCAAoC,SAAS,MAAM;AAAA,MACvD;AAAA,IACF;AAEA,QAAI,UAAU,KAAK,QAAQ,iBAAiB;AAC1C,yBAAmB;AAAA,IACrB;AAEA,QAAI,gBAAgB;AAClB,UAAI,CAAC,QAAQ,gBAAgB;AAC3B,eAAO,OAAO;AAAA,UACZ,OAAO;AAAA,YACL,MAAM;AAAA,YACN,SAAS,GAAG,cAAc;AAAA,YAC1B,WAAW;AAAA,UACb;AAAA,QACF,CAAC;AAAA,MACH;AACA,UAAI;AACF,cAAM,WAAW,MAAM,QAAQ,eAAe,gBAAgB;AAAA,UAC5D,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,QAAQ,iBAAiB;AAAA,QAC3B,CAAC;AACD,YACE,CAAC,SAAS,cACV,CAAC,SAAS,SACV,CAAC,SAAS,aACT,SAAS,aAAa,WAAW,SAAS,aAAa,UACxD,OAAO,MAAM,KAAK,MAAM,SAAS,SAAS,CAAC,GAC3C;AACA,iBAAO,MAAM,OAAO;AAAA,YAClB,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF,CAAC;AAAA,QACH;AACA,mBAAW;AACX,YAAI,iBAAiB,QAAQ,SAAS;AACpC,iBAAO,MAAM,OAAO;AAAA,YAClB,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF,CAAC;AAAA,QACH;AACA,YAAI,SAAS,aAAa,SAAS;AACjC,iBAAO,MAAM,OAAO;AAAA,YAClB,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,SAAS,UAAU;AAAA,cAC5B,WAAW;AAAA,YACb;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,QAAQ;AACN,eAAO,OAAO;AAAA,UACZ,OAAO;AAAA,YACL,MAAM,iBAAiB,QAAQ,UAC3B,cACA;AAAA,YACJ,SAAS,iBAAiB,QAAQ,UAC9B,yCACA;AAAA,YACJ,WAAW;AAAA,UACb;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,OAAO,SAAS,QAAQ,MAAM;AACpC,QAAI,OAAO,SAAS,YAAY;AAC9B,aAAO,OAAO;AAAA,QACZ,OAAO,EAAE,MAAM,eAAe,SAAS,SAAS,MAAM,6CAA6C,WAAW,MAAM;AAAA,MACtH,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,OAAO;AACb,YAAM,mBAAuC,iBAAiB,SAC1D,EAAE,GAAG,QAAQ,SAAS,iBAAiB,iBAAiB,OAAO,IAC/D,QAAQ;AACZ,YAAM,MAAM,MAAM,KAAK,UAAU,KAAK,aAAa,CAAC,GAAG,gBAAgB;AACvE,UAAI;AACJ,UAAI,gBAAgB,GAAG,GAAG;AACxB,cAAM,SAAoB,CAAC;AAC3B,cAAM,WAAW,IAAI,OAAO,aAAa,EAAE;AAC3C,YAAI;AACF,iBAAO,MAAM;AACX,gBAAI,iBAAiB,QAAQ,SAAS;AACpC,oBAAM,IAAI,aAAa,2BAA2B,YAAY;AAAA,YAChE;AACA,kBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,gBAAI,KAAK,KAAM;AACf,mBAAO,KAAK,KAAK,KAAK;AAAA,UACxB;AAAA,QACF,UAAE;AACA,gBAAM,SAAS,SAAS;AAAA,QAC1B;AACA,gBAAQ;AAAA,MACV,OAAO;AACL,gBAAQ;AAAA,MACV;AAEA,YAAM,EAAE,MAAM,WAAW,IAAI,oBAAoB,OAAO,QAAQ,eAAe;AAC/E,YAAM,SAA8B,EAAE,OAAO,cAAc,KAAK;AAChE,YAAM,mBAAmB,sBAAsB;AAC/C,YAAM,MAAM,kBAAkB,MAAM;AACpC,aAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ;AAAA,UACN,GAAG,iBAAiB;AAAA,UACpB,OAAO;AAAA,UACP;AAAA,UACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACtC;AAAA,MACF;AAAA,IACF,SAASC,QAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ;AACzC,YAAM,UAAU,UACZ,4BACAA,kBAAiB,QACjBA,OAAM,UACN,OAAOA,MAAK;AAChB,aAAO,OAAO;AAAA,QACZ,OAAO;AAAA,UACL,MAAM,UAAU,cAAc;AAAA,UAC9B;AAAA,UACA,WAAW;AAAA,QACb;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ;AACnB;;;AC/NO,SAAS,sCACd,OACA,SACuC;AACvC,QAAM,UAAU,IAAI,IAAI,QAAQ,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,KAAK,CAAC,CAAC;AAC3E,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,sBAAsB,QAAQ,uBAAuB;AAC3D,QAAM,QAAQ,QAAQ,UAAU,CAAC,OAAe,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAChG,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,UAAU,QAAQ,YAAY,MAAY;AAAA,EAAC;AACjD,QAAM,SAAS,oBAAI,IAAY;AAC/B,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,QAAM,aAAa,IAAI,gBAAgB;AACvC,MAAI,UAAU;AAEd,iBAAe,kBAAkB,OAAgE;AAC/F,UAAM,QAAQ,MAAM,aAAa;AACjC,WAAO,CAAC,SAAS;AACf,YAAM,UAAU,eAAe,IAAI,MAAM,IAAI,KAAK;AAClD,UAAI,UAAU,UAAa,UAAU,OAAO;AAC1C,uBAAe,IAAI,MAAM,MAAM,UAAU,CAAC;AAC1C,eAAO;AAAA,MACT;AACA,YAAM,MAAM,cAAc;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AAEA,WAAS,kBAAkB,MAAoB;AAC7C,UAAM,UAAU,eAAe,IAAI,IAAI,KAAK;AAC5C,QAAI,WAAW,EAAG,gBAAe,OAAO,IAAI;AAAA,QACvC,gBAAe,IAAI,MAAM,UAAU,CAAC;AAAA,EAC3C;AAEA,WAAS,YAAY,UAA0D;AAC7E,WAAO;AAAA,MACL,YAAY,SAAS;AAAA,MACrB,MAAM,SAAS;AAAA,MACf,MAAM,SAAS,SAAS;AAAA,MACxB,WAAW,SAAS,SAAS;AAAA,IAC/B;AAAA,EACF;AAEA,WAAS,QAAQ,UAA8C;AAC7D,WAAO,SAAS,SAAS,sBACpB,SAAmC,KAAK,WAAW,eACnD,SAAmC,KAAK,WAAW;AAAA,EAC1D;AAEA,WAAS,eAAe,UAAiE;AACvF,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,GAAG,SAAS,SAAS,IAAI;AAAA,MAC/B,WAAW,SAAS,SAAS;AAAA,IAC/B;AAAA,EACF;AAEA,iBAAe,UAAU,UAA0E;AACjG,UAAM,YAAY,eAAe,QAAQ;AACzC,QAAI,MAAM,MAAM,IAAI,SAAS,EAAG,QAAO;AACvC,UAAM,WAAW,uBAAuB,UAAU,MAAO;AAAA,MACvD,aAAa;AAAA,QACX,YAAY,SAAS;AAAA,QACrB,MAAM,SAAS;AAAA,QACf,MAAM,SAAS,SAAS;AAAA,QACxB,WAAW,SAAS,SAAS;AAAA,QAC7B,KAAK,SAAS,SAAS;AAAA,MACzB;AAAA,IACF,CAAC;AACD,aAAS,SAAS,YAAY,SAAS,SAAS;AAChD,QAAI;AACF,YAAM,MAAM,OAAO,QAAQ,OAAO,QAAQ;AAAA,IAC5C,SAASC,QAAO;AACd,UAAI,EAAEA,kBAAiB,uBAAuBA,OAAM,SAAS,WAAY,OAAMA;AAAA,IACjF;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,aACb,WACA,OACe;AACf,aAAS,UAAU,GAAG,UAAU,qBAAqB,WAAW,GAAG;AACjE,YAAM,UAAU,MAAM,MAAM,IAAsC,SAAS;AAC3E,UAAI,CAAC,QAAS;AACd,UAAI;AACF,cAAM,MAAM,aAAa,QAAQ,OAAO,WAAW,MAAM,QAAQ,MAAM,GAAG;AAAA,UACxE,iBAAiB,QAAQ,SAAS;AAAA,QACpC,CAAC;AACD;AAAA,MACF,SAASA,QAAO;AACd,YAAIA,kBAAiB,sBAAsBA,OAAM,SAAS,WAAY;AACtE,cAAMA;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,+BAA+B,UAAU,QAAQ,EAAE,cAAc,mBAAmB;AAAA,MAC7F,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,WAAW,UAAiE;AACnF,UAAM,WAAW,QAAQ,QAAQ;AACjC,UAAM,QAAQ,WAAW,QAAQ,IAAI,QAAQ,IAAI;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,0BAA0B,YAAY,EAAE;AAAA,QACjD,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,CAAC,MAAM,aAAa,QAAQ,SAAS,SAAS,IAAyC,GAAG;AAC5F,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,0BAA0B,QAAQ,qBAAqB,SAAS,IAAI;AAAA,QAC7E,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,CAAC,MAAM,aAAa,kBAAkB;AACxC,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,0BAA0B,QAAQ;AAAA,QAC3C,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,KAAK,UAA0BA,QAA+B;AAC3E,UAAM,UAAU,cAAcA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK,CAAC;AACpF,QAAI,SAAS,SAAS,qBAAqB;AACzC,YAAM,aAA6B,eAAe,QAAiC,GAAG,OAAO;AAAA,QAC3F,OAAO;AAAA,QACP,SAAS;AAAA,QACT,UAAU;AAAA,MACZ,EAAE;AACF,YAAM,aAAkC,YAAY,QAAQ,GAAG,CAAC,aAAa;AAAA,QAC3E,GAAG;AAAA,QACH,OAAO;AAAA,QACP,eAAe;AAAA,MACjB,EAAE;AAAA,IACJ,OAAO;AACL,YAAM,aAAkC,YAAY,QAAQ,GAAG,CAAC,aAAa;AAAA,QAC3E,GAAG;AAAA,QACH,OAAO;AAAA,QACP,QAAQ;AAAA,UACN,OAAO;AAAA,YACL,MAAMA,kBAAiB,qBAAqBA,OAAM,OAAO;AAAA,YACzD;AAAA,YACA,WAAWA,kBAAiB,qBAAqBA,OAAM,YAAY;AAAA,UACrE;AAAA,QACF;AAAA,QACA,aAAa,IAAI,EAAE,YAAY;AAAA,MACjC,EAAE;AAAA,IACJ;AAAA,EACF;AAEA,iBAAe,sBACb,UACA,UACkB;AAClB,UAAM,WAAW,SAAS,UAAU,eAAe,SAAS,UAAU,YAAY,SAAS,UAAU;AACrG,UAAM,gBAAgB,SAAS,UAAU,eAAe,SAAS,kBAAkB;AACnF,UAAM,cAAc,gBAAgB,WAAW,SAAS,eAAe;AACvE,UAAM,YAAY,SAAS,UAAU,eAAe,gBAAgB;AACpE,UAAM,YAAY,SAAS,UAAU,eAAe,gBAAgB;AACpE,UAAM,UAAU;AAAA,MACd,SAAS,eAAe,WACtB,SAAS,eAAe,OAAO,YAC9B,gBAAgB,+DAA+D,SAAS;AAAA,IAC7F;AACA,UAAM,eAAe,eAAe,QAAQ;AAC5C,UAAM,aAA6B,cAAc,OAAO;AAAA,MACtD,OAAO,YACH,cACA,YACA,cACA,WACA,WACA;AAAA,MACJ,GAAI,YAAY,SAAY,EAAE,SAAS,QAAQ,IAAI,CAAC;AAAA,MACpD,GAAI,WAAW,EAAE,UAAU,YAAY,IAAI,EAAE,IAAI,CAAC;AAAA,IACpD,EAAE;AACF,UAAM,aAAkC,YAAY,QAAQ,GAAG,CAAC,aAAa;AAAA,MAC3E,GAAG;AAAA,MACH,OAAO,YACH,cACA,WACA,WACA,SAAS,UAAU,YACnB,eACA;AAAA,MACJ,GAAI,YAAY,SAAY,EAAE,eAAe,QAAQ,IAAI,CAAC;AAAA,IAC5D,EAAE;AACF,WAAO;AAAA,EACT;AAEA,iBAAe,kBACb,UACA,UACA,UACkB;AAClB,UAAM,WAAW,SAAS,UAAU,eAAe,SAAS,UAAU,YAAY,SAAS,UAAU;AACrG,UAAM,gBAAgB,SAAS,UAAU,eAAe,SAAS,kBAAkB;AACnF,UAAM,cAAc,gBAAgB,WAAW,SAAS,eAAe;AACvE,UAAM,YAAY,SAAS,UAAU,eAAe,gBAAgB;AACpE,UAAM,YAAY,SAAS,UAAU,eAAe,gBAAgB;AACpE,UAAM,iBAAiB,aAAa,SAAS,eAAe,SACxD,cAAc,SAAS,cAAc,MAAM,IAC3C;AACJ,QAAI,WAAW;AACb;AAAA,QACE;AAAA,QACA,SAAS,eAAe,QAAQ;AAAA,MAClC;AAAA,IACF;AACA,UAAMA,SAAQ,SAAS,eAAe,UAAU,gBAC5C,EAAE,MAAM,WAAW,SAAS,8DAA8D,WAAW,MAAM,IAC3G,SAAS,UAAU,WACnB,EAAE,MAAM,YAAY,SAAS,SAAS,WAAW,kCAAkC,WAAW,MAAM,IACpG;AACJ,UAAM,aAAkC,YAAY,QAAQ,GAAG,CAAC,aAAa;AAAA,MAC3E,GAAG;AAAA,MACH,OAAO,YACH,cACA,YACA,cACA,WACA,WACA,SAAS,UAAU,YACnB,YACA;AAAA,MACJ,GAAI,iBAAiB,EAAE,QAAQ,eAAe,IAAIA,SAAQ,EAAE,QAAQ,EAAE,OAAO,cAAcA,MAAK,EAAE,EAAE,IAAI,CAAC;AAAA,MACzG,GAAI,WAAW,EAAE,aAAa,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC;AAAA,IACzD,EAAE;AACF,WAAO;AAAA,EACT;AAEA,iBAAe,kBAAkB,UAAgD;AAC/E,UAAM,QAAQ,WAAW,QAAQ;AACjC,UAAM,UAAU;AAAA,MACd;AAAA,MACA,MAAM,aAAa;AAAA,IACrB;AACA,qCAAiC,UAAU,OAAO;AAClD,UAAM,YAAY,YAAY,QAAQ;AACtC,UAAM,eAAe,MAAM,UAAU,QAAQ;AAC7C,UAAM,SAAS,MAAM,MAAM,IAAI,SAAS;AACxC,QAAI,aAAa,QAAQ,QAAQ,cAAc,SAAS,QAAQ;AAChE,QAAI,CAAC,YAAY;AACf,UAAI,CAAC,QAAQ,4BAA4B;AACvC,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,gBAAgB,MAAM,QAAQ,2BAA2B,UAAU,KAAK;AAC9E,YAAM,SAAS,MAAM,MAAM,OAAO,UAAU;AAC5C,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI,mBAAmB,EAAE,MAAM,eAAe,SAAS,0BAA0B,MAAM,IAAI,kBAAkB,WAAW,KAAK,CAAC;AAAA,MACtI;AACA,YAAM,aAAkC,WAAW,CAAC,aAAa;AAAA,QAC/D,GAAG;AAAA,QACH,OAAO;AAAA,QACP,gBAAgB,MAAM;AAAA,QACtB,MAAM,CAAC,YAAY;AAAA,QACnB,sBAAsB,cAAc;AAAA,QACpC,uBAAuB,cAAc;AAAA,MACvC,EAAE;AACF,UAAI;AACJ,UAAI,SAAS,KAAK,iBAAiB;AACjC,uBAAe,MAAM,QAAQ,sBAAsB,SAAS,KAAK,eAAe;AAChF,YAAI,iBAAiB,QAAW;AAC9B,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,oBAAoB,SAAS,KAAK,eAAe;AAAA,YAC1D,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,YAAM,kBAAkB,MAAM,QAAQ,wBAAwB,UAAU,YAAY;AACpF,YAAM,SAAS,MAAM,MAAM,OAAO,cAAc,UAAU,QAAQ,OAAO;AAAA,QACvE,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC;AAAA,QACrD,GAAI,oBAAoB,SAAY,EAAE,gBAAgB,IAAI,CAAC;AAAA,MAC7D,CAAC;AACD,mBAAa,OAAO;AACpB,YAAM,aAAkC,WAAW,CAAC,aAAa;AAAA,QAC/D,GAAG;AAAA,QACH,OAAO;AAAA,QACP,gBAAgB,MAAM;AAAA,QACtB,cAAc,OAAO;AAAA,QACrB,YAAY,OAAO;AAAA,QACnB,MAAM,CAAC,YAAY;AAAA,QACnB,GAAI,OAAO,mBAAmB,EAAE,kBAAkB,OAAO,iBAAiB,IAAI,CAAC;AAAA,MACjF,EAAE;AACF,YAAM,aAA6B,cAAc,OAAO,EAAE,OAAO,UAAU,EAAE;AAAA,IAC/E;AACA,WAAO,CAAC,SAAS;AACf,YAAM,WAAW,MAAM,MAAM,OAAO,kBAAkB,UAAU;AAChE,UAAI,MAAM,sBAAsB,UAAU,QAAQ,EAAG;AACrD,YAAM,MAAM,cAAc;AAAA,IAC5B;AAAA,EACF;AAEA,iBAAe,uBAAuB,UAAgD;AACpF,UAAM,QAAQ,WAAW,QAAQ;AACjC,UAAM,eAAe,SAAS,SAAS,cAAc,2BAA2B;AAChF,UAAM,WAAW;AAAA,MACf;AAAA,MACA,MAAM,aAAa;AAAA,MACnB;AAAA,IACF;AACA,UAAM,YAAY,YAAY,QAAQ;AACtC,UAAM,SAAS,MAAM,MAAM,IAAI,SAAS;AACxC,QAAI,aAAa,QAAQ,QAAQ,cAAc,SAAS,QAAQ;AAChE,QAAI,CAAC,YAAY;AACf,YAAM,SAAS,MAAM,MAAM,OAAO,UAAU;AAC5C,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI,mBAAmB,EAAE,MAAM,eAAe,SAAS,0BAA0B,MAAM,IAAI,kBAAkB,WAAW,KAAK,CAAC;AAAA,MACtI;AACA,YAAM,aAAkC,WAAW,CAAC,aAAa;AAAA,QAC/D,GAAG;AAAA,QACH,OAAO;AAAA,QACP,gBAAgB,MAAM;AAAA,MACxB,EAAE;AACF,UAAI,CAAC,QAAQ,wBAAwB;AACnC,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,gBAAgB,MAAM,QAAQ,uBAAuB,QAAQ;AACnE,UAAI,cAAc,UAAU;AAC1B,cAAM,aAAkC,WAAW,CAAC,aAAa;AAAA,UAC/D,GAAG;AAAA,UACH,UAAU,cAAc;AAAA,QAC1B,EAAE;AAAA,MACJ;AACA,YAAM,SAAS,MAAM,MAAM,OAAO,qBAAqB,UAAU,QAAQ,KAAK;AAC9E,mBAAa,OAAO;AACpB,YAAM,aAAkC,WAAW,CAAC,aAAa;AAAA,QAC/D,GAAG;AAAA,QACH,OAAO;AAAA,QACP,gBAAgB,MAAM;AAAA,QACtB,cAAc,OAAO;AAAA,QACrB,YAAY,OAAO;AAAA,QACnB,WAAW,SAAS,aAAa,IAAI,EAAE,YAAY;AAAA,QACnD,GAAI,OAAO,mBAAmB,EAAE,kBAAkB,OAAO,iBAAiB,IAAI,CAAC;AAAA,MACjF,EAAE;AAAA,IACJ;AACA,WAAO,CAAC,SAAS;AACf,YAAM,WAAW,MAAM,MAAM,OAAO,uBAAuB,UAAU;AACrE,UAAI,MAAM,kBAAkB,UAAU,UAAU,QAAQ,EAAG;AAC3D,YAAM,MAAM,cAAc;AAAA,IAC5B;AAAA,EACF;AAEA,WAAS,WAAW,UAAuC;AACzD,UAAM,SAAS;AACf,QAAI,CAAC,QAAQ,MAAM,EAAG;AACtB,UAAM,QAAQ,OAAO,QAAQ;AAC7B,QAAI,UAAU,eAAe,UAAU,YAAY,UAAU,YAAa;AAC1E,QAAI,OAAO,IAAI,OAAO,SAAS,GAAG,EAAG;AACrC,WAAO,IAAI,OAAO,SAAS,GAAG;AAC9B,UAAM,YAAY;AAChB,UAAI;AACJ,UAAI;AACF,cAAM,QAAQ,WAAW,MAAM;AAC/B,YAAI,CAAC,MAAM,kBAAkB,KAAK,EAAG;AACrC,eAAO,MAAM;AAAA,MACf,SAASA,QAAO;AACd,gBAAQA,MAAK;AACb,cAAM,KAAK,QAAQA,MAAK,EAAE,MAAM,OAAO;AACvC;AAAA,MACF;AACA,UAAI;AACF,eAAO,CAAC,SAAS;AACf,cAAI;AACF,gBAAI,OAAO,SAAS,qBAAqB;AACvC,oBAAM,kBAAkB,MAA+B;AAAA,YACzD,OAAO;AACL,oBAAM,uBAAuB,MAA+B;AAAA,YAC9D;AACA;AAAA,UACF,SAASA,QAAO;AACd,oBAAQA,MAAK;AACb,gBAAI,EAAEA,kBAAiB,uBAAuB,CAACA,OAAM,WAAW;AAC9D,oBAAM,KAAK,QAAQA,MAAK,EAAE,MAAM,OAAO;AACvC;AAAA,YACF;AAIA,kBAAM,MAAM,cAAc;AAAA,UAC5B;AAAA,QACF;AAAA,MACF,UAAE;AACA,YAAI,KAAM,mBAAkB,IAAI;AAAA,MAClC;AAAA,IACF,GAAG,EAAE,QAAQ,MAAM,OAAO,OAAO,OAAO,SAAS,GAAG,CAAC;AAAA,EACvD;AAEA,iBAAe,cAAc,UAAyC;AACpE,UAAM,aAAa,SAAS,QAAQ,kBAAkB,QAAQ,QAAQ;AACtE,UAAM,aAAa,SAAS,QAAQ;AACpC,QAAI,CAAC,cAAc,CAAC,WAAY;AAChC,UAAM,QAAQ,QAAQ,IAAI,UAAU;AACpC,QAAI,CAAC,MAAO;AACZ,QAAI,SAAS,SAAS,qBAAqB;AACzC,YAAM,MAAM,OAAO,aAAa,YAAY,QAAQ,KAAK;AAAA,IAC3D,OAAO;AACL,YAAM,MAAM,OAAO,oBAAoB,YAAY,QAAQ,KAAK;AAAA,IAClE;AAAA,EACF;AAEA,iBAAe,QAAQ,YAAoB,MAA6B;AACtE,WAAO,CAAC,SAAS;AACf,UAAI;AAIF,cAAM,WAAW,MAAM;AAAA,UACrB,EAAE,YAAY,KAAK;AAAA,UACnB,EAAE,QAAQ,WAAW,OAAO;AAAA,QAC9B,EAAE,OAAO,aAAa,EAAE;AACxB,cAAM,WAAW,MAAM,MAAM,KAAK,EAAE,YAAY,KAAK,CAAC;AACtD,mBAAW,YAAY,SAAS,MAAO,YAAW,QAAQ;AAC1D,eAAO,CAAC,SAAS;AACf,gBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,cAAI,KAAK,KAAM;AACf,gBAAM,QAAQ,KAAK;AACnB,cAAI,QAAS;AACb,cAAI,MAAM,SAAS,WAAW;AAC5B,kBAAM,cAAc,MAAM,QAA0B,EAAE,MAAM,OAAO;AAAA,UACrE,WAAW,MAAM,SAAS,WAAW,MAAM,SAAS,YAAY;AAC9D,uBAAW,MAAM,QAAQ;AAAA,UAC3B;AAAA,QACF;AAAA,MACF,SAASA,QAAO;AACd,gBAAQA,MAAK;AAAA,MACf;AACA,UAAI,CAAC,QAAS,OAAM,MAAM,GAAI;AAAA,IAChC;AAAA,EACF;AAEA,QAAM,WAAW;AAAA,IACf,QAAQ,4BAA4B,mBAAmB;AAAA,IACvD,QAAQ,4BAA4B,mBAAmB;AAAA,EACzD;AACA,aAAW,WAAW,SAAU,MAAK,QAAQ,MAAM,OAAO;AAE1D,SAAO;AAAA,IACL,MAAM,OAAO;AACX,gBAAU;AACV,iBAAW,MAAM;AAIjB,YAAM,QAAQ,KAAK;AAAA,QACjB,QAAQ,WAAW,QAAQ;AAAA,QAC3B,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACpdA,SAAS,YAAYC,QAAuE;AAC1F,MAAIA,kBAAiB,oBAAoB;AACvC,WAAO,EAAE,MAAMA,OAAM,MAAM,SAASA,OAAM,SAAS,WAAWA,OAAM,UAAU;AAAA,EAChF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAASA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,IAC9D,WAAW;AAAA,EACb;AACF;AAGA,SAAS,mBAAmB,MAAuB;AACjD,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,SAAS;AACf,QAAI,OAAO,SAAS,aAAa,OAAO,OAAO,SAAS,SAAU,QAAO,OAAO;AAAA,EAClF;AACA,SAAO;AACT;AAOO,SAAS,iCACd,SACA,UAA6C,CAAC,GAC3B;AACnB,SAAO;AAAA,IACL,MAAM,MAAM,SAAS;AACnB,YAAM,EAAE,UAAU,IAAI,IAAI;AAC1B,YAAM,iBAAiB,WAAW,IAAI,SAAS,aAAa,SAAS,IAAI,IAAI,SAAS,IAAI;AAC1F,YAAM,UAAU,QAAQ,WAAW,SAAS,SAAS;AACrD,UAAI,mBAAmB;AAEvB,UACE,QAAQ,qBACR,SAAS,KAAK,eAAe,gBAC7B,QAAQ,cAAc,UACtB,SAAS,KAAK,eAAe,SAAS,QACtC;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,wBAAwB,SAAS,SAAS,IAAI;AAAA,UACvD,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AAEA,UAAI,SAAS,KAAK,aAAa,YAAY;AACzC,cAAM,WAAW,QAAQ;AACzB,YACE,CAAC,YACD,IAAI,QAAQ,uBAAuB,QAAQ,SAAS,SAAS,OAC7D,SAAS,KAAK,cAAc,SAAS,SAAS,KAAK,YAAY,YAC/D;AACA,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,QAAQ,IAAI,SAAS,IAAI;AAAA,YAClC,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,YAAI,QAAQ,sBAAsB;AAChC,gBAAM,WAAW,MAAM,QAAQ,qBAAqB,UAAU,OAAO;AACrE,cAAI,CAAC,UAAU;AACb,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS,kBAAkB,SAAS,SAAS,IAAI;AAAA,cACjD,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AACA,6BAAmB,EAAE,GAAG,SAAS,aAAa,SAAS;AAAA,QACzD,WAAW,SAAS,KAAK,WAAW,SAAS,QAAQ,cAAc;AACjE,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,yBAAyB,SAAS,SAAS,IAAI;AAAA,YACxD,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AAKA,YAAM,EAAE,uBAAAC,wBAAuB,6BAAAC,6BAA4B,IAAI,MAAM,OAAO,uBAAe;AAE3F,UAAI,SAAkG;AAEtG,UAAI,SAAS,KAAK,iBAAiB;AACjC,YAAI,CAAC,QAAQ,cAAc;AACzB,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,aAAa,SAAS,SAAS,IAAI,0BAA0B,SAAS,KAAK,eAAe;AAAA,YACnG,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,cAAM,UAAuB;AAAA,UAC3B,IAAI,YAAY,SAAS,SAAS,IAAI;AAAA,UACtC,MAAM,SAAS,SAAS;AAAA,UACxB,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,iBAAiB,EAAE,MAAM,UAAU,QAAQ,QAAQ,aAAa;AAAA,QAClE;AACA,iBAAS,MAAMA,6BAA4B,kBAAkB,SAAS,cAAc;AAAA,MACtF,WAAW,SAAS,KAAK,WAAW;AAClC,iBAAS,MAAMD,uBAAsB,kBAAkB,EAAE,cAAc,SAAS,KAAK,WAAW,eAAe,CAAC;AAAA,MAClH,OAAO;AACL,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,aAAa,SAAS,SAAS,IAAI;AAAA,UAC5C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AAEA,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,gCAAgC,SAAS,SAAS,IAAI,eAAe,SAAS,KAAK,aAAa,EAAE;AAAA,UAC3G,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AAEA,YAAM,eAAe,YAAqC;AACxD,YAAI;AACF,cAAI,UAAU;AACd,2BAAiB,QAAQ,OAAO,EAAE,gBAAgB,QAAQ,CAAC,GAAG;AAC5D,uBAAW,mBAAmB,IAAI;AAAA,UACpC;AACA,cAAI,iBAAiB,0BAA0B,IAAI,cAAc,GAAG;AAClE,6BAAiB,yBAAyB,OAAO,cAAc;AAC/D,mBAAO,EAAE,OAAO,aAAa,QAAQ;AAAA,UACvC;AACA,iBAAO,EAAE,OAAO,aAAa,QAAQ;AAAA,QACvC,SAASD,QAAO;AACd,iBAAO,EAAE,OAAO,UAAU,OAAO,YAAYA,MAAK,EAAE;AAAA,QACtD;AAAA,MACF,GAAG;AAEH,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,MAAM,SAAS;AACb,2BAAiB,0BAA0B,IAAI,cAAc;AAAA,QAC/D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AA2BO,SAAS,gCAAgC,SAA8D;AAC5G,QAAM,iBAAiB,QAAQ,kBAAkB;AAEjD,WAAS,cAAc,UAAoD;AACzE,QAAI,CAAC,SAAS,KAAK,iBAAiB;AAElC,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,YAAY,SAAS,KAAK;AAChC,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,oBAAoB,SAAS,SAAS,IAAI;AAAA,QACnD,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,UAAM,OAAO,eAAe,SAAS;AACrC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,oBAAoB,SAAS,SAAS,IAAI,sCAAsC,SAAS;AAAA,QAClG,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,KAAK,cAAc,OAAQ,QAAO,QAAQ;AAC9C,QAAI,KAAK,cAAc,WAAW;AAChC,UAAI,CAAC,QAAQ,eAAe;AAC1B,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,iBAAiB,SAAS;AAAA,UACnC,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,iBAAiB,SAAS,eAAe,KAAK,SAAS;AAAA,MAChE,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,MAAM,SAAS;AACnB,aAAO,cAAc,QAAQ,QAAQ,EAAE,MAAM,OAAO;AAAA,IACtD;AAAA,EACF;AACF;;;ACvRA,IAAMG,cAA6C;AAAA,EACjD,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS;AACX;AAEA,IAAM,sBAA0D;AAAA,EAC9D,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,cAAc;AAAA,EACd,YAAY;AACd;AAEA,IAAM,kCAA8E;AAAA,EAClF,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS;AACX;AAQA,SAAS,kBAAkB,UAAuF;AAChH,SAAO;AAAA,IACL,YAAY,SAAS;AAAA,IACrB,MAAM,SAAS;AAAA,IACf,MAAM,SAAS,SAAS;AAAA,IACxB,GAAI,SAAS,SAAS,cAAc,SAAY,EAAE,WAAW,SAAS,SAAS,UAAU,IAAI,CAAC;AAAA,IAC9F,KAAK,SAAS,SAAS;AAAA,EACzB;AACF;AAEA,SAAS,oBAAoB,SAAiB,oBAA4B;AACxE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,cAAc,QAAwB,SAA0B;AACvE,QAAM,YAAY,OAAO,YAAY,KAAK,CAAC,SAAS,KAAK,SAAS,wBAAwB;AAC1F,SAAO,WAAW,WAAW,WAC3B,UAAU,WAAW,wBACrB,UAAU,YAAY;AAC1B;AAEA,eAAe,cACb,UACA,WACA,eACA,OACA,gBACsB;AACtB,QAAM,gBAAgB,SAAS,KAAK,aAAa;AACjD,MAAI,CAAC,cAAe,QAAO,CAAC;AAC5B,QAAM,gBAAgB,SAAS,KAAK,SAAS;AAC7C,QAAM,yBAAyB,SAAS,KAAK,WAAW,sBAAsB;AAC9E,QAAM,qBAAqB,SAAS,KAAK,WAAW;AACpD,QAAM,oBAAoB,SAAS,KAAK,aAAa;AACrD,QAAM,aAA0B,CAAC;AAEjC,aAAW,YAAY,WAAW;AAChC,QAAI,SAAS,KAAK,cAAc,SAAS,cAAe;AACxD,QAAI,SAAS,QAAQ,YAAY,KAAM;AACvC,UAAM,cAAc,KAAK,MAAM,SAAS,OAAO,aAAa,EAAE;AAC9D,QAAI,CAAC,OAAO,SAAS,WAAW,KAAK,QAAQ,cAAc,eAAgB;AAC3E,UAAM,QAAQ,SAAS,KAAK,SAAS;AACrC,QAAIA,YAAW,KAAK,IAAIA,YAAW,aAAa,EAAG;AACnD,UAAM,gBAAgB,SAAS,KAAK,UAAU,iBAAiB;AAC/D,UAAM,QAAQ,iBAAiB,SAAS,OAAO,eAAe;AAC9D,QAAI,QAAQ,EAAG;AACf,UAAM,yBAAyB,SAAS,KAAK,YAAY,kBACvD,gCAAgC,KAAK;AACvC,QACE,EAAE,0BAA0B,wBAC5B,oBAAoB,sBAAsB,IAAI,oBAAoB,sBAAsB,GACxF;AACA;AAAA,IACF;AAEA,UAAM,aAAa,MAAM,cAAc,QAAQ;AAC/C,QAAI,CAAC,WAAY;AACjB,QAAI,WAAW,KAAK,UAAU,SAAS,KAAK,gBAAgB,WAAW,KAAK,OAAQ;AACpF,QAAI,mBAAmB,UAAU,CAAC,kBAAkB,SAAS,WAAW,KAAK,KAAK,EAAG;AACrF,QACE,oBAAoB,WACnB,CAAC,WAAW,KAAK,iBAAiB,CAAC,mBAAmB,SAAS,WAAW,KAAK,aAAa,IAC7F;AACA;AAAA,IACF;AAEA,UAAM,WAAW,SAAS,KAAK,WAAW,SAAS,QAAQ,eAAe,MAAO;AACjF,eAAW,KAAK,EAAE,UAAU,YAAY,OAAO,WAAW,MAAM,CAAC;AAAA,EACnE;AAEA,SAAO,WAAW;AAAA,IAAK,CAAC,MAAM,UAC5B,MAAM,QAAQ,KAAK,SACnB,KAAK,SAAS,SAAS,KAAK,cAAc,MAAM,SAAS,SAAS,IAAI;AAAA,EACxE;AACF;AAOO,SAAS,qCACd,SACsC;AACtC,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,yBAAyB,QAAQ,0BAA0B;AACjE,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,MAAM,QAAQ;AACpB,YAAM,SAAS,IAAI,UAAU,CAAC;AAC9B,YAAM,mBAAmB,IAAI;AAC7B,YAAM,eAAe,iBAAiB,YAAY;AAClD,UAAI,OAAO,SAAS,OAAO,UAAU,UAAW,QAAO,EAAE,OAAO,KAAK;AAErE,YAAM,WAAW,MAAM,QAAQ,YAAY,GAAG;AAC9C,UAAI,CAAC,UAAU;AACb,cAAM,UAAU;AAChB,eAAO;AAAA,UACL,GAAI,cAAc,QAAQ,OAAO,IAC7B,CAAC,IACD;AAAA,YACA,QAAQ;AAAA,cACN,GAAG;AAAA,cACH,YAAY;AAAA,gBACV,IAAI,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,wBAAwB;AAAA,gBACpF,oBAAoB,SAAS,YAAY;AAAA,cAC3C;AAAA,YACF;AAAA,UACF;AAAA,UACF,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UAAI,CAAC,SAAS,KAAK,aAAa,WAAY,QAAO,EAAE,OAAO,KAAK;AAEjE,YAAM,eAAe,oBAAI,IAAoB;AAC7C,iBAAW,SAAS,MAAM,QAAQ,WAAW,KAAK,CAAC,GAAG;AACpD,YAAI,MAAM,SAAS,QAAQ,IAAI,SAAS,IAAK;AAC7C,YACE,MAAM,QAAQ,UAAU,eACxB,MAAM,QAAQ,UAAU,YACxB,MAAM,QAAQ,UAAU,YACxB;AACF,cAAM,cAAc,MAAM,QAAQ,uBAAuB;AACzD,YAAI,YAAa,cAAa,IAAI,cAAc,aAAa,IAAI,WAAW,KAAK,KAAK,CAAC;AAAA,MACzF;AACA,YAAM,aAAa,MAAM,QAAQ,cAAc,GAAG,IAAI,CAAC,cAAc;AAAA,QACnE,GAAG;AAAA,QACH,QAAQ;AAAA,UACN,GAAG,SAAS;AAAA,UACZ,cAAc,SAAS,QAAQ,eAAe,MAC3C,aAAa,IAAI,SAAS,SAAS,GAAG,KAAK;AAAA,QAChD;AAAA,MACF,EAAE;AACF,YAAM,aAAa,MAAM;AAAA,QACvB;AAAA,QACA;AAAA,QACA,CAAC,aAAa,QAAQ,cAAc,QAAQ;AAAA,QAC5C,iBAAiB,QAAQ;AAAA,QACzB;AAAA,MACF;AACA,YAAM,WAAW,WAAW,CAAC,GAAG;AAChC,UAAI,CAAC,UAAU;AACb,cAAM,UAAU,8CAA8C,SAAS,KAAK,YAAY,UAAU;AAClG,cAAM;AAAA,UACJ,uBAAuB;AAAA,UACvB,cAAc;AAAA,UACd,GAAG;AAAA,QACL,IAAI;AACJ,eAAO;AAAA,UACL,GAAI,cAAc,QAAQ,OAAO,KAAK,CAAC,OAAO,wBAC1C,CAAC,IACD;AAAA,YACA,QAAQ;AAAA,cACN,GAAG;AAAA,cACH,OAAO;AAAA,cACP,YAAY;AAAA,gBACV,IAAI,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,wBAAwB;AAAA,gBACpF,oBAAoB,SAAS,YAAY;AAAA,cAC3C;AAAA,YACF;AAAA,UACF;AAAA,UACF,gBAAgB;AAAA,QAClB;AAAA,MACF;AAEA,UACE,OAAO,uBAAuB,QAAQ,SAAS,SAAS,OACxD,OAAO,cAAc,4BAA4B,SAAS,SAAS,mBACnE,OAAO,aAAa,eAAe,QAAQ,YAC3C;AACA,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,uBAAuB,kBAAkB,QAAQ;AAAA,UACjD,cAAc;AAAA,YACZ,YAAY,QAAQ;AAAA,YACpB,yBAAyB,SAAS,SAAS;AAAA,YAC3C,SAAS;AAAA,UACX;AAAA,UACA,YAAY;AAAA,YACV,IAAI,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,wBAAwB;AAAA,YACpF;AAAA,cACE,MAAM;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,SAAS,2BAA2B,SAAS,SAAS,IAAI;AAAA,cAC1D,oBAAoB;AAAA,YACtB;AAAA,UACF;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AC9NA,SAAS,eAAe,SAAiB,MAAc;AACrD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR;AAAA,IACA,oBAAoB;AAAA,EACtB;AACF;AAOO,SAAS,yCACd,SAC+C;AAC/C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,aAAa,QAAQ;AAC3B,YAAM,SAAS,WAAW,UAAU,CAAC;AACrC,UAAI,OAAO,SAAS,OAAO,UAAU,UAAW,QAAO,EAAE,OAAO,KAAK;AACrE,YAAM,eAAe,IAAI,EAAE,YAAY;AACvC,YAAM,eAAe,MAAM,QAAQ,gBAAgB,UAAU;AAC7D,UAAI,CAAC,cAAc;AACjB,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,YAAY,CAAC,eAAe,0CAA0C,YAAY,CAAC;AAAA,UACrF;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AAEA,YAAM,WAAW,MAAM,QAAQ,cAAc,UAAU;AACvD,YAAM,eAAe,WAAW,KAAK,UAAU,UAAU,QAAQ;AACjE,YAAM,cAAc,MAAM,QAAQ,UAAU,GAAG,QAAQ,CAAC,SAAS;AAC/D,YAAI,CAAC,KAAK,WAAY,gBAAgB,KAAK,WAAW,aAAe,QAAO,CAAC;AAC7E,YACE,KAAK,mBAAmB,WACvB,KAAK,qBAAqB,MAAM,KAAK,eACtC,QAAO,CAAC;AACV,cAAM,aAAa,KAAK,aAAa;AAAA,UACnC,CAAC,cAAc,UAAU,SAAS,aAAa,KAAK;AAAA,QACtD;AACA,YAAI,CAAC,cAAc,CAAC,sBAAsB,YAAY,YAAY,EAAE,UAAW,QAAO,CAAC;AACvF,eAAO,CAAC,EAAE,MAAM,WAAW,CAAC;AAAA,MAC9B,CAAC,EAAE;AAAA,QAAK,CAAC,MAAM,WACZ,KAAK,KAAK,qBAAqB,MAAM,MAAM,KAAK,qBAAqB,MACtE,KAAK,KAAK,OAAO,cAAc,MAAM,KAAK,MAAM;AAAA,MAClD;AAEA,YAAM,WAAW,WAAW,CAAC;AAC7B,UAAI,CAAC,UAAU;AACb,cAAM,UAAU,6CAA6C,aAAa,SAAS,IAAI;AACvF,cAAM,EAAE,cAAc,OAAO,gBAAgB,SAAS,SAAS,UAAU,GAAG,QAAQ,IAAI;AACxF,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,YAAY,CAAC,eAAe,SAAS,YAAY,CAAC;AAAA,UACpD;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UACE,OAAO,iBAAiB,SAAS,KAAK,UACtC,OAAO,mBAAmB,SAAS,WAAW,QAC9C,OAAO,SAAS,eAAe,QAAQ,cACvC,OAAO,QAAQ,gCAAgC,aAAa,SAAS,iBACrE;AACA,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,cAAc,SAAS,KAAK;AAAA,UAC5B,gBAAgB,SAAS,WAAW;AAAA,UACpC,SAAS;AAAA,YACP,YAAY,QAAQ;AAAA,YACpB,6BAA6B,aAAa,SAAS;AAAA,YACnD,SAAS;AAAA,UACX;AAAA,UACA,YAAY,CAAC;AAAA,YACX,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,SAAS,oBAAoB,SAAS,WAAW,IAAI,cAAc,SAAS,KAAK,MAAM;AAAA,YACvF,oBAAoB;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AA+BO,SAAS,2CACd,SAC+C;AAC/C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,aAAa,QAAQ;AAC3B,YAAM,SAAS,WAAW,UAAU,CAAC;AACrC,UAAI,OAAO,iBAAiB,QAAQ,UAAU,CAAC,OAAO,kBAAkB,CAAC,OAAO,SAAS;AACvF,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,UAAI,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY;AAC5D,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,UAAI,OAAO,UAAU,cAAc,CAAC,OAAO,mBAAoB,QAAO,EAAE,OAAO,KAAK;AACpF,YAAM,SAAS,MAAM,QAAQ,UAAU,OAAO,cAAc;AAC5D,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,yBAAyB,OAAO,cAAc;AAAA,cACvD,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,OAAO,UAAU,cAAc,OAAO,oBAAoB;AAC5D,YAAI,CAAC,OAAO,QAAQ;AAClB,iBAAO;AAAA,YACL,QAAQ;AAAA,cACN,GAAG;AAAA,cACH,OAAO;AAAA,cACP,OAAO;AAAA,gBACL,MAAM;AAAA,gBACN,SAAS;AAAA,gBACT,WAAW;AAAA,cACb;AAAA,YACF;AAAA,YACA,OAAO;AAAA,UACT;AAAA,QACF;AACA,YAAI,QAAQ,SAAS;AACnB,gBAAM,gBAAgB,MAAM,QAAQ,QAAQ,UAAU,OAAO,cAAc;AAC3E,cAAI,CAAC,eAAe;AAClB,mBAAO;AAAA,cACL,QAAQ;AAAA,gBACN,GAAG;AAAA,gBACH,OAAO;AAAA,gBACP,OAAO;AAAA,kBACL,MAAM;AAAA,kBACN,SAAS,iCAAiC,OAAO,cAAc;AAAA,kBAC/D,WAAW;AAAA,gBACb;AAAA,cACF;AAAA,cACA,OAAO;AAAA,YACT;AAAA,UACF;AACA,gBAAM,cAAc;AAAA,YAClB,MAAM,QAAQ,QAAQ,qBAAqB;AAAA,cACzC;AAAA,cACA,eAAe,OAAO;AAAA,cACtB,OAAO,QAAQ;AAAA,cACf,YAAY,QAAQ;AAAA,YACtB,CAAC;AAAA,UACH;AAAA,QACF,OAAO;AACL,gBAAM,OAAO,QAAQ,OAAO,MAAM;AAAA,QACpC;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,YAAY,IAAI,EAAE,YAAY;AAAA,UAChC;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,eAAe,MAAM,QAAQ,gBAAgB,UAAU;AAC7D,UACE,CAAC,gBACD,aAAa,SAAS,oBAAoB,OAAO,QAAQ,6BACzD;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,YAAM,SAAS,MAAM,OAAO,UAAU;AACtC,YAAM,eAAe,sBAAsB,cAAc,YAAY;AACrE,UACE,CAAC,OAAO,WACR,aAAa,SAAS,OAAO,kBAC7B,CAAC,aAAa,WACd;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,aAAa,UAAU,OAAO,UAAU;AAAA,cACjD,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,YAAM,YAAY,IAAI,EAAE,YAAY;AACpC,UAAI,OAAO,UAAU,aAAa;AAChC,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,gBAAgB,EAAE,YAAY,QAAQ,YAAY,UAAU;AAAA,UAC9D;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UAAI,OAAO,gBAAgB,eAAe,QAAQ,YAAY;AAC5D,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,YAAM,gBAAgB,MAAM,QAAQ,aAAa,UAAU,KACzD,YAAY,WAAW,KAAK,aAAa,OAAO,WAAW,SAAS,GAAG;AACzE,YAAM,UAAU,QAAQ;AACxB,YAAM,WAAW,UACb,OAAO,YAAY;AACnB,cAAM,gBAAgB,MAAM,QAAQ,UAAU,OAAO,cAAwB;AAC7E,YAAI,CAAC,eAAe;AAClB,iBAAO;AAAA,YACL,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,iCAAiC,OAAO,cAAc;AAAA,cAC/D,WAAW;AAAA,YACb;AAAA,UACF;AAAA,QACF;AACA,cAAM,gBAAgB,MAAM,cAAc;AAAA,UACxC,MAAM,QAAQ,qBAAqB;AAAA,YACjC;AAAA,YACA;AAAA,YACA;AAAA,YACA,OAAO,QAAQ;AAAA,YACf,YAAY,QAAQ;AAAA,UACtB,CAAC;AAAA,QACH;AACA,eAAO;AAAA,UACL,OAAO;AAAA,UACP,QAAQ,cAAc;AAAA,UACtB,GAAI,cAAc,iBAAiB,SAAS,IACxC,EAAE,UAAU,cAAc,iBAAiB,IAC3C,CAAC;AAAA,UACL,YAAY,cAAc;AAAA,QAC5B;AAAA,MACF,GAAG,IACD,MAAM,OAAO,QAAQ;AAAA,QACrB;AAAA,QACA;AAAA,QACA,YAAY;AAAA,MACd,CAAC;AACH,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,GAAG;AAAA,UACH,cAAc,OAAO;AAAA,UACrB,gBAAgB,OAAO;AAAA,UACvB,SAAS,OAAO;AAAA,UAChB,gBAAgB,OAAO;AAAA,QACzB;AAAA,QACA,OAAO,SAAS,UAAU,cAAc,SAAS,UAAU;AAAA,QAC3D,GAAI,SAAS,UAAU,YAAY,EAAE,gBAAgB,IAAK,IAAI,CAAC;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;;;AClSO,SAAS,0BACd,SACsC;AACtC,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,MAAM,QAAQ;AACpB,YAAM,SAAS,IAAI,UAAU,CAAC;AAC9B,YAAM,WAAW,MAAM,QAAQ,YAAY,GAAG;AAC9C,UAAI,CAAC,YAAY,SAAS,QAAQ,iBAAiB,QAAQ,OAAQ,QAAO,EAAE,OAAO,KAAK;AACxF,YAAM,YAAY,SAAS,KAAK,eAAe,WAAW,CAAC;AAC3D,UAAI,UAAU,WAAW,EAAG,QAAO,EAAE,OAAO,KAAK;AAEjD,WACG,OAAO,gBAAgB,WAAW,OAAO,gBAAgB,iBAC1D,OAAO,0BACP;AACA,eAAO;AAAA,UACL,QAAQ,EAAE,GAAG,QAAQ,aAAa,YAAY;AAAA,UAC9C,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UAAI,OAAO,gBAAgB,aAAa;AACtC,mBAAW,WAAW,OAAO,kBAAkB,CAAC,GAAG;AACjD,gBAAM,gBAAgB,QAAQ,UAC1B,MAAM,QAAQ,QAAQ,UAAU,QAAQ,cAAc,IACtD;AACJ,cAAI,iBAAiB,QAAQ,WAAW,QAAQ,aAAa;AAC3D,kBAAM,cAAc;AAAA,cAClB,MAAM,QAAQ,QAAQ,uBAAuB;AAAA,gBAC3C;AAAA,gBACA,eAAe,QAAQ;AAAA,gBACvB,OAAO,QAAQ;AAAA,gBACf,YAAY,QAAQ;AAAA,cACtB,CAAC;AAAA,YACH;AACA,kBAAM,cAAc;AAAA,cAClB,MAAM,QAAQ,QAAQ,qBAAqB;AAAA,gBACzC;AAAA,gBACA,aAAa,QAAQ;AAAA,gBACrB,OAAO,QAAQ;AAAA,gBACf,YAAY,QAAQ;AAAA,cACtB,CAAC;AAAA,YACH;AAAA,UACF,OAAO;AACL,kBAAM,SAAS,MAAM,QAAQ,UAAU,QAAQ,cAAc;AAC7D,gBAAI,CAAC,QAAQ;AACX,oBAAM,IAAI,mBAAmB;AAAA,gBAC3B,MAAM;AAAA,gBACN,SAAS,mBAAmB,QAAQ,cAAc;AAAA,gBAClD,WAAW;AAAA,cACb,CAAC;AAAA,YACH;AACA,kBAAM,OAAO,UAAU,QAAQ,aAAa;AAAA,UAC9C;AACA,gBAAM,QAAQ,MAAM,QAAQ,SAAS,QAAQ,SAAS,MAAM,IAAI,SAAS,SAAS;AAClF,gBAAM,SAAS,QAAQ,MAAM,QAAQ,UAAU,KAAK,IAAI;AACxD,cAAI,OAAQ,OAAM,QAAQ,oBAAoB,QAAQ,UAAU,QAAQ,MAAM;AAAA,QAChF;AACA,eAAO;AAAA,UACL,QAAQ,EAAE,GAAG,QAAQ,aAAa,WAAW;AAAA,UAC7C,OAAO;AAAA,QACT;AAAA,MACF;AACA,UACE,OAAO,gBAAgB,WACvB,OAAO,gBAAgB,cACvB,OAAO,gBAAgB,SACvB,QAAO,EAAE,OAAO,KAAK;AAEvB,YAAM,WAMD,CAAC;AACN,iBAAW,YAAY,WAAW;AAChC,cAAM,QAAQ,MAAM,QAAQ,SAAS,SAAS,UAAU,IAAI,SAAS,SAAS;AAC9E,YAAI,CAAC,MAAO,QAAO,EAAE,gBAAgB,IAAK;AAC1C,YAAI,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,UAAU,QAAQ;AACtE,iBAAO;AAAA,YACL,QAAQ;AAAA,cACN,GAAG;AAAA,cACH,aAAa;AAAA,cACb,aAAa;AAAA,gBACX,MAAM;AAAA,gBACN,SAAS,iBAAiB,SAAS,QAAQ,QAAQ,MAAM,OAAO,KAAK;AAAA,gBACrE,WAAW;AAAA,cACb;AAAA,YACF;AAAA,YACA,OAAO;AAAA,UACT;AAAA,QACF;AACA,YACE,MAAM,QAAQ,UAAU,WACxB,MAAM,OAAO,iBAAiB,QAAQ,UACtC,CAAC,MAAM,OAAO,eACd,QAAO,EAAE,gBAAgB,IAAK;AAChC,cAAM,SAAS,MAAM,QAAQ,UAAU,KAAK;AAC5C,YAAI,CAAC,UAAU,OAAO,SAAS,QAAQ,MAAM,OAAO,WAAW,KAAK;AAClE,iBAAO,EAAE,gBAAgB,IAAK;AAAA,QAChC;AACA,cAAM,SAAS,MAAM,QAAQ,UAAU,MAAM,OAAO,cAAc;AAClE,YAAI,CAAC,OAAQ,QAAO,EAAE,gBAAgB,IAAK;AAC3C,iBAAS,KAAK;AAAA,UACZ,MAAM,SAAS;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU,MAAM,KAAK,eAAe;AAAA,QACtC,CAAC;AAAA,MACH;AAEA,UAAI,OAAO,gBAAgB,cAAc;AACvC,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,aAAa;AAAA,YACb,oBAAoB;AAAA,cAClB,YAAY,QAAQ;AAAA,cACpB,WAAW,IAAI,EAAE,YAAY;AAAA,YAC/B;AAAA,UACF;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UAAI,OAAO,oBAAoB,eAAe,QAAQ,YAAY;AAChE,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,aAAa;AAAA,YACb,aAAa;AAAA,cACX,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,YAAM,WAAW,CAAC,GAAI,OAAO,kBAAkB,CAAC,CAAE;AAClD,YAAM,OAAO,SAAS,KAAK,CAAC,SAAS,CAAC,SAAS,KAAK,CAAC,YAAY,QAAQ,SAAS,KAAK,IAAI,CAAC;AAC5F,UAAI,MAAM;AACR,cAAM,gBAAgB,QAAQ,UAC1B,MAAM,QAAQ,QAAQ,UAAU,KAAK,MAAM,OAAQ,cAAe,IAClE;AACJ,cAAM,QAAQ,iBAAiB,QAAQ,UACnC,MAAM,cAAc;AAAA,UACpB,MAAM,QAAQ,QAAQ,mBAAmB;AAAA,YACvC;AAAA,YACA,QAAQ,KAAK;AAAA,YACb,QAAQ,QAAQ;AAAA,YAChB,OAAO,QAAQ;AAAA,YACf,YAAY,QAAQ;AAAA,UACtB,CAAC;AAAA,QACH,IACE;AACJ,cAAM,qBAAqB,iBAAiB,QAAQ,WAAW,QAC3D,MAAM,cAAc;AAAA,UACpB,MAAM,QAAQ,QAAQ,qBAAqB;AAAA,YACzC;AAAA,YACA,aAAa,MAAM;AAAA,YACnB,aAAa,SAAS,SAAS;AAAA,YAC/B,UAAU,KAAK;AAAA,YACf,OAAO,QAAQ;AAAA,YACf,YAAY,QAAQ;AAAA,UACtB,CAAC;AAAA,QACH,IACE;AACJ,cAAM,YAAY,sBAAsB,MAAM,KAAK,OAAO,QAAQ;AAAA,UAChE,QAAQ,KAAK;AAAA,UACb,QAAQ,QAAQ;AAAA,UAChB,aAAa,SAAS,SAAS;AAAA,UAC/B,UAAU,KAAK;AAAA,QACjB,CAAC;AACD,cAAM,QAAQ,kBAAkB,KAAK,QAAQ,UAAU,QAAQ,MAAM;AACrE,iBAAS,KAAK;AAAA,UACZ,MAAM,KAAK;AAAA,UACX,UAAU,EAAE,MAAM,KAAK,MAAM,SAAS,MAAM,KAAK,KAAK,MAAM,SAAS,IAAI;AAAA,UACzE,WAAW,EAAE,MAAM,KAAK,OAAO,SAAS,MAAM,KAAK,KAAK,OAAO,SAAS,IAAI;AAAA,UAC5E,gBAAgB,KAAK,MAAM,OAAQ;AAAA,UACnC,cAAc,QAAQ;AAAA,UACtB,GAAI,QAAQ,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,UAClD,eAAe,UAAU;AAAA,UACzB,UAAU,KAAK;AAAA,QACjB,CAAC;AACD,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,aAAa;AAAA,YACb,gBAAgB;AAAA,UAClB;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,aAAa;AAAA,UACb,gBAAgB;AAAA,QAClB;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AC/KA,IAAMC,cAA6C;AAAA,EACjD,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS;AACX;AAGA,IAAMC,uBAA0D;AAAA,EAC9D,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,cAAc;AAAA,EACd,YAAY;AACd;AAEA,IAAM,6BAAyE;AAAA,EAC7E,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,IAAM,2BAA2B;AAAA,EAC/B,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW;AAAA,EACX,MAAM;AAAA,EACN,UAAU;AACZ;AAUA,SAAS,qBAAqB,UAAiD;AAC7E,SAAO,SAAS,KAAK,SAAS;AAChC;AAQA,SAAS,OAAO,WAAoC;AAClD,SAAO,EAAE,UAAU,OAAO,SAAS,CAAC,GAAG,UAAU;AACnD;AAOA,SAAS,wBACP,UACA,MACiB;AACjB,QAAM,YAAY,SAAS,KAAK,aAAa,CAAC;AAC9C,QAAM,UAAoB,CAAC;AAC3B,QAAM,WAAW,qBAAqB,QAAQ;AAC9C,QAAM,yBAAyB,UAAU,sBAAsB;AAE/D,MAAI,KAAK,YAAY,MAAO,QAAO,OAAO,mBAAmB;AAC7D,MAAI,KAAK,SAAS,CAAC,KAAK,MAAM,SAAS,QAAQ,EAAG,QAAO,OAAO,yCAAyC;AACzG,MAAI,UAAU,sBAAsB,KAAK,aAAa,MAAM;AAC1D,WAAO,OAAO,uCAAuC;AAAA,EACvD;AACA,MAAI,UAAU,gBAAgB,KAAK,SAAS,UAAU,aAAc,QAAO,OAAO,6BAA6B;AAC/G,MAAI,UAAU,cAAc;AAC1B,UAAM,UAAU,OAAO,QAAQ,UAAU,YAAY,EAAE;AAAA,MACrD,CAAC,CAAC,KAAK,KAAK,MAAM,KAAK,SAAS,GAAG,MAAM;AAAA,IAC3C;AACA,QAAI,CAAC,QAAS,QAAO,OAAO,6BAA6B;AACzD,YAAQ,KAAK,sBAAsB;AAAA,EACrC;AACA,MAAI,UAAU,cAAc,SAAS,KAAK,WAAW,GAAG;AACtD,WAAO,OAAO,gBAAgB,KAAK,WAAW,+BAA+B;AAAA,EAC/E;AAEA,MAAI,aAAa,cAAc;AAC7B,QAAI,KAAK,eAAe,aAAc,QAAO,OAAO,iDAAiD;AACrG,YAAQ,KAAK,4BAA4B;AAAA,EAC3C,OAAO;AACL,QAAI,KAAK,eAAe,aAAc,QAAO,OAAO,oDAAoD;AACxG,QAAID,YAAW,KAAK,UAAU,IAAIA,YAAW,QAAQ,GAAG;AACtD,aAAO,OAAO,eAAe,KAAK,UAAU,aAAa,QAAQ,EAAE;AAAA,IACrE;AACA,YAAQ,KAAK,UAAU,KAAK,UAAU,WAAM,QAAQ,EAAE;AAAA,EACxD;AAEA,QAAM,eAAe,KAAK,yBAAyB,2BAA2B,KAAK,UAAU;AAC7F,MAAIC,qBAAoB,sBAAsB,IAAIA,qBAAoB,YAAY,GAAG;AACnF,WAAO,OAAO,uBAAuB,sBAAsB,YAAY,YAAY,EAAE;AAAA,EACvF;AACA,UAAQ,KAAK,SAAS,sBAAsB,WAAM,YAAY,EAAE;AAChE,MAAI,UAAU,eAAe,QAAQ;AACnC,QAAI,CAAC,KAAK,eAAe,KAAK,CAAC,cAAc,UAAU,eAAe,SAAS,SAAS,CAAC,GAAG;AAC1F,aAAO,OAAO,+BAA+B;AAAA,IAC/C;AACA,YAAQ,KAAK,sBAAsB;AAAA,EACrC;AAEA,MAAI,KAAK,QAAQ,QAAQ;AACvB,UAAM,cAAc,UAAU,eAAe,CAAC;AAC9C,UAAM,cAAc,KAAK,OAAO,OAAO,CAAC,UAAU,CAAC,YAAY,SAAS,KAAK,CAAC;AAC9E,QAAI,YAAY,OAAQ,QAAO,OAAO,uBAAuB,YAAY,KAAK,IAAI,CAAC,EAAE;AACrF,YAAQ,KAAK,kBAAkB;AAAA,EACjC;AAEA,MAAI,SAAS,KAAK,cAAc;AAC9B,QAAI,CAAC,KAAK,yBAAyB,SAAS,SAAS,KAAK,YAAY,GAAG;AACvE,aAAO,OAAO,iBAAiB,SAAS,KAAK,YAAY,iBAAiB;AAAA,IAC5E;AACA,YAAQ,KAAK,iBAAiB,SAAS,KAAK,YAAY,YAAY;AAAA,EACtE;AACA,QAAM,sBAAsB,SAAS,KAAK,YAAY,uBAAuB,CAAC;AAC9E,QAAM,mBAAmB,oBAAoB;AAAA,IAC3C,CAAC,cAAc,CAAC,KAAK,sBAAsB,SAAS,SAAS;AAAA,EAC/D;AACA,MAAI,iBAAkB,QAAO,OAAO,cAAc,gBAAgB,iBAAiB;AACnF,MAAI,oBAAoB,OAAQ,SAAQ,KAAK,iCAAiC;AAE9E,QAAM,qBAAqB,SAAS,KAAK,aAAa;AACtD,MAAI,oBAAoB;AACtB,QAAI,CAAC,KAAK,uBAAuB,SAAS,kBAAkB,GAAG;AAC7D,aAAO,OAAO,eAAe,kBAAkB,iBAAiB;AAAA,IAClE;AACA,YAAQ,KAAK,eAAe,kBAAkB,YAAY;AAAA,EAC5D;AAEA,QAAM,gBAAgB,SAAS,KAAK;AACpC,MAAI,eAAe,cAAc;AAC/B,UAAM,aAAa,KAAK,qBAAqB;AAAA,MAC3C,CAAC,cAAc,UAAU,iBAAiB,cAAc;AAAA,IAC1D;AACA,QAAI,CAAC,WAAY,QAAO,OAAO,iBAAiB,cAAc,YAAY,iBAAiB;AAC3F,UAAM,UAAU,cAAc,sBAAsB;AACpD,QAAI,yBAAyB,WAAW,gBAAgB,IAAI,yBAAyB,OAAO,GAAG;AAC7F,aAAO,OAAO,uBAAuB,WAAW,gBAAgB,aAAa,OAAO,EAAE;AAAA,IACxF;AACA,QAAI,cAAc,UAAU,CAAC,WAAW,QAAQ,SAAS,cAAc,MAAM,GAAG;AAC9E,aAAO,OAAO,uBAAuB,cAAc,MAAM,iBAAiB;AAAA,IAC5E;AACA,YAAQ,KAAK,iBAAiB,cAAc,YAAY,cAAc;AAAA,EACxE;AAEA,QAAM,gBAAgB,SAAS,KAAK;AACpC,MACE,eAAe,gBACf,CAAC,KAAK,yBAAyB,SAAS,cAAc,YAAY,GAClE;AACA,WAAO,OAAO,iBAAiB,cAAc,YAAY,iBAAiB;AAAA,EAC5E;AACA,QAAM,eAAe,eAAe,SAAS;AAAA,IAC3C,CAAC,WAAW,CAAC,KAAK,uBAAuB,SAAS,OAAO,QAAQ;AAAA,EACnE;AACA,MAAI,aAAc,QAAO,OAAO,gBAAgB,aAAa,QAAQ,iBAAiB;AACtF,MAAI,eAAe,gBAAgB,eAAe,SAAS,QAAQ;AACjE,YAAQ,KAAK,gCAAgC;AAAA,EAC/C;AAEA,QAAM,mBAAmB,SAAS,KAAK;AACvC,MAAI,kBAAkB;AACpB,UAAM,aAAa,KAAK,wBAAwB;AAAA,MAC9C,CAAC,cACC,CAAC,iBAAiB,eAClB,UAAU,gBAAgB,iBAAiB;AAAA,IAC/C;AACA,QAAI,CAAC,WAAY,QAAO,OAAO,2CAA2C;AAC1E,UAAM,kBAAkB,iBAAiB,WAAW;AAAA,MAClD,CAAC,aAAa,CAAC,WAAW,WAAW,SAAS,QAAQ;AAAA,IACxD;AACA,QAAI,gBAAiB,QAAO,OAAO,uBAAuB,eAAe,iBAAiB;AAC1F,UAAM,gBAAgB,iBAAiB,SAAS;AAAA,MAC9C,CAAC,WAAW,CAAC,WAAW,SAAS,SAAS,MAAM;AAAA,IAClD;AACA,QAAI,cAAe,QAAO,OAAO,qBAAqB,aAAa,iBAAiB;AACpF,YAAQ,KAAK,0CAA0C;AAAA,EACzD;AAEA,QAAM,eAAe,SAAS,KAAK;AACnC,MAAI,cAAc;AAChB,UAAM,aAAsE;AAAA,MAC1E,CAAC,iBAAiB,KAAK;AAAA,MACvB,CAAC,eAAe,QAAQ;AAAA,MACxB,CAAC,YAAY,KAAK;AAAA,MAClB,CAAC,aAAa,MAAM;AAAA,MACpB,CAAC,iBAAiB,WAAW;AAAA,IAC/B;AACA,eAAW,CAAC,KAAK,KAAK,KAAK,YAAY;AACrC,YAAM,YAAY,aAAa,GAAG;AAClC,UAAI,cAAc,OAAW;AAC7B,UAAI,CAAC,OAAO,SAAS,SAAS,KAAK,YAAY,EAAG,QAAO,OAAO,GAAG,KAAK,qBAAqB;AAC7F,WAAK,KAAK,WAAW,GAAG,KAAK,KAAK,UAAW,QAAO,OAAO,gBAAgB,KAAK,WAAW;AAAA,IAC7F;AACA,YAAQ,KAAK,uBAAuB;AAAA,EACtC;AAEA,QAAM,UAAU,UAAU;AAC1B,MAAI,SAAS;AACX,QAAI,QAAQ,sBAAsB,SAAS,KAAK,WAAW,GAAG;AAC5D,aAAO,OAAO,gBAAgB,KAAK,WAAW,iCAAiC;AAAA,IACjF;AACA,UAAM,UAAU,KAAK,cAAc,QAAQ,OAAO,KAAK;AACvD,QACE,QAAQ,gCAAgC,UACxC,WAAW,QAAQ,6BACnB;AACA,aAAO,OAAO,iBAAiB,QAAQ,OAAO,iCAAiC;AAAA,IACjF;AACA,YAAQ,KAAK,iBAAiB,QAAQ,OAAO,WAAW;AAAA,EAC1D;AAEA,SAAO,EAAE,UAAU,MAAM,QAAQ;AACnC;AAMA,SAAS,uBACP,QACA,iBACA,QACA,KACqB;AACrB,QAAM,cAAc,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,cAAc,UAAU,SAAS,WAAW;AACjG,aAAW,KAAK,EAAE,MAAM,aAAa,QAAQ,iBAAiB,QAAQ,oBAAoB,IAAI,YAAY,EAAE,CAAC;AAC7G,SAAO,EAAE,GAAG,QAAQ,WAAW;AACjC;AAcO,SAAS,wBACd,QACA,SAC2C;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAA6C;AAC3D,YAAM,WAAW,QAAQ;AACzB,YAAM,SAAS,SAAS,UAAU,CAAC;AAInC,UAAI,SAAS,KAAK,WAAW,cAAc;AACzC,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AAGA,UAAI,OAAO,UAAU,aAAa,OAAO,UAAU,QAAW;AAC5D,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AAEA,YAAM,QAAQ,MAAM,QAAQ,UAAU;AACtC,YAAM,WAAW,QAAQ,UAAU,SAAS,UAAU,KAAK;AAE3D,UAAI,CAAC,UAAU;AACb,eAAO;AAAA,UACL,QAAQ;AAAA,YACN;AAAA,cACE,GAAG;AAAA,cACH,OAAO;AAAA,cACP,eAAe;AAAA,YACjB;AAAA,YACA;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS,QAAQ;AAC3D,YAAM,cAAc,OAAO,wBAAwB,UAAU,IAAI,IAAI,OAAO,8BAA8B;AAC1G,UAAI,CAAC,YAAY,UAAU;AACzB,eAAO;AAAA,UACL,QAAQ;AAAA,YACN;AAAA,cACE,GAAG;AAAA,cACH,OAAO;AAAA,cACP,eAAe,QAAQ,SAAS,QAAQ,0BAA0B,YAAY,SAAS;AAAA,YACzF;AAAA,YACA;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,YAAM,iBAAiB,QAAQ,qBAC3B,MAAM,QAAQ,mBAAmB;AAAA,QACjC;AAAA,QACA;AAAA,QACA,OAAO,QAAQ;AAAA,QACf,YAAY,QAAQ;AAAA,MACtB,CAAC,IACC;AACJ,UAAI,gBAAgB,YAAY,QAAQ;AACtC,eAAO;AAAA,UACL,QAAQ;AAAA,YACN;AAAA,cACE,GAAG;AAAA,cACH,OAAO;AAAA,cACP,sBAAsB,eAAe;AAAA,cACrC,uBAAuB,eAAe;AAAA,cACtC,eAAe,QAAQ,SAAS,QAAQ,wCAAwC,eAAe,QAAQ,KAAK,IAAI,CAAC;AAAA,YACnH;AAAA,YACA;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN;AAAA,YACE,GAAG;AAAA,YACH,OAAO;AAAA,YACP,cAAc,SAAS;AAAA,YACvB,GAAI,iBACA;AAAA,cACA,sBAAsB,eAAe;AAAA,cACrC,uBAAuB,eAAe;AAAA,YACxC,IACE,CAAC;AAAA,YACL,eAAe,YAAY,SAAS,QAAQ,YAAY,SAAS,KAAK,YAAY,QAAQ,UAAU;AAAA,UACtG;AAAA,UACA;AAAA,UACA,WAAW,SAAS,QAAQ;AAAA,UAC5B,QAAQ;AAAA,QACV;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAkBO,SAAS,0BAAqC;AACnD,SAAO;AAAA,IACL,SAAS,UAAU,OAAO;AACxB,YAAM,YAAY,SAAS,KAAK,aAAa,CAAC;AAC9C,YAAM,aAA+E,CAAC;AAEtF,iBAAW,QAAQ,OAAO;AACxB,cAAM,cAAc,wBAAwB,UAAU,IAAI;AAC1D,YAAI,CAAC,YAAY,SAAU;AAC3B,cAAM,UAAU,YAAY;AAG5B,cAAM,MAAM,KAAK,UAAU,iBAAiB;AAC5C,cAAM,SAAS,KAAK,UAAU,eAAe;AAC7C,YAAI,QAAQ,MAAM,KAAK,MAAM,UAAU,OAAO,KAAK;AACnD,gBAAQ,KAAK,mBAAmB,KAAK,EAAE;AAGvC,iBAASD,YAAW,KAAK,UAAU,IAAI;AACvC,YAAI,KAAK,eAAe,WAAW;AACjC,kBAAQ,KAAK,oBAAoB;AAAA,QACnC,WAAW,KAAK,eAAe,cAAc;AAC3C,kBAAQ,KAAK,0BAA0B;AAAA,QACzC;AAGA,YAAI,KAAK,oBAAoB,KAAK,mBAAmB,GAAG;AACtD,mBAAS,KAAK,IAAI,KAAK,mBAAmB,IAAI,GAAG;AACjD,kBAAQ,KAAK,sBAAsB,KAAK,gBAAgB,EAAE;AAAA,QAC5D;AAEA,YAAI,UAAU,kBAAkB,KAAK,MAAM;AACzC,mBAAS;AACT,kBAAQ,KAAK,yBAAyB;AAAA,QACxC;AACA,cAAM,iBAAiB,SAAS,KAAK,oBAAoB;AAAA,UACvD,CAAC,cAAc,KAAK,yBAAyB,SAAS,SAAS;AAAA,QACjE,EAAE,UAAU;AACZ,YAAI,gBAAgB;AAClB,mBAAS,iBAAiB;AAC1B,kBAAQ,KAAK,GAAG,cAAc,oBAAoB;AAAA,QACpD;AACA,YACE,SAAS,KAAK,uBACd,KAAK,2BAA2B,SAAS,SAAS,KAAK,mBAAmB,GAC1E;AACA,mBAAS;AACT,kBAAQ,KAAK,kBAAkB;AAAA,QACjC;AAEA,mBAAW,KAAK,EAAE,MAAM,OAAO,QAAQ,CAAC;AAAA,MAC1C;AAEA,UAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,iBAAW,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AAC3C,YAAM,OAAO,WAAW,CAAC;AACzB,aAAO;AAAA,QACL,UAAU,KAAK,KAAK;AAAA,QACpB,OAAO,KAAK;AAAA,QACZ,SAAS,KAAK;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACF;;;AC1gBA,IAAME,UAAS;AACf,IAAMC,uBAAsB;AAC5B,IAAM,cAAc,oBAAI,IAAI;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,UAAU,SAAwB;AACzC,QAAM,IAAI,mBAAmB;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AACH;AAOO,SAAS,8BAEN;AACR,SAAO,CAAC,YAAY;AAClB,QAAI,QAAQ,UAAU,SAAS,kBAAmB;AAClD,QAAI,QAAQ,SAAS,UAAU;AAC7B,gBAAU,uCAAuC;AAAA,IACnD;AACA,UAAM,OAAO,QAAQ,kBAAkB;AACvC,UAAM,aAAa,MAAM;AACzB,UAAM,mBAAmB,cACrB,OAAO,eAAe,YACtB,CAAC,MAAM,QAAQ,UAAU,IACzB,OAAO,QAAQ,UAAU,IACzB,CAAC;AACL,UAAM,OAAO,MAAM;AACnB,UAAM,qBAAqB,MAAM,SAAS,UACtC,CAAC,QAAQ,UAAU,WAAW,YAAY,IAC1C,MAAM,SAAS,UACf,CAAC,QAAQ,QAAQ,UAAU,IAC3B,MAAM,SAAS,WACf,CAAC,QAAQ,QAAQ,SAAS,MAAM,IAChC,MAAM,SAAS,UACf,CAAC,QAAQ,QAAQ,WAAW,UAAU,cAAc,QAAQ,IAC5D,CAAC;AACL,UAAM,kBAAkB;AAAA,MACtB,QACE,KAAK,SAAS,MAAM,cACpB,OAAO,KAAK,IAAI,EAAE,MAAM,CAAC,UAAU,mBAAmB,SAAS,KAAK,CAAC,MAElE,KAAK,SAAS,WACb,OAAO,KAAK,WAAW,YACvB,CAAC,WAAW,UAAU,SAAS,EAAE,SAAS,OAAO,KAAK,OAAO,CAAC,KAC/D,KAAK,SAAS,WACb,OAAO,KAAK,SAAS,YACrB,CAAC,SAAS,QAAQ,WAAW,SAAS,UAAU,EAAE;AAAA,QAChD,OAAO,KAAK,QAAQ;AAAA,MACtB,KACD,KAAK,SAAS,YACb,OAAO,KAAK,SAAS,YACrB,OAAO,KAAK,UAAU,YACtB,OAAO,SAAS,KAAK,KAAK,KAC1B,OAAO,KAAK,SAAS,YACtB,KAAK,SAAS,WACb,OAAO,KAAK,SAAS,YACrB,OAAO,KAAK,YAAY,YACxB,OAAO,KAAK,WAAW,YACvB,OAAO,KAAK,eAAe,YAC3B,OAAO,SAAS,KAAK,UAAU,KAC/B,KAAK,cAAc,KACnB,CAAC,MAAM,OAAO,EAAE,SAAS,OAAO,KAAK,MAAM,CAAC;AAAA,IAEpD;AACA,QACE,CAAC,QACD,OAAO,KAAK,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,IAAI,KAAK,CAAC,KACzD,KAAK,OAAO,OAAO,QAAQ,MAAM,MACjC,KAAK,OAAO,SAAS,QAAQ,MAAM,QACnC,CAAC,KAAK,UACN,KAAK,OAAO,SAAS,OACrB,CAAC,OAAO,cAAc,KAAK,QAAQ,KACnC,KAAK,WAAW,KAChB,CAAC,KAAK,eACN,OAAO,MAAM,KAAK,MAAM,KAAK,UAAU,CAAC,KACxC,CAAC,CAAC,SAAS,SAAS,UAAU,OAAO,EAAE,SAAS,KAAK,UAAU,KAC/D,CAAC,mBACD,OAAO,OAAO,QAAQ,CAAC,CAAC,EAAE;AAAA,MACxB,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IACzD,KACA,CAAC,KAAK,cACN,CAAC,CAAC,cAAc,WAAW,UAAU,UAAU,UAAU,EAAE;AAAA,MACzD,KAAK,WAAW;AAAA,IAClB,KACA,CAAC,KAAK,WAAW,YACjB,KAAK,WAAW,SAAS,SAAS,OACjC,KAAK,WAAW,YAAY,WAEzB,OAAO,KAAK,WAAW,YAAY,YACnC,CAAC,KAAK,WAAW,WACjB,KAAK,WAAW,QAAQ,SAAS,QAErC,CAAC;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,SAAS,KAAK,MAAM,KACtB,CAAC,cACD,OAAO,eAAe,YACtB,MAAM,QAAQ,UAAU,KACxB,iBAAiB,SAAS,MAC1B,iBAAiB;AAAA,MAAK,CAAC,CAAC,KAAK,KAAK,MAChC,CAAC,OACD,IAAI,SAAS,MACbA,qBAAoB,KAAK,GAAG,KAC5B,OAAO,UAAU,YACjB,MAAM,SAAS,OACf,gBAAgB,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC;AAAA,IAClC,KACA,CAAC,OAAO,cAAc,KAAK,YAAY,KACvC,KAAK,eAAe,KACpB,CAACD,QAAO,KAAK,KAAK,YAAY,KAC9B,CAACA,QAAO,KAAK,KAAK,gBAAgB,KAClC,CAACA,QAAO,KAAK,KAAK,YAAY,KAC9B,CAACA,QAAO,KAAK,KAAK,kBAAkB,KACpC,CAACA,QAAO,KAAK,KAAK,iBAAiB,KAClC,KAAK,mBAAmB,UAAa,CAACA,QAAO,KAAK,KAAK,cAAc,KACtE,QAAQ,UAAU,SAChB,SAAS,KAAK,kBAAkB,MAAM,UAAU,QAAQ,EAAE,CAAC,IAC7D;AACA,gBAAU,0CAA0C;AAAA,IACtD;AAAA,EACF;AACF;;;ACjEA,IAAM,eAAe;AACrB,IAAM,iBAAiB,KAAK,KAAK;AACjC,IAAM,aAAa,KAAK,KAAK;AAU7B,IAAI,eAAe;AAEZ,SAAS,+BAA+B,SAAkE;AAC/G,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,aAAa,QAAQ,gBAAgB;AAC3C,QAAM,SAAS,QAAQ,YAAY;AACnC,QAAME,WAAU,IAAI,YAAY;AAChC,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,UAAU,oBAAI,IAAY;AAEhC,QAAM,gBAAgB,oBAAI,IAAY;AAEtC,WAAS,YAAY,SAAqC;AACxD,QAAI,CAAC,QAAQ,OAAO,OAAO,CAAC,QAAQ,OAAO,QAAQ,CAAC,QAAQ,OAAO,cAAc,CAAC,QAAQ,OAAO,MAAM;AACrG,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,6CAA6C,WAAW,MAAM,CAAC;AAAA,IAC1H;AACA,QAAI,CAAC,OAAO,UAAU,QAAQ,OAAO,KAAK,QAAQ,UAAU,GAAG;AAC7D,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,uDAAuD,WAAW,MAAM,CAAC;AAAA,IACpI;AACA,QAAI,CAAC,QAAQ,WAAW;AACtB,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,2CAA2C,WAAW,MAAM,CAAC;AAAA,IACxH;AACA,QAAI,CAAC,QAAQ,QAAQ;AACnB,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,uCAAuC,WAAW,MAAM,CAAC;AAAA,IACpH;AACA,QAAI,CAAC,QAAQ,QAAQ;AACnB,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,uCAAuC,WAAW,MAAM,CAAC;AAAA,IACpH;AACA,QAAI,CAAC,QAAQ,UAAU;AACrB,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,yCAAyC,WAAW,MAAM,CAAC;AAAA,IACtH;AACA,QAAI,CAAC,QAAQ,cAAc;AACzB,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,8CAA8C,WAAW,MAAM,CAAC;AAAA,IAC3H;AAAA,EACF;AAEA,iBAAe,KAAK,QAA+D;AACjF,UAAM,UAAUA,SAAQ,OAAO,KAAK,UAAU,MAAM,CAAC;AACrD,UAAM,YAAY,MAAM,QAAQ,OAAO,KAAK,OAAO;AACnD,WAAO,EAAE,OAAO,GAAG,YAAY,IAAI,gBAAgB,OAAO,CAAC,IAAI,gBAAgB,SAAS,CAAC,IAAI,OAAO;AAAA,EACtG;AAEA,iBAAe,eAAe,OAA+C;AAC3E,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc;AACnD,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,8BAA8B,WAAW,MAAM,CAAC;AAAA,IAC3G;AACA,UAAM,UAAU,gBAAgB,MAAM,CAAC,CAAC;AACxC,UAAM,YAAY,gBAAgB,MAAM,CAAC,CAAC;AAC1C,QAAI,CAAE,MAAM,QAAQ,OAAO,OAAO,SAAS,SAAS,GAAI;AACtD,YAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,SAAS,sCAAsC,WAAW,MAAM,CAAC;AAAA,IACrH;AACA,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,QAAQ,OAAO,OAAO,CAAC;AAAA,IAC7C,QAAQ;AACN,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,oCAAoC,WAAW,MAAM,CAAC;AAAA,IACjH;AACA,WAAO;AAAA,EACT;AAEA,WAAS,aAAa,QAA+B,IAAgB;AACnE,QAAI,QAAQ,IAAI,OAAO,OAAO,GAAG;AAC/B,YAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,SAAS,4BAA4B,WAAW,OAAO,SAAS,EAAE,SAAS,OAAO,QAAQ,EAAE,CAAC;AAAA,IACjJ;AACA,QAAI,GAAG,QAAQ,KAAK,KAAK,MAAM,OAAO,SAAS,GAAG;AAChD,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,4BAA4B,WAAW,OAAO,SAAS,EAAE,WAAW,OAAO,UAAU,EAAE,CAAC;AAAA,IACnJ;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,MAAM,SAAS;AACnB,kBAAY,OAAO;AACnB,YAAM,WAAW,IAAI;AACrB,YAAM,MAAM,KAAK,IAAI,QAAQ,SAAS,YAAY,MAAM;AACxD,UAAI,OAAO,GAAG;AACZ,cAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,yCAAyC,WAAW,MAAM,CAAC;AAAA,MACtH;AACA,sBAAgB;AAChB,YAAM,SAAgC;AAAA,QACpC,SAAS,QAAQ,WAAW,QAAQ,SAAS,QAAQ,EAAE,SAAS,EAAE,CAAC,IAAI,aAAa,SAAS,EAAE,CAAC;AAAA,QAChG,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,QACjB,WAAW,QAAQ;AAAA,QACnB,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,QAChB,UAAU,QAAQ;AAAA,QAClB,cAAc,QAAQ;AAAA,QACtB,UAAU,SAAS,YAAY;AAAA,QAC/B,WAAW,IAAI,KAAK,SAAS,QAAQ,IAAI,GAAG,EAAE,YAAY;AAAA,MAC5D;AACA,oBAAc,IAAI,OAAO,OAAO;AAChC,aAAO,KAAK,MAAM;AAAA,IACpB;AAAA,IAEA,MAAM,MAAM,OAAO,eAAe,CAAC,GAAG;AACpC,YAAM,SAAS,MAAM,eAAe,KAAK;AACzC,mBAAa,QAAQ,aAAa,MAAM,KAAK,IAAI,CAAC;AAClD,YAAM,YAAY,aAAa,MAAM,KAAK,IAAI;AAC9C,YAAM,MAAM,KAAK,IAAI,aAAa,SAAS,YAAY,MAAM;AAC7D,aAAO,KAAK;AAAA,QACV,GAAG;AAAA,QACH,WAAW,UAAU,YAAY;AAAA,QACjC,WAAW,IAAI,KAAK,UAAU,QAAQ,IAAI,GAAG,EAAE,YAAY;AAAA,MAC7D,CAAC;AAAA,IACH;AAAA,IAEA,OAAO,SAAS;AACd,cAAQ,IAAI,OAAO;AAAA,IACrB;AAAA,IAEA,MAAM,QAAQ,OAAO;AACnB,YAAM,SAAS,MAAM,eAAe,KAAK;AACzC,YAAM,UAAU,IAAI,EAAE,QAAQ,KAAK,KAAK,MAAM,OAAO,SAAS;AAC9D,YAAM,YAAY,QAAQ,IAAI,OAAO,OAAO;AAC5C,YAAM,WAAW,cAAc,IAAI,OAAO,OAAO,IAAI,mBAAmB;AACxE,aAAO;AAAA,QACL,SAAS,OAAO;AAAA,QAChB,OAAO;AAAA,UACL,QAAQ,OAAO;AAAA,UACf,SAAS,OAAO;AAAA,UAChB,WAAW,OAAO;AAAA,UAClB,QAAQ,OAAO;AAAA,UACf,QAAQ,OAAO;AAAA,UACf,UAAU,OAAO;AAAA,UACjB,cAAc,OAAO;AAAA,QACvB;AAAA,QACA,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,QACT;AAAA,QACA;AAAA,QACA,kBAAkB,aAAa,UAAU;AAAA,QACzC,GAAI,aAAa,SAAS,EAAE,gBAAgB,iFAAiF,IAAI,CAAC;AAAA,MACpI;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,OAAO,cAAc;AAChC,YAAM,SAAS,MAAM,eAAe,KAAK;AACzC,mBAAa,QAAQ,IAAI,CAAC;AAC1B,UACE,OAAO,OAAO,eAAe,aAAa,OAAO,cACjD,OAAO,OAAO,SAAS,aAAa,OAAO,QAC3C,OAAO,OAAO,SAAS,aAAa,OAAO,QAC3C,OAAO,OAAO,QAAQ,aAAa,OAAO,OAC1C,OAAO,YAAY,aAAa,WAChC,OAAO,iBAAiB,aAAa,cACrC;AACA,cAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,SAAS,iDAAiD,WAAW,MAAM,CAAC;AAAA,MAChI;AACA,UAAI,OAAO,WAAW,aAAa,QAAQ;AACzC,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,+CAA+C,aAAa,MAAM;AAAA,UAC3E,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,OAAO,WAAW,aAAa,QAAQ;AACzC,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,+CAA+C,aAAa,MAAM;AAAA,UAC3E,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,OAAO,aAAa,aAAa,UAAU;AAC7C,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,iDAAiD,aAAa,QAAQ;AAAA,UAC/E,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,OAAO,cAAc,aAAa,WAAW;AAC/C,cAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,SAAS,wCAAwC,WAAW,MAAM,CAAC;AAAA,MACvH;AACA,UACE,CAAE,MAAM,QAAQ,cAAc,iBAAiB;AAAA,QAC7C,WAAW,OAAO;AAAA,QAClB,SAAS,OAAO;AAAA,QAChB,UAAU,OAAO;AAAA,QACjB,OAAO,aAAa;AAAA,MACtB,CAAC,GACD;AACA,cAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,SAAS,gDAAgD,WAAW,MAAM,CAAC;AAAA,MAC/H;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACjQA,eAAsB,yBACpB,OACA,OACA,gBACA,QACA,UACA,MAAkB,MAAM,oBAAI,KAAK,GACE;AACnC,MAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,SAAS;AACzD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAGA,QAAM,aAAa,MAAM,MAAM,IAAI;AAAA,IACjC,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAED,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,oBAAoB,cAAc,YAAY;AAAA,EAChE;AAGA,MAAI,WAAW,KAAK,eAAe,cAAc;AAC/C,UAAM,IAAI;AAAA,MACR,0DAA0D,cAAc,oBAAoB,WAAW,KAAK,UAAU;AAAA,IACxH;AAAA,EACF;AAGA,QAAM,WAAW,MAAM,MAAM,KAAK;AAAA,IAChC,MAAM;AAAA,EACR,CAAC;AACD,QAAM,cAAc,IAAI;AACxB,QAAM,iBAAkB,SAAS,MAA6C;AAAA,IAC5E,CAAC,YACC,QAAQ,KAAK,cAAc,SAAS,kBACpC,qBAAqB,SAAS,WAAW;AAAA,EAC7C;AAGA,QAAM,YAAY,IAAI,EAAE,YAAY;AACpC,aAAW,WAAW,gBAAgB;AACpC,UAAM,MAAM;AAAA,MACV;AAAA,MACA,EAAE,YAAY,4BAA4B,MAAM,qBAAqB,MAAM,QAAQ,SAAS,KAAK;AAAA,MACjG;AAAA,QACE,OAAO;AAAA,QACP;AAAA,QACA,cAAc,uBAAuB,MAAM;AAAA,MAC7C;AAAA,MACA,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,IACtD;AAAA,EACF;AAGA,QAAM,MAAM;AAAA,IACV;AAAA,IACA,EAAE,YAAY,+BAA+B,MAAM,wBAAwB,MAAM,eAAe;AAAA,IAChG;AAAA,MACE,OAAO;AAAA,MACP;AAAA,MACA,cAAc;AAAA,IAChB;AAAA,IACA,EAAE,iBAAiB,WAAW,SAAS,gBAAgB;AAAA,EACzD;AAEA,SAAO;AAAA,IACL;AAAA,IACA,cAAc,eAAe,IAAI,CAAC,YAAY,QAAQ,SAAS,IAAI;AAAA,IACnE;AAAA,IACA,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACF;AAOA,eAAsB,gBACpB,OACA,OACA,SACA,MAAkB,MAAM,oBAAI,KAAK,GACE;AACnC,MAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,SAAS;AACzD,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAGA,QAAM,SAAS,MAAM,MAAM,IAAI;AAAA,IAC7B,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,MAAM,QAAQ;AAAA,EAChB,CAAC;AAED,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,oBAAoB,QAAQ,oBAAoB,YAAY;AAAA,EAC9E;AAEA,MAAI,OAAO,KAAK,eAAe,cAAc;AAC3C,UAAM,IAAI;AAAA,MACR,+CAA+C,QAAQ,oBAAoB,oBAAoB,OAAO,KAAK,UAAU;AAAA,IACvH;AAAA,EACF;AAGA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,2CAA2C,QAAQ,oBAAoB;AAAA,IACvE;AAAA,EACF;AAGA,QAAM,oBAAoB,GAAG,QAAQ,oBAAoB,aAAa,KAAK,IAAI,CAAC;AAChF,QAAM,WAAW;AAAA,IACf,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,MAAM,kBAAkB;AAAA,IACpC,MAAM;AAAA,MACJ,SAAS,OAAO,KAAK;AAAA,MACrB,YAAY,QAAQ;AAAA,MACpB,oBAAoB,OAAO,KAAK;AAAA,MAChC,YAAY,QAAQ;AAAA,MACpB,WAAW,IAAI,KAAK,IAAI,EAAE,QAAQ,IAAI,KAAK,KAAK,KAAK,GAAI,EAAE,YAAY;AAAA,IACzE;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,MAAM,OAAO,OAAO,QAAQ;AACnD,SAAO;AACT;AAKA,eAAsB,kBACpB,OACA,gBACkB;AAClB,QAAM,aAAa,MAAM,MAAM,IAAI;AAAA,IACjC,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAED,SAAO,YAAY,QAAQ,UAAU;AACvC;;;ACvLO,IAAM,mBAAmB;AACzB,IAAM,YAAY;AA6BzB,IAAM,gCAAgC,oBAAI,IAAI;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcM,SAAS,4BAAiF;AAC/F,SAAO,CAAC,YAA8C;AACpD,QAAI,QAAQ,UAAU,SAAS,UAAW;AAE1C,UAAM,EAAE,OAAO,MAAM,SAAS,eAAe,IAAI;AAGjD,QAAI,SAAS,UAAU;AAIrB;AAAA,IACF;AAEA,QAAI,SAAS,mBAAmB,WAAW,gBAAgB;AACzD,YAAM,gBAAgB,QAAQ;AAC9B,YAAM,qBAAqB;AAG3B,UAAI,eAAe,eAAe,mBAAmB,YAAY;AAC/D;AAAA,MACF;AAGA,UAAI,MAAM,SAAS,YAAY;AAC7B,cAAM,IAAI;AAAA,UACR,gEAAgE,MAAM,IAAI;AAAA,QAC5E;AAAA,MACF;AAGA,UAAI,CAAC,mBAAmB,iBAAiB,mBAAmB,cAAc,WAAW,GAAG;AACtF,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AAGA,UAAI,CAAC,mBAAmB,mBAAmB,mBAAmB,oBAAoB,MAAM,IAAI;AAC1F,cAAM,IAAI;AAAA,UACR,6EAA6E,MAAM,EAAE;AAAA,QACvF;AAAA,MACF;AAEA;AAAA,IACF;AAEA,QAAI,SAAS,mBAAmB,SAAS,eAAe;AAGtD,YAAM,YAAY,QAAQ,UAAU,QAAQ;AAC5C,YAAM,YAAa,SAAS,QAAmC;AAC/D,UAAI,cAAc,gBAAgB,cAAc,cAAc;AAC5D,mBAAW,QAAQ,+BAA+B;AAChD,cAAI,UAAU,WAAW,IAAI,GAAG;AAC9B,kBAAM,IAAI;AAAA,cACR,yBAAyB,SAAS,4CAA4C,IAAI;AAAA,YACpF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA;AAAA,IACF;AAAA,EACF;AACF;AAMO,SAAS,iBAAiB,MAAsB;AACrD,MAAI,KAAK,QAAQ;AACf,UAAM,kBAAkB,CAAC,eAAe,cAAc,YAAY;AAClE,eAAW,SAAS,iBAAiB;AACnC,UAAI,SAAS,KAAK,QAAQ;AACxB,cAAM,IAAI;AAAA,UACR,oDAAoD,KAAK;AAAA,QAC3D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAOO,SAAS,qBAAqB,YAA4B,MAAuB;AACtF,MAAI,eAAe,UAAW,QAAO;AACrC,SAAO,CAAC,8BAA8B,IAAI,IAAI;AAChD;;;AC3IA,SAASC,WAAU,SAAwB;AACzC,QAAM,IAAI,mBAAmB;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AACH;AAOO,SAAS,iCAEN;AACR,SAAO,CAAC,YAAY;AAClB,QAAI,QAAQ,UAAU,SAAS,qBAAsB;AAErD,QAAI,QAAQ,SAAS,UAAU;AAC7B,YAAM,OAAO,QAAQ,kBAAkB;AAGvC,UACE,CAAC,QACD,KAAK,gBAAgB,QAAQ,MAAM,OAEjC,KAAK,iBAAiB,eAClB,QAAQ,MAAM,SAAS,aACvB,QAAQ,MAAM,SAAS,gBACvB,QAAQ,MAAM,SAAS,YAG3B,KAAK,iBAAiB,cACtB,KAAK,mBAAmB,aAGxB,KAAK,iBAAiB,cACtB,KAAK,mBAAmB,WAE1B;AACA,QAAAA,WAAU,6DAA6D;AAAA,MACzE;AACA;AAAA,IACF;AAEA,QAAI,QAAQ,SAAS,iBAAiB;AACpC,YAAM,UAAU,QAAQ;AACxB,YAAM,WAAW,QAAQ;AAGzB,UACE,CAAC,WACD,QAAQ,KAAK,iBAAiB,cAC9B,QAAQ,KAAK,mBAAmB,aAChC,QAAQ,MAAM,SAAS,WACvB,CAAC,YACA,SAAS,YAAY,WAAW,SAAS,YAAY,UACtD,SAAS,cAAc,QAAQ,MAAM,MACrC,CAAC,SAAS,aACV,CAAC,SAAS,yBACV,CAAC,MAAM,QAAQ,SAAS,OAAO,KAC/B,SAAS,QAAQ,WAAW,GAC5B;AACA,QAAAA;AAAA,UACE;AAAA,QACF;AAAA,MACF;AACA,YAAM,gBAAgB,QAAQ;AAC9B,UACE,kBAEE,cAAc,YAAY,SAAS,WACnC,cAAc,cAAc,SAAS,aACrC,cAAc,cAAc,SAAS,aACrC,cAAc,0BACZ,SAAS,yBACX,cAAc,QAAQ,CAAC,MAAM,SAAS,QAAQ,CAAC,IAEjD;AACA,QAAAA,WAAU,iDAAiD;AAAA,MAC7D;AACA;AAAA,IACF;AAEA,IAAAA,WAAU,gEAAgE;AAAA,EAC5E;AACF;;;AC7BA,SAAS,OAAO,MAAsC,SAAiB,SAA4D;AACjI,SAAO,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,SAAS,WAAW,SAAS,eAAe,SAAS,eAAe,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC,EAAG,EAAE;AAC3I;AAEA,IAAM,eAAe;AAGd,SAAS,YAAY,SAA0B;AACpD,QAAM,KAAK,aAAa,KAAK,OAAO;AACpC,MAAI,IAAI;AACN,UAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC;AAC5C,QAAI,IAAI,OAAO,IAAI,IAAK,QAAO;AAC/B,QAAI,MAAM,KAAK,MAAM,MAAM,MAAM,IAAK,QAAO;AAC7C,QAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,QAAI,MAAM,OAAO,KAAK,MAAM,KAAK,GAAI,QAAO;AAC5C,QAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,QAAI,MAAM,OAAO,KAAK,MAAM,KAAK,IAAK,QAAO;AAC7C,QAAI,KAAK,IAAK,QAAO;AACrB,WAAO;AAAA,EACT;AACA,QAAM,aAAa,QAAQ,YAAY,EAAE,QAAQ,YAAY,EAAE;AAC/D,MAAI,eAAe,SAAS,eAAe,KAAM,QAAO;AACxD,MAAI,WAAW,WAAW,OAAO,EAAG,QAAO;AAC3C,MAAI,WAAW,WAAW,IAAI,KAAK,WAAW,WAAW,IAAI,EAAG,QAAO;AACvE,MAAI,WAAW,WAAW,SAAS,GAAG;AAEpC,UAAM,OAAO,WAAW,MAAM,UAAU,MAAM;AAC9C,QAAI,aAAa,KAAK,IAAI,EAAG,QAAO,YAAY,IAAI;AACpD,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,OAAO,WAAW,GAAG;AACvB,YAAM,KAAK,OAAO,SAAS,OAAO,CAAC,GAAG,EAAE;AACxC,YAAM,KAAK,OAAO,SAAS,OAAO,CAAC,GAAG,EAAE;AACxC,UAAI,CAAC,OAAO,MAAM,EAAE,KAAK,CAAC,OAAO,MAAM,EAAE,GAAG;AAC1C,eAAO,YAAY,GAAI,MAAM,IAAK,GAAG,IAAI,KAAK,GAAG,IAAK,MAAM,IAAK,GAAG,IAAI,KAAK,GAAG,EAAE;AAAA,MACpF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,YAAY,UAA2B;AAC9C,SAAO,aAAa,KAAK,QAAQ,KAAK,SAAS,SAAS,GAAG;AAC7D;AAEA,SAAS,qBAAqB,UAAkB,WAA8B;AAC5E,QAAM,QAAQ,SAAS,YAAY;AACnC,SAAO,UAAU,KAAK,CAAC,UAAU;AAC/B,UAAM,SAAS,MAAM,YAAY;AACjC,WAAO,UAAU,UAAU,MAAM,SAAS,IAAI,MAAM,EAAE;AAAA,EACxD,CAAC;AACH;AAQO,SAAS,yBAAyB,MAAoB,MAAM,KAAK,IAAI,GAAuB;AACjG,QAAM,UAAU,oBAAI,IAAoD;AACxE,SAAO;AAAA,IACL,QAAQ,KAAK,WAAW;AACtB,UAAI,aAAa,EAAG,QAAO;AAC3B,YAAM,KAAK,IAAI;AACf,YAAM,SAAS,QAAQ,IAAI,GAAG,KAAK,EAAE,QAAQ,WAAW,YAAY,GAAG;AACvE,YAAM,iBAAiB,KAAK,IAAI,IAAI,KAAK,OAAO,cAAc,GAAM;AACpE,YAAM,SAAS,KAAK,IAAI,WAAW,OAAO,SAAS,iBAAiB,SAAS;AAC7E,UAAI,SAAS,GAAG;AACd,gBAAQ,IAAI,KAAK,EAAE,QAAQ,YAAY,GAAG,CAAC;AAC3C,eAAO;AAAA,MACT;AACA,cAAQ,IAAI,KAAK,EAAE,QAAQ,SAAS,GAAG,YAAY,GAAG,CAAC;AACvD,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAGO,SAAS,6BAAuG;AACrH,QAAM,UAAU,oBAAI,IAAY;AAChC,SAAO;AAAA,IACL,OAAO,UAAU;AACf,cAAQ,IAAI,QAAQ;AAAA,IACtB;AAAA,IACA,UAAU,UAAU;AAClB,aAAO,QAAQ,IAAI,QAAQ;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,IAAM,kBAAkB,CAAC,OAAO,QAAQ,MAAM;AAC9C,IAAM,kBAAkB,CAAC,OAAO;AAChC,IAAM,gBAAgB,CAAC,GAAG;AAC1B,IAAM,mBAAmB,OAAO;AAChC,IAAM,0BAA0B;AAOhC,eAAsB,uBACpB,SACA,QACA,UAAoC,CAAC,GACH;AAClC,MAAI,QAAQ,YAAY,QAAQ,QAAQ,GAAG;AACzC,WAAO,OAAO,aAAa,WAAW,QAAQ,QAAQ,cAAc;AAAA,EACtE;AAEA,QAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,QAAM,iBAAiB,OAAO,kBAAkB;AAChD,MAAI,CAAC,eAAe,SAAS,MAAM,GAAG;AACpC,WAAO,OAAO,aAAa,WAAW,MAAM,oBAAoB,EAAE,eAAe,CAAC;AAAA,EACpF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,QAAQ,GAAG;AAAA,EAC3B,QAAQ;AACN,WAAO,OAAO,WAAW,QAAQ,QAAQ,GAAG,oBAAoB;AAAA,EAClE;AAEA,QAAM,SAAS,IAAI,SAAS,QAAQ,MAAM,EAAE,EAAE,YAAY;AAC1D,QAAM,iBAAiB,OAAO,kBAAkB;AAChD,MAAI,CAAC,eAAe,SAAS,MAAM,GAAG;AACpC,WAAO,OAAO,aAAa,WAAW,MAAM,oBAAoB,EAAE,eAAe,CAAC;AAAA,EACpF;AAEA,QAAM,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,IAAK,WAAW,UAAU,MAAM;AACvE,QAAM,eAAe,OAAO,gBAAgB;AAC5C,MAAI,CAAC,aAAa,SAAS,IAAI,GAAG;AAChC,WAAO,OAAO,aAAa,QAAQ,IAAI,mBAAmB,EAAE,aAAa,CAAC;AAAA,EAC5E;AAEA,QAAM,WAAW,IAAI,SAAS,YAAY;AAC1C,MAAI,OAAO,gBAAgB,CAAC,qBAAqB,UAAU,OAAO,YAAY,GAAG;AAC/E,WAAO,OAAO,aAAa,SAAS,QAAQ,2BAA2B;AAAA,EACzE;AAEA,MAAI,YAAsB,CAAC;AAC3B,MAAI,YAAY,QAAQ,GAAG;AACzB,gBAAY,CAAC,SAAS,QAAQ,YAAY,EAAE,CAAC;AAC7C,QAAI,CAAC,OAAO,wBAAwB,YAAY,QAAQ,GAAG;AACzD,aAAO,OAAO,aAAa,WAAW,QAAQ,sCAAsC;AAAA,IACtF;AAAA,EACF,WAAW,QAAQ,iBAAiB;AAClC,QAAI;AACF,kBAAY,MAAM,QAAQ,gBAAgB,QAAQ;AAAA,IACpD,QAAQ;AACN,aAAO,OAAO,eAAe,aAAa,QAAQ,yBAAyB;AAAA,IAC7E;AACA,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO,OAAO,eAAe,aAAa,QAAQ,4BAA4B;AAAA,IAChF;AACA,QAAI,CAAC,OAAO,sBAAsB;AAChC,YAAM,iBAAiB,UAAU,KAAK,CAAC,YAAY,YAAY,OAAO,CAAC;AACvE,UAAI,gBAAgB;AAClB,eAAO,OAAO,aAAa,aAAa,QAAQ,iCAAiC,cAAc,EAAE;AAAA,MACnG;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,eAAe,MAAM;AAChD,QAAM,UAAU,aAAa,gBAAgB,OAAO,gBAAgB;AACpE,OAAK,QAAQ,aAAa,KAAK,SAAS;AACtC,WAAO,OAAO,WAAW,gBAAgB,QAAQ,SAAS,wBAAwB,OAAO,IAAI,EAAE,cAAc,QAAQ,CAAC;AAAA,EACxH;AAEA,QAAM,YAAY,aAAa,qBAAqB,OAAO,6BAA6B;AACxF,QAAM,UAAU,QAAQ;AACxB,MAAI,WAAW,CAAC,QAAQ,QAAQ,GAAG,QAAQ,QAAQ,IAAI,MAAM,IAAI,SAAS,GAAG;AAC3E,WAAO,OAAO,aAAa,mCAAmC,QAAQ,QAAQ,aAAa,MAAM,KAAK,EAAE,mBAAmB,UAAU,CAAC;AAAA,EACxI;AAEA,SAAO,EAAE,IAAI,MAAM,eAAe,IAAI,SAAS,GAAG,UAAU,UAAU;AACxE;AAGA,eAAsB,uBACpB,SACA,UACA,QACA,UAAoC,CAAC,GACH;AAClC,SAAO;AAAA,IACL,EAAE,UAAU,QAAQ,UAAU,QAAQ,QAAQ,UAAU,OAAO,KAAK,UAAU,WAAW,EAAE;AAAA,IAC3F;AAAA,IACA;AAAA,EACF;AACF;;;ACnPO,IAAM,0BAA0B;AAEhC,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA2HA,IAAM,yBAA+D;AAAA,EACnE,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,qBAAqB;AAAA,EACrB,gBAAgB,KAAK;AAAA,EACrB,sBAAsB,KAAK;AAAA,EAC3B,mBAAmB,OAAO;AAAA,EAC1B,sBAAsB,KAAK;AAAA,EAC3B,kBAAkB,KAAK;AAAA,EACvB,oBAAoB;AACtB;AAEA,IAAM,6BAA6B,OAAO;AAC1C,IAAMC,2BAA0B;AAChC,IAAM,4BAA4B;AAClC,IAAM,UAAU,IAAI,YAAY;AAEhC,SAASC,UAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC1G,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAChE,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,YAAY,EAAE,KAAK,GAAG,CAAC;AACtE,MAAIA,UAAS,KAAK,GAAG;AACnB,UAAM,UAAU,OAAO,QAAQ,KAAK,EACjC,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,SAAS,MAAS,EACvC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE;AACtE,WAAO,IAAI,QAAQ,KAAK,GAAG,CAAC;AAAA,EAC9B;AACA,QAAM,IAAI,MAAM,gDAAgD;AAClE;AAGO,SAAS,oCACd,SACY;AACZ,QAAM,EAAE,WAAW,YAAY,GAAG,SAAS,IAAI;AAC/C,SAAO,QAAQ,OAAO,aAAa,QAAQ,CAAC;AAC9C;AAGO,SAAS,wCACd,YACY;AACZ,QAAM,EAAE,kBAAkB,mBAAmB,GAAG,SAAS,IAAI;AAC7D,SAAO,QAAQ,OAAO,aAAa,QAAQ,CAAC;AAC9C;AAEA,SAAS,SAAS,OAAwB;AACxC,SAAO,QAAQ,OAAO,aAAa,KAAK,CAAC,EAAE;AAC7C;AAEA,SAAS,cACP,MACA,SACA,YAAY,OACQ;AACpB,SAAO,IAAI,mBAAmB,EAAE,MAAM,SAAS,UAAU,CAAC;AAC5D;AAEA,SAAS,cAAc,SAAsC;AAC3D,MAAI,QAAQ,eAAe,yBAAyB;AAClD,UAAM,cAAc,eAAe,oBAAoB,OAAO,QAAQ,UAAU,CAAC,oBAAoB;AAAA,EACvG;AACA,MACE,CAAC,QAAQ,aACT,CAAC,QAAQ,eACT,CAAC,OAAO,cAAc,QAAQ,QAAQ,KACtC,QAAQ,WAAW,KACnB,CAAC,0BAA0B,KAAK,QAAQ,KAAK,KAC7C,CAAC,QAAQ,YACT,CAAC,QAAQ,UACT,CAAC,QAAQ,gBACT,CAAC,QAAQ,WACT;AACA,UAAM,cAAc,WAAW,+CAA+C;AAAA,EAChF;AACA,MACE,CAAC,QAAQ,KAAK,OACd,CAAC,OAAO,cAAc,QAAQ,IAAI,OAAO,KACzC,QAAQ,IAAI,UAAU,KACtB,CAAC,OAAO,cAAc,QAAQ,IAAI,KAAK,KACvC,QAAQ,IAAI,QAAQ,GACpB;AACA,UAAM,cAAc,WAAW,0CAA0C;AAAA,EAC3E;AACA,MAAI,CAAC,wBAAwB,SAAS,QAAQ,MAAM,GAAG;AACrD,UAAM,cAAc,aAAa,2BAA2B,QAAQ,MAAM,kBAAkB;AAAA,EAC9F;AACF;AAEA,SAAS,QAAQ,MAAwB,OAAkC;AACzE,SAAO,KAAK,QAAQ,MAAM,OAAO,KAAK,YAAY,MAAM,WAAW,KAAK,UAAU,MAAM;AAC1F;AAEA,SAAS,QAAQC,QAAwC;AACvD,MAAIA,kBAAiB,oBAAoB;AACvC,UAAM,gBAAyE;AAAA,MAC7E,SAAS;AAAA,MACT,WAAW;AAAA,MACX,WAAW;AAAA,MACX,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU;AAAA,MACV,aAAa;AAAA,IACf;AACA,WAAO;AAAA,MACL,MAAMA,OAAM;AAAA,MACZ,SAAS,cAAcA,OAAM,IAAI,KAAK;AAAA,MACtC,WAAWA,OAAM;AAAA,MACjB,GAAIA,OAAM,iBAAiB,SAAY,EAAE,cAAcA,OAAM,aAAa,IAAI,CAAC;AAAA,IACjF;AAAA,EACF;AACA,SAAO,EAAE,MAAM,YAAY,SAAS,iCAAiC,WAAW,MAAM;AACxF;AAMO,SAAS,4BAA4B,SAE1C;AACA,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,YAAY,QAAQ,wBAAwBF;AAClD,QAAM,mBAAmB,QAAQ,oBAAoB;AACrD,QAAM,aAAa,oBAAI,IAAsB;AAE7C,iBAAe,MACb,SACA,UACA,YACA,MACe;AACf,QAAI;AACF,YAAM,QAAQ,UAAU;AAAA,QACtB,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,QAChB,cAAc,QAAQ;AAAA,QACtB;AAAA,QACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AAAA,IAGR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,OAAO,SAAS,SAAS,IAAI,gBAAgB,EAAE,QAAQ;AAC3D,YAAM,WAAW,IAAI;AACrB,YAAM,aAAa,SAAS,YAAY;AACxC,UAAI;AACF,sBAAc,OAAO;AACrB,cAAM,WAAW,IAAI,KAAK,QAAQ,QAAQ;AAC1C,YAAI,CAAC,OAAO,SAAS,SAAS,QAAQ,CAAC,KAAK,SAAS,QAAQ,IAAI,SAAS,QAAQ,GAAG;AACnF,gBAAM,cAAc,WAAW,8CAA8C;AAAA,QAC/E;AACA,YAAI,SAAS,QAAQ,IAAI,SAAS,QAAQ,IAAI,gBAAgB;AAC5D,gBAAM,cAAc,WAAW,gEAAgE;AAAA,QACjG;AACA,cAAM,eAAe,QAAQ,sBAAsB,QAAQ,MAAM,KAAK,uBAAuB,QAAQ,MAAM;AAC3G,YAAI,SAAS,QAAQ,OAAO,IAAI,cAAc;AAC5C,gBAAM,cAAc,WAAW,mCAAmC,YAAY,QAAQ;AAAA,QACxF;AAEA,cAAM,UAAU,MAAM,QAAQ,eAAe,QAAQ,WAAW;AAChE,YAAI,CAAC,WAAW,QAAQ,QAAS,OAAM,cAAc,aAAa,0CAA0C;AAC5G,YAAI,QAAQ,aAAa,wBAAyB,OAAM,cAAc,eAAe,0CAA0C;AAC/H,YAAI,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ,KAAK,SAAS,QAAQ,GAAG;AAC/D,gBAAM,cAAc,WAAW,4BAA4B;AAAA,QAC7D;AACA,YACE,QAAQ,aAAa,QAAQ,YAC7B,QAAQ,iBAAiB,QAAQ,gBACjC,CAAC,QAAQ,QAAQ,KAAK,QAAQ,GAAG,GACjC;AACA,gBAAM,cAAc,aAAa,iDAAiD;AAAA,QACpF;AACA,YAAI,CAAC,QAAQ,eAAe,SAAS,QAAQ,MAAM,GAAG;AACpD,gBAAM,cAAc,aAAa,kCAAkC,QAAQ,MAAM,GAAG;AAAA,QACtF;AACA,YAAI,QAAQ,kBAAkB,CAAC,QAAQ,eAAe,SAAS,QAAQ,MAAM,GAAG;AAC9E,gBAAM,cAAc,aAAa,yCAAyC,QAAQ,MAAM,GAAG;AAAA,QAC7F;AACA,YACE,CAAC,MAAM,QAAQ,gBAAgB;AAAA,UAC7B;AAAA,UACA,SAAS,oCAAoC,OAAO;AAAA,UACpD,WAAW,QAAQ;AAAA,QACrB,CAAC,GACD;AACA,gBAAM,cAAc,aAAa,qCAAqC;AAAA,QACxE;AACA,YAAI,CAAC,MAAM,QAAQ,gBAAgB,QAAQ,QAAQ,MAAM,QAAQ,UAAU,QAAQ,KAAK,GAAG;AACzF,gBAAM,cAAc,YAAY,uDAAuD;AAAA,QACzF;AAEA,cAAM,cAAc,SAAS,QAAQ,IAAI;AACzC,cAAM,OAAO,WAAW,IAAI,QAAQ,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,SAAS,QAAQ,WAAW;AACrF,YAAI,IAAI,UAAU,WAAW;AAC3B,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,YACX,cAAc,KAAK,IAAI,GAAG,IAAI,CAAC,IAAI,MAAS,SAAS,QAAQ,CAAC;AAAA,UAChE,CAAC;AAAA,QACH;AACA,YAAI,KAAK,SAAS,QAAQ,CAAC;AAC3B,mBAAW,IAAI,QAAQ,MAAM,GAAG;AAEhC,cAAM,UAAU,MAAM,QAAQ,SAAS;AAAA,UACrC,WAAW,QAAQ;AAAA,UACnB;AAAA,UACA,QAAQ,QAAQ;AAAA,UAChB,QAAQ,QAAQ;AAAA,UAChB,SAAS,QAAQ;AAAA,UACjB;AAAA,QACF,CAAC;AACD,YAAI,SAAS,OAAO,IAAI,kBAAkB;AACxC,gBAAM,cAAc,aAAa,oCAAoC,gBAAgB,QAAQ;AAAA,QAC/F;AACA,cAAM,MAAM,SAAS,MAAM,UAAU;AACrC,eAAO;AAAA,UACL,YAAY;AAAA,UACZ,WAAW,QAAQ;AAAA,UACnB,IAAI;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF,SAASE,QAAO;AACd,gBAAQ,UAAUA,MAAK;AACvB,cAAM,OAAO,QAAQA,MAAK;AAC1B,cAAM,MAAM,SAAS,OAAO,YAAY,KAAK,IAAI;AACjD,eAAO;AAAA,UACL,YAAY;AAAA,UACZ,WAAW,OAAO,SAAS,cAAc,WAAW,QAAQ,YAAY;AAAA,UACxE,IAAI;AAAA,UACJ,OAAO;AAAA,UACP;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAGO,SAAS,sCAAqE;AACnF,QAAM,SAAS,oBAAI,IAAuD;AAC1E,SAAO;AAAA,IACL,MAAM,QAAQ,aAAa,UAAU,OAAO;AAC1C,YAAM,QAAQ,OAAO,IAAI,WAAW;AACpC,UAAK,CAAC,SAAS,aAAa,KAAO,SAAS,aAAa,MAAM,WAAW,KAAM,OAAO,OAAO,IAAI,KAAK,GAAG;AACxG,eAAO;AAAA,MACT;AACA,YAAM,SAAS,OAAO,UAAU,oBAAI,IAAY;AAChD,aAAO,IAAI,KAAK;AAChB,aAAO,IAAI,aAAa,EAAE,UAAU,OAAO,CAAC;AAC5C,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AC9ZO,IAAM,wCAAwC;AAC9C,IAAM,iCAAiC;AA6E9C,IAAMC,WAAU,IAAI,YAAY;AAEhC,SAASC,cAAa,OAAwB;AAC5C,MAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AAC7E,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAChE,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAIA,aAAY,EAAE,KAAK,GAAG,CAAC;AACtE,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,IACL,OAAO,QAAQ,KAAK,EACjB,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,SAAS,MAAS,EACvC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC,IAAIA,cAAa,IAAI,CAAC,EAAE,EACnE,KAAK,GAAG,CACb;AAAA,EACF;AACA,QAAM,IAAI,MAAM,iDAAiD;AACnE;AAEO,SAAS,sCACd,MACY;AACZ,QAAM,EAAE,WAAW,YAAY,GAAG,OAAO,IAAI;AAC7C,SAAOD,SAAQ,OAAOC,cAAa,MAAM,CAAC;AAC5C;AAEO,SAAS,sCACd,MACA,MAMA;AACA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,0BACd,UAC6C;AAC7C,SAAO,SAAS,eAAe,yCAC7B,SAAS,SAAS;AACtB;AAEA,SAAS,aAAa,QAAwC;AAC5D,MAAI,CAAC,OAAO,cAAc,OAAO,WAAW,KAAK,OAAO,cAAc,GAAG;AACvE,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,QAAI,UAAU,WAAc,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI;AACjE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,4BAA4B,IAAI;AAAA,QACzC,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGA,eAAsB,6BACpB,OACA,OACA,SACA,MACA,MAAkB,MAAM,oBAAI,KAAK,GACS;AAC1C,MAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,SAAS;AACzD,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,QAAM,WAAW,IAAI;AACrB,QAAM,gBAAgB,IAAI,KAAK,QAAQ,QAAQ,SAAS;AACxD,MACE,QAAQ,QAAQ,WAChB,CAAC,OAAO,SAAS,cAAc,QAAQ,CAAC,KACxC,iBAAiB,YACjB,CAAC,QAAQ,WACT,CAAC,QAAQ,kBACT,CAAC,QAAQ,cACT,CAAC,QAAQ,UACT,CAAC,OAAO,SAAS,QAAQ,KAAK,KAC9B,QAAQ,SAAS,GACjB;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MACE,CAAC,QAAQ,QAAQ,eAAe,SAAS,QAAQ,cAAc,KAC9D,QAAQ,QAAQ,kBACf,CAAC,QAAQ,QAAQ,eAAe,SAAS,QAAQ,MAAM,GACzD;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,eAAa,QAAQ,MAAM;AAC3B,QAAM,YAAY,IAAI;AAAA,IACpB,KAAK,IAAI,cAAc,QAAQ,GAAG,SAAS,QAAQ,IAAI,QAAQ,KAAK;AAAA,EACtE,EAAE,YAAY;AACd,QAAM,WAA2D;AAAA,IAC/D,SAAS,QAAQ;AAAA,IACjB,YAAY;AAAA,MACV,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,QAAQ,QAAQ;AAAA,IACxB;AAAA,IACA,KAAK,QAAQ,QAAQ;AAAA,IACrB,sBAAsB,QAAQ,QAAQ;AAAA,IACtC,gBAAgB,QAAQ;AAAA,IACxB,UAAU,QAAQ,QAAQ;AAAA,IAC1B,UAAU,QAAQ,QAAQ;AAAA,IAC1B,gBAAgB,QAAQ;AAAA,IACxB,YAAY,QAAQ;AAAA,IACpB,QAAQ,QAAQ;AAAA,IAChB,cAAc,QAAQ,QAAQ;AAAA,IAC9B,QAAQ,QAAQ;AAAA,IAChB,UAAU,SAAS,YAAY;AAAA,IAC/B;AAAA,IACA,UAAU,MAAM;AAAA,EAClB;AACA,QAAM,YAAY,MAAM,KAAK,sCAAsC,QAAQ,CAAC;AAC5E,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,QAAM,UAAU,MAAM,MAAM;AAAA,IAC1B;AAAA,IACA,sCAAsC,QAAQ,SAAS;AAAA,MACrD,GAAG;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,MAAM,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,MACE,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,QAAQ;AAAA,IAChB;AAAA,IACA,EAAE,OAAO,aAAa;AAAA,IACtB,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,EACtD;AACA,SAAO;AACT;AAGA,eAAsB,8BACpB,OACA,cACA,QACA,MAAkB,MAAM,oBAAI,KAAK,GAClB;AACf,QAAM,OAAO,MAAM;AACnB,QAAM,WAAW,IAAI,KAAK,KAAK,QAAQ,EAAE,QAAQ;AACjD,QAAM,YAAY,IAAI,KAAK,KAAK,SAAS,EAAE,QAAQ;AACnD,QAAM,cAAc,IAAI,EAAE,QAAQ;AAClC,QAAM,QAAQ,MAAM,SAAS,SAAS,aAAa,WACjD,KAAK,YAAY,aAAa,WAC9B,KAAK,WAAW,SAAS,aAAa,eACtC,KAAK,IAAI,QAAQ,aAAa,IAAI,OAClC,KAAK,IAAI,YAAY,aAAa,IAAI,WACtC,KAAK,IAAI,UAAU,aAAa,IAAI,SACpC,KAAK,yBAAyB,aAAa,wBAC3C,KAAK,mBAAmB,aAAa,kBACrC,KAAK,aAAa,aAAa,YAC/B,KAAK,aAAa,aAAa,YAC/B,KAAK,mBAAmB,aAAa,kBACrC,KAAK,eAAe,aAAa,cACjC,KAAK,WAAW,aAAa,UAC7B,KAAK,iBAAiB,aAAa;AACrC,MACE,CAAC,SACD,MAAM,QAAQ,UAAU,gBACxB,CAAC,OAAO,SAAS,QAAQ,KACzB,CAAC,OAAO,SAAS,SAAS,KAC1B,WAAW,eACX,aAAa,eACb,aAAa,YACb,CAAC,MAAM,OAAO,sCAAsC,IAAI,GAAG,KAAK,SAAS,GACzE;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,eAAa,KAAK,MAAM;AAC1B;AAGA,eAAsB,+BACpB,OACA,OACA,OACA,MAAkB,MAAM,oBAAI,KAAK,GACS;AAC1C,MAAI,MAAM,QAAQ,UAAU,gBAAgB,MAAM,KAAK,OAAO,gBAAgB,GAAG;AAC/E,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO,MAAM,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,MACE,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,MAAM,SAAS;AAAA,IACvB;AAAA,IACA,EAAE,GAAG,MAAM,QAAQ,OAAO,YAAY,YAAY,IAAI,EAAE,YAAY,EAAE;AAAA,IACtE,EAAE,iBAAiB,MAAM,SAAS,gBAAgB;AAAA,EACpD;AACF;;;AClMO,IAAM,qBAAN,MAAiD;AAAA,EAC9C;AAAA,EACS;AAAA,EACT;AAAA,EACS;AAAA,EACA,WAAW,oBAAI,IAAY;AAAA,EAC3B;AAAA,EAEA,OAAO,oBAAI,IAA4B;AAAA,EACvC,cAAc,oBAAI,IAGhC;AAAA,EACK,WAAW;AAAA,EACF,SAAS,oBAAI,IAAwB;AAAA;AAAA,EAErC,cAAc,oBAAI,IAAoB;AAAA,EACtC,WAAW,oBAAI,IAA+B;AAAA,EACvD,eAAe;AAAA,EACN,eAAoC,CAAC;AAAA,EAC9C,oBAAoB;AAAA,EACX;AAAA,EACA,cAAc,oBAAI,IAA4C;AAAA,EACvE,SAAS;AAAA,EACT,OAAO;AAAA,EAER,YAAY,SAAoC;AACrD,SAAK,WAAW,QAAQ;AACxB,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,aAAa,QAAQ;AAC1B,SAAK,SAAS,IAAI,IAAI,QAAQ,UAAU,CAAC,QAAQ,QAAQ,CAAC;AAC1D,SAAK,aAAa,QAAQ,cAAc,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,OAAO,OAAO,CAAC,IAAI,CAAC;AACxF,SAAK,iBAAiB,QAAQ,kBAAkB;AAChD,QAAI,CAAC,OAAO,cAAc,KAAK,cAAc,KAAK,KAAK,iBAAiB,GAAG;AACzE,YAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AAAA,EACF;AAAA;AAAA,EAIQ,eAAuB;AAC7B,SAAK,YAAY;AACjB,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,YAAY,GAA0C;AAC5D,UAAM,KAAK,EAAE,SAAS,aAAa;AACnC,WAAO,GAAG,EAAE,UAAU,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,QAAQ,EAAE;AAAA,EACjE;AAAA,EAEQ,OAAO,GAA2C;AACxD,UAAM,KAAK,EAAE,aAAa;AAC1B,WAAO,GAAG,EAAE,UAAU,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;AAAA,EACxD;AAAA,EAEQ,YAAY,GAAuC;AACzD,UAAM,KAAK,EAAE,aAAa;AAC1B,QAAI,EAAE,cAAc,GAAI,QAAO,GAAG,EAAE,UAAU,IAAI,EAAE,IAAI,IAAI,EAAE;AAC9D,QAAI,EAAE,WAAY,QAAO,GAAG,EAAE,UAAU,IAAI,EAAE,IAAI;AAClD,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,KAAa,GAAwC;AAGtE,QAAI,EAAE,YAAY;AAChB,UAAI,CAAC,IAAI,WAAW,GAAG,EAAE,UAAU,IAAI,EAAE,IAAI,GAAG,EAAG,QAAO;AAC1D,UAAI,EAAE,WAAW;AACf,eAAO,IAAI,MAAM,GAAG,EAAE,UAAU,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,WAAW,GAAG,EAAE,SAAS,GAAG;AAAA,MACpF;AACA,aAAO;AAAA,IACT;AACA,QAAI,CAAC,IAAI,SAAS,IAAI,EAAE,IAAI,GAAG,EAAG,QAAO;AACzC,QAAI,EAAE,aAAa,CAAC,IAAI,SAAS,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS,GAAG,EAAG,QAAO;AACvE,WAAO;AAAA,EACT;AAAA,EAEQ,YAAY,QAAsB;AACxC,QAAI,KAAK,OAAQ,OAAM,IAAI,MAAM,iBAAiB;AAClD,QAAI,KAAK,OAAO,OAAO,KAAK,YAAY;AACtC,YAAM,IAAI,mBAAmB,EAAE,MAAM,eAAe,SAAS,GAAG,MAAM,oBAAoB,WAAW,KAAK,CAAC;AAAA,IAC7G;AAAA,EACF;AAAA,EAEQ,OAAO,KAAa,UAAiC,MAAqD;AAChH,UAAM,KAAK,OAAO,SAAS,SAAS,eAAe;AACnD,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,iBAAiB,SAAS,SAAS;AAAA,MACnC,UAAU,gBAAgB,QAAQ;AAAA,IACpC;AACA,SAAK,aAAa,KAAK,EAAE,KAAK,MAAM,CAAC;AACrC,WAAO,KAAK,aAAa,SAAS,KAAK,gBAAgB;AACrD,YAAM,UAAU,KAAK,aAAa,MAAM;AACxC,UAAI,SAAS;AACX,aAAK,oBAAoB,KAAK;AAAA,UAC5B,KAAK;AAAA,UACL,OAAO,QAAQ,MAAM,eAAe;AAAA,QACtC;AAAA,MACF;AAAA,IACF;AACA,eAAW,OAAO,KAAK,SAAS,OAAO,GAAG;AACxC,UAAI,CAAC,IAAI,WAAW,KAAK,YAAY,IAAI,KAAK,CAAC,EAAG;AAClD,UAAI,CAAC,KAAK,WAAW,KAAK,IAAI,KAAK,EAAG;AACtC,UAAI,MAAM,IAAI,cAAe;AAC7B,UAAI,gBAAgB;AACpB,UAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,IACjC;AAAA,EACF;AAAA;AAAA,EAIA,MAAa,IAAoB,WAAkG;AACjI,UAAM,IAAI,KAAK,KAAK,IAAI,KAAK,OAAO,SAAS,CAAC;AAC9C,QAAI,CAAC,KAAK,EAAE,QAAS,QAAO;AAC5B,WAAO,gBAAgB,EAAE,QAAQ;AAAA,EACnC;AAAA,EAEA,MAAa,KAAqB,OAAuF;AACvH,UAAM,QAAsD,CAAC;AAC7D,eAAW,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM;AAChC,UAAI,EAAE,QAAS;AACf,UAAI,CAAC,KAAK,WAAW,KAAK,KAAK,EAAG;AAClC,YAAM,KAAK,gBAAgB,EAAE,QAAQ,CAAqD;AAAA,IAC5F;AACA,WAAO,EAAE,OAAO,iBAAiB,OAAO,KAAK,QAAQ,EAAE;AAAA,EACzD;AAAA,EAEO,MACL,OACA,UAAqC,CAAC,GACkB;AAExD,UAAM,OAAO;AACb,QAAI,OAAO;AACX,WAAO;AAAA,MACL,CAAC,OAAO,aAAa,IAAI;AAIvB,cAAM,SAAyD,CAAC;AAChE,YAAI,UAA8F;AAClG,cAAM,KAAK,KAAK;AAChB,cAAM,mBAAmB,KAAK;AAC9B,cAAM,oBAAoB,QAAQ,oBAAoB,SAClD,mBACA,OAAO,QAAQ,eAAe;AAClC,YACE,CAAC,OAAO,cAAc,iBAAiB,KACvC,oBAAoB,KACpB,oBAAoB,kBACpB;AACA,iBAAO,KAAK;AAAA,YACV,MAAM;AAAA,YACN,iBAAiB,OAAO,gBAAgB;AAAA,YACxC,UAAU;AAAA,YACV,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,kCAAkC,OAAO,QAAQ,eAAe,CAAC;AAAA,cAC1E,WAAW;AAAA,YACb;AAAA,UACF,CAAC;AACD,iBAAO;AAAA,QACT,WAAW,oBAAoB,KAAK,mBAAmB;AACrD,iBAAO,KAAK;AAAA,YACV,MAAM;AAAA,YACN,iBAAiB,OAAO,KAAK,iBAAiB;AAAA,YAC9C,UAAU;AAAA,YACV,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,mBAAmB,iBAAiB;AAAA,cAC7C,WAAW;AAAA,YACb;AAAA,UACF,CAAC;AACD,iBAAO;AAAA,QACT;AACA,YAAI,CAAC,QAAQ,QAAQ,mBAAmB;AACtC,qBAAW,CAAC,KAAK,MAAM,KAAK,KAAK,MAAM;AACrC,gBACE,OAAO,WACP,OAAO,WAAW,oBAClB,CAAC,KAAK,WAAW,KAAK,KAAK,EAC3B;AACF,mBAAO,KAAK;AAAA,cACV,MAAM;AAAA,cACN,iBAAiB,OAAO,SAAS,SAAS;AAAA,cAC1C,UAAU,gBAAgB,OAAO,QAAQ;AAAA,YAC3C,CAA4C;AAAA,UAC9C;AACA,iBAAO,KAAK;AAAA,YACV,MAAM;AAAA,YACN,iBAAiB,OAAO,gBAAgB;AAAA,UAC1C,CAAC;AAAA,QACH,WAAW,CAAC,QAAQ,QAAQ,oBAAoB,QAAW;AACzD,qBAAW,SAAS,KAAK,cAAc;AACrC,kBAAM,WAAW,OAAO,MAAM,MAAM,eAAe;AACnD,gBACE,YAAY,qBACZ,WAAW,oBACX,CAAC,KAAK,WAAW,MAAM,KAAK,KAAK,EACjC;AACF,mBAAO;AAAA,cACL,gBAAgB,MAAM,KAAK;AAAA,YAC7B;AAAA,UACF;AAAA,QACF;AACA,YAAI;AACJ,cAAM,gBAAgB,MAAY;AAChC,gBAAM,UAAU;AAChB,oBAAU;AACV,oBAAU,EAAE,MAAM,MAAM,OAAO,OAAU,CAAC;AAAA,QAC5C;AACA,cAAM,QAAQ,MAAY;AACxB,iBAAO;AACP,cAAI,QAAS,cAAa,OAAO;AACjC,kBAAQ,QAAQ,oBAAoB,SAAS,KAAK;AAClD,wBAAc;AACd,eAAK,SAAS,OAAO,EAAE;AAAA,QACzB;AACA,YAAI,CAAC,MAAM;AACT,eAAK,SAAS,IAAI,IAAI;AAAA,YACpB;AAAA,YACA,eAAe;AAAA,YACf,MAAM,CAAC,UAAU;AACf,kBAAI,SAAS;AACX,sBAAM,UAAU;AAChB,0BAAU;AACV,wBAAQ,EAAE,MAAM,OAAO,OAAO,MAAiD,CAAC;AAAA,cAClF,OAAO;AACL,uBAAO,KAAK,KAAgD;AAAA,cAC9D;AAAA,YACF;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AACA,gBAAQ,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAC/D,YAAI,QAAQ,QAAQ,QAAS,OAAM;AACnC,YAAI,CAAC,QAAQ,QAAQ,cAAc,QAAW;AAC5C,oBAAU,WAAW,OAAO,KAAK,IAAI,GAAG,QAAQ,SAAS,CAAC;AAAA,QAC5D;AACA,eAAO;AAAA,UACL,MAAM,OAAyE;AAC7E,kBAAM,WAAW,OAAO,MAAM;AAC9B,gBAAI,aAAa,OAAW,QAAO,EAAE,MAAM,OAAO,OAAO,SAAS;AAClE,gBAAI,QAAQ,KAAK,OAAQ,QAAO,EAAE,MAAM,MAAM,OAAO,OAAU;AAC/D,mBAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,wBAAU;AAAA,YACZ,CAAC;AAAA,UACH;AAAA,UACA,MAAM,SAAS;AACb,kBAAM;AACN,mBAAO,EAAE,MAAM,MAAM,OAAO,OAAU;AAAA,UACxC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAa,OACX,OACA,UACA,SACgD;AAChD,SAAK,YAAY,QAAQ;AACzB,UAAM,MAAM,KAAK,YAAY,QAAyC;AAEtE,UAAM,gBAAgB,2BAA2B,EAAE,OAAO,SAAS,CAAC;AACpE,QAAI,SAAS,gBAAgB;AAC3B,YAAM,SAAS,KAAK,YAAY,IAAI,UAAU,QAAQ,cAAc,EAAE;AACtE,UAAI,QAAQ;AACV,YAAI,OAAO,kBAAkB,eAAe;AAC1C,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,gBAAgB,OAAO,QAAQ;AAAA,MACxC;AAAA,IACF;AAEA,QAAI,KAAK,KAAK,IAAI,GAAG,GAAG;AACtB,YAAM,IAAI,mBAAmB,EAAE,MAAM,YAAY,SAAS,YAAY,GAAG,mBAAmB,WAAW,MAAM,CAAC;AAAA,IAChH;AAEA,SAAK,YAAY,UAAU;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN,WAAW;AAAA,QACT,YAAY,SAAS;AAAA,QACrB,MAAM,SAAS;AAAA,QACf,MAAM,SAAS,SAAS;AAAA,QACxB,WAAW,SAAS,SAAS;AAAA,MAC/B;AAAA,MACA,kBAAkB;AAAA,IACpB,CAAC;AACD,UAAM,KAAK,SAAS,SAAS,KAAK,WAAW,KAAK,aAAa;AAC/D,UAAM,MAAM,GAAG,SAAS,IAAI,IAAI,SAAS,SAAS,aAAa,SAAS,IAAI,SAAS,SAAS,QAAQ,EAAE,IAAI,EAAE;AAC9G,UAAM,SAAgC;AAAA,MACpC,YAAY,SAAS;AAAA,MACrB,MAAM,SAAS;AAAA,MACf,UAAU;AAAA,QACR,MAAM,SAAS,SAAS,QAAQ;AAAA,QAChC,WAAW,SAAS,SAAS,aAAa;AAAA,QAC1C;AAAA,QACA,YAAY;AAAA,QACZ,iBAAiB,OAAO,EAAE;AAAA,QAC1B,oBAAmB,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC1C,QAAQ,SAAS,SAAS;AAAA,QAC1B,aAAa,SAAS,SAAS;AAAA,QAC/B,iBAAiB,SAAS,SAAS;AAAA,QACnC,YAAY,SAAS,SAAS;AAAA,MAChC;AAAA,MACA,MAAM,SAAS;AAAA,IACjB;AAEA,QAAI,CAAC,SAAS,QAAQ;AACpB,WAAK,KAAK,IAAI,KAAK,EAAE,UAAU,QAAQ,UAAU,IAAI,SAAS,MAAM,CAAC;AACrE,UAAI,SAAS,gBAAgB;AAC3B,aAAK,YAAY,IAAI,UAAU,QAAQ,cAAc,IAAI;AAAA,UACvD;AAAA,UACA,UAAU,gBAAgB,MAAM;AAAA,QAClC,CAAC;AAAA,MACH;AACA,WAAK,OAAO,KAAK,QAAQ,OAAO;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAa,MACX,OACA,UACA,UAAoC,CAAC,GACW;AAChD,SAAK,YAAY,OAAO;AACxB,UAAM,MAAM,KAAK,YAAY,QAAyC;AACtE,UAAM,iBAAiB,QAAQ,iBAC3B,SAAS,QAAQ,cAAc,KAC/B;AACJ,UAAM,cAAc,2BAA2B,EAAE,OAAO,SAAS,CAAC;AAClE,QAAI,gBAAgB;AAClB,YAAM,SAAS,KAAK,YAAY,IAAI,cAAc;AAClD,UAAI,QAAQ;AACV,YAAI,OAAO,kBAAkB,aAAa;AACxC,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,gBAAgB,OAAO,QAAQ;AAAA,MACxC;AAAA,IACF;AACA,UAAM,SAAS,KAAK,KAAK,IAAI,GAAG;AAChC,QAAI,CAAC,UAAU,OAAO,SAAS;AAC7B,YAAM,UAAU,MAAM,KAAK,OAAuB,OAAO,UAAU;AAAA,QACjE,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,MACnE,CAAC;AACD,UAAI,kBAAkB,CAAC,QAAQ,QAAQ;AACrC,aAAK,YAAY,IAAI,gBAAgB;AAAA,UACnC,eAAe;AAAA,UACf,UAAU,gBAAgB,OAAO;AAAA,QACnC,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AACA,QACE;AAAA,MACE,OAAO;AAAA,MACP;AAAA,IACF,GACA;AACA,UAAI,kBAAkB,CAAC,QAAQ,QAAQ;AACrC,aAAK,YAAY,IAAI,gBAAgB;AAAA,UACnC,eAAe;AAAA,UACf,UAAU,gBAAgB,OAAO,QAAQ;AAAA,QAC3C,CAAC;AAAA,MACH;AACA,aAAO,gBAAgB,OAAO,QAAQ;AAAA,IACxC;AACA,QACE,CAAC,QAAQ,mBACT,QAAQ,oBAAoB,OAAO,SAAS,SAAS,iBACrD;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,KAAK,YAAY;AACnB,WAAK,WAAW,UAAU;AAAA,QACxB;AAAA,QACA,MAAM;AAAA,QACN,WAAW;AAAA,UACT,YAAY,SAAS;AAAA,UACrB,MAAM,SAAS;AAAA,UACf,MAAM,SAAS,SAAS;AAAA,UACxB,WAAW,SAAS,SAAS;AAAA,QAC/B;AAAA,QACA,SAAS,OAAO;AAAA,QAChB,kBAAkB;AAAA,MACpB,CAAC;AAAA,IACH;AACA,UAAM,KAAK,QAAQ,SAAS,KAAK,WAAW,KAAK,aAAa;AAC9D,UAAM,cAAc,2BAA2B,OAAO,SAAS,IAAI,MACjE,2BAA2B,SAAS,IAAI;AAC1C,UAAM,UAAiC;AAAA,MACrC,GAAG,OAAO;AAAA,MACV,UAAU;AAAA,QACR,GAAG,OAAO,SAAS;AAAA,QACnB,GAAG,gBAAgB,SAAS,QAAQ;AAAA,QACpC,MAAM,OAAO,SAAS,SAAS;AAAA,QAC/B,WAAW,OAAO,SAAS,SAAS;AAAA,QACpC,KAAK,OAAO,SAAS,SAAS;AAAA,QAC9B,YAAY,OAAO,SAAS,SAAS,cAAc,cAAc,IAAI;AAAA,QACrE,iBAAiB,OAAO,EAAE;AAAA,QAC1B,mBAAmB,OAAO,SAAS,SAAS;AAAA,MAC9C;AAAA,MACA,MAAM,gBAAgB,SAAS,IAAI;AAAA,IACrC;AACA,QAAI,CAAC,QAAQ,QAAQ;AACnB,WAAK,KAAK,IAAI,KAAK,EAAE,UAAU,SAAS,UAAU,IAAI,SAAS,MAAM,CAAC;AACtE,UAAI,gBAAgB;AAClB,aAAK,YAAY,IAAI,gBAAgB;AAAA,UACnC,eAAe;AAAA,UACf,UAAU,gBAAgB,OAAO;AAAA,QACnC,CAAC;AAAA,MACH;AACA,WAAK,OAAO,KAAK,SAAS,UAAU;AAAA,IACtC;AACA,WAAO,gBAAgB,OAAO;AAAA,EAChC;AAAA,EAEA,MAAa,aACX,OACA,WACA,QACA,SACgD;AAChD,SAAK,YAAY,cAAc;AAC/B,UAAM,MAAM,KAAK,OAAO,SAAS;AACjC,UAAM,gBAAgB,2BAA2B;AAAA,MAC/C;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB,QAAQ;AAAA,IAC3B,CAAC;AACD,UAAM,iBAAiB,QAAQ,iBAC3B,UAAU,QAAQ,cAAc,KAChC;AACJ,QAAI,gBAAgB;AAClB,YAAM,SAAS,KAAK,YAAY,IAAI,cAAc;AAClD,UAAI,QAAQ;AACV,YAAI,OAAO,kBAAkB,eAAe;AAC1C,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,gBAAgB,OAAO,QAAQ;AAAA,MACxC;AAAA,IACF;AACA,UAAM,SAAS,KAAK,KAAK,IAAI,GAAG;AAChC,QAAI,CAAC,UAAU,OAAO,SAAS;AAC7B,YAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,SAAS,YAAY,GAAG,cAAc,WAAW,MAAM,CAAC;AAAA,IAC5G;AAEA,QAAI,KAAK,YAAY;AACnB,WAAK,WAAW,UAAU;AAAA,QACxB;AAAA,QACA,MAAM;AAAA,QACN;AAAA,QACA,SAAS,OAAO;AAAA,QAChB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAEA,QAAI,QAAQ,mBAAmB,OAAO,SAAS,SAAS,oBAAoB,QAAQ,iBAAiB;AACnG,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,0BAA0B,QAAQ,eAAe,SAAS,OAAO,SAAS,SAAS,eAAe;AAAA,QAC3G,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAEA,UAAM,KAAK,QAAQ,SAAS,KAAK,WAAW,KAAK,aAAa;AAC9D,UAAM,UAAiC;AAAA,MACrC,GAAG,OAAO;AAAA,MACV;AAAA,MACA,UAAU;AAAA,QACR,GAAG,OAAO,SAAS;AAAA,QACnB,iBAAiB,OAAO,EAAE;AAAA,MAC5B;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,QAAQ;AACnB,WAAK,KAAK,IAAI,KAAK,EAAE,UAAU,SAAS,UAAU,IAAI,SAAS,MAAM,CAAC;AACtE,UAAI,gBAAgB;AAClB,aAAK,YAAY,IAAI,gBAAgB;AAAA,UACnC;AAAA,UACA,UAAU,gBAAgB,OAAO;AAAA,QACnC,CAAC;AAAA,MACH;AACA,WAAK,OAAO,KAAK,SAAS,UAAU;AAAA,IACtC;AACA,WAAO,gBAAgB,OAAO;AAAA,EAChC;AAAA,EAEA,MAAa,OACX,OACA,WACA,UAAsC,CAAC,GACH;AACpC,SAAK,YAAY,QAAQ;AACzB,UAAM,MAAM,KAAK,OAAO,SAAS;AACjC,UAAM,gBAAgB,2BAA2B;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,eAAe,QAAQ;AAAA,MACvB,mBAAmB,QAAQ;AAAA,IAC7B,CAAC;AACD,UAAM,iBAAiB,QAAQ,iBAC3B,UAAU,QAAQ,cAAc,KAChC;AACJ,QAAI,gBAAgB;AAClB,YAAM,SAAS,KAAK,YAAY,IAAI,cAAc;AAClD,UAAI,QAAQ;AACV,YAAI,OAAO,kBAAkB,eAAe;AAC1C,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,gBAAgB,OAAO,QAAQ;AAAA,MACxC;AAAA,IACF;AACA,UAAM,SAAS,KAAK,KAAK,IAAI,GAAG;AAChC,QAAI,CAAC,UAAU,OAAO,QAAS,QAAO,EAAE,UAAU,OAAO,UAAU;AAEnE,UAAM,gBAAgB,QAAQ;AAC9B,QACG,eAAe,QAAQ,UACtB,cAAc,QAAQ,OAAO,SAAS,SAAS,OAChD,eAAe,oBAAoB,UAClC,cAAc,oBAAoB,OAAO,SAAS,SAAS,mBAC5D,eAAe,eAAe,UAC7B,cAAc,eAAe,OAAO,SAAS,SAAS,YACxD;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,SAAK,YAAY,UAAU;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,SAAS,OAAO;AAAA,IAClB,CAAC;AAED,UAAM,WAAW,OAAO,SAAS,SAAS,YAAY,UAAU,KAAK;AACrE,UAAM,iBAAiB,WAAW,OAAO,SAAS,SAAS,sBAAsB;AACjF,UAAM,KAAK,QAAQ,UAAU,iBACzB,KAAK,WACL,KAAK,aAAa;AACtB,UAAM,UAAiC;AAAA,MACrC,GAAG,OAAO;AAAA,MACV,UAAU;AAAA,QACR,GAAG,OAAO,SAAS;AAAA,QACnB,iBAAiB,OAAO,EAAE;AAAA,QAC1B,GAAI,WAAW,CAAC,iBACZ,EAAE,oBAAmB,oBAAI,KAAK,GAAE,YAAY,EAAE,IAC9C,CAAC;AAAA,MACP;AAAA,IACF;AACA,UAAM,SAAoC,EAAE,UAAU,MAAM,UAAU;AACtE,QAAI,CAAC,QAAQ,QAAQ;AACnB,UAAI,CAAC,gBAAgB;AACnB,aAAK,KAAK,IAAI,KAAK;AAAA,UACjB,UAAU;AAAA,UACV,UAAU;AAAA,UACV,SAAS,CAAC;AAAA,QACZ,CAAC;AAAA,MACH;AACA,UAAI,gBAAgB;AAClB,aAAK,YAAY,IAAI,gBAAgB;AAAA,UACnC;AAAA,UACA,UAAU,gBAAgB,MAAM;AAAA,QAClC,CAAC;AAAA,MACH;AACA,UAAI,CAAC,gBAAgB;AACnB,aAAK,OAAO,KAAK,SAAS,UAAU,aAAa,SAAS;AAAA,MAC5D;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAIA,MAAa,aAAa,OAA0B,SAA0D;AAC5G,SAAK,YAAY,cAAc;AAC/B,QACE,CAAC,QAAQ,QACT,CAAC,QAAQ,UACT,CAAC,OAAO,cAAc,QAAQ,KAAK,KACnC,QAAQ,SAAS,GACjB;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,SAAK,YAAY,UAAU;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN,WAAW,KAAK,eAAe,QAAQ,IAAI;AAAA,IAC7C,CAAC;AACD,UAAM,WAAW,KAAK,OAAO,IAAI,QAAQ,IAAI;AAC7C,QAAI,YAAY,KAAK,IAAI,IAAI,SAAS,WAAW;AAC/C,YAAM,IAAI,mBAAmB,EAAE,MAAM,YAAY,SAAS,SAAS,QAAQ,IAAI,YAAY,SAAS,MAAM,IAAI,WAAW,KAAK,CAAC;AAAA,IACjI;AACA,SAAK,gBAAgB,QAAQ,IAAI;AAEjC,UAAM,UAAU,SAAS,QAAQ,IAAI,IAAI,QAAQ,MAAM,IAAI,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC;AAClF,UAAM,KAAK,KAAK,aAAa;AAC7B,UAAM,MAAM,KAAK,IAAI;AAGrB,UAAM,SAAS,KAAK,YAAY,IAAI,QAAQ,IAAI,KAAK,KAAK;AAC1D,SAAK,YAAY,IAAI,QAAQ,MAAM,KAAK;AACxC,SAAK,OAAO,IAAI,QAAQ,MAAM;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,OAAO,OAAO,KAAK;AAAA,MACnB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,WAAW,MAAM,QAAQ;AAAA,IAC3B,CAAC;AACD,SAAK,YAAY;AAAA,MACf,QAAQ;AAAA,MACR,YAAY,MAAM;AAChB,aAAK,YAAY,QAAQ,IAAI;AAAA,MAC/B,GAAG,KAAK,IAAI,QAAQ,OAAO,GAAM,CAAC;AAAA,IACpC;AAEA,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,OAAO,OAAO,KAAK;AAAA,MACnB,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,WAAW,IAAI,KAAK,MAAM,QAAQ,KAAK,EAAE,YAAY;AAAA,MACrD,iBAAiB,OAAO,EAAE;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,OAA0B,IAA0B,OAA2C;AACrH,SAAK,YAAY,YAAY;AAC7B,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,SAAK,YAAY,UAAU;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN,WAAW,KAAK,eAAe,GAAG,IAAI;AAAA,IACxC,CAAC;AACD,UAAM,WAAW,KAAK,OAAO,IAAI,GAAG,IAAI;AAExC,UAAM,MAAM,KAAK,IAAI;AACrB,QACE,CAAC,YACD,SAAS,WAAW,GAAG,UACvB,SAAS,YAAY,GAAG,WACxB,GAAG,UAAU,SAAS,SACtB,SAAS,aAAa,KACtB;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,SAAS,GAAG,IAAI;AAAA,QACzB,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,aAAS,YAAY;AACrB,aAAS,YAAY,MAAM;AAC3B,WAAO;AAAA,MACL,MAAM,GAAG;AAAA,MACT,QAAQ,SAAS;AAAA,MACjB,SAAS,SAAS;AAAA,MAClB,OAAO,SAAS;AAAA,MAChB,YAAY,IAAI,KAAK,SAAS,UAAU,EAAE,YAAY;AAAA,MACtD,WAAW,IAAI,KAAK,SAAS,SAAS,EAAE,YAAY;AAAA,MACpD,WAAW,IAAI,KAAK,SAAS,SAAS,EAAE,YAAY;AAAA,MACpD,iBAAiB,OAAO,KAAK,aAAa,CAAC;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,MAAa,aAAa,OAA0B,IAAyC;AAC3F,SAAK,YAAY,cAAc;AAC/B,SAAK,YAAY,UAAU;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN,WAAW,KAAK,eAAe,GAAG,IAAI;AAAA,IACxC,CAAC;AACD,UAAM,WAAW,KAAK,OAAO,IAAI,GAAG,IAAI;AACxC,QACE,CAAC,YACD,SAAS,WAAW,GAAG,UACvB,SAAS,YAAY,GAAG,WACxB,SAAS,UAAU,GAAG,OACtB;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,SAAS,GAAG,IAAI;AAAA,QACzB,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,SAAK,OAAO,OAAO,GAAG,IAAI;AAC1B,SAAK,gBAAgB,GAAG,IAAI;AAAA,EAC9B;AAAA;AAAA,EAIA,MAAa,QAAQ,wBAAuE;AAC1F,UAAM,SAAS,OAAO,sBAAsB;AAC5C,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,KAAK,SAAS,KAAK,UAAU;AACzE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,uCAAuC,sBAAsB;AAAA,QACtE,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,SAAK,oBAAoB,KAAK,IAAI,KAAK,mBAAmB,MAAM;AAChE,aAAS,QAAQ,KAAK,aAAa,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG;AACrE,UAAI,OAAO,KAAK,aAAa,KAAK,EAAE,MAAM,eAAe,KAAK,QAAQ;AACpE,aAAK,aAAa,OAAO,OAAO,CAAC;AAAA,MACnC;AAAA,IACF;AACA,eAAW,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM;AAChC,UAAI,EAAE,WAAW,EAAE,YAAY,OAAQ,MAAK,KAAK,OAAO,GAAG;AAAA,IAC7D;AACA,WAAO,EAAE,kBAAkB,OAAO,MAAM,GAAG,iBAAiB,OAAO,KAAK,QAAQ,EAAE;AAAA,EACpF;AAAA,EAEA,MAAa,SAAS,aAA0D;AAG9E,WAAO,EAAE,iBAAiB,OAAO,KAAK,QAAQ,GAAG,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,EACvF;AAAA;AAAA,EAGO,iBAA6C;AAClD,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,mBAAmB,KAAK;AAAA,MACxB,MAAM,KAAK;AAAA,MACX,QAAQ,CAAC,GAAG,KAAK,MAAM;AAAA,MACvB,UAAU,CAAC,GAAG,KAAK,QAAQ;AAAA,MAC3B,YAAY,KAAK;AAAA,MACjB,aAAa,OAAO,YAAY,KAAK,WAAW;AAAA,MAChD,WAAW,CAAC,GAAG,KAAK,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;AAAA,QACzD;AAAA,QACA,UAAU,gBAAgB,MAAM,QAAQ;AAAA,QACxC,UAAU,MAAM;AAAA,QAChB,SAAS,MAAM;AAAA,MACjB,EAAE;AAAA,MACF,aAAa,CAAC,GAAG,KAAK,YAAY,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;AAAA,QAClE;AAAA,QACA,eAAe,MAAM;AAAA,QACrB,UAAU,gBAAgB,MAAM,QAAQ;AAAA,MAC1C,EAAE;AAAA,MACF,aAAa,KAAK,aAAa,IAAI,CAAC,WAAW;AAAA,QAC7C,KAAK,MAAM;AAAA,QACX,OAAO,gBAAgB,MAAM,KAAK;AAAA,MACpC,EAAE;AAAA,MACF,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC;AAAA,EACF;AAAA;AAAA,EAGO,gBAAgB,UAA4C;AACjE,QAAI,KAAK,OAAQ,OAAM,IAAI,MAAM,iBAAiB;AAClD,SAAK,KAAK,MAAM;AAChB,eAAW,SAAS,SAAS,WAAW;AACtC,UAAI,MAAM,IAAI,WAAW,UAAU,EAAG;AACtC,WAAK,KAAK,IAAI,MAAM,KAAK;AAAA,QACvB,UAAU,gBAAgB,MAAM,QAAQ;AAAA,QACxC,UAAU,MAAM;AAAA,QAChB,SAAS,MAAM;AAAA,MACjB,CAAC;AAAA,IACH;AACA,SAAK,YAAY,MAAM;AACvB,eAAW,SAAS,SAAS,eAAe,CAAC,GAAG;AAC9C,WAAK,YAAY,IAAI,MAAM,KAAK;AAAA,QAC9B,eAAe,MAAM;AAAA,QACrB,UAAU,gBAAgB,MAAM,QAAQ;AAAA,MAC1C,CAAC;AAAA,IACH;AACA,SAAK,WAAW,SAAS;AACzB,SAAK,oBAAoB,SAAS,qBAAqB;AACvD,SAAK,aAAa;AAAA,MAChB;AAAA,MACA,KAAK,aAAa;AAAA,MAClB,IAAI,SAAS,eAAe,CAAC,GAAG,IAAI,CAAC,WAAW;AAAA,QAC9C,KAAK,MAAM;AAAA,QACX,OAAO,gBAAgB,MAAM,KAAK;AAAA,MACpC,EAAE;AAAA,IACJ;AACA,SAAK,OAAO,SAAS;AACrB,SAAK,OAAO,MAAM;AAClB,eAAW,MAAM,SAAS,OAAQ,MAAK,OAAO,IAAI,EAAE;AACpD,SAAK,SAAS,MAAM;AACpB,eAAW,MAAM,SAAS,SAAU,MAAK,SAAS,IAAI,EAAE;AACxD,SAAK,aAAa,SAAS;AAC3B,SAAK,YAAY,MAAM;AACvB,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,WAAW,GAAG;AAChE,WAAK,YAAY,IAAI,MAAM,KAAK;AAAA,IAClC;AAGA,eAAW,QAAQ,CAAC,GAAG,KAAK,OAAO,KAAK,CAAC,GAAG;AAC1C,WAAK,OAAO,OAAO,IAAI;AACvB,WAAK,gBAAgB,IAAI;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,MAAa,YAAyC;AACpD,WAAO,EAAE,SAAS,KAAK,OAAO,QAAQ,KAAK,cAAc,CAAC,KAAK,QAAQ,iBAAiB,OAAO,KAAK,QAAQ,EAAE;AAAA,EAChH;AAAA,EAEA,MAAa,QAAuB;AAClC,SAAK,SAAS;AACd,eAAW,CAAC,EAAE,CAAC,KAAK,KAAK,YAAa,eAAc,CAAC;AACrD,SAAK,YAAY,MAAM;AACvB,eAAW,OAAO,KAAK,SAAS,OAAO,EAAG,KAAI,MAAM;AACpD,SAAK,SAAS,MAAM;AAAA,EACtB;AAAA;AAAA,EAIA,MAAa,cAAuC;AAClD,UAAM,UAA0B;AAAA,MAC9B,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,IAAI,CAAC,QAAsB,EAAE,IAAI,UAAU,CAAC,GAAG,WAAW,OAAO,KAAK,WAAW,KAAK,YAAY,MAAM,EAAE;AAAA,MAC9H,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,QAAsB,EAAE,IAAI,UAAU,CAAC,GAAG,WAAW,KAAK,EAAE;AAAA,IAC9H;AACA,UAAM,UAAU,KAAK,OAAO,QAAQ,KAAK,cAAc,CAAC,KAAK;AAC7D,WAAO,EAAE,SAAS,UAAU,UAAU,KAAK,WAAW,QAAW,MAAM,KAAK,KAAK;AAAA,EACnF;AAAA;AAAA,EAGQ,kBAAwB;AAC9B,SAAK,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,OAAO,OAAO,CAAC,IAAI,CAAC;AAAA,EACpE;AAAA,EAEQ,eAAe,MAA8C;AACnE,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,WAAW;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAa,SAAS,GAAgC;AACpD,SAAK,SAAS,OAAO,EAAE,EAAE;AACzB,SAAK,OAAO,IAAI,EAAE,EAAE;AACpB,SAAK,gBAAgB;AACrB,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,YAAY,IAA2B;AAClD,QAAI,CAAC,KAAK,OAAO,IAAI,EAAE,EAAG;AAC1B,QAAI,KAAK,OAAO,QAAQ,GAAG;AACzB,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,8CAA8C,EAAE,KAAK,WAAW,MAAM,CAAC;AAAA,IAClI;AACA,SAAK,OAAO,OAAO,EAAE;AACrB,SAAK,gBAAgB;AACrB,SAAK,QAAQ;AACb,SAAK,YAAY,aAAa;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,WAAW,GAAgC;AACtD,QAAI,KAAK,OAAO,IAAI,EAAE,EAAE,EAAG;AAC3B,SAAK,SAAS,IAAI,EAAE,EAAE;AAAA,EACxB;AAAA,EAEA,MAAa,cAAc,IAA2B;AACpD,SAAK,SAAS,OAAO,EAAE;AAAA,EACzB;AAAA,EAEA,MAAa,eAAe,IAA2B;AACrD,SAAK,SAAS,OAAO,EAAE;AACvB,SAAK,OAAO,IAAI,EAAE;AAClB,QAAI,OAAO,KAAK,SAAU,MAAK,YAAY;AAC3C,SAAK,gBAAgB;AACrB,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA,EAIQ,YAAY,MAAoB;AACtC,UAAM,QAAQ,KAAK,OAAO,IAAI,IAAI;AAClC,QAAI,SAAS,KAAK,IAAI,KAAK,MAAM,WAAW;AAC1C,WAAK,OAAO,OAAO,IAAI;AACvB,WAAK,gBAAgB,IAAI;AAAA,IAC3B;AAAA,EACF;AAAA,EAEQ,gBAAgB,MAAoB;AAC1C,UAAM,IAAI,KAAK,YAAY,IAAI,IAAI;AACnC,QAAI,GAAG;AACL,oBAAc,CAAC;AACf,WAAK,YAAY,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;;;ACphCA,IAAMC,cAA6C;AAAA,EACjD,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS;AACX;AAEA,IAAM,kBAAkB,oBAAI,IAAI,CAAC,aAAa,UAAU,WAAW,CAAC;AAU7D,SAAS,mBACd,WACA,WAC8B;AAC9B,QAAM,YAAY,UAAU,KAAK,aAAa,CAAC;AAC/C,QAAM,eAAe,UAAU,gBAAgB;AAC/C,QAAM,aAAsC,CAAC;AAE7C,aAAW,YAAY,WAAW;AAChC,UAAM,SAAS,SAAS,KAAK;AAC7B,QAAI,CAAC,UAAU,SAAS,QAAQ,YAAY,MAAO;AACnD,QAAI,UAAU,gBAAgB,UAAU,iBAAiB,OAAQ;AACjE,QACE,UAAU,gBAAgB,CAAC,OAAO,QAAQ,UAAU,YAAY,EAAE;AAAA,MAChE,CAAC,CAAC,KAAK,KAAK,MAAM,SAAS,KAAK,YAAY,GAAG,MAAM;AAAA,IACvD,EACA;AACF,UAAM,QAAQ,SAAS,KAAK,SAAS;AACrC,QAAIA,YAAW,KAAK,IAAIA,YAAW,YAAY,EAAG;AAElD,UAAM,aAAa,SAAS,KAAK,aAAa;AAAA,MAAK,CAAC,cAClD,UAAU,aAAa,SAAS,UAAU,KAAK,QAAQ,SACtD,UAAU,WAAW,CAAC,SAAS,GAAG,SAAS,UAAU,KAAK,MAAM,MAChE,CAAC,UAAU,KAAK,QAAQ,gBACvB,UAAU,iBAAiB,UAAU,KAAK,QAAQ,iBACpD,UAAU,QAAQ,YAAY;AAAA,IAChC;AACA,QAAI,CAAC,WAAY;AAEjB,UAAM,UAAU,WAAW,UAAU,iBAAiB;AACtD,UAAM,SAAS,WAAW,UAAU,cAAc;AAClD,UAAM,QAAQ,UAAU;AACxB,QAAI,SAAS,EAAG;AAChB,QAAI,QAAQ,QAAQ,MAAMA,YAAW,KAAK,IAAI;AAC9C,UAAM,UAAU,CAAC,UAAU,WAAW,YAAY,IAAI,kBAAkB,KAAK,EAAE;AAC/E,QAAI,UAAU,kBAAkB,QAAQ;AACtC,eAAS;AACT,cAAQ,KAAK,gBAAgB;AAAA,IAC/B;AACA,eAAW,KAAK,EAAE,UAAU,QAAQ,OAAO,QAAQ,CAAC;AAAA,EACtD;AAEA,aAAW;AAAA,IAAK,CAAC,MAAM,UACrB,MAAM,QAAQ,KAAK,UAClB,KAAK,SAAS,SAAS,QAAQ,IAAI,cAAc,MAAM,SAAS,SAAS,QAAQ,EAAE;AAAA,EACtF;AACA,SAAO,WAAW,CAAC,KAAK;AAC1B;AAQA,SAASC,wBACP,QACA,iBACA,QACA,KACqB;AACrB,QAAM,cAAc,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,cAAc,UAAU,SAAS,WAAW;AACjG,aAAW,KAAK;AAAA,IACd,MAAM;AAAA,IACN,QAAQ;AAAA,IACR;AAAA,IACA,oBAAoB,IAAI,YAAY;AAAA,EACtC,CAAC;AACD,SAAO,EAAE,GAAG,QAAQ,WAAW;AACjC;AAMO,SAAS,qCACd,SAC2C;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAA6C;AAC3D,YAAM,YAAY,QAAQ;AAC1B,YAAM,SAAS,UAAU,UAAU,CAAC;AACpC,UACE,UAAU,KAAK,WAAW,gBAC1B,gBAAgB,IAAI,OAAO,SAAS,EAAE,KACtC,OAAO,UAAU,aACjB,OAAO,kBACP;AACA,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AAEA,YAAM,WAAW,mBAAmB,WAAW,MAAM,QAAQ,cAAc,CAAC;AAC5E,UAAI,CAAC,UAAU;AACb,eAAO;AAAA,UACL,QAAQA;AAAA,YACN,EAAE,GAAG,QAAQ,OAAO,UAAU;AAAA,YAC9B;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AAAA,UACA,OAAO;AAAA,UACP,gBAAgB,QAAQ,gBAAgB;AAAA,QAC1C;AAAA,MACF;AAEA,YAAM,WAAW,SAAS;AAC1B,aAAO;AAAA,QACL,QAAQA;AAAA,UACN;AAAA,YACE,GAAG;AAAA,YACH,OAAO;AAAA,YACP,cAAc,SAAS;AAAA,YACvB,gBAAgB,SAAS,SAAS;AAAA,YAClC,kBAAkB;AAAA,cAChB,YAAY;AAAA,cACZ,MAAM;AAAA,cACN,MAAM,SAAS,SAAS;AAAA,cACxB,WAAW,SAAS,SAAS;AAAA,cAC7B,KAAK,SAAS,SAAS;AAAA,YACzB;AAAA,UACF;AAAA,UACA;AAAA,UACA,WAAW,SAAS,SAAS,IAAI;AAAA,UACjC,QAAQ;AAAA,QACV;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAQA,SAAS,oBACP,QACA,KACA,UAAU,0GACW;AACrB,QAAM,SAAS;AACf,QAAM,cAAc,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,cAAc,UAAU,SAAS,eAAe;AACrG,aAAW,KAAK;AAAA,IACd,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,oBAAoB,IAAI,YAAY;AAAA,EACtC,CAAC;AACD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO;AAAA,IACP,aAAa,IAAI,YAAY;AAAA,IAC7B,QAAQ;AAAA,MACN,OAAO;AAAA,QACL,MAAM;AAAA,QACN;AAAA,QACA,WAAW;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF;AAWA,SAAS,aAAa,WAA4D;AAChF,SAAO,UAAU,SAAS,OACxB,GAAG,UAAU,SAAS,aAAa,SAAS,IAAI,UAAU,SAAS,QAAQ,EAAE;AACjF;AAOO,SAAS,uCACd,SACkC;AAClC,QAAM,SAAS,oBAAI,IAGhB;AAEH,QAAM,aAA+C;AAAA,IACnD,OAAO,WAAW;AAChB,YAAM,UAAU,OAAO,IAAI,aAAa,SAAS,CAAC;AAClD,UAAI,CAAC,QAAS,QAAO;AACrB,cAAQ,SAAS;AACjB,cAAQ,WAAW,MAAM;AACzB,aAAO;AAAA,IACT;AAAA,IACA,YAAY;AACV,YAAM,QAAQ,OAAO;AACrB,iBAAW,WAAW,OAAO,OAAO,GAAG;AACrC,gBAAQ,SAAS;AACjB,gBAAQ,WAAW,MAAM;AAAA,MAC3B;AACA,aAAO;AAAA,IACT;AAAA,IACA,aAAa,MAAM,OAAO;AAAA,IAC1B,MAAM,UAAU,SAA6C;AAC3D,YAAM,YAAY,QAAQ;AAC1B,YAAM,SAAS,UAAU,UAAU,CAAC;AACpC,UACE,UAAU,KAAK,WAAW,gBAC1B,gBAAgB,IAAI,OAAO,SAAS,EAAE,KACtC,OAAO,iBAAiB,QAAQ,QAChC;AACA,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AAEA,WAAK,OAAO,SAAS,eAAe,WAAW;AAC7C,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,WAAW,OAAO,aAAa,QAAQ,IAAI,YAAY;AAAA,YACvD,gBAAgB;AAAA,cACd,YAAY,QAAQ;AAAA,cACpB,WAAW,QAAQ,IAAI,YAAY;AAAA,YACrC;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,UAAI,OAAO,UAAU,aAAa,CAAC,OAAO,eAAgB,QAAO,EAAE,OAAO,KAAK;AAC/E,UAAI,OAAO,eAAe,eAAe,QAAQ,YAAY;AAC3D,YAAI,UAAU,KAAK,WAAW,QAAQ;AACpC,iBAAO;AAAA,YACL,QAAQ;AAAA,cACN,GAAG;AAAA,cACH,OAAO;AAAA,cACP,gBAAgB;AAAA,YAClB;AAAA,YACA,OAAO;AAAA,UACT;AAAA,QACF;AACA,eAAO,EAAE,QAAQ,oBAAoB,QAAQ,QAAQ,GAAG,GAAG,OAAO,KAAK;AAAA,MACzE;AAEA,YAAM,MAAM,aAAa,SAAS;AAClC,YAAM,kBAAkB,IAAI,gBAAgB;AAC5C,YAAM,kBAGF,EAAE,YAAY,iBAAiB,QAAQ,YAAY;AACvD,aAAO,IAAI,KAAK,eAAe;AAC/B,YAAM,YAAY,UAAU,KAAK;AACjC,YAAM,UAAU,cAAc,UAAa,YAAY,IACnD,WAAW,MAAM;AACjB,wBAAgB,SAAS;AACzB,wBAAgB,MAAM;AAAA,MACxB,GAAG,SAAS,IACV;AACJ,YAAM,YAAY,QAAQ,OAAO,QAAQ,WAAW;AAAA,QAClD,QAAQ,gBAAgB;AAAA,QACxB,OAAO,QAAQ;AAAA,QACf,YAAY,QAAQ;AAAA,MACtB,CAAC,EAAE;AAAA,QACD,CAAC,cAAc,EAAE,MAAM,YAAqB,SAAS;AAAA,QACrD,CAACC,YAAoB,EAAE,MAAM,SAAkB,OAAAA,OAAM;AAAA,MACvD;AACA,YAAM,UAAU,IAAI,QAA6B,CAAC,YAAY;AAC5D,wBAAgB,OAAO;AAAA,UACrB;AAAA,UACA,MAAM;AACJ,oBAAQ,EAAE,MAAM,UAAU,CAAC;AAAA,UAC7B;AAAA,UACA,EAAE,MAAM,KAAK;AAAA,QACf;AAAA,MACF,CAAC;AACD,YAAM,UAAU,MAAM,QAAQ,KAAK,CAAC,WAAW,OAAO,CAAC;AACvD,UAAI,YAAY,OAAW,cAAa,OAAO;AAC/C,aAAO,OAAO,GAAG;AAEjB,UAAI,QAAQ,SAAS,WAAW;AAI9B,aAAK,UAAU,KAAK,MAAM,MAAS;AACnC,YAAI,UAAU,KAAK,WAAW,QAAQ;AACpC,iBAAO;AAAA,YACL,QAAQ;AAAA,cACN;AAAA,cACA,QAAQ;AAAA,cACR,kBAAkB,gBAAgB,MAAM;AAAA,YAC1C;AAAA,YACA,OAAO;AAAA,UACT;AAAA,QACF;AACA,cAAM,WAAW,gBAAgB,WAAW;AAC5C,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO,WAAW,WAAW;AAAA,YAC7B,aAAa,QAAQ,IAAI,YAAY;AAAA,YACrC,QAAQ;AAAA,cACN,OAAO;AAAA,gBACL,MAAM,WAAW,YAAY;AAAA,gBAC7B,SAAS,WAAW,4BAA4B;AAAA,gBAChD,WAAW;AAAA,cACb;AAAA,YACF;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,UAAI,QAAQ,SAAS,YAAY;AAC/B,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG,QAAQ,SAAS;AAAA,YACpB,gBAAgB,OAAO;AAAA,YACvB,cAAc,OAAO;AAAA,YACrB,kBAAkB,OAAO;AAAA,YACzB,gBAAgB,OAAO;AAAA,UACzB;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,aAAa,QAAQ,IAAI,YAAY;AAAA,UACrC,QAAQ;AAAA,YACN,OAAO,cAAc,yBAAyB,QAAQ,KAAK,CAAC;AAAA,UAC9D;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;;;AC/VO,SAAS,mCACd,SAC8C;AAC9C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,QAAQ,QAAQ;AACtB,YAAM,SAAS,MAAM,UAAU,CAAC;AAChC,UAAI,OAAO,SAAS,OAAO,UAAU,UAAW,QAAO,EAAE,OAAO,KAAK;AACrE,YAAM,eAAe,MAAM,QAAQ,gBAAgB,KAAK;AACxD,YAAM,eAAe,IAAI,EAAE,YAAY;AACvC,UAAI,CAAC,cAAc;AACjB,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,YAAY,CAAC;AAAA,cACX,MAAM;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,SAAS;AAAA,cACT,oBAAoB;AAAA,YACtB,CAAC;AAAA,UACH;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,YAAM,eAAe,MAAM,QAAQ,uBAAuB,KAAK;AAC/D,YAAM,cAAc,MAAM,QAAQ,YAAY,GAAG,QAAQ,CAAC,aAAa;AACrE,YACE,CAAC,SAAS,WACV,SAAS,UAAU,aAClB,gBAAgB,SAAS,WAAW,aACrC,QAAO,CAAC;AACV,YACE,SAAS,eAAe,WACvB,SAAS,iBAAiB,MAAM,SAAS,WAC1C,QAAO,CAAC;AACV,YACE,SAAS,mBAAmB,WAC3B,MAAM,KAAK,aAAa,KAAK,SAAS,eACvC,QAAO,CAAC;AACV,YACE,MAAM,KAAK,YACX,OAAO,QAAQ,MAAM,KAAK,QAAQ,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,SAAS,SAAS,GAAG,MAAM,KAAK,EAC3F,QAAO,CAAC;AACV,cAAM,aAAa,SAAS,aAAa,KAAK,CAAC,SAAS,4BAA4B,MAAM,OAAO,YAAY,CAAC;AAC9G,eAAO,aAAa,CAAC,EAAE,UAAU,WAAW,CAAC,IAAI,CAAC;AAAA,MACpD,CAAC,EAAE;AAAA,QAAK,CAAC,MAAM,WACZ,KAAK,SAAS,iBAAiB,MAAM,MAAM,SAAS,iBAAiB,MACtE,KAAK,SAAS,OAAO,cAAc,MAAM,SAAS,MAAM;AAAA,MAC1D;AACA,YAAM,WAAW,WAAW,CAAC;AAC7B,UAAI,CAAC,UAAU;AACb,cAAM,EAAE,cAAc,OAAO,gBAAgB,SAAS,SAAS,UAAU,GAAG,QAAQ,IAAI;AACxF,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,YAAY,CAAC;AAAA,cACX,MAAM;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,SAAS,6CAA6C,aAAa,SAAS,IAAI;AAAA,cAChF,oBAAoB;AAAA,YACtB,CAAC;AAAA,UACH;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UACE,OAAO,iBAAiB,SAAS,SAAS,UAC1C,OAAO,mBAAmB,SAAS,WAAW,QAC9C,OAAO,SAAS,eAAe,QAAQ,cACvC,OAAO,QAAQ,gCAAgC,aAAa,SAAS,gBACrE,QAAO,EAAE,OAAO,KAAK;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,cAAc,SAAS,SAAS;AAAA,UAChC,gBAAgB,SAAS,WAAW;AAAA,UACpC,SAAS;AAAA,YACP,YAAY,QAAQ;AAAA,YACpB,6BAA6B,aAAa,SAAS;AAAA,YACnD,SAAS;AAAA,UACX;AAAA,UACA,YAAY,CAAC;AAAA,YACX,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,SAAS,aAAa,SAAS,WAAW,IAAI,SAAS,SAAS,SAAS,MAAM;AAAA,YAC/E,oBAAoB;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAwBO,SAAS,qCACd,SAC8C;AAC9C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,QAAQ,QAAQ;AACtB,YAAM,SAAS,MAAM,UAAU,CAAC;AAChC,UAAI,OAAO,iBAAiB,QAAQ,UAAU,CAAC,OAAO,kBAAkB,CAAC,OAAO,SAAS;AACvF,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,UAAI,OAAO,UAAU,WAAW,OAAO,UAAU,UAAU,OAAO,UAAU,UAAU;AACpF,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,YAAM,eAAe,MAAM,QAAQ,gBAAgB,KAAK;AACxD,UACE,CAAC,gBACD,aAAa,SAAS,oBAAoB,OAAO,QAAQ,6BACzD;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,SAAS,MAAM,QAAQ,UAAU,OAAO,cAAc;AAC5D,UAAI,CAAC,UAAU,EAAE,MAAM,OAAO,UAAU,GAAG,SAAS;AAClD,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,yBAAyB,OAAO,cAAc;AAAA,cACvD,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,OAAO,UAAU,gBAAgB;AACnC,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,gBAAgB;AAAA,cACd,YAAY,QAAQ;AAAA,cACpB,WAAW,IAAI,EAAE,YAAY;AAAA,YAC/B;AAAA,UACF;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UAAI,OAAO,gBAAgB,eAAe,QAAQ,YAAY;AAC5D,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,aAAa,MAAM,OAAO,gBAAgB;AAChD,UAAI,CAAC,4BAA4B,YAAY,OAAO,YAAY,GAAG;AACjE,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,gBAAgB,QAAQ,UAC1B,MAAM,QAAQ,QAAQ,UAAU,OAAO,cAAc,IACrD;AACJ,YAAM,gBAAgB,iBAAiB,QAAQ,UAC3C,MAAM,cAAc;AAAA,QACpB,MAAM,QAAQ,QAAQ,uBAAuB;AAAA,UAC3C;AAAA,UACA;AAAA,UACA,OAAO,QAAQ;AAAA,UACf,YAAY,QAAQ;AAAA,QACtB,CAAC;AAAA,MACH,IACE;AACJ,YAAM,cAAc,gBAChB;AAAA,QACA,cAAc,cAAc;AAAA,QAC5B,eAAe,cAAc;AAAA,QAC7B,UAAU,EAAE,QAAQ,QAAQ,OAAO;AAAA,MACrC,IACE,MAAM,OAAO,UAAU,EAAE,OAAO,aAAa,CAAC;AAClD,YAAM,SAAS,MAAM,QAAQ,aAAa,OAAO,cAAc,WAAW;AAC1E,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,WAAW;AAAA,YACT,YAAY,OAAO;AAAA,YACnB,MAAM,OAAO;AAAA,YACb,MAAM,OAAO,SAAS;AAAA,YACtB,KAAK,OAAO,SAAS;AAAA,UACvB;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;ACtMA,IAAM,sBAAsB,oBAAI,IAAI,CAAC,aAAa,UAAU,WAAW,CAAC;AACxE,IAAI,4BAA4B;AAEzB,SAAS,kCACd,OACA,QACA,SACmC;AACnC,QAAM,QAAQ,QAAQ,UAAU,CAAC,OAAe,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAChG,QAAM,sBAAsB,QAAQ,uBAAuB;AAC3D,QAAM,wBAAwB,QAAQ,yBAAyB;AAC/D,QAAM,6BAA6B,QAAQ,8BAA8B;AACzE,QAAM,yBAAyB,QAAQ,0BAA0B;AACjE,QAAM,2BAA2B,QAAQ,4BAA4B;AACrE,QAAM,8BAA8B,QAAQ,+BAA+B;AAC3E,QAAM,UAAU,QAAQ,YAAY,MAAY;AAAA,EAAC;AACjD,+BAA6B;AAC7B,QAAM,uBAAuB,QAAQ,wBACnC,GAAG,QAAQ,MAAM,IAAI,KAAK,IAAI,CAAC,IAAI,yBAAyB;AAC9D,MAAI,CAAC,sBAAsB;AACzB,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,QAAM,SAAS,oBAAI,IAAyC;AAC5D,MAAI,UAAU;AAEd,iBAAe,sBACb,WACA,OACe;AACf,aAAS,UAAU,GAAG,UAAU,qBAAqB,WAAW,GAAG;AACjE,YAAM,UAAU,MAAM,MAAM,IAAsC,SAAS;AAC3E,UAAI,CAAC,QAAS;AACd,UAAI;AACF,cAAM,MAAM,aAAa,QAAQ,OAAO,WAAW,MAAM,QAAQ,MAAM,GAAG;AAAA,UACxE,iBAAiB,QAAQ,SAAS;AAAA,QACpC,CAAC;AACD;AAAA,MACF,SAASC,QAAO;AACd,YAAIA,kBAAiB,sBAAsBA,OAAM,SAAS,WAAY;AACtE,cAAMA;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,sBAAsB,UAAU,QAAQ,EAAE,cAAc,mBAAmB;AAAA,MACpF,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,kBAAkB,UAAiE;AAC1F,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,SAAS,SAAS;AAAA,MACxB,WAAW,SAAS,SAAS;AAAA,IAC/B;AAAA,EACF;AAEA,WAAS,0BACP,UACA,KACM;AACN,UAAM,YAAY,IAAI,KAAK;AAC3B,UAAM,oBAAoB,SAAS,SAAS,aAAa;AACzD,UAAM,qBAAqB,UAAU,aAAa,IAAI,SAAS,aAAa;AAC5E,QACE,UAAU,eAAe,8BACzB,UAAU,SAAS,uBACnB,UAAU,SAAS,SAAS,SAAS,QACrC,uBAAuB,qBACvB,UAAU,QAAQ,SAAS,SAAS,OACpC,IAAI,KAAK,oBAAoB,UAC7B,IAAI,KAAK,UAAU,UACnB,IAAI,KAAK,cAAc,QACvB;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,0BAA0B,IAAI,SAAS,IAAI,uDAAuD,SAAS,SAAS,IAAI;AAAA,QACjI,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,iBAAe,sBACb,WACkC;AAClC,aAAS,UAAU,GAAG,UAAU,qBAAqB,WAAW,GAAG;AACjE,YAAM,UAAU,MAAM,MAAM,IAG1B,SAAS;AACX,UAAI,CAAC,QAAS,QAAO;AAGrB,UAAI,QAAQ,QAAQ,sBAAuB,QAAO;AAClD,UAAI;AACF,eAAO,MAAM,MAAM;AAAA,UAIjB,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,YACE,GAAG,QAAQ;AAAA,YACX,OAAO;AAAA,YACP,uBAAuB;AAAA,cACrB;AAAA,cACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,YACpC;AAAA,UACF;AAAA,UACA,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,QACtD;AAAA,MACF,SAASA,QAAO;AACd,YAAIA,kBAAiB,sBAAsBA,OAAM,SAAS,YAAY;AACpE;AAAA,QACF;AACA,cAAMA;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,gCAAgC,UAAU,QAAQ,EAAE,cAAc,mBAAmB;AAAA,MAC9F,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,iBAAe,oBACb,UACA,cACsE;AACtE,UAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,eAAS;AACP,UAAI,SAAS;AACX,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,UAAU,MAAM,MAAM;AAAA,QAC1B;AAAA,MACF;AACA,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,aAAa,aAAa,QAAQ,EAAE;AAAA,UAC7C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,CAAC,SAAS,KAAK,aAAa,WAAY,QAAO,EAAE,KAAK,QAAQ;AAClE,YAAM,UAAU,QAAQ,QAAQ;AAChC,UAAI,SAAS;AACX,cAAM,WAAW,MAAM,MAAM,IAAoE;AAAA,UAC/F,YAAY,QAAQ,cAAc;AAAA,UAClC,MAAM,QAAQ,QAAQ;AAAA,UACtB,MAAM,QAAQ;AAAA,UACd,WAAW,QAAQ;AAAA,QACrB,CAAC;AACD,YACE,YACA,SAAS,SAAS,QAAQ,QAAQ,OAClC,SAAS,QAAQ,YAAY,QAC7B,OAAO,SAAS,KAAK,MAAM,SAAS,OAAO,aAAa,EAAE,CAAC,KAC3D,KAAK,IAAI,IAAI,KAAK,MAAM,SAAS,OAAO,aAAa,EAAE,KAAK,+BAC5D,SAAS,KAAK,cAAc,SAAS,SAAS,KAAK,YAAY,YAC/D;AACA,iBAAO,EAAE,KAAK,SAAS,SAAS;AAAA,QAClC;AAAA,MACF;AACA,UAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,aAAa,QAAQ,SAAS,IAAI,4DAA4D,qBAAqB;AAAA,UAC5H,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,MAAM,wBAAwB;AAAA,IACtC;AAAA,EACF;AAEA,iBAAe,wBACb,UACA,cACA,QACgD;AAChD,UAAM,mBAAmB,SAAS,KAAK,eAAe;AACtD,QAAI,CAAC,iBAAkB,QAAO;AAC9B,UAAM,iBAAiB,GAAG,aAAa,QAAQ,SAAS,SAAS,IAAI;AACrE,UAAM,YAA4C;AAAA,MAChD,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,WAAW,SAAS,SAAS;AAAA,IAC/B;AACA,QAAI,aAAa,MAAM,MAAM,IAG3B,SAAS;AACX,QAAI,CAAC,YAAY;AACf,YAAM,WAAW,gCAAgC,gBAAgB;AAAA,QAC/D,iBAAiB;AAAA,UACf,YAAY;AAAA,UACZ,MAAM;AAAA,UACN,MAAM;AAAA,QACR;AAAA,QACA,aAAa;AAAA,UACX,YAAY,SAAS;AAAA,UACrB,MAAM,SAAS;AAAA,UACf,MAAM,SAAS,SAAS;AAAA,UACxB,KAAK,SAAS,SAAS;AAAA,QACzB;AAAA,QACA,QAAQ;AAAA,UACN,YAAY,aAAa;AAAA,UACzB,MAAM,aAAa;AAAA,UACnB,MAAM,aAAa;AAAA,UACnB,KAAK;AAAA,UACL,YAAY;AAAA,QACd;AAAA,QACA,QAAQ,QAAQ;AAAA,MAClB,CAAC;AACD,eAAS,SAAS,YAAY,SAAS,SAAS;AAChD,mBAAa,MAAM,MAAM,OAAO,QAAQ,OAAO,QAAQ;AAAA,IACzD;AACA,UAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,MACtE,GAAG;AAAA,MACH,sBAAsB;AAAA,QACpB,YAAY,WAAW;AAAA,QACvB,MAAM,WAAW;AAAA,QACjB,MAAM,WAAW,SAAS;AAAA,QAC1B,GAAI,WAAW,SAAS,YAAY,EAAE,WAAW,WAAW,SAAS,UAAU,IAAI,CAAC;AAAA,QACpF,KAAK,WAAW,SAAS;AAAA,MAC3B;AAAA,IACF,EAAE;AAEF,UAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,eAAS;AACP,UAAI,SAAS;AACX,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,UAAU,MAAM,MAAM,IAG1B,SAAS;AACX,UAAI,CAAC,WAAW,QAAQ,SAAS,QAAQ,WAAW,SAAS,KAAK;AAChE,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,sBAAsB,cAAc;AAAA,UAC7C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,QAAQ,UAAU,UAAU;AACtC,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM,QAAQ,OAAO,OAAO,QAAQ;AAAA,UACpC,SAAS,QAAQ,OAAO,OAAO,WAAW,sBAAsB,cAAc;AAAA,UAC9E,WAAW,QAAQ,OAAO,OAAO,aAAa;AAAA,QAChD,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,QAAQ,UAAU,cAAc,QAAQ,OAAO,QAAQ;AACjE,cAAM,eAAe,MAAM,MAAM,IAG/B,QAAQ,KAAK,eAAe;AAC9B,YACE,gBACA,QAAQ,OAAO,SAAS,gCAAgC,aAAa,SAAS,mBAC9E,QAAQ,OAAO,iBAAiB,QAAQ,UACxC,QAAQ,OAAO,mBAAmB,aAAa,KAAK,QACpD;AACA,iBAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,sBAAsB,cAAc,0BAA0B,0BAA0B;AAAA,UACjG,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,MAAM,wBAAwB;AAAA,IACtC;AAAA,EACF;AAEA,iBAAe,sBACb,UACA,cAIC;AACD,UAAM,WAAW,SAAS,KAAK,eAAe,WAAW,CAAC;AAC1D,QAAI,SAAS,WAAW,GAAG;AACzB,YAAM,MAAM,MAAM,MAAM;AAAA,QACtB;AAAA,MACF;AACA,aAAO,EAAE,IAAI;AAAA,IACf;AACA,UAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,eAAS;AACP,UAAI,SAAS;AACX,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,MAAM,MAAM,MAAM;AAAA,QACtB;AAAA,MACF;AACA,UAAI,CAAC,KAAK;AACR,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,aAAa,aAAa,QAAQ,EAAE;AAAA,UAC7C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,IAAI,QAAQ,gBAAgB,UAAU;AACxC,cAAM,IAAI;AAAA,UACR,IAAI,OAAO,eAAe;AAAA,YACxB,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb;AAAA,QACF;AAAA,MACF;AACA,YAAM,eAAe,IAAI,IAAI,IAAI,QAAQ,gBAAgB,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;AACjF,UACE,IAAI,QAAQ,gBAAgB,WAC5B,SAAS,MAAM,CAAC,SAAS,aAAa,IAAI,KAAK,IAAI,CAAC,GACpD;AACA,YAAI,CAAC,QAAQ,qBAAqB;AAChC,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,oBAAoB,UAAU,GAAG,EAAE;AAAA,MACzE;AACA,UAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,aAAa,IAAI,SAAS,IAAI,mCAAmC,sBAAsB;AAAA,UAChG,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,MAAM,wBAAwB;AAAA,IACtC;AAAA,EACF;AAEA,iBAAe,yBACb,cACe;AACf,UAAM,MAAM,MAAM,MAAM;AAAA,MACtB;AAAA,IACF;AACA,QAAI,CAAC,IAAK;AACV,UAAM,eAAc,oBAAI,KAAK,GAAE,YAAY;AAC3C,UAAM,aAAa,IAAI,QAAQ;AAC/B,QAAI,YAAY;AACd,YAAM;AAAA,QACJ;AAAA,UACE,YAAY,WAAW;AAAA,UACvB,MAAM,WAAW;AAAA,UACjB,MAAM,WAAW;AAAA,UACjB,WAAW,WAAW;AAAA,QACxB;AAAA,QACA,CAAC,aAAa;AAAA,UACZ,GAAG;AAAA,UACH,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AACA,QACE,IAAI,QAAQ,gBAAgB,WAC5B,IAAI,QAAQ,gBAAgB,cAC5B;AACA,YAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,QACtE,GAAG;AAAA,QACH,0BAA0B;AAAA,MAC5B,EAAE;AAAA,IACJ;AAAA,EACF;AAEA,iBAAe,QAAQ,UAAgD;AACrE,UAAM,qBAAqB,kBAAkB,QAAQ;AACrD,UAAM,UAAU,GAAG,SAAS,SAAS,IAAI;AACzC,UAAM,eAA+C;AAAA,MACnD,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,WAAW,SAAS,SAAS;AAAA,IAC/B;AACA,QAAI,iBAAiB;AAErB,QAAI;AAEF,UAAI;AACJ,UAAI,SAAS,KAAK,iBAAiB;AACjC,uBAAe,MAAM,QAAQ,sBAAsB,SAAS,KAAK,eAAe;AAChF,YAAI,CAAC,cAAc;AACjB,gBAAM,sBAA2C,oBAAoB,CAAC,aAAa;AAAA,YACjF,GAAG;AAAA,YACH,OAAO;AAAA,YACP,eAAe,oBAAoB,SAAS,KAAK,eAAe;AAAA,UAClE,EAAE;AACF;AAAA,QACF;AAAA,MACF;AAGA,UAAI,MAAM,MAAM,MAAM,IAA0D,YAAY;AAC5F,UAAI,CAAC,KAAK;AACR,cAAM,WAAW,uBAAuB,SAAS;AAAA,UAC/C,aAAa;AAAA,YACX,YAAY;AAAA,YACZ,MAAM;AAAA,YACN,MAAM,SAAS,SAAS;AAAA,YACxB,WAAW,SAAS,SAAS;AAAA,YAC7B,KAAK,SAAS,SAAS;AAAA,UACzB;AAAA,QACF,CAAC;AACD,iBAAS,SAAS,YAAY,SAAS,SAAS;AAChD,YAAI;AACF,gBAAM,MAAM,MAAM;AAAA,YAChB,QAAQ;AAAA,YACR;AAAA,UACF;AAAA,QACF,SAASA,QAAO;AACd,cAAI,EAAEA,kBAAiB,uBAAuBA,OAAM,SAAS,YAAY;AACvE,kBAAMA;AAAA,UACR;AAEA,gBAAM,MAAM,MAAM,IAGhB,YAAY;AACd,cAAI,CAAC,IAAK,OAAMA;AAAA,QAClB;AAAA,MACF;AACA,gCAA0B,UAAU,GAAG;AACvC,UAAI,IAAI,QAAQ,SAAS,oBAAoB,IAAI,IAAI,OAAO,KAAK,GAAG;AAElE,cAAM,iBAAiB,IAAI;AAC3B,cAAM,sBAA2C,oBAAoB,CAAC,aAAa;AAAA,UACjF,GAAG;AAAA,UACH,OAAO,eAAe,UAAU,cAAc,cAAc;AAAA,UAC5D,eAAe,eAAe;AAAA,QAChC,EAAE;AACF;AAAA,MACF;AAEA,YAAM,CAAC,cAAc,mBAAmB,kBAAkB,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC9E,oBAAoB,UAAU,YAAY;AAAA,QAC1C,wBAAwB,UAAU,cAAc,IAAI,SAAS,GAAG;AAAA,QAChE,sBAAsB,UAAU,YAAY;AAAA,MAC9C,CAAC;AACD,YAAM,mBAAmB;AAEzB,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,MACF,KAAyB;AAEzB,YAAM,sBAA2C,oBAAoB,CAAC,aAAa;AAAA,QACjF,GAAG;AAAA,QACH,OAAO;AAAA,QACP,MAAM,CAAC,YAAY;AAAA,MACrB,EAAE;AACF,YAAM,aAAa,MAAM,sBAAsB,YAAY;AAC3D,UAAI,CAAC,WAAY;AACjB,uBAAiB;AACjB,YAAM;AACN,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,QACA,GAAI,aAAa,WAAW,EAAE,eAAe,aAAa,SAAS,IAAI,CAAC;AAAA,QACxE,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;AAAA,QACjD,GAAI,mBAAmB,SAAS,EAAE,cAAc,mBAAmB,OAAO,IAAI,CAAC;AAAA,QAC/E;AAAA,QACA,SAAS,QAAQ,qBAAqB,QAAQ,KAAK,SAAS,SAAS;AAAA,MACvE,CAAC;AACD,aAAO,IAAI,SAAS,SAAS,KAAK,MAAM;AACxC,YAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,QACtE,GAAG;AAAA,QACH,OAAO;AAAA,MACT,EAAE;AACF,YAAM,UAAU,MAAM,OAAO,KAAK;AAElC,YAAM,yBAAyB,YAAY;AAE3C,YAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,QACtE,GAAG;AAAA,QACH,OAAO,QAAQ;AAAA,QACf,SAAS,QAAQ,WAAW,QAAQ,OAAO;AAAA,QAC3C,UAAU,QAAQ,UAAU,cAAc,IAAI;AAAA,MAChD,EAAE;AACF,YAAM,sBAA2C,oBAAoB,CAAC,aAAa;AAAA,QACjF,GAAG;AAAA,QACH,OAAO,QAAQ,UAAU,cAAc,cAAc;AAAA,QACrD,eAAe,QAAQ,WAAW,QAAQ,OAAO;AAAA,MACnD,EAAE;AAAA,IACJ,SAASA,QAAO;AACd,YAAM,yBAAyB,YAAY,EAAE,MAAM,OAAO;AAC1D,YAAM,QAAQA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AACnE,YAAM,UAAU,iBACZ,uHAAuH,KAAK,KAC5H;AACJ,YAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,QACtE,GAAG;AAAA,QACH,GAAI,SAAS,SAAS,oBAAoB,IAAI,QAAQ,KAAK,IACvD,CAAC,IACD;AAAA,UACA,OAAO;AAAA,UACP,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,MACJ,EAAE,EAAE,MAAM,OAAO;AACjB,UAAI,QAAS;AACb,cAAQA,MAAK;AACb,YAAM,sBAA2C,oBAAoB,CAAC,aAAa;AAAA,QACjF,GAAG;AAAA,QACH,OAAO;AAAA,QACP,eAAe;AAAA,MACjB,EAAE,EAAE,MAAM,OAAO;AAAA,IACnB,UAAE;AACA,aAAO,OAAO,SAAS,SAAS,GAAG;AAAA,IACrC;AAAA,EACF;AAEA,iBAAe,eAAe,UAAgD;AAC5E,UAAM,eAA+C;AAAA,MACnD,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,GAAG,SAAS,SAAS,IAAI;AAAA,MAC/B,WAAW,SAAS,SAAS;AAAA,IAC/B;AACA,QAAI;AACF,YAAM,MAAM,MAAM,MAAM;AAAA,QACtB;AAAA,MACF;AACA,UAAI,KAAK;AACP,YAAI;AACF,oCAA0B,UAAU,GAAG;AAAA,QACzC,SAASA,QAAO;AACd,gBAAMC,WAAUD,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AACrE,gBAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,YACtE,GAAG;AAAA,YACH,OAAO;AAAA,YACP,SAASC;AAAA,YACT,UAAU;AAAA,UACZ,EAAE;AACF,gBAAM;AAAA,YACJ,kBAAkB,QAAQ;AAAA,YAC1B,CAAC,aAAa;AAAA,cACZ,GAAG;AAAA,cACH,OAAO;AAAA,cACP,eAAeA;AAAA,YACjB;AAAA,UACF;AACA,kBAAQD,MAAK;AACb;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,SAAS,IAAI,OAAO,UAAU,WAAW;AAGhE,cAAM,QAAQ,QAAQ;AACtB;AAAA,MACF;AACA,UAAI,oBAAoB,IAAI,IAAI,OAAO,KAAK,GAAG;AAC7C,cAAM,yBAAyB,YAAY;AAC3C,cAAM;AAAA,UACJ,kBAAkB,QAAQ;AAAA,UAC1B,CAAC,aAAa;AAAA,YACZ,GAAG;AAAA,YACH,OAAO,IAAI,QAAQ,UAAU,cAAc,cAAc;AAAA,YACzD,eAAe,IAAI,QAAQ;AAAA,UAC7B;AAAA,QACF;AACA;AAAA,MACF;AAEA,YAAM,UAAU,6BAA6B,IAAI,SAAS,IAAI,cAAc,IAAI,OAAO,KAAK,mBACxE,IAAI,OAAO,uBAAuB,wBAAwB,SAAS;AAEvF,YAAM,yBAAyB,YAAY;AAC3C,YAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,QACtE,GAAG;AAAA,QACH,OAAO;AAAA,QACP,SAAS;AAAA,QACT,UAAU;AAAA,MACZ,EAAE;AACF,YAAM;AAAA,QACJ,kBAAkB,QAAQ;AAAA,QAC1B,CAAC,aAAa;AAAA,UACZ,GAAG;AAAA,UACH,OAAO;AAAA,UACP,eAAe;AAAA,QACjB;AAAA,MACF;AAAA,IACF,SAASA,QAAO;AACd,cAAQA,MAAK;AAAA,IACf,UAAE;AACA,aAAO,OAAO,SAAS,SAAS,GAAG;AAAA,IACrC;AAAA,EACF;AAEA,WAAS,WAAW,UAAuC;AACzD,UAAM,WAAW;AACjB,UAAM,SAAS,SAAS;AACxB,QACE,CAAC,UACA,OAAO,UAAU,gBAAgB,OAAO,UAAU,UACnD;AACF,QAAI,OAAO,iBAAiB,QAAQ,OAAQ;AAC5C,QAAI,OAAO,IAAI,SAAS,SAAS,GAAG,EAAG;AACvC,WAAO,IAAI,SAAS,SAAS,KAAK,EAAE,QAAQ,YAAY;AAAA,IAAC,EAAE,CAAC;AAC5D,QAAI,OAAO,UAAU,WAAW;AAC9B,WAAK,eAAe,QAAQ;AAAA,IAC9B,OAAO;AACL,WAAK,QAAQ,QAAQ,EAAE,MAAM,OAAO;AAAA,IACtC;AAAA,EACF;AAEA,QAAM,YAAY;AAChB,WAAO,CAAC,SAAS;AACf,UAAI;AACF,yBACQ,SAAS,MAAM;AAAA,UACnB,EAAE,YAAY,4BAA4B,MAAM,oBAAoB;AAAA,UACpE,EAAE,mBAAmB,KAAK;AAAA,QAC5B,GACA;AACA,cAAI,QAAS;AACb,cAAI,MAAM,SAAS,WAAW,MAAM,SAAS,YAAY;AACvD,uBAAW,MAAM,QAAQ;AAAA,UAC3B,WAAW,MAAM,SAAS,WAAW;AACnC,kBAAM,WAAW,MAAM;AACvB,kBAAM,OAAO,IAAI,SAAS,SAAS,GAAG,GAAG,OAAO,EAAE,MAAM,OAAO;AAAA,UACjE;AAAA,QACF;AAAA,MACF,SAASA,QAAO;AACd,gBAAQA,MAAK;AAAA,MACf;AACA,UAAI,CAAC,QAAS,OAAM,MAAM,GAAI;AAAA,IAChC;AAAA,EACF,GAAG,EAAE,MAAM,OAAO;AAElB,SAAO;AAAA,IACL,MAAM,OAAO;AACX,gBAAU;AACV,iBAAW,UAAU,OAAO,OAAO,GAAG;AACpC,cAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACF;;;AC7tBO,IAAM,8BAA8B;AACpC,IAAM,uBAAuB;AAapC,SAAS,eAAe,KAAqB;AAC3C,SAAO,mBAAmB,GAAG;AAC/B;AAEA,eAAe,cAAc,MAAgC;AAC3D,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,IAAI;AAC7C,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO;AAC1D,SAAO,MAAM,KAAK,IAAI,WAAW,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC7F;AAEO,SAAS,sCACd,OACA,OACA,MAAkB,MAAM,oBAAI,KAAK,GACN;AAC3B,SAAO;AAAA,IACL,MAAM,eAAe,gBAAgB,KAAK,QAAQ;AAChD,YAAM,YAAY;AAAA,QAChB,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,WAAW;AAAA,QACX,MAAM,eAAe,GAAG;AAAA,MAC1B;AACA,YAAM,WAAW,MAAM,MAAM,IAAwB,SAAS;AAC9D,UAAI,SAAU;AACd,YAAM,SAAS,gBAAgB,MAAM;AACrC,YAAME,UAAS,MAAM,cAAc,MAAM;AACzC,YAAM,WAA8D;AAAA,QAClE,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,UAAU,EAAE,WAAW,gBAAgB,MAAM,eAAe,GAAG,EAAE;AAAA,QACjE,MAAM,EAAE,gBAAgB,KAAK,QAAQ,QAAQ,QAAAA,SAAQ,WAAW,IAAI,EAAE,YAAY,EAAE;AAAA,MACtF;AACA,UAAI;AACF,cAAM,MAAM,OAAO,OAAO,UAAU,EAAE,gBAAgB,mBAAmB,cAAc,IAAI,GAAG,GAAG,CAAC;AAAA,MACpG,SAASC,QAAO;AACd,YAAI,EAAEA,kBAAiB,uBAAuBA,OAAM,SAAS,WAAY,OAAMA;AAAA,MACjF;AAAA,IACF;AAAA,IAEA,MAAM,eAAkB,gBAAwB,KAAqC;AACnF,YAAM,aAAa,MAAM,MAAM,IAAwB;AAAA,QACrD,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,WAAW;AAAA,QACX,MAAM,eAAe,GAAG;AAAA,MAC1B,CAAC;AACD,UAAI,CAAC,WAAY,QAAO;AACxB,YAAM,iBAAiB,WAAW,KAAK;AACvC,YAAM,eAAe,MAAM,cAAc,WAAW,KAAK,MAAM;AAC/D,UAAI,iBAAiB,eAAgB,QAAO;AAC5C,aAAO,gBAAgB,WAAW,KAAK,MAAM;AAAA,IAC/C;AAAA,EACF;AACF;;;ACmKO,SAAS,4BAA4B,MAAiC;AAC3E,SAAO,KAAK;AACd;AAEO,SAAS,kCACd,YACA,WAC0B;AAC1B,QAAM,QAAkC,CAAC;AACzC,aAAW,OAAO,OAAO,KAAK,SAAS,GAAoD;AACzF,UAAM,QAAQ,UAAU,GAAG;AAC3B,QAAI,UAAU,UAAa,UAAU,WAAW,GAAG,GAAG;AACpD,MAAC,MAAkC,GAAG,IAAI;AAAA,IAC5C;AAAA,EACF;AACA,SAAO;AACT;;;ACpOO,IAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,SAAS,WAAW,GAAe,GAAwB;AACzD,SAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,UAAU,SAAS,EAAE,KAAK,CAAC;AAC5E;AAEA,eAAsB,sBACpB,SACA,UAAoF,CAAC,GAClD;AACnC,QAAM,iBAAiB,QAAQ,kBAAkB,eAAe,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC;AACvF,QAAM,UAAU,IAAI,IAAI,QAAQ,UAAU,0BAA0B;AACpE,QAAM,WAAwC,CAAC;AAC/C,MAAI,SAAS;AAEb,iBAAe,IAAI,MAA+B,MAA0C;AAC1F,QAAI,CAAC,QAAQ,IAAI,IAAI,EAAG;AACxB,cAAU;AACV,QAAI;AACF,YAAM,KAAK;AAAA,IACb,SAASC,QAAO;AACd,eAAS,KAAK,EAAE,OAAO,MAAM,SAASA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK,EAAE,CAAC;AAAA,IAChG;AAAA,EACF;AAEA,WAAS,OAAO,WAAoB,SAAuB;AACzD,QAAI,CAAC,UAAW,OAAM,IAAI,MAAM,OAAO;AAAA,EACzC;AAEA,QAAM,IAAI,4BAA4B,YAAY;AAChD,UAAM,QAAQ,kBAAkB,EAAE,WAAW,GAAG,cAAc,OAAO,gBAAgB,MAAM,QAAQ,SAAS,SAAS,cAAc,EAAE,CAAC;AACtI,UAAM,SAAS,kBAAkB,EAAE,WAAW,GAAG,cAAc,OAAO,gBAAgB,MAAM,aAAa,SAAS,SAAS,cAAc,EAAE,CAAC;AAC5I,UAAM,QAAQ,cAAc,KAAK;AACjC,UAAM,QAAQ,cAAc,MAAM;AAClC,UAAM,WAAW,MAAM,QAAQ,YAAY,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACnF,UAAM,MAAM,SAAS,IAAI,CAAC,YAAY,QAAQ,SAAS;AACvD,WAAO,IAAI,SAAS,MAAM,SAAS,KAAK,IAAI,SAAS,OAAO,SAAS,GAAG,+BAA+B,IAAI,KAAK,GAAG,CAAC,EAAE;AACtH,UAAM,YAAY,SAAS,KAAK,CAAC,YAAY,QAAQ,cAAc,MAAM,SAAS;AAClF,WAAO,WAAW,YAAY,SAAS,iCAAiC;AAAA,EAC1E,CAAC;AAED,QAAM,IAAI,4BAA4B,YAAY;AAChD,UAAM,UAAU,kBAAkB,EAAE,WAAW,GAAG,cAAc,QAAQ,gBAAgB,MAAM,QAAQ,SAAS,QAAQ,cAAc,EAAE,CAAC;AACxI,UAAM,QAAQ,uBAAuB,CAAC,OAAO,CAAC;AAC9C,UAAM,QAAQ,uBAAuB,CAAC,OAAO,CAAC;AAC9C,UAAM,WAAW,MAAM,QAAQ,YAAY,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACnF,UAAM,cAAc,SAAS,OAAO,CAAC,UAAU,MAAM,cAAc,QAAQ,SAAS;AACpF,WAAO,YAAY,WAAW,GAAG,kCAAkC,YAAY,MAAM,EAAE;AAAA,EACzF,CAAC;AAED,QAAM,IAAI,oCAAoC,YAAY;AACxD,UAAM,QAAQ,2BAA2B;AAAA,MACvC;AAAA,MACA,OAAO;AAAA,MACP,oBAAoB;AAAA,MACpB,sBAAsB,KAAK,IAAI;AAAA,MAC/B,cAAc;AAAA,MACd,cAAc;AAAA,MACd,aAAa;AAAA,MACb,cAAc;AAAA,MACd,iBAAiB;AAAA,IACnB,CAAC;AACD,UAAM,OAAO,MAAM,QAAQ,oBAAoB,cAAc;AAC7D,WAAO,QAAQ,MAAM,kDAAkD;AACvE,WAAO,MAAM,iBAAiB,qBAAqB,iCAAiC;AAAA,EACtF,CAAC;AAED,QAAM,IAAI,sBAAsB,YAAY;AAC1C,UAAM,gBAAgB,MAAM,QAAQ,kBAAkB;AACtD;AAAA,MACE,cAAc,KAAK,CAAC,SAAS,KAAK,mBAAmB,cAAc;AAAA,MACnE;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,IAAI,yBAAyB,YAAY;AAC7C,UAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,0BAA0B;AACjE,UAAMC,UAAS,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,KAAK;AACrE,UAAM,cAAc,UAAU,CAAC,GAAG,IAAI,WAAWA,OAAM,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AACpH,UAAM,YAAiC;AAAA,MACrC;AAAA,MACA,UAAU;AAAA,MACV,UAAU;AAAA,MACV,MAAM,MAAM;AAAA,IACd;AACA,UAAM,QAAQ,eAAe,WAAW,KAAK;AAC7C,UAAM,SAAS,MAAM,QAAQ,cAAc,UAAU,WAAW;AAChE,WAAO,UAAU,MAAM,+CAA+C;AACtE,QAAI,OAAO,QAAQ,uBAAuB,YAAY;AACpD,YAAM,OAAO,MAAM,QAAQ,mBAAmB,UAAU,WAAW;AACnE,aAAO,QAAQ,QAAQ,WAAW,MAAM,KAAK,GAAG,gDAAgD;AAAA,IAClG;AAAA,EACF,CAAC;AAED,QAAM,IAAI,mCAAmC,YAAY;AACvD,UAAM,UAAU,MAAM,QAAQ,mBAAmB,GAAG,cAAc,UAAU;AAC5E,WAAO,YAAY,MAAM,qDAAqD;AAAA,EAChF,CAAC;AAED,SAAO,EAAE,QAAQ,QAAQ,SAAS,SAAS,QAAQ,SAAS;AAC9D;AAEA,eAAsB,yBACpB,SACA,UAAoF,CAAC,GACtE;AACf,QAAM,SAAS,MAAM,sBAAsB,SAAS,OAAO;AAC3D,MAAI,OAAO,SAAS,SAAS,GAAG;AAC9B,UAAM,UAAU,OAAO,SAAS,IAAI,CAAC,YAAY,GAAG,QAAQ,KAAK,KAAK,QAAQ,OAAO,EAAE,EAAE,KAAK,IAAI;AAClG,UAAM,IAAI,MAAM,+BAA+B,OAAO,MAAM,IAAI,OAAO,MAAM,MAAM,OAAO,EAAE;AAAA,EAC9F;AACF;;;ACrHO,SAAS,uBACd,gBACA,UACA,WAAU,oBAAI,KAAK,GAAE,YAAY,GACf;AAClB,QAAM,cAAc,SAAS,SAAS,SAAS,CAAC;AAChD,QAAM,UAAU,eAAe,OAAO,YAAY,YAAY,WAAW,YAAY,QAAQ,MAAM,GAAG,GAAG,IAAI;AAE7G,SAAO;AAAA,IACL;AAAA,IACA,UAAU,CAAC,GAAG,QAAQ;AAAA,IACtB;AAAA,IACA,cAAc,SAAS;AAAA,IACvB,oBAAoB;AAAA,EACtB;AACF;AAEO,SAAS,sBAAsB,KAAsC;AAC1E,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,WAAO,mBAAmB,MAAM,IAAI,SAAS;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,0BAA0B,QAAkC;AAC1E,SAAO,KAAK,UAAU,QAAQ,MAAM,CAAC;AACvC;AAEO,IAAM,0BAAN,MAAyD;AAAA,EAC7C,UAAU,oBAAI,IAA8B;AAAA,EAE7D,YAAY,UAAiC,CAAC,GAAG;AAC/C,eAAW,UAAU,QAAQ,WAAW,CAAC,GAAG;AAC1C,WAAK,QAAQ,IAAI,OAAO,gBAAgB,sBAAsB,MAAM,CAAC;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,gBAAwB,UAAoD;AAC/F,UAAM,SAAS,uBAAuB,gBAAgB,QAAQ;AAC9D,SAAK,QAAQ,IAAI,gBAAgB,sBAAsB,MAAM,CAAC;AAC9D,WAAO,sBAAsB,MAAM;AAAA,EACrC;AAAA,EAEA,MAAM,eAAe,gBAA0D;AAC7E,UAAM,SAAS,KAAK,QAAQ,IAAI,cAAc;AAC9C,WAAO,SAAS,sBAAsB,MAAM,IAAI;AAAA,EAClD;AAAA,EAEA,MAAM,kBAAgD;AACpD,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,EAC7B,IAAI,mBAAmB,EACvB,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;AAAA,EACtD;AAAA,EAEA,MAAM,iBAAiB,gBAA0C;AAC/D,WAAO,KAAK,QAAQ,OAAO,cAAc;AAAA,EAC3C;AACF;AAEO,IAAM,iBAAN,cAA6B,wBAAwB;AAAC;AAE7D,SAAS,mBAAmB,QAA6C;AACvE,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAClB,SACE,OAAO,UAAU,mBAAmB,YACpC,MAAM,QAAQ,UAAU,QAAQ,KAChC,OAAO,UAAU,YAAY,YAC7B,OAAO,UAAU,iBAAiB,YAClC,OAAO,UAAU,uBAAuB;AAE5C;AAEA,SAAS,sBAAsB,QAA4C;AACzE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAU,CAAC,GAAG,OAAO,QAAQ;AAAA,EAC/B;AACF;AAEA,SAAS,oBAAoB,QAA6C;AACxE,SAAO;AAAA,IACL,gBAAgB,OAAO;AAAA,IACvB,SAAS,OAAO;AAAA,IAChB,cAAc,OAAO;AAAA,IACrB,oBAAoB,OAAO;AAAA,EAC7B;AACF;;;AC3FO,SAAS,yBACd,SACA,eACwB;AACxB,MAAI,CAAC,WAAW,CAAC,QAAQ,SAAS,OAAO,QAAQ,SAAS,SAAU,QAAO;AAE3E,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,QAAQ,IAAI;AACtC,QAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,aAAO;AAAA,IACT;AACA,2BAAuB;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,CAAC,OAAgB,WAAW,OAC5C,OAAO,UAAU,WACb,QACA,SAAS,OAAO,UAAU,WAC1B,KAAK,UAAU,KAAK,IACpB;AAEN,QAAM,YAAY,CAAC,UAAoE;AACrF,QAAI,OAAO,UAAU,UAAU;AAC7B,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,YAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,iBAAO;AAAA,QACT;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,KAAK,iBAAiB,UAAU,QAAQ,KAAK,EAAE,QAAQ,mBAAmB,GAAG,CAAC;AACpF,QAAM,OAAO,UAAU,QAAQ,OAAO,KAAK,UAAU,QAAQ,KAAK;AAClE,QAAM,cAAc,UAAU,QAAQ,WAAW,KAAK,uBAAuB,iBAAiB,MAAM;AAEpG,QAAM,iBAAiB,UAAU,QAAQ,aAAa;AACtD,QAAM,cAAc,kBAAkB,OAAO,mBAAmB,YAAY,CAAC,MAAM,QAAQ,cAAc,IACrG,iBACA;AACJ,QAAM,cAAc,cAChB;AAAA,IACA,UAAU,OAAO,YAAY,aAAa,WAAW,YAAY,WAAW;AAAA,IAC5E,OAAO,OAAO,YAAY,UAAU,WAAW,YAAY,QAAQ;AAAA,EACrE,IACE;AAEJ,QAAM,WAAW,UAAU,QAAQ,WAAW;AAC9C,QAAM,YAAY,MAAM,QAAQ,QAAQ,IACnC,SACA,OAAO,CAAC,MAAM,OAAO,GAAG,WAAW,QAAQ,EAC3C,IAAI,CAAC,MAAM,OAAO,EAAE,MAAM,CAAC,IAC5B,CAAC;AAEL,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,OAAO;AAAA,IACP;AAAA;AAAA,IAEA,cAAc;AAAA,IACd,sBAAsB;AAAA,MACpB,SAAS,MAAM,QAAQ,qBAAqB,OAAO,IAC9C,qBAAqB,UACtB,CAAC;AAAA,MACL,SAAS,MAAM,QAAQ,qBAAqB,OAAO,IAC9C,qBAAqB,UACtB,CAAC;AAAA,MACL,UAAU,MAAM,QAAQ,qBAAqB,QAAQ,IACjD,qBAAqB,WACrB;AAAA,IACN;AAAA,IACA,SAAS;AAAA,EACX;AACF;;;ACvGA,SAAS,UAAU,MAA+B;AAChD,QAAM,IAAI,+CAA+C,KAAK,IAAI;AAClE,MAAI,CAAC,EAAG,QAAO;AACf,SAAO,EAAE,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;AAC3C;AAEA,SAAS,wBAAwB,MAAuB;AACtD,QAAM,IAAI,UAAU,IAAI;AACxB,MAAI,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,EAAG,QAAO;AACzC,QAAM,CAAC,GAAG,CAAC,IAAI;AACf,MAAI,MAAM,OAAO,MAAM,EAAG,QAAO;AACjC,MAAI,MAAM,GAAI,QAAO;AACrB,MAAI,MAAM,OAAO,KAAK,MAAM,KAAK,GAAI,QAAO;AAC5C,MAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,MAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,SAAO;AACT;AAGO,SAAS,0BAA0B,KAAyB;AACjE,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,WAAO;AAAA,EACT;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AACzD,WAAO;AAAA,EACT;AACA,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,MACE,SAAS,eACT,KAAK,SAAS,YAAY,KAC1B,SAAS,aACT,SAAS,UACT,SAAS,MACT;AACA,WAAO;AAAA,EACT;AACA,MAAI,KAAK,WAAW,MAAM,GAAG;AAC3B,WAAO;AAAA,EACT;AACA,MAAI,wBAAwB,IAAI,GAAG;AACjC,WAAO;AAAA,EACT;AACA,MAAI,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,WAAW,GAAG,GAAG;AAC/C,UAAM,QAAQ,KAAK,YAAY;AAC/B,QAAI,MAAM,WAAW,OAAO,KAAK,MAAM,WAAW,IAAI,KAAK,MAAM,WAAW,IAAI,GAAG;AACjF,aAAO;AAAA,IACT;AACA,QAAI,UAAU,OAAO;AACnB,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,GAAG;AAC9C,UAAM,QAAQ,KAAK,MAAM,GAAG,EAAE,EAAE,YAAY;AAC5C,QAAI,UAAU,SAAS,MAAM,WAAW,OAAO,KAAK,MAAM,WAAW,IAAI,KAAK,MAAM,WAAW,IAAI,GAAG;AACpG,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,IAAI,KAAK,QAAQ,YAAY,EAAE,EAAE,YAAY;AACnD,MAAI,MAAM,8BAA8B,EAAE,SAAS,WAAW,GAAG;AAC/D,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACjDA,IAAM,SAAS;AAKR,SAAS,qBAAqB,QAAgB,UAA0B;AAC7E,QAAM,aAAa,SAAS,QAAQ,QAAQ,EAAE;AAC9C,QAAM,WAAW,WAAW,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,IAAI,kBAAkB;AAC7E,SAAO,mBAAmB,mBAAmB,MAAM,CAAC,SAAS,SAAS,KAAK,GAAG,CAAC;AACjF;AAGO,IAAM,mBAAmB;AAKzB,SAAS,iBAAiB,KAAuC;AACtE,QAAM,IAAI,IAAI,KAAK;AACnB,MAAI,CAAC,EAAE,WAAW,MAAM,EAAG,QAAO;AAClC,QAAM,OAAO,EAAE,MAAM,OAAO,MAAM;AAClC,QAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,MAAI,SAAS,EAAG,QAAO;AACvB,MAAI;AACJ,MAAI;AACF,aAAS,mBAAmB,KAAK,MAAM,GAAG,KAAK,CAAC;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,YAAY,KAAK,MAAM,QAAQ,CAAC;AACtC,MAAI,CAAC,UAAU,WAAW,OAAO,EAAG,QAAO;AAC3C,QAAM,WAAW,UAAU,MAAM,QAAQ,MAAM;AAC/C,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO,EAAE,QAAQ,YAAY,MAAM,QAAQ,QAAQ,UAAU,GAAG;AAAA,EAClE;AACA,MAAI;AACF,UAAM,WAAW,SAAS,MAAM,GAAG,EAAE,IAAI,kBAAkB,EAAE,KAAK,GAAG;AACrE,WAAO,EAAE,QAAQ,YAAY,MAAM,QAAQ,QAAQ,SAAS;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC7CO,SAAS,mCAAmC,SAAgE;AACjH,SAAO,OAAO,EAAE,QAAQ,WAAW,MAAM;AACvC,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO,EAAE,aAAa,MAAM,QAAQ,sBAAsB,KAAK,CAAC,EAAE;AAAA,MACpE,KAAK,yBAAyB;AAC5B,cAAM,gBAAgB,gBAAgB,UAAU;AAChD,eAAO,QAAQ,QAAQ,YAAY;AAAA,UACjC,cAAc,gBAAgB,eAAe,cAAc;AAAA,UAC3D,gBAAgB,wBAAwB,eAAe,gBAAgB;AAAA,QACzE,CAAC;AAAA,MACH;AAAA,MACA,KAAK,uBAAuB;AAC1B,cAAM,gBAAgB,gBAAgB,UAAU;AAChD,cAAM,QAAQ,QAAQ,YAAY;AAAA,UAChC,gBAAgB,gBAAgB,eAAe,gBAAgB;AAAA,UAC/D,SAAS,gBAAgB,eAAe,SAAS;AAAA,UACjD,cAAc,wBAAwB,eAAe,cAAc;AAAA,UACnE,aAAa,qBAAqB,eAAe,aAAa;AAAA,UAC9D,eAAe,0BAA0B,eAAe,eAAe;AAAA,QACzE,CAAC;AACD,eAAO,EAAE,IAAI,KAAK;AAAA,MACpB;AAAA,MACA,KAAK,0BAA0B;AAC7B,cAAM,gBAAgB,gBAAgB,UAAU;AAChD,cAAM,iBAAiB,gBAAgB,eAAe,gBAAgB;AACtE,cAAM,eAAe,gBAAgB,eAAe,cAAc;AAClE,cAAM,gCAAgC;AAAA,UACpC,SAAS,QAAQ;AAAA,UACjB;AAAA,UACA;AAAA,UACA,cAAc,0BAA0B,eAAe,cAAc;AAAA,UACrE,aAAa,QAAQ;AAAA,QACvB,CAAC;AACD,cAAM,QAAQ,QAAQ,YAAY;AAAA,UAChC;AAAA,UACA;AAAA,UACA,SAAS,gBAAgB,eAAe,SAAS;AAAA,UACjD,aAAa,qBAAqB,eAAe,aAAa;AAAA,UAC9D,eAAe,0BAA0B,eAAe,eAAe;AAAA,QACzE,CAAC;AACD,eAAO,EAAE,IAAI,MAAM,eAAe;AAAA,MACpC;AAAA,MACA,KAAK,yBAAyB;AAC5B,cAAM,gBAAgB,gBAAgB,UAAU;AAChD,cAAM,QAAQ,QAAQ,YAAY,gBAAgB,eAAe,gBAAgB,CAAC;AAClF,eAAO,EAAE,IAAI,KAAK;AAAA,MACpB;AAAA,MACA,KAAK,iCAAiC;AACpC,cAAM,gBAAgB,gBAAgB,UAAU;AAChD,cAAM,iBAAiB,gBAAgB,eAAe,gBAAgB;AACtE,cAAM,QAAQ,IAAI,IAAI,qBAAqB,eAAe,iBAAiB,CAAC;AAC5E,cAAM,WAAW,MAAM,QAAQ,QAAQ,YAAY,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC3F,eAAO,EAAE,UAAU,SAAS,OAAO,CAAC,YAAY,CAAC,MAAM,IAAI,QAAQ,SAAS,CAAC,EAAE;AAAA,MACjF;AAAA,MACA;AACE,cAAM,IAAI,MAAM,wBAAwB,MAAM,EAAE;AAAA,IACpD;AAAA,EACF;AACF;AAEA,eAAe,gCAAgC,OAM7B;AAChB,MAAI,MAAM,cAAc;AACtB,UAAM,MAAM,QAAQ,2BAA2B,MAAM,YAAY;AACjE;AAAA,EACF;AACA,QAAM,WAAW,MAAM,MAAM,QAAQ,oBAAoB,MAAM,cAAc,EAAE,MAAM,MAAM,IAAI;AAC/F,MAAI,SAAU;AACd,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,MAAM,QAAQ,2BAA2B;AAAA,IAC7C,gBAAgB,MAAM;AAAA,IACtB,OAAO,MAAM;AAAA,IACb,oBAAoB;AAAA,IACpB,sBAAsB;AAAA,IACtB,cAAc;AAAA,IACd,cAAc,MAAM,eAAe;AAAA,IACnC,aAAa;AAAA,IACb,cAAc,MAAM;AAAA,IACpB,iBAAiB;AAAA,EACnB,CAAC;AACH;AAEA,SAAS,gBAAgB,OAAyC;AAChE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC7G,SAAO;AACT;AAEA,SAAS,gBAAgB,YAAqC,KAAqB;AACjF,QAAM,QAAQ,WAAW,GAAG;AAC5B,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,oBAAoB;AACzF,SAAO;AACT;AAEA,SAAS,wBAAwB,YAAqC,KAAiC;AACrG,QAAM,QAAQ,WAAW,GAAG;AAC5B,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,MAAM,oBAAoB;AACnE,SAAO;AACT;AAEA,SAAS,qBAAqB,YAAqC,KAAuB;AACxF,QAAM,QAAQ,WAAW,GAAG;AAC5B,MAAI,UAAU,OAAW,QAAO,CAAC;AACjC,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC/D,SAAO,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ;AACxE;AAEA,SAAS,qBAAqB,YAAqC,KAAsC;AACvG,QAAM,QAAQ,WAAW,GAAG;AAC5B,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,CAAC,cAAc,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC/D,SAAO;AACT;AAEA,SAAS,0BAA0B,YAAqC,KAAwC;AAC9G,QAAM,QAAQ,WAAW,GAAG;AAC5B,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC/D,SAAO,MAAM,OAAO,aAAa;AACnC;AAEA,SAAS,0BAA0B,YAAqC,KAA2C;AACjH,QAAM,QAAQ,WAAW,GAAG;AAC5B,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,CAAC,uBAAuB,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AACxE,SAAO;AACT;AAEA,SAAS,cAAc,OAAsC;AAC3D,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,SACE,OAAO,OAAO,cAAc,YAC5B,OAAO,OAAO,mBAAmB,YACjC,OAAO,OAAO,iBAAiB,YAC/B,OAAO,OAAO,cAAc,YAC5B,OAAO,OAAO,iBAAiB,YAC/B,OAAO,OAAO,SAAS,YACvB,OAAO,OAAO,YAAY;AAE9B;AAEA,SAAS,uBAAuB,OAA2C;AACzE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,SACE,OAAO,OAAO,mBAAmB,YACjC,OAAO,OAAO,UAAU,YACxB,OAAO,OAAO,yBAAyB,YACvC,OAAO,OAAO,iBAAiB,YAC/B,OAAO,OAAO,iBAAiB,YAC/B,OAAO,OAAO,gBAAgB,YAC9B,OAAO,OAAO,iBAAiB,YAC/B,OAAO,OAAO,oBAAoB;AAEtC;;;AC7KO,IAAM,+BAA+B;AAwC5C,IAAM,qBAAqB;AAC3B,IAAM,2BAA2B;AACjC,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB,OAAO;AACpC,IAAM,iBAAiB,KAAK;AAC5B,IAAM,gBAAgB,oBAAI,IAA+B;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAASC,UAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAgB,OAAe,eAAgD;AACvG,MACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,SAAS,iBACf,CAAC,mBAAmB,KAAK,KAAK,GAC9B;AACA,UAAM,IAAI,MAAM,uBAAuB,KAAK,EAAE;AAAA,EAChD;AACF;AAEA,SAAS,kBAAkB,OAAgB,OAAqB;AAC9D,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,UAAU,KAAK;AAAA,EAChC,QAAQ;AACN,UAAM,IAAI,MAAM,uBAAuB,KAAK,EAAE;AAAA,EAChD;AACA,MAAI,YAAY,UAAa,IAAI,YAAY,EAAE,OAAO,OAAO,EAAE,aAAa,sBAAsB;AAChG,UAAM,IAAI,MAAM,eAAe,KAAK,YAAY,oBAAoB,QAAQ;AAAA,EAC9E;AACF;AAEA,SAAS,iBAAiB,OAAuD;AAC/E,MAAI,CAACA,UAAS,KAAK,EAAG,OAAM,IAAI,MAAM,gCAAgC;AACtE,MAAI,MAAM,YAAY,8BAA8B;AAClD,UAAM,IAAI,MAAM,6CAA6C,OAAO,MAAM,OAAO,CAAC,EAAE;AAAA,EACtF;AACA,MAAI,MAAM,UAAU,aAAa,MAAM,UAAU,WAAW,MAAM,UAAU,QAAQ;AAClF,UAAM,IAAI,MAAM,2BAA2B;AAAA,EAC7C;AACA,mBAAiB,MAAM,cAAc,gBAAgB,wBAAwB;AAC7E,mBAAiB,MAAM,WAAW,aAAa,oBAAoB;AACnE,MACE,MAAM,cAAc,WACnB,OAAO,MAAM,cAAc,YAC1B,CAAC,OAAO,cAAc,MAAM,SAAS,KACrC,MAAM,YAAY,KAClB,MAAM,YAAY,iBACpB;AACA,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,MAAI,EAAE,gBAAgB,OAAQ,OAAM,IAAI,MAAM,gCAAgC;AAC9E,oBAAkB,MAAM,YAAY,YAAY;AAClD;AAEA,SAAS,0BAA0B,OAGjC;AACA,MAAI,CAACA,UAAS,KAAK,EAAG,OAAM,IAAI,MAAM,0CAA0C;AAChF,MAAI,MAAM,YAAY,8BAA8B;AAClD,UAAM,IAAI,MAAM,6CAA6C,OAAO,MAAM,OAAO,CAAC,EAAE;AAAA,EACtF;AACA,mBAAiB,MAAM,cAAc,gBAAgB,wBAAwB;AAC/E;AAEA,SAAS,aAAa,OAAgB,cAAyD;AAC7F,MACE,CAACA,UAAS,KAAK,KACf,MAAM,YAAY,gCAClB,MAAM,iBAAiB,gBACvB,CAAC,cAAc,IAAI,MAAM,KAAkC,KAC1D,MAAM,UAAU,WACd,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,SAC1D,MAAM,gBAAgB,WACpB,OAAO,MAAM,gBAAgB,YAAY,CAAC,OAAO,SAAS,KAAK,MAAM,MAAM,WAAW,CAAC,IAC1F;AACA,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AACA,MAAI,YAAY,MAAO,mBAAkB,MAAM,QAAQ,QAAQ;AACjE;AAOO,SAAS,0BAA0B,SAAqC;AAC7E,iBAAe,iBACb,QACA,YAC2B;AAC3B,UAAM,sBAA4C;AAAA,MAChD,SAAS;AAAA,MACT,GAAG;AAAA,IACL;AACA,qBAAiB,mBAAmB;AAEpC,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B;AAAA,MACA,GAAG,4BAA4B;AAAA,MAC/B;AAAA,IACF;AACA,iBAAa,QAAQ,WAAW,YAAY;AAC5C,WAAO;AAAA,EACT;AAEA,iBAAe,oBACb,QACA,cAC2B;AAC3B,qBAAiB,cAAc,gBAAgB,wBAAwB;AACvE,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B;AAAA,MACA,GAAG,4BAA4B;AAAA,MAC/B,EAAE,SAAS,8BAA8B,aAAa;AAAA,IACxD;AACA,iBAAa,QAAQ,YAAY;AACjC,WAAO;AAAA,EACT;AAEA,iBAAe,iBACb,QACA,cAC2B;AAC3B,qBAAiB,cAAc,gBAAgB,wBAAwB;AACvE,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B;AAAA,MACA,GAAG,4BAA4B;AAAA,MAC/B,EAAE,SAAS,8BAA8B,aAAa;AAAA,IACxD;AACA,iBAAa,QAAQ,YAAY;AACjC,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAMO,SAAS,2BAA2B,UAatB;AACnB,SAAO,OAAO,UAAU;AACtB,UAAM,EAAE,QAAQ,WAAW,IAAI;AAC/B,UAAM,UAAoC,EAAE,cAAc,MAAM,aAAa;AAE7E,QAAI,WAAW,GAAG,4BAA4B,WAAW;AACvD,uBAAiB,UAAU;AAC3B,UAAI,CAAC,SAAS,UAAU;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAChD;AACA,YAAM,SAAS,MAAM,SAAS,SAAS,YAAY,OAAO;AAC1D,mBAAa,QAAQ,WAAW,YAAY;AAC5C,aAAO;AAAA,IACT;AAEA,QAAI,WAAW,GAAG,4BAA4B,WAAW;AACvD,gCAA0B,UAAU;AACpC,UAAI,CAAC,SAAS,UAAU;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAChD;AACA,YAAM,SAAS,MAAM,SAAS,SAAS,WAAW,cAAc,OAAO;AACvE,mBAAa,QAAQ,WAAW,YAAY;AAC5C,aAAO;AAAA,IACT;AAEA,QAAI,WAAW,GAAG,4BAA4B,WAAW;AACvD,gCAA0B,UAAU;AACpC,UAAI,CAAC,SAAS,UAAU;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAChD;AACA,YAAM,SAAS,MAAM,SAAS,SAAS,WAAW,cAAc,OAAO;AACvE,mBAAa,QAAQ,WAAW,YAAY;AAC5C,aAAO;AAAA,IACT;AAEA,UAAM,IAAI,MAAM,0CAA0C,MAAM;AAAA,EAClE;AACF;;;ACrPO,IAAM,wCAAwC;;;ACO9C,IAAM,mBAAN,MAAuB;AAAA,EAG5B,YACmB,SAIjB;AAJiB;AAAA,EAIhB;AAAA,EAPc,WAAW,oBAAI,IAA8B;AAAA,EAStD,IAAI,WAAmB,UAA0B;AACvD,WAAO,GAAG,SAAS,KAAK,QAAQ;AAAA,EAClC;AAAA,EAEA,MAAM,WAAW,WAAmB,UAAyD;AAC3F,UAAM,IAAI,KAAK,IAAI,WAAW,QAAQ;AACtC,QAAI,KAAK,SAAS,cAAc;AAC9B,YAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,WAAW,QAAQ;AAC/D,UAAI,KAAK;AACP,aAAK,SAAS,IAAI,GAAG,GAAG;AACxB,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO,KAAK,SAAS,IAAI,CAAC;AAAA,EAC5B;AAAA,EAEA,MAAM,WAAW,QAAyC;AACxD,SAAK,SAAS,IAAI,KAAK,IAAI,OAAO,WAAW,OAAO,QAAQ,GAAG,MAAM;AACrE,QAAI,KAAK,SAAS,cAAc;AAC9B,YAAM,KAAK,QAAQ,aAAa,MAAM;AAAA,IACxC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBACJ,SACA,QACA,SACqC;AACrC,UAAM,WAAW,MAAM,KAAK,WAAW,QAAQ,WAAW,QAAQ,QAAQ;AAC1E,QAAI,UAAU;AACZ,YAAM,OAAO,YAAY;AAAA,QACvB,gBAAgB,SAAS;AAAA,QACzB,SAAS,QAAQ;AAAA,MACnB,CAAC;AACD,aAAO,EAAE,gBAAgB,SAAS,qBAAqB;AAAA,IACzD;AACA,UAAM,eAAe,QAAQ;AAC7B,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,YAAY;AAAA,MAClD;AAAA,MACA,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,UAAM,KAAK,WAAW;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB,sBAAsB;AAAA,MACtB,WAAW,KAAK,IAAI;AAAA,MACpB,qBAAqB;AAAA,IACvB,CAAC;AACD,WAAO,EAAE,eAAe;AAAA,EAC1B;AAAA,EAEA,MAAM,mBACJ,WACA,UACA,gBACe;AACf,UAAM,UAAU,MAAM,KAAK,WAAW,WAAW,QAAQ;AACzD,QAAI,SAAS;AACX,YAAM,KAAK,WAAW,EAAE,GAAG,SAAS,sBAAsB,eAAe,CAAC;AAAA,IAC5E,OAAO;AACL,YAAM,KAAK,WAAW;AAAA,QACpB;AAAA,QACA;AAAA,QACA,sBAAsB;AAAA,QACtB,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,SAAS,YAAY,UAAwB,UAA0C;AAC5F,SAAO,SAAS,KAAK,CAAC,MAAM,EAAE,aAAa,QAAQ;AACrD;;;AC3FO,SAAS,0BAA0B,UAA0B;AAClE,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;;;ACEA,eAAsB,wBAAwB,SAG3C;AACD,QAAM,IAAI,QAAQ,QAAQ,KAAK;AAC/B,MAAI,CAAC,EAAE,WAAW,GAAG,KAAK,EAAE,WAAW,IAAI,KAAK,EAAE,SAAS,GAAG;AAC5D,WAAO,EAAE,SAAS,OAAO,UAAU,CAAC,EAAE;AAAA,EACxC;AACA,QAAM,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,EAAE,OAAO,OAAO;AACpD,QAAM,OAAO,MAAM,CAAC,KAAK,IAAI,YAAY;AACzC,QAAM,OAAO,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,KAAK;AAE3C,QAAM,UAAU,MAAM,QAAQ,QAAQ,WAAW,QAAQ,WAAW,QAAQ,QAAQ;AACpF,QAAM,KAAK,CAAC,WAAqB,EAAE,SAAS,MAAe,UAAU,MAAM;AAE3E,MAAI,QAAQ,QAAQ;AAClB,UAAM,OAAO,MAAM,QAAQ,QAAQ,kBAAkB,EAAE,OAAO,GAAG,CAAC;AAClE,QAAI,KAAK,WAAW,EAAG,QAAO,GAAG,CAAC,sCAAQ,CAAC;AAC3C,UAAM,OAAO,KAAK;AAAA,MAChB,CAAC,GAAG,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,WAAM,EAAE,eAAe,MAAM,GAAG,EAAE,CAAC;AAAA,IAC/F;AACA,WAAO,GAAG,CAAC,wCAAU,GAAG,KAAK,IAAI,CAAC,MAAM,UAAK,CAAC,EAAE,CAAC,CAAC;AAAA,EACpD;AAEA,MAAI,QAAQ,UAAU;AACpB,QAAI,CAAC,QAAS,QAAO,GAAG,CAAC,sFAAqB,CAAC;AAC/C,UAAM,OAAO,MAAM,QAAQ,QAAQ,kBAAkB,EAAE,OAAO,GAAG,CAAC;AAClE,UAAM,WAAW,KAAK,KAAK;AAC3B,QAAI,CAAC,SAAU,QAAO,GAAG,CAAC,+DAAiC,CAAC;AAC5D,UAAM,IAAI,SAAS,UAAU,EAAE;AAC/B,QAAI;AACJ,QAAI,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,QAAQ;AAClD,iBAAW,KAAK,IAAI,CAAC,GAAG;AAAA,IAC1B,OAAO;AACL,iBAAW,KAAK;AAAA,QACd,CAAC,MAAM,EAAE,mBAAmB,YAAY,EAAE,eAAe,SAAS,QAAQ;AAAA,MAC5E,GAAG;AAAA,IACL;AACA,QAAI,CAAC,SAAU,QAAO,GAAG,CAAC,uCAAS,QAAQ,EAAE,CAAC;AAC9C,UAAM,QAAQ,QAAQ,mBAAmB,QAAQ,WAAW,QAAQ,UAAU,QAAQ;AACtF,WAAO,GAAG,CAAC,iCAAQ,QAAQ,EAAE,CAAC;AAAA,EAChC;AAEA,MAAI,QAAQ,SAAS,QAAQ,SAAS;AACpC,UAAM,eAAe,QAAQ,QAAQ;AACrC,UAAM,EAAE,eAAe,IAAI,MAAM,QAAQ,OAAO,YAAY,EAAE,aAAa,CAAC;AAC5E,UAAM,QAAQ,QAAQ,WAAW;AAAA,MAC/B,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB,sBAAsB;AAAA,MACtB,WAAW,KAAK,IAAI;AAAA,MACpB,qBAAqB;AAAA,IACvB,CAAC;AACD,WAAO,GAAG,CAAC;AAAA,YAAmB,cAAc;AAAA,uDAAe,CAAC;AAAA,EAC9D;AAEA,MAAI,QAAQ,UAAU;AACpB,QAAI,CAAC,QAAS,QAAO,GAAG,CAAC,0CAAY,CAAC;AACtC,UAAM,OAAO,MAAM,QAAQ,QAAQ,oBAAoB,QAAQ,oBAAoB;AACnF,WAAO,GAAG;AAAA,MACR,qBAAM,QAAQ,oBAAoB;AAAA,MAClC,qBAAM,MAAM,gBAAgB,GAAG;AAAA,MAC/B,2BAAO,MAAM,gBAAgB,GAAG;AAAA,IAClC,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,UAAU;AACpB,QAAI,CAAC,QAAS,QAAO,GAAG,CAAC,4CAAS,CAAC;AACnC,UAAM,QAAQ,QAAQ,YAAY,QAAQ,oBAAoB;AAC9D,WAAO,GAAG,CAAC,8DAAY,CAAC;AAAA,EAC1B;AAEA,SAAO,EAAE,SAAS,OAAO,UAAU,CAAC,EAAE;AACxC;;;ACtFA,SAAS,iBAAiB,OAAwB;AAChD,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AACxF,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,MAAI;AACF,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,4BAA4B,SAMhC;AAChB,QAAM,MAAM,0BAA0B,QAAQ,QAAQ;AACtD,MAAI,MAAM;AAEV,QAAM,YAAY,OAAO,UAAkC;AACzD,QAAI,IAAI,WAAW,EAAG;AACtB,QAAI,OAAO;AACT,aAAO,IAAI,SAAS,GAAG;AACrB,cAAM,OAAO,KAAK,IAAI,KAAK,IAAI,MAAM;AACrC,cAAM,QAAQ,IAAI,MAAM,GAAG,IAAI;AAC/B,cAAM,IAAI,MAAM,IAAI;AACpB,YAAI,MAAM,KAAK,EAAE,SAAS,EAAG,OAAM,QAAQ,MAAM,KAAK;AAAA,MACxD;AACA;AAAA,IACF;AACA,WAAO,IAAI,UAAU,KAAK;AACxB,YAAM,QAAQ,IAAI,MAAM,GAAG,GAAG;AAC9B,YAAM,IAAI,MAAM,GAAG;AACnB,YAAM,QAAQ,MAAM,KAAK;AAAA,IAC3B;AAAA,EACF;AAEA,QAAM,IAAI,QAAc,CAAC,SAASC,YAAW;AAC3C,UAAM,MAAM,QAAQ,QAAQ,mBAAmB,QAAQ,gBAAgB,CAAC,MAAe;AACrF,YAAM,IAAI;AACV,UAAI,EAAE,SAAS,cAAc;AAC3B,aAAK,UAAU,IAAI,EAChB,KAAK,MAAM;AACV,cAAI;AACJ,kBAAQ;AAAA,QACV,CAAC,EACA,MAAMA,OAAM;AACf;AAAA,MACF;AACA,UAAI,EAAE,SAAS,eAAe;AAC5B,YAAI;AACJ,QAAAA,QAAO,IAAI,MAAO,EAAyB,SAAS,aAAa,CAAC;AAClE;AAAA,MACF;AACA,UAAI,EAAE,SAAS,gBAAgB,EAAE,MAAM,SAAS,WAAW;AACzD,cAAM,WAAW,EAAE,KAAK;AACxB,YAAI,QAAQ;AACZ,YAAI,OAAO,aAAa,SAAU,SAAQ;AAAA,iBACjC,YAAY,QAAQ,OAAO,aAAa,YAAY,aAAa,UAAU;AAClF,gBAAM,UAAW,SAAmC;AACpD,kBAAQ,iBAAiB,OAAO;AAAA,QAClC,MAAO,SAAQ,iBAAiB,QAAQ;AACxC,eAAO;AACP,aAAK,UAAU,KAAK;AAAA,MACtB;AACA,UAAI,EAAE,SAAS,gBAAgB,EAAE,MAAM,SAAS,QAAQ;AACtD,cAAM,KAAK,EAAE,KAAK;AAMlB,cAAM,KAAK,GAAG;AACd,YAAI,CAAC,GAAI;AACT,YAAI,OAAO,gBAAgB;AACzB,gBAAM,IAAI,GAAG;AAIb,gBAAM,IAAI,OAAO,GAAG,aAAa,WAAW,EAAE,WAAW;AACzD,gBAAM,YAAY,GAAG,SACjB,IAAI,CAACC,OAAMA,GAAE,KAAK,EACnB,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AACnD,gBAAM,UAAU,QAAQ,SAAS,kBAAkB,GAAG,SAAS;AAC/D,kBAAQ,OAAO,CAAC,IAAI,SAAS,IAAI,IAAI,OAAO,MAAM,UAAU;AAC5D,eAAK,UAAU,IAAI;AACnB;AAAA,QACF;AACA,YAAI,GAAG,SAAS;AACd,kBAAQ,OAAO,CAAC,IAAI,SAAS,IAAI,IAAI,OAAO,MAC1C,QAAQ,SAAS,YAAY,iBAAiB,GAAG,MAAM,KAAK,YAAY,IACxE;AACF,eAAK,UAAU,KAAK;AACpB;AAAA,QACF;AACA,cAAM,WAAW,QAAQ,SAAS,sBAAsB,IAAI,GAAG,cAAc,CAAC,CAAC;AAC/E,cAAM,aAAa,QAAQ,SAAS,wBAAwB,IAAI,GAAG,UAAU,IAAI;AACjF,gBAAQ,OAAO,CAAC,IAAI,SAAS,IAAI,IAAI,OAAO,MAC1C,YACC,aAAa;AAAA,EAAK,UAAU,KAAK,MAClC;AACF,aAAK,UAAU,KAAK;AAAA,MACtB;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;;;ACrHO,IAAM,sBAAN,MAAwD;AAAA,EAC7D,gBAAgB,SAAyB;AACvC,WAAO,QAAQ,KAAK;AAAA,EACtB;AAAA,EAEA,sBAAsB,UAAkB,YAA6B;AACnE,UAAM,KAAK,MAAM;AACf,UAAI;AACF,cAAM,QAAQ,KAAK,UAAU,UAAU;AACvC,YAAI,CAAC,SAAS,UAAU,KAAM,QAAO;AACrC,eAAO,MAAM,SAAS,MAAM,GAAG,MAAM,MAAM,GAAG,GAAG,CAAC,WAAM;AAAA,MAC1D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF,GAAG;AACH,WAAO,IAAI,aAAM,QAAQ,KAAK,CAAC,KAAK,aAAM,QAAQ;AAAA,EACpD;AAAA,EAEA,wBAAwB,UAAkB,QAAgC;AAExE,QAAI,UAAU,KAAM,QAAO,UAAK,QAAQ;AACxC,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,OAAO,KAAK;AACtB,UAAI,CAAC,EAAG,QAAO,UAAK,QAAQ;AAC5B,aAAO,UAAK,QAAQ,KAAK,EAAE,SAAS,MAAM,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,WAAM,CAAC;AAAA,IACrE;AACA,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,OAAO,OAAO,KAAK,MAAiC;AAC1D,UAAI,KAAK,WAAW,EAAG,QAAO,UAAK,QAAQ;AAC3C,aAAO,UAAK,QAAQ,MAAM,KAAK,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,aAAQ,EAAE;AAAA,IACtF;AACA,QAAI,OAAO,WAAW,SAAU,QAAO,UAAK,QAAQ,KAAK,OAAO,SAAS,CAAC;AAC1E,QAAI,OAAO,WAAW,WAAY,QAAO,UAAK,QAAQ;AACtD,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,aAAa,OAAO,WAAW,UAAU;AAC3F,aAAO,UAAK,QAAQ,KAAK,OAAO,MAAM,CAAC;AAAA,IACzC;AACA,WAAO,UAAK,QAAQ;AAAA,EACtB;AAAA,EAEA,mBAAmB,UAAkB,YAA6B;AAChE,WAAO,gEAAc,QAAQ;AAAA;AAAA;AAAA,EAAsB,KAAK,UAAU,YAAY,MAAM,CAAC,CAAC;AAAA;AAAA;AAAA,EACxF;AAAA,EAEA,kBAAkB,UAAkB,SAA4B;AAC9D,UAAM,QAAQ,SAAS,SACnB,CAAC,UAAK,QAAQ,IAAI,GAAG,QAAQ,IAAI,CAAC,GAAG,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IACpE,CAAC,UAAK,QAAQ,EAAE;AACpB,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB;AAAA,EAEA,eAAe,UAAiC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,YAAYC,QAAuB;AACjC,WAAO,kCAASA,MAAK;AAAA,EACvB;AAAA,EAEA,eAAe,OAAoE;AACjF,WAAO,CAAC,kBAAW,GAAG,MAAM,IAAI,CAAC,MAAM,GAAG,EAAE,OAAO,QAAQ,KAAK,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,IAAI;AAAA,EAC1F;AACF;;;ACzDO,IAAM,oBAAoB;AAAA,EAC/B;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AACF;AAWA,eAAsB,qBAAqB,IAAoB,gBAAuC;AACpG,QAAM,GAAG,QAAQ,mBAAmB,GAAG,WAAW,GAAG,UAAU,cAAc;AAC/E;;;ACrCA,SAAS,SAAS;AASX,IAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,aAAa,EAAE,OAAO,CAAC,CAAC;AAE9B,IAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC;AAClC,CAAC;AAED,IAAM,YAAY,EAAE,OAAO;AAAA,EACzB,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC3C,CAAC;AAED,IAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,SAAS;AAC7D,CAAC;AAOD,SAAS,MAAM,SAAoC;AACjD,SAAO,EAAE,OAAO,QAAQ;AAC1B;AAEA,eAAe,gBACb,SACA,gBACwF;AACxF,QAAM,OAAO,MAAM,QAAQ,QAAQ,oBAAoB,cAAc;AACrE,QAAM,KAAK,MAAM;AACjB,MAAI,CAAC,IAAI;AACP,WAAO,EAAE,OAAO,8BAA8B;AAAA,EAChD;AACA,SAAO,EAAE,WAAW,GAAG,WAAW,UAAU,GAAG,UAAU,UAAU,GAAG,SAAS;AACjF;AAEA,eAAsB,wBACpB,YACA,SACA,MACiD;AACjD,QAAM,SAAS,WAAW,UAAU,UAAU;AAC9C,MAAI,CAAC,OAAO,QAAS,QAAO,MAAM,cAAc;AAChD,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,IAAK,QAAO,MAAM,wBAAwB;AAC/C,QAAM,SAAS,MAAM,gBAAgB,SAAS,GAAG;AACjD,MAAI,WAAW,OAAQ,QAAO;AAC9B,QAAM,MAAM,MAAM,QAAQ,QAAQ,kBAAkB,CAAC,CAAC;AACtD,MAAI,IAAI,WAAW,EAAG,QAAO,EAAE,QAAQ,uCAAS;AAChD,QAAM,SAAS,CAAC,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,uBAAuB,EAAE,oBAAoB;AACtF,QAAM,QAAQ,OAAO,IAAI,CAAC,GAAG,UAAU;AACrC,UAAM,QAAQ,EAAE,SAAS,EAAE;AAC3B,UAAM,IAAI,IAAI,KAAK,EAAE,oBAAoB,EAAE,YAAY;AACvD,WAAO,GAAG,QAAQ,CAAC,KAAK,KAAK;AAAA,SAAY,EAAE,cAAc;AAAA,UAAa,EAAE,YAAY,MAAM,CAAC;AAAA,EAC7F,CAAC;AACD,SAAO,EAAE,QAAQ;AAAA,EAAY,MAAM,KAAK,IAAI,CAAC,GAAG;AAClD;AAEA,eAAsB,yBACpB,YACA,SACA,KACiD;AACjD,QAAM,SAAS,aAAa,UAAU,UAAU;AAChD,MAAI,CAAC,OAAO,QAAS,QAAO,MAAM,cAAc;AAChD,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,IAAK,QAAO,MAAM,wBAAwB;AAC/C,QAAM,SAAS,MAAM,gBAAgB,SAAS,GAAG;AACjD,MAAI,WAAW,OAAQ,QAAO;AAC9B,QAAM,IAAI,iBAAiB;AAAA,IACzB,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO,KAAK;AAAA,EACd;AACA,SAAO,EAAE,QAAQ,6CAAU,OAAO,KAAK,cAAc,GAAG;AAC1D;AAEA,eAAsB,sBACpB,YACA,SACA,KACiD;AACjD,QAAM,SAAS,UAAU,UAAU,UAAU;AAC7C,MAAI,CAAC,OAAO,QAAS,QAAO,MAAM,cAAc;AAChD,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,IAAK,QAAO,MAAM,wBAAwB;AAC/C,QAAM,SAAS,MAAM,gBAAgB,SAAS,GAAG;AACjD,MAAI,WAAW,OAAQ,QAAO;AAC9B,QAAM,UAAU,MAAM,IAAI,iBAAiB,WAAW,OAAO,WAAW,OAAO,QAAQ;AACvF,QAAM,eAAe,OAAO,KAAK,cAAc,KAAK,KAClD,SAAS,uBACT;AACF,QAAM,KAAK,IAAI,mBAAmB;AAClC,QAAM,EAAE,eAAe,IAAI,MAAM,GAAG,YAAY,EAAE,cAAc,gBAAgB,GAAG,CAAC;AACpF,QAAM,IAAI,iBAAiB,WAAW;AAAA,IACpC,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,sBAAsB;AAAA,IACtB,WAAW,KAAK,IAAI;AAAA,IACpB,qBAAqB;AAAA,EACvB,CAAC;AACD,QAAM,OAAO,MAAM,QAAQ,QAAQ,oBAAoB,cAAc;AACrE,MAAI,MAAM;AACR,UAAM,QAAQ,QAAQ,2BAA2B;AAAA,MAC/C,GAAG;AAAA,MACH,eAAe;AAAA,QACb,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB,UAAU,OAAO;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,QAAQ,+DAAa,cAAc;AAAA,cAAiB,YAAY;AAAA;AAAA,EAClE;AACF;AAEA,eAAsB,uBACpB,YACA,SACA,MACiD;AACjD,QAAM,SAAS,gBAAgB,UAAU,UAAU;AACnD,MAAI,CAAC,OAAO,QAAS,QAAO,MAAM,cAAc;AAChD,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,IAAK,QAAO,MAAM,wBAAwB;AAC/C,QAAM,SAAS,MAAM,gBAAgB,SAAS,GAAG;AACjD,MAAI,WAAW,OAAQ,QAAO;AAC9B,OAAK;AACL,QAAM,MAAM,OAAO,KAAK,eAAe;AACvC,QAAM,OAAO,MAAM,QAAQ,QAAQ,YAAY,KAAK,EAAE,MAAM,eAAe,CAAC;AAC5E,QAAM,OAAO,KAAK,MAAM,CAAC,GAAG;AAC5B,MAAI,KAAK,WAAW,EAAG,QAAO,EAAE,QAAQ,+DAAa;AACrD,QAAM,QAAQ,KAAK;AAAA,IACjB,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,EAAE,QAAQ,MAAM,GAAG,GAAI,CAAC,GAAG,EAAE,QAAQ,SAAS,MAAO,WAAM,EAAE;AAAA,EACrF;AACA,SAAO;AAAA,IACL,QAAQ,gBAAM,KAAK,MAAM;AAAA,EAAsB,MAAM,KAAK,SAAS,CAAC;AAAA,EACtE;AACF;AAKO,SAAS,8BACd,UACA,SACA,KACM;AACN,QAAM,QAAQ,CAAC,cAA8C,CAAC,eAAwC,UAAU,YAAY,SAAS,GAAG;AAExI,WAAS;AAAA,IACP;AAAA,IACA,MAAM,uBAAuB;AAAA,IAC7B;AAAA,IACA;AAAA,EACF;AACA,WAAS;AAAA,IACP;AAAA,IACA,MAAM,wBAAwB;AAAA,IAC9B;AAAA,IACA;AAAA,EACF;AACA,WAAS;AAAA,IACP;AAAA,IACA,MAAM,qBAAqB;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AACA,WAAS;AAAA,IACP;AAAA,IACA,MAAM,sBAAsB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AAEA,8BAA4B,wBAAwB,YAAY;AAAA,IAC9D,aAAa;AAAA,IACb,aAAa;AAAA,EACf,CAAC;AACD,8BAA4B,yBAAyB,cAAc;AAAA,IACjE,aAAa;AAAA,IACb,aAAa;AAAA,EACf,CAAC;AACD,8BAA4B,sBAAsB,WAAW;AAAA,IAC3D,aAAa;AAAA,IACb,aAAa;AAAA,EACf,CAAC;AACD,8BAA4B,uBAAuB,iBAAiB;AAAA,IAClE,aAAa;AAAA,IACb,aAAa;AAAA,EACf,CAAC;AACH;;;ACrLO,SAAS,qBAAqB,UAAyB,SAAmC;AAC/F,QAAM,oBAAoB,SAAS,mBAAmB;AACtD,MAAI,mBAAmB;AACrB,eAAW,CAAC,IAAI,IAAI,KAAK,gBAAgB;AACvC,wBAAkB,IAAI,IAAI,IAAI;AAAA,IAChC;AACA,iCAA6B,iBAAiB;AAAA,EAChD,OAAO;AACL,iCAA6B;AAAA,EAC/B;AAEA,6BAA2B;AAC3B,kBAAgB,EAAE,sBAAsB,KAAK,EAAE,GAAG,SAAS,cAAc,SAAS,GAAG;AAAA,IACnF,GAAG;AAAA,EACL,CAAC;AACH;;;ACnCA,IAAM,0BAA0B;AAChC,IAAM,2BAA2B;AAejC,eAAe,mBAAmB,OAA+C;AAC/E,QAAM,YAAY,MAAM,aAAa;AAErC,SAAO,IAAI,QAAwB,CAAC,YAAY;AAC9C,QAAI,UAAU;AAEd,UAAM,QAAQ,YAAY,IACtB,WAAW,MAAM;AACjB,UAAI,CAAC,SAAS;AACZ,kBAAU;AACV,gBAAQ;AAAA,UACN,MAAM,MAAM;AAAA,UACZ,QAAQ;AAAA,UACR,OAAO,SAAS,MAAM,KAAK,MAAM,qBAAqB,SAAS;AAAA,QACjE,CAAC;AAAA,MACH;AAAA,IACF,GAAG,SAAS,IACV;AAEJ,UACG,SAAS,MAAM,KAAK,cAAc,CAAC,CAAC,EACpC,KAAK,CAAC,WAAW;AAChB,UAAI,CAAC,SAAS;AACZ,kBAAU;AACV,YAAI,MAAO,cAAa,KAAK;AAC7B,gBAAQ,EAAE,MAAM,MAAM,MAAM,QAAQ,aAAa,OAAO,CAAC;AAAA,MAC3D;AAAA,IACF,CAAC,EACA,MAAM,CAACC,WAAmB;AACzB,UAAI,CAAC,SAAS;AACZ,kBAAU;AACV,YAAI,MAAO,cAAa,KAAK;AAC7B,gBAAQ;AAAA,UACN,MAAM,MAAM;AAAA,UACZ,QAAQ;AAAA,UACR,QAAQ;AAAA,YACN,SAAS;AAAA,YACT,OAAOA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,UAC9D;AAAA,UACA,OAAOA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,QAC9D,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACH;AAEA,eAAsB,yBACpB,SACA,iBAAyB,0BACE;AAC3B,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAClC,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,CAAC,MAAM,mBAAmB,QAAQ,CAAC,CAAC,CAAC;AAAA,EAC9C;AAEA,QAAM,WAAW,QAAQ,IAAI,CAAC,UAAU,mBAAmB,KAAK,CAAC;AAEjE,MAAI,iBAAiB,GAAG;AACtB,UAAM,aAAa,IAAI,QAA0B,CAAC,YAAY;AAC5D,iBAAW,MAAM;AACf;AAAA,UACE,QAAQ,IAAI,CAAC,WAAW;AAAA,YACtB,MAAM,MAAM;AAAA,YACZ,QAAQ;AAAA,YACR,OAAO,kBAAkB,cAAc;AAAA,UACzC,EAAE;AAAA,QACJ;AAAA,MACF,GAAG,cAAc;AAAA,IACnB,CAAC;AAED,WAAO,QAAQ,KAAK,CAAC,QAAQ,IAAI,QAAQ,GAAG,UAAU,CAAC;AAAA,EACzD;AAEA,SAAO,QAAQ,IAAI,QAAQ;AAC7B;AAEA,eAAsB,2BACpB,SAC2B;AAC3B,QAAM,UAA4B,CAAC;AACnC,aAAW,SAAS,SAAS;AAC3B,YAAQ,KAAK,MAAM,mBAAmB,KAAK,CAAC;AAAA,EAC9C;AACA,SAAO;AACT;;;ACnGO,SAAS,oBAAoB,QAAmB;AACrD,QAAM,aAAa,uBAAuB,MAAM;AAGhD,QAAM,OAAO,MAAM,QAAS,OAAgE,IAAI,IAC3F,OAAgE,OAAO,CAAC,IACzE;AAEJ,QAAM,QAAS,MAAM,SAAqB,WAAW,SAAoB;AACzE,QAAM,cAAe,MAAM,eACxB,OAA+C,eAC/C,WAAW,eACZ;AACF,QAAM,WAAY,MAAM,YACrB,WAAW,YACZ,CAAC;AAEH,QAAM,QAAQ,WAAW;AACzB,QAAM,gBAAgB,MAAM,QAAQ,WAAW,QAAQ,IAAK,WAAW,WAAwB,CAAC;AAEhG,MAAI,iBAAiB;AACrB,MAAI,OAAO;AACT,qBAAiB,OAAO,QAAQ,KAAK,EAClC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AACrB,YAAM,IAAI;AACV,YAAM,OAAQ,GAAG,QAAmB;AACpC,YAAM,OAAQ,GAAG,eAA2B,GAAG,SAAoB;AACnE,YAAM,WAAW,cAAc,SAAS,GAAG,IAAI,aAAa;AAC5D,aAAO,KAAK,GAAG,KAAK,IAAI,KAAK,QAAQ,MAAM,IAAI;AAAA,IACjD,CAAC,EACA,KAAK,IAAI;AAAA,EACd;AAEA,QAAM,iBAAiB,SACpB,IAAI,CAAC,YAAY,qBAAqB,KAAK,KAAK,KAAK,UAAU,OAAO,CAAC,aAAa,EACpF,KAAK,IAAI;AAEZ,SAAO;AAAA,KAAQ,KAAK;AAAA,mBAAsB,WAAW;AAAA;AAAA,EAAsB,cAAc;AAAA;AAAA;AAAA,EAAsB,cAAc;AAAA;AAC/H;;;ACnBA,IAAM,wBAAwB;AAE9B,IAAM,SAAS;AAAA,EACb,OAAO,IAAI,OAAkB;AAAA,EAAC;AAAA,EAC9B,MAAM,IAAI,MAAiB;AACzB,YAAQ,KAAK,yBAAyB,GAAG,CAAC;AAAA,EAC5C;AAAA,EACA,OAAO,IAAI,MAAiB;AAC1B,YAAQ,MAAM,yBAAyB,GAAG,CAAC;AAAA,EAC7C;AACF;AAaO,SAAS,WAId,YAQA;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AACJ,QAAM,eAAe,GAAG,MAAM;AAE9B,QAAM,OAAyB,CAAC,UAAU;AACxC,QAAI,kBAAkB;AACpB,YAAM,eAAe,SAAS,GAAG,MAAM,mBAAmB,OAAO,SAAS,aAAa;AACrF,YAAI;AACF,gBAAM,EAAE,YAAY,SAAS,UAAU,sBAAsB,IAAI;AAEjE,cAAI,WAAW,WAAW,QAAQ;AAChC,qBAAS;AACT;AAAA,UACF;AAEA,cAAI,WAAW,YAAY,OAAO;AAChC,qBAAS;AACT;AAAA,UACF;AAEA,gBAAM,YAAqB,WAAW,YAAY;AAClD,cAAI,CAAC,WAAW;AACd,qBAAS;AACT;AAAA,UACF;AAEA,gBAAM,SAAS,aAAa,MAAM,SAAS;AAE3C,gBAAM,iBAAoD;AAAA,YACxD;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YAEA,YAAY,CAAC,OAAe,eAAe,SAAS,EAAE;AAAA,YAEtD,gBAAgB,CAAC,YAAmC;AAClD,oBAAM,SAAS,eAAe,SAAS,QAAQ,QAAQ;AACvD,kBAAI,CAAC,QAAQ;AACX,uBAAO,KAAK,mDAAmD;AAAA,kBAC7D,UAAU,QAAQ;AAAA,kBAClB;AAAA,gBACF,CAAC;AACD;AAAA,cACF;AAEA,oBAAM,UAAU,QAAQ,gBAAgB,iBAAiB,OAAO,OAAO,cAAc,IAAI,CAAC;AAC1F,oBAAM,cAAc,QAAQ,IAAI,CAAC,WAAW,oBAAoB,MAAM,CAAC,EAAE,KAAK,MAAM;AAEpF,oBAAM,cAAe,QAAoC;AACzD,oBAAM,SAAS,gBAAgB,SAAY,CAAC,WAAW,WAAW,EAAE,IAAI;AAExE,oBAAM,aAAsB;AAAA,gBAC1B,IAAI,GAAG,MAAM,cAAc,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,gBAC/E,MAAM;AAAA,gBACN,SAAS,QAAQ,WAAW,GAAG,WAAW,WAAW;AAAA,gBACrD,SAAS;AAAA,gBACT;AAAA,cACF;AAEA,kBAAI,QAAQ,aAAa,SAAS;AAChC,oBAAI,CAAC,OAAO,OAAO,UAAU;AAC3B,yBAAO,OAAO,WAAW,CAAC;AAAA,gBAC5B;AACA,uBAAO,OAAO,SAAS,KAAK,UAAU;AAAA,cACxC,WAAW,QAAQ,aAAa,UAAU;AACxC,uBAAO,OAAO,OAAO,OAAO,OAAO,GAAG,UAAU;AAAA,cAClD,OAAO;AACL,uBAAO,OAAO,OAAO,OAAO,QAAQ,GAAG,GAAG,UAAU;AAAA,cACtD;AAAA,YACF;AAAA,YAEA,eAAe,CAAC,YAAkC;AAChD,oBAAM,SAAS,eAAe,SAAS,QAAQ,QAAQ;AACvD,kBAAI,CAAC,QAAQ;AACX,uBAAO,KAAK,iDAAiD;AAAA,kBAC3D,UAAU,QAAQ;AAAA,kBAClB;AAAA,gBACF,CAAC;AACD;AAAA,cACF;AAEA,oBAAM,cAAe,QAAoC;AACzD,oBAAM,SAAS,gBAAgB,SAAY,CAAC,WAAW,WAAW,EAAE,IAAI;AAExE,oBAAM,gBAAyB;AAAA,gBAC7B,IAAI,QAAQ,MACV,GAAG,MAAM,YAAY,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,gBAC3E,MAAM,QAAQ;AAAA,gBACd,SAAS,QAAQ,WAAW;AAAA,gBAC5B,SAAS;AAAA,gBACT;AAAA,cACF;AAEA,kBAAI,QAAQ,aAAa,SAAS;AAChC,oBAAI,CAAC,OAAO,OAAO,UAAU;AAC3B,yBAAO,OAAO,WAAW,CAAC;AAAA,gBAC5B;AACA,uBAAO,OAAO,SAAS,KAAK,aAAa;AAAA,cAC3C,WAAW,QAAQ,aAAa,UAAU;AACxC,uBAAO,OAAO,OAAO,OAAO,OAAO,GAAG,aAAa;AAAA,cACrD,OAAO;AACL,uBAAO,OAAO,OAAO,OAAO,QAAQ,GAAG,GAAG,aAAa;AAAA,cACzD;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,iBAAiB,cAAc;AACrC,mBAAS;AAAA,QACX,SAASC,QAAO;AACd,iBAAO,MAAM,YAAY,MAAM,2BAA2BA,MAAK;AAC/D,mBAAS;AAAA,QACX;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,oBAAoB;AACtB,YAAM,iBAAiB,SAAS,GAAG,MAAM,qBAAqB,OAAO,SAAS,aAAa;AACzF,YAAI;AACF,gBAAM;AAAA,YACJ;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,YAAY;AAAA,UACd,IAAI;AAKJ,gBAAM,uBAAuB,sBAAsB,SAAS;AAAA,YAC1D,CAAC,MAAM,EAAE,WAAW;AAAA,UACtB;AACA,gBAAM,gBAAgB,yBACnB,kBAAkB,WAAW,SAAS,mBAAmB;AAE5D,cAAI,CAAC,eAAe;AAClB,qBAAS;AACT;AAAA,UACF;AAEA,cAAI,cAAc,YAAY,OAAO;AACnC,qBAAS;AACT;AAAA,UACF;AAEA,cAAI,SAAS,WAAW,UAAU,CAAC,SAAS,SAAS;AACnD,qBAAS;AACT;AAAA,UACF;AAEA,gBAAM,EAAE,OAAO,UAAU,UAAU,WAAW,IAAI,qBAAqB,SAAS,OAAO;AACvF,gBAAM,WAAW,SAAS,SAAS,IAAI,SAAS,CAAC,IAAI;AAErD,gBAAM,YAAqB,cAAc,YAAY;AACrD,cAAI;AACJ,cAAI,WAAW;AACb,gBAAI;AACF,uBAAS,aAAa,MAAM,SAAS;AAAA,YACvC,SAAS,YAAY;AACnB,qBAAO,KAAK,8BAA8B,MAAM,IAAI,UAAU;AAAA,YAChE;AAAA,UACF;AAEA,gBAAM,UAAU,sBAAsB;AAEtC,gBAAM,iBAAyE;AAAA,YAC7E;AAAA,YACA,YAAY;AAAA,YACZ,UAAU,sBAAsB,MAAM;AAAA,YACtC;AAAA,YACA;AAAA,YACA;AAAA,YACA,cAAc;AAAA,YACd;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YAEA,YAAY,MAAM;AAAA,YAElB,gBAAgB,MAAM;AACpB,qBAAO,KAAK,mDAAmD;AAAA,YACjE;AAAA,YAEA,eAAe,MAAM;AACnB,qBAAO,KAAK,kDAAkD;AAAA,YAChE;AAAA,YAEA,iBAAiB,OACf,UACA,aAGqB;AACrB,oBAAM,iBAAiB,OAAO,QAAQ;AACtC,kBAAI,CAAC,YAAY,SAAS,WAAW,gBAAgB;AACnD,uBAAO;AAAA,cACT;AAEA,oBAAM,aAAa,iBAAiB,QAAQ;AAC5C,kBAAI,CAAC,YAAY;AACf,uBAAO,MAAM,6BAA6B,cAAc,EAAE;AAC1D,uBAAO;AAAA,cACT;AAEA,kBAAI;AACF,sBAAM,sBAAsB,SAAS,WACnC,8BACF;AACA,oBAAI,OAAO,wBAAwB,UAAU;AAC3C,wBAAM,IAAI,MAAM,mBAAmB;AAAA,gBACrC;AACA,sBAAM,sBAAsB,WAAW,MAAM,SAAS,UAAU;AAIhE,sBAAM,iBAAiB,cAAc;AACrC,sBAAM,WAAW;AAAA,kBACf;AAAA,kBACA;AAAA,kBACA;AAAA,gBACF;AACA,oBAAI,aAAa,QAAQ;AACvB,iCAAe,cAAc;AAAA,oBAC3B,UAAU;AAAA,oBACV,YAAY;AAAA,oBACZ,QAAQ;AAAA,oBACR,SAAS;AAAA,oBACT,UAAU;AAAA,kBACZ,CAAC;AACD,iCAAe,YAAY;AAC3B,yBAAO;AAAA,gBACT;AACA,oBAAI,aAAa,WAAW;AAC1B,wBAAM,aAAa,YAAY,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AACnF,wBAAM,eAAe,MAAM,gBAAgB;AAAA,oBACzC;AAAA,oBACA,SAAS,sBAAsB,MAAM;AAAA,oBACrC,UAAU;AAAA,oBACV,YAAY;AAAA,oBACZ,cAAc,SAAS;AAAA,oBACvB,SAAS,oBAAI,KAAK;AAAA,kBACpB,CAAC;AACD,sBAAI,iBAAiB,QAAQ;AAC3B,mCAAe,cAAc;AAAA,sBAC3B,UAAU;AAAA,sBACV,YAAY;AAAA,sBACZ,QAAQ;AAAA,sBACR,SAAS;AAAA,sBACT,UAAU;AAAA,oBACZ,CAAC;AACD,mCAAe,YAAY;AAC3B,2BAAO;AAAA,kBACT;AAAA,gBACF;AAEA,sBAAM,SAAS,MAAM,SAAS,mBAAmB;AAEjD,sBAAM,qBAAsB,QAAwD,sBAAsB;AAC1G,+BAAe,cAAc;AAAA,kBAC3B,UAAU;AAAA,kBACV,YAAY;AAAA,kBACZ,QAAQ,OAAO,UACV,OAAO,QAAQ,YACf,OAAO,SAAS;AAAA,kBACrB,SAAS,CAAC,OAAO;AAAA,kBACjB,UAAU;AAAA,gBACZ,CAAC;AAED,+BAAe,YAAY;AAE3B,sBAAM,MAAM,aAAa,QAAQ;AAAA,kBAC/B;AAAA,kBACA,YAAY;AAAA,kBACZ,UAAU;AAAA,oBACR,QAAQ;AAAA,oBACR,YAAY;AAAA,oBACZ,cAAc,SAAS;AAAA,kBACzB;AAAA,kBACA;AAAA,gBACF,CAAC;AAED,uBAAO;AAAA,cACT,SAASA,QAAO;AACd,uBAAO,MAAM,0BAA0B,cAAc,IAAIA,MAAK;AAE9D,+BAAe,cAAc;AAAA,kBAC3B,UAAU;AAAA,kBACV,YAAY,SAAS;AAAA,kBACrB,QAAQA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,kBAC7D,SAAS;AAAA,kBACT,UAAU;AAAA,gBACZ,CAAC;AAED,+BAAe,YAAY;AAE3B,sBAAM,MAAM,aAAa,QAAQ;AAAA,kBAC/B;AAAA,kBACA,YAAY;AAAA,oBACV,SAAS;AAAA,oBACT,OAAOA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,kBAC9D;AAAA,kBACA,UAAU;AAAA,oBACR,QAAQ;AAAA,oBACR,YAAY,SAAS,cAAc,CAAC;AAAA,kBACtC;AAAA,gBACF,CAAC;AAED,uBAAO;AAAA,cACT;AAAA,YACF;AAAA,YAEA,eAAe,CAAC,YAAkC;AAChD,kBAAI,gBAAgB,QAAQ;AAC5B,kBAAI,cAAc,SAAS,uBAAuB;AAChD,sBAAM,YAAY,cAAc,MAAM,GAAG,qBAAqB;AAC9D,gCAAgB,GAAG,SAAS;AAAA;AAAA,mCAAmC,QAAQ,OAAO,MAAM,yBAAyB,qBAAqB;AAAA,cACpI;AAEA,oBAAM,WAAoB,MAAM;AAC9B,oBAAI;AACF,yBAAO,KAAK,MAAM,aAAa;AAAA,gBACjC,QAAQ;AACN,yBAAO;AAAA,gBACT;AAAA,cACF,GAAG;AAEH,oBAAM,oBAAiC,kBAAkB;AAAA,gBACvD,WAAW,eAAe,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,gBAC9E,gBAAgB,sBAAsB,MAAM;AAAA,gBAC5C,cAAc;AAAA,gBACd,cAAc;AAAA,gBACd,MAAM;AAAA,gBACN,OAAO,CAAC;AAAA,kBACN,MAAM;AAAA,kBACN,UAAU,QAAQ;AAAA,kBAClB,YAAY,QAAQ;AAAA,kBACpB,QAAQ;AAAA,kBACR,SAAS,QAAQ,WAAW;AAAA,kBAC5B;AAAA,gBACF,CAAC;AAAA,gBACD,UAAU,QAAQ,YAAY;AAAA,gBAC9B,UAAU;AAAA,kBACR,cAAc;AAAA,kBACd,SAAS,QAAQ,WAAW;AAAA,kBAC5B,QAAQ,QAAQ;AAAA,kBAChB,gBAAgB,QAAQ;AAAA,kBACxB,aAAa;AAAA,kBACb,YAAY;AAAA,gBACd;AAAA,cACF,CAAC;AAED,oCAAsB,MAAM,SAAS,KAAK,iBAAiB;AAE3D,oBAAM,aAAa,sBAAsB,MAAM,SAAS;AAAA,gBACtD,CAAC,MAAM,EAAE,SAAS;AAAA,cACpB;AACA,kBAAI,WAAW,SAAS,GAAG;AACzB,sBAAM,kBAAkB,WAAW,WAAW,SAAS,CAAC;AACxD,oBACE,gBAAgB,YAAY,SAAS,WACrC,CAAC,gBAAgB,UAAU,kBAC3B;AACA,kCAAgB,WAAW;AAC3B,kCAAgB,WAAW;AAAA,oBACzB,GAAG,gBAAgB;AAAA,oBACnB,kBAAkB;AAAA,oBAClB,QAAQ,QAAQ;AAAA,oBAChB,aAAa;AAAA,kBACf;AAEA,sBAAI,SAAS;AACX,0BAAM,YAAY;AAChB,0BAAI;AACF,8BAAM,QAAQ,eAAe;AAAA,sBAC/B,SAASA,QAAO;AACd,+BAAO,KAAK,+CAA+C;AAAA,0BACzD,OAAAA;AAAA,0BACA,WAAW,gBAAgB;AAAA,wBAC7B,CAAC;AAAA,sBACH;AAAA,oBACF,GAAG;AAAA,kBACL;AAAA,gBACF;AAAA,cACF;AAEA,kBAAI,SAAS;AACX,sBAAM,YAAY;AAChB,sBAAI;AACF,0BAAM,QAAQ,iBAAiB;AAC/B,sCAAkB,WAAW;AAAA,sBAC3B,GAAG,kBAAkB;AAAA,sBACrB,aAAa;AAAA,oBACf;AAAA,kBACF,SAASA,QAAO;AACd,2BAAO,KAAK,iCAAiC;AAAA,sBAC3C,OAAAA;AAAA,sBACA,WAAW,kBAAkB;AAAA,oBAC/B,CAAC;AAAA,kBACH;AAAA,gBACF,GAAG;AAAA,cACL;AAAA,YACF;AAAA,YAEA,aAAa,MAAM;AACjB,oBAAM,WAAW;AACjB,kBAAI,CAAC,SAAS,SAAS;AACrB,yBAAS,UAAU,CAAC;AAAA,cACtB;AACA,uBAAS,QAAQ,mBAAmB;AAAA,YACtC;AAAA,YAEA,cAAc,MAAM;AAClB,oBAAM,WAAW;AACjB,kBAAI,CAAC,SAAS,SAAS;AACrB,yBAAS,UAAU,CAAC;AAAA,cACtB;AACA,uBAAS,QAAQ,mBAAmB;AAAA,YACtC;AAAA,YAEA,6BAA6B,OAC3B,UACA,UAGA,YACoB;AACpB,oBAAM,iBAAiB,OAAO,QAAQ;AACtC,oBAAM,gBAAgB,SAAS,OAAO,CAAC,SAAS,KAAK,WAAW,cAAc;AAC9E,kBAAI,cAAc,WAAW,EAAG,QAAO;AAEvC,oBAAM,aAAa,iBAAiB,QAAQ;AAC5C,kBAAI,CAAC,YAAY;AACf,uBAAO,MAAM,6BAA6B,cAAc,EAAE;AAC1D,uBAAO;AAAA,cACT;AAEA,oBAAM,qBAAsB,QAAwD,sBAAsB;AAE1G,oBAAM,UAID,CAAC;AAEN,oBAAM,iBAAiB,cAAc;AACrC,oBAAM,gBAAgB;AAAA,gBACpB;AAAA,gBACA;AAAA,gBACA,cAAc,CAAC,GAAG,cAAc,CAAC;AAAA,cACnC;AACA,kBAAI,kBAAkB,QAAQ;AAC5B,2BAAW,QAAQ,eAAe;AAChC,iCAAe,cAAc;AAAA,oBAC3B,UAAU;AAAA,oBACV,YAAY,KAAK;AAAA,oBACjB,QAAQ;AAAA,oBACR,SAAS;AAAA,oBACT,UAAU;AAAA,kBACZ,CAAC;AAAA,gBACH;AACA,+BAAe,YAAY;AAC3B,uBAAO,cAAc;AAAA,cACvB;AACA,kBAAI,kBAAkB,WAAW;AAC/B,sBAAM,aAAa,kBAAkB,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AACzF,sBAAM,eAAe,MAAM,gBAAgB;AAAA,kBACzC;AAAA,kBACA,SAAS,sBAAsB,MAAM;AAAA,kBACrC,UAAU;AAAA,kBACV,YAAY;AAAA,oBACV,YAAY,cAAc;AAAA,oBAC1B,kBAAkB,cAAc,CAAC,GAAG;AAAA,kBACtC;AAAA,kBACA,SAAS,oBAAI,KAAK;AAAA,gBACpB,CAAC;AACD,oBAAI,iBAAiB,QAAQ;AAC3B,6BAAW,QAAQ,eAAe;AAChC,mCAAe,cAAc;AAAA,sBAC3B,UAAU;AAAA,sBACV,YAAY,KAAK;AAAA,sBACjB,QAAQ;AAAA,sBACR,SAAS;AAAA,sBACT,UAAU;AAAA,oBACZ,CAAC;AAAA,kBACH;AACA,iCAAe,YAAY;AAC3B,yBAAO,cAAc;AAAA,gBACvB;AAAA,cACF;AAEA,yBAAW,QAAQ,eAAe;AAChC,oBAAI;AACF,wBAAM,sBAAsB,WAAW,MAAM,KAAK,UAAU;AAG5D,0BAAQ,KAAK;AAAA,oBACX;AAAA,oBACA,UAAU,YAAY,SAAS,mBAAmB;AAAA,oBAClD,WAAW,SAAS;AAAA,kBACtB,CAAC;AAAA,gBACH,SAAS,iBAAiB;AACxB,iCAAe,cAAc;AAAA,oBAC3B,UAAU;AAAA,oBACV,YAAY,KAAK;AAAA,oBACjB,QAAQ,gCAAgC,2BAA2B,QAAQ,gBAAgB,UAAU,OAAO,eAAe,CAAC;AAAA,oBAC5H,SAAS;AAAA,oBACT,UAAU;AAAA,kBACZ,CAAC;AAAA,gBACH;AAAA,cACF;AAEA,kBAAI,QAAQ,WAAW,EAAG,QAAO,cAAc;AAE/C,kBAAI;AAMJ,kBAAI,YAAY;AACd,0BAAU,MAAM,yBAAyB,OAAO;AAAA,cAClD,OAAO;AACL,0BAAU,MAAM,2BAA2B,OAAO;AAAA,cACpD;AAEA,yBAAW,UAAU,SAAS;AAC5B,sBAAM,UAAU,OAAO,WAAW,eAC/B,OAAO,WAAW,UAAa,CAAC,OAAO,OAAO;AACjD,sBAAM,aAAa,OAAO,WAAW,YAChC,OAAO,SAAS,6BACjB,OAAO,WAAW,aACjB,OAAO,SAAS,0BACjB,OAAO,QAAQ,UACd,OAAO,OAAO,QAAQ,YACtB,OAAO,QAAQ,SAAS;AAE7B,+BAAe,cAAc;AAAA,kBAC3B,UAAU;AAAA,kBACV,YAAY,OAAO,KAAK;AAAA,kBACxB,QAAQ;AAAA,kBACR;AAAA,kBACA,UAAU;AAAA,gBACZ,CAAC;AAED,sBAAM,MAAM,aAAa,QAAQ;AAAA,kBAC/B;AAAA,kBACA,YAAY,OAAO,UAAU,EAAE,SAAS,OAAO,OAAO,WAAW;AAAA,kBACjE,UAAU;AAAA,oBACR,QAAQ;AAAA,oBACR,YAAY,OAAO,KAAK,cAAc,CAAC;AAAA,oBACvC,cAAc,OAAO,KAAK;AAAA,kBAC5B;AAAA,kBACA;AAAA,gBACF,CAAC;AAAA,cACH;AAEA,6BAAe,YAAY;AAC3B,qBAAO,cAAc;AAAA,YACvB;AAAA,UACF;AAEA,gBAAM,mBAAmB,cAAc;AACvC,mBAAS;AAAA,QACX,SAASA,QAAO;AACd,iBAAO,MAAM,YAAY,MAAM,6BAA6BA,MAAK;AACjE,mBAAS;AAAA,QACX;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,eAAe;AACjB,YAAM,YAAY;AAAA,QAChB,GAAG,MAAM;AAAA,QACT,OAAO,SAA6B,aAAa;AAC/C,cAAI;AACF,kBAAM,EAAE,YAAY,SAAS,UAAU,uBAAuB,aAAa,UAAU,IAAI;AAEzF,gBAAI,WAAW,WAAW,QAAQ;AAChC,uBAAS;AACT;AAAA,YACF;AAEA,gBAAI,WAAW,YAAY,OAAO;AAChC,uBAAS;AACT;AAAA,YACF;AAEA,kBAAM,YAAqB,WAAW,YAAY;AAClD,gBAAI,CAAC,WAAW;AACd,uBAAS;AACT;AAAA,YACF;AAEA,kBAAM,SAAS,aAAa,MAAM,SAAS;AAE3C,kBAAM,iBAA2D;AAAA,cAC/D;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cAEA,YAAY,CAAC,OAAe,eAAe,SAAS,EAAE;AAAA,cAEtD,gBAAgB,MAAM;AACpB,uBAAO,KAAK,wDAAwD;AAAA,cACtE;AAAA,cAEA,eAAe,MAAM;AACnB,uBAAO,KAAK,uDAAuD;AAAA,cACrE;AAAA,YACF;AAEA,kBAAM,cAAc,cAAc;AAClC,qBAAS;AAAA,UACX,SAASA,QAAO;AACd,mBAAO,MAAM,YAAY,MAAM,wBAAwBA,MAAK;AAC5D,qBAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,0BAAwB,EAAE,IAAI,QAAQ,IAAI;AAE1C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa,WAAW;AAAA,IACxB,aAAa,WAAW;AAAA,EAC1B;AACF;;;ACxrBA,SAAS,eAAe,OAAwE;AAC9F,SAAO,OAAO,UAAU,YAAY,UAAU;AAChD;AAEO,SAAS,mCACd,iBACA,YACsB;AACtB,QAAM,aAAa,EAAE,GAAI,mBAAmB,CAAC,EAAG;AAChD,QAAM,aAAa,MAAM,QAAQ,WAAW,OAAO,IAAI,WAAW,UAAU,CAAC;AAC7E,QAAM,iBAAiB,oBAAI,IAAqC;AAChE,QAAM,sBAAiC,CAAC;AAExC,aAAW,UAAU,YAAY;AAC/B,QAAI,eAAe,MAAM,KAAK,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,SAAS,GAAG;AAC3F,qBAAe,IAAI,OAAO,QAAQ,MAAM;AAAA,IAC1C,OAAO;AACL,0BAAoB,KAAK,MAAM;AAAA,IACjC;AAAA,EACF;AAEA,aAAW,QAAQ,cAAc,CAAC,GAAG;AACnC,QAAI,CAAC,KAAK,OAAQ;AAClB,mBAAe,IAAI,KAAK,QAAQ;AAAA,MAC9B,IAAI,GAAG,KAAK,MAAM;AAAA,MAClB,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK,WAAW;AAAA,MACzB,GAAI,KAAK,cAAc,CAAC;AAAA,IAC1B,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,MAAM,QAAQ,WAAW,OAAO,IAAI,WAAW,UAAU,CAAC;AAAA,IACnE,UAAU,MAAM,QAAQ,WAAW,QAAQ,IAAI,WAAW,WAAW;AAAA,IACrE,SAAS,CAAC,GAAG,qBAAqB,GAAG,eAAe,OAAO,CAAC;AAAA,EAC9D;AACF;;;AClCO,IAAM,yBAAN,MAA6B;AAAA,EACjB,WAAW,oBAAI,IAAyB;AAAA,EAEzD,uBAGE,YAAyG;AACzG,UAAM,iBAAiB,WAAW,UAAU;AAE5C,gCAA4B,eAAe,QAAQ,eAAe,cAAwB;AAAA,MACxF,aAAa,eAAe;AAAA,MAC5B,aAAa,eAAe;AAAA,IAC9B,CAAC;AAED,SAAK,SAAS,IAAI,eAAe,QAAQ,cAA6B;AACtE,WAAO;AAAA,EACT;AAAA,EAEA,wBAAkD;AAChD,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,kBAAkB,QAAyC;AACzD,WAAO,KAAK,SAAS,IAAI,MAAM;AAAA,EACjC;AACF;AAIA,IAAM,gCAAgC,IAAI,uBAAuB;AAE1D,SAAS,mCAA2D;AACzE,SAAO;AACT;AAEO,SAAS,uBAGd,YAAyG;AACzG,SAAO,8BAA8B,uBAAuB,UAAU;AACxE;AAEO,SAAS,wBAAkD;AAChE,SAAO,8BAA8B,sBAAsB;AAC7D;AAEO,SAAS,kBAAkB,QAAyC;AACzE,SAAO,8BAA8B,kBAAkB,MAAM;AAC/D;","names":["error","targets","maxConcurrency","newEvidence","error","error","fields","SHA256","invalid","exactFields","boundedString","digest","fields","decisions","error","error","error","invalid","invalid","isRecord","invalid","exactFields","error","fields","invalid","unsupported","operationKey","stage","publication","digest","invalid","exactFields","fields","invalid","unsupported","digest","exactFields","fields","error","record","error","error","error","error","createAgentLoopRunner","createAgentLoopScriptRunner","TRUST_RANK","TRUST_RANK","CLASSIFICATION_RANK","SHA256","FORBIDDEN_ATTRIBUTE","encoder","forbidden","DEFAULT_RATE_PER_MINUTE","isRecord","error","encoder","canonicalize","TRUST_RANK","withScheduledCondition","error","error","message","digest","error","error","digest","isRecord","reject","o","error","error","error"]}
+{"version":3,"sources":["../src/orchestration/artifacts/verifierOnlyTransitions.ts","../src/orchestration/artifacts/artifactReviewWriter.ts","../src/orchestration/controllerRunner.ts","../src/orchestration/controllers/fleetRollout.ts","../src/orchestration/controlStore.ts","../src/orchestration/controllers/storageReplication.ts","../src/orchestration/controlStoreClient.ts","../src/orchestration/credentialGrantController.ts","../src/orchestration/drivers/controlStoreAuditTelemetryAdapter.ts","../src/orchestration/drivers/controlStorePolicyApprovalAdapter.ts","../src/orchestration/drivers/driverConformance.ts","../src/orchestration/drivers/driverConformanceFixtures.ts","../src/orchestration/drivers/externalDriver.ts","../src/orchestration/drivers/externalToolContract.ts","../src/orchestration/drivers/externalWorkloadContract.ts","../src/orchestration/drivers/localModelRegistration.ts","../src/orchestration/drivers/managedArtifactAdapter.ts","../src/orchestration/drivers/storageDriver.ts","../src/orchestration/drivers/managedStorageDriverAdapter.ts","../src/orchestration/drivers/managedToolExecutionRoute.ts","../src/orchestration/security/workerIdentity.ts","../src/orchestration/drivers/managedWorkerIdentityAdapter.ts","../src/orchestration/drivers/modelEndpointRegistrar.ts","../src/orchestration/drivers/modelGateway.ts","../src/orchestration/drivers/toolExecutionDriver.ts","../src/orchestration/externalOrchestrationController.ts","../src/orchestration/loopRuntimeDriver.ts","../src/orchestration/modelEndpointBindingController.ts","../src/orchestration/networkAttachmentController.ts","../src/orchestration/runVolumeController.ts","../src/orchestration/scheduler.ts","../src/orchestration/security/auditRecordAuthorizer.ts","../src/orchestration/security/credentialBroker.ts","../src/orchestration/security/identityLifecycle.ts","../src/orchestration/security/nodeTrustAdmission.ts","../src/orchestration/security/policyDecisionAuthorizer.ts","../src/orchestration/security/quarantineGateway.ts","../src/orchestration/security/workerProtocol.ts","../src/orchestration/security/workloadCapabilityGrant.ts","../src/orchestration/stores/quorumControlStore.ts","../src/orchestration/toolOperationController.ts","../src/orchestration/volumeClaimController.ts","../src/orchestration/workloadExecutionController.ts","../src/loopAPI/controlStoreLoopCheckpointStore.ts","../src/types.ts","../src/storage/conformance.ts","../src/storage/sessionStorage.ts","../src/agent/tiddlerTemplateConverter.ts","../src/network/gitProxyUrlPolicy.ts","../src/network/uri.ts","../src/device-network/agentRuntimeRpcHandler.ts","../src/device-network/peerDriverTransport.ts","../src/network/terminalNotifications.ts","../src/im/channelManager.ts","../src/im/imPlatformLimits.ts","../src/im/slashCommands.ts","../src/im/streamAgentReplyToIm.ts","../src/im/textRenderer.ts","../src/im/tools.ts","../src/tools/builtins/imBuiltinTools.ts","../src/tools/builtins/index.ts","../src/tools/parallelExecution.ts","../src/tools/schemaToToolContent.ts","../src/tools/defineTool.ts","../src/tools/hostAgentTools.ts","../src/tools/toolRegistry.ts"],"sourcesContent":["import type { ControlStoreAuthorizationRequest } from '../controlStore.js';\nimport type { ArtifactRecordResource, ArtifactRecordStatus, ArtifactReviewEvidence } from '../resources.js';\nimport { ARTIFACT_RECORD_KIND } from '../resources.js';\n\n/**\n * Verifier-only protected transitions for ArtifactRecord (plan 24.52).\n *\n * Artifact review evidence (scan, sanitize, verify) can only be appended by\n * verifier actors. Storage drivers, controllers, and workers cannot write\n * review outcomes or unquarantine artifacts. This ensures that trust\n * promotion is always grounded in an external, attested verification step.\n */\n\nexport interface VerifierOnlyTransitionOptions {\n  /** Actor ID prefix that identifies trusted verifiers. */\n  verifierActorPrefix?: string;\n  /** Allow quarantine by any actor (fail-safe). Default: true. */\n  allowAnyActorQuarantine?: boolean;\n}\n\nconst DEFAULT_VERIFIER_PREFIX = 'verifier/';\n\n/**\n * Create a ControlStore authorizer that enforces verifier-only transitions\n * for ArtifactRecord resources.\n *\n * Rules:\n * 1. Only verifier actors may append reviews or change quarantine status.\n * 2. Review evidence must be bound to the current content hash.\n * 3. Review evidence must record the verifier's actor ID.\n * 4. Quarantine is fail-safe: any actor may quarantine, but only verifiers\n *    may unquarantine (by appending a passing verify review).\n * 5. Non-verifier actors may still read and create ArtifactRecords.\n */\nexport function createVerifierOnlyAuthorizer(\n  options: VerifierOnlyTransitionOptions = {},\n): (request: ControlStoreAuthorizationRequest) => void {\n  const verifierPrefix = options.verifierActorPrefix ?? DEFAULT_VERIFIER_PREFIX;\n  const allowAnyActorQuarantine = options.allowAnyActorQuarantine ?? true;\n\n  return (request: ControlStoreAuthorizationRequest) => {\n    if (request.reference.kind !== ARTIFACT_RECORD_KIND) return;\n\n    const { actor, verb, current, proposedStatus } = request;\n\n    if (verb === 'create') {\n      // Creation is allowed for any actor; trust is set in spec at creation.\n      return;\n    }\n\n    if (verb === 'update-status' && current && proposedStatus) {\n      const currentStatus = current.status as ArtifactRecordStatus | undefined;\n      const proposed = proposedStatus as ArtifactRecordStatus;\n\n      const currentReviews = currentStatus?.reviews ?? [];\n      const proposedReviews = proposed.reviews ?? [];\n\n      // If no review changes and no quarantine change, allow.\n      const reviewsUnchanged = currentReviews.length === proposedReviews.length &&\n        currentReviews.every((review, index) => {\n          const proposedReview = proposedReviews[index];\n          return (\n            review.kind === proposedReview.kind &&\n            review.outcome === proposedReview.outcome &&\n            review.reviewer === proposedReview.reviewer &&\n            review.contentHash === proposedReview.contentHash &&\n            review.policyDigest === proposedReview.policyDigest &&\n            review.recordedAt === proposedReview.recordedAt &&\n            review.destinations.length === proposedReview.destinations.length &&\n            review.destinations.every((destination, destinationIndex) => destination === proposedReview.destinations[destinationIndex])\n          );\n        });\n      const currentQuarantined = currentStatus?.quarantined ?? false;\n      const proposedQuarantined = proposed.quarantined ?? false;\n      const quarantineUnchanged = currentQuarantined === proposedQuarantined &&\n        (currentStatus?.quarantineReason ?? '') === (proposed.quarantineReason ?? '');\n\n      if (reviewsUnchanged && quarantineUnchanged) {\n        return;\n      }\n\n      // Quarantine is fail-safe: any actor may quarantine.\n      const isQuarantineOnly = !currentStatus?.quarantined &&\n        proposed.quarantined === true &&\n        reviewsUnchanged;\n\n      if (isQuarantineOnly && allowAnyActorQuarantine) {\n        return;\n      }\n\n      // All other transitions require a verifier actor.\n      if (!actor.id.startsWith(verifierPrefix)) {\n        throw new Error(\n          `ArtifactRecord review and unquarantine transitions require a verifier actor (prefix: ${verifierPrefix}), got ${actor.id}`,\n        );\n      }\n\n      // New reviews must be appended, not modified or removed.\n      if (proposedReviews.length < currentReviews.length) {\n        throw new Error('ArtifactRecord reviews cannot be removed');\n      }\n      for (let index = 0; index < currentReviews.length; index += 1) {\n        if (currentReviews[index] !== proposedReviews[index]) {\n          throw new Error('ArtifactRecord reviews cannot be modified');\n        }\n      }\n\n      // Validate each new review.\n      const newReviews = proposedReviews.slice(currentReviews.length);\n      const artifact = current as unknown as ArtifactRecordResource;\n      for (const review of newReviews) {\n        validateReviewEvidence(review, artifact, actor.id);\n      }\n\n      return;\n    }\n  };\n}\n\nfunction validateReviewEvidence(\n  review: ArtifactReviewEvidence,\n  artifact: ArtifactRecordResource,\n  actorId: string,\n): void {\n  if (review.contentHash !== artifact.spec.contentHash) {\n    throw new Error(\n      `Review contentHash ${review.contentHash} does not match artifact contentHash ${artifact.spec.contentHash}`,\n    );\n  }\n  if (review.reviewer !== actorId) {\n    throw new Error(\n      `Review reviewer ${review.reviewer} must match the acting verifier ${actorId}`,\n    );\n  }\n  if (review.recordedAt.length === 0) {\n    throw new Error('Review must record recordedAt timestamp');\n  }\n}\n\n/**\n * Check whether an actor ID belongs to a verifier.\n */\nexport function isVerifierActor(actorId: string, verifierPrefix: string = DEFAULT_VERIFIER_PREFIX): boolean {\n  return actorId.startsWith(verifierPrefix);\n}\n","import type { OrchestrationResource } from '../client.js';\nimport type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport type { ArtifactRecordResource, ArtifactRecordStatus, ArtifactReviewEvidence } from '../resources.js';\nimport { ARTIFACT_RECORD_KIND } from '../resources.js';\nimport type { ArtifactReviewWriter } from './artifactTrust.js';\nimport { createVerifierOnlyAuthorizer } from './verifierOnlyTransitions.js';\n\n/**\n * ControlStore-backed ArtifactReviewWriter (plan 24.47).\n *\n * Every review append or quarantine goes through ControlStore.updateStatus,\n * protected by the verifier-only authorizer. The authorizer is injected so\n * callers in different hosts can wire the verifier actor prefix appropriate\n * to their trust model.\n */\n\nexport function createControlStoreArtifactReviewWriter(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  authorizer: ReturnType<typeof createVerifierOnlyAuthorizer> = createVerifierOnlyAuthorizer(),\n): ArtifactReviewWriter {\n  return {\n    async appendReview(_contentHash: string, evidence: ArtifactReviewEvidence) {\n      const current = await store.get({\n        kind: ARTIFACT_RECORD_KIND,\n        namespace: 'default',\n        name: evidence.contentHash,\n        apiVersion: 'execution.memeloop.io/v1alpha1',\n      }) as unknown as ArtifactRecordResource | null;\n\n      if (!current) {\n        throw new Error(`ArtifactRecord not found for contentHash ${evidence.contentHash}`);\n      }\n\n      const currentReviews = current.status?.reviews ?? [];\n      const proposedStatus: ArtifactRecordStatus = {\n        ...current.status,\n        reviews: [...currentReviews, evidence],\n      };\n\n      // Authorize: verifier-only transition.\n      authorizer({\n        actor,\n        verb: 'update-status',\n        reference: {\n          kind: ARTIFACT_RECORD_KIND,\n          namespace: 'default',\n          name: evidence.contentHash,\n          apiVersion: 'execution.memeloop.io/v1alpha1',\n        },\n        current: current as unknown as OrchestrationResource,\n        proposedStatus,\n      });\n\n      await store.updateStatus(\n        actor,\n        {\n          kind: ARTIFACT_RECORD_KIND,\n          namespace: current.metadata.namespace,\n          name: current.metadata.name,\n          apiVersion: current.apiVersion,\n        },\n        proposedStatus,\n        { resourceVersion: current.metadata.resourceVersion },\n      );\n    },\n\n    async quarantine(contentHash: string, reason: string) {\n      const current = await store.get({\n        kind: ARTIFACT_RECORD_KIND,\n        namespace: 'default',\n        name: contentHash,\n        apiVersion: 'execution.memeloop.io/v1alpha1',\n      }) as unknown as ArtifactRecordResource | null;\n\n      if (!current) {\n        throw new Error(`ArtifactRecord not found for contentHash ${contentHash}`);\n      }\n\n      const proposedStatus: ArtifactRecordStatus = {\n        ...current.status,\n        quarantined: true,\n        quarantineReason: reason,\n      };\n\n      // Authorize: any actor may quarantine (fail-safe).\n      authorizer({\n        actor,\n        verb: 'update-status',\n        reference: {\n          kind: ARTIFACT_RECORD_KIND,\n          namespace: 'default',\n          name: contentHash,\n          apiVersion: 'execution.memeloop.io/v1alpha1',\n        },\n        current: current as unknown as OrchestrationResource,\n        proposedStatus,\n      });\n\n      await store.updateStatus(\n        actor,\n        {\n          kind: ARTIFACT_RECORD_KIND,\n          namespace: current.metadata.namespace,\n          name: current.metadata.name,\n          apiVersion: current.apiVersion,\n        },\n        proposedStatus,\n        { resourceVersion: current.metadata.resourceVersion },\n      );\n    },\n  };\n}\n","import type { OrchestrationResource, OrchestrationResourceStatus } from './client.js';\nimport type { ControlStore, ControlStoreActor } from './controlStore.js';\n\nexport interface ControllerReconcileRequest<\n  TSpec = Record<string, unknown>,\n  TStatus = OrchestrationResourceStatus,\n> {\n  resource: OrchestrationResource<TSpec, TStatus>;\n  actor: ControlStoreActor;\n  leaseEpoch: string;\n  now: Date;\n}\n\nexport interface ControllerReconcileResult<\n  TStatus extends OrchestrationResourceStatus = OrchestrationResourceStatus,\n> {\n  /** New status to write; omit to leave status unchanged. */\n  status?: TStatus;\n  /** If true, the resource is ready; controller stops reconciling until it changes. */\n  ready?: boolean;\n  /** Optional requeue delay when the controller wants to try again later. */\n  requeueAfterMs?: number;\n}\n\nexport interface Controller<\n  TSpec = Record<string, unknown>,\n  TStatus extends OrchestrationResourceStatus = OrchestrationResourceStatus,\n> {\n  reconcile(request: ControllerReconcileRequest<TSpec, TStatus>): Promise<ControllerReconcileResult<TStatus>>;\n}\n\nexport interface ControllerRunnerOptions<\n  TSpec = Record<string, unknown>,\n  TStatus extends OrchestrationResourceStatus = OrchestrationResourceStatus,\n> {\n  /** Controller identity used for all ControlStore writes. */\n  actor: ControlStoreActor;\n  /** Lease name; controllers with the same name compete for the lease. */\n  leaseName: string;\n  /** Resource kind this controller reconciles (passed to ControlStore.watch). */\n  watchKind: string;\n  /** How long the lease is valid before it must be renewed. */\n  leaseTtlMs: number;\n  /** How often to renew the lease while running. */\n  leaseRenewIntervalMs?: number;\n  /** Initial backoff after a reconcile failure. */\n  retryBaseDelayMs?: number;\n  /** Maximum backoff after consecutive reconcile failures. */\n  retryMaxDelayMs?: number;\n  /** Filter which resources this controller reconciles. */\n  resourceFilter?: (resource: OrchestrationResource<TSpec, TStatus>) => boolean;\n  /** Injectable clock for deterministic tests. */\n  now?: () => Date;\n  /** Injectable sleep for deterministic tests. */\n  sleep?: (ms: number) => Promise<void>;\n}\n\nexport interface ControllerRunnerHandle {\n  /** Stop watching and release the lease. */\n  stop(): Promise<void>;\n  /** Wait until the runner has fully stopped. */\n  done(): Promise<void>;\n}\n\n/**\n * Restart-safe generic controller runner.\n *\n * Watches a ControlStore query, acquires a lease, and calls `controller.reconcile`\n * for each matching resource. On success it may update status and mark Ready.\n * On failure it retries with exponential backoff. If the process crashes, the\n * lease expires and another runner takes over; watch replay resumes from the\n * last acknowledged resource version.\n */\nexport async function createControllerRunner<\n  TSpec = Record<string, unknown>,\n  TStatus extends OrchestrationResourceStatus = OrchestrationResourceStatus,\n>(\n  store: ControlStore,\n  controller: Controller<TSpec, TStatus>,\n  options: ControllerRunnerOptions<TSpec, TStatus>,\n): Promise<ControllerRunnerHandle> {\n  const now = options.now ?? (() => new Date());\n  const sleep = options.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n  const leaseRenewInterval = options.leaseRenewIntervalMs ?? Math.max(1, Math.floor(options.leaseTtlMs / 3));\n  const retryBaseDelay = options.retryBaseDelayMs ?? 100;\n  const retryMaxDelay = options.retryMaxDelayMs ?? 30_000;\n\n  let stopped = false;\n  let currentLease: Awaited<ReturnType<ControlStore['acquireLease']>> | null = null;\n  const pendingRetries = new Map<string, ReturnType<typeof setTimeout>>();\n  let stopWatch: (() => void) | null = null;\n\n  // Acquire the lease before watching so a standby runner does not process\n  // stale events from before it became leader.\n  currentLease = await store.acquireLease(options.actor, {\n    name: options.leaseName,\n    holder: options.actor.id,\n    ttlMs: options.leaseTtlMs,\n  });\n\n  const stopPromise = (async () => {\n    if (stopped) {\n      await store.releaseLease(options.actor, currentLease).catch(() => undefined);\n      currentLease = null;\n      return;\n    }\n\n    const renewTimer = setInterval(async () => {\n      if (stopped || !currentLease) return;\n      try {\n        currentLease = await store.renewLease(options.actor, currentLease, options.leaseTtlMs);\n      } catch {\n        // Lost lease (or the store went away); stop reconciling and let\n        // another runner take over. Break the watch loop and stop renewing\n        // so a closed store does not leave a live timer behind.\n        stopped = true;\n        clearInterval(renewTimer);\n        stopWatch?.();\n      }\n    }, leaseRenewInterval);\n\n    const watcher = store.watch<TSpec, TStatus>(\n      { kind: options.watchKind },\n      { sendInitialEvents: true },\n    );\n    const iterator = watcher[Symbol.asyncIterator]();\n    stopWatch = () => void iterator.return?.();\n\n    try {\n      while (!stopped) {\n        const result = await iterator.next();\n        if (result.done === true || result.value === undefined) break;\n        const event = result.value;\n        if (event.type !== 'ADDED' && event.type !== 'MODIFIED') continue;\n\n        const resource = event.resource;\n        if (\n          options.resourceFilter &&\n          !options.resourceFilter(resource)\n        ) continue;\n\n        const key = `${resource.metadata.namespace}/${resource.metadata.name}`;\n        if (pendingRetries.has(key)) continue;\n\n        await reconcileWithRetry(key, resource);\n      }\n    } finally {\n      clearInterval(renewTimer);\n      for (const timer of pendingRetries.values()) clearTimeout(timer);\n      pendingRetries.clear();\n      if (currentLease) {\n        await store.releaseLease(options.actor, currentLease).catch(() => undefined);\n        currentLease = null;\n      }\n    }\n  })();\n\n  async function reconcileWithRetry(\n    key: string,\n    resource: OrchestrationResource<TSpec, TStatus>,\n    attempt = 0,\n  ): Promise<void> {\n    if (stopped || !currentLease) return;\n\n    try {\n      const result = await controller.reconcile({\n        resource,\n        actor: options.actor,\n        leaseEpoch: currentLease.epoch,\n        now: now(),\n      });\n\n      if (result.status && Object.keys(result.status).length > 0) {\n        await store.updateStatus(\n          options.actor,\n          {\n            apiVersion: resource.apiVersion,\n            kind: resource.kind,\n            namespace: resource.metadata.namespace,\n            name: resource.metadata.name,\n          },\n          result.status,\n          {\n            resourceVersion: resource.metadata.resourceVersion,\n          },\n        );\n      }\n\n      if (result.requeueAfterMs !== undefined && result.requeueAfterMs > 0) {\n        const timer = setTimeout(() => {\n          pendingRetries.delete(key);\n          if (!stopped) void regetAndReconcile(key, resource, 0);\n        }, result.requeueAfterMs);\n        pendingRetries.set(key, timer);\n      }\n    } catch {\n      const delay = Math.min(retryMaxDelay, retryBaseDelay * 2 ** attempt);\n      const timer = setTimeout(() => {\n        pendingRetries.delete(key);\n        if (!stopped) void regetAndReconcile(key, resource, attempt + 1);\n      }, delay);\n      pendingRetries.set(key, timer);\n    }\n  }\n\n  /**\n   * Requeue/retry must reconcile the CURRENT resource, not the snapshot the\n   * timer captured: controllers whose progress lives in status (e.g. fleet\n   * rollout batches) would otherwise reprocess the same stage forever and\n   * fail every status CAS against the newer resourceVersion.\n   */\n  async function regetAndReconcile(\n    key: string,\n    fallback: OrchestrationResource<TSpec, TStatus>,\n    attempt: number,\n  ): Promise<void> {\n    let current: OrchestrationResource<TSpec, TStatus> | null;\n    try {\n      current = await store.get<TSpec, TStatus>({\n        apiVersion: fallback.apiVersion,\n        kind: fallback.kind,\n        namespace: fallback.metadata.namespace,\n        name: fallback.metadata.name,\n      });\n    } catch {\n      // An unavailable current read is uncertainty, not permission to act on\n      // the captured snapshot. Retry the read with backoff and do no work\n      // until the authoritative resource can be observed again.\n      const delay = Math.min(retryMaxDelay, retryBaseDelay * 2 ** attempt);\n      const timer = setTimeout(() => {\n        pendingRetries.delete(key);\n        if (!stopped) void regetAndReconcile(key, fallback, attempt + 1);\n      }, delay);\n      pendingRetries.set(key, timer);\n      return;\n    }\n    // A deleted resource must never fall back to the stale snapshot: doing\n    // so can repeat a side effect after its cancellation/delete request.\n    if (!current) return;\n    await reconcileWithRetry(key, current, attempt);\n  }\n\n  return {\n    async stop() {\n      stopped = true;\n      stopWatch?.();\n      // Release the lease immediately; do not wait for a potentially stuck watch.\n      if (currentLease) {\n        await store.releaseLease(options.actor, currentLease).catch(() => undefined);\n        currentLease = null;\n      }\n      // Give the background loop a short grace period to clean up timers.\n      await Promise.race([\n        stopPromise.catch(() => undefined),\n        sleep(50),\n      ]);\n    },\n    done: () => stopPromise,\n  };\n}\n","import type { OrchestrationResource } from '../client.js';\nimport type { Controller, ControllerReconcileResult } from '../controllerRunner.js';\nimport type { ControlStore, ControlStoreActor } from '../controlStore.js';\n\nexport const FLEET_ROLLOUT_API_VERSION = 'fleet.memeloop.io/v1alpha1';\nexport const FLEET_ROLLOUT_KIND = 'FleetRollout';\n\nexport type RolloutStrategy = 'batch' | 'canary';\n\nexport interface FleetRolloutSpec {\n  /** Target resource kind to roll out (e.g. AgentWorkload). */\n  targetKind: string;\n  /** Target namespace. */\n  targetNamespace?: string;\n  /** Label selector for target resources. */\n  selector?: Record<string, string>;\n  /** Rollout strategy. */\n  strategy: RolloutStrategy;\n  /** Batch size for batch strategy. */\n  batchSize?: number;\n  /** Canary stages for canary strategy. */\n  canaryStages?: Array<{\n    weight: number;\n    pauseDurationMs?: number;\n  }>;\n  /** Maximum unavailable resources during rollout. */\n  maxUnavailable?: number;\n  /** Maximum surge resources during rollout. */\n  maxSurge?: number;\n  /** Maximum concurrent target updates (default: 1 = sequential). */\n  maxConcurrency?: number;\n  /** Rollout deadline in milliseconds. */\n  deadlineMs?: number;\n  /** Pause rollout on failure threshold. */\n  pauseOnFailureThreshold?: number;\n  /**\n   * Pause when at least this many targets report drift — the host observed\n   * their actual state diverging from the desired template (§8.4/§8.8).\n   */\n  pauseOnDriftThreshold?: number;\n  /**\n   * Pause when at least this many targets carry host-reported security\n   * findings (§8.8). Fail-safe recommendation: 1 (any finding pauses).\n   */\n  pauseOnSecurityThreshold?: number;\n  /** Automatically rollback updated targets when failure threshold is reached. */\n  autoRollback?: boolean;\n  /**\n   * Aggregate budget for the whole rollout (§8.8 cost threshold). Usage is\n   * metered from per-target update results; the rollout pauses between\n   * batches/stages once a limit is reached (overshoot is bounded by the\n   * in-flight batch).\n   */\n  budget?: {\n    maxTokens?: number;\n    maxCost?: number;\n  };\n  /**\n   * Per-run budget cap for a single target (§8: bounded per-run model\n   * budget). A target whose reported usage exceeds the cap counts as a\n   * failure with a budget reason.\n   */\n  perTargetBudget?: {\n    maxTokens?: number;\n    maxCost?: number;\n  };\n}\n\n/** Metered model usage reported by a target update (tokens/cost). */\nexport interface TargetUsage {\n  tokens?: number;\n  cost?: number;\n}\n\n/** Result of updating one target; usage feeds rollout budget accounting. */\nexport interface TargetUpdateResult {\n  usage?: TargetUsage;\n}\n\nexport interface RolloutEvidenceEntry {\n  resourceName: string;\n  outcome: 'success' | 'failure' | 'skipped';\n  message?: string;\n  timestamp: string;\n  /** Metered model usage for this target's run. */\n  usage?: TargetUsage;\n}\n\n/** Sum metered usage across evidence entries (idempotent accounting). */\nexport function sumEvidenceUsage(evidence: readonly RolloutEvidenceEntry[] | undefined): { tokens: number; cost: number } {\n  let tokens = 0;\n  let cost = 0;\n  for (const event of evidence ?? []) {\n    tokens += event.usage?.tokens ?? 0;\n    cost += event.usage?.cost ?? 0;\n  }\n  // Round float noise from per-target cost accumulation (deterministic status).\n  return { tokens: Math.round(tokens * 1e6) / 1e6, cost: Math.round(cost * 1e6) / 1e6 };\n}\n\nfunction budgetExceeded(budget: FleetRolloutSpec['budget'], consumed: { tokens: number; cost: number }): string | undefined {\n  if (!budget) return undefined;\n  if (budget.maxTokens !== undefined && consumed.tokens >= budget.maxTokens) {\n    return `tokens ${consumed.tokens} >= ${budget.maxTokens}`;\n  }\n  if (budget.maxCost !== undefined && consumed.cost >= budget.maxCost) {\n    return `cost ${consumed.cost} >= ${budget.maxCost}`;\n  }\n  return undefined;\n}\n\nfunction perTargetBudgetExceeded(cap: FleetRolloutSpec['perTargetBudget'], usage: TargetUsage | undefined): string | undefined {\n  if (!cap || !usage) return undefined;\n  if (cap.maxTokens !== undefined && (usage.tokens ?? 0) > cap.maxTokens) {\n    return `tokens ${usage.tokens} > per-run cap ${cap.maxTokens}`;\n  }\n  if (cap.maxCost !== undefined && (usage.cost ?? 0) > cap.maxCost) {\n    return `cost ${usage.cost} > per-run cap ${cap.maxCost}`;\n  }\n  return undefined;\n}\n\n/**\n * Process targets with bounded concurrency. Returns evidence for each target.\n * Targets exceeding the per-run budget cap are converted to failures (§8).\n */\nasync function processTargetsBounded(\n  targets: RolloutTarget[],\n  updateFunction: (target: RolloutTarget) => Promise<TargetUpdateResult | undefined>,\n  maxConcurrency: number,\n  now: () => Date,\n  perTargetBudget?: FleetRolloutSpec['perTargetBudget'],\n): Promise<RolloutEvidenceEntry[]> {\n  const results: RolloutEvidenceEntry[] = [];\n  const queue = [...targets];\n\n  async function worker(): Promise<void> {\n    while (queue.length > 0) {\n      const target = queue.shift()!;\n      try {\n        const result = await updateFunction(target);\n        const budgetViolation = perTargetBudgetExceeded(perTargetBudget, result?.usage);\n        if (budgetViolation) {\n          results.push({\n            resourceName: target.name,\n            outcome: 'failure',\n            message: `per-target budget exceeded: ${budgetViolation}`,\n            timestamp: now().toISOString(),\n            ...(result?.usage ? { usage: result.usage } : {}),\n          });\n        } else {\n          results.push({\n            resourceName: target.name,\n            outcome: 'success',\n            timestamp: now().toISOString(),\n            ...(result?.usage ? { usage: result.usage } : {}),\n          });\n        }\n      } catch (error) {\n        results.push({\n          resourceName: target.name,\n          outcome: 'failure',\n          message: error instanceof Error ? error.message : String(error),\n          timestamp: now().toISOString(),\n        });\n      }\n    }\n  }\n\n  const concurrency = Math.min(maxConcurrency, targets.length);\n  await Promise.all(Array.from({ length: concurrency }, () => worker()));\n  return results;\n}\n\nexport interface FleetRolloutStatus {\n  phase?: 'Pending' | 'Rolling' | 'Paused' | 'Completed' | 'Failed' | 'RolledBack';\n  currentBatch?: number;\n  currentCanaryStage?: number;\n  updatedReplicas?: number;\n  readyReplicas?: number;\n  availableReplicas?: number;\n  unavailableReplicas?: number;\n  observedGeneration?: number;\n  startedAt?: string;\n  completedAt?: string;\n  pausedAt?: string;\n  pauseReason?: string;\n  failedAt?: string;\n  failureReason?: string;\n  deadlineExceeded?: boolean;\n  rollbackReason?: string;\n  /** Aggregate metered usage across all processed targets (§8 cost). */\n  consumedBudget?: { tokens: number; cost: number };\n  evidence?: RolloutEvidenceEntry[];\n}\n\nexport type FleetRolloutResource = OrchestrationResource<FleetRolloutSpec>;\n\nexport interface RolloutTarget {\n  name: string;\n  namespace?: string;\n  generation: number;\n  available: boolean;\n  /** Host observation: actual state diverged from the desired template (§8.4). */\n  drifted?: boolean;\n  /** Host-reported security finding on this target (§8.8). */\n  securityFlagged?: boolean;\n}\n\nexport interface FleetRolloutControllerOptions {\n  actor: ControlStoreActor;\n  listTargets: (rollout: FleetRolloutResource) => Promise<RolloutTarget[]>;\n  updateTarget: (rollout: FleetRolloutResource, target: RolloutTarget) => Promise<TargetUpdateResult | undefined>;\n  rollbackTarget: (rollout: FleetRolloutResource, target: RolloutTarget) => Promise<void>;\n  now?: () => Date;\n}\n\n/**\n * Create a controller that manages FleetRollout resources.\n *\n * The controller implements batch and canary rollout strategies with\n * maxUnavailable, pause on failure, deadline, and rollback support.\n */\nexport function createFleetRolloutController(\n  _store: ControlStore,\n  options: FleetRolloutControllerOptions,\n): Controller<FleetRolloutSpec> {\n  const now = options.now ?? (() => new Date());\n\n  async function reconcileRollout(request: Parameters<Controller<FleetRolloutSpec>['reconcile']>[0]): Promise<ControllerReconcileResult> {\n    const rollout = request.resource as FleetRolloutResource;\n    const status: FleetRolloutStatus = rollout.status ?? {};\n    const spec = rollout.spec;\n\n    // Skip completed or failed rollouts.\n    if (status.phase === 'Completed' || status.phase === 'Failed' || status.phase === 'RolledBack') {\n      return { ready: true };\n    }\n\n    // Initialize rollout on first reconcile.\n    if (!status.phase) {\n      return {\n        status: {\n          ...status,\n          phase: 'Rolling',\n          currentBatch: 0,\n          currentCanaryStage: 0,\n          updatedReplicas: 0,\n          readyReplicas: 0,\n          availableReplicas: 0,\n          unavailableReplicas: 0,\n          startedAt: now().toISOString(),\n          evidence: [],\n        } as FleetRolloutStatus,\n        ready: false,\n      };\n    }\n\n    // Check deadline.\n    const deadlineMs: number | undefined = spec.deadlineMs;\n    const startedAt: string | undefined = status.startedAt;\n    if (deadlineMs && startedAt) {\n      const elapsed = now().getTime() - new Date(startedAt).getTime();\n      if (elapsed > deadlineMs) {\n        if (spec.autoRollback) {\n          const targets = await options.listTargets(rollout);\n          const updatedTargets = (status.evidence ?? [])\n            .filter((event) => event.outcome === 'success')\n            .map((event) => targets.find((t) => t.name === event.resourceName))\n            .filter((t): t is RolloutTarget => t !== undefined);\n          for (const target of updatedTargets) {\n            try {\n              await options.rollbackTarget(rollout, target);\n            } catch { /* best-effort */ }\n          }\n        }\n        return {\n          status: {\n            ...status,\n            phase: spec.autoRollback ? 'RolledBack' : 'Failed',\n            failedAt: now().toISOString(),\n            failureReason: 'rollout deadline exceeded',\n            deadlineExceeded: true,\n            rollbackReason: spec.autoRollback ? 'deadline exceeded' : undefined,\n          } as FleetRolloutStatus,\n          ready: true,\n        };\n      }\n    }\n\n    // Check pause.\n    if (status.phase === 'Paused') {\n      return { ready: true };\n    }\n\n    const targets = await options.listTargets(rollout);\n    const evidence: NonNullable<FleetRolloutStatus['evidence']> = status.evidence ?? [];\n\n    // Count current state.\n    const totalReplicas = targets.length;\n    const updatedReplicas = evidence.filter((event) => event.outcome === 'success').length;\n    const failedReplicas = evidence.filter((event) => event.outcome === 'failure').length;\n    const availableReplicas = targets.filter((t) => t.available).length;\n    const unavailableReplicas = totalReplicas - availableReplicas;\n\n    // §8.8 automatic pause thresholds: security first (fail-safe), then\n    // drift, then aggregate cost. These pause for human/verifier decision;\n    // autoRollback remains scoped to failure threshold and deadline.\n    const securityFlagged = targets.filter((t) => t.securityFlagged).length;\n    if (spec.pauseOnSecurityThreshold !== undefined && securityFlagged >= spec.pauseOnSecurityThreshold) {\n      return {\n        status: {\n          ...status,\n          phase: 'Paused',\n          pausedAt: now().toISOString(),\n          pauseReason: `security threshold exceeded: ${securityFlagged} flagged >= ${spec.pauseOnSecurityThreshold}`,\n          updatedReplicas,\n          readyReplicas: updatedReplicas,\n          availableReplicas,\n          unavailableReplicas,\n          evidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    const driftedCount = targets.filter((t) => t.drifted).length;\n    if (spec.pauseOnDriftThreshold !== undefined && driftedCount >= spec.pauseOnDriftThreshold) {\n      return {\n        status: {\n          ...status,\n          phase: 'Paused',\n          pausedAt: now().toISOString(),\n          pauseReason: `drift threshold exceeded: ${driftedCount} drifted >= ${spec.pauseOnDriftThreshold}`,\n          updatedReplicas,\n          readyReplicas: updatedReplicas,\n          availableReplicas,\n          unavailableReplicas,\n          evidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    const budgetViolation = budgetExceeded(spec.budget, sumEvidenceUsage(evidence));\n    if (budgetViolation) {\n      return {\n        status: {\n          ...status,\n          phase: 'Paused',\n          pausedAt: now().toISOString(),\n          pauseReason: `rollout budget exceeded: ${budgetViolation}`,\n          updatedReplicas,\n          readyReplicas: updatedReplicas,\n          availableReplicas,\n          unavailableReplicas,\n          evidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    // Enforce maxUnavailable: pause if too many targets are unavailable.\n    if (spec.maxUnavailable !== undefined && unavailableReplicas > spec.maxUnavailable) {\n      return {\n        status: {\n          ...status,\n          phase: 'Paused',\n          pausedAt: now().toISOString(),\n          pauseReason: `maxUnavailable exceeded: ${unavailableReplicas} unavailable > ${spec.maxUnavailable} max`,\n          updatedReplicas,\n          readyReplicas: updatedReplicas,\n          availableReplicas,\n          unavailableReplicas,\n          evidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    // Check pause on failure threshold.\n    if (spec.pauseOnFailureThreshold && failedReplicas >= spec.pauseOnFailureThreshold) {\n      if (spec.autoRollback) {\n        const updatedTargets = evidence\n          .filter((event) => event.outcome === 'success')\n          .map((event) => targets.find((t) => t.name === event.resourceName))\n          .filter((t): t is RolloutTarget => t !== undefined);\n        for (const target of updatedTargets) {\n          try {\n            await options.rollbackTarget(rollout, target);\n          } catch { /* best-effort */ }\n        }\n        return {\n          status: {\n            ...status,\n            phase: 'RolledBack',\n            pausedAt: now().toISOString(),\n            pauseReason: `failure threshold reached: ${failedReplicas} failures`,\n            rollbackReason: `auto-rollback: ${failedReplicas} failures`,\n            updatedReplicas: 0,\n            readyReplicas: 0,\n            availableReplicas,\n            unavailableReplicas,\n            evidence,\n          } as FleetRolloutStatus,\n          ready: true,\n        };\n      }\n      return {\n        status: {\n          ...status,\n          phase: 'Paused',\n          pausedAt: now().toISOString(),\n          pauseReason: `failure threshold reached: ${failedReplicas} failures`,\n          updatedReplicas,\n          readyReplicas: updatedReplicas,\n          availableReplicas,\n          unavailableReplicas,\n          evidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    // Determine next batch or canary stage.\n    if (spec.strategy === 'batch') {\n      const batchSize = spec.batchSize ?? 1;\n      const maxConcurrency = spec.maxConcurrency ?? 1;\n      const currentBatch: number = status.currentBatch ?? 0;\n      const batchStart = currentBatch * batchSize;\n      const batchEnd = Math.min(batchStart + batchSize, totalReplicas);\n\n      if (batchStart >= totalReplicas) {\n        // Rollout complete.\n        return {\n          status: {\n            ...status,\n            phase: 'Completed',\n            completedAt: now().toISOString(),\n            updatedReplicas,\n            readyReplicas: updatedReplicas,\n            availableReplicas,\n            unavailableReplicas,\n            evidence,\n          } as FleetRolloutStatus,\n          ready: true,\n        };\n      }\n\n      // Process next batch with bounded concurrency.\n      const batchTargets = targets.slice(batchStart, batchEnd);\n      const batchEvidence = await processTargetsBounded(\n        batchTargets,\n        (target) => options.updateTarget(rollout, target),\n        maxConcurrency,\n        now,\n        spec.perTargetBudget,\n      );\n      const newEvidence = [...evidence, ...batchEvidence];\n\n      const batchBudgetViolation = budgetExceeded(spec.budget, sumEvidenceUsage(newEvidence));\n      if (batchBudgetViolation) {\n        return {\n          status: {\n            ...status,\n            phase: 'Paused',\n            pausedAt: now().toISOString(),\n            pauseReason: `rollout budget exceeded: ${batchBudgetViolation}`,\n            updatedReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n            readyReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n            availableReplicas,\n            unavailableReplicas,\n            evidence: newEvidence,\n          } as FleetRolloutStatus,\n          ready: true,\n        };\n      }\n\n      const newFailedReplicas = newEvidence.filter((event) => event.outcome === 'failure').length;\n      if (spec.pauseOnFailureThreshold && newFailedReplicas >= spec.pauseOnFailureThreshold) {\n        if (spec.autoRollback) {\n          const updatedTargets = newEvidence\n            .filter((event) => event.outcome === 'success')\n            .map((event) => targets.find((t) => t.name === event.resourceName))\n            .filter((t): t is RolloutTarget => t !== undefined);\n          for (const target of updatedTargets) {\n            try {\n              await options.rollbackTarget(rollout, target);\n            } catch { /* best-effort */ }\n          }\n          return {\n            status: {\n              ...status,\n              phase: 'RolledBack',\n              pausedAt: now().toISOString(),\n              pauseReason: `failure threshold reached: ${newFailedReplicas} failures`,\n              rollbackReason: `auto-rollback: ${newFailedReplicas} failures`,\n              updatedReplicas: 0,\n              readyReplicas: 0,\n              availableReplicas,\n              unavailableReplicas,\n              evidence: newEvidence,\n            } as FleetRolloutStatus,\n            ready: true,\n          };\n        }\n        return {\n          status: {\n            ...status,\n            phase: 'Paused',\n            pausedAt: now().toISOString(),\n            pauseReason: `failure threshold reached: ${newFailedReplicas} failures`,\n            updatedReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n            readyReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n            availableReplicas,\n            unavailableReplicas,\n            evidence: newEvidence,\n          } as FleetRolloutStatus,\n          ready: true,\n        };\n      }\n\n      return {\n        status: {\n          ...status,\n          phase: 'Rolling',\n          currentBatch: currentBatch + 1,\n          updatedReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n          readyReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n          availableReplicas,\n          unavailableReplicas,\n          evidence: newEvidence,\n        } as FleetRolloutStatus,\n        ready: false,\n        requeueAfterMs: 1000,\n      };\n    }\n\n    // Canary strategy.\n    const stages = spec.canaryStages ?? [{ weight: 100 }];\n    const currentStage = status.currentCanaryStage ?? 0;\n\n    if (currentStage >= stages.length) {\n      return {\n        status: {\n          ...status,\n          phase: 'Completed',\n          completedAt: now().toISOString(),\n          updatedReplicas,\n          readyReplicas: updatedReplicas,\n          availableReplicas,\n          unavailableReplicas,\n          evidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    const stage = stages[currentStage];\n    const maxConcurrency = spec.maxConcurrency ?? 1;\n    const stageReplicas = Math.ceil((stage.weight / 100) * totalReplicas);\n    const stageTargets = targets.slice(0, stageReplicas).filter(\n      (t) => !evidence.some((event) => event.resourceName === t.name && event.outcome === 'success'),\n    );\n    const stageEvidence = await processTargetsBounded(\n      stageTargets,\n      (target) => options.updateTarget(rollout, target),\n      maxConcurrency,\n      now,\n      spec.perTargetBudget,\n    );\n    const newEvidence = [...evidence, ...stageEvidence];\n\n    const stageBudgetViolation = budgetExceeded(spec.budget, sumEvidenceUsage(newEvidence));\n    if (stageBudgetViolation) {\n      return {\n        status: {\n          ...status,\n          phase: 'Paused',\n          pausedAt: now().toISOString(),\n          pauseReason: `rollout budget exceeded: ${stageBudgetViolation}`,\n          updatedReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n          readyReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n          availableReplicas,\n          unavailableReplicas,\n          evidence: newEvidence,\n        } as FleetRolloutStatus,\n        ready: true,\n      };\n    }\n\n    const stagePauseMs = stage.pauseDurationMs ?? 0;\n    return {\n      status: {\n        ...status,\n        phase: 'Rolling',\n        currentCanaryStage: currentStage + 1,\n        updatedReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n        readyReplicas: newEvidence.filter((event) => event.outcome === 'success').length,\n        availableReplicas,\n        unavailableReplicas,\n        evidence: newEvidence,\n      } as FleetRolloutStatus,\n      ready: false,\n      requeueAfterMs: stagePauseMs > 0 ? stagePauseMs : 1000,\n    };\n  }\n\n  return {\n    async reconcile(request): Promise<ControllerReconcileResult> {\n      const result = await reconcileRollout(request);\n      // Aggregate budget accounting is derived from evidence on every path so\n      // no return site can forget it (idempotent: recomputed, not accumulated).\n      if (result.status) {\n        result.status = {\n          ...result.status,\n          consumedBudget: sumEvidenceUsage((result.status as FleetRolloutStatus).evidence),\n        } as FleetRolloutStatus;\n      }\n      return result;\n    },\n  };\n}\n","import type {\n  OrchestrationDeleteOptions,\n  OrchestrationDeleteResult,\n  OrchestrationGetOptions,\n  OrchestrationListOptions,\n  OrchestrationResource,\n  OrchestrationResourceList,\n  OrchestrationResourceManifest,\n  OrchestrationResourceQuery,\n  OrchestrationResourceReference,\n  OrchestrationResourceStatus,\n  OrchestrationWatchEvent,\n  OrchestrationWatchOptions,\n} from './client.js';\n\nexport type ControlStoreVerb =\n  | 'create'\n  | 'apply'\n  | 'update-status'\n  | 'delete'\n  | 'acquire-lease'\n  | 'renew-lease'\n  | 'release-lease';\n\nexport interface ControlStoreActor {\n  id: string;\n  kind: 'controller' | 'verifier' | 'admin';\n  properties?: string[];\n}\n\nexport interface ControlStoreAuthorizationRequest {\n  actor: ControlStoreActor;\n  verb: ControlStoreVerb;\n  reference: OrchestrationResourceReference;\n  current?: OrchestrationResource;\n  proposedResource?: OrchestrationResourceManifest;\n  proposedStatus?: OrchestrationResourceStatus;\n}\n\nexport interface ControlStoreAuthorizer {\n  /** Must return synchronously so authorization and the protected write share one transaction. */\n  authorize(request: ControlStoreAuthorizationRequest): void;\n}\n\nexport interface ControlStoreCreateOptions {\n  idempotencyKey?: string;\n  dryRun?: boolean;\n}\n\nexport interface ControlStoreApplyOptions {\n  /** Required when changing an existing spec; omitted only for create/same-spec retry. */\n  resourceVersion?: string;\n  idempotencyKey?: string;\n  dryRun?: boolean;\n}\n\nexport interface ControlStoreStatusUpdateOptions {\n  /** Exact compare-and-swap precondition. */\n  resourceVersion: string;\n  idempotencyKey?: string;\n  dryRun?: boolean;\n}\n\nexport interface ControlLeaseRequest {\n  name: string;\n  holder: string;\n  ttlMs: number;\n}\n\nexport interface ControlLeaseIdentity {\n  name: string;\n  holder: string;\n  leaseId: string;\n  epoch: string;\n}\n\nexport interface ControlLeaseGrant extends ControlLeaseIdentity {\n  acquiredAt: string;\n  renewedAt: string;\n  expiresAt: string;\n  resourceVersion: string;\n}\n\nexport interface ControlStoreCompactionResult {\n  compactedThrough: string;\n  resourceVersion: string;\n}\n\nexport interface ControlStoreSnapshotResult {\n  resourceVersion: string;\n  createdAt: string;\n}\n\nexport interface ControlStoreHealth {\n  healthy: boolean;\n  resourceVersion: string;\n  detail?: string;\n}\n\n/**\n * Trusted controller-facing state store. Agent-facing clients never receive\n * status, lease, compaction, snapshot, or actor-selection capabilities.\n */\nexport interface ControlStore {\n  get<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n    reference: OrchestrationResourceReference,\n    options?: OrchestrationGetOptions,\n  ): Promise<OrchestrationResource<TSpec, TStatus> | null>;\n\n  list<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n    query: OrchestrationResourceQuery,\n    options?: OrchestrationListOptions,\n  ): Promise<OrchestrationResourceList<TSpec, TStatus>>;\n\n  watch<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n    query: OrchestrationResourceQuery,\n    options?: OrchestrationWatchOptions,\n  ): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>>;\n\n  create<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n    actor: ControlStoreActor,\n    resource: OrchestrationResourceManifest<TSpec>,\n    options?: ControlStoreCreateOptions,\n  ): Promise<OrchestrationResource<TSpec, TStatus>>;\n\n  apply<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n    actor: ControlStoreActor,\n    resource: OrchestrationResourceManifest<TSpec>,\n    options?: ControlStoreApplyOptions,\n  ): Promise<OrchestrationResource<TSpec, TStatus>>;\n\n  updateStatus<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n    actor: ControlStoreActor,\n    reference: OrchestrationResourceReference,\n    status: TStatus,\n    options: ControlStoreStatusUpdateOptions,\n  ): Promise<OrchestrationResource<TSpec, TStatus>>;\n\n  delete(\n    actor: ControlStoreActor,\n    reference: OrchestrationResourceReference,\n    options?: OrchestrationDeleteOptions,\n  ): Promise<OrchestrationDeleteResult>;\n\n  acquireLease(actor: ControlStoreActor, request: ControlLeaseRequest): Promise<ControlLeaseGrant>;\n  renewLease(actor: ControlStoreActor, identity: ControlLeaseIdentity, ttlMs: number): Promise<ControlLeaseGrant>;\n  releaseLease(actor: ControlStoreActor, identity: ControlLeaseIdentity): Promise<void>;\n\n  compact(throughResourceVersion: string): Promise<ControlStoreCompactionResult>;\n  snapshot(targetPath: string): Promise<ControlStoreSnapshotResult>;\n  getHealth(): Promise<ControlStoreHealth>;\n  close(): Promise<void>;\n}\n\n/** Key-order-independent structural form used by every ControlStore backend. */\nexport function canonicalControlStoreValue(value: unknown): string {\n  if (value === undefined) return 'undefined';\n  if (Array.isArray(value)) {\n    return `[${value.map(canonicalControlStoreValue).join(',')}]`;\n  }\n  if (value !== null && typeof value === 'object') {\n    return `{${\n      Object.entries(value as Record<string, unknown>)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([key, item]) => `${JSON.stringify(key)}:${canonicalControlStoreValue(item)}`)\n        .join(',')\n    }}`;\n  }\n  return JSON.stringify(value) ?? typeof value;\n}\n\nconst DECLARATIVE_METADATA_FIELDS = [\n  'labels',\n  'annotations',\n  'ownerReferences',\n  'finalizers',\n] as const;\n\n/** Whether an apply manifest is already represented by the stored resource. */\nexport function controlStoreApplyMatches(\n  current: OrchestrationResource,\n  proposed: OrchestrationResourceManifest,\n): boolean {\n  if (\n    canonicalControlStoreValue(current.spec) !==\n      canonicalControlStoreValue(proposed.spec)\n  ) {\n    return false;\n  }\n  return DECLARATIVE_METADATA_FIELDS.every((field) => {\n    const desired = proposed.metadata[field];\n    return desired === undefined ||\n      canonicalControlStoreValue(current.metadata[field]) ===\n        canonicalControlStoreValue(desired);\n  });\n}\n","import { OrchestrationError } from '../errors.js';\nimport type { NodeTrustClass } from '../resources.js';\nimport type { AgentVolumeReplicaStatus, AgentVolumeResource, StorageClassResource } from '../resources.js';\n\n/**\n * Replicated storage controller (plan 24.45).\n *\n * Pure decision logic plus a thin executor over an injected transport:\n * - Authoritative replicas are placed only on trusted nodes and spread across\n *   fault domains.\n * - Every replica's content hash is verified against the volume's contentHash\n *   (the source of truth); mismatches and unreadable replicas are rebuilt\n *   from the primary.\n * - Transfers originate only from the fenced primary; primary changes bump a\n *   monotonically increasing epoch so stale primaries cannot serve data.\n * - Loss and corruption converge to the desired replica count.\n */\n\nexport interface ReplicationNode {\n  nodeId: string;\n  faultDomain?: string;\n  trust: NodeTrustClass;\n}\n\n/**\n * Host-owned immutable point-in-time view of the fenced primary. The handle\n * is ephemeral authority and must never be persisted in ControlStore.\n */\nexport interface ReplicationSnapshot {\n  snapshotHandle: string;\n  contentHash: string;\n}\n\nexport interface ReplicationTransport {\n  /** Compute a replica's content hash from trusted storage; null when unreadable/missing. */\n  readReplicaHash(volume: AgentVolumeResource, nodeId: string): Promise<string | null>;\n  /**\n   * Atomically compare the previous fence and persist the newly elected\n   * primary fence. Repeating the exact same transition must succeed so a\n   * controller can recover when its subsequent ControlStore CAS loses a race.\n   */\n  commitPrimaryFence(\n    volume: AgentVolumeResource,\n    previous: { nodeId?: string; epoch: number },\n    next: { nodeId: string; epoch: number },\n  ): Promise<void>;\n  /**\n   * Capture a storage-native, internally verified immutable snapshot from the\n   * active primary. The transport must reject a stale epoch and make an exact\n   * retry idempotent.\n   */\n  capturePrimarySnapshot(\n    volume: AgentVolumeResource,\n    nodeId: string,\n    epoch: number,\n  ): Promise<ReplicationSnapshot>;\n  /**\n   * Idempotently transfer the exact captured snapshot, atomically rejecting\n   * an epoch that is not the active primary fence.\n   */\n  transferReplica(\n    volume: AgentVolumeResource,\n    snapshot: ReplicationSnapshot,\n    fromNodeId: string,\n    toNodeId: string,\n    epoch: number,\n  ): Promise<void>;\n  /** Idempotently release the ephemeral snapshot after reconciliation. */\n  releaseSnapshot(volume: AgentVolumeResource, snapshot: ReplicationSnapshot): Promise<void>;\n}\n\nexport interface ReplicationContext extends ReplicationTransport {\n  nodes: ReplicationNode[];\n  now?: () => string;\n}\n\nexport type ReplicationAction =\n  | { type: 'elect-primary'; nodeId: string; epoch: number }\n  | { type: 'mark-degraded'; nodeId: string; reason: string }\n  | { type: 'mark-offline'; nodeId: string }\n  | { type: 'place-replica'; nodeId: string; fromNodeId: string }\n  | { type: 'rebuild-replica'; nodeId: string; fromNodeId: string };\n\nexport interface ReplicationResult {\n  volume: AgentVolumeResource;\n  actions: ReplicationAction[];\n}\n\nfunction desiredFactor(storageClass: StorageClassResource): number {\n  return Math.max(1, storageClass.spec.replication?.factor ?? 1);\n}\n\n/**\n * Choose target nodes for new replicas, preferring fault domains not already\n * covered by existing replicas and skipping nodes that already host one.\n * Authoritative storage never uses restricted or quarantine nodes.\n */\nexport function planReplicaPlacement(\n  existing: AgentVolumeReplicaStatus[],\n  candidates: ReplicationNode[],\n  count: number,\n): ReplicationNode[] {\n  const usedNodes = new Set(existing.map((replica) => replica.nodeId));\n  const usedDomains = new Set(\n    existing\n      .map((replica) => candidates.find((node) => node.nodeId === replica.nodeId)?.faultDomain)\n      .filter((domain): domain is string => domain !== undefined),\n  );\n  const available = candidates.filter((node) => node.trust === 'trusted' && !usedNodes.has(node.nodeId));\n  const freshDomain = available.filter((node) => node.faultDomain !== undefined && !usedDomains.has(node.faultDomain));\n  const rest = available.filter((node) => !freshDomain.includes(node));\n  return [...freshDomain, ...rest].slice(0, count);\n}\n\n/**\n * Reconcile one volume to its desired replica state. Reads and verifies all\n * replicas, elects/fences a primary, rebuilds corrupt or lost replicas, and\n * converges to the class's desired factor when autoRebuild is enabled.\n */\nexport async function reconcileVolumeReplication(\n  volume: AgentVolumeResource,\n  storageClass: StorageClassResource,\n  context: ReplicationContext,\n): Promise<ReplicationResult> {\n  const now = context.now?.() ?? new Date().toISOString();\n  const actions: ReplicationAction[] = [];\n  const desired = desiredFactor(storageClass);\n  const status = volume.status ?? {};\n  const replicas: AgentVolumeReplicaStatus[] = [...(status.replicas ?? [])];\n  let contentHash = status.contentHash;\n  let primaryNodeId = status.primaryNodeId;\n  let primaryEpoch = status.primaryEpoch ?? 0;\n  let snapshot: ReplicationSnapshot | undefined;\n\n  async function electPrimary(nodeId: string): Promise<void> {\n    const previous = { ...(primaryNodeId ? { nodeId: primaryNodeId } : {}), epoch: primaryEpoch };\n    const next = { nodeId, epoch: primaryEpoch + 1 };\n    await context.commitPrimaryFence(volume, previous, next);\n    primaryNodeId = nodeId;\n    primaryEpoch = next.epoch;\n    actions.push({ type: 'elect-primary', nodeId, epoch: primaryEpoch });\n  }\n\n  // 1. Read every trusted replica. Non-trusted or missing nodes are never\n  //    candidates for authoritative data.\n  const hashes = new Map<string, string | null>();\n  for (const replica of replicas) {\n    const node = context.nodes.find((candidate) => candidate.nodeId === replica.nodeId);\n    hashes.set(replica.nodeId, node?.trust === 'trusted' ? await context.readReplicaHash(volume, replica.nodeId) : null);\n  }\n\n  // 2. Keep a readable fenced primary. After primary loss, only a replica\n  //    matching the last committed hash may be promoted. On bootstrap there is\n  //    no prior truth, so the first readable trusted replica becomes primary.\n  const existingPrimaryReadable = primaryNodeId !== undefined &&\n    Number.isSafeInteger(primaryEpoch) &&\n    primaryEpoch >= 1 &&\n    hashes.get(primaryNodeId) != null;\n  if (!existingPrimaryReadable) {\n    const candidate = replicas.find((replica) => {\n      const hash = hashes.get(replica.nodeId);\n      return hash != null && (!contentHash || hash === contentHash);\n    });\n    if (candidate) {\n      await electPrimary(candidate.nodeId);\n    } else {\n      primaryNodeId = undefined;\n    }\n  }\n\n  let operationFailed = false;\n  try {\n    // 3. The fenced primary's immutable native snapshot is the authority for\n    //    legitimate writes. This distinguishes a committed primary update\n    //    from a divergent secondary and binds every transfer to one version.\n    if (primaryNodeId) {\n      snapshot = await context.capturePrimarySnapshot(\n        volume,\n        primaryNodeId,\n        primaryEpoch,\n      );\n      if (\n        !snapshot.snapshotHandle ||\n        snapshot.snapshotHandle.length > 4096 ||\n        !snapshot.contentHash ||\n        snapshot.contentHash.length > 512\n      ) {\n        throw new OrchestrationError({\n          code: 'INVALID',\n          message: 'replication transport returned an invalid primary snapshot',\n          retryable: false,\n        });\n      }\n      contentHash = snapshot.contentHash;\n      hashes.set(primaryNodeId, contentHash);\n    }\n\n    // 4. Classify every replica against the captured primary snapshot.\n    for (const [index, replica] of replicas.entries()) {\n      const hash = hashes.get(replica.nodeId);\n      if (hash == null) {\n        if (replica.state !== 'offline') {\n          replicas[index] = { ...replica, state: 'offline', updatedAt: now };\n          actions.push({ type: 'mark-offline', nodeId: replica.nodeId });\n        }\n        continue;\n      }\n      if (contentHash && hash !== contentHash) {\n        if (replica.state !== 'degraded' || replica.contentHash !== hash) {\n          replicas[index] = { ...replica, state: 'degraded', contentHash: hash, updatedAt: now };\n          actions.push({ type: 'mark-degraded', nodeId: replica.nodeId, reason: 'content hash mismatch' });\n        }\n        continue;\n      }\n      if (replica.state !== 'healthy' || replica.contentHash !== hash) {\n        replicas[index] = { ...replica, state: 'healthy', contentHash: hash, updatedAt: now };\n      }\n    }\n\n    const healthyReplicas = () =>\n      replicas.filter(\n        (replica) =>\n          replica.state === 'healthy' &&\n          replica.contentHash === contentHash,\n      );\n\n    // 5. Rebuild divergent replicas from the exact captured snapshot.\n    if (\n      primaryNodeId &&\n      snapshot &&\n      storageClass.spec.replication?.autoRebuild !== false\n    ) {\n      for (const [index, replica] of replicas.entries()) {\n        if (replica.state !== 'degraded') continue;\n        replicas[index] = { ...replica, state: 'rebuilding', updatedAt: now };\n        actions.push({ type: 'rebuild-replica', nodeId: replica.nodeId, fromNodeId: primaryNodeId });\n        await context.transferReplica(\n          volume,\n          snapshot,\n          primaryNodeId,\n          replica.nodeId,\n          primaryEpoch,\n        );\n        const stored = await context.readReplicaHash(volume, replica.nodeId);\n        replicas[index] = stored === contentHash\n          ? { ...replicas[index], state: 'healthy', contentHash: stored, updatedAt: now }\n          : { ...replicas[index], state: 'degraded', ...(stored ? { contentHash: stored } : {}), updatedAt: now };\n      }\n    }\n\n    // 6. Place new replicas from that same immutable snapshot.\n    const hostingNodes = new Set(replicas.map((replica) => replica.nodeId));\n    const missing = desired - healthyReplicas().length -\n      replicas.filter((replica) => replica.state === 'rebuilding').length;\n    if (\n      primaryNodeId &&\n      snapshot &&\n      missing > 0 &&\n      storageClass.spec.replication?.autoRebuild !== false\n    ) {\n      const targets = planReplicaPlacement(replicas, context.nodes, missing);\n      for (const target of targets) {\n        if (hostingNodes.has(target.nodeId)) continue;\n        actions.push({ type: 'place-replica', nodeId: target.nodeId, fromNodeId: primaryNodeId });\n        await context.transferReplica(\n          volume,\n          snapshot,\n          primaryNodeId,\n          target.nodeId,\n          primaryEpoch,\n        );\n        const stored = await context.readReplicaHash(volume, target.nodeId);\n        replicas.push({\n          nodeId: target.nodeId,\n          state: stored === contentHash ? 'healthy' : 'degraded',\n          ...(stored ? { contentHash: stored } : {}),\n          updatedAt: now,\n        });\n        hostingNodes.add(target.nodeId);\n      }\n    }\n\n    const healthy = healthyReplicas().length;\n    const health = healthy >= desired\n      ? 'healthy'\n      : healthy > 0 || replicas.some((replica) => replica.state === 'rebuilding')\n      ? 'degraded'\n      : 'failed';\n\n    return {\n      volume: {\n        ...volume,\n        status: {\n          ...status,\n          replicas,\n          ...(contentHash ? { contentHash } : {}),\n          // Always overwrite: a lost primary must not linger in status.\n          primaryNodeId,\n          primaryEpoch,\n          health,\n        },\n      },\n      actions,\n    };\n  } catch (error) {\n    operationFailed = true;\n    throw error;\n  } finally {\n    if (snapshot) {\n      const release = context.releaseSnapshot(volume, snapshot);\n      if (operationFailed) {\n        await release.catch(() => undefined);\n      } else {\n        await release;\n      }\n    }\n  }\n}\n\nimport { createControllerRunner } from '../controllerRunner.js';\nimport { canonicalControlStoreValue, type ControlStore, type ControlStoreActor } from '../controlStore.js';\n\n/**\n * Dependencies for the replication controller beyond what ReplicationTransport covers.\n */\nexport interface ReplicationControllerDeps {\n  store: ControlStore;\n  getStorageClass: (volume: AgentVolumeResource) => Promise<StorageClassResource | null>;\n  listNodes: () => Promise<ReplicationNode[]>;\n  /**\n   * The transport must durably commit the elected epoch before accepting a\n   * transfer. ControlStore status is the observable mirror, not the native\n   * data-plane fencing authority.\n   */\n  transport: ReplicationTransport;\n  actor: ControlStoreActor;\n}\n\n/**\n * Create a controller runner that reconciles AgentVolume resources through\n * the pure reconcileVolumeReplication with a transport-owned primary fence.\n *\n * Each reconcile reads the latest volume from the store. The injected\n * transport durably commits a new primary epoch before any transfer can use\n * it. The resulting mirrored status is then written through `updateStatus`\n * with resourceVersion CAS; stale writes are retried by the runner.\n */\nexport function createReplicationController(deps: ReplicationControllerDeps) {\n  const { store, getStorageClass, listNodes, transport, actor } = deps;\n\n  return createControllerRunner(store, {\n    async reconcile(request) {\n      const volume = request.resource as unknown as AgentVolumeResource;\n\n      const storageClass = await getStorageClass(volume);\n      if (!storageClass) return { ready: true };\n\n      const nodes = await listNodes();\n\n      // Re-read current version for an accurate CAS token.\n      const current = (await store.get({\n        kind: volume.kind,\n        namespace: volume.metadata.namespace,\n        name: volume.metadata.name,\n        apiVersion: volume.apiVersion,\n      })) as unknown as AgentVolumeResource | null;\n      const reconciled = current ?? volume;\n\n      const context: ReplicationContext = {\n        nodes,\n        readReplicaHash: async (targetVolume, nodeId) => await transport.readReplicaHash(targetVolume, nodeId),\n        capturePrimarySnapshot: async (targetVolume, nodeId, epoch) => await transport.capturePrimarySnapshot(targetVolume, nodeId, epoch),\n        transferReplica: async (targetVolume, targetSnapshot, fromNodeId, toNodeId, epoch) => {\n          await transport.transferReplica(\n            targetVolume,\n            targetSnapshot,\n            fromNodeId,\n            toNodeId,\n            epoch,\n          );\n        },\n        commitPrimaryFence: async (targetVolume, previous, next) => {\n          await transport.commitPrimaryFence(targetVolume, previous, next);\n        },\n        releaseSnapshot: async (targetVolume, targetSnapshot) => {\n          await transport.releaseSnapshot(targetVolume, targetSnapshot);\n        },\n      };\n\n      const result = await reconcileVolumeReplication(reconciled, storageClass, context);\n      const nextStatus = result.volume.status ?? {};\n      if (\n        canonicalControlStoreValue(nextStatus) ===\n          canonicalControlStoreValue(reconciled.status ?? {})\n      ) {\n        return { ready: true };\n      }\n\n      // Return status so the controller runner CAS-commits it exactly once.\n      return { status: nextStatus };\n    },\n  }, {\n    actor,\n    leaseName: 'storage-replication',\n    watchKind: 'AgentVolume',\n    leaseTtlMs: 30_000,\n  });\n}\n","import type {\n  AgentOrchestrationCapabilities,\n  AgentOrchestrationClient,\n  OrchestrationApplyOptions,\n  OrchestrationDeleteOptions,\n  OrchestrationDeleteResult,\n  OrchestrationGetOptions,\n  OrchestrationListOptions,\n  OrchestrationResource,\n  OrchestrationResourceList,\n  OrchestrationResourceManifest,\n  OrchestrationResourceQuery,\n  OrchestrationResourceReference,\n  OrchestrationResourceStatus,\n  OrchestrationWatchEvent,\n  OrchestrationWatchOptions,\n} from './client.js';\nimport type { ControlStore, ControlStoreActor } from './controlStore.js';\n\n/**\n * ControlStore-backed AgentOrchestrationClient (plan 24.14).\n *\n * Adapts the trusted controller store to the Agent-facing facade so script\n * deployment (and later other facade consumers) can run against the real\n * store instead of test fakes. Actor identity is bound by the host at\n * construction; callers cannot choose it.\n *\n * Apply delegates to the store's atomic declarative update: create when\n * absent, return an equal spec idempotently, or CAS a changed desired spec\n * while preserving identity/status and advancing generation.\n */\n\nexport interface ControlStoreOrchestrationClientOptions {\n  /** Resource kinds reported by getCapabilities (default: workload-related kinds). */\n  resourceKinds?: string[];\n}\n\nconst DEFAULT_RESOURCE_KINDS = [\n  'AgentWorkload',\n  'AgentRun',\n  'ToolOperation',\n  'ArtifactRecord',\n  'ModelClass',\n  'ModelEndpoint',\n  'WorkloadCapabilityGrant',\n];\n\nexport function createControlStoreOrchestrationClient(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  options: ControlStoreOrchestrationClientOptions = {},\n): AgentOrchestrationClient {\n  const resourceKinds = options.resourceKinds ?? DEFAULT_RESOURCE_KINDS;\n\n  return {\n    async getCapabilities(): Promise<AgentOrchestrationCapabilities> {\n      return {\n        operations: ['apply', 'get', 'list', 'watch', 'delete'],\n        resourceKinds,\n        interfaces: ['resource'],\n      };\n    },\n\n    async apply<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      resource: OrchestrationResourceManifest<TSpec>,\n      applyOptions?: OrchestrationApplyOptions,\n    ): Promise<OrchestrationResource<TSpec, TStatus>> {\n      const reference: OrchestrationResourceReference = {\n        apiVersion: resource.apiVersion,\n        kind: resource.kind,\n        name: resource.metadata.name,\n        namespace: resource.metadata.namespace,\n      };\n      const existing = await store.get<TSpec, TStatus>(reference);\n      return store.apply(actor, resource, {\n        ...(existing ? { resourceVersion: existing.metadata.resourceVersion } : {}),\n        idempotencyKey: applyOptions?.idempotencyKey,\n        dryRun: applyOptions?.dryRun,\n      });\n    },\n\n    get<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      reference: OrchestrationResourceReference,\n      _options?: OrchestrationGetOptions,\n    ): Promise<OrchestrationResource<TSpec, TStatus> | null> {\n      return store.get<TSpec, TStatus>(reference);\n    },\n\n    list<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      _options?: OrchestrationListOptions,\n    ): Promise<OrchestrationResourceList<TSpec, TStatus>> {\n      return store.list<TSpec, TStatus>(query);\n    },\n\n    watch<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      watchOptions?: OrchestrationWatchOptions,\n    ): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>> {\n      return store.watch<TSpec, TStatus>(query, watchOptions);\n    },\n\n    delete(\n      reference: OrchestrationResourceReference,\n      deleteOptions?: OrchestrationDeleteOptions,\n    ): Promise<OrchestrationDeleteResult> {\n      return store.delete(actor, reference, deleteOptions);\n    },\n  };\n}\n","import type { Controller } from './controllerRunner.js';\nimport type { CredentialIssuePayload, CredentialManagementDriver } from './drivers/credentialManagement.js';\nimport type { DriverRequestEnvelope } from './drivers/driverRequest.js';\nimport type { CredentialGrantResource, CredentialGrantStatus } from './resources.js';\nimport type { CredentialBrokerDriver, CredentialGrantHandle } from './security/credentialBroker.js';\n\nexport interface CredentialBrokerEndpoint {\n  nodeId: string;\n  brokerClass: string;\n  healthy: boolean;\n  audiences: string[];\n  methods?: string[];\n  /** Exact targets or prefix patterns ending in `*`. */\n  targets?: string[];\n  activeGrants?: number;\n  maxGrants?: number;\n}\n\nexport interface CredentialGrantPlacementRequirements {\n  brokerClass?: string;\n  requiredNode?: string;\n  /** Host admission denial; binding becomes terminal Failed. */\n  denyReason?: string;\n}\n\nexport interface CredentialGrantBindingControllerOptions {\n  listBrokers(): Promise<CredentialBrokerEndpoint[]>;\n  requirementsForGrant?(\n    grant: CredentialGrantResource,\n  ): Promise<CredentialGrantPlacementRequirements>;\n  now?: () => Date;\n}\n\nfunction targetMatches(pattern: string, target: string): boolean {\n  return pattern.endsWith('*')\n    ? target.startsWith(pattern.slice(0, -1))\n    : pattern === target;\n}\n\n/** Independently selects a healthy broker that can honor the complete scope. */\nexport function createCredentialGrantBindingController(\n  options: CredentialGrantBindingControllerOptions,\n): Controller<CredentialGrantResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const grant = request.resource as CredentialGrantResource;\n      const status = grant.status ?? {};\n      if (status.phase && status.phase !== 'Pending') return { ready: true };\n      const requirements = await options.requirementsForGrant?.(grant) ?? {};\n      if (requirements.denyReason) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'FORBIDDEN',\n              message: requirements.denyReason,\n              retryable: false,\n            },\n          } satisfies CredentialGrantStatus,\n          ready: true,\n        };\n      }\n      const candidates = (await options.listBrokers()).filter((broker) =>\n        broker.healthy &&\n        (!requirements.requiredNode || broker.nodeId === requirements.requiredNode) &&\n        (!requirements.brokerClass || broker.brokerClass === requirements.brokerClass) &&\n        broker.audiences.includes(grant.spec.audience) &&\n        (!broker.methods?.length || broker.methods.includes(grant.spec.method)) &&\n        (!broker.targets?.length || broker.targets.some((pattern) => targetMatches(pattern, grant.spec.target))) &&\n        (broker.maxGrants === undefined || (broker.activeGrants ?? 0) < broker.maxGrants)\n      ).sort((left, right) =>\n        (left.activeGrants ?? 0) - (right.activeGrants ?? 0) ||\n        left.nodeId.localeCompare(right.nodeId) ||\n        left.brokerClass.localeCompare(right.brokerClass)\n      );\n      const selected = candidates[0];\n      const reconciledAt = now().toISOString();\n      if (!selected) {\n        const { assignedNode: _node, assignedBroker: _broker, binding: _binding, ...unbound } = status;\n        return {\n          status: {\n            ...unbound,\n            phase: 'Pending',\n            conditions: [{\n              type: 'CredentialBrokerScheduled',\n              status: 'False',\n              reason: 'NoEligibleBroker',\n              message: `no healthy credential broker satisfies '${grant.spec.audience}' / '${grant.spec.target}'`,\n              lastTransitionTime: reconciledAt,\n            }],\n          } satisfies CredentialGrantStatus,\n          requeueAfterMs: 1000,\n        };\n      }\n      if (\n        status.assignedNode === selected.nodeId &&\n        status.assignedBroker === selected.brokerClass &&\n        status.binding?.leaseEpoch === request.leaseEpoch\n      ) return { ready: true };\n      return {\n        status: {\n          ...status,\n          phase: 'Pending',\n          assignedNode: selected.nodeId,\n          assignedBroker: selected.brokerClass,\n          binding: { leaseEpoch: request.leaseEpoch, boundAt: reconciledAt },\n          conditions: [{\n            type: 'CredentialBrokerScheduled',\n            status: 'True',\n            reason: 'BrokerSelected',\n            message: `bound to '${selected.brokerClass}' on '${selected.nodeId}'`,\n            lastTransitionTime: reconciledAt,\n          }],\n        } satisfies CredentialGrantStatus,\n        ready: true,\n      };\n    },\n  };\n}\n\nexport interface CredentialHandleVault {\n  /** The token remains outside ControlStore; handleRef is safe to persist. */\n  put(handleReference: string, handle: CredentialGrantHandle): Promise<void>;\n  get(handleReference: string): Promise<CredentialGrantHandle | undefined>;\n  delete(handleReference: string): Promise<void>;\n}\n\nexport interface CredentialGrantExecutionControllerOptions {\n  nodeId: string;\n  getBroker(\n    brokerClass: string,\n    nodeId: string,\n  ): Promise<CredentialBrokerDriver | undefined>;\n  vault: CredentialHandleVault;\n  managed?: {\n    getDriver(\n      brokerClass: string,\n      nodeId: string,\n    ): Promise<CredentialManagementDriver | undefined>;\n    createIssueRequest(input: {\n      grant: CredentialGrantResource;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<CredentialIssuePayload>>;\n  };\n  now?: () => Date;\n}\n\n/** Persists a fencing claim before issuing a worker-visible credential. */\nexport function createCredentialGrantExecutionController(\n  options: CredentialGrantExecutionControllerOptions,\n): Controller<CredentialGrantResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const grant = request.resource as CredentialGrantResource;\n      const status = grant.status ?? {};\n      if (status.assignedNode !== options.nodeId || !status.assignedBroker || !status.binding) {\n        return { ready: true };\n      }\n      if (\n        status.phase === 'Issued' ||\n        status.phase === 'Renewed' ||\n        status.phase === 'Revoked' ||\n        status.phase === 'Expired' ||\n        status.phase === 'Failed'\n      ) return { ready: true };\n      const managedDriver = options.managed\n        ? await options.managed.getDriver(\n          status.assignedBroker,\n          options.nodeId,\n        )\n        : undefined;\n      const broker = managedDriver\n        ? undefined\n        : await options.getBroker(status.assignedBroker, options.nodeId);\n      if (!managedDriver && !broker) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNAVAILABLE',\n              message: `bound credential broker '${status.assignedBroker}' is unavailable`,\n              retryable: true,\n            },\n          } satisfies CredentialGrantStatus,\n          ready: true,\n        };\n      }\n      if (status.phase !== 'Issuing') {\n        return {\n          status: {\n            ...status,\n            phase: 'Issuing',\n            issuanceClaim: {\n              leaseEpoch: request.leaseEpoch,\n              claimedAt: now().toISOString(),\n            },\n          } satisfies CredentialGrantStatus,\n          requeueAfterMs: 1,\n        };\n      }\n      if (status.issuanceClaim?.leaseEpoch !== request.leaseEpoch) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNKNOWN_EFFECT',\n              message: 'controller epoch changed after credential issuance was claimed; refusing duplicate issuance',\n              retryable: false,\n            },\n          } satisfies CredentialGrantStatus,\n          ready: true,\n        };\n      }\n      const managedGrant = managedDriver && options.managed\n        ? await managedDriver.issue(\n          await options.managed.createIssueRequest({\n            grant,\n            actor: request.actor,\n            leaseEpoch: request.leaseEpoch,\n          }),\n        )\n        : undefined;\n      const handle = managedGrant\n        ? undefined\n        : await (broker as CredentialBrokerDriver).issue({\n          ...grant.spec,\n          grantId: grant.metadata.uid,\n        });\n      const handleReference = managedGrant?.grantHandle ??\n        `credential://${options.nodeId}/${grant.metadata.uid}`;\n      if (handle) await options.vault.put(handleReference, handle);\n      return {\n        status: {\n          ...status,\n          phase: 'Issued',\n          handleRef: handleReference,\n          issuedAt: managedGrant?.issuedAt ?? handle?.claims.issuedAt,\n          expiresAt: managedGrant?.expiresAt ?? handle?.claims.expiresAt,\n          exposure: 'worker-visible',\n          rotationRequired: true,\n          rotationReason: 'grant was issued for a worker; rotate the underlying credential after exposure',\n        } satisfies CredentialGrantStatus,\n        ready: true,\n      };\n    },\n  };\n}\n\nexport async function revokeCredentialGrant(\n  grant: CredentialGrantResource,\n  broker: CredentialBrokerDriver,\n  vault: CredentialHandleVault,\n): Promise<void> {\n  const handleReference = grant.status?.handleRef;\n  if (!handleReference) return;\n  const handle = await vault.get(handleReference);\n  broker.revoke(handle?.claims.grantId ?? grant.metadata.uid);\n  await vault.delete(handleReference);\n}\n\nexport interface CredentialGrantLifecycleControllerOptions {\n  nodeId: string;\n  getBroker(\n    brokerClass: string,\n    nodeId: string,\n  ): Promise<CredentialBrokerDriver | undefined>;\n  vault: CredentialHandleVault;\n  managed?: {\n    getDriver(\n      brokerClass: string,\n      nodeId: string,\n    ): Promise<CredentialManagementDriver | undefined>;\n    createRevokeRequest(input: {\n      grant: CredentialGrantResource;\n      grantHandle: string;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<{ grantHandle: string }>>;\n  };\n  isRunTerminal(grant: CredentialGrantResource): Promise<boolean>;\n  now?: () => Date;\n}\n\n/** Revokes issued grants on Run termination or expiry, including after restart. */\nexport function createCredentialGrantLifecycleController(\n  options: CredentialGrantLifecycleControllerOptions,\n): Controller<CredentialGrantResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const grant = request.resource as CredentialGrantResource;\n      const status = grant.status ?? {};\n      if (\n        status.assignedNode !== options.nodeId ||\n        !status.assignedBroker ||\n        (status.phase !== 'Issued' && status.phase !== 'Renewed')\n      ) return { ready: true };\n      const managedDriver = options.managed\n        ? await options.managed.getDriver(\n          status.assignedBroker,\n          options.nodeId,\n        )\n        : undefined;\n      const broker = managedDriver\n        ? undefined\n        : await options.getBroker(status.assignedBroker, options.nodeId);\n      if (!managedDriver && !broker) return { requeueAfterMs: 1000 };\n      const checkedAt = now();\n      const expired = !Number.isFinite(Date.parse(status.expiresAt ?? '')) ||\n        checkedAt.getTime() >= Date.parse(status.expiresAt ?? '');\n      const runTerminal = await options.isRunTerminal(grant);\n      if (!expired && !runTerminal) {\n        return {\n          requeueAfterMs: Math.max(\n            1,\n            Math.min(1000, Date.parse(status.expiresAt ?? '') - checkedAt.getTime()),\n          ),\n        };\n      }\n      if (managedDriver && options.managed && status.handleRef) {\n        await managedDriver.revoke(\n          await options.managed.createRevokeRequest({\n            grant,\n            grantHandle: status.handleRef,\n            actor: request.actor,\n            leaseEpoch: request.leaseEpoch,\n          }),\n        );\n      } else if (broker) {\n        await revokeCredentialGrant(grant, broker, options.vault);\n      }\n      return {\n        status: {\n          ...status,\n          phase: expired ? 'Expired' : 'Revoked',\n          revokedAt: checkedAt.toISOString(),\n        } satisfies CredentialGrantStatus,\n        ready: true,\n      };\n    },\n  };\n}\n","import type { ControlLeaseGrant, ControlStore } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport { AUDIT_RECORD_API_VERSION, AUDIT_RECORD_KIND, type AuditRecordResource, type AuditRecordSpec, createAuditRecordManifest } from '../resources.js';\nimport { containsSecrets } from '../security/secretRedaction.js';\n\nimport {\n  type AuditEffect,\n  type AuditProvenance,\n  type AuditTelemetryManagementDriver,\n  type AuditTelemetryRecord,\n  type AuditTelemetryRecordKind,\n} from './auditTelemetryManagement.js';\nimport { assertDriverRequestEnvelope, canonicalDriverValue, type DriverRequestEnvelope } from './driverRequest.js';\n\nconst SHA256 = /^sha256:[a-f0-9]{64}$/;\nconst FORBIDDEN_ATTRIBUTE = /(?:secret|token|password|credential|authorization|cookie|private[-_]?key)/i;\nconst RECORD_KINDS: AuditTelemetryRecordKind[] = [\n  'audit',\n  'event',\n  'metric',\n  'trace',\n];\n\ninterface CommonRecordPayload {\n  policyDigest: string;\n  effect: AuditEffect;\n  provenance: AuditProvenance;\n  attributes?: Record<string, string>;\n}\n\nexport interface ControlStoreAuditTelemetryAdapterOptions {\n  store: ControlStore;\n  name: string;\n  authorizeRequest(\n    request: DriverRequestEnvelope,\n  ): boolean | Promise<boolean>;\n  now?: () => Date;\n  maxRecordsPerResource?: number;\n  maxAttributes?: number;\n  persistence: 'host' | 'external';\n  threatAssumptions: string[];\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({\n    code: 'INVALID',\n    message,\n    retryable: false,\n  });\n}\n\nfunction boundedString(\n  value: unknown,\n  field: string,\n  maximum = 256,\n): string {\n  if (typeof value !== 'string' || !value || value.length > maximum) {\n    invalid(`managed audit ${field} is invalid`);\n  }\n  return value;\n}\n\nfunction exactFields(\n  value: unknown,\n  allowed: readonly string[],\n  location: string,\n): void {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    invalid(`managed audit ${location} must be an object`);\n  }\n  const unknown = Object.keys(value).filter((field) => !allowed.includes(field));\n  if (unknown.length > 0) {\n    invalid(\n      `managed audit ${location} contains unsupported fields: ${unknown.join(', ')}`,\n    );\n  }\n}\n\nasync function digest(value: unknown): Promise<string> {\n  const bytes = new TextEncoder().encode(canonicalDriverValue(value));\n  const result = await globalThis.crypto.subtle.digest('SHA-256', bytes);\n  return `sha256:${\n    [...new Uint8Array(result)]\n      .map((byte) => byte.toString(16).padStart(2, '0'))\n      .join('')\n  }`;\n}\n\nfunction recordName(idempotencyDigest: string): string {\n  return `audit-${idempotencyDigest.slice('sha256:'.length, 62)}`;\n}\n\nfunction publicRecord(resource: AuditRecordResource): AuditTelemetryRecord {\n  const spec = resource.spec;\n  return {\n    sequence: spec.sequence,\n    recordHandle: `audit-record:${resource.metadata.name}`,\n    resourceUid: spec.resourceUid,\n    kind: spec.recordKind,\n    receivedAt: spec.receivedAt,\n    actor: structuredClone(spec.actor),\n    policyDigest: spec.policyDigest,\n    capabilityDigest: spec.capabilityDigest,\n    effect: spec.effect,\n    provenance: structuredClone(spec.provenance),\n    attributes: structuredClone(spec.attributes),\n    data: structuredClone(spec.data),\n    ...(spec.previousDigest ? { previousDigest: spec.previousDigest } : {}),\n    recordDigest: spec.recordDigest,\n  };\n}\n\n/**\n * ControlStore-backed production audit sink. A short ControlStore lease\n * serializes a named stream across processes; immutable AuditRecord resources\n * retain idempotency, fencing, quota, and hash-chain evidence across restarts.\n */\nexport function createControlStoreAuditTelemetryAdapter(\n  options: ControlStoreAuditTelemetryAdapterOptions,\n): AuditTelemetryManagementDriver {\n  const now = options.now ?? (() => new Date());\n  const maxRecordsPerResource = options.maxRecordsPerResource ?? 10_000;\n  const maxAttributes = options.maxAttributes ?? 16;\n  const stream = boundedString(options.name, 'stream name', 128);\n  const holderNonce = new Uint8Array(16);\n  globalThis.crypto.getRandomValues(holderNonce);\n  const holder = `${stream}-${\n    [...holderNonce]\n      .map((byte) => byte.toString(16).padStart(2, '0'))\n      .join('')\n  }`;\n  const leaseName = `audit-${stream}`\n    .toLowerCase()\n    .replace(/[^a-z0-9.-]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .slice(0, 253);\n  if (\n    !options.threatAssumptions.length ||\n    !Number.isSafeInteger(maxRecordsPerResource) ||\n    maxRecordsPerResource < 1 ||\n    !Number.isSafeInteger(maxAttributes) ||\n    maxAttributes < 1\n  ) invalid('managed audit adapter options are invalid');\n\n  async function listStream(): Promise<AuditRecordResource[]> {\n    const result = await options.store.list<AuditRecordSpec>({\n      apiVersion: AUDIT_RECORD_API_VERSION,\n      kind: AUDIT_RECORD_KIND,\n    });\n    return (result.items as AuditRecordResource[])\n      .filter((item) => item.spec.stream === stream)\n      .sort((left, right) => left.spec.sequence - right.spec.sequence);\n  }\n\n  async function acquire(\n    actor: DriverRequestEnvelope['actor'],\n    deadline: string,\n  ): Promise<ControlLeaseGrant> {\n    let lastError: unknown;\n    for (let attempt = 0; attempt < 100 && now().getTime() < Date.parse(deadline); attempt += 1) {\n      try {\n        return await options.store.acquireLease(actor, {\n          name: leaseName,\n          holder,\n          ttlMs: 5000,\n        });\n      } catch (error) {\n        lastError = error;\n        if (\n          !(error instanceof OrchestrationError) ||\n          error.code !== 'CONFLICT'\n        ) throw error;\n        await new Promise<void>((resolve) => setTimeout(resolve, 10));\n      }\n    }\n    throw lastError instanceof OrchestrationError\n      ? lastError\n      : new OrchestrationError({\n        code: 'TIMEOUT',\n        message: 'managed audit append lock timed out',\n        retryable: true,\n      });\n  }\n\n  async function authorized<T>(\n    request: DriverRequestEnvelope<T>,\n    method: string,\n    fields: string[],\n  ): Promise<void> {\n    exactFields(request.payload, fields, `${method} payload`);\n    assertDriverRequestEnvelope(request, {\n      now,\n      requireFencing: true,\n      requireCapability: true,\n      expectedMethod: method,\n    });\n    if (!await options.authorizeRequest(request)) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed audit capability was rejected',\n        retryable: false,\n      });\n    }\n  }\n\n  function common(payload: CommonRecordPayload): {\n    policyDigest: string;\n    effect: AuditEffect;\n    provenance: AuditProvenance;\n    attributes: Record<string, string>;\n  } {\n    if (!SHA256.test(boundedString(payload.policyDigest, 'policyDigest', 80))) {\n      invalid('managed audit policyDigest must be canonical');\n    }\n    if (\n      ![\n        'read',\n        'create',\n        'update',\n        'delete',\n        'execute',\n        'decision',\n        'security',\n      ].includes(payload.effect)\n    ) invalid('managed audit effect is invalid');\n    const provenance = payload.provenance;\n    if (\n      !provenance ||\n      ![\n        'controller',\n        'gateway',\n        'driver',\n        'worker',\n        'operator',\n      ].includes(provenance.source)\n    ) invalid('managed audit provenance is invalid');\n    boundedString(provenance.producer, 'provenance producer');\n    if (provenance.subject !== undefined) {\n      boundedString(provenance.subject, 'provenance subject');\n    }\n    const attributes = payload.attributes ?? {};\n    if (Object.keys(attributes).length > maxAttributes) {\n      invalid('managed audit attribute quota exceeded');\n    }\n    for (const [key, value] of Object.entries(attributes)) {\n      if (\n        !key ||\n        key.length > 64 ||\n        FORBIDDEN_ATTRIBUTE.test(key) ||\n        typeof value !== 'string' ||\n        value.length > 256 ||\n        containsSecrets({ [key]: value })\n      ) invalid(`managed audit attribute '${key}' is invalid or sensitive`);\n    }\n    return {\n      policyDigest: payload.policyDigest,\n      effect: payload.effect,\n      provenance: structuredClone(provenance),\n      attributes: structuredClone(attributes),\n    };\n  }\n\n  async function verify(\n    records: AuditRecordResource[],\n  ): Promise<string | undefined> {\n    let previousDigest: string | undefined;\n    let sequence = 0;\n    for (const resource of records) {\n      const spec = resource.spec;\n      sequence += 1;\n      if (\n        spec.sequence !== sequence ||\n        spec.previousDigest !== previousDigest\n      ) {\n        throw new OrchestrationError({\n          code: 'INTERNAL',\n          message: `managed audit chain is broken at sequence ${spec.sequence}`,\n          retryable: false,\n        });\n      }\n      const { recordDigest, ...unsigned } = spec;\n      if (recordDigest !== await digest(unsigned)) {\n        throw new OrchestrationError({\n          code: 'INTERNAL',\n          message: `managed audit record ${spec.sequence} failed integrity verification`,\n          retryable: false,\n        });\n      }\n      previousDigest = spec.recordDigest;\n    }\n    return previousDigest;\n  }\n\n  async function append(\n    request: DriverRequestEnvelope<CommonRecordPayload>,\n    recordKind: AuditTelemetryRecordKind,\n    data: AuditTelemetryRecord['data'],\n  ): Promise<AuditTelemetryRecord> {\n    const metadata = common(request.payload);\n    const requestFingerprint = await digest(request.payload);\n    const idempotencyDigest = await digest({\n      stream,\n      resourceUid: request.resource.uid,\n      method: request.method,\n      idempotencyKey: request.idempotencyKey,\n    });\n    const name = recordName(idempotencyDigest);\n    const lease = await acquire(request.actor, request.deadline);\n    try {\n      const records = await listStream();\n      const chainHead = await verify(records);\n      const existing = records.find(\n        (item) => item.spec.idempotencyDigest === idempotencyDigest,\n      );\n      if (existing) {\n        if (existing.spec.requestFingerprint !== requestFingerprint) {\n          throw new OrchestrationError({\n            code: 'CONFLICT',\n            message: 'managed audit idempotency key was reused with different input',\n            retryable: false,\n          });\n        }\n        return publicRecord(existing);\n      }\n      const currentFence = records\n        .filter((item) => item.spec.resourceUid === request.resource.uid)\n        .reduce(\n          (maximum, item) => Math.max(maximum, item.spec.fencingEpoch),\n          0,\n        );\n      if ((request.fencingEpoch as number) < currentFence) {\n        throw new OrchestrationError({\n          code: 'STALE_EPOCH',\n          message: `stale managed audit fencing epoch ${request.fencingEpoch}; current epoch is ${currentFence}`,\n          retryable: false,\n        });\n      }\n      const resourceCount = records.filter(\n        (item) => item.spec.resourceUid === request.resource.uid,\n      ).length;\n      if (resourceCount >= maxRecordsPerResource) {\n        throw new OrchestrationError({\n          code: 'EXHAUSTED',\n          message: `managed audit quota of ${maxRecordsPerResource} records was exceeded`,\n          retryable: false,\n        });\n      }\n      const unsigned = {\n        sequence: records.length + 1,\n        resourceUid: request.resource.uid,\n        recordKind,\n        receivedAt: now().toISOString(),\n        actor: {\n          id: request.actor.id,\n          kind: request.actor.kind,\n        },\n        ...metadata,\n        capabilityDigest: await digest(request.capabilityHandleRef),\n        data,\n        ...(chainHead ? { previousDigest: chainHead } : {}),\n      };\n      const unsignedSpec = {\n        stream,\n        ...unsigned,\n        requestFingerprint,\n        idempotencyDigest,\n        fencingEpoch: request.fencingEpoch as number,\n      };\n      const spec: AuditRecordSpec = {\n        ...unsignedSpec,\n        recordDigest: await digest(unsignedSpec),\n      };\n      const created = await options.store.create<AuditRecordSpec>(\n        request.actor,\n        createAuditRecordManifest(name, spec),\n        { idempotencyKey: `audit-record:${idempotencyDigest}` },\n      ) as AuditRecordResource;\n      return publicRecord(created);\n    } finally {\n      await options.store.releaseLease(request.actor, lease).catch(() => undefined);\n    }\n  }\n\n  return {\n    async getCapabilities() {\n      return {\n        name: stream,\n        recordKinds: RECORD_KINDS,\n        appendOnly: true,\n        trustedReceiverTime: true,\n        tamperEvident: true,\n        maxRecordsPerResource,\n        maxAttributes,\n        persistence: options.persistence,\n        threatAssumptions: [...options.threatAssumptions],\n      };\n    },\n    async appendAudit(request) {\n      await authorized(request, 'audit.append', [\n        'policyDigest',\n        'effect',\n        'provenance',\n        'attributes',\n        'action',\n        'outcome',\n        'reasonCode',\n      ]);\n      const action = boundedString(request.payload.action, 'action');\n      if (!['success', 'denied', 'failure'].includes(request.payload.outcome)) {\n        invalid('managed audit outcome is invalid');\n      }\n      if (request.payload.reasonCode !== undefined) {\n        boundedString(request.payload.reasonCode, 'reasonCode');\n      }\n      return append(request, 'audit', {\n        kind: 'audit',\n        action,\n        outcome: request.payload.outcome,\n        ...(request.payload.reasonCode\n          ? { reasonCode: request.payload.reasonCode }\n          : {}),\n      });\n    },\n    async emitEvent(request) {\n      await authorized(request, 'telemetry.emit-event', [\n        'policyDigest',\n        'effect',\n        'provenance',\n        'attributes',\n        'name',\n        'severity',\n      ]);\n      const name = boundedString(request.payload.name, 'event name');\n      if (\n        !['debug', 'info', 'warning', 'error', 'critical'].includes(\n          request.payload.severity,\n        )\n      ) invalid('managed audit event severity is invalid');\n      return append(request, 'event', {\n        kind: 'event',\n        name,\n        severity: request.payload.severity,\n      });\n    },\n    async emitMetric(request) {\n      await authorized(request, 'telemetry.emit-metric', [\n        'policyDigest',\n        'effect',\n        'provenance',\n        'attributes',\n        'name',\n        'value',\n        'unit',\n      ]);\n      const name = boundedString(request.payload.name, 'metric name');\n      const unit = boundedString(request.payload.unit, 'metric unit', 64);\n      if (!Number.isFinite(request.payload.value)) {\n        invalid('managed audit metric value must be finite');\n      }\n      return append(request, 'metric', {\n        kind: 'metric',\n        name,\n        value: request.payload.value,\n        unit,\n      });\n    },\n    async emitTrace(request) {\n      await authorized(request, 'telemetry.emit-trace', [\n        'policyDigest',\n        'effect',\n        'provenance',\n        'attributes',\n        'name',\n        'traceId',\n        'spanId',\n        'durationMs',\n        'status',\n      ]);\n      const name = boundedString(request.payload.name, 'trace name');\n      const traceId = boundedString(\n        request.payload.traceId,\n        'traceId',\n        128,\n      );\n      const spanId = boundedString(request.payload.spanId, 'spanId', 128);\n      if (\n        !Number.isFinite(request.payload.durationMs) ||\n        request.payload.durationMs < 0\n      ) invalid('managed audit trace duration must be non-negative');\n      if (!['ok', 'error'].includes(request.payload.status)) {\n        invalid('managed audit trace status is invalid');\n      }\n      return append(request, 'trace', {\n        kind: 'trace',\n        name,\n        traceId,\n        spanId,\n        durationMs: request.payload.durationMs,\n        status: request.payload.status,\n      });\n    },\n    async readRecords(request) {\n      await authorized(request, 'audit.read', [\n        'afterSequence',\n        'limit',\n        'kinds',\n      ]);\n      const afterSequence = request.payload.afterSequence ?? 0;\n      if (!Number.isSafeInteger(afterSequence) || afterSequence < 0) {\n        invalid('managed audit afterSequence is invalid');\n      }\n      if (\n        !Number.isSafeInteger(request.payload.limit) ||\n        request.payload.limit < 1 ||\n        request.payload.limit > 100\n      ) invalid('managed audit read limit must be between 1 and 100');\n      const kinds = request.payload.kinds;\n      if (\n        kinds !== undefined &&\n        (\n          !Array.isArray(kinds) ||\n          kinds.some((kind) => !RECORD_KINDS.includes(kind))\n        )\n      ) invalid('managed audit record kind filter is invalid');\n      const records = await listStream();\n      const chainHead = await verify(records);\n      const currentFence = records\n        .filter((item) => item.spec.resourceUid === request.resource.uid)\n        .reduce(\n          (maximum, item) => Math.max(maximum, item.spec.fencingEpoch),\n          0,\n        );\n      if ((request.fencingEpoch as number) < currentFence) {\n        throw new OrchestrationError({\n          code: 'STALE_EPOCH',\n          message: `stale managed audit fencing epoch ${request.fencingEpoch}; current epoch is ${currentFence}`,\n          retryable: false,\n        });\n      }\n      return {\n        records: records\n          .filter((item) =>\n            item.spec.resourceUid === request.resource.uid &&\n            item.spec.sequence > afterSequence &&\n            (!kinds || kinds.includes(item.spec.recordKind))\n          )\n          .slice(0, request.payload.limit)\n          .map(publicRecord),\n        ...(chainHead ? { chainHead } : {}),\n      };\n    },\n  };\n}\n","import type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport {\n  createPolicyDecisionManifest,\n  POLICY_DECISION_API_VERSION,\n  POLICY_DECISION_KIND,\n  type PolicyDecisionResource,\n  type PolicyDecisionSpec,\n  type PolicyDecisionStatus,\n} from '../resources.js';\n\nimport { assertDriverRequestEnvelope, canonicalDriverValue, type DriverRequestEnvelope } from './driverRequest.js';\nimport type { PolicyApprovalManagementDriver, PolicyDecision, PolicyDecisionKind } from './policyApprovalManagement.js';\n\nconst SHA256 = /^sha256:[a-f0-9]{64}$/;\n\nexport interface PolicyEvaluation {\n  outcome: 'allow' | 'deny';\n  reasons: string[];\n  obligations?: string[];\n}\n\ninterface PersistedPolicyEvaluation {\n  outcome: 'allow' | 'deny' | 'pending';\n  reasons: string[];\n  obligations?: string[];\n}\n\nexport interface ControlStorePolicyApprovalAdapterOptions {\n  store: ControlStore;\n  name: string;\n  authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;\n  evaluateResourceAdmission?(\n    request: Parameters<PolicyApprovalManagementDriver['admitResource']>[0],\n  ): PolicyEvaluation | Promise<PolicyEvaluation>;\n  evaluatePlacement?(\n    request: Parameters<PolicyApprovalManagementDriver['authorizePlacement']>[0],\n  ): PolicyEvaluation | Promise<PolicyEvaluation>;\n  evaluateToolOperation?(\n    request: Parameters<PolicyApprovalManagementDriver['authorizeToolOperation']>[0],\n    approval: PolicyDecision | undefined,\n  ): PolicyEvaluation | Promise<PolicyEvaluation>;\n  evaluateTransition?(\n    request: Parameters<PolicyApprovalManagementDriver['verifyTransition']>[0],\n  ): PolicyEvaluation | Promise<PolicyEvaluation>;\n  maxApprovalTtlMs?: number;\n  now?: () => Date;\n  persistence: 'host' | 'external';\n  threatAssumptions: string[];\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction unsupported(message: string): never {\n  throw new OrchestrationError({\n    code: 'UNSUPPORTED',\n    message,\n    retryable: false,\n  });\n}\n\nfunction exactFields(\n  payload: unknown,\n  allowed: readonly string[],\n  location: string,\n): void {\n  if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) {\n    invalid(`managed policy ${location} must be an object`);\n  }\n  const unknown = Object.keys(payload).filter((field) => !allowed.includes(field));\n  if (unknown.length > 0) {\n    invalid(`managed policy ${location} contains unsupported fields: ${unknown.join(', ')}`);\n  }\n}\n\nfunction boundedString(\n  value: unknown,\n  field: string,\n  maximum = 1024,\n): string {\n  if (typeof value !== 'string' || !value || value.length > maximum) {\n    invalid(`managed policy ${field} is invalid`);\n  }\n  return value;\n}\n\nfunction canonicalDigest(value: unknown): Promise<string> {\n  const bytes = new TextEncoder().encode(canonicalDriverValue(value));\n  return globalThis.crypto.subtle.digest('SHA-256', bytes).then((result) =>\n    `sha256:${\n      [...new Uint8Array(result)]\n        .map((byte) => byte.toString(16).padStart(2, '0'))\n        .join('')\n    }`\n  );\n}\n\nfunction assertDigest(value: unknown, field: string): string {\n  const digest = boundedString(value, field, 80);\n  if (!SHA256.test(digest)) invalid(`managed policy ${field} must be canonical`);\n  return digest;\n}\n\nfunction decisionName(fingerprintDigest: string): string {\n  return `decision-${fingerprintDigest.slice('sha256:'.length, 62)}`;\n}\n\nfunction handleName(handle: string): string {\n  const prefix = 'policy-decision:';\n  if (!handle.startsWith(prefix)) invalid('managed policy decision handle is invalid');\n  return boundedString(handle.slice(prefix.length), 'decision handle', 253);\n}\n\nfunction validateEvaluation(\n  value: PersistedPolicyEvaluation,\n): PersistedPolicyEvaluation {\n  if (\n    !value ||\n    !['allow', 'deny', 'pending'].includes(value.outcome) ||\n    !Array.isArray(value.reasons) ||\n    value.reasons.length < 1 ||\n    value.reasons.length > 16 ||\n    value.reasons.some((reason) => typeof reason !== 'string' || !reason || reason.length > 1024) ||\n    (value.obligations !== undefined &&\n      (\n        !Array.isArray(value.obligations) ||\n        value.obligations.length > 16 ||\n        value.obligations.some((obligation) =>\n          typeof obligation !== 'string' ||\n          !obligation ||\n          obligation.length > 1024\n        )\n      ))\n  ) invalid('managed policy evaluator returned invalid evidence');\n  return value;\n}\n\n/**\n * Durable production Policy/Approval adapter. Policy outcomes come only from\n * host-injected evaluators or authenticated admin/verifier requests; caller\n * payloads contain no allow bit.\n */\nexport function createControlStorePolicyApprovalAdapter(\n  options: ControlStorePolicyApprovalAdapterOptions,\n): PolicyApprovalManagementDriver {\n  const now = options.now ?? (() => new Date());\n  const maxApprovalTtlMs = options.maxApprovalTtlMs ?? 15 * 60_000;\n  if (\n    !options.name ||\n    !options.threatAssumptions.length ||\n    !Number.isSafeInteger(maxApprovalTtlMs) ||\n    maxApprovalTtlMs < 1\n  ) invalid('managed policy adapter options are invalid');\n\n  let mutations = Promise.resolve();\n\n  async function serialized<T>(operation: () => Promise<T>): Promise<T> {\n    const previous = mutations;\n    let release!: () => void;\n    mutations = new Promise<void>((resolve) => {\n      release = resolve;\n    });\n    await previous;\n    try {\n      return await operation();\n    } finally {\n      release();\n    }\n  }\n\n  async function authorize<T>(\n    request: DriverRequestEnvelope<T>,\n    method: string,\n    fields: string[],\n    actorKinds: ControlStoreActor['kind'][],\n  ): Promise<void> {\n    exactFields(request.payload, fields, `${method} payload`);\n    assertDriverRequestEnvelope(request, {\n      now,\n      requireFencing: true,\n      requireCapability: true,\n      expectedMethod: method,\n    });\n    if (!actorKinds.includes(request.actor.kind)) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: `managed policy actor kind '${request.actor.kind}' cannot call ${method}`,\n        retryable: false,\n      });\n    }\n    if (!await options.authorizeRequest(request)) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed policy capability was rejected',\n        retryable: false,\n      });\n    }\n    await rejectStaleFence(request);\n  }\n\n  async function resourceForHandle(\n    handle: string,\n    subjectUid: string,\n  ): Promise<PolicyDecisionResource> {\n    const resource = await options.store.get<PolicyDecisionSpec, PolicyDecisionStatus>({\n      apiVersion: POLICY_DECISION_API_VERSION,\n      kind: POLICY_DECISION_KIND,\n      name: handleName(handle),\n    }) as PolicyDecisionResource | null;\n    if (!resource) {\n      throw new OrchestrationError({\n        code: 'NOT_FOUND',\n        message: 'managed policy decision was not found',\n        retryable: false,\n      });\n    }\n    if (resource.spec.subjectRef.uid !== subjectUid) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed policy decision belongs to another resource',\n        retryable: false,\n      });\n    }\n    return resource;\n  }\n\n  function toDecision(resource: PolicyDecisionResource): PolicyDecision {\n    let status: PolicyDecisionStatus = resource.status ?? {\n      outcome: resource.spec.initialOutcome,\n      decidedBy: resource.spec.requestedBy,\n      decidedAt: resource.spec.decidedAt,\n      reasons: resource.spec.reasons,\n    };\n    if (\n      status.outcome === 'pending' &&\n      resource.spec.approval &&\n      Date.parse(resource.spec.approval.expiresAt) <= now().getTime()\n    ) {\n      status = {\n        outcome: 'deny',\n        decidedBy: resource.spec.requestedBy,\n        decidedAt: resource.spec.approval.expiresAt,\n        reasons: ['approval expired without an administrator resolution'],\n      };\n    }\n    return {\n      decisionHandle: `policy-decision:${resource.metadata.name}`,\n      resourceUid: resource.spec.subjectRef.uid,\n      kind: resource.spec.decisionKind,\n      outcome: status.outcome,\n      policyDigest: resource.spec.policyDigest,\n      inputDigest: resource.spec.inputDigest,\n      actorId: status.decidedBy,\n      reasons: status.reasons,\n      obligations: resource.spec.obligations,\n      decidedAt: status.decidedAt,\n      ...(resource.spec.approval\n        ? {\n          approval: {\n            ...resource.spec.approval,\n            ...(status.outcome !== 'pending'\n              ? {\n                decidedBy: status.decidedBy,\n                resolvedAt: status.decidedAt,\n                ...(status.resolutionInputDigest\n                  ? { resolutionInputDigest: status.resolutionInputDigest }\n                  : {}),\n              }\n              : {}),\n          },\n        }\n        : {}),\n    };\n  }\n\n  async function rejectStaleFence(\n    request: DriverRequestEnvelope,\n  ): Promise<void> {\n    const decisions = await options.store.list<PolicyDecisionSpec, PolicyDecisionStatus>({\n      apiVersion: POLICY_DECISION_API_VERSION,\n      kind: POLICY_DECISION_KIND,\n    });\n    const maximum = (decisions.items as PolicyDecisionResource[])\n      .filter((item) => item.spec.subjectRef.uid === request.resource.uid)\n      .reduce(\n        (value, item) => Math.max(value, item.spec.fencingEpoch),\n        0,\n      );\n    if ((request.fencingEpoch as number) < maximum) {\n      throw new OrchestrationError({\n        code: 'STALE_EPOCH',\n        message: `managed policy fencing epoch is stale; current epoch is ${maximum}`,\n        retryable: false,\n      });\n    }\n  }\n\n  async function persist(\n    request: DriverRequestEnvelope,\n    kind: PolicyDecisionKind,\n    policyDigest: string,\n    evaluation: PersistedPolicyEvaluation,\n    approval?: PolicyDecisionSpec['approval'],\n  ): Promise<PolicyDecision> {\n    assertDigest(policyDigest, 'policyDigest');\n    const normalized = validateEvaluation(evaluation);\n    return serialized(async () => {\n      await rejectStaleFence(request);\n      const inputDigest = await canonicalDigest(request.payload);\n      const requestFingerprint = await canonicalDigest({\n        method: request.method,\n        resource: request.resource,\n        fencingEpoch: request.fencingEpoch,\n        actor: request.actor,\n        session: request.session,\n        capabilityHandleRef: request.capabilityHandleRef,\n        payloadSchemaDigest: request.payloadSchemaDigest,\n        payload: request.payload,\n      });\n      const identityDigest = await canonicalDigest({\n        resourceUid: request.resource.uid,\n        method: request.method,\n        idempotencyKey: request.idempotencyKey,\n      });\n      const name = decisionName(identityDigest);\n      const existing = await options.store.get<PolicyDecisionSpec, PolicyDecisionStatus>({\n        apiVersion: POLICY_DECISION_API_VERSION,\n        kind: POLICY_DECISION_KIND,\n        name,\n      }) as PolicyDecisionResource | null;\n      if (existing) {\n        if (\n          existing.spec.requestFingerprint !== requestFingerprint ||\n          existing.spec.decisionKind !== kind\n        ) {\n          throw new OrchestrationError({\n            code: 'CONFLICT',\n            message: 'managed policy idempotency input drifted',\n            retryable: false,\n          });\n        }\n        return toDecision(existing);\n      }\n      const decidedAt = now().toISOString();\n      const manifest = createPolicyDecisionManifest(name, {\n        subjectRef: {\n          apiVersion: request.resource.apiVersion,\n          kind: request.resource.kind,\n          name: request.resource.name,\n          uid: request.resource.uid,\n          generation: request.resource.generation,\n        },\n        decisionKind: kind,\n        policyDigest,\n        inputDigest,\n        requestFingerprint,\n        idempotencyKey: request.idempotencyKey,\n        fencingEpoch: request.fencingEpoch as number,\n        requestedBy: request.actor.id,\n        reasons: normalized.reasons,\n        obligations: normalized.obligations ?? [],\n        decidedAt,\n        initialOutcome: normalized.outcome,\n        ...(approval ? { approval } : {}),\n      });\n      let created: PolicyDecisionResource;\n      try {\n        created = await options.store.create<PolicyDecisionSpec, PolicyDecisionStatus>(\n          request.actor,\n          manifest,\n          { idempotencyKey: `managed-policy:${identityDigest}` },\n        ) as PolicyDecisionResource;\n      } catch (error) {\n        const raced = await options.store.get<PolicyDecisionSpec, PolicyDecisionStatus>({\n          apiVersion: POLICY_DECISION_API_VERSION,\n          kind: POLICY_DECISION_KIND,\n          name,\n        }) as PolicyDecisionResource | null;\n        if (!raced || raced.spec.requestFingerprint !== requestFingerprint) throw error;\n        return toDecision(raced);\n      }\n      return toDecision(created);\n    });\n  }\n\n  const decisions: PolicyDecisionKind[] = ['approval'];\n  if (options.evaluateResourceAdmission) decisions.push('resource-admission');\n  if (options.evaluatePlacement) decisions.push('placement');\n  if (options.evaluateToolOperation) decisions.push('tool-operation');\n  if (options.evaluateTransition) decisions.push('transition');\n\n  return {\n    async getCapabilities() {\n      return {\n        name: options.name,\n        decisions: [...decisions],\n        defaultOutcome: 'deny',\n        supportsDurableApproval: true,\n        supportsExplanation: true,\n        persistence: options.persistence,\n        threatAssumptions: [...options.threatAssumptions],\n      };\n    },\n    async admitResource(request) {\n      await authorize(request, 'policy.admit-resource', [\n        'policyDigest',\n        'resourceApiVersion',\n        'resourceKind',\n      ], ['controller', 'admin']);\n      if (!options.evaluateResourceAdmission) {\n        unsupported('managed resource admission is not configured');\n      }\n      const policyDigest = assertDigest(request.payload.policyDigest, 'policyDigest');\n      boundedString(request.payload.resourceApiVersion, 'resourceApiVersion');\n      boundedString(request.payload.resourceKind, 'resourceKind');\n      const evaluation = await options.evaluateResourceAdmission(request);\n      return persist(request, 'resource-admission', policyDigest, evaluation);\n    },\n    async authorizePlacement(request) {\n      await authorize(request, 'policy.authorize-placement', [\n        'policyDigest',\n        'nodeId',\n        'nodeTrustClass',\n        'requiredTrustClass',\n        'attested',\n        'driverConformancePassed',\n      ], ['controller', 'admin']);\n      if (!options.evaluatePlacement) {\n        unsupported('managed placement authorization is not configured');\n      }\n      const policyDigest = assertDigest(request.payload.policyDigest, 'policyDigest');\n      boundedString(request.payload.nodeId, 'nodeId');\n      if (\n        !['trusted', 'restricted', 'quarantine'].includes(\n          request.payload.nodeTrustClass,\n        ) ||\n        !['trusted', 'restricted', 'quarantine'].includes(\n          request.payload.requiredTrustClass,\n        ) ||\n        typeof request.payload.attested !== 'boolean' ||\n        typeof request.payload.driverConformancePassed !== 'boolean'\n      ) invalid('managed placement payload is invalid');\n      const evaluation = await options.evaluatePlacement(request);\n      return persist(request, 'placement', policyDigest, evaluation);\n    },\n    async authorizeToolOperation(request) {\n      await authorize(request, 'policy.authorize-tool-operation', [\n        'policyDigest',\n        'toolName',\n        'effect',\n        'operationDigest',\n        'approvalDecisionHandle',\n      ], ['controller', 'admin']);\n      if (!options.evaluateToolOperation) {\n        unsupported('managed tool authorization is not configured');\n      }\n      const policyDigest = assertDigest(request.payload.policyDigest, 'policyDigest');\n      boundedString(request.payload.toolName, 'toolName');\n      const operationDigest = assertDigest(\n        request.payload.operationDigest,\n        'operationDigest',\n      );\n      if (\n        !['read', 'create', 'update', 'delete', 'execute', 'unknown'].includes(\n          request.payload.effect,\n        )\n      ) invalid('managed tool effect is invalid');\n      let approval: PolicyDecision | undefined;\n      if (request.payload.approvalDecisionHandle !== undefined) {\n        const resource = await resourceForHandle(\n          boundedString(\n            request.payload.approvalDecisionHandle,\n            'approvalDecisionHandle',\n          ),\n          request.resource.uid,\n        );\n        approval = toDecision(resource);\n        if (\n          approval.kind !== 'approval' ||\n          approval.outcome !== 'allow' ||\n          approval.policyDigest !== policyDigest ||\n          approval.approval?.subjectDigest !== operationDigest ||\n          Date.parse(approval.approval.expiresAt) <= now().getTime()\n        ) {\n          throw new OrchestrationError({\n            code: 'FORBIDDEN',\n            message: 'managed tool approval is invalid, expired, or cross-scoped',\n            retryable: false,\n          });\n        }\n      }\n      const evaluation = await options.evaluateToolOperation(request, approval);\n      return persist(request, 'tool-operation', policyDigest, evaluation);\n    },\n    async requestApproval(request) {\n      await authorize(request, 'policy.request-approval', [\n        'policyDigest',\n        'subjectKind',\n        'subjectDigest',\n        'reason',\n        'ttlMs',\n      ], ['controller', 'admin']);\n      const policyDigest = assertDigest(request.payload.policyDigest, 'policyDigest');\n      const subjectDigest = assertDigest(\n        request.payload.subjectDigest,\n        'subjectDigest',\n      );\n      if (\n        !['tool-operation', 'resource', 'placement', 'transition'].includes(\n          request.payload.subjectKind,\n        ) ||\n        !Number.isSafeInteger(request.payload.ttlMs) ||\n        request.payload.ttlMs < 1 ||\n        request.payload.ttlMs > maxApprovalTtlMs\n      ) invalid('managed approval request is invalid');\n      boundedString(request.payload.reason, 'reason');\n      const requestedAt = now();\n      return persist(\n        request,\n        'approval',\n        policyDigest,\n        {\n          outcome: 'pending',\n          reasons: ['approval awaits an authenticated administrator decision'],\n          obligations: ['deny if unresolved or expired'],\n        },\n        {\n          subjectDigest,\n          requestedBy: request.actor.id,\n          requestedAt: requestedAt.toISOString(),\n          expiresAt: new Date(\n            requestedAt.getTime() + request.payload.ttlMs,\n          ).toISOString(),\n        },\n      );\n    },\n    async resolveApproval(request) {\n      await authorize(request, 'policy.resolve-approval', [\n        'approvalDecisionHandle',\n        'outcome',\n        'reason',\n      ], ['admin']);\n      if (request.payload.outcome !== 'allow' && request.payload.outcome !== 'deny') {\n        invalid('managed approval resolution is invalid');\n      }\n      const reason = boundedString(request.payload.reason, 'reason');\n      return serialized(async () => {\n        await rejectStaleFence(request);\n        const resource = await resourceForHandle(\n          boundedString(\n            request.payload.approvalDecisionHandle,\n            'approvalDecisionHandle',\n          ),\n          request.resource.uid,\n        );\n        if (resource.spec.decisionKind !== 'approval' || !resource.spec.approval) {\n          invalid('managed policy decision is not an approval');\n        }\n        if (Date.parse(resource.spec.approval.expiresAt) <= now().getTime()) {\n          throw new OrchestrationError({\n            code: 'TIMEOUT',\n            message: 'managed approval expired before resolution',\n            retryable: false,\n          });\n        }\n        const resolutionInputDigest = await canonicalDigest(request.payload);\n        const currentOutcome = resource.status?.outcome ??\n          resource.spec.initialOutcome;\n        if (currentOutcome !== 'pending') {\n          if (\n            currentOutcome !== request.payload.outcome ||\n            resource.status?.resolutionInputDigest !== resolutionInputDigest\n          ) {\n            throw new OrchestrationError({\n              code: 'CONFLICT',\n              message: 'managed approval resolution is immutable',\n              retryable: false,\n            });\n          }\n          return toDecision(resource);\n        }\n        const status: PolicyDecisionStatus = {\n          outcome: request.payload.outcome,\n          decidedBy: request.actor.id,\n          decidedAt: now().toISOString(),\n          reasons: [reason],\n          resolutionInputDigest,\n        };\n        const updated = await options.store.updateStatus<\n          PolicyDecisionSpec\n        >(\n          request.actor,\n          {\n            apiVersion: POLICY_DECISION_API_VERSION,\n            kind: POLICY_DECISION_KIND,\n            name: resource.metadata.name,\n          },\n          status,\n          {\n            resourceVersion: resource.metadata.resourceVersion,\n            idempotencyKey: `managed-policy-resolve:${resource.metadata.uid}:${request.idempotencyKey}`,\n          },\n        ) as PolicyDecisionResource;\n        return toDecision(updated);\n      });\n    },\n    async verifyTransition(request) {\n      await authorize(request, 'policy.verify-transition', [\n        'policyDigest',\n        'transition',\n        'from',\n        'to',\n        'evidenceDigest',\n      ], ['verifier']);\n      if (!options.evaluateTransition) {\n        unsupported('managed transition verification is not configured');\n      }\n      const policyDigest = assertDigest(request.payload.policyDigest, 'policyDigest');\n      boundedString(request.payload.transition, 'transition');\n      boundedString(request.payload.from, 'from');\n      boundedString(request.payload.to, 'to');\n      assertDigest(request.payload.evidenceDigest, 'evidenceDigest');\n      const evaluation = await options.evaluateTransition(request);\n      return persist(request, 'transition', policyDigest, evaluation);\n    },\n    async explainDecision(request) {\n      await authorize(request, 'policy.explain-decision', ['decisionHandle'], [\n        'controller',\n        'verifier',\n        'admin',\n      ]);\n      const resource = await resourceForHandle(\n        boundedString(request.payload.decisionHandle, 'decisionHandle'),\n        request.resource.uid,\n      );\n      const decision = toDecision(resource);\n      return {\n        decision,\n        summary: `${decision.kind} ${decision.outcome}: ${decision.reasons.join('; ')}`,\n      };\n    },\n  };\n}\n","import type { ControlStoreActor } from '../controlStore.js';\nimport type { AgentWorkloadResource, InfrastructureDriverType, NetworkAttachmentStatus, ToolOperationResource } from '../resources.js';\nimport type { ExternalOrchestrationDriver } from './externalDriver.js';\nimport type { ModelGenerateRequest, ModelProviderDriver, ModelProviderHealth, ModelStreamChunk } from './modelProviderDriver.js';\nimport type { NetworkAttachRequest, NetworkDriver, NetworkDriverCapabilities, NetworkDriverHealth } from './networkDriver.js';\nimport type { ToolExecutionDriver } from './toolExecutionDriver.js';\n\nexport interface DriverManifest {\n  name: string;\n  version: string;\n  kind: InfrastructureDriverType;\n  capabilities: Record<string, boolean | string | number>;\n  supportsCancellation: boolean;\n  supportsBackpressure: boolean;\n  supportsAdoption: boolean;\n  supportsFencing: boolean;\n}\n\nexport interface DriverConformanceTest {\n  name: string;\n  description: string;\n  run: (driver: unknown) => Promise<void>;\n}\n\nexport interface DriverConformanceSuite {\n  interfaceKind: DriverManifest['kind'];\n  tests: DriverConformanceTest[];\n}\n\nexport interface FakeDriverOptions {\n  latencyMs?: number;\n  failureRate?: number;\n  supportsCancellation?: boolean;\n  supportsBackpressure?: boolean;\n  supportsAdoption?: boolean;\n  supportsFencing?: boolean;\n}\n\nasync function maybeFail(latency: number, failureRate: number): Promise<void> {\n  if (latency > 0) await new Promise((resolve) => setTimeout(resolve, latency));\n  if (Math.random() < failureRate) throw new Error('injected failure');\n}\n\n/**\n * Create a fake network driver for conformance testing.\n */\nexport function createFakeNetworkDriver(options: FakeDriverOptions = {}): NetworkDriver {\n  const latency = options.latencyMs ?? 0;\n  const failureRate = options.failureRate ?? 0;\n\n  return {\n    async getCapabilities(): Promise<NetworkDriverCapabilities> {\n      await maybeFail(latency, failureRate);\n      return {\n        name: 'fake-network-driver',\n        enforcedFeatures: ['egress'],\n        enforcementLevel: 'process',\n      };\n    },\n    async prepare(_request: NetworkAttachRequest): Promise<NetworkAttachmentStatus> {\n      await maybeFail(latency, failureRate);\n      return { handle: 'fake-handle' };\n    },\n    async check(_handle: string): Promise<NetworkAttachmentStatus | null> {\n      await maybeFail(latency, failureRate);\n      return { handle: 'fake-handle' };\n    },\n    async update(_handle: string, _request: NetworkAttachRequest): Promise<NetworkAttachmentStatus> {\n      await maybeFail(latency, failureRate);\n      return { handle: 'fake-handle' };\n    },\n    async resolveService(_name: string, _handle?: string): Promise<string | undefined> {\n      await maybeFail(latency, failureRate);\n      return undefined;\n    },\n    async release(_handle: string): Promise<void> {\n      await maybeFail(latency, failureRate);\n    },\n    async getHealth(): Promise<NetworkDriverHealth> {\n      await maybeFail(latency, failureRate);\n      return { healthy: true, checkedAt: new Date().toISOString() };\n    },\n  };\n}\n\n/**\n * Create a fake model provider driver for conformance testing.\n */\nexport function createFakeModelProviderDriver(options: FakeDriverOptions = {}): ModelProviderDriver {\n  const latency = options.latencyMs ?? 0;\n  const failureRate = options.failureRate ?? 0;\n\n  return {\n    async listModels() {\n      await maybeFail(latency, failureRate);\n      return [];\n    },\n    async getHealth(): Promise<ModelProviderHealth> {\n      await maybeFail(latency, failureRate);\n      return { healthy: true, checkedAt: new Date().toISOString() };\n    },\n    async *generate(_request: ModelGenerateRequest): AsyncIterable<ModelStreamChunk> {\n      await maybeFail(latency, failureRate);\n      yield { type: 'delta', delta: 'fake response' };\n    },\n  };\n}\n\n/**\n * Create a fake tool execution driver for conformance testing.\n */\nexport function createFakeToolExecutionDriver(options: FakeDriverOptions = {}): ToolExecutionDriver {\n  const latency = options.latencyMs ?? 0;\n  const failureRate = options.failureRate ?? 0;\n\n  return {\n    async execute(operation): Promise<ToolOperationResource> {\n      await maybeFail(latency, failureRate);\n      return {\n        ...operation,\n        status: { phase: 'Completed', startedAt: new Date().toISOString(), completedAt: new Date().toISOString() },\n      };\n    },\n  };\n}\n\n/**\n * Run a conformance suite against a driver.\n */\nexport async function runConformanceSuite(\n  suite: DriverConformanceSuite,\n  driver: unknown,\n): Promise<{ passed: number; failed: number; failures: Array<{ name: string; error: string }> }> {\n  const failures: Array<{ name: string; error: string }> = [];\n\n  for (const test of suite.tests) {\n    try {\n      await test.run(driver);\n    } catch (error) {\n      failures.push({\n        name: test.name,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n\n  return {\n    passed: suite.tests.length - failures.length,\n    failed: failures.length,\n    failures,\n  };\n}\n\n/**\n * Standard conformance tests for network drivers.\n */\nexport function createNetworkDriverConformanceSuite(): DriverConformanceSuite {\n  return {\n    interfaceKind: 'network',\n    tests: [\n      {\n        name: 'getCapabilities returns valid capabilities',\n        description: 'Driver must return its capability set',\n        run: async (driver) => {\n          const networkDriver = driver as NetworkDriver;\n          const capabilities = await networkDriver.getCapabilities();\n          if (!capabilities.name) throw new Error('name is required');\n          if (!capabilities.enforcementLevel) throw new Error('enforcementLevel is required');\n        },\n      },\n      {\n        name: 'prepare returns attachment status with handle',\n        description: 'Driver must prepare network for a workload',\n        run: async (driver) => {\n          const networkDriver = driver as NetworkDriver;\n          const result = await networkDriver.prepare({\n            attachment: {\n              apiVersion: 'network.memeloop.io/v1alpha1',\n              kind: 'NetworkAttachment',\n              metadata: { name: 'test', namespace: 'default', uid: 'uid-1', generation: 1, resourceVersion: '1', creationTimestamp: '2026-07-18T00:00:00.000Z' },\n              spec: { networkClassRef: { apiVersion: 'network.memeloop.io/v1alpha1', kind: 'NetworkClass', name: 'process' } },\n            },\n            networkClass: {\n              apiVersion: 'network.memeloop.io/v1alpha1',\n              kind: 'NetworkClass',\n              metadata: { name: 'process', namespace: 'default', uid: 'uid-2', generation: 1, resourceVersion: '1', creationTimestamp: '2026-07-18T00:00:00.000Z' },\n              spec: { driver: 'fake-network-driver', enforcement: 'best-effort' },\n            },\n            sandboxRef: 'sandbox-1',\n          });\n          if (!result.handle) throw new Error('prepare must return handle');\n        },\n      },\n      {\n        name: 'getHealth returns health status',\n        description: 'Driver must report its health',\n        run: async (driver) => {\n          const networkDriver = driver as NetworkDriver;\n          const health = await networkDriver.getHealth();\n          if (typeof health.healthy !== 'boolean') throw new Error('healthy is required');\n        },\n      },\n    ],\n  };\n}\n\n/**\n * Standard conformance tests for model provider drivers.\n */\nexport function createModelProviderDriverConformanceSuite(): DriverConformanceSuite {\n  return {\n    interfaceKind: 'model-provider',\n    tests: [\n      {\n        name: 'listModels returns model array',\n        description: 'Driver must list available models',\n        run: async (driver) => {\n          const modelDriver = driver as ModelProviderDriver;\n          const models = await modelDriver.listModels();\n          if (!Array.isArray(models)) throw new Error('listModels must return array');\n        },\n      },\n      {\n        name: 'getHealth returns health status',\n        description: 'Driver must report its health',\n        run: async (driver) => {\n          const modelDriver = driver as ModelProviderDriver;\n          const health = await modelDriver.getHealth();\n          if (typeof health.healthy !== 'boolean') throw new Error('healthy is required');\n        },\n      },\n    ],\n  };\n}\n\n/**\n * Standard conformance tests for tool execution drivers.\n */\nexport function createToolExecutionDriverConformanceSuite(): DriverConformanceSuite {\n  return {\n    interfaceKind: 'tool-execution',\n    tests: [\n      {\n        name: 'execute returns operation resource with status',\n        description: 'Driver must execute a tool operation',\n        run: async (driver) => {\n          const toolDriver = driver as ToolExecutionDriver;\n          const operation: ToolOperationResource = {\n            apiVersion: 'execution.memeloop.io/v1alpha1',\n            kind: 'ToolOperation',\n            metadata: { name: 'test', namespace: 'default', uid: 'uid-1', generation: 1, resourceVersion: '1', creationTimestamp: '2026-07-18T00:00:00.000Z' },\n            spec: { toolRef: { kind: 'Tool', name: 'test-tool' }, effect: 'execute' },\n          };\n          const result = await toolDriver.execute(operation);\n          if (!result.status) throw new Error('execute must return status');\n          if (!result.status.phase) throw new Error('status.phase is required');\n        },\n      },\n    ],\n  };\n}\n\n/**\n * Standard lifecycle and crash-adoption contract for optional external\n * orchestrators. Resource factories keep backend-specific runtime-image\n * annotations out of portable core while allowing this exact suite to run\n * against Swarm, Kubernetes, and future plugins.\n */\nexport function createExternalOrchestrationDriverConformanceSuite(options: {\n  createWorkload: (name: string) => AgentWorkloadResource;\n  createToolOperation: (name: string) => ToolOperationResource;\n  actor?: ControlStoreActor;\n}): DriverConformanceSuite {\n  const actor = options.actor ?? { id: 'controller/external-conformance', kind: 'controller' };\n  return {\n    interfaceKind: 'external-orchestrator',\n    tests: [\n      {\n        name: 'reports honest external orchestration capabilities and health',\n        description: 'Both independently managed resource kinds, adoption support, and health are explicit',\n        run: async (driver) => {\n          const external = driver as ExternalOrchestrationDriver;\n          const [capabilities, health] = await Promise.all([\n            external.getCapabilities(),\n            external.getHealth(),\n          ]);\n          for (const kind of ['AgentWorkload', 'ToolOperation'] as const) {\n            if (!capabilities.manages.includes(kind)) throw new Error(`capabilities do not manage ${kind}`);\n          }\n          if (!capabilities.supportsAdoption) throw new Error('crash-safe adoption is required');\n          if (typeof health.healthy !== 'boolean' || !health.checkedAt) throw new Error('invalid health result');\n        },\n      },\n      {\n        name: 'places, discovers, adopts, inspects, and stops a workload',\n        description: 'The workload lifecycle is independently addressable and duplicate UID placement is idempotent',\n        run: async (driver) => {\n          const external = driver as ExternalOrchestrationDriver;\n          const workload = options.createWorkload('external-conformance-workload');\n          const first = await external.placeWorkload(workload, actor);\n          if (!first.externalId) throw new Error('placement did not return externalId');\n          const second = await external.placeWorkload(workload, actor);\n          if (second.externalId !== first.externalId) throw new Error('duplicate workload UID was not adopted');\n          const status = await external.getWorkloadStatus(first.externalId);\n          if (status.externalId !== first.externalId) throw new Error('workload status identity mismatch');\n          const listed = await external.listWorkloads();\n          if (!listed.some((entry) => entry.externalId === first.externalId)) {\n            throw new Error('placed workload missing from listWorkloads');\n          }\n          await external.stopWorkload(first.externalId, actor);\n        },\n      },\n      {\n        name: 'executes, discovers, adopts, inspects, and cancels a tool operation',\n        description: 'The tool lifecycle is independently addressable and duplicate UID submission is idempotent',\n        run: async (driver) => {\n          const external = driver as ExternalOrchestrationDriver;\n          const operation = options.createToolOperation('external-conformance-tool');\n          const first = await external.executeToolOperation(operation, actor);\n          if (!first.externalId) throw new Error('execution did not return externalId');\n          const second = await external.executeToolOperation(operation, actor);\n          if (second.externalId !== first.externalId) throw new Error('duplicate tool UID was not adopted');\n          const status = await external.getToolOperationStatus(first.externalId);\n          if (status.externalId !== first.externalId) throw new Error('tool status identity mismatch');\n          const listed = await external.listToolOperations();\n          if (!listed.some((entry) => entry.externalId === first.externalId)) {\n            throw new Error('placed tool operation missing from listToolOperations');\n          }\n          await external.cancelToolOperation(first.externalId, actor);\n        },\n      },\n    ],\n  };\n}\n","/**\n * Plan 24.61: record/replay fixtures, capability negotiation, cancel/backpressure,\n * crash/adoption, idempotency/fencing, downgrade, and security conformance tests.\n *\n * These helpers are interface-agnostic: each takes the small set of driver\n * operations it needs, so the same suites apply to network, model-provider,\n * tool-execution, storage, and credential drivers.\n */\n\nimport type { DriverConformanceTest, DriverManifest } from './driverConformance.js';\n\n// ─── Assertion helpers (vitest-agnostic so suites run in any harness) ───\n\nasync function assertRejects(promise: Promise<unknown>, message: string): Promise<void> {\n  try {\n    await promise;\n  } catch {\n    return;\n  }\n  throw new Error(message);\n}\n\nasync function assertResolves(promise: Promise<unknown>, message: string): Promise<void> {\n  try {\n    await promise;\n  } catch (error) {\n    throw new Error(`${message}: ${error instanceof Error ? error.message : String(error)}`);\n  }\n}\n\n// ─── Record/Replay Fixtures ─────────────────────────────────────────\n\nexport interface RecordedInteraction {\n  method: string;\n  arguments: unknown[];\n  result?: unknown;\n  error?: string;\n  recordedAt: string;\n}\n\nexport interface DriverFixture {\n  name: string;\n  driverKind: DriverManifest['kind'];\n  interactions: RecordedInteraction[];\n}\n\n/**\n * Wrap a driver and record every method call into a fixture. The fixture can\n * be serialized to JSON and checked into the repo as a portable conformance\n * artifact.\n */\nexport function createRecordingDriver<T extends object>(driver: T, kind: DriverManifest['kind'], name: string): { driver: T; fixture: () => DriverFixture } {\n  const interactions: RecordedInteraction[] = [];\n  const proxy = new Proxy(driver, {\n    get(target, property, receiver) {\n      const value = Reflect.get(target, property, receiver);\n      if (typeof value !== 'function' || typeof property !== 'string') return value;\n      return async (...arguments_: unknown[]) => {\n        const recordedAt = new Date().toISOString();\n        try {\n          const result = await (value as (...arguments__: unknown[]) => Promise<unknown>).apply(target, arguments_);\n          interactions.push({ method: property, arguments: arguments_, result, recordedAt });\n          return result;\n        } catch (error) {\n          interactions.push({\n            method: property,\n            arguments: arguments_,\n            error: error instanceof Error ? error.message : String(error),\n            recordedAt,\n          });\n          throw error;\n        }\n      };\n    },\n  });\n  return {\n    driver: proxy,\n    fixture: () => ({ name, driverKind: kind, interactions: [...interactions] }),\n  };\n}\n\n/**\n * Create a driver that replays a recorded fixture. Each method call returns\n * the recorded result (or throws the recorded error) in order. A call that\n * does not match the next recorded interaction fails the replay.\n */\nexport function createReplayingDriver(fixture: DriverFixture): Record<string, unknown> {\n  let cursor = 0;\n  return new Proxy({} as Record<string, unknown>, {\n    get(_target, property) {\n      if (typeof property !== 'string') return undefined;\n      return async (..._arguments: unknown[]) => {\n        const interaction = fixture.interactions[cursor];\n        if (!interaction) {\n          throw new Error(`replay exhausted: no recorded interaction for ${property}`);\n        }\n        if (interaction.method !== property) {\n          throw new Error(`replay mismatch: expected ${interaction.method}, got ${property}`);\n        }\n        cursor += 1;\n        if (interaction.error) throw new Error(interaction.error);\n        return interaction.result;\n      };\n    },\n  });\n}\n\n// ─── Capability Negotiation ─────────────────────────────────────────\n\n/**\n * Verify a driver's reported capabilities satisfy the required capability set.\n * Returns the list of missing capabilities (empty when negotiation succeeds).\n */\nexport function negotiateCapabilities(\n  reported: Record<string, boolean | string | number>,\n  required: Record<string, boolean | string | number>,\n): string[] {\n  const missing: string[] = [];\n  for (const [key, value] of Object.entries(required)) {\n    if (reported[key] !== value) {\n      missing.push(key);\n    }\n  }\n  return missing;\n}\n\nexport function createCapabilityNegotiationTests(options: {\n  getCapabilities: (driver: unknown) => Promise<Record<string, boolean | string | number>>;\n  requiredCapabilities: Record<string, boolean | string | number>;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'capability negotiation succeeds for required set',\n      description: 'Driver-reported capabilities must cover every required capability',\n      run: async (driver) => {\n        const reported = await options.getCapabilities(driver);\n        const missing = negotiateCapabilities(reported, options.requiredCapabilities);\n        if (missing.length > 0) {\n          throw new Error(`missing required capabilities: ${missing.join(', ')}`);\n        }\n      },\n    },\n    {\n      name: 'capability negotiation rejects unsupported requirement',\n      description: 'Control plane must detect when a driver cannot satisfy a requirement',\n      run: async (driver) => {\n        const reported = await options.getCapabilities(driver);\n        const missing = negotiateCapabilities(reported, { 'definitely-unsupported-capability': true });\n        if (missing.length === 0) {\n          throw new Error('negotiation must report missing capabilities');\n        }\n      },\n    },\n  ];\n}\n\n// ─── Cancel / Backpressure ──────────────────────────────────────────\n\nexport function createCancellationTests(options: {\n  startLongOperation: (driver: unknown, signal: AbortSignal) => Promise<unknown>;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'cancellation aborts a long-running operation',\n      description: 'Aborting the signal must terminate the operation with a cancellation error',\n      run: async (driver) => {\n        const controller = new AbortController();\n        const pending = options.startLongOperation(driver, controller.signal);\n        controller.abort();\n        await assertRejects(pending, 'operation must reject when aborted');\n      },\n    },\n    {\n      name: 'unaborted long operation completes',\n      description: 'Control case: without abort, the operation completes normally',\n      run: async (driver) => {\n        const controller = new AbortController();\n        await assertResolves(options.startLongOperation(driver, controller.signal), 'operation must complete when not aborted');\n      },\n    },\n  ];\n}\n\nexport function createBackpressureTests(options: {\n  submit: (driver: unknown) => Promise<unknown>;\n  concurrencyLimit: number;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'backpressure rejects excess concurrent operations',\n      description: 'Driver must reject or queue operations beyond its concurrency limit',\n      run: async (driver) => {\n        const inFlight = Array.from({ length: options.concurrencyLimit + 5 }, () => options.submit(driver));\n        const results = await Promise.allSettled(inFlight);\n        const rejected = results.filter((result) => result.status === 'rejected');\n        // At least one submission beyond the limit must be rejected or all must complete.\n        if (rejected.length === 0 && results.length > options.concurrencyLimit * 4) {\n          throw new Error('driver accepted unbounded concurrency without backpressure');\n        }\n      },\n    },\n  ];\n}\n\n// ─── Crash / Adoption ───────────────────────────────────────────────\n\nexport function createAdoptionTests(options: {\n  createResource: (driver: unknown) => Promise<string>;\n  recreateDriver: () => unknown;\n  listResources: (driver: unknown) => Promise<string[]>;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'restarted driver adopts pre-crash resources',\n      description: 'A new driver instance must discover resources created before the crash',\n      run: async (driver) => {\n        const resourceId = await options.createResource(driver);\n        const restarted = options.recreateDriver();\n        const adopted = await options.listResources(restarted);\n        if (!adopted.includes(resourceId)) {\n          throw new Error(`restarted driver did not adopt resource ${resourceId}`);\n        }\n      },\n    },\n  ];\n}\n\n// ─── Idempotency / Fencing ──────────────────────────────────────────\n\nexport function createIdempotencyTests(options: {\n  submitWithIdempotencyKey: (driver: unknown, key: string) => Promise<unknown>;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'repeated submission with same idempotency key returns same result',\n      description: 'Duplicate submissions must not create duplicate side effects',\n      run: async (driver) => {\n        const key = `idem-${Date.now()}`;\n        const first = await options.submitWithIdempotencyKey(driver, key);\n        const second = await options.submitWithIdempotencyKey(driver, key);\n        if (JSON.stringify(first) !== JSON.stringify(second)) {\n          throw new Error('idempotent submissions returned different results');\n        }\n      },\n    },\n  ];\n}\n\nexport function createFencingTests(options: {\n  operateWithFence: (driver: unknown, fenceToken: number) => Promise<unknown>;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'stale fence token is rejected',\n      description: 'An operation carrying an older fence token must fail',\n      run: async (driver) => {\n        await options.operateWithFence(driver, 2);\n        await assertRejects(options.operateWithFence(driver, 1), 'stale fence token must be rejected');\n      },\n    },\n    {\n      name: 'monotonic fence tokens are accepted',\n      description: 'Operations with increasing fence tokens must succeed',\n      run: async (driver) => {\n        await options.operateWithFence(driver, 10);\n        await assertResolves(options.operateWithFence(driver, 11), 'monotonic fence token must be accepted');\n      },\n    },\n  ];\n}\n\n// ─── Downgrade ──────────────────────────────────────────────────────\n\nexport function createDowngradeTests(options: {\n  callWithVersion: (driver: unknown, version: string) => Promise<unknown>;\n  supportedVersion: string;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'unsupported newer version is rejected with explicit error',\n      description: 'Driver must fail closed when asked to speak a newer protocol version',\n      run: async (driver) => {\n        await assertRejects(options.callWithVersion(driver, 'v999'), 'unsupported version must be rejected');\n      },\n    },\n    {\n      name: 'supported version is accepted',\n      description: 'Control case: the supported protocol version works',\n      run: async (driver) => {\n        await assertResolves(options.callWithVersion(driver, options.supportedVersion), 'supported version must be accepted');\n      },\n    },\n  ];\n}\n\n// ─── Security ───────────────────────────────────────────────────────\n\nexport function createSecurityTests(options: {\n  callAsActor: (driver: unknown, actorId: string) => Promise<unknown>;\n  unauthorizedActorId: string;\n  authorizedActorId: string;\n}): DriverConformanceTest[] {\n  return [\n    {\n      name: 'unauthorized actor is rejected',\n      description: 'Driver must reject calls from actors without grants',\n      run: async (driver) => {\n        await assertRejects(options.callAsActor(driver, options.unauthorizedActorId), 'unauthorized actor must be rejected');\n      },\n    },\n    {\n      name: 'authorized actor is accepted',\n      description: 'Control case: an actor with grants succeeds',\n      run: async (driver) => {\n        await assertResolves(options.callAsActor(driver, options.authorizedActorId), 'authorized actor must be accepted');\n      },\n    },\n  ];\n}\n","import type { ControlStoreActor } from '../controlStore.js';\nimport { ORCHESTRATION_ERROR_CODES, type OrchestrationErrorData } from '../errors.js';\nimport type { AgentWorkloadResource, ToolOperationResource, ToolOperationResult } from '../resources.js';\nimport type { ExternalToolContract } from './externalToolContract.js';\nimport type { ExternalWorkloadRuntimeContract } from './externalWorkloadContract.js';\n\nconst RUNTIME_RESULT_PREFIX = 'MEMELOOP_RESULT ';\n\nexport interface ExternalRuntimeResult {\n  phase: 'Completed' | 'Failed' | 'Cancelled';\n  summary?: string;\n  result?: ToolOperationResult;\n  error?: OrchestrationErrorData;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction isOrchestrationErrorData(value: unknown): value is OrchestrationErrorData {\n  if (!isRecord(value)) return false;\n  return (\n    typeof value.code === 'string' &&\n    ORCHESTRATION_ERROR_CODES.includes(value.code as OrchestrationErrorData['code']) &&\n    typeof value.message === 'string' &&\n    typeof value.retryable === 'boolean' &&\n    (value.retryAfterMs === undefined ||\n      (typeof value.retryAfterMs === 'number' && Number.isFinite(value.retryAfterMs))) &&\n    (value.reason === undefined || typeof value.reason === 'string') &&\n    (value.details === undefined || isRecord(value.details))\n  );\n}\n\n/** Parse the last structured worker-result line from a bounded log tail. */\nexport function parseExternalRuntimeResult(logTail: string): ExternalRuntimeResult | undefined {\n  const offset = logTail.lastIndexOf(RUNTIME_RESULT_PREFIX);\n  if (offset < 0) return undefined;\n  const line = logTail\n    .slice(offset + RUNTIME_RESULT_PREFIX.length)\n    .split(/\\r?\\n/, 1)[0]\n    ?.trim();\n  if (!line) return undefined;\n  try {\n    const value = JSON.parse(line) as Record<string, unknown>;\n    if (!isRecord(value)) return undefined;\n    if (value.phase !== 'Completed' && value.phase !== 'Failed' && value.phase !== 'Cancelled') {\n      return undefined;\n    }\n    if (value.summary !== undefined && typeof value.summary !== 'string') return undefined;\n    if (\n      value.result !== undefined &&\n      (!isRecord(value.result) ||\n        (value.result.error !== undefined && !isOrchestrationErrorData(value.result.error)) ||\n        (value.result.evidenceRef !== undefined && typeof value.result.evidenceRef !== 'string'))\n    ) {\n      return undefined;\n    }\n    if (value.error !== undefined && !isOrchestrationErrorData(value.error)) return undefined;\n    return value as unknown as ExternalRuntimeResult;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * External orchestrator driver contract (24.62).\n *\n * Every external orchestrator (Docker Swarm, Kubernetes/K3s, Nomad, etc.)\n * implements this portable contract so that the memeloop control plane can\n * map AgentWorkload and ToolOperation resources without importing any\n * backend SDK into core or the default CLI.\n *\n * Driver packages (memeloop-swarm, memeloop-k8s, etc.) are separate optional\n * Node packages that import this contract from `memeloop` and register\n * themselves through the ControlStore's driver manifest system.\n */\n\nexport interface ExternalPlacementResult {\n  /** External orchestrator's native resource identifier (service name, pod name, job name). */\n  externalId: string;\n  /** The node where the workload or operation was placed. */\n  nodeName: string;\n  /** Provider-specific metadata (e.g. Docker service ID, K8s UID). */\n  providerMetadata?: Record<string, string>;\n}\n\nexport interface ExternalStatusResult {\n  externalId: string;\n  phase: 'Pending' | 'Running' | 'Succeeded' | 'Failed' | 'Cancelled' | 'Unknown';\n  message?: string;\n  /** Structured, validated `MEMELOOP_RESULT` recovered from the worker. */\n  runtimeResult?: ExternalRuntimeResult;\n  /** When the external orchestrator last reported this status. */\n  observedAt: string;\n  /** Resource usage reported by the external runtime. */\n  resources?: {\n    cpuCores?: number;\n    memoryBytes?: number;\n  };\n}\n\nexport interface ExternalDriverCapabilities {\n  name: string;\n  version: string;\n  /** What the driver manages: workloads, tool-operations, or both. */\n  manages: Array<'AgentWorkload' | 'ToolOperation'>;\n  /** Whether the driver supports co-located scheduling (workload + tool on same node). */\n  supportsColocation: boolean;\n  /**\n   * Whether repeated placement of the same immutable MemeLoop resource UID\n   * adopts the native object. Required for crash-safe controller recovery.\n   */\n  supportsAdoption: boolean;\n  /** Maximum concurrent workloads this driver can handle. */\n  maxConcurrency?: number;\n  /**\n   * Trusted tool/runtime contracts. Required for every externally placed\n   * ToolOperation; an empty/absent catalog makes tool placement fail closed.\n   */\n  toolContracts?: ExternalToolContract[];\n  /** Host-owned runtimeClass-to-container bindings for AgentWorkloads. */\n  workloadRuntimes?: ExternalWorkloadRuntimeContract[];\n}\n\nexport interface ExternalWorkloadPlacementContext {\n  /** Admitted source resolved from the content-addressed artifact store. */\n  scriptSource?: string;\n  /**\n   * Single-use worker bootstrap secret. Drivers must materialize it through\n   * their native secret mechanism as a read-only file, never argv, ordinary\n   * environment, labels, annotations, provider metadata, or ControlStore.\n   */\n  workerBootstrap?: ExternalWorkerBootstrapSecret;\n  /** Portable cancellation for placement requests. */\n  signal?: AbortSignal;\n}\n\nexport interface ExternalWorkerBootstrapSecret {\n  apiVersion: 'worker.memeloop.io/v1alpha1';\n  gatewayUrl: string;\n  gatewayPublicKey: string;\n  gatewayKeyFingerprint: string;\n  /** Optional PEM CA certificate for an internal HTTPS worker gateway. */\n  gatewayCaCertificate?: string;\n  enrollmentName: string;\n  bootstrapToken: string;\n}\n\n/**\n * Portable external orchestrator driver.\n *\n * Implementations translate between memeloop orchestration resources and\n * the external orchestrator's native API. The control plane never calls\n * Docker/K8s SDKs directly — it always goes through this contract.\n */\nexport interface ExternalOrchestrationDriver {\n  /** Return capabilities so the control plane knows what to route. */\n  getCapabilities(): Promise<ExternalDriverCapabilities>;\n\n  /** Place an AgentWorkload on the external orchestrator. */\n  placeWorkload(\n    workload: AgentWorkloadResource,\n    actor: ControlStoreActor,\n    context?: ExternalWorkloadPlacementContext,\n  ): Promise<ExternalPlacementResult>;\n\n  /** Get the current status of a placed workload. */\n  getWorkloadStatus(externalId: string): Promise<ExternalStatusResult>;\n\n  /** Stop and remove a placed workload. */\n  stopWorkload(externalId: string, actor: ControlStoreActor): Promise<void>;\n\n  /** Execute a ToolOperation on the external orchestrator. */\n  executeToolOperation(\n    operation: ToolOperationResource,\n    actor: ControlStoreActor,\n  ): Promise<ExternalPlacementResult>;\n\n  /** Get the current status of a tool operation execution. */\n  getToolOperationStatus(externalId: string): Promise<ExternalStatusResult>;\n\n  /** Cancel a running tool operation. */\n  cancelToolOperation(externalId: string, actor: ControlStoreActor): Promise<void>;\n\n  /** List all workloads currently managed by this driver. */\n  listWorkloads(): Promise<ExternalStatusResult[]>;\n\n  /** List all tool operations currently managed by this driver. */\n  listToolOperations(): Promise<ExternalStatusResult[]>;\n\n  /** Health check for the driver connection. */\n  getHealth(): Promise<{ healthy: boolean; detail?: string; checkedAt: string }>;\n}\n","import { Ajv, type ValidateFunction } from 'ajv';\nimport { Ajv2019 } from 'ajv/dist/2019.js';\nimport { Ajv2020 } from 'ajv/dist/2020.js';\n\nimport { OrchestrationError } from '../errors.js';\nimport type { ToolOperationEffect, ToolOperationResource } from '../resources.js';\n\nexport interface ExternalToolContract {\n  /** Exact portable tool identity implemented by the external runtime. */\n  kind: string;\n  name: string;\n  /** Host-authoritative effect. A caller cannot downgrade this value. */\n  effect: ToolOperationEffect;\n  /** Portable JSON Schema applied without coercion, defaults, or field removal. */\n  inputSchema: Record<string, unknown>;\n  /** Portable JSON Schema for the untrusted runtime's returned value. */\n  outputSchema: Record<string, unknown>;\n  /** Optional content digest callers may pin through `toolRef.schemaDigest`. */\n  schemaDigest?: string;\n  /** Host-owned hard resource ceiling for the one-shot executor. */\n  resources: {\n    cpuMillicores: number;\n    memoryBytes: number;\n  };\n  /** Exact immutable/tagged image references admitted to implement this contract. */\n  runtimeImages: string[];\n}\n\nconst validatorOptions = {\n  allErrors: true,\n  coerceTypes: false,\n  removeAdditional: false,\n  strict: false,\n  useDefaults: false,\n  validateFormats: false,\n} as const;\nconst TOOL_EFFECTS = new Set<ToolOperationEffect>([\n  'read',\n  'create',\n  'update',\n  'delete',\n  'execute',\n  'unknown',\n]);\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction compilerFor(schema: Record<string, unknown>): Ajv | Ajv2019 | Ajv2020 {\n  switch (schema.$schema) {\n    case undefined:\n    case 'http://json-schema.org/draft-07/schema#':\n    case 'https://json-schema.org/draft-07/schema#': {\n      return new Ajv(validatorOptions);\n    }\n    case 'https://json-schema.org/draft/2019-09/schema': {\n      return new Ajv2019(validatorOptions);\n    }\n    case 'https://json-schema.org/draft/2020-12/schema': {\n      return new Ajv2020(validatorOptions);\n    }\n    default: {\n      invalid(`external tool contract uses unsupported schema draft '${String(schema.$schema)}'`);\n    }\n  }\n}\n\nfunction compileSchema(\n  contract: ExternalToolContract,\n  schema: Record<string, unknown>,\n  direction: 'input' | 'output',\n): ValidateFunction {\n  if (\n    typeof contract.kind !== 'string' ||\n    contract.kind.length === 0 ||\n    typeof contract.name !== 'string' ||\n    contract.name.length === 0 ||\n    !TOOL_EFFECTS.has(contract.effect) ||\n    !Array.isArray(contract.runtimeImages) ||\n    contract.runtimeImages.length === 0 ||\n    contract.runtimeImages.some((image) => typeof image !== 'string' || image.length === 0) ||\n    !contract.resources ||\n    !Number.isSafeInteger(contract.resources.cpuMillicores) ||\n    contract.resources.cpuMillicores < 1 ||\n    !Number.isSafeInteger(contract.resources.memoryBytes) ||\n    contract.resources.memoryBytes < 1\n  ) {\n    invalid(`external tool contract '${contract.name}' is incomplete`);\n  }\n  try {\n    return compilerFor(schema).compile(schema);\n  } catch {\n    invalid(`external tool contract '${contract.name}' has an invalid ${direction} schema`);\n  }\n}\n\n/** Validate a driver-published catalog once at construction/discovery time. */\nexport function assertExternalToolContracts(\n  contracts: readonly ExternalToolContract[],\n): void {\n  const identities = new Set<string>();\n  for (const contract of contracts) {\n    if (contract === null || typeof contract !== 'object' || Array.isArray(contract)) {\n      invalid('external tool contract must be an object');\n    }\n    const identity = `${contract.kind}\\0${contract.name}`;\n    if (identities.has(identity)) {\n      invalid(`external tool contract '${contract.kind}/${contract.name}' is duplicated`);\n    }\n    identities.add(identity);\n    compileSchema(contract, contract.inputSchema, 'input');\n    compileSchema(contract, contract.outputSchema, 'output');\n  }\n}\n\n/**\n * Bind an externally placed operation to the driver/runtime's trusted\n * declaration before any native API call or adoption lookup.\n */\nexport function assertExternalToolOperationContract(\n  operation: ToolOperationResource,\n  contracts: readonly ExternalToolContract[] | undefined,\n  runtimeImage: string | undefined,\n): ExternalToolContract {\n  const matches = (contracts ?? []).filter((candidate) =>\n    candidate.kind === operation.spec.toolRef.kind &&\n    candidate.name === operation.spec.toolRef.name\n  );\n  if (matches.length !== 1) {\n    invalid(\n      `external tool '${operation.spec.toolRef.kind}/${operation.spec.toolRef.name}' has no unique trusted runtime contract`,\n    );\n  }\n  const contract = matches[0];\n  if (operation.spec.effect !== contract.effect) {\n    invalid(\n      `external tool '${contract.name}' effect '${operation.spec.effect}' does not match host contract '${contract.effect}'`,\n    );\n  }\n  if (\n    operation.spec.toolRef.schemaDigest !== undefined &&\n    operation.spec.toolRef.schemaDigest !== contract.schemaDigest\n  ) {\n    invalid(`external tool '${contract.name}' schema digest does not match the host contract`);\n  }\n  if (runtimeImage !== undefined && !contract.runtimeImages.includes(runtimeImage)) {\n    invalid(`runtime image '${runtimeImage}' is not admitted for external tool '${contract.name}'`);\n  }\n  const validate = compileSchema(contract, contract.inputSchema, 'input');\n  if (!validate(operation.spec.arguments ?? {})) {\n    invalid(`external tool '${contract.name}' arguments do not match the host contract`);\n  }\n  return contract;\n}\n\n/** Validate the value returned by an external runtime before persistence. */\nexport function assertExternalToolOperationResult(\n  contract: ExternalToolContract,\n  value: unknown,\n): void {\n  const validate = compileSchema(contract, contract.outputSchema, 'output');\n  if (!validate(value)) {\n    invalid(`external tool '${contract.name}' result does not match the host contract`);\n  }\n}\n\n/** Contracts implemented by the bundled minimal worker-runtime image. */\nexport function createMinimalExternalRuntimeToolContracts(runtimeImage: string): ExternalToolContract[] {\n  return [{\n    kind: 'Tool',\n    name: 'memeloop.runtime.health',\n    effect: 'read',\n    inputSchema: { type: 'object', additionalProperties: false },\n    outputSchema: {\n      type: 'object',\n      properties: { healthy: { type: 'boolean' } },\n      required: ['healthy'],\n      additionalProperties: false,\n    },\n    resources: { cpuMillicores: 500, memoryBytes: 256 * 1024 * 1024 },\n    runtimeImages: [runtimeImage],\n  }, {\n    kind: 'Tool',\n    name: 'memeloop.runtime.echo',\n    effect: 'read',\n    inputSchema: { type: 'object' },\n    outputSchema: { type: 'object' },\n    resources: { cpuMillicores: 500, memoryBytes: 256 * 1024 * 1024 },\n    runtimeImages: [runtimeImage],\n  }];\n}\n","import { OrchestrationError } from '../errors.js';\nimport type { AgentWorkloadResource } from '../resources.js';\nimport type { AgentWorkloadResourceRequirements } from '../resources.js';\n\nconst RUNTIME_IMAGE_ANNOTATION = 'memeloop.io/runtime-image';\nconst RUNTIME_COMMAND_ANNOTATION = 'memeloop.io/runtime-command';\nconst RUNTIME_ENV_ANNOTATION = 'memeloop.io/runtime-env';\nconst RUNTIME_CPU_ANNOTATION = 'memeloop.io/runtime-cpu';\nconst RUNTIME_MEMORY_ANNOTATION = 'memeloop.io/runtime-memory';\n\nexport interface ExternalWorkloadRuntimeContract {\n  /** Matches `AgentWorkload.spec.runtimeClass`; `default` matches omission. */\n  runtimeClass: string;\n  /** Host-selected image. Production deployments should pin a manifest digest. */\n  image: string;\n  /** Host-selected entrypoint override, if the image default is insufficient. */\n  command?: string[];\n  /** Host-selected non-secret container environment. */\n  environment?: Record<string, string>;\n  /** Default and maximum enforced CPU/memory allocation. */\n  resources: {\n    cpuMillicores: number;\n    memoryBytes: number;\n  };\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nexport function assertExternalWorkloadRuntimeContracts(\n  contracts: readonly ExternalWorkloadRuntimeContract[],\n): void {\n  const classes = new Set<string>();\n  for (const contract of contracts) {\n    if (contract === null || typeof contract !== 'object' || Array.isArray(contract)) {\n      invalid('external workload runtime contract must be an object');\n    }\n    if (\n      typeof contract.runtimeClass !== 'string' ||\n      contract.runtimeClass.length === 0 ||\n      typeof contract.image !== 'string' ||\n      contract.image.length === 0\n    ) {\n      invalid('external workload runtime contracts require runtimeClass and image');\n    }\n    if (\n      !Number.isSafeInteger(contract.resources?.cpuMillicores) ||\n      contract.resources.cpuMillicores < 1 ||\n      !Number.isSafeInteger(contract.resources?.memoryBytes) ||\n      contract.resources.memoryBytes < 1\n    ) {\n      invalid(\n        `external workload runtimeClass '${contract.runtimeClass}' requires positive safe CPU/memory limits`,\n      );\n    }\n    if (classes.has(contract.runtimeClass)) {\n      invalid(`external workload runtimeClass '${contract.runtimeClass}' is duplicated`);\n    }\n    classes.add(contract.runtimeClass);\n    if (\n      (\n        contract.command !== undefined &&\n        (\n          !Array.isArray(contract.command) ||\n          contract.command.some((argument) => typeof argument !== 'string')\n        )\n      ) ||\n      (\n        contract.environment !== undefined &&\n        !isRecord(contract.environment)\n      ) ||\n      Object.entries(contract.environment ?? {}).some(([key, value]) => !key || typeof value !== 'string' || key.startsWith('MEMELOOP_'))\n    ) {\n      invalid(`external workload runtimeClass '${contract.runtimeClass}' has invalid command or environment`);\n    }\n  }\n}\n\n/**\n * Resolve only host-published runtime configuration. Legacy annotations are\n * rejected because they let a workload replace the trusted worker process.\n */\nexport function resolveExternalWorkloadRuntime(\n  workload: AgentWorkloadResource,\n  contracts: readonly ExternalWorkloadRuntimeContract[] | undefined,\n): ExternalWorkloadRuntimeContract {\n  const annotations = workload.metadata.annotations;\n  if (\n    annotations?.[RUNTIME_IMAGE_ANNOTATION] !== undefined ||\n    annotations?.[RUNTIME_COMMAND_ANNOTATION] !== undefined ||\n    annotations?.[RUNTIME_ENV_ANNOTATION] !== undefined ||\n    annotations?.[RUNTIME_CPU_ANNOTATION] !== undefined ||\n    annotations?.[RUNTIME_MEMORY_ANNOTATION] !== undefined\n  ) {\n    invalid(\n      'AgentWorkload runtime image, command, container environment, and resources are host-owned; select spec.runtimeClass and spec.resources instead',\n    );\n  }\n  const runtimeClass = workload.spec.runtimeClass ?? 'default';\n  const matches = (contracts ?? []).filter((candidate) => candidate.runtimeClass === runtimeClass);\n  if (matches.length !== 1) {\n    invalid(`AgentWorkload runtimeClass '${runtimeClass}' has no unique trusted external runtime`);\n  }\n  return matches[0];\n}\n\n/** Apply host maxima and safe defaults to portable workload requirements. */\nexport function resolveExternalWorkloadResources(\n  workload: AgentWorkloadResource,\n  contract: ExternalWorkloadRuntimeContract,\n): AgentWorkloadResourceRequirements {\n  const requested = workload.spec.resources;\n  if (\n    (requested?.gpuCount ?? 0) > 0 ||\n    (requested?.diskBytes ?? 0) > 0 ||\n    (requested?.bandwidthKbps ?? 0) > 0\n  ) {\n    invalid(\n      `external runtimeClass '${contract.runtimeClass}' does not implement GPU, disk, or bandwidth isolation`,\n    );\n  }\n  const cpuMillicores = requested?.cpuMillicores ??\n    contract.resources.cpuMillicores;\n  const memoryBytes = requested?.memoryBytes ?? contract.resources.memoryBytes;\n  if (\n    !Number.isSafeInteger(cpuMillicores) ||\n    cpuMillicores < 1 ||\n    cpuMillicores > contract.resources.cpuMillicores ||\n    !Number.isSafeInteger(memoryBytes) ||\n    memoryBytes < 1 ||\n    memoryBytes > contract.resources.memoryBytes\n  ) {\n    invalid(\n      `AgentWorkload resources exceed the host contract for runtimeClass '${contract.runtimeClass}'`,\n    );\n  }\n  return { cpuMillicores, memoryBytes };\n}\n","import {\n  createModelClassManifest,\n  createModelEndpointManifest,\n  MODEL_CLASS_API_VERSION,\n  MODEL_CLASS_KIND,\n  type ModelClassManifest,\n  type ModelEndpointManifest,\n} from '../resources.js';\nimport { modelClassNameForSpec, type ModelProviderDriver, type ModelProviderHealth } from './modelProviderDriver.js';\n\n/**\n * Local model endpoint registration (plan 24.36).\n *\n * A worker advertises the models its ModelProviderDriver can serve as\n * ModelClass + ModelEndpoint manifests. Advertisement carries digest, health,\n * capacity, modalities, data policy, and node trust so the scheduler can\n * place model calls without contacting the node. Local model output is data\n * only — it can never authorize tool admission, which is host-bound.\n */\n\nexport interface LocalModelAdvertisementOptions {\n  nodeId: string;\n  trust: 'trusted' | 'restricted' | 'quarantine';\n  /** Prefix for opaque endpoint handles (default `local://<nodeId>`). */\n  endpointPrefix?: string;\n  capacity?: {\n    maxConcurrent?: number;\n    tokensPerMinute?: number;\n  };\n  dataPolicy?: {\n    classification?: string;\n    retention?: string;\n  };\n}\n\nexport interface LocalModelAdvertisement {\n  modelClasses: ModelClassManifest[];\n  endpoints: ModelEndpointManifest[];\n  health: ModelProviderHealth;\n}\n\nfunction sanitizeModelName(name: string): string {\n  return name.toLowerCase().replace(/[^a-z0-9.-]+/g, '-').replace(/^-+|-+$/g, '') || 'model';\n}\n\n/**\n * Build declarative manifests for every model the driver serves. Endpoint\n * handles are opaque (`<prefix>/<provider>/<model>`) and never embed\n * credentials or URLs.\n */\nexport async function describeLocalModelEndpoints(\n  driver: ModelProviderDriver,\n  options: LocalModelAdvertisementOptions,\n): Promise<LocalModelAdvertisement> {\n  const [models, health] = await Promise.all([driver.listModels(), driver.getHealth()]);\n  const prefix = options.endpointPrefix ?? `local://${options.nodeId}`;\n\n  const modelClasses: ModelClassManifest[] = [];\n  const endpoints: ModelEndpointManifest[] = [];\n\n  for (const model of models) {\n    const baseName = modelClassNameForSpec(model);\n    modelClasses.push(createModelClassManifest(baseName, model));\n    endpoints.push(createModelEndpointManifest(`${baseName}-${sanitizeModelName(options.nodeId)}`, {\n      modelClassRef: { apiVersion: MODEL_CLASS_API_VERSION, kind: MODEL_CLASS_KIND, name: baseName },\n      ...(model.digest ? { modelDigest: model.digest } : {}),\n      nodeId: options.nodeId,\n      trust: options.trust,\n      endpoint: `${prefix}/${model.provider}/${model.model}`,\n      ...(options.capacity ? { capacity: options.capacity } : {}),\n      ...(options.dataPolicy ? { dataPolicy: options.dataPolicy } : {}),\n    }));\n  }\n\n  return { modelClasses, endpoints, health };\n}\n\nexport type ModelEndpointTrust = 'trusted' | 'restricted' | 'quarantine';\n\nconst TRUST_RANK: Record<ModelEndpointTrust, number> = {\n  quarantine: 0,\n  restricted: 1,\n  trusted: 2,\n};\n\nexport interface ModelSelectionRequirements {\n  /** Required ModelClass name. */\n  modelClassName: string;\n  /** Required model digest; endpoints with a mismatching digest are excluded. */\n  modelDigest?: string;\n  /** Minimum acceptable node trust (default `quarantine` — any node qualifies). */\n  minimumTrust?: ModelEndpointTrust;\n  /** Exclude endpoints whose status reports unhealthy (default true). */\n  requireHealthy?: boolean;\n  /** Required spare concurrency. */\n  minConcurrent?: number;\n}\n\nexport interface SelectableModelEndpoint {\n  manifest: ModelEndpointManifest;\n  status?: {\n    healthy?: boolean;\n  };\n}\n\n/**\n * Pick the best endpoint for a model call: filters by class name, digest,\n * trust, health, and capacity, then prefers the highest-capacity endpoint.\n * Returns null when nothing qualifies — the caller must surface a scheduling\n * failure rather than silently falling back to an unvetted endpoint.\n */\nexport function selectModelEndpoint(\n  endpoints: SelectableModelEndpoint[],\n  requirements: ModelSelectionRequirements,\n): ModelEndpointManifest | null {\n  const minimumTrustRank = TRUST_RANK[requirements.minimumTrust ?? 'quarantine'];\n  const requireHealthy = requirements.requireHealthy ?? true;\n\n  const candidates = endpoints.filter(({ manifest, status }) => {\n    if (manifest.spec.modelClassRef.name !== requirements.modelClassName) return false;\n    if (requirements.modelDigest && manifest.spec.modelDigest !== requirements.modelDigest) return false;\n    const trustRank = TRUST_RANK[manifest.spec.trust ?? 'quarantine'];\n    if (trustRank < minimumTrustRank) return false;\n    if (requireHealthy && status?.healthy === false) return false;\n    if (requirements.minConcurrent !== undefined) {\n      const capacity = manifest.spec.capacity?.maxConcurrent ?? 0;\n      if (capacity < requirements.minConcurrent) return false;\n    }\n    return true;\n  });\n\n  candidates.sort((a, b) => (b.manifest.spec.capacity?.maxConcurrent ?? 0) - (a.manifest.spec.capacity?.maxConcurrent ?? 0));\n\n  return candidates[0]?.manifest ?? null;\n}\n","import type { ArtifactDestinationPolicy } from '../artifacts/artifactTrust.js';\nimport { OrchestrationError } from '../errors.js';\n\nimport {\n  type ArtifactInspector,\n  type ArtifactManagementCapabilities,\n  type ArtifactManagementDriver,\n  type ArtifactManagementStateSnapshot,\n  createFakeArtifactManagementDriver,\n  type FakeArtifactManagementState,\n  snapshotArtifactManagementState,\n} from './artifactManagement.js';\nimport type { DriverRequestEnvelope } from './driverRequest.js';\n\nexport interface ManagedArtifactDriverAdapterOptions {\n  state: FakeArtifactManagementState;\n  inspector: ArtifactInspector;\n  authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;\n  persistState(snapshot: ArtifactManagementStateSnapshot): Promise<void>;\n  name: string;\n  maxArtifactBytes?: number;\n  inspectionIsolation: Exclude<\n    ArtifactManagementCapabilities['inspectionIsolation'],\n    'none'\n  >;\n  persistence: Exclude<ArtifactManagementCapabilities['persistence'], 'process'>;\n  reviewer?: string;\n  threatAssumptions: string[];\n  now?: () => Date;\n  destinationPolicies?: Partial<\n    Record<\n      import('../resources.js').ArtifactDestination,\n      ArtifactDestinationPolicy\n    >\n  >;\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction exactFields(\n  payload: unknown,\n  allowed: readonly string[],\n  location: string,\n): void {\n  if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) {\n    invalid(`managed artifact ${location} must be an object`);\n  }\n  const unknown = Object.keys(payload).filter((field) => !allowed.includes(field));\n  if (unknown.length > 0) {\n    invalid(\n      `managed artifact ${location} contains unsupported fields: ${unknown.join(', ')}`,\n    );\n  }\n}\n\nconst ARTIFACT_DESTINATIONS = new Set([\n  'prompt',\n  'volume',\n  'backup',\n  'knowledge',\n]);\n\nfunction validateReviewPayload(payload: {\n  policyDigest: string;\n  destinations: unknown;\n}): void {\n  if (!/^sha256:[a-f0-9]{64}$/.test(payload.policyDigest)) {\n    invalid('managed artifact policyDigest must be a canonical SHA-256 digest');\n  }\n  if (\n    !Array.isArray(payload.destinations) ||\n    payload.destinations.length < 1 ||\n    payload.destinations.length > ARTIFACT_DESTINATIONS.size ||\n    new Set(payload.destinations).size !== payload.destinations.length ||\n    payload.destinations.some((destination) =>\n      typeof destination !== 'string' ||\n      !ARTIFACT_DESTINATIONS.has(destination)\n    )\n  ) invalid('managed artifact destinations are invalid');\n}\n\n/**\n * Production boundary over the fully tested artifact state engine.\n *\n * Calls are serialized so an asynchronous isolated inspector cannot race\n * mutations. Every accepted request (including one that fails after fencing)\n * is flushed through the host's atomic persistence port before the lock is\n * released.\n */\nexport function createManagedArtifactDriverAdapter(\n  options: ManagedArtifactDriverAdapterOptions,\n): ArtifactManagementDriver {\n  if (\n    !options.name ||\n    !options.threatAssumptions.length\n  ) {\n    invalid(\n      'managed artifact adapter requires durable storage, isolated inspection, and threat assumptions',\n    );\n  }\n  const engine = createFakeArtifactManagementDriver({\n    state: options.state,\n    inspector: options.inspector,\n    reviewer: options.reviewer,\n    now: options.now,\n    maxArtifactBytes: options.maxArtifactBytes,\n    capabilities: {\n      name: options.name,\n      inspectionIsolation: options.inspectionIsolation,\n      persistence: options.persistence,\n      threatAssumptions: options.threatAssumptions,\n    },\n    destinationPolicies: options.destinationPolicies,\n  });\n\n  let tail: Promise<void> = Promise.resolve();\n\n  async function exclusive<T>(action: () => Promise<T>): Promise<T> {\n    let release!: () => void;\n    const previous = tail;\n    tail = new Promise<void>((resolve) => {\n      release = resolve;\n    });\n    await previous;\n    let result: T | undefined;\n    let operationError: unknown;\n    try {\n      result = await action();\n    } catch (error) {\n      operationError = error;\n    }\n    try {\n      await options.persistState(snapshotArtifactManagementState(options.state));\n    } catch (error) {\n      release();\n      throw new OrchestrationError({\n        code: 'UNKNOWN_EFFECT',\n        message: `artifact host state could not be durably committed: ${error instanceof Error ? error.message : String(error)}`,\n        retryable: false,\n      });\n    }\n    release();\n    if (operationError !== undefined) {\n      if (operationError instanceof Error) throw operationError;\n      throw new OrchestrationError({\n        code: 'INTERNAL',\n        message: 'artifact operation failed with a non-error value',\n        retryable: false,\n      });\n    }\n    return result as T;\n  }\n\n  async function authorize<T>(\n    request: DriverRequestEnvelope<T>,\n    fields: readonly string[],\n  ): Promise<void> {\n    exactFields(request.payload, fields, `${request.method} payload`);\n    if (!await options.authorizeRequest(request)) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed artifact capability was rejected',\n        retryable: false,\n      });\n    }\n  }\n\n  return {\n    getCapabilities: () => engine.getCapabilities(),\n    async put(request, content) {\n      await authorize(request, [\n        'expectedContentHash',\n        'mimeType',\n        'trust',\n        'producerRunUid',\n        'parentContentHashes',\n        'maxBytes',\n      ]);\n      if (\n        request.payload.expectedContentHash !== undefined &&\n        !/^sha256:[a-f0-9]{64}$/.test(request.payload.expectedContentHash)\n      ) invalid('managed artifact expectedContentHash is invalid');\n      if (\n        typeof request.payload.mimeType !== 'string' ||\n        request.payload.mimeType.length > 256 ||\n        !/^[a-z0-9!#$&^_.+-]+\\/[a-z0-9!#$&^_.+-]+$/i.test(\n          request.payload.mimeType,\n        )\n      ) invalid('managed artifact mimeType is invalid');\n      if (\n        request.payload.producerRunUid !== undefined &&\n        (\n          typeof request.payload.producerRunUid !== 'string' ||\n          !request.payload.producerRunUid ||\n          request.payload.producerRunUid.length > 256\n        )\n      ) invalid('managed artifact producerRunUid is invalid');\n      const parents = request.payload.parentContentHashes ?? [];\n      if (\n        !Array.isArray(parents) ||\n        parents.length > 64 ||\n        new Set(parents).size !== parents.length ||\n        parents.some((parent) =>\n          typeof parent !== 'string' ||\n          !/^sha256:[a-f0-9]{64}$/.test(parent)\n        )\n      ) invalid('managed artifact parentContentHashes are invalid');\n      return exclusive(() => engine.put(request, content));\n    },\n    async resolve(request) {\n      await authorize(request, ['contentHash']);\n      return exclusive(() => engine.resolve(request));\n    },\n    async *read(request) {\n      await authorize(request, ['artifactHandle']);\n      const chunks = await exclusive(async () => {\n        const values: Uint8Array[] = [];\n        for await (const chunk of engine.read(request)) values.push(chunk);\n        return values;\n      });\n      for (const chunk of chunks) yield chunk;\n    },\n    async scan(request) {\n      await authorize(request, [\n        'artifactHandle',\n        'policyDigest',\n        'destinations',\n      ]);\n      validateReviewPayload(request.payload);\n      return exclusive(() => engine.scan(request));\n    },\n    async sanitize(request) {\n      await authorize(request, [\n        'artifactHandle',\n        'outputResource',\n        'policyDigest',\n        'destinations',\n      ]);\n      exactFields(\n        request.payload.outputResource,\n        ['uid', 'name', 'generation'],\n        'sanitize outputResource',\n      );\n      validateReviewPayload(request.payload);\n      return exclusive(() => engine.sanitize(request));\n    },\n    async verify(request) {\n      await authorize(request, [\n        'artifactHandle',\n        'policyDigest',\n        'destinations',\n        'properties',\n      ]);\n      validateReviewPayload(request.payload);\n      if (\n        !Array.isArray(request.payload.properties) ||\n        request.payload.properties.length < 1 ||\n        request.payload.properties.length > 16 ||\n        new Set(request.payload.properties).size !==\n          request.payload.properties.length ||\n        request.payload.properties.some((property) =>\n          typeof property !== 'string' ||\n          !property ||\n          property.length > 128\n        )\n      ) invalid('managed artifact verification properties are invalid');\n      return exclusive(() => engine.verify(request));\n    },\n    async promote(request) {\n      await authorize(request, ['artifactHandle', 'destination']);\n      return exclusive(() => engine.promote(request));\n    },\n    async quarantine(request) {\n      await authorize(request, ['artifactHandle', 'reason']);\n      if (\n        typeof request.payload.reason !== 'string' ||\n        !request.payload.reason ||\n        request.payload.reason.length > 1024\n      ) invalid('managed artifact quarantine reason is invalid');\n      return exclusive(() => engine.quarantine(request));\n    },\n    async mount(request) {\n      await authorize(request, ['artifactHandle', 'destination']);\n      return exclusive(() => engine.mount(request));\n    },\n    async unmount(request) {\n      await authorize(request, ['mountHandle']);\n      return exclusive(() => engine.unmount(request));\n    },\n    async delete(request) {\n      await authorize(request, ['artifactHandle']);\n      return exclusive(() => engine.delete(request));\n    },\n  };\n}\n","import type { AgentVolumeClaimResource, AgentVolumeResource, StorageClassResource, VolumeAccessMode } from '../resources.js';\n\nexport interface StorageDriverCapabilities {\n  name: string;\n  accessModes: VolumeAccessMode[];\n  snapshots: boolean;\n  encryption: boolean;\n  /** The host stack has a wired replica transport/controller. */\n  replication?: boolean;\n  /** The host stack has a wired durable backup implementation. */\n  backup?: boolean;\n  maxVolumeBytes?: number;\n}\n\n/** Shared claim/class capability gate used at binding and immediately pre-effect. */\nexport function storageDriverSatisfiesClass(\n  capability: StorageDriverCapabilities,\n  claim: AgentVolumeClaimResource,\n  storageClass: StorageClassResource,\n): boolean {\n  const replicaFactor = storageClass.spec.replication?.factor ?? 1;\n  const backupRequested = storageClass.spec.backup?.schedule !== undefined ||\n    storageClass.spec.backup?.retentionCount !== undefined;\n  return capability.name === storageClass.spec.driver &&\n    capability.accessModes.includes(claim.spec.accessMode) &&\n    (!storageClass.spec.allowedAccessModes?.length ||\n      storageClass.spec.allowedAccessModes.includes(claim.spec.accessMode)) &&\n    (!claim.spec.dataSourceRef || capability.snapshots) &&\n    (!storageClass.spec.snapshotSupport || capability.snapshots) &&\n    (!storageClass.spec.encryption?.enabled || capability.encryption) &&\n    Number.isSafeInteger(replicaFactor) &&\n    replicaFactor >= 1 &&\n    (replicaFactor === 1 || capability.replication === true) &&\n    (!backupRequested || capability.backup === true) &&\n    (capability.maxVolumeBytes === undefined ||\n      (claim.spec.sizeBytes ?? 0) <= capability.maxVolumeBytes);\n}\n\nexport interface StorageProvisionRequest {\n  claim: AgentVolumeClaimResource;\n  storageClass: StorageClassResource;\n}\n\nexport interface StorageProvisionResult {\n  /** Opaque and stable for the claim UID. */\n  driverHandle: string;\n  capacityBytes?: number;\n  topology?: { nodeId?: string; zone?: string };\n}\n\nexport interface StoragePublishRequest {\n  volume: AgentVolumeResource;\n  nodeId: string;\n  workloadUid: string;\n  readOnly: boolean;\n}\n\nexport interface StoragePublishResult {\n  /** Opaque and stable for volume/workload/node. */\n  publishHandle: string;\n  /** Host path or runtime-native mount descriptor; never parsed by core. */\n  mountPath: string;\n}\n\n/** CSI-like host port. Provision/publish/delete/unpublish must be idempotent. */\nexport interface StorageDriver {\n  getCapabilities(): Promise<StorageDriverCapabilities>;\n  getHealth(): Promise<{ healthy: boolean; detail?: string; checkedAt: string }>;\n  provision(request: StorageProvisionRequest): Promise<StorageProvisionResult>;\n  delete(volume: AgentVolumeResource): Promise<void>;\n  publish(request: StoragePublishRequest): Promise<StoragePublishResult>;\n  getPublished(publishHandle: string): Promise<StoragePublishResult | undefined>;\n  unpublish(publishHandle: string): Promise<void>;\n}\n","import { OrchestrationError } from '../errors.js';\nimport type { AgentVolumeClaimResource, AgentVolumeResource, StorageClassResource } from '../resources.js';\n\nimport { assertDriverRequestEnvelope, canonicalDriverValue, type DriverRequestEnvelope } from './driverRequest.js';\nimport { type StorageDriver, storageDriverSatisfiesClass } from './storageDriver.js';\nimport type { ManagedVolumePublication, ManagedVolumeStage, StorageManagementDriver, StorageProvisionPayload } from './storageManagement.js';\n\ninterface StoredOperation {\n  fingerprint: string;\n  result?: string;\n}\n\nexport interface ManagedStorageAdapterStateStore {\n  get(key: string): Promise<unknown>;\n  put(key: string, value: unknown): Promise<void>;\n  delete(key: string): Promise<void>;\n}\n\nexport interface ManagedStorageDriverAdapterOptions {\n  authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;\n  resolveProvisionInput(\n    request: DriverRequestEnvelope<StorageProvisionPayload>,\n  ): Promise<{\n    claim: AgentVolumeClaimResource;\n    storageClass: StorageClassResource;\n  }>;\n  resolveVolume(\n    volumeHandle: string,\n    request: DriverRequestEnvelope,\n  ): Promise<AgentVolumeResource | undefined>;\n  stateStore?: ManagedStorageAdapterStateStore;\n  stableStageHandleFor?(\n    request: DriverRequestEnvelope<{ volumeHandle: string; nodeId: string }>,\n  ): string;\n  threatAssumptions: string[];\n  now?: () => Date;\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction unsupported(capability: string): never {\n  throw new OrchestrationError({\n    code: 'UNSUPPORTED',\n    message: `the narrow storage driver does not support ${capability}`,\n    retryable: false,\n  });\n}\n\nfunction fields(\n  value: unknown,\n  allowed: readonly string[],\n  location: string,\n): Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    invalid(`storage ${location} must be an object`);\n  }\n  const record = value as Record<string, unknown>;\n  const unknown = Object.keys(record).filter((key) => !allowed.includes(key));\n  if (unknown.length > 0) {\n    invalid(`storage ${location} contains unsupported fields: ${unknown.join(', ')}`);\n  }\n  return record;\n}\n\nfunction stringField(value: unknown, location: string): string {\n  if (typeof value !== 'string' || value.length === 0 || value.length > 2048) {\n    invalid(`storage ${location} must be a bounded non-empty string`);\n  }\n  return value;\n}\n\n/**\n * Production bridge for the existing CSI-like StorageDriver. Unsupported data\n * management operations fail explicitly instead of fabricating capabilities.\n */\nexport function createManagedStorageDriverAdapter(\n  driver: StorageDriver,\n  options: ManagedStorageDriverAdapterOptions,\n): StorageManagementDriver {\n  if (\n    typeof options.authorizeRequest !== 'function' ||\n    !options.threatAssumptions.length\n  ) invalid('managed storage adapter authority and threat assumptions are required');\n  const now = options.now ?? (() => new Date());\n  const processState = new Map<string, unknown>();\n  let nextStage = 1;\n\n  const getState = async <T>(key: string): Promise<T | undefined> =>\n    (options.stateStore\n      ? await options.stateStore.get(key)\n      : processState.get(key)) as T | undefined;\n  const putState = async (key: string, value: unknown): Promise<void> => {\n    if (options.stateStore) await options.stateStore.put(key, value);\n    else processState.set(key, value);\n  };\n  const deleteState = async (key: string): Promise<void> => {\n    if (options.stateStore) await options.stateStore.delete(key);\n    else processState.delete(key);\n  };\n\n  async function validate<T>(\n    request: DriverRequestEnvelope<T>,\n    method: string,\n  ): Promise<void> {\n    assertDriverRequestEnvelope(request, {\n      now,\n      requireFencing: true,\n      requireCapability: true,\n      expectedMethod: method,\n    });\n    if (!await options.authorizeRequest(request)) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'storage management capability was rejected',\n        retryable: false,\n      });\n    }\n    const fenceKey = `fence:${request.resource.uid}`;\n    const current = await getState<number>(fenceKey) ?? 0;\n    const fence = request.fencingEpoch as number;\n    if (fence < current) {\n      throw new OrchestrationError({\n        code: 'STALE_EPOCH',\n        message: `stale storage fencing epoch ${fence}; current epoch is ${current}`,\n        retryable: false,\n      });\n    }\n    if (fence > current) await putState(fenceKey, fence);\n  }\n\n  function operationKey(request: DriverRequestEnvelope): string {\n    return `operation:${request.resource.uid}:${request.method}:${request.idempotencyKey}`;\n  }\n\n  function fingerprint(request: DriverRequestEnvelope): string {\n    return canonicalDriverValue({\n      resource: request.resource,\n      run: request.run,\n      actor: request.actor,\n      payloadSchemaDigest: request.payloadSchemaDigest,\n      payload: request.payload,\n    });\n  }\n\n  async function previous(\n    request: DriverRequestEnvelope,\n  ): Promise<StoredOperation | undefined> {\n    const operation = await getState<StoredOperation>(operationKey(request));\n    if (operation && operation.fingerprint !== fingerprint(request)) {\n      throw new OrchestrationError({\n        code: 'CONFLICT',\n        message: 'storage idempotency key was reused with different input',\n        retryable: false,\n      });\n    }\n    return operation;\n  }\n\n  async function remember(\n    request: DriverRequestEnvelope,\n    result?: string,\n  ): Promise<void> {\n    await putState(\n      operationKey(request),\n      {\n        fingerprint: fingerprint(request),\n        ...(result ? { result } : {}),\n      } satisfies StoredOperation,\n    );\n  }\n\n  const stageKey = (handle: string) => `stage:${handle}`;\n  const publicationKey = (handle: string) => `publication:${handle}`;\n  const volumeStagesKey = (handle: string) => `volume-stages:${handle}`;\n  const activePublicationKey = (handle: string) => `stage-active-publication:${handle}`;\n\n  return {\n    async getCapabilities() {\n      const capabilities = await driver.getCapabilities();\n      return {\n        name: capabilities.name,\n        controllerService: true,\n        nodeService: true,\n        accessModes: [...capabilities.accessModes],\n        supportsSnapshots: false,\n        supportsExpansion: false,\n        supportsReplication: false,\n        supportsBackup: false,\n        persistence: options.stateStore ? 'host' : 'process',\n        threatAssumptions: [...options.threatAssumptions],\n      };\n    },\n    async provision(request) {\n      await validate(request, 'storage.provision');\n      fields(request.payload, [\n        'capacityBytes',\n        'accessMode',\n        'storageClass',\n        'replicaCount',\n      ], 'provision payload');\n      if (\n        !Number.isSafeInteger(request.payload.capacityBytes) ||\n        request.payload.capacityBytes < 1 ||\n        !Number.isSafeInteger(request.payload.replicaCount) ||\n        request.payload.replicaCount !== 1\n      ) invalid('narrow storage provisioning requires positive capacity and replicaCount 1');\n      stringField(request.payload.storageClass, 'provision storageClass');\n      const prior = await previous(request);\n      const { claim, storageClass } = await options.resolveProvisionInput(request);\n      if (\n        claim.metadata.uid !== request.resource.uid ||\n        claim.spec.accessMode !== request.payload.accessMode ||\n        (claim.spec.sizeBytes ?? 1) !== request.payload.capacityBytes ||\n        storageClass.metadata.name !== request.payload.storageClass ||\n        claim.spec.storageClassRef.apiVersion !== storageClass.apiVersion ||\n        claim.spec.storageClassRef.kind !== storageClass.kind ||\n        claim.spec.storageClassRef.name !== storageClass.metadata.name\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'resolved storage claim/class differs from the managed request',\n          retryable: false,\n        });\n      }\n      const capabilities = await driver.getCapabilities();\n      if (!storageDriverSatisfiesClass(capabilities, claim, storageClass)) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: `storage driver '${capabilities.name}' does not satisfy the resolved claim and StorageClass`,\n          retryable: false,\n        });\n      }\n      if (prior?.result) {\n        const volume = await options.resolveVolume(prior.result, request);\n        if (volume) {\n          if (\n            volume.spec.driverHandle !== prior.result ||\n            volume.spec.claimRef?.uid !== claim.metadata.uid ||\n            volume.spec.storageClassRef.apiVersion !== storageClass.apiVersion ||\n            volume.spec.storageClassRef.kind !== storageClass.kind ||\n            volume.spec.storageClassRef.name !== storageClass.metadata.name ||\n            !volume.spec.accessModes?.includes(request.payload.accessMode) ||\n            (volume.spec.capacityBytes ?? 0) < request.payload.capacityBytes\n          ) {\n            throw new OrchestrationError({\n              code: 'CONFLICT',\n              message: 'adopted storage volume differs from the authorized claim and class',\n              retryable: false,\n            });\n          }\n          return {\n            volumeHandle: prior.result,\n            resourceUid: request.resource.uid,\n            capacityBytes: volume.spec.capacityBytes ?? request.payload.capacityBytes,\n            accessMode: request.payload.accessMode,\n            fencingEpoch: request.fencingEpoch as number,\n            phase: 'Available',\n          };\n        }\n      }\n      const provisioned = await driver.provision({ claim, storageClass });\n      const volumeHandle = stringField(\n        provisioned.driverHandle,\n        'provision result driverHandle',\n      );\n      const capacityBytes = provisioned.capacityBytes ??\n        request.payload.capacityBytes;\n      if (\n        !Number.isSafeInteger(capacityBytes) ||\n        capacityBytes < request.payload.capacityBytes\n      ) {\n        throw new OrchestrationError({\n          code: 'UNKNOWN_EFFECT',\n          message: 'storage driver provisioned a volume with invalid or insufficient capacity',\n          retryable: false,\n        });\n      }\n      await remember(request, volumeHandle);\n      return {\n        volumeHandle,\n        resourceUid: request.resource.uid,\n        capacityBytes,\n        accessMode: request.payload.accessMode,\n        fencingEpoch: request.fencingEpoch as number,\n        phase: 'Available',\n      };\n    },\n    async deleteVolume(request) {\n      await validate(request, 'storage.delete');\n      fields(request.payload, ['volumeHandle'], 'delete payload');\n      const volumeHandle = stringField(request.payload.volumeHandle, 'delete volumeHandle');\n      if (await previous(request)) return;\n      const stages = await getState<string[]>(volumeStagesKey(volumeHandle)) ?? [];\n      if (stages.length > 0) {\n        throw new OrchestrationError({\n          code: 'CONFLICT',\n          message: 'storage volume must be unstaged before deletion',\n          retryable: false,\n        });\n      }\n      const volume = await options.resolveVolume(volumeHandle, request);\n      if (volume) await driver.delete(volume);\n      await remember(request);\n    },\n    async createSnapshot(request) {\n      await validate(request, 'storage.snapshot.create');\n      fields(request.payload, ['volumeHandle'], 'snapshot payload');\n      return unsupported('snapshots');\n    },\n    async restoreSnapshot(request) {\n      await validate(request, 'storage.snapshot.restore');\n      fields(request.payload, ['snapshotHandle', 'capacityBytes'], 'restore payload');\n      return unsupported('snapshot restore');\n    },\n    async expand(request) {\n      await validate(request, 'storage.expand');\n      fields(request.payload, ['volumeHandle', 'capacityBytes'], 'expand payload');\n      return unsupported('volume expansion');\n    },\n    async getReplicaHealth(request) {\n      await validate(request, 'storage.replica.health');\n      fields(request.payload, ['volumeHandle'], 'replica-health payload');\n      return unsupported('replication');\n    },\n    async rebuildReplica(request) {\n      await validate(request, 'storage.replica.rebuild');\n      fields(request.payload, ['volumeHandle', 'replicaCount'], 'replica-rebuild payload');\n      return unsupported('replication');\n    },\n    async createBackup(request) {\n      await validate(request, 'storage.backup.create');\n      fields(request.payload, ['volumeHandle'], 'backup payload');\n      return unsupported('backups');\n    },\n    async stage(request) {\n      await validate(request, 'storage.stage');\n      fields(request.payload, ['volumeHandle', 'nodeId'], 'stage payload');\n      stringField(request.payload.volumeHandle, 'stage volumeHandle');\n      stringField(request.payload.nodeId, 'stage nodeId');\n      const prior = await previous(request);\n      if (prior?.result) {\n        const stage = await getState<ManagedVolumeStage>(stageKey(prior.result));\n        if (stage) return stage;\n      }\n      const volume = await options.resolveVolume(request.payload.volumeHandle, request);\n      if (!volume) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: `storage volume '${request.payload.volumeHandle}' was not found`,\n          retryable: false,\n        });\n      }\n      if (\n        volume.spec.topology?.nodeId &&\n        volume.spec.topology.nodeId !== request.payload.nodeId\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: `storage volume cannot be staged on node '${request.payload.nodeId}'`,\n          retryable: false,\n        });\n      }\n      const stageHandle = options.stableStageHandleFor?.(request) ??\n        `managed-storage-stage:${nextStage++}`;\n      const stage: ManagedVolumeStage = {\n        stageHandle,\n        volumeHandle: request.payload.volumeHandle,\n        resourceUid: request.resource.uid,\n        nodeId: request.payload.nodeId,\n      };\n      const collision = await getState<ManagedVolumeStage>(stageKey(stageHandle));\n      if (\n        collision &&\n        canonicalDriverValue(collision) !== canonicalDriverValue(stage)\n      ) {\n        throw new OrchestrationError({\n          code: 'CONFLICT',\n          message: 'storage stage handle collided across resources or volumes',\n          retryable: false,\n        });\n      }\n      await putState(stageKey(stageHandle), stage);\n      const stages = await getState<string[]>(\n        volumeStagesKey(request.payload.volumeHandle),\n      ) ?? [];\n      if (!stages.includes(stageHandle)) {\n        await putState(\n          volumeStagesKey(request.payload.volumeHandle),\n          [...stages, stageHandle],\n        );\n      }\n      await remember(request, stageHandle);\n      return stage;\n    },\n    async publish(request) {\n      await validate(request, 'storage.publish');\n      fields(request.payload, [\n        'stageHandle',\n        'workloadUid',\n        'readOnly',\n      ], 'publish payload');\n      stringField(request.payload.stageHandle, 'publish stageHandle');\n      stringField(request.payload.workloadUid, 'publish workloadUid');\n      if (typeof request.payload.readOnly !== 'boolean') {\n        invalid('storage publish readOnly must be boolean');\n      }\n      const prior = await previous(request);\n      if (prior?.result) {\n        const publication = await getState<ManagedVolumePublication>(\n          publicationKey(prior.result),\n        );\n        if (publication) return publication;\n      }\n      const stage = await getState<ManagedVolumeStage>(\n        stageKey(request.payload.stageHandle),\n      );\n      if (!stage || stage.resourceUid !== request.resource.uid) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'storage stage handle is unavailable or belongs to another resource',\n          retryable: false,\n        });\n      }\n      const volume = await options.resolveVolume(stage.volumeHandle, request);\n      if (!volume) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: `storage volume '${stage.volumeHandle}' was not found`,\n          retryable: false,\n        });\n      }\n      if (\n        volume.spec.accessModes?.length === 1 &&\n        volume.spec.accessModes[0] === 'ReadOnlyMany' &&\n        !request.payload.readOnly\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'read-only storage volume cannot be published writable',\n          retryable: false,\n        });\n      }\n      const published = await driver.publish({\n        volume,\n        nodeId: stage.nodeId,\n        workloadUid: request.payload.workloadUid,\n        readOnly: request.payload.readOnly,\n      });\n      const publication: ManagedVolumePublication = {\n        publishHandle: published.publishHandle,\n        stageHandle: stage.stageHandle,\n        resourceUid: request.resource.uid,\n        workloadUid: request.payload.workloadUid,\n        readOnly: request.payload.readOnly,\n      };\n      const collision = await getState<ManagedVolumePublication>(\n        publicationKey(publication.publishHandle),\n      );\n      if (\n        collision &&\n        canonicalDriverValue(collision) !== canonicalDriverValue(publication)\n      ) {\n        await driver.unpublish(publication.publishHandle);\n        throw new OrchestrationError({\n          code: 'CONFLICT',\n          message: 'storage publication handle collided across scopes',\n          retryable: false,\n        });\n      }\n      await putState(publicationKey(publication.publishHandle), publication);\n      await putState(\n        activePublicationKey(stage.stageHandle),\n        publication.publishHandle,\n      );\n      await remember(request, publication.publishHandle);\n      return publication;\n    },\n    async unpublish(request) {\n      await validate(request, 'storage.unpublish');\n      fields(request.payload, ['publishHandle'], 'unpublish payload');\n      const handle = stringField(request.payload.publishHandle, 'unpublish publishHandle');\n      if (await previous(request)) return;\n      const publication = await getState<ManagedVolumePublication>(\n        publicationKey(handle),\n      );\n      if (publication && publication.resourceUid !== request.resource.uid) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'storage publication belongs to another resource',\n          retryable: false,\n        });\n      }\n      await driver.unpublish(handle);\n      await deleteState(publicationKey(handle));\n      if (publication) {\n        await deleteState(activePublicationKey(publication.stageHandle));\n      }\n      await remember(request);\n    },\n    async unstage(request) {\n      await validate(request, 'storage.unstage');\n      fields(request.payload, ['stageHandle'], 'unstage payload');\n      const handle = stringField(request.payload.stageHandle, 'unstage stageHandle');\n      if (await previous(request)) return;\n      const stage = await getState<ManagedVolumeStage>(stageKey(handle));\n      if (stage && stage.resourceUid !== request.resource.uid) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'storage stage belongs to another resource',\n          retryable: false,\n        });\n      }\n      if (await getState<string>(activePublicationKey(handle))) {\n        throw new OrchestrationError({\n          code: 'CONFLICT',\n          message: 'storage publication must be removed before unstage',\n          retryable: false,\n        });\n      }\n      await deleteState(stageKey(handle));\n      if (stage) {\n        const stages = await getState<string[]>(\n          volumeStagesKey(stage.volumeHandle),\n        ) ?? [];\n        const remaining = stages.filter((item) => item !== handle);\n        if (remaining.length > 0) {\n          await putState(volumeStagesKey(stage.volumeHandle), remaining);\n        } else {\n          await deleteState(volumeStagesKey(stage.volumeHandle));\n        }\n      }\n      await remember(request);\n    },\n    async getStats(request) {\n      await validate(request, 'storage.stats');\n      fields(request.payload, ['publishHandle'], 'stats payload');\n      return unsupported('volume statistics');\n    },\n  };\n}\n","import { getToolMetadata, getToolParameterSchema, toolSchemaToJsonSchema } from '../../tools/schemaRegistry.js';\nimport type { IToolRegistry } from '../../types.js';\nimport type { ControllerReconcileRequest } from '../controllerRunner.js';\nimport { OrchestrationError } from '../errors.js';\nimport type { ToolOperationApprovalEvidence, ToolOperationEffect, ToolOperationResource, ToolRiskLevel } from '../resources.js';\n\nimport { canonicalDriverValue, type DriverRequestEnvelope } from './driverRequest.js';\nimport type { ToolExecutionDriver } from './toolExecutionDriver.js';\nimport { createFakeToolManagementDriver, createFakeToolManagementState, type ManagedToolDescriptor, type ToolManagementDriver } from './toolManagement.js';\n\nasync function digest(value: unknown): Promise<string> {\n  const bytes = new TextEncoder().encode(canonicalDriverValue(value));\n  const result = await globalThis.crypto.subtle.digest('SHA-256', bytes);\n  return `sha256:${\n    [...new Uint8Array(result)]\n      .map((byte) => byte.toString(16).padStart(2, '0'))\n      .join('')\n  }`;\n}\n\nfunction riskForEffect(effect: ToolOperationEffect): ToolRiskLevel {\n  switch (effect) {\n    case 'read': {\n      return 'medium';\n    }\n    case 'create':\n    case 'update': {\n      return 'high';\n    }\n    case 'delete':\n    case 'execute':\n    case 'unknown': {\n      return 'critical';\n    }\n  }\n}\n\n/** Build content-addressed descriptors from the schemas actually registered by the host. */\nexport async function createManagedToolDescriptors(\n  registry: IToolRegistry,\n  nodeId: string,\n): Promise<ManagedToolDescriptor[]> {\n  const descriptors: ManagedToolDescriptor[] = [];\n  for (const name of [...registry.listTools()].sort()) {\n    const registeredSchema = registry.getToolParameterSchema\n      ? registry.getToolParameterSchema(name)\n      : getToolParameterSchema(name);\n    if (registeredSchema === undefined) {\n      // Legacy host tools without a portable schema are not safe to expose\n      // through the managed catalog. They remain available to their owning\n      // host, but cannot be prepared or executed as managed operations.\n      continue;\n    }\n    const inputSchema = toolSchemaToJsonSchema(registeredSchema);\n    const outputSchema: Record<string, unknown> = {};\n    const schemaDigest = await digest({ inputSchema, outputSchema });\n    const metadata = getToolMetadata(name);\n    const target = `local-tool://${encodeURIComponent(nodeId)}/${encodeURIComponent(name)}`;\n    const effect = registry.getToolEffect?.(name) ?? 'execute';\n    descriptors.push({\n      name,\n      version: `1.0.0-${effect}`,\n      description: metadata?.description ?? `Host-registered tool ${name}`,\n      inputSchema,\n      outputSchema,\n      schemaDigest,\n      effect,\n      risk: riskForEffect(effect),\n      targets: [target],\n      supportsIdempotency: effect === 'read',\n      supportsFencing: true,\n      supportsEvidence: true,\n    });\n  }\n  return descriptors;\n}\n\nexport interface ManagedToolPolicyDecision {\n  handle: string;\n  policyDigest: string;\n  approval?: ToolOperationApprovalEvidence;\n}\n\nexport interface ManagedToolExecutionRouteOptions {\n  descriptors: ManagedToolDescriptor[];\n  resolveOperation(resourceUid: string): Promise<ToolOperationResource | undefined>;\n  authorizeOperation(\n    operation: ToolOperationResource,\n    signal?: AbortSignal,\n  ): Promise<ManagedToolPolicyDecision>;\n  authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;\n  createRequest<T>(input: {\n    method: string;\n    payload: T;\n    operation: ToolOperationResource;\n    actor: ControllerReconcileRequest['actor'];\n    leaseEpoch: string;\n    idempotencyKey: string;\n    payloadFields: string[];\n  }): DriverRequestEnvelope<T>;\n  name: string;\n  maxOutputBytes?: number;\n  maxOutputChunks?: number;\n  now?: () => Date;\n  threatAssumptions: string[];\n}\n\nexport interface ManagedToolExecutionRoute {\n  managementDriver: ToolManagementDriver;\n  executionDriver: ToolExecutionDriver;\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction exactFields(payload: unknown, allowed: readonly string[], location: string): void {\n  if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) {\n    invalid(`managed tool ${location} must be an object`);\n  }\n  const unknown = Object.keys(payload).filter((field) => !allowed.includes(field));\n  if (unknown.length > 0) {\n    invalid(`managed tool ${location} contains unsupported fields: ${unknown.join(', ')}`);\n  }\n}\n\n/**\n * Round-trip the existing ToolExecutionDriver through the complete managed\n * lifecycle while keeping live results and approval evidence host-local.\n */\nexport function createManagedToolExecutionRoute(\n  narrowDriver: ToolExecutionDriver,\n  options: ManagedToolExecutionRouteOptions,\n): ManagedToolExecutionRoute {\n  if (!options.descriptors.length || !options.threatAssumptions.length) {\n    invalid('managed tool route requires a non-empty catalog and threat assumptions');\n  }\n  const pendingDecisions = new Map<string, ManagedToolPolicyDecision>();\n  const approvalEvidence = new Map<string, ToolOperationApprovalEvidence>();\n  const state = createFakeToolManagementState();\n  const engine = createFakeToolManagementDriver({\n    state,\n    now: options.now,\n    tools: options.descriptors,\n    maxOutputBytes: options.maxOutputBytes,\n    maxOutputChunks: options.maxOutputChunks,\n    capabilities: {\n      name: options.name,\n      persistence: 'process',\n      threatAssumptions: options.threatAssumptions,\n    },\n    async verifyPolicyDecision(input) {\n      const operation = await options.resolveOperation(input.resourceUid);\n      const pending = pendingDecisions.get(input.resourceUid);\n      if (\n        !operation ||\n        !pending ||\n        pending.handle !== input.handle ||\n        pending.policyDigest !== input.policyDigest ||\n        operation.spec.toolRef.name !== input.tool.name ||\n        operation.spec.effect !== input.tool.effect ||\n        !input.tool.targets.includes(input.target)\n      ) {\n        return false;\n      }\n      if (pending.approval) {\n        approvalEvidence.set(input.resourceUid, pending.approval);\n      }\n      return true;\n    },\n    async *executor(descriptor, _target, arguments_, signal, resourceUid) {\n      if (!resourceUid) invalid('managed tool executor has no resource identity');\n      const operation = await options.resolveOperation(resourceUid);\n      if (\n        !operation ||\n        operation.spec.toolRef.name !== descriptor.name ||\n        operation.spec.effect !== descriptor.effect ||\n        canonicalDriverValue(operation.spec.arguments ?? {}) !== canonicalDriverValue(arguments_)\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'resolved ToolOperation differs from the managed invocation',\n          retryable: false,\n        });\n      }\n      const approval = approvalEvidence.get(resourceUid);\n      const executed = await narrowDriver.execute(\n        approval\n          ? {\n            ...operation,\n            status: { ...operation.status, approval },\n          }\n          : operation,\n        { signal },\n      );\n      yield JSON.stringify(executed);\n    },\n  });\n\n  async function authorize<T>(\n    request: DriverRequestEnvelope<T>,\n    fields: readonly string[],\n  ): Promise<void> {\n    exactFields(request.payload, fields, `${request.method} payload`);\n    if (!(await options.authorizeRequest(request))) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed tool capability was rejected',\n        retryable: false,\n      });\n    }\n  }\n\n  const managementDriver: ToolManagementDriver = {\n    getCapabilities: () => engine.getCapabilities(),\n    async discover(request) {\n      await authorize(request, ['namePrefix']);\n      return engine.discover(request);\n    },\n    async describe(request) {\n      await authorize(request, ['name', 'version', 'catalogDigest']);\n      return engine.describe(request);\n    },\n    async prepare(request) {\n      await authorize(request, [\n        'name',\n        'version',\n        'schemaDigest',\n        'catalogDigest',\n        'target',\n        'effect',\n        'operationIdempotencyKey',\n      ]);\n      return engine.prepare(request);\n    },\n    async authorize(request) {\n      await authorize(request, [\n        'preparationHandle',\n        'policyDecisionHandle',\n        'policyDigest',\n        'ttlMs',\n      ]);\n      return engine.authorize(request);\n    },\n    async *invoke(request, invokeOptions) {\n      await authorize(request, ['preparationHandle', 'authorizationHandle', 'arguments']);\n      yield* engine.invoke(request, invokeOptions);\n    },\n    async inspect(request) {\n      await authorize(request, ['executionHandle', 'preparationHandle']);\n      return engine.inspect(request);\n    },\n    async reconcileUnknownEffect(request) {\n      await authorize(request, ['executionHandle', 'resultObserved', 'evidenceDigest']);\n      return engine.reconcileUnknownEffect(request);\n    },\n    async collectEvidence(request) {\n      await authorize(request, ['executionHandle']);\n      return engine.collectEvidence(request);\n    },\n    async cleanup(request) {\n      await authorize(request, ['preparationHandle', 'executionHandle']);\n      return engine.cleanup(request);\n    },\n  };\n\n  const executionDriver: ToolExecutionDriver = {\n    async execute(operation, executionOptions = {}) {\n      const actor = executionOptions.actor;\n      const leaseEpoch = executionOptions.leaseEpoch;\n      if (!actor || !leaseEpoch) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'managed tool execution requires controller actor and fencing epoch',\n          retryable: false,\n        });\n      }\n      const request = <T>(method: string, payload: T, suffix: string, payloadFields: string[]) =>\n        options.createRequest({\n          method,\n          payload,\n          operation,\n          actor,\n          leaseEpoch,\n          idempotencyKey: `${operation.metadata.uid}:${suffix}`,\n          payloadFields,\n        });\n      const snapshot = await managementDriver.discover(\n        request('tool.discover', {}, 'discover', ['namePrefix']),\n      );\n      const descriptor = snapshot.tools.find(\n        (candidate) =>\n          candidate.name === operation.spec.toolRef.name &&\n          candidate.effect === operation.spec.effect,\n      );\n      if (!descriptor) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: 'managed tool descriptor was not found',\n          retryable: false,\n        });\n      }\n      if (\n        operation.spec.toolRef.schemaDigest &&\n        operation.spec.toolRef.schemaDigest !== descriptor.schemaDigest\n      ) {\n        throw new OrchestrationError({\n          code: 'CONFLICT',\n          message: 'ToolOperation schema digest differs from the managed catalog',\n          retryable: false,\n        });\n      }\n      const preparation = await managementDriver.prepare(\n        request(\n          'tool.prepare',\n          {\n            name: descriptor.name,\n            version: descriptor.version,\n            schemaDigest: descriptor.schemaDigest,\n            catalogDigest: snapshot.catalogDigest,\n            target: descriptor.targets[0],\n            effect: descriptor.effect,\n            ...(operation.spec.idempotencyKey && descriptor.supportsIdempotency\n              ? { operationIdempotencyKey: operation.spec.idempotencyKey }\n              : {}),\n          },\n          'prepare',\n          [\n            'name',\n            'version',\n            'schemaDigest',\n            'catalogDigest',\n            'target',\n            'effect',\n            'operationIdempotencyKey',\n          ],\n        ),\n      );\n      const policy = await options.authorizeOperation(operation, executionOptions.signal);\n      pendingDecisions.set(operation.metadata.uid, policy);\n      const authorization = await managementDriver\n        .authorize(\n          request(\n            'tool.authorize',\n            {\n              preparationHandle: preparation.preparationHandle,\n              policyDecisionHandle: policy.handle,\n              policyDigest: policy.policyDigest,\n              ttlMs: Math.min(60_000, Math.max(1, operation.spec.timeoutMs ?? 30_000)),\n            },\n            'authorize',\n            ['preparationHandle', 'policyDecisionHandle', 'policyDigest', 'ttlMs'],\n          ),\n        )\n        .finally(() => {\n          pendingDecisions.delete(operation.metadata.uid);\n        });\n      try {\n        const chunks: string[] = [];\n        let executionHandle: string | undefined;\n        for await (\n          const chunk of managementDriver.invoke(\n            request(\n              'tool.invoke',\n              {\n                preparationHandle: preparation.preparationHandle,\n                authorizationHandle: authorization.authorizationHandle,\n                arguments: operation.spec.arguments ?? {},\n              },\n              'invoke',\n              ['preparationHandle', 'authorizationHandle', 'arguments'],\n            ),\n            { signal: executionOptions.signal },\n          )\n        ) {\n          executionHandle = chunk.executionHandle;\n          if (!chunk.final) chunks.push(chunk.data);\n        }\n        if (!executionHandle || chunks.length !== 1) {\n          invalid('managed narrow tool execution returned an invalid result stream');\n        }\n        const executed = JSON.parse(chunks[0]) as ToolOperationResource;\n        const evidence = await managementDriver.collectEvidence(\n          request('tool.collect-evidence', { executionHandle }, 'evidence', ['executionHandle']),\n        );\n        await managementDriver.cleanup(\n          request(\n            'tool.cleanup',\n            {\n              preparationHandle: preparation.preparationHandle,\n              executionHandle,\n            },\n            'cleanup',\n            ['preparationHandle', 'executionHandle'],\n          ),\n        );\n        return {\n          ...executed,\n          status: {\n            ...executed.status,\n            result: {\n              ...executed.status?.result,\n              evidenceRef: evidence.outputDigest,\n            },\n          },\n        };\n      } finally {\n        approvalEvidence.delete(operation.metadata.uid);\n      }\n    },\n  };\n\n  return { managementDriver, executionDriver };\n}\n","import type { OrchestrationResource, OrchestrationResourceStatus } from '../client.js';\nimport type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport type { NodeTrustClass } from '../resources.js';\nimport type { WorkerProtocolMethod, WorkerRunBinding } from './workerProtocol.js';\n\nexport const WORKER_ENROLLMENT_API_VERSION = 'security.memeloop.io/v1alpha1';\nexport const WORKER_ENROLLMENT_KIND = 'WorkerEnrollment';\n\nexport const WORKER_SESSION_API_VERSION = 'security.memeloop.io/v1alpha1';\nexport const WORKER_SESSION_KIND = 'WorkerSession';\n\n/**\n * WorkerEnrollment: one-time bootstrap record for a worker identity.\n * Created by a trusted controller or admin; never by the worker itself.\n */\nexport interface WorkerEnrollmentSpec {\n  /** Node this worker is enrolled on. */\n  nodeRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n    namespace?: string;\n  };\n  /** Trust class assigned at enrollment time; immutable after creation. */\n  trustClass: NodeTrustClass;\n  /** Pinned gateway URL and public-key fingerprint known before bootstrap. */\n  expectedGateway: string;\n  gatewayKeyFingerprint: string;\n  /** Narrow protocol/session scope fixed by the trusted enrolling actor. */\n  audience: string;\n  allowedProtocol: string;\n  run: WorkerRunBinding;\n  policyDigest: string;\n  allowedMethods: WorkerProtocolMethod[];\n  allowedTargets?: string[];\n  /** One-time bootstrap token hash; the raw token is only shown once. */\n  bootstrapTokenHash: string;\n  /** Enrolling actor (controller or admin). */\n  enrolledBy: string;\n  /** Expiry of the enrollment record itself. */\n  expiresAt: string;\n}\n\nexport interface WorkerEnrollmentStatus extends OrchestrationResourceStatus {\n  phase?: 'Pending' | 'Bound' | 'Expired' | 'Revoked';\n  /** Fingerprint of the worker's ephemeral public key, set after binding. */\n  workerKeyFingerprint?: string;\n  boundAt?: string;\n  revokedAt?: string;\n  revokeReason?: string;\n}\n\n/**\n * WorkerSession: ephemeral identity session bound to a worker key.\n * Created after a worker proves possession of the bootstrap token.\n */\nexport interface WorkerSessionSpec {\n  enrollmentRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n    namespace?: string;\n  };\n  /** Fingerprint of the worker's ephemeral public key. */\n  workerKeyFingerprint: string;\n  /** Encoded ephemeral public key used for per-message signature checks. */\n  workerPublicKey: string;\n  audience: string;\n  allowedProtocol: string;\n  run: WorkerRunBinding;\n  policyDigest: string;\n  allowedMethods: WorkerProtocolMethod[];\n  allowedTargets?: string[];\n  /** Session TTL in milliseconds. */\n  ttlMs: number;\n}\n\nexport interface WorkerSessionStatus extends OrchestrationResourceStatus {\n  phase?: 'Active' | 'Expired' | 'Revoked';\n  issuedAt?: string;\n  expiresAt?: string;\n  lastProofAt?: string;\n  revokedAt?: string;\n  revokeReason?: string;\n  /** Durable replay fence for the dedicated worker protocol. */\n  lastSequence?: number;\n  /** Bounded recent nonce window; sequence remains the primary fence. */\n  recentNonces?: string[];\n}\n\nexport type WorkerEnrollmentResource = Omit<OrchestrationResource<WorkerEnrollmentSpec>, 'status'> & {\n  status?: WorkerEnrollmentStatus;\n};\n\nexport type WorkerSessionResource = Omit<OrchestrationResource<WorkerSessionSpec>, 'status'> & {\n  status?: WorkerSessionStatus;\n};\n\nexport interface BindWorkerSessionRequest {\n  /** Raw, single-use bootstrap token. It must never be persisted or logged. */\n  bootstrapToken: string;\n  /** Fingerprint of the ephemeral public key proved by the worker. */\n  workerKeyFingerprint: string;\n  /** Encoded ephemeral public key; public, but never worker-selected authority. */\n  workerPublicKey: string;\n  /** Pinned gateway identity serving this bootstrap request. */\n  gatewayKeyFingerprint: string;\n  /** Gateway-issued one-time challenge and the worker's signature over it. */\n  proof: { challenge: string; signature: string };\n  /** Requested session lifetime. It is capped by the enrollment expiry. */\n  ttlMs: number;\n  /**\n   * Host cryptographic verifier. Core deliberately does not prescribe a\n   * password-hash implementation; the verifier compares the raw token with\n   * the enrollment's persisted hash in constant-time.\n   */\n  verifyBootstrapToken: (token: string, expectedHash: string) => Promise<boolean> | boolean;\n  /** Verify key fingerprint and proof-of-possession, consuming the challenge. */\n  verifyWorkerProof: (request: {\n    enrollmentName: string;\n    workerKeyFingerprint: string;\n    workerPublicKey: string;\n    challenge: string;\n    signature: string;\n  }) => Promise<boolean> | boolean;\n}\n\nexport function createWorkerEnrollmentManifest(\n  name: string,\n  spec: WorkerEnrollmentSpec,\n): { apiVersion: string; kind: string; metadata: { name: string }; spec: WorkerEnrollmentSpec } {\n  return {\n    apiVersion: WORKER_ENROLLMENT_API_VERSION,\n    kind: WORKER_ENROLLMENT_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function createWorkerSessionManifest(\n  name: string,\n  spec: WorkerSessionSpec,\n): { apiVersion: string; kind: string; metadata: { name: string }; spec: WorkerSessionSpec } {\n  return {\n    apiVersion: WORKER_SESSION_API_VERSION,\n    kind: WORKER_SESSION_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isWorkerEnrollment(resource: OrchestrationResource<unknown, unknown>): resource is WorkerEnrollmentResource {\n  return resource.kind === WORKER_ENROLLMENT_KIND;\n}\n\nexport function isWorkerSession(resource: OrchestrationResource<unknown, unknown>): resource is WorkerSessionResource {\n  return resource.kind === WORKER_SESSION_KIND;\n}\n\n/**\n * Enroll a new worker: create a WorkerEnrollment with a one-time bootstrap token.\n * Only callable by trusted controller or admin actors.\n */\nexport async function enrollWorker(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  name: string,\n  spec: WorkerEnrollmentSpec,\n): Promise<WorkerEnrollmentResource> {\n  if (actor.kind !== 'controller' && actor.kind !== 'admin') {\n    throw new Error('Worker enrollment requires controller or admin actor');\n  }\n  const manifest = createWorkerEnrollmentManifest(name, spec);\n  const resource = await store.create(actor, manifest);\n  return resource as WorkerEnrollmentResource;\n}\n\n/**\n * Bind a worker to its enrollment: the worker proves possession of the\n * bootstrap token and receives a WorkerSession with an ephemeral identity.\n */\nexport async function bindWorkerSession(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  enrollmentName: string,\n  request: BindWorkerSessionRequest,\n  now: () => Date = () => new Date(),\n): Promise<WorkerSessionResource> {\n  if (actor.kind !== 'controller' && actor.kind !== 'admin') {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'Worker session binding requires controller or admin actor',\n      retryable: false,\n    });\n  }\n  if (\n    !request.bootstrapToken ||\n    !request.workerKeyFingerprint ||\n    !request.workerPublicKey ||\n    !request.gatewayKeyFingerprint ||\n    !request.proof.challenge ||\n    !request.proof.signature ||\n    !Number.isFinite(request.ttlMs) ||\n    request.ttlMs <= 0\n  ) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: 'Worker session binding requires a bootstrap token, worker key fingerprint, and positive TTL',\n      retryable: false,\n    });\n  }\n\n  const enrollmentResource = await store.get<WorkerEnrollmentSpec>({\n    apiVersion: WORKER_ENROLLMENT_API_VERSION,\n    kind: WORKER_ENROLLMENT_KIND,\n    name: enrollmentName,\n  });\n  const enrollment = enrollmentResource as WorkerEnrollmentResource | null;\n  if (!enrollment) {\n    throw new OrchestrationError({\n      code: 'NOT_FOUND',\n      message: `WorkerEnrollment '${enrollmentName}' not found`,\n      retryable: false,\n    });\n  }\n  const currentTime = now();\n  const enrollmentExpiry = new Date(enrollment.spec.expiresAt);\n  if (!Number.isFinite(enrollmentExpiry.getTime()) || enrollmentExpiry <= currentTime) {\n    throw new OrchestrationError({\n      code: 'TIMEOUT',\n      message: `WorkerEnrollment '${enrollmentName}' has expired`,\n      retryable: false,\n    });\n  }\n  if (enrollment.status?.phase === 'Revoked' || enrollment.status?.phase === 'Expired') {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `WorkerEnrollment '${enrollmentName}' is not active`,\n      retryable: false,\n    });\n  }\n  if (enrollment.spec.gatewayKeyFingerprint !== request.gatewayKeyFingerprint) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'Worker enrollment gateway key does not match the serving gateway',\n      retryable: false,\n    });\n  }\n  if (\n    enrollment.status?.phase === 'Bound' &&\n    enrollment.status.workerKeyFingerprint !== request.workerKeyFingerprint\n  ) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `WorkerEnrollment '${enrollmentName}' has already been consumed`,\n      retryable: false,\n    });\n  }\n  if (!await request.verifyBootstrapToken(request.bootstrapToken, enrollment.spec.bootstrapTokenHash)) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'Worker bootstrap token is invalid',\n      retryable: false,\n    });\n  }\n  if (\n    !await request.verifyWorkerProof({\n      enrollmentName,\n      workerKeyFingerprint: request.workerKeyFingerprint,\n      workerPublicKey: request.workerPublicKey,\n      challenge: request.proof.challenge,\n      signature: request.proof.signature,\n    })\n  ) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'Worker bootstrap proof-of-possession is invalid',\n      retryable: false,\n    });\n  }\n\n  if (enrollment.status?.phase !== 'Bound') {\n    const boundStatus: WorkerEnrollmentStatus = {\n      phase: 'Bound',\n      workerKeyFingerprint: request.workerKeyFingerprint,\n      boundAt: currentTime.toISOString(),\n    };\n    await store.updateStatus(\n      actor,\n      {\n        apiVersion: WORKER_ENROLLMENT_API_VERSION,\n        kind: WORKER_ENROLLMENT_KIND,\n        name: enrollmentName,\n      },\n      boundStatus,\n      { resourceVersion: enrollment.metadata.resourceVersion },\n    );\n  }\n\n  // Stable identity makes a controller crash after the enrollment fence\n  // recoverable without creating a second session.\n  const sessionName = `session-${enrollment.metadata.uid}`;\n  const existingSessionResource = await store.get<WorkerSessionSpec>({\n    apiVersion: WORKER_SESSION_API_VERSION,\n    kind: WORKER_SESSION_KIND,\n    name: sessionName,\n  });\n  const existingSession = existingSessionResource as WorkerSessionResource | null;\n  if (existingSession) {\n    if (existingSession.spec.workerKeyFingerprint !== request.workerKeyFingerprint) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: `WorkerEnrollment '${enrollmentName}' session identity does not match`,\n        retryable: false,\n      });\n    }\n    return existingSession;\n  }\n\n  const ttlMs = Math.min(request.ttlMs, enrollmentExpiry.getTime() - currentTime.getTime());\n  const manifest = createWorkerSessionManifest(sessionName, {\n    enrollmentRef: {\n      apiVersion: WORKER_ENROLLMENT_API_VERSION,\n      kind: WORKER_ENROLLMENT_KIND,\n      name: enrollmentName,\n    },\n    workerKeyFingerprint: request.workerKeyFingerprint,\n    workerPublicKey: request.workerPublicKey,\n    audience: enrollment.spec.audience,\n    allowedProtocol: enrollment.spec.allowedProtocol,\n    run: enrollment.spec.run,\n    policyDigest: enrollment.spec.policyDigest,\n    allowedMethods: enrollment.spec.allowedMethods,\n    ...(enrollment.spec.allowedTargets ? { allowedTargets: enrollment.spec.allowedTargets } : {}),\n    ttlMs,\n  });\n  const resource = await store.create(actor, manifest);\n  const session = resource as WorkerSessionResource;\n\n  // Update session status to Active.\n  const issuedAt = currentTime.toISOString();\n  const expiresAt = new Date(currentTime.getTime() + ttlMs).toISOString();\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-arguments -- required for correct status type inference\n  await store.updateStatus<WorkerSessionSpec, WorkerSessionStatus>(\n    actor,\n    { apiVersion: WORKER_SESSION_API_VERSION, kind: WORKER_SESSION_KIND, name: sessionName },\n    {\n      phase: 'Active',\n      issuedAt,\n      expiresAt,\n      lastProofAt: issuedAt,\n    },\n    { resourceVersion: session.metadata.resourceVersion },\n  );\n\n  return {\n    ...session,\n    status: {\n      phase: 'Active',\n      issuedAt,\n      expiresAt,\n      lastProofAt: issuedAt,\n    } as WorkerSessionStatus,\n  };\n}\n\n/**\n * Revoke a worker session, preventing further use of the ephemeral identity.\n */\nexport async function revokeWorkerSession(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  sessionName: string,\n  reason: string,\n  now: () => Date = () => new Date(),\n): Promise<void> {\n  const session = await store.get<WorkerSessionSpec>({\n    apiVersion: WORKER_SESSION_API_VERSION,\n    kind: WORKER_SESSION_KIND,\n    name: sessionName,\n  });\n  if (!session) {\n    throw new Error(`WorkerSession ${sessionName} not found`);\n  }\n  await store.updateStatus(\n    actor,\n    { apiVersion: WORKER_SESSION_API_VERSION, kind: WORKER_SESSION_KIND, name: sessionName },\n    {\n      phase: 'Revoked',\n      revokedAt: now().toISOString(),\n      revokeReason: reason,\n    },\n    { resourceVersion: session.metadata.resourceVersion },\n  );\n}\n\n/**\n * Check whether a worker session is currently valid (active and not expired).\n */\nexport function isWorkerSessionValid(session: WorkerSessionResource, now: Date = new Date()): boolean {\n  const status = session.status;\n  if (status?.phase !== 'Active') return false;\n  const expiresAt = status.expiresAt;\n  if (!expiresAt) return false;\n  return new Date(expiresAt) > now;\n}\n","import type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport {\n  bindWorkerSession as bindNarrowWorkerSession,\n  type BindWorkerSessionRequest,\n  revokeWorkerSession,\n  WORKER_ENROLLMENT_API_VERSION,\n  WORKER_ENROLLMENT_KIND,\n  WORKER_SESSION_API_VERSION,\n  WORKER_SESSION_KIND,\n  type WorkerEnrollmentResource,\n  type WorkerSessionResource,\n  type WorkerSessionSpec,\n} from '../security/workerIdentity.js';\n\nimport { assertDriverRequestEnvelope, canonicalDriverValue, type DriverRequestEnvelope } from './driverRequest.js';\nimport type {\n  AttestedIdentity,\n  IdentityAttestationManagementDriver,\n  IdentityChallenge,\n  IdentityEnrollment,\n  IdentityInspection,\n  IdentitySession,\n} from './identityAttestationManagement.js';\n\nconst WORKER_ATTESTATION_FORMAT = 'worker-ed25519-bootstrap/v1';\n\nexport interface ManagedWorkerIdentityRequestFactoryInput<T> {\n  method: string;\n  payload: T;\n  enrollment: WorkerEnrollmentResource;\n  actor: ControlStoreActor;\n  idempotencyKey: string;\n  payloadFields: string[];\n}\n\nexport interface ManagedWorkerIdentityAdapterOptions {\n  store: ControlStore;\n  actor: ControlStoreActor;\n  authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;\n  createRequest<T>(\n    input: ManagedWorkerIdentityRequestFactoryInput<T>,\n  ): DriverRequestEnvelope<T>;\n  maxChallengeTtlMs?: number;\n  maxSessionTtlMs?: number;\n  now?: () => Date;\n  name: string;\n  threatAssumptions: string[];\n}\n\nexport interface ManagedWorkerIdentityRoute {\n  driver: IdentityAttestationManagementDriver;\n  bindWorkerSession(\n    enrollmentName: string,\n    request: BindWorkerSessionRequest,\n  ): Promise<WorkerSessionResource>;\n}\n\ninterface PendingBinding {\n  enrollment: WorkerEnrollmentResource;\n  request: BindWorkerSessionRequest;\n  channelBinding: string;\n  proofDigest: string;\n  evidenceDigest: string;\n}\n\nfunction invalid(message: string): never {\n  throw new OrchestrationError({ code: 'INVALID', message, retryable: false });\n}\n\nfunction unsupported(message: string): never {\n  throw new OrchestrationError({\n    code: 'UNSUPPORTED',\n    message,\n    retryable: false,\n  });\n}\n\nasync function digest(value: unknown): Promise<string> {\n  const bytes = new TextEncoder().encode(canonicalDriverValue(value));\n  const result = await globalThis.crypto.subtle.digest('SHA-256', bytes);\n  return `sha256:${\n    [...new Uint8Array(result)]\n      .map((byte) => byte.toString(16).padStart(2, '0'))\n      .join('')\n  }`;\n}\n\nfunction exactFields(\n  payload: unknown,\n  allowed: readonly string[],\n  location: string,\n): void {\n  if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) {\n    invalid(`managed worker identity ${location} must be an object`);\n  }\n  const unknown = Object.keys(payload).filter((field) => !allowed.includes(field));\n  if (unknown.length > 0) {\n    invalid(\n      `managed worker identity ${location} contains unsupported fields: ${unknown.join(', ')}`,\n    );\n  }\n}\n\nfunction requireBoundedString(\n  value: unknown,\n  field: string,\n  maximum = 1024,\n): string {\n  if (\n    typeof value !== 'string' ||\n    !value ||\n    value.length > maximum\n  ) invalid(`managed worker identity ${field} is invalid`);\n  return value;\n}\n\n/**\n * Put the existing one-time WorkerEnrollment/WorkerSession Ed25519 flow behind\n * the general Identity/Attestation contract without claiming hardware\n * attestation or crash-persistent pending proof material.\n */\nexport function createManagedWorkerIdentityAdapter(\n  options: ManagedWorkerIdentityAdapterOptions,\n): ManagedWorkerIdentityRoute {\n  const now = options.now ?? (() => new Date());\n  const maxChallengeTtlMs = options.maxChallengeTtlMs ?? 60_000;\n  const maxSessionTtlMs = options.maxSessionTtlMs ?? 60 * 60_000;\n  if (\n    !options.name ||\n    !options.threatAssumptions.length ||\n    !Number.isSafeInteger(maxChallengeTtlMs) ||\n    maxChallengeTtlMs < 1 ||\n    !Number.isSafeInteger(maxSessionTtlMs) ||\n    maxSessionTtlMs < 1\n  ) invalid('managed worker identity adapter options are invalid');\n\n  const enrollments = new Map<string, IdentityEnrollment>();\n  const challenges = new Map<string, IdentityChallenge>();\n  const identities = new Map<string, AttestedIdentity>();\n  const sessions = new Map<string, IdentitySession>();\n  const pending = new Map<string, PendingBinding>();\n  const active = new Set<string>();\n  const fences = new Map<string, number>();\n  const idempotency = new Map<string, string>();\n\n  async function enrollmentFor(\n    request: DriverRequestEnvelope,\n  ): Promise<WorkerEnrollmentResource> {\n    if (\n      request.resource.apiVersion !== WORKER_ENROLLMENT_API_VERSION ||\n      request.resource.kind !== WORKER_ENROLLMENT_KIND\n    ) invalid('managed worker identity resource kind is invalid');\n    const resource = await options.store.get({\n      apiVersion: WORKER_ENROLLMENT_API_VERSION,\n      kind: WORKER_ENROLLMENT_KIND,\n      name: request.resource.name,\n    }) as WorkerEnrollmentResource | null;\n    if (\n      !resource ||\n      resource.metadata.uid !== request.resource.uid ||\n      resource.metadata.generation !== request.resource.generation\n    ) {\n      throw new OrchestrationError({\n        code: resource ? 'CONFLICT' : 'NOT_FOUND',\n        message: 'managed worker enrollment identity changed or disappeared',\n        retryable: false,\n      });\n    }\n    return resource;\n  }\n\n  async function authorize<T>(\n    request: DriverRequestEnvelope<T>,\n    method: string,\n    fields: string[],\n  ): Promise<WorkerEnrollmentResource> {\n    exactFields(request.payload, fields, `${method} payload`);\n    assertDriverRequestEnvelope(request, {\n      now,\n      requireFencing: true,\n      requireCapability: true,\n      expectedMethod: method,\n    });\n    if (\n      request.actor.id !== options.actor.id ||\n      request.actor.kind !== options.actor.kind\n    ) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed worker identity actor was rejected',\n        retryable: false,\n      });\n    }\n    if (!await options.authorizeRequest(request)) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'managed worker identity capability was rejected',\n        retryable: false,\n      });\n    }\n    const resource = await enrollmentFor(request);\n    const idempotencyKey = `${request.resource.uid}:${method}:${request.idempotencyKey}`;\n    const fingerprint = canonicalDriverValue({\n      resource: request.resource,\n      fencingEpoch: request.fencingEpoch,\n      actor: request.actor,\n      session: request.session,\n      capabilityHandleRef: request.capabilityHandleRef,\n      payloadSchemaDigest: request.payloadSchemaDigest,\n      payload: request.payload,\n    });\n    const previous = idempotency.get(idempotencyKey);\n    if (previous !== undefined && previous !== fingerprint) {\n      throw new OrchestrationError({\n        code: 'CONFLICT',\n        message: `managed worker identity ${method} idempotency input drifted`,\n        retryable: false,\n      });\n    }\n    idempotency.set(idempotencyKey, fingerprint);\n    const fence = request.fencingEpoch;\n    if (!Number.isSafeInteger(fence) || (fence as number) < 1) {\n      invalid('managed worker identity fencing epoch is invalid');\n    }\n    const current = fences.get(request.resource.uid) ?? 0;\n    if ((fence as number) < current) {\n      throw new OrchestrationError({\n        code: 'STALE_EPOCH',\n        message: 'managed worker identity fencing epoch is stale',\n        retryable: false,\n      });\n    }\n    fences.set(request.resource.uid, fence as number);\n    return resource;\n  }\n\n  function owned<T extends { resourceUid: string }>(\n    values: Map<string, T>,\n    handle: string,\n    resourceUid: string,\n    kind: string,\n  ): T {\n    const value = values.get(handle);\n    if (!value) {\n      throw new OrchestrationError({\n        code: 'NOT_FOUND',\n        message: `managed worker ${kind} handle was not found`,\n        retryable: false,\n      });\n    }\n    if (value.resourceUid !== resourceUid) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: `managed worker ${kind} belongs to another resource`,\n        retryable: false,\n      });\n    }\n    return value;\n  }\n\n  const driver: IdentityAttestationManagementDriver = {\n    async getCapabilities() {\n      return {\n        name: options.name,\n        identityDomains: ['enrollment'],\n        attestationFormats: [WORKER_ATTESTATION_FORMAT],\n        supportsProofOfPossession: true,\n        supportsChannelBinding: true,\n        supportsRotation: false,\n        maxChallengeTtlMs,\n        maxSessionTtlMs,\n        persistence: 'process',\n        threatAssumptions: options.threatAssumptions,\n      };\n    },\n    async enroll(request) {\n      const resource = await authorize(request, 'identity.enroll', [\n        'domain',\n        'subject',\n        'trustClass',\n        'bootstrapKeyFingerprint',\n        'ttlMs',\n      ]);\n      if (\n        request.payload.domain !== 'enrollment' ||\n        request.payload.subject !== resource.metadata.name ||\n        request.payload.trustClass !== resource.spec.trustClass ||\n        request.payload.bootstrapKeyFingerprint !==\n          resource.spec.bootstrapTokenHash\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'managed enrollment payload differs from WorkerEnrollment',\n          retryable: false,\n        });\n      }\n      const remaining = Date.parse(resource.spec.expiresAt) - now().getTime();\n      if (\n        !Number.isSafeInteger(remaining) ||\n        remaining < 1 ||\n        !Number.isSafeInteger(request.payload.ttlMs) ||\n        request.payload.ttlMs < 1 ||\n        request.payload.ttlMs > maxSessionTtlMs\n      ) invalid('managed enrollment is expired or its requested TTL is invalid');\n      const value: IdentityEnrollment = {\n        enrollmentHandle: `worker-enrollment:${resource.metadata.uid}`,\n        resourceUid: resource.metadata.uid,\n        domain: 'enrollment',\n        subject: resource.metadata.name,\n        trustClass: resource.spec.trustClass,\n        bootstrapKeyFingerprint: resource.spec.bootstrapTokenHash,\n        expiresAt: resource.spec.expiresAt,\n        consumed: resource.status?.phase === 'Bound',\n        revoked: resource.status?.phase === 'Revoked' ||\n          resource.status?.phase === 'Expired',\n      };\n      enrollments.set(value.enrollmentHandle, value);\n      return structuredClone(value);\n    },\n    async challenge(request) {\n      const resource = await authorize(request, 'identity.challenge', [\n        'enrollmentHandle',\n        'channelBinding',\n        'ttlMs',\n      ]);\n      const enrollment = owned(\n        enrollments,\n        requireBoundedString(\n          request.payload.enrollmentHandle,\n          'enrollmentHandle',\n        ),\n        resource.metadata.uid,\n        'enrollment',\n      );\n      const binding = pending.get(resource.metadata.uid);\n      if (\n        !binding ||\n        binding.channelBinding !== request.payload.channelBinding ||\n        enrollment.revoked ||\n        Date.parse(enrollment.expiresAt) <= now().getTime()\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'managed worker challenge has no active host binding',\n          retryable: false,\n        });\n      }\n      if (\n        !Number.isSafeInteger(request.payload.ttlMs) ||\n        request.payload.ttlMs < 1 ||\n        request.payload.ttlMs > maxChallengeTtlMs\n      ) invalid('managed worker challenge TTL is invalid');\n      const handle = `worker-challenge:${resource.metadata.uid}:${binding.request.workerKeyFingerprint}`;\n      const challenge: IdentityChallenge = {\n        challengeHandle: handle,\n        enrollmentHandle: enrollment.enrollmentHandle,\n        resourceUid: resource.metadata.uid,\n        nonce: binding.evidenceDigest,\n        channelBinding: binding.channelBinding,\n        expiresAt: new Date(\n          Math.min(\n            now().getTime() + request.payload.ttlMs,\n            Date.parse(resource.spec.expiresAt),\n          ),\n        ).toISOString(),\n        consumed: false,\n      };\n      challenges.set(handle, challenge);\n      return structuredClone(challenge);\n    },\n    async attest(request) {\n      const resource = await authorize(request, 'identity.attest', [\n        'challengeHandle',\n        'publicKeyFingerprint',\n        'channelBinding',\n        'attestation',\n        'proof',\n      ]);\n      exactFields(\n        request.payload.attestation,\n        ['format', 'evidenceDigest'],\n        'attestation',\n      );\n      const challenge = owned(\n        challenges,\n        requireBoundedString(\n          request.payload.challengeHandle,\n          'challengeHandle',\n        ),\n        resource.metadata.uid,\n        'challenge',\n      );\n      const binding = pending.get(resource.metadata.uid);\n      if (\n        !binding ||\n        challenge.consumed ||\n        Date.parse(challenge.expiresAt) <= now().getTime() ||\n        request.payload.publicKeyFingerprint !==\n          binding.request.workerKeyFingerprint ||\n        request.payload.channelBinding !== binding.channelBinding ||\n        request.payload.attestation?.format !== WORKER_ATTESTATION_FORMAT ||\n        request.payload.attestation?.evidenceDigest !== binding.evidenceDigest ||\n        request.payload.proof !== binding.proofDigest\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'managed worker attestation binding is invalid',\n          retryable: false,\n        });\n      }\n      if (\n        !await binding.request.verifyBootstrapToken(\n          binding.request.bootstrapToken,\n          resource.spec.bootstrapTokenHash,\n        ) ||\n        !await binding.request.verifyWorkerProof({\n          enrollmentName: resource.metadata.name,\n          workerKeyFingerprint: binding.request.workerKeyFingerprint,\n          workerPublicKey: binding.request.workerPublicKey,\n          challenge: binding.request.proof.challenge,\n          signature: binding.request.proof.signature,\n        })\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'managed worker proof of possession was rejected',\n          retryable: false,\n        });\n      }\n      challenge.consumed = true;\n      const identity: AttestedIdentity = {\n        identityHandle: `worker-identity:${resource.metadata.uid}:${binding.request.workerKeyFingerprint}`,\n        resourceUid: resource.metadata.uid,\n        domain: 'enrollment',\n        subject: resource.metadata.name,\n        trustClass: resource.spec.trustClass,\n        keyFingerprint: binding.request.workerKeyFingerprint,\n        channelBinding: binding.channelBinding,\n        attestationFormat: WORKER_ATTESTATION_FORMAT,\n        evidenceDigest: binding.evidenceDigest,\n        issuedAt: now().toISOString(),\n        revoked: false,\n      };\n      identities.set(identity.identityHandle, identity);\n      return structuredClone(identity);\n    },\n    async issueSession(request) {\n      const resource = await authorize(request, 'identity.issue-session', [\n        'identityHandle',\n        'domain',\n        'audience',\n        'channelBinding',\n        'ttlMs',\n      ]);\n      const identity = owned(\n        identities,\n        requireBoundedString(request.payload.identityHandle, 'identityHandle'),\n        resource.metadata.uid,\n        'identity',\n      );\n      const binding = pending.get(resource.metadata.uid);\n      if (\n        !binding ||\n        identity.revoked ||\n        request.payload.domain !== 'enrollment' ||\n        request.payload.audience !== resource.spec.audience ||\n        request.payload.channelBinding !== identity.channelBinding ||\n        !Number.isSafeInteger(request.payload.ttlMs) ||\n        request.payload.ttlMs < 1 ||\n        request.payload.ttlMs > maxSessionTtlMs\n      ) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'managed worker session scope is invalid',\n          retryable: false,\n        });\n      }\n      const workerSession = await bindNarrowWorkerSession(\n        options.store,\n        options.actor,\n        resource.metadata.name,\n        {\n          ...binding.request,\n          ttlMs: request.payload.ttlMs,\n          // Attest already consumed the host's one-time verifiers. The narrow\n          // store function still rechecks all durable resource/session scope.\n          verifyBootstrapToken: () => true,\n          verifyWorkerProof: () => true,\n        },\n        now,\n      );\n      if (\n        workerSession.status?.phase !== 'Active' ||\n        !workerSession.status.issuedAt ||\n        !workerSession.status.expiresAt\n      ) {\n        throw new OrchestrationError({\n          code: 'UNKNOWN_EFFECT',\n          message: 'managed worker session was not durably activated',\n          retryable: false,\n        });\n      }\n      const session: IdentitySession = {\n        sessionHandle: `worker-session:${workerSession.metadata.name}`,\n        identityHandle: identity.identityHandle,\n        resourceUid: resource.metadata.uid,\n        domain: 'enrollment',\n        audience: workerSession.spec.audience,\n        channelBinding: identity.channelBinding,\n        issuedAt: workerSession.status.issuedAt,\n        expiresAt: workerSession.status.expiresAt,\n        revoked: false,\n      };\n      sessions.set(session.sessionHandle, session);\n      return structuredClone(session);\n    },\n    async rotate(request) {\n      await authorize(request, 'identity.rotate', [\n        'identityHandle',\n        'newKeyFingerprint',\n        'channelBinding',\n        'proof',\n      ]);\n      unsupported(\n        'WorkerSession uses ephemeral Ed25519 keys; in-place identity rotation is unsupported, create a new enrollment',\n      );\n    },\n    async revoke(request) {\n      const resource = await authorize(request, 'identity.revoke', [\n        'identityHandle',\n        'reason',\n      ]);\n      const identity = owned(\n        identities,\n        requireBoundedString(request.payload.identityHandle, 'identityHandle'),\n        resource.metadata.uid,\n        'identity',\n      );\n      const reason = requireBoundedString(request.payload.reason, 'reason');\n      const session = [...sessions.values()].find(\n        (candidate) => candidate.identityHandle === identity.identityHandle,\n      );\n      if (session) {\n        await revokeWorkerSession(\n          options.store,\n          options.actor,\n          session.sessionHandle.slice('worker-session:'.length),\n          reason,\n          now,\n        );\n        session.revoked = true;\n      }\n      identity.revoked = true;\n      identity.revokeReason = reason;\n      return structuredClone(identity);\n    },\n    async inspect(request) {\n      const resource = await authorize(request, 'identity.inspect', ['handle']);\n      const handle = requireBoundedString(request.payload.handle, 'handle');\n      const candidates: Array<IdentityInspection | undefined> = [\n        enrollments.get(handle)\n          ? { kind: 'enrollment', value: enrollments.get(handle)! }\n          : undefined,\n        challenges.get(handle)\n          ? { kind: 'challenge', value: challenges.get(handle)! }\n          : undefined,\n        identities.get(handle)\n          ? { kind: 'identity', value: identities.get(handle)! }\n          : undefined,\n        sessions.get(handle)\n          ? { kind: 'session', value: sessions.get(handle)! }\n          : undefined,\n      ];\n      const found = candidates.find(\n        (candidate) => candidate?.value.resourceUid === resource.metadata.uid,\n      );\n      return found ? structuredClone(found) : undefined;\n    },\n  };\n\n  return {\n    driver,\n    async bindWorkerSession(enrollmentName, request) {\n      const enrollment = await options.store.get({\n        apiVersion: WORKER_ENROLLMENT_API_VERSION,\n        kind: WORKER_ENROLLMENT_KIND,\n        name: enrollmentName,\n      }) as WorkerEnrollmentResource | null;\n      if (!enrollment) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: `WorkerEnrollment '${enrollmentName}' not found`,\n          retryable: false,\n        });\n      }\n      if (\n        !request.bootstrapToken ||\n        request.bootstrapToken.length > 4096 ||\n        !request.workerKeyFingerprint ||\n        request.workerKeyFingerprint.length > 512 ||\n        !request.workerPublicKey ||\n        request.workerPublicKey.length > 16 * 1024 ||\n        !request.gatewayKeyFingerprint ||\n        request.gatewayKeyFingerprint.length > 512 ||\n        !request.proof.challenge ||\n        request.proof.challenge.length > 16 * 1024 ||\n        !request.proof.signature ||\n        request.proof.signature.length > 16 * 1024 ||\n        !Number.isSafeInteger(request.ttlMs) ||\n        request.ttlMs < 1\n      ) invalid('managed worker binding request is invalid or too large');\n      const remainingAtStart = Date.parse(enrollment.spec.expiresAt) -\n        now().getTime();\n      if (!Number.isSafeInteger(remainingAtStart) || remainingAtStart < 1) {\n        throw new OrchestrationError({\n          code: 'TIMEOUT',\n          message: `WorkerEnrollment '${enrollmentName}' has expired`,\n          retryable: false,\n        });\n      }\n      if (active.has(enrollment.metadata.uid)) {\n        throw new OrchestrationError({\n          code: 'CONFLICT',\n          message: `WorkerEnrollment '${enrollmentName}' is already binding`,\n          retryable: true,\n        });\n      }\n      active.add(enrollment.metadata.uid);\n      try {\n        const channelBinding = await digest({\n          gatewayKeyFingerprint: request.gatewayKeyFingerprint,\n          audience: enrollment.spec.audience,\n          workerKeyFingerprint: request.workerKeyFingerprint,\n        });\n        const proofDigest = await digest({\n          signature: request.proof.signature,\n        });\n        const evidenceDigest = await digest({\n          challenge: request.proof.challenge,\n          signature: request.proof.signature,\n          workerPublicKey: request.workerPublicKey,\n          channelBinding,\n        });\n        pending.set(enrollment.metadata.uid, {\n          enrollment,\n          request,\n          channelBinding,\n          proofDigest,\n          evidenceDigest,\n        });\n        const call = <T>(\n          method: string,\n          payload: T,\n          suffix: string,\n          payloadFields: string[],\n        ) =>\n          options.createRequest({\n            method,\n            payload,\n            enrollment,\n            actor: options.actor,\n            idempotencyKey: `${enrollment.metadata.uid}:${suffix}:${request.workerKeyFingerprint}`,\n            payloadFields,\n          });\n        const expiration = Date.parse(enrollment.spec.expiresAt);\n        const remaining = expiration - now().getTime();\n        if (!Number.isSafeInteger(remaining) || remaining < 1) {\n          throw new OrchestrationError({\n            code: 'TIMEOUT',\n            message: `WorkerEnrollment '${enrollmentName}' expired during binding`,\n            retryable: false,\n          });\n        }\n        const managedEnrollment = await driver.enroll(call(\n          'identity.enroll',\n          {\n            domain: 'enrollment' as const,\n            subject: enrollment.metadata.name,\n            trustClass: enrollment.spec.trustClass,\n            bootstrapKeyFingerprint: enrollment.spec.bootstrapTokenHash,\n            // The durable absolute expiresAt remains authoritative. Using the\n            // configured bound keeps retries stable across elapsed time and\n            // across ControlStore/adapter clock implementations.\n            ttlMs: maxSessionTtlMs,\n          },\n          'enroll',\n          [\n            'domain',\n            'subject',\n            'trustClass',\n            'bootstrapKeyFingerprint',\n            'ttlMs',\n          ],\n        ));\n        const challenge = await driver.challenge(call(\n          'identity.challenge',\n          {\n            enrollmentHandle: managedEnrollment.enrollmentHandle,\n            channelBinding,\n            ttlMs: maxChallengeTtlMs,\n          },\n          'challenge',\n          ['enrollmentHandle', 'channelBinding', 'ttlMs'],\n        ));\n        const identity = await driver.attest(call(\n          'identity.attest',\n          {\n            challengeHandle: challenge.challengeHandle,\n            publicKeyFingerprint: request.workerKeyFingerprint,\n            channelBinding,\n            attestation: {\n              format: WORKER_ATTESTATION_FORMAT,\n              evidenceDigest,\n            },\n            proof: proofDigest,\n          },\n          'attest',\n          [\n            'challengeHandle',\n            'publicKeyFingerprint',\n            'channelBinding',\n            'attestation',\n            'proof',\n          ],\n        ));\n        await driver.issueSession(call(\n          'identity.issue-session',\n          {\n            identityHandle: identity.identityHandle,\n            domain: 'enrollment' as const,\n            audience: enrollment.spec.audience,\n            channelBinding,\n            ttlMs: Math.min(request.ttlMs, maxSessionTtlMs),\n          },\n          'issue-session',\n          [\n            'identityHandle',\n            'domain',\n            'audience',\n            'channelBinding',\n            'ttlMs',\n          ],\n        ));\n        const session = await options.store.get<WorkerSessionSpec>({\n          apiVersion: WORKER_SESSION_API_VERSION,\n          kind: WORKER_SESSION_KIND,\n          name: `session-${enrollment.metadata.uid}`,\n        }) as WorkerSessionResource | null;\n        if (!session) {\n          throw new OrchestrationError({\n            code: 'UNKNOWN_EFFECT',\n            message: 'managed worker session was issued but could not be observed',\n            retryable: false,\n          });\n        }\n        return session;\n      } finally {\n        pending.delete(enrollment.metadata.uid);\n        active.delete(enrollment.metadata.uid);\n      }\n    },\n  };\n}\n","import type { OrchestrationResourceReference } from '../client.js';\nimport type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport { MODEL_CLASS_API_VERSION, MODEL_CLASS_KIND, MODEL_ENDPOINT_API_VERSION, MODEL_ENDPOINT_KIND, type ModelEndpointStatus } from '../resources.js';\nimport { describeLocalModelEndpoints, type LocalModelAdvertisementOptions } from './localModelRegistration.js';\nimport type { ModelProviderDriver } from './modelProviderDriver.js';\n\n/**\n * ModelEndpoint registration heartbeat (plan 24.36).\n *\n * A node runs one registrar per ModelProviderDriver. Each heartbeat tick\n * re-describes the driver's models, upserts ModelClass/ModelEndpoint\n * resources into the ControlStore, and refreshes endpoint `status.healthy`\n * and `status.heartbeat` so the scheduler can place model calls on live\n * endpoints. Endpoints the driver stops serving are deleted; when the driver\n * cannot be interrogated or the registrar stops, owned endpoints are marked\n * unhealthy (fail-safe: never advertise a possibly-dead model as healthy).\n *\n * The actor identity is host-bound; scripts and model output cannot choose\n * it. Endpoint specs are immutable here because ControlStore intentionally\n * exposes no spec-update verb — identity changes require delete + recreate.\n */\n\nexport interface ModelEndpointRegistrarOptions {\n  /** Host-bound actor identity used for every ControlStore write. */\n  actor: ControlStoreActor;\n  /** Advertisement identity/policy (nodeId, trust, capacity, data policy). */\n  advertisement: LocalModelAdvertisementOptions;\n  /** Heartbeat interval in milliseconds (default 30_000). */\n  heartbeatIntervalMs?: number;\n  /** CAS attempts per status write before giving up (default 3). */\n  statusWriteAttempts?: number;\n  /** Start the background loop immediately (default true). */\n  autoStart?: boolean;\n  /** Injectable clock for deterministic tests. */\n  now?: () => Date;\n  /** Injectable sleep for deterministic tests. */\n  sleep?: (ms: number) => Promise<void>;\n  /** Observes swallowed tick errors; the loop keeps running regardless. */\n  onError?: (error: unknown) => void;\n}\n\nexport interface ModelEndpointRegistrarHandle {\n  /** Run one registration + heartbeat pass (serialized with the loop). */\n  refresh(): Promise<void>;\n  /** Stop the loop and mark owned endpoints unhealthy (best-effort). */\n  stop(): Promise<void>;\n}\n\nexport function createModelEndpointRegistrar(\n  store: ControlStore,\n  driver: ModelProviderDriver,\n  options: ModelEndpointRegistrarOptions,\n): ModelEndpointRegistrarHandle {\n  const now = options.now ?? (() => new Date());\n  const sleep = options.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n  const intervalMs = options.heartbeatIntervalMs ?? 30_000;\n  const statusWriteAttempts = options.statusWriteAttempts ?? 3;\n  const onError = options.onError ?? ((): void => {});\n\n  const ownedEndpoints = new Map<string, OrchestrationResourceReference>();\n  let stopped = false;\n  let inFlight: Promise<void> = Promise.resolve();\n\n  async function writeEndpointStatus(\n    reference: OrchestrationResourceReference,\n    patch: Pick<ModelEndpointStatus, 'healthy' | 'heartbeat'>,\n  ): Promise<void> {\n    for (let attempt = 0; attempt < statusWriteAttempts; attempt += 1) {\n      const current = await store.get(reference);\n      if (!current) return; // Deleted concurrently; nothing to refresh.\n      try {\n        await store.updateStatus(\n          options.actor,\n          reference,\n          { ...current.status, ...patch },\n          { resourceVersion: current.metadata.resourceVersion },\n        );\n        return;\n      } catch (error) {\n        if (error instanceof OrchestrationError && error.code === 'CONFLICT') continue;\n        throw error;\n      }\n    }\n    throw new OrchestrationError({\n      code: 'CONFLICT',\n      message: `endpoint '${reference.name}' status update exceeded ${statusWriteAttempts} CAS attempts`,\n      retryable: true,\n    });\n  }\n\n  async function markAllOwned(healthy: boolean): Promise<void> {\n    for (const reference of ownedEndpoints.values()) {\n      try {\n        await writeEndpointStatus(reference, { healthy, heartbeat: now().toISOString() });\n      } catch (error) {\n        onError(error);\n      }\n    }\n  }\n\n  async function refreshOnce(): Promise<void> {\n    let advertisement;\n    try {\n      advertisement = await describeLocalModelEndpoints(driver, options.advertisement);\n    } catch (error) {\n      // Fail-safe: a driver we cannot interrogate must not keep advertising\n      // healthy endpoints.\n      onError(error);\n      await markAllOwned(false);\n      return;\n    }\n\n    for (const classManifest of advertisement.modelClasses) {\n      const reference: OrchestrationResourceReference = {\n        apiVersion: MODEL_CLASS_API_VERSION,\n        kind: MODEL_CLASS_KIND,\n        name: classManifest.metadata.name,\n      };\n      try {\n        if (!(await store.get(reference))) {\n          await store.create(options.actor, classManifest);\n        }\n      } catch (error) {\n        onError(error);\n      }\n    }\n\n    const seen = new Set<string>();\n    for (const endpointManifest of advertisement.endpoints) {\n      const name = endpointManifest.metadata.name;\n      if (!name) continue;\n      const reference: OrchestrationResourceReference = {\n        apiVersion: MODEL_ENDPOINT_API_VERSION,\n        kind: MODEL_ENDPOINT_KIND,\n        name,\n      };\n      seen.add(name);\n      try {\n        if (!(await store.get(reference))) {\n          await store.create(options.actor, endpointManifest);\n        }\n        ownedEndpoints.set(name, reference);\n        await writeEndpointStatus(reference, {\n          healthy: advertisement.health.healthy,\n          heartbeat: now().toISOString(),\n        });\n      } catch (error) {\n        onError(error);\n      }\n    }\n\n    // Prune endpoints the driver no longer serves.\n    for (const [name, reference] of [...ownedEndpoints]) {\n      if (seen.has(name)) continue;\n      try {\n        await store.delete(options.actor, reference);\n      } catch (error) {\n        onError(error);\n      }\n      ownedEndpoints.delete(name);\n    }\n  }\n\n  function runRefresh(): Promise<void> {\n    inFlight = inFlight.then(() => refreshOnce()).catch(onError);\n    return inFlight;\n  }\n\n  if (options.autoStart ?? true) {\n    void (async () => {\n      while (!stopped) {\n        await runRefresh();\n        if (stopped) break;\n        await sleep(intervalMs);\n      }\n    })().catch(onError);\n  }\n\n  return {\n    refresh: runRefresh,\n    async stop() {\n      stopped = true;\n      await inFlight.catch(() => undefined);\n      await markAllOwned(false);\n    },\n  };\n}\n","import type { OrchestrationOwnerReference } from '../client.js';\nimport { OrchestrationError } from '../errors.js';\nimport type { OrchestrationErrorData } from '../errors.js';\nimport type { ModelCallRecordSpec, ModelCallRecordStatus } from '../resources.js';\nimport type { ModelClassSpec } from '../resources.js';\nimport type { ModelAccessHandleBroker, ModelAccessHandleClaims } from '../security/modelAccessHandle.js';\nimport type { ModelProviderHealth } from './modelProviderDriver.js';\nimport type { ModelGenerateRequest, ModelStreamChunk } from './modelProviderDriver.js';\n\n/**\n * ModelGateway (plan §12, §21.3): the trusted model path.\n *\n * The gateway holds no provider credential itself — it guards an\n * `ModelGatewayExecutor` (host-provided, e.g. the legacy provider adapter)\n * that performs the actual call with host-held keys. Workers present a\n * short-lived `ModelAccessHandle` (24.34) instead of a provider key; the\n * gateway verifies Run/model/audience/expiry/proof-of-possession and\n * enforces per-Run token, cost, concurrency, and request-rate budgets at\n * the gateway (§12.4 — not only in the worker). Every call produces a\n * `ModelCallRecord` (24.32) via the injected recorder.\n *\n * Secret discipline (§12.4): handle tokens, prompts, and model output are\n * never written to records, logs, or thrown error details.\n */\n\nexport interface ModelGatewayGenerateRequest extends ModelGenerateRequest {\n  /** Opaque ModelAccessHandle token presented by the caller. Never recorded. */\n  accessHandle: string;\n  /** Presented worker key fingerprint for the proof-of-possession check. */\n  workerKey?: string;\n}\n\nexport interface ModelGatewayCallRecord {\n  /** ModelCallRecord correlation id (ModelGenerateRequest.callId). */\n  callId: string;\n  spec: ModelCallRecordSpec;\n  status: ModelCallRecordStatus;\n}\n\n/** Audit port; hosts persist ModelCallRecord resources (e.g. ControlStore). */\nexport interface ModelGatewayRecorder {\n  recordCall(record: ModelGatewayCallRecord): Promise<void> | void;\n}\n\n/** Performs the actual provider call with host-held credentials. */\nexport interface ModelGatewayExecutor {\n  listModels?(): Promise<ModelClassSpec[]>;\n  getHealth?(): Promise<ModelProviderHealth>;\n  generate(request: ModelGenerateRequest): AsyncIterable<ModelStreamChunk>;\n  cancel?(callId: string): Promise<void>;\n}\n\nexport interface ModelGatewayOptions {\n  /** Handle issuer/verifier (24.34). */\n  broker: ModelAccessHandleBroker;\n  /** Host provider executor holding the real credentials. */\n  executor: ModelGatewayExecutor;\n  /** Audit recorder for ModelCallRecords; recording failures never break calls. */\n  recorder?: ModelGatewayRecorder;\n  /** Host-asserted caller identity stamped on records (never self-reported). */\n  caller?: string;\n  /** Required handle audience (defaults to the broker's audience). */\n  audience?: string;\n  /** Cost charged per token (input + output) when the stream reports usage. */\n  costPerToken?: number;\n  /** Currency stamped on recorded usage. */\n  currency?: string;\n  /** Sliding-window request rate limit per handle (requests/second). */\n  maxRequestsPerSecond?: number;\n  /** Sink for non-fatal gateway errors (e.g. recorder failures). */\n  onError?: (error: unknown) => void;\n  now?: () => Date;\n}\n\nexport interface ModelGateway {\n  listModels(): Promise<ModelClassSpec[]>;\n  getHealth(): Promise<ModelProviderHealth>;\n  generate(request: ModelGatewayGenerateRequest): AsyncIterable<ModelStreamChunk>;\n  /** Abort an in-flight call (e.g. Run cancellation). */\n  cancel(callId: string): Promise<void>;\n  /** Revoke a handle immediately (Run completion, cancellation, policy change). */\n  revokeHandle(handleId: string): void;\n  /** Revoke every handle the gateway has verified for the given Run name. */\n  revokeRunHandles(runName: string): void;\n}\n\nexport function createModelGateway(options: ModelGatewayOptions): ModelGateway {\n  const now = options.now ?? (() => new Date());\n  const onError = options.onError ?? (() => {});\n  const costPerToken = options.costPerToken ?? 0;\n\n  /** In-flight calls by callId. */\n  const inFlight = new Map<string, { handleId: string }>();\n  /** handleId → run name, for revokeRunHandles (§12.1 step 6). */\n  const seenHandles = new Map<string, string | undefined>();\n  /** Per-handle request timestamps for the sliding-window rate limit. */\n  const requestLog = new Map<string, number[]>();\n\n  function checkRateLimit(handleId: string): void {\n    const limit = options.maxRequestsPerSecond;\n    if (!limit) return;\n    const at = now().getTime();\n    const windowStart = at - 1000;\n    const log = (requestLog.get(handleId) ?? []).filter((timestamp) => timestamp >= windowStart);\n    if (log.length >= limit) {\n      const retryAfterMs = Math.max(1, log[0] + 1000 - at);\n      throw new OrchestrationError({\n        code: 'EXHAUSTED',\n        message: `model gateway request rate limit exceeded (${limit}/s)`,\n        retryable: true,\n        retryAfterMs,\n      });\n    }\n    log.push(at);\n    requestLog.set(handleId, log);\n  }\n\n  async function verifyRequest(request: ModelGatewayGenerateRequest): Promise<ModelAccessHandleClaims> {\n    const claims = await options.broker.verifyModelAccessHandle(request.accessHandle, {\n      ...(options.audience !== undefined ? { audience: options.audience } : {}),\n      ...(request.workerKey !== undefined ? { workerKey: request.workerKey } : {}),\n    });\n    // PoP: a key-bound handle must be presented with a key; the broker only\n    // compares when both sides exist, so the gateway closes the gap.\n    if (claims.workerKey && !request.workerKey) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'model access handle requires proof-of-possession of the bound worker key',\n        retryable: false,\n      });\n    }\n    if (\n      claims.modelClassRef.apiVersion !== request.modelClassRef.apiVersion ||\n      claims.modelClassRef.kind !== request.modelClassRef.kind ||\n      claims.modelClassRef.name !== request.modelClassRef.name\n    ) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'handle model class identity does not match the gateway request',\n        retryable: false,\n      });\n    }\n    if (claims.modelDigest && request.modelDigest !== claims.modelDigest) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: 'handle requires its bound model digest on the gateway request',\n        retryable: false,\n      });\n    }\n    checkRateLimit(claims.handleId);\n    const concurrent = [...inFlight.values()].filter((entry) => entry.handleId === claims.handleId).length;\n    const maxConcurrent = claims.budget?.maxConcurrent;\n    if (maxConcurrent !== undefined && concurrent >= maxConcurrent) {\n      throw new OrchestrationError({\n        code: 'EXHAUSTED',\n        message: `model gateway concurrency budget exceeded (${maxConcurrent} in-flight)`,\n        retryable: true,\n        retryAfterMs: 100,\n      });\n    }\n    return claims;\n  }\n\n  function buildRecord(\n    request: ModelGatewayGenerateRequest,\n    claims: ModelAccessHandleClaims,\n    status: ModelCallRecordStatus,\n  ): ModelGatewayCallRecord {\n    const runReference: OrchestrationOwnerReference | undefined = claims.runRef\n      ? {\n        apiVersion: claims.runRef.apiVersion,\n        kind: claims.runRef.kind,\n        name: claims.runRef.name,\n        // ModelAccessHandle claims allow an absent uid; the record schema\n        // requires one, so fall back to the empty marker.\n        uid: claims.runRef.uid ?? '',\n      }\n      : undefined;\n    // §12.4: the record carries identity, policy, usage, and latency — never\n    // the handle token, prompts, or model output.\n    return {\n      callId: request.callId,\n      spec: {\n        modelClassRef: claims.modelClassRef,\n        ...((claims.modelDigest ?? request.modelDigest) !== undefined\n          ? { modelDigest: claims.modelDigest ?? request.modelDigest }\n          : {}),\n        ...(runReference ? { runRef: runReference } : {}),\n        ...(claims.attempt !== undefined ? { runAttempt: claims.attempt } : {}),\n        ...(options.caller !== undefined ? { caller: options.caller } : {}),\n        accessHandleRef: claims.handleId,\n        ...(claims.policyDigest !== undefined ? { policyDigest: claims.policyDigest } : {}),\n        ...(request.inputClassification !== undefined ? { inputClassification: request.inputClassification } : {}),\n      },\n      status,\n    };\n  }\n\n  async function record(record: ModelGatewayCallRecord): Promise<void> {\n    try {\n      await options.recorder?.recordCall(record);\n    } catch (error) {\n      onError(error);\n    }\n  }\n\n  async function* generate(request: ModelGatewayGenerateRequest): AsyncIterable<ModelStreamChunk> {\n    const startedAt = now();\n    const claims = await verifyRequest(request);\n    seenHandles.set(claims.handleId, claims.runRef?.name);\n    inFlight.set(request.callId, { handleId: claims.handleId });\n\n    // Clamp the output cap to the handle's remaining output budget so the\n    // executor never produces beyond the budget by construction.\n    const maxOutputTokens = claims.budget?.maxOutputTokens;\n    const effectiveRequest: ModelGenerateRequest = {\n      ...request,\n      ...(maxOutputTokens !== undefined\n        ? { maxOutputTokens: Math.min(request.maxOutputTokens ?? maxOutputTokens, maxOutputTokens) }\n        : {}),\n    };\n\n    let inputTokens = 0;\n    let outputTokens = 0;\n    let phase: ModelCallRecordStatus['phase'] = 'Completed';\n    let failure: OrchestrationErrorData | undefined;\n\n    try {\n      for await (const chunk of options.executor.generate(effectiveRequest)) {\n        if (chunk.type === 'usage') {\n          // Usage chunks are cumulative; take the max to tolerate duplicates.\n          inputTokens = Math.max(inputTokens, chunk.usage?.inputTokens ?? 0);\n          outputTokens = Math.max(outputTokens, chunk.usage?.outputTokens ?? 0);\n          const cost = (inputTokens + outputTokens) * costPerToken;\n          const overInput = claims.budget?.maxInputTokens !== undefined && inputTokens > claims.budget.maxInputTokens;\n          const overOutput = claims.budget?.maxOutputTokens !== undefined && outputTokens > claims.budget.maxOutputTokens;\n          const overCost = claims.budget?.maxCost !== undefined && cost > claims.budget.maxCost;\n          if (overInput || overOutput || overCost) {\n            phase = 'Failed';\n            failure = {\n              code: 'EXHAUSTED',\n              message: 'model access handle budget exceeded at gateway',\n              retryable: false,\n            };\n            await options.executor.cancel?.(request.callId);\n            yield { type: 'error', error: failure };\n            return;\n          }\n          continue;\n        }\n        if (chunk.type === 'error') {\n          phase = chunk.error?.code === 'CANCELLED' ? 'Cancelled' : 'Failed';\n          failure = chunk.error as OrchestrationErrorData;\n        }\n        yield chunk;\n      }\n      if (phase === 'Completed' && request.signal?.aborted) {\n        phase = 'Cancelled';\n      }\n    } catch (error) {\n      phase = 'Failed';\n      failure = error instanceof OrchestrationError\n        ? { code: error.code, message: error.message, retryable: error.retryable }\n        : { code: 'INTERNAL', message: error instanceof Error ? error.message : String(error), retryable: false };\n      throw error;\n    } finally {\n      inFlight.delete(request.callId);\n      const completedAt = now();\n      await record(buildRecord(request, claims, {\n        phase,\n        usage: {\n          inputTokens,\n          outputTokens,\n          cost: (inputTokens + outputTokens) * costPerToken,\n          ...(options.currency !== undefined ? { currency: options.currency } : {}),\n        },\n        latencyMs: completedAt.getTime() - startedAt.getTime(),\n        startedAt: startedAt.toISOString(),\n        completedAt: completedAt.toISOString(),\n        ...(failure ? { error: failure } : {}),\n      }));\n    }\n  }\n\n  return {\n    async listModels() {\n      if (!options.executor.listModels) return [];\n      return options.executor.listModels();\n    },\n    async getHealth() {\n      if (options.executor.getHealth) return options.executor.getHealth();\n      return { healthy: true, detail: 'model gateway', checkedAt: now().toISOString() };\n    },\n    generate,\n    async cancel(callId: string) {\n      await options.executor.cancel?.(callId);\n    },\n    revokeHandle(handleId: string) {\n      options.broker.revokeModelAccessHandle(handleId);\n      for (const [callId, entry] of inFlight) {\n        if (entry.handleId === handleId) void options.executor.cancel?.(callId);\n      }\n    },\n    revokeRunHandles(runName: string) {\n      for (const [handleId, handleRun] of seenHandles) {\n        if (handleRun === runName) {\n          options.broker.revokeModelAccessHandle(handleId);\n          for (const [callId, entry] of inFlight) {\n            if (entry.handleId === handleId) void options.executor.cancel?.(callId);\n          }\n        }\n      }\n    },\n  };\n}\n\n// ─── Loop-side adapter: ILLMProvider over the gateway ─────────────────\n\nimport type { ILLMProvider } from '../../types.js';\nimport type { ModelAccessHandleBudget } from '../security/modelAccessHandle.js';\nimport type { ModelGenerateMessage } from './modelProviderDriver.js';\n\nexport interface GatewayMediatedLLMProviderOptions {\n  gateway: ModelGateway;\n  broker: ModelAccessHandleBroker;\n  /** ModelClass the loops are bound to; handles are issued for this model. */\n  modelClassRef: ModelAccessHandleClaims['modelClassRef'];\n  modelDigest?: string;\n  /** Select a declared ModelClass for a request. Unknown explicit ids must fail closed. */\n  resolveModelForRequest?: (request: unknown) => {\n    modelClassRef: ModelAccessHandleClaims['modelClassRef'];\n    modelDigest?: string;\n  };\n  /** Admission/policy snapshot digest bound into every issued handle. */\n  policyDigest?: string;\n  /** Worker key fingerprint bound into issued handles (PoP). */\n  workerKey?: string;\n  /** Static Run binding, or derive one per chat request (e.g. workload runs). */\n  runRef?: ModelAccessHandleClaims['runRef'];\n  /** Immutable AgentRun attempt bound into issued handles. */\n  attempt?: number;\n  runRefForRequest?: (request: unknown) => ModelAccessHandleClaims['runRef'] | undefined;\n  /** Budget stamped into every issued handle (enforced at the gateway). */\n  budget?: ModelAccessHandleBudget;\n  /** Per-call handle TTL in milliseconds (broker default applies when unset). */\n  handleTtlMs?: number;\n  /** Display name/model for the ILLMProvider surface. */\n  name?: string;\n  modelId?: string;\n  model?: unknown;\n  /** Customize callId derivation (default: conversationId + sequence). */\n  callIdForRequest?: (request: unknown, sequence: number) => string;\n}\n\n/**\n * Route legacy loop model calls through the ModelGateway (plan §12.1, 24.35):\n * loops keep the `ILLMProvider` surface, but every `chat()` issues a\n * short-lived handle, streams through the gateway's verification, budget\n * enforcement, and audit, and revokes the handle when the call ends (§12.1\n * step 6). No provider key exists on this path by construction.\n */\nexport function createGatewayMediatedLLMProvider(options: GatewayMediatedLLMProviderOptions): ILLMProvider {\n  let sequence = 0;\n  return {\n    name: options.name ?? 'model-gateway',\n    modelId: options.modelId ??\n      (typeof options.model === 'string' ? options.model : options.modelClassRef.name),\n    model: options.model,\n    chat(request: unknown) {\n      const record = (request ?? {}) as {\n        conversationId?: unknown;\n        messages?: unknown;\n        max_tokens?: unknown;\n        maxOutputTokens?: unknown;\n        providerOptions?: unknown;\n        abortSignal?: AbortSignal;\n        signal?: AbortSignal;\n        temperature?: unknown;\n        topP?: unknown;\n      };\n      sequence += 1;\n      const conversationId = typeof record.conversationId === 'string' ? record.conversationId : 'anonymous';\n      const callId = options.callIdForRequest?.(request, sequence) ?? `chat-${conversationId}-${sequence}`;\n      const messages = (Array.isArray(record.messages) ? record.messages : []) as ModelGenerateMessage[];\n      const runReference = options.runRefForRequest?.(request) ?? options.runRef;\n\n      return (async function*(): AsyncGenerator<string, void, unknown> {\n        const selectedModel = options.resolveModelForRequest?.(request) ?? {\n          modelClassRef: options.modelClassRef,\n          ...(options.modelDigest !== undefined ? { modelDigest: options.modelDigest } : {}),\n        };\n        const handle = await options.broker.issueModelAccessHandle({\n          modelClassRef: selectedModel.modelClassRef,\n          ...(selectedModel.modelDigest !== undefined ? { modelDigest: selectedModel.modelDigest } : {}),\n          ...(options.policyDigest !== undefined ? { policyDigest: options.policyDigest } : {}),\n          ...(runReference ? { runRef: runReference } : {}),\n          ...(runReference && options.attempt !== undefined\n            ? { attempt: options.attempt }\n            : {}),\n          ...(options.workerKey !== undefined ? { workerKey: options.workerKey } : {}),\n          ...(options.budget !== undefined ? { budget: options.budget } : {}),\n          ...(options.handleTtlMs !== undefined ? { ttlMs: options.handleTtlMs } : {}),\n        });\n        try {\n          for await (\n            const chunk of options.gateway.generate({\n              callId,\n              modelClassRef: selectedModel.modelClassRef,\n              ...(selectedModel.modelDigest !== undefined ? { modelDigest: selectedModel.modelDigest } : {}),\n              messages,\n              ...(typeof record.maxOutputTokens === 'number'\n                ? { maxOutputTokens: record.maxOutputTokens }\n                : typeof record.max_tokens === 'number'\n                ? { maxOutputTokens: record.max_tokens }\n                : {}),\n              ...(typeof record.temperature === 'number' ? { temperature: record.temperature } : {}),\n              ...(typeof record.topP === 'number' ? { topP: record.topP } : {}),\n              ...(record.providerOptions !== null && typeof record.providerOptions === 'object'\n                ? {\n                  providerOptions: record.providerOptions as Record<string, Record<string, unknown>>,\n                }\n                : {}),\n              accessHandle: handle.token,\n              ...(options.workerKey !== undefined ? { workerKey: options.workerKey } : {}),\n              ...(record.abortSignal ?? record.signal\n                ? { signal: record.abortSignal ?? record.signal }\n                : {}),\n            })\n          ) {\n            if (chunk.type === 'delta' && chunk.delta !== undefined) {\n              yield chunk.delta;\n            } else if (chunk.type === 'error') {\n              throw new OrchestrationError(\n                (chunk.error as OrchestrationErrorData | undefined) ?? {\n                  code: 'INTERNAL',\n                  message: 'model gateway call failed',\n                  retryable: false,\n                },\n              );\n            }\n          }\n        } finally {\n          // §12.1 step 6: the handle dies with the call.\n          options.broker.revokeModelAccessHandle(handle.claims.handleId);\n        }\n      })();\n    },\n  };\n}\n","import type { BuiltinToolContext, BuiltinToolImpl } from '../../tools/builtins/types.js';\nimport type { IToolRegistry } from '../../types.js';\nimport type { ControlStoreActor } from '../controlStore.js';\nimport type { ToolOperationApprovalEvidence, ToolOperationResource, ToolOperationResult, ToolOperationStatus } from '../resources.js';\nimport { evaluateToolAdmission, type ToolAdmissionPolicy } from '../security/admission.js';\n\nexport interface ToolExecutionDriver {\n  execute(\n    operation: ToolOperationResource,\n    options?: {\n      signal?: AbortSignal;\n      /** Required by managed routes; ignored by legacy narrow drivers. */\n      actor?: ControlStoreActor;\n      leaseEpoch?: string;\n    },\n  ): Promise<ToolOperationResource>;\n}\n\nexport type ToolOperationApprovalDecision = ToolOperationApprovalEvidence;\n\nexport interface ToolOperationApprovalRequest {\n  operation: ToolOperationResource;\n  /** Trusted policy explanation; never interpreted as authority by itself. */\n  reason?: string;\n  signal?: AbortSignal;\n}\n\n/** Host-owned approval boundary. Implementations bind authenticated users and durable audit. */\nexport interface ToolOperationApprovalBroker {\n  requestApproval(request: ToolOperationApprovalRequest): Promise<ToolOperationApprovalDecision>;\n}\n\nexport interface InProcessToolExecutionDriverOptions {\n  context: BuiltinToolContext;\n  /**\n   * Host-bound trusted admission policy. Enforced before approval checks and\n   * tool lookup; the model, scripts, and agent configuration cannot override\n   * it. Denied operations fail with `FORBIDDEN` and are still audited.\n   */\n  admission?: ToolAdmissionPolicy;\n  approvalBroker?: ToolOperationApprovalBroker;\n  auditor?: (\n    operation: ToolOperationResource,\n    result: ToolOperationResult,\n  ) => Promise<void> | void;\n  maxOutputLength?: number;\n}\n\nfunction isAsyncIterable(value: unknown): value is AsyncIterable<unknown> {\n  return value != null && typeof value === 'object' && Symbol.asyncIterator in value;\n}\n\nfunction normalizeToolResult(value: unknown, maxOutputLength?: number): { text: string; structured?: unknown } {\n  if (typeof value === 'string') {\n    const text = maxOutputLength && value.length > maxOutputLength ? `${value.slice(0, maxOutputLength)}...` : value;\n    return { text };\n  }\n  if (value && typeof value === 'object') {\n    let text = '';\n    if ('summary' in value && typeof value.summary === 'string') {\n      text = value.summary;\n    } else if ('result' in value && typeof value.result === 'string') {\n      text = value.result;\n    } else {\n      text = JSON.stringify(value);\n    }\n    const truncated = maxOutputLength && text.length > maxOutputLength ? `${text.slice(0, maxOutputLength)}...` : text;\n    return { text: truncated, structured: value };\n  }\n  return { text: String(value) };\n}\n\nexport function createInProcessToolExecutionDriver(\n  registry: IToolRegistry,\n  options: InProcessToolExecutionDriverOptions,\n): ToolExecutionDriver {\n  async function execute(\n    operation: ToolOperationResource,\n    executionOptions: {\n      signal?: AbortSignal;\n      actor?: ControlStoreActor;\n      leaseEpoch?: string;\n    } = {},\n  ): Promise<ToolOperationResource> {\n    const startedAt = new Date().toISOString();\n    const toolId = operation.spec.toolRef.name;\n\n    const pendingStatus: ToolOperationStatus = {\n      ...operation.status,\n      phase: 'Running',\n      startedAt,\n      attempts: (operation.status?.attempts ?? 0) + 1,\n    };\n    const runningOperation: ToolOperationResource = { ...operation, status: pendingStatus };\n    let approval: ToolOperationStatus['approval'];\n\n    function operationWithApproval(): ToolOperationResource {\n      if (!approval) return runningOperation;\n      return {\n        ...runningOperation,\n        status: {\n          ...runningOperation.status,\n          approval,\n        },\n      };\n    }\n\n    if (executionOptions.signal?.aborted) {\n      return failed({\n        error: {\n          code: 'CANCELLED',\n          message: 'ToolOperation cancelled before admission',\n          retryable: false,\n        },\n      });\n    }\n\n    async function audit(\n      auditedOperation: ToolOperationResource,\n      result: ToolOperationResult,\n    ): Promise<void> {\n      try {\n        await options.auditor?.(auditedOperation, result);\n      } catch {\n        // Audit sink failure is reported by the host sink and must not replace\n        // the durable ToolOperation result.\n      }\n    }\n\n    async function failed(\n      result: ToolOperationResult,\n    ): Promise<ToolOperationResource> {\n      const auditedOperation = operationWithApproval();\n      await audit(auditedOperation, result);\n      return {\n        ...auditedOperation,\n        status: {\n          ...auditedOperation.status,\n          phase: 'Failed',\n          result,\n          completedAt: new Date().toISOString(),\n        },\n      };\n    }\n\n    let approvalReason: string | undefined;\n    if (options.admission) {\n      const decision = evaluateToolAdmission(options.admission, operation);\n      if (decision.action === 'deny') {\n        return failed({\n          error: {\n            code: 'FORBIDDEN',\n            message: decision.reason ?? `ToolOperation denied by trusted admission policy (${decision.source})`,\n            retryable: false,\n            details: { admissionSource: decision.source },\n          },\n        });\n      }\n      if (decision.action === 'require-approval') {\n        approvalReason = decision.reason ??\n          `ToolOperation requires approval (${decision.source})`;\n      }\n    }\n\n    if (operation.spec.policy?.requireApproval) {\n      approvalReason ??= 'ToolOperation policy requires approval';\n    }\n\n    if (approvalReason) {\n      if (!options.approvalBroker) {\n        return failed({\n          error: {\n            code: 'FORBIDDEN',\n            message: `${approvalReason}; no trusted approval broker is configured`,\n            retryable: false,\n          },\n        });\n      }\n      try {\n        const decision = await options.approvalBroker.requestApproval({\n          operation: runningOperation,\n          reason: approvalReason,\n          signal: executionOptions.signal,\n        });\n        if (\n          !decision.approvalId ||\n          !decision.actor ||\n          !decision.decidedAt ||\n          (decision.decision !== 'allow' && decision.decision !== 'deny') ||\n          Number.isNaN(Date.parse(decision.decidedAt))\n        ) {\n          return await failed({\n            error: {\n              code: 'FORBIDDEN',\n              message: 'Trusted approval broker returned invalid evidence',\n              retryable: false,\n            },\n          });\n        }\n        approval = decision;\n        if (executionOptions.signal?.aborted) {\n          return await failed({\n            error: {\n              code: 'CANCELLED',\n              message: 'ToolOperation approval was cancelled',\n              retryable: false,\n            },\n          });\n        }\n        if (decision.decision !== 'allow') {\n          return await failed({\n            error: {\n              code: 'FORBIDDEN',\n              message: decision.reason ?? 'ToolOperation approval was denied',\n              retryable: false,\n            },\n          });\n        }\n      } catch {\n        return failed({\n          error: {\n            code: executionOptions.signal?.aborted\n              ? 'CANCELLED'\n              : 'FORBIDDEN',\n            message: executionOptions.signal?.aborted\n              ? 'ToolOperation approval was cancelled'\n              : 'Trusted approval broker failed closed',\n            retryable: false,\n          },\n        });\n      }\n    }\n\n    const tool = registry.getTool(toolId);\n    if (typeof tool !== 'function') {\n      return failed({\n        error: { code: 'UNSUPPORTED', message: `Tool \"${toolId}\" is not available as a function executor`, retryable: false },\n      });\n    }\n\n    try {\n      const impl = tool as BuiltinToolImpl;\n      const executionContext: BuiltinToolContext = executionOptions.signal\n        ? { ...options.context, operationSignal: executionOptions.signal }\n        : options.context;\n      const raw = await impl(operation.spec.arguments ?? {}, executionContext);\n      let value: unknown;\n      if (isAsyncIterable(raw)) {\n        const chunks: unknown[] = [];\n        const iterator = raw[Symbol.asyncIterator]();\n        try {\n          while (true) {\n            if (executionOptions.signal?.aborted) {\n              throw new DOMException('ToolOperation cancelled', 'AbortError');\n            }\n            const item = await iterator.next();\n            if (item.done) break;\n            chunks.push(item.value);\n          }\n        } finally {\n          await iterator.return?.();\n        }\n        value = chunks;\n      } else {\n        value = raw;\n      }\n\n      const { text, structured } = normalizeToolResult(value, options.maxOutputLength);\n      const result: ToolOperationResult = { value: structured ?? text };\n      const auditedOperation = operationWithApproval();\n      await audit(auditedOperation, result);\n      return {\n        ...auditedOperation,\n        status: {\n          ...auditedOperation.status,\n          phase: 'Completed',\n          result,\n          completedAt: new Date().toISOString(),\n        },\n      };\n    } catch (error) {\n      const aborted = executionOptions.signal?.aborted;\n      const message = aborted\n        ? 'ToolOperation cancelled'\n        : error instanceof Error\n        ? error.message\n        : String(error);\n      return failed({\n        error: {\n          code: aborted ? 'CANCELLED' : 'INTERNAL',\n          message,\n          retryable: false,\n        },\n      });\n    }\n  }\n\n  return { execute };\n}\n","import type { OrchestrationResource, OrchestrationResourceReference, OrchestrationResourceStatus } from './client.js';\nimport type { ControlStore, ControlStoreActor } from './controlStore.js';\nimport type { ExternalDriverCapabilities, ExternalOrchestrationDriver, ExternalStatusResult, ExternalWorkerBootstrapSecret } from './drivers/externalDriver.js';\nimport { assertExternalToolOperationContract, assertExternalToolOperationResult, type ExternalToolContract } from './drivers/externalToolContract.js';\nimport { resolveExternalWorkloadResources, resolveExternalWorkloadRuntime } from './drivers/externalWorkloadContract.js';\nimport { OrchestrationError } from './errors.js';\nimport {\n  AGENT_RUN_API_VERSION,\n  AGENT_RUN_KIND,\n  AGENT_WORKLOAD_API_VERSION,\n  AGENT_WORKLOAD_KIND,\n  type AgentRunStatus,\n  type AgentWorkloadResource,\n  type AgentWorkloadStatus,\n  createAgentRunManifest,\n  TOOL_OPERATION_API_VERSION,\n  TOOL_OPERATION_KIND,\n  type ToolOperationResource,\n  type ToolOperationStatus,\n} from './resources.js';\nimport { redactSecrets } from './security/secretRedaction.js';\n\nexport interface RegisteredExternalOrchestrationDriver {\n  name: string;\n  driver: ExternalOrchestrationDriver;\n  capabilities: ExternalDriverCapabilities;\n}\n\nexport interface ExternalOrchestrationControllerOptions {\n  actor: ControlStoreActor;\n  drivers: RegisteredExternalOrchestrationDriver[];\n  pollIntervalMs?: number;\n  statusWriteAttempts?: number;\n  sleep?: (ms: number) => Promise<void>;\n  now?: () => Date;\n  /** Resolve admitted script content without persisting it in ControlStore. */\n  resolveScriptSource?: (scriptReference: string) => Promise<string | undefined>;\n  /** Create a short-lived, single-use bootstrap secret at placement time. */\n  createWorkerBootstrap?: (\n    workload: AgentWorkloadResource,\n    runReference: OrchestrationResourceReference,\n  ) => Promise<ExternalWorkerBootstrapSecret | undefined>;\n  /**\n   * Host-bound policy/approval authority for external tool effects. The\n   * controller fails closed when this hook is absent.\n   */\n  authorizeToolOperation?: (\n    operation: ToolOperationResource,\n    signal?: AbortSignal,\n  ) => Promise<{ approval?: NonNullable<ToolOperationStatus['approval']> }>;\n  /**\n   * Host-bound admission for external workload placement. The returned\n   * durable decision identity is persisted before the native side effect.\n   */\n  authorizeWorkloadPlacement?: (\n    workload: AgentWorkloadResource,\n    driver: RegisteredExternalOrchestrationDriver,\n    signal?: AbortSignal,\n  ) => Promise<{ decisionHandle: string; policyDigest: string }>;\n  onError?: (error: unknown) => void;\n}\n\nexport interface ExternalOrchestrationControllerHandle {\n  stop(): Promise<void>;\n}\n\ntype RoutedResource = AgentWorkloadResource | ToolOperationResource;\n\n/**\n * Reconcile explicitly external AgentWorkloads and ToolOperations through\n * registered optional drivers. Placement identity is persisted before status\n * polling, so controller restart adopts the native resource rather than\n * creating a second effect. Driver implementations must make placement\n * idempotent by MemeLoop resource UID.\n */\nexport function createExternalOrchestrationController(\n  store: ControlStore,\n  options: ExternalOrchestrationControllerOptions,\n): ExternalOrchestrationControllerHandle {\n  const drivers = new Map(options.drivers.map((entry) => [entry.name, entry]));\n  const pollIntervalMs = options.pollIntervalMs ?? 1000;\n  const statusWriteAttempts = options.statusWriteAttempts ?? 3;\n  const sleep = options.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n  const now = options.now ?? (() => new Date());\n  const onError = options.onError ?? ((): void => {});\n  const active = new Set<string>();\n  const activeByDriver = new Map<string, number>();\n  const watchAbort = new AbortController();\n  let stopped = false;\n\n  async function acquireDriverSlot(entry: RegisteredExternalOrchestrationDriver): Promise<boolean> {\n    const limit = entry.capabilities.maxConcurrency;\n    while (!stopped) {\n      const current = activeByDriver.get(entry.name) ?? 0;\n      if (limit === undefined || current < limit) {\n        activeByDriver.set(entry.name, current + 1);\n        return true;\n      }\n      await sleep(pollIntervalMs);\n    }\n    return false;\n  }\n\n  function releaseDriverSlot(name: string): void {\n    const current = activeByDriver.get(name) ?? 0;\n    if (current <= 1) activeByDriver.delete(name);\n    else activeByDriver.set(name, current - 1);\n  }\n\n  function referenceOf(resource: RoutedResource): OrchestrationResourceReference {\n    return {\n      apiVersion: resource.apiVersion,\n      kind: resource.kind,\n      name: resource.metadata.name,\n      namespace: resource.metadata.namespace,\n    };\n  }\n\n  function routeOf(resource: RoutedResource): string | undefined {\n    return resource.kind === AGENT_WORKLOAD_KIND\n      ? (resource as AgentWorkloadResource).spec.placement?.orchestrator\n      : (resource as ToolOperationResource).spec.placement?.orchestrator;\n  }\n\n  function runReferenceOf(workload: AgentWorkloadResource): OrchestrationResourceReference {\n    return {\n      apiVersion: AGENT_RUN_API_VERSION,\n      kind: AGENT_RUN_KIND,\n      name: `${workload.metadata.name}-run`,\n      namespace: workload.metadata.namespace,\n    };\n  }\n\n  async function ensureRun(workload: AgentWorkloadResource): Promise<OrchestrationResourceReference> {\n    const reference = runReferenceOf(workload);\n    if (await store.get(reference)) return reference;\n    const manifest = createAgentRunManifest(reference.name!, {\n      workloadRef: {\n        apiVersion: workload.apiVersion,\n        kind: workload.kind,\n        name: workload.metadata.name,\n        namespace: workload.metadata.namespace,\n        uid: workload.metadata.uid,\n      },\n    });\n    manifest.metadata.namespace = workload.metadata.namespace;\n    try {\n      await store.create(options.actor, manifest);\n    } catch (error) {\n      if (!(error instanceof OrchestrationError) || error.code !== 'CONFLICT') throw error;\n    }\n    return reference;\n  }\n\n  async function updateStatus<TStatus extends OrchestrationResourceStatus>(\n    reference: OrchestrationResourceReference,\n    patch: (current: TStatus | undefined) => TStatus,\n  ): Promise<void> {\n    for (let attempt = 0; attempt < statusWriteAttempts; attempt += 1) {\n      const current = await store.get<Record<string, unknown>, TStatus>(reference);\n      if (!current) return;\n      try {\n        await store.updateStatus(options.actor, reference, patch(current.status), {\n          resourceVersion: current.metadata.resourceVersion,\n        });\n        return;\n      } catch (error) {\n        if (error instanceof OrchestrationError && error.code === 'CONFLICT') continue;\n        throw error;\n      }\n    }\n    throw new OrchestrationError({\n      code: 'CONFLICT',\n      message: `external status update for '${reference.name ?? ''}' exceeded ${statusWriteAttempts} CAS attempts`,\n      retryable: true,\n    });\n  }\n\n  function findDriver(resource: RoutedResource): RegisteredExternalOrchestrationDriver {\n    const selected = routeOf(resource);\n    const entry = selected ? drivers.get(selected) : undefined;\n    if (!entry) {\n      throw new OrchestrationError({\n        code: 'NOT_FOUND',\n        message: `external orchestrator '${selected ?? ''}' is not registered`,\n        retryable: false,\n      });\n    }\n    if (!entry.capabilities.manages.includes(resource.kind as 'AgentWorkload' | 'ToolOperation')) {\n      throw new OrchestrationError({\n        code: 'UNSUPPORTED',\n        message: `external orchestrator '${selected}' does not manage ${resource.kind}`,\n        retryable: false,\n      });\n    }\n    if (!entry.capabilities.supportsAdoption) {\n      throw new OrchestrationError({\n        code: 'UNSUPPORTED',\n        message: `external orchestrator '${selected}' cannot safely adopt placement after controller restart`,\n        retryable: false,\n      });\n    }\n    return entry;\n  }\n\n  async function fail(resource: RoutedResource, error: unknown): Promise<void> {\n    const message = redactSecrets(error instanceof Error ? error.message : String(error));\n    if (resource.kind === AGENT_WORKLOAD_KIND) {\n      await updateStatus<AgentRunStatus>(runReferenceOf(resource as AgentWorkloadResource), () => ({\n        phase: 'Failed',\n        summary: message,\n        exitCode: 1,\n      }));\n      await updateStatus<AgentWorkloadStatus>(referenceOf(resource), (current) => ({\n        ...current,\n        phase: 'Failed',\n        lastRunResult: message,\n      }));\n    } else {\n      await updateStatus<ToolOperationStatus>(referenceOf(resource), (current) => ({\n        ...current,\n        phase: 'Failed',\n        result: {\n          error: {\n            code: error instanceof OrchestrationError ? error.code : 'INTERNAL',\n            message,\n            retryable: error instanceof OrchestrationError ? error.retryable : false,\n          },\n        },\n        completedAt: now().toISOString(),\n      }));\n    }\n  }\n\n  async function reflectWorkloadStatus(\n    resource: AgentWorkloadResource,\n    external: ExternalStatusResult,\n  ): Promise<boolean> {\n    const terminal = external.phase === 'Succeeded' || external.phase === 'Failed' || external.phase === 'Cancelled';\n    const missingResult = external.phase === 'Succeeded' && external.runtimeResult === undefined;\n    const resultPhase = missingResult ? 'Failed' : external.runtimeResult?.phase;\n    const succeeded = external.phase === 'Succeeded' && resultPhase === 'Completed';\n    const cancelled = external.phase === 'Cancelled' || resultPhase === 'Cancelled';\n    const message = redactSecrets(\n      external.runtimeResult?.summary ??\n        external.runtimeResult?.error?.message ??\n        (missingResult ? 'external runtime completed without a valid MEMELOOP_RESULT' : external.message),\n    );\n    const runReference = runReferenceOf(resource);\n    await updateStatus<AgentRunStatus>(runReference, () => ({\n      phase: succeeded\n        ? 'Completed'\n        : cancelled\n        ? 'Cancelled'\n        : terminal\n        ? 'Failed'\n        : 'Running',\n      ...(message !== undefined ? { summary: message } : {}),\n      ...(terminal ? { exitCode: succeeded ? 0 : 1 } : {}),\n    }));\n    await updateStatus<AgentWorkloadStatus>(referenceOf(resource), (current) => ({\n      ...current,\n      phase: succeeded\n        ? 'Completed'\n        : terminal\n        ? 'Failed'\n        : external.phase === 'Pending'\n        ? 'Scheduling'\n        : 'Running',\n      ...(message !== undefined ? { lastRunResult: message } : {}),\n    }));\n    return terminal;\n  }\n\n  async function reflectToolStatus(\n    resource: ToolOperationResource,\n    external: ExternalStatusResult,\n    contract: ExternalToolContract,\n  ): Promise<boolean> {\n    const terminal = external.phase === 'Succeeded' || external.phase === 'Failed' || external.phase === 'Cancelled';\n    const missingResult = external.phase === 'Succeeded' && external.runtimeResult === undefined;\n    const resultPhase = missingResult ? 'Failed' : external.runtimeResult?.phase;\n    const succeeded = external.phase === 'Succeeded' && resultPhase === 'Completed';\n    const cancelled = external.phase === 'Cancelled' || resultPhase === 'Cancelled';\n    const externalResult = succeeded && external.runtimeResult?.result\n      ? redactSecrets(external.runtimeResult.result)\n      : undefined;\n    if (succeeded) {\n      assertExternalToolOperationResult(\n        contract,\n        external.runtimeResult?.result?.value,\n      );\n    }\n    const error = external.runtimeResult?.error ?? (missingResult\n      ? { code: 'INVALID', message: 'external runtime completed without a valid MEMELOOP_RESULT', retryable: false }\n      : external.phase === 'Failed'\n      ? { code: 'INTERNAL', message: external.message ?? 'external tool operation failed', retryable: false }\n      : undefined);\n    await updateStatus<ToolOperationStatus>(referenceOf(resource), (current) => ({\n      ...current,\n      phase: succeeded\n        ? 'Completed'\n        : cancelled\n        ? 'Cancelled'\n        : terminal\n        ? 'Failed'\n        : external.phase === 'Pending'\n        ? 'Pending'\n        : 'Running',\n      ...(externalResult ? { result: externalResult } : error ? { result: { error: redactSecrets(error) } } : {}),\n      ...(terminal ? { completedAt: now().toISOString() } : {}),\n    }));\n    return terminal;\n  }\n\n  async function reconcileWorkload(resource: AgentWorkloadResource): Promise<void> {\n    const entry = findDriver(resource);\n    const runtime = resolveExternalWorkloadRuntime(\n      resource,\n      entry.capabilities.workloadRuntimes,\n    );\n    resolveExternalWorkloadResources(resource, runtime);\n    const reference = referenceOf(resource);\n    const runReference = await ensureRun(resource);\n    const latest = await store.get(reference) as unknown as AgentWorkloadResource | null;\n    let externalId = latest?.status?.externalId ?? resource.status?.externalId;\n    if (!externalId) {\n      if (!options.authorizeWorkloadPlacement) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'external AgentWorkload has no host-bound placement authority',\n          retryable: false,\n        });\n      }\n      const authorization = await options.authorizeWorkloadPlacement(resource, entry);\n      const health = await entry.driver.getHealth();\n      if (!health.healthy) {\n        throw new OrchestrationError({ code: 'UNAVAILABLE', message: `external orchestrator '${entry.name}' is unhealthy`, retryable: true });\n      }\n      await updateStatus<AgentWorkloadStatus>(reference, (current) => ({\n        ...current,\n        phase: 'Scheduling',\n        assignedDriver: entry.name,\n        runs: [runReference],\n        placementDecisionRef: authorization.decisionHandle,\n        placementPolicyDigest: authorization.policyDigest,\n      }));\n      let scriptSource: string | undefined;\n      if (resource.spec.scriptReference) {\n        scriptSource = await options.resolveScriptSource?.(resource.spec.scriptReference);\n        if (scriptSource === undefined) {\n          throw new OrchestrationError({\n            code: 'NOT_FOUND',\n            message: `script artifact '${resource.spec.scriptReference}' is unavailable for external placement`,\n            retryable: false,\n          });\n        }\n      }\n      const workerBootstrap = await options.createWorkerBootstrap?.(resource, runReference);\n      const placed = await entry.driver.placeWorkload(resource, options.actor, {\n        ...(scriptSource !== undefined ? { scriptSource } : {}),\n        ...(workerBootstrap !== undefined ? { workerBootstrap } : {}),\n      });\n      externalId = placed.externalId;\n      await updateStatus<AgentWorkloadStatus>(reference, (current) => ({\n        ...current,\n        phase: 'Running',\n        assignedDriver: entry.name,\n        assignedNode: placed.nodeName,\n        externalId: placed.externalId,\n        runs: [runReference],\n        ...(placed.providerMetadata ? { externalMetadata: placed.providerMetadata } : {}),\n      }));\n      await updateStatus<AgentRunStatus>(runReference, () => ({ phase: 'Running' }));\n    }\n    while (!stopped) {\n      const external = await entry.driver.getWorkloadStatus(externalId);\n      if (await reflectWorkloadStatus(resource, external)) return;\n      await sleep(pollIntervalMs);\n    }\n  }\n\n  async function reconcileToolOperation(resource: ToolOperationResource): Promise<void> {\n    const entry = findDriver(resource);\n    const runtimeImage = resource.metadata.annotations?.['memeloop.io/runtime-image'];\n    const contract = assertExternalToolOperationContract(\n      resource,\n      entry.capabilities.toolContracts,\n      runtimeImage,\n    );\n    const reference = referenceOf(resource);\n    const latest = await store.get(reference) as unknown as ToolOperationResource | null;\n    let externalId = latest?.status?.externalId ?? resource.status?.externalId;\n    if (!externalId) {\n      const health = await entry.driver.getHealth();\n      if (!health.healthy) {\n        throw new OrchestrationError({ code: 'UNAVAILABLE', message: `external orchestrator '${entry.name}' is unhealthy`, retryable: true });\n      }\n      await updateStatus<ToolOperationStatus>(reference, (current) => ({\n        ...current,\n        phase: 'Pending',\n        assignedDriver: entry.name,\n      }));\n      if (!options.authorizeToolOperation) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: 'external ToolOperation has no host-bound policy authority',\n          retryable: false,\n        });\n      }\n      const authorization = await options.authorizeToolOperation(resource);\n      if (authorization.approval) {\n        await updateStatus<ToolOperationStatus>(reference, (current) => ({\n          ...current,\n          approval: authorization.approval,\n        }));\n      }\n      const placed = await entry.driver.executeToolOperation(resource, options.actor);\n      externalId = placed.externalId;\n      await updateStatus<ToolOperationStatus>(reference, (current) => ({\n        ...current,\n        phase: 'Running',\n        assignedDriver: entry.name,\n        assignedNode: placed.nodeName,\n        externalId: placed.externalId,\n        startedAt: current?.startedAt ?? now().toISOString(),\n        ...(placed.providerMetadata ? { externalMetadata: placed.providerMetadata } : {}),\n      }));\n    }\n    while (!stopped) {\n      const external = await entry.driver.getToolOperationStatus(externalId);\n      if (await reflectToolStatus(resource, external, contract)) return;\n      await sleep(pollIntervalMs);\n    }\n  }\n\n  function maybeStart(resource: OrchestrationResource): void {\n    const routed = resource as RoutedResource;\n    if (!routeOf(routed)) return;\n    const phase = routed.status?.phase;\n    if (phase === 'Completed' || phase === 'Failed' || phase === 'Cancelled') return;\n    if (active.has(routed.metadata.uid)) return;\n    active.add(routed.metadata.uid);\n    void (async () => {\n      let slot: string | undefined;\n      try {\n        const entry = findDriver(routed);\n        if (!await acquireDriverSlot(entry)) return;\n        slot = entry.name;\n      } catch (error) {\n        onError(error);\n        await fail(routed, error).catch(onError);\n        return;\n      }\n      try {\n        while (!stopped) {\n          try {\n            if (routed.kind === AGENT_WORKLOAD_KIND) {\n              await reconcileWorkload(routed as AgentWorkloadResource);\n            } else {\n              await reconcileToolOperation(routed as ToolOperationResource);\n            }\n            return;\n          } catch (error) {\n            onError(error);\n            if (!(error instanceof OrchestrationError) || !error.retryable) {\n              await fail(routed, error).catch(onError);\n              return;\n            }\n            // Retriable backend/transport failures must not turn a declared\n            // workload into a permanent failure. Placement retries are safe\n            // because external drivers adopt by immutable resource UID.\n            await sleep(pollIntervalMs);\n          }\n        }\n      } finally {\n        if (slot) releaseDriverSlot(slot);\n      }\n    })().finally(() => active.delete(routed.metadata.uid));\n  }\n\n  async function cancelDeleted(resource: RoutedResource): Promise<void> {\n    const driverName = resource.status?.assignedDriver ?? routeOf(resource);\n    const externalId = resource.status?.externalId;\n    if (!driverName || !externalId) return;\n    const entry = drivers.get(driverName);\n    if (!entry) return;\n    if (resource.kind === AGENT_WORKLOAD_KIND) {\n      await entry.driver.stopWorkload(externalId, options.actor);\n    } else {\n      await entry.driver.cancelToolOperation(externalId, options.actor);\n    }\n  }\n\n  async function runKind(apiVersion: string, kind: string): Promise<void> {\n    while (!stopped) {\n      try {\n        // Subscribe before listing. ControlStore implementations buffer watch\n        // events, closing the otherwise dangerous list→watch race where a\n        // resource created between those operations would never reconcile.\n        const iterator = store.watch(\n          { apiVersion, kind },\n          { signal: watchAbort.signal },\n        )[Symbol.asyncIterator]();\n        const existing = await store.list({ apiVersion, kind });\n        for (const resource of existing.items) maybeStart(resource);\n        while (!stopped) {\n          const next = await iterator.next();\n          if (next.done) break;\n          const event = next.value;\n          if (stopped) break;\n          if (event.type === 'DELETED') {\n            await cancelDeleted(event.resource as RoutedResource).catch(onError);\n          } else if (event.type === 'ADDED' || event.type === 'MODIFIED') {\n            maybeStart(event.resource);\n          }\n        }\n      } catch (error) {\n        onError(error);\n      }\n      if (!stopped) await sleep(1000);\n    }\n  }\n\n  const watchers = [\n    runKind(AGENT_WORKLOAD_API_VERSION, AGENT_WORKLOAD_KIND),\n    runKind(TOOL_OPERATION_API_VERSION, TOOL_OPERATION_KIND),\n  ];\n  for (const watcher of watchers) void watcher.catch(onError);\n\n  return {\n    async stop() {\n      stopped = true;\n      watchAbort.abort();\n      // Some third-party ControlStore watches cannot interrupt an already\n      // pending `next()`. Give conforming stores time to observe the signal\n      // without letting runtime shutdown hang forever.\n      await Promise.race([\n        Promise.allSettled(watchers),\n        new Promise<void>((resolve) => setTimeout(resolve, 50)),\n      ]);\n    },\n  };\n}\n","import type { LoopProfile } from '../loopAPI/types.js';\nimport type { AgentFrameworkContext, ILLMProvider } from '../types.js';\n\nimport { OrchestrationError } from './errors.js';\nimport type { AgentRunResource, AgentWorkloadResource, ModelEndpointResource, NetworkAttachmentResource } from './resources.js';\nimport { BUILTIN_RUNTIME_CLASSES, type RuntimeClassSpec } from './scripts/scriptRuntime.js';\n\n/**\n * Loop Runtime Driver (plan §10.2, Phase 4.2).\n *\n * The cognition-plane counterpart of the tool execution driver (24.28): a\n * LoopRuntimeDriver starts an AgentLoopRun-equivalent execution for a bound\n * AgentWorkload and reports a terminal outcome. The in-process\n * implementation runs the loop in the current process through the existing\n * profile/script machinery — the same contracts apply as for remote drivers\n * (no authorization bypass; scripts re-pass the host load gate on import).\n */\n\nexport interface LoopRunStartRequest {\n  /** Bound workload being executed. */\n  workload: AgentWorkloadResource;\n  /** AgentRun resource tracking this attempt. */\n  run: AgentRunResource;\n  /** Fenced ModelEndpoint selected independently for this run. */\n  modelEndpoint?: ModelEndpointResource;\n  /** Independently bound and prepared network attachment for this run. */\n  networkAttachment?: NetworkAttachmentResource;\n  /** Ephemeral host-resolved mounts; never persisted in ControlStore. */\n  volumeMounts?: Array<{\n    name: string;\n    mountPath: string;\n    readOnly: boolean;\n  }>;\n  /**\n   * Script source resolved by the host for `spec.scriptReference` workloads.\n   * The driver re-admits it through the host script load gate before import.\n   */\n  scriptSource?: string;\n  /** Message delivered to the loop as its input. */\n  message?: string;\n}\n\nexport interface LoopRunOutcome {\n  phase: 'Completed' | 'Failed' | 'Cancelled';\n  summary?: string;\n  error?: {\n    code: string;\n    message: string;\n    retryable: boolean;\n  };\n}\n\nexport interface LoopRunHandle {\n  /** Terminal outcome of the run. */\n  wait(): Promise<LoopRunOutcome>;\n  /** Request cancellation; the loop observes it through the cancellation set. */\n  cancel(): Promise<void>;\n}\n\nexport interface LoopRuntimeDriver {\n  start(request: LoopRunStartRequest): Promise<LoopRunHandle>;\n}\n\nexport interface InProcessLoopRuntimeDriverOptions {\n  /**\n   * Resolve a provider for an independently placed endpoint. Downstream hosts\n   * use this port for remote ModelGateway transports. Returning undefined\n   * fails closed.\n   */\n  resolveModelProvider?: (\n    endpoint: ModelEndpointResource,\n    request: LoopRunStartRequest,\n  ) => Promise<ILLMProvider | undefined>;\n}\n\nfunction toErrorData(error: unknown): { code: string; message: string; retryable: boolean } {\n  if (error instanceof OrchestrationError) {\n    return { code: error.code, message: error.message, retryable: error.retryable };\n  }\n  return {\n    code: 'INTERNAL',\n    message: error instanceof Error ? error.message : String(error),\n    retryable: false,\n  };\n}\n\n/** Extract text from a loop step; tolerates raw string yields (AgentAgent runScript passes them through unwrapped). */\nfunction extractMessageText(step: unknown): string {\n  if (typeof step === 'string') return step;\n  if (step && typeof step === 'object') {\n    const record = step as { type?: unknown; data?: unknown };\n    if (record.type === 'message' && typeof record.data === 'string') return record.data;\n  }\n  return '';\n}\n\n/**\n * In-process LoopRuntimeDriver: executes profile workloads through the\n * definition store and script workloads through a synthesized AgentAgent\n * profile whose source was resolved (and admitted) upstream.\n */\nexport function createInProcessLoopRuntimeDriver(\n  context: AgentFrameworkContext,\n  options: InProcessLoopRuntimeDriverOptions = {},\n): LoopRuntimeDriver {\n  return {\n    async start(request) {\n      const { workload, run } = request;\n      const conversationId = `looprun:${run.metadata.namespace ?? 'default'}:${run.metadata.name}`;\n      const message = request.message ?? workload.metadata.name;\n      let executionContext = context;\n\n      if (\n        request.networkAttachment ||\n        workload.spec.networkPolicy?.networkClass ||\n        request.volumeMounts?.length ||\n        workload.spec.storagePolicy?.volumes?.length\n      ) {\n        throw new OrchestrationError({\n          code: 'UNSUPPORTED',\n          message: `in-process workload '${workload.metadata.name}' cannot consume isolated network/volume dependencies`,\n          retryable: false,\n        });\n      }\n\n      if (workload.spec.modelPolicy?.modelClass) {\n        const endpoint = request.modelEndpoint;\n        if (\n          !endpoint ||\n          run.status?.assignedModelEndpoint?.uid !== endpoint.metadata.uid ||\n          endpoint.spec.modelClassRef.name !== workload.spec.modelPolicy.modelClass\n        ) {\n          throw new OrchestrationError({\n            code: 'INVALID',\n            message: `run '${run.metadata.name}' has no valid fenced ModelEndpoint binding`,\n            retryable: false,\n          });\n        }\n        if (options.resolveModelProvider) {\n          const provider = await options.resolveModelProvider(endpoint, request);\n          if (!provider) {\n            throw new OrchestrationError({\n              code: 'UNAVAILABLE',\n              message: `ModelEndpoint '${endpoint.metadata.name}' has no reachable provider transport`,\n              retryable: true,\n            });\n          }\n          executionContext = { ...context, llmProvider: provider };\n        } else if (endpoint.spec.nodeId !== workload.status?.assignedNode) {\n          throw new OrchestrationError({\n            code: 'UNSUPPORTED',\n            message: `remote ModelEndpoint '${endpoint.metadata.name}' requires a host ModelGateway transport`,\n            retryable: false,\n          });\n        }\n      }\n\n      // Lazy import: a top-level value import of runtime.js creates a module\n      // initialization cycle (orchestration/index → loopRuntimeDriver →\n      // runtime → builtinLoopsPlugin → agent-agent-loop → orchestration).\n      const { createAgentLoopRunner, createAgentLoopScriptRunner } = await import('../runtime.js');\n\n      let runner: ((input: { conversationId: string; message: string }) => AsyncIterable<unknown>) | null = null;\n\n      if (workload.spec.scriptReference) {\n        if (!request.scriptSource) {\n          throw new OrchestrationError({\n            code: 'INVALID',\n            message: `workload '${workload.metadata.name}' has scriptReference '${workload.spec.scriptReference}' but no script source was resolved`,\n            retryable: false,\n          });\n        }\n        const profile: LoopProfile = {\n          id: `workload:${workload.metadata.name}`,\n          name: workload.metadata.name,\n          description: 'AgentWorkload script execution',\n          loopId: 'agent-agent-loop',\n          scriptReference: { kind: 'source', source: request.scriptSource },\n        };\n        runner = await createAgentLoopScriptRunner(executionContext, profile, conversationId);\n      } else if (workload.spec.profileId) {\n        runner = await createAgentLoopRunner(executionContext, { definitionId: workload.spec.profileId, conversationId });\n      } else {\n        throw new OrchestrationError({\n          code: 'INVALID',\n          message: `workload '${workload.metadata.name}' has neither scriptReference nor profileId`,\n          retryable: false,\n        });\n      }\n\n      if (!runner) {\n        throw new OrchestrationError({\n          code: 'INVALID',\n          message: `no loop runner for workload '${workload.metadata.name}' (profile '${workload.spec.profileId ?? ''}' not found)`,\n          retryable: false,\n        });\n      }\n\n      const waitPromise = (async (): Promise<LoopRunOutcome> => {\n        try {\n          let summary = '';\n          for await (const step of runner({ conversationId, message })) {\n            summary += extractMessageText(step);\n          }\n          if (executionContext.conversationCancellation?.has(conversationId)) {\n            executionContext.conversationCancellation.delete(conversationId);\n            return { phase: 'Cancelled', summary };\n          }\n          return { phase: 'Completed', summary };\n        } catch (error) {\n          return { phase: 'Failed', error: toErrorData(error) };\n        }\n      })();\n\n      return {\n        wait: () => waitPromise,\n        async cancel() {\n          executionContext.conversationCancellation?.add(conversationId);\n        },\n      };\n    },\n  };\n}\n\n// ─── RuntimeClass routing ─────────────────────────────────────────────\n\nexport interface RuntimeClassRoutingDriverOptions {\n  /**\n   * Driver for profile workloads and for script workloads whose RuntimeClass\n   * declares `isolation: 'none'`.\n   */\n  inProcessDriver: LoopRuntimeDriver;\n  /**\n   * Driver for script workloads whose RuntimeClass declares\n   * `isolation: 'process'` (all built-in classes do). When absent, such\n   * workloads fail closed with UNSUPPORTED rather than silently running\n   * in-process (plan 24.18: declared isolation must be real).\n   */\n  processDriver?: LoopRuntimeDriver;\n  /** RuntimeClass specs by name (defaults to the built-in classes). */\n  runtimeClasses?: Record<string, RuntimeClassSpec>;\n}\n\n/**\n * Route a bound workload to the driver that honors its declared RuntimeClass\n * isolation. Unknown or missing classes fail closed — admission (plan 24.18)\n * assigns a RuntimeClass before scheduling, and there is no silent fallback\n * to a weaker isolation level.\n */\nexport function createRuntimeClassRoutingDriver(options: RuntimeClassRoutingDriverOptions): LoopRuntimeDriver {\n  const runtimeClasses = options.runtimeClasses ?? BUILTIN_RUNTIME_CLASSES;\n\n  function resolveDriver(workload: AgentWorkloadResource): LoopRuntimeDriver {\n    if (!workload.spec.scriptReference) {\n      // Profile workloads run host-trusted definitions in-process.\n      return options.inProcessDriver;\n    }\n    const className = workload.spec.runtimeClass;\n    if (!className) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: `script workload '${workload.metadata.name}' has no runtimeClass; admission (plan 24.18) must assign one before scheduling`,\n        retryable: false,\n      });\n    }\n    const spec = runtimeClasses[className];\n    if (!spec) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: `script workload '${workload.metadata.name}' references unknown RuntimeClass '${className}' — fail-closed, no silent fallback (plan 24.18)`,\n        retryable: false,\n      });\n    }\n    if (spec.isolation === 'none') return options.inProcessDriver;\n    if (spec.isolation === 'process') {\n      if (!options.processDriver) {\n        throw new OrchestrationError({\n          code: 'UNSUPPORTED',\n          message: `RuntimeClass '${className}' declares process isolation but no process LoopRuntimeDriver is configured`,\n          retryable: false,\n        });\n      }\n      return options.processDriver;\n    }\n    throw new OrchestrationError({\n      code: 'UNSUPPORTED',\n      message: `RuntimeClass '${className}' declares '${spec.isolation}' isolation; no LoopRuntimeDriver provides it`,\n      retryable: false,\n    });\n  }\n\n  return {\n    async start(request) {\n      return resolveDriver(request.workload).start(request);\n    },\n  };\n}\n","import type { Controller } from './controllerRunner.js';\nimport type { ControlStoreActor } from './controlStore.js';\nimport type { AgentRunResource, AgentRunStatus, AgentWorkloadResource, DataClassification, ModelClassResource, ModelEndpointResource, NodeTrustClass } from './resources.js';\n\nexport interface ModelEndpointBindingControllerOptions {\n  actor: ControlStoreActor;\n  getWorkload(run: AgentRunResource): Promise<AgentWorkloadResource | null>;\n  listEndpoints(): Promise<ModelEndpointResource[]>;\n  getModelClass(endpoint: ModelEndpointResource): Promise<ModelClassResource | null>;\n  /** Existing bindings used as conservative live capacity reservations. */\n  listRuns?: () => Promise<AgentRunResource[]>;\n  /** Maximum endpoint heartbeat age accepted for placement (default 90s). */\n  endpointHeartbeatTtlMs?: number;\n  /** Clock used only for the persisted binding timestamp. */\n  now?: () => Date;\n}\n\nconst TRUST_RANK: Record<NodeTrustClass, number> = {\n  quarantine: 0,\n  restricted: 1,\n  trusted: 2,\n};\n\nconst CLASSIFICATION_RANK: Record<DataClassification, number> = {\n  public: 0,\n  internal: 1,\n  confidential: 2,\n  restricted: 3,\n};\n\nconst DEFAULT_ENDPOINT_CLASSIFICATION: Record<NodeTrustClass, DataClassification> = {\n  quarantine: 'public',\n  restricted: 'internal',\n  trusted: 'restricted',\n};\n\ninterface Candidate {\n  endpoint: ModelEndpointResource;\n  modelClass: ModelClassResource;\n  score: number;\n}\n\nfunction endpointReference(endpoint: ModelEndpointResource): NonNullable<AgentRunStatus['assignedModelEndpoint']> {\n  return {\n    apiVersion: endpoint.apiVersion,\n    kind: endpoint.kind,\n    name: endpoint.metadata.name,\n    ...(endpoint.metadata.namespace !== undefined ? { namespace: endpoint.metadata.namespace } : {}),\n    uid: endpoint.metadata.uid,\n  };\n}\n\nfunction schedulingCondition(message: string, lastTransitionTime: string) {\n  return {\n    type: 'ModelEndpointScheduled',\n    status: 'False' as const,\n    reason: 'NoEligibleEndpoint',\n    message,\n    lastTransitionTime,\n  };\n}\n\nfunction sameCondition(status: AgentRunStatus, message: string): boolean {\n  const condition = status.conditions?.find((item) => item.type === 'ModelEndpointScheduled');\n  return condition?.status === 'False' &&\n    condition.reason === 'NoEligibleEndpoint' &&\n    condition.message === message;\n}\n\nasync function candidatesFor(\n  workload: AgentWorkloadResource,\n  endpoints: ModelEndpointResource[],\n  getModelClass: ModelEndpointBindingControllerOptions['getModelClass'],\n  nowMs: number,\n  heartbeatTtlMs: number,\n): Promise<Candidate[]> {\n  const requiredClass = workload.spec.modelPolicy?.modelClass;\n  if (!requiredClass) return [];\n  const requiredTrust = workload.spec.trust ?? 'restricted';\n  const requiredClassification = workload.spec.placement?.dataClassification ?? 'internal';\n  const allowedResidencies = workload.spec.placement?.dataResidency;\n  const allowedModelNames = workload.spec.modelPolicy?.allowedModelNames;\n  const candidates: Candidate[] = [];\n\n  for (const endpoint of endpoints) {\n    if (endpoint.spec.modelClassRef.name !== requiredClass) continue;\n    if (endpoint.status?.healthy !== true) continue;\n    const heartbeatAt = Date.parse(endpoint.status.heartbeat ?? '');\n    if (!Number.isFinite(heartbeatAt) || nowMs - heartbeatAt > heartbeatTtlMs) continue;\n    const trust = endpoint.spec.trust ?? 'quarantine';\n    if (TRUST_RANK[trust] < TRUST_RANK[requiredTrust]) continue;\n    const maxConcurrent = endpoint.spec.capacity?.maxConcurrent ?? 0;\n    const spare = maxConcurrent - (endpoint.status.activeCalls ?? 0);\n    if (spare < 1) continue;\n    const endpointClassification = endpoint.spec.dataPolicy?.classification as DataClassification | undefined ??\n      DEFAULT_ENDPOINT_CLASSIFICATION[trust];\n    if (\n      !(endpointClassification in CLASSIFICATION_RANK) ||\n      CLASSIFICATION_RANK[requiredClassification] > CLASSIFICATION_RANK[endpointClassification]\n    ) {\n      continue;\n    }\n\n    const modelClass = await getModelClass(endpoint);\n    if (!modelClass) continue;\n    if (modelClass.spec.digest && endpoint.spec.modelDigest !== modelClass.spec.digest) continue;\n    if (allowedModelNames?.length && !allowedModelNames.includes(modelClass.spec.model)) continue;\n    if (\n      allowedResidencies?.length &&\n      (!modelClass.spec.dataResidency || !allowedResidencies.includes(modelClass.spec.dataResidency))\n    ) {\n      continue;\n    }\n\n    const locality = endpoint.spec.nodeId === workload.status?.assignedNode ? 1000 : 0;\n    candidates.push({ endpoint, modelClass, score: locality + spare });\n  }\n\n  return candidates.sort((left, right) =>\n    right.score - left.score ||\n    left.endpoint.metadata.name.localeCompare(right.endpoint.metadata.name)\n  );\n}\n\n/**\n * Independently binds a Pending AgentRun to a live ModelEndpoint. The\n * controller re-evaluates every hard policy requirement itself and persists\n * the lease epoch before workload execution may consume the endpoint.\n */\nexport function createModelEndpointBindingController(\n  options: ModelEndpointBindingControllerOptions,\n): Controller<AgentRunResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  const endpointHeartbeatTtlMs = options.endpointHeartbeatTtlMs ?? 90_000;\n  return {\n    async reconcile(request) {\n      const run = request.resource as AgentRunResource;\n      const status = run.status ?? {};\n      const reconciledAtDate = now();\n      const reconciledAt = reconciledAtDate.toISOString();\n      if (status.phase && status.phase !== 'Pending') return { ready: true };\n\n      const workload = await options.getWorkload(run);\n      if (!workload) {\n        const message = 'referenced AgentWorkload is unavailable';\n        return {\n          ...(sameCondition(status, message)\n            ? {}\n            : {\n              status: {\n                ...status,\n                conditions: [\n                  ...(status.conditions ?? []).filter((item) => item.type !== 'ModelEndpointScheduled'),\n                  schedulingCondition(message, reconciledAt),\n                ],\n              } satisfies AgentRunStatus,\n            }),\n          requeueAfterMs: 1000,\n        };\n      }\n      if (!workload.spec.modelPolicy?.modelClass) return { ready: true };\n\n      const reservations = new Map<string, number>();\n      for (const other of await options.listRuns?.() ?? []) {\n        if (other.metadata.uid === run.metadata.uid) continue;\n        if (\n          other.status?.phase === 'Completed' ||\n          other.status?.phase === 'Failed' ||\n          other.status?.phase === 'Cancelled'\n        ) continue;\n        const endpointUid = other.status?.assignedModelEndpoint?.uid;\n        if (endpointUid) reservations.set(endpointUid, (reservations.get(endpointUid) ?? 0) + 1);\n      }\n      const endpoints = (await options.listEndpoints()).map((endpoint) => ({\n        ...endpoint,\n        status: {\n          ...endpoint.status,\n          activeCalls: (endpoint.status?.activeCalls ?? 0) +\n            (reservations.get(endpoint.metadata.uid) ?? 0),\n        },\n      }));\n      const candidates = await candidatesFor(\n        workload,\n        endpoints,\n        (endpoint) => options.getModelClass(endpoint),\n        reconciledAtDate.getTime(),\n        endpointHeartbeatTtlMs,\n      );\n      const selected = candidates[0]?.endpoint;\n      if (!selected) {\n        const message = `no healthy endpoint satisfies model class '${workload.spec.modelPolicy.modelClass}'`;\n        const {\n          assignedModelEndpoint: _assignedModelEndpoint,\n          modelBinding: _modelBinding,\n          ...unboundStatus\n        } = status;\n        return {\n          ...(sameCondition(status, message) && !status.assignedModelEndpoint\n            ? {}\n            : {\n              status: {\n                ...unboundStatus,\n                phase: 'Pending',\n                conditions: [\n                  ...(status.conditions ?? []).filter((item) => item.type !== 'ModelEndpointScheduled'),\n                  schedulingCondition(message, reconciledAt),\n                ],\n              } satisfies AgentRunStatus,\n            }),\n          requeueAfterMs: 1000,\n        };\n      }\n\n      if (\n        status.assignedModelEndpoint?.uid === selected.metadata.uid &&\n        status.modelBinding?.endpointResourceVersion === selected.metadata.resourceVersion &&\n        status.modelBinding.leaseEpoch === request.leaseEpoch\n      ) {\n        return { ready: true };\n      }\n      return {\n        status: {\n          ...status,\n          phase: 'Pending',\n          assignedModelEndpoint: endpointReference(selected),\n          modelBinding: {\n            leaseEpoch: request.leaseEpoch,\n            endpointResourceVersion: selected.metadata.resourceVersion,\n            boundAt: reconciledAt,\n          },\n          conditions: [\n            ...(status.conditions ?? []).filter((item) => item.type !== 'ModelEndpointScheduled'),\n            {\n              type: 'ModelEndpointScheduled',\n              status: 'True',\n              reason: 'EndpointSelected',\n              message: `bound to ModelEndpoint '${selected.metadata.name}'`,\n              lastTransitionTime: reconciledAt,\n            },\n          ],\n        } satisfies AgentRunStatus,\n        ready: true,\n      };\n    },\n  };\n}\n","import type { Controller } from './controllerRunner.js';\nimport type { DriverRequestEnvelope } from './drivers/driverRequest.js';\nimport type { NetworkDriver, NetworkDriverCapabilities } from './drivers/networkDriver.js';\nimport { canDriverSatisfyClass } from './drivers/networkDriver.js';\nimport type { NetworkManagementDriver, NetworkPreparePayload } from './drivers/networkManagement.js';\nimport type { AgentWorkloadResource, NetworkAttachmentResource, NetworkClassResource } from './resources.js';\n\nexport interface NetworkAttachmentNode {\n  nodeId: string;\n  healthy: boolean;\n  capabilities: NetworkDriverCapabilities[];\n  /** Conservative number of attachments not yet reflected by the driver. */\n  activeAttachments?: number;\n  maxAttachments?: number;\n}\n\nexport interface NetworkAttachmentBindingControllerOptions {\n  getNetworkClass(attachment: NetworkAttachmentResource): Promise<NetworkClassResource | null>;\n  getWorkload?(attachment: NetworkAttachmentResource): Promise<AgentWorkloadResource | null>;\n  listNodes(): Promise<NetworkAttachmentNode[]>;\n  now?: () => Date;\n}\n\nfunction falseCondition(message: string, time: string) {\n  return {\n    type: 'NetworkScheduled',\n    status: 'False' as const,\n    reason: 'NoEligibleNetworkDriver',\n    message,\n    lastTransitionTime: time,\n  };\n}\n\n/**\n * Selects the node-local NetworkDriver independently from workload execution.\n * NetworkClass capability checks are hard filters; best-effort degradation is\n * allowed only when the class itself explicitly opts into it.\n */\nexport function createNetworkAttachmentBindingController(\n  options: NetworkAttachmentBindingControllerOptions,\n): Controller<NetworkAttachmentResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const attachment = request.resource as NetworkAttachmentResource;\n      const status = attachment.status ?? {};\n      if (status.phase && status.phase !== 'Pending') return { ready: true };\n      const reconciledAt = now().toISOString();\n      const networkClass = await options.getNetworkClass(attachment);\n      if (!networkClass) {\n        return {\n          status: {\n            ...status,\n            phase: 'Pending',\n            conditions: [falseCondition('referenced NetworkClass is unavailable', reconciledAt)],\n          },\n          requeueAfterMs: 1000,\n        };\n      }\n\n      const workload = await options.getWorkload?.(attachment);\n      const requiredNode = attachment.spec.nodeId ?? workload?.status?.assignedNode;\n      const candidates = (await options.listNodes()).flatMap((node) => {\n        if (!node.healthy || (requiredNode && node.nodeId !== requiredNode)) return [];\n        if (\n          node.maxAttachments !== undefined &&\n          (node.activeAttachments ?? 0) >= node.maxAttachments\n        ) return [];\n        const capability = node.capabilities.find(\n          (candidate) => candidate.name === networkClass.spec.driver,\n        );\n        if (!capability || !canDriverSatisfyClass(capability, networkClass).satisfied) return [];\n        return [{ node, capability }];\n      }).sort((left, right) =>\n        (left.node.activeAttachments ?? 0) - (right.node.activeAttachments ?? 0) ||\n        left.node.nodeId.localeCompare(right.node.nodeId)\n      );\n\n      const selected = candidates[0];\n      if (!selected) {\n        const message = `no healthy driver satisfies NetworkClass '${networkClass.metadata.name}'`;\n        const { assignedNode: _node, assignedDriver: _driver, binding: _binding, ...unbound } = status;\n        return {\n          status: {\n            ...unbound,\n            phase: 'Pending',\n            conditions: [falseCondition(message, reconciledAt)],\n          },\n          requeueAfterMs: 1000,\n        };\n      }\n      if (\n        status.assignedNode === selected.node.nodeId &&\n        status.assignedDriver === selected.capability.name &&\n        status.binding?.leaseEpoch === request.leaseEpoch &&\n        status.binding.networkClassResourceVersion === networkClass.metadata.resourceVersion\n      ) {\n        return { ready: true };\n      }\n      return {\n        status: {\n          ...status,\n          phase: 'Pending',\n          assignedNode: selected.node.nodeId,\n          assignedDriver: selected.capability.name,\n          binding: {\n            leaseEpoch: request.leaseEpoch,\n            networkClassResourceVersion: networkClass.metadata.resourceVersion,\n            boundAt: reconciledAt,\n          },\n          conditions: [{\n            type: 'NetworkScheduled',\n            status: 'True',\n            reason: 'DriverSelected',\n            message: `bound to driver '${selected.capability.name}' on node '${selected.node.nodeId}'`,\n            lastTransitionTime: reconciledAt,\n          }],\n        },\n        ready: true,\n      };\n    },\n  };\n}\n\nexport interface NetworkAttachmentExecutionControllerOptions {\n  nodeId: string;\n  getNetworkClass(attachment: NetworkAttachmentResource): Promise<NetworkClassResource | null>;\n  getDriver(name: string): Promise<NetworkDriver | undefined>;\n  sandboxRef?(attachment: NetworkAttachmentResource): Promise<string>;\n  managed?: {\n    getDriver(name: string): Promise<NetworkManagementDriver | undefined>;\n    createPrepareRequest(input: {\n      attachment: NetworkAttachmentResource;\n      networkClass: NetworkClassResource;\n      sandboxHandle: string;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<NetworkPreparePayload>>;\n    createReleaseRequest(input: {\n      attachment: NetworkAttachmentResource;\n      networkHandle: string;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<{ networkHandle: string }>>;\n  };\n  now?: () => Date;\n}\n\n/**\n * Executes a bound attachment on its selected node. prepare() implementations\n * must be idempotent for an attachment UID. The persisted Preparing claim\n * prevents a new controller epoch from repeating a possibly completed effect.\n */\nexport function createNetworkAttachmentExecutionController(\n  options: NetworkAttachmentExecutionControllerOptions,\n): Controller<NetworkAttachmentResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const attachment = request.resource as NetworkAttachmentResource;\n      const status = attachment.status ?? {};\n      if (status.assignedNode !== options.nodeId || !status.assignedDriver || !status.binding) {\n        return { ready: true };\n      }\n      if (status.phase === 'Failed' || status.phase === 'Detached') {\n        return { ready: true };\n      }\n      if (status.phase === 'Attached' && !status.releaseRequestedAt) return { ready: true };\n      const driver = await options.getDriver(status.assignedDriver);\n      if (!driver) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNAVAILABLE',\n              message: `bound network driver '${status.assignedDriver}' is unavailable`,\n              retryable: true,\n            },\n          },\n          ready: true,\n        };\n      }\n      if (status.phase === 'Attached' && status.releaseRequestedAt) {\n        if (!status.handle) {\n          return {\n            status: {\n              ...status,\n              phase: 'Failed',\n              error: {\n                code: 'INVALID',\n                message: 'attached network resource has no driver handle to release',\n                retryable: false,\n              },\n            },\n            ready: true,\n          };\n        }\n        if (options.managed) {\n          const managedDriver = await options.managed.getDriver(status.assignedDriver);\n          if (!managedDriver) {\n            return {\n              status: {\n                ...status,\n                phase: 'Failed',\n                error: {\n                  code: 'UNAVAILABLE',\n                  message: `bound managed network driver '${status.assignedDriver}' is unavailable`,\n                  retryable: true,\n                },\n              },\n              ready: true,\n            };\n          }\n          await managedDriver.releaseNetwork(\n            await options.managed.createReleaseRequest({\n              attachment,\n              networkHandle: status.handle,\n              actor: request.actor,\n              leaseEpoch: request.leaseEpoch,\n            }),\n          );\n        } else {\n          await driver.release(status.handle);\n        }\n        return {\n          status: {\n            ...status,\n            phase: 'Detached',\n            detachedAt: now().toISOString(),\n          },\n          ready: true,\n        };\n      }\n      const networkClass = await options.getNetworkClass(attachment);\n      if (\n        !networkClass ||\n        networkClass.metadata.resourceVersion !== status.binding.networkClassResourceVersion\n      ) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'CONFLICT',\n              message: 'NetworkClass changed after attachment binding; a fresh attachment is required',\n              retryable: false,\n            },\n          },\n          ready: true,\n        };\n      }\n      const capabilities = await driver.getCapabilities();\n      const health = await driver.getHealth();\n      const satisfaction = canDriverSatisfyClass(capabilities, networkClass);\n      if (\n        !health.healthy ||\n        capabilities.name !== status.assignedDriver ||\n        !satisfaction.satisfied\n      ) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNAVAILABLE',\n              message: satisfaction.reason ?? health.detail ?? 'network driver is unhealthy',\n              retryable: true,\n            },\n          },\n          ready: true,\n        };\n      }\n\n      const claimedAt = now().toISOString();\n      if (status.phase !== 'Preparing') {\n        return {\n          status: {\n            ...status,\n            phase: 'Preparing',\n            executionClaim: { leaseEpoch: request.leaseEpoch, claimedAt },\n          },\n          requeueAfterMs: 1,\n        };\n      }\n      if (status.executionClaim?.leaseEpoch !== request.leaseEpoch) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNKNOWN_EFFECT',\n              message: 'controller epoch changed after network prepare was claimed; refusing duplicate attachment',\n              retryable: false,\n            },\n          },\n          ready: true,\n        };\n      }\n\n      const sandboxHandle = await options.sandboxRef?.(attachment) ??\n        `workload:${attachment.spec.workloadRef?.uid ?? attachment.metadata.uid}`;\n      const managed = options.managed;\n      const prepared = managed\n        ? await (async () => {\n          const managedDriver = await managed.getDriver(status.assignedDriver as string);\n          if (!managedDriver) {\n            return {\n              phase: 'Failed' as const,\n              error: {\n                code: 'UNAVAILABLE' as const,\n                message: `bound managed network driver '${status.assignedDriver}' is unavailable`,\n                retryable: true,\n              },\n            };\n          }\n          const managedStatus = await managedDriver.prepareNetwork(\n            await managed.createPrepareRequest({\n              attachment,\n              networkClass,\n              sandboxHandle,\n              actor: request.actor,\n              leaseEpoch: request.leaseEpoch,\n            }),\n          );\n          return {\n            phase: 'Attached' as const,\n            handle: managedStatus.networkHandle,\n            ...(managedStatus.degradedFeatures.length > 0\n              ? { degraded: managedStatus.degradedFeatures }\n              : {}),\n            attachedAt: managedStatus.updatedAt,\n          };\n        })()\n        : await driver.prepare({\n          attachment,\n          networkClass,\n          sandboxRef: sandboxHandle,\n        });\n      return {\n        status: {\n          ...status,\n          ...prepared,\n          assignedNode: status.assignedNode,\n          assignedDriver: status.assignedDriver,\n          binding: status.binding,\n          executionClaim: status.executionClaim,\n        },\n        ready: prepared.phase === 'Attached' || prepared.phase === 'Failed',\n        ...(prepared.phase === 'Pending' ? { requeueAfterMs: 1000 } : {}),\n      };\n    },\n  };\n}\n","import type { Controller } from './controllerRunner.js';\nimport type { DriverRequestEnvelope } from './drivers/driverRequest.js';\nimport type { StorageDriver } from './drivers/storageDriver.js';\nimport type { StorageManagementDriver } from './drivers/storageManagement.js';\nimport { OrchestrationError } from './errors.js';\nimport type { AgentRunResource, AgentRunStatus, AgentVolumeClaimResource, AgentVolumeResource, AgentWorkloadResource } from './resources.js';\n\nexport interface RunVolumeControllerOptions {\n  nodeId: string;\n  getWorkload(run: AgentRunResource): Promise<AgentWorkloadResource | null>;\n  getClaim(name: string, namespace?: string): Promise<AgentVolumeClaimResource | null>;\n  getVolume(claim: AgentVolumeClaimResource): Promise<AgentVolumeResource | null>;\n  getDriver(name: string): Promise<StorageDriver | undefined>;\n  managed?: {\n    getDriver(name: string): Promise<StorageManagementDriver | undefined>;\n    createStageRequest(input: {\n      run: AgentRunResource;\n      volume: AgentVolumeResource;\n      nodeId: string;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<{ volumeHandle: string; nodeId: string }>>;\n    createPublishRequest(input: {\n      run: AgentRunResource;\n      stageHandle: string;\n      workloadUid: string;\n      readOnly: boolean;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<\n      DriverRequestEnvelope<{\n        stageHandle: string;\n        workloadUid: string;\n        readOnly: boolean;\n      }>\n    >;\n    createUnpublishRequest(input: {\n      run: AgentRunResource;\n      publishHandle: string;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<{ publishHandle: string }>>;\n    createUnstageRequest(input: {\n      run: AgentRunResource;\n      stageHandle: string;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<{ stageHandle: string }>>;\n  };\n  recordPublished?(\n    volume: AgentVolumeResource,\n    workload: AgentWorkloadResource,\n    nodeId: string,\n  ): Promise<void>;\n  recordUnpublished?(\n    volume: AgentVolumeResource,\n    workload: AgentWorkloadResource,\n    nodeId: string,\n  ): Promise<void>;\n  now?: () => Date;\n}\n\n/** Publishes independently provisioned claims to a bound Run's workload node. */\nexport function createRunVolumeController(\n  options: RunVolumeControllerOptions,\n): Controller<AgentRunResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const run = request.resource as AgentRunResource;\n      const status = run.status ?? {};\n      const workload = await options.getWorkload(run);\n      if (!workload || workload.status?.assignedNode !== options.nodeId) return { ready: true };\n      const requested = workload.spec.storagePolicy?.volumes ?? [];\n      if (requested.length === 0) return { ready: true };\n\n      if (\n        (status.volumePhase === 'Ready' || status.volumePhase === 'Publishing') &&\n        status.volumeReleaseRequestedAt\n      ) {\n        return {\n          status: { ...status, volumePhase: 'Releasing' } satisfies AgentRunStatus,\n          requeueAfterMs: 1,\n        };\n      }\n      if (status.volumePhase === 'Releasing') {\n        for (const binding of status.volumeBindings ?? []) {\n          const managedDriver = options.managed\n            ? await options.managed.getDriver(binding.assignedDriver)\n            : undefined;\n          if (managedDriver && options.managed && binding.stageHandle) {\n            await managedDriver.unpublish(\n              await options.managed.createUnpublishRequest({\n                run,\n                publishHandle: binding.publishHandle,\n                actor: request.actor,\n                leaseEpoch: request.leaseEpoch,\n              }),\n            );\n            await managedDriver.unstage(\n              await options.managed.createUnstageRequest({\n                run,\n                stageHandle: binding.stageHandle,\n                actor: request.actor,\n                leaseEpoch: request.leaseEpoch,\n              }),\n            );\n          } else {\n            const driver = await options.getDriver(binding.assignedDriver);\n            if (!driver) {\n              throw new OrchestrationError({\n                code: 'UNAVAILABLE',\n                message: `storage driver '${binding.assignedDriver}' unavailable during unpublish`,\n                retryable: true,\n              });\n            }\n            await driver.unpublish(binding.publishHandle);\n          }\n          const claim = await options.getClaim(binding.claimRef.name, run.metadata.namespace);\n          const volume = claim ? await options.getVolume(claim) : null;\n          if (volume) await options.recordUnpublished?.(volume, workload, options.nodeId);\n        }\n        return {\n          status: { ...status, volumePhase: 'Released' } satisfies AgentRunStatus,\n          ready: true,\n        };\n      }\n      if (\n        status.volumePhase === 'Ready' ||\n        status.volumePhase === 'Released' ||\n        status.volumePhase === 'Failed'\n      ) return { ready: true };\n\n      const resolved: Array<{\n        name: string;\n        claim: AgentVolumeClaimResource;\n        volume: AgentVolumeResource;\n        driver: StorageDriver;\n        readOnly: boolean;\n      }> = [];\n      for (const request_ of requested) {\n        const claim = await options.getClaim(request_.claimRef, run.metadata.namespace);\n        if (!claim) return { requeueAfterMs: 1000 };\n        if (claim.status?.phase === 'Failed' || claim.status?.phase === 'Lost') {\n          return {\n            status: {\n              ...status,\n              volumePhase: 'Failed',\n              volumeError: {\n                code: 'UNAVAILABLE',\n                message: `volume claim '${request_.claimRef}' is ${claim.status.phase}`,\n                retryable: false,\n              },\n            } satisfies AgentRunStatus,\n            ready: true,\n          };\n        }\n        if (\n          claim.status?.phase !== 'Bound' ||\n          claim.status.assignedNode !== options.nodeId ||\n          !claim.status.assignedDriver\n        ) return { requeueAfterMs: 1000 };\n        const volume = await options.getVolume(claim);\n        if (!volume || volume.metadata.uid !== claim.status.volumeRef?.uid) {\n          return { requeueAfterMs: 1000 };\n        }\n        const driver = await options.getDriver(claim.status.assignedDriver);\n        if (!driver) return { requeueAfterMs: 1000 };\n        resolved.push({\n          name: request_.name,\n          claim,\n          volume,\n          driver,\n          readOnly: claim.spec.accessMode === 'ReadOnlyMany',\n        });\n      }\n\n      if (status.volumePhase !== 'Publishing') {\n        return {\n          status: {\n            ...status,\n            volumePhase: 'Publishing',\n            volumePublishClaim: {\n              leaseEpoch: request.leaseEpoch,\n              claimedAt: now().toISOString(),\n            },\n          } satisfies AgentRunStatus,\n          requeueAfterMs: 1,\n        };\n      }\n      if (status.volumePublishClaim?.leaseEpoch !== request.leaseEpoch) {\n        return {\n          status: {\n            ...status,\n            volumePhase: 'Failed',\n            volumeError: {\n              code: 'UNKNOWN_EFFECT',\n              message: 'controller epoch changed after volume publication was claimed',\n              retryable: false,\n            },\n          } satisfies AgentRunStatus,\n          ready: true,\n        };\n      }\n\n      const bindings = [...(status.volumeBindings ?? [])];\n      const next = resolved.find((item) => !bindings.some((binding) => binding.name === item.name));\n      if (next) {\n        const managedDriver = options.managed\n          ? await options.managed.getDriver(next.claim.status!.assignedDriver!)\n          : undefined;\n        const stage = managedDriver && options.managed\n          ? await managedDriver.stage(\n            await options.managed.createStageRequest({\n              run,\n              volume: next.volume,\n              nodeId: options.nodeId,\n              actor: request.actor,\n              leaseEpoch: request.leaseEpoch,\n            }),\n          )\n          : undefined;\n        const managedPublication = managedDriver && options.managed && stage\n          ? await managedDriver.publish(\n            await options.managed.createPublishRequest({\n              run,\n              stageHandle: stage.stageHandle,\n              workloadUid: workload.metadata.uid,\n              readOnly: next.readOnly,\n              actor: request.actor,\n              leaseEpoch: request.leaseEpoch,\n            }),\n          )\n          : undefined;\n        const published = managedPublication ?? await next.driver.publish({\n          volume: next.volume,\n          nodeId: options.nodeId,\n          workloadUid: workload.metadata.uid,\n          readOnly: next.readOnly,\n        });\n        await options.recordPublished?.(next.volume, workload, options.nodeId);\n        bindings.push({\n          name: next.name,\n          claimRef: { name: next.claim.metadata.name, uid: next.claim.metadata.uid },\n          volumeRef: { name: next.volume.metadata.name, uid: next.volume.metadata.uid },\n          assignedDriver: next.claim.status!.assignedDriver!,\n          assignedNode: options.nodeId,\n          ...(stage ? { stageHandle: stage.stageHandle } : {}),\n          publishHandle: published.publishHandle,\n          readOnly: next.readOnly,\n        });\n        return {\n          status: {\n            ...status,\n            volumePhase: 'Publishing',\n            volumeBindings: bindings,\n          } satisfies AgentRunStatus,\n          requeueAfterMs: 1,\n        };\n      }\n      return {\n        status: {\n          ...status,\n          volumePhase: 'Ready',\n          volumeBindings: bindings,\n        } satisfies AgentRunStatus,\n        ready: true,\n      };\n    },\n  };\n}\n","import type { Controller, ControllerReconcileResult } from './controllerRunner.js';\nimport type { ControlStore, ControlStoreActor } from './controlStore.js';\nimport type { AgentWorkloadResource, AgentWorkloadStatus, DataClassification, NodeTrustClass } from './resources.js';\n\nexport interface SchedulerNode {\n  name: string;\n  trustClass: NodeTrustClass;\n  faultDomain: string;\n  /** Explicit false removes the node from scheduling immediately. */\n  healthy?: boolean;\n  /** When reported, the node must include `worker` to accept workloads. */\n  roles?: string[];\n  /** Trusted verifier assessment, never a worker self-report. */\n  attested?: boolean;\n  /** Host registry confirms every selected driver has passing conformance evidence. */\n  driverConformancePassed?: boolean;\n  capacity?: {\n    cpuMillicores?: number;\n    memoryBytes?: number;\n    gpuCount?: number;\n    diskBytes?: number;\n    bandwidthKbps?: number;\n  };\n  labels?: Record<string, string>;\n  /** Taints that repel workloads unless they explicitly tolerate them. */\n  taints?: string[];\n  /**\n   * Maximum data classification this node is allowed to process.\n   * Defaults to 'restricted' for trusted, 'internal' for restricted, 'public' for quarantine.\n   */\n  maxDataClassification?: DataClassification;\n  /** Residency labels in which this node may process data. */\n  dataResidency?: string[];\n  /** Runtime classes backed by an admitted runtime driver on this node. */\n  availableRuntimeClasses?: string[];\n  /** Healthy tool executor classes available on this node. */\n  availableToolClasses?: string[];\n  /** Available model endpoints on this node (by model class name). */\n  availableModelClasses?: string[];\n  /** Network classes and the boundary/egress modes they can enforce. */\n  networkCapabilities?: Array<{\n    networkClass: string;\n    enforcementLevel: 'none' | 'process' | 'namespace' | 'host' | 'external';\n    egress?: Array<'none' | 'same-node' | 'restricted' | 'open'>;\n  }>;\n  /** Storage classes provisionable or publishable on this node. */\n  availableStorageClasses?: string[];\n  /** Existing claims local/publishable to this node. */\n  availableVolumeClaims?: string[];\n  /** Credential broker capabilities; these are policy metadata, never handles. */\n  credentialCapabilities?: Array<{\n    brokerClass: string;\n    audiences?: string[];\n    targets?: string[];\n  }>;\n  /** Content-addressed data already present on this node, used only for scoring. */\n  localArtifactReferences?: string[];\n  localCheckpointReferences?: string[];\n  /** Active target count for each rollout batch on this fault domain. */\n  rolloutLoad?: Record<string, number>;\n  /** Spare concurrency slots. */\n  spareConcurrency?: number;\n}\n\nexport interface SchedulingDecision {\n  nodeName: string;\n  score: number;\n  reasons: string[];\n}\n\nexport interface Scheduler {\n  schedule(\n    workload: AgentWorkloadResource,\n    nodes: SchedulerNode[],\n  ): SchedulingDecision | null;\n}\n\nexport interface BindingControllerOptions {\n  actor: ControlStoreActor;\n  scheduler: Scheduler;\n  listNodes: () => Promise<SchedulerNode[]>;\n  authorizePlacement?(input: {\n    workload: AgentWorkloadResource;\n    node: SchedulerNode;\n    actor: ControlStoreActor;\n    leaseEpoch: string;\n  }): Promise<{\n    outcome: 'allow' | 'deny';\n    decisionHandle: string;\n    policyDigest: string;\n    reasons: string[];\n  }>;\n}\n\n/** Trust rank: higher = more trusted. */\nconst TRUST_RANK: Record<NodeTrustClass, number> = {\n  quarantine: 0,\n  restricted: 1,\n  trusted: 2,\n};\n\n/** Data classification rank: higher = more sensitive. */\nconst CLASSIFICATION_RANK: Record<DataClassification, number> = {\n  public: 0,\n  internal: 1,\n  confidential: 2,\n  restricted: 3,\n};\n\nconst DEFAULT_MAX_CLASSIFICATION: Record<NodeTrustClass, DataClassification> = {\n  trusted: 'restricted',\n  restricted: 'internal',\n  quarantine: 'public',\n};\n\nconst NETWORK_ENFORCEMENT_RANK = {\n  none: 0,\n  process: 1,\n  namespace: 2,\n  host: 3,\n  external: 4,\n} as const;\n\n/**\n * Determine the minimum node trust class required for a workload.\n *\n * Per §7.2 and §23, restricted nodes are the preferred fleet-worker class.\n * Quarantine workloads (trust='quarantine') must only run on quarantine nodes.\n * Workloads with no trust specified default to 'restricted' (allowed on\n * restricted or trusted nodes).\n */\nfunction resolveMinTrustClass(workload: AgentWorkloadResource): NodeTrustClass {\n  return workload.spec.trust ?? 'restricted';\n}\n\ninterface NodeEligibility {\n  eligible: boolean;\n  reasons: string[];\n  rejection?: string;\n}\n\nfunction reject(rejection: string): NodeEligibility {\n  return { eligible: false, reasons: [], rejection };\n}\n\n/**\n * Evaluate every hard placement requirement in one place. The binding\n * controller calls this again after a Scheduler decision, so a custom\n * scheduler cannot bypass security/capability admission.\n */\nfunction evaluateNodeEligibility(\n  workload: AgentWorkloadResource,\n  node: SchedulerNode,\n): NodeEligibility {\n  const placement = workload.spec.placement ?? {};\n  const reasons: string[] = [];\n  const minTrust = resolveMinTrustClass(workload);\n  const workloadClassification = placement.dataClassification ?? 'internal';\n\n  if (node.healthy === false) return reject('node is unhealthy');\n  if (node.roles && !node.roles.includes('worker')) return reject('node does not advertise the worker role');\n  if (placement.requireAttestation && node.attested !== true) {\n    return reject('verified node attestation is required');\n  }\n  if (placement.requiredNode && node.name !== placement.requiredNode) return reject('requiredNode does not match');\n  if (placement.nodeSelector) {\n    const matches = Object.entries(placement.nodeSelector).every(\n      ([key, value]) => node.labels?.[key] === value,\n    );\n    if (!matches) return reject('nodeSelector does not match');\n    reasons.push('matches nodeSelector');\n  }\n  if (placement.antiAffinity?.includes(node.faultDomain)) {\n    return reject(`fault domain ${node.faultDomain} is excluded by anti-affinity`);\n  }\n\n  if (minTrust === 'quarantine') {\n    if (node.trustClass !== 'quarantine') return reject('quarantine isolation requires a quarantine node');\n    reasons.push('quarantine isolation match');\n  } else {\n    if (node.trustClass === 'quarantine') return reject('non-quarantine workload cannot use quarantine node');\n    if (TRUST_RANK[node.trustClass] < TRUST_RANK[minTrust]) {\n      return reject(`trust class ${node.trustClass} is below ${minTrust}`);\n    }\n    reasons.push(`trust: ${node.trustClass} ≥ ${minTrust}`);\n  }\n\n  const nodeMaxClass = node.maxDataClassification ?? DEFAULT_MAX_CLASSIFICATION[node.trustClass];\n  if (CLASSIFICATION_RANK[workloadClassification] > CLASSIFICATION_RANK[nodeMaxClass]) {\n    return reject(`data classification ${workloadClassification} exceeds ${nodeMaxClass}`);\n  }\n  reasons.push(`data: ${workloadClassification} ≤ ${nodeMaxClass}`);\n  if (placement.dataResidency?.length) {\n    if (!node.dataResidency?.some((residency) => placement.dataResidency?.includes(residency))) {\n      return reject('data residency does not match');\n    }\n    reasons.push('data residency match');\n  }\n\n  if (node.taints?.length) {\n    const tolerations = placement.tolerations ?? [];\n    const untolerated = node.taints.filter((taint) => !tolerations.includes(taint));\n    if (untolerated.length) return reject(`untolerated taints: ${untolerated.join(', ')}`);\n    reasons.push('taints tolerated');\n  }\n\n  if (workload.spec.runtimeClass) {\n    if (!node.availableRuntimeClasses?.includes(workload.spec.runtimeClass)) {\n      return reject(`runtime class ${workload.spec.runtimeClass} is unavailable`);\n    }\n    reasons.push(`runtime class ${workload.spec.runtimeClass} available`);\n  }\n  const requiredToolClasses = workload.spec.toolPolicy?.requiredToolClasses ?? [];\n  const missingToolClass = requiredToolClasses.find(\n    (toolClass) => !node.availableToolClasses?.includes(toolClass),\n  );\n  if (missingToolClass) return reject(`tool class ${missingToolClass} is unavailable`);\n  if (requiredToolClasses.length) reasons.push('required tool classes available');\n\n  const requiredModelClass = workload.spec.modelPolicy?.modelClass;\n  if (requiredModelClass) {\n    if (!node.availableModelClasses?.includes(requiredModelClass)) {\n      return reject(`model class ${requiredModelClass} is unavailable`);\n    }\n    reasons.push(`model class ${requiredModelClass} available`);\n  }\n\n  const networkPolicy = workload.spec.networkPolicy;\n  if (networkPolicy?.networkClass) {\n    const capability = node.networkCapabilities?.find(\n      (candidate) => candidate.networkClass === networkPolicy.networkClass,\n    );\n    if (!capability) return reject(`network class ${networkPolicy.networkClass} is unavailable`);\n    const minimum = networkPolicy.minimumEnforcement ?? 'none';\n    if (NETWORK_ENFORCEMENT_RANK[capability.enforcementLevel] < NETWORK_ENFORCEMENT_RANK[minimum]) {\n      return reject(`network enforcement ${capability.enforcementLevel} is below ${minimum}`);\n    }\n    if (networkPolicy.egress && !capability.egress?.includes(networkPolicy.egress)) {\n      return reject(`network egress mode ${networkPolicy.egress} is unavailable`);\n    }\n    reasons.push(`network class ${networkPolicy.networkClass} enforceable`);\n  }\n\n  const storagePolicy = workload.spec.storagePolicy;\n  if (\n    storagePolicy?.storageClass &&\n    !node.availableStorageClasses?.includes(storagePolicy.storageClass)\n  ) {\n    return reject(`storage class ${storagePolicy.storageClass} is unavailable`);\n  }\n  const missingClaim = storagePolicy?.volumes?.find(\n    (volume) => !node.availableVolumeClaims?.includes(volume.claimRef),\n  );\n  if (missingClaim) return reject(`volume claim ${missingClaim.claimRef} is unavailable`);\n  if (storagePolicy?.storageClass || storagePolicy?.volumes?.length) {\n    reasons.push('storage requirements available');\n  }\n\n  const credentialPolicy = workload.spec.credentialPolicy;\n  if (credentialPolicy) {\n    const capability = node.credentialCapabilities?.find(\n      (candidate) =>\n        !credentialPolicy.brokerClass ||\n        candidate.brokerClass === credentialPolicy.brokerClass,\n    );\n    if (!capability) return reject('required credential broker is unavailable');\n    const missingAudience = credentialPolicy.audiences?.find(\n      (audience) => !capability.audiences?.includes(audience),\n    );\n    if (missingAudience) return reject(`credential audience ${missingAudience} is unavailable`);\n    const missingTarget = credentialPolicy.targets?.find(\n      (target) => !capability.targets?.includes(target),\n    );\n    if (missingTarget) return reject(`credential target ${missingTarget} is unavailable`);\n    reasons.push('credential broker requirements available');\n  }\n\n  const requirements = workload.spec.resources;\n  if (requirements) {\n    const dimensions: Array<[keyof NonNullable<typeof requirements>, string]> = [\n      ['cpuMillicores', 'CPU'],\n      ['memoryBytes', 'memory'],\n      ['gpuCount', 'GPU'],\n      ['diskBytes', 'disk'],\n      ['bandwidthKbps', 'bandwidth'],\n    ];\n    for (const [key, label] of dimensions) {\n      const requested = requirements[key];\n      if (requested === undefined) continue;\n      if (!Number.isFinite(requested) || requested < 0) return reject(`${label} request is invalid`);\n      if ((node.capacity?.[key] ?? 0) < requested) return reject(`insufficient ${label} capacity`);\n    }\n    reasons.push('resource requests fit');\n  }\n\n  const rollout = placement.rollout;\n  if (rollout) {\n    if (rollout.excludedFaultDomains?.includes(node.faultDomain)) {\n      return reject(`fault domain ${node.faultDomain} is excluded from rollout batch`);\n    }\n    const current = node.rolloutLoad?.[rollout.batchId] ?? 0;\n    if (\n      rollout.maxConcurrentPerFaultDomain !== undefined &&\n      current >= rollout.maxConcurrentPerFaultDomain\n    ) {\n      return reject(`rollout batch ${rollout.batchId} reached its fault-domain limit`);\n    }\n    reasons.push(`rollout batch ${rollout.batchId} admitted`);\n  }\n\n  return { eligible: true, reasons };\n}\n\n/**\n * Upsert the `Scheduled` condition so requesters can watch readiness through\n * the standard condition-wait path (plan 24.14).\n */\nfunction withScheduledCondition(\n  status: AgentWorkloadStatus,\n  conditionStatus: 'True' | 'False',\n  reason: string,\n  now: Date,\n): AgentWorkloadStatus {\n  const conditions = (status.conditions ?? []).filter((condition) => condition.type !== 'Scheduled');\n  conditions.push({ type: 'Scheduled', status: conditionStatus, reason, lastTransitionTime: now.toISOString() });\n  return { ...status, conditions };\n}\n\n/**\n * Create a controller that binds AgentWorkloads to Nodes.\n *\n * The controller watches AgentWorkloads in Pending phase, runs the scheduler\n * to select a node, and updates the workload status with the binding through\n * ControlStore CAS. The lease epoch is included in the status update for\n * fencing.\n *\n * Per §7.2 and §23, restricted nodes are the preferred fleet-worker class and\n * are allowed for ordinary worker workloads. Only quarantine-designated\n * workloads may run on quarantine nodes.\n */\nexport function createBindingController(\n  _store: ControlStore,\n  options: BindingControllerOptions,\n): Controller<AgentWorkloadResource['spec']> {\n  return {\n    async reconcile(request): Promise<ControllerReconcileResult> {\n      const workload = request.resource as AgentWorkloadResource;\n      const status = workload.status ?? {};\n\n      // External placement is explicit and owned by the external\n      // orchestration controller. Never race it with the local node binder.\n      if (workload.spec.placement?.orchestrator) {\n        return { ready: true };\n      }\n\n      // Skip workloads that are already bound or completed.\n      if (status.phase !== 'Pending' && status.phase !== undefined) {\n        return { ready: true };\n      }\n\n      const nodes = await options.listNodes();\n      const decision = options.scheduler.schedule(workload, nodes);\n\n      if (!decision) {\n        return {\n          status: withScheduledCondition(\n            {\n              ...status,\n              phase: 'Failed',\n              lastRunResult: 'no suitable node found',\n            } as AgentWorkloadStatus,\n            'False',\n            'NoSuitableNode',\n            request.now,\n          ),\n          ready: true,\n        };\n      }\n\n      const node = nodes.find((n) => n.name === decision.nodeName);\n      const eligibility = node ? evaluateNodeEligibility(workload, node) : reject('selected node does not exist');\n      if (!eligibility.eligible) {\n        return {\n          status: withScheduledCondition(\n            {\n              ...status,\n              phase: 'Failed',\n              lastRunResult: `node ${decision.nodeName} rejected before bind: ${eligibility.rejection}`,\n            } as AgentWorkloadStatus,\n            'False',\n            'BindingAdmissionRejected',\n            request.now,\n          ),\n          ready: true,\n        };\n      }\n\n      const policyDecision = options.authorizePlacement\n        ? await options.authorizePlacement({\n          workload,\n          node: node as SchedulerNode,\n          actor: request.actor,\n          leaseEpoch: request.leaseEpoch,\n        })\n        : undefined;\n      if (policyDecision?.outcome === 'deny') {\n        return {\n          status: withScheduledCondition(\n            {\n              ...status,\n              phase: 'Failed',\n              placementDecisionRef: policyDecision.decisionHandle,\n              placementPolicyDigest: policyDecision.policyDigest,\n              lastRunResult: `node ${decision.nodeName} denied by trusted placement policy: ${policyDecision.reasons.join('; ')}`,\n            } as AgentWorkloadStatus,\n            'False',\n            'PlacementPolicyDenied',\n            request.now,\n          ),\n          ready: true,\n        };\n      }\n\n      return {\n        status: withScheduledCondition(\n          {\n            ...status,\n            phase: 'Scheduling',\n            assignedNode: decision.nodeName,\n            ...(policyDecision\n              ? {\n                placementDecisionRef: policyDecision.decisionHandle,\n                placementPolicyDigest: policyDecision.policyDigest,\n              }\n              : {}),\n            lastRunResult: `bound to ${decision.nodeName} (score: ${decision.score}, lease: ${request.leaseEpoch})`,\n          } as AgentWorkloadStatus,\n          'True',\n          `BoundTo ${decision.nodeName}`,\n          request.now,\n        ),\n        ready: true,\n      };\n    },\n  };\n}\n\n/**\n * Capacity scheduler with trust, data-classification, taint/toleration,\n * model-capability, and anti-affinity filters.\n *\n * Trust filtering (§7.2, §23):\n * - Restricted nodes are allowed for ordinary/restricted workloads.\n * - Quarantine nodes are only candidates for quarantine-designated workloads.\n * - Trusted nodes are always eligible (unless filtered by other criteria).\n *\n * Data classification filtering:\n * - Workloads with sensitive data are not scheduled on nodes whose\n *   `maxDataClassification` is lower than the workload's classification.\n * - Quarantine nodes default to `public`-only.\n *\n * Scoring favors trusted nodes, higher capacity, and data locality.\n */\nexport function createCapacityScheduler(): Scheduler {\n  return {\n    schedule(workload, nodes) {\n      const placement = workload.spec.placement ?? {};\n      const candidates: Array<{ node: SchedulerNode; score: number; reasons: string[] }> = [];\n\n      for (const node of nodes) {\n        const eligibility = evaluateNodeEligibility(workload, node);\n        if (!eligibility.eligible) continue;\n        const reasons = eligibility.reasons;\n\n        // ── Score: available capacity (higher is better) ──\n        const cpu = node.capacity?.cpuMillicores ?? 0;\n        const memory = node.capacity?.memoryBytes ?? 0;\n        let score = cpu + Math.floor(memory / (1024 * 1024));\n        reasons.push(`capacity score: ${score}`);\n\n        // ── Score: trust bonus (prefer higher trust) ──\n        score += TRUST_RANK[node.trustClass] * 500;\n        if (node.trustClass === 'trusted') {\n          reasons.push('trusted node bonus');\n        } else if (node.trustClass === 'restricted') {\n          reasons.push('restricted node eligible');\n        }\n\n        // ── Score: spare concurrency bonus ──\n        if (node.spareConcurrency && node.spareConcurrency > 0) {\n          score += Math.min(node.spareConcurrency * 10, 200);\n          reasons.push(`spare concurrency: ${node.spareConcurrency}`);\n        }\n\n        if (placement.preferredNode === node.name) {\n          score += 300;\n          reasons.push('preferred node locality');\n        }\n        const localArtifacts = workload.spec.artifactReferences?.filter(\n          (reference) => node.localArtifactReferences?.includes(reference),\n        ).length ?? 0;\n        if (localArtifacts) {\n          score += localArtifacts * 100;\n          reasons.push(`${localArtifacts} local artifact(s)`);\n        }\n        if (\n          workload.spec.checkpointReference &&\n          node.localCheckpointReferences?.includes(workload.spec.checkpointReference)\n        ) {\n          score += 200;\n          reasons.push('checkpoint local');\n        }\n\n        candidates.push({ node, score, reasons });\n      }\n\n      if (candidates.length === 0) return null;\n\n      candidates.sort((a, b) => b.score - a.score);\n      const best = candidates[0];\n      return {\n        nodeName: best.node.name,\n        score: best.score,\n        reasons: best.reasons,\n      };\n    },\n  };\n}\n","import type { ControlStoreAuthorizationRequest } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport { AUDIT_RECORD_KIND, type AuditRecordSpec } from '../resources.js';\nimport { containsSecrets } from './secretRedaction.js';\n\nconst SHA256 = /^sha256:[a-f0-9]{64}$/;\nconst FORBIDDEN_ATTRIBUTE = /(?:secret|token|password|credential|authorization|cookie|private[-_]?key)/i;\nconst SPEC_FIELDS = new Set([\n  'stream',\n  'sequence',\n  'resourceUid',\n  'recordKind',\n  'receivedAt',\n  'actor',\n  'policyDigest',\n  'capabilityDigest',\n  'effect',\n  'provenance',\n  'attributes',\n  'data',\n  'previousDigest',\n  'recordDigest',\n  'requestFingerprint',\n  'idempotencyDigest',\n  'fencingEpoch',\n]);\n\nfunction forbidden(message: string): never {\n  throw new OrchestrationError({\n    code: 'FORBIDDEN',\n    message,\n    retryable: false,\n  });\n}\n\n/**\n * Enforce AuditRecord append-only semantics in the protected ControlStore\n * write transaction. Only the actor stamped into immutable evidence may\n * create it; no status, apply, delete, or resource lease mutation is valid.\n */\nexport function createAuditRecordAuthorizer(): (\n  request: ControlStoreAuthorizationRequest,\n) => void {\n  return (request) => {\n    if (request.reference.kind !== AUDIT_RECORD_KIND) return;\n    if (request.verb !== 'create') {\n      forbidden('AuditRecord resources are append-only');\n    }\n    const spec = request.proposedResource?.spec as AuditRecordSpec | undefined;\n    const attributes = spec?.attributes;\n    const attributeEntries = attributes &&\n        typeof attributes === 'object' &&\n        !Array.isArray(attributes)\n      ? Object.entries(attributes)\n      : [];\n    const data = spec?.data as Record<string, unknown> | undefined;\n    const expectedDataFields = data?.kind === 'audit'\n      ? ['kind', 'action', 'outcome', 'reasonCode']\n      : data?.kind === 'event'\n      ? ['kind', 'name', 'severity']\n      : data?.kind === 'metric'\n      ? ['kind', 'name', 'value', 'unit']\n      : data?.kind === 'trace'\n      ? ['kind', 'name', 'traceId', 'spanId', 'durationMs', 'status']\n      : [];\n    const dataMatchesKind = Boolean(\n      data &&\n        data.kind === spec?.recordKind &&\n        Object.keys(data).every((field) => expectedDataFields.includes(field)) &&\n        (\n          (data.kind === 'audit' &&\n            typeof data.action === 'string' &&\n            ['success', 'denied', 'failure'].includes(String(data.outcome))) ||\n          (data.kind === 'event' &&\n            typeof data.name === 'string' &&\n            ['debug', 'info', 'warning', 'error', 'critical'].includes(\n              String(data.severity),\n            )) ||\n          (data.kind === 'metric' &&\n            typeof data.name === 'string' &&\n            typeof data.value === 'number' &&\n            Number.isFinite(data.value) &&\n            typeof data.unit === 'string') ||\n          (data.kind === 'trace' &&\n            typeof data.name === 'string' &&\n            typeof data.traceId === 'string' &&\n            typeof data.spanId === 'string' &&\n            typeof data.durationMs === 'number' &&\n            Number.isFinite(data.durationMs) &&\n            data.durationMs >= 0 &&\n            ['ok', 'error'].includes(String(data.status)))\n        ),\n    );\n    if (\n      !spec ||\n      Object.keys(spec).some((field) => !SPEC_FIELDS.has(field)) ||\n      spec.actor?.id !== request.actor.id ||\n      spec.actor?.kind !== request.actor.kind ||\n      !spec.stream ||\n      spec.stream.length > 128 ||\n      !Number.isSafeInteger(spec.sequence) ||\n      spec.sequence < 1 ||\n      !spec.resourceUid ||\n      Number.isNaN(Date.parse(spec.receivedAt)) ||\n      !['audit', 'event', 'metric', 'trace'].includes(spec.recordKind) ||\n      !dataMatchesKind ||\n      Object.values(data ?? {}).some(\n        (value) => typeof value === 'string' && value.length > 256,\n      ) ||\n      !spec.provenance ||\n      !['controller', 'gateway', 'driver', 'worker', 'operator'].includes(\n        spec.provenance.source,\n      ) ||\n      !spec.provenance.producer ||\n      spec.provenance.producer.length > 256 ||\n      (spec.provenance.subject !== undefined &&\n        (\n          typeof spec.provenance.subject !== 'string' ||\n          !spec.provenance.subject ||\n          spec.provenance.subject.length > 256\n        )) ||\n      ![\n        'read',\n        'create',\n        'update',\n        'delete',\n        'execute',\n        'decision',\n        'security',\n      ].includes(spec.effect) ||\n      !attributes ||\n      typeof attributes !== 'object' ||\n      Array.isArray(attributes) ||\n      attributeEntries.length > 64 ||\n      attributeEntries.some(([key, value]) =>\n        !key ||\n        key.length > 64 ||\n        FORBIDDEN_ATTRIBUTE.test(key) ||\n        typeof value !== 'string' ||\n        value.length > 256 ||\n        containsSecrets({ [key]: value })\n      ) ||\n      !Number.isSafeInteger(spec.fencingEpoch) ||\n      spec.fencingEpoch < 1 ||\n      !SHA256.test(spec.policyDigest) ||\n      !SHA256.test(spec.capabilityDigest) ||\n      !SHA256.test(spec.recordDigest) ||\n      !SHA256.test(spec.requestFingerprint) ||\n      !SHA256.test(spec.idempotencyDigest) ||\n      (spec.previousDigest !== undefined && !SHA256.test(spec.previousDigest)) ||\n      request.reference.name !==\n        `audit-${spec.idempotencyDigest.slice('sha256:'.length, 62)}`\n    ) {\n      forbidden('AuditRecord creation evidence is invalid');\n    }\n  };\n}\n","import { OrchestrationError } from '../errors.js';\nimport { base64UrlDecode, base64UrlEncode, type ModelHandleSigner } from './modelAccessHandle.js';\n\n/**\n * CredentialGrant broker contract (plan 24.46).\n *\n * Generalizes the ModelAccessHandle pattern to arbitrary scoped credentials\n * (tool operations, SSH, cloud APIs, model access). Every grant is bound to\n * Run/attempt/worker key/target/method/audience/policy digest/expiry, and the\n * broker records exposure and post-task rotation requirements. Grants resolve\n * to opaque handles; raw secret material never appears here — the broker only\n * signs and verifies scoped claims.\n */\n\nexport interface CredentialGrantScope {\n  runRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n    uid: string;\n  };\n  attempt: number;\n  /** Fingerprint of the worker's ephemeral public key (proof-of-possession binding). */\n  workerKey: string;\n  target: string;\n  method: string;\n  audience: string;\n  policyDigest: string;\n}\n\nexport interface CredentialGrantProof {\n  /** Broker-issued, one-time challenge identifier. */\n  challengeId: string;\n  signature: Uint8Array;\n}\n\nexport interface CredentialProofVerifier {\n  /** Verify the worker signature and atomically consume the challenge. */\n  verifyAndConsume(request: {\n    workerKey: string;\n    grantId: string;\n    audience: string;\n    proof: CredentialGrantProof;\n  }): Promise<boolean>;\n}\n\nexport interface CredentialGrantVerification extends CredentialGrantScope {\n  proof: CredentialGrantProof;\n}\n\nexport interface CredentialGrantClaims extends CredentialGrantScope {\n  grantId: string;\n  issuedAt: string;\n  expiresAt: string;\n  renewedAt?: string;\n}\n\nexport interface CredentialGrantHandle {\n  /** Opaque token presented to the target driver. */\n  token: string;\n  claims: CredentialGrantClaims;\n}\n\nexport interface CredentialGrantInspection {\n  grantId: string;\n  scope: CredentialGrantScope;\n  issuedAt: string;\n  expiresAt: string;\n  revoked: boolean;\n  expired: boolean;\n  /** Exposure assessment used to decide post-task rotation. */\n  exposure: 'none' | 'worker-visible' | 'potentially-exposed';\n  rotationRequired: boolean;\n  rotationReason?: string;\n}\n\nexport interface IssueCredentialGrantRequest extends CredentialGrantScope {\n  grantId?: string;\n  ttlMs?: number;\n}\n\nexport interface CredentialBrokerDriver {\n  issue(request: IssueCredentialGrantRequest): Promise<CredentialGrantHandle>;\n  /** Renew an unexpired, unrevoked grant; returns a new token with a fresh expiry. */\n  renew(token: string, options?: { ttlMs?: number; now?: () => Date }): Promise<CredentialGrantHandle>;\n  revoke(grantId: string): void;\n  inspect(token: string): Promise<CredentialGrantInspection>;\n  /** Verify the token's entire scope and the worker's proof of possession. */\n  verify(token: string, requirements: CredentialGrantVerification): Promise<CredentialGrantClaims>;\n}\n\nconst TOKEN_PREFIX = 'mlcg1';\nconst DEFAULT_TTL_MS = 15 * 60 * 1000;\nconst MAX_TTL_MS = 60 * 60 * 1000;\n\nexport interface InMemoryCredentialBrokerOptions {\n  signer: ModelHandleSigner;\n  proofVerifier: CredentialProofVerifier;\n  defaultTtlMs?: number;\n  maxTtlMs?: number;\n  now?: () => Date;\n}\n\nlet grantCounter = 0;\n\nexport function createInMemoryCredentialBroker(options: InMemoryCredentialBrokerOptions): CredentialBrokerDriver {\n  const now = options.now ?? (() => new Date());\n  const defaultTtl = options.defaultTtlMs ?? DEFAULT_TTL_MS;\n  const maxTtl = options.maxTtlMs ?? MAX_TTL_MS;\n  const encoder = new TextEncoder();\n  const decoder = new TextDecoder();\n  const revoked = new Set<string>();\n  /** Grants issued to workers are worker-visible and need rotation after the task. */\n  const workerVisible = new Set<string>();\n\n  function assertScope(request: CredentialGrantScope): void {\n    if (!request.runRef.uid || !request.runRef.name || !request.runRef.apiVersion || !request.runRef.kind) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant Run identity is required', retryable: false });\n    }\n    if (!Number.isInteger(request.attempt) || request.attempt < 1) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant attempt must be a positive integer', retryable: false });\n    }\n    if (!request.workerKey) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant worker key is required', retryable: false });\n    }\n    if (!request.target) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant target is required', retryable: false });\n    }\n    if (!request.method) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant method is required', retryable: false });\n    }\n    if (!request.audience) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant audience is required', retryable: false });\n    }\n    if (!request.policyDigest) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant policy digest is required', retryable: false });\n    }\n  }\n\n  async function sign(claims: CredentialGrantClaims): Promise<CredentialGrantHandle> {\n    const payload = encoder.encode(JSON.stringify(claims));\n    const signature = await options.signer.sign(payload);\n    return { token: `${TOKEN_PREFIX}.${base64UrlEncode(payload)}.${base64UrlEncode(signature)}`, claims };\n  }\n\n  async function parseAndVerify(token: string): Promise<CredentialGrantClaims> {\n    const parts = token.split('.');\n    if (parts.length !== 3 || parts[0] !== TOKEN_PREFIX) {\n      throw new OrchestrationError({ code: 'INVALID', message: 'malformed credential grant', retryable: false });\n    }\n    const payload = base64UrlDecode(parts[1]);\n    const signature = base64UrlDecode(parts[2]);\n    if (!(await options.signer.verify(payload, signature))) {\n      throw new OrchestrationError({ code: 'FORBIDDEN', message: 'credential grant signature invalid', retryable: false });\n    }\n    let claims: CredentialGrantClaims;\n    try {\n      claims = JSON.parse(decoder.decode(payload)) as CredentialGrantClaims;\n    } catch {\n      throw new OrchestrationError({ code: 'INVALID', message: 'credential grant payload invalid', retryable: false });\n    }\n    return claims;\n  }\n\n  function assertUsable(claims: CredentialGrantClaims, at: Date): void {\n    if (revoked.has(claims.grantId)) {\n      throw new OrchestrationError({ code: 'FORBIDDEN', message: 'credential grant revoked', retryable: false, details: { grantId: claims.grantId } });\n    }\n    if (at.getTime() >= Date.parse(claims.expiresAt)) {\n      throw new OrchestrationError({ code: 'TIMEOUT', message: 'credential grant expired', retryable: false, details: { expiresAt: claims.expiresAt } });\n    }\n  }\n\n  return {\n    async issue(request) {\n      assertScope(request);\n      const issuedAt = now();\n      const ttl = Math.min(request.ttlMs ?? defaultTtl, maxTtl);\n      if (ttl <= 0) {\n        throw new OrchestrationError({ code: 'INVALID', message: 'credential grant ttl must be positive', retryable: false });\n      }\n      grantCounter += 1;\n      const claims: CredentialGrantClaims = {\n        grantId: request.grantId ?? `mlcg-${issuedAt.getTime().toString(36)}-${grantCounter.toString(36)}`,\n        runRef: request.runRef,\n        attempt: request.attempt,\n        workerKey: request.workerKey,\n        target: request.target,\n        method: request.method,\n        audience: request.audience,\n        policyDigest: request.policyDigest,\n        issuedAt: issuedAt.toISOString(),\n        expiresAt: new Date(issuedAt.getTime() + ttl).toISOString(),\n      };\n      workerVisible.add(claims.grantId);\n      return sign(claims);\n    },\n\n    async renew(token, renewOptions = {}) {\n      const claims = await parseAndVerify(token);\n      assertUsable(claims, renewOptions.now?.() ?? now());\n      const renewedAt = renewOptions.now?.() ?? now();\n      const ttl = Math.min(renewOptions.ttlMs ?? defaultTtl, maxTtl);\n      return sign({\n        ...claims,\n        renewedAt: renewedAt.toISOString(),\n        expiresAt: new Date(renewedAt.getTime() + ttl).toISOString(),\n      });\n    },\n\n    revoke(grantId) {\n      revoked.add(grantId);\n    },\n\n    async inspect(token) {\n      const claims = await parseAndVerify(token);\n      const expired = now().getTime() >= Date.parse(claims.expiresAt);\n      const isRevoked = revoked.has(claims.grantId);\n      const exposure = workerVisible.has(claims.grantId) ? 'worker-visible' : 'none';\n      return {\n        grantId: claims.grantId,\n        scope: {\n          runRef: claims.runRef,\n          attempt: claims.attempt,\n          workerKey: claims.workerKey,\n          target: claims.target,\n          method: claims.method,\n          audience: claims.audience,\n          policyDigest: claims.policyDigest,\n        },\n        issuedAt: claims.issuedAt,\n        expiresAt: claims.expiresAt,\n        revoked: isRevoked,\n        expired,\n        exposure,\n        rotationRequired: exposure !== 'none' || isRevoked,\n        ...(exposure !== 'none' ? { rotationReason: 'grant was visible to a worker; rotate the underlying credential after the task' } : {}),\n      };\n    },\n\n    async verify(token, requirements) {\n      const claims = await parseAndVerify(token);\n      assertUsable(claims, now());\n      if (\n        claims.runRef.apiVersion !== requirements.runRef.apiVersion ||\n        claims.runRef.kind !== requirements.runRef.kind ||\n        claims.runRef.name !== requirements.runRef.name ||\n        claims.runRef.uid !== requirements.runRef.uid ||\n        claims.attempt !== requirements.attempt ||\n        claims.policyDigest !== requirements.policyDigest\n      ) {\n        throw new OrchestrationError({ code: 'FORBIDDEN', message: 'credential grant Run or policy scope mismatch', retryable: false });\n      }\n      if (claims.target !== requirements.target) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: `credential grant target mismatch: expected '${requirements.target}'`,\n          retryable: false,\n        });\n      }\n      if (claims.method !== requirements.method) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: `credential grant method mismatch: expected '${requirements.method}'`,\n          retryable: false,\n        });\n      }\n      if (claims.audience !== requirements.audience) {\n        throw new OrchestrationError({\n          code: 'FORBIDDEN',\n          message: `credential grant audience mismatch: expected '${requirements.audience}'`,\n          retryable: false,\n        });\n      }\n      if (claims.workerKey !== requirements.workerKey) {\n        throw new OrchestrationError({ code: 'FORBIDDEN', message: 'credential grant worker key mismatch', retryable: false });\n      }\n      if (\n        !(await options.proofVerifier.verifyAndConsume({\n          workerKey: claims.workerKey,\n          grantId: claims.grantId,\n          audience: claims.audience,\n          proof: requirements.proof,\n        }))\n      ) {\n        throw new OrchestrationError({ code: 'FORBIDDEN', message: 'credential grant proof of possession invalid', retryable: false });\n      }\n      return claims;\n    },\n  };\n}\n","import type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport type { WorkerEnrollmentResource, WorkerSessionResource } from './workerIdentity.js';\nimport { isWorkerSessionValid, WORKER_ENROLLMENT_API_VERSION, WORKER_ENROLLMENT_KIND, WORKER_SESSION_API_VERSION, WORKER_SESSION_KIND } from './workerIdentity.js';\n\nexport type IdentityRevocationReason = 'security-incident' | 'credential-rotation' | 'policy-violation' | 'manual';\n\nexport interface IdentityRevocationRecord {\n  enrollmentName: string;\n  sessionNames: string[];\n  reason: IdentityRevocationReason;\n  revokedBy: string;\n  revokedAt: string;\n  evidence?: string;\n}\n\nexport interface IdentityPromotionRequest {\n  /** The quarantine enrollment to promote from. */\n  sourceEnrollmentName: string;\n  /** New trust class for the promoted identity. */\n  targetTrustClass: 'trusted' | 'restricted';\n  /** Evidence from trusted verification (e.g. reimage attestation). */\n  verificationEvidence: string;\n  /** Verifier actor ID that performed the verification. */\n  verifiedBy: string;\n  /** Approval actor ID that authorized the promotion. */\n  approvedBy: string;\n}\n\n/**\n * Permanently revoke a quarantine identity and all its sessions.\n * Once revoked, the identity cannot be re-enabled; promotion requires\n * creating a new enrollment through trusted verification.\n */\nexport async function revokeQuarantineIdentity(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  enrollmentName: string,\n  reason: IdentityRevocationReason,\n  evidence?: string,\n  now: () => Date = () => new Date(),\n): Promise<IdentityRevocationRecord> {\n  if (actor.kind !== 'controller' && actor.kind !== 'admin') {\n    throw new Error('Identity revocation requires controller or admin actor');\n  }\n\n  // Get the enrollment.\n  const enrollment = await store.get({\n    apiVersion: WORKER_ENROLLMENT_API_VERSION,\n    kind: WORKER_ENROLLMENT_KIND,\n    name: enrollmentName,\n  }) as WorkerEnrollmentResource | null;\n\n  if (!enrollment) {\n    throw new Error(`WorkerEnrollment ${enrollmentName} not found`);\n  }\n\n  // Only quarantine identities can be permanently revoked through this path.\n  if (enrollment.spec.trustClass !== 'quarantine') {\n    throw new Error(\n      `Only quarantine identities can be permanently revoked; ${enrollmentName} has trust class ${enrollment.spec.trustClass}`,\n    );\n  }\n\n  // Find all active sessions for this enrollment.\n  const sessions = await store.list({\n    kind: WORKER_SESSION_KIND,\n  });\n  const currentTime = now();\n  const activeSessions = (sessions.items as unknown as WorkerSessionResource[]).filter(\n    (session) =>\n      session.spec.enrollmentRef.name === enrollmentName &&\n      isWorkerSessionValid(session, currentTime),\n  );\n\n  // Revoke all active sessions.\n  const revokedAt = now().toISOString();\n  for (const session of activeSessions) {\n    await store.updateStatus(\n      actor,\n      { apiVersion: WORKER_SESSION_API_VERSION, kind: WORKER_SESSION_KIND, name: session.metadata.name },\n      {\n        phase: 'Revoked',\n        revokedAt,\n        revokeReason: `enrollment revoked: ${reason}`,\n      },\n      { resourceVersion: session.metadata.resourceVersion },\n    );\n  }\n\n  // Mark the enrollment itself as revoked.\n  await store.updateStatus(\n    actor,\n    { apiVersion: WORKER_ENROLLMENT_API_VERSION, kind: WORKER_ENROLLMENT_KIND, name: enrollmentName },\n    {\n      phase: 'Revoked',\n      revokedAt,\n      revokeReason: reason,\n    },\n    { resourceVersion: enrollment.metadata.resourceVersion },\n  );\n\n  return {\n    enrollmentName,\n    sessionNames: activeSessions.map((session) => session.metadata.name),\n    reason,\n    revokedBy: actor.id,\n    revokedAt,\n    evidence,\n  };\n}\n\n/**\n * Promote a quarantine identity to a new ordinary identity after trusted\n * verification. The old quarantine enrollment is permanently revoked, and a\n * new enrollment is created with the target trust class.\n */\nexport async function promoteIdentity(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  request: IdentityPromotionRequest,\n  now: () => Date = () => new Date(),\n): Promise<WorkerEnrollmentResource> {\n  if (actor.kind !== 'controller' && actor.kind !== 'admin') {\n    throw new Error('Identity promotion requires controller or admin actor');\n  }\n\n  // Get the source enrollment.\n  const source = await store.get({\n    apiVersion: WORKER_ENROLLMENT_API_VERSION,\n    kind: WORKER_ENROLLMENT_KIND,\n    name: request.sourceEnrollmentName,\n  }) as WorkerEnrollmentResource | null;\n\n  if (!source) {\n    throw new Error(`WorkerEnrollment ${request.sourceEnrollmentName} not found`);\n  }\n\n  if (source.spec.trustClass !== 'quarantine') {\n    throw new Error(\n      `Only quarantine identities can be promoted; ${request.sourceEnrollmentName} has trust class ${source.spec.trustClass}`,\n    );\n  }\n\n  // Permanently revoke the old quarantine identity.\n  await revokeQuarantineIdentity(\n    store,\n    actor,\n    request.sourceEnrollmentName,\n    'security-incident',\n    `promoted to new identity with evidence: ${request.verificationEvidence}`,\n    now,\n  );\n\n  // Create a new enrollment with the target trust class.\n  const newEnrollmentName = `${request.sourceEnrollmentName}-promoted-${Date.now()}`;\n  const manifest = {\n    apiVersion: WORKER_ENROLLMENT_API_VERSION,\n    kind: WORKER_ENROLLMENT_KIND,\n    metadata: { name: newEnrollmentName },\n    spec: {\n      nodeRef: source.spec.nodeRef,\n      trustClass: request.targetTrustClass,\n      bootstrapTokenHash: source.spec.bootstrapTokenHash,\n      enrolledBy: request.approvedBy,\n      expiresAt: new Date(now().getTime() + 24 * 60 * 60 * 1000).toISOString(),\n    },\n  };\n\n  const resource = await store.create(actor, manifest);\n  return resource as WorkerEnrollmentResource;\n}\n\n/**\n * Check whether an identity is permanently revoked.\n */\nexport async function isIdentityRevoked(\n  store: ControlStore,\n  enrollmentName: string,\n): Promise<boolean> {\n  const enrollment = await store.get({\n    apiVersion: WORKER_ENROLLMENT_API_VERSION,\n    kind: WORKER_ENROLLMENT_KIND,\n    name: enrollmentName,\n  }) as WorkerEnrollmentResource | null;\n\n  return enrollment?.status?.phase === 'Revoked';\n}\n","import type { ControlStoreAuthorizationRequest } from '../controlStore.js';\nimport type { NodeTrustClass } from '../resources.js';\n\nexport const NODE_API_VERSION = 'memeloop/v1';\nexport const NODE_KIND = 'Node';\n\nexport interface NodeSpec {\n  nodeId: string;\n  faultDomain: string;\n  capacity?: {\n    cpuMillicores?: number;\n    memoryBytes?: number;\n    gpuCount?: number;\n  };\n  labels?: Record<string, string>;\n}\n\nexport interface NodeStatus {\n  trustClass: NodeTrustClass;\n  trustEvidence?: string;\n  trustVerifiedBy?: string;\n  trustVerifiedAt?: string;\n  conditions?: Array<{\n    type: string;\n    status: 'True' | 'False' | 'Unknown';\n    reason: string;\n    lastTransitionTime: string;\n  }>;\n}\n\n/**\n * Roles that a restricted or quarantine node must never hold.\n */\nconst FORBIDDEN_ROLES_FOR_UNTRUSTED = new Set([\n  'controller',\n  'voter',\n  'scheduler',\n  'plugin-host',\n  'control-store-client',\n  'storage-replica',\n]);\n\n/**\n * Create a ControlStore authorizer that enforces immutable Node trust admission.\n *\n * Rules:\n * 1. Node trustClass can only be set at creation time in spec.\n * 2. After creation, trustClass can only be changed by a verifier actor\n *    providing signed evidence, and only through status updates.\n * 3. A node cannot modify its own trustClass.\n * 4. Restricted/quarantine nodes cannot acquire leases for forbidden roles.\n * 5. Any attempt to use a self-report or label update to change trustClass\n *    is rejected.\n */\nexport function createNodeTrustAuthorizer(): (request: ControlStoreAuthorizationRequest) => void {\n  return (request: ControlStoreAuthorizationRequest) => {\n    if (request.reference.kind !== NODE_KIND) return;\n\n    const { actor, verb, current, proposedStatus } = request;\n\n    // Rule: only allow create, update-status, delete for Node resources.\n    if (verb === 'create') {\n      // At creation, trustClass must be explicitly set in spec.\n      // This is checked by the caller; the authorizer just ensures the\n      // resource kind is Node.\n      return;\n    }\n\n    if (verb === 'update-status' && current && proposedStatus) {\n      const currentStatus = current.status as NodeStatus | undefined;\n      const proposedNodeStatus = proposedStatus as NodeStatus;\n\n      // If trustClass is not changing, allow.\n      if (currentStatus?.trustClass === proposedNodeStatus.trustClass) {\n        return;\n      }\n\n      // Trust class is changing. Only verifier actors may change it.\n      if (actor.kind !== 'verifier') {\n        throw new Error(\n          `Node trust class can only be changed by verifier actors, not ${actor.kind}`,\n        );\n      }\n\n      // The verifier must provide evidence.\n      if (!proposedNodeStatus.trustEvidence || proposedNodeStatus.trustEvidence.length === 0) {\n        throw new Error('Node trust class change requires trustEvidence');\n      }\n\n      // The verifier must record its identity.\n      if (!proposedNodeStatus.trustVerifiedBy || proposedNodeStatus.trustVerifiedBy !== actor.id) {\n        throw new Error(\n          `Node trust class change must record trustVerifiedBy matching the actor id ${actor.id}`,\n        );\n      }\n\n      return;\n    }\n\n    if (verb === 'acquire-lease' || verb === 'renew-lease') {\n      // Restricted/quarantine nodes cannot hold forbidden roles.\n      // The lease name encodes the role, e.g. \"controller/storage\" or \"scheduler/main\".\n      const leaseName = request.reference.name ?? '';\n      const nodeTrust = (current?.status as NodeStatus | undefined)?.trustClass;\n      if (nodeTrust === 'restricted' || nodeTrust === 'quarantine') {\n        for (const role of FORBIDDEN_ROLES_FOR_UNTRUSTED) {\n          if (leaseName.startsWith(role)) {\n            throw new Error(\n              `Node with trust class ${nodeTrust} cannot acquire lease for forbidden role ${role}`,\n            );\n          }\n        }\n      }\n      return;\n    }\n  };\n}\n\n/**\n * Validate that a Node resource's spec does not attempt to self-assert\n * trust status through labels or annotations.\n */\nexport function validateNodeSpec(spec: NodeSpec): void {\n  if (spec.labels) {\n    const forbiddenLabels = ['trust-class', 'trustClass', 'node-trust'];\n    for (const label of forbiddenLabels) {\n      if (label in spec.labels) {\n        throw new Error(\n          `Node spec cannot self-assert trust through label ${label}; trust is managed through status by verifier actors`,\n        );\n      }\n    }\n  }\n}\n\n/**\n * Check whether a node with the given trust class is allowed to perform\n * a sensitive role. This is a pure function for use by schedulers and\n * admission controllers outside the ControlStore authorizer.\n */\nexport function isNodeAllowedForRole(trustClass: NodeTrustClass, role: string): boolean {\n  if (trustClass === 'trusted') return true;\n  return !FORBIDDEN_ROLES_FOR_UNTRUSTED.has(role);\n}\n","import type { ControlStoreAuthorizationRequest } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport { POLICY_DECISION_KIND, type PolicyDecisionResource, type PolicyDecisionSpec, type PolicyDecisionStatus } from '../resources.js';\n\nfunction forbidden(message: string): never {\n  throw new OrchestrationError({\n    code: 'FORBIDDEN',\n    message,\n    retryable: false,\n  });\n}\n\n/**\n * Protect durable PolicyDecision evidence in the same ControlStore\n * transaction as its write. Decisions are create-only; only an authenticated\n * admin may resolve the status of a pending approval.\n */\nexport function createPolicyDecisionAuthorizer(): (\n  request: ControlStoreAuthorizationRequest,\n) => void {\n  return (request) => {\n    if (request.reference.kind !== POLICY_DECISION_KIND) return;\n\n    if (request.verb === 'create') {\n      const spec = request.proposedResource?.spec as\n        | PolicyDecisionSpec\n        | undefined;\n      if (\n        !spec ||\n        spec.requestedBy !== request.actor.id ||\n        (\n          spec.decisionKind === 'transition'\n            ? request.actor.kind !== 'verifier'\n            : request.actor.kind !== 'controller' &&\n              request.actor.kind !== 'admin'\n        ) ||\n        (\n          spec.decisionKind === 'approval' &&\n          spec.initialOutcome !== 'pending'\n        ) ||\n        (\n          spec.decisionKind !== 'approval' &&\n          spec.initialOutcome === 'pending'\n        )\n      ) {\n        forbidden('PolicyDecision creation actor or initial outcome is invalid');\n      }\n      return;\n    }\n\n    if (request.verb === 'update-status') {\n      const current = request.current as PolicyDecisionResource | undefined;\n      const proposed = request.proposedStatus as\n        | PolicyDecisionStatus\n        | undefined;\n      if (\n        !current ||\n        current.spec.decisionKind !== 'approval' ||\n        current.spec.initialOutcome !== 'pending' ||\n        request.actor.kind !== 'admin' ||\n        !proposed ||\n        (proposed.outcome !== 'allow' && proposed.outcome !== 'deny') ||\n        proposed.decidedBy !== request.actor.id ||\n        !proposed.decidedAt ||\n        !proposed.resolutionInputDigest ||\n        !Array.isArray(proposed.reasons) ||\n        proposed.reasons.length !== 1\n      ) {\n        forbidden(\n          'only an authenticated admin may resolve a pending PolicyDecision approval',\n        );\n      }\n      const currentStatus = current.status;\n      if (\n        currentStatus &&\n        (\n          currentStatus.outcome !== proposed.outcome ||\n          currentStatus.decidedBy !== proposed.decidedBy ||\n          currentStatus.decidedAt !== proposed.decidedAt ||\n          currentStatus.resolutionInputDigest !==\n            proposed.resolutionInputDigest ||\n          currentStatus.reasons[0] !== proposed.reasons[0]\n        )\n      ) {\n        forbidden('PolicyDecision approval resolution is immutable');\n      }\n      return;\n    }\n\n    forbidden('PolicyDecision resources cannot be applied, deleted, or leased');\n  };\n}\n","import type { OrchestrationErrorData } from '../errors.js';\n\n/**\n * Quarantine gateway request mediation (plan 24.40).\n *\n * All checks run on the trusted gateway side, outside worker control. The\n * gateway is the worker's only network endpoint — it never receives ordinary\n * peer topology, sync, or device-directory access through this channel. Every\n * outbound request is validated for method, scheme, port, host allowlist,\n * SSRF (literal and DNS-resolved private addresses), redirect targets, body\n * size, per-method limits, and per-worker rate limits; revoked workers are\n * rejected before any validation.\n */\n\nexport interface QuarantineGatewayPolicy {\n  /** Allowed HTTP methods (default GET/HEAD/POST). */\n  allowedMethods?: string[];\n  /** Allowed URL schemes (default ['https']). */\n  allowedSchemes?: string[];\n  /** Allowed ports (default [443]). */\n  allowedPorts?: number[];\n  /** Hostname suffix allowlist; when set, only matching hosts pass. */\n  allowedHosts?: string[];\n  /** Allow private/loopback/link-local targets (default false — SSRF blocked). */\n  allowPrivateNetworks?: boolean;\n  /** Maximum followed redirects, each re-validated (default 0). */\n  maxRedirects?: number;\n  /** Global request body cap in bytes (default 1 MiB). */\n  maxBodyBytes?: number;\n  /** Per-method overrides. */\n  methodLimits?: Record<string, {\n    maxBodyBytes?: number;\n    requestsPerMinute?: number;\n  }>;\n  /** Default per-worker+method rate limit (default 60/minute). */\n  defaultRateLimitPerMinute?: number;\n  /** Response body cap in bytes for the executor (default 8 MiB). */\n  maxResponseBytes?: number;\n}\n\nexport interface GatewayHttpRequest {\n  workerId: string;\n  method: string;\n  url: string;\n  /** Declared request body size in bytes (0/undefined for bodyless). */\n  bodyBytes?: number;\n}\n\nexport interface GatewayValidationContext {\n  /** Injected DNS resolver returning IP literals for a hostname. */\n  resolveHostname?: (hostname: string) => Promise<string[]>;\n  /** Trusted revocation check for worker sessions. */\n  isRevoked?: (workerId: string) => boolean;\n  /** Rate limiter state; one shared limiter per gateway. */\n  rateLimiter?: GatewayRateLimiter;\n  now?: () => number;\n}\n\nexport type GatewayValidationResult =\n  | { ok: true; normalizedUrl: string; hostname: string; addresses: string[] }\n  | { ok: false; error: OrchestrationErrorData };\n\nfunction denied(code: OrchestrationErrorData['code'], message: string, details?: Record<string, unknown>): GatewayValidationResult {\n  return { ok: false, error: { code, message, retryable: code === 'EXHAUSTED' || code === 'UNAVAILABLE', ...(details ? { details } : {}) } };\n}\n\nconst IPV4_PATTERN = /^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/;\n\n/** True when the IP literal is loopback, private, link-local, or otherwise non-public. */\nexport function isPrivateIp(address: string): boolean {\n  const v4 = IPV4_PATTERN.exec(address);\n  if (v4) {\n    const [a, b] = [Number(v4[1]), Number(v4[2])];\n    if (a > 255 || b > 255) return true;\n    if (a === 0 || a === 10 || a === 127) return true;\n    if (a === 169 && b === 254) return true;\n    if (a === 172 && b >= 16 && b <= 31) return true;\n    if (a === 192 && b === 168) return true;\n    if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT\n    if (a >= 224) return true; // multicast/reserved/broadcast\n    return false;\n  }\n  const normalized = address.toLowerCase().replace(/^\\[|\\]$/g, '');\n  if (normalized === '::1' || normalized === '::') return true;\n  if (normalized.startsWith('fe80:')) return true;\n  if (normalized.startsWith('fc') || normalized.startsWith('fd')) return true;\n  if (normalized.startsWith('::ffff:')) {\n    // IPv4-mapped IPv6; URL parsers may normalize the dotted quad to hex.\n    const rest = normalized.slice('::ffff:'.length);\n    if (IPV4_PATTERN.test(rest)) return isPrivateIp(rest);\n    const groups = rest.split(':');\n    if (groups.length === 2) {\n      const hi = Number.parseInt(groups[0], 16);\n      const lo = Number.parseInt(groups[1], 16);\n      if (!Number.isNaN(hi) && !Number.isNaN(lo)) {\n        return isPrivateIp(`${(hi >> 8) & 255}.${hi & 255}.${(lo >> 8) & 255}.${lo & 255}`);\n      }\n    }\n    // Unparseable mapped form — fail closed.\n    return true;\n  }\n  return false;\n}\n\nfunction isIpLiteral(hostname: string): boolean {\n  return IPV4_PATTERN.test(hostname) || hostname.includes(':');\n}\n\nfunction hostMatchesAllowlist(hostname: string, allowlist: string[]): boolean {\n  const lower = hostname.toLowerCase();\n  return allowlist.some((entry) => {\n    const suffix = entry.toLowerCase();\n    return lower === suffix || lower.endsWith(`.${suffix}`);\n  });\n}\n\nexport interface GatewayRateLimiter {\n  /** True when the request is within budget; false when limited. */\n  consume(key: string, perMinute: number): boolean;\n}\n\n/** Token-bucket rate limiter with an injectable clock (trusted-side state). */\nexport function createGatewayRateLimiter(now: () => number = () => Date.now()): GatewayRateLimiter {\n  const buckets = new Map<string, { tokens: number; refilledAt: number }>();\n  return {\n    consume(key, perMinute) {\n      if (perMinute <= 0) return false;\n      const at = now();\n      const bucket = buckets.get(key) ?? { tokens: perMinute, refilledAt: at };\n      const elapsedMinutes = Math.max(0, (at - bucket.refilledAt) / 60_000);\n      const tokens = Math.min(perMinute, bucket.tokens + elapsedMinutes * perMinute);\n      if (tokens < 1) {\n        buckets.set(key, { tokens, refilledAt: at });\n        return false;\n      }\n      buckets.set(key, { tokens: tokens - 1, refilledAt: at });\n      return true;\n    },\n  };\n}\n\n/** Revocation list for quarantine worker sessions (trusted-side state). */\nexport function createWorkerRevocationList(): { revoke(workerId: string): void; isRevoked(workerId: string): boolean } {\n  const revoked = new Set<string>();\n  return {\n    revoke(workerId) {\n      revoked.add(workerId);\n    },\n    isRevoked(workerId) {\n      return revoked.has(workerId);\n    },\n  };\n}\n\nconst DEFAULT_METHODS = ['GET', 'HEAD', 'POST'];\nconst DEFAULT_SCHEMES = ['https'];\nconst DEFAULT_PORTS = [443];\nconst DEFAULT_MAX_BODY = 1024 * 1024;\nconst DEFAULT_RATE_PER_MINUTE = 60;\n\n/**\n * Validate one gateway request. Order matters: revocation first, then cheap\n * syntactic checks, then SSRF (literal before DNS), then rate limits, so a\n * revoked or malformed request never costs a DNS lookup.\n */\nexport async function validateGatewayRequest(\n  request: GatewayHttpRequest,\n  policy: QuarantineGatewayPolicy,\n  context: GatewayValidationContext = {},\n): Promise<GatewayValidationResult> {\n  if (context.isRevoked?.(request.workerId)) {\n    return denied('FORBIDDEN', `worker '${request.workerId}' is revoked`);\n  }\n\n  const method = request.method.toUpperCase();\n  const allowedMethods = policy.allowedMethods ?? DEFAULT_METHODS;\n  if (!allowedMethods.includes(method)) {\n    return denied('FORBIDDEN', `method '${method}' is not allowed`, { allowedMethods });\n  }\n\n  let url: URL;\n  try {\n    url = new URL(request.url);\n  } catch {\n    return denied('INVALID', `url '${request.url}' cannot be parsed`);\n  }\n\n  const scheme = url.protocol.replace(/:$/, '').toLowerCase();\n  const allowedSchemes = policy.allowedSchemes ?? DEFAULT_SCHEMES;\n  if (!allowedSchemes.includes(scheme)) {\n    return denied('FORBIDDEN', `scheme '${scheme}' is not allowed`, { allowedSchemes });\n  }\n\n  const port = url.port ? Number(url.port) : (scheme === 'https' ? 443 : 80);\n  const allowedPorts = policy.allowedPorts ?? DEFAULT_PORTS;\n  if (!allowedPorts.includes(port)) {\n    return denied('FORBIDDEN', `port ${port} is not allowed`, { allowedPorts });\n  }\n\n  const hostname = url.hostname.toLowerCase();\n  if (policy.allowedHosts && !hostMatchesAllowlist(hostname, policy.allowedHosts)) {\n    return denied('FORBIDDEN', `host '${hostname}' is not in the allowlist`);\n  }\n\n  let addresses: string[] = [];\n  if (isIpLiteral(hostname)) {\n    addresses = [hostname.replace(/^\\[|\\]$/g, '')];\n    if (!policy.allowPrivateNetworks && isPrivateIp(hostname)) {\n      return denied('FORBIDDEN', `target '${hostname}' is a private or non-public address`);\n    }\n  } else if (context.resolveHostname) {\n    try {\n      addresses = await context.resolveHostname(hostname);\n    } catch {\n      return denied('UNAVAILABLE', `hostname '${hostname}' could not be resolved`);\n    }\n    if (addresses.length === 0) {\n      return denied('UNAVAILABLE', `hostname '${hostname}' resolved to no addresses`);\n    }\n    if (!policy.allowPrivateNetworks) {\n      const privateAddress = addresses.find((address) => isPrivateIp(address));\n      if (privateAddress) {\n        return denied('FORBIDDEN', `hostname '${hostname}' resolves to private address ${privateAddress}`);\n      }\n    }\n  }\n\n  const methodLimit = policy.methodLimits?.[method];\n  const maxBody = methodLimit?.maxBodyBytes ?? policy.maxBodyBytes ?? DEFAULT_MAX_BODY;\n  if ((request.bodyBytes ?? 0) > maxBody) {\n    return denied('INVALID', `request body ${request.bodyBytes} bytes exceeds limit ${maxBody}`, { maxBodyBytes: maxBody });\n  }\n\n  const perMinute = methodLimit?.requestsPerMinute ?? policy.defaultRateLimitPerMinute ?? DEFAULT_RATE_PER_MINUTE;\n  const limiter = context.rateLimiter;\n  if (limiter && !limiter.consume(`${request.workerId}:${method}`, perMinute)) {\n    return denied('EXHAUSTED', `rate limit exceeded for worker '${request.workerId}' method '${method}'`, { requestsPerMinute: perMinute });\n  }\n\n  return { ok: true, normalizedUrl: url.toString(), hostname, addresses };\n}\n\n/** Validate a redirect target with the same policy; redirect chains are bounded by the caller. */\nexport async function validateRedirectTarget(\n  request: Omit<GatewayHttpRequest, 'method' | 'bodyBytes'> & { method?: string },\n  location: string,\n  policy: QuarantineGatewayPolicy,\n  context: GatewayValidationContext = {},\n): Promise<GatewayValidationResult> {\n  return validateGatewayRequest(\n    { workerId: request.workerId, method: request.method ?? 'GET', url: location, bodyBytes: 0 },\n    policy,\n    context,\n  );\n}\n","import { OrchestrationError, type OrchestrationErrorData } from '../errors.js';\n\n/**\n * Dedicated outbound worker protocol (plan §13).\n *\n * This protocol is deliberately smaller than ResourceClient. A worker can\n * interact only with its own assignment/run through method-specific gateway\n * handlers; it cannot list/watch control state, acquire leases, discover\n * peers, or mutate Node/verification/promotion resources.\n */\n\nexport const WORKER_PROTOCOL_VERSION = 'worker.memeloop.io/v1alpha1';\n\nexport const WORKER_PROTOCOL_METHODS = [\n  'assignment.pull',\n  'assignment.ack',\n  'session.heartbeat',\n  'event.submit',\n  'capability.request',\n  'artifact.upload',\n  'operation.complete',\n  'operation.fail',\n  'operation.cancel',\n] as const;\n\nexport type WorkerProtocolMethod = typeof WORKER_PROTOCOL_METHODS[number];\n\nexport interface WorkerRunBinding {\n  uid: string;\n  attempt: number;\n  epoch: number;\n}\n\nexport interface WorkerProtocolRequest {\n  apiVersion: typeof WORKER_PROTOCOL_VERSION;\n  requestId: string;\n  sessionName: string;\n  sequence: number;\n  nonce: string;\n  deadline: string;\n  audience: string;\n  run: WorkerRunBinding;\n  method: WorkerProtocolMethod;\n  target: string;\n  policyDigest: string;\n  payload: unknown;\n  /** Signature over canonicalWorkerProtocolRequestBytes(request). */\n  signature: string;\n}\n\nexport type WorkerProtocolResponse =\n  | {\n    apiVersion: typeof WORKER_PROTOCOL_VERSION;\n    requestId: string;\n    ok: true;\n    payload: unknown;\n    receivedAt: string;\n  }\n  | {\n    apiVersion: typeof WORKER_PROTOCOL_VERSION;\n    requestId: string;\n    ok: false;\n    error: OrchestrationErrorData;\n    receivedAt: string;\n  };\n\nexport interface WorkerBootstrapSessionDescriptor {\n  apiVersion: typeof WORKER_PROTOCOL_VERSION;\n  sessionName: string;\n  audience: string;\n  expiresAt: string;\n  run: WorkerRunBinding;\n  policyDigest: string;\n  allowedMethods: WorkerProtocolMethod[];\n  allowedTargets?: string[];\n  workerKeyFingerprint: string;\n  gatewayKeyFingerprint: string;\n  issuedAt: string;\n}\n\nexport interface SignedWorkerBootstrapSessionDescriptor extends WorkerBootstrapSessionDescriptor {\n  /** Gateway signature over canonicalWorkerBootstrapDescriptorBytes(...). */\n  gatewaySignature: string;\n}\n\nexport interface WorkerGatewaySession {\n  name: string;\n  workerKeyFingerprint: string;\n  workerPublicKey: string;\n  audience: string;\n  protocol: typeof WORKER_PROTOCOL_VERSION;\n  expiresAt: string;\n  revoked: boolean;\n  run: WorkerRunBinding;\n  policyDigest: string;\n  allowedMethods: WorkerProtocolMethod[];\n  allowedTargets?: string[];\n}\n\nexport interface WorkerProtocolReplayProtector {\n  /**\n   * Atomically accept exactly the next sequence and a fresh nonce.\n   * Production implementations must persist this state; returning false\n   * fails closed on replay, gaps, or uncertain state.\n   */\n  consume(sessionName: string, sequence: number, nonce: string): Promise<boolean>;\n}\n\nexport interface WorkerProtocolGatewayOptions {\n  resolveSession: (sessionName: string) => Promise<WorkerGatewaySession | undefined>;\n  replayProtector: WorkerProtocolReplayProtector;\n  verifySignature: (request: {\n    session: WorkerGatewaySession;\n    message: Uint8Array;\n    signature: string;\n  }) => Promise<boolean>;\n  dispatch: (request: {\n    requestId: string;\n    session: WorkerGatewaySession;\n    method: WorkerProtocolMethod;\n    target: string;\n    payload: unknown;\n    signal: AbortSignal;\n  }) => Promise<unknown>;\n  now?: () => Date;\n  maxClockSkewMs?: number;\n  maxRequestsPerMinute?: number;\n  methodPayloadLimits?: Partial<Record<WorkerProtocolMethod, number>>;\n  maxResponseBytes?: number;\n  onAudit?: (event: WorkerProtocolAuditEvent) => Promise<void> | void;\n  /** Trusted host diagnostics; never serialized to the worker response. */\n  onError?: (error: unknown) => void;\n}\n\nexport interface WorkerProtocolAuditEvent {\n  requestId: string;\n  sessionName: string;\n  method: string;\n  target: string;\n  /** Policy snapshot from the verified request/session binding. */\n  policyDigest: string;\n  accepted: boolean;\n  code?: OrchestrationErrorData['code'];\n  receivedAt: string;\n}\n\nconst DEFAULT_PAYLOAD_LIMITS: Record<WorkerProtocolMethod, number> = {\n  'assignment.pull': 1024,\n  'assignment.ack': 4096,\n  'session.heartbeat': 4096,\n  'event.submit': 64 * 1024,\n  'capability.request': 32 * 1024,\n  'artifact.upload': 1024 * 1024,\n  'operation.complete': 64 * 1024,\n  'operation.fail': 32 * 1024,\n  'operation.cancel': 4096,\n};\n\nconst DEFAULT_MAX_RESPONSE_BYTES = 1024 * 1024;\nconst DEFAULT_RATE_PER_MINUTE = 120;\nconst DEFAULT_MAX_CLOCK_SKEW_MS = 30_000;\nconst encoder = new TextEncoder();\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction canonicalize(value: unknown): string {\n  if (value === null || typeof value === 'boolean' || typeof value === 'string') return JSON.stringify(value);\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) throw new Error('non-finite number');\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) return `[${value.map(canonicalize).join(',')}]`;\n  if (isRecord(value)) {\n    const entries = Object.entries(value)\n      .filter(([, item]) => item !== undefined)\n      .sort(([left], [right]) => left.localeCompare(right))\n      .map(([key, item]) => `${JSON.stringify(key)}:${canonicalize(item)}`);\n    return `{${entries.join(',')}}`;\n  }\n  throw new Error('worker protocol values must be JSON-compatible');\n}\n\n/** Canonical bytes signed by the worker; excludes only the signature field. */\nexport function canonicalWorkerProtocolRequestBytes(\n  request: Omit<WorkerProtocolRequest, 'signature'> | WorkerProtocolRequest,\n): Uint8Array {\n  const { signature: _signature, ...unsigned } = request as WorkerProtocolRequest;\n  return encoder.encode(canonicalize(unsigned));\n}\n\n/** Canonical bytes signed by the pinned gateway after enrollment. */\nexport function canonicalWorkerBootstrapDescriptorBytes(\n  descriptor: WorkerBootstrapSessionDescriptor | SignedWorkerBootstrapSessionDescriptor,\n): Uint8Array {\n  const { gatewaySignature: _gatewaySignature, ...unsigned } = descriptor as SignedWorkerBootstrapSessionDescriptor;\n  return encoder.encode(canonicalize(unsigned));\n}\n\nfunction byteSize(value: unknown): number {\n  return encoder.encode(canonicalize(value)).byteLength;\n}\n\nfunction protocolError(\n  code: OrchestrationErrorData['code'],\n  message: string,\n  retryable = false,\n): OrchestrationError {\n  return new OrchestrationError({ code, message, retryable });\n}\n\nfunction validateShape(request: WorkerProtocolRequest): void {\n  if (request.apiVersion !== WORKER_PROTOCOL_VERSION) {\n    throw protocolError('UNSUPPORTED', `worker protocol '${String(request.apiVersion)}' is not supported`);\n  }\n  if (\n    !request.requestId ||\n    !request.sessionName ||\n    !Number.isSafeInteger(request.sequence) ||\n    request.sequence < 1 ||\n    !/^[A-Za-z0-9_-]{16,128}$/.test(request.nonce) ||\n    !request.audience ||\n    !request.target ||\n    !request.policyDigest ||\n    !request.signature\n  ) {\n    throw protocolError('INVALID', 'worker protocol request envelope is malformed');\n  }\n  if (\n    !request.run?.uid ||\n    !Number.isSafeInteger(request.run.attempt) ||\n    request.run.attempt < 1 ||\n    !Number.isSafeInteger(request.run.epoch) ||\n    request.run.epoch < 1\n  ) {\n    throw protocolError('INVALID', 'worker protocol Run binding is malformed');\n  }\n  if (!WORKER_PROTOCOL_METHODS.includes(request.method)) {\n    throw protocolError('FORBIDDEN', `worker protocol method '${request.method}' is not allowed`);\n  }\n}\n\nfunction sameRun(left: WorkerRunBinding, right: WorkerRunBinding): boolean {\n  return left.uid === right.uid && left.attempt === right.attempt && left.epoch === right.epoch;\n}\n\nfunction asError(error: unknown): OrchestrationErrorData {\n  if (error instanceof OrchestrationError) {\n    const publicMessage: Partial<Record<OrchestrationErrorData['code'], string>> = {\n      INVALID: 'worker gateway request is invalid',\n      FORBIDDEN: 'worker gateway request was denied',\n      NOT_FOUND: 'worker gateway target is unavailable',\n      UNSUPPORTED: 'worker gateway request is unsupported',\n      TIMEOUT: 'worker gateway request expired',\n      CONFLICT: 'worker gateway request conflicts with session state',\n      EXHAUSTED: 'worker gateway request exceeded a limit',\n      INTERNAL: 'worker gateway request failed',\n      UNAVAILABLE: 'worker gateway is unavailable',\n    };\n    return {\n      code: error.code,\n      message: publicMessage[error.code] ?? 'worker gateway request failed',\n      retryable: error.retryable,\n      ...(error.retryAfterMs !== undefined ? { retryAfterMs: error.retryAfterMs } : {}),\n    };\n  }\n  return { code: 'INTERNAL', message: 'worker gateway request failed', retryable: false };\n}\n\n/**\n * Create the trusted-side protocol gateway. Session resolution, signature\n * verification, replay state, and effects are all injected host ports.\n */\nexport function createWorkerProtocolGateway(options: WorkerProtocolGatewayOptions): {\n  handle(request: WorkerProtocolRequest, signal?: AbortSignal): Promise<WorkerProtocolResponse>;\n} {\n  const now = options.now ?? (() => new Date());\n  const maxClockSkewMs = options.maxClockSkewMs ?? DEFAULT_MAX_CLOCK_SKEW_MS;\n  const rateLimit = options.maxRequestsPerMinute ?? DEFAULT_RATE_PER_MINUTE;\n  const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;\n  const requestLog = new Map<string, number[]>();\n\n  async function audit(\n    request: Pick<WorkerProtocolRequest, 'requestId' | 'sessionName' | 'method' | 'target' | 'policyDigest'>,\n    accepted: boolean,\n    receivedAt: string,\n    code?: OrchestrationErrorData['code'],\n  ): Promise<void> {\n    try {\n      await options.onAudit?.({\n        requestId: request.requestId,\n        sessionName: request.sessionName,\n        method: request.method,\n        target: request.target,\n        policyDigest: request.policyDigest,\n        accepted,\n        ...(code ? { code } : {}),\n        receivedAt,\n      });\n    } catch {\n      // Audit storage failure must not leak request payloads or replace the\n      // original protocol result. Hosts should alert through their sink.\n    }\n  }\n\n  return {\n    async handle(request, signal = new AbortController().signal) {\n      const received = now();\n      const receivedAt = received.toISOString();\n      try {\n        validateShape(request);\n        const deadline = new Date(request.deadline);\n        if (!Number.isFinite(deadline.getTime()) || deadline.getTime() < received.getTime()) {\n          throw protocolError('TIMEOUT', 'worker protocol request deadline has expired');\n        }\n        if (deadline.getTime() - received.getTime() > maxClockSkewMs) {\n          throw protocolError('INVALID', 'worker protocol request deadline is outside the allowed window');\n        }\n        const payloadLimit = options.methodPayloadLimits?.[request.method] ?? DEFAULT_PAYLOAD_LIMITS[request.method];\n        if (byteSize(request.payload) > payloadLimit) {\n          throw protocolError('INVALID', `worker protocol payload exceeds ${payloadLimit} bytes`);\n        }\n\n        const session = await options.resolveSession(request.sessionName);\n        if (!session || session.revoked) throw protocolError('FORBIDDEN', 'worker session is unavailable or revoked');\n        if (session.protocol !== WORKER_PROTOCOL_VERSION) throw protocolError('UNSUPPORTED', 'worker session protocol is not supported');\n        if (new Date(session.expiresAt).getTime() <= received.getTime()) {\n          throw protocolError('TIMEOUT', 'worker session has expired');\n        }\n        if (\n          session.audience !== request.audience ||\n          session.policyDigest !== request.policyDigest ||\n          !sameRun(session.run, request.run)\n        ) {\n          throw protocolError('FORBIDDEN', 'worker request scope does not match its session');\n        }\n        if (!session.allowedMethods.includes(request.method)) {\n          throw protocolError('FORBIDDEN', `worker session does not allow '${request.method}'`);\n        }\n        if (session.allowedTargets && !session.allowedTargets.includes(request.target)) {\n          throw protocolError('FORBIDDEN', `worker session does not allow target '${request.target}'`);\n        }\n        if (\n          !await options.verifySignature({\n            session,\n            message: canonicalWorkerProtocolRequestBytes(request),\n            signature: request.signature,\n          })\n        ) {\n          throw protocolError('FORBIDDEN', 'worker request signature is invalid');\n        }\n        if (!await options.replayProtector.consume(session.name, request.sequence, request.nonce)) {\n          throw protocolError('CONFLICT', 'worker request sequence or nonce was already consumed');\n        }\n\n        const windowStart = received.getTime() - 60_000;\n        const log = (requestLog.get(session.name) ?? []).filter((time) => time >= windowStart);\n        if (log.length >= rateLimit) {\n          throw new OrchestrationError({\n            code: 'EXHAUSTED',\n            message: 'worker protocol session rate limit exceeded',\n            retryable: true,\n            retryAfterMs: Math.max(1, log[0] + 60_000 - received.getTime()),\n          });\n        }\n        log.push(received.getTime());\n        requestLog.set(session.name, log);\n\n        const payload = await options.dispatch({\n          requestId: request.requestId,\n          session,\n          method: request.method,\n          target: request.target,\n          payload: request.payload,\n          signal,\n        });\n        if (byteSize(payload) > maxResponseBytes) {\n          throw protocolError('EXHAUSTED', `worker protocol response exceeds ${maxResponseBytes} bytes`);\n        }\n        await audit(request, true, receivedAt);\n        return {\n          apiVersion: WORKER_PROTOCOL_VERSION,\n          requestId: request.requestId,\n          ok: true,\n          payload,\n          receivedAt,\n        };\n      } catch (error) {\n        options.onError?.(error);\n        const data = asError(error);\n        await audit(request, false, receivedAt, data.code);\n        return {\n          apiVersion: WORKER_PROTOCOL_VERSION,\n          requestId: typeof request?.requestId === 'string' ? request.requestId : '',\n          ok: false,\n          error: data,\n          receivedAt,\n        };\n      }\n    },\n  };\n}\n\n/** In-memory replay fixture. Production gateways must use durable state. */\nexport function createInMemoryWorkerReplayProtector(): WorkerProtocolReplayProtector {\n  const states = new Map<string, { sequence: number; nonces: Set<string> }>();\n  return {\n    async consume(sessionName, sequence, nonce) {\n      const state = states.get(sessionName);\n      if ((!state && sequence !== 1) || (state && sequence !== state.sequence + 1) || state?.nonces.has(nonce)) {\n        return false;\n      }\n      const nonces = state?.nonces ?? new Set<string>();\n      nonces.add(nonce);\n      states.set(sessionName, { sequence, nonces });\n      return true;\n    },\n  };\n}\n","import type { OrchestrationResource, OrchestrationResourceStatus } from '../client.js';\nimport type { ControlStore, ControlStoreActor } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\nimport type { WorkerGatewaySession, WorkerProtocolMethod, WorkerRunBinding } from './workerProtocol.js';\n\nexport const WORKLOAD_CAPABILITY_GRANT_API_VERSION = 'security.memeloop.io/v1alpha1';\nexport const WORKLOAD_CAPABILITY_GRANT_KIND = 'WorkloadCapabilityGrant';\n\nexport interface WorkloadCapabilityBudget {\n  maxRequests: number;\n  maxInputBytes?: number;\n  maxOutputBytes?: number;\n  maxTokens?: number;\n  maxCost?: number;\n}\n\nexport interface WorkloadCapabilityGrantSpec {\n  /** Stable identity included in the signed claims; must equal metadata.name. */\n  grantId: string;\n  sessionRef: {\n    apiVersion: string;\n    kind: 'WorkerSession';\n    name: string;\n  };\n  run: WorkerRunBinding;\n  workerKeyFingerprint: string;\n  /** Pinned gateway/channel identity, never a worker-provided label. */\n  channelBinding: string;\n  audience: string;\n  protocol: string;\n  protocolMethod: WorkerProtocolMethod;\n  capability: string;\n  target: string;\n  policyDigest: string;\n  budget: WorkloadCapabilityBudget;\n  issuedAt: string;\n  expiresAt: string;\n  issuedBy: string;\n  /** Gateway signature over canonicalWorkloadCapabilityGrantBytes(spec). */\n  signature: string;\n}\n\nexport interface WorkloadCapabilityGrantStatus extends OrchestrationResourceStatus {\n  phase?: 'Authorized' | 'Consumed' | 'Revoked' | 'Expired' | 'Failed';\n  consumedAt?: string;\n  revokedAt?: string;\n  reason?: string;\n}\n\nexport type WorkloadCapabilityGrantResource =\n  & Omit<\n    OrchestrationResource<WorkloadCapabilityGrantSpec>,\n    'status'\n  >\n  & {\n    status?: WorkloadCapabilityGrantStatus;\n  };\n\nexport interface IssueWorkloadCapabilityGrantRequest {\n  grantId: string;\n  session: WorkerGatewaySession;\n  channelBinding: string;\n  protocolMethod: WorkerProtocolMethod;\n  capability: string;\n  target: string;\n  budget: WorkloadCapabilityBudget;\n  ttlMs: number;\n}\n\nexport interface WorkloadCapabilityGrantRequirements {\n  grantId: string;\n  sessionName: string;\n  run: WorkerRunBinding;\n  workerKeyFingerprint: string;\n  channelBinding: string;\n  audience: string;\n  protocol: string;\n  protocolMethod: WorkerProtocolMethod;\n  capability: string;\n  target: string;\n  policyDigest: string;\n}\n\nconst encoder = new TextEncoder();\n\nfunction canonicalize(value: unknown): string {\n  if (value === null || typeof value === 'boolean' || typeof value === 'string') {\n    return JSON.stringify(value);\n  }\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) throw new Error('non-finite number');\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) return `[${value.map(canonicalize).join(',')}]`;\n  if (value && typeof value === 'object') {\n    return `{${\n      Object.entries(value)\n        .filter(([, item]) => item !== undefined)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([key, item]) => `${JSON.stringify(key)}:${canonicalize(item)}`)\n        .join(',')\n    }}`;\n  }\n  throw new Error('capability grant values must be JSON-compatible');\n}\n\nexport function canonicalWorkloadCapabilityGrantBytes(\n  spec: WorkloadCapabilityGrantSpec | Omit<WorkloadCapabilityGrantSpec, 'signature'>,\n): Uint8Array {\n  const { signature: _signature, ...claims } = spec as WorkloadCapabilityGrantSpec;\n  return encoder.encode(canonicalize(claims));\n}\n\nexport function createWorkloadCapabilityGrantManifest(\n  name: string,\n  spec: WorkloadCapabilityGrantSpec,\n): {\n  apiVersion: typeof WORKLOAD_CAPABILITY_GRANT_API_VERSION;\n  kind: typeof WORKLOAD_CAPABILITY_GRANT_KIND;\n  metadata: { name: string };\n  spec: WorkloadCapabilityGrantSpec;\n} {\n  return {\n    apiVersion: WORKLOAD_CAPABILITY_GRANT_API_VERSION,\n    kind: WORKLOAD_CAPABILITY_GRANT_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isWorkloadCapabilityGrant(\n  resource: { apiVersion?: string; kind?: string },\n): resource is WorkloadCapabilityGrantResource {\n  return resource.apiVersion === WORKLOAD_CAPABILITY_GRANT_API_VERSION &&\n    resource.kind === WORKLOAD_CAPABILITY_GRANT_KIND;\n}\n\nfunction assertBudget(budget: WorkloadCapabilityBudget): void {\n  if (!Number.isSafeInteger(budget.maxRequests) || budget.maxRequests < 1) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: 'capability grant maxRequests must be a positive integer',\n      retryable: false,\n    });\n  }\n  for (const [name, value] of Object.entries(budget)) {\n    if (value !== undefined && (!Number.isFinite(value) || value < 0)) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: `capability grant budget '${name}' must be finite and non-negative`,\n        retryable: false,\n      });\n    }\n  }\n}\n\n/** Issue and durably record one host-authorized capability grant. */\nexport async function issueWorkloadCapabilityGrant(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  request: IssueWorkloadCapabilityGrantRequest,\n  sign: (message: Uint8Array) => Promise<string> | string,\n  now: () => Date = () => new Date(),\n): Promise<WorkloadCapabilityGrantResource> {\n  if (actor.kind !== 'controller' && actor.kind !== 'admin') {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'workload capability grants require a trusted controller or admin',\n      retryable: false,\n    });\n  }\n  const issuedAt = now();\n  const sessionExpiry = new Date(request.session.expiresAt);\n  if (\n    request.session.revoked ||\n    !Number.isFinite(sessionExpiry.getTime()) ||\n    sessionExpiry <= issuedAt ||\n    !request.grantId ||\n    !request.channelBinding ||\n    !request.capability ||\n    !request.target ||\n    !Number.isFinite(request.ttlMs) ||\n    request.ttlMs <= 0\n  ) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'capability grant request or worker session is not usable',\n      retryable: false,\n    });\n  }\n  if (\n    !request.session.allowedMethods.includes(request.protocolMethod) ||\n    (request.session.allowedTargets &&\n      !request.session.allowedTargets.includes(request.target))\n  ) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'capability grant exceeds the worker session scope',\n      retryable: false,\n    });\n  }\n  assertBudget(request.budget);\n  const expiresAt = new Date(\n    Math.min(sessionExpiry.getTime(), issuedAt.getTime() + request.ttlMs),\n  ).toISOString();\n  const unsigned: Omit<WorkloadCapabilityGrantSpec, 'signature'> = {\n    grantId: request.grantId,\n    sessionRef: {\n      apiVersion: 'security.memeloop.io/v1alpha1',\n      kind: 'WorkerSession',\n      name: request.session.name,\n    },\n    run: request.session.run,\n    workerKeyFingerprint: request.session.workerKeyFingerprint,\n    channelBinding: request.channelBinding,\n    audience: request.session.audience,\n    protocol: request.session.protocol,\n    protocolMethod: request.protocolMethod,\n    capability: request.capability,\n    target: request.target,\n    policyDigest: request.session.policyDigest,\n    budget: request.budget,\n    issuedAt: issuedAt.toISOString(),\n    expiresAt,\n    issuedBy: actor.id,\n  };\n  const signature = await sign(canonicalWorkloadCapabilityGrantBytes(unsigned));\n  if (!signature) {\n    throw new OrchestrationError({\n      code: 'INTERNAL',\n      message: 'capability grant signer returned no signature',\n      retryable: false,\n    });\n  }\n  const created = await store.create(\n    actor,\n    createWorkloadCapabilityGrantManifest(request.grantId, {\n      ...unsigned,\n      signature,\n    }),\n  ) as WorkloadCapabilityGrantResource;\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-arguments -- required for the grant-specific status shape\n  const active = await store.updateStatus<WorkloadCapabilityGrantSpec, WorkloadCapabilityGrantStatus>(\n    actor,\n    {\n      apiVersion: WORKLOAD_CAPABILITY_GRANT_API_VERSION,\n      kind: WORKLOAD_CAPABILITY_GRANT_KIND,\n      name: request.grantId,\n    },\n    { phase: 'Authorized' },\n    { resourceVersion: created.metadata.resourceVersion },\n  );\n  return active as WorkloadCapabilityGrantResource;\n}\n\n/** Verify signature, expiry, lifecycle, and every authority-bearing claim. */\nexport async function verifyWorkloadCapabilityGrant(\n  grant: WorkloadCapabilityGrantResource,\n  requirements: WorkloadCapabilityGrantRequirements,\n  verify: (message: Uint8Array, signature: string) => Promise<boolean> | boolean,\n  now: () => Date = () => new Date(),\n): Promise<void> {\n  const spec = grant.spec;\n  const issuedAt = new Date(spec.issuedAt).getTime();\n  const expiresAt = new Date(spec.expiresAt).getTime();\n  const currentTime = now().getTime();\n  const exact = grant.metadata.name === requirements.grantId &&\n    spec.grantId === requirements.grantId &&\n    spec.sessionRef.name === requirements.sessionName &&\n    spec.run.uid === requirements.run.uid &&\n    spec.run.attempt === requirements.run.attempt &&\n    spec.run.epoch === requirements.run.epoch &&\n    spec.workerKeyFingerprint === requirements.workerKeyFingerprint &&\n    spec.channelBinding === requirements.channelBinding &&\n    spec.audience === requirements.audience &&\n    spec.protocol === requirements.protocol &&\n    spec.protocolMethod === requirements.protocolMethod &&\n    spec.capability === requirements.capability &&\n    spec.target === requirements.target &&\n    spec.policyDigest === requirements.policyDigest;\n  if (\n    !exact ||\n    grant.status?.phase !== 'Authorized' ||\n    !Number.isFinite(issuedAt) ||\n    !Number.isFinite(expiresAt) ||\n    issuedAt > currentTime ||\n    expiresAt <= currentTime ||\n    expiresAt <= issuedAt ||\n    !await verify(canonicalWorkloadCapabilityGrantBytes(spec), spec.signature)\n  ) {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: 'workload capability grant verification failed',\n      retryable: false,\n    });\n  }\n  assertBudget(spec.budget);\n}\n\n/** Atomically consume a single-use grant before invoking the capability. */\nexport async function consumeWorkloadCapabilityGrant(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  grant: WorkloadCapabilityGrantResource,\n  now: () => Date = () => new Date(),\n): Promise<WorkloadCapabilityGrantResource> {\n  if (grant.status?.phase !== 'Authorized' || grant.spec.budget.maxRequests !== 1) {\n    throw new OrchestrationError({\n      code: 'CONFLICT',\n      message: 'workload capability grant is not a fresh single-use authorization',\n      retryable: false,\n    });\n  }\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-arguments -- required for the grant-specific status shape\n  return await store.updateStatus<WorkloadCapabilityGrantSpec, WorkloadCapabilityGrantStatus>(\n    actor,\n    {\n      apiVersion: WORKLOAD_CAPABILITY_GRANT_API_VERSION,\n      kind: WORKLOAD_CAPABILITY_GRANT_KIND,\n      name: grant.metadata.name,\n    },\n    { ...grant.status, phase: 'Consumed', consumedAt: now().toISOString() },\n    { resourceVersion: grant.metadata.resourceVersion },\n  ) as WorkloadCapabilityGrantResource;\n}\n","import type {\n  OrchestrationDeleteOptions,\n  OrchestrationDeleteResult,\n  OrchestrationResource,\n  OrchestrationResourceList,\n  OrchestrationResourceManifest,\n  OrchestrationResourceQuery,\n  OrchestrationResourceReference,\n  OrchestrationResourceStatus,\n  OrchestrationResourceWatchEvent,\n  OrchestrationWatchEvent,\n  OrchestrationWatchOptions,\n} from '../client.js';\nimport type {\n  ControlLeaseGrant,\n  ControlLeaseIdentity,\n  ControlLeaseRequest,\n  ControlStore,\n  ControlStoreActor,\n  ControlStoreApplyOptions,\n  ControlStoreAuthorizer,\n  ControlStoreCompactionResult,\n  ControlStoreCreateOptions,\n  ControlStoreHealth,\n  ControlStoreSnapshotResult,\n  ControlStoreStatusUpdateOptions,\n} from '../controlStore.js';\nimport { canonicalControlStoreValue, controlStoreApplyMatches } from '../controlStore.js';\nimport { OrchestrationError } from '../errors.js';\n\n// ─── Quorum Types ────────────────────────────────────────────────────────\n\nexport interface QuorumMember {\n  id: string;\n  peerUrls: string[];\n  isLearner: boolean;\n}\n\nexport interface QuorumTopology {\n  members: QuorumMember[];\n  leaderId?: string;\n  term: number;\n}\n\n// ─── Internal State ──────────────────────────────────────────────────────\n\ninterface StoredResource {\n  resource: OrchestrationResource;\n  revision: number;\n  deleted: boolean;\n}\n\ninterface LeaseEntry {\n  holder: string;\n  leaseId: string;\n  epoch: string;\n  acquiredAt: number;\n  renewedAt: number;\n  expiresAt: number;\n}\n\n/**\n * Serializable point-in-time state of a QuorumControlStore. Portable core\n * cannot write files, so persistence flows through `exportSnapshot()` /\n * `restoreSnapshot()`; the host decides where bytes live. Live leases and\n * their timers are ephemeral and intentionally excluded; per-name fencing\n * epochs are preserved so a restored store never re-issues epoch 1.\n */\nexport interface QuorumControlStoreSnapshot {\n  revision: number;\n  compactedRevision?: number;\n  term: number;\n  voters: string[];\n  learners: string[];\n  quorumSize: number;\n  leaseEpochs: Record<string, number>;\n  resources: Array<{\n    key: string;\n    resource: OrchestrationResource;\n    revision: number;\n    deleted: boolean;\n  }>;\n  idempotency?: Array<{\n    key: string;\n    requestDigest: string;\n    response: unknown;\n  }>;\n  watchEvents?: Array<{\n    key: string;\n    event: OrchestrationResourceWatchEvent;\n  }>;\n  createdAt: string;\n}\n\ninterface WatchSubscription {\n  query: OrchestrationResourceQuery;\n  sinceRevision: number;\n  /** Deliver a matched event; the iterator buffers events between next() calls. */\n  push: (event: OrchestrationWatchEvent) => void;\n  /** Resolve a pending next() with done (store close / iterator return). */\n  close: () => void;\n}\n\ninterface WatchHistoryEntry {\n  key: string;\n  event: OrchestrationResourceWatchEvent;\n}\n\n// ─── Config ──────────────────────────────────────────────────────────────\n\nexport interface QuorumControlStoreOptions {\n  memberId: string;\n  isLearner?: boolean;\n  authorizer?: ControlStoreAuthorizer;\n  quorumSize?: number;\n  voters?: string[];\n  /** Retained resumable resource events before automatic compaction. */\n  maxWatchEvents?: number;\n}\n\n/**\n * In-process quorum ControlStore (plan 24.59).\n *\n * Implements full ControlStore semantics: multi-voter consensus, learner\n * replication, CAS updates, lease management with epochs, watch subscriptions\n * with revision tracking, compaction, and snapshot. Loss-of-quorum writes\n * are rejected with UNAVAILABLE.\n *\n * A production etcd-backed adapter is planned as a separate package.\n */\nexport class QuorumControlStore implements ControlStore {\n  private isLearner: boolean;\n  private readonly authorizer?: ControlStoreAuthorizer;\n  private quorumSize: number;\n  private readonly voters: Set<string>;\n  private readonly learners = new Set<string>();\n  private readonly memberId: string;\n\n  private readonly data = new Map<string, StoredResource>();\n  private readonly idempotency = new Map<string, {\n    requestDigest: string;\n    response: unknown;\n  }>();\n  private revision = 0;\n  private readonly leases = new Map<string, LeaseEntry>();\n  /** Monotonic fencing epoch per lease name; survives release/expiry and restore. */\n  private readonly leaseEpochs = new Map<string, number>();\n  private readonly watchers = new Map<number, WatchSubscription>();\n  private watcherIdSeq = 0;\n  private readonly watchHistory: WatchHistoryEntry[] = [];\n  private compactedRevision = 0;\n  private readonly maxWatchEvents: number;\n  private readonly leaseTimers = new Map<string, ReturnType<typeof setInterval>>();\n  private closed = false;\n  private term = 1;\n\n  public constructor(options: QuorumControlStoreOptions) {\n    this.memberId = options.memberId;\n    this.isLearner = options.isLearner ?? false;\n    this.authorizer = options.authorizer;\n    this.voters = new Set(options.voters ?? [options.memberId]);\n    this.quorumSize = options.quorumSize ?? Math.max(1, Math.floor(this.voters.size / 2) + 1);\n    this.maxWatchEvents = options.maxWatchEvents ?? 10_000;\n    if (!Number.isSafeInteger(this.maxWatchEvents) || this.maxWatchEvents < 1) {\n      throw new Error('maxWatchEvents must be a positive safe integer');\n    }\n  }\n\n  // ─── Helpers ────────────────────────────────────────────────────────\n\n  private nextRevision(): number {\n    this.revision += 1;\n    return this.revision;\n  }\n\n  private manifestKey(m: OrchestrationResourceManifest): string {\n    const ns = m.metadata.namespace ?? 'default';\n    return `${m.apiVersion}/${m.kind}/${ns}/${m.metadata.name ?? ''}`;\n  }\n\n  private refKey(r: OrchestrationResourceReference): string {\n    const ns = r.namespace ?? 'default';\n    return `${r.apiVersion}/${r.kind}/${ns}/${r.name ?? ''}`;\n  }\n\n  private queryPrefix(q: OrchestrationResourceQuery): string {\n    const ns = q.namespace ?? '';\n    if (q.apiVersion && ns) return `${q.apiVersion}/${q.kind}/${ns}/`;\n    if (q.apiVersion) return `${q.apiVersion}/${q.kind}/`;\n    return '';\n  }\n\n  private matchQuery(key: string, q: OrchestrationResourceQuery): boolean {\n    // apiVersion contains '/' (e.g. models.memeloop.io/v1alpha1), so the key\n    // cannot be parsed by fixed segment indices; match by prefix instead.\n    if (q.apiVersion) {\n      if (!key.startsWith(`${q.apiVersion}/${q.kind}/`)) return false;\n      if (q.namespace) {\n        return key.slice(`${q.apiVersion}/${q.kind}/`.length).startsWith(`${q.namespace}/`);\n      }\n      return true;\n    }\n    if (!key.includes(`/${q.kind}/`)) return false;\n    if (q.namespace && !key.includes(`/${q.kind}/${q.namespace}/`)) return false;\n    return true;\n  }\n\n  private checkQuorum(action: string): void {\n    if (this.closed) throw new Error('store is closed');\n    if (this.voters.size < this.quorumSize) {\n      throw new OrchestrationError({ code: 'UNAVAILABLE', message: `${action}: loss of quorum`, retryable: true });\n    }\n  }\n\n  private notify(key: string, resource: OrchestrationResource, type: OrchestrationResourceWatchEvent['type']): void {\n    const rv = Number(resource.metadata.resourceVersion);\n    const event = {\n      type,\n      resourceVersion: resource.metadata.resourceVersion,\n      resource: structuredClone(resource),\n    } as OrchestrationResourceWatchEvent;\n    this.watchHistory.push({ key, event });\n    while (this.watchHistory.length > this.maxWatchEvents) {\n      const removed = this.watchHistory.shift();\n      if (removed) {\n        this.compactedRevision = Math.max(\n          this.compactedRevision,\n          Number(removed.event.resourceVersion),\n        );\n      }\n    }\n    for (const sub of this.watchers.values()) {\n      if (!key.startsWith(this.queryPrefix(sub.query))) continue;\n      if (!this.matchQuery(key, sub.query)) continue;\n      if (rv <= sub.sinceRevision) continue;\n      sub.sinceRevision = rv;\n      sub.push(structuredClone(event));\n    }\n  }\n\n  // ─── CRUD ───────────────────────────────────────────────────────────\n\n  public async get<TSpec, TStatus>(reference: OrchestrationResourceReference): Promise<OrchestrationResource<TSpec, TStatus> | null> {\n    const s = this.data.get(this.refKey(reference));\n    if (!s || s.deleted) return null;\n    return structuredClone(s.resource) as unknown as OrchestrationResource<TSpec, TStatus>;\n  }\n\n  public async list<TSpec, TStatus>(query: OrchestrationResourceQuery): Promise<OrchestrationResourceList<TSpec, TStatus>> {\n    const items: Array<OrchestrationResource<TSpec, TStatus>> = [];\n    for (const [key, s] of this.data) {\n      if (s.deleted) continue;\n      if (!this.matchQuery(key, query)) continue;\n      items.push(structuredClone(s.resource) as unknown as OrchestrationResource<TSpec, TStatus>);\n    }\n    return { items, resourceVersion: String(this.revision) };\n  }\n\n  public watch<TSpec, TStatus>(\n    query: OrchestrationResourceQuery,\n    options: OrchestrationWatchOptions = {},\n  ): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>> {\n    // eslint-disable-next-line @typescript-eslint/no-this-alias\n    const self = this;\n    let done = false;\n    return {\n      [Symbol.asyncIterator]() {\n        // Buffered subscription: events arriving between next() calls are\n        // queued, so back-to-back writes are never lost (the previous\n        // one-shot subscription dropped events in the re-registration gap).\n        const buffer: Array<OrchestrationWatchEvent<TSpec, TStatus>> = [];\n        let waiting: ((result: IteratorResult<OrchestrationWatchEvent<TSpec, TStatus>>) => void) | null = null;\n        const id = self.watcherIdSeq++;\n        const snapshotRevision = self.revision;\n        const requestedRevision = options.resourceVersion === undefined\n          ? snapshotRevision\n          : Number(options.resourceVersion);\n        if (\n          !Number.isSafeInteger(requestedRevision) ||\n          requestedRevision < 0 ||\n          requestedRevision > snapshotRevision\n        ) {\n          buffer.push({\n            type: 'ERROR',\n            resourceVersion: String(snapshotRevision),\n            terminal: true,\n            error: {\n              code: 'INVALID',\n              message: `invalid watch resourceVersion '${String(options.resourceVersion)}'`,\n              retryable: false,\n            },\n          });\n          done = true;\n        } else if (requestedRevision < self.compactedRevision) {\n          buffer.push({\n            type: 'ERROR',\n            resourceVersion: String(self.compactedRevision),\n            terminal: true,\n            error: {\n              code: 'WATCH_COMPACTED',\n              message: `resourceVersion ${requestedRevision} was compacted`,\n              retryable: true,\n            },\n          });\n          done = true;\n        }\n        if (!done && options.sendInitialEvents) {\n          for (const [key, stored] of self.data) {\n            if (\n              stored.deleted ||\n              stored.revision > snapshotRevision ||\n              !self.matchQuery(key, query)\n            ) continue;\n            buffer.push({\n              type: 'ADDED',\n              resourceVersion: stored.resource.metadata.resourceVersion,\n              resource: structuredClone(stored.resource),\n            } as OrchestrationWatchEvent<TSpec, TStatus>);\n          }\n          buffer.push({\n            type: 'BOOKMARK',\n            resourceVersion: String(snapshotRevision),\n          });\n        } else if (!done && options.resourceVersion !== undefined) {\n          for (const entry of self.watchHistory) {\n            const revision = Number(entry.event.resourceVersion);\n            if (\n              revision <= requestedRevision ||\n              revision > snapshotRevision ||\n              !self.matchQuery(entry.key, query)\n            ) continue;\n            buffer.push(\n              structuredClone(entry.event) as OrchestrationWatchEvent<TSpec, TStatus>,\n            );\n          }\n        }\n        let timeout: ReturnType<typeof setTimeout> | undefined;\n        const finishWaiting = (): void => {\n          const resolve = waiting;\n          waiting = null;\n          resolve?.({ done: true, value: undefined });\n        };\n        const close = (): void => {\n          done = true;\n          if (timeout) clearTimeout(timeout);\n          options.signal?.removeEventListener('abort', close);\n          finishWaiting();\n          self.watchers.delete(id);\n        };\n        if (!done) {\n          self.watchers.set(id, {\n            query,\n            sinceRevision: snapshotRevision,\n            push: (event) => {\n              if (waiting) {\n                const resolve = waiting;\n                waiting = null;\n                resolve({ done: false, value: event as OrchestrationWatchEvent<TSpec, TStatus> });\n              } else {\n                buffer.push(event as OrchestrationWatchEvent<TSpec, TStatus>);\n              }\n            },\n            close,\n          });\n        }\n        options.signal?.addEventListener('abort', close, { once: true });\n        if (options.signal?.aborted) close();\n        if (!done && options.timeoutMs !== undefined) {\n          timeout = setTimeout(close, Math.max(0, options.timeoutMs));\n        }\n        return {\n          async next(): Promise<IteratorResult<OrchestrationWatchEvent<TSpec, TStatus>>> {\n            const buffered = buffer.shift();\n            if (buffered !== undefined) return { done: false, value: buffered };\n            if (done || self.closed) return { done: true, value: undefined };\n            return new Promise((resolve) => {\n              waiting = resolve;\n            });\n          },\n          async return() {\n            close();\n            return { done: true, value: undefined };\n          },\n        };\n      },\n    };\n  }\n\n  public async create<TSpec, TStatus>(\n    actor: ControlStoreActor,\n    resource: OrchestrationResourceManifest<TSpec>,\n    options?: ControlStoreCreateOptions,\n  ): Promise<OrchestrationResource<TSpec, TStatus>> {\n    this.checkQuorum('create');\n    const key = this.manifestKey(resource as OrchestrationResourceManifest);\n\n    const requestDigest = canonicalControlStoreValue({ actor, resource });\n    if (options?.idempotencyKey) {\n      const replay = this.idempotency.get(`create:${options.idempotencyKey}`);\n      if (replay) {\n        if (replay.requestDigest !== requestDigest) {\n          throw new OrchestrationError({\n            code: 'CONFLICT',\n            message: 'idempotency key was reused for another create request',\n            retryable: false,\n          });\n        }\n        return structuredClone(replay.response) as OrchestrationResource<TSpec, TStatus>;\n      }\n    }\n\n    if (this.data.has(key)) {\n      throw new OrchestrationError({ code: 'CONFLICT', message: `resource ${key} already exists`, retryable: false });\n    }\n\n    this.authorizer?.authorize({\n      actor,\n      verb: 'create',\n      reference: {\n        apiVersion: resource.apiVersion,\n        kind: resource.kind,\n        name: resource.metadata.name,\n        namespace: resource.metadata.namespace,\n      },\n      proposedResource: resource as OrchestrationResourceManifest,\n    });\n    const rv = options?.dryRun ? this.revision : this.nextRevision();\n    const uid = `${resource.kind}-${resource.metadata.namespace ?? 'default'}-${resource.metadata.name ?? ''}-${rv}`;\n    const result: OrchestrationResource = {\n      apiVersion: resource.apiVersion,\n      kind: resource.kind,\n      metadata: {\n        name: resource.metadata.name ?? '',\n        namespace: resource.metadata.namespace ?? 'default',\n        uid,\n        generation: 1,\n        resourceVersion: String(rv),\n        creationTimestamp: new Date().toISOString(),\n        labels: resource.metadata.labels,\n        annotations: resource.metadata.annotations,\n        ownerReferences: resource.metadata.ownerReferences,\n        finalizers: resource.metadata.finalizers,\n      },\n      spec: resource.spec as Record<string, unknown>,\n    };\n\n    if (!options?.dryRun) {\n      this.data.set(key, { resource: result, revision: rv, deleted: false });\n      if (options?.idempotencyKey) {\n        this.idempotency.set(`create:${options.idempotencyKey}`, {\n          requestDigest,\n          response: structuredClone(result),\n        });\n      }\n      this.notify(key, result, 'ADDED');\n    }\n    return result as unknown as OrchestrationResource<TSpec, TStatus>;\n  }\n\n  public async apply<TSpec, TStatus>(\n    actor: ControlStoreActor,\n    resource: OrchestrationResourceManifest<TSpec>,\n    options: ControlStoreApplyOptions = {},\n  ): Promise<OrchestrationResource<TSpec, TStatus>> {\n    this.checkQuorum('apply');\n    const key = this.manifestKey(resource as OrchestrationResourceManifest);\n    const idempotencyKey = options.idempotencyKey\n      ? `apply:${options.idempotencyKey}`\n      : undefined;\n    const fingerprint = canonicalControlStoreValue({ actor, resource });\n    if (idempotencyKey) {\n      const replay = this.idempotency.get(idempotencyKey);\n      if (replay) {\n        if (replay.requestDigest !== fingerprint) {\n          throw new OrchestrationError({\n            code: 'CONFLICT',\n            message: 'idempotency key was reused for another apply request',\n            retryable: false,\n          });\n        }\n        return structuredClone(replay.response) as OrchestrationResource<TSpec, TStatus>;\n      }\n    }\n    const stored = this.data.get(key);\n    if (!stored || stored.deleted) {\n      const created = await this.create<TSpec, TStatus>(actor, resource, {\n        ...(options.dryRun !== undefined ? { dryRun: options.dryRun } : {}),\n      });\n      if (idempotencyKey && !options.dryRun) {\n        this.idempotency.set(idempotencyKey, {\n          requestDigest: fingerprint,\n          response: structuredClone(created) as unknown as OrchestrationResource,\n        });\n      }\n      return created;\n    }\n    if (\n      controlStoreApplyMatches(\n        stored.resource,\n        resource as OrchestrationResourceManifest,\n      )\n    ) {\n      if (idempotencyKey && !options.dryRun) {\n        this.idempotency.set(idempotencyKey, {\n          requestDigest: fingerprint,\n          response: structuredClone(stored.resource),\n        });\n      }\n      return structuredClone(stored.resource) as unknown as OrchestrationResource<TSpec, TStatus>;\n    }\n    if (\n      !options.resourceVersion ||\n      options.resourceVersion !== stored.resource.metadata.resourceVersion\n    ) {\n      throw new OrchestrationError({\n        code: 'CONFLICT',\n        message: 'apply resourceVersion precondition failed',\n        retryable: true,\n      });\n    }\n    if (this.authorizer) {\n      this.authorizer.authorize({\n        actor,\n        verb: 'apply',\n        reference: {\n          apiVersion: resource.apiVersion,\n          kind: resource.kind,\n          name: resource.metadata.name,\n          namespace: resource.metadata.namespace,\n        },\n        current: stored.resource,\n        proposedResource: resource as OrchestrationResourceManifest,\n      });\n    }\n    const rv = options.dryRun ? this.revision : this.nextRevision();\n    const specChanged = canonicalControlStoreValue(stored.resource.spec) !==\n      canonicalControlStoreValue(resource.spec);\n    const updated: OrchestrationResource = {\n      ...stored.resource,\n      metadata: {\n        ...stored.resource.metadata,\n        ...structuredClone(resource.metadata),\n        name: stored.resource.metadata.name,\n        namespace: stored.resource.metadata.namespace,\n        uid: stored.resource.metadata.uid,\n        generation: stored.resource.metadata.generation + (specChanged ? 1 : 0),\n        resourceVersion: String(rv),\n        creationTimestamp: stored.resource.metadata.creationTimestamp,\n      },\n      spec: structuredClone(resource.spec) as Record<string, unknown>,\n    };\n    if (!options.dryRun) {\n      this.data.set(key, { resource: updated, revision: rv, deleted: false });\n      if (idempotencyKey) {\n        this.idempotency.set(idempotencyKey, {\n          requestDigest: fingerprint,\n          response: structuredClone(updated),\n        });\n      }\n      this.notify(key, updated, 'MODIFIED');\n    }\n    return structuredClone(updated) as unknown as OrchestrationResource<TSpec, TStatus>;\n  }\n\n  public async updateStatus<TSpec, TStatus>(\n    actor: ControlStoreActor,\n    reference: OrchestrationResourceReference,\n    status: TStatus,\n    options: ControlStoreStatusUpdateOptions,\n  ): Promise<OrchestrationResource<TSpec, TStatus>> {\n    this.checkQuorum('updateStatus');\n    const key = this.refKey(reference);\n    const requestDigest = canonicalControlStoreValue({\n      actor,\n      reference,\n      status,\n      resourceVersion: options.resourceVersion,\n    });\n    const idempotencyKey = options.idempotencyKey\n      ? `status:${options.idempotencyKey}`\n      : undefined;\n    if (idempotencyKey) {\n      const replay = this.idempotency.get(idempotencyKey);\n      if (replay) {\n        if (replay.requestDigest !== requestDigest) {\n          throw new OrchestrationError({\n            code: 'CONFLICT',\n            message: 'idempotency key was reused for another status request',\n            retryable: false,\n          });\n        }\n        return structuredClone(replay.response) as OrchestrationResource<TSpec, TStatus>;\n      }\n    }\n    const stored = this.data.get(key);\n    if (!stored || stored.deleted) {\n      throw new OrchestrationError({ code: 'NOT_FOUND', message: `resource ${key} not found`, retryable: false });\n    }\n\n    if (this.authorizer) {\n      this.authorizer.authorize({\n        actor,\n        verb: 'update-status',\n        reference,\n        current: stored.resource,\n        proposedStatus: status as unknown as OrchestrationResourceStatus,\n      });\n    }\n\n    if (options.resourceVersion && stored.resource.metadata.resourceVersion !== options.resourceVersion) {\n      throw new OrchestrationError({\n        code: 'CONFLICT',\n        message: `CAS conflict: expected ${options.resourceVersion}, got ${stored.resource.metadata.resourceVersion}`,\n        retryable: true,\n      });\n    }\n\n    const rv = options.dryRun ? this.revision : this.nextRevision();\n    const updated: OrchestrationResource = {\n      ...stored.resource,\n      status: status as unknown as OrchestrationResourceStatus,\n      metadata: {\n        ...stored.resource.metadata,\n        resourceVersion: String(rv),\n      },\n    };\n    if (!options.dryRun) {\n      this.data.set(key, { resource: updated, revision: rv, deleted: false });\n      if (idempotencyKey) {\n        this.idempotency.set(idempotencyKey, {\n          requestDigest,\n          response: structuredClone(updated),\n        });\n      }\n      this.notify(key, updated, 'MODIFIED');\n    }\n    return structuredClone(updated) as OrchestrationResource<TSpec, TStatus>;\n  }\n\n  public async delete(\n    actor: ControlStoreActor,\n    reference: OrchestrationResourceReference,\n    options: OrchestrationDeleteOptions = {},\n  ): Promise<OrchestrationDeleteResult> {\n    this.checkQuorum('delete');\n    const key = this.refKey(reference);\n    const requestDigest = canonicalControlStoreValue({\n      actor,\n      reference,\n      preconditions: options.preconditions,\n      propagationPolicy: options.propagationPolicy,\n    });\n    const idempotencyKey = options.idempotencyKey\n      ? `delete:${options.idempotencyKey}`\n      : undefined;\n    if (idempotencyKey) {\n      const replay = this.idempotency.get(idempotencyKey);\n      if (replay) {\n        if (replay.requestDigest !== requestDigest) {\n          throw new OrchestrationError({\n            code: 'CONFLICT',\n            message: 'idempotency key was reused for another delete request',\n            retryable: false,\n          });\n        }\n        return structuredClone(replay.response) as OrchestrationDeleteResult;\n      }\n    }\n    const stored = this.data.get(key);\n    if (!stored || stored.deleted) return { accepted: false, reference };\n\n    const preconditions = options.preconditions;\n    if (\n      (preconditions?.uid !== undefined &&\n        preconditions.uid !== stored.resource.metadata.uid) ||\n      (preconditions?.resourceVersion !== undefined &&\n        preconditions.resourceVersion !== stored.resource.metadata.resourceVersion) ||\n      (preconditions?.generation !== undefined &&\n        preconditions.generation !== stored.resource.metadata.generation)\n    ) {\n      throw new OrchestrationError({\n        code: 'CONFLICT',\n        message: 'delete precondition failed',\n        retryable: true,\n      });\n    }\n    this.authorizer?.authorize({\n      actor,\n      verb: 'delete',\n      reference,\n      current: stored.resource,\n    });\n\n    const pending = (stored.resource.metadata.finalizers?.length ?? 0) > 0;\n    const alreadyPending = pending && stored.resource.metadata.deletionTimestamp !== undefined;\n    const rv = options.dryRun || alreadyPending\n      ? this.revision\n      : this.nextRevision();\n    const deleted: OrchestrationResource = {\n      ...stored.resource,\n      metadata: {\n        ...stored.resource.metadata,\n        resourceVersion: String(rv),\n        ...(pending && !alreadyPending\n          ? { deletionTimestamp: new Date().toISOString() }\n          : {}),\n      },\n    };\n    const result: OrchestrationDeleteResult = { accepted: true, reference };\n    if (!options.dryRun) {\n      if (!alreadyPending) {\n        this.data.set(key, {\n          resource: deleted,\n          revision: rv,\n          deleted: !pending,\n        });\n      }\n      if (idempotencyKey) {\n        this.idempotency.set(idempotencyKey, {\n          requestDigest,\n          response: structuredClone(result),\n        });\n      }\n      if (!alreadyPending) {\n        this.notify(key, deleted, pending ? 'MODIFIED' : 'DELETED');\n      }\n    }\n    return result;\n  }\n\n  // ─── Leases ──────────────────────────────────────────────────────────\n\n  public async acquireLease(actor: ControlStoreActor, request: ControlLeaseRequest): Promise<ControlLeaseGrant> {\n    this.checkQuorum('acquireLease');\n    if (\n      !request.name ||\n      !request.holder ||\n      !Number.isSafeInteger(request.ttlMs) ||\n      request.ttlMs <= 0\n    ) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: 'lease name, holder, and positive ttlMs are required',\n        retryable: false,\n      });\n    }\n    this.authorizer?.authorize({\n      actor,\n      verb: 'acquire-lease',\n      reference: this.leaseReference(request.name),\n    });\n    const existing = this.leases.get(request.name);\n    if (existing && Date.now() < existing.expiresAt) {\n      throw new OrchestrationError({ code: 'CONFLICT', message: `lease ${request.name} held by ${existing.holder}`, retryable: true });\n    }\n    this.clearLeaseTimer(request.name);\n\n    const leaseId = `lease-${request.name}-${request.holder}-${Date.now().toString(36)}`;\n    const rv = this.nextRevision();\n    const now = Date.now();\n    // Fencing epochs are monotonic per lease name across holders, releases,\n    // and expiries — a stale holder's epoch is permanently unusable.\n    const epoch = (this.leaseEpochs.get(request.name) ?? 0) + 1;\n    this.leaseEpochs.set(request.name, epoch);\n    this.leases.set(request.name, {\n      holder: request.holder,\n      leaseId,\n      epoch: String(epoch),\n      acquiredAt: now,\n      renewedAt: now,\n      expiresAt: now + request.ttlMs,\n    });\n    this.leaseTimers.set(\n      request.name,\n      setInterval(() => {\n        this.expireLease(request.name);\n      }, Math.min(request.ttlMs, 30_000)),\n    );\n\n    return {\n      name: request.name,\n      holder: request.holder,\n      leaseId,\n      epoch: String(epoch),\n      acquiredAt: new Date().toISOString(),\n      renewedAt: new Date().toISOString(),\n      expiresAt: new Date(now + request.ttlMs).toISOString(),\n      resourceVersion: String(rv),\n    };\n  }\n\n  public async renewLease(actor: ControlStoreActor, id: ControlLeaseIdentity, ttlMs: number): Promise<ControlLeaseGrant> {\n    this.checkQuorum('renewLease');\n    if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: 'positive lease ttlMs is required',\n        retryable: false,\n      });\n    }\n    this.authorizer?.authorize({\n      actor,\n      verb: 'renew-lease',\n      reference: this.leaseReference(id.name),\n    });\n    const existing = this.leases.get(id.name);\n\n    const now = Date.now();\n    if (\n      !existing ||\n      existing.holder !== id.holder ||\n      existing.leaseId !== id.leaseId ||\n      id.epoch !== existing.epoch ||\n      existing.expiresAt <= now\n    ) {\n      throw new OrchestrationError({\n        code: 'STALE_EPOCH',\n        message: `lease ${id.name} identity is stale`,\n        retryable: false,\n      });\n    }\n    existing.renewedAt = now;\n    existing.expiresAt = now + ttlMs;\n    return {\n      name: id.name,\n      holder: existing.holder,\n      leaseId: existing.leaseId,\n      epoch: existing.epoch,\n      acquiredAt: new Date(existing.acquiredAt).toISOString(),\n      renewedAt: new Date(existing.renewedAt).toISOString(),\n      expiresAt: new Date(existing.expiresAt).toISOString(),\n      resourceVersion: String(this.nextRevision()),\n    };\n  }\n\n  public async releaseLease(actor: ControlStoreActor, id: ControlLeaseIdentity): Promise<void> {\n    this.checkQuorum('releaseLease');\n    this.authorizer?.authorize({\n      actor,\n      verb: 'release-lease',\n      reference: this.leaseReference(id.name),\n    });\n    const existing = this.leases.get(id.name);\n    if (\n      !existing ||\n      existing.holder !== id.holder ||\n      existing.leaseId !== id.leaseId ||\n      existing.epoch !== id.epoch\n    ) {\n      throw new OrchestrationError({\n        code: 'STALE_EPOCH',\n        message: `lease ${id.name} identity is stale`,\n        retryable: false,\n      });\n    }\n    this.leases.delete(id.name);\n    this.clearLeaseTimer(id.name);\n  }\n\n  // ─── Maintenance ─────────────────────────────────────────────────────\n\n  public async compact(throughResourceVersion: string): Promise<ControlStoreCompactionResult> {\n    const target = Number(throughResourceVersion);\n    if (!Number.isSafeInteger(target) || target < 0 || target > this.revision) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: `invalid compaction resourceVersion '${throughResourceVersion}'`,\n        retryable: false,\n      });\n    }\n    this.compactedRevision = Math.max(this.compactedRevision, target);\n    for (let index = this.watchHistory.length - 1; index >= 0; index -= 1) {\n      if (Number(this.watchHistory[index].event.resourceVersion) <= target) {\n        this.watchHistory.splice(index, 1);\n      }\n    }\n    for (const [key, s] of this.data) {\n      if (s.deleted && s.revision <= target) this.data.delete(key);\n    }\n    return { compactedThrough: String(target), resourceVersion: String(this.revision) };\n  }\n\n  public async snapshot(_targetPath: string): Promise<ControlStoreSnapshotResult> {\n    // Portable core cannot write files; hosts persist the bytes returned by\n    // exportSnapshot(). This method only reports the snapshot point.\n    return { resourceVersion: String(this.revision), createdAt: new Date().toISOString() };\n  }\n\n  /** Serialize the full store state. Excludes live leases/timers; preserves fencing epochs. */\n  public exportSnapshot(): QuorumControlStoreSnapshot {\n    return {\n      revision: this.revision,\n      compactedRevision: this.compactedRevision,\n      term: this.term,\n      voters: [...this.voters],\n      learners: [...this.learners],\n      quorumSize: this.quorumSize,\n      leaseEpochs: Object.fromEntries(this.leaseEpochs),\n      resources: [...this.data.entries()].map(([key, entry]) => ({\n        key,\n        resource: structuredClone(entry.resource),\n        revision: entry.revision,\n        deleted: entry.deleted,\n      })),\n      idempotency: [...this.idempotency.entries()].map(([key, entry]) => ({\n        key,\n        requestDigest: entry.requestDigest,\n        response: structuredClone(entry.response),\n      })),\n      watchEvents: this.watchHistory.map((entry) => ({\n        key: entry.key,\n        event: structuredClone(entry.event),\n      })),\n      createdAt: new Date().toISOString(),\n    };\n  }\n\n  /** Replace the store state with a snapshot previously produced by exportSnapshot(). */\n  public restoreSnapshot(snapshot: QuorumControlStoreSnapshot): void {\n    if (this.closed) throw new Error('store is closed');\n    this.data.clear();\n    for (const entry of snapshot.resources) {\n      if (entry.key.startsWith('__idem__')) continue;\n      this.data.set(entry.key, {\n        resource: structuredClone(entry.resource),\n        revision: entry.revision,\n        deleted: entry.deleted,\n      });\n    }\n    this.idempotency.clear();\n    for (const entry of snapshot.idempotency ?? []) {\n      this.idempotency.set(entry.key, {\n        requestDigest: entry.requestDigest,\n        response: structuredClone(entry.response),\n      });\n    }\n    this.revision = snapshot.revision;\n    this.compactedRevision = snapshot.compactedRevision ?? 0;\n    this.watchHistory.splice(\n      0,\n      this.watchHistory.length,\n      ...(snapshot.watchEvents ?? []).map((entry) => ({\n        key: entry.key,\n        event: structuredClone(entry.event),\n      })),\n    );\n    this.term = snapshot.term;\n    this.voters.clear();\n    for (const id of snapshot.voters) this.voters.add(id);\n    this.learners.clear();\n    for (const id of snapshot.learners) this.learners.add(id);\n    this.quorumSize = snapshot.quorumSize;\n    this.leaseEpochs.clear();\n    for (const [name, epoch] of Object.entries(snapshot.leaseEpochs)) {\n      this.leaseEpochs.set(name, epoch);\n    }\n    // Live leases are not restored; any holder from before the snapshot must\n    // re-acquire and will receive a higher fencing epoch.\n    for (const name of [...this.leases.keys()]) {\n      this.leases.delete(name);\n      this.clearLeaseTimer(name);\n    }\n  }\n\n  public async getHealth(): Promise<ControlStoreHealth> {\n    return { healthy: this.voters.size >= this.quorumSize && !this.closed, resourceVersion: String(this.revision) };\n  }\n\n  public async close(): Promise<void> {\n    this.closed = true;\n    for (const [, t] of this.leaseTimers) clearInterval(t);\n    this.leaseTimers.clear();\n    for (const sub of this.watchers.values()) sub.close();\n    this.watchers.clear();\n  }\n\n  // ─── Topology ────────────────────────────────────────────────────────\n\n  public async getTopology(): Promise<QuorumTopology> {\n    const members: QuorumMember[] = [\n      ...[...this.voters].map((id): QuorumMember => ({ id, peerUrls: [], isLearner: id === this.memberId ? this.isLearner : false })),\n      ...[...this.learners].filter((id) => !this.voters.has(id)).map((id): QuorumMember => ({ id, peerUrls: [], isLearner: true })),\n    ];\n    const healthy = this.voters.size >= this.quorumSize && !this.closed;\n    return { members, leaderId: healthy ? this.memberId : undefined, term: this.term };\n  }\n\n  /** Recompute quorum as a majority of the current voter set (etcd semantics). */\n  private recomputeQuorum(): void {\n    this.quorumSize = Math.max(1, Math.floor(this.voters.size / 2) + 1);\n  }\n\n  private leaseReference(name: string): OrchestrationResourceReference {\n    return {\n      apiVersion: 'coordination.memeloop.io/v1alpha1',\n      kind: 'ControlLease',\n      namespace: 'system',\n      name,\n    };\n  }\n\n  public async addVoter(m: QuorumMember): Promise<void> {\n    this.learners.delete(m.id);\n    this.voters.add(m.id);\n    this.recomputeQuorum();\n    this.term += 1;\n  }\n\n  public async removeVoter(id: string): Promise<void> {\n    if (!this.voters.has(id)) return;\n    if (this.voters.size <= 1) {\n      throw new OrchestrationError({ code: 'INVALID', message: `removeVoter: cannot remove the last voter '${id}'`, retryable: false });\n    }\n    this.voters.delete(id);\n    this.recomputeQuorum();\n    this.term += 1;\n    this.checkQuorum('removeVoter');\n  }\n\n  /**\n   * Add an observer that receives no vote and does not count toward quorum\n   * (§17.3: a second node starts as observer, never a fragile two-voter\n   * configuration; promotion is an explicit later step).\n   */\n  public async addLearner(m: QuorumMember): Promise<void> {\n    if (this.voters.has(m.id)) return;\n    this.learners.add(m.id);\n  }\n\n  public async removeLearner(id: string): Promise<void> {\n    this.learners.delete(id);\n  }\n\n  public async promoteLearner(id: string): Promise<void> {\n    this.learners.delete(id);\n    this.voters.add(id);\n    if (id === this.memberId) this.isLearner = false;\n    this.recomputeQuorum();\n    this.term += 1;\n  }\n\n  // ─── Private ─────────────────────────────────────────────────────────\n\n  private expireLease(name: string): void {\n    const entry = this.leases.get(name);\n    if (entry && Date.now() >= entry.expiresAt) {\n      this.leases.delete(name);\n      this.clearLeaseTimer(name);\n    }\n  }\n\n  private clearLeaseTimer(name: string): void {\n    const t = this.leaseTimers.get(name);\n    if (t) {\n      clearInterval(t);\n      this.leaseTimers.delete(name);\n    }\n  }\n}\n","import type { Controller, ControllerReconcileResult } from './controllerRunner.js';\nimport type { ControlStoreActor } from './controlStore.js';\nimport type { ToolExecutionDriver } from './drivers/toolExecutionDriver.js';\nimport { toOrchestrationErrorData } from './errors.js';\nimport {\n  type NodeTrustClass,\n  TOOL_EXECUTOR_API_VERSION,\n  TOOL_EXECUTOR_KIND,\n  type ToolExecutorResource,\n  type ToolOperationResource,\n  type ToolOperationStatus,\n} from './resources.js';\nimport { redactSecrets } from './security/secretRedaction.js';\n\nconst TRUST_RANK: Record<NodeTrustClass, number> = {\n  quarantine: 0,\n  restricted: 1,\n  trusted: 2,\n};\n\nconst TERMINAL_PHASES = new Set(['Completed', 'Failed', 'Cancelled']);\n\nexport interface ToolExecutorSelection {\n  executor: ToolExecutorResource;\n  nodeId: string;\n  score: number;\n  reasons: string[];\n}\n\n/** Select a healthy, schema-compatible executor without loading its implementation. */\nexport function selectToolExecutor(\n  operation: ToolOperationResource,\n  executors: ToolExecutorResource[],\n): ToolExecutorSelection | null {\n  const placement = operation.spec.placement ?? {};\n  const minimumTrust = placement.minimumTrust ?? 'restricted';\n  const candidates: ToolExecutorSelection[] = [];\n\n  for (const executor of executors) {\n    const nodeId = executor.spec.nodeId;\n    if (!nodeId || executor.status?.healthy === false) continue;\n    if (placement.requiredNode && placement.requiredNode !== nodeId) continue;\n    if (\n      placement.nodeSelector && !Object.entries(placement.nodeSelector).every(\n        ([key, value]) => executor.spec.selectors?.[key] === value,\n      )\n    ) continue;\n    const trust = executor.spec.trust ?? 'quarantine';\n    if (TRUST_RANK[trust] < TRUST_RANK[minimumTrust]) continue;\n\n    const capability = executor.spec.capabilities.find((candidate) =>\n      candidate.toolClassRef.name === operation.spec.toolRef.name &&\n      (candidate.effects ?? ['execute']).includes(operation.spec.effect) &&\n      (!operation.spec.toolRef.schemaDigest ||\n        candidate.schemaDigest === operation.spec.toolRef.schemaDigest) &&\n      candidate.health?.healthy !== false\n    );\n    if (!capability) continue;\n\n    const maximum = capability.capacity?.maxConcurrent ?? 1;\n    const queued = capability.capacity?.queueDepth ?? 0;\n    const spare = maximum - queued;\n    if (spare <= 0) continue;\n    let score = spare * 100 + TRUST_RANK[trust] * 10;\n    const reasons = [`schema ${capability.schemaDigest}`, `spare capacity ${spare}`];\n    if (placement.preferredNode === nodeId) {\n      score += 1000;\n      reasons.push('preferred node');\n    }\n    candidates.push({ executor, nodeId, score, reasons });\n  }\n\n  candidates.sort((left, right) =>\n    right.score - left.score ||\n    (left.executor.metadata.name ?? '').localeCompare(right.executor.metadata.name ?? '')\n  );\n  return candidates[0] ?? null;\n}\n\nexport interface ToolOperationBindingControllerOptions {\n  actor: ControlStoreActor;\n  listExecutors: () => Promise<ToolExecutorResource[]>;\n  retryAfterMs?: number;\n}\n\nfunction withScheduledCondition(\n  status: ToolOperationStatus,\n  conditionStatus: 'True' | 'False',\n  reason: string,\n  now: Date,\n): ToolOperationStatus {\n  const conditions = (status.conditions ?? []).filter((condition) => condition.type !== 'Scheduled');\n  conditions.push({\n    type: 'Scheduled',\n    status: conditionStatus,\n    reason,\n    lastTransitionTime: now.toISOString(),\n  });\n  return { ...status, conditions };\n}\n\n/**\n * Independently bind pending ToolOperations to declarative ToolExecutors.\n * Explicit external-orchestrator operations remain owned by that controller.\n */\nexport function createToolOperationBindingController(\n  options: ToolOperationBindingControllerOptions,\n): Controller<ToolOperationResource['spec']> {\n  return {\n    async reconcile(request): Promise<ControllerReconcileResult> {\n      const operation = request.resource as ToolOperationResource;\n      const status = operation.status ?? {};\n      if (\n        operation.spec.placement?.orchestrator ||\n        TERMINAL_PHASES.has(status.phase ?? '') ||\n        status.phase === 'Running' ||\n        status.assignedExecutor\n      ) {\n        return { ready: true };\n      }\n\n      const selected = selectToolExecutor(operation, await options.listExecutors());\n      if (!selected) {\n        return {\n          status: withScheduledCondition(\n            { ...status, phase: 'Pending' },\n            'False',\n            'NoSuitableExecutor',\n            request.now,\n          ),\n          ready: false,\n          requeueAfterMs: options.retryAfterMs ?? 1000,\n        };\n      }\n\n      const executor = selected.executor;\n      return {\n        status: withScheduledCondition(\n          {\n            ...status,\n            phase: 'Pending',\n            assignedNode: selected.nodeId,\n            assignedDriver: executor.metadata.name,\n            assignedExecutor: {\n              apiVersion: TOOL_EXECUTOR_API_VERSION,\n              kind: TOOL_EXECUTOR_KIND,\n              name: executor.metadata.name,\n              namespace: executor.metadata.namespace,\n              uid: executor.metadata.uid,\n            },\n          },\n          'True',\n          `BoundTo ${executor.metadata.name}`,\n          request.now,\n        ),\n        ready: true,\n      };\n    },\n  };\n}\n\nexport interface ToolOperationExecutionControllerOptions {\n  actor: ControlStoreActor;\n  nodeId: string;\n  driver: ToolExecutionDriver;\n}\n\nfunction unknownEffectStatus(\n  status: ToolOperationStatus,\n  now: Date,\n  message = 'tool executor fencing epoch changed after execution was claimed; effect requires external verification',\n): ToolOperationStatus {\n  const action = 'verification-required';\n  const conditions = (status.conditions ?? []).filter((condition) => condition.type !== 'EffectUnknown');\n  conditions.push({\n    type: 'EffectUnknown',\n    status: 'True',\n    reason: action,\n    lastTransitionTime: now.toISOString(),\n  });\n  return {\n    ...status,\n    phase: 'Failed',\n    completedAt: now.toISOString(),\n    result: {\n      error: {\n        code: 'UNKNOWN_EFFECT',\n        message,\n        retryable: false,\n        reason: action,\n      },\n    },\n    conditions,\n  };\n}\n\nexport interface ToolOperationExecutionController extends Controller<ToolOperationResource['spec']> {\n  /** Cooperatively abort one currently executing operation. */\n  cancel(operation: Pick<ToolOperationResource, 'metadata'>): boolean;\n  /** Abort all local effects during runtime shutdown. */\n  cancelAll(): number;\n  /** Diagnostic count only; no operation inputs/results are exposed. */\n  activeCount(): number;\n}\n\nfunction operationKey(operation: Pick<ToolOperationResource, 'metadata'>): string {\n  return operation.metadata.uid ??\n    `${operation.metadata.namespace ?? 'default'}/${operation.metadata.name ?? ''}`;\n}\n\n/**\n * Execute operations assigned to one node. Claiming and effect execution are\n * deliberately separate reconciles so the claim is durable before any side\n * effect starts.\n */\nexport function createToolOperationExecutionController(\n  options: ToolOperationExecutionControllerOptions,\n): ToolOperationExecutionController {\n  const active = new Map<string, {\n    controller: AbortController;\n    reason: 'cancelled' | 'timeout';\n  }>();\n\n  const controller: ToolOperationExecutionController = {\n    cancel(operation) {\n      const current = active.get(operationKey(operation));\n      if (!current) return false;\n      current.reason = 'cancelled';\n      current.controller.abort();\n      return true;\n    },\n    cancelAll() {\n      const count = active.size;\n      for (const current of active.values()) {\n        current.reason = 'cancelled';\n        current.controller.abort();\n      }\n      return count;\n    },\n    activeCount: () => active.size,\n    async reconcile(request): Promise<ControllerReconcileResult> {\n      const operation = request.resource as ToolOperationResource;\n      const status = operation.status ?? {};\n      if (\n        operation.spec.placement?.orchestrator ||\n        TERMINAL_PHASES.has(status.phase ?? '') ||\n        status.assignedNode !== options.nodeId\n      ) {\n        return { ready: true };\n      }\n\n      if ((status.phase ?? 'Pending') === 'Pending') {\n        return {\n          status: {\n            ...status,\n            phase: 'Running',\n            startedAt: status.startedAt ?? request.now.toISOString(),\n            executionClaim: {\n              leaseEpoch: request.leaseEpoch,\n              claimedAt: request.now.toISOString(),\n            },\n          } as ToolOperationStatus,\n          ready: false,\n        };\n      }\n\n      if (status.phase !== 'Running' || !status.executionClaim) return { ready: true };\n      if (status.executionClaim.leaseEpoch !== request.leaseEpoch) {\n        if (operation.spec.effect === 'read') {\n          return {\n            status: {\n              ...status,\n              phase: 'Pending',\n              executionClaim: undefined,\n            } as ToolOperationStatus,\n            ready: false,\n          };\n        }\n        return { status: unknownEffectStatus(status, request.now), ready: true };\n      }\n\n      const key = operationKey(operation);\n      const abortController = new AbortController();\n      const activeExecution: {\n        controller: AbortController;\n        reason: 'cancelled' | 'timeout';\n      } = { controller: abortController, reason: 'cancelled' };\n      active.set(key, activeExecution);\n      const timeoutMs = operation.spec.timeoutMs;\n      const timeout = timeoutMs !== undefined && timeoutMs > 0\n        ? setTimeout(() => {\n          activeExecution.reason = 'timeout';\n          abortController.abort();\n        }, timeoutMs)\n        : undefined;\n      const execution = options.driver.execute(operation, {\n        signal: abortController.signal,\n        actor: request.actor,\n        leaseEpoch: request.leaseEpoch,\n      }).then(\n        (executed) => ({ kind: 'executed' as const, executed }),\n        (error: unknown) => ({ kind: 'error' as const, error }),\n      );\n      const aborted = new Promise<{ kind: 'aborted' }>((resolve) => {\n        abortController.signal.addEventListener(\n          'abort',\n          () => {\n            resolve({ kind: 'aborted' });\n          },\n          { once: true },\n        );\n      });\n      const outcome = await Promise.race([execution, aborted]);\n      if (timeout !== undefined) clearTimeout(timeout);\n      active.delete(key);\n\n      if (outcome.kind === 'aborted') {\n        // Observe eventual driver settlement to prevent an unhandled rejection;\n        // terminal state is decided now so an uncooperative tool cannot hang\n        // the controller indefinitely.\n        void execution.then(() => undefined);\n        if (operation.spec.effect !== 'read') {\n          return {\n            status: unknownEffectStatus(\n              status,\n              request.now,\n              `tool operation ${activeExecution.reason} after its effect started; external verification is required`,\n            ),\n            ready: true,\n          };\n        }\n        const timedOut = activeExecution.reason === 'timeout';\n        return {\n          status: {\n            ...status,\n            phase: timedOut ? 'Failed' : 'Cancelled',\n            completedAt: request.now.toISOString(),\n            result: {\n              error: {\n                code: timedOut ? 'TIMEOUT' : 'CANCELLED',\n                message: timedOut ? 'ToolOperation timed out' : 'ToolOperation cancelled',\n                retryable: timedOut,\n              },\n            },\n          } as ToolOperationStatus,\n          ready: true,\n        };\n      }\n\n      if (outcome.kind === 'executed') {\n        return {\n          status: {\n            ...outcome.executed.status,\n            assignedDriver: status.assignedDriver,\n            assignedNode: status.assignedNode,\n            assignedExecutor: status.assignedExecutor,\n            executionClaim: status.executionClaim,\n          } as ToolOperationStatus,\n          ready: true,\n        };\n      }\n\n      return {\n        status: {\n          ...status,\n          phase: 'Failed',\n          completedAt: request.now.toISOString(),\n          result: {\n            error: redactSecrets(toOrchestrationErrorData(outcome.error)),\n          },\n        } as ToolOperationStatus,\n        ready: true,\n      };\n    },\n  };\n  return controller;\n}\n","import type { Controller } from './controllerRunner.js';\nimport type { DriverRequestEnvelope } from './drivers/driverRequest.js';\nimport { type StorageDriver, type StorageDriverCapabilities, storageDriverSatisfiesClass, type StorageProvisionResult } from './drivers/storageDriver.js';\nimport type { StorageManagementDriver, StorageProvisionPayload } from './drivers/storageManagement.js';\nimport type { AgentVolumeClaimResource, AgentVolumeClaimStatus, AgentVolumeResource, NodeTrustClass, StorageClassResource } from './resources.js';\n\nexport interface StorageDriverEndpoint {\n  nodeId: string;\n  healthy: boolean;\n  capabilities: StorageDriverCapabilities[];\n  trust: NodeTrustClass;\n  labels?: Record<string, string>;\n  activeVolumes?: number;\n  maxVolumes?: number;\n  availableBytes?: number;\n}\n\nexport interface VolumeClaimBindingControllerOptions {\n  getStorageClass(claim: AgentVolumeClaimResource): Promise<StorageClassResource | null>;\n  listDrivers(): Promise<StorageDriverEndpoint[]>;\n  requiredNodeForClaim?(claim: AgentVolumeClaimResource): Promise<string | undefined>;\n  now?: () => Date;\n}\n\n/** Independently binds a claim to a healthy provisioner endpoint. */\nexport function createVolumeClaimBindingController(\n  options: VolumeClaimBindingControllerOptions,\n): Controller<AgentVolumeClaimResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const claim = request.resource as AgentVolumeClaimResource;\n      const status = claim.status ?? {};\n      if (status.phase && status.phase !== 'Pending') return { ready: true };\n      const storageClass = await options.getStorageClass(claim);\n      const reconciledAt = now().toISOString();\n      if (!storageClass) {\n        return {\n          status: {\n            ...status,\n            phase: 'Pending',\n            conditions: [{\n              type: 'VolumeScheduled',\n              status: 'False',\n              reason: 'StorageClassUnavailable',\n              message: 'referenced StorageClass is unavailable',\n              lastTransitionTime: reconciledAt,\n            }],\n          } satisfies AgentVolumeClaimStatus,\n          requeueAfterMs: 1000,\n        };\n      }\n      const requiredNode = await options.requiredNodeForClaim?.(claim);\n      const candidates = (await options.listDrivers()).flatMap((endpoint) => {\n        if (\n          !endpoint.healthy ||\n          endpoint.trust !== 'trusted' ||\n          (requiredNode && endpoint.nodeId !== requiredNode)\n        ) return [];\n        if (\n          endpoint.maxVolumes !== undefined &&\n          (endpoint.activeVolumes ?? 0) >= endpoint.maxVolumes\n        ) return [];\n        if (\n          endpoint.availableBytes !== undefined &&\n          (claim.spec.sizeBytes ?? 0) > endpoint.availableBytes\n        ) return [];\n        if (\n          claim.spec.selector &&\n          Object.entries(claim.spec.selector).some(([key, value]) => endpoint.labels?.[key] !== value)\n        ) return [];\n        const capability = endpoint.capabilities.find((item) => storageDriverSatisfiesClass(item, claim, storageClass));\n        return capability ? [{ endpoint, capability }] : [];\n      }).sort((left, right) =>\n        (left.endpoint.activeVolumes ?? 0) - (right.endpoint.activeVolumes ?? 0) ||\n        left.endpoint.nodeId.localeCompare(right.endpoint.nodeId)\n      );\n      const selected = candidates[0];\n      if (!selected) {\n        const { assignedNode: _node, assignedDriver: _driver, binding: _binding, ...unbound } = status;\n        return {\n          status: {\n            ...unbound,\n            phase: 'Pending',\n            conditions: [{\n              type: 'VolumeScheduled',\n              status: 'False',\n              reason: 'NoEligibleStorageDriver',\n              message: `no healthy driver satisfies StorageClass '${storageClass.metadata.name}'`,\n              lastTransitionTime: reconciledAt,\n            }],\n          } satisfies AgentVolumeClaimStatus,\n          requeueAfterMs: 1000,\n        };\n      }\n      if (\n        status.assignedNode === selected.endpoint.nodeId &&\n        status.assignedDriver === selected.capability.name &&\n        status.binding?.leaseEpoch === request.leaseEpoch &&\n        status.binding.storageClassResourceVersion === storageClass.metadata.resourceVersion\n      ) return { ready: true };\n      return {\n        status: {\n          ...status,\n          phase: 'Pending',\n          assignedNode: selected.endpoint.nodeId,\n          assignedDriver: selected.capability.name,\n          binding: {\n            leaseEpoch: request.leaseEpoch,\n            storageClassResourceVersion: storageClass.metadata.resourceVersion,\n            boundAt: reconciledAt,\n          },\n          conditions: [{\n            type: 'VolumeScheduled',\n            status: 'True',\n            reason: 'StorageDriverSelected',\n            message: `bound to '${selected.capability.name}' on '${selected.endpoint.nodeId}'`,\n            lastTransitionTime: reconciledAt,\n          }],\n        } satisfies AgentVolumeClaimStatus,\n        ready: true,\n      };\n    },\n  };\n}\n\nexport interface VolumeClaimExecutionControllerOptions {\n  nodeId: string;\n  getStorageClass(claim: AgentVolumeClaimResource): Promise<StorageClassResource | null>;\n  getDriver(name: string): Promise<StorageDriver | undefined>;\n  managed?: {\n    getDriver(name: string): Promise<StorageManagementDriver | undefined>;\n    createProvisionRequest(input: {\n      claim: AgentVolumeClaimResource;\n      storageClass: StorageClassResource;\n      actor: Parameters<Controller['reconcile']>[0]['actor'];\n      leaseEpoch: string;\n    }): Promise<DriverRequestEnvelope<StorageProvisionPayload>>;\n  };\n  ensureVolume(\n    claim: AgentVolumeClaimResource,\n    storageClass: StorageClassResource,\n    provisioned: StorageProvisionResult,\n  ): Promise<AgentVolumeResource>;\n  now?: () => Date;\n}\n\n/** Persists a fencing claim before idempotent volume provisioning. */\nexport function createVolumeClaimExecutionController(\n  options: VolumeClaimExecutionControllerOptions,\n): Controller<AgentVolumeClaimResource['spec']> {\n  const now = options.now ?? (() => new Date());\n  return {\n    async reconcile(request) {\n      const claim = request.resource as AgentVolumeClaimResource;\n      const status = claim.status ?? {};\n      if (status.assignedNode !== options.nodeId || !status.assignedDriver || !status.binding) {\n        return { ready: true };\n      }\n      if (status.phase === 'Bound' || status.phase === 'Lost' || status.phase === 'Failed') {\n        return { ready: true };\n      }\n      const storageClass = await options.getStorageClass(claim);\n      if (\n        !storageClass ||\n        storageClass.metadata.resourceVersion !== status.binding.storageClassResourceVersion\n      ) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'CONFLICT',\n              message: 'StorageClass changed after claim binding',\n              retryable: false,\n            },\n          } satisfies AgentVolumeClaimStatus,\n          ready: true,\n        };\n      }\n      const driver = await options.getDriver(status.assignedDriver);\n      if (!driver || !(await driver.getHealth()).healthy) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNAVAILABLE',\n              message: `bound storage driver '${status.assignedDriver}' is unavailable`,\n              retryable: true,\n            },\n          } satisfies AgentVolumeClaimStatus,\n          ready: true,\n        };\n      }\n      if (status.phase !== 'Provisioning') {\n        return {\n          status: {\n            ...status,\n            phase: 'Provisioning',\n            provisionClaim: {\n              leaseEpoch: request.leaseEpoch,\n              claimedAt: now().toISOString(),\n            },\n          } satisfies AgentVolumeClaimStatus,\n          requeueAfterMs: 1,\n        };\n      }\n      if (status.provisionClaim?.leaseEpoch !== request.leaseEpoch) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'UNKNOWN_EFFECT',\n              message: 'controller epoch changed after volume provisioning was claimed',\n              retryable: false,\n            },\n          } satisfies AgentVolumeClaimStatus,\n          ready: true,\n        };\n      }\n      const capability = await driver.getCapabilities();\n      if (!storageDriverSatisfiesClass(capability, claim, storageClass)) {\n        return {\n          status: {\n            ...status,\n            phase: 'Failed',\n            error: {\n              code: 'FORBIDDEN',\n              message: 'storage driver no longer satisfies the bound claim',\n              retryable: false,\n            },\n          } satisfies AgentVolumeClaimStatus,\n          ready: true,\n        };\n      }\n      const managedDriver = options.managed\n        ? await options.managed.getDriver(status.assignedDriver)\n        : undefined;\n      const managedVolume = managedDriver && options.managed\n        ? await managedDriver.provision(\n          await options.managed.createProvisionRequest({\n            claim,\n            storageClass,\n            actor: request.actor,\n            leaseEpoch: request.leaseEpoch,\n          }),\n        )\n        : undefined;\n      const provisioned = managedVolume\n        ? {\n          driverHandle: managedVolume.volumeHandle,\n          capacityBytes: managedVolume.capacityBytes,\n          topology: { nodeId: options.nodeId },\n        }\n        : await driver.provision({ claim, storageClass });\n      const volume = await options.ensureVolume(claim, storageClass, provisioned);\n      return {\n        status: {\n          ...status,\n          phase: 'Bound',\n          volumeRef: {\n            apiVersion: volume.apiVersion,\n            kind: volume.kind,\n            name: volume.metadata.name,\n            uid: volume.metadata.uid,\n          },\n        } satisfies AgentVolumeClaimStatus,\n        ready: true,\n      };\n    },\n  };\n}\n","import type { OrchestrationResource, OrchestrationResourceReference, OrchestrationResourceStatus } from './client.js';\nimport type { ControlStore, ControlStoreActor } from './controlStore.js';\nimport { OrchestrationError } from './errors.js';\nimport type { LoopRuntimeDriver } from './loopRuntimeDriver.js';\nimport {\n  AGENT_RUN_API_VERSION,\n  AGENT_RUN_KIND,\n  AGENT_WORKLOAD_API_VERSION,\n  AGENT_WORKLOAD_KIND,\n  type AgentRunResource,\n  type AgentRunStatus,\n  type AgentWorkloadResource,\n  type AgentWorkloadStatus,\n  createAgentRunManifest,\n  createNetworkAttachmentManifest,\n  MODEL_ENDPOINT_API_VERSION,\n  MODEL_ENDPOINT_KIND,\n  type ModelEndpointResource,\n  NETWORK_ATTACHMENT_API_VERSION,\n  NETWORK_ATTACHMENT_KIND,\n  type NetworkAttachmentResource,\n  type NetworkAttachmentStatus,\n  type NetworkClassResource,\n} from './resources.js';\n\n/**\n * Workload execution controller (Phase 4.2 / plan 24.14).\n *\n * Watches AgentWorkloads, and for each one the binding controller (24.56)\n * has scheduled onto THIS node (`status.phase === 'Scheduling'` with\n * `status.assignedNode === nodeId`), creates an AgentRun and executes it\n * through the injected LoopRuntimeDriver. Terminal outcomes are written to\n * both the run and the workload. Deleting a running workload cancels its\n * execution. Executions on other nodes are ignored — remote nodes run their\n * own controller instance.\n */\n\nexport interface WorkloadExecutionControllerOptions {\n  /** Host-bound actor identity for all ControlStore writes. */\n  actor: ControlStoreActor;\n  /** Only execute workloads bound to this node name. */\n  nodeId: string;\n  /** Stable only for this daemon lifetime; changes after restart. */\n  controllerInstanceId?: string;\n  /** Resolve a `spec.scriptReference` (content digest) to admitted source. */\n  resolveScriptSource?: (scriptReference: string) => Promise<string | undefined>;\n  /** Message delivered to the loop (default: workload name). */\n  messageForWorkload?: (workload: AgentWorkloadResource) => string;\n  /** CAS attempts per status write (default 3). */\n  statusWriteAttempts?: number;\n  /** Maximum wait for an independently scheduled ModelEndpoint (default 30s). */\n  modelBindingTimeoutMs?: number;\n  /** Maximum wait for an independently prepared NetworkAttachment (default 30s). */\n  networkAttachmentTimeoutMs?: number;\n  /** Maximum wait for independently published volumes (default 30s). */\n  volumeBindingTimeoutMs?: number;\n  /** Resolve publish handles into ephemeral host mount paths. */\n  resolveVolumeMounts?: (\n    workload: AgentWorkloadResource,\n    run: AgentRunResource,\n  ) => Promise<NonNullable<import('./loopRuntimeDriver.js').LoopRunStartRequest['volumeMounts']>>;\n  /** Poll interval while waiting for model binding (default 25ms). */\n  dependencyPollIntervalMs?: number;\n  /** Revalidate selected endpoint heartbeat age before launch (default 90s). */\n  modelEndpointHeartbeatTtlMs?: number;\n  /** Injectable sleep for watch-retry backoff in tests. */\n  sleep?: (ms: number) => Promise<void>;\n  /** Observes swallowed errors; the controller keeps watching regardless. */\n  onError?: (error: unknown) => void;\n}\n\nexport interface WorkloadExecutionControllerHandle {\n  stop(): Promise<void>;\n}\n\nconst TERMINAL_RUN_PHASES = new Set(['Completed', 'Failed', 'Cancelled']);\nlet controllerInstanceCounter = 0;\n\nexport function createWorkloadExecutionController(\n  store: ControlStore,\n  driver: LoopRuntimeDriver,\n  options: WorkloadExecutionControllerOptions,\n): WorkloadExecutionControllerHandle {\n  const sleep = options.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n  const statusWriteAttempts = options.statusWriteAttempts ?? 3;\n  const modelBindingTimeoutMs = options.modelBindingTimeoutMs ?? 30_000;\n  const networkAttachmentTimeoutMs = options.networkAttachmentTimeoutMs ?? 30_000;\n  const volumeBindingTimeoutMs = options.volumeBindingTimeoutMs ?? 30_000;\n  const dependencyPollIntervalMs = options.dependencyPollIntervalMs ?? 25;\n  const modelEndpointHeartbeatTtlMs = options.modelEndpointHeartbeatTtlMs ?? 90_000;\n  const onError = options.onError ?? ((): void => {});\n  controllerInstanceCounter += 1;\n  const controllerInstanceId = options.controllerInstanceId ??\n    `${options.nodeId}:${Date.now()}:${controllerInstanceCounter}`;\n  if (!controllerInstanceId) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: 'workload execution controller instance identity is required',\n      retryable: false,\n    });\n  }\n  const active = new Map<string, { cancel(): Promise<void> }>();\n  let stopped = false;\n\n  async function updateStatusWithRetry<TStatus extends OrchestrationResourceStatus>(\n    reference: OrchestrationResourceReference,\n    patch: (current: TStatus | undefined) => TStatus,\n  ): Promise<void> {\n    for (let attempt = 0; attempt < statusWriteAttempts; attempt += 1) {\n      const current = await store.get<Record<string, unknown>, TStatus>(reference);\n      if (!current) return; // Deleted concurrently.\n      try {\n        await store.updateStatus(options.actor, reference, patch(current.status), {\n          resourceVersion: current.metadata.resourceVersion,\n        });\n        return;\n      } catch (error) {\n        if (error instanceof OrchestrationError && error.code === 'CONFLICT') continue;\n        throw error;\n      }\n    }\n    throw new OrchestrationError({\n      code: 'CONFLICT',\n      message: `status update for '${reference.name ?? ''}' exceeded ${statusWriteAttempts} CAS attempts`,\n      retryable: true,\n    });\n  }\n\n  function workloadReference(workload: AgentWorkloadResource): OrchestrationResourceReference {\n    return {\n      apiVersion: AGENT_WORKLOAD_API_VERSION,\n      kind: AGENT_WORKLOAD_KIND,\n      name: workload.metadata.name,\n      namespace: workload.metadata.namespace,\n    };\n  }\n\n  function assertCanonicalRunBinding(\n    workload: AgentWorkloadResource,\n    run: AgentRunResource,\n  ): void {\n    const reference = run.spec.workloadRef;\n    const workloadNamespace = workload.metadata.namespace ?? 'default';\n    const referenceNamespace = reference.namespace ?? run.metadata.namespace ?? 'default';\n    if (\n      reference.apiVersion !== AGENT_WORKLOAD_API_VERSION ||\n      reference.kind !== AGENT_WORKLOAD_KIND ||\n      reference.name !== workload.metadata.name ||\n      referenceNamespace !== workloadNamespace ||\n      reference.uid !== workload.metadata.uid ||\n      run.spec.promptReference !== undefined ||\n      run.spec.retry !== undefined ||\n      run.spec.timeoutMs !== undefined\n    ) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: `pre-existing AgentRun '${run.metadata.name}' does not exactly match controller-owned workload '${workload.metadata.name}'`,\n        retryable: false,\n      });\n    }\n  }\n\n  async function claimRuntimeExecution(\n    reference: OrchestrationResourceReference,\n  ): Promise<AgentRunResource | null> {\n    for (let attempt = 0; attempt < statusWriteAttempts; attempt += 1) {\n      const current = await store.get<\n        AgentRunResource['spec'],\n        AgentRunResource['status']\n      >(reference) as AgentRunResource | null;\n      if (!current) return null;\n      // Another daemon already crossed the durable pre-effect boundary.\n      // Never overwrite its claim, even after a CAS retry.\n      if (current.status?.runtimeExecutionClaim) return null;\n      try {\n        return await store.updateStatus<\n          AgentRunResource['spec'],\n          AgentRunResource['status']\n        >(\n          options.actor,\n          reference,\n          {\n            ...current.status,\n            phase: 'Starting',\n            runtimeExecutionClaim: {\n              controllerInstanceId,\n              claimedAt: new Date().toISOString(),\n            },\n          },\n          { resourceVersion: current.metadata.resourceVersion },\n        ) as AgentRunResource;\n      } catch (error) {\n        if (error instanceof OrchestrationError && error.code === 'CONFLICT') {\n          continue;\n        }\n        throw error;\n      }\n    }\n    throw new OrchestrationError({\n      code: 'CONFLICT',\n      message: `runtime execution claim for '${reference.name ?? ''}' exceeded ${statusWriteAttempts} CAS attempts`,\n      retryable: true,\n    });\n  }\n\n  async function waitForModelBinding(\n    workload: AgentWorkloadResource,\n    runReference: OrchestrationResourceReference,\n  ): Promise<{ run: AgentRunResource; endpoint?: ModelEndpointResource }> {\n    const deadline = Date.now() + modelBindingTimeoutMs;\n    for (;;) {\n      if (stopped) {\n        throw new OrchestrationError({\n          code: 'CANCELLED',\n          message: 'workload execution controller stopped while awaiting dependencies',\n          retryable: false,\n        });\n      }\n      const current = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(\n        runReference,\n      ) as AgentRunResource | null;\n      if (!current) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: `AgentRun '${runReference.name ?? ''}' was deleted while awaiting dependencies`,\n          retryable: false,\n        });\n      }\n      if (!workload.spec.modelPolicy?.modelClass) return { run: current };\n      const binding = current.status?.assignedModelEndpoint;\n      if (binding) {\n        const endpoint = await store.get<ModelEndpointResource['spec'], ModelEndpointResource['status']>({\n          apiVersion: binding.apiVersion || MODEL_ENDPOINT_API_VERSION,\n          kind: binding.kind || MODEL_ENDPOINT_KIND,\n          name: binding.name,\n          namespace: binding.namespace,\n        }) as ModelEndpointResource | null;\n        if (\n          endpoint &&\n          endpoint.metadata.uid === binding.uid &&\n          endpoint.status?.healthy === true &&\n          Number.isFinite(Date.parse(endpoint.status.heartbeat ?? '')) &&\n          Date.now() - Date.parse(endpoint.status.heartbeat ?? '') <= modelEndpointHeartbeatTtlMs &&\n          endpoint.spec.modelClassRef.name === workload.spec.modelPolicy.modelClass\n        ) {\n          return { run: current, endpoint };\n        }\n      }\n      if (Date.now() >= deadline) {\n        throw new OrchestrationError({\n          code: 'TIMEOUT',\n          message: `AgentRun '${current.metadata.name}' did not receive a healthy ModelEndpoint binding within ${modelBindingTimeoutMs}ms`,\n          retryable: true,\n        });\n      }\n      await sleep(dependencyPollIntervalMs);\n    }\n  }\n\n  async function ensureNetworkAttachment(\n    workload: AgentWorkloadResource,\n    runReference: OrchestrationResourceReference,\n    runUid: string,\n  ): Promise<NetworkAttachmentResource | undefined> {\n    const networkClassName = workload.spec.networkPolicy?.networkClass;\n    if (!networkClassName) return undefined;\n    const attachmentName = `${runReference.name ?? workload.metadata.name}-network`;\n    const reference: OrchestrationResourceReference = {\n      apiVersion: NETWORK_ATTACHMENT_API_VERSION,\n      kind: NETWORK_ATTACHMENT_KIND,\n      name: attachmentName,\n      namespace: workload.metadata.namespace,\n    };\n    let attachment = await store.get<\n      NetworkAttachmentResource['spec'],\n      NetworkAttachmentResource['status']\n    >(reference) as NetworkAttachmentResource | null;\n    if (!attachment) {\n      const manifest = createNetworkAttachmentManifest(attachmentName, {\n        networkClassRef: {\n          apiVersion: 'network.memeloop.io/v1alpha1',\n          kind: 'NetworkClass',\n          name: networkClassName,\n        },\n        workloadRef: {\n          apiVersion: workload.apiVersion,\n          kind: workload.kind,\n          name: workload.metadata.name,\n          uid: workload.metadata.uid,\n        },\n        runRef: {\n          apiVersion: runReference.apiVersion,\n          kind: runReference.kind,\n          name: runReference.name as string,\n          uid: runUid,\n          controller: true,\n        },\n        nodeId: options.nodeId,\n      });\n      manifest.metadata.namespace = workload.metadata.namespace;\n      attachment = await store.create(options.actor, manifest) as unknown as NetworkAttachmentResource;\n    }\n    await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n      ...current,\n      networkAttachmentRef: {\n        apiVersion: attachment.apiVersion,\n        kind: attachment.kind,\n        name: attachment.metadata.name,\n        ...(attachment.metadata.namespace ? { namespace: attachment.metadata.namespace } : {}),\n        uid: attachment.metadata.uid,\n      },\n    }));\n\n    const deadline = Date.now() + networkAttachmentTimeoutMs;\n    for (;;) {\n      if (stopped) {\n        throw new OrchestrationError({\n          code: 'CANCELLED',\n          message: 'workload execution controller stopped while awaiting network attachment',\n          retryable: false,\n        });\n      }\n      const current = await store.get<\n        NetworkAttachmentResource['spec'],\n        NetworkAttachmentResource['status']\n      >(reference) as NetworkAttachmentResource | null;\n      if (!current || current.metadata.uid !== attachment.metadata.uid) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: `NetworkAttachment '${attachmentName}' disappeared before workload launch`,\n          retryable: false,\n        });\n      }\n      if (current.status?.phase === 'Failed') {\n        throw new OrchestrationError({\n          code: current.status.error?.code ?? 'UNAVAILABLE',\n          message: current.status.error?.message ?? `NetworkAttachment '${attachmentName}' failed`,\n          retryable: current.status.error?.retryable ?? false,\n        });\n      }\n      if (current.status?.phase === 'Attached' && current.status.handle) {\n        const networkClass = await store.get<\n          NetworkClassResource['spec'],\n          NetworkClassResource['status']\n        >(current.spec.networkClassRef) as NetworkClassResource | null;\n        if (\n          networkClass &&\n          current.status.binding?.networkClassResourceVersion === networkClass.metadata.resourceVersion &&\n          current.status.assignedNode === options.nodeId &&\n          current.status.assignedDriver === networkClass.spec.driver\n        ) {\n          return current;\n        }\n      }\n      if (Date.now() >= deadline) {\n        throw new OrchestrationError({\n          code: 'TIMEOUT',\n          message: `NetworkAttachment '${attachmentName}' was not ready within ${networkAttachmentTimeoutMs}ms`,\n          retryable: true,\n        });\n      }\n      await sleep(dependencyPollIntervalMs);\n    }\n  }\n\n  async function waitForVolumeBindings(\n    workload: AgentWorkloadResource,\n    runReference: OrchestrationResourceReference,\n  ): Promise<{\n    run: AgentRunResource;\n    mounts?: NonNullable<import('./loopRuntimeDriver.js').LoopRunStartRequest['volumeMounts']>;\n  }> {\n    const expected = workload.spec.storagePolicy?.volumes ?? [];\n    if (expected.length === 0) {\n      const run = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(\n        runReference,\n      ) as AgentRunResource;\n      return { run };\n    }\n    const deadline = Date.now() + volumeBindingTimeoutMs;\n    for (;;) {\n      if (stopped) {\n        throw new OrchestrationError({\n          code: 'CANCELLED',\n          message: 'workload execution controller stopped while awaiting volumes',\n          retryable: false,\n        });\n      }\n      const run = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(\n        runReference,\n      ) as AgentRunResource | null;\n      if (!run) {\n        throw new OrchestrationError({\n          code: 'NOT_FOUND',\n          message: `AgentRun '${runReference.name ?? ''}' disappeared while awaiting volumes`,\n          retryable: false,\n        });\n      }\n      if (run.status?.volumePhase === 'Failed') {\n        throw new OrchestrationError(\n          run.status.volumeError ?? {\n            code: 'UNAVAILABLE',\n            message: 'volume publication failed',\n            retryable: false,\n          },\n        );\n      }\n      const bindingNames = new Set(run.status?.volumeBindings?.map((item) => item.name));\n      if (\n        run.status?.volumePhase === 'Ready' &&\n        expected.every((item) => bindingNames.has(item.name))\n      ) {\n        if (!options.resolveVolumeMounts) {\n          throw new OrchestrationError({\n            code: 'UNSUPPORTED',\n            message: 'host cannot resolve published volume handles',\n            retryable: false,\n          });\n        }\n        return { run, mounts: await options.resolveVolumeMounts(workload, run) };\n      }\n      if (Date.now() >= deadline) {\n        throw new OrchestrationError({\n          code: 'TIMEOUT',\n          message: `AgentRun '${run.metadata.name}' volumes were not ready within ${volumeBindingTimeoutMs}ms`,\n          retryable: true,\n        });\n      }\n      await sleep(dependencyPollIntervalMs);\n    }\n  }\n\n  async function requestDependencyRelease(\n    runReference: OrchestrationResourceReference,\n  ): Promise<void> {\n    const run = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(\n      runReference,\n    ) as AgentRunResource | null;\n    if (!run) return;\n    const requestedAt = new Date().toISOString();\n    const attachment = run.status?.networkAttachmentRef;\n    if (attachment) {\n      await updateStatusWithRetry<NetworkAttachmentStatus>(\n        {\n          apiVersion: attachment.apiVersion,\n          kind: attachment.kind,\n          name: attachment.name,\n          namespace: attachment.namespace,\n        },\n        (current) => ({\n          ...current,\n          releaseRequestedAt: requestedAt,\n        }),\n      );\n    }\n    if (\n      run.status?.volumePhase === 'Ready' ||\n      run.status?.volumePhase === 'Publishing'\n    ) {\n      await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n        ...current,\n        volumeReleaseRequestedAt: requestedAt,\n      }));\n    }\n  }\n\n  async function execute(workload: AgentWorkloadResource): Promise<void> {\n    const workloadReference_ = workloadReference(workload);\n    const runName = `${workload.metadata.name}-run`;\n    const runReference: OrchestrationResourceReference = {\n      apiVersion: AGENT_RUN_API_VERSION,\n      kind: AGENT_RUN_KIND,\n      name: runName,\n      namespace: workload.metadata.namespace,\n    };\n    let runtimeClaimed = false;\n\n    try {\n      // Resolve script source for artifact-backed workloads.\n      let scriptSource: string | undefined;\n      if (workload.spec.scriptReference) {\n        scriptSource = await options.resolveScriptSource?.(workload.spec.scriptReference);\n        if (!scriptSource) {\n          await updateStatusWithRetry<AgentWorkloadStatus>(workloadReference_, (current) => ({\n            ...current,\n            phase: 'Failed',\n            lastRunResult: `script artifact '${workload.spec.scriptReference}' unavailable`,\n          }));\n          return;\n        }\n      }\n\n      // Create (or adopt, after a controller restart) the AgentRun.\n      let run = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(runReference) as AgentRunResource | null;\n      if (!run) {\n        const manifest = createAgentRunManifest(runName, {\n          workloadRef: {\n            apiVersion: AGENT_WORKLOAD_API_VERSION,\n            kind: AGENT_WORKLOAD_KIND,\n            name: workload.metadata.name,\n            namespace: workload.metadata.namespace,\n            uid: workload.metadata.uid,\n          },\n        });\n        manifest.metadata.namespace = workload.metadata.namespace;\n        try {\n          run = await store.create(\n            options.actor,\n            manifest,\n          ) as unknown as AgentRunResource;\n        } catch (error) {\n          if (!(error instanceof OrchestrationError) || error.code !== 'CONFLICT') {\n            throw error;\n          }\n          // A competing controller may have created the deterministic Run.\n          run = await store.get<\n            AgentRunResource['spec'],\n            AgentRunResource['status']\n          >(runReference) as AgentRunResource | null;\n          if (!run) throw error;\n        }\n      }\n      assertCanonicalRunBinding(workload, run);\n      if (run.status?.phase && TERMINAL_RUN_PHASES.has(run.status.phase)) {\n        // Previous attempt finished; mirror the outcome and stop.\n        const terminalStatus = run.status;\n        await updateStatusWithRetry<AgentWorkloadStatus>(workloadReference_, (current) => ({\n          ...current,\n          phase: terminalStatus.phase === 'Completed' ? 'Completed' : 'Failed',\n          lastRunResult: terminalStatus.summary,\n        }));\n        return;\n      }\n\n      const [dependencies, networkAttachment, volumeDependencies] = await Promise.all([\n        waitForModelBinding(workload, runReference),\n        ensureNetworkAttachment(workload, runReference, run.metadata.uid),\n        waitForVolumeBindings(workload, runReference),\n      ]);\n      run = volumeDependencies.run;\n      // ensureNetworkAttachment may have added the durable reference.\n      run = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(\n        runReference,\n      ) as AgentRunResource ?? run;\n\n      await updateStatusWithRetry<AgentWorkloadStatus>(workloadReference_, (current) => ({\n        ...current,\n        phase: 'Running',\n        runs: [runReference],\n      }));\n      const claimedRun = await claimRuntimeExecution(runReference);\n      if (!claimedRun) return;\n      runtimeClaimed = true;\n      run = claimedRun;\n      const handle = await driver.start({\n        workload,\n        run,\n        ...(dependencies.endpoint ? { modelEndpoint: dependencies.endpoint } : {}),\n        ...(networkAttachment ? { networkAttachment } : {}),\n        ...(volumeDependencies.mounts ? { volumeMounts: volumeDependencies.mounts } : {}),\n        scriptSource,\n        message: options.messageForWorkload?.(workload) ?? workload.metadata.name,\n      });\n      active.set(workload.metadata.uid, handle);\n      await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n        ...current,\n        phase: 'Running',\n      }));\n      const outcome = await handle.wait();\n\n      await requestDependencyRelease(runReference);\n\n      await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n        ...current,\n        phase: outcome.phase,\n        summary: outcome.summary ?? outcome.error?.message,\n        exitCode: outcome.phase === 'Completed' ? 0 : 1,\n      }));\n      await updateStatusWithRetry<AgentWorkloadStatus>(workloadReference_, (current) => ({\n        ...current,\n        phase: outcome.phase === 'Completed' ? 'Completed' : 'Failed',\n        lastRunResult: outcome.summary ?? outcome.error?.message,\n      }));\n    } catch (error) {\n      await requestDependencyRelease(runReference).catch(onError);\n      const cause = error instanceof Error ? error.message : String(error);\n      const message = runtimeClaimed\n        ? `UNKNOWN_EFFECT: runtime execution failed after the durable pre-effect claim; verify external state before retrying: ${cause}`\n        : cause;\n      await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n        ...current,\n        ...(current?.phase && TERMINAL_RUN_PHASES.has(current.phase)\n          ? {}\n          : {\n            phase: 'Failed' as const,\n            summary: message,\n            exitCode: 1,\n          }),\n      })).catch(onError);\n      if (stopped) return;\n      onError(error);\n      await updateStatusWithRetry<AgentWorkloadStatus>(workloadReference_, (current) => ({\n        ...current,\n        phase: 'Failed',\n        lastRunResult: message,\n      })).catch(onError);\n    } finally {\n      active.delete(workload.metadata.uid);\n    }\n  }\n\n  async function recoverRunning(workload: AgentWorkloadResource): Promise<void> {\n    const runReference: OrchestrationResourceReference = {\n      apiVersion: AGENT_RUN_API_VERSION,\n      kind: AGENT_RUN_KIND,\n      name: `${workload.metadata.name}-run`,\n      namespace: workload.metadata.namespace,\n    };\n    try {\n      const run = await store.get<AgentRunResource['spec'], AgentRunResource['status']>(\n        runReference,\n      ) as AgentRunResource | null;\n      if (run) {\n        try {\n          assertCanonicalRunBinding(workload, run);\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n            ...current,\n            phase: 'Failed',\n            summary: message,\n            exitCode: 1,\n          }));\n          await updateStatusWithRetry<AgentWorkloadStatus>(\n            workloadReference(workload),\n            (current) => ({\n              ...current,\n              phase: 'Failed',\n              lastRunResult: message,\n            }),\n          );\n          onError(error);\n          return;\n        }\n      }\n      if (!run || !run.status?.phase || run.status.phase === 'Pending') {\n        // The previous daemon stopped before persisting its pre-effect claim.\n        // No runtime side effect was authorized, so this instance may resume.\n        await execute(workload);\n        return;\n      }\n      if (TERMINAL_RUN_PHASES.has(run.status.phase)) {\n        await requestDependencyRelease(runReference);\n        await updateStatusWithRetry<AgentWorkloadStatus>(\n          workloadReference(workload),\n          (current) => ({\n            ...current,\n            phase: run.status?.phase === 'Completed' ? 'Completed' : 'Failed',\n            lastRunResult: run.status?.summary,\n          }),\n        );\n        return;\n      }\n\n      const message = `UNKNOWN_EFFECT: AgentRun '${run.metadata.name}' was left ${run.status.phase} ` +\n        `by controller '${run.status.runtimeExecutionClaim?.controllerInstanceId ?? 'unknown'}'; ` +\n        'the configured LoopRuntimeDriver cannot safely adopt it';\n      await requestDependencyRelease(runReference);\n      await updateStatusWithRetry<AgentRunStatus>(runReference, (current) => ({\n        ...current,\n        phase: 'Failed',\n        summary: message,\n        exitCode: 1,\n      }));\n      await updateStatusWithRetry<AgentWorkloadStatus>(\n        workloadReference(workload),\n        (current) => ({\n          ...current,\n          phase: 'Failed',\n          lastRunResult: message,\n        }),\n      );\n    } catch (error) {\n      onError(error);\n    } finally {\n      active.delete(workload.metadata.uid);\n    }\n  }\n\n  function maybeStart(resource: OrchestrationResource): void {\n    const workload = resource as AgentWorkloadResource;\n    const status = workload.status;\n    if (\n      !status ||\n      (status.phase !== 'Scheduling' && status.phase !== 'Running')\n    ) return;\n    if (status.assignedNode !== options.nodeId) return;\n    if (active.has(workload.metadata.uid)) return;\n    active.set(workload.metadata.uid, { cancel: async () => {} });\n    if (status.phase === 'Running') {\n      void recoverRunning(workload);\n    } else {\n      void execute(workload).catch(onError);\n    }\n  }\n\n  void (async () => {\n    while (!stopped) {\n      try {\n        for await (\n          const event of store.watch(\n            { apiVersion: AGENT_WORKLOAD_API_VERSION, kind: AGENT_WORKLOAD_KIND },\n            { sendInitialEvents: true },\n          )\n        ) {\n          if (stopped) break;\n          if (event.type === 'ADDED' || event.type === 'MODIFIED') {\n            maybeStart(event.resource);\n          } else if (event.type === 'DELETED') {\n            const workload = event.resource as AgentWorkloadResource;\n            await active.get(workload.metadata.uid)?.cancel().catch(onError);\n          }\n        }\n      } catch (error) {\n        onError(error);\n      }\n      if (!stopped) await sleep(1000);\n    }\n  })().catch(onError);\n\n  return {\n    async stop() {\n      stopped = true;\n      for (const handle of active.values()) {\n        await handle.cancel().catch(() => undefined);\n      }\n    },\n  };\n}\n","import type { OrchestrationResource, OrchestrationResourceManifest } from '../orchestration/client.js';\nimport type { ControlStore, ControlStoreActor } from '../orchestration/controlStore.js';\nimport { OrchestrationError } from '../orchestration/errors.js';\nimport type { LoopScriptCheckpointStore } from './types.js';\n\nexport const LOOP_CHECKPOINT_API_VERSION = 'loops.memeloop.io/v1alpha1';\nexport const LOOP_CHECKPOINT_KIND = 'LoopCheckpoint';\n\nexport interface LoopCheckpointSpec {\n  conversationId: string;\n  key: string;\n  result: unknown;\n  /** SHA-256 hex digest of the serialised result. Verified on load. */\n  digest: string;\n  createdAt: string;\n}\n\nexport type LoopCheckpointResource = OrchestrationResource<LoopCheckpointSpec>;\n\nfunction checkpointName(key: string): string {\n  return encodeURIComponent(key);\n}\n\nasync function computeDigest(data: unknown): Promise<string> {\n  const json = JSON.stringify(data);\n  const encoded = new TextEncoder().encode(json);\n  const hash = await crypto.subtle.digest('SHA-256', encoded);\n  return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, '0')).join('');\n}\n\nexport function createControlStoreLoopCheckpointStore(\n  store: ControlStore,\n  actor: ControlStoreActor,\n  now: () => Date = () => new Date(),\n): LoopScriptCheckpointStore {\n  return {\n    async saveCheckpoint(conversationId, key, result) {\n      const reference = {\n        apiVersion: LOOP_CHECKPOINT_API_VERSION,\n        kind: LOOP_CHECKPOINT_KIND,\n        namespace: conversationId,\n        name: checkpointName(key),\n      };\n      const existing = await store.get<LoopCheckpointSpec>(reference);\n      if (existing) return;\n      const cloned = structuredClone(result);\n      const digest = await computeDigest(cloned);\n      const manifest: OrchestrationResourceManifest<LoopCheckpointSpec> = {\n        apiVersion: LOOP_CHECKPOINT_API_VERSION,\n        kind: LOOP_CHECKPOINT_KIND,\n        metadata: { namespace: conversationId, name: checkpointName(key) },\n        spec: { conversationId, key, result: cloned, digest, createdAt: now().toISOString() },\n      };\n      try {\n        await store.create(actor, manifest, { idempotencyKey: `loop-checkpoint:${conversationId}:${key}` });\n      } catch (error) {\n        if (!(error instanceof OrchestrationError) || error.code !== 'CONFLICT') throw error;\n      }\n    },\n\n    async loadCheckpoint<T>(conversationId: string, key: string): Promise<T | undefined> {\n      const checkpoint = await store.get<LoopCheckpointSpec>({\n        apiVersion: LOOP_CHECKPOINT_API_VERSION,\n        kind: LOOP_CHECKPOINT_KIND,\n        namespace: conversationId,\n        name: checkpointName(key),\n      });\n      if (!checkpoint) return undefined;\n      const expectedDigest = checkpoint.spec.digest;\n      const actualDigest = await computeDigest(checkpoint.spec.result);\n      if (actualDigest !== expectedDigest) return undefined;\n      return structuredClone(checkpoint.spec.result) as T;\n    },\n  };\n}\n","import type { AgentDefinition } from './agent/types.js';\nimport type { ChatMessage } from './conversation/index.js';\nimport type { AgentOrchestrationClient, NodeTrustClass, ScriptDeploymentClientConfig, ToolOperationEffect } from './orchestration/index.js';\nimport type { AgentFrameworkConfig } from './promptUtilities/types.js';\nimport type { IAgentStorage } from './storage/interface.js';\nimport type { ConversationMeta } from './sync/protocol.js';\n\nimport type { AgentLoopGenerator, AgentLoopInput, AgentLoopRuntime, AgentLoopScriptPolicy } from './loopAPI/types.js';\nimport type { LoopScriptCheckpointStore } from './loopAPI/types.js';\nimport type { ControlStore } from './orchestration/controlStore.js';\nimport type { CheckpointStore } from './storage/sessionStorage.js';\n\n// Storage types are defined once in `storage/ports.ts` (narrow ports) and\n// composed in `storage/interface.ts`; re-exported here for compatibility.\nexport type { ConversationQueryMode, GetMessagesOptions, IAgentStorage, ListConversationsOptions } from './storage/interface.js';\n\nexport interface MemeLoopLogger {\n  debug?(message: string, ...arguments_: unknown[]): void;\n  info?(message: string, ...arguments_: unknown[]): void;\n  warn?(message: string, ...arguments_: unknown[]): void;\n  error?(message: string, ...arguments_: unknown[]): void;\n}\n\nexport interface ILLMProvider {\n  name: string;\n  /**\n   * Serializable default model identity used by orchestration resources.\n   * `model` may be an SDK object or factory and must never be persisted.\n   */\n  modelId?: string;\n  model?: unknown;\n\n  chat(request: unknown): AsyncIterable<unknown> | Promise<unknown>;\n}\n\n/* eslint-disable @typescript-eslint/no-redundant-type-constituents */\nexport interface IToolRegistry {\n  registerTool(\n    id: string,\n    impl: unknown,\n    parameterSchema?: unknown,\n    effect?: ToolOperationEffect,\n  ): void;\n  getTool(id: string): unknown | undefined;\n  listTools(): string[];\n  /**\n   * Instance-local schema lookup. Managed catalogs use this when available so\n   * one embedded runtime cannot inherit another runtime's process-global schema.\n   */\n  getToolParameterSchema?: (id: string) => unknown | undefined;\n  /** Host-authoritative effect classification; omitted tools default to conservative execute. */\n  getToolEffect?: (id: string) => ToolOperationEffect | undefined;\n  /** Prompt-concat plugin registry, isolated per runtime. Falls back to the process-level default registry. */\n  getPromptPlugins?: () => Map<\n    string,\n    (hooks: import('./tools/types.js').PromptConcatHooks) => void\n  >;\n}\n\nexport interface IChatSyncAdapter {\n  start(): Promise<void>;\n  stop(): Promise<void>;\n}\n\nexport interface INetworkService {\n  start(): Promise<void>;\n  stop(): Promise<void>;\n}\n\nexport interface AgentToolLoopOptions {\n  /** Maximum LLM-to-tool round-trips. `0` means unlimited, still capped internally. */\n  maxIterations?: number;\n  /** Whether to parse `<tool_use>` / `<function_call>` and execute through `IToolRegistry` (default true). */\n  enableToolLoop?: boolean;\n  /** Cancellation check, e.g. when the user stops a run. */\n  isCancelled?: (conversationId: string) => boolean;\n  /** Attachment injection for promptConcat, aligned with `PromptConcatOptions`. */\n  readAttachmentFile?: (path: string) => Promise<Uint8Array>;\n  /** Omit history older than this many milliseconds when building LLM input. `0` disables trimming. */\n  maxHistoryAgeMs?: number;\n  /**\n   * When `defineTool` / plugins are configured, fall back to `IToolRegistry` for tool calls not handled by `onResponseComplete`.\n   */\n  fallbackRegistryTools?: boolean;\n  /**\n   * Tool permission rules (default allow).\n   * Supports wildcards such as \"terminal.*\" and \"file.read\".\n   */\n  toolPermissions?: {\n    default?: 'allow' | 'ask' | 'deny';\n    rules?: Array<{ pattern: string; action: 'allow' | 'ask' | 'deny' }>;\n    perAgent?: Record<\n      string,\n      {\n        default?: 'allow' | 'ask' | 'deny';\n        rules?: Array<{ pattern: string; action: 'allow' | 'ask' | 'deny' }>;\n      }\n    >;\n  };\n  /** Threshold for repeated identical tool+input calls (default 3). */\n  doomLoopThreshold?: number;\n  /**\n   * Timeout for a single ToolOperation executed through the orchestration\n   * facade (default 60_000ms). Covers the full lifecycle from apply until a\n   * terminal phase, including scheduling and remote execution.\n   */\n  toolOperationTimeoutMs?: number;\n  /**\n   * Host-bound trust class of the node running this loop. Restricted and\n   * quarantine nodes default the model-facing tool permission layer to deny\n   * when no explicit wildcard rule exists. Bound by the host at assembly\n   * time; never self-reported by the workload or model.\n   */\n  trustClass?: NodeTrustClass;\n  /** History compaction window: keep the most recent N turns plus the last user message. */\n  contextCompaction?: { maxMessages?: number; replayLastUserMessage?: boolean };\n  /**\n   * Auto-compaction: when message count exceeds threshold, summarizes old\n   * conversation turns via truncation or LLM summarization. Default: disabled.\n   */\n  autoCompact?: {\n    /** Trigger compaction when message count exceeds this (default: 50) */\n    threshold?: number;\n    /** Number of recent turns to preserve (default: 4) */\n    recentTurnsToKeep?: number;\n    /** Maximum token estimate before compaction; 0 disables token-based compaction */\n    maxTokens?: number;\n  };\n  /** Session checkpoint: save conversation history after each turn for resume. */\n  sessionCheckpoint?: {\n    /** Enable checkpoint saves. Default: false. */\n    enabled?: boolean;\n    /** Store provided by the runtime host. */\n    store?: CheckpointStore;\n    /** Custom checkpoint directory (default: ~/.memeloop/sessions/) */\n    directory?: string;\n  };\n  /**\n   * After a tool returns `__memeloopToolResult.awaitSessionId`, AgentToolLoop waits here before the next LLM round.\n   */\n  waitForTerminalSession?: (sessionId: string) => Promise<{\n    exitCode: number | null;\n    truncatedOutput: string;\n  }>;\n}\n\nexport interface AgentFrameworkContext {\n  storage: IAgentStorage;\n  llmProvider: ILLMProvider;\n  tools: IToolRegistry;\n  syncAdapters: IChatSyncAdapter[];\n  network: INetworkService;\n  /** Policy-scoped declarative manager facade shared by Agent loops and Agent-facing tools. */\n  orchestration?: AgentOrchestrationClient;\n  /**\n   * Host-bound script deployment configuration (plan 24.14). Loop runtimes\n   * build a `ctx.scriptClient` from it; scripts never see the raw config,\n   * so trust class and interface ceilings stay host-controlled.\n   */\n  scriptDeployment?: ScriptDeploymentClientConfig;\n  /** Trusted controller state store; Agent-facing loop scripts receive only its checkpoint adapter. */\n  controlStore?: ControlStore;\n  /** Durable milestones used by script-backed loops such as quality-gate. */\n  loopCheckpoints?: LoopScriptCheckpointStore;\n  /** Let host runtimes preserve platform-specific message aliases/metadata while core owns the loop. */\n  normalizeMessage?: (message: ChatMessage) => ChatMessage;\n  /**\n   * Notify a host about an in-memory streaming message. The core invokes this\n   * with the same message ID used for the immutable final persisted message.\n   */\n  onTransientMessage?: (message: ChatMessage) => void | Promise<void>;\n\n  /** AgentToolLoop ReAct behavior, migrated from the TidGi-Desktop agentToolLoop integration. */\n  agentToolLoop?: AgentToolLoopOptions;\n  /**\n   * Host-injected runner used by `createMemeLoopRuntime` after a user sends a message.\n   */\n  runAgentToolLoop?: (input: AgentLoopInput) => AgentLoopGenerator;\n  /** Run a child agent for orchestration loops such as AgentAgentLoop. */\n  runChildAgent?: AgentLoopRuntime['runChildAgent'];\n  /** Policy for loading script-backed loops. Defaults to bundled scripts + import specifiers only. */\n  loopScriptPolicy?: AgentLoopScriptPolicy;\n  /**\n   * Build the agent view supplied to defineTool hooks for a conversation.\n   */\n  resolveAgentRuntimeView?: (\n    conversationId: string,\n    messages: ChatMessage[],\n  ) => Promise<AgentInstanceModel>;\n  /** Current agent view for defineTool / TidGi compatibility. */\n  agent?: { id: string; messages: ChatMessage[] };\n  /** Persist a `ChatMessage` if the runtime host supplies this hook. */\n  persistAgentMessage?: (message: ChatMessage) => Promise<void>;\n  /** Cancellation markers written by `createMemeLoopRuntime`. */\n  conversationCancellation?: Set<string>;\n  /** Resolve an AgentDefinition from host-specific sources. */\n  resolveAgentDefinition?: (definitionId: string) => Promise<AgentDefinition | null>;\n  /** Fallback logger used when the host does not inject one. */\n  logger?: MemeLoopLogger;\n  /** TidGi defineTool compatibility: legacy plugins call this without arguments. */\n  isCancelled?: () => boolean;\n}\n\nexport type AgentInstanceState =\n  | 'submitted'\n  | 'working'\n  | 'input-required'\n  | 'completed'\n  | 'canceled'\n  | 'failed'\n  | 'unknown';\n\nexport interface AgentInstanceLatestStatus {\n  state: AgentInstanceState;\n  message?: ChatMessage;\n  /** Human-readable sub-status for the header — shown while agent is working. */\n  progress?: string;\n  created?: Date;\n  modified?: Date;\n}\n\nexport interface AgentInstanceModel extends Omit<AgentDefinition, 'name'> {\n  agentDefId: string;\n  name?: string;\n  agentFrameworkConfig?: AgentFrameworkConfig;\n  messages: ChatMessage[];\n  status: AgentInstanceLatestStatus;\n  created: Date;\n  modified?: Date;\n  closed?: boolean;\n  volatile?: boolean;\n  isDelegatedAgentRun?: boolean;\n  parentAgentRunId?: string;\n}\n\nexport type { AgentInstanceModel as AgentInstance };\n\nexport function isUserInitiatedConversation(meta: ConversationMeta): boolean {\n  return meta.isUserInitiated;\n}\n\nexport function createInstanceDeltaFromDefinition(\n  definition: AgentDefinition,\n  overrides: Partial<AgentDefinition>,\n): Partial<AgentDefinition> {\n  const delta: Partial<AgentDefinition> = {};\n  for (const key of Object.keys(overrides) as Array<Extract<keyof AgentDefinition, string>>) {\n    const value = overrides[key];\n    if (value !== undefined && value !== definition[key]) {\n      (delta as Record<string, unknown>)[key] = value;\n    }\n  }\n  return delta;\n}\n","import { type AttachmentReference, createChatMessage } from '../conversation/index.js';\n\nimport type { FullAgentStorage } from './ports.js';\n\n/**\n * Storage conformance suite (plan 24.43).\n *\n * Host-agnostic behavioral checks every logical storage driver must pass.\n * Run it in the host's own test setup (`runStorageConformance` returns a\n * report; `assertStorageConformance` throws on the first failure summary).\n * Drivers that implement only a subset of ports can run the relevant checks\n * via `checks` filtering.\n */\n\nexport interface StorageConformanceFailure {\n  check: string;\n  message: string;\n}\n\nexport interface StorageConformanceReport {\n  checks: number;\n  passed: number;\n  failures: StorageConformanceFailure[];\n}\n\nexport const STORAGE_CONFORMANCE_CHECKS = [\n  'append-and-read-messages',\n  'insert-if-absent-dedupes',\n  'conversation-metadata-round-trip',\n  'list-conversations',\n  'attachment-round-trip',\n  'missing-definition-returns-null',\n] as const;\n\nexport type StorageConformanceCheck = (typeof STORAGE_CONFORMANCE_CHECKS)[number];\n\nfunction bytesEqual(a: Uint8Array, b: Uint8Array): boolean {\n  return a.length === b.length && a.every((byte, index) => byte === b[index]);\n}\n\nexport async function runStorageConformance(\n  storage: FullAgentStorage,\n  options: { conversationId?: string; checks?: readonly StorageConformanceCheck[] } = {},\n): Promise<StorageConformanceReport> {\n  const conversationId = options.conversationId ?? `conformance-${Date.now().toString(36)}`;\n  const enabled = new Set(options.checks ?? STORAGE_CONFORMANCE_CHECKS);\n  const failures: StorageConformanceFailure[] = [];\n  let checks = 0;\n\n  async function run(name: StorageConformanceCheck, body: () => Promise<void>): Promise<void> {\n    if (!enabled.has(name)) return;\n    checks += 1;\n    try {\n      await body();\n    } catch (error) {\n      failures.push({ check: name, message: error instanceof Error ? error.message : String(error) });\n    }\n  }\n\n  function expect(condition: boolean, message: string): void {\n    if (!condition) throw new Error(message);\n  }\n\n  await run('append-and-read-messages', async () => {\n    const first = createChatMessage({ messageId: `${conversationId}:m1`, conversationId, role: 'user', content: 'hello', lamportClock: 1 });\n    const second = createChatMessage({ messageId: `${conversationId}:m2`, conversationId, role: 'assistant', content: 'world', lamportClock: 2 });\n    await storage.appendMessage(first);\n    await storage.appendMessage(second);\n    const messages = await storage.getMessages(conversationId, { mode: 'full-content' });\n    const ids = messages.map((message) => message.messageId);\n    expect(ids.includes(first.messageId) && ids.includes(second.messageId), `expected both messages, got ${ids.join(',')}`);\n    const roundTrip = messages.find((message) => message.messageId === first.messageId);\n    expect(roundTrip?.content === 'hello', 'message content must round-trip');\n  });\n\n  await run('insert-if-absent-dedupes', async () => {\n    const message = createChatMessage({ messageId: `${conversationId}:dup`, conversationId, role: 'user', content: 'once', lamportClock: 3 });\n    await storage.insertMessagesIfAbsent([message]);\n    await storage.insertMessagesIfAbsent([message]);\n    const messages = await storage.getMessages(conversationId, { mode: 'full-content' });\n    const occurrences = messages.filter((entry) => entry.messageId === message.messageId);\n    expect(occurrences.length === 1, `expected exactly one copy, got ${occurrences.length}`);\n  });\n\n  await run('conversation-metadata-round-trip', async () => {\n    await storage.upsertConversationMetadata({\n      conversationId,\n      title: 'conformance',\n      lastMessagePreview: '',\n      lastMessageTimestamp: Date.now(),\n      messageCount: 0,\n      originNodeId: 'local',\n      originClock: 1,\n      definitionId: 'conformance-agent',\n      isUserInitiated: true,\n    });\n    const meta = await storage.getConversationMeta(conversationId);\n    expect(meta != null, 'getConversationMeta must return the upserted row');\n    expect(meta?.definitionId === 'conformance-agent', 'metadata fields must round-trip');\n  });\n\n  await run('list-conversations', async () => {\n    const conversations = await storage.listConversations();\n    expect(\n      conversations.some((meta) => meta.conversationId === conversationId),\n      'listConversations must include the written conversation',\n    );\n  });\n\n  await run('attachment-round-trip', async () => {\n    const bytes = new TextEncoder().encode('conformance-blob-payload');\n    const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes);\n    const contentHash = `sha256:${[...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, '0')).join('')}`;\n    const reference: AttachmentReference = {\n      contentHash,\n      filename: 'payload.bin',\n      mimeType: 'application/octet-stream',\n      size: bytes.byteLength,\n    };\n    await storage.saveAttachment(reference, bytes);\n    const stored = await storage.getAttachment(reference.contentHash);\n    expect(stored != null, 'getAttachment must return the saved reference');\n    if (typeof storage.readAttachmentData === 'function') {\n      const data = await storage.readAttachmentData(reference.contentHash);\n      expect(data != null && bytesEqual(data, bytes), 'attachment bytes must round-trip as Uint8Array');\n    }\n  });\n\n  await run('missing-definition-returns-null', async () => {\n    const missing = await storage.getAgentDefinition(`${conversationId}:missing`);\n    expect(missing === null, 'getAgentDefinition must return null for unknown ids');\n  });\n\n  return { checks, passed: checks - failures.length, failures };\n}\n\nexport async function assertStorageConformance(\n  storage: FullAgentStorage,\n  options: { conversationId?: string; checks?: readonly StorageConformanceCheck[] } = {},\n): Promise<void> {\n  const report = await runStorageConformance(storage, options);\n  if (report.failures.length > 0) {\n    const summary = report.failures.map((failure) => `${failure.check}: ${failure.message}`).join('; ');\n    throw new Error(`storage conformance failed (${report.passed}/${report.checks}): ${summary}`);\n  }\n}\n","import type { ChatMessage } from '../conversation/index.js';\n\nexport interface CheckpointRecord {\n  conversationId: string;\n  messages: ChatMessage[];\n  savedAt: string;\n  messageCount: number;\n  lastMessagePreview: string;\n}\n\nexport interface CheckpointSummary {\n  conversationId: string;\n  savedAt: string;\n  messageCount: number;\n  lastMessagePreview: string;\n}\n\nexport interface CheckpointStore {\n  saveCheckpoint(conversationId: string, messages: ChatMessage[]): Promise<CheckpointRecord>;\n  loadCheckpoint(conversationId: string): Promise<CheckpointRecord | null>;\n  listCheckpoints(): Promise<CheckpointSummary[]>;\n  deleteCheckpoint(conversationId: string): Promise<boolean>;\n}\n\nexport interface SessionStorageOptions {\n  records?: CheckpointRecord[];\n}\n\nexport function createCheckpointRecord(\n  conversationId: string,\n  messages: ChatMessage[],\n  savedAt = new Date().toISOString(),\n): CheckpointRecord {\n  const lastMessage = messages[messages.length - 1];\n  const preview = lastMessage && typeof lastMessage.content === 'string' ? lastMessage.content.slice(0, 200) : '';\n\n  return {\n    conversationId,\n    messages: [...messages],\n    savedAt,\n    messageCount: messages.length,\n    lastMessagePreview: preview,\n  };\n}\n\nexport function parseCheckpointRecord(raw: string): CheckpointRecord | null {\n  try {\n    const record = JSON.parse(raw) as unknown;\n    return isCheckpointRecord(record) ? record : null;\n  } catch {\n    return null;\n  }\n}\n\nexport function serializeCheckpointRecord(record: CheckpointRecord): string {\n  return JSON.stringify(record, null, 2);\n}\n\nexport class InMemoryCheckpointStore implements CheckpointStore {\n  private readonly records = new Map<string, CheckpointRecord>();\n\n  constructor(options: SessionStorageOptions = {}) {\n    for (const record of options.records ?? []) {\n      this.records.set(record.conversationId, cloneCheckpointRecord(record));\n    }\n  }\n\n  async saveCheckpoint(conversationId: string, messages: ChatMessage[]): Promise<CheckpointRecord> {\n    const record = createCheckpointRecord(conversationId, messages);\n    this.records.set(conversationId, cloneCheckpointRecord(record));\n    return cloneCheckpointRecord(record);\n  }\n\n  async loadCheckpoint(conversationId: string): Promise<CheckpointRecord | null> {\n    const record = this.records.get(conversationId);\n    return record ? cloneCheckpointRecord(record) : null;\n  }\n\n  async listCheckpoints(): Promise<CheckpointSummary[]> {\n    return [...this.records.values()]\n      .map(toCheckpointSummary)\n      .sort((a, b) => b.savedAt.localeCompare(a.savedAt));\n  }\n\n  async deleteCheckpoint(conversationId: string): Promise<boolean> {\n    return this.records.delete(conversationId);\n  }\n}\n\nexport class SessionStorage extends InMemoryCheckpointStore {}\n\nfunction isCheckpointRecord(record: unknown): record is CheckpointRecord {\n  if (!record || typeof record !== 'object') return false;\n  const candidate = record as Record<string, unknown>;\n  return (\n    typeof candidate.conversationId === 'string' &&\n    Array.isArray(candidate.messages) &&\n    typeof candidate.savedAt === 'string' &&\n    typeof candidate.messageCount === 'number' &&\n    typeof candidate.lastMessagePreview === 'string'\n  );\n}\n\nfunction cloneCheckpointRecord(record: CheckpointRecord): CheckpointRecord {\n  return {\n    ...record,\n    messages: [...record.messages],\n  };\n}\n\nfunction toCheckpointSummary(record: CheckpointRecord): CheckpointSummary {\n  return {\n    conversationId: record.conversationId,\n    savedAt: record.savedAt,\n    messageCount: record.messageCount,\n    lastMessagePreview: record.lastMessagePreview,\n  };\n}\n","/**\n * Convert TiddlyWiki tiddler fields into memeloop AgentDefinition.\n *\n * Tiddlers tagged `$:/tags/AI/Template` carry agent configuration in their text field (JSON).\n * This pure function handles the parsing and field mapping.\n */\nimport type { AgentDefinition } from '../agent/types.js';\nimport type { AgentFrameworkConfig, PromptNode, PromptPluginConfig } from '../promptUtilities/types.js';\n\n/** Minimal tiddler fields shape consumed by the converter. */\nexport interface TiddlerFieldsForAgent {\n  title: string;\n  text?: string;\n  caption?: string;\n  description?: string;\n  avatar_url?: string;\n  handler_id?: string;\n  agentFrameworkID?: string;\n  ai_api_config?: string | Record<string, unknown>;\n  agent_tools?: string | unknown[];\n}\n\n/**\n * Validate and convert a wiki tiddler to an AgentDefinition.\n * Returns null if the tiddler cannot be parsed.\n */\nexport function tiddlerToAgentDefinition(\n  tiddler: TiddlerFieldsForAgent,\n  workspaceName?: string,\n): AgentDefinition | null {\n  if (!tiddler || !tiddler.title || typeof tiddler.text !== 'string') return null;\n\n  let agentFrameworkConfig: Record<string, unknown>;\n  try {\n    const parsed = JSON.parse(tiddler.text) as unknown;\n    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {\n      return null;\n    }\n    agentFrameworkConfig = parsed as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n\n  const getString = (field: unknown, fallback = ''): string =>\n    typeof field === 'string'\n      ? field\n      : field && typeof field === 'object'\n      ? JSON.stringify(field)\n      : fallback;\n\n  const parseJSON = (field: unknown): Record<string, unknown> | unknown[] | undefined => {\n    if (typeof field === 'string') {\n      try {\n        const parsed = JSON.parse(field) as unknown;\n        if (typeof parsed === 'object' && parsed !== null) {\n          return parsed as Record<string, unknown> | unknown[];\n        }\n      } catch {\n        /* ignore */\n      }\n    }\n    return undefined;\n  };\n\n  const id = `wiki-template-${getString(tiddler.title).replace(/[^a-zA-Z0-9-_]/g, '-')}`;\n  const name = getString(tiddler.caption) || getString(tiddler.title);\n  const description = getString(tiddler.description) || `Agent template from ${workspaceName || 'wiki'}`;\n\n  const modelConfigRaw = parseJSON(tiddler.ai_api_config);\n  const rawAsRecord = modelConfigRaw && typeof modelConfigRaw === 'object' && !Array.isArray(modelConfigRaw)\n    ? modelConfigRaw\n    : undefined;\n  const modelConfig = rawAsRecord\n    ? {\n      provider: typeof rawAsRecord.provider === 'string' ? rawAsRecord.provider : '',\n      model: typeof rawAsRecord.model === 'string' ? rawAsRecord.model : '',\n    }\n    : undefined;\n\n  const toolsRaw = parseJSON(tiddler.agent_tools);\n  const toolNames = Array.isArray(toolsRaw)\n    ? (toolsRaw as Array<Record<string, unknown>>)\n      .filter((t) => typeof t?.toolId === 'string')\n      .map((t) => String(t.toolId))\n    : [];\n\n  return {\n    id,\n    name,\n    description,\n    systemPrompt: '',\n    tools: toolNames,\n    modelConfig,\n    // Keep the original config as promptSchema for the UI editor\n    promptSchema: agentFrameworkConfig,\n    agentFrameworkConfig: {\n      prompts: Array.isArray(agentFrameworkConfig.prompts)\n        ? (agentFrameworkConfig.prompts as PromptNode[])\n        : [],\n      plugins: Array.isArray(agentFrameworkConfig.plugins)\n        ? (agentFrameworkConfig.plugins as PromptPluginConfig[])\n        : [],\n      response: Array.isArray(agentFrameworkConfig.response)\n        ? agentFrameworkConfig.response\n        : undefined,\n    } as AgentFrameworkConfig,\n    version: '1',\n  };\n}\n","/**\n * Git HTTP 反向代理目标校验：降低 SSRF 风险（内网/metadata 等）。\n * 仍依赖 getBackendUrl 返回可信基础 URL；此处拦截明显危险的解析结果。\n */\n\nfunction ipv4Parts(host: string): number[] | null {\n  const m = /^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/.exec(host);\n  if (!m) return null;\n  return m.slice(1, 5).map((x) => Number(x));\n}\n\nfunction isPrivateOrLoopbackIpv4(host: string): boolean {\n  const p = ipv4Parts(host);\n  if (!p || p.some((n) => n > 255)) return false;\n  const [a, b] = p;\n  if (a === 127 || a === 0) return true;\n  if (a === 10) return true;\n  if (a === 172 && b >= 16 && b <= 31) return true;\n  if (a === 192 && b === 168) return true;\n  if (a === 169 && b === 254) return true;\n  return false;\n}\n\n/** 若目标 URL 不允许作为 Git 代理上游，返回简短原因；否则 null。 */\nexport function gitProxyTargetBlockReason(url: URL): string | null {\n  if (url.username || url.password) {\n    return 'credentials_in_url';\n  }\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') {\n    return 'unsupported_protocol';\n  }\n  const host = url.hostname.toLowerCase();\n  if (\n    host === 'localhost' ||\n    host.endsWith('.localhost') ||\n    host === '0.0.0.0' ||\n    host === '[::]' ||\n    host === '::'\n  ) {\n    return 'loopback_or_wildcard';\n  }\n  if (host.startsWith('127.')) {\n    return 'loopback_ipv4';\n  }\n  if (isPrivateOrLoopbackIpv4(host)) {\n    return 'private_ipv4';\n  }\n  if (host.includes(':') && !host.startsWith('[')) {\n    const lower = host.toLowerCase();\n    if (lower.startsWith('fe80:') || lower.startsWith('fc') || lower.startsWith('fd')) {\n      return 'private_ipv6';\n    }\n    if (lower === '::1') {\n      return 'loopback_ipv6';\n    }\n  }\n  if (host.startsWith('[') && host.endsWith(']')) {\n    const inner = host.slice(1, -1).toLowerCase();\n    if (inner === '::1' || inner.startsWith('fe80:') || inner.startsWith('fc') || inner.startsWith('fd')) {\n      return 'blocked_ipv6_literal';\n    }\n  }\n  const h = host.replace(/^\\[|\\]$/g, '').toLowerCase();\n  if (h === 'metadata.google.internal' || h.endsWith('.internal')) {\n    return 'internal_hostname';\n  }\n  return null;\n}\n","/**\n * memeloop:// URI scheme for cross-node references (e.g. file.read without inlining bytes).\n * Format: memeloop://node/<nodeId>/file/<pathSegments...>\n * Path segments are percent-encoded per RFC 3986.\n */\n\nexport type MemeloopUriKind = 'file';\n\nexport interface ParsedMemeloopFileUri {\n  scheme: 'memeloop';\n  kind: 'file';\n  nodeId: string;\n  /** Logical path on the holding node (slashes preserved, not leading slash). */\n  filePath: string;\n}\n\nexport type ParsedMemeloopUri = ParsedMemeloopFileUri;\n\nconst PREFIX = 'memeloop://node/';\n\n/**\n * Build `memeloop://node/<nodeId>/file/<encodedPath>` for a file on a node.\n */\nexport function buildMemeloopFileUri(nodeId: string, filePath: string): string {\n  const normalized = filePath.replace(/^\\/+/, '');\n  const segments = normalized.split('/').filter(Boolean).map(encodeURIComponent);\n  return `memeloop://node/${encodeURIComponent(nodeId)}/file/${segments.join('/')}`;\n}\n\n/** Alias for {@link buildMemeloopFileUri} (plan §22.2 / §16.8 `buildMemeloopUri`). */\nexport const buildMemeloopUri = buildMemeloopFileUri;\n\n/**\n * Parse a memeloop URI. Currently only `.../file/...` is supported.\n */\nexport function parseMemeloopUri(uri: string): ParsedMemeloopUri | null {\n  const u = uri.trim();\n  if (!u.startsWith(PREFIX)) return null;\n  const rest = u.slice(PREFIX.length);\n  const slash = rest.indexOf('/');\n  if (slash <= 0) return null;\n  let nodeId: string;\n  try {\n    nodeId = decodeURIComponent(rest.slice(0, slash));\n  } catch {\n    return null;\n  }\n  const afterNode = rest.slice(slash + 1);\n  if (!afterNode.startsWith('file/')) return null;\n  const pathPart = afterNode.slice('file/'.length);\n  if (pathPart.length === 0) {\n    return { scheme: 'memeloop', kind: 'file', nodeId, filePath: '' };\n  }\n  try {\n    const filePath = pathPart.split('/').map(decodeURIComponent).join('/');\n    return { scheme: 'memeloop', kind: 'file', nodeId, filePath };\n  } catch {\n    return null;\n  }\n}\n","import type { AgentDefinition } from '../agent/types.js';\nimport type { ChatMessage } from '../conversation/index.js';\nimport type { MemeLoopRuntime } from '../runtime.js';\nimport type { ConversationMeta } from '../sync/protocol.js';\nimport type { IAgentStorage } from '../types.js';\nimport type { DeviceRpcHandler } from './types.js';\n\nexport interface AgentRuntimeDeviceRpcHandlerOptions {\n  runtime: Pick<MemeLoopRuntime, 'createAgent' | 'sendMessage' | 'cancelAgent'>;\n  storage: IAgentStorage;\n  getAgentDefinitions?: () => AgentDefinition[] | Promise<AgentDefinition[]>;\n  localNodeId?: string;\n}\n\nexport function createAgentRuntimeDeviceRpcHandler(options: AgentRuntimeDeviceRpcHandlerOptions): DeviceRpcHandler {\n  return async ({ method, parameters }) => {\n    switch (method) {\n      case 'memeloop.agent.getDefinitions':\n        return { definitions: await options.getAgentDefinitions?.() ?? [] };\n      case 'memeloop.agent.create': {\n        const rpcParameters = objectParameter(parameters);\n        return options.runtime.createAgent({\n          definitionId: stringParameter(rpcParameters, 'definitionId'),\n          initialMessage: optionalStringParameter(rpcParameters, 'initialMessage'),\n        });\n      }\n      case 'memeloop.agent.send': {\n        const rpcParameters = objectParameter(parameters);\n        await options.runtime.sendMessage({\n          conversationId: stringParameter(rpcParameters, 'conversationId'),\n          message: stringParameter(rpcParameters, 'message'),\n          definitionId: optionalStringParameter(rpcParameters, 'definitionId'),\n          userMessage: chatMessageParameter(rpcParameters, 'userMessage'),\n          resumeSession: chatMessageArrayParameter(rpcParameters, 'resumeSession'),\n        });\n        return { ok: true };\n      }\n      case 'memeloop.agent.runTurn': {\n        const rpcParameters = objectParameter(parameters);\n        const conversationId = stringParameter(rpcParameters, 'conversationId');\n        const definitionId = stringParameter(rpcParameters, 'definitionId');\n        await upsertConversationForRemoteTurn({\n          storage: options.storage,\n          conversationId,\n          definitionId,\n          conversation: conversationMetaParameter(rpcParameters, 'conversation'),\n          localNodeId: options.localNodeId,\n        });\n        await options.runtime.sendMessage({\n          conversationId,\n          definitionId,\n          message: stringParameter(rpcParameters, 'message'),\n          userMessage: chatMessageParameter(rpcParameters, 'userMessage'),\n          resumeSession: chatMessageArrayParameter(rpcParameters, 'resumeSession'),\n        });\n        return { ok: true, conversationId };\n      }\n      case 'memeloop.agent.cancel': {\n        const rpcParameters = objectParameter(parameters);\n        await options.runtime.cancelAgent(stringParameter(rpcParameters, 'conversationId'));\n        return { ok: true };\n      }\n      case 'memeloop.chat.pullAgentRunLog': {\n        const rpcParameters = objectParameter(parameters);\n        const conversationId = stringParameter(rpcParameters, 'conversationId');\n        const known = new Set(stringArrayParameter(rpcParameters, 'knownMessageIds'));\n        const messages = await options.storage.getMessages(conversationId, { mode: 'full-content' });\n        return { messages: messages.filter((message) => !known.has(message.messageId)) };\n      }\n      default:\n        throw new Error(`rpc_method_not_found:${method}`);\n    }\n  };\n}\n\nasync function upsertConversationForRemoteTurn(input: {\n  storage: IAgentStorage;\n  conversationId: string;\n  definitionId: string;\n  conversation?: ConversationMeta;\n  localNodeId?: string;\n}): Promise<void> {\n  if (input.conversation) {\n    await input.storage.upsertConversationMetadata(input.conversation);\n    return;\n  }\n  const existing = await input.storage.getConversationMeta(input.conversationId).catch(() => null);\n  if (existing) return;\n  const now = Date.now();\n  await input.storage.upsertConversationMetadata({\n    conversationId: input.conversationId,\n    title: input.definitionId,\n    lastMessagePreview: '',\n    lastMessageTimestamp: now,\n    messageCount: 0,\n    originNodeId: input.localNodeId ?? 'remote',\n    originClock: 1,\n    definitionId: input.definitionId,\n    isUserInitiated: true,\n  });\n}\n\nfunction objectParameter(value: unknown): Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) throw new Error('invalid_rpc_params');\n  return value as Record<string, unknown>;\n}\n\nfunction stringParameter(parameters: Record<string, unknown>, key: string): string {\n  const value = parameters[key];\n  if (typeof value !== 'string' || value.length === 0) throw new Error('invalid_rpc_params');\n  return value;\n}\n\nfunction optionalStringParameter(parameters: Record<string, unknown>, key: string): string | undefined {\n  const value = parameters[key];\n  if (value === undefined) return undefined;\n  if (typeof value !== 'string') throw new Error('invalid_rpc_params');\n  return value;\n}\n\nfunction stringArrayParameter(parameters: Record<string, unknown>, key: string): string[] {\n  const value = parameters[key];\n  if (value === undefined) return [];\n  if (!Array.isArray(value)) throw new Error('invalid_rpc_params');\n  return value.filter((item): item is string => typeof item === 'string');\n}\n\nfunction chatMessageParameter(parameters: Record<string, unknown>, key: string): ChatMessage | undefined {\n  const value = parameters[key];\n  if (value === undefined) return undefined;\n  if (!isChatMessage(value)) throw new Error('invalid_rpc_params');\n  return value;\n}\n\nfunction chatMessageArrayParameter(parameters: Record<string, unknown>, key: string): ChatMessage[] | undefined {\n  const value = parameters[key];\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value)) throw new Error('invalid_rpc_params');\n  return value.filter(isChatMessage);\n}\n\nfunction conversationMetaParameter(parameters: Record<string, unknown>, key: string): ConversationMeta | undefined {\n  const value = parameters[key];\n  if (value === undefined) return undefined;\n  if (!isConversationMetaLike(value)) throw new Error('invalid_rpc_params');\n  return value;\n}\n\nfunction isChatMessage(value: unknown): value is ChatMessage {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  return (\n    typeof record.messageId === 'string' &&\n    typeof record.conversationId === 'string' &&\n    typeof record.originNodeId === 'string' &&\n    typeof record.timestamp === 'number' &&\n    typeof record.lamportClock === 'number' &&\n    typeof record.role === 'string' &&\n    typeof record.content === 'string'\n  );\n}\n\nfunction isConversationMetaLike(value: unknown): value is ConversationMeta {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  return (\n    typeof record.conversationId === 'string' &&\n    typeof record.title === 'string' &&\n    typeof record.lastMessageTimestamp === 'number' &&\n    typeof record.messageCount === 'number' &&\n    typeof record.originNodeId === 'string' &&\n    typeof record.originClock === 'number' &&\n    typeof record.definitionId === 'string' &&\n    typeof record.isUserInitiated === 'boolean'\n  );\n}\n","import type { DeviceRpcHandler } from './types.js';\n\nexport const PEER_DRIVER_PROTOCOL_VERSION = 'memeloop-peer-driver/v2';\n\nexport type PeerDriverScope = 'runtime' | 'model' | 'tool';\n\nexport interface PeerDriverAssignment {\n  /** Protocol version for forward compatibility. */\n  version: typeof PEER_DRIVER_PROTOCOL_VERSION;\n  /** Scoped driver domain. */\n  scope: PeerDriverScope;\n  /** Assignment ID for idempotency and tracking. */\n  assignmentId: string;\n  /** Target operation within the scope. */\n  operation: string;\n  /** Operation parameters. */\n  parameters: unknown;\n  /** Optional timeout in milliseconds. */\n  timeoutMs?: number;\n}\n\nexport interface PeerDriverStatus {\n  version: typeof PEER_DRIVER_PROTOCOL_VERSION;\n  assignmentId: string;\n  state: 'accepted' | 'running' | 'completed' | 'failed';\n  result?: unknown;\n  error?: string;\n  completedAt?: string;\n}\n\nexport interface PeerDriverTransportOptions {\n  /** Send a raw RPC to a peer. */\n  sendRpc: (peerId: string, method: string, parameters: unknown) => Promise<unknown>;\n  /** Default timeout for assignments. */\n  defaultTimeoutMs?: number;\n}\n\nexport interface PeerDriverRequestContext {\n  /** Authenticated transport identity; never sourced from request parameters. */\n  remotePeerId: string;\n}\n\nconst IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;\nconst MAX_ASSIGNMENT_ID_LENGTH = 256;\nconst MAX_OPERATION_LENGTH = 128;\nconst MAX_PARAMETERS_BYTES = 1024 * 1024;\nconst MAX_TIMEOUT_MS = 10 * 60_000;\nconst STATUS_STATES = new Set<PeerDriverStatus['state']>([\n  'accepted',\n  'running',\n  'completed',\n  'failed',\n]);\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction assertIdentifier(value: unknown, field: string, maximumLength: number): asserts value is string {\n  if (\n    typeof value !== 'string' ||\n    value.length < 1 ||\n    value.length > maximumLength ||\n    !IDENTIFIER_PATTERN.test(value)\n  ) {\n    throw new Error(`Invalid peer driver ${field}`);\n  }\n}\n\nfunction assertBoundedJson(value: unknown, field: string): void {\n  let encoded: string;\n  try {\n    encoded = JSON.stringify(value);\n  } catch {\n    throw new Error(`Invalid peer driver ${field}`);\n  }\n  if (encoded === undefined || new TextEncoder().encode(encoded).byteLength > MAX_PARAMETERS_BYTES) {\n    throw new Error(`Peer driver ${field} exceeds ${MAX_PARAMETERS_BYTES} bytes`);\n  }\n}\n\nfunction assertAssignment(value: unknown): asserts value is PeerDriverAssignment {\n  if (!isRecord(value)) throw new Error('Invalid peer driver assignment');\n  if (value.version !== PEER_DRIVER_PROTOCOL_VERSION) {\n    throw new Error(`Unsupported peer driver protocol version: ${String(value.version)}`);\n  }\n  if (value.scope !== 'runtime' && value.scope !== 'model' && value.scope !== 'tool') {\n    throw new Error('Invalid peer driver scope');\n  }\n  assertIdentifier(value.assignmentId, 'assignmentId', MAX_ASSIGNMENT_ID_LENGTH);\n  assertIdentifier(value.operation, 'operation', MAX_OPERATION_LENGTH);\n  if (\n    value.timeoutMs !== undefined &&\n    (typeof value.timeoutMs !== 'number' ||\n      !Number.isSafeInteger(value.timeoutMs) ||\n      value.timeoutMs < 1 ||\n      value.timeoutMs > MAX_TIMEOUT_MS)\n  ) {\n    throw new Error('Invalid peer driver timeoutMs');\n  }\n  if (!('parameters' in value)) throw new Error('Invalid peer driver parameters');\n  assertBoundedJson(value.parameters, 'parameters');\n}\n\nfunction assertAssignmentReference(value: unknown): asserts value is {\n  version: typeof PEER_DRIVER_PROTOCOL_VERSION;\n  assignmentId: string;\n} {\n  if (!isRecord(value)) throw new Error('Invalid peer driver assignment reference');\n  if (value.version !== PEER_DRIVER_PROTOCOL_VERSION) {\n    throw new Error(`Unsupported peer driver protocol version: ${String(value.version)}`);\n  }\n  assertIdentifier(value.assignmentId, 'assignmentId', MAX_ASSIGNMENT_ID_LENGTH);\n}\n\nfunction assertStatus(value: unknown, assignmentId: string): asserts value is PeerDriverStatus {\n  if (\n    !isRecord(value) ||\n    value.version !== PEER_DRIVER_PROTOCOL_VERSION ||\n    value.assignmentId !== assignmentId ||\n    !STATUS_STATES.has(value.state as PeerDriverStatus['state']) ||\n    (value.error !== undefined &&\n      (typeof value.error !== 'string' || value.error.length > 4096)) ||\n    (value.completedAt !== undefined &&\n      (typeof value.completedAt !== 'string' || !Number.isFinite(Date.parse(value.completedAt))))\n  ) {\n    throw new Error('Invalid peer driver status response');\n  }\n  if ('result' in value) assertBoundedJson(value.result, 'result');\n}\n\n/**\n * Create a scoped peer driver transport that exchanges versioned assignments\n * and status through the device network. LLMs and callers use scoped\n * operations (runtime/model/tool) instead of raw node IDs and RPC methods.\n */\nexport function createPeerDriverTransport(options: PeerDriverTransportOptions) {\n  async function submitAssignment(\n    peerId: string,\n    assignment: Omit<PeerDriverAssignment, 'version'>,\n  ): Promise<PeerDriverStatus> {\n    const versionedAssignment: PeerDriverAssignment = {\n      version: PEER_DRIVER_PROTOCOL_VERSION,\n      ...assignment,\n    };\n    assertAssignment(versionedAssignment);\n\n    const result = await options.sendRpc(\n      peerId,\n      `${PEER_DRIVER_PROTOCOL_VERSION}/submit`,\n      versionedAssignment,\n    );\n    assertStatus(result, assignment.assignmentId);\n    return result;\n  }\n\n  async function getAssignmentStatus(\n    peerId: string,\n    assignmentId: string,\n  ): Promise<PeerDriverStatus> {\n    assertIdentifier(assignmentId, 'assignmentId', MAX_ASSIGNMENT_ID_LENGTH);\n    const result = await options.sendRpc(\n      peerId,\n      `${PEER_DRIVER_PROTOCOL_VERSION}/status`,\n      { version: PEER_DRIVER_PROTOCOL_VERSION, assignmentId },\n    );\n    assertStatus(result, assignmentId);\n    return result;\n  }\n\n  async function cancelAssignment(\n    peerId: string,\n    assignmentId: string,\n  ): Promise<PeerDriverStatus> {\n    assertIdentifier(assignmentId, 'assignmentId', MAX_ASSIGNMENT_ID_LENGTH);\n    const result = await options.sendRpc(\n      peerId,\n      `${PEER_DRIVER_PROTOCOL_VERSION}/cancel`,\n      { version: PEER_DRIVER_PROTOCOL_VERSION, assignmentId },\n    );\n    assertStatus(result, assignmentId);\n    return result;\n  }\n\n  return {\n    submitAssignment,\n    getAssignmentStatus,\n    cancelAssignment,\n  };\n}\n\n/**\n * Create a DeviceRpcHandler that routes scoped driver protocol calls to the\n * appropriate local handlers.\n */\nexport function createPeerDriverRpcHandler(handlers: {\n  onSubmit?: (\n    assignment: PeerDriverAssignment,\n    context: PeerDriverRequestContext,\n  ) => Promise<PeerDriverStatus>;\n  onStatus?: (\n    assignmentId: string,\n    context: PeerDriverRequestContext,\n  ) => Promise<PeerDriverStatus>;\n  onCancel?: (\n    assignmentId: string,\n    context: PeerDriverRequestContext,\n  ) => Promise<PeerDriverStatus>;\n}): DeviceRpcHandler {\n  return async (input) => {\n    const { method, parameters } = input;\n    const context: PeerDriverRequestContext = { remotePeerId: input.remotePeerId };\n\n    if (method === `${PEER_DRIVER_PROTOCOL_VERSION}/submit`) {\n      assertAssignment(parameters);\n      if (!handlers.onSubmit) {\n        throw new Error('No submit handler registered');\n      }\n      const result = await handlers.onSubmit(parameters, context);\n      assertStatus(result, parameters.assignmentId);\n      return result;\n    }\n\n    if (method === `${PEER_DRIVER_PROTOCOL_VERSION}/status`) {\n      assertAssignmentReference(parameters);\n      if (!handlers.onStatus) {\n        throw new Error('No status handler registered');\n      }\n      const result = await handlers.onStatus(parameters.assignmentId, context);\n      assertStatus(result, parameters.assignmentId);\n      return result;\n    }\n\n    if (method === `${PEER_DRIVER_PROTOCOL_VERSION}/cancel`) {\n      assertAssignmentReference(parameters);\n      if (!handlers.onCancel) {\n        throw new Error('No cancel handler registered');\n      }\n      const result = await handlers.onCancel(parameters.assignmentId, context);\n      assertStatus(result, parameters.assignmentId);\n      return result;\n    }\n\n    throw new Error('Unknown peer driver protocol method: ' + method);\n  };\n}\n","export const MEMELOOP_TERMINAL_OUTPUT_NOTIFICATION = 'memeloop.terminal.output.delta' as const;\n\nexport type MemeloopTerminalOutputNotificationMethod = typeof MEMELOOP_TERMINAL_OUTPUT_NOTIFICATION;\n","import type { IMChannelBinding } from './protocol.js';\n\nimport type { IIMAdapter, ImAgentDriver, ImInboundMessage } from './interface.js';\n\n/**\n * 管理 IM 用户与会话的绑定；可选 `storage` 使用 IAgentStorage 的 IM 绑定持久化。\n */\nexport class IMChannelManager {\n  private readonly bindings = new Map<string, IMChannelBinding>();\n\n  constructor(\n    private readonly storage?: {\n      getImBinding?(c: string, u: string): Promise<IMChannelBinding | null>;\n      setImBinding?(r: IMChannelBinding): Promise<void>;\n    },\n  ) {}\n\n  private key(channelId: string, imUserId: string): string {\n    return `${channelId}::${imUserId}`;\n  }\n\n  async getBinding(channelId: string, imUserId: string): Promise<IMChannelBinding | undefined> {\n    const k = this.key(channelId, imUserId);\n    if (this.storage?.getImBinding) {\n      const row = await this.storage.getImBinding(channelId, imUserId);\n      if (row) {\n        this.bindings.set(k, row);\n        return row;\n      }\n    }\n    return this.bindings.get(k);\n  }\n\n  async setBinding(record: IMChannelBinding): Promise<void> {\n    this.bindings.set(this.key(record.channelId, record.imUserId), record);\n    if (this.storage?.setImBinding) {\n      await this.storage.setImBinding(record);\n    }\n  }\n\n  /**\n   * 处理入站文本：无 binding 时创建会话并发送首条用户消息。\n   */\n  async dispatchInbound(\n    message: ImInboundMessage,\n    driver: ImAgentDriver,\n    options: { defaultDefinitionId: string },\n  ): Promise<{ conversationId: string }> {\n    const existing = await this.getBinding(message.channelId, message.imUserId);\n    if (existing) {\n      await driver.sendMessage({\n        conversationId: existing.activeConversationId,\n        message: message.text,\n      });\n      return { conversationId: existing.activeConversationId };\n    }\n    const definitionId = options.defaultDefinitionId;\n    const { conversationId } = await driver.createAgent({\n      definitionId,\n      initialMessage: message.text,\n    });\n    await this.setBinding({\n      channelId: message.channelId,\n      imUserId: message.imUserId,\n      activeConversationId: conversationId,\n      createdAt: Date.now(),\n      defaultDefinitionId: definitionId,\n    });\n    return { conversationId };\n  }\n\n  async switchConversation(\n    channelId: string,\n    imUserId: string,\n    conversationId: string,\n  ): Promise<void> {\n    const current = await this.getBinding(channelId, imUserId);\n    if (current) {\n      await this.setBinding({ ...current, activeConversationId: conversationId });\n    } else {\n      await this.setBinding({\n        channelId,\n        imUserId,\n        activeConversationId: conversationId,\n        createdAt: Date.now(),\n      });\n    }\n  }\n}\n\nexport function pickAdapter(adapters: IIMAdapter[], platform: string): IIMAdapter | undefined {\n  return adapters.find((a) => a.platform === platform);\n}\n","/** Plan §20.6.1 — chunk assistant text before sending to IM APIs. */\nexport function imPlatformMaxMessageChars(platform: string): number {\n  switch (platform) {\n    case 'telegram':\n      return 4096;\n    case 'discord':\n      return 2000;\n    case 'lark':\n      return 4096;\n    case 'wecom':\n      return 2048;\n    case 'slack':\n      return 4000;\n    case 'qq':\n      return 4500;\n    default:\n      return 3500;\n  }\n}\n","import type { MemeLoopRuntime } from '../runtime.js';\nimport type { IAgentStorage } from '../storage/interface.js';\n\nimport type { IMChannelManager } from './channelManager.js';\nimport type { ImAgentDriver } from './interface.js';\n\nexport interface ImSlashCommandContext {\n  rawText: string;\n  channelId: string;\n  imUserId: string;\n  manager: IMChannelManager;\n  storage: IAgentStorage;\n  driver: ImAgentDriver;\n  runtime: MemeLoopRuntime;\n  defaultDefinitionId: string;\n}\n\n/**\n * Plan §20.6.4 — parse `/list`, `/switch`, `/new`, `/agent`, `/status`, `/cancel` locally (no LLM).\n */\nexport async function tryHandleImSlashCommand(context: ImSlashCommandContext): Promise<{\n  handled: boolean;\n  messages: string[];\n}> {\n  const t = context.rawText.trim();\n  if (!t.startsWith('/') || t.startsWith('//') || t.length < 2) {\n    return { handled: false, messages: [] };\n  }\n  const parts = t.slice(1).split(/\\s+/).filter(Boolean);\n  const cmd = (parts[0] ?? '').toLowerCase();\n  const rest = parts.slice(1).join(' ').trim();\n\n  const binding = await context.manager.getBinding(context.channelId, context.imUserId);\n  const ok = (lines: string[]) => ({ handled: true as const, messages: lines });\n\n  if (cmd === 'list') {\n    const list = await context.storage.listConversations({ limit: 50 });\n    if (list.length === 0) return ok(['（暂无会话）']);\n    const body = list.map(\n      (c, index) => `${index + 1}. ${c.title || c.conversationId} — ${c.conversationId.slice(0, 14)}…`,\n    );\n    return ok(['可切换会话：', ...body.map((l) => `• ${l}`)]);\n  }\n\n  if (cmd === 'switch') {\n    if (!binding) return ok(['当前无绑定会话，先用 /new 创建。']);\n    const list = await context.storage.listConversations({ limit: 50 });\n    const argument = rest.trim();\n    if (!argument) return ok(['用法：/switch <编号或 conversationId>']);\n    const n = parseInt(argument, 10);\n    let targetId: string | undefined;\n    if (!Number.isNaN(n) && n >= 1 && n <= list.length) {\n      targetId = list[n - 1]?.conversationId;\n    } else {\n      targetId = list.find(\n        (c) => c.conversationId === argument || c.conversationId.includes(argument),\n      )?.conversationId;\n    }\n    if (!targetId) return ok([`未找到会话：${argument}`]);\n    await context.manager.switchConversation(context.channelId, context.imUserId, targetId);\n    return ok([`已切换到：${targetId}`]);\n  }\n\n  if (cmd === 'new' || cmd === 'agent') {\n    const definitionId = rest || context.defaultDefinitionId;\n    const { conversationId } = await context.driver.createAgent({ definitionId });\n    await context.manager.setBinding({\n      channelId: context.channelId,\n      imUserId: context.imUserId,\n      activeConversationId: conversationId,\n      createdAt: Date.now(),\n      defaultDefinitionId: definitionId,\n    });\n    return ok([`已新建并绑定会话。\\nID：\\`${conversationId}\\`\\n发送消息即可开始。`]);\n  }\n\n  if (cmd === 'status') {\n    if (!binding) return ok(['无活跃 IM 绑定。']);\n    const meta = await context.storage.getConversationMeta(binding.activeConversationId);\n    return ok([\n      `会话：${binding.activeConversationId}`,\n      `定义：${meta?.definitionId ?? '?'}`,\n      `消息数：${meta?.messageCount ?? '?'}`,\n    ]);\n  }\n\n  if (cmd === 'cancel') {\n    if (!binding) return ok(['无会话可取消。']);\n    await context.runtime.cancelAgent(binding.activeConversationId);\n    return ok(['已请求取消当前任务。']);\n  }\n\n  return { handled: false, messages: [] };\n}\n","import type { MemeLoopRuntime } from '../runtime.js';\n\nimport { imPlatformMaxMessageChars } from './imPlatformLimits.js';\nimport type { TextMessageRenderer } from './textRenderer.js';\n\nexport type ImStreamFlush = (text: string) => Promise<void>;\n\nfunction stringifyImValue(value: unknown): string {\n  if (value == null) return '';\n  if (typeof value === 'string') return value;\n  if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') {\n    return String(value);\n  }\n  try {\n    return JSON.stringify(value);\n  } catch {\n    return '[unserializable value]';\n  }\n}\n\n/**\n * Subscribe to `runtime` agent updates and forward assistant text + light tool summaries to IM,\n * flushing when the buffer reaches the platform limit (plan §20.6.1).\n */\nexport async function streamRuntimeAgentReplyToIm(options: {\n  runtime: MemeLoopRuntime;\n  conversationId: string;\n  platform: string;\n  renderer: TextMessageRenderer;\n  flush: ImStreamFlush;\n}): Promise<void> {\n  const max = imPlatformMaxMessageChars(options.platform);\n  let buf = '';\n\n  const sendSlice = async (force: boolean): Promise<void> => {\n    if (buf.length === 0) return;\n    if (force) {\n      while (buf.length > 0) {\n        const take = Math.min(max, buf.length);\n        const chunk = buf.slice(0, take);\n        buf = buf.slice(take);\n        if (chunk.trim().length > 0) await options.flush(chunk);\n      }\n      return;\n    }\n    while (buf.length >= max) {\n      const chunk = buf.slice(0, max);\n      buf = buf.slice(max);\n      await options.flush(chunk);\n    }\n  };\n\n  await new Promise<void>((resolve, reject) => {\n    const off = options.runtime.subscribeToUpdates(options.conversationId, (u: unknown) => {\n      const o = u as { type?: string; step?: { type?: string; data?: unknown } };\n      if (o.type === 'agent-done') {\n        void sendSlice(true)\n          .then(() => {\n            off();\n            resolve();\n          })\n          .catch(reject);\n        return;\n      }\n      if (o.type === 'agent-error') {\n        off();\n        reject(new Error((o as { error?: string }).error ?? 'agent-error'));\n        return;\n      }\n      if (o.type === 'agent-step' && o.step?.type === 'message') {\n        const stepData = o.step.data;\n        let piece = '';\n        if (typeof stepData === 'string') piece = stepData;\n        else if (stepData != null && typeof stepData === 'object' && 'content' in stepData) {\n          const content = (stepData as { content?: unknown }).content;\n          piece = stringifyImValue(content);\n        } else piece = stringifyImValue(stepData);\n        buf += piece;\n        void sendSlice(false);\n      }\n      if (o.type === 'agent-step' && o.step?.type === 'tool') {\n        const td = o.step.data as {\n          toolId?: string;\n          parameters?: unknown;\n          result?: unknown;\n          isError?: boolean;\n        };\n        const id = td.toolId;\n        if (!id) return;\n        if (id === 'ask-question') {\n          const p = td.parameters as {\n            question?: string;\n            options?: Array<{ label: string }>;\n          };\n          const q = typeof p?.question === 'string' ? p.question : '';\n          const optLabels = p?.options\n            ?.map((o) => o.label)\n            .filter((x): x is string => typeof x === 'string');\n          const askText = options.renderer.renderAskQuestion(q, optLabels);\n          buf += (buf && !buf.endsWith('\\n') ? '\\n' : '') + askText + '\\n';\n          void sendSlice(true);\n          return;\n        }\n        if (td.isError) {\n          buf += (buf && !buf.endsWith('\\n') ? '\\n' : '') +\n            options.renderer.renderError(stringifyImValue(td.result) || 'tool error') +\n            '\\n';\n          void sendSlice(false);\n          return;\n        }\n        const callLine = options.renderer.renderToolCallSummary(id, td.parameters ?? {});\n        const resultLine = options.renderer.renderToolResultSummary(id, td.result ?? null);\n        buf += (buf && !buf.endsWith('\\n') ? '\\n' : '') +\n          callLine +\n          (resultLine ? `\\n${resultLine}` : '') +\n          '\\n';\n        void sendSlice(false);\n      }\n    });\n  });\n}\n","import type { IIMMessageRenderer } from './interface.js';\n\n/** 通用文本/Markdown 友好输出（IM 端以纯文本展示） */\nexport class TextMessageRenderer implements IIMMessageRenderer {\n  renderPlainText(content: string): string {\n    return content.trim();\n  }\n\n  renderToolCallSummary(toolName: string, arguments_: unknown): string {\n    const s = (() => {\n      try {\n        const index = JSON.stringify(arguments_);\n        if (!index || index === '{}') return '';\n        return index.length > 120 ? `${index.slice(0, 117)}…` : index;\n      } catch {\n        return '';\n      }\n    })();\n    return s ? `🔧 ${toolName}: ${s}` : `🔧 ${toolName}`;\n  }\n\n  renderToolResultSummary(toolName: string, result: unknown): string | null {\n    // IM 默认隐藏工具结果细节：只给一个轻量摘要，避免刷屏。\n    if (result == null) return `✅ ${toolName}: done`;\n    if (typeof result === 'string') {\n      const t = result.trim();\n      if (!t) return `✅ ${toolName}: done`;\n      return `✅ ${toolName}: ${t.length > 120 ? `${t.slice(0, 117)}…` : t}`;\n    }\n    if (typeof result === 'object') {\n      const keys = Object.keys(result as Record<string, unknown>);\n      if (keys.length === 0) return `✅ ${toolName}: done`;\n      return `✅ ${toolName}: {${keys.slice(0, 6).join(', ')}${keys.length > 6 ? ', …' : ''}}`;\n    }\n    if (typeof result === 'symbol') return `✅ ${toolName}: ${result.toString()}`;\n    if (typeof result === 'function') return `✅ ${toolName}: [function]`;\n    if (typeof result === 'number' || typeof result === 'boolean' || typeof result === 'bigint') {\n      return `✅ ${toolName}: ${String(result)}`;\n    }\n    return `✅ ${toolName}: done`;\n  }\n\n  renderToolApproval(toolName: string, arguments_: unknown): string {\n    return `⏸ 需要审批执行工具：${toolName}\\n参数：\\n\\`\\`\\`json\\n${JSON.stringify(arguments_, null, 2)}\\n\\`\\`\\`\\n回复 Y 同意 / N 拒绝`;\n  }\n\n  renderAskQuestion(question: string, options?: string[]): string {\n    const lines = options?.length\n      ? [`❓ ${question}`, ...options.map((o, index) => `${index + 1}. ${o}`)]\n      : [`❓ ${question}`];\n    return lines.join('\\n');\n  }\n\n  renderThinking(_content: string): string | null {\n    return null;\n  }\n\n  renderError(error: string): string {\n    return `⚠️ 错误：${error}`;\n  }\n\n  renderTodoList(todos: Array<{ id: string; text: string; done?: boolean }>): string {\n    return ['📋 Todo', ...todos.map((t) => `${t.done ? '[x]' : '[ ]'} ${t.text}`)].join('\\n');\n  }\n}\n","import type { IMChannelManager } from './channelManager.js';\nimport type { ImAgentDriver } from './interface.js';\n\n/**\n * IM 会话控制工具（计划 20.4）：在带 IM binding 的会话中注入。\n * 这里仅导出工具 schema 描述，实际注册由上层 ToolRegistry 完成。\n */\nexport const imToolDefinitions = [\n  {\n    name: 'im.listConversations',\n    description: '列出可切换的会话（由 memeloop-cli registerImSessionTools 注册，仅 IM 来源会话可用）。',\n  },\n  {\n    name: 'im.switchConversation',\n    description: '切换当前 IM 用户绑定的活跃会话。参数：{ conversationId: string }',\n  },\n  {\n    name: 'im.newConversation',\n    description: '创建新会话并切换绑定。参数：{ definitionId?: string }',\n  },\n  {\n    name: 'im.summarizeHistory',\n    description: '返回当前会话最近消息的纯文本摘要（规则拼接，非 LLM）。参数：{ maxMessages?: number }',\n  },\n] as const;\n\nexport interface ImToolsRuntime {\n  channelId: string;\n  imUserId: string;\n  manager: IMChannelManager;\n  driver: ImAgentDriver;\n  defaultDefinitionId: string;\n}\n\n/** 供工具实现层调用的命令式 API（避免在 core 内耦合 defineTool） */\nexport async function imSwitchConversation(rt: ImToolsRuntime, conversationId: string): Promise<void> {\n  await rt.manager.switchConversation(rt.channelId, rt.imUserId, conversationId);\n}\n","import { z } from 'zod';\n\nimport type { IMChannelManager } from '../../im/channelManager.js';\nimport type { MemeLoopRuntime } from '../../runtime.js';\nimport type { IToolRegistry } from '../../types.js';\nimport type { BuiltinToolContext } from './types.js';\n\nimport { registerToolParameterSchema } from '../schemaRegistry.js';\n\nexport const IM_SESSION_TOOL_IDS = [\n  'im.listConversations',\n  'im.switchConversation',\n  'im.newConversation',\n  'im.summarizeHistory',\n] as const;\n\nconst listSchema = z.object({});\n\nconst switchSchema = z.object({\n  conversationId: z.string().min(1),\n});\n\nconst newSchema = z.object({\n  definitionId: z.string().min(1).optional(),\n});\n\nconst summarizeSchema = z.object({\n  maxMessages: z.number().int().positive().max(200).optional(),\n});\n\nexport interface ImSessionBuiltinRegistration {\n  imChannelManager: IMChannelManager;\n  getMemeLoopRuntime: () => MemeLoopRuntime;\n}\n\nfunction error(message: string): { error: string } {\n  return { error: message };\n}\n\nasync function requireImSource(\n  context: BuiltinToolContext,\n  conversationId: string,\n): Promise<{ channelId: string; imUserId: string; platform: string } | { error: string }> {\n  const meta = await context.storage.getConversationMeta(conversationId);\n  const sc = meta?.sourceChannel;\n  if (!sc) {\n    return { error: 'im_tools_only_in_im_session' };\n  }\n  return { channelId: sc.channelId, imUserId: sc.imUserId, platform: sc.platform };\n}\n\nexport async function imListConversationsImpl(\n  arguments_: Record<string, unknown>,\n  context: BuiltinToolContext,\n  _reg: ImSessionBuiltinRegistration,\n): Promise<{ result: string } | { error: string }> {\n  const parsed = listSchema.safeParse(arguments_);\n  if (!parsed.success) return error('invalid_args');\n  const cid = context.activeToolConversationId;\n  if (!cid) return error('no_active_conversation');\n  const source = await requireImSource(context, cid);\n  if ('error' in source) return source;\n  const all = await context.storage.listConversations({});\n  if (all.length === 0) return { result: '（暂无会话）' };\n  const sorted = [...all].sort((a, b) => b.lastMessageTimestamp - a.lastMessageTimestamp);\n  const lines = sorted.map((m, index) => {\n    const title = m.title || m.conversationId;\n    const t = new Date(m.lastMessageTimestamp).toISOString();\n    return `${index + 1}. ${title}\\n   id: ${m.conversationId}\\n   def: ${m.definitionId} | ${t}`;\n  });\n  return { result: `可切换的会话：\\n${lines.join('\\n')}` };\n}\n\nexport async function imSwitchConversationImpl(\n  arguments_: Record<string, unknown>,\n  context: BuiltinToolContext,\n  reg: ImSessionBuiltinRegistration,\n): Promise<{ result: string } | { error: string }> {\n  const parsed = switchSchema.safeParse(arguments_);\n  if (!parsed.success) return error('invalid_args');\n  const cid = context.activeToolConversationId;\n  if (!cid) return error('no_active_conversation');\n  const source = await requireImSource(context, cid);\n  if ('error' in source) return source;\n  await reg.imChannelManager.switchConversation(\n    source.channelId,\n    source.imUserId,\n    parsed.data.conversationId,\n  );\n  return { result: `已切换到会话：${parsed.data.conversationId}` };\n}\n\nexport async function imNewConversationImpl(\n  arguments_: Record<string, unknown>,\n  context: BuiltinToolContext,\n  reg: ImSessionBuiltinRegistration,\n): Promise<{ result: string } | { error: string }> {\n  const parsed = newSchema.safeParse(arguments_);\n  if (!parsed.success) return error('invalid_args');\n  const cid = context.activeToolConversationId;\n  if (!cid) return error('no_active_conversation');\n  const source = await requireImSource(context, cid);\n  if ('error' in source) return source;\n  const current = await reg.imChannelManager.getBinding(source.channelId, source.imUserId);\n  const definitionId = parsed.data.definitionId?.trim() ||\n    current?.defaultDefinitionId ||\n    'memeloop:general-assistant';\n  const rt = reg.getMemeLoopRuntime();\n  const { conversationId } = await rt.createAgent({ definitionId, initialMessage: '' });\n  await reg.imChannelManager.setBinding({\n    channelId: source.channelId,\n    imUserId: source.imUserId,\n    activeConversationId: conversationId,\n    createdAt: Date.now(),\n    defaultDefinitionId: definitionId,\n  });\n  const meta = await context.storage.getConversationMeta(conversationId);\n  if (meta) {\n    await context.storage.upsertConversationMetadata({\n      ...meta,\n      sourceChannel: {\n        channelId: source.channelId,\n        platform: source.platform,\n        imUserId: source.imUserId,\n      },\n    });\n  }\n  return {\n    result: `已新建并切换到会话：${conversationId}\\ndefinition: ${definitionId}\\n请让用户发送下一条消息以开始对话。`,\n  };\n}\n\nexport async function imSummarizeHistoryImpl(\n  arguments_: Record<string, unknown>,\n  context: BuiltinToolContext,\n  _reg: ImSessionBuiltinRegistration,\n): Promise<{ result: string } | { error: string }> {\n  const parsed = summarizeSchema.safeParse(arguments_);\n  if (!parsed.success) return error('invalid_args');\n  const cid = context.activeToolConversationId;\n  if (!cid) return error('no_active_conversation');\n  const source = await requireImSource(context, cid);\n  if ('error' in source) return source;\n  void source;\n  const max = parsed.data.maxMessages ?? 40;\n  const msgs = await context.storage.getMessages(cid, { mode: 'full-content' });\n  const tail = msgs.slice(-max);\n  if (tail.length === 0) return { result: '（当前会话尚无消息）' };\n  const lines = tail.map(\n    (m) => `[${m.role}] ${m.content.slice(0, 2000)}${m.content.length > 2000 ? '…' : ''}`,\n  );\n  return {\n    result: `最近 ${tail.length} 条消息摘要（供 IM 上下文）：\\n${lines.join('\\n---\\n')}`,\n  };\n}\n\n/**\n * 注册 IM 会话专用工具（需节点传入 `imChannelManager` 与 `getMemeLoopRuntime`）。\n */\nexport function registerImSessionBuiltinTools(\n  registry: IToolRegistry,\n  context: BuiltinToolContext,\n  reg: ImSessionBuiltinRegistration,\n): void {\n  const bound = (function_: typeof imListConversationsImpl) => (arguments_: Record<string, unknown>) => function_(arguments_, context, reg);\n\n  registry.registerTool(\n    'im.listConversations',\n    bound(imListConversationsImpl),\n    listSchema,\n    'read',\n  );\n  registry.registerTool(\n    'im.switchConversation',\n    bound(imSwitchConversationImpl),\n    switchSchema,\n    'update',\n  );\n  registry.registerTool(\n    'im.newConversation',\n    bound(imNewConversationImpl),\n    newSchema,\n    'create',\n  );\n  registry.registerTool(\n    'im.summarizeHistory',\n    bound(imSummarizeHistoryImpl),\n    summarizeSchema,\n    'update',\n  );\n\n  registerToolParameterSchema('im.listConversations', listSchema, {\n    displayName: 'IM: list conversations',\n    description: 'List conversations the user can switch to (IM sessions only).',\n  });\n  registerToolParameterSchema('im.switchConversation', switchSchema, {\n    displayName: 'IM: switch conversation',\n    description: 'Switch this IM user binding to another conversationId.',\n  });\n  registerToolParameterSchema('im.newConversation', newSchema, {\n    displayName: 'IM: new conversation',\n    description: 'Create a new agent conversation and bind this IM user to it.',\n  });\n  registerToolParameterSchema('im.summarizeHistory', summarizeSchema, {\n    displayName: 'IM: summarize history',\n    description: 'Return a plain-text digest of recent messages in the current conversation.',\n  });\n}\n","import { BUILTIN_TOOL_PLUGIN_IDS, registerBuiltinToolPlugins } from '../../loopAPI/plugins/builtinToolsPlugin.js';\nimport { getLoopRegistry } from '../../loopAPI/registry.js';\nimport { registerBuiltinPromptPlugins } from '../../promptUtilities/builtinPromptPlugins.js';\nimport type { IToolRegistry } from '../../types.js';\nimport { pluginRegistry } from '../pluginRegistry.js';\nimport type { BuiltinToolContext } from './types.js';\n\nexport { ASK_QUESTION_TOOL_ID, askQuestionConfigSchema, askQuestionImpl } from './askQuestion.js';\nexport { ASK_USER_QUESTION_TOOL_ID, askUserQuestionConfigSchema, askUserQuestionImpl } from './askUserQuestion.js';\nexport { IM_SESSION_TOOL_IDS, type ImSessionBuiltinRegistration, registerImSessionBuiltinTools } from './imBuiltinTools.js';\nexport { getMcpClientToolId, mcpClientConfigSchema, mcpClientImpl } from './mcpClient.js';\nexport { getMcpForwardToolId, mcpForwardConfigSchema, mcpForwardImpl } from './mcpForward.js';\nexport { ORCHESTRATION_TOOL_ID, orchestrationConfigSchema, orchestrationImpl } from './orchestration.js';\nexport { resolveQuestionAnswer } from './questionWaitRegistry.js';\nexport { getRemoteAgentToolId, remoteAgentConfigSchema, remoteAgentImpl, remoteAgentListImpl } from './remoteAgent.js';\nexport { getSpawnAgentToolId, spawnAgentConfigSchema, spawnAgentImpl } from './spawnAgent.js';\nexport { getTaskToolId, taskToolConfigSchema, taskToolImpl } from './task.js';\nexport { __clearTodoStore, TODO_WRITE_TOOL_ID, todoWriteConfigSchema, todoWriteImpl } from './todoWrite.js';\nexport type { BuiltinToolContext, BuiltinToolImpl } from './types.js';\n\n/**\n * Register framework-level builtin tools (agent orchestration, user interaction, MCP).\n *\n * Environment-specific tools (bash, file*, grep, glob, git, webFetch, webSearch, lsp)\n * must be registered by the host environment (e.g. memeloop-cli via registerNodeEnvironmentTools).\n */\nexport function registerBuiltinTools(registry: IToolRegistry, context: BuiltinToolContext): void {\n  const promptDestination = registry.getPromptPlugins?.();\n  if (promptDestination) {\n    for (const [id, tool] of pluginRegistry) {\n      promptDestination.set(id, tool);\n    }\n    registerBuiltinPromptPlugins(promptDestination);\n  } else {\n    registerBuiltinPromptPlugins();\n  }\n\n  registerBuiltinToolPlugins();\n  getLoopRegistry().installPluginsForLoop('*', { ...context, toolRegistry: registry }, [\n    ...BUILTIN_TOOL_PLUGIN_IDS,\n  ]);\n}\n","/**\n * TidGi `parallelExecution.ts` 迁移。\n */\nimport type { ToolCallingMatch } from '../promptUtilities/responsePatternUtility.js';\nimport type { ToolExecutionResult } from './defineToolTypes.js';\n\nconst DEFAULT_TOOL_TIMEOUT_MS = 30_000;\nconst DEFAULT_BATCH_TIMEOUT_MS = 120_000;\n\nexport interface ToolCallEntry {\n  call: ToolCallingMatch & { found: true };\n  executor: (parameters: Record<string, unknown>) => Promise<ToolExecutionResult>;\n  timeoutMs?: number;\n}\n\nexport interface ToolCallResult {\n  call: ToolCallingMatch & { found: true };\n  status: 'fulfilled' | 'rejected' | 'timeout';\n  result?: ToolExecutionResult;\n  error?: string;\n}\n\nasync function executeWithTimeout(entry: ToolCallEntry): Promise<ToolCallResult> {\n  const timeoutMs = entry.timeoutMs ?? DEFAULT_TOOL_TIMEOUT_MS;\n\n  return new Promise<ToolCallResult>((resolve) => {\n    let settled = false;\n\n    const timer = timeoutMs > 0\n      ? setTimeout(() => {\n        if (!settled) {\n          settled = true;\n          resolve({\n            call: entry.call,\n            status: 'timeout',\n            error: `Tool \"${entry.call.toolId}\" timed out after ${timeoutMs}ms`,\n          });\n        }\n      }, timeoutMs)\n      : undefined;\n\n    entry\n      .executor(entry.call.parameters ?? {})\n      .then((result) => {\n        if (!settled) {\n          settled = true;\n          if (timer) clearTimeout(timer);\n          resolve({ call: entry.call, status: 'fulfilled', result });\n        }\n      })\n      .catch((error: unknown) => {\n        if (!settled) {\n          settled = true;\n          if (timer) clearTimeout(timer);\n          resolve({\n            call: entry.call,\n            status: 'rejected',\n            result: {\n              success: false,\n              error: error instanceof Error ? error.message : String(error),\n            },\n            error: error instanceof Error ? error.message : String(error),\n          });\n        }\n      });\n  });\n}\n\nexport async function executeToolCallsParallel(\n  entries: ToolCallEntry[],\n  batchTimeoutMs: number = DEFAULT_BATCH_TIMEOUT_MS,\n): Promise<ToolCallResult[]> {\n  if (entries.length === 0) return [];\n  if (entries.length === 1) {\n    return [await executeWithTimeout(entries[0])];\n  }\n\n  const promises = entries.map((entry) => executeWithTimeout(entry));\n\n  if (batchTimeoutMs > 0) {\n    const batchTimer = new Promise<ToolCallResult[]>((resolve) => {\n      setTimeout(() => {\n        resolve(\n          entries.map((entry) => ({\n            call: entry.call,\n            status: 'timeout' as const,\n            error: `Batch timeout: ${batchTimeoutMs}ms exceeded`,\n          })),\n        );\n      }, batchTimeoutMs);\n    });\n\n    return Promise.race([Promise.all(promises), batchTimer]);\n  }\n\n  return Promise.all(promises);\n}\n\nexport async function executeToolCallsSequential(\n  entries: ToolCallEntry[],\n): Promise<ToolCallResult[]> {\n  const results: ToolCallResult[] = [];\n  for (const entry of entries) {\n    results.push(await executeWithTimeout(entry));\n  }\n  return results;\n}\n","/**\n * Generate tool description for prompt injection from zod v4 schema definitions.\n */\nimport type { z } from 'zod';\n\nimport { toolSchemaToJsonSchema } from './schemaRegistry.js';\n\nexport function schemaToToolContent(schema: z.ZodType) {\n  const jsonSchema = toolSchemaToJsonSchema(schema);\n\n  // zod v4 stores title/description/examples in .meta()\n  const meta = Array.isArray((schema as unknown as { meta?: Array<Record<string, unknown>> }).meta)\n    ? (schema as unknown as { meta?: Array<Record<string, unknown>> }).meta?.[0]\n    : undefined;\n\n  const title = (meta?.title as string) || (jsonSchema.title as string) || 'tool';\n  const description = (meta?.description as string) ||\n    (schema as unknown as { description?: string }).description ||\n    (jsonSchema.description as string) ||\n    '';\n  const examples = (meta?.examples as Array<Record<string, unknown>>) ||\n    (jsonSchema.examples as Array<Record<string, unknown>>) ||\n    [];\n\n  const props = jsonSchema.properties as Record<string, unknown> | undefined;\n  const requiredArray = Array.isArray(jsonSchema.required) ? (jsonSchema.required as string[]) : [];\n\n  let parameterLines = '';\n  if (props) {\n    parameterLines = Object.entries(props)\n      .map(([key, value]) => {\n        const p = value as Record<string, unknown> | undefined;\n        const type = (p?.type as string) || 'string';\n        const desc = (p?.description as string) || (p?.title as string) || '';\n        const required = requiredArray.includes(key) ? 'required' : 'optional';\n        return `- ${key} (${type}, ${required}): ${desc}`;\n      })\n      .join('\\n');\n  }\n\n  const exampleSection = examples\n    .map((example) => `- <tool_use name=\"${title}\">${JSON.stringify(example)}</tool_use>`)\n    .join('\\n');\n\n  return `\\n## ${title}\\n**Description**: ${description}\\n**Parameters**:\\n${parameterLines}\\n\\n**Examples**:\\n${exampleSection}\\n`;\n}\n","/**\n * TidGi `defineTool.ts` 逐行迁移；持久化改为 `AgentFrameworkContext.persistAgentMessage`（memeloop）。\n */\nimport type { z } from 'zod';\n\nimport { type ChatMessage, createChatMessage } from '../conversation/index.js';\nimport { findPromptById } from '../promptUtilities/promptConcat.js';\nimport { matchAllToolCallings, TOOL_PARAMETER_PARSE_ERROR_KEY } from '../promptUtilities/responsePatternUtility.js';\nimport type { ToolCallingMatch } from '../promptUtilities/responsePatternUtility.js';\nimport type { IPrompt } from '../promptUtilities/types.js';\nimport { evaluateApproval, requestApproval } from './approval.js';\nimport type {\n  AddToolResultOptions,\n  InjectContentOptions,\n  InjectToolListOptions,\n  PostProcessHandlerContext,\n  ResponseHandlerContext,\n  ToolDefinition,\n  ToolExecutionResult,\n  ToolHandlerContext,\n} from './defineToolTypes.js';\nimport { executeToolCallsParallel, executeToolCallsSequential } from './parallelExecution.js';\nimport { getActivePluginRegistry } from './pluginRegistry.js';\nimport { schemaToToolContent } from './schemaToToolContent.js';\nimport type { AIResponseContext, PostProcessContext, PromptConcatHookContext, PromptConcatTool } from './types.js';\n\nconst MAX_TOOL_RESULT_CHARS = 32_000;\n\nconst logger = {\n  debug: (..._a: unknown[]) => {},\n  warn: (...a: unknown[]) => {\n    console.warn('[memeloop.defineTool]', ...a);\n  },\n  error: (...a: unknown[]) => {\n    console.error('[memeloop.defineTool]', ...a);\n  },\n};\n\nexport type {\n  AddToolResultOptions,\n  InjectContentOptions,\n  InjectToolListOptions,\n  PostProcessHandlerContext,\n  ResponseHandlerContext,\n  ToolDefinition,\n  ToolExecutionResult,\n  ToolHandlerContext,\n} from './defineToolTypes.js';\n\nexport function defineTool<\n  TConfigSchema extends z.ZodType,\n  TLLMToolSchemas extends Record<string, z.ZodType> = Record<string, z.ZodType>,\n>(\n  definition: ToolDefinition<TConfigSchema, TLLMToolSchemas>,\n): {\n  tool: PromptConcatTool;\n  toolId: string;\n  configSchema: TConfigSchema;\n  llmToolSchemas: TLLMToolSchemas | undefined;\n  displayName: string;\n  description: string;\n} {\n  const {\n    toolId,\n    configSchema,\n    llmToolSchemas,\n    onProcessPrompts,\n    onResponseComplete,\n    onPostProcess,\n  } = definition;\n  const parameterKey = `${toolId}Param`;\n\n  const tool: PromptConcatTool = (hooks) => {\n    if (onProcessPrompts) {\n      hooks.processPrompts.tapAsync(`${toolId}-processPrompts`, async (context, callback) => {\n        try {\n          const { toolConfig, prompts, messages, agentFrameworkContext } = context as PromptConcatHookContext;\n\n          if (toolConfig.toolId !== toolId) {\n            callback();\n            return;\n          }\n\n          if (toolConfig.enabled === false) {\n            callback();\n            return;\n          }\n\n          const rawConfig: unknown = toolConfig[parameterKey];\n          if (!rawConfig) {\n            callback();\n            return;\n          }\n\n          const config = configSchema.parse(rawConfig) as z.infer<TConfigSchema>;\n\n          const handlerContext: ToolHandlerContext<TConfigSchema> = {\n            config,\n            toolConfig,\n            prompts: prompts,\n            messages,\n            agentFrameworkContext,\n\n            findPrompt: (id: string) => findPromptById(prompts, id),\n\n            injectToolList: (options: InjectToolListOptions) => {\n              const target = findPromptById(prompts, options.targetId);\n              if (!target) {\n                logger.warn(`Target prompt not found for tool list injection`, {\n                  targetId: options.targetId,\n                  toolId,\n                });\n                return;\n              }\n\n              const schemas = options.toolSchemas ?? (llmToolSchemas ? Object.values(llmToolSchemas) : []);\n              const toolContent = schemas.map((schema) => schemaToToolContent(schema)).join('\\n\\n');\n\n              const pluginIndex = (context as PromptConcatHookContext).pluginIndex;\n              const source = pluginIndex !== undefined ? ['plugins', toolConfig.id] : undefined;\n\n              const toolPrompt: IPrompt = {\n                id: `${toolId}-tool-list-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`,\n                text: toolContent,\n                caption: options.caption ?? `${definition.displayName} Tools`,\n                enabled: true,\n                source,\n              };\n\n              if (options.position === 'child') {\n                if (!target.prompt.children) {\n                  target.prompt.children = [];\n                }\n                target.prompt.children.push(toolPrompt);\n              } else if (options.position === 'before') {\n                target.parent.splice(target.index, 0, toolPrompt);\n              } else {\n                target.parent.splice(target.index + 1, 0, toolPrompt);\n              }\n            },\n\n            injectContent: (options: InjectContentOptions) => {\n              const target = findPromptById(prompts, options.targetId);\n              if (!target) {\n                logger.warn(`Target prompt not found for content injection`, {\n                  targetId: options.targetId,\n                  toolId,\n                });\n                return;\n              }\n\n              const pluginIndex = (context as PromptConcatHookContext).pluginIndex;\n              const source = pluginIndex !== undefined ? ['plugins', toolConfig.id] : undefined;\n\n              const contentPrompt: IPrompt = {\n                id: options.id ??\n                  `${toolId}-content-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`,\n                text: options.content,\n                caption: options.caption ?? 'Injected Content',\n                enabled: true,\n                source,\n              };\n\n              if (options.position === 'child') {\n                if (!target.prompt.children) {\n                  target.prompt.children = [];\n                }\n                target.prompt.children.push(contentPrompt);\n              } else if (options.position === 'before') {\n                target.parent.splice(target.index, 0, contentPrompt);\n              } else {\n                target.parent.splice(target.index + 1, 0, contentPrompt);\n              }\n            },\n          };\n\n          await onProcessPrompts(handlerContext);\n          callback();\n        } catch (error) {\n          logger.error(`Error in ${toolId} processPrompts handler`, error);\n          callback();\n        }\n      });\n    }\n\n    if (onResponseComplete) {\n      hooks.responseComplete.tapAsync(`${toolId}-responseComplete`, async (context, callback) => {\n        try {\n          const {\n            agentFrameworkContext,\n            response,\n            agentFrameworkConfig,\n            requestId,\n            toolConfig: directToolConfig,\n          } = context as AIResponseContext & {\n            toolConfig?: PromptConcatHookContext['toolConfig'];\n            actions?: { yieldNextRoundTo?: 'human' | 'self' };\n          };\n\n          const configuredToolConfig = agentFrameworkConfig?.plugins?.find(\n            (p) => p.toolId === toolId,\n          );\n          const ourToolConfig = configuredToolConfig ??\n            (directToolConfig?.toolId === toolId ? directToolConfig : undefined);\n\n          if (!ourToolConfig) {\n            callback();\n            return;\n          }\n\n          if (ourToolConfig.enabled === false) {\n            callback();\n            return;\n          }\n\n          if (response.status !== 'done' || !response.content) {\n            callback();\n            return;\n          }\n\n          const { calls: allCalls, parallel: isParallel } = matchAllToolCallings(response.content);\n          const toolCall = allCalls.length > 0 ? allCalls[0] : null;\n\n          const rawConfig: unknown = ourToolConfig[parameterKey];\n          let config: z.infer<TConfigSchema> | undefined;\n          if (rawConfig) {\n            try {\n              config = configSchema.parse(rawConfig) as z.infer<TConfigSchema>;\n            } catch (parseError) {\n              logger.warn(`Failed to parse config for ${toolId}`, parseError);\n            }\n          }\n\n          const persist = agentFrameworkContext.persistAgentMessage;\n\n          const handlerContext: ResponseHandlerContext<TConfigSchema, TLLMToolSchemas> = {\n            config,\n            toolConfig: ourToolConfig,\n            messages: agentFrameworkContext.agent.messages,\n            agentFrameworkContext,\n            response,\n            toolCall,\n            allToolCalls: allCalls,\n            isParallel,\n            agentFrameworkConfig,\n            hooks,\n            requestId,\n\n            findPrompt: () => undefined,\n\n            injectToolList: () => {\n              logger.warn('injectToolList is not available in response phase');\n            },\n\n            injectContent: () => {\n              logger.warn('injectContent is not available in response phase');\n            },\n\n            executeToolCall: async <TToolName extends keyof TLLMToolSchemas>(\n              toolName: TToolName,\n              executor: (\n                parameters: z.infer<TLLMToolSchemas[TToolName]>,\n              ) => Promise<ToolExecutionResult>,\n            ): Promise<boolean> => {\n              const toolNameString = String(toolName);\n              if (!toolCall || toolCall.toolId !== toolNameString) {\n                return false;\n              }\n\n              const toolSchema = llmToolSchemas?.[toolName];\n              if (!toolSchema) {\n                logger.error(`No schema found for tool: ${toolNameString}`);\n                return false;\n              }\n\n              try {\n                const parameterParseError = toolCall.parameters[\n                  TOOL_PARAMETER_PARSE_ERROR_KEY\n                ];\n                if (typeof parameterParseError === 'string') {\n                  throw new Error(parameterParseError);\n                }\n                const validatedParameters = toolSchema.parse(toolCall.parameters) as z.infer<\n                  TLLMToolSchemas[TToolName]\n                >;\n\n                const approvalConfig = ourToolConfig.approval;\n                const decision = evaluateApproval(\n                  approvalConfig,\n                  toolNameString,\n                  validatedParameters as Record<string, unknown>,\n                );\n                if (decision === 'deny') {\n                  handlerContext.addToolResult({\n                    toolName: toolNameString,\n                    parameters: validatedParameters,\n                    result: 'Tool execution denied by approval policy.',\n                    isError: true,\n                    duration: 2,\n                  });\n                  handlerContext.yieldToSelf();\n                  return true;\n                }\n                if (decision === 'pending') {\n                  const approvalId = `approval-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`;\n                  const userDecision = await requestApproval({\n                    approvalId,\n                    agentId: agentFrameworkContext.agent.id,\n                    toolName: toolNameString,\n                    parameters: validatedParameters as Record<string, unknown>,\n                    originalText: toolCall.originalText,\n                    created: new Date(),\n                  });\n                  if (userDecision === 'deny') {\n                    handlerContext.addToolResult({\n                      toolName: toolNameString,\n                      parameters: validatedParameters,\n                      result: 'Tool execution denied by user.',\n                      isError: true,\n                      duration: 2,\n                    });\n                    handlerContext.yieldToSelf();\n                    return true;\n                  }\n                }\n\n                const result = await executor(validatedParameters);\n\n                const toolResultDuration = (config as { toolResultDuration?: number } | undefined)?.toolResultDuration ?? 1;\n                handlerContext.addToolResult({\n                  toolName: toolNameString,\n                  parameters: validatedParameters,\n                  result: result.success\n                    ? (result.data ?? 'Success')\n                    : (result.error ?? 'Unknown error'),\n                  isError: !result.success,\n                  duration: toolResultDuration,\n                });\n\n                handlerContext.yieldToSelf();\n\n                await hooks.toolExecuted.promise({\n                  agentFrameworkContext,\n                  toolResult: result,\n                  toolInfo: {\n                    toolId: toolNameString,\n                    parameters: validatedParameters as Record<string, unknown>,\n                    originalText: toolCall.originalText,\n                  },\n                  requestId,\n                });\n\n                return true;\n              } catch (error) {\n                logger.error(`Tool execution failed: ${toolNameString}`, error);\n\n                handlerContext.addToolResult({\n                  toolName: toolNameString,\n                  parameters: toolCall.parameters,\n                  result: error instanceof Error ? error.message : String(error),\n                  isError: true,\n                  duration: 2,\n                });\n\n                handlerContext.yieldToSelf();\n\n                await hooks.toolExecuted.promise({\n                  agentFrameworkContext,\n                  toolResult: {\n                    success: false,\n                    error: error instanceof Error ? error.message : String(error),\n                  },\n                  toolInfo: {\n                    toolId: toolNameString,\n                    parameters: toolCall.parameters || {},\n                  },\n                });\n\n                return true;\n              }\n            },\n\n            addToolResult: (options: AddToolResultOptions) => {\n              let resultContent = options.result;\n              if (resultContent.length > MAX_TOOL_RESULT_CHARS) {\n                const truncated = resultContent.slice(0, MAX_TOOL_RESULT_CHARS);\n                resultContent = `${truncated}\\n\\n[... truncated — result was ${options.result.length} chars, showing first ${MAX_TOOL_RESULT_CHARS}]`;\n              }\n\n              const payload: unknown = (() => {\n                try {\n                  return JSON.parse(resultContent) as unknown;\n                } catch {\n                  return undefined;\n                }\n              })();\n\n              const toolResultMessage: ChatMessage = createChatMessage({\n                messageId: `tool-result-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`,\n                conversationId: agentFrameworkContext.agent.id,\n                originNodeId: 'local',\n                lamportClock: 0,\n                role: 'tool',\n                parts: [{\n                  type: 'tool-result',\n                  toolName: options.toolName,\n                  parameters: options.parameters,\n                  result: resultContent,\n                  isError: options.isError ?? false,\n                  payload,\n                }],\n                duration: options.duration ?? 1,\n                metadata: {\n                  isToolResult: true,\n                  isError: options.isError ?? false,\n                  toolId: options.toolName,\n                  toolParameters: options.parameters,\n                  isPersisted: false,\n                  isComplete: true,\n                },\n              });\n\n              agentFrameworkContext.agent.messages.push(toolResultMessage);\n\n              const aiMessages = agentFrameworkContext.agent.messages.filter(\n                (m) => m.role === 'assistant',\n              );\n              if (aiMessages.length > 0) {\n                const latestAiMessage = aiMessages[aiMessages.length - 1];\n                if (\n                  latestAiMessage.content === response.content &&\n                  !latestAiMessage.metadata?.containsToolCall\n                ) {\n                  latestAiMessage.duration = 1;\n                  latestAiMessage.metadata = {\n                    ...latestAiMessage.metadata,\n                    containsToolCall: true,\n                    toolId: options.toolName,\n                    isPersisted: true,\n                  };\n\n                  if (persist) {\n                    void (async () => {\n                      try {\n                        await persist(latestAiMessage);\n                      } catch (error) {\n                        logger.warn('Failed to persist AI message with tool call', {\n                          error,\n                          messageId: latestAiMessage.messageId,\n                        });\n                      }\n                    })();\n                  }\n                }\n              }\n\n              if (persist) {\n                void (async () => {\n                  try {\n                    await persist(toolResultMessage);\n                    toolResultMessage.metadata = {\n                      ...toolResultMessage.metadata,\n                      isPersisted: true,\n                    };\n                  } catch (error) {\n                    logger.warn('Failed to persist tool result', {\n                      error,\n                      messageId: toolResultMessage.messageId,\n                    });\n                  }\n                })();\n              }\n            },\n\n            yieldToSelf: () => {\n              const context_ = context as { actions?: { yieldNextRoundTo?: 'human' | 'self' } };\n              if (!context_.actions) {\n                context_.actions = {};\n              }\n              context_.actions.yieldNextRoundTo = 'self';\n            },\n\n            yieldToHuman: () => {\n              const context_ = context as { actions?: { yieldNextRoundTo?: 'human' | 'self' } };\n              if (!context_.actions) {\n                context_.actions = {};\n              }\n              context_.actions.yieldNextRoundTo = 'human';\n            },\n\n            executeAllMatchingToolCalls: async <TToolName extends keyof TLLMToolSchemas>(\n              toolName: TToolName,\n              executor: (\n                parameters: z.infer<TLLMToolSchemas[TToolName]>,\n              ) => Promise<ToolExecutionResult>,\n              options?: { timeoutMs?: number },\n            ): Promise<number> => {\n              const toolNameString = String(toolName);\n              const matchingCalls = allCalls.filter((call) => call.toolId === toolNameString);\n              if (matchingCalls.length === 0) return 0;\n\n              const toolSchema = llmToolSchemas?.[toolName];\n              if (!toolSchema) {\n                logger.error(`No schema found for tool: ${toolNameString}`);\n                return 0;\n              }\n\n              const toolResultDuration = (config as { toolResultDuration?: number } | undefined)?.toolResultDuration ?? 1;\n\n              const entries: Array<{\n                call: ToolCallingMatch & { found: true };\n                executor: (parameters: Record<string, unknown>) => Promise<ToolExecutionResult>;\n                timeoutMs?: number;\n              }> = [];\n\n              const approvalConfig = ourToolConfig.approval;\n              const batchDecision = evaluateApproval(\n                approvalConfig,\n                toolNameString,\n                matchingCalls[0]?.parameters ?? {},\n              );\n              if (batchDecision === 'deny') {\n                for (const call of matchingCalls) {\n                  handlerContext.addToolResult({\n                    toolName: toolNameString,\n                    parameters: call.parameters,\n                    result: 'Tool execution denied by approval policy.',\n                    isError: true,\n                    duration: toolResultDuration,\n                  });\n                }\n                handlerContext.yieldToSelf();\n                return matchingCalls.length;\n              }\n              if (batchDecision === 'pending') {\n                const approvalId = `approval-batch-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`;\n                const userDecision = await requestApproval({\n                  approvalId,\n                  agentId: agentFrameworkContext.agent.id,\n                  toolName: toolNameString,\n                  parameters: {\n                    _batchSize: matchingCalls.length,\n                    _firstCallParams: matchingCalls[0]?.parameters,\n                  },\n                  created: new Date(),\n                });\n                if (userDecision === 'deny') {\n                  for (const call of matchingCalls) {\n                    handlerContext.addToolResult({\n                      toolName: toolNameString,\n                      parameters: call.parameters,\n                      result: 'Tool execution denied by user.',\n                      isError: true,\n                      duration: toolResultDuration,\n                    });\n                  }\n                  handlerContext.yieldToSelf();\n                  return matchingCalls.length;\n                }\n              }\n\n              for (const call of matchingCalls) {\n                try {\n                  const validatedParameters = toolSchema.parse(call.parameters) as z.infer<\n                    TLLMToolSchemas[TToolName]\n                  >;\n                  entries.push({\n                    call,\n                    executor: async () => executor(validatedParameters),\n                    timeoutMs: options?.timeoutMs,\n                  });\n                } catch (validationError) {\n                  handlerContext.addToolResult({\n                    toolName: toolNameString,\n                    parameters: call.parameters,\n                    result: `Parameter validation failed: ${validationError instanceof Error ? validationError.message : String(validationError)}`,\n                    isError: true,\n                    duration: toolResultDuration,\n                  });\n                }\n              }\n\n              if (entries.length === 0) return matchingCalls.length;\n\n              let results: Array<{\n                call: ToolCallingMatch & { found: true };\n                status: string;\n                result?: ToolExecutionResult;\n                error?: string;\n              }>;\n              if (isParallel) {\n                results = await executeToolCallsParallel(entries);\n              } else {\n                results = await executeToolCallsSequential(entries);\n              }\n\n              for (const result of results) {\n                const isError = result.status !== 'fulfilled' ||\n                  (result.result !== undefined && !result.result.success);\n                const resultText = result.status === 'timeout'\n                  ? (result.error ?? 'Tool execution timed out')\n                  : result.status === 'rejected'\n                  ? (result.error ?? 'Tool execution failed')\n                  : result.result?.success\n                  ? (result.result.data ?? 'Success')\n                  : (result.result?.error ?? 'Unknown error');\n\n                handlerContext.addToolResult({\n                  toolName: toolNameString,\n                  parameters: result.call.parameters,\n                  result: resultText,\n                  isError,\n                  duration: toolResultDuration,\n                });\n\n                await hooks.toolExecuted.promise({\n                  agentFrameworkContext,\n                  toolResult: result.result ?? { success: false, error: resultText },\n                  toolInfo: {\n                    toolId: toolNameString,\n                    parameters: result.call.parameters ?? {},\n                    originalText: result.call.originalText,\n                  },\n                  requestId,\n                });\n              }\n\n              handlerContext.yieldToSelf();\n              return matchingCalls.length;\n            },\n          };\n\n          await onResponseComplete(handlerContext);\n          callback();\n        } catch (error) {\n          logger.error(`Error in ${toolId} responseComplete handler`, error);\n          callback();\n        }\n      });\n    }\n\n    if (onPostProcess) {\n      hooks.postProcess.tapAsync(\n        `${toolId}-postProcess`,\n        async (context: PostProcessContext, callback) => {\n          try {\n            const { toolConfig, prompts, messages, agentFrameworkContext, llmResponse, responses } = context;\n\n            if (toolConfig.toolId !== toolId) {\n              callback();\n              return;\n            }\n\n            if (toolConfig.enabled === false) {\n              callback();\n              return;\n            }\n\n            const rawConfig: unknown = toolConfig[parameterKey];\n            if (!rawConfig) {\n              callback();\n              return;\n            }\n\n            const config = configSchema.parse(rawConfig) as z.infer<TConfigSchema>;\n\n            const handlerContext: PostProcessHandlerContext<TConfigSchema> = {\n              config,\n              toolConfig,\n              prompts: prompts,\n              messages,\n              agentFrameworkContext,\n              llmResponse,\n              responses,\n\n              findPrompt: (id: string) => findPromptById(prompts, id),\n\n              injectToolList: () => {\n                logger.warn('injectToolList is not recommended in postProcess phase');\n              },\n\n              injectContent: () => {\n                logger.warn('injectContent is not recommended in postProcess phase');\n              },\n            };\n\n            await onPostProcess(handlerContext);\n            callback();\n          } catch (error) {\n            logger.error(`Error in ${toolId} postProcess handler`, error);\n            callback();\n          }\n        },\n      );\n    }\n  };\n\n  getActivePluginRegistry().set(toolId, tool);\n\n  return {\n    tool,\n    toolId,\n    configSchema,\n    llmToolSchemas,\n    displayName: definition.displayName,\n    description: definition.description,\n  };\n}\n","/**\n * Host agent tool configuration → prompt plugin mapping.\n * Every host (Desktop, CLI, Cloud) that defines agent tools needs this merge logic.\n * Defined once in memeloop so each host doesn't reimplement it.\n */\n\nimport type { AgentDefinitionToolConfig } from '../agent/types.js';\nimport type { AgentFrameworkConfig, PromptPluginConfig } from '../promptUtilities/types.js';\n\nexport type HostAgentToolConfig = AgentDefinitionToolConfig;\n\nfunction isPluginConfig(value: unknown): value is Record<string, unknown> & { toolId?: string } {\n  return typeof value === 'object' && value !== null;\n}\n\nexport function mergeAgentToolsIntoFrameworkConfig(\n  frameworkConfig: AgentFrameworkConfig | undefined,\n  agentTools: HostAgentToolConfig[] | undefined,\n): AgentFrameworkConfig {\n  const baseConfig = { ...(frameworkConfig ?? {}) };\n  const rawPlugins = Array.isArray(baseConfig.plugins) ? baseConfig.plugins : [];\n  const pluginByToolId = new Map<string, Record<string, unknown>>();\n  const pluginWithoutToolId: unknown[] = [];\n\n  for (const plugin of rawPlugins) {\n    if (isPluginConfig(plugin) && typeof plugin.toolId === 'string' && plugin.toolId.length > 0) {\n      pluginByToolId.set(plugin.toolId, plugin);\n    } else {\n      pluginWithoutToolId.push(plugin);\n    }\n  }\n\n  for (const tool of agentTools ?? []) {\n    if (!tool.toolId) continue;\n    pluginByToolId.set(tool.toolId, {\n      id: `${tool.toolId}-agent-tool`,\n      toolId: tool.toolId,\n      enabled: tool.enabled ?? true,\n      ...(tool.parameters ?? {}),\n    });\n  }\n\n  return {\n    ...baseConfig,\n    prompts: Array.isArray(baseConfig.prompts) ? baseConfig.prompts : [],\n    response: Array.isArray(baseConfig.response) ? baseConfig.response : undefined,\n    plugins: [...pluginWithoutToolId, ...pluginByToolId.values()] as PromptPluginConfig[],\n  };\n}\n","/**\n * Tool definition registry.\n * Converted from module-level singletons to an instance class for test isolation\n * and multi-runtime support.\n */\nimport type { z } from 'zod';\n\nimport { defineTool } from './defineTool.js';\nimport type { DefinedTool, ToolDefinition } from './defineToolTypes.js';\nimport { registerToolParameterSchema } from './schemaRegistry.js';\n\n/**\n * Instance-level tool definition registry.\n */\nexport class ToolDefinitionRegistry {\n  private readonly registry = new Map<string, DefinedTool>();\n\n  registerToolDefinition<\n    TConfigSchema extends z.ZodType,\n    TLLMToolSchemas extends Record<string, z.ZodType>,\n  >(definition: ToolDefinition<TConfigSchema, TLLMToolSchemas>): DefinedTool<TConfigSchema, TLLMToolSchemas> {\n    const toolDefinition = defineTool(definition);\n\n    registerToolParameterSchema(toolDefinition.toolId, toolDefinition.configSchema as object, {\n      displayName: toolDefinition.displayName,\n      description: toolDefinition.description,\n    });\n\n    this.registry.set(toolDefinition.toolId, toolDefinition as DefinedTool);\n    return toolDefinition as DefinedTool<TConfigSchema, TLLMToolSchemas>;\n  }\n\n  getAllToolDefinitions(): Map<string, DefinedTool> {\n    return this.registry;\n  }\n\n  getToolDefinition(toolId: string): DefinedTool | undefined {\n    return this.registry.get(toolId);\n  }\n}\n\n// ─── Default global instance + backward-compatible function exports ───\n\nconst defaultToolDefinitionRegistry = new ToolDefinitionRegistry();\n\nexport function getDefaultToolDefinitionRegistry(): ToolDefinitionRegistry {\n  return defaultToolDefinitionRegistry;\n}\n\nexport function registerToolDefinition<\n  TConfigSchema extends z.ZodType,\n  TLLMToolSchemas extends Record<string, z.ZodType>,\n>(definition: ToolDefinition<TConfigSchema, TLLMToolSchemas>): DefinedTool<TConfigSchema, TLLMToolSchemas> {\n  return defaultToolDefinitionRegistry.registerToolDefinition(definition);\n}\n\nexport function getAllToolDefinitions(): Map<string, DefinedTool> {\n  return defaultToolDefinitionRegistry.getAllToolDefinitions();\n}\n\nexport function getToolDefinition(toolId: string): DefinedTool | undefined {\n  return defaultToolDefinitionRegistry.getToolDefinition(toolId);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoBA,IAAM,0BAA0B;AAczB,SAAS,6BACd,UAAyC,CAAC,GACW;AACrD,QAAM,iBAAiB,QAAQ,uBAAuB;AACtD,QAAM,0BAA0B,QAAQ,2BAA2B;AAEnE,SAAO,CAAC,YAA8C;AACpD,QAAI,QAAQ,UAAU,SAAS,qBAAsB;AAErD,UAAM,EAAE,OAAO,MAAM,SAAS,eAAe,IAAI;AAEjD,QAAI,SAAS,UAAU;AAErB;AAAA,IACF;AAEA,QAAI,SAAS,mBAAmB,WAAW,gBAAgB;AACzD,YAAM,gBAAgB,QAAQ;AAC9B,YAAM,WAAW;AAEjB,YAAM,iBAAiB,eAAe,WAAW,CAAC;AAClD,YAAM,kBAAkB,SAAS,WAAW,CAAC;AAG7C,YAAM,mBAAmB,eAAe,WAAW,gBAAgB,UACjE,eAAe,MAAM,CAAC,QAAQ,UAAU;AACtC,cAAM,iBAAiB,gBAAgB,KAAK;AAC5C,eACE,OAAO,SAAS,eAAe,QAC/B,OAAO,YAAY,eAAe,WAClC,OAAO,aAAa,eAAe,YACnC,OAAO,gBAAgB,eAAe,eACtC,OAAO,iBAAiB,eAAe,gBACvC,OAAO,eAAe,eAAe,cACrC,OAAO,aAAa,WAAW,eAAe,aAAa,UAC3D,OAAO,aAAa,MAAM,CAAC,aAAa,qBAAqB,gBAAgB,eAAe,aAAa,gBAAgB,CAAC;AAAA,MAE9H,CAAC;AACH,YAAM,qBAAqB,eAAe,eAAe;AACzD,YAAM,sBAAsB,SAAS,eAAe;AACpD,YAAM,sBAAsB,uBAAuB,wBAChD,eAAe,oBAAoB,SAAS,SAAS,oBAAoB;AAE5E,UAAI,oBAAoB,qBAAqB;AAC3C;AAAA,MACF;AAGA,YAAM,mBAAmB,CAAC,eAAe,eACvC,SAAS,gBAAgB,QACzB;AAEF,UAAI,oBAAoB,yBAAyB;AAC/C;AAAA,MACF;AAGA,UAAI,CAAC,MAAM,GAAG,WAAW,cAAc,GAAG;AACxC,cAAM,IAAI;AAAA,UACR,wFAAwF,cAAc,UAAU,MAAM,EAAE;AAAA,QAC1H;AAAA,MACF;AAGA,UAAI,gBAAgB,SAAS,eAAe,QAAQ;AAClD,cAAM,IAAI,MAAM,0CAA0C;AAAA,MAC5D;AACA,eAAS,QAAQ,GAAG,QAAQ,eAAe,QAAQ,SAAS,GAAG;AAC7D,YAAI,eAAe,KAAK,MAAM,gBAAgB,KAAK,GAAG;AACpD,gBAAM,IAAI,MAAM,2CAA2C;AAAA,QAC7D;AAAA,MACF;AAGA,YAAM,aAAa,gBAAgB,MAAM,eAAe,MAAM;AAC9D,YAAM,WAAW;AACjB,iBAAW,UAAU,YAAY;AAC/B,+BAAuB,QAAQ,UAAU,MAAM,EAAE;AAAA,MACnD;AAEA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,uBACP,QACA,UACA,SACM;AACN,MAAI,OAAO,gBAAgB,SAAS,KAAK,aAAa;AACpD,UAAM,IAAI;AAAA,MACR,sBAAsB,OAAO,WAAW,wCAAwC,SAAS,KAAK,WAAW;AAAA,IAC3G;AAAA,EACF;AACA,MAAI,OAAO,aAAa,SAAS;AAC/B,UAAM,IAAI;AAAA,MACR,mBAAmB,OAAO,QAAQ,mCAAmC,OAAO;AAAA,IAC9E;AAAA,EACF;AACA,MAAI,OAAO,WAAW,WAAW,GAAG;AAClC,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACF;AAKO,SAAS,gBAAgB,SAAiB,iBAAyB,yBAAkC;AAC1G,SAAO,QAAQ,WAAW,cAAc;AAC1C;;;AChIO,SAAS,uCACd,OACA,OACA,aAA8D,6BAA6B,GACrE;AACtB,SAAO;AAAA,IACL,MAAM,aAAa,cAAsB,UAAkC;AACzE,YAAM,UAAU,MAAM,MAAM,IAAI;AAAA,QAC9B,MAAM;AAAA,QACN,WAAW;AAAA,QACX,MAAM,SAAS;AAAA,QACf,YAAY;AAAA,MACd,CAAC;AAED,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,4CAA4C,SAAS,WAAW,EAAE;AAAA,MACpF;AAEA,YAAM,iBAAiB,QAAQ,QAAQ,WAAW,CAAC;AACnD,YAAM,iBAAuC;AAAA,QAC3C,GAAG,QAAQ;AAAA,QACX,SAAS,CAAC,GAAG,gBAAgB,QAAQ;AAAA,MACvC;AAGA,iBAAW;AAAA,QACT;AAAA,QACA,MAAM;AAAA,QACN,WAAW;AAAA,UACT,MAAM;AAAA,UACN,WAAW;AAAA,UACX,MAAM,SAAS;AAAA,UACf,YAAY;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAED,YAAM,MAAM;AAAA,QACV;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,WAAW,QAAQ,SAAS;AAAA,UAC5B,MAAM,QAAQ,SAAS;AAAA,UACvB,YAAY,QAAQ;AAAA,QACtB;AAAA,QACA;AAAA,QACA,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,MACtD;AAAA,IACF;AAAA,IAEA,MAAM,WAAW,aAAqB,QAAgB;AACpD,YAAM,UAAU,MAAM,MAAM,IAAI;AAAA,QAC9B,MAAM;AAAA,QACN,WAAW;AAAA,QACX,MAAM;AAAA,QACN,YAAY;AAAA,MACd,CAAC;AAED,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,4CAA4C,WAAW,EAAE;AAAA,MAC3E;AAEA,YAAM,iBAAuC;AAAA,QAC3C,GAAG,QAAQ;AAAA,QACX,aAAa;AAAA,QACb,kBAAkB;AAAA,MACpB;AAGA,iBAAW;AAAA,QACT;AAAA,QACA,MAAM;AAAA,QACN,WAAW;AAAA,UACT,MAAM;AAAA,UACN,WAAW;AAAA,UACX,MAAM;AAAA,UACN,YAAY;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAED,YAAM,MAAM;AAAA,QACV;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,WAAW,QAAQ,SAAS;AAAA,UAC5B,MAAM,QAAQ,SAAS;AAAA,UACvB,YAAY,QAAQ;AAAA,QACtB;AAAA,QACA;AAAA,QACA,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,MACtD;AAAA,IACF;AAAA,EACF;AACF;;;ACvCA,eAAsB,uBAIpB,OACA,YACA,SACiC;AACjC,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,QAAQ,QAAQ,UAAU,CAAC,OAAe,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAChG,QAAM,qBAAqB,QAAQ,wBAAwB,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,aAAa,CAAC,CAAC;AACzG,QAAM,iBAAiB,QAAQ,oBAAoB;AACnD,QAAM,gBAAgB,QAAQ,mBAAmB;AAEjD,MAAI,UAAU;AACd,MAAI,eAAyE;AAC7E,QAAM,iBAAiB,oBAAI,IAA2C;AACtE,MAAI,YAAiC;AAIrC,iBAAe,MAAM,MAAM,aAAa,QAAQ,OAAO;AAAA,IACrD,MAAM,QAAQ;AAAA,IACd,QAAQ,QAAQ,MAAM;AAAA,IACtB,OAAO,QAAQ;AAAA,EACjB,CAAC;AAED,QAAM,eAAe,YAAY;AAC/B,QAAI,SAAS;AACX,YAAM,MAAM,aAAa,QAAQ,OAAO,YAAY,EAAE,MAAM,MAAM,MAAS;AAC3E,qBAAe;AACf;AAAA,IACF;AAEA,UAAM,aAAa,YAAY,YAAY;AACzC,UAAI,WAAW,CAAC,aAAc;AAC9B,UAAI;AACF,uBAAe,MAAM,MAAM,WAAW,QAAQ,OAAO,cAAc,QAAQ,UAAU;AAAA,MACvF,QAAQ;AAIN,kBAAU;AACV,sBAAc,UAAU;AACxB,oBAAY;AAAA,MACd;AAAA,IACF,GAAG,kBAAkB;AAErB,UAAM,UAAU,MAAM;AAAA,MACpB,EAAE,MAAM,QAAQ,UAAU;AAAA,MAC1B,EAAE,mBAAmB,KAAK;AAAA,IAC5B;AACA,UAAM,WAAW,QAAQ,OAAO,aAAa,EAAE;AAC/C,gBAAY,MAAM,KAAK,SAAS,SAAS;AAEzC,QAAI;AACF,aAAO,CAAC,SAAS;AACf,cAAM,SAAS,MAAM,SAAS,KAAK;AACnC,YAAI,OAAO,SAAS,QAAQ,OAAO,UAAU,OAAW;AACxD,cAAM,QAAQ,OAAO;AACrB,YAAI,MAAM,SAAS,WAAW,MAAM,SAAS,WAAY;AAEzD,cAAM,WAAW,MAAM;AACvB,YACE,QAAQ,kBACR,CAAC,QAAQ,eAAe,QAAQ,EAChC;AAEF,cAAM,MAAM,GAAG,SAAS,SAAS,SAAS,IAAI,SAAS,SAAS,IAAI;AACpE,YAAI,eAAe,IAAI,GAAG,EAAG;AAE7B,cAAM,mBAAmB,KAAK,QAAQ;AAAA,MACxC;AAAA,IACF,UAAE;AACA,oBAAc,UAAU;AACxB,iBAAW,SAAS,eAAe,OAAO,EAAG,cAAa,KAAK;AAC/D,qBAAe,MAAM;AACrB,UAAI,cAAc;AAChB,cAAM,MAAM,aAAa,QAAQ,OAAO,YAAY,EAAE,MAAM,MAAM,MAAS;AAC3E,uBAAe;AAAA,MACjB;AAAA,IACF;AAAA,EACF,GAAG;AAEH,iBAAe,mBACb,KACA,UACA,UAAU,GACK;AACf,QAAI,WAAW,CAAC,aAAc;AAE9B,QAAI;AACF,YAAM,SAAS,MAAM,WAAW,UAAU;AAAA,QACxC;AAAA,QACA,OAAO,QAAQ;AAAA,QACf,YAAY,aAAa;AAAA,QACzB,KAAK,IAAI;AAAA,MACX,CAAC;AAED,UAAI,OAAO,UAAU,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,GAAG;AAC1D,cAAM,MAAM;AAAA,UACV,QAAQ;AAAA,UACR;AAAA,YACE,YAAY,SAAS;AAAA,YACrB,MAAM,SAAS;AAAA,YACf,WAAW,SAAS,SAAS;AAAA,YAC7B,MAAM,SAAS,SAAS;AAAA,UAC1B;AAAA,UACA,OAAO;AAAA,UACP;AAAA,YACE,iBAAiB,SAAS,SAAS;AAAA,UACrC;AAAA,QACF;AAAA,MACF;AAEA,UAAI,OAAO,mBAAmB,UAAa,OAAO,iBAAiB,GAAG;AACpE,cAAM,QAAQ,WAAW,MAAM;AAC7B,yBAAe,OAAO,GAAG;AACzB,cAAI,CAAC,QAAS,MAAK,kBAAkB,KAAK,UAAU,CAAC;AAAA,QACvD,GAAG,OAAO,cAAc;AACxB,uBAAe,IAAI,KAAK,KAAK;AAAA,MAC/B;AAAA,IACF,QAAQ;AACN,YAAM,QAAQ,KAAK,IAAI,eAAe,iBAAiB,KAAK,OAAO;AACnE,YAAM,QAAQ,WAAW,MAAM;AAC7B,uBAAe,OAAO,GAAG;AACzB,YAAI,CAAC,QAAS,MAAK,kBAAkB,KAAK,UAAU,UAAU,CAAC;AAAA,MACjE,GAAG,KAAK;AACR,qBAAe,IAAI,KAAK,KAAK;AAAA,IAC/B;AAAA,EACF;AAQA,iBAAe,kBACb,KACA,UACA,SACe;AACf,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,MAAM,IAAoB;AAAA,QACxC,YAAY,SAAS;AAAA,QACrB,MAAM,SAAS;AAAA,QACf,WAAW,SAAS,SAAS;AAAA,QAC7B,MAAM,SAAS,SAAS;AAAA,MAC1B,CAAC;AAAA,IACH,QAAQ;AAIN,YAAM,QAAQ,KAAK,IAAI,eAAe,iBAAiB,KAAK,OAAO;AACnE,YAAM,QAAQ,WAAW,MAAM;AAC7B,uBAAe,OAAO,GAAG;AACzB,YAAI,CAAC,QAAS,MAAK,kBAAkB,KAAK,UAAU,UAAU,CAAC;AAAA,MACjE,GAAG,KAAK;AACR,qBAAe,IAAI,KAAK,KAAK;AAC7B;AAAA,IACF;AAGA,QAAI,CAAC,QAAS;AACd,UAAM,mBAAmB,KAAK,SAAS,OAAO;AAAA,EAChD;AAEA,SAAO;AAAA,IACL,MAAM,OAAO;AACX,gBAAU;AACV,kBAAY;AAEZ,UAAI,cAAc;AAChB,cAAM,MAAM,aAAa,QAAQ,OAAO,YAAY,EAAE,MAAM,MAAM,MAAS;AAC3E,uBAAe;AAAA,MACjB;AAEA,YAAM,QAAQ,KAAK;AAAA,QACjB,YAAY,MAAM,MAAM,MAAS;AAAA,QACjC,MAAM,EAAE;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,MAAM,MAAM;AAAA,EACd;AACF;;;AC/PO,IAAM,4BAA4B;AAClC,IAAM,qBAAqB;AAoF3B,SAAS,iBAAiB,UAAyF;AACxH,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,SAAS,YAAY,CAAC,GAAG;AAClC,cAAU,MAAM,OAAO,UAAU;AACjC,YAAQ,MAAM,OAAO,QAAQ;AAAA,EAC/B;AAEA,SAAO,EAAE,QAAQ,KAAK,MAAM,SAAS,GAAG,IAAI,KAAK,MAAM,KAAK,MAAM,OAAO,GAAG,IAAI,IAAI;AACtF;AAEA,SAAS,eAAe,QAAoC,UAAgE;AAC1H,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,cAAc,UAAa,SAAS,UAAU,OAAO,WAAW;AACzE,WAAO,UAAU,SAAS,MAAM,OAAO,OAAO,SAAS;AAAA,EACzD;AACA,MAAI,OAAO,YAAY,UAAa,SAAS,QAAQ,OAAO,SAAS;AACnE,WAAO,QAAQ,SAAS,IAAI,OAAO,OAAO,OAAO;AAAA,EACnD;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,KAA0C,OAAoD;AAC7H,MAAI,CAAC,OAAO,CAAC,MAAO,QAAO;AAC3B,MAAI,IAAI,cAAc,WAAc,MAAM,UAAU,KAAK,IAAI,WAAW;AACtE,WAAO,UAAU,MAAM,MAAM,kBAAkB,IAAI,SAAS;AAAA,EAC9D;AACA,MAAI,IAAI,YAAY,WAAc,MAAM,QAAQ,KAAK,IAAI,SAAS;AAChE,WAAO,QAAQ,MAAM,IAAI,kBAAkB,IAAI,OAAO;AAAA,EACxD;AACA,SAAO;AACT;AAMA,eAAe,sBACb,SACA,gBACA,gBACA,KACA,iBACiC;AACjC,QAAM,UAAkC,CAAC;AACzC,QAAM,QAAQ,CAAC,GAAG,OAAO;AAEzB,iBAAe,SAAwB;AACrC,WAAO,MAAM,SAAS,GAAG;AACvB,YAAM,SAAS,MAAM,MAAM;AAC3B,UAAI;AACF,cAAM,SAAS,MAAM,eAAe,MAAM;AAC1C,cAAM,kBAAkB,wBAAwB,iBAAiB,QAAQ,KAAK;AAC9E,YAAI,iBAAiB;AACnB,kBAAQ,KAAK;AAAA,YACX,cAAc,OAAO;AAAA,YACrB,SAAS;AAAA,YACT,SAAS,+BAA+B,eAAe;AAAA,YACvD,WAAW,IAAI,EAAE,YAAY;AAAA,YAC7B,GAAI,QAAQ,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,UACjD,CAAC;AAAA,QACH,OAAO;AACL,kBAAQ,KAAK;AAAA,YACX,cAAc,OAAO;AAAA,YACrB,SAAS;AAAA,YACT,WAAW,IAAI,EAAE,YAAY;AAAA,YAC7B,GAAI,QAAQ,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,UACjD,CAAC;AAAA,QACH;AAAA,MACF,SAASA,QAAO;AACd,gBAAQ,KAAK;AAAA,UACX,cAAc,OAAO;AAAA,UACrB,SAAS;AAAA,UACT,SAASA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,UAC9D,WAAW,IAAI,EAAE,YAAY;AAAA,QAC/B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,KAAK,IAAI,gBAAgB,QAAQ,MAAM;AAC3D,QAAM,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ,YAAY,GAAG,MAAM,OAAO,CAAC,CAAC;AACrE,SAAO;AACT;AAmDO,SAAS,6BACd,QACA,SAC8B;AAC9B,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAE3C,iBAAe,iBAAiB,SAAuG;AACrI,UAAM,UAAU,QAAQ;AACxB,UAAM,SAA6B,QAAQ,UAAU,CAAC;AACtD,UAAM,OAAO,QAAQ;AAGrB,QAAI,OAAO,UAAU,eAAe,OAAO,UAAU,YAAY,OAAO,UAAU,cAAc;AAC9F,aAAO,EAAE,OAAO,KAAK;AAAA,IACvB;AAGA,QAAI,CAAC,OAAO,OAAO;AACjB,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,cAAc;AAAA,UACd,oBAAoB;AAAA,UACpB,iBAAiB;AAAA,UACjB,eAAe;AAAA,UACf,mBAAmB;AAAA,UACnB,qBAAqB;AAAA,UACrB,WAAW,IAAI,EAAE,YAAY;AAAA,UAC7B,UAAU,CAAC;AAAA,QACb;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAGA,UAAM,aAAiC,KAAK;AAC5C,UAAM,YAAgC,OAAO;AAC7C,QAAI,cAAc,WAAW;AAC3B,YAAM,UAAU,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,QAAQ;AAC9D,UAAI,UAAU,YAAY;AACxB,YAAI,KAAK,cAAc;AACrB,gBAAMC,WAAU,MAAM,QAAQ,YAAY,OAAO;AACjD,gBAAM,kBAAkB,OAAO,YAAY,CAAC,GACzC,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAC7C,IAAI,CAAC,UAAUA,SAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM,YAAY,CAAC,EACjE,OAAO,CAAC,MAA0B,MAAM,MAAS;AACpD,qBAAW,UAAU,gBAAgB;AACnC,gBAAI;AACF,oBAAM,QAAQ,eAAe,SAAS,MAAM;AAAA,YAC9C,QAAQ;AAAA,YAAoB;AAAA,UAC9B;AAAA,QACF;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO,KAAK,eAAe,eAAe;AAAA,YAC1C,UAAU,IAAI,EAAE,YAAY;AAAA,YAC5B,eAAe;AAAA,YACf,kBAAkB;AAAA,YAClB,gBAAgB,KAAK,eAAe,sBAAsB;AAAA,UAC5D;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAGA,QAAI,OAAO,UAAU,UAAU;AAC7B,aAAO,EAAE,OAAO,KAAK;AAAA,IACvB;AAEA,UAAM,UAAU,MAAM,QAAQ,YAAY,OAAO;AACjD,UAAM,WAAwD,OAAO,YAAY,CAAC;AAGlF,UAAM,gBAAgB,QAAQ;AAC9B,UAAM,kBAAkB,SAAS,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAChF,UAAM,iBAAiB,SAAS,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAC/E,UAAM,oBAAoB,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE;AAC7D,UAAM,sBAAsB,gBAAgB;AAK5C,UAAM,kBAAkB,QAAQ,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE;AACjE,QAAI,KAAK,6BAA6B,UAAa,mBAAmB,KAAK,0BAA0B;AACnG,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,UAAU,IAAI,EAAE,YAAY;AAAA,UAC5B,aAAa,gCAAgC,eAAe,eAAe,KAAK,wBAAwB;AAAA,UACxG;AAAA,UACA,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,QAAQ,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;AACtD,QAAI,KAAK,0BAA0B,UAAa,gBAAgB,KAAK,uBAAuB;AAC1F,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,UAAU,IAAI,EAAE,YAAY;AAAA,UAC5B,aAAa,6BAA6B,YAAY,eAAe,KAAK,qBAAqB;AAAA,UAC/F;AAAA,UACA,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,kBAAkB,eAAe,KAAK,QAAQ,iBAAiB,QAAQ,CAAC;AAC9E,QAAI,iBAAiB;AACnB,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,UAAU,IAAI,EAAE,YAAY;AAAA,UAC5B,aAAa,4BAA4B,eAAe;AAAA,UACxD;AAAA,UACA,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,KAAK,mBAAmB,UAAa,sBAAsB,KAAK,gBAAgB;AAClF,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,UAAU,IAAI,EAAE,YAAY;AAAA,UAC5B,aAAa,4BAA4B,mBAAmB,kBAAkB,KAAK,cAAc;AAAA,UACjG;AAAA,UACA,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,KAAK,2BAA2B,kBAAkB,KAAK,yBAAyB;AAClF,UAAI,KAAK,cAAc;AACrB,cAAM,iBAAiB,SACpB,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAC7C,IAAI,CAAC,UAAU,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM,YAAY,CAAC,EACjE,OAAO,CAAC,MAA0B,MAAM,MAAS;AACpD,mBAAW,UAAU,gBAAgB;AACnC,cAAI;AACF,kBAAM,QAAQ,eAAe,SAAS,MAAM;AAAA,UAC9C,QAAQ;AAAA,UAAoB;AAAA,QAC9B;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,UAAU,IAAI,EAAE,YAAY;AAAA,YAC5B,aAAa,8BAA8B,cAAc;AAAA,YACzD,gBAAgB,kBAAkB,cAAc;AAAA,YAChD,iBAAiB;AAAA,YACjB,eAAe;AAAA,YACf;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,UAAU,IAAI,EAAE,YAAY;AAAA,UAC5B,aAAa,8BAA8B,cAAc;AAAA,UACzD;AAAA,UACA,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,KAAK,aAAa,SAAS;AAC7B,YAAM,YAAY,KAAK,aAAa;AACpC,YAAMC,kBAAiB,KAAK,kBAAkB;AAC9C,YAAM,eAAuB,OAAO,gBAAgB;AACpD,YAAM,aAAa,eAAe;AAClC,YAAM,WAAW,KAAK,IAAI,aAAa,WAAW,aAAa;AAE/D,UAAI,cAAc,eAAe;AAE/B,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,aAAa,IAAI,EAAE,YAAY;AAAA,YAC/B;AAAA,YACA,eAAe;AAAA,YACf;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAGA,YAAM,eAAe,QAAQ,MAAM,YAAY,QAAQ;AACvD,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA,CAAC,WAAW,QAAQ,aAAa,SAAS,MAAM;AAAA,QAChDA;AAAA,QACA;AAAA,QACA,KAAK;AAAA,MACP;AACA,YAAMC,eAAc,CAAC,GAAG,UAAU,GAAG,aAAa;AAElD,YAAM,uBAAuB,eAAe,KAAK,QAAQ,iBAAiBA,YAAW,CAAC;AACtF,UAAI,sBAAsB;AACxB,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,UAAU,IAAI,EAAE,YAAY;AAAA,YAC5B,aAAa,4BAA4B,oBAAoB;AAAA,YAC7D,iBAAiBA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,YAC5E,eAAeA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,YAC1E;AAAA,YACA;AAAA,YACA,UAAUA;AAAA,UACZ;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,YAAM,oBAAoBA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AACrF,UAAI,KAAK,2BAA2B,qBAAqB,KAAK,yBAAyB;AACrF,YAAI,KAAK,cAAc;AACrB,gBAAM,iBAAiBA,aACpB,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAC7C,IAAI,CAAC,UAAU,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM,YAAY,CAAC,EACjE,OAAO,CAAC,MAA0B,MAAM,MAAS;AACpD,qBAAW,UAAU,gBAAgB;AACnC,gBAAI;AACF,oBAAM,QAAQ,eAAe,SAAS,MAAM;AAAA,YAC9C,QAAQ;AAAA,YAAoB;AAAA,UAC9B;AACA,iBAAO;AAAA,YACL,QAAQ;AAAA,cACN,GAAG;AAAA,cACH,OAAO;AAAA,cACP,UAAU,IAAI,EAAE,YAAY;AAAA,cAC5B,aAAa,8BAA8B,iBAAiB;AAAA,cAC5D,gBAAgB,kBAAkB,iBAAiB;AAAA,cACnD,iBAAiB;AAAA,cACjB,eAAe;AAAA,cACf;AAAA,cACA;AAAA,cACA,UAAUA;AAAA,YACZ;AAAA,YACA,OAAO;AAAA,UACT;AAAA,QACF;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,UAAU,IAAI,EAAE,YAAY;AAAA,YAC5B,aAAa,8BAA8B,iBAAiB;AAAA,YAC5D,iBAAiBA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,YAC5E,eAAeA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,YAC1E;AAAA,YACA;AAAA,YACA,UAAUA;AAAA,UACZ;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,cAAc,eAAe;AAAA,UAC7B,iBAAiBA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,UAC5E,eAAeA,aAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,UAC1E;AAAA,UACA;AAAA,UACA,UAAUA;AAAA,QACZ;AAAA,QACA,OAAO;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,IACF;AAGA,UAAM,SAAS,KAAK,gBAAgB,CAAC,EAAE,QAAQ,IAAI,CAAC;AACpD,UAAM,eAAe,OAAO,sBAAsB;AAElD,QAAI,gBAAgB,OAAO,QAAQ;AACjC,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,aAAa,IAAI,EAAE,YAAY;AAAA,UAC/B;AAAA,UACA,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,QAAQ,OAAO,YAAY;AACjC,UAAM,iBAAiB,KAAK,kBAAkB;AAC9C,UAAM,gBAAgB,KAAK,KAAM,MAAM,SAAS,MAAO,aAAa;AACpE,UAAM,eAAe,QAAQ,MAAM,GAAG,aAAa,EAAE;AAAA,MACnD,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,UAAU,MAAM,iBAAiB,EAAE,QAAQ,MAAM,YAAY,SAAS;AAAA,IAC/F;AACA,UAAM,gBAAgB,MAAM;AAAA,MAC1B;AAAA,MACA,CAAC,WAAW,QAAQ,aAAa,SAAS,MAAM;AAAA,MAChD;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP;AACA,UAAM,cAAc,CAAC,GAAG,UAAU,GAAG,aAAa;AAElD,UAAM,uBAAuB,eAAe,KAAK,QAAQ,iBAAiB,WAAW,CAAC;AACtF,QAAI,sBAAsB;AACxB,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,UAAU,IAAI,EAAE,YAAY;AAAA,UAC5B,aAAa,4BAA4B,oBAAoB;AAAA,UAC7D,iBAAiB,YAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,UAC5E,eAAe,YAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,UAC1E;AAAA,UACA;AAAA,UACA,UAAU;AAAA,QACZ;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,MAAM,mBAAmB;AAC9C,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,GAAG;AAAA,QACH,OAAO;AAAA,QACP,oBAAoB,eAAe;AAAA,QACnC,iBAAiB,YAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,QAC5E,eAAe,YAAY,OAAO,CAAC,UAAU,MAAM,YAAY,SAAS,EAAE;AAAA,QAC1E;AAAA,QACA;AAAA,QACA,UAAU;AAAA,MACZ;AAAA,MACA,OAAO;AAAA,MACP,gBAAgB,eAAe,IAAI,eAAe;AAAA,IACpD;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,SAA6C;AAC3D,YAAM,SAAS,MAAM,iBAAiB,OAAO;AAG7C,UAAI,OAAO,QAAQ;AACjB,eAAO,SAAS;AAAA,UACd,GAAG,OAAO;AAAA,UACV,gBAAgB,iBAAkB,OAAO,OAA8B,QAAQ;AAAA,QACjF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACndO,SAAS,2BAA2B,OAAwB;AACjE,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,IAAI,MAAM,IAAI,0BAA0B,EAAE,KAAK,GAAG,CAAC;AAAA,EAC5D;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,WAAO,IACL,OAAO,QAAQ,KAAgC,EAC5C,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,2BAA2B,IAAI,CAAC,EAAE,EACjF,KAAK,GAAG,CACb;AAAA,EACF;AACA,SAAO,KAAK,UAAU,KAAK,KAAK,OAAO;AACzC;AAEA,IAAM,8BAA8B;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,SAAS,yBACd,SACA,UACS;AACT,MACE,2BAA2B,QAAQ,IAAI,MACrC,2BAA2B,SAAS,IAAI,GAC1C;AACA,WAAO;AAAA,EACT;AACA,SAAO,4BAA4B,MAAM,CAAC,UAAU;AAClD,UAAM,UAAU,SAAS,SAAS,KAAK;AACvC,WAAO,YAAY,UACjB,2BAA2B,QAAQ,SAAS,KAAK,CAAC,MAChD,2BAA2B,OAAO;AAAA,EACxC,CAAC;AACH;;;AC3GA,SAAS,cAAc,cAA4C;AACjE,SAAO,KAAK,IAAI,GAAG,aAAa,KAAK,aAAa,UAAU,CAAC;AAC/D;AAOO,SAAS,qBACd,UACA,YACA,OACmB;AACnB,QAAM,YAAY,IAAI,IAAI,SAAS,IAAI,CAAC,YAAY,QAAQ,MAAM,CAAC;AACnE,QAAM,cAAc,IAAI;AAAA,IACtB,SACG,IAAI,CAAC,YAAY,WAAW,KAAK,CAAC,SAAS,KAAK,WAAW,QAAQ,MAAM,GAAG,WAAW,EACvF,OAAO,CAAC,WAA6B,WAAW,MAAS;AAAA,EAC9D;AACA,QAAM,YAAY,WAAW,OAAO,CAAC,SAAS,KAAK,UAAU,aAAa,CAAC,UAAU,IAAI,KAAK,MAAM,CAAC;AACrG,QAAM,cAAc,UAAU,OAAO,CAAC,SAAS,KAAK,gBAAgB,UAAa,CAAC,YAAY,IAAI,KAAK,WAAW,CAAC;AACnH,QAAM,OAAO,UAAU,OAAO,CAAC,SAAS,CAAC,YAAY,SAAS,IAAI,CAAC;AACnE,SAAO,CAAC,GAAG,aAAa,GAAG,IAAI,EAAE,MAAM,GAAG,KAAK;AACjD;AAOA,eAAsB,2BACpB,QACA,cACA,SAC4B;AAC5B,QAAM,MAAM,QAAQ,MAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AACtD,QAAM,UAA+B,CAAC;AACtC,QAAM,UAAU,cAAc,YAAY;AAC1C,QAAM,SAAS,OAAO,UAAU,CAAC;AACjC,QAAM,WAAuC,CAAC,GAAI,OAAO,YAAY,CAAC,CAAE;AACxE,MAAI,cAAc,OAAO;AACzB,MAAI,gBAAgB,OAAO;AAC3B,MAAI,eAAe,OAAO,gBAAgB;AAC1C,MAAI;AAEJ,iBAAe,aAAa,QAA+B;AACzD,UAAM,WAAW,EAAE,GAAI,gBAAgB,EAAE,QAAQ,cAAc,IAAI,CAAC,GAAI,OAAO,aAAa;AAC5F,UAAM,OAAO,EAAE,QAAQ,OAAO,eAAe,EAAE;AAC/C,UAAM,QAAQ,mBAAmB,QAAQ,UAAU,IAAI;AACvD,oBAAgB;AAChB,mBAAe,KAAK;AACpB,YAAQ,KAAK,EAAE,MAAM,iBAAiB,QAAQ,OAAO,aAAa,CAAC;AAAA,EACrE;AAIA,QAAM,SAAS,oBAAI,IAA2B;AAC9C,aAAW,WAAW,UAAU;AAC9B,UAAM,OAAO,QAAQ,MAAM,KAAK,CAAC,cAAc,UAAU,WAAW,QAAQ,MAAM;AAClF,WAAO,IAAI,QAAQ,QAAQ,MAAM,UAAU,YAAY,MAAM,QAAQ,gBAAgB,QAAQ,QAAQ,MAAM,IAAI,IAAI;AAAA,EACrH;AAKA,QAAM,0BAA0B,kBAAkB,UAChD,OAAO,cAAc,YAAY,KACjC,gBAAgB,KAChB,OAAO,IAAI,aAAa,KAAK;AAC/B,MAAI,CAAC,yBAAyB;AAC5B,UAAM,YAAY,SAAS,KAAK,CAAC,YAAY;AAC3C,YAAM,OAAO,OAAO,IAAI,QAAQ,MAAM;AACtC,aAAO,QAAQ,SAAS,CAAC,eAAe,SAAS;AAAA,IACnD,CAAC;AACD,QAAI,WAAW;AACb,YAAM,aAAa,UAAU,MAAM;AAAA,IACrC,OAAO;AACL,sBAAgB;AAAA,IAClB;AAAA,EACF;AAEA,MAAI,kBAAkB;AACtB,MAAI;AAIF,QAAI,eAAe;AACjB,iBAAW,MAAM,QAAQ;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,UACE,CAAC,SAAS,kBACV,SAAS,eAAe,SAAS,QACjC,CAAC,SAAS,eACV,SAAS,YAAY,SAAS,KAC9B;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,oBAAc,SAAS;AACvB,aAAO,IAAI,eAAe,WAAW;AAAA,IACvC;AAGA,eAAW,CAAC,OAAO,OAAO,KAAK,SAAS,QAAQ,GAAG;AACjD,YAAM,OAAO,OAAO,IAAI,QAAQ,MAAM;AACtC,UAAI,QAAQ,MAAM;AAChB,YAAI,QAAQ,UAAU,WAAW;AAC/B,mBAAS,KAAK,IAAI,EAAE,GAAG,SAAS,OAAO,WAAW,WAAW,IAAI;AACjE,kBAAQ,KAAK,EAAE,MAAM,gBAAgB,QAAQ,QAAQ,OAAO,CAAC;AAAA,QAC/D;AACA;AAAA,MACF;AACA,UAAI,eAAe,SAAS,aAAa;AACvC,YAAI,QAAQ,UAAU,cAAc,QAAQ,gBAAgB,MAAM;AAChE,mBAAS,KAAK,IAAI,EAAE,GAAG,SAAS,OAAO,YAAY,aAAa,MAAM,WAAW,IAAI;AACrF,kBAAQ,KAAK,EAAE,MAAM,iBAAiB,QAAQ,QAAQ,QAAQ,QAAQ,wBAAwB,CAAC;AAAA,QACjG;AACA;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,aAAa,QAAQ,gBAAgB,MAAM;AAC/D,iBAAS,KAAK,IAAI,EAAE,GAAG,SAAS,OAAO,WAAW,aAAa,MAAM,WAAW,IAAI;AAAA,MACtF;AAAA,IACF;AAEA,UAAM,kBAAkB,MACtB,SAAS;AAAA,MACP,CAAC,YACC,QAAQ,UAAU,aAClB,QAAQ,gBAAgB;AAAA,IAC5B;AAGF,QACE,iBACA,YACA,aAAa,KAAK,aAAa,gBAAgB,OAC/C;AACA,iBAAW,CAAC,OAAO,OAAO,KAAK,SAAS,QAAQ,GAAG;AACjD,YAAI,QAAQ,UAAU,WAAY;AAClC,iBAAS,KAAK,IAAI,EAAE,GAAG,SAAS,OAAO,cAAc,WAAW,IAAI;AACpE,gBAAQ,KAAK,EAAE,MAAM,mBAAmB,QAAQ,QAAQ,QAAQ,YAAY,cAAc,CAAC;AAC3F,cAAM,QAAQ;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR;AAAA,QACF;AACA,cAAM,SAAS,MAAM,QAAQ,gBAAgB,QAAQ,QAAQ,MAAM;AACnE,iBAAS,KAAK,IAAI,WAAW,cACzB,EAAE,GAAG,SAAS,KAAK,GAAG,OAAO,WAAW,aAAa,QAAQ,WAAW,IAAI,IAC5E,EAAE,GAAG,SAAS,KAAK,GAAG,OAAO,YAAY,GAAI,SAAS,EAAE,aAAa,OAAO,IAAI,CAAC,GAAI,WAAW,IAAI;AAAA,MAC1G;AAAA,IACF;AAGA,UAAM,eAAe,IAAI,IAAI,SAAS,IAAI,CAAC,YAAY,QAAQ,MAAM,CAAC;AACtE,UAAM,UAAU,UAAU,gBAAgB,EAAE,SAC1C,SAAS,OAAO,CAAC,YAAY,QAAQ,UAAU,YAAY,EAAE;AAC/D,QACE,iBACA,YACA,UAAU,KACV,aAAa,KAAK,aAAa,gBAAgB,OAC/C;AACA,YAAM,UAAU,qBAAqB,UAAU,QAAQ,OAAO,OAAO;AACrE,iBAAW,UAAU,SAAS;AAC5B,YAAI,aAAa,IAAI,OAAO,MAAM,EAAG;AACrC,gBAAQ,KAAK,EAAE,MAAM,iBAAiB,QAAQ,OAAO,QAAQ,YAAY,cAAc,CAAC;AACxF,cAAM,QAAQ;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO;AAAA,UACP;AAAA,QACF;AACA,cAAM,SAAS,MAAM,QAAQ,gBAAgB,QAAQ,OAAO,MAAM;AAClE,iBAAS,KAAK;AAAA,UACZ,QAAQ,OAAO;AAAA,UACf,OAAO,WAAW,cAAc,YAAY;AAAA,UAC5C,GAAI,SAAS,EAAE,aAAa,OAAO,IAAI,CAAC;AAAA,UACxC,WAAW;AAAA,QACb,CAAC;AACD,qBAAa,IAAI,OAAO,MAAM;AAAA,MAChC;AAAA,IACF;AAEA,UAAM,UAAU,gBAAgB,EAAE;AAClC,UAAM,SAAS,WAAW,UACtB,YACA,UAAU,KAAK,SAAS,KAAK,CAAC,YAAY,QAAQ,UAAU,YAAY,IACxE,aACA;AAEJ,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,GAAG;AAAA,QACH,QAAQ;AAAA,UACN,GAAG;AAAA,UACH;AAAA,UACA,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA;AAAA,UAErC;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAASC,QAAO;AACd,sBAAkB;AAClB,UAAMA;AAAA,EACR,UAAE;AACA,QAAI,UAAU;AACZ,YAAM,UAAU,QAAQ,gBAAgB,QAAQ,QAAQ;AACxD,UAAI,iBAAiB;AACnB,cAAM,QAAQ,MAAM,MAAM,MAAS;AAAA,MACrC,OAAO;AACL,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AA8BO,SAAS,4BAA4B,MAAiC;AAC3E,QAAM,EAAE,OAAO,iBAAiB,WAAW,WAAW,MAAM,IAAI;AAEhE,SAAO,uBAAuB,OAAO;AAAA,IACnC,MAAM,UAAU,SAAS;AACvB,YAAM,SAAS,QAAQ;AAEvB,YAAM,eAAe,MAAM,gBAAgB,MAAM;AACjD,UAAI,CAAC,aAAc,QAAO,EAAE,OAAO,KAAK;AAExC,YAAM,QAAQ,MAAM,UAAU;AAG9B,YAAM,UAAW,MAAM,MAAM,IAAI;AAAA,QAC/B,MAAM,OAAO;AAAA,QACb,WAAW,OAAO,SAAS;AAAA,QAC3B,MAAM,OAAO,SAAS;AAAA,QACtB,YAAY,OAAO;AAAA,MACrB,CAAC;AACD,YAAM,aAAa,WAAW;AAE9B,YAAM,UAA8B;AAAA,QAClC;AAAA,QACA,iBAAiB,OAAO,cAAc,WAAW,MAAM,UAAU,gBAAgB,cAAc,MAAM;AAAA,QACrG,wBAAwB,OAAO,cAAc,QAAQ,UAAU,MAAM,UAAU,uBAAuB,cAAc,QAAQ,KAAK;AAAA,QACjI,iBAAiB,OAAO,cAAc,gBAAgB,YAAY,UAAU,UAAU;AACpF,gBAAM,UAAU;AAAA,YACd;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,QACA,oBAAoB,OAAO,cAAc,UAAU,SAAS;AAC1D,gBAAM,UAAU,mBAAmB,cAAc,UAAU,IAAI;AAAA,QACjE;AAAA,QACA,iBAAiB,OAAO,cAAc,mBAAmB;AACvD,gBAAM,UAAU,gBAAgB,cAAc,cAAc;AAAA,QAC9D;AAAA,MACF;AAEA,YAAM,SAAS,MAAM,2BAA2B,YAAY,cAAc,OAAO;AACjF,YAAM,aAAa,OAAO,OAAO,UAAU,CAAC;AAC5C,UACE,2BAA2B,UAAU,MACnC,2BAA2B,WAAW,UAAU,CAAC,CAAC,GACpD;AACA,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AAGA,aAAO,EAAE,QAAQ,WAAW;AAAA,IAC9B;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IACA,WAAW;AAAA,IACX,WAAW;AAAA,IACX,YAAY;AAAA,EACd,CAAC;AACH;;;AClXA,IAAM,yBAAyB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,sCACd,OACA,OACA,UAAkD,CAAC,GACzB;AAC1B,QAAM,gBAAgB,QAAQ,iBAAiB;AAE/C,SAAO;AAAA,IACL,MAAM,kBAA2D;AAC/D,aAAO;AAAA,QACL,YAAY,CAAC,SAAS,OAAO,QAAQ,SAAS,QAAQ;AAAA,QACtD;AAAA,QACA,YAAY,CAAC,UAAU;AAAA,MACzB;AAAA,IACF;AAAA,IAEA,MAAM,MACJ,UACA,cACgD;AAChD,YAAM,YAA4C;AAAA,QAChD,YAAY,SAAS;AAAA,QACrB,MAAM,SAAS;AAAA,QACf,MAAM,SAAS,SAAS;AAAA,QACxB,WAAW,SAAS,SAAS;AAAA,MAC/B;AACA,YAAM,WAAW,MAAM,MAAM,IAAoB,SAAS;AAC1D,aAAO,MAAM,MAAM,OAAO,UAAU;AAAA,QAClC,GAAI,WAAW,EAAE,iBAAiB,SAAS,SAAS,gBAAgB,IAAI,CAAC;AAAA,QACzE,gBAAgB,cAAc;AAAA,QAC9B,QAAQ,cAAc;AAAA,MACxB,CAAC;AAAA,IACH;AAAA,IAEA,IACE,WACA,UACuD;AACvD,aAAO,MAAM,IAAoB,SAAS;AAAA,IAC5C;AAAA,IAEA,KACE,OACA,UACoD;AACpD,aAAO,MAAM,KAAqB,KAAK;AAAA,IACzC;AAAA,IAEA,MACE,OACA,cACwD;AACxD,aAAO,MAAM,MAAsB,OAAO,YAAY;AAAA,IACxD;AAAA,IAEA,OACE,WACA,eACoC;AACpC,aAAO,MAAM,OAAO,OAAO,WAAW,aAAa;AAAA,IACrD;AAAA,EACF;AACF;;;AC5EA,SAAS,cAAc,SAAiB,QAAyB;AAC/D,SAAO,QAAQ,SAAS,GAAG,IACvB,OAAO,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC,IACtC,YAAY;AAClB;AAGO,SAAS,uCACd,SAC6C;AAC7C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,QAAQ,QAAQ;AACtB,YAAM,SAAS,MAAM,UAAU,CAAC;AAChC,UAAI,OAAO,SAAS,OAAO,UAAU,UAAW,QAAO,EAAE,OAAO,KAAK;AACrE,YAAM,eAAe,MAAM,QAAQ,uBAAuB,KAAK,KAAK,CAAC;AACrE,UAAI,aAAa,YAAY;AAC3B,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,aAAa;AAAA,cACtB,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,cAAc,MAAM,QAAQ,YAAY,GAAG;AAAA,QAAO,CAAC,WACvD,OAAO,YACN,CAAC,aAAa,gBAAgB,OAAO,WAAW,aAAa,kBAC7D,CAAC,aAAa,eAAe,OAAO,gBAAgB,aAAa,gBAClE,OAAO,UAAU,SAAS,MAAM,KAAK,QAAQ,MAC5C,CAAC,OAAO,SAAS,UAAU,OAAO,QAAQ,SAAS,MAAM,KAAK,MAAM,OACpE,CAAC,OAAO,SAAS,UAAU,OAAO,QAAQ,KAAK,CAAC,YAAY,cAAc,SAAS,MAAM,KAAK,MAAM,CAAC,OACrG,OAAO,cAAc,WAAc,OAAO,gBAAgB,KAAK,OAAO;AAAA,MACzE,EAAE;AAAA,QAAK,CAAC,MAAM,WACX,KAAK,gBAAgB,MAAM,MAAM,gBAAgB,MAClD,KAAK,OAAO,cAAc,MAAM,MAAM,KACtC,KAAK,YAAY,cAAc,MAAM,WAAW;AAAA,MAClD;AACA,YAAM,WAAW,WAAW,CAAC;AAC7B,YAAM,eAAe,IAAI,EAAE,YAAY;AACvC,UAAI,CAAC,UAAU;AACb,cAAM,EAAE,cAAc,OAAO,gBAAgB,SAAS,SAAS,UAAU,GAAG,QAAQ,IAAI;AACxF,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,YAAY,CAAC;AAAA,cACX,MAAM;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,SAAS,2CAA2C,MAAM,KAAK,QAAQ,QAAQ,MAAM,KAAK,MAAM;AAAA,cAChG,oBAAoB;AAAA,YACtB,CAAC;AAAA,UACH;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UACE,OAAO,iBAAiB,SAAS,UACjC,OAAO,mBAAmB,SAAS,eACnC,OAAO,SAAS,eAAe,QAAQ,WACvC,QAAO,EAAE,OAAO,KAAK;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,cAAc,SAAS;AAAA,UACvB,gBAAgB,SAAS;AAAA,UACzB,SAAS,EAAE,YAAY,QAAQ,YAAY,SAAS,aAAa;AAAA,UACjE,YAAY,CAAC;AAAA,YACX,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,SAAS,aAAa,SAAS,WAAW,SAAS,SAAS,MAAM;AAAA,YAClE,oBAAoB;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AA+BO,SAAS,yCACd,SAC6C;AAC7C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,QAAQ,QAAQ;AACtB,YAAM,SAAS,MAAM,UAAU,CAAC;AAChC,UAAI,OAAO,iBAAiB,QAAQ,UAAU,CAAC,OAAO,kBAAkB,CAAC,OAAO,SAAS;AACvF,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,UACE,OAAO,UAAU,YACjB,OAAO,UAAU,aACjB,OAAO,UAAU,aACjB,OAAO,UAAU,aACjB,OAAO,UAAU,SACjB,QAAO,EAAE,OAAO,KAAK;AACvB,YAAM,gBAAgB,QAAQ,UAC1B,MAAM,QAAQ,QAAQ;AAAA,QACtB,OAAO;AAAA,QACP,QAAQ;AAAA,MACV,IACE;AACJ,YAAM,SAAS,gBACX,SACA,MAAM,QAAQ,UAAU,OAAO,gBAAgB,QAAQ,MAAM;AACjE,UAAI,CAAC,iBAAiB,CAAC,QAAQ;AAC7B,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,4BAA4B,OAAO,cAAc;AAAA,cAC1D,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,OAAO,UAAU,WAAW;AAC9B,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,eAAe;AAAA,cACb,YAAY,QAAQ;AAAA,cACpB,WAAW,IAAI,EAAE,YAAY;AAAA,YAC/B;AAAA,UACF;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UAAI,OAAO,eAAe,eAAe,QAAQ,YAAY;AAC3D,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,eAAe,iBAAiB,QAAQ,UAC1C,MAAM,cAAc;AAAA,QACpB,MAAM,QAAQ,QAAQ,mBAAmB;AAAA,UACvC;AAAA,UACA,OAAO,QAAQ;AAAA,UACf,YAAY,QAAQ;AAAA,QACtB,CAAC;AAAA,MACH,IACE;AACJ,YAAM,SAAS,eACX,SACA,MAAO,OAAkC,MAAM;AAAA,QAC/C,GAAG,MAAM;AAAA,QACT,SAAS,MAAM,SAAS;AAAA,MAC1B,CAAC;AACH,YAAM,kBAAkB,cAAc,eACpC,gBAAgB,QAAQ,MAAM,IAAI,MAAM,SAAS,GAAG;AACtD,UAAI,OAAQ,OAAM,QAAQ,MAAM,IAAI,iBAAiB,MAAM;AAC3D,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,WAAW;AAAA,UACX,UAAU,cAAc,YAAY,QAAQ,OAAO;AAAA,UACnD,WAAW,cAAc,aAAa,QAAQ,OAAO;AAAA,UACrD,UAAU;AAAA,UACV,kBAAkB;AAAA,UAClB,gBAAgB;AAAA,QAClB;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,sBACpB,OACA,QACA,OACe;AACf,QAAM,kBAAkB,MAAM,QAAQ;AACtC,MAAI,CAAC,gBAAiB;AACtB,QAAM,SAAS,MAAM,MAAM,IAAI,eAAe;AAC9C,SAAO,OAAO,QAAQ,OAAO,WAAW,MAAM,SAAS,GAAG;AAC1D,QAAM,MAAM,OAAO,eAAe;AACpC;AA0BO,SAAS,yCACd,SAC6C;AAC7C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,QAAQ,QAAQ;AACtB,YAAM,SAAS,MAAM,UAAU,CAAC;AAChC,UACE,OAAO,iBAAiB,QAAQ,UAChC,CAAC,OAAO,kBACP,OAAO,UAAU,YAAY,OAAO,UAAU,UAC/C,QAAO,EAAE,OAAO,KAAK;AACvB,YAAM,gBAAgB,QAAQ,UAC1B,MAAM,QAAQ,QAAQ;AAAA,QACtB,OAAO;AAAA,QACP,QAAQ;AAAA,MACV,IACE;AACJ,YAAM,SAAS,gBACX,SACA,MAAM,QAAQ,UAAU,OAAO,gBAAgB,QAAQ,MAAM;AACjE,UAAI,CAAC,iBAAiB,CAAC,OAAQ,QAAO,EAAE,gBAAgB,IAAK;AAC7D,YAAM,YAAY,IAAI;AACtB,YAAM,UAAU,CAAC,OAAO,SAAS,KAAK,MAAM,OAAO,aAAa,EAAE,CAAC,KACjE,UAAU,QAAQ,KAAK,KAAK,MAAM,OAAO,aAAa,EAAE;AAC1D,YAAM,cAAc,MAAM,QAAQ,cAAc,KAAK;AACrD,UAAI,CAAC,WAAW,CAAC,aAAa;AAC5B,eAAO;AAAA,UACL,gBAAgB,KAAK;AAAA,YACnB;AAAA,YACA,KAAK,IAAI,KAAM,KAAK,MAAM,OAAO,aAAa,EAAE,IAAI,UAAU,QAAQ,CAAC;AAAA,UACzE;AAAA,QACF;AAAA,MACF;AACA,UAAI,iBAAiB,QAAQ,WAAW,OAAO,WAAW;AACxD,cAAM,cAAc;AAAA,UAClB,MAAM,QAAQ,QAAQ,oBAAoB;AAAA,YACxC;AAAA,YACA,aAAa,OAAO;AAAA,YACpB,OAAO,QAAQ;AAAA,YACf,YAAY,QAAQ;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,MACF,WAAW,QAAQ;AACjB,cAAM,sBAAsB,OAAO,QAAQ,QAAQ,KAAK;AAAA,MAC1D;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO,UAAU,YAAY;AAAA,UAC7B,WAAW,UAAU,YAAY;AAAA,QACnC;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AC7UA,IAAM,SAAS;AACf,IAAM,sBAAsB;AAC5B,IAAM,eAA2C;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAsBA,SAAS,QAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,cACP,OACA,OACA,UAAU,KACF;AACR,MAAI,OAAO,UAAU,YAAY,CAAC,SAAS,MAAM,SAAS,SAAS;AACjE,YAAQ,iBAAiB,KAAK,aAAa;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,YACP,OACA,SACA,UACM;AACN,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,YAAQ,iBAAiB,QAAQ,oBAAoB;AAAA,EACvD;AACA,QAAM,UAAU,OAAO,KAAK,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,SAAS,KAAK,CAAC;AAC7E,MAAI,QAAQ,SAAS,GAAG;AACtB;AAAA,MACE,iBAAiB,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC9E;AAAA,EACF;AACF;AAEA,eAAe,OAAO,OAAiC;AACrD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,qBAAqB,KAAK,CAAC;AAClE,QAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,KAAK;AACrE,SAAO,UACL,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,EACvB,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE,CACZ;AACF;AAEA,SAAS,WAAW,mBAAmC;AACrD,SAAO,SAAS,kBAAkB,MAAM,UAAU,QAAQ,EAAE,CAAC;AAC/D;AAEA,SAAS,aAAa,UAAqD;AACzE,QAAM,OAAO,SAAS;AACtB,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf,cAAc,gBAAgB,SAAS,SAAS,IAAI;AAAA,IACpD,aAAa,KAAK;AAAA,IAClB,MAAM,KAAK;AAAA,IACX,YAAY,KAAK;AAAA,IACjB,OAAO,gBAAgB,KAAK,KAAK;AAAA,IACjC,cAAc,KAAK;AAAA,IACnB,kBAAkB,KAAK;AAAA,IACvB,QAAQ,KAAK;AAAA,IACb,YAAY,gBAAgB,KAAK,UAAU;AAAA,IAC3C,YAAY,gBAAgB,KAAK,UAAU;AAAA,IAC3C,MAAM,gBAAgB,KAAK,IAAI;AAAA,IAC/B,GAAI,KAAK,iBAAiB,EAAE,gBAAgB,KAAK,eAAe,IAAI,CAAC;AAAA,IACrE,cAAc,KAAK;AAAA,EACrB;AACF;AAOO,SAAS,wCACd,SACgC;AAChC,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,wBAAwB,QAAQ,yBAAyB;AAC/D,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,SAAS,cAAc,QAAQ,MAAM,eAAe,GAAG;AAC7D,QAAM,cAAc,IAAI,WAAW,EAAE;AACrC,aAAW,OAAO,gBAAgB,WAAW;AAC7C,QAAM,SAAS,GAAG,MAAM,IACtB,CAAC,GAAG,WAAW,EACZ,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE,CACZ;AACA,QAAM,YAAY,SAAS,MAAM,GAC9B,YAAY,EACZ,QAAQ,iBAAiB,GAAG,EAC5B,QAAQ,YAAY,EAAE,EACtB,MAAM,GAAG,GAAG;AACf,MACE,CAAC,QAAQ,kBAAkB,UAC3B,CAAC,OAAO,cAAc,qBAAqB,KAC3C,wBAAwB,KACxB,CAAC,OAAO,cAAc,aAAa,KACnC,gBAAgB,EAChB,SAAQ,2CAA2C;AAErD,iBAAe,aAA6C;AAC1D,UAAM,SAAS,MAAM,QAAQ,MAAM,KAAsB;AAAA,MACvD,YAAY;AAAA,MACZ,MAAM;AAAA,IACR,CAAC;AACD,WAAQ,OAAO,MACZ,OAAO,CAAC,SAAS,KAAK,KAAK,WAAW,MAAM,EAC5C,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,WAAW,MAAM,KAAK,QAAQ;AAAA,EACnE;AAEA,iBAAe,QACb,OACA,UAC4B;AAC5B,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,OAAO,IAAI,EAAE,QAAQ,IAAI,KAAK,MAAM,QAAQ,GAAG,WAAW,GAAG;AAC3F,UAAI;AACF,eAAO,MAAM,QAAQ,MAAM,aAAa,OAAO;AAAA,UAC7C,MAAM;AAAA,UACN;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AAAA,MACH,SAASC,QAAO;AACd,oBAAYA;AACZ,YACE,EAAEA,kBAAiB,uBACnBA,OAAM,SAAS,WACf,OAAMA;AACR,cAAM,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,MAC9D;AAAA,IACF;AACA,UAAM,qBAAqB,qBACvB,YACA,IAAI,mBAAmB;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACL;AAEA,iBAAe,WACb,SACA,QACAC,SACe;AACf,gBAAY,QAAQ,SAASA,SAAQ,GAAG,MAAM,UAAU;AACxD,gCAA4B,SAAS;AAAA,MACnC;AAAA,MACA,gBAAgB;AAAA,MAChB,mBAAmB;AAAA,MACnB,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAC5C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,WAAS,OAAO,SAKd;AACA,QAAI,CAAC,OAAO,KAAK,cAAc,QAAQ,cAAc,gBAAgB,EAAE,CAAC,GAAG;AACzE,cAAQ,8CAA8C;AAAA,IACxD;AACA,QACE,CAAC;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,SAAS,QAAQ,MAAM,EACzB,SAAQ,iCAAiC;AAC3C,UAAM,aAAa,QAAQ;AAC3B,QACE,CAAC,cACD,CAAC;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,SAAS,WAAW,MAAM,EAC5B,SAAQ,qCAAqC;AAC/C,kBAAc,WAAW,UAAU,qBAAqB;AACxD,QAAI,WAAW,YAAY,QAAW;AACpC,oBAAc,WAAW,SAAS,oBAAoB;AAAA,IACxD;AACA,UAAM,aAAa,QAAQ,cAAc,CAAC;AAC1C,QAAI,OAAO,KAAK,UAAU,EAAE,SAAS,eAAe;AAClD,cAAQ,wCAAwC;AAAA,IAClD;AACA,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,UACE,CAAC,OACD,IAAI,SAAS,MACb,oBAAoB,KAAK,GAAG,KAC5B,OAAO,UAAU,YACjB,MAAM,SAAS,OACf,gBAAgB,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,EAChC,SAAQ,4BAA4B,GAAG,2BAA2B;AAAA,IACtE;AACA,WAAO;AAAA,MACL,cAAc,QAAQ;AAAA,MACtB,QAAQ,QAAQ;AAAA,MAChB,YAAY,gBAAgB,UAAU;AAAA,MACtC,YAAY,gBAAgB,UAAU;AAAA,IACxC;AAAA,EACF;AAEA,iBAAe,OACb,SAC6B;AAC7B,QAAI;AACJ,QAAI,WAAW;AACf,eAAW,YAAY,SAAS;AAC9B,YAAM,OAAO,SAAS;AACtB,kBAAY;AACZ,UACE,KAAK,aAAa,YAClB,KAAK,mBAAmB,gBACxB;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,6CAA6C,KAAK,QAAQ;AAAA,UACnE,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,EAAE,cAAc,GAAG,SAAS,IAAI;AACtC,UAAI,iBAAiB,MAAM,OAAO,QAAQ,GAAG;AAC3C,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,wBAAwB,KAAK,QAAQ;AAAA,UAC9C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,uBAAiB,KAAK;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,OACb,SACA,YACA,MAC+B;AAC/B,UAAM,WAAW,OAAO,QAAQ,OAAO;AACvC,UAAM,qBAAqB,MAAM,OAAO,QAAQ,OAAO;AACvD,UAAM,oBAAoB,MAAM,OAAO;AAAA,MACrC;AAAA,MACA,aAAa,QAAQ,SAAS;AAAA,MAC9B,QAAQ,QAAQ;AAAA,MAChB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,UAAM,OAAO,WAAW,iBAAiB;AACzC,UAAM,QAAQ,MAAM,QAAQ,QAAQ,OAAO,QAAQ,QAAQ;AAC3D,QAAI;AACF,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,YAAY,MAAM,OAAO,OAAO;AACtC,YAAM,WAAW,QAAQ;AAAA,QACvB,CAAC,SAAS,KAAK,KAAK,sBAAsB;AAAA,MAC5C;AACA,UAAI,UAAU;AACZ,YAAI,SAAS,KAAK,uBAAuB,oBAAoB;AAC3D,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,aAAa,QAAQ;AAAA,MAC9B;AACA,YAAM,eAAe,QAClB,OAAO,CAAC,SAAS,KAAK,KAAK,gBAAgB,QAAQ,SAAS,GAAG,EAC/D;AAAA,QACC,CAAC,SAAS,SAAS,KAAK,IAAI,SAAS,KAAK,KAAK,YAAY;AAAA,QAC3D;AAAA,MACF;AACF,UAAK,QAAQ,eAA0B,cAAc;AACnD,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,qCAAqC,QAAQ,YAAY,sBAAsB,YAAY;AAAA,UACpG,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,gBAAgB,QAAQ;AAAA,QAC5B,CAAC,SAAS,KAAK,KAAK,gBAAgB,QAAQ,SAAS;AAAA,MACvD,EAAE;AACF,UAAI,iBAAiB,uBAAuB;AAC1C,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,0BAA0B,qBAAqB;AAAA,UACxD,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,WAAW;AAAA,QACf,UAAU,QAAQ,SAAS;AAAA,QAC3B,aAAa,QAAQ,SAAS;AAAA,QAC9B;AAAA,QACA,YAAY,IAAI,EAAE,YAAY;AAAA,QAC9B,OAAO;AAAA,UACL,IAAI,QAAQ,MAAM;AAAA,UAClB,MAAM,QAAQ,MAAM;AAAA,QACtB;AAAA,QACA,GAAG;AAAA,QACH,kBAAkB,MAAM,OAAO,QAAQ,mBAAmB;AAAA,QAC1D;AAAA,QACA,GAAI,YAAY,EAAE,gBAAgB,UAAU,IAAI,CAAC;AAAA,MACnD;AACA,YAAM,eAAe;AAAA,QACnB;AAAA,QACA,GAAG;AAAA,QACH;AAAA,QACA;AAAA,QACA,cAAc,QAAQ;AAAA,MACxB;AACA,YAAM,OAAwB;AAAA,QAC5B,GAAG;AAAA,QACH,cAAc,MAAM,OAAO,YAAY;AAAA,MACzC;AACA,YAAM,UAAU,MAAM,QAAQ,MAAM;AAAA,QAClC,QAAQ;AAAA,QACR,0BAA0B,MAAM,IAAI;AAAA,QACpC,EAAE,gBAAgB,gBAAgB,iBAAiB,GAAG;AAAA,MACxD;AACA,aAAO,aAAa,OAAO;AAAA,IAC7B,UAAE;AACA,YAAM,QAAQ,MAAM,aAAa,QAAQ,OAAO,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,IAC9E;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,qBAAqB;AAAA,QACrB,eAAe;AAAA,QACf;AAAA,QACA;AAAA,QACA,aAAa,QAAQ;AAAA,QACrB,mBAAmB,CAAC,GAAG,QAAQ,iBAAiB;AAAA,MAClD;AAAA,IACF;AAAA,IACA,MAAM,YAAY,SAAS;AACzB,YAAM,WAAW,SAAS,gBAAgB;AAAA,QACxC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,SAAS,cAAc,QAAQ,QAAQ,QAAQ,QAAQ;AAC7D,UAAI,CAAC,CAAC,WAAW,UAAU,SAAS,EAAE,SAAS,QAAQ,QAAQ,OAAO,GAAG;AACvE,gBAAQ,kCAAkC;AAAA,MAC5C;AACA,UAAI,QAAQ,QAAQ,eAAe,QAAW;AAC5C,sBAAc,QAAQ,QAAQ,YAAY,YAAY;AAAA,MACxD;AACA,aAAO,OAAO,SAAS,SAAS;AAAA,QAC9B,MAAM;AAAA,QACN;AAAA,QACA,SAAS,QAAQ,QAAQ;AAAA,QACzB,GAAI,QAAQ,QAAQ,aAChB,EAAE,YAAY,QAAQ,QAAQ,WAAW,IACzC,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AAAA,IACA,MAAM,UAAU,SAAS;AACvB,YAAM,WAAW,SAAS,wBAAwB;AAAA,QAChD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,OAAO,cAAc,QAAQ,QAAQ,MAAM,YAAY;AAC7D,UACE,CAAC,CAAC,SAAS,QAAQ,WAAW,SAAS,UAAU,EAAE;AAAA,QACjD,QAAQ,QAAQ;AAAA,MAClB,EACA,SAAQ,yCAAyC;AACnD,aAAO,OAAO,SAAS,SAAS;AAAA,QAC9B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,QAAQ,QAAQ;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,IACA,MAAM,WAAW,SAAS;AACxB,YAAM,WAAW,SAAS,yBAAyB;AAAA,QACjD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,OAAO,cAAc,QAAQ,QAAQ,MAAM,aAAa;AAC9D,YAAM,OAAO,cAAc,QAAQ,QAAQ,MAAM,eAAe,EAAE;AAClE,UAAI,CAAC,OAAO,SAAS,QAAQ,QAAQ,KAAK,GAAG;AAC3C,gBAAQ,2CAA2C;AAAA,MACrD;AACA,aAAO,OAAO,SAAS,UAAU;AAAA,QAC/B,MAAM;AAAA,QACN;AAAA,QACA,OAAO,QAAQ,QAAQ;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,MAAM,UAAU,SAAS;AACvB,YAAM,WAAW,SAAS,wBAAwB;AAAA,QAChD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,OAAO,cAAc,QAAQ,QAAQ,MAAM,YAAY;AAC7D,YAAM,UAAU;AAAA,QACd,QAAQ,QAAQ;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AACA,YAAM,SAAS,cAAc,QAAQ,QAAQ,QAAQ,UAAU,GAAG;AAClE,UACE,CAAC,OAAO,SAAS,QAAQ,QAAQ,UAAU,KAC3C,QAAQ,QAAQ,aAAa,EAC7B,SAAQ,mDAAmD;AAC7D,UAAI,CAAC,CAAC,MAAM,OAAO,EAAE,SAAS,QAAQ,QAAQ,MAAM,GAAG;AACrD,gBAAQ,uCAAuC;AAAA,MACjD;AACA,aAAO,OAAO,SAAS,SAAS;AAAA,QAC9B,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,QAAQ,QAAQ;AAAA,QAC5B,QAAQ,QAAQ,QAAQ;AAAA,MAC1B,CAAC;AAAA,IACH;AAAA,IACA,MAAM,YAAY,SAAS;AACzB,YAAM,WAAW,SAAS,cAAc;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,gBAAgB,QAAQ,QAAQ,iBAAiB;AACvD,UAAI,CAAC,OAAO,cAAc,aAAa,KAAK,gBAAgB,GAAG;AAC7D,gBAAQ,wCAAwC;AAAA,MAClD;AACA,UACE,CAAC,OAAO,cAAc,QAAQ,QAAQ,KAAK,KAC3C,QAAQ,QAAQ,QAAQ,KACxB,QAAQ,QAAQ,QAAQ,IACxB,SAAQ,oDAAoD;AAC9D,YAAM,QAAQ,QAAQ,QAAQ;AAC9B,UACE,UAAU,WAER,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,SAAS,IAAI,CAAC,GAEnD,SAAQ,6CAA6C;AACvD,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,YAAY,MAAM,OAAO,OAAO;AACtC,YAAM,eAAe,QAClB,OAAO,CAAC,SAAS,KAAK,KAAK,gBAAgB,QAAQ,SAAS,GAAG,EAC/D;AAAA,QACC,CAAC,SAAS,SAAS,KAAK,IAAI,SAAS,KAAK,KAAK,YAAY;AAAA,QAC3D;AAAA,MACF;AACF,UAAK,QAAQ,eAA0B,cAAc;AACnD,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,qCAAqC,QAAQ,YAAY,sBAAsB,YAAY;AAAA,UACpG,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,SAAS,QACN;AAAA,UAAO,CAAC,SACP,KAAK,KAAK,gBAAgB,QAAQ,SAAS,OAC3C,KAAK,KAAK,WAAW,kBACpB,CAAC,SAAS,MAAM,SAAS,KAAK,KAAK,UAAU;AAAA,QAChD,EACC,MAAM,GAAG,QAAQ,QAAQ,KAAK,EAC9B,IAAI,YAAY;AAAA,QACnB,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACF;;;AC1hBA,IAAMC,UAAS;AAqCf,SAASC,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAAS,YAAY,SAAwB;AAC3C,QAAM,IAAI,mBAAmB;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAASC,aACP,SACA,SACA,UACM;AACN,MAAI,YAAY,QAAQ,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AAC7E,IAAAD,SAAQ,kBAAkB,QAAQ,oBAAoB;AAAA,EACxD;AACA,QAAM,UAAU,OAAO,KAAK,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,SAAS,KAAK,CAAC;AAC/E,MAAI,QAAQ,SAAS,GAAG;AACtB,IAAAA,SAAQ,kBAAkB,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,EACzF;AACF;AAEA,SAASE,eACP,OACA,OACA,UAAU,MACF;AACR,MAAI,OAAO,UAAU,YAAY,CAAC,SAAS,MAAM,SAAS,SAAS;AACjE,IAAAF,SAAQ,kBAAkB,KAAK,aAAa;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAiC;AACxD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,qBAAqB,KAAK,CAAC;AAClE,SAAO,WAAW,OAAO,OAAO,OAAO,WAAW,KAAK,EAAE;AAAA,IAAK,CAAC,WAC7D,UACE,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,EACvB,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE,CACZ;AAAA,EACF;AACF;AAEA,SAAS,aAAa,OAAgB,OAAuB;AAC3D,QAAMG,UAASD,eAAc,OAAO,OAAO,EAAE;AAC7C,MAAI,CAACH,QAAO,KAAKI,OAAM,EAAG,CAAAH,SAAQ,kBAAkB,KAAK,oBAAoB;AAC7E,SAAOG;AACT;AAEA,SAAS,aAAa,mBAAmC;AACvD,SAAO,YAAY,kBAAkB,MAAM,UAAU,QAAQ,EAAE,CAAC;AAClE;AAEA,SAAS,WAAW,QAAwB;AAC1C,QAAM,SAAS;AACf,MAAI,CAAC,OAAO,WAAW,MAAM,EAAG,CAAAH,SAAQ,2CAA2C;AACnF,SAAOE,eAAc,OAAO,MAAM,OAAO,MAAM,GAAG,mBAAmB,GAAG;AAC1E;AAEA,SAAS,mBACP,OAC2B;AAC3B,MACE,CAAC,SACD,CAAC,CAAC,SAAS,QAAQ,SAAS,EAAE,SAAS,MAAM,OAAO,KACpD,CAAC,MAAM,QAAQ,MAAM,OAAO,KAC5B,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,SAAS,MACvB,MAAM,QAAQ,KAAK,CAAC,WAAW,OAAO,WAAW,YAAY,CAAC,UAAU,OAAO,SAAS,IAAI,KAC3F,MAAM,gBAAgB,WAEnB,CAAC,MAAM,QAAQ,MAAM,WAAW,KAChC,MAAM,YAAY,SAAS,MAC3B,MAAM,YAAY;AAAA,IAAK,CAAC,eACtB,OAAO,eAAe,YACtB,CAAC,cACD,WAAW,SAAS;AAAA,EACtB,GAEJ,CAAAF,SAAQ,oDAAoD;AAC9D,SAAO;AACT;AAOO,SAAS,wCACd,SACgC;AAChC,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,mBAAmB,QAAQ,oBAAoB,KAAK;AAC1D,MACE,CAAC,QAAQ,QACT,CAAC,QAAQ,kBAAkB,UAC3B,CAAC,OAAO,cAAc,gBAAgB,KACtC,mBAAmB,EACnB,CAAAA,SAAQ,4CAA4C;AAEtD,MAAI,YAAY,QAAQ,QAAQ;AAEhC,iBAAe,WAAc,WAAyC;AACpE,UAAM,WAAW;AACjB,QAAI;AACJ,gBAAY,IAAI,QAAc,CAAC,YAAY;AACzC,gBAAU;AAAA,IACZ,CAAC;AACD,UAAM;AACN,QAAI;AACF,aAAO,MAAM,UAAU;AAAA,IACzB,UAAE;AACA,cAAQ;AAAA,IACV;AAAA,EACF;AAEA,iBAAe,UACb,SACA,QACAI,SACA,YACe;AACf,IAAAH,aAAY,QAAQ,SAASG,SAAQ,GAAG,MAAM,UAAU;AACxD,gCAA4B,SAAS;AAAA,MACnC;AAAA,MACA,gBAAgB;AAAA,MAChB,mBAAmB;AAAA,MACnB,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,WAAW,SAAS,QAAQ,MAAM,IAAI,GAAG;AAC5C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,8BAA8B,QAAQ,MAAM,IAAI,iBAAiB,MAAM;AAAA,QAChF,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,CAAC,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAC5C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,UAAM,iBAAiB,OAAO;AAAA,EAChC;AAEA,iBAAe,kBACb,QACA,YACiC;AACjC,UAAM,WAAW,MAAM,QAAQ,MAAM,IAA8C;AAAA,MACjF,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,WAAW,MAAM;AAAA,IACzB,CAAC;AACD,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,SAAS,KAAK,WAAW,QAAQ,YAAY;AAC/C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,WAAS,WAAW,UAAkD;AACpE,QAAI,SAA+B,SAAS,UAAU;AAAA,MACpD,SAAS,SAAS,KAAK;AAAA,MACvB,WAAW,SAAS,KAAK;AAAA,MACzB,WAAW,SAAS,KAAK;AAAA,MACzB,SAAS,SAAS,KAAK;AAAA,IACzB;AACA,QACE,OAAO,YAAY,aACnB,SAAS,KAAK,YACd,KAAK,MAAM,SAAS,KAAK,SAAS,SAAS,KAAK,IAAI,EAAE,QAAQ,GAC9D;AACA,eAAS;AAAA,QACP,SAAS;AAAA,QACT,WAAW,SAAS,KAAK;AAAA,QACzB,WAAW,SAAS,KAAK,SAAS;AAAA,QAClC,SAAS,CAAC,sDAAsD;AAAA,MAClE;AAAA,IACF;AACA,WAAO;AAAA,MACL,gBAAgB,mBAAmB,SAAS,SAAS,IAAI;AAAA,MACzD,aAAa,SAAS,KAAK,WAAW;AAAA,MACtC,MAAM,SAAS,KAAK;AAAA,MACpB,SAAS,OAAO;AAAA,MAChB,cAAc,SAAS,KAAK;AAAA,MAC5B,aAAa,SAAS,KAAK;AAAA,MAC3B,SAAS,OAAO;AAAA,MAChB,SAAS,OAAO;AAAA,MAChB,aAAa,SAAS,KAAK;AAAA,MAC3B,WAAW,OAAO;AAAA,MAClB,GAAI,SAAS,KAAK,WACd;AAAA,QACA,UAAU;AAAA,UACR,GAAG,SAAS,KAAK;AAAA,UACjB,GAAI,OAAO,YAAY,YACnB;AAAA,YACA,WAAW,OAAO;AAAA,YAClB,YAAY,OAAO;AAAA,YACnB,GAAI,OAAO,wBACP,EAAE,uBAAuB,OAAO,sBAAsB,IACtD,CAAC;AAAA,UACP,IACE,CAAC;AAAA,QACP;AAAA,MACF,IACE,CAAC;AAAA,IACP;AAAA,EACF;AAEA,iBAAe,iBACb,SACe;AACf,UAAMC,aAAY,MAAM,QAAQ,MAAM,KAA+C;AAAA,MACnF,YAAY;AAAA,MACZ,MAAM;AAAA,IACR,CAAC;AACD,UAAM,UAAWA,WAAU,MACxB,OAAO,CAAC,SAAS,KAAK,KAAK,WAAW,QAAQ,QAAQ,SAAS,GAAG,EAClE;AAAA,MACC,CAAC,OAAO,SAAS,KAAK,IAAI,OAAO,KAAK,KAAK,YAAY;AAAA,MACvD;AAAA,IACF;AACF,QAAK,QAAQ,eAA0B,SAAS;AAC9C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,2DAA2D,OAAO;AAAA,QAC3E,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,iBAAe,QACb,SACA,MACA,cACA,YACA,UACyB;AACzB,iBAAa,cAAc,cAAc;AACzC,UAAM,aAAa,mBAAmB,UAAU;AAChD,WAAO,WAAW,YAAY;AAC5B,YAAM,iBAAiB,OAAO;AAC9B,YAAM,cAAc,MAAM,gBAAgB,QAAQ,OAAO;AACzD,YAAM,qBAAqB,MAAM,gBAAgB;AAAA,QAC/C,QAAQ,QAAQ;AAAA,QAChB,UAAU,QAAQ;AAAA,QAClB,cAAc,QAAQ;AAAA,QACtB,OAAO,QAAQ;AAAA,QACf,SAAS,QAAQ;AAAA,QACjB,qBAAqB,QAAQ;AAAA,QAC7B,qBAAqB,QAAQ;AAAA,QAC7B,SAAS,QAAQ;AAAA,MACnB,CAAC;AACD,YAAM,iBAAiB,MAAM,gBAAgB;AAAA,QAC3C,aAAa,QAAQ,SAAS;AAAA,QAC9B,QAAQ,QAAQ;AAAA,QAChB,gBAAgB,QAAQ;AAAA,MAC1B,CAAC;AACD,YAAM,OAAO,aAAa,cAAc;AACxC,YAAM,WAAW,MAAM,QAAQ,MAAM,IAA8C;AAAA,QACjF,YAAY;AAAA,QACZ,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AACD,UAAI,UAAU;AACZ,YACE,SAAS,KAAK,uBAAuB,sBACrC,SAAS,KAAK,iBAAiB,MAC/B;AACA,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,WAAW,QAAQ;AAAA,MAC5B;AACA,YAAM,YAAY,IAAI,EAAE,YAAY;AACpC,YAAM,WAAW,6BAA6B,MAAM;AAAA,QAClD,YAAY;AAAA,UACV,YAAY,QAAQ,SAAS;AAAA,UAC7B,MAAM,QAAQ,SAAS;AAAA,UACvB,MAAM,QAAQ,SAAS;AAAA,UACvB,KAAK,QAAQ,SAAS;AAAA,UACtB,YAAY,QAAQ,SAAS;AAAA,QAC/B;AAAA,QACA,cAAc;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,QACA,gBAAgB,QAAQ;AAAA,QACxB,cAAc,QAAQ;AAAA,QACtB,aAAa,QAAQ,MAAM;AAAA,QAC3B,SAAS,WAAW;AAAA,QACpB,aAAa,WAAW,eAAe,CAAC;AAAA,QACxC;AAAA,QACA,gBAAgB,WAAW;AAAA,QAC3B,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC,CAAC;AACD,UAAI;AACJ,UAAI;AACF,kBAAU,MAAM,QAAQ,MAAM;AAAA,UAC5B,QAAQ;AAAA,UACR;AAAA,UACA,EAAE,gBAAgB,kBAAkB,cAAc,GAAG;AAAA,QACvD;AAAA,MACF,SAASC,QAAO;AACd,cAAM,QAAQ,MAAM,QAAQ,MAAM,IAA8C;AAAA,UAC9E,YAAY;AAAA,UACZ,MAAM;AAAA,UACN;AAAA,QACF,CAAC;AACD,YAAI,CAAC,SAAS,MAAM,KAAK,uBAAuB,mBAAoB,OAAMA;AAC1E,eAAO,WAAW,KAAK;AAAA,MACzB;AACA,aAAO,WAAW,OAAO;AAAA,IAC3B,CAAC;AAAA,EACH;AAEA,QAAM,YAAkC,CAAC,UAAU;AACnD,MAAI,QAAQ,0BAA2B,WAAU,KAAK,oBAAoB;AAC1E,MAAI,QAAQ,kBAAmB,WAAU,KAAK,WAAW;AACzD,MAAI,QAAQ,sBAAuB,WAAU,KAAK,gBAAgB;AAClE,MAAI,QAAQ,mBAAoB,WAAU,KAAK,YAAY;AAE3D,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,aAAO;AAAA,QACL,MAAM,QAAQ;AAAA,QACd,WAAW,CAAC,GAAG,SAAS;AAAA,QACxB,gBAAgB;AAAA,QAChB,yBAAyB;AAAA,QACzB,qBAAqB;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,mBAAmB,CAAC,GAAG,QAAQ,iBAAiB;AAAA,MAClD;AAAA,IACF;AAAA,IACA,MAAM,cAAc,SAAS;AAC3B,YAAM,UAAU,SAAS,yBAAyB;AAAA,QAChD;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,CAAC,cAAc,OAAO,CAAC;AAC1B,UAAI,CAAC,QAAQ,2BAA2B;AACtC,oBAAY,8CAA8C;AAAA,MAC5D;AACA,YAAM,eAAe,aAAa,QAAQ,QAAQ,cAAc,cAAc;AAC9E,MAAAJ,eAAc,QAAQ,QAAQ,oBAAoB,oBAAoB;AACtE,MAAAA,eAAc,QAAQ,QAAQ,cAAc,cAAc;AAC1D,YAAM,aAAa,MAAM,QAAQ,0BAA0B,OAAO;AAClE,aAAO,QAAQ,SAAS,sBAAsB,cAAc,UAAU;AAAA,IACxE;AAAA,IACA,MAAM,mBAAmB,SAAS;AAChC,YAAM,UAAU,SAAS,8BAA8B;AAAA,QACrD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,CAAC,cAAc,OAAO,CAAC;AAC1B,UAAI,CAAC,QAAQ,mBAAmB;AAC9B,oBAAY,mDAAmD;AAAA,MACjE;AACA,YAAM,eAAe,aAAa,QAAQ,QAAQ,cAAc,cAAc;AAC9E,MAAAA,eAAc,QAAQ,QAAQ,QAAQ,QAAQ;AAC9C,UACE,CAAC,CAAC,WAAW,cAAc,YAAY,EAAE;AAAA,QACvC,QAAQ,QAAQ;AAAA,MAClB,KACA,CAAC,CAAC,WAAW,cAAc,YAAY,EAAE;AAAA,QACvC,QAAQ,QAAQ;AAAA,MAClB,KACA,OAAO,QAAQ,QAAQ,aAAa,aACpC,OAAO,QAAQ,QAAQ,4BAA4B,UACnD,CAAAF,SAAQ,sCAAsC;AAChD,YAAM,aAAa,MAAM,QAAQ,kBAAkB,OAAO;AAC1D,aAAO,QAAQ,SAAS,aAAa,cAAc,UAAU;AAAA,IAC/D;AAAA,IACA,MAAM,uBAAuB,SAAS;AACpC,YAAM,UAAU,SAAS,mCAAmC;AAAA,QAC1D;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,CAAC,cAAc,OAAO,CAAC;AAC1B,UAAI,CAAC,QAAQ,uBAAuB;AAClC,oBAAY,8CAA8C;AAAA,MAC5D;AACA,YAAM,eAAe,aAAa,QAAQ,QAAQ,cAAc,cAAc;AAC9E,MAAAE,eAAc,QAAQ,QAAQ,UAAU,UAAU;AAClD,YAAM,kBAAkB;AAAA,QACtB,QAAQ,QAAQ;AAAA,QAChB;AAAA,MACF;AACA,UACE,CAAC,CAAC,QAAQ,UAAU,UAAU,UAAU,WAAW,SAAS,EAAE;AAAA,QAC5D,QAAQ,QAAQ;AAAA,MAClB,EACA,CAAAF,SAAQ,gCAAgC;AAC1C,UAAI;AACJ,UAAI,QAAQ,QAAQ,2BAA2B,QAAW;AACxD,cAAM,WAAW,MAAM;AAAA,UACrBE;AAAA,YACE,QAAQ,QAAQ;AAAA,YAChB;AAAA,UACF;AAAA,UACA,QAAQ,SAAS;AAAA,QACnB;AACA,mBAAW,WAAW,QAAQ;AAC9B,YACE,SAAS,SAAS,cAClB,SAAS,YAAY,WACrB,SAAS,iBAAiB,gBAC1B,SAAS,UAAU,kBAAkB,mBACrC,KAAK,MAAM,SAAS,SAAS,SAAS,KAAK,IAAI,EAAE,QAAQ,GACzD;AACA,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,YAAM,aAAa,MAAM,QAAQ,sBAAsB,SAAS,QAAQ;AACxE,aAAO,QAAQ,SAAS,kBAAkB,cAAc,UAAU;AAAA,IACpE;AAAA,IACA,MAAM,gBAAgB,SAAS;AAC7B,YAAM,UAAU,SAAS,2BAA2B;AAAA,QAClD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,CAAC,cAAc,OAAO,CAAC;AAC1B,YAAM,eAAe,aAAa,QAAQ,QAAQ,cAAc,cAAc;AAC9E,YAAM,gBAAgB;AAAA,QACpB,QAAQ,QAAQ;AAAA,QAChB;AAAA,MACF;AACA,UACE,CAAC,CAAC,kBAAkB,YAAY,aAAa,YAAY,EAAE;AAAA,QACzD,QAAQ,QAAQ;AAAA,MAClB,KACA,CAAC,OAAO,cAAc,QAAQ,QAAQ,KAAK,KAC3C,QAAQ,QAAQ,QAAQ,KACxB,QAAQ,QAAQ,QAAQ,iBACxB,CAAAF,SAAQ,qCAAqC;AAC/C,MAAAE,eAAc,QAAQ,QAAQ,QAAQ,QAAQ;AAC9C,YAAM,cAAc,IAAI;AACxB,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,UACE,SAAS;AAAA,UACT,SAAS,CAAC,yDAAyD;AAAA,UACnE,aAAa,CAAC,+BAA+B;AAAA,QAC/C;AAAA,QACA;AAAA,UACE;AAAA,UACA,aAAa,QAAQ,MAAM;AAAA,UAC3B,aAAa,YAAY,YAAY;AAAA,UACrC,WAAW,IAAI;AAAA,YACb,YAAY,QAAQ,IAAI,QAAQ,QAAQ;AAAA,UAC1C,EAAE,YAAY;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,gBAAgB,SAAS;AAC7B,YAAM,UAAU,SAAS,2BAA2B;AAAA,QAClD;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,CAAC,OAAO,CAAC;AACZ,UAAI,QAAQ,QAAQ,YAAY,WAAW,QAAQ,QAAQ,YAAY,QAAQ;AAC7E,QAAAF,SAAQ,wCAAwC;AAAA,MAClD;AACA,YAAM,SAASE,eAAc,QAAQ,QAAQ,QAAQ,QAAQ;AAC7D,aAAO,WAAW,YAAY;AAC5B,cAAM,iBAAiB,OAAO;AAC9B,cAAM,WAAW,MAAM;AAAA,UACrBA;AAAA,YACE,QAAQ,QAAQ;AAAA,YAChB;AAAA,UACF;AAAA,UACA,QAAQ,SAAS;AAAA,QACnB;AACA,YAAI,SAAS,KAAK,iBAAiB,cAAc,CAAC,SAAS,KAAK,UAAU;AACxE,UAAAF,SAAQ,4CAA4C;AAAA,QACtD;AACA,YAAI,KAAK,MAAM,SAAS,KAAK,SAAS,SAAS,KAAK,IAAI,EAAE,QAAQ,GAAG;AACnE,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,cAAM,wBAAwB,MAAM,gBAAgB,QAAQ,OAAO;AACnE,cAAM,iBAAiB,SAAS,QAAQ,WACtC,SAAS,KAAK;AAChB,YAAI,mBAAmB,WAAW;AAChC,cACE,mBAAmB,QAAQ,QAAQ,WACnC,SAAS,QAAQ,0BAA0B,uBAC3C;AACA,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AACA,iBAAO,WAAW,QAAQ;AAAA,QAC5B;AACA,cAAM,SAA+B;AAAA,UACnC,SAAS,QAAQ,QAAQ;AAAA,UACzB,WAAW,QAAQ,MAAM;AAAA,UACzB,WAAW,IAAI,EAAE,YAAY;AAAA,UAC7B,SAAS,CAAC,MAAM;AAAA,UAChB;AAAA,QACF;AACA,cAAM,UAAU,MAAM,QAAQ,MAAM;AAAA,UAGlC,QAAQ;AAAA,UACR;AAAA,YACE,YAAY;AAAA,YACZ,MAAM;AAAA,YACN,MAAM,SAAS,SAAS;AAAA,UAC1B;AAAA,UACA;AAAA,UACA;AAAA,YACE,iBAAiB,SAAS,SAAS;AAAA,YACnC,gBAAgB,0BAA0B,SAAS,SAAS,GAAG,IAAI,QAAQ,cAAc;AAAA,UAC3F;AAAA,QACF;AACA,eAAO,WAAW,OAAO;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,IACA,MAAM,iBAAiB,SAAS;AAC9B,YAAM,UAAU,SAAS,4BAA4B;AAAA,QACnD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,CAAC,UAAU,CAAC;AACf,UAAI,CAAC,QAAQ,oBAAoB;AAC/B,oBAAY,mDAAmD;AAAA,MACjE;AACA,YAAM,eAAe,aAAa,QAAQ,QAAQ,cAAc,cAAc;AAC9E,MAAAE,eAAc,QAAQ,QAAQ,YAAY,YAAY;AACtD,MAAAA,eAAc,QAAQ,QAAQ,MAAM,MAAM;AAC1C,MAAAA,eAAc,QAAQ,QAAQ,IAAI,IAAI;AACtC,mBAAa,QAAQ,QAAQ,gBAAgB,gBAAgB;AAC7D,YAAM,aAAa,MAAM,QAAQ,mBAAmB,OAAO;AAC3D,aAAO,QAAQ,SAAS,cAAc,cAAc,UAAU;AAAA,IAChE;AAAA,IACA,MAAM,gBAAgB,SAAS;AAC7B,YAAM,UAAU,SAAS,2BAA2B,CAAC,gBAAgB,GAAG;AAAA,QACtE;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,WAAW,MAAM;AAAA,QACrBA,eAAc,QAAQ,QAAQ,gBAAgB,gBAAgB;AAAA,QAC9D,QAAQ,SAAS;AAAA,MACnB;AACA,YAAM,WAAW,WAAW,QAAQ;AACpC,aAAO;AAAA,QACL;AAAA,QACA,SAAS,GAAG,SAAS,IAAI,IAAI,SAAS,OAAO,KAAK,SAAS,QAAQ,KAAK,IAAI,CAAC;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;;;AC9lBA,eAAe,UAAU,SAAiB,aAAoC;AAC5E,MAAI,UAAU,EAAG,OAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,OAAO,CAAC;AAC5E,MAAI,KAAK,OAAO,IAAI,YAAa,OAAM,IAAI,MAAM,kBAAkB;AACrE;AAKO,SAAS,wBAAwB,UAA6B,CAAC,GAAkB;AACtF,QAAM,UAAU,QAAQ,aAAa;AACrC,QAAM,cAAc,QAAQ,eAAe;AAE3C,SAAO;AAAA,IACL,MAAM,kBAAsD;AAC1D,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,kBAAkB,CAAC,QAAQ;AAAA,QAC3B,kBAAkB;AAAA,MACpB;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,UAAkE;AAC9E,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO,EAAE,QAAQ,cAAc;AAAA,IACjC;AAAA,IACA,MAAM,MAAM,SAA0D;AACpE,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO,EAAE,QAAQ,cAAc;AAAA,IACjC;AAAA,IACA,MAAM,OAAO,SAAiB,UAAkE;AAC9F,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO,EAAE,QAAQ,cAAc;AAAA,IACjC;AAAA,IACA,MAAM,eAAe,OAAe,SAA+C;AACjF,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,QAAQ,SAAgC;AAC5C,YAAM,UAAU,SAAS,WAAW;AAAA,IACtC;AAAA,IACA,MAAM,YAA0C;AAC9C,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO,EAAE,SAAS,MAAM,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,IAC9D;AAAA,EACF;AACF;AAKO,SAAS,8BAA8B,UAA6B,CAAC,GAAwB;AAClG,QAAM,UAAU,QAAQ,aAAa;AACrC,QAAM,cAAc,QAAQ,eAAe;AAE3C,SAAO;AAAA,IACL,MAAM,aAAa;AACjB,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO,CAAC;AAAA,IACV;AAAA,IACA,MAAM,YAA0C;AAC9C,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO,EAAE,SAAS,MAAM,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,IAC9D;AAAA,IACA,OAAO,SAAS,UAAiE;AAC/E,YAAM,UAAU,SAAS,WAAW;AACpC,YAAM,EAAE,MAAM,SAAS,OAAO,gBAAgB;AAAA,IAChD;AAAA,EACF;AACF;AAKO,SAAS,8BAA8B,UAA6B,CAAC,GAAwB;AAClG,QAAM,UAAU,QAAQ,aAAa;AACrC,QAAM,cAAc,QAAQ,eAAe;AAE3C,SAAO;AAAA,IACL,MAAM,QAAQ,WAA2C;AACvD,YAAM,UAAU,SAAS,WAAW;AACpC,aAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ,EAAE,OAAO,aAAa,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,cAAa,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,MAC3G;AAAA,IACF;AAAA,EACF;AACF;AAKA,eAAsB,oBACpB,OACA,QAC+F;AAC/F,QAAM,WAAmD,CAAC;AAE1D,aAAW,QAAQ,MAAM,OAAO;AAC9B,QAAI;AACF,YAAM,KAAK,IAAI,MAAM;AAAA,IACvB,SAASK,QAAO;AACd,eAAS,KAAK;AAAA,QACZ,MAAM,KAAK;AAAA,QACX,OAAOA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,MAAM,MAAM,SAAS,SAAS;AAAA,IACtC,QAAQ,SAAS;AAAA,IACjB;AAAA,EACF;AACF;AAKO,SAAS,sCAA8D;AAC5E,SAAO;AAAA,IACL,eAAe;AAAA,IACf,OAAO;AAAA,MACL;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,gBAAgB;AACtB,gBAAM,eAAe,MAAM,cAAc,gBAAgB;AACzD,cAAI,CAAC,aAAa,KAAM,OAAM,IAAI,MAAM,kBAAkB;AAC1D,cAAI,CAAC,aAAa,iBAAkB,OAAM,IAAI,MAAM,8BAA8B;AAAA,QACpF;AAAA,MACF;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,gBAAgB;AACtB,gBAAM,SAAS,MAAM,cAAc,QAAQ;AAAA,YACzC,YAAY;AAAA,cACV,YAAY;AAAA,cACZ,MAAM;AAAA,cACN,UAAU,EAAE,MAAM,QAAQ,WAAW,WAAW,KAAK,SAAS,YAAY,GAAG,iBAAiB,KAAK,mBAAmB,2BAA2B;AAAA,cACjJ,MAAM,EAAE,iBAAiB,EAAE,YAAY,gCAAgC,MAAM,gBAAgB,MAAM,UAAU,EAAE;AAAA,YACjH;AAAA,YACA,cAAc;AAAA,cACZ,YAAY;AAAA,cACZ,MAAM;AAAA,cACN,UAAU,EAAE,MAAM,WAAW,WAAW,WAAW,KAAK,SAAS,YAAY,GAAG,iBAAiB,KAAK,mBAAmB,2BAA2B;AAAA,cACpJ,MAAM,EAAE,QAAQ,uBAAuB,aAAa,cAAc;AAAA,YACpE;AAAA,YACA,YAAY;AAAA,UACd,CAAC;AACD,cAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,4BAA4B;AAAA,QAClE;AAAA,MACF;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,gBAAgB;AACtB,gBAAM,SAAS,MAAM,cAAc,UAAU;AAC7C,cAAI,OAAO,OAAO,YAAY,UAAW,OAAM,IAAI,MAAM,qBAAqB;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAKO,SAAS,4CAAoE;AAClF,SAAO;AAAA,IACL,eAAe;AAAA,IACf,OAAO;AAAA,MACL;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,cAAc;AACpB,gBAAM,SAAS,MAAM,YAAY,WAAW;AAC5C,cAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,MAAM,8BAA8B;AAAA,QAC5E;AAAA,MACF;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,cAAc;AACpB,gBAAM,SAAS,MAAM,YAAY,UAAU;AAC3C,cAAI,OAAO,OAAO,YAAY,UAAW,OAAM,IAAI,MAAM,qBAAqB;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAKO,SAAS,4CAAoE;AAClF,SAAO;AAAA,IACL,eAAe;AAAA,IACf,OAAO;AAAA,MACL;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,aAAa;AACnB,gBAAM,YAAmC;AAAA,YACvC,YAAY;AAAA,YACZ,MAAM;AAAA,YACN,UAAU,EAAE,MAAM,QAAQ,WAAW,WAAW,KAAK,SAAS,YAAY,GAAG,iBAAiB,KAAK,mBAAmB,2BAA2B;AAAA,YACjJ,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,YAAY,GAAG,QAAQ,UAAU;AAAA,UAC1E;AACA,gBAAM,SAAS,MAAM,WAAW,QAAQ,SAAS;AACjD,cAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,4BAA4B;AAChE,cAAI,CAAC,OAAO,OAAO,MAAO,OAAM,IAAI,MAAM,0BAA0B;AAAA,QACtE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAQO,SAAS,kDAAkD,SAIvC;AACzB,QAAM,QAAQ,QAAQ,SAAS,EAAE,IAAI,mCAAmC,MAAM,aAAa;AAC3F,SAAO;AAAA,IACL,eAAe;AAAA,IACf,OAAO;AAAA,MACL;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,WAAW;AACjB,gBAAM,CAAC,cAAc,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,YAC/C,SAAS,gBAAgB;AAAA,YACzB,SAAS,UAAU;AAAA,UACrB,CAAC;AACD,qBAAW,QAAQ,CAAC,iBAAiB,eAAe,GAAY;AAC9D,gBAAI,CAAC,aAAa,QAAQ,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,8BAA8B,IAAI,EAAE;AAAA,UAChG;AACA,cAAI,CAAC,aAAa,iBAAkB,OAAM,IAAI,MAAM,iCAAiC;AACrF,cAAI,OAAO,OAAO,YAAY,aAAa,CAAC,OAAO,UAAW,OAAM,IAAI,MAAM,uBAAuB;AAAA,QACvG;AAAA,MACF;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,WAAW;AACjB,gBAAM,WAAW,QAAQ,eAAe,+BAA+B;AACvE,gBAAM,QAAQ,MAAM,SAAS,cAAc,UAAU,KAAK;AAC1D,cAAI,CAAC,MAAM,WAAY,OAAM,IAAI,MAAM,qCAAqC;AAC5E,gBAAM,SAAS,MAAM,SAAS,cAAc,UAAU,KAAK;AAC3D,cAAI,OAAO,eAAe,MAAM,WAAY,OAAM,IAAI,MAAM,wCAAwC;AACpG,gBAAM,SAAS,MAAM,SAAS,kBAAkB,MAAM,UAAU;AAChE,cAAI,OAAO,eAAe,MAAM,WAAY,OAAM,IAAI,MAAM,mCAAmC;AAC/F,gBAAM,SAAS,MAAM,SAAS,cAAc;AAC5C,cAAI,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,eAAe,MAAM,UAAU,GAAG;AAClE,kBAAM,IAAI,MAAM,4CAA4C;AAAA,UAC9D;AACA,gBAAM,SAAS,aAAa,MAAM,YAAY,KAAK;AAAA,QACrD;AAAA,MACF;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,QACb,KAAK,OAAO,WAAW;AACrB,gBAAM,WAAW;AACjB,gBAAM,YAAY,QAAQ,oBAAoB,2BAA2B;AACzE,gBAAM,QAAQ,MAAM,SAAS,qBAAqB,WAAW,KAAK;AAClE,cAAI,CAAC,MAAM,WAAY,OAAM,IAAI,MAAM,qCAAqC;AAC5E,gBAAM,SAAS,MAAM,SAAS,qBAAqB,WAAW,KAAK;AACnE,cAAI,OAAO,eAAe,MAAM,WAAY,OAAM,IAAI,MAAM,oCAAoC;AAChG,gBAAM,SAAS,MAAM,SAAS,uBAAuB,MAAM,UAAU;AACrE,cAAI,OAAO,eAAe,MAAM,WAAY,OAAM,IAAI,MAAM,+BAA+B;AAC3F,gBAAM,SAAS,MAAM,SAAS,mBAAmB;AACjD,cAAI,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,eAAe,MAAM,UAAU,GAAG;AAClE,kBAAM,IAAI,MAAM,uDAAuD;AAAA,UACzE;AACA,gBAAM,SAAS,oBAAoB,MAAM,YAAY,KAAK;AAAA,QAC5D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;AChUA,eAAe,cAAc,SAA2B,SAAgC;AACtF,MAAI;AACF,UAAM;AAAA,EACR,QAAQ;AACN;AAAA,EACF;AACA,QAAM,IAAI,MAAM,OAAO;AACzB;AAEA,eAAe,eAAe,SAA2B,SAAgC;AACvF,MAAI;AACF,UAAM;AAAA,EACR,SAASC,QAAO;AACd,UAAM,IAAI,MAAM,GAAG,OAAO,KAAKA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK,CAAC,EAAE;AAAA,EACzF;AACF;AAuBO,SAAS,sBAAwC,QAAW,MAA8B,MAA2D;AAC1J,QAAM,eAAsC,CAAC;AAC7C,QAAM,QAAQ,IAAI,MAAM,QAAQ;AAAA,IAC9B,IAAI,QAAQ,UAAU,UAAU;AAC9B,YAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,QAAQ;AACpD,UAAI,OAAO,UAAU,cAAc,OAAO,aAAa,SAAU,QAAO;AACxE,aAAO,UAAU,eAA0B;AACzC,cAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC1C,YAAI;AACF,gBAAM,SAAS,MAAO,MAA0D,MAAM,QAAQ,UAAU;AACxG,uBAAa,KAAK,EAAE,QAAQ,UAAU,WAAW,YAAY,QAAQ,WAAW,CAAC;AACjF,iBAAO;AAAA,QACT,SAASA,QAAO;AACd,uBAAa,KAAK;AAAA,YAChB,QAAQ;AAAA,YACR,WAAW;AAAA,YACX,OAAOA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,YAC5D;AAAA,UACF,CAAC;AACD,gBAAMA;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,SAAS,OAAO,EAAE,MAAM,YAAY,MAAM,cAAc,CAAC,GAAG,YAAY,EAAE;AAAA,EAC5E;AACF;AAOO,SAAS,sBAAsB,SAAiD;AACrF,MAAI,SAAS;AACb,SAAO,IAAI,MAAM,CAAC,GAA8B;AAAA,IAC9C,IAAI,SAAS,UAAU;AACrB,UAAI,OAAO,aAAa,SAAU,QAAO;AACzC,aAAO,UAAU,eAA0B;AACzC,cAAM,cAAc,QAAQ,aAAa,MAAM;AAC/C,YAAI,CAAC,aAAa;AAChB,gBAAM,IAAI,MAAM,iDAAiD,QAAQ,EAAE;AAAA,QAC7E;AACA,YAAI,YAAY,WAAW,UAAU;AACnC,gBAAM,IAAI,MAAM,6BAA6B,YAAY,MAAM,SAAS,QAAQ,EAAE;AAAA,QACpF;AACA,kBAAU;AACV,YAAI,YAAY,MAAO,OAAM,IAAI,MAAM,YAAY,KAAK;AACxD,eAAO,YAAY;AAAA,MACrB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAQO,SAAS,sBACd,UACA,UACU;AACV,QAAM,UAAoB,CAAC;AAC3B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,QAAI,SAAS,GAAG,MAAM,OAAO;AAC3B,cAAQ,KAAK,GAAG;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,iCAAiC,SAGrB;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,WAAW,MAAM,QAAQ,gBAAgB,MAAM;AACrD,cAAM,UAAU,sBAAsB,UAAU,QAAQ,oBAAoB;AAC5E,YAAI,QAAQ,SAAS,GAAG;AACtB,gBAAM,IAAI,MAAM,kCAAkC,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,QACxE;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,WAAW,MAAM,QAAQ,gBAAgB,MAAM;AACrD,cAAM,UAAU,sBAAsB,UAAU,EAAE,qCAAqC,KAAK,CAAC;AAC7F,YAAI,QAAQ,WAAW,GAAG;AACxB,gBAAM,IAAI,MAAM,8CAA8C;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAIO,SAAS,wBAAwB,SAEZ;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,aAAa,IAAI,gBAAgB;AACvC,cAAM,UAAU,QAAQ,mBAAmB,QAAQ,WAAW,MAAM;AACpE,mBAAW,MAAM;AACjB,cAAM,cAAc,SAAS,oCAAoC;AAAA,MACnE;AAAA,IACF;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,aAAa,IAAI,gBAAgB;AACvC,cAAM,eAAe,QAAQ,mBAAmB,QAAQ,WAAW,MAAM,GAAG,0CAA0C;AAAA,MACxH;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,wBAAwB,SAGZ;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,WAAW,MAAM,KAAK,EAAE,QAAQ,QAAQ,mBAAmB,EAAE,GAAG,MAAM,QAAQ,OAAO,MAAM,CAAC;AAClG,cAAM,UAAU,MAAM,QAAQ,WAAW,QAAQ;AACjD,cAAM,WAAW,QAAQ,OAAO,CAAC,WAAW,OAAO,WAAW,UAAU;AAExE,YAAI,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,mBAAmB,GAAG;AAC1E,gBAAM,IAAI,MAAM,4DAA4D;AAAA,QAC9E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAIO,SAAS,oBAAoB,SAIR;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,aAAa,MAAM,QAAQ,eAAe,MAAM;AACtD,cAAM,YAAY,QAAQ,eAAe;AACzC,cAAM,UAAU,MAAM,QAAQ,cAAc,SAAS;AACrD,YAAI,CAAC,QAAQ,SAAS,UAAU,GAAG;AACjC,gBAAM,IAAI,MAAM,2CAA2C,UAAU,EAAE;AAAA,QACzE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAIO,SAAS,uBAAuB,SAEX;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,MAAM,QAAQ,KAAK,IAAI,CAAC;AAC9B,cAAM,QAAQ,MAAM,QAAQ,yBAAyB,QAAQ,GAAG;AAChE,cAAM,SAAS,MAAM,QAAQ,yBAAyB,QAAQ,GAAG;AACjE,YAAI,KAAK,UAAU,KAAK,MAAM,KAAK,UAAU,MAAM,GAAG;AACpD,gBAAM,IAAI,MAAM,mDAAmD;AAAA,QACrE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,mBAAmB,SAEP;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,QAAQ,iBAAiB,QAAQ,CAAC;AACxC,cAAM,cAAc,QAAQ,iBAAiB,QAAQ,CAAC,GAAG,oCAAoC;AAAA,MAC/F;AAAA,IACF;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,QAAQ,iBAAiB,QAAQ,EAAE;AACzC,cAAM,eAAe,QAAQ,iBAAiB,QAAQ,EAAE,GAAG,wCAAwC;AAAA,MACrG;AAAA,IACF;AAAA,EACF;AACF;AAIO,SAAS,qBAAqB,SAGT;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,cAAc,QAAQ,gBAAgB,QAAQ,MAAM,GAAG,sCAAsC;AAAA,MACrG;AAAA,IACF;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,eAAe,QAAQ,gBAAgB,QAAQ,QAAQ,gBAAgB,GAAG,oCAAoC;AAAA,MACtH;AAAA,IACF;AAAA,EACF;AACF;AAIO,SAAS,oBAAoB,SAIR;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,cAAc,QAAQ,YAAY,QAAQ,QAAQ,mBAAmB,GAAG,qCAAqC;AAAA,MACrH;AAAA,IACF;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,KAAK,OAAO,WAAW;AACrB,cAAM,eAAe,QAAQ,YAAY,QAAQ,QAAQ,iBAAiB,GAAG,mCAAmC;AAAA,MAClH;AAAA,IACF;AAAA,EACF;AACF;;;ACxTA,IAAM,wBAAwB;AAS9B,SAAS,SAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,yBAAyB,OAAiD;AACjF,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAC7B,SACE,OAAO,MAAM,SAAS,YACtB,0BAA0B,SAAS,MAAM,IAAsC,KAC/E,OAAO,MAAM,YAAY,YACzB,OAAO,MAAM,cAAc,cAC1B,MAAM,iBAAiB,UACrB,OAAO,MAAM,iBAAiB,YAAY,OAAO,SAAS,MAAM,YAAY,OAC9E,MAAM,WAAW,UAAa,OAAO,MAAM,WAAW,cACtD,MAAM,YAAY,UAAa,SAAS,MAAM,OAAO;AAE1D;AAGO,SAAS,2BAA2B,SAAoD;AAC7F,QAAM,SAAS,QAAQ,YAAY,qBAAqB;AACxD,MAAI,SAAS,EAAG,QAAO;AACvB,QAAM,OAAO,QACV,MAAM,SAAS,sBAAsB,MAAM,EAC3C,MAAM,SAAS,CAAC,EAAE,CAAC,GAClB,KAAK;AACT,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,UAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAC7B,QAAI,MAAM,UAAU,eAAe,MAAM,UAAU,YAAY,MAAM,UAAU,aAAa;AAC1F,aAAO;AAAA,IACT;AACA,QAAI,MAAM,YAAY,UAAa,OAAO,MAAM,YAAY,SAAU,QAAO;AAC7E,QACE,MAAM,WAAW,WAChB,CAAC,SAAS,MAAM,MAAM,KACpB,MAAM,OAAO,UAAU,UAAa,CAAC,yBAAyB,MAAM,OAAO,KAAK,KAChF,MAAM,OAAO,gBAAgB,UAAa,OAAO,MAAM,OAAO,gBAAgB,WACjF;AACA,aAAO;AAAA,IACT;AACA,QAAI,MAAM,UAAU,UAAa,CAAC,yBAAyB,MAAM,KAAK,EAAG,QAAO;AAChF,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC9DA,SAAS,WAAkC;AAC3C,SAAS,eAAe;AACxB,SAAS,eAAe;AA0BxB,IAAM,mBAAmB;AAAA,EACvB,WAAW;AAAA,EACX,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,iBAAiB;AACnB;AACA,IAAM,eAAe,oBAAI,IAAyB;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAASC,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAAS,YAAY,QAA0D;AAC7E,UAAQ,OAAO,SAAS;AAAA,IACtB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,4CAA4C;AAC/C,aAAO,IAAI,IAAI,gBAAgB;AAAA,IACjC;AAAA,IACA,KAAK,gDAAgD;AACnD,aAAO,IAAI,QAAQ,gBAAgB;AAAA,IACrC;AAAA,IACA,KAAK,gDAAgD;AACnD,aAAO,IAAI,QAAQ,gBAAgB;AAAA,IACrC;AAAA,IACA,SAAS;AACP,MAAAA,SAAQ,yDAAyD,OAAO,OAAO,OAAO,CAAC,GAAG;AAAA,IAC5F;AAAA,EACF;AACF;AAEA,SAAS,cACP,UACA,QACA,WACkB;AAClB,MACE,OAAO,SAAS,SAAS,YACzB,SAAS,KAAK,WAAW,KACzB,OAAO,SAAS,SAAS,YACzB,SAAS,KAAK,WAAW,KACzB,CAAC,aAAa,IAAI,SAAS,MAAM,KACjC,CAAC,MAAM,QAAQ,SAAS,aAAa,KACrC,SAAS,cAAc,WAAW,KAClC,SAAS,cAAc,KAAK,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,WAAW,CAAC,KACtF,CAAC,SAAS,aACV,CAAC,OAAO,cAAc,SAAS,UAAU,aAAa,KACtD,SAAS,UAAU,gBAAgB,KACnC,CAAC,OAAO,cAAc,SAAS,UAAU,WAAW,KACpD,SAAS,UAAU,cAAc,GACjC;AACA,IAAAA,SAAQ,2BAA2B,SAAS,IAAI,iBAAiB;AAAA,EACnE;AACA,MAAI;AACF,WAAO,YAAY,MAAM,EAAE,QAAQ,MAAM;AAAA,EAC3C,QAAQ;AACN,IAAAA,SAAQ,2BAA2B,SAAS,IAAI,oBAAoB,SAAS,SAAS;AAAA,EACxF;AACF;AAGO,SAAS,4BACd,WACM;AACN,QAAM,aAAa,oBAAI,IAAY;AACnC,aAAW,YAAY,WAAW;AAChC,QAAI,aAAa,QAAQ,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,GAAG;AAChF,MAAAA,SAAQ,0CAA0C;AAAA,IACpD;AACA,UAAM,WAAW,GAAG,SAAS,IAAI,KAAK,SAAS,IAAI;AACnD,QAAI,WAAW,IAAI,QAAQ,GAAG;AAC5B,MAAAA,SAAQ,2BAA2B,SAAS,IAAI,IAAI,SAAS,IAAI,iBAAiB;AAAA,IACpF;AACA,eAAW,IAAI,QAAQ;AACvB,kBAAc,UAAU,SAAS,aAAa,OAAO;AACrD,kBAAc,UAAU,SAAS,cAAc,QAAQ;AAAA,EACzD;AACF;AAMO,SAAS,oCACd,WACA,WACA,cACsB;AACtB,QAAM,WAAW,aAAa,CAAC,GAAG;AAAA,IAAO,CAAC,cACxC,UAAU,SAAS,UAAU,KAAK,QAAQ,QAC1C,UAAU,SAAS,UAAU,KAAK,QAAQ;AAAA,EAC5C;AACA,MAAI,QAAQ,WAAW,GAAG;AACxB,IAAAA;AAAA,MACE,kBAAkB,UAAU,KAAK,QAAQ,IAAI,IAAI,UAAU,KAAK,QAAQ,IAAI;AAAA,IAC9E;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,CAAC;AAC1B,MAAI,UAAU,KAAK,WAAW,SAAS,QAAQ;AAC7C,IAAAA;AAAA,MACE,kBAAkB,SAAS,IAAI,aAAa,UAAU,KAAK,MAAM,mCAAmC,SAAS,MAAM;AAAA,IACrH;AAAA,EACF;AACA,MACE,UAAU,KAAK,QAAQ,iBAAiB,UACxC,UAAU,KAAK,QAAQ,iBAAiB,SAAS,cACjD;AACA,IAAAA,SAAQ,kBAAkB,SAAS,IAAI,kDAAkD;AAAA,EAC3F;AACA,MAAI,iBAAiB,UAAa,CAAC,SAAS,cAAc,SAAS,YAAY,GAAG;AAChF,IAAAA,SAAQ,kBAAkB,YAAY,wCAAwC,SAAS,IAAI,GAAG;AAAA,EAChG;AACA,QAAM,WAAW,cAAc,UAAU,SAAS,aAAa,OAAO;AACtE,MAAI,CAAC,SAAS,UAAU,KAAK,aAAa,CAAC,CAAC,GAAG;AAC7C,IAAAA,SAAQ,kBAAkB,SAAS,IAAI,4CAA4C;AAAA,EACrF;AACA,SAAO;AACT;AAGO,SAAS,kCACd,UACA,OACM;AACN,QAAM,WAAW,cAAc,UAAU,SAAS,cAAc,QAAQ;AACxE,MAAI,CAAC,SAAS,KAAK,GAAG;AACpB,IAAAA,SAAQ,kBAAkB,SAAS,IAAI,2CAA2C;AAAA,EACpF;AACF;AAGO,SAAS,0CAA0C,cAA8C;AACtG,SAAO,CAAC;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,aAAa,EAAE,MAAM,UAAU,sBAAsB,MAAM;AAAA,IAC3D,cAAc;AAAA,MACZ,MAAM;AAAA,MACN,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,EAAE;AAAA,MAC3C,UAAU,CAAC,SAAS;AAAA,MACpB,sBAAsB;AAAA,IACxB;AAAA,IACA,WAAW,EAAE,eAAe,KAAK,aAAa,MAAM,OAAO,KAAK;AAAA,IAChE,eAAe,CAAC,YAAY;AAAA,EAC9B,GAAG;AAAA,IACD,MAAM;AAAA,IACN,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,aAAa,EAAE,MAAM,SAAS;AAAA,IAC9B,cAAc,EAAE,MAAM,SAAS;AAAA,IAC/B,WAAW,EAAE,eAAe,KAAK,aAAa,MAAM,OAAO,KAAK;AAAA,IAChE,eAAe,CAAC,YAAY;AAAA,EAC9B,CAAC;AACH;;;AC3LA,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAC/B,IAAM,4BAA4B;AAkBlC,SAASC,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAASC,UAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEO,SAAS,uCACd,WACM;AACN,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,YAAY,WAAW;AAChC,QAAI,aAAa,QAAQ,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,GAAG;AAChF,MAAAD,SAAQ,sDAAsD;AAAA,IAChE;AACA,QACE,OAAO,SAAS,iBAAiB,YACjC,SAAS,aAAa,WAAW,KACjC,OAAO,SAAS,UAAU,YAC1B,SAAS,MAAM,WAAW,GAC1B;AACA,MAAAA,SAAQ,oEAAoE;AAAA,IAC9E;AACA,QACE,CAAC,OAAO,cAAc,SAAS,WAAW,aAAa,KACvD,SAAS,UAAU,gBAAgB,KACnC,CAAC,OAAO,cAAc,SAAS,WAAW,WAAW,KACrD,SAAS,UAAU,cAAc,GACjC;AACA,MAAAA;AAAA,QACE,mCAAmC,SAAS,YAAY;AAAA,MAC1D;AAAA,IACF;AACA,QAAI,QAAQ,IAAI,SAAS,YAAY,GAAG;AACtC,MAAAA,SAAQ,mCAAmC,SAAS,YAAY,iBAAiB;AAAA,IACnF;AACA,YAAQ,IAAI,SAAS,YAAY;AACjC,QAEI,SAAS,YAAY,WAEnB,CAAC,MAAM,QAAQ,SAAS,OAAO,KAC/B,SAAS,QAAQ,KAAK,CAAC,aAAa,OAAO,aAAa,QAAQ,MAIlE,SAAS,gBAAgB,UACzB,CAACC,UAAS,SAAS,WAAW,KAEhC,OAAO,QAAQ,SAAS,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,OAAO,UAAU,YAAY,IAAI,WAAW,WAAW,CAAC,GAClI;AACA,MAAAD,SAAQ,mCAAmC,SAAS,YAAY,sCAAsC;AAAA,IACxG;AAAA,EACF;AACF;AAMO,SAAS,+BACd,UACA,WACiC;AACjC,QAAM,cAAc,SAAS,SAAS;AACtC,MACE,cAAc,wBAAwB,MAAM,UAC5C,cAAc,0BAA0B,MAAM,UAC9C,cAAc,sBAAsB,MAAM,UAC1C,cAAc,sBAAsB,MAAM,UAC1C,cAAc,yBAAyB,MAAM,QAC7C;AACA,IAAAA;AAAA,MACE;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,SAAS,KAAK,gBAAgB;AACnD,QAAM,WAAW,aAAa,CAAC,GAAG,OAAO,CAAC,cAAc,UAAU,iBAAiB,YAAY;AAC/F,MAAI,QAAQ,WAAW,GAAG;AACxB,IAAAA,SAAQ,+BAA+B,YAAY,0CAA0C;AAAA,EAC/F;AACA,SAAO,QAAQ,CAAC;AAClB;AAGO,SAAS,iCACd,UACA,UACmC;AACnC,QAAM,YAAY,SAAS,KAAK;AAChC,OACG,WAAW,YAAY,KAAK,MAC5B,WAAW,aAAa,KAAK,MAC7B,WAAW,iBAAiB,KAAK,GAClC;AACA,IAAAA;AAAA,MACE,0BAA0B,SAAS,YAAY;AAAA,IACjD;AAAA,EACF;AACA,QAAM,gBAAgB,WAAW,iBAC/B,SAAS,UAAU;AACrB,QAAM,cAAc,WAAW,eAAe,SAAS,UAAU;AACjE,MACE,CAAC,OAAO,cAAc,aAAa,KACnC,gBAAgB,KAChB,gBAAgB,SAAS,UAAU,iBACnC,CAAC,OAAO,cAAc,WAAW,KACjC,cAAc,KACd,cAAc,SAAS,UAAU,aACjC;AACA,IAAAA;AAAA,MACE,sEAAsE,SAAS,YAAY;AAAA,IAC7F;AAAA,EACF;AACA,SAAO,EAAE,eAAe,YAAY;AACtC;;;ACrGA,SAAS,kBAAkB,MAAsB;AAC/C,SAAO,KAAK,YAAY,EAAE,QAAQ,iBAAiB,GAAG,EAAE,QAAQ,YAAY,EAAE,KAAK;AACrF;AAOA,eAAsB,4BACpB,QACA,SACkC;AAClC,QAAM,CAAC,QAAQ,MAAM,IAAI,MAAM,QAAQ,IAAI,CAAC,OAAO,WAAW,GAAG,OAAO,UAAU,CAAC,CAAC;AACpF,QAAM,SAAS,QAAQ,kBAAkB,WAAW,QAAQ,MAAM;AAElE,QAAM,eAAqC,CAAC;AAC5C,QAAM,YAAqC,CAAC;AAE5C,aAAW,SAAS,QAAQ;AAC1B,UAAM,WAAW,sBAAsB,KAAK;AAC5C,iBAAa,KAAK,yBAAyB,UAAU,KAAK,CAAC;AAC3D,cAAU,KAAK,4BAA4B,GAAG,QAAQ,IAAI,kBAAkB,QAAQ,MAAM,CAAC,IAAI;AAAA,MAC7F,eAAe,EAAE,YAAY,yBAAyB,MAAM,kBAAkB,MAAM,SAAS;AAAA,MAC7F,GAAI,MAAM,SAAS,EAAE,aAAa,MAAM,OAAO,IAAI,CAAC;AAAA,MACpD,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,UAAU,GAAG,MAAM,IAAI,MAAM,QAAQ,IAAI,MAAM,KAAK;AAAA,MACpD,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,MACzD,GAAI,QAAQ,aAAa,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;AAAA,IACjE,CAAC,CAAC;AAAA,EACJ;AAEA,SAAO,EAAE,cAAc,WAAW,OAAO;AAC3C;AAIA,IAAM,aAAiD;AAAA,EACrD,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS;AACX;AA4BO,SAAS,oBACd,WACA,cAC8B;AAC9B,QAAM,mBAAmB,WAAW,aAAa,gBAAgB,YAAY;AAC7E,QAAM,iBAAiB,aAAa,kBAAkB;AAEtD,QAAM,aAAa,UAAU,OAAO,CAAC,EAAE,UAAU,OAAO,MAAM;AAC5D,QAAI,SAAS,KAAK,cAAc,SAAS,aAAa,eAAgB,QAAO;AAC7E,QAAI,aAAa,eAAe,SAAS,KAAK,gBAAgB,aAAa,YAAa,QAAO;AAC/F,UAAM,YAAY,WAAW,SAAS,KAAK,SAAS,YAAY;AAChE,QAAI,YAAY,iBAAkB,QAAO;AACzC,QAAI,kBAAkB,QAAQ,YAAY,MAAO,QAAO;AACxD,QAAI,aAAa,kBAAkB,QAAW;AAC5C,YAAM,WAAW,SAAS,KAAK,UAAU,iBAAiB;AAC1D,UAAI,WAAW,aAAa,cAAe,QAAO;AAAA,IACpD;AACA,WAAO;AAAA,EACT,CAAC;AAED,aAAW,KAAK,CAAC,GAAG,OAAO,EAAE,SAAS,KAAK,UAAU,iBAAiB,MAAM,EAAE,SAAS,KAAK,UAAU,iBAAiB,EAAE;AAEzH,SAAO,WAAW,CAAC,GAAG,YAAY;AACpC;;;ACjGA,SAASE,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAASC,aACP,SACA,SACA,UACM;AACN,MAAI,YAAY,QAAQ,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AAC7E,IAAAD,SAAQ,oBAAoB,QAAQ,oBAAoB;AAAA,EAC1D;AACA,QAAM,UAAU,OAAO,KAAK,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,SAAS,KAAK,CAAC;AAC/E,MAAI,QAAQ,SAAS,GAAG;AACtB,IAAAA;AAAA,MACE,oBAAoB,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,CAAC;AAAA,IACjF;AAAA,EACF;AACF;AAEA,IAAM,wBAAwB,oBAAI,IAAI;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,sBAAsB,SAGtB;AACP,MAAI,CAAC,wBAAwB,KAAK,QAAQ,YAAY,GAAG;AACvD,IAAAA,SAAQ,kEAAkE;AAAA,EAC5E;AACA,MACE,CAAC,MAAM,QAAQ,QAAQ,YAAY,KACnC,QAAQ,aAAa,SAAS,KAC9B,QAAQ,aAAa,SAAS,sBAAsB,QACpD,IAAI,IAAI,QAAQ,YAAY,EAAE,SAAS,QAAQ,aAAa,UAC5D,QAAQ,aAAa;AAAA,IAAK,CAAC,gBACzB,OAAO,gBAAgB,YACvB,CAAC,sBAAsB,IAAI,WAAW;AAAA,EACxC,EACA,CAAAA,SAAQ,2CAA2C;AACvD;AAUO,SAAS,mCACd,SAC0B;AAC1B,MACE,CAAC,QAAQ,QACT,CAAC,QAAQ,kBAAkB,QAC3B;AACA,IAAAA;AAAA,MACE;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,mCAAmC;AAAA,IAChD,OAAO,QAAQ;AAAA,IACf,WAAW,QAAQ;AAAA,IACnB,UAAU,QAAQ;AAAA,IAClB,KAAK,QAAQ;AAAA,IACb,kBAAkB,QAAQ;AAAA,IAC1B,cAAc;AAAA,MACZ,MAAM,QAAQ;AAAA,MACd,qBAAqB,QAAQ;AAAA,MAC7B,aAAa,QAAQ;AAAA,MACrB,mBAAmB,QAAQ;AAAA,IAC7B;AAAA,IACA,qBAAqB,QAAQ;AAAA,EAC/B,CAAC;AAED,MAAI,OAAsB,QAAQ,QAAQ;AAE1C,iBAAe,UAAa,QAAsC;AAChE,QAAI;AACJ,UAAM,WAAW;AACjB,WAAO,IAAI,QAAc,CAAC,YAAY;AACpC,gBAAU;AAAA,IACZ,CAAC;AACD,UAAM;AACN,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,OAAO;AAAA,IACxB,SAASE,QAAO;AACd,uBAAiBA;AAAA,IACnB;AACA,QAAI;AACF,YAAM,QAAQ,aAAa,gCAAgC,QAAQ,KAAK,CAAC;AAAA,IAC3E,SAASA,QAAO;AACd,cAAQ;AACR,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,uDAAuDA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK,CAAC;AAAA,QACtH,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,YAAQ;AACR,QAAI,mBAAmB,QAAW;AAChC,UAAI,0BAA0B,MAAO,OAAM;AAC3C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,UACb,SACAC,SACe;AACf,IAAAF,aAAY,QAAQ,SAASE,SAAQ,GAAG,QAAQ,MAAM,UAAU;AAChE,QAAI,CAAC,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAC5C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,iBAAiB,MAAM,OAAO,gBAAgB;AAAA,IAC9C,MAAM,IAAI,SAAS,SAAS;AAC1B,YAAM,UAAU,SAAS;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,UACE,QAAQ,QAAQ,wBAAwB,UACxC,CAAC,wBAAwB,KAAK,QAAQ,QAAQ,mBAAmB,EACjE,CAAAH,SAAQ,iDAAiD;AAC3D,UACE,OAAO,QAAQ,QAAQ,aAAa,YACpC,QAAQ,QAAQ,SAAS,SAAS,OAClC,CAAC,4CAA4C;AAAA,QAC3C,QAAQ,QAAQ;AAAA,MAClB,EACA,CAAAA,SAAQ,sCAAsC;AAChD,UACE,QAAQ,QAAQ,mBAAmB,WAEjC,OAAO,QAAQ,QAAQ,mBAAmB,YAC1C,CAAC,QAAQ,QAAQ,kBACjB,QAAQ,QAAQ,eAAe,SAAS,KAE1C,CAAAA,SAAQ,4CAA4C;AACtD,YAAM,UAAU,QAAQ,QAAQ,uBAAuB,CAAC;AACxD,UACE,CAAC,MAAM,QAAQ,OAAO,KACtB,QAAQ,SAAS,MACjB,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,UAClC,QAAQ;AAAA,QAAK,CAAC,WACZ,OAAO,WAAW,YAClB,CAAC,wBAAwB,KAAK,MAAM;AAAA,MACtC,EACA,CAAAA,SAAQ,kDAAkD;AAC5D,aAAO,UAAU,MAAM,OAAO,IAAI,SAAS,OAAO,CAAC;AAAA,IACrD;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,UAAU,SAAS,CAAC,aAAa,CAAC;AACxC,aAAO,UAAU,MAAM,OAAO,QAAQ,OAAO,CAAC;AAAA,IAChD;AAAA,IACA,OAAO,KAAK,SAAS;AACnB,YAAM,UAAU,SAAS,CAAC,gBAAgB,CAAC;AAC3C,YAAM,SAAS,MAAM,UAAU,YAAY;AACzC,cAAM,SAAuB,CAAC;AAC9B,yBAAiB,SAAS,OAAO,KAAK,OAAO,EAAG,QAAO,KAAK,KAAK;AACjE,eAAO;AAAA,MACT,CAAC;AACD,iBAAW,SAAS,OAAQ,OAAM;AAAA,IACpC;AAAA,IACA,MAAM,KAAK,SAAS;AAClB,YAAM,UAAU,SAAS;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,4BAAsB,QAAQ,OAAO;AACrC,aAAO,UAAU,MAAM,OAAO,KAAK,OAAO,CAAC;AAAA,IAC7C;AAAA,IACA,MAAM,SAAS,SAAS;AACtB,YAAM,UAAU,SAAS;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,MAAAC;AAAA,QACE,QAAQ,QAAQ;AAAA,QAChB,CAAC,OAAO,QAAQ,YAAY;AAAA,QAC5B;AAAA,MACF;AACA,4BAAsB,QAAQ,OAAO;AACrC,aAAO,UAAU,MAAM,OAAO,SAAS,OAAO,CAAC;AAAA,IACjD;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,UAAU,SAAS;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,4BAAsB,QAAQ,OAAO;AACrC,UACE,CAAC,MAAM,QAAQ,QAAQ,QAAQ,UAAU,KACzC,QAAQ,QAAQ,WAAW,SAAS,KACpC,QAAQ,QAAQ,WAAW,SAAS,MACpC,IAAI,IAAI,QAAQ,QAAQ,UAAU,EAAE,SAClC,QAAQ,QAAQ,WAAW,UAC7B,QAAQ,QAAQ,WAAW;AAAA,QAAK,CAAC,aAC/B,OAAO,aAAa,YACpB,CAAC,YACD,SAAS,SAAS;AAAA,MACpB,EACA,CAAAD,SAAQ,sDAAsD;AAChE,aAAO,UAAU,MAAM,OAAO,OAAO,OAAO,CAAC;AAAA,IAC/C;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,UAAU,SAAS,CAAC,kBAAkB,aAAa,CAAC;AAC1D,aAAO,UAAU,MAAM,OAAO,QAAQ,OAAO,CAAC;AAAA,IAChD;AAAA,IACA,MAAM,WAAW,SAAS;AACxB,YAAM,UAAU,SAAS,CAAC,kBAAkB,QAAQ,CAAC;AACrD,UACE,OAAO,QAAQ,QAAQ,WAAW,YAClC,CAAC,QAAQ,QAAQ,UACjB,QAAQ,QAAQ,OAAO,SAAS,KAChC,CAAAA,SAAQ,+CAA+C;AACzD,aAAO,UAAU,MAAM,OAAO,WAAW,OAAO,CAAC;AAAA,IACnD;AAAA,IACA,MAAM,MAAM,SAAS;AACnB,YAAM,UAAU,SAAS,CAAC,kBAAkB,aAAa,CAAC;AAC1D,aAAO,UAAU,MAAM,OAAO,MAAM,OAAO,CAAC;AAAA,IAC9C;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,UAAU,SAAS,CAAC,aAAa,CAAC;AACxC,aAAO,UAAU,MAAM,OAAO,QAAQ,OAAO,CAAC;AAAA,IAChD;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,UAAU,SAAS,CAAC,gBAAgB,CAAC;AAC3C,aAAO,UAAU,MAAM,OAAO,OAAO,OAAO,CAAC;AAAA,IAC/C;AAAA,EACF;AACF;;;ACzRO,SAAS,4BACd,YACA,OACA,cACS;AACT,QAAM,gBAAgB,aAAa,KAAK,aAAa,UAAU;AAC/D,QAAM,kBAAkB,aAAa,KAAK,QAAQ,aAAa,UAC7D,aAAa,KAAK,QAAQ,mBAAmB;AAC/C,SAAO,WAAW,SAAS,aAAa,KAAK,UAC3C,WAAW,YAAY,SAAS,MAAM,KAAK,UAAU,MACpD,CAAC,aAAa,KAAK,oBAAoB,UACtC,aAAa,KAAK,mBAAmB,SAAS,MAAM,KAAK,UAAU,OACpE,CAAC,MAAM,KAAK,iBAAiB,WAAW,eACxC,CAAC,aAAa,KAAK,mBAAmB,WAAW,eACjD,CAAC,aAAa,KAAK,YAAY,WAAW,WAAW,eACtD,OAAO,cAAc,aAAa,KAClC,iBAAiB,MAChB,kBAAkB,KAAK,WAAW,gBAAgB,UAClD,CAAC,mBAAmB,WAAW,WAAW,UAC1C,WAAW,mBAAmB,WAC5B,MAAM,KAAK,aAAa,MAAM,WAAW;AAChD;;;ACEA,SAASI,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAASC,aAAY,YAA2B;AAC9C,QAAM,IAAI,mBAAmB;AAAA,IAC3B,MAAM;AAAA,IACN,SAAS,8CAA8C,UAAU;AAAA,IACjE,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,OACP,OACA,SACA,UACyB;AACzB,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,IAAAD,SAAQ,WAAW,QAAQ,oBAAoB;AAAA,EACjD;AACA,QAAM,SAAS;AACf,QAAM,UAAU,OAAO,KAAK,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;AAC1E,MAAI,QAAQ,SAAS,GAAG;AACtB,IAAAA,SAAQ,WAAW,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,EAClF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAgB,UAA0B;AAC7D,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM;AAC1E,IAAAA,SAAQ,WAAW,QAAQ,qCAAqC;AAAA,EAClE;AACA,SAAO;AACT;AAMO,SAAS,kCACd,QACA,SACyB;AACzB,MACE,OAAO,QAAQ,qBAAqB,cACpC,CAAC,QAAQ,kBAAkB,OAC3B,CAAAA,SAAQ,uEAAuE;AACjF,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,eAAe,oBAAI,IAAqB;AAC9C,MAAI,YAAY;AAEhB,QAAM,WAAW,OAAU,QACxB,QAAQ,aACL,MAAM,QAAQ,WAAW,IAAI,GAAG,IAChC,aAAa,IAAI,GAAG;AAC1B,QAAM,WAAW,OAAO,KAAa,UAAkC;AACrE,QAAI,QAAQ,WAAY,OAAM,QAAQ,WAAW,IAAI,KAAK,KAAK;AAAA,QAC1D,cAAa,IAAI,KAAK,KAAK;AAAA,EAClC;AACA,QAAM,cAAc,OAAO,QAA+B;AACxD,QAAI,QAAQ,WAAY,OAAM,QAAQ,WAAW,OAAO,GAAG;AAAA,QACtD,cAAa,OAAO,GAAG;AAAA,EAC9B;AAEA,iBAAe,SACb,SACA,QACe;AACf,gCAA4B,SAAS;AAAA,MACnC;AAAA,MACA,gBAAgB;AAAA,MAChB,mBAAmB;AAAA,MACnB,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAC5C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,UAAM,WAAW,SAAS,QAAQ,SAAS,GAAG;AAC9C,UAAM,UAAU,MAAM,SAAiB,QAAQ,KAAK;AACpD,UAAM,QAAQ,QAAQ;AACtB,QAAI,QAAQ,SAAS;AACnB,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,+BAA+B,KAAK,sBAAsB,OAAO;AAAA,QAC1E,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,QAAS,OAAM,SAAS,UAAU,KAAK;AAAA,EACrD;AAEA,WAASE,cAAa,SAAwC;AAC5D,WAAO,aAAa,QAAQ,SAAS,GAAG,IAAI,QAAQ,MAAM,IAAI,QAAQ,cAAc;AAAA,EACtF;AAEA,WAAS,YAAY,SAAwC;AAC3D,WAAO,qBAAqB;AAAA,MAC1B,UAAU,QAAQ;AAAA,MAClB,KAAK,QAAQ;AAAA,MACb,OAAO,QAAQ;AAAA,MACf,qBAAqB,QAAQ;AAAA,MAC7B,SAAS,QAAQ;AAAA,IACnB,CAAC;AAAA,EACH;AAEA,iBAAe,SACb,SACsC;AACtC,UAAM,YAAY,MAAM,SAA0BA,cAAa,OAAO,CAAC;AACvE,QAAI,aAAa,UAAU,gBAAgB,YAAY,OAAO,GAAG;AAC/D,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,SACb,SACA,QACe;AACf,UAAM;AAAA,MACJA,cAAa,OAAO;AAAA,MACpB;AAAA,QACE,aAAa,YAAY,OAAO;AAAA,QAChC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,CAAC,WAAmB,SAAS,MAAM;AACpD,QAAM,iBAAiB,CAAC,WAAmB,eAAe,MAAM;AAChE,QAAM,kBAAkB,CAAC,WAAmB,iBAAiB,MAAM;AACnE,QAAM,uBAAuB,CAAC,WAAmB,4BAA4B,MAAM;AAEnF,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,aAAO;AAAA,QACL,MAAM,aAAa;AAAA,QACnB,mBAAmB;AAAA,QACnB,aAAa;AAAA,QACb,aAAa,CAAC,GAAG,aAAa,WAAW;AAAA,QACzC,mBAAmB;AAAA,QACnB,mBAAmB;AAAA,QACnB,qBAAqB;AAAA,QACrB,gBAAgB;AAAA,QAChB,aAAa,QAAQ,aAAa,SAAS;AAAA,QAC3C,mBAAmB,CAAC,GAAG,QAAQ,iBAAiB;AAAA,MAClD;AAAA,IACF;AAAA,IACA,MAAM,UAAU,SAAS;AACvB,YAAM,SAAS,SAAS,mBAAmB;AAC3C,aAAO,QAAQ,SAAS;AAAA,QACtB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,mBAAmB;AACtB,UACE,CAAC,OAAO,cAAc,QAAQ,QAAQ,aAAa,KACnD,QAAQ,QAAQ,gBAAgB,KAChC,CAAC,OAAO,cAAc,QAAQ,QAAQ,YAAY,KAClD,QAAQ,QAAQ,iBAAiB,EACjC,CAAAF,SAAQ,2EAA2E;AACrF,kBAAY,QAAQ,QAAQ,cAAc,wBAAwB;AAClE,YAAM,QAAQ,MAAM,SAAS,OAAO;AACpC,YAAM,EAAE,OAAO,aAAa,IAAI,MAAM,QAAQ,sBAAsB,OAAO;AAC3E,UACE,MAAM,SAAS,QAAQ,QAAQ,SAAS,OACxC,MAAM,KAAK,eAAe,QAAQ,QAAQ,eACzC,MAAM,KAAK,aAAa,OAAO,QAAQ,QAAQ,iBAChD,aAAa,SAAS,SAAS,QAAQ,QAAQ,gBAC/C,MAAM,KAAK,gBAAgB,eAAe,aAAa,cACvD,MAAM,KAAK,gBAAgB,SAAS,aAAa,QACjD,MAAM,KAAK,gBAAgB,SAAS,aAAa,SAAS,MAC1D;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,UAAI,CAAC,4BAA4B,cAAc,OAAO,YAAY,GAAG;AACnE,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,mBAAmB,aAAa,IAAI;AAAA,UAC7C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,OAAO,QAAQ;AACjB,cAAM,SAAS,MAAM,QAAQ,cAAc,MAAM,QAAQ,OAAO;AAChE,YAAI,QAAQ;AACV,cACE,OAAO,KAAK,iBAAiB,MAAM,UACnC,OAAO,KAAK,UAAU,QAAQ,MAAM,SAAS,OAC7C,OAAO,KAAK,gBAAgB,eAAe,aAAa,cACxD,OAAO,KAAK,gBAAgB,SAAS,aAAa,QAClD,OAAO,KAAK,gBAAgB,SAAS,aAAa,SAAS,QAC3D,CAAC,OAAO,KAAK,aAAa,SAAS,QAAQ,QAAQ,UAAU,MAC5D,OAAO,KAAK,iBAAiB,KAAK,QAAQ,QAAQ,eACnD;AACA,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AACA,iBAAO;AAAA,YACL,cAAc,MAAM;AAAA,YACpB,aAAa,QAAQ,SAAS;AAAA,YAC9B,eAAe,OAAO,KAAK,iBAAiB,QAAQ,QAAQ;AAAA,YAC5D,YAAY,QAAQ,QAAQ;AAAA,YAC5B,cAAc,QAAQ;AAAA,YACtB,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AACA,YAAM,cAAc,MAAM,OAAO,UAAU,EAAE,OAAO,aAAa,CAAC;AAClE,YAAM,eAAe;AAAA,QACnB,YAAY;AAAA,QACZ;AAAA,MACF;AACA,YAAM,gBAAgB,YAAY,iBAChC,QAAQ,QAAQ;AAClB,UACE,CAAC,OAAO,cAAc,aAAa,KACnC,gBAAgB,QAAQ,QAAQ,eAChC;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,SAAS,YAAY;AACpC,aAAO;AAAA,QACL;AAAA,QACA,aAAa,QAAQ,SAAS;AAAA,QAC9B;AAAA,QACA,YAAY,QAAQ,QAAQ;AAAA,QAC5B,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,MAAM,aAAa,SAAS;AAC1B,YAAM,SAAS,SAAS,gBAAgB;AACxC,aAAO,QAAQ,SAAS,CAAC,cAAc,GAAG,gBAAgB;AAC1D,YAAM,eAAe,YAAY,QAAQ,QAAQ,cAAc,qBAAqB;AACpF,UAAI,MAAM,SAAS,OAAO,EAAG;AAC7B,YAAM,SAAS,MAAM,SAAmB,gBAAgB,YAAY,CAAC,KAAK,CAAC;AAC3E,UAAI,OAAO,SAAS,GAAG;AACrB,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,MAAM,QAAQ,cAAc,cAAc,OAAO;AAChE,UAAI,OAAQ,OAAM,OAAO,OAAO,MAAM;AACtC,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,IACA,MAAM,eAAe,SAAS;AAC5B,YAAM,SAAS,SAAS,yBAAyB;AACjD,aAAO,QAAQ,SAAS,CAAC,cAAc,GAAG,kBAAkB;AAC5D,aAAOC,aAAY,WAAW;AAAA,IAChC;AAAA,IACA,MAAM,gBAAgB,SAAS;AAC7B,YAAM,SAAS,SAAS,0BAA0B;AAClD,aAAO,QAAQ,SAAS,CAAC,kBAAkB,eAAe,GAAG,iBAAiB;AAC9E,aAAOA,aAAY,kBAAkB;AAAA,IACvC;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,SAAS,SAAS,gBAAgB;AACxC,aAAO,QAAQ,SAAS,CAAC,gBAAgB,eAAe,GAAG,gBAAgB;AAC3E,aAAOA,aAAY,kBAAkB;AAAA,IACvC;AAAA,IACA,MAAM,iBAAiB,SAAS;AAC9B,YAAM,SAAS,SAAS,wBAAwB;AAChD,aAAO,QAAQ,SAAS,CAAC,cAAc,GAAG,wBAAwB;AAClE,aAAOA,aAAY,aAAa;AAAA,IAClC;AAAA,IACA,MAAM,eAAe,SAAS;AAC5B,YAAM,SAAS,SAAS,yBAAyB;AACjD,aAAO,QAAQ,SAAS,CAAC,gBAAgB,cAAc,GAAG,yBAAyB;AACnF,aAAOA,aAAY,aAAa;AAAA,IAClC;AAAA,IACA,MAAM,aAAa,SAAS;AAC1B,YAAM,SAAS,SAAS,uBAAuB;AAC/C,aAAO,QAAQ,SAAS,CAAC,cAAc,GAAG,gBAAgB;AAC1D,aAAOA,aAAY,SAAS;AAAA,IAC9B;AAAA,IACA,MAAM,MAAM,SAAS;AACnB,YAAM,SAAS,SAAS,eAAe;AACvC,aAAO,QAAQ,SAAS,CAAC,gBAAgB,QAAQ,GAAG,eAAe;AACnE,kBAAY,QAAQ,QAAQ,cAAc,oBAAoB;AAC9D,kBAAY,QAAQ,QAAQ,QAAQ,cAAc;AAClD,YAAM,QAAQ,MAAM,SAAS,OAAO;AACpC,UAAI,OAAO,QAAQ;AACjB,cAAME,SAAQ,MAAM,SAA6B,SAAS,MAAM,MAAM,CAAC;AACvE,YAAIA,OAAO,QAAOA;AAAA,MACpB;AACA,YAAM,SAAS,MAAM,QAAQ,cAAc,QAAQ,QAAQ,cAAc,OAAO;AAChF,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,mBAAmB,QAAQ,QAAQ,YAAY;AAAA,UACxD,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UACE,OAAO,KAAK,UAAU,UACtB,OAAO,KAAK,SAAS,WAAW,QAAQ,QAAQ,QAChD;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,4CAA4C,QAAQ,QAAQ,MAAM;AAAA,UAC3E,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,cAAc,QAAQ,uBAAuB,OAAO,KACxD,yBAAyB,WAAW;AACtC,YAAM,QAA4B;AAAA,QAChC;AAAA,QACA,cAAc,QAAQ,QAAQ;AAAA,QAC9B,aAAa,QAAQ,SAAS;AAAA,QAC9B,QAAQ,QAAQ,QAAQ;AAAA,MAC1B;AACA,YAAM,YAAY,MAAM,SAA6B,SAAS,WAAW,CAAC;AAC1E,UACE,aACA,qBAAqB,SAAS,MAAM,qBAAqB,KAAK,GAC9D;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,SAAS,WAAW,GAAG,KAAK;AAC3C,YAAM,SAAS,MAAM;AAAA,QACnB,gBAAgB,QAAQ,QAAQ,YAAY;AAAA,MAC9C,KAAK,CAAC;AACN,UAAI,CAAC,OAAO,SAAS,WAAW,GAAG;AACjC,cAAM;AAAA,UACJ,gBAAgB,QAAQ,QAAQ,YAAY;AAAA,UAC5C,CAAC,GAAG,QAAQ,WAAW;AAAA,QACzB;AAAA,MACF;AACA,YAAM,SAAS,SAAS,WAAW;AACnC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,SAAS,SAAS,iBAAiB;AACzC,aAAO,QAAQ,SAAS;AAAA,QACtB;AAAA,QACA;AAAA,QACA;AAAA,MACF,GAAG,iBAAiB;AACpB,kBAAY,QAAQ,QAAQ,aAAa,qBAAqB;AAC9D,kBAAY,QAAQ,QAAQ,aAAa,qBAAqB;AAC9D,UAAI,OAAO,QAAQ,QAAQ,aAAa,WAAW;AACjD,QAAAH,SAAQ,0CAA0C;AAAA,MACpD;AACA,YAAM,QAAQ,MAAM,SAAS,OAAO;AACpC,UAAI,OAAO,QAAQ;AACjB,cAAMI,eAAc,MAAM;AAAA,UACxB,eAAe,MAAM,MAAM;AAAA,QAC7B;AACA,YAAIA,aAAa,QAAOA;AAAA,MAC1B;AACA,YAAM,QAAQ,MAAM;AAAA,QAClB,SAAS,QAAQ,QAAQ,WAAW;AAAA,MACtC;AACA,UAAI,CAAC,SAAS,MAAM,gBAAgB,QAAQ,SAAS,KAAK;AACxD,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,MAAM,QAAQ,cAAc,MAAM,cAAc,OAAO;AACtE,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,mBAAmB,MAAM,YAAY;AAAA,UAC9C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UACE,OAAO,KAAK,aAAa,WAAW,KACpC,OAAO,KAAK,YAAY,CAAC,MAAM,kBAC/B,CAAC,QAAQ,QAAQ,UACjB;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,YAAY,MAAM,OAAO,QAAQ;AAAA,QACrC;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,aAAa,QAAQ,QAAQ;AAAA,QAC7B,UAAU,QAAQ,QAAQ;AAAA,MAC5B,CAAC;AACD,YAAM,cAAwC;AAAA,QAC5C,eAAe,UAAU;AAAA,QACzB,aAAa,MAAM;AAAA,QACnB,aAAa,QAAQ,SAAS;AAAA,QAC9B,aAAa,QAAQ,QAAQ;AAAA,QAC7B,UAAU,QAAQ,QAAQ;AAAA,MAC5B;AACA,YAAM,YAAY,MAAM;AAAA,QACtB,eAAe,YAAY,aAAa;AAAA,MAC1C;AACA,UACE,aACA,qBAAqB,SAAS,MAAM,qBAAqB,WAAW,GACpE;AACA,cAAM,OAAO,UAAU,YAAY,aAAa;AAChD,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,eAAe,YAAY,aAAa,GAAG,WAAW;AACrE,YAAM;AAAA,QACJ,qBAAqB,MAAM,WAAW;AAAA,QACtC,YAAY;AAAA,MACd;AACA,YAAM,SAAS,SAAS,YAAY,aAAa;AACjD,aAAO;AAAA,IACT;AAAA,IACA,MAAM,UAAU,SAAS;AACvB,YAAM,SAAS,SAAS,mBAAmB;AAC3C,aAAO,QAAQ,SAAS,CAAC,eAAe,GAAG,mBAAmB;AAC9D,YAAM,SAAS,YAAY,QAAQ,QAAQ,eAAe,yBAAyB;AACnF,UAAI,MAAM,SAAS,OAAO,EAAG;AAC7B,YAAM,cAAc,MAAM;AAAA,QACxB,eAAe,MAAM;AAAA,MACvB;AACA,UAAI,eAAe,YAAY,gBAAgB,QAAQ,SAAS,KAAK;AACnE,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,OAAO,UAAU,MAAM;AAC7B,YAAM,YAAY,eAAe,MAAM,CAAC;AACxC,UAAI,aAAa;AACf,cAAM,YAAY,qBAAqB,YAAY,WAAW,CAAC;AAAA,MACjE;AACA,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,SAAS,SAAS,iBAAiB;AACzC,aAAO,QAAQ,SAAS,CAAC,aAAa,GAAG,iBAAiB;AAC1D,YAAM,SAAS,YAAY,QAAQ,QAAQ,aAAa,qBAAqB;AAC7E,UAAI,MAAM,SAAS,OAAO,EAAG;AAC7B,YAAM,QAAQ,MAAM,SAA6B,SAAS,MAAM,CAAC;AACjE,UAAI,SAAS,MAAM,gBAAgB,QAAQ,SAAS,KAAK;AACvD,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,MAAM,SAAiB,qBAAqB,MAAM,CAAC,GAAG;AACxD,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,YAAY,SAAS,MAAM,CAAC;AAClC,UAAI,OAAO;AACT,cAAM,SAAS,MAAM;AAAA,UACnB,gBAAgB,MAAM,YAAY;AAAA,QACpC,KAAK,CAAC;AACN,cAAM,YAAY,OAAO,OAAO,CAAC,SAAS,SAAS,MAAM;AACzD,YAAI,UAAU,SAAS,GAAG;AACxB,gBAAM,SAAS,gBAAgB,MAAM,YAAY,GAAG,SAAS;AAAA,QAC/D,OAAO;AACL,gBAAM,YAAY,gBAAgB,MAAM,YAAY,CAAC;AAAA,QACvD;AAAA,MACF;AACA,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,IACA,MAAM,SAAS,SAAS;AACtB,YAAM,SAAS,SAAS,eAAe;AACvC,aAAO,QAAQ,SAAS,CAAC,eAAe,GAAG,eAAe;AAC1D,aAAOH,aAAY,mBAAmB;AAAA,IACxC;AAAA,EACF;AACF;;;ACnhBA,eAAeI,QAAO,OAAiC;AACrD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,qBAAqB,KAAK,CAAC;AAClE,QAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,KAAK;AACrE,SAAO,UACL,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,EACvB,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE,CACZ;AACF;AAEA,SAAS,cAAc,QAA4C;AACjE,UAAQ,QAAQ;AAAA,IACd,KAAK,QAAQ;AACX,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AAAA,IACL,KAAK,UAAU;AACb,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,WAAW;AACd,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAGA,eAAsB,6BACpB,UACA,QACkC;AAClC,QAAM,cAAuC,CAAC;AAC9C,aAAW,QAAQ,CAAC,GAAG,SAAS,UAAU,CAAC,EAAE,KAAK,GAAG;AACnD,UAAM,mBAAmB,SAAS,yBAC9B,SAAS,uBAAuB,IAAI,IACpC,uBAAuB,IAAI;AAC/B,QAAI,qBAAqB,QAAW;AAIlC;AAAA,IACF;AACA,UAAM,cAAc,uBAAuB,gBAAgB;AAC3D,UAAM,eAAwC,CAAC;AAC/C,UAAM,eAAe,MAAMA,QAAO,EAAE,aAAa,aAAa,CAAC;AAC/D,UAAM,WAAW,gBAAgB,IAAI;AACrC,UAAM,SAAS,gBAAgB,mBAAmB,MAAM,CAAC,IAAI,mBAAmB,IAAI,CAAC;AACrF,UAAM,SAAS,SAAS,gBAAgB,IAAI,KAAK;AACjD,gBAAY,KAAK;AAAA,MACf;AAAA,MACA,SAAS,SAAS,MAAM;AAAA,MACxB,aAAa,UAAU,eAAe,wBAAwB,IAAI;AAAA,MAClE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,cAAc,MAAM;AAAA,MAC1B,SAAS,CAAC,MAAM;AAAA,MAChB,qBAAqB,WAAW;AAAA,MAChC,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,IACpB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAqCA,SAASC,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAASC,aAAY,SAAkB,SAA4B,UAAwB;AACzF,MAAI,YAAY,QAAQ,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AAC7E,IAAAD,SAAQ,gBAAgB,QAAQ,oBAAoB;AAAA,EACtD;AACA,QAAM,UAAU,OAAO,KAAK,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,SAAS,KAAK,CAAC;AAC/E,MAAI,QAAQ,SAAS,GAAG;AACtB,IAAAA,SAAQ,gBAAgB,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,EACvF;AACF;AAMO,SAAS,gCACd,cACA,SAC2B;AAC3B,MAAI,CAAC,QAAQ,YAAY,UAAU,CAAC,QAAQ,kBAAkB,QAAQ;AACpE,IAAAA,SAAQ,wEAAwE;AAAA,EAClF;AACA,QAAM,mBAAmB,oBAAI,IAAuC;AACpE,QAAM,mBAAmB,oBAAI,IAA2C;AACxE,QAAM,QAAQ,8BAA8B;AAC5C,QAAM,SAAS,+BAA+B;AAAA,IAC5C;AAAA,IACA,KAAK,QAAQ;AAAA,IACb,OAAO,QAAQ;AAAA,IACf,gBAAgB,QAAQ;AAAA,IACxB,iBAAiB,QAAQ;AAAA,IACzB,cAAc;AAAA,MACZ,MAAM,QAAQ;AAAA,MACd,aAAa;AAAA,MACb,mBAAmB,QAAQ;AAAA,IAC7B;AAAA,IACA,MAAM,qBAAqB,OAAO;AAChC,YAAM,YAAY,MAAM,QAAQ,iBAAiB,MAAM,WAAW;AAClE,YAAM,UAAU,iBAAiB,IAAI,MAAM,WAAW;AACtD,UACE,CAAC,aACD,CAAC,WACD,QAAQ,WAAW,MAAM,UACzB,QAAQ,iBAAiB,MAAM,gBAC/B,UAAU,KAAK,QAAQ,SAAS,MAAM,KAAK,QAC3C,UAAU,KAAK,WAAW,MAAM,KAAK,UACrC,CAAC,MAAM,KAAK,QAAQ,SAAS,MAAM,MAAM,GACzC;AACA,eAAO;AAAA,MACT;AACA,UAAI,QAAQ,UAAU;AACpB,yBAAiB,IAAI,MAAM,aAAa,QAAQ,QAAQ;AAAA,MAC1D;AACA,aAAO;AAAA,IACT;AAAA,IACA,OAAO,SAAS,YAAY,SAAS,YAAY,QAAQ,aAAa;AACpE,UAAI,CAAC,YAAa,CAAAA,SAAQ,gDAAgD;AAC1E,YAAM,YAAY,MAAM,QAAQ,iBAAiB,WAAW;AAC5D,UACE,CAAC,aACD,UAAU,KAAK,QAAQ,SAAS,WAAW,QAC3C,UAAU,KAAK,WAAW,WAAW,UACrC,qBAAqB,UAAU,KAAK,aAAa,CAAC,CAAC,MAAM,qBAAqB,UAAU,GACxF;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,WAAW,iBAAiB,IAAI,WAAW;AACjD,YAAM,WAAW,MAAM,aAAa;AAAA,QAClC,WACI;AAAA,UACA,GAAG;AAAA,UACH,QAAQ,EAAE,GAAG,UAAU,QAAQ,SAAS;AAAA,QAC1C,IACE;AAAA,QACJ,EAAE,OAAO;AAAA,MACX;AACA,YAAM,KAAK,UAAU,QAAQ;AAAA,IAC/B;AAAA,EACF,CAAC;AAED,iBAAe,UACb,SACAE,SACe;AACf,IAAAD,aAAY,QAAQ,SAASC,SAAQ,GAAG,QAAQ,MAAM,UAAU;AAChE,QAAI,CAAE,MAAM,QAAQ,iBAAiB,OAAO,GAAI;AAC9C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,mBAAyC;AAAA,IAC7C,iBAAiB,MAAM,OAAO,gBAAgB;AAAA,IAC9C,MAAM,SAAS,SAAS;AACtB,YAAM,UAAU,SAAS,CAAC,YAAY,CAAC;AACvC,aAAO,OAAO,SAAS,OAAO;AAAA,IAChC;AAAA,IACA,MAAM,SAAS,SAAS;AACtB,YAAM,UAAU,SAAS,CAAC,QAAQ,WAAW,eAAe,CAAC;AAC7D,aAAO,OAAO,SAAS,OAAO;AAAA,IAChC;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,UAAU,SAAS;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,aAAO,OAAO,QAAQ,OAAO;AAAA,IAC/B;AAAA,IACA,MAAM,UAAU,SAAS;AACvB,YAAM,UAAU,SAAS;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,aAAO,OAAO,UAAU,OAAO;AAAA,IACjC;AAAA,IACA,OAAO,OAAO,SAAS,eAAe;AACpC,YAAM,UAAU,SAAS,CAAC,qBAAqB,uBAAuB,WAAW,CAAC;AAClF,aAAO,OAAO,OAAO,SAAS,aAAa;AAAA,IAC7C;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,UAAU,SAAS,CAAC,mBAAmB,mBAAmB,CAAC;AACjE,aAAO,OAAO,QAAQ,OAAO;AAAA,IAC/B;AAAA,IACA,MAAM,uBAAuB,SAAS;AACpC,YAAM,UAAU,SAAS,CAAC,mBAAmB,kBAAkB,gBAAgB,CAAC;AAChF,aAAO,OAAO,uBAAuB,OAAO;AAAA,IAC9C;AAAA,IACA,MAAM,gBAAgB,SAAS;AAC7B,YAAM,UAAU,SAAS,CAAC,iBAAiB,CAAC;AAC5C,aAAO,OAAO,gBAAgB,OAAO;AAAA,IACvC;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,UAAU,SAAS,CAAC,qBAAqB,iBAAiB,CAAC;AACjE,aAAO,OAAO,QAAQ,OAAO;AAAA,IAC/B;AAAA,EACF;AAEA,QAAM,kBAAuC;AAAA,IAC3C,MAAM,QAAQ,WAAW,mBAAmB,CAAC,GAAG;AAC9C,YAAM,QAAQ,iBAAiB;AAC/B,YAAM,aAAa,iBAAiB;AACpC,UAAI,CAAC,SAAS,CAAC,YAAY;AACzB,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,UAAU,CAAI,QAAgB,SAAY,QAAgB,kBAC9D,QAAQ,cAAc;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,gBAAgB,GAAG,UAAU,SAAS,GAAG,IAAI,MAAM;AAAA,QACnD;AAAA,MACF,CAAC;AACH,YAAM,WAAW,MAAM,iBAAiB;AAAA,QACtC,QAAQ,iBAAiB,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC;AAAA,MACzD;AACA,YAAM,aAAa,SAAS,MAAM;AAAA,QAChC,CAAC,cACC,UAAU,SAAS,UAAU,KAAK,QAAQ,QAC1C,UAAU,WAAW,UAAU,KAAK;AAAA,MACxC;AACA,UAAI,CAAC,YAAY;AACf,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UACE,UAAU,KAAK,QAAQ,gBACvB,UAAU,KAAK,QAAQ,iBAAiB,WAAW,cACnD;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,cAAc,MAAM,iBAAiB;AAAA,QACzC;AAAA,UACE;AAAA,UACA;AAAA,YACE,MAAM,WAAW;AAAA,YACjB,SAAS,WAAW;AAAA,YACpB,cAAc,WAAW;AAAA,YACzB,eAAe,SAAS;AAAA,YACxB,QAAQ,WAAW,QAAQ,CAAC;AAAA,YAC5B,QAAQ,WAAW;AAAA,YACnB,GAAI,UAAU,KAAK,kBAAkB,WAAW,sBAC5C,EAAE,yBAAyB,UAAU,KAAK,eAAe,IACzD,CAAC;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAS,MAAM,QAAQ,mBAAmB,WAAW,iBAAiB,MAAM;AAClF,uBAAiB,IAAI,UAAU,SAAS,KAAK,MAAM;AACnD,YAAM,gBAAgB,MAAM,iBACzB;AAAA,QACC;AAAA,UACE;AAAA,UACA;AAAA,YACE,mBAAmB,YAAY;AAAA,YAC/B,sBAAsB,OAAO;AAAA,YAC7B,cAAc,OAAO;AAAA,YACrB,OAAO,KAAK,IAAI,KAAQ,KAAK,IAAI,GAAG,UAAU,KAAK,aAAa,GAAM,CAAC;AAAA,UACzE;AAAA,UACA;AAAA,UACA,CAAC,qBAAqB,wBAAwB,gBAAgB,OAAO;AAAA,QACvE;AAAA,MACF,EACC,QAAQ,MAAM;AACb,yBAAiB,OAAO,UAAU,SAAS,GAAG;AAAA,MAChD,CAAC;AACH,UAAI;AACF,cAAM,SAAmB,CAAC;AAC1B,YAAI;AACJ,yBACQ,SAAS,iBAAiB;AAAA,UAC9B;AAAA,YACE;AAAA,YACA;AAAA,cACE,mBAAmB,YAAY;AAAA,cAC/B,qBAAqB,cAAc;AAAA,cACnC,WAAW,UAAU,KAAK,aAAa,CAAC;AAAA,YAC1C;AAAA,YACA;AAAA,YACA,CAAC,qBAAqB,uBAAuB,WAAW;AAAA,UAC1D;AAAA,UACA,EAAE,QAAQ,iBAAiB,OAAO;AAAA,QACpC,GACA;AACA,4BAAkB,MAAM;AACxB,cAAI,CAAC,MAAM,MAAO,QAAO,KAAK,MAAM,IAAI;AAAA,QAC1C;AACA,YAAI,CAAC,mBAAmB,OAAO,WAAW,GAAG;AAC3C,UAAAF,SAAQ,iEAAiE;AAAA,QAC3E;AACA,cAAM,WAAW,KAAK,MAAM,OAAO,CAAC,CAAC;AACrC,cAAM,WAAW,MAAM,iBAAiB;AAAA,UACtC,QAAQ,yBAAyB,EAAE,gBAAgB,GAAG,YAAY,CAAC,iBAAiB,CAAC;AAAA,QACvF;AACA,cAAM,iBAAiB;AAAA,UACrB;AAAA,YACE;AAAA,YACA;AAAA,cACE,mBAAmB,YAAY;AAAA,cAC/B;AAAA,YACF;AAAA,YACA;AAAA,YACA,CAAC,qBAAqB,iBAAiB;AAAA,UACzC;AAAA,QACF;AACA,eAAO;AAAA,UACL,GAAG;AAAA,UACH,QAAQ;AAAA,YACN,GAAG,SAAS;AAAA,YACZ,QAAQ;AAAA,cACN,GAAG,SAAS,QAAQ;AAAA,cACpB,aAAa,SAAS;AAAA,YACxB;AAAA,UACF;AAAA,QACF;AAAA,MACF,UAAE;AACA,yBAAiB,OAAO,UAAU,SAAS,GAAG;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,kBAAkB,gBAAgB;AAC7C;;;ACvZO,IAAM,gCAAgC;AACtC,IAAM,yBAAyB;AAE/B,IAAM,6BAA6B;AACnC,IAAM,sBAAsB;AAsH5B,SAAS,+BACd,MACA,MAC8F;AAC9F,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,4BACd,MACA,MAC2F;AAC3F,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,mBAAmB,UAAyF;AAC1H,SAAO,SAAS,SAAS;AAC3B;AAEO,SAAS,gBAAgB,UAAsF;AACpH,SAAO,SAAS,SAAS;AAC3B;AAMA,eAAsB,aACpB,OACA,OACA,MACA,MACmC;AACnC,MAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,SAAS;AACzD,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,QAAM,WAAW,+BAA+B,MAAM,IAAI;AAC1D,QAAM,WAAW,MAAM,MAAM,OAAO,OAAO,QAAQ;AACnD,SAAO;AACT;AAMA,eAAsB,kBACpB,OACA,OACA,gBACA,SACA,MAAkB,MAAM,oBAAI,KAAK,GACD;AAChC,MAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,SAAS;AACzD,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MACE,CAAC,QAAQ,kBACT,CAAC,QAAQ,wBACT,CAAC,QAAQ,mBACT,CAAC,QAAQ,yBACT,CAAC,QAAQ,MAAM,aACf,CAAC,QAAQ,MAAM,aACf,CAAC,OAAO,SAAS,QAAQ,KAAK,KAC9B,QAAQ,SAAS,GACjB;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,QAAM,qBAAqB,MAAM,MAAM,IAA0B;AAAA,IAC/D,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACD,QAAM,aAAa;AACnB,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,qBAAqB,cAAc;AAAA,MAC5C,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,QAAM,cAAc,IAAI;AACxB,QAAM,mBAAmB,IAAI,KAAK,WAAW,KAAK,SAAS;AAC3D,MAAI,CAAC,OAAO,SAAS,iBAAiB,QAAQ,CAAC,KAAK,oBAAoB,aAAa;AACnF,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,qBAAqB,cAAc;AAAA,MAC5C,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MAAI,WAAW,QAAQ,UAAU,aAAa,WAAW,QAAQ,UAAU,WAAW;AACpF,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,qBAAqB,cAAc;AAAA,MAC5C,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MAAI,WAAW,KAAK,0BAA0B,QAAQ,uBAAuB;AAC3E,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MACE,WAAW,QAAQ,UAAU,WAC7B,WAAW,OAAO,yBAAyB,QAAQ,sBACnD;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,qBAAqB,cAAc;AAAA,MAC5C,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MAAI,CAAC,MAAM,QAAQ,qBAAqB,QAAQ,gBAAgB,WAAW,KAAK,kBAAkB,GAAG;AACnG,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MACE,CAAC,MAAM,QAAQ,kBAAkB;AAAA,IAC/B;AAAA,IACA,sBAAsB,QAAQ;AAAA,IAC9B,iBAAiB,QAAQ;AAAA,IACzB,WAAW,QAAQ,MAAM;AAAA,IACzB,WAAW,QAAQ,MAAM;AAAA,EAC3B,CAAC,GACD;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,MAAI,WAAW,QAAQ,UAAU,SAAS;AACxC,UAAM,cAAsC;AAAA,MAC1C,OAAO;AAAA,MACP,sBAAsB,QAAQ;AAAA,MAC9B,SAAS,YAAY,YAAY;AAAA,IACnC;AACA,UAAM,MAAM;AAAA,MACV;AAAA,MACA;AAAA,QACE,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,iBAAiB,WAAW,SAAS,gBAAgB;AAAA,IACzD;AAAA,EACF;AAIA,QAAM,cAAc,WAAW,WAAW,SAAS,GAAG;AACtD,QAAM,0BAA0B,MAAM,MAAM,IAAuB;AAAA,IACjE,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACD,QAAM,kBAAkB;AACxB,MAAI,iBAAiB;AACnB,QAAI,gBAAgB,KAAK,yBAAyB,QAAQ,sBAAsB;AAC9E,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,qBAAqB,cAAc;AAAA,QAC5C,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,KAAK,IAAI,QAAQ,OAAO,iBAAiB,QAAQ,IAAI,YAAY,QAAQ,CAAC;AACxF,QAAM,WAAW,4BAA4B,aAAa;AAAA,IACxD,eAAe;AAAA,MACb,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAAA,IACA,sBAAsB,QAAQ;AAAA,IAC9B,iBAAiB,QAAQ;AAAA,IACzB,UAAU,WAAW,KAAK;AAAA,IAC1B,iBAAiB,WAAW,KAAK;AAAA,IACjC,KAAK,WAAW,KAAK;AAAA,IACrB,cAAc,WAAW,KAAK;AAAA,IAC9B,gBAAgB,WAAW,KAAK;AAAA,IAChC,GAAI,WAAW,KAAK,iBAAiB,EAAE,gBAAgB,WAAW,KAAK,eAAe,IAAI,CAAC;AAAA,IAC3F;AAAA,EACF,CAAC;AACD,QAAM,WAAW,MAAM,MAAM,OAAO,OAAO,QAAQ;AACnD,QAAM,UAAU;AAGhB,QAAM,WAAW,YAAY,YAAY;AACzC,QAAM,YAAY,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,EAAE,YAAY;AAEtE,QAAM,MAAM;AAAA,IACV;AAAA,IACA,EAAE,YAAY,4BAA4B,MAAM,qBAAqB,MAAM,YAAY;AAAA,IACvF;AAAA,MACE,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA,aAAa;AAAA,IACf;AAAA,IACA,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,EACtD;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ;AAAA,MACN,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA,aAAa;AAAA,IACf;AAAA,EACF;AACF;AAKA,eAAsB,oBACpB,OACA,OACA,aACA,QACA,MAAkB,MAAM,oBAAI,KAAK,GAClB;AACf,QAAM,UAAU,MAAM,MAAM,IAAuB;AAAA,IACjD,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,iBAAiB,WAAW,YAAY;AAAA,EAC1D;AACA,QAAM,MAAM;AAAA,IACV;AAAA,IACA,EAAE,YAAY,4BAA4B,MAAM,qBAAqB,MAAM,YAAY;AAAA,IACvF;AAAA,MACE,OAAO;AAAA,MACP,WAAW,IAAI,EAAE,YAAY;AAAA,MAC7B,cAAc;AAAA,IAChB;AAAA,IACA,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,EACtD;AACF;AAKO,SAAS,qBAAqB,SAAgC,MAAY,oBAAI,KAAK,GAAY;AACpG,QAAM,SAAS,QAAQ;AACvB,MAAI,QAAQ,UAAU,SAAU,QAAO;AACvC,QAAM,YAAY,OAAO;AACzB,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,IAAI,KAAK,SAAS,IAAI;AAC/B;;;AC7XA,IAAM,4BAA4B;AAyClC,SAASG,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC7E;AAEA,SAASC,aAAY,SAAwB;AAC3C,QAAM,IAAI,mBAAmB;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AACH;AAEA,eAAeC,QAAO,OAAiC;AACrD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,qBAAqB,KAAK,CAAC;AAClE,QAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,KAAK;AACrE,SAAO,UACL,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,EACvB,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE,CACZ;AACF;AAEA,SAASC,aACP,SACA,SACA,UACM;AACN,MAAI,YAAY,QAAQ,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AAC7E,IAAAH,SAAQ,2BAA2B,QAAQ,oBAAoB;AAAA,EACjE;AACA,QAAM,UAAU,OAAO,KAAK,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,SAAS,KAAK,CAAC;AAC/E,MAAI,QAAQ,SAAS,GAAG;AACtB,IAAAA;AAAA,MACE,2BAA2B,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,CAAC;AAAA,IACxF;AAAA,EACF;AACF;AAEA,SAAS,qBACP,OACA,OACA,UAAU,MACF;AACR,MACE,OAAO,UAAU,YACjB,CAAC,SACD,MAAM,SAAS,QACf,CAAAA,SAAQ,2BAA2B,KAAK,aAAa;AACvD,SAAO;AACT;AAOO,SAAS,mCACd,SAC4B;AAC5B,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,oBAAoB,QAAQ,qBAAqB;AACvD,QAAM,kBAAkB,QAAQ,mBAAmB,KAAK;AACxD,MACE,CAAC,QAAQ,QACT,CAAC,QAAQ,kBAAkB,UAC3B,CAAC,OAAO,cAAc,iBAAiB,KACvC,oBAAoB,KACpB,CAAC,OAAO,cAAc,eAAe,KACrC,kBAAkB,EAClB,CAAAA,SAAQ,qDAAqD;AAE/D,QAAM,cAAc,oBAAI,IAAgC;AACxD,QAAM,aAAa,oBAAI,IAA+B;AACtD,QAAM,aAAa,oBAAI,IAA8B;AACrD,QAAM,WAAW,oBAAI,IAA6B;AAClD,QAAM,UAAU,oBAAI,IAA4B;AAChD,QAAM,SAAS,oBAAI,IAAY;AAC/B,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,cAAc,oBAAI,IAAoB;AAE5C,iBAAe,cACb,SACmC;AACnC,QACE,QAAQ,SAAS,eAAe,iCAChC,QAAQ,SAAS,SAAS,uBAC1B,CAAAA,SAAQ,kDAAkD;AAC5D,UAAM,WAAW,MAAM,QAAQ,MAAM,IAAI;AAAA,MACvC,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,QAAQ,SAAS;AAAA,IACzB,CAAC;AACD,QACE,CAAC,YACD,SAAS,SAAS,QAAQ,QAAQ,SAAS,OAC3C,SAAS,SAAS,eAAe,QAAQ,SAAS,YAClD;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM,WAAW,aAAa;AAAA,QAC9B,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,UACb,SACA,QACAI,SACmC;AACnC,IAAAD,aAAY,QAAQ,SAASC,SAAQ,GAAG,MAAM,UAAU;AACxD,gCAA4B,SAAS;AAAA,MACnC;AAAA,MACA,gBAAgB;AAAA,MAChB,mBAAmB;AAAA,MACnB,gBAAgB;AAAA,IAClB,CAAC;AACD,QACE,QAAQ,MAAM,OAAO,QAAQ,MAAM,MACnC,QAAQ,MAAM,SAAS,QAAQ,MAAM,MACrC;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,CAAC,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAC5C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,UAAM,WAAW,MAAM,cAAc,OAAO;AAC5C,UAAM,iBAAiB,GAAG,QAAQ,SAAS,GAAG,IAAI,MAAM,IAAI,QAAQ,cAAc;AAClF,UAAM,cAAc,qBAAqB;AAAA,MACvC,UAAU,QAAQ;AAAA,MAClB,cAAc,QAAQ;AAAA,MACtB,OAAO,QAAQ;AAAA,MACf,SAAS,QAAQ;AAAA,MACjB,qBAAqB,QAAQ;AAAA,MAC7B,qBAAqB,QAAQ;AAAA,MAC7B,SAAS,QAAQ;AAAA,IACnB,CAAC;AACD,UAAM,WAAW,YAAY,IAAI,cAAc;AAC/C,QAAI,aAAa,UAAa,aAAa,aAAa;AACtD,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,2BAA2B,MAAM;AAAA,QAC1C,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,gBAAY,IAAI,gBAAgB,WAAW;AAC3C,UAAM,QAAQ,QAAQ;AACtB,QAAI,CAAC,OAAO,cAAc,KAAK,KAAM,QAAmB,GAAG;AACzD,MAAAJ,SAAQ,kDAAkD;AAAA,IAC5D;AACA,UAAM,UAAU,OAAO,IAAI,QAAQ,SAAS,GAAG,KAAK;AACpD,QAAK,QAAmB,SAAS;AAC/B,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO,IAAI,QAAQ,SAAS,KAAK,KAAe;AAChD,WAAO;AAAA,EACT;AAEA,WAAS,MACP,QACA,QACA,aACA,MACG;AACH,UAAM,QAAQ,OAAO,IAAI,MAAM;AAC/B,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,kBAAkB,IAAI;AAAA,QAC/B,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,MAAM,gBAAgB,aAAa;AACrC,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,kBAAkB,IAAI;AAAA,QAC/B,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,QAAM,SAA8C;AAAA,IAClD,MAAM,kBAAkB;AACtB,aAAO;AAAA,QACL,MAAM,QAAQ;AAAA,QACd,iBAAiB,CAAC,YAAY;AAAA,QAC9B,oBAAoB,CAAC,yBAAyB;AAAA,QAC9C,2BAA2B;AAAA,QAC3B,wBAAwB;AAAA,QACxB,kBAAkB;AAAA,QAClB;AAAA,QACA;AAAA,QACA,aAAa;AAAA,QACb,mBAAmB,QAAQ;AAAA,MAC7B;AAAA,IACF;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,WAAW,MAAM,UAAU,SAAS,mBAAmB;AAAA,QAC3D;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,UACE,QAAQ,QAAQ,WAAW,gBAC3B,QAAQ,QAAQ,YAAY,SAAS,SAAS,QAC9C,QAAQ,QAAQ,eAAe,SAAS,KAAK,cAC7C,QAAQ,QAAQ,4BACd,SAAS,KAAK,oBAChB;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,YAAY,KAAK,MAAM,SAAS,KAAK,SAAS,IAAI,IAAI,EAAE,QAAQ;AACtE,UACE,CAAC,OAAO,cAAc,SAAS,KAC/B,YAAY,KACZ,CAAC,OAAO,cAAc,QAAQ,QAAQ,KAAK,KAC3C,QAAQ,QAAQ,QAAQ,KACxB,QAAQ,QAAQ,QAAQ,gBACxB,CAAAA,SAAQ,+DAA+D;AACzE,YAAM,QAA4B;AAAA,QAChC,kBAAkB,qBAAqB,SAAS,SAAS,GAAG;AAAA,QAC5D,aAAa,SAAS,SAAS;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,SAAS,SAAS;AAAA,QAC3B,YAAY,SAAS,KAAK;AAAA,QAC1B,yBAAyB,SAAS,KAAK;AAAA,QACvC,WAAW,SAAS,KAAK;AAAA,QACzB,UAAU,SAAS,QAAQ,UAAU;AAAA,QACrC,SAAS,SAAS,QAAQ,UAAU,aAClC,SAAS,QAAQ,UAAU;AAAA,MAC/B;AACA,kBAAY,IAAI,MAAM,kBAAkB,KAAK;AAC7C,aAAO,gBAAgB,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,UAAU,SAAS;AACvB,YAAM,WAAW,MAAM,UAAU,SAAS,sBAAsB;AAAA,QAC9D;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,aAAa;AAAA,QACjB;AAAA,QACA;AAAA,UACE,QAAQ,QAAQ;AAAA,UAChB;AAAA,QACF;AAAA,QACA,SAAS,SAAS;AAAA,QAClB;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,IAAI,SAAS,SAAS,GAAG;AACjD,UACE,CAAC,WACD,QAAQ,mBAAmB,QAAQ,QAAQ,kBAC3C,WAAW,WACX,KAAK,MAAM,WAAW,SAAS,KAAK,IAAI,EAAE,QAAQ,GAClD;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UACE,CAAC,OAAO,cAAc,QAAQ,QAAQ,KAAK,KAC3C,QAAQ,QAAQ,QAAQ,KACxB,QAAQ,QAAQ,QAAQ,kBACxB,CAAAA,SAAQ,yCAAyC;AACnD,YAAM,SAAS,oBAAoB,SAAS,SAAS,GAAG,IAAI,QAAQ,QAAQ,oBAAoB;AAChG,YAAM,YAA+B;AAAA,QACnC,iBAAiB;AAAA,QACjB,kBAAkB,WAAW;AAAA,QAC7B,aAAa,SAAS,SAAS;AAAA,QAC/B,OAAO,QAAQ;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,WAAW,IAAI;AAAA,UACb,KAAK;AAAA,YACH,IAAI,EAAE,QAAQ,IAAI,QAAQ,QAAQ;AAAA,YAClC,KAAK,MAAM,SAAS,KAAK,SAAS;AAAA,UACpC;AAAA,QACF,EAAE,YAAY;AAAA,QACd,UAAU;AAAA,MACZ;AACA,iBAAW,IAAI,QAAQ,SAAS;AAChC,aAAO,gBAAgB,SAAS;AAAA,IAClC;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,WAAW,MAAM,UAAU,SAAS,mBAAmB;AAAA,QAC3D;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,MAAAG;AAAA,QACE,QAAQ,QAAQ;AAAA,QAChB,CAAC,UAAU,gBAAgB;AAAA,QAC3B;AAAA,MACF;AACA,YAAM,YAAY;AAAA,QAChB;AAAA,QACA;AAAA,UACE,QAAQ,QAAQ;AAAA,UAChB;AAAA,QACF;AAAA,QACA,SAAS,SAAS;AAAA,QAClB;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,IAAI,SAAS,SAAS,GAAG;AACjD,UACE,CAAC,WACD,UAAU,YACV,KAAK,MAAM,UAAU,SAAS,KAAK,IAAI,EAAE,QAAQ,KACjD,QAAQ,QAAQ,yBACd,QAAQ,QAAQ,wBAClB,QAAQ,QAAQ,mBAAmB,QAAQ,kBAC3C,QAAQ,QAAQ,aAAa,WAAW,6BACxC,QAAQ,QAAQ,aAAa,mBAAmB,QAAQ,kBACxD,QAAQ,QAAQ,UAAU,QAAQ,aAClC;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UACE,CAAC,MAAM,QAAQ,QAAQ;AAAA,QACrB,QAAQ,QAAQ;AAAA,QAChB,SAAS,KAAK;AAAA,MAChB,KACA,CAAC,MAAM,QAAQ,QAAQ,kBAAkB;AAAA,QACvC,gBAAgB,SAAS,SAAS;AAAA,QAClC,sBAAsB,QAAQ,QAAQ;AAAA,QACtC,iBAAiB,QAAQ,QAAQ;AAAA,QACjC,WAAW,QAAQ,QAAQ,MAAM;AAAA,QACjC,WAAW,QAAQ,QAAQ,MAAM;AAAA,MACnC,CAAC,GACD;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,gBAAU,WAAW;AACrB,YAAM,WAA6B;AAAA,QACjC,gBAAgB,mBAAmB,SAAS,SAAS,GAAG,IAAI,QAAQ,QAAQ,oBAAoB;AAAA,QAChG,aAAa,SAAS,SAAS;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,SAAS,SAAS;AAAA,QAC3B,YAAY,SAAS,KAAK;AAAA,QAC1B,gBAAgB,QAAQ,QAAQ;AAAA,QAChC,gBAAgB,QAAQ;AAAA,QACxB,mBAAmB;AAAA,QACnB,gBAAgB,QAAQ;AAAA,QACxB,UAAU,IAAI,EAAE,YAAY;AAAA,QAC5B,SAAS;AAAA,MACX;AACA,iBAAW,IAAI,SAAS,gBAAgB,QAAQ;AAChD,aAAO,gBAAgB,QAAQ;AAAA,IACjC;AAAA,IACA,MAAM,aAAa,SAAS;AAC1B,YAAM,WAAW,MAAM,UAAU,SAAS,0BAA0B;AAAA,QAClE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,WAAW;AAAA,QACf;AAAA,QACA,qBAAqB,QAAQ,QAAQ,gBAAgB,gBAAgB;AAAA,QACrE,SAAS,SAAS;AAAA,QAClB;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,IAAI,SAAS,SAAS,GAAG;AACjD,UACE,CAAC,WACD,SAAS,WACT,QAAQ,QAAQ,WAAW,gBAC3B,QAAQ,QAAQ,aAAa,SAAS,KAAK,YAC3C,QAAQ,QAAQ,mBAAmB,SAAS,kBAC5C,CAAC,OAAO,cAAc,QAAQ,QAAQ,KAAK,KAC3C,QAAQ,QAAQ,QAAQ,KACxB,QAAQ,QAAQ,QAAQ,iBACxB;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,gBAAgB,MAAM;AAAA,QAC1B,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,SAAS,SAAS;AAAA,QAClB;AAAA,UACE,GAAG,QAAQ;AAAA,UACX,OAAO,QAAQ,QAAQ;AAAA;AAAA;AAAA,UAGvB,sBAAsB,MAAM;AAAA,UAC5B,mBAAmB,MAAM;AAAA,QAC3B;AAAA,QACA;AAAA,MACF;AACA,UACE,cAAc,QAAQ,UAAU,YAChC,CAAC,cAAc,OAAO,YACtB,CAAC,cAAc,OAAO,WACtB;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,UAA2B;AAAA,QAC/B,eAAe,kBAAkB,cAAc,SAAS,IAAI;AAAA,QAC5D,gBAAgB,SAAS;AAAA,QACzB,aAAa,SAAS,SAAS;AAAA,QAC/B,QAAQ;AAAA,QACR,UAAU,cAAc,KAAK;AAAA,QAC7B,gBAAgB,SAAS;AAAA,QACzB,UAAU,cAAc,OAAO;AAAA,QAC/B,WAAW,cAAc,OAAO;AAAA,QAChC,SAAS;AAAA,MACX;AACA,eAAS,IAAI,QAAQ,eAAe,OAAO;AAC3C,aAAO,gBAAgB,OAAO;AAAA,IAChC;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,UAAU,SAAS,mBAAmB;AAAA,QAC1C;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,MAAAF;AAAA,QACE;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,WAAW,MAAM,UAAU,SAAS,mBAAmB;AAAA,QAC3D;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,WAAW;AAAA,QACf;AAAA,QACA,qBAAqB,QAAQ,QAAQ,gBAAgB,gBAAgB;AAAA,QACrE,SAAS,SAAS;AAAA,QAClB;AAAA,MACF;AACA,YAAM,SAAS,qBAAqB,QAAQ,QAAQ,QAAQ,QAAQ;AACpE,YAAM,UAAU,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE;AAAA,QACrC,CAAC,cAAc,UAAU,mBAAmB,SAAS;AAAA,MACvD;AACA,UAAI,SAAS;AACX,cAAM;AAAA,UACJ,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ,cAAc,MAAM,kBAAkB,MAAM;AAAA,UACpD;AAAA,UACA;AAAA,QACF;AACA,gBAAQ,UAAU;AAAA,MACpB;AACA,eAAS,UAAU;AACnB,eAAS,eAAe;AACxB,aAAO,gBAAgB,QAAQ;AAAA,IACjC;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,YAAM,WAAW,MAAM,UAAU,SAAS,oBAAoB,CAAC,QAAQ,CAAC;AACxE,YAAM,SAAS,qBAAqB,QAAQ,QAAQ,QAAQ,QAAQ;AACpE,YAAM,aAAoD;AAAA,QACxD,YAAY,IAAI,MAAM,IAClB,EAAE,MAAM,cAAc,OAAO,YAAY,IAAI,MAAM,EAAG,IACtD;AAAA,QACJ,WAAW,IAAI,MAAM,IACjB,EAAE,MAAM,aAAa,OAAO,WAAW,IAAI,MAAM,EAAG,IACpD;AAAA,QACJ,WAAW,IAAI,MAAM,IACjB,EAAE,MAAM,YAAY,OAAO,WAAW,IAAI,MAAM,EAAG,IACnD;AAAA,QACJ,SAAS,IAAI,MAAM,IACf,EAAE,MAAM,WAAW,OAAO,SAAS,IAAI,MAAM,EAAG,IAChD;AAAA,MACN;AACA,YAAM,QAAQ,WAAW;AAAA,QACvB,CAAC,cAAc,WAAW,MAAM,gBAAgB,SAAS,SAAS;AAAA,MACpE;AACA,aAAO,QAAQ,gBAAgB,KAAK,IAAI;AAAA,IAC1C;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,kBAAkB,gBAAgB,SAAS;AAC/C,YAAM,aAAa,MAAM,QAAQ,MAAM,IAAI;AAAA,QACzC,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,MAAM;AAAA,MACR,CAAC;AACD,UAAI,CAAC,YAAY;AACf,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,qBAAqB,cAAc;AAAA,UAC5C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UACE,CAAC,QAAQ,kBACT,QAAQ,eAAe,SAAS,QAChC,CAAC,QAAQ,wBACT,QAAQ,qBAAqB,SAAS,OACtC,CAAC,QAAQ,mBACT,QAAQ,gBAAgB,SAAS,KAAK,QACtC,CAAC,QAAQ,yBACT,QAAQ,sBAAsB,SAAS,OACvC,CAAC,QAAQ,MAAM,aACf,QAAQ,MAAM,UAAU,SAAS,KAAK,QACtC,CAAC,QAAQ,MAAM,aACf,QAAQ,MAAM,UAAU,SAAS,KAAK,QACtC,CAAC,OAAO,cAAc,QAAQ,KAAK,KACnC,QAAQ,QAAQ,EAChB,CAAAD,SAAQ,wDAAwD;AAClE,YAAM,mBAAmB,KAAK,MAAM,WAAW,KAAK,SAAS,IAC3D,IAAI,EAAE,QAAQ;AAChB,UAAI,CAAC,OAAO,cAAc,gBAAgB,KAAK,mBAAmB,GAAG;AACnE,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,qBAAqB,cAAc;AAAA,UAC5C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,OAAO,IAAI,WAAW,SAAS,GAAG,GAAG;AACvC,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,qBAAqB,cAAc;AAAA,UAC5C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,aAAO,IAAI,WAAW,SAAS,GAAG;AAClC,UAAI;AACF,cAAM,iBAAiB,MAAME,QAAO;AAAA,UAClC,uBAAuB,QAAQ;AAAA,UAC/B,UAAU,WAAW,KAAK;AAAA,UAC1B,sBAAsB,QAAQ;AAAA,QAChC,CAAC;AACD,cAAM,cAAc,MAAMA,QAAO;AAAA,UAC/B,WAAW,QAAQ,MAAM;AAAA,QAC3B,CAAC;AACD,cAAM,iBAAiB,MAAMA,QAAO;AAAA,UAClC,WAAW,QAAQ,MAAM;AAAA,UACzB,WAAW,QAAQ,MAAM;AAAA,UACzB,iBAAiB,QAAQ;AAAA,UACzB;AAAA,QACF,CAAC;AACD,gBAAQ,IAAI,WAAW,SAAS,KAAK;AAAA,UACnC;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AACD,cAAM,OAAO,CACX,QACA,SACA,QACA,kBAEA,QAAQ,cAAc;AAAA,UACpB;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO,QAAQ;AAAA,UACf,gBAAgB,GAAG,WAAW,SAAS,GAAG,IAAI,MAAM,IAAI,QAAQ,oBAAoB;AAAA,UACpF;AAAA,QACF,CAAC;AACH,cAAM,aAAa,KAAK,MAAM,WAAW,KAAK,SAAS;AACvD,cAAM,YAAY,aAAa,IAAI,EAAE,QAAQ;AAC7C,YAAI,CAAC,OAAO,cAAc,SAAS,KAAK,YAAY,GAAG;AACrD,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,qBAAqB,cAAc;AAAA,YAC5C,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,cAAM,oBAAoB,MAAM,OAAO,OAAO;AAAA,UAC5C;AAAA,UACA;AAAA,YACE,QAAQ;AAAA,YACR,SAAS,WAAW,SAAS;AAAA,YAC7B,YAAY,WAAW,KAAK;AAAA,YAC5B,yBAAyB,WAAW,KAAK;AAAA;AAAA;AAAA;AAAA,YAIzC,OAAO;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF,CAAC;AACD,cAAM,YAAY,MAAM,OAAO,UAAU;AAAA,UACvC;AAAA,UACA;AAAA,YACE,kBAAkB,kBAAkB;AAAA,YACpC;AAAA,YACA,OAAO;AAAA,UACT;AAAA,UACA;AAAA,UACA,CAAC,oBAAoB,kBAAkB,OAAO;AAAA,QAChD,CAAC;AACD,cAAM,WAAW,MAAM,OAAO,OAAO;AAAA,UACnC;AAAA,UACA;AAAA,YACE,iBAAiB,UAAU;AAAA,YAC3B,sBAAsB,QAAQ;AAAA,YAC9B;AAAA,YACA,aAAa;AAAA,cACX,QAAQ;AAAA,cACR;AAAA,YACF;AAAA,YACA,OAAO;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF,CAAC;AACD,cAAM,OAAO,aAAa;AAAA,UACxB;AAAA,UACA;AAAA,YACE,gBAAgB,SAAS;AAAA,YACzB,QAAQ;AAAA,YACR,UAAU,WAAW,KAAK;AAAA,YAC1B;AAAA,YACA,OAAO,KAAK,IAAI,QAAQ,OAAO,eAAe;AAAA,UAChD;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF,CAAC;AACD,cAAM,UAAU,MAAM,QAAQ,MAAM,IAAuB;AAAA,UACzD,YAAY;AAAA,UACZ,MAAM;AAAA,UACN,MAAM,WAAW,WAAW,SAAS,GAAG;AAAA,QAC1C,CAAC;AACD,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO;AAAA,MACT,UAAE;AACA,gBAAQ,OAAO,WAAW,SAAS,GAAG;AACtC,eAAO,OAAO,WAAW,SAAS,GAAG;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AACF;;;AC1sBO,SAAS,6BACd,OACA,QACA,SAC8B;AAC9B,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,QAAQ,QAAQ,UAAU,CAAC,OAAe,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAChG,QAAM,aAAa,QAAQ,uBAAuB;AAClD,QAAM,sBAAsB,QAAQ,uBAAuB;AAC3D,QAAM,UAAU,QAAQ,YAAY,MAAY;AAAA,EAAC;AAEjD,QAAM,iBAAiB,oBAAI,IAA4C;AACvE,MAAI,UAAU;AACd,MAAI,WAA0B,QAAQ,QAAQ;AAE9C,iBAAe,oBACb,WACA,OACe;AACf,aAAS,UAAU,GAAG,UAAU,qBAAqB,WAAW,GAAG;AACjE,YAAM,UAAU,MAAM,MAAM,IAAI,SAAS;AACzC,UAAI,CAAC,QAAS;AACd,UAAI;AACF,cAAM,MAAM;AAAA,UACV,QAAQ;AAAA,UACR;AAAA,UACA,EAAE,GAAG,QAAQ,QAAQ,GAAG,MAAM;AAAA,UAC9B,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,QACtD;AACA;AAAA,MACF,SAASG,QAAO;AACd,YAAIA,kBAAiB,sBAAsBA,OAAM,SAAS,WAAY;AACtE,cAAMA;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,aAAa,UAAU,IAAI,4BAA4B,mBAAmB;AAAA,MACnF,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,iBAAe,aAAa,SAAiC;AAC3D,eAAW,aAAa,eAAe,OAAO,GAAG;AAC/C,UAAI;AACF,cAAM,oBAAoB,WAAW,EAAE,SAAS,WAAW,IAAI,EAAE,YAAY,EAAE,CAAC;AAAA,MAClF,SAASA,QAAO;AACd,gBAAQA,MAAK;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,cAA6B;AAC1C,QAAI;AACJ,QAAI;AACF,sBAAgB,MAAM,4BAA4B,QAAQ,QAAQ,aAAa;AAAA,IACjF,SAASA,QAAO;AAGd,cAAQA,MAAK;AACb,YAAM,aAAa,KAAK;AACxB;AAAA,IACF;AAEA,eAAW,iBAAiB,cAAc,cAAc;AACtD,YAAM,YAA4C;AAAA,QAChD,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,MAAM,cAAc,SAAS;AAAA,MAC/B;AACA,UAAI;AACF,YAAI,CAAE,MAAM,MAAM,IAAI,SAAS,GAAI;AACjC,gBAAM,MAAM,OAAO,QAAQ,OAAO,aAAa;AAAA,QACjD;AAAA,MACF,SAASA,QAAO;AACd,gBAAQA,MAAK;AAAA,MACf;AAAA,IACF;AAEA,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,oBAAoB,cAAc,WAAW;AACtD,YAAM,OAAO,iBAAiB,SAAS;AACvC,UAAI,CAAC,KAAM;AACX,YAAM,YAA4C;AAAA,QAChD,YAAY;AAAA,QACZ,MAAM;AAAA,QACN;AAAA,MACF;AACA,WAAK,IAAI,IAAI;AACb,UAAI;AACF,YAAI,CAAE,MAAM,MAAM,IAAI,SAAS,GAAI;AACjC,gBAAM,MAAM,OAAO,QAAQ,OAAO,gBAAgB;AAAA,QACpD;AACA,uBAAe,IAAI,MAAM,SAAS;AAClC,cAAM,oBAAoB,WAAW;AAAA,UACnC,SAAS,cAAc,OAAO;AAAA,UAC9B,WAAW,IAAI,EAAE,YAAY;AAAA,QAC/B,CAAC;AAAA,MACH,SAASA,QAAO;AACd,gBAAQA,MAAK;AAAA,MACf;AAAA,IACF;AAGA,eAAW,CAAC,MAAM,SAAS,KAAK,CAAC,GAAG,cAAc,GAAG;AACnD,UAAI,KAAK,IAAI,IAAI,EAAG;AACpB,UAAI;AACF,cAAM,MAAM,OAAO,QAAQ,OAAO,SAAS;AAAA,MAC7C,SAASA,QAAO;AACd,gBAAQA,MAAK;AAAA,MACf;AACA,qBAAe,OAAO,IAAI;AAAA,IAC5B;AAAA,EACF;AAEA,WAAS,aAA4B;AACnC,eAAW,SAAS,KAAK,MAAM,YAAY,CAAC,EAAE,MAAM,OAAO;AAC3D,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,aAAa,MAAM;AAC7B,UAAM,YAAY;AAChB,aAAO,CAAC,SAAS;AACf,cAAM,WAAW;AACjB,YAAI,QAAS;AACb,cAAM,MAAM,UAAU;AAAA,MACxB;AAAA,IACF,GAAG,EAAE,MAAM,OAAO;AAAA,EACpB;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM,OAAO;AACX,gBAAU;AACV,YAAM,SAAS,MAAM,MAAM,MAAS;AACpC,YAAM,aAAa,KAAK;AAAA,IAC1B;AAAA,EACF;AACF;;;ACrGO,SAAS,mBAAmB,SAA4C;AAC7E,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,UAAU,QAAQ,YAAY,MAAM;AAAA,EAAC;AAC3C,QAAM,eAAe,QAAQ,gBAAgB;AAG7C,QAAM,WAAW,oBAAI,IAAkC;AAEvD,QAAM,cAAc,oBAAI,IAAgC;AAExD,QAAM,aAAa,oBAAI,IAAsB;AAE7C,WAAS,eAAe,UAAwB;AAC9C,UAAM,QAAQ,QAAQ;AACtB,QAAI,CAAC,MAAO;AACZ,UAAM,KAAK,IAAI,EAAE,QAAQ;AACzB,UAAM,cAAc,KAAK;AACzB,UAAM,OAAO,WAAW,IAAI,QAAQ,KAAK,CAAC,GAAG,OAAO,CAAC,cAAc,aAAa,WAAW;AAC3F,QAAI,IAAI,UAAU,OAAO;AACvB,YAAM,eAAe,KAAK,IAAI,GAAG,IAAI,CAAC,IAAI,MAAO,EAAE;AACnD,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,8CAA8C,KAAK;AAAA,QAC5D,WAAW;AAAA,QACX;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI,KAAK,EAAE;AACX,eAAW,IAAI,UAAU,GAAG;AAAA,EAC9B;AAEA,iBAAe,cAAc,SAAwE;AACnG,UAAM,SAAS,MAAM,QAAQ,OAAO,wBAAwB,QAAQ,cAAc;AAAA,MAChF,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,MACvE,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,IAC5E,CAAC;AAGD,QAAI,OAAO,aAAa,CAAC,QAAQ,WAAW;AAC1C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QACE,OAAO,cAAc,eAAe,QAAQ,cAAc,cAC1D,OAAO,cAAc,SAAS,QAAQ,cAAc,QACpD,OAAO,cAAc,SAAS,QAAQ,cAAc,MACpD;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,OAAO,eAAe,QAAQ,gBAAgB,OAAO,aAAa;AACpE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,mBAAe,OAAO,QAAQ;AAC9B,UAAM,aAAa,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,MAAM,aAAa,OAAO,QAAQ,EAAE;AAChG,UAAM,gBAAgB,OAAO,QAAQ;AACrC,QAAI,kBAAkB,UAAa,cAAc,eAAe;AAC9D,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,8CAA8C,aAAa;AAAA,QACpE,WAAW;AAAA,QACX,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,WAAS,YACP,SACA,QACA,QACwB;AACxB,UAAM,eAAwD,OAAO,SACjE;AAAA,MACA,YAAY,OAAO,OAAO;AAAA,MAC1B,MAAM,OAAO,OAAO;AAAA,MACpB,MAAM,OAAO,OAAO;AAAA;AAAA;AAAA,MAGpB,KAAK,OAAO,OAAO,OAAO;AAAA,IAC5B,IACE;AAGJ,WAAO;AAAA,MACL,QAAQ,QAAQ;AAAA,MAChB,MAAM;AAAA,QACJ,eAAe,OAAO;AAAA,QACtB,IAAK,OAAO,eAAe,QAAQ,iBAAiB,SAChD,EAAE,aAAa,OAAO,eAAe,QAAQ,YAAY,IACzD,CAAC;AAAA,QACL,GAAI,eAAe,EAAE,QAAQ,aAAa,IAAI,CAAC;AAAA,QAC/C,GAAI,OAAO,YAAY,SAAY,EAAE,YAAY,OAAO,QAAQ,IAAI,CAAC;AAAA,QACrE,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,QACjE,iBAAiB,OAAO;AAAA,QACxB,GAAI,OAAO,iBAAiB,SAAY,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,QACjF,GAAI,QAAQ,wBAAwB,SAAY,EAAE,qBAAqB,QAAQ,oBAAoB,IAAI,CAAC;AAAA,MAC1G;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,OAAOC,SAA+C;AACnE,QAAI;AACF,YAAM,QAAQ,UAAU,WAAWA,OAAM;AAAA,IAC3C,SAASC,QAAO;AACd,cAAQA,MAAK;AAAA,IACf;AAAA,EACF;AAEA,kBAAgB,SAAS,SAAuE;AAC9F,UAAM,YAAY,IAAI;AACtB,UAAM,SAAS,MAAM,cAAc,OAAO;AAC1C,gBAAY,IAAI,OAAO,UAAU,OAAO,QAAQ,IAAI;AACpD,aAAS,IAAI,QAAQ,QAAQ,EAAE,UAAU,OAAO,SAAS,CAAC;AAI1D,UAAM,kBAAkB,OAAO,QAAQ;AACvC,UAAM,mBAAyC;AAAA,MAC7C,GAAG;AAAA,MACH,GAAI,oBAAoB,SACpB,EAAE,iBAAiB,KAAK,IAAI,QAAQ,mBAAmB,iBAAiB,eAAe,EAAE,IACzF,CAAC;AAAA,IACP;AAEA,QAAI,cAAc;AAClB,QAAI,eAAe;AACnB,QAAI,QAAwC;AAC5C,QAAI;AAEJ,QAAI;AACF,uBAAiB,SAAS,QAAQ,SAAS,SAAS,gBAAgB,GAAG;AACrE,YAAI,MAAM,SAAS,SAAS;AAE1B,wBAAc,KAAK,IAAI,aAAa,MAAM,OAAO,eAAe,CAAC;AACjE,yBAAe,KAAK,IAAI,cAAc,MAAM,OAAO,gBAAgB,CAAC;AACpE,gBAAM,QAAQ,cAAc,gBAAgB;AAC5C,gBAAM,YAAY,OAAO,QAAQ,mBAAmB,UAAa,cAAc,OAAO,OAAO;AAC7F,gBAAM,aAAa,OAAO,QAAQ,oBAAoB,UAAa,eAAe,OAAO,OAAO;AAChG,gBAAM,WAAW,OAAO,QAAQ,YAAY,UAAa,OAAO,OAAO,OAAO;AAC9E,cAAI,aAAa,cAAc,UAAU;AACvC,oBAAQ;AACR,sBAAU;AAAA,cACR,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,kBAAM,QAAQ,SAAS,SAAS,QAAQ,MAAM;AAC9C,kBAAM,EAAE,MAAM,SAAS,OAAO,QAAQ;AACtC;AAAA,UACF;AACA;AAAA,QACF;AACA,YAAI,MAAM,SAAS,SAAS;AAC1B,kBAAQ,MAAM,OAAO,SAAS,cAAc,cAAc;AAC1D,oBAAU,MAAM;AAAA,QAClB;AACA,cAAM;AAAA,MACR;AACA,UAAI,UAAU,eAAe,QAAQ,QAAQ,SAAS;AACpD,gBAAQ;AAAA,MACV;AAAA,IACF,SAASA,QAAO;AACd,cAAQ;AACR,gBAAUA,kBAAiB,qBACvB,EAAE,MAAMA,OAAM,MAAM,SAASA,OAAM,SAAS,WAAWA,OAAM,UAAU,IACvE,EAAE,MAAM,YAAY,SAASA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK,GAAG,WAAW,MAAM;AAC1G,YAAMA;AAAA,IACR,UAAE;AACA,eAAS,OAAO,QAAQ,MAAM;AAC9B,YAAM,cAAc,IAAI;AACxB,YAAM,OAAO,YAAY,SAAS,QAAQ;AAAA,QACxC;AAAA,QACA,OAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA,OAAO,cAAc,gBAAgB;AAAA,UACrC,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,QACzE;AAAA,QACA,WAAW,YAAY,QAAQ,IAAI,UAAU,QAAQ;AAAA,QACrD,WAAW,UAAU,YAAY;AAAA,QACjC,aAAa,YAAY,YAAY;AAAA,QACrC,GAAI,UAAU,EAAE,OAAO,QAAQ,IAAI,CAAC;AAAA,MACtC,CAAC,CAAC;AAAA,IACJ;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,aAAa;AACjB,UAAI,CAAC,QAAQ,SAAS,WAAY,QAAO,CAAC;AAC1C,aAAO,QAAQ,SAAS,WAAW;AAAA,IACrC;AAAA,IACA,MAAM,YAAY;AAChB,UAAI,QAAQ,SAAS,UAAW,QAAO,QAAQ,SAAS,UAAU;AAClE,aAAO,EAAE,SAAS,MAAM,QAAQ,iBAAiB,WAAW,IAAI,EAAE,YAAY,EAAE;AAAA,IAClF;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAgB;AAC3B,YAAM,QAAQ,SAAS,SAAS,MAAM;AAAA,IACxC;AAAA,IACA,aAAa,UAAkB;AAC7B,cAAQ,OAAO,wBAAwB,QAAQ;AAC/C,iBAAW,CAAC,QAAQ,KAAK,KAAK,UAAU;AACtC,YAAI,MAAM,aAAa,SAAU,MAAK,QAAQ,SAAS,SAAS,MAAM;AAAA,MACxE;AAAA,IACF;AAAA,IACA,iBAAiB,SAAiB;AAChC,iBAAW,CAAC,UAAU,SAAS,KAAK,aAAa;AAC/C,YAAI,cAAc,SAAS;AACzB,kBAAQ,OAAO,wBAAwB,QAAQ;AAC/C,qBAAW,CAAC,QAAQ,KAAK,KAAK,UAAU;AACtC,gBAAI,MAAM,aAAa,SAAU,MAAK,QAAQ,SAAS,SAAS,MAAM;AAAA,UACxE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AA+CO,SAAS,iCAAiC,SAA0D;AACzG,MAAI,WAAW;AACf,SAAO;AAAA,IACL,MAAM,QAAQ,QAAQ;AAAA,IACtB,SAAS,QAAQ,YACd,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ,QAAQ,cAAc;AAAA,IAC7E,OAAO,QAAQ;AAAA,IACf,KAAK,SAAkB;AACrB,YAAM,SAAU,WAAW,CAAC;AAW5B,kBAAY;AACZ,YAAM,iBAAiB,OAAO,OAAO,mBAAmB,WAAW,OAAO,iBAAiB;AAC3F,YAAM,SAAS,QAAQ,mBAAmB,SAAS,QAAQ,KAAK,QAAQ,cAAc,IAAI,QAAQ;AAClG,YAAM,WAAY,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAW,CAAC;AACtE,YAAM,eAAe,QAAQ,mBAAmB,OAAO,KAAK,QAAQ;AAEpE,cAAQ,mBAAyD;AAC/D,cAAM,gBAAgB,QAAQ,yBAAyB,OAAO,KAAK;AAAA,UACjE,eAAe,QAAQ;AAAA,UACvB,GAAI,QAAQ,gBAAgB,SAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,QAClF;AACA,cAAM,SAAS,MAAM,QAAQ,OAAO,uBAAuB;AAAA,UACzD,eAAe,cAAc;AAAA,UAC7B,GAAI,cAAc,gBAAgB,SAAY,EAAE,aAAa,cAAc,YAAY,IAAI,CAAC;AAAA,UAC5F,GAAI,QAAQ,iBAAiB,SAAY,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;AAAA,UACnF,GAAI,eAAe,EAAE,QAAQ,aAAa,IAAI,CAAC;AAAA,UAC/C,GAAI,gBAAgB,QAAQ,YAAY,SACpC,EAAE,SAAS,QAAQ,QAAQ,IAC3B,CAAC;AAAA,UACL,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,UAC1E,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,UACjE,GAAI,QAAQ,gBAAgB,SAAY,EAAE,OAAO,QAAQ,YAAY,IAAI,CAAC;AAAA,QAC5E,CAAC;AACD,YAAI;AACF,2BACQ,SAAS,QAAQ,QAAQ,SAAS;AAAA,YACtC;AAAA,YACA,eAAe,cAAc;AAAA,YAC7B,GAAI,cAAc,gBAAgB,SAAY,EAAE,aAAa,cAAc,YAAY,IAAI,CAAC;AAAA,YAC5F;AAAA,YACA,GAAI,OAAO,OAAO,oBAAoB,WAClC,EAAE,iBAAiB,OAAO,gBAAgB,IAC1C,OAAO,OAAO,eAAe,WAC7B,EAAE,iBAAiB,OAAO,WAAW,IACrC,CAAC;AAAA,YACL,GAAI,OAAO,OAAO,gBAAgB,WAAW,EAAE,aAAa,OAAO,YAAY,IAAI,CAAC;AAAA,YACpF,GAAI,OAAO,OAAO,SAAS,WAAW,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,YAC/D,GAAI,OAAO,oBAAoB,QAAQ,OAAO,OAAO,oBAAoB,WACrE;AAAA,cACA,iBAAiB,OAAO;AAAA,YAC1B,IACE,CAAC;AAAA,YACL,cAAc,OAAO;AAAA,YACrB,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,YAC1E,GAAI,OAAO,eAAe,OAAO,SAC7B,EAAE,QAAQ,OAAO,eAAe,OAAO,OAAO,IAC9C,CAAC;AAAA,UACP,CAAC,GACD;AACA,gBAAI,MAAM,SAAS,WAAW,MAAM,UAAU,QAAW;AACvD,oBAAM,MAAM;AAAA,YACd,WAAW,MAAM,SAAS,SAAS;AACjC,oBAAM,IAAI;AAAA,gBACP,MAAM,SAAgD;AAAA,kBACrD,MAAM;AAAA,kBACN,SAAS;AAAA,kBACT,WAAW;AAAA,gBACb;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF,UAAE;AAEA,kBAAQ,OAAO,wBAAwB,OAAO,OAAO,QAAQ;AAAA,QAC/D;AAAA,MACF,GAAG;AAAA,IACL;AAAA,EACF;AACF;;;AChZA,SAAS,gBAAgB,OAAiD;AACxE,SAAO,SAAS,QAAQ,OAAO,UAAU,YAAY,OAAO,iBAAiB;AAC/E;AAEA,SAAS,oBAAoB,OAAgB,iBAAkE;AAC7G,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,OAAO,mBAAmB,MAAM,SAAS,kBAAkB,GAAG,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ;AAC3G,WAAO,EAAE,KAAK;AAAA,EAChB;AACA,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,QAAI,OAAO;AACX,QAAI,aAAa,SAAS,OAAO,MAAM,YAAY,UAAU;AAC3D,aAAO,MAAM;AAAA,IACf,WAAW,YAAY,SAAS,OAAO,MAAM,WAAW,UAAU;AAChE,aAAO,MAAM;AAAA,IACf,OAAO;AACL,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AACA,UAAM,YAAY,mBAAmB,KAAK,SAAS,kBAAkB,GAAG,KAAK,MAAM,GAAG,eAAe,CAAC,QAAQ;AAC9G,WAAO,EAAE,MAAM,WAAW,YAAY,MAAM;AAAA,EAC9C;AACA,SAAO,EAAE,MAAM,OAAO,KAAK,EAAE;AAC/B;AAEO,SAAS,mCACd,UACA,SACqB;AACrB,iBAAe,QACb,WACA,mBAII,CAAC,GAC2B;AAChC,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,UAAM,SAAS,UAAU,KAAK,QAAQ;AAEtC,UAAM,gBAAqC;AAAA,MACzC,GAAG,UAAU;AAAA,MACb,OAAO;AAAA,MACP;AAAA,MACA,WAAW,UAAU,QAAQ,YAAY,KAAK;AAAA,IAChD;AACA,UAAM,mBAA0C,EAAE,GAAG,WAAW,QAAQ,cAAc;AACtF,QAAI;AAEJ,aAAS,wBAA+C;AACtD,UAAI,CAAC,SAAU,QAAO;AACtB,aAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ;AAAA,UACN,GAAG,iBAAiB;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,iBAAiB,QAAQ,SAAS;AACpC,aAAO,OAAO;AAAA,QACZ,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,MACF,CAAC;AAAA,IACH;AAEA,mBAAe,MACb,kBACA,QACe;AACf,UAAI;AACF,cAAM,QAAQ,UAAU,kBAAkB,MAAM;AAAA,MAClD,QAAQ;AAAA,MAGR;AAAA,IACF;AAEA,mBAAe,OACb,QACgC;AAChC,YAAM,mBAAmB,sBAAsB;AAC/C,YAAM,MAAM,kBAAkB,MAAM;AACpC,aAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ;AAAA,UACN,GAAG,iBAAiB;AAAA,UACpB,OAAO;AAAA,UACP;AAAA,UACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACtC;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACJ,QAAI,QAAQ,WAAW;AACrB,YAAM,WAAW,sBAAsB,QAAQ,WAAW,SAAS;AACnE,UAAI,SAAS,WAAW,QAAQ;AAC9B,eAAO,OAAO;AAAA,UACZ,OAAO;AAAA,YACL,MAAM;AAAA,YACN,SAAS,SAAS,UAAU,qDAAqD,SAAS,MAAM;AAAA,YAChG,WAAW;AAAA,YACX,SAAS,EAAE,iBAAiB,SAAS,OAAO;AAAA,UAC9C;AAAA,QACF,CAAC;AAAA,MACH;AACA,UAAI,SAAS,WAAW,oBAAoB;AAC1C,yBAAiB,SAAS,UACxB,oCAAoC,SAAS,MAAM;AAAA,MACvD;AAAA,IACF;AAEA,QAAI,UAAU,KAAK,QAAQ,iBAAiB;AAC1C,yBAAmB;AAAA,IACrB;AAEA,QAAI,gBAAgB;AAClB,UAAI,CAAC,QAAQ,gBAAgB;AAC3B,eAAO,OAAO;AAAA,UACZ,OAAO;AAAA,YACL,MAAM;AAAA,YACN,SAAS,GAAG,cAAc;AAAA,YAC1B,WAAW;AAAA,UACb;AAAA,QACF,CAAC;AAAA,MACH;AACA,UAAI;AACF,cAAM,WAAW,MAAM,QAAQ,eAAe,gBAAgB;AAAA,UAC5D,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,QAAQ,iBAAiB;AAAA,QAC3B,CAAC;AACD,YACE,CAAC,SAAS,cACV,CAAC,SAAS,SACV,CAAC,SAAS,aACT,SAAS,aAAa,WAAW,SAAS,aAAa,UACxD,OAAO,MAAM,KAAK,MAAM,SAAS,SAAS,CAAC,GAC3C;AACA,iBAAO,MAAM,OAAO;AAAA,YAClB,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF,CAAC;AAAA,QACH;AACA,mBAAW;AACX,YAAI,iBAAiB,QAAQ,SAAS;AACpC,iBAAO,MAAM,OAAO;AAAA,YAClB,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF,CAAC;AAAA,QACH;AACA,YAAI,SAAS,aAAa,SAAS;AACjC,iBAAO,MAAM,OAAO;AAAA,YAClB,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,SAAS,UAAU;AAAA,cAC5B,WAAW;AAAA,YACb;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,QAAQ;AACN,eAAO,OAAO;AAAA,UACZ,OAAO;AAAA,YACL,MAAM,iBAAiB,QAAQ,UAC3B,cACA;AAAA,YACJ,SAAS,iBAAiB,QAAQ,UAC9B,yCACA;AAAA,YACJ,WAAW;AAAA,UACb;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,OAAO,SAAS,QAAQ,MAAM;AACpC,QAAI,OAAO,SAAS,YAAY;AAC9B,aAAO,OAAO;AAAA,QACZ,OAAO,EAAE,MAAM,eAAe,SAAS,SAAS,MAAM,6CAA6C,WAAW,MAAM;AAAA,MACtH,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,OAAO;AACb,YAAM,mBAAuC,iBAAiB,SAC1D,EAAE,GAAG,QAAQ,SAAS,iBAAiB,iBAAiB,OAAO,IAC/D,QAAQ;AACZ,YAAM,MAAM,MAAM,KAAK,UAAU,KAAK,aAAa,CAAC,GAAG,gBAAgB;AACvE,UAAI;AACJ,UAAI,gBAAgB,GAAG,GAAG;AACxB,cAAM,SAAoB,CAAC;AAC3B,cAAM,WAAW,IAAI,OAAO,aAAa,EAAE;AAC3C,YAAI;AACF,iBAAO,MAAM;AACX,gBAAI,iBAAiB,QAAQ,SAAS;AACpC,oBAAM,IAAI,aAAa,2BAA2B,YAAY;AAAA,YAChE;AACA,kBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,gBAAI,KAAK,KAAM;AACf,mBAAO,KAAK,KAAK,KAAK;AAAA,UACxB;AAAA,QACF,UAAE;AACA,gBAAM,SAAS,SAAS;AAAA,QAC1B;AACA,gBAAQ;AAAA,MACV,OAAO;AACL,gBAAQ;AAAA,MACV;AAEA,YAAM,EAAE,MAAM,WAAW,IAAI,oBAAoB,OAAO,QAAQ,eAAe;AAC/E,YAAM,SAA8B,EAAE,OAAO,cAAc,KAAK;AAChE,YAAM,mBAAmB,sBAAsB;AAC/C,YAAM,MAAM,kBAAkB,MAAM;AACpC,aAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ;AAAA,UACN,GAAG,iBAAiB;AAAA,UACpB,OAAO;AAAA,UACP;AAAA,UACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACtC;AAAA,MACF;AAAA,IACF,SAASC,QAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ;AACzC,YAAM,UAAU,UACZ,4BACAA,kBAAiB,QACjBA,OAAM,UACN,OAAOA,MAAK;AAChB,aAAO,OAAO;AAAA,QACZ,OAAO;AAAA,UACL,MAAM,UAAU,cAAc;AAAA,UAC9B;AAAA,UACA,WAAW;AAAA,QACb;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ;AACnB;;;AC/NO,SAAS,sCACd,OACA,SACuC;AACvC,QAAM,UAAU,IAAI,IAAI,QAAQ,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,KAAK,CAAC,CAAC;AAC3E,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,sBAAsB,QAAQ,uBAAuB;AAC3D,QAAM,QAAQ,QAAQ,UAAU,CAAC,OAAe,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAChG,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,UAAU,QAAQ,YAAY,MAAY;AAAA,EAAC;AACjD,QAAM,SAAS,oBAAI,IAAY;AAC/B,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,QAAM,aAAa,IAAI,gBAAgB;AACvC,MAAI,UAAU;AAEd,iBAAe,kBAAkB,OAAgE;AAC/F,UAAM,QAAQ,MAAM,aAAa;AACjC,WAAO,CAAC,SAAS;AACf,YAAM,UAAU,eAAe,IAAI,MAAM,IAAI,KAAK;AAClD,UAAI,UAAU,UAAa,UAAU,OAAO;AAC1C,uBAAe,IAAI,MAAM,MAAM,UAAU,CAAC;AAC1C,eAAO;AAAA,MACT;AACA,YAAM,MAAM,cAAc;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AAEA,WAAS,kBAAkB,MAAoB;AAC7C,UAAM,UAAU,eAAe,IAAI,IAAI,KAAK;AAC5C,QAAI,WAAW,EAAG,gBAAe,OAAO,IAAI;AAAA,QACvC,gBAAe,IAAI,MAAM,UAAU,CAAC;AAAA,EAC3C;AAEA,WAAS,YAAY,UAA0D;AAC7E,WAAO;AAAA,MACL,YAAY,SAAS;AAAA,MACrB,MAAM,SAAS;AAAA,MACf,MAAM,SAAS,SAAS;AAAA,MACxB,WAAW,SAAS,SAAS;AAAA,IAC/B;AAAA,EACF;AAEA,WAAS,QAAQ,UAA8C;AAC7D,WAAO,SAAS,SAAS,sBACpB,SAAmC,KAAK,WAAW,eACnD,SAAmC,KAAK,WAAW;AAAA,EAC1D;AAEA,WAAS,eAAe,UAAiE;AACvF,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,GAAG,SAAS,SAAS,IAAI;AAAA,MAC/B,WAAW,SAAS,SAAS;AAAA,IAC/B;AAAA,EACF;AAEA,iBAAe,UAAU,UAA0E;AACjG,UAAM,YAAY,eAAe,QAAQ;AACzC,QAAI,MAAM,MAAM,IAAI,SAAS,EAAG,QAAO;AACvC,UAAM,WAAW,uBAAuB,UAAU,MAAO;AAAA,MACvD,aAAa;AAAA,QACX,YAAY,SAAS;AAAA,QACrB,MAAM,SAAS;AAAA,QACf,MAAM,SAAS,SAAS;AAAA,QACxB,WAAW,SAAS,SAAS;AAAA,QAC7B,KAAK,SAAS,SAAS;AAAA,MACzB;AAAA,IACF,CAAC;AACD,aAAS,SAAS,YAAY,SAAS,SAAS;AAChD,QAAI;AACF,YAAM,MAAM,OAAO,QAAQ,OAAO,QAAQ;AAAA,IAC5C,SAASC,QAAO;AACd,UAAI,EAAEA,kBAAiB,uBAAuBA,OAAM,SAAS,WAAY,OAAMA;AAAA,IACjF;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,aACb,WACA,OACe;AACf,aAAS,UAAU,GAAG,UAAU,qBAAqB,WAAW,GAAG;AACjE,YAAM,UAAU,MAAM,MAAM,IAAsC,SAAS;AAC3E,UAAI,CAAC,QAAS;AACd,UAAI;AACF,cAAM,MAAM,aAAa,QAAQ,OAAO,WAAW,MAAM,QAAQ,MAAM,GAAG;AAAA,UACxE,iBAAiB,QAAQ,SAAS;AAAA,QACpC,CAAC;AACD;AAAA,MACF,SAASA,QAAO;AACd,YAAIA,kBAAiB,sBAAsBA,OAAM,SAAS,WAAY;AACtE,cAAMA;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,+BAA+B,UAAU,QAAQ,EAAE,cAAc,mBAAmB;AAAA,MAC7F,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,WAAW,UAAiE;AACnF,UAAM,WAAW,QAAQ,QAAQ;AACjC,UAAM,QAAQ,WAAW,QAAQ,IAAI,QAAQ,IAAI;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,0BAA0B,YAAY,EAAE;AAAA,QACjD,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,CAAC,MAAM,aAAa,QAAQ,SAAS,SAAS,IAAyC,GAAG;AAC5F,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,0BAA0B,QAAQ,qBAAqB,SAAS,IAAI;AAAA,QAC7E,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,CAAC,MAAM,aAAa,kBAAkB;AACxC,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,0BAA0B,QAAQ;AAAA,QAC3C,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,KAAK,UAA0BA,QAA+B;AAC3E,UAAM,UAAU,cAAcA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK,CAAC;AACpF,QAAI,SAAS,SAAS,qBAAqB;AACzC,YAAM,aAA6B,eAAe,QAAiC,GAAG,OAAO;AAAA,QAC3F,OAAO;AAAA,QACP,SAAS;AAAA,QACT,UAAU;AAAA,MACZ,EAAE;AACF,YAAM,aAAkC,YAAY,QAAQ,GAAG,CAAC,aAAa;AAAA,QAC3E,GAAG;AAAA,QACH,OAAO;AAAA,QACP,eAAe;AAAA,MACjB,EAAE;AAAA,IACJ,OAAO;AACL,YAAM,aAAkC,YAAY,QAAQ,GAAG,CAAC,aAAa;AAAA,QAC3E,GAAG;AAAA,QACH,OAAO;AAAA,QACP,QAAQ;AAAA,UACN,OAAO;AAAA,YACL,MAAMA,kBAAiB,qBAAqBA,OAAM,OAAO;AAAA,YACzD;AAAA,YACA,WAAWA,kBAAiB,qBAAqBA,OAAM,YAAY;AAAA,UACrE;AAAA,QACF;AAAA,QACA,aAAa,IAAI,EAAE,YAAY;AAAA,MACjC,EAAE;AAAA,IACJ;AAAA,EACF;AAEA,iBAAe,sBACb,UACA,UACkB;AAClB,UAAM,WAAW,SAAS,UAAU,eAAe,SAAS,UAAU,YAAY,SAAS,UAAU;AACrG,UAAM,gBAAgB,SAAS,UAAU,eAAe,SAAS,kBAAkB;AACnF,UAAM,cAAc,gBAAgB,WAAW,SAAS,eAAe;AACvE,UAAM,YAAY,SAAS,UAAU,eAAe,gBAAgB;AACpE,UAAM,YAAY,SAAS,UAAU,eAAe,gBAAgB;AACpE,UAAM,UAAU;AAAA,MACd,SAAS,eAAe,WACtB,SAAS,eAAe,OAAO,YAC9B,gBAAgB,+DAA+D,SAAS;AAAA,IAC7F;AACA,UAAM,eAAe,eAAe,QAAQ;AAC5C,UAAM,aAA6B,cAAc,OAAO;AAAA,MACtD,OAAO,YACH,cACA,YACA,cACA,WACA,WACA;AAAA,MACJ,GAAI,YAAY,SAAY,EAAE,SAAS,QAAQ,IAAI,CAAC;AAAA,MACpD,GAAI,WAAW,EAAE,UAAU,YAAY,IAAI,EAAE,IAAI,CAAC;AAAA,IACpD,EAAE;AACF,UAAM,aAAkC,YAAY,QAAQ,GAAG,CAAC,aAAa;AAAA,MAC3E,GAAG;AAAA,MACH,OAAO,YACH,cACA,WACA,WACA,SAAS,UAAU,YACnB,eACA;AAAA,MACJ,GAAI,YAAY,SAAY,EAAE,eAAe,QAAQ,IAAI,CAAC;AAAA,IAC5D,EAAE;AACF,WAAO;AAAA,EACT;AAEA,iBAAe,kBACb,UACA,UACA,UACkB;AAClB,UAAM,WAAW,SAAS,UAAU,eAAe,SAAS,UAAU,YAAY,SAAS,UAAU;AACrG,UAAM,gBAAgB,SAAS,UAAU,eAAe,SAAS,kBAAkB;AACnF,UAAM,cAAc,gBAAgB,WAAW,SAAS,eAAe;AACvE,UAAM,YAAY,SAAS,UAAU,eAAe,gBAAgB;AACpE,UAAM,YAAY,SAAS,UAAU,eAAe,gBAAgB;AACpE,UAAM,iBAAiB,aAAa,SAAS,eAAe,SACxD,cAAc,SAAS,cAAc,MAAM,IAC3C;AACJ,QAAI,WAAW;AACb;AAAA,QACE;AAAA,QACA,SAAS,eAAe,QAAQ;AAAA,MAClC;AAAA,IACF;AACA,UAAMA,SAAQ,SAAS,eAAe,UAAU,gBAC5C,EAAE,MAAM,WAAW,SAAS,8DAA8D,WAAW,MAAM,IAC3G,SAAS,UAAU,WACnB,EAAE,MAAM,YAAY,SAAS,SAAS,WAAW,kCAAkC,WAAW,MAAM,IACpG;AACJ,UAAM,aAAkC,YAAY,QAAQ,GAAG,CAAC,aAAa;AAAA,MAC3E,GAAG;AAAA,MACH,OAAO,YACH,cACA,YACA,cACA,WACA,WACA,SAAS,UAAU,YACnB,YACA;AAAA,MACJ,GAAI,iBAAiB,EAAE,QAAQ,eAAe,IAAIA,SAAQ,EAAE,QAAQ,EAAE,OAAO,cAAcA,MAAK,EAAE,EAAE,IAAI,CAAC;AAAA,MACzG,GAAI,WAAW,EAAE,aAAa,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC;AAAA,IACzD,EAAE;AACF,WAAO;AAAA,EACT;AAEA,iBAAe,kBAAkB,UAAgD;AAC/E,UAAM,QAAQ,WAAW,QAAQ;AACjC,UAAM,UAAU;AAAA,MACd;AAAA,MACA,MAAM,aAAa;AAAA,IACrB;AACA,qCAAiC,UAAU,OAAO;AAClD,UAAM,YAAY,YAAY,QAAQ;AACtC,UAAM,eAAe,MAAM,UAAU,QAAQ;AAC7C,UAAM,SAAS,MAAM,MAAM,IAAI,SAAS;AACxC,QAAI,aAAa,QAAQ,QAAQ,cAAc,SAAS,QAAQ;AAChE,QAAI,CAAC,YAAY;AACf,UAAI,CAAC,QAAQ,4BAA4B;AACvC,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,gBAAgB,MAAM,QAAQ,2BAA2B,UAAU,KAAK;AAC9E,YAAM,SAAS,MAAM,MAAM,OAAO,UAAU;AAC5C,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI,mBAAmB,EAAE,MAAM,eAAe,SAAS,0BAA0B,MAAM,IAAI,kBAAkB,WAAW,KAAK,CAAC;AAAA,MACtI;AACA,YAAM,aAAkC,WAAW,CAAC,aAAa;AAAA,QAC/D,GAAG;AAAA,QACH,OAAO;AAAA,QACP,gBAAgB,MAAM;AAAA,QACtB,MAAM,CAAC,YAAY;AAAA,QACnB,sBAAsB,cAAc;AAAA,QACpC,uBAAuB,cAAc;AAAA,MACvC,EAAE;AACF,UAAI;AACJ,UAAI,SAAS,KAAK,iBAAiB;AACjC,uBAAe,MAAM,QAAQ,sBAAsB,SAAS,KAAK,eAAe;AAChF,YAAI,iBAAiB,QAAW;AAC9B,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,oBAAoB,SAAS,KAAK,eAAe;AAAA,YAC1D,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,YAAM,kBAAkB,MAAM,QAAQ,wBAAwB,UAAU,YAAY;AACpF,YAAM,SAAS,MAAM,MAAM,OAAO,cAAc,UAAU,QAAQ,OAAO;AAAA,QACvE,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC;AAAA,QACrD,GAAI,oBAAoB,SAAY,EAAE,gBAAgB,IAAI,CAAC;AAAA,MAC7D,CAAC;AACD,mBAAa,OAAO;AACpB,YAAM,aAAkC,WAAW,CAAC,aAAa;AAAA,QAC/D,GAAG;AAAA,QACH,OAAO;AAAA,QACP,gBAAgB,MAAM;AAAA,QACtB,cAAc,OAAO;AAAA,QACrB,YAAY,OAAO;AAAA,QACnB,MAAM,CAAC,YAAY;AAAA,QACnB,GAAI,OAAO,mBAAmB,EAAE,kBAAkB,OAAO,iBAAiB,IAAI,CAAC;AAAA,MACjF,EAAE;AACF,YAAM,aAA6B,cAAc,OAAO,EAAE,OAAO,UAAU,EAAE;AAAA,IAC/E;AACA,WAAO,CAAC,SAAS;AACf,YAAM,WAAW,MAAM,MAAM,OAAO,kBAAkB,UAAU;AAChE,UAAI,MAAM,sBAAsB,UAAU,QAAQ,EAAG;AACrD,YAAM,MAAM,cAAc;AAAA,IAC5B;AAAA,EACF;AAEA,iBAAe,uBAAuB,UAAgD;AACpF,UAAM,QAAQ,WAAW,QAAQ;AACjC,UAAM,eAAe,SAAS,SAAS,cAAc,2BAA2B;AAChF,UAAM,WAAW;AAAA,MACf;AAAA,MACA,MAAM,aAAa;AAAA,MACnB;AAAA,IACF;AACA,UAAM,YAAY,YAAY,QAAQ;AACtC,UAAM,SAAS,MAAM,MAAM,IAAI,SAAS;AACxC,QAAI,aAAa,QAAQ,QAAQ,cAAc,SAAS,QAAQ;AAChE,QAAI,CAAC,YAAY;AACf,YAAM,SAAS,MAAM,MAAM,OAAO,UAAU;AAC5C,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI,mBAAmB,EAAE,MAAM,eAAe,SAAS,0BAA0B,MAAM,IAAI,kBAAkB,WAAW,KAAK,CAAC;AAAA,MACtI;AACA,YAAM,aAAkC,WAAW,CAAC,aAAa;AAAA,QAC/D,GAAG;AAAA,QACH,OAAO;AAAA,QACP,gBAAgB,MAAM;AAAA,MACxB,EAAE;AACF,UAAI,CAAC,QAAQ,wBAAwB;AACnC,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,gBAAgB,MAAM,QAAQ,uBAAuB,QAAQ;AACnE,UAAI,cAAc,UAAU;AAC1B,cAAM,aAAkC,WAAW,CAAC,aAAa;AAAA,UAC/D,GAAG;AAAA,UACH,UAAU,cAAc;AAAA,QAC1B,EAAE;AAAA,MACJ;AACA,YAAM,SAAS,MAAM,MAAM,OAAO,qBAAqB,UAAU,QAAQ,KAAK;AAC9E,mBAAa,OAAO;AACpB,YAAM,aAAkC,WAAW,CAAC,aAAa;AAAA,QAC/D,GAAG;AAAA,QACH,OAAO;AAAA,QACP,gBAAgB,MAAM;AAAA,QACtB,cAAc,OAAO;AAAA,QACrB,YAAY,OAAO;AAAA,QACnB,WAAW,SAAS,aAAa,IAAI,EAAE,YAAY;AAAA,QACnD,GAAI,OAAO,mBAAmB,EAAE,kBAAkB,OAAO,iBAAiB,IAAI,CAAC;AAAA,MACjF,EAAE;AAAA,IACJ;AACA,WAAO,CAAC,SAAS;AACf,YAAM,WAAW,MAAM,MAAM,OAAO,uBAAuB,UAAU;AACrE,UAAI,MAAM,kBAAkB,UAAU,UAAU,QAAQ,EAAG;AAC3D,YAAM,MAAM,cAAc;AAAA,IAC5B;AAAA,EACF;AAEA,WAAS,WAAW,UAAuC;AACzD,UAAM,SAAS;AACf,QAAI,CAAC,QAAQ,MAAM,EAAG;AACtB,UAAM,QAAQ,OAAO,QAAQ;AAC7B,QAAI,UAAU,eAAe,UAAU,YAAY,UAAU,YAAa;AAC1E,QAAI,OAAO,IAAI,OAAO,SAAS,GAAG,EAAG;AACrC,WAAO,IAAI,OAAO,SAAS,GAAG;AAC9B,UAAM,YAAY;AAChB,UAAI;AACJ,UAAI;AACF,cAAM,QAAQ,WAAW,MAAM;AAC/B,YAAI,CAAC,MAAM,kBAAkB,KAAK,EAAG;AACrC,eAAO,MAAM;AAAA,MACf,SAASA,QAAO;AACd,gBAAQA,MAAK;AACb,cAAM,KAAK,QAAQA,MAAK,EAAE,MAAM,OAAO;AACvC;AAAA,MACF;AACA,UAAI;AACF,eAAO,CAAC,SAAS;AACf,cAAI;AACF,gBAAI,OAAO,SAAS,qBAAqB;AACvC,oBAAM,kBAAkB,MAA+B;AAAA,YACzD,OAAO;AACL,oBAAM,uBAAuB,MAA+B;AAAA,YAC9D;AACA;AAAA,UACF,SAASA,QAAO;AACd,oBAAQA,MAAK;AACb,gBAAI,EAAEA,kBAAiB,uBAAuB,CAACA,OAAM,WAAW;AAC9D,oBAAM,KAAK,QAAQA,MAAK,EAAE,MAAM,OAAO;AACvC;AAAA,YACF;AAIA,kBAAM,MAAM,cAAc;AAAA,UAC5B;AAAA,QACF;AAAA,MACF,UAAE;AACA,YAAI,KAAM,mBAAkB,IAAI;AAAA,MAClC;AAAA,IACF,GAAG,EAAE,QAAQ,MAAM,OAAO,OAAO,OAAO,SAAS,GAAG,CAAC;AAAA,EACvD;AAEA,iBAAe,cAAc,UAAyC;AACpE,UAAM,aAAa,SAAS,QAAQ,kBAAkB,QAAQ,QAAQ;AACtE,UAAM,aAAa,SAAS,QAAQ;AACpC,QAAI,CAAC,cAAc,CAAC,WAAY;AAChC,UAAM,QAAQ,QAAQ,IAAI,UAAU;AACpC,QAAI,CAAC,MAAO;AACZ,QAAI,SAAS,SAAS,qBAAqB;AACzC,YAAM,MAAM,OAAO,aAAa,YAAY,QAAQ,KAAK;AAAA,IAC3D,OAAO;AACL,YAAM,MAAM,OAAO,oBAAoB,YAAY,QAAQ,KAAK;AAAA,IAClE;AAAA,EACF;AAEA,iBAAe,QAAQ,YAAoB,MAA6B;AACtE,WAAO,CAAC,SAAS;AACf,UAAI;AAIF,cAAM,WAAW,MAAM;AAAA,UACrB,EAAE,YAAY,KAAK;AAAA,UACnB,EAAE,QAAQ,WAAW,OAAO;AAAA,QAC9B,EAAE,OAAO,aAAa,EAAE;AACxB,cAAM,WAAW,MAAM,MAAM,KAAK,EAAE,YAAY,KAAK,CAAC;AACtD,mBAAW,YAAY,SAAS,MAAO,YAAW,QAAQ;AAC1D,eAAO,CAAC,SAAS;AACf,gBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,cAAI,KAAK,KAAM;AACf,gBAAM,QAAQ,KAAK;AACnB,cAAI,QAAS;AACb,cAAI,MAAM,SAAS,WAAW;AAC5B,kBAAM,cAAc,MAAM,QAA0B,EAAE,MAAM,OAAO;AAAA,UACrE,WAAW,MAAM,SAAS,WAAW,MAAM,SAAS,YAAY;AAC9D,uBAAW,MAAM,QAAQ;AAAA,UAC3B;AAAA,QACF;AAAA,MACF,SAASA,QAAO;AACd,gBAAQA,MAAK;AAAA,MACf;AACA,UAAI,CAAC,QAAS,OAAM,MAAM,GAAI;AAAA,IAChC;AAAA,EACF;AAEA,QAAM,WAAW;AAAA,IACf,QAAQ,4BAA4B,mBAAmB;AAAA,IACvD,QAAQ,4BAA4B,mBAAmB;AAAA,EACzD;AACA,aAAW,WAAW,SAAU,MAAK,QAAQ,MAAM,OAAO;AAE1D,SAAO;AAAA,IACL,MAAM,OAAO;AACX,gBAAU;AACV,iBAAW,MAAM;AAIjB,YAAM,QAAQ,KAAK;AAAA,QACjB,QAAQ,WAAW,QAAQ;AAAA,QAC3B,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACpdA,SAAS,YAAYC,QAAuE;AAC1F,MAAIA,kBAAiB,oBAAoB;AACvC,WAAO,EAAE,MAAMA,OAAM,MAAM,SAASA,OAAM,SAAS,WAAWA,OAAM,UAAU;AAAA,EAChF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAASA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,IAC9D,WAAW;AAAA,EACb;AACF;AAGA,SAAS,mBAAmB,MAAuB;AACjD,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,SAAS;AACf,QAAI,OAAO,SAAS,aAAa,OAAO,OAAO,SAAS,SAAU,QAAO,OAAO;AAAA,EAClF;AACA,SAAO;AACT;AAOO,SAAS,iCACd,SACA,UAA6C,CAAC,GAC3B;AACnB,SAAO;AAAA,IACL,MAAM,MAAM,SAAS;AACnB,YAAM,EAAE,UAAU,IAAI,IAAI;AAC1B,YAAM,iBAAiB,WAAW,IAAI,SAAS,aAAa,SAAS,IAAI,IAAI,SAAS,IAAI;AAC1F,YAAM,UAAU,QAAQ,WAAW,SAAS,SAAS;AACrD,UAAI,mBAAmB;AAEvB,UACE,QAAQ,qBACR,SAAS,KAAK,eAAe,gBAC7B,QAAQ,cAAc,UACtB,SAAS,KAAK,eAAe,SAAS,QACtC;AACA,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,wBAAwB,SAAS,SAAS,IAAI;AAAA,UACvD,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AAEA,UAAI,SAAS,KAAK,aAAa,YAAY;AACzC,cAAM,WAAW,QAAQ;AACzB,YACE,CAAC,YACD,IAAI,QAAQ,uBAAuB,QAAQ,SAAS,SAAS,OAC7D,SAAS,KAAK,cAAc,SAAS,SAAS,KAAK,YAAY,YAC/D;AACA,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,QAAQ,IAAI,SAAS,IAAI;AAAA,YAClC,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,YAAI,QAAQ,sBAAsB;AAChC,gBAAM,WAAW,MAAM,QAAQ,qBAAqB,UAAU,OAAO;AACrE,cAAI,CAAC,UAAU;AACb,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS,kBAAkB,SAAS,SAAS,IAAI;AAAA,cACjD,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AACA,6BAAmB,EAAE,GAAG,SAAS,aAAa,SAAS;AAAA,QACzD,WAAW,SAAS,KAAK,WAAW,SAAS,QAAQ,cAAc;AACjE,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,yBAAyB,SAAS,SAAS,IAAI;AAAA,YACxD,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AAKA,YAAM,EAAE,uBAAAC,wBAAuB,6BAAAC,6BAA4B,IAAI,MAAM,OAAO,uBAAe;AAE3F,UAAI,SAAkG;AAEtG,UAAI,SAAS,KAAK,iBAAiB;AACjC,YAAI,CAAC,QAAQ,cAAc;AACzB,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,aAAa,SAAS,SAAS,IAAI,0BAA0B,SAAS,KAAK,eAAe;AAAA,YACnG,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,cAAM,UAAuB;AAAA,UAC3B,IAAI,YAAY,SAAS,SAAS,IAAI;AAAA,UACtC,MAAM,SAAS,SAAS;AAAA,UACxB,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,iBAAiB,EAAE,MAAM,UAAU,QAAQ,QAAQ,aAAa;AAAA,QAClE;AACA,iBAAS,MAAMA,6BAA4B,kBAAkB,SAAS,cAAc;AAAA,MACtF,WAAW,SAAS,KAAK,WAAW;AAClC,iBAAS,MAAMD,uBAAsB,kBAAkB,EAAE,cAAc,SAAS,KAAK,WAAW,eAAe,CAAC;AAAA,MAClH,OAAO;AACL,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,aAAa,SAAS,SAAS,IAAI;AAAA,UAC5C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AAEA,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,gCAAgC,SAAS,SAAS,IAAI,eAAe,SAAS,KAAK,aAAa,EAAE;AAAA,UAC3G,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AAEA,YAAM,eAAe,YAAqC;AACxD,YAAI;AACF,cAAI,UAAU;AACd,2BAAiB,QAAQ,OAAO,EAAE,gBAAgB,QAAQ,CAAC,GAAG;AAC5D,uBAAW,mBAAmB,IAAI;AAAA,UACpC;AACA,cAAI,iBAAiB,0BAA0B,IAAI,cAAc,GAAG;AAClE,6BAAiB,yBAAyB,OAAO,cAAc;AAC/D,mBAAO,EAAE,OAAO,aAAa,QAAQ;AAAA,UACvC;AACA,iBAAO,EAAE,OAAO,aAAa,QAAQ;AAAA,QACvC,SAASD,QAAO;AACd,iBAAO,EAAE,OAAO,UAAU,OAAO,YAAYA,MAAK,EAAE;AAAA,QACtD;AAAA,MACF,GAAG;AAEH,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,MAAM,SAAS;AACb,2BAAiB,0BAA0B,IAAI,cAAc;AAAA,QAC/D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AA2BO,SAAS,gCAAgC,SAA8D;AAC5G,QAAM,iBAAiB,QAAQ,kBAAkB;AAEjD,WAAS,cAAc,UAAoD;AACzE,QAAI,CAAC,SAAS,KAAK,iBAAiB;AAElC,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,YAAY,SAAS,KAAK;AAChC,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,oBAAoB,SAAS,SAAS,IAAI;AAAA,QACnD,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,UAAM,OAAO,eAAe,SAAS;AACrC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,oBAAoB,SAAS,SAAS,IAAI,sCAAsC,SAAS;AAAA,QAClG,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,KAAK,cAAc,OAAQ,QAAO,QAAQ;AAC9C,QAAI,KAAK,cAAc,WAAW;AAChC,UAAI,CAAC,QAAQ,eAAe;AAC1B,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,iBAAiB,SAAS;AAAA,UACnC,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,iBAAiB,SAAS,eAAe,KAAK,SAAS;AAAA,MAChE,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,MAAM,SAAS;AACnB,aAAO,cAAc,QAAQ,QAAQ,EAAE,MAAM,OAAO;AAAA,IACtD;AAAA,EACF;AACF;;;ACvRA,IAAMG,cAA6C;AAAA,EACjD,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS;AACX;AAEA,IAAM,sBAA0D;AAAA,EAC9D,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,cAAc;AAAA,EACd,YAAY;AACd;AAEA,IAAM,kCAA8E;AAAA,EAClF,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS;AACX;AAQA,SAAS,kBAAkB,UAAuF;AAChH,SAAO;AAAA,IACL,YAAY,SAAS;AAAA,IACrB,MAAM,SAAS;AAAA,IACf,MAAM,SAAS,SAAS;AAAA,IACxB,GAAI,SAAS,SAAS,cAAc,SAAY,EAAE,WAAW,SAAS,SAAS,UAAU,IAAI,CAAC;AAAA,IAC9F,KAAK,SAAS,SAAS;AAAA,EACzB;AACF;AAEA,SAAS,oBAAoB,SAAiB,oBAA4B;AACxE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,cAAc,QAAwB,SAA0B;AACvE,QAAM,YAAY,OAAO,YAAY,KAAK,CAAC,SAAS,KAAK,SAAS,wBAAwB;AAC1F,SAAO,WAAW,WAAW,WAC3B,UAAU,WAAW,wBACrB,UAAU,YAAY;AAC1B;AAEA,eAAe,cACb,UACA,WACA,eACA,OACA,gBACsB;AACtB,QAAM,gBAAgB,SAAS,KAAK,aAAa;AACjD,MAAI,CAAC,cAAe,QAAO,CAAC;AAC5B,QAAM,gBAAgB,SAAS,KAAK,SAAS;AAC7C,QAAM,yBAAyB,SAAS,KAAK,WAAW,sBAAsB;AAC9E,QAAM,qBAAqB,SAAS,KAAK,WAAW;AACpD,QAAM,oBAAoB,SAAS,KAAK,aAAa;AACrD,QAAM,aAA0B,CAAC;AAEjC,aAAW,YAAY,WAAW;AAChC,QAAI,SAAS,KAAK,cAAc,SAAS,cAAe;AACxD,QAAI,SAAS,QAAQ,YAAY,KAAM;AACvC,UAAM,cAAc,KAAK,MAAM,SAAS,OAAO,aAAa,EAAE;AAC9D,QAAI,CAAC,OAAO,SAAS,WAAW,KAAK,QAAQ,cAAc,eAAgB;AAC3E,UAAM,QAAQ,SAAS,KAAK,SAAS;AACrC,QAAIA,YAAW,KAAK,IAAIA,YAAW,aAAa,EAAG;AACnD,UAAM,gBAAgB,SAAS,KAAK,UAAU,iBAAiB;AAC/D,UAAM,QAAQ,iBAAiB,SAAS,OAAO,eAAe;AAC9D,QAAI,QAAQ,EAAG;AACf,UAAM,yBAAyB,SAAS,KAAK,YAAY,kBACvD,gCAAgC,KAAK;AACvC,QACE,EAAE,0BAA0B,wBAC5B,oBAAoB,sBAAsB,IAAI,oBAAoB,sBAAsB,GACxF;AACA;AAAA,IACF;AAEA,UAAM,aAAa,MAAM,cAAc,QAAQ;AAC/C,QAAI,CAAC,WAAY;AACjB,QAAI,WAAW,KAAK,UAAU,SAAS,KAAK,gBAAgB,WAAW,KAAK,OAAQ;AACpF,QAAI,mBAAmB,UAAU,CAAC,kBAAkB,SAAS,WAAW,KAAK,KAAK,EAAG;AACrF,QACE,oBAAoB,WACnB,CAAC,WAAW,KAAK,iBAAiB,CAAC,mBAAmB,SAAS,WAAW,KAAK,aAAa,IAC7F;AACA;AAAA,IACF;AAEA,UAAM,WAAW,SAAS,KAAK,WAAW,SAAS,QAAQ,eAAe,MAAO;AACjF,eAAW,KAAK,EAAE,UAAU,YAAY,OAAO,WAAW,MAAM,CAAC;AAAA,EACnE;AAEA,SAAO,WAAW;AAAA,IAAK,CAAC,MAAM,UAC5B,MAAM,QAAQ,KAAK,SACnB,KAAK,SAAS,SAAS,KAAK,cAAc,MAAM,SAAS,SAAS,IAAI;AAAA,EACxE;AACF;AAOO,SAAS,qCACd,SACsC;AACtC,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,yBAAyB,QAAQ,0BAA0B;AACjE,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,MAAM,QAAQ;AACpB,YAAM,SAAS,IAAI,UAAU,CAAC;AAC9B,YAAM,mBAAmB,IAAI;AAC7B,YAAM,eAAe,iBAAiB,YAAY;AAClD,UAAI,OAAO,SAAS,OAAO,UAAU,UAAW,QAAO,EAAE,OAAO,KAAK;AAErE,YAAM,WAAW,MAAM,QAAQ,YAAY,GAAG;AAC9C,UAAI,CAAC,UAAU;AACb,cAAM,UAAU;AAChB,eAAO;AAAA,UACL,GAAI,cAAc,QAAQ,OAAO,IAC7B,CAAC,IACD;AAAA,YACA,QAAQ;AAAA,cACN,GAAG;AAAA,cACH,YAAY;AAAA,gBACV,IAAI,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,wBAAwB;AAAA,gBACpF,oBAAoB,SAAS,YAAY;AAAA,cAC3C;AAAA,YACF;AAAA,UACF;AAAA,UACF,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UAAI,CAAC,SAAS,KAAK,aAAa,WAAY,QAAO,EAAE,OAAO,KAAK;AAEjE,YAAM,eAAe,oBAAI,IAAoB;AAC7C,iBAAW,SAAS,MAAM,QAAQ,WAAW,KAAK,CAAC,GAAG;AACpD,YAAI,MAAM,SAAS,QAAQ,IAAI,SAAS,IAAK;AAC7C,YACE,MAAM,QAAQ,UAAU,eACxB,MAAM,QAAQ,UAAU,YACxB,MAAM,QAAQ,UAAU,YACxB;AACF,cAAM,cAAc,MAAM,QAAQ,uBAAuB;AACzD,YAAI,YAAa,cAAa,IAAI,cAAc,aAAa,IAAI,WAAW,KAAK,KAAK,CAAC;AAAA,MACzF;AACA,YAAM,aAAa,MAAM,QAAQ,cAAc,GAAG,IAAI,CAAC,cAAc;AAAA,QACnE,GAAG;AAAA,QACH,QAAQ;AAAA,UACN,GAAG,SAAS;AAAA,UACZ,cAAc,SAAS,QAAQ,eAAe,MAC3C,aAAa,IAAI,SAAS,SAAS,GAAG,KAAK;AAAA,QAChD;AAAA,MACF,EAAE;AACF,YAAM,aAAa,MAAM;AAAA,QACvB;AAAA,QACA;AAAA,QACA,CAAC,aAAa,QAAQ,cAAc,QAAQ;AAAA,QAC5C,iBAAiB,QAAQ;AAAA,QACzB;AAAA,MACF;AACA,YAAM,WAAW,WAAW,CAAC,GAAG;AAChC,UAAI,CAAC,UAAU;AACb,cAAM,UAAU,8CAA8C,SAAS,KAAK,YAAY,UAAU;AAClG,cAAM;AAAA,UACJ,uBAAuB;AAAA,UACvB,cAAc;AAAA,UACd,GAAG;AAAA,QACL,IAAI;AACJ,eAAO;AAAA,UACL,GAAI,cAAc,QAAQ,OAAO,KAAK,CAAC,OAAO,wBAC1C,CAAC,IACD;AAAA,YACA,QAAQ;AAAA,cACN,GAAG;AAAA,cACH,OAAO;AAAA,cACP,YAAY;AAAA,gBACV,IAAI,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,wBAAwB;AAAA,gBACpF,oBAAoB,SAAS,YAAY;AAAA,cAC3C;AAAA,YACF;AAAA,UACF;AAAA,UACF,gBAAgB;AAAA,QAClB;AAAA,MACF;AAEA,UACE,OAAO,uBAAuB,QAAQ,SAAS,SAAS,OACxD,OAAO,cAAc,4BAA4B,SAAS,SAAS,mBACnE,OAAO,aAAa,eAAe,QAAQ,YAC3C;AACA,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,uBAAuB,kBAAkB,QAAQ;AAAA,UACjD,cAAc;AAAA,YACZ,YAAY,QAAQ;AAAA,YACpB,yBAAyB,SAAS,SAAS;AAAA,YAC3C,SAAS;AAAA,UACX;AAAA,UACA,YAAY;AAAA,YACV,IAAI,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,wBAAwB;AAAA,YACpF;AAAA,cACE,MAAM;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,SAAS,2BAA2B,SAAS,SAAS,IAAI;AAAA,cAC1D,oBAAoB;AAAA,YACtB;AAAA,UACF;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AC9NA,SAAS,eAAe,SAAiB,MAAc;AACrD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR;AAAA,IACA,oBAAoB;AAAA,EACtB;AACF;AAOO,SAAS,yCACd,SAC+C;AAC/C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,aAAa,QAAQ;AAC3B,YAAM,SAAS,WAAW,UAAU,CAAC;AACrC,UAAI,OAAO,SAAS,OAAO,UAAU,UAAW,QAAO,EAAE,OAAO,KAAK;AACrE,YAAM,eAAe,IAAI,EAAE,YAAY;AACvC,YAAM,eAAe,MAAM,QAAQ,gBAAgB,UAAU;AAC7D,UAAI,CAAC,cAAc;AACjB,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,YAAY,CAAC,eAAe,0CAA0C,YAAY,CAAC;AAAA,UACrF;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AAEA,YAAM,WAAW,MAAM,QAAQ,cAAc,UAAU;AACvD,YAAM,eAAe,WAAW,KAAK,UAAU,UAAU,QAAQ;AACjE,YAAM,cAAc,MAAM,QAAQ,UAAU,GAAG,QAAQ,CAAC,SAAS;AAC/D,YAAI,CAAC,KAAK,WAAY,gBAAgB,KAAK,WAAW,aAAe,QAAO,CAAC;AAC7E,YACE,KAAK,mBAAmB,WACvB,KAAK,qBAAqB,MAAM,KAAK,eACtC,QAAO,CAAC;AACV,cAAM,aAAa,KAAK,aAAa;AAAA,UACnC,CAAC,cAAc,UAAU,SAAS,aAAa,KAAK;AAAA,QACtD;AACA,YAAI,CAAC,cAAc,CAAC,sBAAsB,YAAY,YAAY,EAAE,UAAW,QAAO,CAAC;AACvF,eAAO,CAAC,EAAE,MAAM,WAAW,CAAC;AAAA,MAC9B,CAAC,EAAE;AAAA,QAAK,CAAC,MAAM,WACZ,KAAK,KAAK,qBAAqB,MAAM,MAAM,KAAK,qBAAqB,MACtE,KAAK,KAAK,OAAO,cAAc,MAAM,KAAK,MAAM;AAAA,MAClD;AAEA,YAAM,WAAW,WAAW,CAAC;AAC7B,UAAI,CAAC,UAAU;AACb,cAAM,UAAU,6CAA6C,aAAa,SAAS,IAAI;AACvF,cAAM,EAAE,cAAc,OAAO,gBAAgB,SAAS,SAAS,UAAU,GAAG,QAAQ,IAAI;AACxF,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,YAAY,CAAC,eAAe,SAAS,YAAY,CAAC;AAAA,UACpD;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UACE,OAAO,iBAAiB,SAAS,KAAK,UACtC,OAAO,mBAAmB,SAAS,WAAW,QAC9C,OAAO,SAAS,eAAe,QAAQ,cACvC,OAAO,QAAQ,gCAAgC,aAAa,SAAS,iBACrE;AACA,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,cAAc,SAAS,KAAK;AAAA,UAC5B,gBAAgB,SAAS,WAAW;AAAA,UACpC,SAAS;AAAA,YACP,YAAY,QAAQ;AAAA,YACpB,6BAA6B,aAAa,SAAS;AAAA,YACnD,SAAS;AAAA,UACX;AAAA,UACA,YAAY,CAAC;AAAA,YACX,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,SAAS,oBAAoB,SAAS,WAAW,IAAI,cAAc,SAAS,KAAK,MAAM;AAAA,YACvF,oBAAoB;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AA+BO,SAAS,2CACd,SAC+C;AAC/C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,aAAa,QAAQ;AAC3B,YAAM,SAAS,WAAW,UAAU,CAAC;AACrC,UAAI,OAAO,iBAAiB,QAAQ,UAAU,CAAC,OAAO,kBAAkB,CAAC,OAAO,SAAS;AACvF,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,UAAI,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY;AAC5D,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,UAAI,OAAO,UAAU,cAAc,CAAC,OAAO,mBAAoB,QAAO,EAAE,OAAO,KAAK;AACpF,YAAM,SAAS,MAAM,QAAQ,UAAU,OAAO,cAAc;AAC5D,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,yBAAyB,OAAO,cAAc;AAAA,cACvD,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,OAAO,UAAU,cAAc,OAAO,oBAAoB;AAC5D,YAAI,CAAC,OAAO,QAAQ;AAClB,iBAAO;AAAA,YACL,QAAQ;AAAA,cACN,GAAG;AAAA,cACH,OAAO;AAAA,cACP,OAAO;AAAA,gBACL,MAAM;AAAA,gBACN,SAAS;AAAA,gBACT,WAAW;AAAA,cACb;AAAA,YACF;AAAA,YACA,OAAO;AAAA,UACT;AAAA,QACF;AACA,YAAI,QAAQ,SAAS;AACnB,gBAAM,gBAAgB,MAAM,QAAQ,QAAQ,UAAU,OAAO,cAAc;AAC3E,cAAI,CAAC,eAAe;AAClB,mBAAO;AAAA,cACL,QAAQ;AAAA,gBACN,GAAG;AAAA,gBACH,OAAO;AAAA,gBACP,OAAO;AAAA,kBACL,MAAM;AAAA,kBACN,SAAS,iCAAiC,OAAO,cAAc;AAAA,kBAC/D,WAAW;AAAA,gBACb;AAAA,cACF;AAAA,cACA,OAAO;AAAA,YACT;AAAA,UACF;AACA,gBAAM,cAAc;AAAA,YAClB,MAAM,QAAQ,QAAQ,qBAAqB;AAAA,cACzC;AAAA,cACA,eAAe,OAAO;AAAA,cACtB,OAAO,QAAQ;AAAA,cACf,YAAY,QAAQ;AAAA,YACtB,CAAC;AAAA,UACH;AAAA,QACF,OAAO;AACL,gBAAM,OAAO,QAAQ,OAAO,MAAM;AAAA,QACpC;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,YAAY,IAAI,EAAE,YAAY;AAAA,UAChC;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,eAAe,MAAM,QAAQ,gBAAgB,UAAU;AAC7D,UACE,CAAC,gBACD,aAAa,SAAS,oBAAoB,OAAO,QAAQ,6BACzD;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,YAAM,SAAS,MAAM,OAAO,UAAU;AACtC,YAAM,eAAe,sBAAsB,cAAc,YAAY;AACrE,UACE,CAAC,OAAO,WACR,aAAa,SAAS,OAAO,kBAC7B,CAAC,aAAa,WACd;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,aAAa,UAAU,OAAO,UAAU;AAAA,cACjD,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,YAAM,YAAY,IAAI,EAAE,YAAY;AACpC,UAAI,OAAO,UAAU,aAAa;AAChC,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,gBAAgB,EAAE,YAAY,QAAQ,YAAY,UAAU;AAAA,UAC9D;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UAAI,OAAO,gBAAgB,eAAe,QAAQ,YAAY;AAC5D,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,YAAM,gBAAgB,MAAM,QAAQ,aAAa,UAAU,KACzD,YAAY,WAAW,KAAK,aAAa,OAAO,WAAW,SAAS,GAAG;AACzE,YAAM,UAAU,QAAQ;AACxB,YAAM,WAAW,UACb,OAAO,YAAY;AACnB,cAAM,gBAAgB,MAAM,QAAQ,UAAU,OAAO,cAAwB;AAC7E,YAAI,CAAC,eAAe;AAClB,iBAAO;AAAA,YACL,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,iCAAiC,OAAO,cAAc;AAAA,cAC/D,WAAW;AAAA,YACb;AAAA,UACF;AAAA,QACF;AACA,cAAM,gBAAgB,MAAM,cAAc;AAAA,UACxC,MAAM,QAAQ,qBAAqB;AAAA,YACjC;AAAA,YACA;AAAA,YACA;AAAA,YACA,OAAO,QAAQ;AAAA,YACf,YAAY,QAAQ;AAAA,UACtB,CAAC;AAAA,QACH;AACA,eAAO;AAAA,UACL,OAAO;AAAA,UACP,QAAQ,cAAc;AAAA,UACtB,GAAI,cAAc,iBAAiB,SAAS,IACxC,EAAE,UAAU,cAAc,iBAAiB,IAC3C,CAAC;AAAA,UACL,YAAY,cAAc;AAAA,QAC5B;AAAA,MACF,GAAG,IACD,MAAM,OAAO,QAAQ;AAAA,QACrB;AAAA,QACA;AAAA,QACA,YAAY;AAAA,MACd,CAAC;AACH,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,GAAG;AAAA,UACH,cAAc,OAAO;AAAA,UACrB,gBAAgB,OAAO;AAAA,UACvB,SAAS,OAAO;AAAA,UAChB,gBAAgB,OAAO;AAAA,QACzB;AAAA,QACA,OAAO,SAAS,UAAU,cAAc,SAAS,UAAU;AAAA,QAC3D,GAAI,SAAS,UAAU,YAAY,EAAE,gBAAgB,IAAK,IAAI,CAAC;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;;;AClSO,SAAS,0BACd,SACsC;AACtC,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,MAAM,QAAQ;AACpB,YAAM,SAAS,IAAI,UAAU,CAAC;AAC9B,YAAM,WAAW,MAAM,QAAQ,YAAY,GAAG;AAC9C,UAAI,CAAC,YAAY,SAAS,QAAQ,iBAAiB,QAAQ,OAAQ,QAAO,EAAE,OAAO,KAAK;AACxF,YAAM,YAAY,SAAS,KAAK,eAAe,WAAW,CAAC;AAC3D,UAAI,UAAU,WAAW,EAAG,QAAO,EAAE,OAAO,KAAK;AAEjD,WACG,OAAO,gBAAgB,WAAW,OAAO,gBAAgB,iBAC1D,OAAO,0BACP;AACA,eAAO;AAAA,UACL,QAAQ,EAAE,GAAG,QAAQ,aAAa,YAAY;AAAA,UAC9C,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UAAI,OAAO,gBAAgB,aAAa;AACtC,mBAAW,WAAW,OAAO,kBAAkB,CAAC,GAAG;AACjD,gBAAM,gBAAgB,QAAQ,UAC1B,MAAM,QAAQ,QAAQ,UAAU,QAAQ,cAAc,IACtD;AACJ,cAAI,iBAAiB,QAAQ,WAAW,QAAQ,aAAa;AAC3D,kBAAM,cAAc;AAAA,cAClB,MAAM,QAAQ,QAAQ,uBAAuB;AAAA,gBAC3C;AAAA,gBACA,eAAe,QAAQ;AAAA,gBACvB,OAAO,QAAQ;AAAA,gBACf,YAAY,QAAQ;AAAA,cACtB,CAAC;AAAA,YACH;AACA,kBAAM,cAAc;AAAA,cAClB,MAAM,QAAQ,QAAQ,qBAAqB;AAAA,gBACzC;AAAA,gBACA,aAAa,QAAQ;AAAA,gBACrB,OAAO,QAAQ;AAAA,gBACf,YAAY,QAAQ;AAAA,cACtB,CAAC;AAAA,YACH;AAAA,UACF,OAAO;AACL,kBAAM,SAAS,MAAM,QAAQ,UAAU,QAAQ,cAAc;AAC7D,gBAAI,CAAC,QAAQ;AACX,oBAAM,IAAI,mBAAmB;AAAA,gBAC3B,MAAM;AAAA,gBACN,SAAS,mBAAmB,QAAQ,cAAc;AAAA,gBAClD,WAAW;AAAA,cACb,CAAC;AAAA,YACH;AACA,kBAAM,OAAO,UAAU,QAAQ,aAAa;AAAA,UAC9C;AACA,gBAAM,QAAQ,MAAM,QAAQ,SAAS,QAAQ,SAAS,MAAM,IAAI,SAAS,SAAS;AAClF,gBAAM,SAAS,QAAQ,MAAM,QAAQ,UAAU,KAAK,IAAI;AACxD,cAAI,OAAQ,OAAM,QAAQ,oBAAoB,QAAQ,UAAU,QAAQ,MAAM;AAAA,QAChF;AACA,eAAO;AAAA,UACL,QAAQ,EAAE,GAAG,QAAQ,aAAa,WAAW;AAAA,UAC7C,OAAO;AAAA,QACT;AAAA,MACF;AACA,UACE,OAAO,gBAAgB,WACvB,OAAO,gBAAgB,cACvB,OAAO,gBAAgB,SACvB,QAAO,EAAE,OAAO,KAAK;AAEvB,YAAM,WAMD,CAAC;AACN,iBAAW,YAAY,WAAW;AAChC,cAAM,QAAQ,MAAM,QAAQ,SAAS,SAAS,UAAU,IAAI,SAAS,SAAS;AAC9E,YAAI,CAAC,MAAO,QAAO,EAAE,gBAAgB,IAAK;AAC1C,YAAI,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,UAAU,QAAQ;AACtE,iBAAO;AAAA,YACL,QAAQ;AAAA,cACN,GAAG;AAAA,cACH,aAAa;AAAA,cACb,aAAa;AAAA,gBACX,MAAM;AAAA,gBACN,SAAS,iBAAiB,SAAS,QAAQ,QAAQ,MAAM,OAAO,KAAK;AAAA,gBACrE,WAAW;AAAA,cACb;AAAA,YACF;AAAA,YACA,OAAO;AAAA,UACT;AAAA,QACF;AACA,YACE,MAAM,QAAQ,UAAU,WACxB,MAAM,OAAO,iBAAiB,QAAQ,UACtC,CAAC,MAAM,OAAO,eACd,QAAO,EAAE,gBAAgB,IAAK;AAChC,cAAM,SAAS,MAAM,QAAQ,UAAU,KAAK;AAC5C,YAAI,CAAC,UAAU,OAAO,SAAS,QAAQ,MAAM,OAAO,WAAW,KAAK;AAClE,iBAAO,EAAE,gBAAgB,IAAK;AAAA,QAChC;AACA,cAAM,SAAS,MAAM,QAAQ,UAAU,MAAM,OAAO,cAAc;AAClE,YAAI,CAAC,OAAQ,QAAO,EAAE,gBAAgB,IAAK;AAC3C,iBAAS,KAAK;AAAA,UACZ,MAAM,SAAS;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU,MAAM,KAAK,eAAe;AAAA,QACtC,CAAC;AAAA,MACH;AAEA,UAAI,OAAO,gBAAgB,cAAc;AACvC,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,aAAa;AAAA,YACb,oBAAoB;AAAA,cAClB,YAAY,QAAQ;AAAA,cACpB,WAAW,IAAI,EAAE,YAAY;AAAA,YAC/B;AAAA,UACF;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UAAI,OAAO,oBAAoB,eAAe,QAAQ,YAAY;AAChE,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,aAAa;AAAA,YACb,aAAa;AAAA,cACX,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,YAAM,WAAW,CAAC,GAAI,OAAO,kBAAkB,CAAC,CAAE;AAClD,YAAM,OAAO,SAAS,KAAK,CAAC,SAAS,CAAC,SAAS,KAAK,CAAC,YAAY,QAAQ,SAAS,KAAK,IAAI,CAAC;AAC5F,UAAI,MAAM;AACR,cAAM,gBAAgB,QAAQ,UAC1B,MAAM,QAAQ,QAAQ,UAAU,KAAK,MAAM,OAAQ,cAAe,IAClE;AACJ,cAAM,QAAQ,iBAAiB,QAAQ,UACnC,MAAM,cAAc;AAAA,UACpB,MAAM,QAAQ,QAAQ,mBAAmB;AAAA,YACvC;AAAA,YACA,QAAQ,KAAK;AAAA,YACb,QAAQ,QAAQ;AAAA,YAChB,OAAO,QAAQ;AAAA,YACf,YAAY,QAAQ;AAAA,UACtB,CAAC;AAAA,QACH,IACE;AACJ,cAAM,qBAAqB,iBAAiB,QAAQ,WAAW,QAC3D,MAAM,cAAc;AAAA,UACpB,MAAM,QAAQ,QAAQ,qBAAqB;AAAA,YACzC;AAAA,YACA,aAAa,MAAM;AAAA,YACnB,aAAa,SAAS,SAAS;AAAA,YAC/B,UAAU,KAAK;AAAA,YACf,OAAO,QAAQ;AAAA,YACf,YAAY,QAAQ;AAAA,UACtB,CAAC;AAAA,QACH,IACE;AACJ,cAAM,YAAY,sBAAsB,MAAM,KAAK,OAAO,QAAQ;AAAA,UAChE,QAAQ,KAAK;AAAA,UACb,QAAQ,QAAQ;AAAA,UAChB,aAAa,SAAS,SAAS;AAAA,UAC/B,UAAU,KAAK;AAAA,QACjB,CAAC;AACD,cAAM,QAAQ,kBAAkB,KAAK,QAAQ,UAAU,QAAQ,MAAM;AACrE,iBAAS,KAAK;AAAA,UACZ,MAAM,KAAK;AAAA,UACX,UAAU,EAAE,MAAM,KAAK,MAAM,SAAS,MAAM,KAAK,KAAK,MAAM,SAAS,IAAI;AAAA,UACzE,WAAW,EAAE,MAAM,KAAK,OAAO,SAAS,MAAM,KAAK,KAAK,OAAO,SAAS,IAAI;AAAA,UAC5E,gBAAgB,KAAK,MAAM,OAAQ;AAAA,UACnC,cAAc,QAAQ;AAAA,UACtB,GAAI,QAAQ,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,UAClD,eAAe,UAAU;AAAA,UACzB,UAAU,KAAK;AAAA,QACjB,CAAC;AACD,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,aAAa;AAAA,YACb,gBAAgB;AAAA,UAClB;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,aAAa;AAAA,UACb,gBAAgB;AAAA,QAClB;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AC/KA,IAAMC,cAA6C;AAAA,EACjD,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS;AACX;AAGA,IAAMC,uBAA0D;AAAA,EAC9D,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,cAAc;AAAA,EACd,YAAY;AACd;AAEA,IAAM,6BAAyE;AAAA,EAC7E,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,IAAM,2BAA2B;AAAA,EAC/B,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW;AAAA,EACX,MAAM;AAAA,EACN,UAAU;AACZ;AAUA,SAAS,qBAAqB,UAAiD;AAC7E,SAAO,SAAS,KAAK,SAAS;AAChC;AAQA,SAAS,OAAO,WAAoC;AAClD,SAAO,EAAE,UAAU,OAAO,SAAS,CAAC,GAAG,UAAU;AACnD;AAOA,SAAS,wBACP,UACA,MACiB;AACjB,QAAM,YAAY,SAAS,KAAK,aAAa,CAAC;AAC9C,QAAM,UAAoB,CAAC;AAC3B,QAAM,WAAW,qBAAqB,QAAQ;AAC9C,QAAM,yBAAyB,UAAU,sBAAsB;AAE/D,MAAI,KAAK,YAAY,MAAO,QAAO,OAAO,mBAAmB;AAC7D,MAAI,KAAK,SAAS,CAAC,KAAK,MAAM,SAAS,QAAQ,EAAG,QAAO,OAAO,yCAAyC;AACzG,MAAI,UAAU,sBAAsB,KAAK,aAAa,MAAM;AAC1D,WAAO,OAAO,uCAAuC;AAAA,EACvD;AACA,MAAI,UAAU,gBAAgB,KAAK,SAAS,UAAU,aAAc,QAAO,OAAO,6BAA6B;AAC/G,MAAI,UAAU,cAAc;AAC1B,UAAM,UAAU,OAAO,QAAQ,UAAU,YAAY,EAAE;AAAA,MACrD,CAAC,CAAC,KAAK,KAAK,MAAM,KAAK,SAAS,GAAG,MAAM;AAAA,IAC3C;AACA,QAAI,CAAC,QAAS,QAAO,OAAO,6BAA6B;AACzD,YAAQ,KAAK,sBAAsB;AAAA,EACrC;AACA,MAAI,UAAU,cAAc,SAAS,KAAK,WAAW,GAAG;AACtD,WAAO,OAAO,gBAAgB,KAAK,WAAW,+BAA+B;AAAA,EAC/E;AAEA,MAAI,aAAa,cAAc;AAC7B,QAAI,KAAK,eAAe,aAAc,QAAO,OAAO,iDAAiD;AACrG,YAAQ,KAAK,4BAA4B;AAAA,EAC3C,OAAO;AACL,QAAI,KAAK,eAAe,aAAc,QAAO,OAAO,oDAAoD;AACxG,QAAID,YAAW,KAAK,UAAU,IAAIA,YAAW,QAAQ,GAAG;AACtD,aAAO,OAAO,eAAe,KAAK,UAAU,aAAa,QAAQ,EAAE;AAAA,IACrE;AACA,YAAQ,KAAK,UAAU,KAAK,UAAU,WAAM,QAAQ,EAAE;AAAA,EACxD;AAEA,QAAM,eAAe,KAAK,yBAAyB,2BAA2B,KAAK,UAAU;AAC7F,MAAIC,qBAAoB,sBAAsB,IAAIA,qBAAoB,YAAY,GAAG;AACnF,WAAO,OAAO,uBAAuB,sBAAsB,YAAY,YAAY,EAAE;AAAA,EACvF;AACA,UAAQ,KAAK,SAAS,sBAAsB,WAAM,YAAY,EAAE;AAChE,MAAI,UAAU,eAAe,QAAQ;AACnC,QAAI,CAAC,KAAK,eAAe,KAAK,CAAC,cAAc,UAAU,eAAe,SAAS,SAAS,CAAC,GAAG;AAC1F,aAAO,OAAO,+BAA+B;AAAA,IAC/C;AACA,YAAQ,KAAK,sBAAsB;AAAA,EACrC;AAEA,MAAI,KAAK,QAAQ,QAAQ;AACvB,UAAM,cAAc,UAAU,eAAe,CAAC;AAC9C,UAAM,cAAc,KAAK,OAAO,OAAO,CAAC,UAAU,CAAC,YAAY,SAAS,KAAK,CAAC;AAC9E,QAAI,YAAY,OAAQ,QAAO,OAAO,uBAAuB,YAAY,KAAK,IAAI,CAAC,EAAE;AACrF,YAAQ,KAAK,kBAAkB;AAAA,EACjC;AAEA,MAAI,SAAS,KAAK,cAAc;AAC9B,QAAI,CAAC,KAAK,yBAAyB,SAAS,SAAS,KAAK,YAAY,GAAG;AACvE,aAAO,OAAO,iBAAiB,SAAS,KAAK,YAAY,iBAAiB;AAAA,IAC5E;AACA,YAAQ,KAAK,iBAAiB,SAAS,KAAK,YAAY,YAAY;AAAA,EACtE;AACA,QAAM,sBAAsB,SAAS,KAAK,YAAY,uBAAuB,CAAC;AAC9E,QAAM,mBAAmB,oBAAoB;AAAA,IAC3C,CAAC,cAAc,CAAC,KAAK,sBAAsB,SAAS,SAAS;AAAA,EAC/D;AACA,MAAI,iBAAkB,QAAO,OAAO,cAAc,gBAAgB,iBAAiB;AACnF,MAAI,oBAAoB,OAAQ,SAAQ,KAAK,iCAAiC;AAE9E,QAAM,qBAAqB,SAAS,KAAK,aAAa;AACtD,MAAI,oBAAoB;AACtB,QAAI,CAAC,KAAK,uBAAuB,SAAS,kBAAkB,GAAG;AAC7D,aAAO,OAAO,eAAe,kBAAkB,iBAAiB;AAAA,IAClE;AACA,YAAQ,KAAK,eAAe,kBAAkB,YAAY;AAAA,EAC5D;AAEA,QAAM,gBAAgB,SAAS,KAAK;AACpC,MAAI,eAAe,cAAc;AAC/B,UAAM,aAAa,KAAK,qBAAqB;AAAA,MAC3C,CAAC,cAAc,UAAU,iBAAiB,cAAc;AAAA,IAC1D;AACA,QAAI,CAAC,WAAY,QAAO,OAAO,iBAAiB,cAAc,YAAY,iBAAiB;AAC3F,UAAM,UAAU,cAAc,sBAAsB;AACpD,QAAI,yBAAyB,WAAW,gBAAgB,IAAI,yBAAyB,OAAO,GAAG;AAC7F,aAAO,OAAO,uBAAuB,WAAW,gBAAgB,aAAa,OAAO,EAAE;AAAA,IACxF;AACA,QAAI,cAAc,UAAU,CAAC,WAAW,QAAQ,SAAS,cAAc,MAAM,GAAG;AAC9E,aAAO,OAAO,uBAAuB,cAAc,MAAM,iBAAiB;AAAA,IAC5E;AACA,YAAQ,KAAK,iBAAiB,cAAc,YAAY,cAAc;AAAA,EACxE;AAEA,QAAM,gBAAgB,SAAS,KAAK;AACpC,MACE,eAAe,gBACf,CAAC,KAAK,yBAAyB,SAAS,cAAc,YAAY,GAClE;AACA,WAAO,OAAO,iBAAiB,cAAc,YAAY,iBAAiB;AAAA,EAC5E;AACA,QAAM,eAAe,eAAe,SAAS;AAAA,IAC3C,CAAC,WAAW,CAAC,KAAK,uBAAuB,SAAS,OAAO,QAAQ;AAAA,EACnE;AACA,MAAI,aAAc,QAAO,OAAO,gBAAgB,aAAa,QAAQ,iBAAiB;AACtF,MAAI,eAAe,gBAAgB,eAAe,SAAS,QAAQ;AACjE,YAAQ,KAAK,gCAAgC;AAAA,EAC/C;AAEA,QAAM,mBAAmB,SAAS,KAAK;AACvC,MAAI,kBAAkB;AACpB,UAAM,aAAa,KAAK,wBAAwB;AAAA,MAC9C,CAAC,cACC,CAAC,iBAAiB,eAClB,UAAU,gBAAgB,iBAAiB;AAAA,IAC/C;AACA,QAAI,CAAC,WAAY,QAAO,OAAO,2CAA2C;AAC1E,UAAM,kBAAkB,iBAAiB,WAAW;AAAA,MAClD,CAAC,aAAa,CAAC,WAAW,WAAW,SAAS,QAAQ;AAAA,IACxD;AACA,QAAI,gBAAiB,QAAO,OAAO,uBAAuB,eAAe,iBAAiB;AAC1F,UAAM,gBAAgB,iBAAiB,SAAS;AAAA,MAC9C,CAAC,WAAW,CAAC,WAAW,SAAS,SAAS,MAAM;AAAA,IAClD;AACA,QAAI,cAAe,QAAO,OAAO,qBAAqB,aAAa,iBAAiB;AACpF,YAAQ,KAAK,0CAA0C;AAAA,EACzD;AAEA,QAAM,eAAe,SAAS,KAAK;AACnC,MAAI,cAAc;AAChB,UAAM,aAAsE;AAAA,MAC1E,CAAC,iBAAiB,KAAK;AAAA,MACvB,CAAC,eAAe,QAAQ;AAAA,MACxB,CAAC,YAAY,KAAK;AAAA,MAClB,CAAC,aAAa,MAAM;AAAA,MACpB,CAAC,iBAAiB,WAAW;AAAA,IAC/B;AACA,eAAW,CAAC,KAAK,KAAK,KAAK,YAAY;AACrC,YAAM,YAAY,aAAa,GAAG;AAClC,UAAI,cAAc,OAAW;AAC7B,UAAI,CAAC,OAAO,SAAS,SAAS,KAAK,YAAY,EAAG,QAAO,OAAO,GAAG,KAAK,qBAAqB;AAC7F,WAAK,KAAK,WAAW,GAAG,KAAK,KAAK,UAAW,QAAO,OAAO,gBAAgB,KAAK,WAAW;AAAA,IAC7F;AACA,YAAQ,KAAK,uBAAuB;AAAA,EACtC;AAEA,QAAM,UAAU,UAAU;AAC1B,MAAI,SAAS;AACX,QAAI,QAAQ,sBAAsB,SAAS,KAAK,WAAW,GAAG;AAC5D,aAAO,OAAO,gBAAgB,KAAK,WAAW,iCAAiC;AAAA,IACjF;AACA,UAAM,UAAU,KAAK,cAAc,QAAQ,OAAO,KAAK;AACvD,QACE,QAAQ,gCAAgC,UACxC,WAAW,QAAQ,6BACnB;AACA,aAAO,OAAO,iBAAiB,QAAQ,OAAO,iCAAiC;AAAA,IACjF;AACA,YAAQ,KAAK,iBAAiB,QAAQ,OAAO,WAAW;AAAA,EAC1D;AAEA,SAAO,EAAE,UAAU,MAAM,QAAQ;AACnC;AAMA,SAAS,uBACP,QACA,iBACA,QACA,KACqB;AACrB,QAAM,cAAc,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,cAAc,UAAU,SAAS,WAAW;AACjG,aAAW,KAAK,EAAE,MAAM,aAAa,QAAQ,iBAAiB,QAAQ,oBAAoB,IAAI,YAAY,EAAE,CAAC;AAC7G,SAAO,EAAE,GAAG,QAAQ,WAAW;AACjC;AAcO,SAAS,wBACd,QACA,SAC2C;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAA6C;AAC3D,YAAM,WAAW,QAAQ;AACzB,YAAM,SAAS,SAAS,UAAU,CAAC;AAInC,UAAI,SAAS,KAAK,WAAW,cAAc;AACzC,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AAGA,UAAI,OAAO,UAAU,aAAa,OAAO,UAAU,QAAW;AAC5D,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AAEA,YAAM,QAAQ,MAAM,QAAQ,UAAU;AACtC,YAAM,WAAW,QAAQ,UAAU,SAAS,UAAU,KAAK;AAE3D,UAAI,CAAC,UAAU;AACb,eAAO;AAAA,UACL,QAAQ;AAAA,YACN;AAAA,cACE,GAAG;AAAA,cACH,OAAO;AAAA,cACP,eAAe;AAAA,YACjB;AAAA,YACA;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS,QAAQ;AAC3D,YAAM,cAAc,OAAO,wBAAwB,UAAU,IAAI,IAAI,OAAO,8BAA8B;AAC1G,UAAI,CAAC,YAAY,UAAU;AACzB,eAAO;AAAA,UACL,QAAQ;AAAA,YACN;AAAA,cACE,GAAG;AAAA,cACH,OAAO;AAAA,cACP,eAAe,QAAQ,SAAS,QAAQ,0BAA0B,YAAY,SAAS;AAAA,YACzF;AAAA,YACA;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,YAAM,iBAAiB,QAAQ,qBAC3B,MAAM,QAAQ,mBAAmB;AAAA,QACjC;AAAA,QACA;AAAA,QACA,OAAO,QAAQ;AAAA,QACf,YAAY,QAAQ;AAAA,MACtB,CAAC,IACC;AACJ,UAAI,gBAAgB,YAAY,QAAQ;AACtC,eAAO;AAAA,UACL,QAAQ;AAAA,YACN;AAAA,cACE,GAAG;AAAA,cACH,OAAO;AAAA,cACP,sBAAsB,eAAe;AAAA,cACrC,uBAAuB,eAAe;AAAA,cACtC,eAAe,QAAQ,SAAS,QAAQ,wCAAwC,eAAe,QAAQ,KAAK,IAAI,CAAC;AAAA,YACnH;AAAA,YACA;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN;AAAA,YACE,GAAG;AAAA,YACH,OAAO;AAAA,YACP,cAAc,SAAS;AAAA,YACvB,GAAI,iBACA;AAAA,cACA,sBAAsB,eAAe;AAAA,cACrC,uBAAuB,eAAe;AAAA,YACxC,IACE,CAAC;AAAA,YACL,eAAe,YAAY,SAAS,QAAQ,YAAY,SAAS,KAAK,YAAY,QAAQ,UAAU;AAAA,UACtG;AAAA,UACA;AAAA,UACA,WAAW,SAAS,QAAQ;AAAA,UAC5B,QAAQ;AAAA,QACV;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAkBO,SAAS,0BAAqC;AACnD,SAAO;AAAA,IACL,SAAS,UAAU,OAAO;AACxB,YAAM,YAAY,SAAS,KAAK,aAAa,CAAC;AAC9C,YAAM,aAA+E,CAAC;AAEtF,iBAAW,QAAQ,OAAO;AACxB,cAAM,cAAc,wBAAwB,UAAU,IAAI;AAC1D,YAAI,CAAC,YAAY,SAAU;AAC3B,cAAM,UAAU,YAAY;AAG5B,cAAM,MAAM,KAAK,UAAU,iBAAiB;AAC5C,cAAM,SAAS,KAAK,UAAU,eAAe;AAC7C,YAAI,QAAQ,MAAM,KAAK,MAAM,UAAU,OAAO,KAAK;AACnD,gBAAQ,KAAK,mBAAmB,KAAK,EAAE;AAGvC,iBAASD,YAAW,KAAK,UAAU,IAAI;AACvC,YAAI,KAAK,eAAe,WAAW;AACjC,kBAAQ,KAAK,oBAAoB;AAAA,QACnC,WAAW,KAAK,eAAe,cAAc;AAC3C,kBAAQ,KAAK,0BAA0B;AAAA,QACzC;AAGA,YAAI,KAAK,oBAAoB,KAAK,mBAAmB,GAAG;AACtD,mBAAS,KAAK,IAAI,KAAK,mBAAmB,IAAI,GAAG;AACjD,kBAAQ,KAAK,sBAAsB,KAAK,gBAAgB,EAAE;AAAA,QAC5D;AAEA,YAAI,UAAU,kBAAkB,KAAK,MAAM;AACzC,mBAAS;AACT,kBAAQ,KAAK,yBAAyB;AAAA,QACxC;AACA,cAAM,iBAAiB,SAAS,KAAK,oBAAoB;AAAA,UACvD,CAAC,cAAc,KAAK,yBAAyB,SAAS,SAAS;AAAA,QACjE,EAAE,UAAU;AACZ,YAAI,gBAAgB;AAClB,mBAAS,iBAAiB;AAC1B,kBAAQ,KAAK,GAAG,cAAc,oBAAoB;AAAA,QACpD;AACA,YACE,SAAS,KAAK,uBACd,KAAK,2BAA2B,SAAS,SAAS,KAAK,mBAAmB,GAC1E;AACA,mBAAS;AACT,kBAAQ,KAAK,kBAAkB;AAAA,QACjC;AAEA,mBAAW,KAAK,EAAE,MAAM,OAAO,QAAQ,CAAC;AAAA,MAC1C;AAEA,UAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,iBAAW,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AAC3C,YAAM,OAAO,WAAW,CAAC;AACzB,aAAO;AAAA,QACL,UAAU,KAAK,KAAK;AAAA,QACpB,OAAO,KAAK;AAAA,QACZ,SAAS,KAAK;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACF;;;AC1gBA,IAAME,UAAS;AACf,IAAMC,uBAAsB;AAC5B,IAAM,cAAc,oBAAI,IAAI;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,UAAU,SAAwB;AACzC,QAAM,IAAI,mBAAmB;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AACH;AAOO,SAAS,8BAEN;AACR,SAAO,CAAC,YAAY;AAClB,QAAI,QAAQ,UAAU,SAAS,kBAAmB;AAClD,QAAI,QAAQ,SAAS,UAAU;AAC7B,gBAAU,uCAAuC;AAAA,IACnD;AACA,UAAM,OAAO,QAAQ,kBAAkB;AACvC,UAAM,aAAa,MAAM;AACzB,UAAM,mBAAmB,cACrB,OAAO,eAAe,YACtB,CAAC,MAAM,QAAQ,UAAU,IACzB,OAAO,QAAQ,UAAU,IACzB,CAAC;AACL,UAAM,OAAO,MAAM;AACnB,UAAM,qBAAqB,MAAM,SAAS,UACtC,CAAC,QAAQ,UAAU,WAAW,YAAY,IAC1C,MAAM,SAAS,UACf,CAAC,QAAQ,QAAQ,UAAU,IAC3B,MAAM,SAAS,WACf,CAAC,QAAQ,QAAQ,SAAS,MAAM,IAChC,MAAM,SAAS,UACf,CAAC,QAAQ,QAAQ,WAAW,UAAU,cAAc,QAAQ,IAC5D,CAAC;AACL,UAAM,kBAAkB;AAAA,MACtB,QACE,KAAK,SAAS,MAAM,cACpB,OAAO,KAAK,IAAI,EAAE,MAAM,CAAC,UAAU,mBAAmB,SAAS,KAAK,CAAC,MAElE,KAAK,SAAS,WACb,OAAO,KAAK,WAAW,YACvB,CAAC,WAAW,UAAU,SAAS,EAAE,SAAS,OAAO,KAAK,OAAO,CAAC,KAC/D,KAAK,SAAS,WACb,OAAO,KAAK,SAAS,YACrB,CAAC,SAAS,QAAQ,WAAW,SAAS,UAAU,EAAE;AAAA,QAChD,OAAO,KAAK,QAAQ;AAAA,MACtB,KACD,KAAK,SAAS,YACb,OAAO,KAAK,SAAS,YACrB,OAAO,KAAK,UAAU,YACtB,OAAO,SAAS,KAAK,KAAK,KAC1B,OAAO,KAAK,SAAS,YACtB,KAAK,SAAS,WACb,OAAO,KAAK,SAAS,YACrB,OAAO,KAAK,YAAY,YACxB,OAAO,KAAK,WAAW,YACvB,OAAO,KAAK,eAAe,YAC3B,OAAO,SAAS,KAAK,UAAU,KAC/B,KAAK,cAAc,KACnB,CAAC,MAAM,OAAO,EAAE,SAAS,OAAO,KAAK,MAAM,CAAC;AAAA,IAEpD;AACA,QACE,CAAC,QACD,OAAO,KAAK,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,IAAI,KAAK,CAAC,KACzD,KAAK,OAAO,OAAO,QAAQ,MAAM,MACjC,KAAK,OAAO,SAAS,QAAQ,MAAM,QACnC,CAAC,KAAK,UACN,KAAK,OAAO,SAAS,OACrB,CAAC,OAAO,cAAc,KAAK,QAAQ,KACnC,KAAK,WAAW,KAChB,CAAC,KAAK,eACN,OAAO,MAAM,KAAK,MAAM,KAAK,UAAU,CAAC,KACxC,CAAC,CAAC,SAAS,SAAS,UAAU,OAAO,EAAE,SAAS,KAAK,UAAU,KAC/D,CAAC,mBACD,OAAO,OAAO,QAAQ,CAAC,CAAC,EAAE;AAAA,MACxB,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IACzD,KACA,CAAC,KAAK,cACN,CAAC,CAAC,cAAc,WAAW,UAAU,UAAU,UAAU,EAAE;AAAA,MACzD,KAAK,WAAW;AAAA,IAClB,KACA,CAAC,KAAK,WAAW,YACjB,KAAK,WAAW,SAAS,SAAS,OACjC,KAAK,WAAW,YAAY,WAEzB,OAAO,KAAK,WAAW,YAAY,YACnC,CAAC,KAAK,WAAW,WACjB,KAAK,WAAW,QAAQ,SAAS,QAErC,CAAC;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,SAAS,KAAK,MAAM,KACtB,CAAC,cACD,OAAO,eAAe,YACtB,MAAM,QAAQ,UAAU,KACxB,iBAAiB,SAAS,MAC1B,iBAAiB;AAAA,MAAK,CAAC,CAAC,KAAK,KAAK,MAChC,CAAC,OACD,IAAI,SAAS,MACbA,qBAAoB,KAAK,GAAG,KAC5B,OAAO,UAAU,YACjB,MAAM,SAAS,OACf,gBAAgB,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC;AAAA,IAClC,KACA,CAAC,OAAO,cAAc,KAAK,YAAY,KACvC,KAAK,eAAe,KACpB,CAACD,QAAO,KAAK,KAAK,YAAY,KAC9B,CAACA,QAAO,KAAK,KAAK,gBAAgB,KAClC,CAACA,QAAO,KAAK,KAAK,YAAY,KAC9B,CAACA,QAAO,KAAK,KAAK,kBAAkB,KACpC,CAACA,QAAO,KAAK,KAAK,iBAAiB,KAClC,KAAK,mBAAmB,UAAa,CAACA,QAAO,KAAK,KAAK,cAAc,KACtE,QAAQ,UAAU,SAChB,SAAS,KAAK,kBAAkB,MAAM,UAAU,QAAQ,EAAE,CAAC,IAC7D;AACA,gBAAU,0CAA0C;AAAA,IACtD;AAAA,EACF;AACF;;;ACjEA,IAAM,eAAe;AACrB,IAAM,iBAAiB,KAAK,KAAK;AACjC,IAAM,aAAa,KAAK,KAAK;AAU7B,IAAI,eAAe;AAEZ,SAAS,+BAA+B,SAAkE;AAC/G,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,aAAa,QAAQ,gBAAgB;AAC3C,QAAM,SAAS,QAAQ,YAAY;AACnC,QAAME,WAAU,IAAI,YAAY;AAChC,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,UAAU,oBAAI,IAAY;AAEhC,QAAM,gBAAgB,oBAAI,IAAY;AAEtC,WAAS,YAAY,SAAqC;AACxD,QAAI,CAAC,QAAQ,OAAO,OAAO,CAAC,QAAQ,OAAO,QAAQ,CAAC,QAAQ,OAAO,cAAc,CAAC,QAAQ,OAAO,MAAM;AACrG,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,6CAA6C,WAAW,MAAM,CAAC;AAAA,IAC1H;AACA,QAAI,CAAC,OAAO,UAAU,QAAQ,OAAO,KAAK,QAAQ,UAAU,GAAG;AAC7D,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,uDAAuD,WAAW,MAAM,CAAC;AAAA,IACpI;AACA,QAAI,CAAC,QAAQ,WAAW;AACtB,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,2CAA2C,WAAW,MAAM,CAAC;AAAA,IACxH;AACA,QAAI,CAAC,QAAQ,QAAQ;AACnB,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,uCAAuC,WAAW,MAAM,CAAC;AAAA,IACpH;AACA,QAAI,CAAC,QAAQ,QAAQ;AACnB,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,uCAAuC,WAAW,MAAM,CAAC;AAAA,IACpH;AACA,QAAI,CAAC,QAAQ,UAAU;AACrB,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,yCAAyC,WAAW,MAAM,CAAC;AAAA,IACtH;AACA,QAAI,CAAC,QAAQ,cAAc;AACzB,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,8CAA8C,WAAW,MAAM,CAAC;AAAA,IAC3H;AAAA,EACF;AAEA,iBAAe,KAAK,QAA+D;AACjF,UAAM,UAAUA,SAAQ,OAAO,KAAK,UAAU,MAAM,CAAC;AACrD,UAAM,YAAY,MAAM,QAAQ,OAAO,KAAK,OAAO;AACnD,WAAO,EAAE,OAAO,GAAG,YAAY,IAAI,gBAAgB,OAAO,CAAC,IAAI,gBAAgB,SAAS,CAAC,IAAI,OAAO;AAAA,EACtG;AAEA,iBAAe,eAAe,OAA+C;AAC3E,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc;AACnD,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,8BAA8B,WAAW,MAAM,CAAC;AAAA,IAC3G;AACA,UAAM,UAAU,gBAAgB,MAAM,CAAC,CAAC;AACxC,UAAM,YAAY,gBAAgB,MAAM,CAAC,CAAC;AAC1C,QAAI,CAAE,MAAM,QAAQ,OAAO,OAAO,SAAS,SAAS,GAAI;AACtD,YAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,SAAS,sCAAsC,WAAW,MAAM,CAAC;AAAA,IACrH;AACA,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,QAAQ,OAAO,OAAO,CAAC;AAAA,IAC7C,QAAQ;AACN,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,oCAAoC,WAAW,MAAM,CAAC;AAAA,IACjH;AACA,WAAO;AAAA,EACT;AAEA,WAAS,aAAa,QAA+B,IAAgB;AACnE,QAAI,QAAQ,IAAI,OAAO,OAAO,GAAG;AAC/B,YAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,SAAS,4BAA4B,WAAW,OAAO,SAAS,EAAE,SAAS,OAAO,QAAQ,EAAE,CAAC;AAAA,IACjJ;AACA,QAAI,GAAG,QAAQ,KAAK,KAAK,MAAM,OAAO,SAAS,GAAG;AAChD,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,4BAA4B,WAAW,OAAO,SAAS,EAAE,WAAW,OAAO,UAAU,EAAE,CAAC;AAAA,IACnJ;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,MAAM,SAAS;AACnB,kBAAY,OAAO;AACnB,YAAM,WAAW,IAAI;AACrB,YAAM,MAAM,KAAK,IAAI,QAAQ,SAAS,YAAY,MAAM;AACxD,UAAI,OAAO,GAAG;AACZ,cAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,yCAAyC,WAAW,MAAM,CAAC;AAAA,MACtH;AACA,sBAAgB;AAChB,YAAM,SAAgC;AAAA,QACpC,SAAS,QAAQ,WAAW,QAAQ,SAAS,QAAQ,EAAE,SAAS,EAAE,CAAC,IAAI,aAAa,SAAS,EAAE,CAAC;AAAA,QAChG,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,QACjB,WAAW,QAAQ;AAAA,QACnB,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,QAChB,UAAU,QAAQ;AAAA,QAClB,cAAc,QAAQ;AAAA,QACtB,UAAU,SAAS,YAAY;AAAA,QAC/B,WAAW,IAAI,KAAK,SAAS,QAAQ,IAAI,GAAG,EAAE,YAAY;AAAA,MAC5D;AACA,oBAAc,IAAI,OAAO,OAAO;AAChC,aAAO,KAAK,MAAM;AAAA,IACpB;AAAA,IAEA,MAAM,MAAM,OAAO,eAAe,CAAC,GAAG;AACpC,YAAM,SAAS,MAAM,eAAe,KAAK;AACzC,mBAAa,QAAQ,aAAa,MAAM,KAAK,IAAI,CAAC;AAClD,YAAM,YAAY,aAAa,MAAM,KAAK,IAAI;AAC9C,YAAM,MAAM,KAAK,IAAI,aAAa,SAAS,YAAY,MAAM;AAC7D,aAAO,KAAK;AAAA,QACV,GAAG;AAAA,QACH,WAAW,UAAU,YAAY;AAAA,QACjC,WAAW,IAAI,KAAK,UAAU,QAAQ,IAAI,GAAG,EAAE,YAAY;AAAA,MAC7D,CAAC;AAAA,IACH;AAAA,IAEA,OAAO,SAAS;AACd,cAAQ,IAAI,OAAO;AAAA,IACrB;AAAA,IAEA,MAAM,QAAQ,OAAO;AACnB,YAAM,SAAS,MAAM,eAAe,KAAK;AACzC,YAAM,UAAU,IAAI,EAAE,QAAQ,KAAK,KAAK,MAAM,OAAO,SAAS;AAC9D,YAAM,YAAY,QAAQ,IAAI,OAAO,OAAO;AAC5C,YAAM,WAAW,cAAc,IAAI,OAAO,OAAO,IAAI,mBAAmB;AACxE,aAAO;AAAA,QACL,SAAS,OAAO;AAAA,QAChB,OAAO;AAAA,UACL,QAAQ,OAAO;AAAA,UACf,SAAS,OAAO;AAAA,UAChB,WAAW,OAAO;AAAA,UAClB,QAAQ,OAAO;AAAA,UACf,QAAQ,OAAO;AAAA,UACf,UAAU,OAAO;AAAA,UACjB,cAAc,OAAO;AAAA,QACvB;AAAA,QACA,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,QACT;AAAA,QACA;AAAA,QACA,kBAAkB,aAAa,UAAU;AAAA,QACzC,GAAI,aAAa,SAAS,EAAE,gBAAgB,iFAAiF,IAAI,CAAC;AAAA,MACpI;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,OAAO,cAAc;AAChC,YAAM,SAAS,MAAM,eAAe,KAAK;AACzC,mBAAa,QAAQ,IAAI,CAAC;AAC1B,UACE,OAAO,OAAO,eAAe,aAAa,OAAO,cACjD,OAAO,OAAO,SAAS,aAAa,OAAO,QAC3C,OAAO,OAAO,SAAS,aAAa,OAAO,QAC3C,OAAO,OAAO,QAAQ,aAAa,OAAO,OAC1C,OAAO,YAAY,aAAa,WAChC,OAAO,iBAAiB,aAAa,cACrC;AACA,cAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,SAAS,iDAAiD,WAAW,MAAM,CAAC;AAAA,MAChI;AACA,UAAI,OAAO,WAAW,aAAa,QAAQ;AACzC,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,+CAA+C,aAAa,MAAM;AAAA,UAC3E,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,OAAO,WAAW,aAAa,QAAQ;AACzC,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,+CAA+C,aAAa,MAAM;AAAA,UAC3E,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,OAAO,aAAa,aAAa,UAAU;AAC7C,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,iDAAiD,aAAa,QAAQ;AAAA,UAC/E,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,OAAO,cAAc,aAAa,WAAW;AAC/C,cAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,SAAS,wCAAwC,WAAW,MAAM,CAAC;AAAA,MACvH;AACA,UACE,CAAE,MAAM,QAAQ,cAAc,iBAAiB;AAAA,QAC7C,WAAW,OAAO;AAAA,QAClB,SAAS,OAAO;AAAA,QAChB,UAAU,OAAO;AAAA,QACjB,OAAO,aAAa;AAAA,MACtB,CAAC,GACD;AACA,cAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,SAAS,gDAAgD,WAAW,MAAM,CAAC;AAAA,MAC/H;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACjQA,eAAsB,yBACpB,OACA,OACA,gBACA,QACA,UACA,MAAkB,MAAM,oBAAI,KAAK,GACE;AACnC,MAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,SAAS;AACzD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAGA,QAAM,aAAa,MAAM,MAAM,IAAI;AAAA,IACjC,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAED,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,oBAAoB,cAAc,YAAY;AAAA,EAChE;AAGA,MAAI,WAAW,KAAK,eAAe,cAAc;AAC/C,UAAM,IAAI;AAAA,MACR,0DAA0D,cAAc,oBAAoB,WAAW,KAAK,UAAU;AAAA,IACxH;AAAA,EACF;AAGA,QAAM,WAAW,MAAM,MAAM,KAAK;AAAA,IAChC,MAAM;AAAA,EACR,CAAC;AACD,QAAM,cAAc,IAAI;AACxB,QAAM,iBAAkB,SAAS,MAA6C;AAAA,IAC5E,CAAC,YACC,QAAQ,KAAK,cAAc,SAAS,kBACpC,qBAAqB,SAAS,WAAW;AAAA,EAC7C;AAGA,QAAM,YAAY,IAAI,EAAE,YAAY;AACpC,aAAW,WAAW,gBAAgB;AACpC,UAAM,MAAM;AAAA,MACV;AAAA,MACA,EAAE,YAAY,4BAA4B,MAAM,qBAAqB,MAAM,QAAQ,SAAS,KAAK;AAAA,MACjG;AAAA,QACE,OAAO;AAAA,QACP;AAAA,QACA,cAAc,uBAAuB,MAAM;AAAA,MAC7C;AAAA,MACA,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,IACtD;AAAA,EACF;AAGA,QAAM,MAAM;AAAA,IACV;AAAA,IACA,EAAE,YAAY,+BAA+B,MAAM,wBAAwB,MAAM,eAAe;AAAA,IAChG;AAAA,MACE,OAAO;AAAA,MACP;AAAA,MACA,cAAc;AAAA,IAChB;AAAA,IACA,EAAE,iBAAiB,WAAW,SAAS,gBAAgB;AAAA,EACzD;AAEA,SAAO;AAAA,IACL;AAAA,IACA,cAAc,eAAe,IAAI,CAAC,YAAY,QAAQ,SAAS,IAAI;AAAA,IACnE;AAAA,IACA,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACF;AAOA,eAAsB,gBACpB,OACA,OACA,SACA,MAAkB,MAAM,oBAAI,KAAK,GACE;AACnC,MAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,SAAS;AACzD,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAGA,QAAM,SAAS,MAAM,MAAM,IAAI;AAAA,IAC7B,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,MAAM,QAAQ;AAAA,EAChB,CAAC;AAED,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,oBAAoB,QAAQ,oBAAoB,YAAY;AAAA,EAC9E;AAEA,MAAI,OAAO,KAAK,eAAe,cAAc;AAC3C,UAAM,IAAI;AAAA,MACR,+CAA+C,QAAQ,oBAAoB,oBAAoB,OAAO,KAAK,UAAU;AAAA,IACvH;AAAA,EACF;AAGA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,2CAA2C,QAAQ,oBAAoB;AAAA,IACvE;AAAA,EACF;AAGA,QAAM,oBAAoB,GAAG,QAAQ,oBAAoB,aAAa,KAAK,IAAI,CAAC;AAChF,QAAM,WAAW;AAAA,IACf,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,MAAM,kBAAkB;AAAA,IACpC,MAAM;AAAA,MACJ,SAAS,OAAO,KAAK;AAAA,MACrB,YAAY,QAAQ;AAAA,MACpB,oBAAoB,OAAO,KAAK;AAAA,MAChC,YAAY,QAAQ;AAAA,MACpB,WAAW,IAAI,KAAK,IAAI,EAAE,QAAQ,IAAI,KAAK,KAAK,KAAK,GAAI,EAAE,YAAY;AAAA,IACzE;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,MAAM,OAAO,OAAO,QAAQ;AACnD,SAAO;AACT;AAKA,eAAsB,kBACpB,OACA,gBACkB;AAClB,QAAM,aAAa,MAAM,MAAM,IAAI;AAAA,IACjC,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAED,SAAO,YAAY,QAAQ,UAAU;AACvC;;;ACvLO,IAAM,mBAAmB;AACzB,IAAM,YAAY;AA6BzB,IAAM,gCAAgC,oBAAI,IAAI;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcM,SAAS,4BAAiF;AAC/F,SAAO,CAAC,YAA8C;AACpD,QAAI,QAAQ,UAAU,SAAS,UAAW;AAE1C,UAAM,EAAE,OAAO,MAAM,SAAS,eAAe,IAAI;AAGjD,QAAI,SAAS,UAAU;AAIrB;AAAA,IACF;AAEA,QAAI,SAAS,mBAAmB,WAAW,gBAAgB;AACzD,YAAM,gBAAgB,QAAQ;AAC9B,YAAM,qBAAqB;AAG3B,UAAI,eAAe,eAAe,mBAAmB,YAAY;AAC/D;AAAA,MACF;AAGA,UAAI,MAAM,SAAS,YAAY;AAC7B,cAAM,IAAI;AAAA,UACR,gEAAgE,MAAM,IAAI;AAAA,QAC5E;AAAA,MACF;AAGA,UAAI,CAAC,mBAAmB,iBAAiB,mBAAmB,cAAc,WAAW,GAAG;AACtF,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AAGA,UAAI,CAAC,mBAAmB,mBAAmB,mBAAmB,oBAAoB,MAAM,IAAI;AAC1F,cAAM,IAAI;AAAA,UACR,6EAA6E,MAAM,EAAE;AAAA,QACvF;AAAA,MACF;AAEA;AAAA,IACF;AAEA,QAAI,SAAS,mBAAmB,SAAS,eAAe;AAGtD,YAAM,YAAY,QAAQ,UAAU,QAAQ;AAC5C,YAAM,YAAa,SAAS,QAAmC;AAC/D,UAAI,cAAc,gBAAgB,cAAc,cAAc;AAC5D,mBAAW,QAAQ,+BAA+B;AAChD,cAAI,UAAU,WAAW,IAAI,GAAG;AAC9B,kBAAM,IAAI;AAAA,cACR,yBAAyB,SAAS,4CAA4C,IAAI;AAAA,YACpF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA;AAAA,IACF;AAAA,EACF;AACF;AAMO,SAAS,iBAAiB,MAAsB;AACrD,MAAI,KAAK,QAAQ;AACf,UAAM,kBAAkB,CAAC,eAAe,cAAc,YAAY;AAClE,eAAW,SAAS,iBAAiB;AACnC,UAAI,SAAS,KAAK,QAAQ;AACxB,cAAM,IAAI;AAAA,UACR,oDAAoD,KAAK;AAAA,QAC3D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAOO,SAAS,qBAAqB,YAA4B,MAAuB;AACtF,MAAI,eAAe,UAAW,QAAO;AACrC,SAAO,CAAC,8BAA8B,IAAI,IAAI;AAChD;;;AC3IA,SAASC,WAAU,SAAwB;AACzC,QAAM,IAAI,mBAAmB;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AACH;AAOO,SAAS,iCAEN;AACR,SAAO,CAAC,YAAY;AAClB,QAAI,QAAQ,UAAU,SAAS,qBAAsB;AAErD,QAAI,QAAQ,SAAS,UAAU;AAC7B,YAAM,OAAO,QAAQ,kBAAkB;AAGvC,UACE,CAAC,QACD,KAAK,gBAAgB,QAAQ,MAAM,OAEjC,KAAK,iBAAiB,eAClB,QAAQ,MAAM,SAAS,aACvB,QAAQ,MAAM,SAAS,gBACvB,QAAQ,MAAM,SAAS,YAG3B,KAAK,iBAAiB,cACtB,KAAK,mBAAmB,aAGxB,KAAK,iBAAiB,cACtB,KAAK,mBAAmB,WAE1B;AACA,QAAAA,WAAU,6DAA6D;AAAA,MACzE;AACA;AAAA,IACF;AAEA,QAAI,QAAQ,SAAS,iBAAiB;AACpC,YAAM,UAAU,QAAQ;AACxB,YAAM,WAAW,QAAQ;AAGzB,UACE,CAAC,WACD,QAAQ,KAAK,iBAAiB,cAC9B,QAAQ,KAAK,mBAAmB,aAChC,QAAQ,MAAM,SAAS,WACvB,CAAC,YACA,SAAS,YAAY,WAAW,SAAS,YAAY,UACtD,SAAS,cAAc,QAAQ,MAAM,MACrC,CAAC,SAAS,aACV,CAAC,SAAS,yBACV,CAAC,MAAM,QAAQ,SAAS,OAAO,KAC/B,SAAS,QAAQ,WAAW,GAC5B;AACA,QAAAA;AAAA,UACE;AAAA,QACF;AAAA,MACF;AACA,YAAM,gBAAgB,QAAQ;AAC9B,UACE,kBAEE,cAAc,YAAY,SAAS,WACnC,cAAc,cAAc,SAAS,aACrC,cAAc,cAAc,SAAS,aACrC,cAAc,0BACZ,SAAS,yBACX,cAAc,QAAQ,CAAC,MAAM,SAAS,QAAQ,CAAC,IAEjD;AACA,QAAAA,WAAU,iDAAiD;AAAA,MAC7D;AACA;AAAA,IACF;AAEA,IAAAA,WAAU,gEAAgE;AAAA,EAC5E;AACF;;;AC7BA,SAAS,OAAO,MAAsC,SAAiB,SAA4D;AACjI,SAAO,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,SAAS,WAAW,SAAS,eAAe,SAAS,eAAe,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC,EAAG,EAAE;AAC3I;AAEA,IAAM,eAAe;AAGd,SAAS,YAAY,SAA0B;AACpD,QAAM,KAAK,aAAa,KAAK,OAAO;AACpC,MAAI,IAAI;AACN,UAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC;AAC5C,QAAI,IAAI,OAAO,IAAI,IAAK,QAAO;AAC/B,QAAI,MAAM,KAAK,MAAM,MAAM,MAAM,IAAK,QAAO;AAC7C,QAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,QAAI,MAAM,OAAO,KAAK,MAAM,KAAK,GAAI,QAAO;AAC5C,QAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,QAAI,MAAM,OAAO,KAAK,MAAM,KAAK,IAAK,QAAO;AAC7C,QAAI,KAAK,IAAK,QAAO;AACrB,WAAO;AAAA,EACT;AACA,QAAM,aAAa,QAAQ,YAAY,EAAE,QAAQ,YAAY,EAAE;AAC/D,MAAI,eAAe,SAAS,eAAe,KAAM,QAAO;AACxD,MAAI,WAAW,WAAW,OAAO,EAAG,QAAO;AAC3C,MAAI,WAAW,WAAW,IAAI,KAAK,WAAW,WAAW,IAAI,EAAG,QAAO;AACvE,MAAI,WAAW,WAAW,SAAS,GAAG;AAEpC,UAAM,OAAO,WAAW,MAAM,UAAU,MAAM;AAC9C,QAAI,aAAa,KAAK,IAAI,EAAG,QAAO,YAAY,IAAI;AACpD,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,OAAO,WAAW,GAAG;AACvB,YAAM,KAAK,OAAO,SAAS,OAAO,CAAC,GAAG,EAAE;AACxC,YAAM,KAAK,OAAO,SAAS,OAAO,CAAC,GAAG,EAAE;AACxC,UAAI,CAAC,OAAO,MAAM,EAAE,KAAK,CAAC,OAAO,MAAM,EAAE,GAAG;AAC1C,eAAO,YAAY,GAAI,MAAM,IAAK,GAAG,IAAI,KAAK,GAAG,IAAK,MAAM,IAAK,GAAG,IAAI,KAAK,GAAG,EAAE;AAAA,MACpF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,YAAY,UAA2B;AAC9C,SAAO,aAAa,KAAK,QAAQ,KAAK,SAAS,SAAS,GAAG;AAC7D;AAEA,SAAS,qBAAqB,UAAkB,WAA8B;AAC5E,QAAM,QAAQ,SAAS,YAAY;AACnC,SAAO,UAAU,KAAK,CAAC,UAAU;AAC/B,UAAM,SAAS,MAAM,YAAY;AACjC,WAAO,UAAU,UAAU,MAAM,SAAS,IAAI,MAAM,EAAE;AAAA,EACxD,CAAC;AACH;AAQO,SAAS,yBAAyB,MAAoB,MAAM,KAAK,IAAI,GAAuB;AACjG,QAAM,UAAU,oBAAI,IAAoD;AACxE,SAAO;AAAA,IACL,QAAQ,KAAK,WAAW;AACtB,UAAI,aAAa,EAAG,QAAO;AAC3B,YAAM,KAAK,IAAI;AACf,YAAM,SAAS,QAAQ,IAAI,GAAG,KAAK,EAAE,QAAQ,WAAW,YAAY,GAAG;AACvE,YAAM,iBAAiB,KAAK,IAAI,IAAI,KAAK,OAAO,cAAc,GAAM;AACpE,YAAM,SAAS,KAAK,IAAI,WAAW,OAAO,SAAS,iBAAiB,SAAS;AAC7E,UAAI,SAAS,GAAG;AACd,gBAAQ,IAAI,KAAK,EAAE,QAAQ,YAAY,GAAG,CAAC;AAC3C,eAAO;AAAA,MACT;AACA,cAAQ,IAAI,KAAK,EAAE,QAAQ,SAAS,GAAG,YAAY,GAAG,CAAC;AACvD,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAGO,SAAS,6BAAuG;AACrH,QAAM,UAAU,oBAAI,IAAY;AAChC,SAAO;AAAA,IACL,OAAO,UAAU;AACf,cAAQ,IAAI,QAAQ;AAAA,IACtB;AAAA,IACA,UAAU,UAAU;AAClB,aAAO,QAAQ,IAAI,QAAQ;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,IAAM,kBAAkB,CAAC,OAAO,QAAQ,MAAM;AAC9C,IAAM,kBAAkB,CAAC,OAAO;AAChC,IAAM,gBAAgB,CAAC,GAAG;AAC1B,IAAM,mBAAmB,OAAO;AAChC,IAAM,0BAA0B;AAOhC,eAAsB,uBACpB,SACA,QACA,UAAoC,CAAC,GACH;AAClC,MAAI,QAAQ,YAAY,QAAQ,QAAQ,GAAG;AACzC,WAAO,OAAO,aAAa,WAAW,QAAQ,QAAQ,cAAc;AAAA,EACtE;AAEA,QAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,QAAM,iBAAiB,OAAO,kBAAkB;AAChD,MAAI,CAAC,eAAe,SAAS,MAAM,GAAG;AACpC,WAAO,OAAO,aAAa,WAAW,MAAM,oBAAoB,EAAE,eAAe,CAAC;AAAA,EACpF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,QAAQ,GAAG;AAAA,EAC3B,QAAQ;AACN,WAAO,OAAO,WAAW,QAAQ,QAAQ,GAAG,oBAAoB;AAAA,EAClE;AAEA,QAAM,SAAS,IAAI,SAAS,QAAQ,MAAM,EAAE,EAAE,YAAY;AAC1D,QAAM,iBAAiB,OAAO,kBAAkB;AAChD,MAAI,CAAC,eAAe,SAAS,MAAM,GAAG;AACpC,WAAO,OAAO,aAAa,WAAW,MAAM,oBAAoB,EAAE,eAAe,CAAC;AAAA,EACpF;AAEA,QAAM,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,IAAK,WAAW,UAAU,MAAM;AACvE,QAAM,eAAe,OAAO,gBAAgB;AAC5C,MAAI,CAAC,aAAa,SAAS,IAAI,GAAG;AAChC,WAAO,OAAO,aAAa,QAAQ,IAAI,mBAAmB,EAAE,aAAa,CAAC;AAAA,EAC5E;AAEA,QAAM,WAAW,IAAI,SAAS,YAAY;AAC1C,MAAI,OAAO,gBAAgB,CAAC,qBAAqB,UAAU,OAAO,YAAY,GAAG;AAC/E,WAAO,OAAO,aAAa,SAAS,QAAQ,2BAA2B;AAAA,EACzE;AAEA,MAAI,YAAsB,CAAC;AAC3B,MAAI,YAAY,QAAQ,GAAG;AACzB,gBAAY,CAAC,SAAS,QAAQ,YAAY,EAAE,CAAC;AAC7C,QAAI,CAAC,OAAO,wBAAwB,YAAY,QAAQ,GAAG;AACzD,aAAO,OAAO,aAAa,WAAW,QAAQ,sCAAsC;AAAA,IACtF;AAAA,EACF,WAAW,QAAQ,iBAAiB;AAClC,QAAI;AACF,kBAAY,MAAM,QAAQ,gBAAgB,QAAQ;AAAA,IACpD,QAAQ;AACN,aAAO,OAAO,eAAe,aAAa,QAAQ,yBAAyB;AAAA,IAC7E;AACA,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO,OAAO,eAAe,aAAa,QAAQ,4BAA4B;AAAA,IAChF;AACA,QAAI,CAAC,OAAO,sBAAsB;AAChC,YAAM,iBAAiB,UAAU,KAAK,CAAC,YAAY,YAAY,OAAO,CAAC;AACvE,UAAI,gBAAgB;AAClB,eAAO,OAAO,aAAa,aAAa,QAAQ,iCAAiC,cAAc,EAAE;AAAA,MACnG;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,eAAe,MAAM;AAChD,QAAM,UAAU,aAAa,gBAAgB,OAAO,gBAAgB;AACpE,OAAK,QAAQ,aAAa,KAAK,SAAS;AACtC,WAAO,OAAO,WAAW,gBAAgB,QAAQ,SAAS,wBAAwB,OAAO,IAAI,EAAE,cAAc,QAAQ,CAAC;AAAA,EACxH;AAEA,QAAM,YAAY,aAAa,qBAAqB,OAAO,6BAA6B;AACxF,QAAM,UAAU,QAAQ;AACxB,MAAI,WAAW,CAAC,QAAQ,QAAQ,GAAG,QAAQ,QAAQ,IAAI,MAAM,IAAI,SAAS,GAAG;AAC3E,WAAO,OAAO,aAAa,mCAAmC,QAAQ,QAAQ,aAAa,MAAM,KAAK,EAAE,mBAAmB,UAAU,CAAC;AAAA,EACxI;AAEA,SAAO,EAAE,IAAI,MAAM,eAAe,IAAI,SAAS,GAAG,UAAU,UAAU;AACxE;AAGA,eAAsB,uBACpB,SACA,UACA,QACA,UAAoC,CAAC,GACH;AAClC,SAAO;AAAA,IACL,EAAE,UAAU,QAAQ,UAAU,QAAQ,QAAQ,UAAU,OAAO,KAAK,UAAU,WAAW,EAAE;AAAA,IAC3F;AAAA,IACA;AAAA,EACF;AACF;;;ACnPO,IAAM,0BAA0B;AAEhC,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA2HA,IAAM,yBAA+D;AAAA,EACnE,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,qBAAqB;AAAA,EACrB,gBAAgB,KAAK;AAAA,EACrB,sBAAsB,KAAK;AAAA,EAC3B,mBAAmB,OAAO;AAAA,EAC1B,sBAAsB,KAAK;AAAA,EAC3B,kBAAkB,KAAK;AAAA,EACvB,oBAAoB;AACtB;AAEA,IAAM,6BAA6B,OAAO;AAC1C,IAAMC,2BAA0B;AAChC,IAAM,4BAA4B;AAClC,IAAM,UAAU,IAAI,YAAY;AAEhC,SAASC,UAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC1G,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAChE,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,YAAY,EAAE,KAAK,GAAG,CAAC;AACtE,MAAIA,UAAS,KAAK,GAAG;AACnB,UAAM,UAAU,OAAO,QAAQ,KAAK,EACjC,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,SAAS,MAAS,EACvC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE;AACtE,WAAO,IAAI,QAAQ,KAAK,GAAG,CAAC;AAAA,EAC9B;AACA,QAAM,IAAI,MAAM,gDAAgD;AAClE;AAGO,SAAS,oCACd,SACY;AACZ,QAAM,EAAE,WAAW,YAAY,GAAG,SAAS,IAAI;AAC/C,SAAO,QAAQ,OAAO,aAAa,QAAQ,CAAC;AAC9C;AAGO,SAAS,wCACd,YACY;AACZ,QAAM,EAAE,kBAAkB,mBAAmB,GAAG,SAAS,IAAI;AAC7D,SAAO,QAAQ,OAAO,aAAa,QAAQ,CAAC;AAC9C;AAEA,SAAS,SAAS,OAAwB;AACxC,SAAO,QAAQ,OAAO,aAAa,KAAK,CAAC,EAAE;AAC7C;AAEA,SAAS,cACP,MACA,SACA,YAAY,OACQ;AACpB,SAAO,IAAI,mBAAmB,EAAE,MAAM,SAAS,UAAU,CAAC;AAC5D;AAEA,SAAS,cAAc,SAAsC;AAC3D,MAAI,QAAQ,eAAe,yBAAyB;AAClD,UAAM,cAAc,eAAe,oBAAoB,OAAO,QAAQ,UAAU,CAAC,oBAAoB;AAAA,EACvG;AACA,MACE,CAAC,QAAQ,aACT,CAAC,QAAQ,eACT,CAAC,OAAO,cAAc,QAAQ,QAAQ,KACtC,QAAQ,WAAW,KACnB,CAAC,0BAA0B,KAAK,QAAQ,KAAK,KAC7C,CAAC,QAAQ,YACT,CAAC,QAAQ,UACT,CAAC,QAAQ,gBACT,CAAC,QAAQ,WACT;AACA,UAAM,cAAc,WAAW,+CAA+C;AAAA,EAChF;AACA,MACE,CAAC,QAAQ,KAAK,OACd,CAAC,OAAO,cAAc,QAAQ,IAAI,OAAO,KACzC,QAAQ,IAAI,UAAU,KACtB,CAAC,OAAO,cAAc,QAAQ,IAAI,KAAK,KACvC,QAAQ,IAAI,QAAQ,GACpB;AACA,UAAM,cAAc,WAAW,0CAA0C;AAAA,EAC3E;AACA,MAAI,CAAC,wBAAwB,SAAS,QAAQ,MAAM,GAAG;AACrD,UAAM,cAAc,aAAa,2BAA2B,QAAQ,MAAM,kBAAkB;AAAA,EAC9F;AACF;AAEA,SAAS,QAAQ,MAAwB,OAAkC;AACzE,SAAO,KAAK,QAAQ,MAAM,OAAO,KAAK,YAAY,MAAM,WAAW,KAAK,UAAU,MAAM;AAC1F;AAEA,SAAS,QAAQC,QAAwC;AACvD,MAAIA,kBAAiB,oBAAoB;AACvC,UAAM,gBAAyE;AAAA,MAC7E,SAAS;AAAA,MACT,WAAW;AAAA,MACX,WAAW;AAAA,MACX,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU;AAAA,MACV,aAAa;AAAA,IACf;AACA,WAAO;AAAA,MACL,MAAMA,OAAM;AAAA,MACZ,SAAS,cAAcA,OAAM,IAAI,KAAK;AAAA,MACtC,WAAWA,OAAM;AAAA,MACjB,GAAIA,OAAM,iBAAiB,SAAY,EAAE,cAAcA,OAAM,aAAa,IAAI,CAAC;AAAA,IACjF;AAAA,EACF;AACA,SAAO,EAAE,MAAM,YAAY,SAAS,iCAAiC,WAAW,MAAM;AACxF;AAMO,SAAS,4BAA4B,SAE1C;AACA,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,YAAY,QAAQ,wBAAwBF;AAClD,QAAM,mBAAmB,QAAQ,oBAAoB;AACrD,QAAM,aAAa,oBAAI,IAAsB;AAE7C,iBAAe,MACb,SACA,UACA,YACA,MACe;AACf,QAAI;AACF,YAAM,QAAQ,UAAU;AAAA,QACtB,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,QAChB,cAAc,QAAQ;AAAA,QACtB;AAAA,QACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AAAA,IAGR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,OAAO,SAAS,SAAS,IAAI,gBAAgB,EAAE,QAAQ;AAC3D,YAAM,WAAW,IAAI;AACrB,YAAM,aAAa,SAAS,YAAY;AACxC,UAAI;AACF,sBAAc,OAAO;AACrB,cAAM,WAAW,IAAI,KAAK,QAAQ,QAAQ;AAC1C,YAAI,CAAC,OAAO,SAAS,SAAS,QAAQ,CAAC,KAAK,SAAS,QAAQ,IAAI,SAAS,QAAQ,GAAG;AACnF,gBAAM,cAAc,WAAW,8CAA8C;AAAA,QAC/E;AACA,YAAI,SAAS,QAAQ,IAAI,SAAS,QAAQ,IAAI,gBAAgB;AAC5D,gBAAM,cAAc,WAAW,gEAAgE;AAAA,QACjG;AACA,cAAM,eAAe,QAAQ,sBAAsB,QAAQ,MAAM,KAAK,uBAAuB,QAAQ,MAAM;AAC3G,YAAI,SAAS,QAAQ,OAAO,IAAI,cAAc;AAC5C,gBAAM,cAAc,WAAW,mCAAmC,YAAY,QAAQ;AAAA,QACxF;AAEA,cAAM,UAAU,MAAM,QAAQ,eAAe,QAAQ,WAAW;AAChE,YAAI,CAAC,WAAW,QAAQ,QAAS,OAAM,cAAc,aAAa,0CAA0C;AAC5G,YAAI,QAAQ,aAAa,wBAAyB,OAAM,cAAc,eAAe,0CAA0C;AAC/H,YAAI,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ,KAAK,SAAS,QAAQ,GAAG;AAC/D,gBAAM,cAAc,WAAW,4BAA4B;AAAA,QAC7D;AACA,YACE,QAAQ,aAAa,QAAQ,YAC7B,QAAQ,iBAAiB,QAAQ,gBACjC,CAAC,QAAQ,QAAQ,KAAK,QAAQ,GAAG,GACjC;AACA,gBAAM,cAAc,aAAa,iDAAiD;AAAA,QACpF;AACA,YAAI,CAAC,QAAQ,eAAe,SAAS,QAAQ,MAAM,GAAG;AACpD,gBAAM,cAAc,aAAa,kCAAkC,QAAQ,MAAM,GAAG;AAAA,QACtF;AACA,YAAI,QAAQ,kBAAkB,CAAC,QAAQ,eAAe,SAAS,QAAQ,MAAM,GAAG;AAC9E,gBAAM,cAAc,aAAa,yCAAyC,QAAQ,MAAM,GAAG;AAAA,QAC7F;AACA,YACE,CAAC,MAAM,QAAQ,gBAAgB;AAAA,UAC7B;AAAA,UACA,SAAS,oCAAoC,OAAO;AAAA,UACpD,WAAW,QAAQ;AAAA,QACrB,CAAC,GACD;AACA,gBAAM,cAAc,aAAa,qCAAqC;AAAA,QACxE;AACA,YAAI,CAAC,MAAM,QAAQ,gBAAgB,QAAQ,QAAQ,MAAM,QAAQ,UAAU,QAAQ,KAAK,GAAG;AACzF,gBAAM,cAAc,YAAY,uDAAuD;AAAA,QACzF;AAEA,cAAM,cAAc,SAAS,QAAQ,IAAI;AACzC,cAAM,OAAO,WAAW,IAAI,QAAQ,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,SAAS,QAAQ,WAAW;AACrF,YAAI,IAAI,UAAU,WAAW;AAC3B,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,YACX,cAAc,KAAK,IAAI,GAAG,IAAI,CAAC,IAAI,MAAS,SAAS,QAAQ,CAAC;AAAA,UAChE,CAAC;AAAA,QACH;AACA,YAAI,KAAK,SAAS,QAAQ,CAAC;AAC3B,mBAAW,IAAI,QAAQ,MAAM,GAAG;AAEhC,cAAM,UAAU,MAAM,QAAQ,SAAS;AAAA,UACrC,WAAW,QAAQ;AAAA,UACnB;AAAA,UACA,QAAQ,QAAQ;AAAA,UAChB,QAAQ,QAAQ;AAAA,UAChB,SAAS,QAAQ;AAAA,UACjB;AAAA,QACF,CAAC;AACD,YAAI,SAAS,OAAO,IAAI,kBAAkB;AACxC,gBAAM,cAAc,aAAa,oCAAoC,gBAAgB,QAAQ;AAAA,QAC/F;AACA,cAAM,MAAM,SAAS,MAAM,UAAU;AACrC,eAAO;AAAA,UACL,YAAY;AAAA,UACZ,WAAW,QAAQ;AAAA,UACnB,IAAI;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF,SAASE,QAAO;AACd,gBAAQ,UAAUA,MAAK;AACvB,cAAM,OAAO,QAAQA,MAAK;AAC1B,cAAM,MAAM,SAAS,OAAO,YAAY,KAAK,IAAI;AACjD,eAAO;AAAA,UACL,YAAY;AAAA,UACZ,WAAW,OAAO,SAAS,cAAc,WAAW,QAAQ,YAAY;AAAA,UACxE,IAAI;AAAA,UACJ,OAAO;AAAA,UACP;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAGO,SAAS,sCAAqE;AACnF,QAAM,SAAS,oBAAI,IAAuD;AAC1E,SAAO;AAAA,IACL,MAAM,QAAQ,aAAa,UAAU,OAAO;AAC1C,YAAM,QAAQ,OAAO,IAAI,WAAW;AACpC,UAAK,CAAC,SAAS,aAAa,KAAO,SAAS,aAAa,MAAM,WAAW,KAAM,OAAO,OAAO,IAAI,KAAK,GAAG;AACxG,eAAO;AAAA,MACT;AACA,YAAM,SAAS,OAAO,UAAU,oBAAI,IAAY;AAChD,aAAO,IAAI,KAAK;AAChB,aAAO,IAAI,aAAa,EAAE,UAAU,OAAO,CAAC;AAC5C,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AC9ZO,IAAM,wCAAwC;AAC9C,IAAM,iCAAiC;AA6E9C,IAAMC,WAAU,IAAI,YAAY;AAEhC,SAASC,cAAa,OAAwB;AAC5C,MAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AAC7E,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAChE,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAIA,aAAY,EAAE,KAAK,GAAG,CAAC;AACtE,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,IACL,OAAO,QAAQ,KAAK,EACjB,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,SAAS,MAAS,EACvC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC,IAAIA,cAAa,IAAI,CAAC,EAAE,EACnE,KAAK,GAAG,CACb;AAAA,EACF;AACA,QAAM,IAAI,MAAM,iDAAiD;AACnE;AAEO,SAAS,sCACd,MACY;AACZ,QAAM,EAAE,WAAW,YAAY,GAAG,OAAO,IAAI;AAC7C,SAAOD,SAAQ,OAAOC,cAAa,MAAM,CAAC;AAC5C;AAEO,SAAS,sCACd,MACA,MAMA;AACA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,0BACd,UAC6C;AAC7C,SAAO,SAAS,eAAe,yCAC7B,SAAS,SAAS;AACtB;AAEA,SAAS,aAAa,QAAwC;AAC5D,MAAI,CAAC,OAAO,cAAc,OAAO,WAAW,KAAK,OAAO,cAAc,GAAG;AACvE,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,QAAI,UAAU,WAAc,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI;AACjE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,4BAA4B,IAAI;AAAA,QACzC,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGA,eAAsB,6BACpB,OACA,OACA,SACA,MACA,MAAkB,MAAM,oBAAI,KAAK,GACS;AAC1C,MAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,SAAS;AACzD,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,QAAM,WAAW,IAAI;AACrB,QAAM,gBAAgB,IAAI,KAAK,QAAQ,QAAQ,SAAS;AACxD,MACE,QAAQ,QAAQ,WAChB,CAAC,OAAO,SAAS,cAAc,QAAQ,CAAC,KACxC,iBAAiB,YACjB,CAAC,QAAQ,WACT,CAAC,QAAQ,kBACT,CAAC,QAAQ,cACT,CAAC,QAAQ,UACT,CAAC,OAAO,SAAS,QAAQ,KAAK,KAC9B,QAAQ,SAAS,GACjB;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MACE,CAAC,QAAQ,QAAQ,eAAe,SAAS,QAAQ,cAAc,KAC9D,QAAQ,QAAQ,kBACf,CAAC,QAAQ,QAAQ,eAAe,SAAS,QAAQ,MAAM,GACzD;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,eAAa,QAAQ,MAAM;AAC3B,QAAM,YAAY,IAAI;AAAA,IACpB,KAAK,IAAI,cAAc,QAAQ,GAAG,SAAS,QAAQ,IAAI,QAAQ,KAAK;AAAA,EACtE,EAAE,YAAY;AACd,QAAM,WAA2D;AAAA,IAC/D,SAAS,QAAQ;AAAA,IACjB,YAAY;AAAA,MACV,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,QAAQ,QAAQ;AAAA,IACxB;AAAA,IACA,KAAK,QAAQ,QAAQ;AAAA,IACrB,sBAAsB,QAAQ,QAAQ;AAAA,IACtC,gBAAgB,QAAQ;AAAA,IACxB,UAAU,QAAQ,QAAQ;AAAA,IAC1B,UAAU,QAAQ,QAAQ;AAAA,IAC1B,gBAAgB,QAAQ;AAAA,IACxB,YAAY,QAAQ;AAAA,IACpB,QAAQ,QAAQ;AAAA,IAChB,cAAc,QAAQ,QAAQ;AAAA,IAC9B,QAAQ,QAAQ;AAAA,IAChB,UAAU,SAAS,YAAY;AAAA,IAC/B;AAAA,IACA,UAAU,MAAM;AAAA,EAClB;AACA,QAAM,YAAY,MAAM,KAAK,sCAAsC,QAAQ,CAAC;AAC5E,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,QAAM,UAAU,MAAM,MAAM;AAAA,IAC1B;AAAA,IACA,sCAAsC,QAAQ,SAAS;AAAA,MACrD,GAAG;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,MAAM,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,MACE,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,QAAQ;AAAA,IAChB;AAAA,IACA,EAAE,OAAO,aAAa;AAAA,IACtB,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,EACtD;AACA,SAAO;AACT;AAGA,eAAsB,8BACpB,OACA,cACA,QACA,MAAkB,MAAM,oBAAI,KAAK,GAClB;AACf,QAAM,OAAO,MAAM;AACnB,QAAM,WAAW,IAAI,KAAK,KAAK,QAAQ,EAAE,QAAQ;AACjD,QAAM,YAAY,IAAI,KAAK,KAAK,SAAS,EAAE,QAAQ;AACnD,QAAM,cAAc,IAAI,EAAE,QAAQ;AAClC,QAAM,QAAQ,MAAM,SAAS,SAAS,aAAa,WACjD,KAAK,YAAY,aAAa,WAC9B,KAAK,WAAW,SAAS,aAAa,eACtC,KAAK,IAAI,QAAQ,aAAa,IAAI,OAClC,KAAK,IAAI,YAAY,aAAa,IAAI,WACtC,KAAK,IAAI,UAAU,aAAa,IAAI,SACpC,KAAK,yBAAyB,aAAa,wBAC3C,KAAK,mBAAmB,aAAa,kBACrC,KAAK,aAAa,aAAa,YAC/B,KAAK,aAAa,aAAa,YAC/B,KAAK,mBAAmB,aAAa,kBACrC,KAAK,eAAe,aAAa,cACjC,KAAK,WAAW,aAAa,UAC7B,KAAK,iBAAiB,aAAa;AACrC,MACE,CAAC,SACD,MAAM,QAAQ,UAAU,gBACxB,CAAC,OAAO,SAAS,QAAQ,KACzB,CAAC,OAAO,SAAS,SAAS,KAC1B,WAAW,eACX,aAAa,eACb,aAAa,YACb,CAAC,MAAM,OAAO,sCAAsC,IAAI,GAAG,KAAK,SAAS,GACzE;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,eAAa,KAAK,MAAM;AAC1B;AAGA,eAAsB,+BACpB,OACA,OACA,OACA,MAAkB,MAAM,oBAAI,KAAK,GACS;AAC1C,MAAI,MAAM,QAAQ,UAAU,gBAAgB,MAAM,KAAK,OAAO,gBAAgB,GAAG;AAC/E,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO,MAAM,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,MACE,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,MAAM,SAAS;AAAA,IACvB;AAAA,IACA,EAAE,GAAG,MAAM,QAAQ,OAAO,YAAY,YAAY,IAAI,EAAE,YAAY,EAAE;AAAA,IACtE,EAAE,iBAAiB,MAAM,SAAS,gBAAgB;AAAA,EACpD;AACF;;;AClMO,IAAM,qBAAN,MAAiD;AAAA,EAC9C;AAAA,EACS;AAAA,EACT;AAAA,EACS;AAAA,EACA,WAAW,oBAAI,IAAY;AAAA,EAC3B;AAAA,EAEA,OAAO,oBAAI,IAA4B;AAAA,EACvC,cAAc,oBAAI,IAGhC;AAAA,EACK,WAAW;AAAA,EACF,SAAS,oBAAI,IAAwB;AAAA;AAAA,EAErC,cAAc,oBAAI,IAAoB;AAAA,EACtC,WAAW,oBAAI,IAA+B;AAAA,EACvD,eAAe;AAAA,EACN,eAAoC,CAAC;AAAA,EAC9C,oBAAoB;AAAA,EACX;AAAA,EACA,cAAc,oBAAI,IAA4C;AAAA,EACvE,SAAS;AAAA,EACT,OAAO;AAAA,EAER,YAAY,SAAoC;AACrD,SAAK,WAAW,QAAQ;AACxB,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,aAAa,QAAQ;AAC1B,SAAK,SAAS,IAAI,IAAI,QAAQ,UAAU,CAAC,QAAQ,QAAQ,CAAC;AAC1D,SAAK,aAAa,QAAQ,cAAc,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,OAAO,OAAO,CAAC,IAAI,CAAC;AACxF,SAAK,iBAAiB,QAAQ,kBAAkB;AAChD,QAAI,CAAC,OAAO,cAAc,KAAK,cAAc,KAAK,KAAK,iBAAiB,GAAG;AACzE,YAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AAAA,EACF;AAAA;AAAA,EAIQ,eAAuB;AAC7B,SAAK,YAAY;AACjB,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,YAAY,GAA0C;AAC5D,UAAM,KAAK,EAAE,SAAS,aAAa;AACnC,WAAO,GAAG,EAAE,UAAU,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,QAAQ,EAAE;AAAA,EACjE;AAAA,EAEQ,OAAO,GAA2C;AACxD,UAAM,KAAK,EAAE,aAAa;AAC1B,WAAO,GAAG,EAAE,UAAU,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;AAAA,EACxD;AAAA,EAEQ,YAAY,GAAuC;AACzD,UAAM,KAAK,EAAE,aAAa;AAC1B,QAAI,EAAE,cAAc,GAAI,QAAO,GAAG,EAAE,UAAU,IAAI,EAAE,IAAI,IAAI,EAAE;AAC9D,QAAI,EAAE,WAAY,QAAO,GAAG,EAAE,UAAU,IAAI,EAAE,IAAI;AAClD,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,KAAa,GAAwC;AAGtE,QAAI,EAAE,YAAY;AAChB,UAAI,CAAC,IAAI,WAAW,GAAG,EAAE,UAAU,IAAI,EAAE,IAAI,GAAG,EAAG,QAAO;AAC1D,UAAI,EAAE,WAAW;AACf,eAAO,IAAI,MAAM,GAAG,EAAE,UAAU,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,WAAW,GAAG,EAAE,SAAS,GAAG;AAAA,MACpF;AACA,aAAO;AAAA,IACT;AACA,QAAI,CAAC,IAAI,SAAS,IAAI,EAAE,IAAI,GAAG,EAAG,QAAO;AACzC,QAAI,EAAE,aAAa,CAAC,IAAI,SAAS,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS,GAAG,EAAG,QAAO;AACvE,WAAO;AAAA,EACT;AAAA,EAEQ,YAAY,QAAsB;AACxC,QAAI,KAAK,OAAQ,OAAM,IAAI,MAAM,iBAAiB;AAClD,QAAI,KAAK,OAAO,OAAO,KAAK,YAAY;AACtC,YAAM,IAAI,mBAAmB,EAAE,MAAM,eAAe,SAAS,GAAG,MAAM,oBAAoB,WAAW,KAAK,CAAC;AAAA,IAC7G;AAAA,EACF;AAAA,EAEQ,OAAO,KAAa,UAAiC,MAAqD;AAChH,UAAM,KAAK,OAAO,SAAS,SAAS,eAAe;AACnD,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,iBAAiB,SAAS,SAAS;AAAA,MACnC,UAAU,gBAAgB,QAAQ;AAAA,IACpC;AACA,SAAK,aAAa,KAAK,EAAE,KAAK,MAAM,CAAC;AACrC,WAAO,KAAK,aAAa,SAAS,KAAK,gBAAgB;AACrD,YAAM,UAAU,KAAK,aAAa,MAAM;AACxC,UAAI,SAAS;AACX,aAAK,oBAAoB,KAAK;AAAA,UAC5B,KAAK;AAAA,UACL,OAAO,QAAQ,MAAM,eAAe;AAAA,QACtC;AAAA,MACF;AAAA,IACF;AACA,eAAW,OAAO,KAAK,SAAS,OAAO,GAAG;AACxC,UAAI,CAAC,IAAI,WAAW,KAAK,YAAY,IAAI,KAAK,CAAC,EAAG;AAClD,UAAI,CAAC,KAAK,WAAW,KAAK,IAAI,KAAK,EAAG;AACtC,UAAI,MAAM,IAAI,cAAe;AAC7B,UAAI,gBAAgB;AACpB,UAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,IACjC;AAAA,EACF;AAAA;AAAA,EAIA,MAAa,IAAoB,WAAkG;AACjI,UAAM,IAAI,KAAK,KAAK,IAAI,KAAK,OAAO,SAAS,CAAC;AAC9C,QAAI,CAAC,KAAK,EAAE,QAAS,QAAO;AAC5B,WAAO,gBAAgB,EAAE,QAAQ;AAAA,EACnC;AAAA,EAEA,MAAa,KAAqB,OAAuF;AACvH,UAAM,QAAsD,CAAC;AAC7D,eAAW,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM;AAChC,UAAI,EAAE,QAAS;AACf,UAAI,CAAC,KAAK,WAAW,KAAK,KAAK,EAAG;AAClC,YAAM,KAAK,gBAAgB,EAAE,QAAQ,CAAqD;AAAA,IAC5F;AACA,WAAO,EAAE,OAAO,iBAAiB,OAAO,KAAK,QAAQ,EAAE;AAAA,EACzD;AAAA,EAEO,MACL,OACA,UAAqC,CAAC,GACkB;AAExD,UAAM,OAAO;AACb,QAAI,OAAO;AACX,WAAO;AAAA,MACL,CAAC,OAAO,aAAa,IAAI;AAIvB,cAAM,SAAyD,CAAC;AAChE,YAAI,UAA8F;AAClG,cAAM,KAAK,KAAK;AAChB,cAAM,mBAAmB,KAAK;AAC9B,cAAM,oBAAoB,QAAQ,oBAAoB,SAClD,mBACA,OAAO,QAAQ,eAAe;AAClC,YACE,CAAC,OAAO,cAAc,iBAAiB,KACvC,oBAAoB,KACpB,oBAAoB,kBACpB;AACA,iBAAO,KAAK;AAAA,YACV,MAAM;AAAA,YACN,iBAAiB,OAAO,gBAAgB;AAAA,YACxC,UAAU;AAAA,YACV,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,kCAAkC,OAAO,QAAQ,eAAe,CAAC;AAAA,cAC1E,WAAW;AAAA,YACb;AAAA,UACF,CAAC;AACD,iBAAO;AAAA,QACT,WAAW,oBAAoB,KAAK,mBAAmB;AACrD,iBAAO,KAAK;AAAA,YACV,MAAM;AAAA,YACN,iBAAiB,OAAO,KAAK,iBAAiB;AAAA,YAC9C,UAAU;AAAA,YACV,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,mBAAmB,iBAAiB;AAAA,cAC7C,WAAW;AAAA,YACb;AAAA,UACF,CAAC;AACD,iBAAO;AAAA,QACT;AACA,YAAI,CAAC,QAAQ,QAAQ,mBAAmB;AACtC,qBAAW,CAAC,KAAK,MAAM,KAAK,KAAK,MAAM;AACrC,gBACE,OAAO,WACP,OAAO,WAAW,oBAClB,CAAC,KAAK,WAAW,KAAK,KAAK,EAC3B;AACF,mBAAO,KAAK;AAAA,cACV,MAAM;AAAA,cACN,iBAAiB,OAAO,SAAS,SAAS;AAAA,cAC1C,UAAU,gBAAgB,OAAO,QAAQ;AAAA,YAC3C,CAA4C;AAAA,UAC9C;AACA,iBAAO,KAAK;AAAA,YACV,MAAM;AAAA,YACN,iBAAiB,OAAO,gBAAgB;AAAA,UAC1C,CAAC;AAAA,QACH,WAAW,CAAC,QAAQ,QAAQ,oBAAoB,QAAW;AACzD,qBAAW,SAAS,KAAK,cAAc;AACrC,kBAAM,WAAW,OAAO,MAAM,MAAM,eAAe;AACnD,gBACE,YAAY,qBACZ,WAAW,oBACX,CAAC,KAAK,WAAW,MAAM,KAAK,KAAK,EACjC;AACF,mBAAO;AAAA,cACL,gBAAgB,MAAM,KAAK;AAAA,YAC7B;AAAA,UACF;AAAA,QACF;AACA,YAAI;AACJ,cAAM,gBAAgB,MAAY;AAChC,gBAAM,UAAU;AAChB,oBAAU;AACV,oBAAU,EAAE,MAAM,MAAM,OAAO,OAAU,CAAC;AAAA,QAC5C;AACA,cAAM,QAAQ,MAAY;AACxB,iBAAO;AACP,cAAI,QAAS,cAAa,OAAO;AACjC,kBAAQ,QAAQ,oBAAoB,SAAS,KAAK;AAClD,wBAAc;AACd,eAAK,SAAS,OAAO,EAAE;AAAA,QACzB;AACA,YAAI,CAAC,MAAM;AACT,eAAK,SAAS,IAAI,IAAI;AAAA,YACpB;AAAA,YACA,eAAe;AAAA,YACf,MAAM,CAAC,UAAU;AACf,kBAAI,SAAS;AACX,sBAAM,UAAU;AAChB,0BAAU;AACV,wBAAQ,EAAE,MAAM,OAAO,OAAO,MAAiD,CAAC;AAAA,cAClF,OAAO;AACL,uBAAO,KAAK,KAAgD;AAAA,cAC9D;AAAA,YACF;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AACA,gBAAQ,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAC/D,YAAI,QAAQ,QAAQ,QAAS,OAAM;AACnC,YAAI,CAAC,QAAQ,QAAQ,cAAc,QAAW;AAC5C,oBAAU,WAAW,OAAO,KAAK,IAAI,GAAG,QAAQ,SAAS,CAAC;AAAA,QAC5D;AACA,eAAO;AAAA,UACL,MAAM,OAAyE;AAC7E,kBAAM,WAAW,OAAO,MAAM;AAC9B,gBAAI,aAAa,OAAW,QAAO,EAAE,MAAM,OAAO,OAAO,SAAS;AAClE,gBAAI,QAAQ,KAAK,OAAQ,QAAO,EAAE,MAAM,MAAM,OAAO,OAAU;AAC/D,mBAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,wBAAU;AAAA,YACZ,CAAC;AAAA,UACH;AAAA,UACA,MAAM,SAAS;AACb,kBAAM;AACN,mBAAO,EAAE,MAAM,MAAM,OAAO,OAAU;AAAA,UACxC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAa,OACX,OACA,UACA,SACgD;AAChD,SAAK,YAAY,QAAQ;AACzB,UAAM,MAAM,KAAK,YAAY,QAAyC;AAEtE,UAAM,gBAAgB,2BAA2B,EAAE,OAAO,SAAS,CAAC;AACpE,QAAI,SAAS,gBAAgB;AAC3B,YAAM,SAAS,KAAK,YAAY,IAAI,UAAU,QAAQ,cAAc,EAAE;AACtE,UAAI,QAAQ;AACV,YAAI,OAAO,kBAAkB,eAAe;AAC1C,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,gBAAgB,OAAO,QAAQ;AAAA,MACxC;AAAA,IACF;AAEA,QAAI,KAAK,KAAK,IAAI,GAAG,GAAG;AACtB,YAAM,IAAI,mBAAmB,EAAE,MAAM,YAAY,SAAS,YAAY,GAAG,mBAAmB,WAAW,MAAM,CAAC;AAAA,IAChH;AAEA,SAAK,YAAY,UAAU;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN,WAAW;AAAA,QACT,YAAY,SAAS;AAAA,QACrB,MAAM,SAAS;AAAA,QACf,MAAM,SAAS,SAAS;AAAA,QACxB,WAAW,SAAS,SAAS;AAAA,MAC/B;AAAA,MACA,kBAAkB;AAAA,IACpB,CAAC;AACD,UAAM,KAAK,SAAS,SAAS,KAAK,WAAW,KAAK,aAAa;AAC/D,UAAM,MAAM,GAAG,SAAS,IAAI,IAAI,SAAS,SAAS,aAAa,SAAS,IAAI,SAAS,SAAS,QAAQ,EAAE,IAAI,EAAE;AAC9G,UAAM,SAAgC;AAAA,MACpC,YAAY,SAAS;AAAA,MACrB,MAAM,SAAS;AAAA,MACf,UAAU;AAAA,QACR,MAAM,SAAS,SAAS,QAAQ;AAAA,QAChC,WAAW,SAAS,SAAS,aAAa;AAAA,QAC1C;AAAA,QACA,YAAY;AAAA,QACZ,iBAAiB,OAAO,EAAE;AAAA,QAC1B,oBAAmB,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC1C,QAAQ,SAAS,SAAS;AAAA,QAC1B,aAAa,SAAS,SAAS;AAAA,QAC/B,iBAAiB,SAAS,SAAS;AAAA,QACnC,YAAY,SAAS,SAAS;AAAA,MAChC;AAAA,MACA,MAAM,SAAS;AAAA,IACjB;AAEA,QAAI,CAAC,SAAS,QAAQ;AACpB,WAAK,KAAK,IAAI,KAAK,EAAE,UAAU,QAAQ,UAAU,IAAI,SAAS,MAAM,CAAC;AACrE,UAAI,SAAS,gBAAgB;AAC3B,aAAK,YAAY,IAAI,UAAU,QAAQ,cAAc,IAAI;AAAA,UACvD;AAAA,UACA,UAAU,gBAAgB,MAAM;AAAA,QAClC,CAAC;AAAA,MACH;AACA,WAAK,OAAO,KAAK,QAAQ,OAAO;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAa,MACX,OACA,UACA,UAAoC,CAAC,GACW;AAChD,SAAK,YAAY,OAAO;AACxB,UAAM,MAAM,KAAK,YAAY,QAAyC;AACtE,UAAM,iBAAiB,QAAQ,iBAC3B,SAAS,QAAQ,cAAc,KAC/B;AACJ,UAAM,cAAc,2BAA2B,EAAE,OAAO,SAAS,CAAC;AAClE,QAAI,gBAAgB;AAClB,YAAM,SAAS,KAAK,YAAY,IAAI,cAAc;AAClD,UAAI,QAAQ;AACV,YAAI,OAAO,kBAAkB,aAAa;AACxC,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,gBAAgB,OAAO,QAAQ;AAAA,MACxC;AAAA,IACF;AACA,UAAM,SAAS,KAAK,KAAK,IAAI,GAAG;AAChC,QAAI,CAAC,UAAU,OAAO,SAAS;AAC7B,YAAM,UAAU,MAAM,KAAK,OAAuB,OAAO,UAAU;AAAA,QACjE,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,MACnE,CAAC;AACD,UAAI,kBAAkB,CAAC,QAAQ,QAAQ;AACrC,aAAK,YAAY,IAAI,gBAAgB;AAAA,UACnC,eAAe;AAAA,UACf,UAAU,gBAAgB,OAAO;AAAA,QACnC,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AACA,QACE;AAAA,MACE,OAAO;AAAA,MACP;AAAA,IACF,GACA;AACA,UAAI,kBAAkB,CAAC,QAAQ,QAAQ;AACrC,aAAK,YAAY,IAAI,gBAAgB;AAAA,UACnC,eAAe;AAAA,UACf,UAAU,gBAAgB,OAAO,QAAQ;AAAA,QAC3C,CAAC;AAAA,MACH;AACA,aAAO,gBAAgB,OAAO,QAAQ;AAAA,IACxC;AACA,QACE,CAAC,QAAQ,mBACT,QAAQ,oBAAoB,OAAO,SAAS,SAAS,iBACrD;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,KAAK,YAAY;AACnB,WAAK,WAAW,UAAU;AAAA,QACxB;AAAA,QACA,MAAM;AAAA,QACN,WAAW;AAAA,UACT,YAAY,SAAS;AAAA,UACrB,MAAM,SAAS;AAAA,UACf,MAAM,SAAS,SAAS;AAAA,UACxB,WAAW,SAAS,SAAS;AAAA,QAC/B;AAAA,QACA,SAAS,OAAO;AAAA,QAChB,kBAAkB;AAAA,MACpB,CAAC;AAAA,IACH;AACA,UAAM,KAAK,QAAQ,SAAS,KAAK,WAAW,KAAK,aAAa;AAC9D,UAAM,cAAc,2BAA2B,OAAO,SAAS,IAAI,MACjE,2BAA2B,SAAS,IAAI;AAC1C,UAAM,UAAiC;AAAA,MACrC,GAAG,OAAO;AAAA,MACV,UAAU;AAAA,QACR,GAAG,OAAO,SAAS;AAAA,QACnB,GAAG,gBAAgB,SAAS,QAAQ;AAAA,QACpC,MAAM,OAAO,SAAS,SAAS;AAAA,QAC/B,WAAW,OAAO,SAAS,SAAS;AAAA,QACpC,KAAK,OAAO,SAAS,SAAS;AAAA,QAC9B,YAAY,OAAO,SAAS,SAAS,cAAc,cAAc,IAAI;AAAA,QACrE,iBAAiB,OAAO,EAAE;AAAA,QAC1B,mBAAmB,OAAO,SAAS,SAAS;AAAA,MAC9C;AAAA,MACA,MAAM,gBAAgB,SAAS,IAAI;AAAA,IACrC;AACA,QAAI,CAAC,QAAQ,QAAQ;AACnB,WAAK,KAAK,IAAI,KAAK,EAAE,UAAU,SAAS,UAAU,IAAI,SAAS,MAAM,CAAC;AACtE,UAAI,gBAAgB;AAClB,aAAK,YAAY,IAAI,gBAAgB;AAAA,UACnC,eAAe;AAAA,UACf,UAAU,gBAAgB,OAAO;AAAA,QACnC,CAAC;AAAA,MACH;AACA,WAAK,OAAO,KAAK,SAAS,UAAU;AAAA,IACtC;AACA,WAAO,gBAAgB,OAAO;AAAA,EAChC;AAAA,EAEA,MAAa,aACX,OACA,WACA,QACA,SACgD;AAChD,SAAK,YAAY,cAAc;AAC/B,UAAM,MAAM,KAAK,OAAO,SAAS;AACjC,UAAM,gBAAgB,2BAA2B;AAAA,MAC/C;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB,QAAQ;AAAA,IAC3B,CAAC;AACD,UAAM,iBAAiB,QAAQ,iBAC3B,UAAU,QAAQ,cAAc,KAChC;AACJ,QAAI,gBAAgB;AAClB,YAAM,SAAS,KAAK,YAAY,IAAI,cAAc;AAClD,UAAI,QAAQ;AACV,YAAI,OAAO,kBAAkB,eAAe;AAC1C,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,gBAAgB,OAAO,QAAQ;AAAA,MACxC;AAAA,IACF;AACA,UAAM,SAAS,KAAK,KAAK,IAAI,GAAG;AAChC,QAAI,CAAC,UAAU,OAAO,SAAS;AAC7B,YAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,SAAS,YAAY,GAAG,cAAc,WAAW,MAAM,CAAC;AAAA,IAC5G;AAEA,QAAI,KAAK,YAAY;AACnB,WAAK,WAAW,UAAU;AAAA,QACxB;AAAA,QACA,MAAM;AAAA,QACN;AAAA,QACA,SAAS,OAAO;AAAA,QAChB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAEA,QAAI,QAAQ,mBAAmB,OAAO,SAAS,SAAS,oBAAoB,QAAQ,iBAAiB;AACnG,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,0BAA0B,QAAQ,eAAe,SAAS,OAAO,SAAS,SAAS,eAAe;AAAA,QAC3G,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAEA,UAAM,KAAK,QAAQ,SAAS,KAAK,WAAW,KAAK,aAAa;AAC9D,UAAM,UAAiC;AAAA,MACrC,GAAG,OAAO;AAAA,MACV;AAAA,MACA,UAAU;AAAA,QACR,GAAG,OAAO,SAAS;AAAA,QACnB,iBAAiB,OAAO,EAAE;AAAA,MAC5B;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,QAAQ;AACnB,WAAK,KAAK,IAAI,KAAK,EAAE,UAAU,SAAS,UAAU,IAAI,SAAS,MAAM,CAAC;AACtE,UAAI,gBAAgB;AAClB,aAAK,YAAY,IAAI,gBAAgB;AAAA,UACnC;AAAA,UACA,UAAU,gBAAgB,OAAO;AAAA,QACnC,CAAC;AAAA,MACH;AACA,WAAK,OAAO,KAAK,SAAS,UAAU;AAAA,IACtC;AACA,WAAO,gBAAgB,OAAO;AAAA,EAChC;AAAA,EAEA,MAAa,OACX,OACA,WACA,UAAsC,CAAC,GACH;AACpC,SAAK,YAAY,QAAQ;AACzB,UAAM,MAAM,KAAK,OAAO,SAAS;AACjC,UAAM,gBAAgB,2BAA2B;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,eAAe,QAAQ;AAAA,MACvB,mBAAmB,QAAQ;AAAA,IAC7B,CAAC;AACD,UAAM,iBAAiB,QAAQ,iBAC3B,UAAU,QAAQ,cAAc,KAChC;AACJ,QAAI,gBAAgB;AAClB,YAAM,SAAS,KAAK,YAAY,IAAI,cAAc;AAClD,UAAI,QAAQ;AACV,YAAI,OAAO,kBAAkB,eAAe;AAC1C,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,gBAAgB,OAAO,QAAQ;AAAA,MACxC;AAAA,IACF;AACA,UAAM,SAAS,KAAK,KAAK,IAAI,GAAG;AAChC,QAAI,CAAC,UAAU,OAAO,QAAS,QAAO,EAAE,UAAU,OAAO,UAAU;AAEnE,UAAM,gBAAgB,QAAQ;AAC9B,QACG,eAAe,QAAQ,UACtB,cAAc,QAAQ,OAAO,SAAS,SAAS,OAChD,eAAe,oBAAoB,UAClC,cAAc,oBAAoB,OAAO,SAAS,SAAS,mBAC5D,eAAe,eAAe,UAC7B,cAAc,eAAe,OAAO,SAAS,SAAS,YACxD;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,SAAK,YAAY,UAAU;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,SAAS,OAAO;AAAA,IAClB,CAAC;AAED,UAAM,WAAW,OAAO,SAAS,SAAS,YAAY,UAAU,KAAK;AACrE,UAAM,iBAAiB,WAAW,OAAO,SAAS,SAAS,sBAAsB;AACjF,UAAM,KAAK,QAAQ,UAAU,iBACzB,KAAK,WACL,KAAK,aAAa;AACtB,UAAM,UAAiC;AAAA,MACrC,GAAG,OAAO;AAAA,MACV,UAAU;AAAA,QACR,GAAG,OAAO,SAAS;AAAA,QACnB,iBAAiB,OAAO,EAAE;AAAA,QAC1B,GAAI,WAAW,CAAC,iBACZ,EAAE,oBAAmB,oBAAI,KAAK,GAAE,YAAY,EAAE,IAC9C,CAAC;AAAA,MACP;AAAA,IACF;AACA,UAAM,SAAoC,EAAE,UAAU,MAAM,UAAU;AACtE,QAAI,CAAC,QAAQ,QAAQ;AACnB,UAAI,CAAC,gBAAgB;AACnB,aAAK,KAAK,IAAI,KAAK;AAAA,UACjB,UAAU;AAAA,UACV,UAAU;AAAA,UACV,SAAS,CAAC;AAAA,QACZ,CAAC;AAAA,MACH;AACA,UAAI,gBAAgB;AAClB,aAAK,YAAY,IAAI,gBAAgB;AAAA,UACnC;AAAA,UACA,UAAU,gBAAgB,MAAM;AAAA,QAClC,CAAC;AAAA,MACH;AACA,UAAI,CAAC,gBAAgB;AACnB,aAAK,OAAO,KAAK,SAAS,UAAU,aAAa,SAAS;AAAA,MAC5D;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAIA,MAAa,aAAa,OAA0B,SAA0D;AAC5G,SAAK,YAAY,cAAc;AAC/B,QACE,CAAC,QAAQ,QACT,CAAC,QAAQ,UACT,CAAC,OAAO,cAAc,QAAQ,KAAK,KACnC,QAAQ,SAAS,GACjB;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,SAAK,YAAY,UAAU;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN,WAAW,KAAK,eAAe,QAAQ,IAAI;AAAA,IAC7C,CAAC;AACD,UAAM,WAAW,KAAK,OAAO,IAAI,QAAQ,IAAI;AAC7C,QAAI,YAAY,KAAK,IAAI,IAAI,SAAS,WAAW;AAC/C,YAAM,IAAI,mBAAmB,EAAE,MAAM,YAAY,SAAS,SAAS,QAAQ,IAAI,YAAY,SAAS,MAAM,IAAI,WAAW,KAAK,CAAC;AAAA,IACjI;AACA,SAAK,gBAAgB,QAAQ,IAAI;AAEjC,UAAM,UAAU,SAAS,QAAQ,IAAI,IAAI,QAAQ,MAAM,IAAI,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC;AAClF,UAAM,KAAK,KAAK,aAAa;AAC7B,UAAM,MAAM,KAAK,IAAI;AAGrB,UAAM,SAAS,KAAK,YAAY,IAAI,QAAQ,IAAI,KAAK,KAAK;AAC1D,SAAK,YAAY,IAAI,QAAQ,MAAM,KAAK;AACxC,SAAK,OAAO,IAAI,QAAQ,MAAM;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,OAAO,OAAO,KAAK;AAAA,MACnB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,WAAW,MAAM,QAAQ;AAAA,IAC3B,CAAC;AACD,SAAK,YAAY;AAAA,MACf,QAAQ;AAAA,MACR,YAAY,MAAM;AAChB,aAAK,YAAY,QAAQ,IAAI;AAAA,MAC/B,GAAG,KAAK,IAAI,QAAQ,OAAO,GAAM,CAAC;AAAA,IACpC;AAEA,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,OAAO,OAAO,KAAK;AAAA,MACnB,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,WAAW,IAAI,KAAK,MAAM,QAAQ,KAAK,EAAE,YAAY;AAAA,MACrD,iBAAiB,OAAO,EAAE;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,OAA0B,IAA0B,OAA2C;AACrH,SAAK,YAAY,YAAY;AAC7B,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,SAAK,YAAY,UAAU;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN,WAAW,KAAK,eAAe,GAAG,IAAI;AAAA,IACxC,CAAC;AACD,UAAM,WAAW,KAAK,OAAO,IAAI,GAAG,IAAI;AAExC,UAAM,MAAM,KAAK,IAAI;AACrB,QACE,CAAC,YACD,SAAS,WAAW,GAAG,UACvB,SAAS,YAAY,GAAG,WACxB,GAAG,UAAU,SAAS,SACtB,SAAS,aAAa,KACtB;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,SAAS,GAAG,IAAI;AAAA,QACzB,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,aAAS,YAAY;AACrB,aAAS,YAAY,MAAM;AAC3B,WAAO;AAAA,MACL,MAAM,GAAG;AAAA,MACT,QAAQ,SAAS;AAAA,MACjB,SAAS,SAAS;AAAA,MAClB,OAAO,SAAS;AAAA,MAChB,YAAY,IAAI,KAAK,SAAS,UAAU,EAAE,YAAY;AAAA,MACtD,WAAW,IAAI,KAAK,SAAS,SAAS,EAAE,YAAY;AAAA,MACpD,WAAW,IAAI,KAAK,SAAS,SAAS,EAAE,YAAY;AAAA,MACpD,iBAAiB,OAAO,KAAK,aAAa,CAAC;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,MAAa,aAAa,OAA0B,IAAyC;AAC3F,SAAK,YAAY,cAAc;AAC/B,SAAK,YAAY,UAAU;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN,WAAW,KAAK,eAAe,GAAG,IAAI;AAAA,IACxC,CAAC;AACD,UAAM,WAAW,KAAK,OAAO,IAAI,GAAG,IAAI;AACxC,QACE,CAAC,YACD,SAAS,WAAW,GAAG,UACvB,SAAS,YAAY,GAAG,WACxB,SAAS,UAAU,GAAG,OACtB;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,SAAS,GAAG,IAAI;AAAA,QACzB,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,SAAK,OAAO,OAAO,GAAG,IAAI;AAC1B,SAAK,gBAAgB,GAAG,IAAI;AAAA,EAC9B;AAAA;AAAA,EAIA,MAAa,QAAQ,wBAAuE;AAC1F,UAAM,SAAS,OAAO,sBAAsB;AAC5C,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,KAAK,SAAS,KAAK,UAAU;AACzE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,uCAAuC,sBAAsB;AAAA,QACtE,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,SAAK,oBAAoB,KAAK,IAAI,KAAK,mBAAmB,MAAM;AAChE,aAAS,QAAQ,KAAK,aAAa,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG;AACrE,UAAI,OAAO,KAAK,aAAa,KAAK,EAAE,MAAM,eAAe,KAAK,QAAQ;AACpE,aAAK,aAAa,OAAO,OAAO,CAAC;AAAA,MACnC;AAAA,IACF;AACA,eAAW,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM;AAChC,UAAI,EAAE,WAAW,EAAE,YAAY,OAAQ,MAAK,KAAK,OAAO,GAAG;AAAA,IAC7D;AACA,WAAO,EAAE,kBAAkB,OAAO,MAAM,GAAG,iBAAiB,OAAO,KAAK,QAAQ,EAAE;AAAA,EACpF;AAAA,EAEA,MAAa,SAAS,aAA0D;AAG9E,WAAO,EAAE,iBAAiB,OAAO,KAAK,QAAQ,GAAG,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,EACvF;AAAA;AAAA,EAGO,iBAA6C;AAClD,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,mBAAmB,KAAK;AAAA,MACxB,MAAM,KAAK;AAAA,MACX,QAAQ,CAAC,GAAG,KAAK,MAAM;AAAA,MACvB,UAAU,CAAC,GAAG,KAAK,QAAQ;AAAA,MAC3B,YAAY,KAAK;AAAA,MACjB,aAAa,OAAO,YAAY,KAAK,WAAW;AAAA,MAChD,WAAW,CAAC,GAAG,KAAK,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;AAAA,QACzD;AAAA,QACA,UAAU,gBAAgB,MAAM,QAAQ;AAAA,QACxC,UAAU,MAAM;AAAA,QAChB,SAAS,MAAM;AAAA,MACjB,EAAE;AAAA,MACF,aAAa,CAAC,GAAG,KAAK,YAAY,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;AAAA,QAClE;AAAA,QACA,eAAe,MAAM;AAAA,QACrB,UAAU,gBAAgB,MAAM,QAAQ;AAAA,MAC1C,EAAE;AAAA,MACF,aAAa,KAAK,aAAa,IAAI,CAAC,WAAW;AAAA,QAC7C,KAAK,MAAM;AAAA,QACX,OAAO,gBAAgB,MAAM,KAAK;AAAA,MACpC,EAAE;AAAA,MACF,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC;AAAA,EACF;AAAA;AAAA,EAGO,gBAAgB,UAA4C;AACjE,QAAI,KAAK,OAAQ,OAAM,IAAI,MAAM,iBAAiB;AAClD,SAAK,KAAK,MAAM;AAChB,eAAW,SAAS,SAAS,WAAW;AACtC,UAAI,MAAM,IAAI,WAAW,UAAU,EAAG;AACtC,WAAK,KAAK,IAAI,MAAM,KAAK;AAAA,QACvB,UAAU,gBAAgB,MAAM,QAAQ;AAAA,QACxC,UAAU,MAAM;AAAA,QAChB,SAAS,MAAM;AAAA,MACjB,CAAC;AAAA,IACH;AACA,SAAK,YAAY,MAAM;AACvB,eAAW,SAAS,SAAS,eAAe,CAAC,GAAG;AAC9C,WAAK,YAAY,IAAI,MAAM,KAAK;AAAA,QAC9B,eAAe,MAAM;AAAA,QACrB,UAAU,gBAAgB,MAAM,QAAQ;AAAA,MAC1C,CAAC;AAAA,IACH;AACA,SAAK,WAAW,SAAS;AACzB,SAAK,oBAAoB,SAAS,qBAAqB;AACvD,SAAK,aAAa;AAAA,MAChB;AAAA,MACA,KAAK,aAAa;AAAA,MAClB,IAAI,SAAS,eAAe,CAAC,GAAG,IAAI,CAAC,WAAW;AAAA,QAC9C,KAAK,MAAM;AAAA,QACX,OAAO,gBAAgB,MAAM,KAAK;AAAA,MACpC,EAAE;AAAA,IACJ;AACA,SAAK,OAAO,SAAS;AACrB,SAAK,OAAO,MAAM;AAClB,eAAW,MAAM,SAAS,OAAQ,MAAK,OAAO,IAAI,EAAE;AACpD,SAAK,SAAS,MAAM;AACpB,eAAW,MAAM,SAAS,SAAU,MAAK,SAAS,IAAI,EAAE;AACxD,SAAK,aAAa,SAAS;AAC3B,SAAK,YAAY,MAAM;AACvB,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,WAAW,GAAG;AAChE,WAAK,YAAY,IAAI,MAAM,KAAK;AAAA,IAClC;AAGA,eAAW,QAAQ,CAAC,GAAG,KAAK,OAAO,KAAK,CAAC,GAAG;AAC1C,WAAK,OAAO,OAAO,IAAI;AACvB,WAAK,gBAAgB,IAAI;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,MAAa,YAAyC;AACpD,WAAO,EAAE,SAAS,KAAK,OAAO,QAAQ,KAAK,cAAc,CAAC,KAAK,QAAQ,iBAAiB,OAAO,KAAK,QAAQ,EAAE;AAAA,EAChH;AAAA,EAEA,MAAa,QAAuB;AAClC,SAAK,SAAS;AACd,eAAW,CAAC,EAAE,CAAC,KAAK,KAAK,YAAa,eAAc,CAAC;AACrD,SAAK,YAAY,MAAM;AACvB,eAAW,OAAO,KAAK,SAAS,OAAO,EAAG,KAAI,MAAM;AACpD,SAAK,SAAS,MAAM;AAAA,EACtB;AAAA;AAAA,EAIA,MAAa,cAAuC;AAClD,UAAM,UAA0B;AAAA,MAC9B,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,IAAI,CAAC,QAAsB,EAAE,IAAI,UAAU,CAAC,GAAG,WAAW,OAAO,KAAK,WAAW,KAAK,YAAY,MAAM,EAAE;AAAA,MAC9H,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,QAAsB,EAAE,IAAI,UAAU,CAAC,GAAG,WAAW,KAAK,EAAE;AAAA,IAC9H;AACA,UAAM,UAAU,KAAK,OAAO,QAAQ,KAAK,cAAc,CAAC,KAAK;AAC7D,WAAO,EAAE,SAAS,UAAU,UAAU,KAAK,WAAW,QAAW,MAAM,KAAK,KAAK;AAAA,EACnF;AAAA;AAAA,EAGQ,kBAAwB;AAC9B,SAAK,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,OAAO,OAAO,CAAC,IAAI,CAAC;AAAA,EACpE;AAAA,EAEQ,eAAe,MAA8C;AACnE,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,WAAW;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAa,SAAS,GAAgC;AACpD,SAAK,SAAS,OAAO,EAAE,EAAE;AACzB,SAAK,OAAO,IAAI,EAAE,EAAE;AACpB,SAAK,gBAAgB;AACrB,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,YAAY,IAA2B;AAClD,QAAI,CAAC,KAAK,OAAO,IAAI,EAAE,EAAG;AAC1B,QAAI,KAAK,OAAO,QAAQ,GAAG;AACzB,YAAM,IAAI,mBAAmB,EAAE,MAAM,WAAW,SAAS,8CAA8C,EAAE,KAAK,WAAW,MAAM,CAAC;AAAA,IAClI;AACA,SAAK,OAAO,OAAO,EAAE;AACrB,SAAK,gBAAgB;AACrB,SAAK,QAAQ;AACb,SAAK,YAAY,aAAa;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,WAAW,GAAgC;AACtD,QAAI,KAAK,OAAO,IAAI,EAAE,EAAE,EAAG;AAC3B,SAAK,SAAS,IAAI,EAAE,EAAE;AAAA,EACxB;AAAA,EAEA,MAAa,cAAc,IAA2B;AACpD,SAAK,SAAS,OAAO,EAAE;AAAA,EACzB;AAAA,EAEA,MAAa,eAAe,IAA2B;AACrD,SAAK,SAAS,OAAO,EAAE;AACvB,SAAK,OAAO,IAAI,EAAE;AAClB,QAAI,OAAO,KAAK,SAAU,MAAK,YAAY;AAC3C,SAAK,gBAAgB;AACrB,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA,EAIQ,YAAY,MAAoB;AACtC,UAAM,QAAQ,KAAK,OAAO,IAAI,IAAI;AAClC,QAAI,SAAS,KAAK,IAAI,KAAK,MAAM,WAAW;AAC1C,WAAK,OAAO,OAAO,IAAI;AACvB,WAAK,gBAAgB,IAAI;AAAA,IAC3B;AAAA,EACF;AAAA,EAEQ,gBAAgB,MAAoB;AAC1C,UAAM,IAAI,KAAK,YAAY,IAAI,IAAI;AACnC,QAAI,GAAG;AACL,oBAAc,CAAC;AACf,WAAK,YAAY,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;;;ACphCA,IAAMC,cAA6C;AAAA,EACjD,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS;AACX;AAEA,IAAM,kBAAkB,oBAAI,IAAI,CAAC,aAAa,UAAU,WAAW,CAAC;AAU7D,SAAS,mBACd,WACA,WAC8B;AAC9B,QAAM,YAAY,UAAU,KAAK,aAAa,CAAC;AAC/C,QAAM,eAAe,UAAU,gBAAgB;AAC/C,QAAM,aAAsC,CAAC;AAE7C,aAAW,YAAY,WAAW;AAChC,UAAM,SAAS,SAAS,KAAK;AAC7B,QAAI,CAAC,UAAU,SAAS,QAAQ,YAAY,MAAO;AACnD,QAAI,UAAU,gBAAgB,UAAU,iBAAiB,OAAQ;AACjE,QACE,UAAU,gBAAgB,CAAC,OAAO,QAAQ,UAAU,YAAY,EAAE;AAAA,MAChE,CAAC,CAAC,KAAK,KAAK,MAAM,SAAS,KAAK,YAAY,GAAG,MAAM;AAAA,IACvD,EACA;AACF,UAAM,QAAQ,SAAS,KAAK,SAAS;AACrC,QAAIA,YAAW,KAAK,IAAIA,YAAW,YAAY,EAAG;AAElD,UAAM,aAAa,SAAS,KAAK,aAAa;AAAA,MAAK,CAAC,cAClD,UAAU,aAAa,SAAS,UAAU,KAAK,QAAQ,SACtD,UAAU,WAAW,CAAC,SAAS,GAAG,SAAS,UAAU,KAAK,MAAM,MAChE,CAAC,UAAU,KAAK,QAAQ,gBACvB,UAAU,iBAAiB,UAAU,KAAK,QAAQ,iBACpD,UAAU,QAAQ,YAAY;AAAA,IAChC;AACA,QAAI,CAAC,WAAY;AAEjB,UAAM,UAAU,WAAW,UAAU,iBAAiB;AACtD,UAAM,SAAS,WAAW,UAAU,cAAc;AAClD,UAAM,QAAQ,UAAU;AACxB,QAAI,SAAS,EAAG;AAChB,QAAI,QAAQ,QAAQ,MAAMA,YAAW,KAAK,IAAI;AAC9C,UAAM,UAAU,CAAC,UAAU,WAAW,YAAY,IAAI,kBAAkB,KAAK,EAAE;AAC/E,QAAI,UAAU,kBAAkB,QAAQ;AACtC,eAAS;AACT,cAAQ,KAAK,gBAAgB;AAAA,IAC/B;AACA,eAAW,KAAK,EAAE,UAAU,QAAQ,OAAO,QAAQ,CAAC;AAAA,EACtD;AAEA,aAAW;AAAA,IAAK,CAAC,MAAM,UACrB,MAAM,QAAQ,KAAK,UAClB,KAAK,SAAS,SAAS,QAAQ,IAAI,cAAc,MAAM,SAAS,SAAS,QAAQ,EAAE;AAAA,EACtF;AACA,SAAO,WAAW,CAAC,KAAK;AAC1B;AAQA,SAASC,wBACP,QACA,iBACA,QACA,KACqB;AACrB,QAAM,cAAc,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,cAAc,UAAU,SAAS,WAAW;AACjG,aAAW,KAAK;AAAA,IACd,MAAM;AAAA,IACN,QAAQ;AAAA,IACR;AAAA,IACA,oBAAoB,IAAI,YAAY;AAAA,EACtC,CAAC;AACD,SAAO,EAAE,GAAG,QAAQ,WAAW;AACjC;AAMO,SAAS,qCACd,SAC2C;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAA6C;AAC3D,YAAM,YAAY,QAAQ;AAC1B,YAAM,SAAS,UAAU,UAAU,CAAC;AACpC,UACE,UAAU,KAAK,WAAW,gBAC1B,gBAAgB,IAAI,OAAO,SAAS,EAAE,KACtC,OAAO,UAAU,aACjB,OAAO,kBACP;AACA,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AAEA,YAAM,WAAW,mBAAmB,WAAW,MAAM,QAAQ,cAAc,CAAC;AAC5E,UAAI,CAAC,UAAU;AACb,eAAO;AAAA,UACL,QAAQA;AAAA,YACN,EAAE,GAAG,QAAQ,OAAO,UAAU;AAAA,YAC9B;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AAAA,UACA,OAAO;AAAA,UACP,gBAAgB,QAAQ,gBAAgB;AAAA,QAC1C;AAAA,MACF;AAEA,YAAM,WAAW,SAAS;AAC1B,aAAO;AAAA,QACL,QAAQA;AAAA,UACN;AAAA,YACE,GAAG;AAAA,YACH,OAAO;AAAA,YACP,cAAc,SAAS;AAAA,YACvB,gBAAgB,SAAS,SAAS;AAAA,YAClC,kBAAkB;AAAA,cAChB,YAAY;AAAA,cACZ,MAAM;AAAA,cACN,MAAM,SAAS,SAAS;AAAA,cACxB,WAAW,SAAS,SAAS;AAAA,cAC7B,KAAK,SAAS,SAAS;AAAA,YACzB;AAAA,UACF;AAAA,UACA;AAAA,UACA,WAAW,SAAS,SAAS,IAAI;AAAA,UACjC,QAAQ;AAAA,QACV;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAQA,SAAS,oBACP,QACA,KACA,UAAU,0GACW;AACrB,QAAM,SAAS;AACf,QAAM,cAAc,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,cAAc,UAAU,SAAS,eAAe;AACrG,aAAW,KAAK;AAAA,IACd,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,oBAAoB,IAAI,YAAY;AAAA,EACtC,CAAC;AACD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO;AAAA,IACP,aAAa,IAAI,YAAY;AAAA,IAC7B,QAAQ;AAAA,MACN,OAAO;AAAA,QACL,MAAM;AAAA,QACN;AAAA,QACA,WAAW;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF;AAWA,SAAS,aAAa,WAA4D;AAChF,SAAO,UAAU,SAAS,OACxB,GAAG,UAAU,SAAS,aAAa,SAAS,IAAI,UAAU,SAAS,QAAQ,EAAE;AACjF;AAOO,SAAS,uCACd,SACkC;AAClC,QAAM,SAAS,oBAAI,IAGhB;AAEH,QAAM,aAA+C;AAAA,IACnD,OAAO,WAAW;AAChB,YAAM,UAAU,OAAO,IAAI,aAAa,SAAS,CAAC;AAClD,UAAI,CAAC,QAAS,QAAO;AACrB,cAAQ,SAAS;AACjB,cAAQ,WAAW,MAAM;AACzB,aAAO;AAAA,IACT;AAAA,IACA,YAAY;AACV,YAAM,QAAQ,OAAO;AACrB,iBAAW,WAAW,OAAO,OAAO,GAAG;AACrC,gBAAQ,SAAS;AACjB,gBAAQ,WAAW,MAAM;AAAA,MAC3B;AACA,aAAO;AAAA,IACT;AAAA,IACA,aAAa,MAAM,OAAO;AAAA,IAC1B,MAAM,UAAU,SAA6C;AAC3D,YAAM,YAAY,QAAQ;AAC1B,YAAM,SAAS,UAAU,UAAU,CAAC;AACpC,UACE,UAAU,KAAK,WAAW,gBAC1B,gBAAgB,IAAI,OAAO,SAAS,EAAE,KACtC,OAAO,iBAAiB,QAAQ,QAChC;AACA,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AAEA,WAAK,OAAO,SAAS,eAAe,WAAW;AAC7C,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,WAAW,OAAO,aAAa,QAAQ,IAAI,YAAY;AAAA,YACvD,gBAAgB;AAAA,cACd,YAAY,QAAQ;AAAA,cACpB,WAAW,QAAQ,IAAI,YAAY;AAAA,YACrC;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,UAAI,OAAO,UAAU,aAAa,CAAC,OAAO,eAAgB,QAAO,EAAE,OAAO,KAAK;AAC/E,UAAI,OAAO,eAAe,eAAe,QAAQ,YAAY;AAC3D,YAAI,UAAU,KAAK,WAAW,QAAQ;AACpC,iBAAO;AAAA,YACL,QAAQ;AAAA,cACN,GAAG;AAAA,cACH,OAAO;AAAA,cACP,gBAAgB;AAAA,YAClB;AAAA,YACA,OAAO;AAAA,UACT;AAAA,QACF;AACA,eAAO,EAAE,QAAQ,oBAAoB,QAAQ,QAAQ,GAAG,GAAG,OAAO,KAAK;AAAA,MACzE;AAEA,YAAM,MAAM,aAAa,SAAS;AAClC,YAAM,kBAAkB,IAAI,gBAAgB;AAC5C,YAAM,kBAGF,EAAE,YAAY,iBAAiB,QAAQ,YAAY;AACvD,aAAO,IAAI,KAAK,eAAe;AAC/B,YAAM,YAAY,UAAU,KAAK;AACjC,YAAM,UAAU,cAAc,UAAa,YAAY,IACnD,WAAW,MAAM;AACjB,wBAAgB,SAAS;AACzB,wBAAgB,MAAM;AAAA,MACxB,GAAG,SAAS,IACV;AACJ,YAAM,YAAY,QAAQ,OAAO,QAAQ,WAAW;AAAA,QAClD,QAAQ,gBAAgB;AAAA,QACxB,OAAO,QAAQ;AAAA,QACf,YAAY,QAAQ;AAAA,MACtB,CAAC,EAAE;AAAA,QACD,CAAC,cAAc,EAAE,MAAM,YAAqB,SAAS;AAAA,QACrD,CAACC,YAAoB,EAAE,MAAM,SAAkB,OAAAA,OAAM;AAAA,MACvD;AACA,YAAM,UAAU,IAAI,QAA6B,CAAC,YAAY;AAC5D,wBAAgB,OAAO;AAAA,UACrB;AAAA,UACA,MAAM;AACJ,oBAAQ,EAAE,MAAM,UAAU,CAAC;AAAA,UAC7B;AAAA,UACA,EAAE,MAAM,KAAK;AAAA,QACf;AAAA,MACF,CAAC;AACD,YAAM,UAAU,MAAM,QAAQ,KAAK,CAAC,WAAW,OAAO,CAAC;AACvD,UAAI,YAAY,OAAW,cAAa,OAAO;AAC/C,aAAO,OAAO,GAAG;AAEjB,UAAI,QAAQ,SAAS,WAAW;AAI9B,aAAK,UAAU,KAAK,MAAM,MAAS;AACnC,YAAI,UAAU,KAAK,WAAW,QAAQ;AACpC,iBAAO;AAAA,YACL,QAAQ;AAAA,cACN;AAAA,cACA,QAAQ;AAAA,cACR,kBAAkB,gBAAgB,MAAM;AAAA,YAC1C;AAAA,YACA,OAAO;AAAA,UACT;AAAA,QACF;AACA,cAAM,WAAW,gBAAgB,WAAW;AAC5C,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO,WAAW,WAAW;AAAA,YAC7B,aAAa,QAAQ,IAAI,YAAY;AAAA,YACrC,QAAQ;AAAA,cACN,OAAO;AAAA,gBACL,MAAM,WAAW,YAAY;AAAA,gBAC7B,SAAS,WAAW,4BAA4B;AAAA,gBAChD,WAAW;AAAA,cACb;AAAA,YACF;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,UAAI,QAAQ,SAAS,YAAY;AAC/B,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG,QAAQ,SAAS;AAAA,YACpB,gBAAgB,OAAO;AAAA,YACvB,cAAc,OAAO;AAAA,YACrB,kBAAkB,OAAO;AAAA,YACzB,gBAAgB,OAAO;AAAA,UACzB;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,aAAa,QAAQ,IAAI,YAAY;AAAA,UACrC,QAAQ;AAAA,YACN,OAAO,cAAc,yBAAyB,QAAQ,KAAK,CAAC;AAAA,UAC9D;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;;;AC/VO,SAAS,mCACd,SAC8C;AAC9C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,QAAQ,QAAQ;AACtB,YAAM,SAAS,MAAM,UAAU,CAAC;AAChC,UAAI,OAAO,SAAS,OAAO,UAAU,UAAW,QAAO,EAAE,OAAO,KAAK;AACrE,YAAM,eAAe,MAAM,QAAQ,gBAAgB,KAAK;AACxD,YAAM,eAAe,IAAI,EAAE,YAAY;AACvC,UAAI,CAAC,cAAc;AACjB,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,YAAY,CAAC;AAAA,cACX,MAAM;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,SAAS;AAAA,cACT,oBAAoB;AAAA,YACtB,CAAC;AAAA,UACH;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,YAAM,eAAe,MAAM,QAAQ,uBAAuB,KAAK;AAC/D,YAAM,cAAc,MAAM,QAAQ,YAAY,GAAG,QAAQ,CAAC,aAAa;AACrE,YACE,CAAC,SAAS,WACV,SAAS,UAAU,aAClB,gBAAgB,SAAS,WAAW,aACrC,QAAO,CAAC;AACV,YACE,SAAS,eAAe,WACvB,SAAS,iBAAiB,MAAM,SAAS,WAC1C,QAAO,CAAC;AACV,YACE,SAAS,mBAAmB,WAC3B,MAAM,KAAK,aAAa,KAAK,SAAS,eACvC,QAAO,CAAC;AACV,YACE,MAAM,KAAK,YACX,OAAO,QAAQ,MAAM,KAAK,QAAQ,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,SAAS,SAAS,GAAG,MAAM,KAAK,EAC3F,QAAO,CAAC;AACV,cAAM,aAAa,SAAS,aAAa,KAAK,CAAC,SAAS,4BAA4B,MAAM,OAAO,YAAY,CAAC;AAC9G,eAAO,aAAa,CAAC,EAAE,UAAU,WAAW,CAAC,IAAI,CAAC;AAAA,MACpD,CAAC,EAAE;AAAA,QAAK,CAAC,MAAM,WACZ,KAAK,SAAS,iBAAiB,MAAM,MAAM,SAAS,iBAAiB,MACtE,KAAK,SAAS,OAAO,cAAc,MAAM,SAAS,MAAM;AAAA,MAC1D;AACA,YAAM,WAAW,WAAW,CAAC;AAC7B,UAAI,CAAC,UAAU;AACb,cAAM,EAAE,cAAc,OAAO,gBAAgB,SAAS,SAAS,UAAU,GAAG,QAAQ,IAAI;AACxF,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,YAAY,CAAC;AAAA,cACX,MAAM;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,SAAS,6CAA6C,aAAa,SAAS,IAAI;AAAA,cAChF,oBAAoB;AAAA,YACtB,CAAC;AAAA,UACH;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UACE,OAAO,iBAAiB,SAAS,SAAS,UAC1C,OAAO,mBAAmB,SAAS,WAAW,QAC9C,OAAO,SAAS,eAAe,QAAQ,cACvC,OAAO,QAAQ,gCAAgC,aAAa,SAAS,gBACrE,QAAO,EAAE,OAAO,KAAK;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,cAAc,SAAS,SAAS;AAAA,UAChC,gBAAgB,SAAS,WAAW;AAAA,UACpC,SAAS;AAAA,YACP,YAAY,QAAQ;AAAA,YACpB,6BAA6B,aAAa,SAAS;AAAA,YACnD,SAAS;AAAA,UACX;AAAA,UACA,YAAY,CAAC;AAAA,YACX,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,SAAS,aAAa,SAAS,WAAW,IAAI,SAAS,SAAS,SAAS,MAAM;AAAA,YAC/E,oBAAoB;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAwBO,SAAS,qCACd,SAC8C;AAC9C,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,UAAU,SAAS;AACvB,YAAM,QAAQ,QAAQ;AACtB,YAAM,SAAS,MAAM,UAAU,CAAC;AAChC,UAAI,OAAO,iBAAiB,QAAQ,UAAU,CAAC,OAAO,kBAAkB,CAAC,OAAO,SAAS;AACvF,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,UAAI,OAAO,UAAU,WAAW,OAAO,UAAU,UAAU,OAAO,UAAU,UAAU;AACpF,eAAO,EAAE,OAAO,KAAK;AAAA,MACvB;AACA,YAAM,eAAe,MAAM,QAAQ,gBAAgB,KAAK;AACxD,UACE,CAAC,gBACD,aAAa,SAAS,oBAAoB,OAAO,QAAQ,6BACzD;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,SAAS,MAAM,QAAQ,UAAU,OAAO,cAAc;AAC5D,UAAI,CAAC,UAAU,EAAE,MAAM,OAAO,UAAU,GAAG,SAAS;AAClD,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,yBAAyB,OAAO,cAAc;AAAA,cACvD,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,OAAO,UAAU,gBAAgB;AACnC,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,gBAAgB;AAAA,cACd,YAAY,QAAQ;AAAA,cACpB,WAAW,IAAI,EAAE,YAAY;AAAA,YAC/B;AAAA,UACF;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AACA,UAAI,OAAO,gBAAgB,eAAe,QAAQ,YAAY;AAC5D,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,aAAa,MAAM,OAAO,gBAAgB;AAChD,UAAI,CAAC,4BAA4B,YAAY,OAAO,YAAY,GAAG;AACjE,eAAO;AAAA,UACL,QAAQ;AAAA,YACN,GAAG;AAAA,YACH,OAAO;AAAA,YACP,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AACA,YAAM,gBAAgB,QAAQ,UAC1B,MAAM,QAAQ,QAAQ,UAAU,OAAO,cAAc,IACrD;AACJ,YAAM,gBAAgB,iBAAiB,QAAQ,UAC3C,MAAM,cAAc;AAAA,QACpB,MAAM,QAAQ,QAAQ,uBAAuB;AAAA,UAC3C;AAAA,UACA;AAAA,UACA,OAAO,QAAQ;AAAA,UACf,YAAY,QAAQ;AAAA,QACtB,CAAC;AAAA,MACH,IACE;AACJ,YAAM,cAAc,gBAChB;AAAA,QACA,cAAc,cAAc;AAAA,QAC5B,eAAe,cAAc;AAAA,QAC7B,UAAU,EAAE,QAAQ,QAAQ,OAAO;AAAA,MACrC,IACE,MAAM,OAAO,UAAU,EAAE,OAAO,aAAa,CAAC;AAClD,YAAM,SAAS,MAAM,QAAQ,aAAa,OAAO,cAAc,WAAW;AAC1E,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAG;AAAA,UACH,OAAO;AAAA,UACP,WAAW;AAAA,YACT,YAAY,OAAO;AAAA,YACnB,MAAM,OAAO;AAAA,YACb,MAAM,OAAO,SAAS;AAAA,YACtB,KAAK,OAAO,SAAS;AAAA,UACvB;AAAA,QACF;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;ACtMA,IAAM,sBAAsB,oBAAI,IAAI,CAAC,aAAa,UAAU,WAAW,CAAC;AACxE,IAAI,4BAA4B;AAEzB,SAAS,kCACd,OACA,QACA,SACmC;AACnC,QAAM,QAAQ,QAAQ,UAAU,CAAC,OAAe,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAChG,QAAM,sBAAsB,QAAQ,uBAAuB;AAC3D,QAAM,wBAAwB,QAAQ,yBAAyB;AAC/D,QAAM,6BAA6B,QAAQ,8BAA8B;AACzE,QAAM,yBAAyB,QAAQ,0BAA0B;AACjE,QAAM,2BAA2B,QAAQ,4BAA4B;AACrE,QAAM,8BAA8B,QAAQ,+BAA+B;AAC3E,QAAM,UAAU,QAAQ,YAAY,MAAY;AAAA,EAAC;AACjD,+BAA6B;AAC7B,QAAM,uBAAuB,QAAQ,wBACnC,GAAG,QAAQ,MAAM,IAAI,KAAK,IAAI,CAAC,IAAI,yBAAyB;AAC9D,MAAI,CAAC,sBAAsB;AACzB,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,QAAM,SAAS,oBAAI,IAAyC;AAC5D,MAAI,UAAU;AAEd,iBAAe,sBACb,WACA,OACe;AACf,aAAS,UAAU,GAAG,UAAU,qBAAqB,WAAW,GAAG;AACjE,YAAM,UAAU,MAAM,MAAM,IAAsC,SAAS;AAC3E,UAAI,CAAC,QAAS;AACd,UAAI;AACF,cAAM,MAAM,aAAa,QAAQ,OAAO,WAAW,MAAM,QAAQ,MAAM,GAAG;AAAA,UACxE,iBAAiB,QAAQ,SAAS;AAAA,QACpC,CAAC;AACD;AAAA,MACF,SAASC,QAAO;AACd,YAAIA,kBAAiB,sBAAsBA,OAAM,SAAS,WAAY;AACtE,cAAMA;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,sBAAsB,UAAU,QAAQ,EAAE,cAAc,mBAAmB;AAAA,MACpF,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,kBAAkB,UAAiE;AAC1F,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,SAAS,SAAS;AAAA,MACxB,WAAW,SAAS,SAAS;AAAA,IAC/B;AAAA,EACF;AAEA,WAAS,0BACP,UACA,KACM;AACN,UAAM,YAAY,IAAI,KAAK;AAC3B,UAAM,oBAAoB,SAAS,SAAS,aAAa;AACzD,UAAM,qBAAqB,UAAU,aAAa,IAAI,SAAS,aAAa;AAC5E,QACE,UAAU,eAAe,8BACzB,UAAU,SAAS,uBACnB,UAAU,SAAS,SAAS,SAAS,QACrC,uBAAuB,qBACvB,UAAU,QAAQ,SAAS,SAAS,OACpC,IAAI,KAAK,oBAAoB,UAC7B,IAAI,KAAK,UAAU,UACnB,IAAI,KAAK,cAAc,QACvB;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,0BAA0B,IAAI,SAAS,IAAI,uDAAuD,SAAS,SAAS,IAAI;AAAA,QACjI,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,iBAAe,sBACb,WACkC;AAClC,aAAS,UAAU,GAAG,UAAU,qBAAqB,WAAW,GAAG;AACjE,YAAM,UAAU,MAAM,MAAM,IAG1B,SAAS;AACX,UAAI,CAAC,QAAS,QAAO;AAGrB,UAAI,QAAQ,QAAQ,sBAAuB,QAAO;AAClD,UAAI;AACF,eAAO,MAAM,MAAM;AAAA,UAIjB,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,YACE,GAAG,QAAQ;AAAA,YACX,OAAO;AAAA,YACP,uBAAuB;AAAA,cACrB;AAAA,cACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,YACpC;AAAA,UACF;AAAA,UACA,EAAE,iBAAiB,QAAQ,SAAS,gBAAgB;AAAA,QACtD;AAAA,MACF,SAASA,QAAO;AACd,YAAIA,kBAAiB,sBAAsBA,OAAM,SAAS,YAAY;AACpE;AAAA,QACF;AACA,cAAMA;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,gCAAgC,UAAU,QAAQ,EAAE,cAAc,mBAAmB;AAAA,MAC9F,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,iBAAe,oBACb,UACA,cACsE;AACtE,UAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,eAAS;AACP,UAAI,SAAS;AACX,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,UAAU,MAAM,MAAM;AAAA,QAC1B;AAAA,MACF;AACA,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,aAAa,aAAa,QAAQ,EAAE;AAAA,UAC7C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,CAAC,SAAS,KAAK,aAAa,WAAY,QAAO,EAAE,KAAK,QAAQ;AAClE,YAAM,UAAU,QAAQ,QAAQ;AAChC,UAAI,SAAS;AACX,cAAM,WAAW,MAAM,MAAM,IAAoE;AAAA,UAC/F,YAAY,QAAQ,cAAc;AAAA,UAClC,MAAM,QAAQ,QAAQ;AAAA,UACtB,MAAM,QAAQ;AAAA,UACd,WAAW,QAAQ;AAAA,QACrB,CAAC;AACD,YACE,YACA,SAAS,SAAS,QAAQ,QAAQ,OAClC,SAAS,QAAQ,YAAY,QAC7B,OAAO,SAAS,KAAK,MAAM,SAAS,OAAO,aAAa,EAAE,CAAC,KAC3D,KAAK,IAAI,IAAI,KAAK,MAAM,SAAS,OAAO,aAAa,EAAE,KAAK,+BAC5D,SAAS,KAAK,cAAc,SAAS,SAAS,KAAK,YAAY,YAC/D;AACA,iBAAO,EAAE,KAAK,SAAS,SAAS;AAAA,QAClC;AAAA,MACF;AACA,UAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,aAAa,QAAQ,SAAS,IAAI,4DAA4D,qBAAqB;AAAA,UAC5H,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,MAAM,wBAAwB;AAAA,IACtC;AAAA,EACF;AAEA,iBAAe,wBACb,UACA,cACA,QACgD;AAChD,UAAM,mBAAmB,SAAS,KAAK,eAAe;AACtD,QAAI,CAAC,iBAAkB,QAAO;AAC9B,UAAM,iBAAiB,GAAG,aAAa,QAAQ,SAAS,SAAS,IAAI;AACrE,UAAM,YAA4C;AAAA,MAChD,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,WAAW,SAAS,SAAS;AAAA,IAC/B;AACA,QAAI,aAAa,MAAM,MAAM,IAG3B,SAAS;AACX,QAAI,CAAC,YAAY;AACf,YAAM,WAAW,gCAAgC,gBAAgB;AAAA,QAC/D,iBAAiB;AAAA,UACf,YAAY;AAAA,UACZ,MAAM;AAAA,UACN,MAAM;AAAA,QACR;AAAA,QACA,aAAa;AAAA,UACX,YAAY,SAAS;AAAA,UACrB,MAAM,SAAS;AAAA,UACf,MAAM,SAAS,SAAS;AAAA,UACxB,KAAK,SAAS,SAAS;AAAA,QACzB;AAAA,QACA,QAAQ;AAAA,UACN,YAAY,aAAa;AAAA,UACzB,MAAM,aAAa;AAAA,UACnB,MAAM,aAAa;AAAA,UACnB,KAAK;AAAA,UACL,YAAY;AAAA,QACd;AAAA,QACA,QAAQ,QAAQ;AAAA,MAClB,CAAC;AACD,eAAS,SAAS,YAAY,SAAS,SAAS;AAChD,mBAAa,MAAM,MAAM,OAAO,QAAQ,OAAO,QAAQ;AAAA,IACzD;AACA,UAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,MACtE,GAAG;AAAA,MACH,sBAAsB;AAAA,QACpB,YAAY,WAAW;AAAA,QACvB,MAAM,WAAW;AAAA,QACjB,MAAM,WAAW,SAAS;AAAA,QAC1B,GAAI,WAAW,SAAS,YAAY,EAAE,WAAW,WAAW,SAAS,UAAU,IAAI,CAAC;AAAA,QACpF,KAAK,WAAW,SAAS;AAAA,MAC3B;AAAA,IACF,EAAE;AAEF,UAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,eAAS;AACP,UAAI,SAAS;AACX,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,UAAU,MAAM,MAAM,IAG1B,SAAS;AACX,UAAI,CAAC,WAAW,QAAQ,SAAS,QAAQ,WAAW,SAAS,KAAK;AAChE,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,sBAAsB,cAAc;AAAA,UAC7C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,QAAQ,UAAU,UAAU;AACtC,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM,QAAQ,OAAO,OAAO,QAAQ;AAAA,UACpC,SAAS,QAAQ,OAAO,OAAO,WAAW,sBAAsB,cAAc;AAAA,UAC9E,WAAW,QAAQ,OAAO,OAAO,aAAa;AAAA,QAChD,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,QAAQ,UAAU,cAAc,QAAQ,OAAO,QAAQ;AACjE,cAAM,eAAe,MAAM,MAAM,IAG/B,QAAQ,KAAK,eAAe;AAC9B,YACE,gBACA,QAAQ,OAAO,SAAS,gCAAgC,aAAa,SAAS,mBAC9E,QAAQ,OAAO,iBAAiB,QAAQ,UACxC,QAAQ,OAAO,mBAAmB,aAAa,KAAK,QACpD;AACA,iBAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,sBAAsB,cAAc,0BAA0B,0BAA0B;AAAA,UACjG,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,MAAM,wBAAwB;AAAA,IACtC;AAAA,EACF;AAEA,iBAAe,sBACb,UACA,cAIC;AACD,UAAM,WAAW,SAAS,KAAK,eAAe,WAAW,CAAC;AAC1D,QAAI,SAAS,WAAW,GAAG;AACzB,YAAM,MAAM,MAAM,MAAM;AAAA,QACtB;AAAA,MACF;AACA,aAAO,EAAE,IAAI;AAAA,IACf;AACA,UAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,eAAS;AACP,UAAI,SAAS;AACX,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,MAAM,MAAM,MAAM;AAAA,QACtB;AAAA,MACF;AACA,UAAI,CAAC,KAAK;AACR,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,aAAa,aAAa,QAAQ,EAAE;AAAA,UAC7C,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,UAAI,IAAI,QAAQ,gBAAgB,UAAU;AACxC,cAAM,IAAI;AAAA,UACR,IAAI,OAAO,eAAe;AAAA,YACxB,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb;AAAA,QACF;AAAA,MACF;AACA,YAAM,eAAe,IAAI,IAAI,IAAI,QAAQ,gBAAgB,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;AACjF,UACE,IAAI,QAAQ,gBAAgB,WAC5B,SAAS,MAAM,CAAC,SAAS,aAAa,IAAI,KAAK,IAAI,CAAC,GACpD;AACA,YAAI,CAAC,QAAQ,qBAAqB;AAChC,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,eAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,oBAAoB,UAAU,GAAG,EAAE;AAAA,MACzE;AACA,UAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS,aAAa,IAAI,SAAS,IAAI,mCAAmC,sBAAsB;AAAA,UAChG,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,MAAM,wBAAwB;AAAA,IACtC;AAAA,EACF;AAEA,iBAAe,yBACb,cACe;AACf,UAAM,MAAM,MAAM,MAAM;AAAA,MACtB;AAAA,IACF;AACA,QAAI,CAAC,IAAK;AACV,UAAM,eAAc,oBAAI,KAAK,GAAE,YAAY;AAC3C,UAAM,aAAa,IAAI,QAAQ;AAC/B,QAAI,YAAY;AACd,YAAM;AAAA,QACJ;AAAA,UACE,YAAY,WAAW;AAAA,UACvB,MAAM,WAAW;AAAA,UACjB,MAAM,WAAW;AAAA,UACjB,WAAW,WAAW;AAAA,QACxB;AAAA,QACA,CAAC,aAAa;AAAA,UACZ,GAAG;AAAA,UACH,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AACA,QACE,IAAI,QAAQ,gBAAgB,WAC5B,IAAI,QAAQ,gBAAgB,cAC5B;AACA,YAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,QACtE,GAAG;AAAA,QACH,0BAA0B;AAAA,MAC5B,EAAE;AAAA,IACJ;AAAA,EACF;AAEA,iBAAe,QAAQ,UAAgD;AACrE,UAAM,qBAAqB,kBAAkB,QAAQ;AACrD,UAAM,UAAU,GAAG,SAAS,SAAS,IAAI;AACzC,UAAM,eAA+C;AAAA,MACnD,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,WAAW,SAAS,SAAS;AAAA,IAC/B;AACA,QAAI,iBAAiB;AAErB,QAAI;AAEF,UAAI;AACJ,UAAI,SAAS,KAAK,iBAAiB;AACjC,uBAAe,MAAM,QAAQ,sBAAsB,SAAS,KAAK,eAAe;AAChF,YAAI,CAAC,cAAc;AACjB,gBAAM,sBAA2C,oBAAoB,CAAC,aAAa;AAAA,YACjF,GAAG;AAAA,YACH,OAAO;AAAA,YACP,eAAe,oBAAoB,SAAS,KAAK,eAAe;AAAA,UAClE,EAAE;AACF;AAAA,QACF;AAAA,MACF;AAGA,UAAI,MAAM,MAAM,MAAM,IAA0D,YAAY;AAC5F,UAAI,CAAC,KAAK;AACR,cAAM,WAAW,uBAAuB,SAAS;AAAA,UAC/C,aAAa;AAAA,YACX,YAAY;AAAA,YACZ,MAAM;AAAA,YACN,MAAM,SAAS,SAAS;AAAA,YACxB,WAAW,SAAS,SAAS;AAAA,YAC7B,KAAK,SAAS,SAAS;AAAA,UACzB;AAAA,QACF,CAAC;AACD,iBAAS,SAAS,YAAY,SAAS,SAAS;AAChD,YAAI;AACF,gBAAM,MAAM,MAAM;AAAA,YAChB,QAAQ;AAAA,YACR;AAAA,UACF;AAAA,QACF,SAASA,QAAO;AACd,cAAI,EAAEA,kBAAiB,uBAAuBA,OAAM,SAAS,YAAY;AACvE,kBAAMA;AAAA,UACR;AAEA,gBAAM,MAAM,MAAM,IAGhB,YAAY;AACd,cAAI,CAAC,IAAK,OAAMA;AAAA,QAClB;AAAA,MACF;AACA,gCAA0B,UAAU,GAAG;AACvC,UAAI,IAAI,QAAQ,SAAS,oBAAoB,IAAI,IAAI,OAAO,KAAK,GAAG;AAElE,cAAM,iBAAiB,IAAI;AAC3B,cAAM,sBAA2C,oBAAoB,CAAC,aAAa;AAAA,UACjF,GAAG;AAAA,UACH,OAAO,eAAe,UAAU,cAAc,cAAc;AAAA,UAC5D,eAAe,eAAe;AAAA,QAChC,EAAE;AACF;AAAA,MACF;AAEA,YAAM,CAAC,cAAc,mBAAmB,kBAAkB,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC9E,oBAAoB,UAAU,YAAY;AAAA,QAC1C,wBAAwB,UAAU,cAAc,IAAI,SAAS,GAAG;AAAA,QAChE,sBAAsB,UAAU,YAAY;AAAA,MAC9C,CAAC;AACD,YAAM,mBAAmB;AAEzB,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,MACF,KAAyB;AAEzB,YAAM,sBAA2C,oBAAoB,CAAC,aAAa;AAAA,QACjF,GAAG;AAAA,QACH,OAAO;AAAA,QACP,MAAM,CAAC,YAAY;AAAA,MACrB,EAAE;AACF,YAAM,aAAa,MAAM,sBAAsB,YAAY;AAC3D,UAAI,CAAC,WAAY;AACjB,uBAAiB;AACjB,YAAM;AACN,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,QACA,GAAI,aAAa,WAAW,EAAE,eAAe,aAAa,SAAS,IAAI,CAAC;AAAA,QACxE,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;AAAA,QACjD,GAAI,mBAAmB,SAAS,EAAE,cAAc,mBAAmB,OAAO,IAAI,CAAC;AAAA,QAC/E;AAAA,QACA,SAAS,QAAQ,qBAAqB,QAAQ,KAAK,SAAS,SAAS;AAAA,MACvE,CAAC;AACD,aAAO,IAAI,SAAS,SAAS,KAAK,MAAM;AACxC,YAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,QACtE,GAAG;AAAA,QACH,OAAO;AAAA,MACT,EAAE;AACF,YAAM,UAAU,MAAM,OAAO,KAAK;AAElC,YAAM,yBAAyB,YAAY;AAE3C,YAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,QACtE,GAAG;AAAA,QACH,OAAO,QAAQ;AAAA,QACf,SAAS,QAAQ,WAAW,QAAQ,OAAO;AAAA,QAC3C,UAAU,QAAQ,UAAU,cAAc,IAAI;AAAA,MAChD,EAAE;AACF,YAAM,sBAA2C,oBAAoB,CAAC,aAAa;AAAA,QACjF,GAAG;AAAA,QACH,OAAO,QAAQ,UAAU,cAAc,cAAc;AAAA,QACrD,eAAe,QAAQ,WAAW,QAAQ,OAAO;AAAA,MACnD,EAAE;AAAA,IACJ,SAASA,QAAO;AACd,YAAM,yBAAyB,YAAY,EAAE,MAAM,OAAO;AAC1D,YAAM,QAAQA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AACnE,YAAM,UAAU,iBACZ,uHAAuH,KAAK,KAC5H;AACJ,YAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,QACtE,GAAG;AAAA,QACH,GAAI,SAAS,SAAS,oBAAoB,IAAI,QAAQ,KAAK,IACvD,CAAC,IACD;AAAA,UACA,OAAO;AAAA,UACP,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,MACJ,EAAE,EAAE,MAAM,OAAO;AACjB,UAAI,QAAS;AACb,cAAQA,MAAK;AACb,YAAM,sBAA2C,oBAAoB,CAAC,aAAa;AAAA,QACjF,GAAG;AAAA,QACH,OAAO;AAAA,QACP,eAAe;AAAA,MACjB,EAAE,EAAE,MAAM,OAAO;AAAA,IACnB,UAAE;AACA,aAAO,OAAO,SAAS,SAAS,GAAG;AAAA,IACrC;AAAA,EACF;AAEA,iBAAe,eAAe,UAAgD;AAC5E,UAAM,eAA+C;AAAA,MACnD,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,GAAG,SAAS,SAAS,IAAI;AAAA,MAC/B,WAAW,SAAS,SAAS;AAAA,IAC/B;AACA,QAAI;AACF,YAAM,MAAM,MAAM,MAAM;AAAA,QACtB;AAAA,MACF;AACA,UAAI,KAAK;AACP,YAAI;AACF,oCAA0B,UAAU,GAAG;AAAA,QACzC,SAASA,QAAO;AACd,gBAAMC,WAAUD,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AACrE,gBAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,YACtE,GAAG;AAAA,YACH,OAAO;AAAA,YACP,SAASC;AAAA,YACT,UAAU;AAAA,UACZ,EAAE;AACF,gBAAM;AAAA,YACJ,kBAAkB,QAAQ;AAAA,YAC1B,CAAC,aAAa;AAAA,cACZ,GAAG;AAAA,cACH,OAAO;AAAA,cACP,eAAeA;AAAA,YACjB;AAAA,UACF;AACA,kBAAQD,MAAK;AACb;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,SAAS,IAAI,OAAO,UAAU,WAAW;AAGhE,cAAM,QAAQ,QAAQ;AACtB;AAAA,MACF;AACA,UAAI,oBAAoB,IAAI,IAAI,OAAO,KAAK,GAAG;AAC7C,cAAM,yBAAyB,YAAY;AAC3C,cAAM;AAAA,UACJ,kBAAkB,QAAQ;AAAA,UAC1B,CAAC,aAAa;AAAA,YACZ,GAAG;AAAA,YACH,OAAO,IAAI,QAAQ,UAAU,cAAc,cAAc;AAAA,YACzD,eAAe,IAAI,QAAQ;AAAA,UAC7B;AAAA,QACF;AACA;AAAA,MACF;AAEA,YAAM,UAAU,6BAA6B,IAAI,SAAS,IAAI,cAAc,IAAI,OAAO,KAAK,mBACxE,IAAI,OAAO,uBAAuB,wBAAwB,SAAS;AAEvF,YAAM,yBAAyB,YAAY;AAC3C,YAAM,sBAAsC,cAAc,CAAC,aAAa;AAAA,QACtE,GAAG;AAAA,QACH,OAAO;AAAA,QACP,SAAS;AAAA,QACT,UAAU;AAAA,MACZ,EAAE;AACF,YAAM;AAAA,QACJ,kBAAkB,QAAQ;AAAA,QAC1B,CAAC,aAAa;AAAA,UACZ,GAAG;AAAA,UACH,OAAO;AAAA,UACP,eAAe;AAAA,QACjB;AAAA,MACF;AAAA,IACF,SAASA,QAAO;AACd,cAAQA,MAAK;AAAA,IACf,UAAE;AACA,aAAO,OAAO,SAAS,SAAS,GAAG;AAAA,IACrC;AAAA,EACF;AAEA,WAAS,WAAW,UAAuC;AACzD,UAAM,WAAW;AACjB,UAAM,SAAS,SAAS;AACxB,QACE,CAAC,UACA,OAAO,UAAU,gBAAgB,OAAO,UAAU,UACnD;AACF,QAAI,OAAO,iBAAiB,QAAQ,OAAQ;AAC5C,QAAI,OAAO,IAAI,SAAS,SAAS,GAAG,EAAG;AACvC,WAAO,IAAI,SAAS,SAAS,KAAK,EAAE,QAAQ,YAAY;AAAA,IAAC,EAAE,CAAC;AAC5D,QAAI,OAAO,UAAU,WAAW;AAC9B,WAAK,eAAe,QAAQ;AAAA,IAC9B,OAAO;AACL,WAAK,QAAQ,QAAQ,EAAE,MAAM,OAAO;AAAA,IACtC;AAAA,EACF;AAEA,QAAM,YAAY;AAChB,WAAO,CAAC,SAAS;AACf,UAAI;AACF,yBACQ,SAAS,MAAM;AAAA,UACnB,EAAE,YAAY,4BAA4B,MAAM,oBAAoB;AAAA,UACpE,EAAE,mBAAmB,KAAK;AAAA,QAC5B,GACA;AACA,cAAI,QAAS;AACb,cAAI,MAAM,SAAS,WAAW,MAAM,SAAS,YAAY;AACvD,uBAAW,MAAM,QAAQ;AAAA,UAC3B,WAAW,MAAM,SAAS,WAAW;AACnC,kBAAM,WAAW,MAAM;AACvB,kBAAM,OAAO,IAAI,SAAS,SAAS,GAAG,GAAG,OAAO,EAAE,MAAM,OAAO;AAAA,UACjE;AAAA,QACF;AAAA,MACF,SAASA,QAAO;AACd,gBAAQA,MAAK;AAAA,MACf;AACA,UAAI,CAAC,QAAS,OAAM,MAAM,GAAI;AAAA,IAChC;AAAA,EACF,GAAG,EAAE,MAAM,OAAO;AAElB,SAAO;AAAA,IACL,MAAM,OAAO;AACX,gBAAU;AACV,iBAAW,UAAU,OAAO,OAAO,GAAG;AACpC,cAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACF;;;AC7tBO,IAAM,8BAA8B;AACpC,IAAM,uBAAuB;AAapC,SAAS,eAAe,KAAqB;AAC3C,SAAO,mBAAmB,GAAG;AAC/B;AAEA,eAAe,cAAc,MAAgC;AAC3D,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,IAAI;AAC7C,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO;AAC1D,SAAO,MAAM,KAAK,IAAI,WAAW,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC7F;AAEO,SAAS,sCACd,OACA,OACA,MAAkB,MAAM,oBAAI,KAAK,GACN;AAC3B,SAAO;AAAA,IACL,MAAM,eAAe,gBAAgB,KAAK,QAAQ;AAChD,YAAM,YAAY;AAAA,QAChB,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,WAAW;AAAA,QACX,MAAM,eAAe,GAAG;AAAA,MAC1B;AACA,YAAM,WAAW,MAAM,MAAM,IAAwB,SAAS;AAC9D,UAAI,SAAU;AACd,YAAM,SAAS,gBAAgB,MAAM;AACrC,YAAME,UAAS,MAAM,cAAc,MAAM;AACzC,YAAM,WAA8D;AAAA,QAClE,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,UAAU,EAAE,WAAW,gBAAgB,MAAM,eAAe,GAAG,EAAE;AAAA,QACjE,MAAM,EAAE,gBAAgB,KAAK,QAAQ,QAAQ,QAAAA,SAAQ,WAAW,IAAI,EAAE,YAAY,EAAE;AAAA,MACtF;AACA,UAAI;AACF,cAAM,MAAM,OAAO,OAAO,UAAU,EAAE,gBAAgB,mBAAmB,cAAc,IAAI,GAAG,GAAG,CAAC;AAAA,MACpG,SAASC,QAAO;AACd,YAAI,EAAEA,kBAAiB,uBAAuBA,OAAM,SAAS,WAAY,OAAMA;AAAA,MACjF;AAAA,IACF;AAAA,IAEA,MAAM,eAAkB,gBAAwB,KAAqC;AACnF,YAAM,aAAa,MAAM,MAAM,IAAwB;AAAA,QACrD,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,WAAW;AAAA,QACX,MAAM,eAAe,GAAG;AAAA,MAC1B,CAAC;AACD,UAAI,CAAC,WAAY,QAAO;AACxB,YAAM,iBAAiB,WAAW,KAAK;AACvC,YAAM,eAAe,MAAM,cAAc,WAAW,KAAK,MAAM;AAC/D,UAAI,iBAAiB,eAAgB,QAAO;AAC5C,aAAO,gBAAgB,WAAW,KAAK,MAAM;AAAA,IAC/C;AAAA,EACF;AACF;;;ACmKO,SAAS,4BAA4B,MAAiC;AAC3E,SAAO,KAAK;AACd;AAEO,SAAS,kCACd,YACA,WAC0B;AAC1B,QAAM,QAAkC,CAAC;AACzC,aAAW,OAAO,OAAO,KAAK,SAAS,GAAoD;AACzF,UAAM,QAAQ,UAAU,GAAG;AAC3B,QAAI,UAAU,UAAa,UAAU,WAAW,GAAG,GAAG;AACpD,MAAC,MAAkC,GAAG,IAAI;AAAA,IAC5C;AAAA,EACF;AACA,SAAO;AACT;;;ACpOO,IAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,SAAS,WAAW,GAAe,GAAwB;AACzD,SAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,UAAU,SAAS,EAAE,KAAK,CAAC;AAC5E;AAEA,eAAsB,sBACpB,SACA,UAAoF,CAAC,GAClD;AACnC,QAAM,iBAAiB,QAAQ,kBAAkB,eAAe,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC;AACvF,QAAM,UAAU,IAAI,IAAI,QAAQ,UAAU,0BAA0B;AACpE,QAAM,WAAwC,CAAC;AAC/C,MAAI,SAAS;AAEb,iBAAe,IAAI,MAA+B,MAA0C;AAC1F,QAAI,CAAC,QAAQ,IAAI,IAAI,EAAG;AACxB,cAAU;AACV,QAAI;AACF,YAAM,KAAK;AAAA,IACb,SAASC,QAAO;AACd,eAAS,KAAK,EAAE,OAAO,MAAM,SAASA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK,EAAE,CAAC;AAAA,IAChG;AAAA,EACF;AAEA,WAAS,OAAO,WAAoB,SAAuB;AACzD,QAAI,CAAC,UAAW,OAAM,IAAI,MAAM,OAAO;AAAA,EACzC;AAEA,QAAM,IAAI,4BAA4B,YAAY;AAChD,UAAM,QAAQ,kBAAkB,EAAE,WAAW,GAAG,cAAc,OAAO,gBAAgB,MAAM,QAAQ,SAAS,SAAS,cAAc,EAAE,CAAC;AACtI,UAAM,SAAS,kBAAkB,EAAE,WAAW,GAAG,cAAc,OAAO,gBAAgB,MAAM,aAAa,SAAS,SAAS,cAAc,EAAE,CAAC;AAC5I,UAAM,QAAQ,cAAc,KAAK;AACjC,UAAM,QAAQ,cAAc,MAAM;AAClC,UAAM,WAAW,MAAM,QAAQ,YAAY,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACnF,UAAM,MAAM,SAAS,IAAI,CAAC,YAAY,QAAQ,SAAS;AACvD,WAAO,IAAI,SAAS,MAAM,SAAS,KAAK,IAAI,SAAS,OAAO,SAAS,GAAG,+BAA+B,IAAI,KAAK,GAAG,CAAC,EAAE;AACtH,UAAM,YAAY,SAAS,KAAK,CAAC,YAAY,QAAQ,cAAc,MAAM,SAAS;AAClF,WAAO,WAAW,YAAY,SAAS,iCAAiC;AAAA,EAC1E,CAAC;AAED,QAAM,IAAI,4BAA4B,YAAY;AAChD,UAAM,UAAU,kBAAkB,EAAE,WAAW,GAAG,cAAc,QAAQ,gBAAgB,MAAM,QAAQ,SAAS,QAAQ,cAAc,EAAE,CAAC;AACxI,UAAM,QAAQ,uBAAuB,CAAC,OAAO,CAAC;AAC9C,UAAM,QAAQ,uBAAuB,CAAC,OAAO,CAAC;AAC9C,UAAM,WAAW,MAAM,QAAQ,YAAY,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACnF,UAAM,cAAc,SAAS,OAAO,CAAC,UAAU,MAAM,cAAc,QAAQ,SAAS;AACpF,WAAO,YAAY,WAAW,GAAG,kCAAkC,YAAY,MAAM,EAAE;AAAA,EACzF,CAAC;AAED,QAAM,IAAI,oCAAoC,YAAY;AACxD,UAAM,QAAQ,2BAA2B;AAAA,MACvC;AAAA,MACA,OAAO;AAAA,MACP,oBAAoB;AAAA,MACpB,sBAAsB,KAAK,IAAI;AAAA,MAC/B,cAAc;AAAA,MACd,cAAc;AAAA,MACd,aAAa;AAAA,MACb,cAAc;AAAA,MACd,iBAAiB;AAAA,IACnB,CAAC;AACD,UAAM,OAAO,MAAM,QAAQ,oBAAoB,cAAc;AAC7D,WAAO,QAAQ,MAAM,kDAAkD;AACvE,WAAO,MAAM,iBAAiB,qBAAqB,iCAAiC;AAAA,EACtF,CAAC;AAED,QAAM,IAAI,sBAAsB,YAAY;AAC1C,UAAM,gBAAgB,MAAM,QAAQ,kBAAkB;AACtD;AAAA,MACE,cAAc,KAAK,CAAC,SAAS,KAAK,mBAAmB,cAAc;AAAA,MACnE;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,IAAI,yBAAyB,YAAY;AAC7C,UAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,0BAA0B;AACjE,UAAMC,UAAS,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,KAAK;AACrE,UAAM,cAAc,UAAU,CAAC,GAAG,IAAI,WAAWA,OAAM,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AACpH,UAAM,YAAiC;AAAA,MACrC;AAAA,MACA,UAAU;AAAA,MACV,UAAU;AAAA,MACV,MAAM,MAAM;AAAA,IACd;AACA,UAAM,QAAQ,eAAe,WAAW,KAAK;AAC7C,UAAM,SAAS,MAAM,QAAQ,cAAc,UAAU,WAAW;AAChE,WAAO,UAAU,MAAM,+CAA+C;AACtE,QAAI,OAAO,QAAQ,uBAAuB,YAAY;AACpD,YAAM,OAAO,MAAM,QAAQ,mBAAmB,UAAU,WAAW;AACnE,aAAO,QAAQ,QAAQ,WAAW,MAAM,KAAK,GAAG,gDAAgD;AAAA,IAClG;AAAA,EACF,CAAC;AAED,QAAM,IAAI,mCAAmC,YAAY;AACvD,UAAM,UAAU,MAAM,QAAQ,mBAAmB,GAAG,cAAc,UAAU;AAC5E,WAAO,YAAY,MAAM,qDAAqD;AAAA,EAChF,CAAC;AAED,SAAO,EAAE,QAAQ,QAAQ,SAAS,SAAS,QAAQ,SAAS;AAC9D;AAEA,eAAsB,yBACpB,SACA,UAAoF,CAAC,GACtE;AACf,QAAM,SAAS,MAAM,sBAAsB,SAAS,OAAO;AAC3D,MAAI,OAAO,SAAS,SAAS,GAAG;AAC9B,UAAM,UAAU,OAAO,SAAS,IAAI,CAAC,YAAY,GAAG,QAAQ,KAAK,KAAK,QAAQ,OAAO,EAAE,EAAE,KAAK,IAAI;AAClG,UAAM,IAAI,MAAM,+BAA+B,OAAO,MAAM,IAAI,OAAO,MAAM,MAAM,OAAO,EAAE;AAAA,EAC9F;AACF;;;ACrHO,SAAS,uBACd,gBACA,UACA,WAAU,oBAAI,KAAK,GAAE,YAAY,GACf;AAClB,QAAM,cAAc,SAAS,SAAS,SAAS,CAAC;AAChD,QAAM,UAAU,eAAe,OAAO,YAAY,YAAY,WAAW,YAAY,QAAQ,MAAM,GAAG,GAAG,IAAI;AAE7G,SAAO;AAAA,IACL;AAAA,IACA,UAAU,CAAC,GAAG,QAAQ;AAAA,IACtB;AAAA,IACA,cAAc,SAAS;AAAA,IACvB,oBAAoB;AAAA,EACtB;AACF;AAEO,SAAS,sBAAsB,KAAsC;AAC1E,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,WAAO,mBAAmB,MAAM,IAAI,SAAS;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,0BAA0B,QAAkC;AAC1E,SAAO,KAAK,UAAU,QAAQ,MAAM,CAAC;AACvC;AAEO,IAAM,0BAAN,MAAyD;AAAA,EAC7C,UAAU,oBAAI,IAA8B;AAAA,EAE7D,YAAY,UAAiC,CAAC,GAAG;AAC/C,eAAW,UAAU,QAAQ,WAAW,CAAC,GAAG;AAC1C,WAAK,QAAQ,IAAI,OAAO,gBAAgB,sBAAsB,MAAM,CAAC;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,gBAAwB,UAAoD;AAC/F,UAAM,SAAS,uBAAuB,gBAAgB,QAAQ;AAC9D,SAAK,QAAQ,IAAI,gBAAgB,sBAAsB,MAAM,CAAC;AAC9D,WAAO,sBAAsB,MAAM;AAAA,EACrC;AAAA,EAEA,MAAM,eAAe,gBAA0D;AAC7E,UAAM,SAAS,KAAK,QAAQ,IAAI,cAAc;AAC9C,WAAO,SAAS,sBAAsB,MAAM,IAAI;AAAA,EAClD;AAAA,EAEA,MAAM,kBAAgD;AACpD,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,EAC7B,IAAI,mBAAmB,EACvB,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;AAAA,EACtD;AAAA,EAEA,MAAM,iBAAiB,gBAA0C;AAC/D,WAAO,KAAK,QAAQ,OAAO,cAAc;AAAA,EAC3C;AACF;AAEO,IAAM,iBAAN,cAA6B,wBAAwB;AAAC;AAE7D,SAAS,mBAAmB,QAA6C;AACvE,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAClB,SACE,OAAO,UAAU,mBAAmB,YACpC,MAAM,QAAQ,UAAU,QAAQ,KAChC,OAAO,UAAU,YAAY,YAC7B,OAAO,UAAU,iBAAiB,YAClC,OAAO,UAAU,uBAAuB;AAE5C;AAEA,SAAS,sBAAsB,QAA4C;AACzE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAU,CAAC,GAAG,OAAO,QAAQ;AAAA,EAC/B;AACF;AAEA,SAAS,oBAAoB,QAA6C;AACxE,SAAO;AAAA,IACL,gBAAgB,OAAO;AAAA,IACvB,SAAS,OAAO;AAAA,IAChB,cAAc,OAAO;AAAA,IACrB,oBAAoB,OAAO;AAAA,EAC7B;AACF;;;AC3FO,SAAS,yBACd,SACA,eACwB;AACxB,MAAI,CAAC,WAAW,CAAC,QAAQ,SAAS,OAAO,QAAQ,SAAS,SAAU,QAAO;AAE3E,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,QAAQ,IAAI;AACtC,QAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,aAAO;AAAA,IACT;AACA,2BAAuB;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,CAAC,OAAgB,WAAW,OAC5C,OAAO,UAAU,WACb,QACA,SAAS,OAAO,UAAU,WAC1B,KAAK,UAAU,KAAK,IACpB;AAEN,QAAM,YAAY,CAAC,UAAoE;AACrF,QAAI,OAAO,UAAU,UAAU;AAC7B,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,YAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,iBAAO;AAAA,QACT;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,KAAK,iBAAiB,UAAU,QAAQ,KAAK,EAAE,QAAQ,mBAAmB,GAAG,CAAC;AACpF,QAAM,OAAO,UAAU,QAAQ,OAAO,KAAK,UAAU,QAAQ,KAAK;AAClE,QAAM,cAAc,UAAU,QAAQ,WAAW,KAAK,uBAAuB,iBAAiB,MAAM;AAEpG,QAAM,iBAAiB,UAAU,QAAQ,aAAa;AACtD,QAAM,cAAc,kBAAkB,OAAO,mBAAmB,YAAY,CAAC,MAAM,QAAQ,cAAc,IACrG,iBACA;AACJ,QAAM,cAAc,cAChB;AAAA,IACA,UAAU,OAAO,YAAY,aAAa,WAAW,YAAY,WAAW;AAAA,IAC5E,OAAO,OAAO,YAAY,UAAU,WAAW,YAAY,QAAQ;AAAA,EACrE,IACE;AAEJ,QAAM,WAAW,UAAU,QAAQ,WAAW;AAC9C,QAAM,YAAY,MAAM,QAAQ,QAAQ,IACnC,SACA,OAAO,CAAC,MAAM,OAAO,GAAG,WAAW,QAAQ,EAC3C,IAAI,CAAC,MAAM,OAAO,EAAE,MAAM,CAAC,IAC5B,CAAC;AAEL,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,OAAO;AAAA,IACP;AAAA;AAAA,IAEA,cAAc;AAAA,IACd,sBAAsB;AAAA,MACpB,SAAS,MAAM,QAAQ,qBAAqB,OAAO,IAC9C,qBAAqB,UACtB,CAAC;AAAA,MACL,SAAS,MAAM,QAAQ,qBAAqB,OAAO,IAC9C,qBAAqB,UACtB,CAAC;AAAA,MACL,UAAU,MAAM,QAAQ,qBAAqB,QAAQ,IACjD,qBAAqB,WACrB;AAAA,IACN;AAAA,IACA,SAAS;AAAA,EACX;AACF;;;ACvGA,SAAS,UAAU,MAA+B;AAChD,QAAM,IAAI,+CAA+C,KAAK,IAAI;AAClE,MAAI,CAAC,EAAG,QAAO;AACf,SAAO,EAAE,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;AAC3C;AAEA,SAAS,wBAAwB,MAAuB;AACtD,QAAM,IAAI,UAAU,IAAI;AACxB,MAAI,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,EAAG,QAAO;AACzC,QAAM,CAAC,GAAG,CAAC,IAAI;AACf,MAAI,MAAM,OAAO,MAAM,EAAG,QAAO;AACjC,MAAI,MAAM,GAAI,QAAO;AACrB,MAAI,MAAM,OAAO,KAAK,MAAM,KAAK,GAAI,QAAO;AAC5C,MAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,MAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,SAAO;AACT;AAGO,SAAS,0BAA0B,KAAyB;AACjE,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,WAAO;AAAA,EACT;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AACzD,WAAO;AAAA,EACT;AACA,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,MACE,SAAS,eACT,KAAK,SAAS,YAAY,KAC1B,SAAS,aACT,SAAS,UACT,SAAS,MACT;AACA,WAAO;AAAA,EACT;AACA,MAAI,KAAK,WAAW,MAAM,GAAG;AAC3B,WAAO;AAAA,EACT;AACA,MAAI,wBAAwB,IAAI,GAAG;AACjC,WAAO;AAAA,EACT;AACA,MAAI,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,WAAW,GAAG,GAAG;AAC/C,UAAM,QAAQ,KAAK,YAAY;AAC/B,QAAI,MAAM,WAAW,OAAO,KAAK,MAAM,WAAW,IAAI,KAAK,MAAM,WAAW,IAAI,GAAG;AACjF,aAAO;AAAA,IACT;AACA,QAAI,UAAU,OAAO;AACnB,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,GAAG;AAC9C,UAAM,QAAQ,KAAK,MAAM,GAAG,EAAE,EAAE,YAAY;AAC5C,QAAI,UAAU,SAAS,MAAM,WAAW,OAAO,KAAK,MAAM,WAAW,IAAI,KAAK,MAAM,WAAW,IAAI,GAAG;AACpG,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,IAAI,KAAK,QAAQ,YAAY,EAAE,EAAE,YAAY;AACnD,MAAI,MAAM,8BAA8B,EAAE,SAAS,WAAW,GAAG;AAC/D,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACjDA,IAAM,SAAS;AAKR,SAAS,qBAAqB,QAAgB,UAA0B;AAC7E,QAAM,aAAa,SAAS,QAAQ,QAAQ,EAAE;AAC9C,QAAM,WAAW,WAAW,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,IAAI,kBAAkB;AAC7E,SAAO,mBAAmB,mBAAmB,MAAM,CAAC,SAAS,SAAS,KAAK,GAAG,CAAC;AACjF;AAGO,IAAM,mBAAmB;AAKzB,SAAS,iBAAiB,KAAuC;AACtE,QAAM,IAAI,IAAI,KAAK;AACnB,MAAI,CAAC,EAAE,WAAW,MAAM,EAAG,QAAO;AAClC,QAAM,OAAO,EAAE,MAAM,OAAO,MAAM;AAClC,QAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,MAAI,SAAS,EAAG,QAAO;AACvB,MAAI;AACJ,MAAI;AACF,aAAS,mBAAmB,KAAK,MAAM,GAAG,KAAK,CAAC;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,YAAY,KAAK,MAAM,QAAQ,CAAC;AACtC,MAAI,CAAC,UAAU,WAAW,OAAO,EAAG,QAAO;AAC3C,QAAM,WAAW,UAAU,MAAM,QAAQ,MAAM;AAC/C,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO,EAAE,QAAQ,YAAY,MAAM,QAAQ,QAAQ,UAAU,GAAG;AAAA,EAClE;AACA,MAAI;AACF,UAAM,WAAW,SAAS,MAAM,GAAG,EAAE,IAAI,kBAAkB,EAAE,KAAK,GAAG;AACrE,WAAO,EAAE,QAAQ,YAAY,MAAM,QAAQ,QAAQ,SAAS;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC7CO,SAAS,mCAAmC,SAAgE;AACjH,SAAO,OAAO,EAAE,QAAQ,WAAW,MAAM;AACvC,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO,EAAE,aAAa,MAAM,QAAQ,sBAAsB,KAAK,CAAC,EAAE;AAAA,MACpE,KAAK,yBAAyB;AAC5B,cAAM,gBAAgB,gBAAgB,UAAU;AAChD,eAAO,QAAQ,QAAQ,YAAY;AAAA,UACjC,cAAc,gBAAgB,eAAe,cAAc;AAAA,UAC3D,gBAAgB,wBAAwB,eAAe,gBAAgB;AAAA,QACzE,CAAC;AAAA,MACH;AAAA,MACA,KAAK,uBAAuB;AAC1B,cAAM,gBAAgB,gBAAgB,UAAU;AAChD,cAAM,QAAQ,QAAQ,YAAY;AAAA,UAChC,gBAAgB,gBAAgB,eAAe,gBAAgB;AAAA,UAC/D,SAAS,gBAAgB,eAAe,SAAS;AAAA,UACjD,cAAc,wBAAwB,eAAe,cAAc;AAAA,UACnE,aAAa,qBAAqB,eAAe,aAAa;AAAA,UAC9D,eAAe,0BAA0B,eAAe,eAAe;AAAA,QACzE,CAAC;AACD,eAAO,EAAE,IAAI,KAAK;AAAA,MACpB;AAAA,MACA,KAAK,0BAA0B;AAC7B,cAAM,gBAAgB,gBAAgB,UAAU;AAChD,cAAM,iBAAiB,gBAAgB,eAAe,gBAAgB;AACtE,cAAM,eAAe,gBAAgB,eAAe,cAAc;AAClE,cAAM,gCAAgC;AAAA,UACpC,SAAS,QAAQ;AAAA,UACjB;AAAA,UACA;AAAA,UACA,cAAc,0BAA0B,eAAe,cAAc;AAAA,UACrE,aAAa,QAAQ;AAAA,QACvB,CAAC;AACD,cAAM,QAAQ,QAAQ,YAAY;AAAA,UAChC;AAAA,UACA;AAAA,UACA,SAAS,gBAAgB,eAAe,SAAS;AAAA,UACjD,aAAa,qBAAqB,eAAe,aAAa;AAAA,UAC9D,eAAe,0BAA0B,eAAe,eAAe;AAAA,QACzE,CAAC;AACD,eAAO,EAAE,IAAI,MAAM,eAAe;AAAA,MACpC;AAAA,MACA,KAAK,yBAAyB;AAC5B,cAAM,gBAAgB,gBAAgB,UAAU;AAChD,cAAM,QAAQ,QAAQ,YAAY,gBAAgB,eAAe,gBAAgB,CAAC;AAClF,eAAO,EAAE,IAAI,KAAK;AAAA,MACpB;AAAA,MACA,KAAK,iCAAiC;AACpC,cAAM,gBAAgB,gBAAgB,UAAU;AAChD,cAAM,iBAAiB,gBAAgB,eAAe,gBAAgB;AACtE,cAAM,QAAQ,IAAI,IAAI,qBAAqB,eAAe,iBAAiB,CAAC;AAC5E,cAAM,WAAW,MAAM,QAAQ,QAAQ,YAAY,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC3F,eAAO,EAAE,UAAU,SAAS,OAAO,CAAC,YAAY,CAAC,MAAM,IAAI,QAAQ,SAAS,CAAC,EAAE;AAAA,MACjF;AAAA,MACA;AACE,cAAM,IAAI,MAAM,wBAAwB,MAAM,EAAE;AAAA,IACpD;AAAA,EACF;AACF;AAEA,eAAe,gCAAgC,OAM7B;AAChB,MAAI,MAAM,cAAc;AACtB,UAAM,MAAM,QAAQ,2BAA2B,MAAM,YAAY;AACjE;AAAA,EACF;AACA,QAAM,WAAW,MAAM,MAAM,QAAQ,oBAAoB,MAAM,cAAc,EAAE,MAAM,MAAM,IAAI;AAC/F,MAAI,SAAU;AACd,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,MAAM,QAAQ,2BAA2B;AAAA,IAC7C,gBAAgB,MAAM;AAAA,IACtB,OAAO,MAAM;AAAA,IACb,oBAAoB;AAAA,IACpB,sBAAsB;AAAA,IACtB,cAAc;AAAA,IACd,cAAc,MAAM,eAAe;AAAA,IACnC,aAAa;AAAA,IACb,cAAc,MAAM;AAAA,IACpB,iBAAiB;AAAA,EACnB,CAAC;AACH;AAEA,SAAS,gBAAgB,OAAyC;AAChE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC7G,SAAO;AACT;AAEA,SAAS,gBAAgB,YAAqC,KAAqB;AACjF,QAAM,QAAQ,WAAW,GAAG;AAC5B,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,oBAAoB;AACzF,SAAO;AACT;AAEA,SAAS,wBAAwB,YAAqC,KAAiC;AACrG,QAAM,QAAQ,WAAW,GAAG;AAC5B,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,MAAM,oBAAoB;AACnE,SAAO;AACT;AAEA,SAAS,qBAAqB,YAAqC,KAAuB;AACxF,QAAM,QAAQ,WAAW,GAAG;AAC5B,MAAI,UAAU,OAAW,QAAO,CAAC;AACjC,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC/D,SAAO,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ;AACxE;AAEA,SAAS,qBAAqB,YAAqC,KAAsC;AACvG,QAAM,QAAQ,WAAW,GAAG;AAC5B,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,CAAC,cAAc,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC/D,SAAO;AACT;AAEA,SAAS,0BAA0B,YAAqC,KAAwC;AAC9G,QAAM,QAAQ,WAAW,GAAG;AAC5B,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC/D,SAAO,MAAM,OAAO,aAAa;AACnC;AAEA,SAAS,0BAA0B,YAAqC,KAA2C;AACjH,QAAM,QAAQ,WAAW,GAAG;AAC5B,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,CAAC,uBAAuB,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AACxE,SAAO;AACT;AAEA,SAAS,cAAc,OAAsC;AAC3D,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,SACE,OAAO,OAAO,cAAc,YAC5B,OAAO,OAAO,mBAAmB,YACjC,OAAO,OAAO,iBAAiB,YAC/B,OAAO,OAAO,cAAc,YAC5B,OAAO,OAAO,iBAAiB,YAC/B,OAAO,OAAO,SAAS,YACvB,OAAO,OAAO,YAAY;AAE9B;AAEA,SAAS,uBAAuB,OAA2C;AACzE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,SACE,OAAO,OAAO,mBAAmB,YACjC,OAAO,OAAO,UAAU,YACxB,OAAO,OAAO,yBAAyB,YACvC,OAAO,OAAO,iBAAiB,YAC/B,OAAO,OAAO,iBAAiB,YAC/B,OAAO,OAAO,gBAAgB,YAC9B,OAAO,OAAO,iBAAiB,YAC/B,OAAO,OAAO,oBAAoB;AAEtC;;;AC7KO,IAAM,+BAA+B;AAwC5C,IAAM,qBAAqB;AAC3B,IAAM,2BAA2B;AACjC,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB,OAAO;AACpC,IAAM,iBAAiB,KAAK;AAC5B,IAAM,gBAAgB,oBAAI,IAA+B;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAASC,UAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAgB,OAAe,eAAgD;AACvG,MACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,SAAS,iBACf,CAAC,mBAAmB,KAAK,KAAK,GAC9B;AACA,UAAM,IAAI,MAAM,uBAAuB,KAAK,EAAE;AAAA,EAChD;AACF;AAEA,SAAS,kBAAkB,OAAgB,OAAqB;AAC9D,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,UAAU,KAAK;AAAA,EAChC,QAAQ;AACN,UAAM,IAAI,MAAM,uBAAuB,KAAK,EAAE;AAAA,EAChD;AACA,MAAI,YAAY,UAAa,IAAI,YAAY,EAAE,OAAO,OAAO,EAAE,aAAa,sBAAsB;AAChG,UAAM,IAAI,MAAM,eAAe,KAAK,YAAY,oBAAoB,QAAQ;AAAA,EAC9E;AACF;AAEA,SAAS,iBAAiB,OAAuD;AAC/E,MAAI,CAACA,UAAS,KAAK,EAAG,OAAM,IAAI,MAAM,gCAAgC;AACtE,MAAI,MAAM,YAAY,8BAA8B;AAClD,UAAM,IAAI,MAAM,6CAA6C,OAAO,MAAM,OAAO,CAAC,EAAE;AAAA,EACtF;AACA,MAAI,MAAM,UAAU,aAAa,MAAM,UAAU,WAAW,MAAM,UAAU,QAAQ;AAClF,UAAM,IAAI,MAAM,2BAA2B;AAAA,EAC7C;AACA,mBAAiB,MAAM,cAAc,gBAAgB,wBAAwB;AAC7E,mBAAiB,MAAM,WAAW,aAAa,oBAAoB;AACnE,MACE,MAAM,cAAc,WACnB,OAAO,MAAM,cAAc,YAC1B,CAAC,OAAO,cAAc,MAAM,SAAS,KACrC,MAAM,YAAY,KAClB,MAAM,YAAY,iBACpB;AACA,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,MAAI,EAAE,gBAAgB,OAAQ,OAAM,IAAI,MAAM,gCAAgC;AAC9E,oBAAkB,MAAM,YAAY,YAAY;AAClD;AAEA,SAAS,0BAA0B,OAGjC;AACA,MAAI,CAACA,UAAS,KAAK,EAAG,OAAM,IAAI,MAAM,0CAA0C;AAChF,MAAI,MAAM,YAAY,8BAA8B;AAClD,UAAM,IAAI,MAAM,6CAA6C,OAAO,MAAM,OAAO,CAAC,EAAE;AAAA,EACtF;AACA,mBAAiB,MAAM,cAAc,gBAAgB,wBAAwB;AAC/E;AAEA,SAAS,aAAa,OAAgB,cAAyD;AAC7F,MACE,CAACA,UAAS,KAAK,KACf,MAAM,YAAY,gCAClB,MAAM,iBAAiB,gBACvB,CAAC,cAAc,IAAI,MAAM,KAAkC,KAC1D,MAAM,UAAU,WACd,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,SAC1D,MAAM,gBAAgB,WACpB,OAAO,MAAM,gBAAgB,YAAY,CAAC,OAAO,SAAS,KAAK,MAAM,MAAM,WAAW,CAAC,IAC1F;AACA,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AACA,MAAI,YAAY,MAAO,mBAAkB,MAAM,QAAQ,QAAQ;AACjE;AAOO,SAAS,0BAA0B,SAAqC;AAC7E,iBAAe,iBACb,QACA,YAC2B;AAC3B,UAAM,sBAA4C;AAAA,MAChD,SAAS;AAAA,MACT,GAAG;AAAA,IACL;AACA,qBAAiB,mBAAmB;AAEpC,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B;AAAA,MACA,GAAG,4BAA4B;AAAA,MAC/B;AAAA,IACF;AACA,iBAAa,QAAQ,WAAW,YAAY;AAC5C,WAAO;AAAA,EACT;AAEA,iBAAe,oBACb,QACA,cAC2B;AAC3B,qBAAiB,cAAc,gBAAgB,wBAAwB;AACvE,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B;AAAA,MACA,GAAG,4BAA4B;AAAA,MAC/B,EAAE,SAAS,8BAA8B,aAAa;AAAA,IACxD;AACA,iBAAa,QAAQ,YAAY;AACjC,WAAO;AAAA,EACT;AAEA,iBAAe,iBACb,QACA,cAC2B;AAC3B,qBAAiB,cAAc,gBAAgB,wBAAwB;AACvE,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B;AAAA,MACA,GAAG,4BAA4B;AAAA,MAC/B,EAAE,SAAS,8BAA8B,aAAa;AAAA,IACxD;AACA,iBAAa,QAAQ,YAAY;AACjC,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAMO,SAAS,2BAA2B,UAatB;AACnB,SAAO,OAAO,UAAU;AACtB,UAAM,EAAE,QAAQ,WAAW,IAAI;AAC/B,UAAM,UAAoC,EAAE,cAAc,MAAM,aAAa;AAE7E,QAAI,WAAW,GAAG,4BAA4B,WAAW;AACvD,uBAAiB,UAAU;AAC3B,UAAI,CAAC,SAAS,UAAU;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAChD;AACA,YAAM,SAAS,MAAM,SAAS,SAAS,YAAY,OAAO;AAC1D,mBAAa,QAAQ,WAAW,YAAY;AAC5C,aAAO;AAAA,IACT;AAEA,QAAI,WAAW,GAAG,4BAA4B,WAAW;AACvD,gCAA0B,UAAU;AACpC,UAAI,CAAC,SAAS,UAAU;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAChD;AACA,YAAM,SAAS,MAAM,SAAS,SAAS,WAAW,cAAc,OAAO;AACvE,mBAAa,QAAQ,WAAW,YAAY;AAC5C,aAAO;AAAA,IACT;AAEA,QAAI,WAAW,GAAG,4BAA4B,WAAW;AACvD,gCAA0B,UAAU;AACpC,UAAI,CAAC,SAAS,UAAU;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAChD;AACA,YAAM,SAAS,MAAM,SAAS,SAAS,WAAW,cAAc,OAAO;AACvE,mBAAa,QAAQ,WAAW,YAAY;AAC5C,aAAO;AAAA,IACT;AAEA,UAAM,IAAI,MAAM,0CAA0C,MAAM;AAAA,EAClE;AACF;;;ACrPO,IAAM,wCAAwC;;;ACO9C,IAAM,mBAAN,MAAuB;AAAA,EAG5B,YACmB,SAIjB;AAJiB;AAAA,EAIhB;AAAA,EAPc,WAAW,oBAAI,IAA8B;AAAA,EAStD,IAAI,WAAmB,UAA0B;AACvD,WAAO,GAAG,SAAS,KAAK,QAAQ;AAAA,EAClC;AAAA,EAEA,MAAM,WAAW,WAAmB,UAAyD;AAC3F,UAAM,IAAI,KAAK,IAAI,WAAW,QAAQ;AACtC,QAAI,KAAK,SAAS,cAAc;AAC9B,YAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,WAAW,QAAQ;AAC/D,UAAI,KAAK;AACP,aAAK,SAAS,IAAI,GAAG,GAAG;AACxB,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO,KAAK,SAAS,IAAI,CAAC;AAAA,EAC5B;AAAA,EAEA,MAAM,WAAW,QAAyC;AACxD,SAAK,SAAS,IAAI,KAAK,IAAI,OAAO,WAAW,OAAO,QAAQ,GAAG,MAAM;AACrE,QAAI,KAAK,SAAS,cAAc;AAC9B,YAAM,KAAK,QAAQ,aAAa,MAAM;AAAA,IACxC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBACJ,SACA,QACA,SACqC;AACrC,UAAM,WAAW,MAAM,KAAK,WAAW,QAAQ,WAAW,QAAQ,QAAQ;AAC1E,QAAI,UAAU;AACZ,YAAM,OAAO,YAAY;AAAA,QACvB,gBAAgB,SAAS;AAAA,QACzB,SAAS,QAAQ;AAAA,MACnB,CAAC;AACD,aAAO,EAAE,gBAAgB,SAAS,qBAAqB;AAAA,IACzD;AACA,UAAM,eAAe,QAAQ;AAC7B,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,YAAY;AAAA,MAClD;AAAA,MACA,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,UAAM,KAAK,WAAW;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB,sBAAsB;AAAA,MACtB,WAAW,KAAK,IAAI;AAAA,MACpB,qBAAqB;AAAA,IACvB,CAAC;AACD,WAAO,EAAE,eAAe;AAAA,EAC1B;AAAA,EAEA,MAAM,mBACJ,WACA,UACA,gBACe;AACf,UAAM,UAAU,MAAM,KAAK,WAAW,WAAW,QAAQ;AACzD,QAAI,SAAS;AACX,YAAM,KAAK,WAAW,EAAE,GAAG,SAAS,sBAAsB,eAAe,CAAC;AAAA,IAC5E,OAAO;AACL,YAAM,KAAK,WAAW;AAAA,QACpB;AAAA,QACA;AAAA,QACA,sBAAsB;AAAA,QACtB,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,SAAS,YAAY,UAAwB,UAA0C;AAC5F,SAAO,SAAS,KAAK,CAAC,MAAM,EAAE,aAAa,QAAQ;AACrD;;;AC3FO,SAAS,0BAA0B,UAA0B;AAClE,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;;;ACEA,eAAsB,wBAAwB,SAG3C;AACD,QAAM,IAAI,QAAQ,QAAQ,KAAK;AAC/B,MAAI,CAAC,EAAE,WAAW,GAAG,KAAK,EAAE,WAAW,IAAI,KAAK,EAAE,SAAS,GAAG;AAC5D,WAAO,EAAE,SAAS,OAAO,UAAU,CAAC,EAAE;AAAA,EACxC;AACA,QAAM,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,EAAE,OAAO,OAAO;AACpD,QAAM,OAAO,MAAM,CAAC,KAAK,IAAI,YAAY;AACzC,QAAM,OAAO,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,KAAK;AAE3C,QAAM,UAAU,MAAM,QAAQ,QAAQ,WAAW,QAAQ,WAAW,QAAQ,QAAQ;AACpF,QAAM,KAAK,CAAC,WAAqB,EAAE,SAAS,MAAe,UAAU,MAAM;AAE3E,MAAI,QAAQ,QAAQ;AAClB,UAAM,OAAO,MAAM,QAAQ,QAAQ,kBAAkB,EAAE,OAAO,GAAG,CAAC;AAClE,QAAI,KAAK,WAAW,EAAG,QAAO,GAAG,CAAC,sCAAQ,CAAC;AAC3C,UAAM,OAAO,KAAK;AAAA,MAChB,CAAC,GAAG,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,WAAM,EAAE,eAAe,MAAM,GAAG,EAAE,CAAC;AAAA,IAC/F;AACA,WAAO,GAAG,CAAC,wCAAU,GAAG,KAAK,IAAI,CAAC,MAAM,UAAK,CAAC,EAAE,CAAC,CAAC;AAAA,EACpD;AAEA,MAAI,QAAQ,UAAU;AACpB,QAAI,CAAC,QAAS,QAAO,GAAG,CAAC,sFAAqB,CAAC;AAC/C,UAAM,OAAO,MAAM,QAAQ,QAAQ,kBAAkB,EAAE,OAAO,GAAG,CAAC;AAClE,UAAM,WAAW,KAAK,KAAK;AAC3B,QAAI,CAAC,SAAU,QAAO,GAAG,CAAC,+DAAiC,CAAC;AAC5D,UAAM,IAAI,SAAS,UAAU,EAAE;AAC/B,QAAI;AACJ,QAAI,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,QAAQ;AAClD,iBAAW,KAAK,IAAI,CAAC,GAAG;AAAA,IAC1B,OAAO;AACL,iBAAW,KAAK;AAAA,QACd,CAAC,MAAM,EAAE,mBAAmB,YAAY,EAAE,eAAe,SAAS,QAAQ;AAAA,MAC5E,GAAG;AAAA,IACL;AACA,QAAI,CAAC,SAAU,QAAO,GAAG,CAAC,uCAAS,QAAQ,EAAE,CAAC;AAC9C,UAAM,QAAQ,QAAQ,mBAAmB,QAAQ,WAAW,QAAQ,UAAU,QAAQ;AACtF,WAAO,GAAG,CAAC,iCAAQ,QAAQ,EAAE,CAAC;AAAA,EAChC;AAEA,MAAI,QAAQ,SAAS,QAAQ,SAAS;AACpC,UAAM,eAAe,QAAQ,QAAQ;AACrC,UAAM,EAAE,eAAe,IAAI,MAAM,QAAQ,OAAO,YAAY,EAAE,aAAa,CAAC;AAC5E,UAAM,QAAQ,QAAQ,WAAW;AAAA,MAC/B,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB,sBAAsB;AAAA,MACtB,WAAW,KAAK,IAAI;AAAA,MACpB,qBAAqB;AAAA,IACvB,CAAC;AACD,WAAO,GAAG,CAAC;AAAA,YAAmB,cAAc;AAAA,uDAAe,CAAC;AAAA,EAC9D;AAEA,MAAI,QAAQ,UAAU;AACpB,QAAI,CAAC,QAAS,QAAO,GAAG,CAAC,0CAAY,CAAC;AACtC,UAAM,OAAO,MAAM,QAAQ,QAAQ,oBAAoB,QAAQ,oBAAoB;AACnF,WAAO,GAAG;AAAA,MACR,qBAAM,QAAQ,oBAAoB;AAAA,MAClC,qBAAM,MAAM,gBAAgB,GAAG;AAAA,MAC/B,2BAAO,MAAM,gBAAgB,GAAG;AAAA,IAClC,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,UAAU;AACpB,QAAI,CAAC,QAAS,QAAO,GAAG,CAAC,4CAAS,CAAC;AACnC,UAAM,QAAQ,QAAQ,YAAY,QAAQ,oBAAoB;AAC9D,WAAO,GAAG,CAAC,8DAAY,CAAC;AAAA,EAC1B;AAEA,SAAO,EAAE,SAAS,OAAO,UAAU,CAAC,EAAE;AACxC;;;ACtFA,SAAS,iBAAiB,OAAwB;AAChD,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AACxF,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,MAAI;AACF,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,4BAA4B,SAMhC;AAChB,QAAM,MAAM,0BAA0B,QAAQ,QAAQ;AACtD,MAAI,MAAM;AAEV,QAAM,YAAY,OAAO,UAAkC;AACzD,QAAI,IAAI,WAAW,EAAG;AACtB,QAAI,OAAO;AACT,aAAO,IAAI,SAAS,GAAG;AACrB,cAAM,OAAO,KAAK,IAAI,KAAK,IAAI,MAAM;AACrC,cAAM,QAAQ,IAAI,MAAM,GAAG,IAAI;AAC/B,cAAM,IAAI,MAAM,IAAI;AACpB,YAAI,MAAM,KAAK,EAAE,SAAS,EAAG,OAAM,QAAQ,MAAM,KAAK;AAAA,MACxD;AACA;AAAA,IACF;AACA,WAAO,IAAI,UAAU,KAAK;AACxB,YAAM,QAAQ,IAAI,MAAM,GAAG,GAAG;AAC9B,YAAM,IAAI,MAAM,GAAG;AACnB,YAAM,QAAQ,MAAM,KAAK;AAAA,IAC3B;AAAA,EACF;AAEA,QAAM,IAAI,QAAc,CAAC,SAASC,YAAW;AAC3C,UAAM,MAAM,QAAQ,QAAQ,mBAAmB,QAAQ,gBAAgB,CAAC,MAAe;AACrF,YAAM,IAAI;AACV,UAAI,EAAE,SAAS,cAAc;AAC3B,aAAK,UAAU,IAAI,EAChB,KAAK,MAAM;AACV,cAAI;AACJ,kBAAQ;AAAA,QACV,CAAC,EACA,MAAMA,OAAM;AACf;AAAA,MACF;AACA,UAAI,EAAE,SAAS,eAAe;AAC5B,YAAI;AACJ,QAAAA,QAAO,IAAI,MAAO,EAAyB,SAAS,aAAa,CAAC;AAClE;AAAA,MACF;AACA,UAAI,EAAE,SAAS,gBAAgB,EAAE,MAAM,SAAS,WAAW;AACzD,cAAM,WAAW,EAAE,KAAK;AACxB,YAAI,QAAQ;AACZ,YAAI,OAAO,aAAa,SAAU,SAAQ;AAAA,iBACjC,YAAY,QAAQ,OAAO,aAAa,YAAY,aAAa,UAAU;AAClF,gBAAM,UAAW,SAAmC;AACpD,kBAAQ,iBAAiB,OAAO;AAAA,QAClC,MAAO,SAAQ,iBAAiB,QAAQ;AACxC,eAAO;AACP,aAAK,UAAU,KAAK;AAAA,MACtB;AACA,UAAI,EAAE,SAAS,gBAAgB,EAAE,MAAM,SAAS,QAAQ;AACtD,cAAM,KAAK,EAAE,KAAK;AAMlB,cAAM,KAAK,GAAG;AACd,YAAI,CAAC,GAAI;AACT,YAAI,OAAO,gBAAgB;AACzB,gBAAM,IAAI,GAAG;AAIb,gBAAM,IAAI,OAAO,GAAG,aAAa,WAAW,EAAE,WAAW;AACzD,gBAAM,YAAY,GAAG,SACjB,IAAI,CAACC,OAAMA,GAAE,KAAK,EACnB,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AACnD,gBAAM,UAAU,QAAQ,SAAS,kBAAkB,GAAG,SAAS;AAC/D,kBAAQ,OAAO,CAAC,IAAI,SAAS,IAAI,IAAI,OAAO,MAAM,UAAU;AAC5D,eAAK,UAAU,IAAI;AACnB;AAAA,QACF;AACA,YAAI,GAAG,SAAS;AACd,kBAAQ,OAAO,CAAC,IAAI,SAAS,IAAI,IAAI,OAAO,MAC1C,QAAQ,SAAS,YAAY,iBAAiB,GAAG,MAAM,KAAK,YAAY,IACxE;AACF,eAAK,UAAU,KAAK;AACpB;AAAA,QACF;AACA,cAAM,WAAW,QAAQ,SAAS,sBAAsB,IAAI,GAAG,cAAc,CAAC,CAAC;AAC/E,cAAM,aAAa,QAAQ,SAAS,wBAAwB,IAAI,GAAG,UAAU,IAAI;AACjF,gBAAQ,OAAO,CAAC,IAAI,SAAS,IAAI,IAAI,OAAO,MAC1C,YACC,aAAa;AAAA,EAAK,UAAU,KAAK,MAClC;AACF,aAAK,UAAU,KAAK;AAAA,MACtB;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;;;ACrHO,IAAM,sBAAN,MAAwD;AAAA,EAC7D,gBAAgB,SAAyB;AACvC,WAAO,QAAQ,KAAK;AAAA,EACtB;AAAA,EAEA,sBAAsB,UAAkB,YAA6B;AACnE,UAAM,KAAK,MAAM;AACf,UAAI;AACF,cAAM,QAAQ,KAAK,UAAU,UAAU;AACvC,YAAI,CAAC,SAAS,UAAU,KAAM,QAAO;AACrC,eAAO,MAAM,SAAS,MAAM,GAAG,MAAM,MAAM,GAAG,GAAG,CAAC,WAAM;AAAA,MAC1D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF,GAAG;AACH,WAAO,IAAI,aAAM,QAAQ,KAAK,CAAC,KAAK,aAAM,QAAQ;AAAA,EACpD;AAAA,EAEA,wBAAwB,UAAkB,QAAgC;AAExE,QAAI,UAAU,KAAM,QAAO,UAAK,QAAQ;AACxC,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,OAAO,KAAK;AACtB,UAAI,CAAC,EAAG,QAAO,UAAK,QAAQ;AAC5B,aAAO,UAAK,QAAQ,KAAK,EAAE,SAAS,MAAM,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,WAAM,CAAC;AAAA,IACrE;AACA,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,OAAO,OAAO,KAAK,MAAiC;AAC1D,UAAI,KAAK,WAAW,EAAG,QAAO,UAAK,QAAQ;AAC3C,aAAO,UAAK,QAAQ,MAAM,KAAK,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,aAAQ,EAAE;AAAA,IACtF;AACA,QAAI,OAAO,WAAW,SAAU,QAAO,UAAK,QAAQ,KAAK,OAAO,SAAS,CAAC;AAC1E,QAAI,OAAO,WAAW,WAAY,QAAO,UAAK,QAAQ;AACtD,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,aAAa,OAAO,WAAW,UAAU;AAC3F,aAAO,UAAK,QAAQ,KAAK,OAAO,MAAM,CAAC;AAAA,IACzC;AACA,WAAO,UAAK,QAAQ;AAAA,EACtB;AAAA,EAEA,mBAAmB,UAAkB,YAA6B;AAChE,WAAO,gEAAc,QAAQ;AAAA;AAAA;AAAA,EAAsB,KAAK,UAAU,YAAY,MAAM,CAAC,CAAC;AAAA;AAAA;AAAA,EACxF;AAAA,EAEA,kBAAkB,UAAkB,SAA4B;AAC9D,UAAM,QAAQ,SAAS,SACnB,CAAC,UAAK,QAAQ,IAAI,GAAG,QAAQ,IAAI,CAAC,GAAG,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IACpE,CAAC,UAAK,QAAQ,EAAE;AACpB,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB;AAAA,EAEA,eAAe,UAAiC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,YAAYC,QAAuB;AACjC,WAAO,kCAASA,MAAK;AAAA,EACvB;AAAA,EAEA,eAAe,OAAoE;AACjF,WAAO,CAAC,kBAAW,GAAG,MAAM,IAAI,CAAC,MAAM,GAAG,EAAE,OAAO,QAAQ,KAAK,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,IAAI;AAAA,EAC1F;AACF;;;ACzDO,IAAM,oBAAoB;AAAA,EAC/B;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AACF;AAWA,eAAsB,qBAAqB,IAAoB,gBAAuC;AACpG,QAAM,GAAG,QAAQ,mBAAmB,GAAG,WAAW,GAAG,UAAU,cAAc;AAC/E;;;ACrCA,SAAS,SAAS;AASX,IAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,aAAa,EAAE,OAAO,CAAC,CAAC;AAE9B,IAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC;AAClC,CAAC;AAED,IAAM,YAAY,EAAE,OAAO;AAAA,EACzB,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC3C,CAAC;AAED,IAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,SAAS;AAC7D,CAAC;AAOD,SAAS,MAAM,SAAoC;AACjD,SAAO,EAAE,OAAO,QAAQ;AAC1B;AAEA,eAAe,gBACb,SACA,gBACwF;AACxF,QAAM,OAAO,MAAM,QAAQ,QAAQ,oBAAoB,cAAc;AACrE,QAAM,KAAK,MAAM;AACjB,MAAI,CAAC,IAAI;AACP,WAAO,EAAE,OAAO,8BAA8B;AAAA,EAChD;AACA,SAAO,EAAE,WAAW,GAAG,WAAW,UAAU,GAAG,UAAU,UAAU,GAAG,SAAS;AACjF;AAEA,eAAsB,wBACpB,YACA,SACA,MACiD;AACjD,QAAM,SAAS,WAAW,UAAU,UAAU;AAC9C,MAAI,CAAC,OAAO,QAAS,QAAO,MAAM,cAAc;AAChD,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,IAAK,QAAO,MAAM,wBAAwB;AAC/C,QAAM,SAAS,MAAM,gBAAgB,SAAS,GAAG;AACjD,MAAI,WAAW,OAAQ,QAAO;AAC9B,QAAM,MAAM,MAAM,QAAQ,QAAQ,kBAAkB,CAAC,CAAC;AACtD,MAAI,IAAI,WAAW,EAAG,QAAO,EAAE,QAAQ,uCAAS;AAChD,QAAM,SAAS,CAAC,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,uBAAuB,EAAE,oBAAoB;AACtF,QAAM,QAAQ,OAAO,IAAI,CAAC,GAAG,UAAU;AACrC,UAAM,QAAQ,EAAE,SAAS,EAAE;AAC3B,UAAM,IAAI,IAAI,KAAK,EAAE,oBAAoB,EAAE,YAAY;AACvD,WAAO,GAAG,QAAQ,CAAC,KAAK,KAAK;AAAA,SAAY,EAAE,cAAc;AAAA,UAAa,EAAE,YAAY,MAAM,CAAC;AAAA,EAC7F,CAAC;AACD,SAAO,EAAE,QAAQ;AAAA,EAAY,MAAM,KAAK,IAAI,CAAC,GAAG;AAClD;AAEA,eAAsB,yBACpB,YACA,SACA,KACiD;AACjD,QAAM,SAAS,aAAa,UAAU,UAAU;AAChD,MAAI,CAAC,OAAO,QAAS,QAAO,MAAM,cAAc;AAChD,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,IAAK,QAAO,MAAM,wBAAwB;AAC/C,QAAM,SAAS,MAAM,gBAAgB,SAAS,GAAG;AACjD,MAAI,WAAW,OAAQ,QAAO;AAC9B,QAAM,IAAI,iBAAiB;AAAA,IACzB,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO,KAAK;AAAA,EACd;AACA,SAAO,EAAE,QAAQ,6CAAU,OAAO,KAAK,cAAc,GAAG;AAC1D;AAEA,eAAsB,sBACpB,YACA,SACA,KACiD;AACjD,QAAM,SAAS,UAAU,UAAU,UAAU;AAC7C,MAAI,CAAC,OAAO,QAAS,QAAO,MAAM,cAAc;AAChD,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,IAAK,QAAO,MAAM,wBAAwB;AAC/C,QAAM,SAAS,MAAM,gBAAgB,SAAS,GAAG;AACjD,MAAI,WAAW,OAAQ,QAAO;AAC9B,QAAM,UAAU,MAAM,IAAI,iBAAiB,WAAW,OAAO,WAAW,OAAO,QAAQ;AACvF,QAAM,eAAe,OAAO,KAAK,cAAc,KAAK,KAClD,SAAS,uBACT;AACF,QAAM,KAAK,IAAI,mBAAmB;AAClC,QAAM,EAAE,eAAe,IAAI,MAAM,GAAG,YAAY,EAAE,cAAc,gBAAgB,GAAG,CAAC;AACpF,QAAM,IAAI,iBAAiB,WAAW;AAAA,IACpC,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,sBAAsB;AAAA,IACtB,WAAW,KAAK,IAAI;AAAA,IACpB,qBAAqB;AAAA,EACvB,CAAC;AACD,QAAM,OAAO,MAAM,QAAQ,QAAQ,oBAAoB,cAAc;AACrE,MAAI,MAAM;AACR,UAAM,QAAQ,QAAQ,2BAA2B;AAAA,MAC/C,GAAG;AAAA,MACH,eAAe;AAAA,QACb,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB,UAAU,OAAO;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,QAAQ,+DAAa,cAAc;AAAA,cAAiB,YAAY;AAAA;AAAA,EAClE;AACF;AAEA,eAAsB,uBACpB,YACA,SACA,MACiD;AACjD,QAAM,SAAS,gBAAgB,UAAU,UAAU;AACnD,MAAI,CAAC,OAAO,QAAS,QAAO,MAAM,cAAc;AAChD,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,IAAK,QAAO,MAAM,wBAAwB;AAC/C,QAAM,SAAS,MAAM,gBAAgB,SAAS,GAAG;AACjD,MAAI,WAAW,OAAQ,QAAO;AAC9B,OAAK;AACL,QAAM,MAAM,OAAO,KAAK,eAAe;AACvC,QAAM,OAAO,MAAM,QAAQ,QAAQ,YAAY,KAAK,EAAE,MAAM,eAAe,CAAC;AAC5E,QAAM,OAAO,KAAK,MAAM,CAAC,GAAG;AAC5B,MAAI,KAAK,WAAW,EAAG,QAAO,EAAE,QAAQ,+DAAa;AACrD,QAAM,QAAQ,KAAK;AAAA,IACjB,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,EAAE,QAAQ,MAAM,GAAG,GAAI,CAAC,GAAG,EAAE,QAAQ,SAAS,MAAO,WAAM,EAAE;AAAA,EACrF;AACA,SAAO;AAAA,IACL,QAAQ,gBAAM,KAAK,MAAM;AAAA,EAAsB,MAAM,KAAK,SAAS,CAAC;AAAA,EACtE;AACF;AAKO,SAAS,8BACd,UACA,SACA,KACM;AACN,QAAM,QAAQ,CAAC,cAA8C,CAAC,eAAwC,UAAU,YAAY,SAAS,GAAG;AAExI,WAAS;AAAA,IACP;AAAA,IACA,MAAM,uBAAuB;AAAA,IAC7B;AAAA,IACA;AAAA,EACF;AACA,WAAS;AAAA,IACP;AAAA,IACA,MAAM,wBAAwB;AAAA,IAC9B;AAAA,IACA;AAAA,EACF;AACA,WAAS;AAAA,IACP;AAAA,IACA,MAAM,qBAAqB;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AACA,WAAS;AAAA,IACP;AAAA,IACA,MAAM,sBAAsB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AAEA,8BAA4B,wBAAwB,YAAY;AAAA,IAC9D,aAAa;AAAA,IACb,aAAa;AAAA,EACf,CAAC;AACD,8BAA4B,yBAAyB,cAAc;AAAA,IACjE,aAAa;AAAA,IACb,aAAa;AAAA,EACf,CAAC;AACD,8BAA4B,sBAAsB,WAAW;AAAA,IAC3D,aAAa;AAAA,IACb,aAAa;AAAA,EACf,CAAC;AACD,8BAA4B,uBAAuB,iBAAiB;AAAA,IAClE,aAAa;AAAA,IACb,aAAa;AAAA,EACf,CAAC;AACH;;;ACrLO,SAAS,qBAAqB,UAAyB,SAAmC;AAC/F,QAAM,oBAAoB,SAAS,mBAAmB;AACtD,MAAI,mBAAmB;AACrB,eAAW,CAAC,IAAI,IAAI,KAAK,gBAAgB;AACvC,wBAAkB,IAAI,IAAI,IAAI;AAAA,IAChC;AACA,iCAA6B,iBAAiB;AAAA,EAChD,OAAO;AACL,iCAA6B;AAAA,EAC/B;AAEA,6BAA2B;AAC3B,kBAAgB,EAAE,sBAAsB,KAAK,EAAE,GAAG,SAAS,cAAc,SAAS,GAAG;AAAA,IACnF,GAAG;AAAA,EACL,CAAC;AACH;;;ACnCA,IAAM,0BAA0B;AAChC,IAAM,2BAA2B;AAejC,eAAe,mBAAmB,OAA+C;AAC/E,QAAM,YAAY,MAAM,aAAa;AAErC,SAAO,IAAI,QAAwB,CAAC,YAAY;AAC9C,QAAI,UAAU;AAEd,UAAM,QAAQ,YAAY,IACtB,WAAW,MAAM;AACjB,UAAI,CAAC,SAAS;AACZ,kBAAU;AACV,gBAAQ;AAAA,UACN,MAAM,MAAM;AAAA,UACZ,QAAQ;AAAA,UACR,OAAO,SAAS,MAAM,KAAK,MAAM,qBAAqB,SAAS;AAAA,QACjE,CAAC;AAAA,MACH;AAAA,IACF,GAAG,SAAS,IACV;AAEJ,UACG,SAAS,MAAM,KAAK,cAAc,CAAC,CAAC,EACpC,KAAK,CAAC,WAAW;AAChB,UAAI,CAAC,SAAS;AACZ,kBAAU;AACV,YAAI,MAAO,cAAa,KAAK;AAC7B,gBAAQ,EAAE,MAAM,MAAM,MAAM,QAAQ,aAAa,OAAO,CAAC;AAAA,MAC3D;AAAA,IACF,CAAC,EACA,MAAM,CAACC,WAAmB;AACzB,UAAI,CAAC,SAAS;AACZ,kBAAU;AACV,YAAI,MAAO,cAAa,KAAK;AAC7B,gBAAQ;AAAA,UACN,MAAM,MAAM;AAAA,UACZ,QAAQ;AAAA,UACR,QAAQ;AAAA,YACN,SAAS;AAAA,YACT,OAAOA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,UAC9D;AAAA,UACA,OAAOA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,QAC9D,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACH;AAEA,eAAsB,yBACpB,SACA,iBAAyB,0BACE;AAC3B,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAClC,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,CAAC,MAAM,mBAAmB,QAAQ,CAAC,CAAC,CAAC;AAAA,EAC9C;AAEA,QAAM,WAAW,QAAQ,IAAI,CAAC,UAAU,mBAAmB,KAAK,CAAC;AAEjE,MAAI,iBAAiB,GAAG;AACtB,UAAM,aAAa,IAAI,QAA0B,CAAC,YAAY;AAC5D,iBAAW,MAAM;AACf;AAAA,UACE,QAAQ,IAAI,CAAC,WAAW;AAAA,YACtB,MAAM,MAAM;AAAA,YACZ,QAAQ;AAAA,YACR,OAAO,kBAAkB,cAAc;AAAA,UACzC,EAAE;AAAA,QACJ;AAAA,MACF,GAAG,cAAc;AAAA,IACnB,CAAC;AAED,WAAO,QAAQ,KAAK,CAAC,QAAQ,IAAI,QAAQ,GAAG,UAAU,CAAC;AAAA,EACzD;AAEA,SAAO,QAAQ,IAAI,QAAQ;AAC7B;AAEA,eAAsB,2BACpB,SAC2B;AAC3B,QAAM,UAA4B,CAAC;AACnC,aAAW,SAAS,SAAS;AAC3B,YAAQ,KAAK,MAAM,mBAAmB,KAAK,CAAC;AAAA,EAC9C;AACA,SAAO;AACT;;;ACnGO,SAAS,oBAAoB,QAAmB;AACrD,QAAM,aAAa,uBAAuB,MAAM;AAGhD,QAAM,OAAO,MAAM,QAAS,OAAgE,IAAI,IAC3F,OAAgE,OAAO,CAAC,IACzE;AAEJ,QAAM,QAAS,MAAM,SAAqB,WAAW,SAAoB;AACzE,QAAM,cAAe,MAAM,eACxB,OAA+C,eAC/C,WAAW,eACZ;AACF,QAAM,WAAY,MAAM,YACrB,WAAW,YACZ,CAAC;AAEH,QAAM,QAAQ,WAAW;AACzB,QAAM,gBAAgB,MAAM,QAAQ,WAAW,QAAQ,IAAK,WAAW,WAAwB,CAAC;AAEhG,MAAI,iBAAiB;AACrB,MAAI,OAAO;AACT,qBAAiB,OAAO,QAAQ,KAAK,EAClC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AACrB,YAAM,IAAI;AACV,YAAM,OAAQ,GAAG,QAAmB;AACpC,YAAM,OAAQ,GAAG,eAA2B,GAAG,SAAoB;AACnE,YAAM,WAAW,cAAc,SAAS,GAAG,IAAI,aAAa;AAC5D,aAAO,KAAK,GAAG,KAAK,IAAI,KAAK,QAAQ,MAAM,IAAI;AAAA,IACjD,CAAC,EACA,KAAK,IAAI;AAAA,EACd;AAEA,QAAM,iBAAiB,SACpB,IAAI,CAAC,YAAY,qBAAqB,KAAK,KAAK,KAAK,UAAU,OAAO,CAAC,aAAa,EACpF,KAAK,IAAI;AAEZ,SAAO;AAAA,KAAQ,KAAK;AAAA,mBAAsB,WAAW;AAAA;AAAA,EAAsB,cAAc;AAAA;AAAA;AAAA,EAAsB,cAAc;AAAA;AAC/H;;;ACnBA,IAAM,wBAAwB;AAE9B,IAAM,SAAS;AAAA,EACb,OAAO,IAAI,OAAkB;AAAA,EAAC;AAAA,EAC9B,MAAM,IAAI,MAAiB;AACzB,YAAQ,KAAK,yBAAyB,GAAG,CAAC;AAAA,EAC5C;AAAA,EACA,OAAO,IAAI,MAAiB;AAC1B,YAAQ,MAAM,yBAAyB,GAAG,CAAC;AAAA,EAC7C;AACF;AAaO,SAAS,WAId,YAQA;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AACJ,QAAM,eAAe,GAAG,MAAM;AAE9B,QAAM,OAAyB,CAAC,UAAU;AACxC,QAAI,kBAAkB;AACpB,YAAM,eAAe,SAAS,GAAG,MAAM,mBAAmB,OAAO,SAAS,aAAa;AACrF,YAAI;AACF,gBAAM,EAAE,YAAY,SAAS,UAAU,sBAAsB,IAAI;AAEjE,cAAI,WAAW,WAAW,QAAQ;AAChC,qBAAS;AACT;AAAA,UACF;AAEA,cAAI,WAAW,YAAY,OAAO;AAChC,qBAAS;AACT;AAAA,UACF;AAEA,gBAAM,YAAqB,WAAW,YAAY;AAClD,cAAI,CAAC,WAAW;AACd,qBAAS;AACT;AAAA,UACF;AAEA,gBAAM,SAAS,aAAa,MAAM,SAAS;AAE3C,gBAAM,iBAAoD;AAAA,YACxD;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YAEA,YAAY,CAAC,OAAe,eAAe,SAAS,EAAE;AAAA,YAEtD,gBAAgB,CAAC,YAAmC;AAClD,oBAAM,SAAS,eAAe,SAAS,QAAQ,QAAQ;AACvD,kBAAI,CAAC,QAAQ;AACX,uBAAO,KAAK,mDAAmD;AAAA,kBAC7D,UAAU,QAAQ;AAAA,kBAClB;AAAA,gBACF,CAAC;AACD;AAAA,cACF;AAEA,oBAAM,UAAU,QAAQ,gBAAgB,iBAAiB,OAAO,OAAO,cAAc,IAAI,CAAC;AAC1F,oBAAM,cAAc,QAAQ,IAAI,CAAC,WAAW,oBAAoB,MAAM,CAAC,EAAE,KAAK,MAAM;AAEpF,oBAAM,cAAe,QAAoC;AACzD,oBAAM,SAAS,gBAAgB,SAAY,CAAC,WAAW,WAAW,EAAE,IAAI;AAExE,oBAAM,aAAsB;AAAA,gBAC1B,IAAI,GAAG,MAAM,cAAc,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,gBAC/E,MAAM;AAAA,gBACN,SAAS,QAAQ,WAAW,GAAG,WAAW,WAAW;AAAA,gBACrD,SAAS;AAAA,gBACT;AAAA,cACF;AAEA,kBAAI,QAAQ,aAAa,SAAS;AAChC,oBAAI,CAAC,OAAO,OAAO,UAAU;AAC3B,yBAAO,OAAO,WAAW,CAAC;AAAA,gBAC5B;AACA,uBAAO,OAAO,SAAS,KAAK,UAAU;AAAA,cACxC,WAAW,QAAQ,aAAa,UAAU;AACxC,uBAAO,OAAO,OAAO,OAAO,OAAO,GAAG,UAAU;AAAA,cAClD,OAAO;AACL,uBAAO,OAAO,OAAO,OAAO,QAAQ,GAAG,GAAG,UAAU;AAAA,cACtD;AAAA,YACF;AAAA,YAEA,eAAe,CAAC,YAAkC;AAChD,oBAAM,SAAS,eAAe,SAAS,QAAQ,QAAQ;AACvD,kBAAI,CAAC,QAAQ;AACX,uBAAO,KAAK,iDAAiD;AAAA,kBAC3D,UAAU,QAAQ;AAAA,kBAClB;AAAA,gBACF,CAAC;AACD;AAAA,cACF;AAEA,oBAAM,cAAe,QAAoC;AACzD,oBAAM,SAAS,gBAAgB,SAAY,CAAC,WAAW,WAAW,EAAE,IAAI;AAExE,oBAAM,gBAAyB;AAAA,gBAC7B,IAAI,QAAQ,MACV,GAAG,MAAM,YAAY,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,gBAC3E,MAAM,QAAQ;AAAA,gBACd,SAAS,QAAQ,WAAW;AAAA,gBAC5B,SAAS;AAAA,gBACT;AAAA,cACF;AAEA,kBAAI,QAAQ,aAAa,SAAS;AAChC,oBAAI,CAAC,OAAO,OAAO,UAAU;AAC3B,yBAAO,OAAO,WAAW,CAAC;AAAA,gBAC5B;AACA,uBAAO,OAAO,SAAS,KAAK,aAAa;AAAA,cAC3C,WAAW,QAAQ,aAAa,UAAU;AACxC,uBAAO,OAAO,OAAO,OAAO,OAAO,GAAG,aAAa;AAAA,cACrD,OAAO;AACL,uBAAO,OAAO,OAAO,OAAO,QAAQ,GAAG,GAAG,aAAa;AAAA,cACzD;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,iBAAiB,cAAc;AACrC,mBAAS;AAAA,QACX,SAASC,QAAO;AACd,iBAAO,MAAM,YAAY,MAAM,2BAA2BA,MAAK;AAC/D,mBAAS;AAAA,QACX;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,oBAAoB;AACtB,YAAM,iBAAiB,SAAS,GAAG,MAAM,qBAAqB,OAAO,SAAS,aAAa;AACzF,YAAI;AACF,gBAAM;AAAA,YACJ;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,YAAY;AAAA,UACd,IAAI;AAKJ,gBAAM,uBAAuB,sBAAsB,SAAS;AAAA,YAC1D,CAAC,MAAM,EAAE,WAAW;AAAA,UACtB;AACA,gBAAM,gBAAgB,yBACnB,kBAAkB,WAAW,SAAS,mBAAmB;AAE5D,cAAI,CAAC,eAAe;AAClB,qBAAS;AACT;AAAA,UACF;AAEA,cAAI,cAAc,YAAY,OAAO;AACnC,qBAAS;AACT;AAAA,UACF;AAEA,cAAI,SAAS,WAAW,UAAU,CAAC,SAAS,SAAS;AACnD,qBAAS;AACT;AAAA,UACF;AAEA,gBAAM,EAAE,OAAO,UAAU,UAAU,WAAW,IAAI,qBAAqB,SAAS,OAAO;AACvF,gBAAM,WAAW,SAAS,SAAS,IAAI,SAAS,CAAC,IAAI;AAErD,gBAAM,YAAqB,cAAc,YAAY;AACrD,cAAI;AACJ,cAAI,WAAW;AACb,gBAAI;AACF,uBAAS,aAAa,MAAM,SAAS;AAAA,YACvC,SAAS,YAAY;AACnB,qBAAO,KAAK,8BAA8B,MAAM,IAAI,UAAU;AAAA,YAChE;AAAA,UACF;AAEA,gBAAM,UAAU,sBAAsB;AAEtC,gBAAM,iBAAyE;AAAA,YAC7E;AAAA,YACA,YAAY;AAAA,YACZ,UAAU,sBAAsB,MAAM;AAAA,YACtC;AAAA,YACA;AAAA,YACA;AAAA,YACA,cAAc;AAAA,YACd;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YAEA,YAAY,MAAM;AAAA,YAElB,gBAAgB,MAAM;AACpB,qBAAO,KAAK,mDAAmD;AAAA,YACjE;AAAA,YAEA,eAAe,MAAM;AACnB,qBAAO,KAAK,kDAAkD;AAAA,YAChE;AAAA,YAEA,iBAAiB,OACf,UACA,aAGqB;AACrB,oBAAM,iBAAiB,OAAO,QAAQ;AACtC,kBAAI,CAAC,YAAY,SAAS,WAAW,gBAAgB;AACnD,uBAAO;AAAA,cACT;AAEA,oBAAM,aAAa,iBAAiB,QAAQ;AAC5C,kBAAI,CAAC,YAAY;AACf,uBAAO,MAAM,6BAA6B,cAAc,EAAE;AAC1D,uBAAO;AAAA,cACT;AAEA,kBAAI;AACF,sBAAM,sBAAsB,SAAS,WACnC,8BACF;AACA,oBAAI,OAAO,wBAAwB,UAAU;AAC3C,wBAAM,IAAI,MAAM,mBAAmB;AAAA,gBACrC;AACA,sBAAM,sBAAsB,WAAW,MAAM,SAAS,UAAU;AAIhE,sBAAM,iBAAiB,cAAc;AACrC,sBAAM,WAAW;AAAA,kBACf;AAAA,kBACA;AAAA,kBACA;AAAA,gBACF;AACA,oBAAI,aAAa,QAAQ;AACvB,iCAAe,cAAc;AAAA,oBAC3B,UAAU;AAAA,oBACV,YAAY;AAAA,oBACZ,QAAQ;AAAA,oBACR,SAAS;AAAA,oBACT,UAAU;AAAA,kBACZ,CAAC;AACD,iCAAe,YAAY;AAC3B,yBAAO;AAAA,gBACT;AACA,oBAAI,aAAa,WAAW;AAC1B,wBAAM,aAAa,YAAY,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AACnF,wBAAM,eAAe,MAAM,gBAAgB;AAAA,oBACzC;AAAA,oBACA,SAAS,sBAAsB,MAAM;AAAA,oBACrC,UAAU;AAAA,oBACV,YAAY;AAAA,oBACZ,cAAc,SAAS;AAAA,oBACvB,SAAS,oBAAI,KAAK;AAAA,kBACpB,CAAC;AACD,sBAAI,iBAAiB,QAAQ;AAC3B,mCAAe,cAAc;AAAA,sBAC3B,UAAU;AAAA,sBACV,YAAY;AAAA,sBACZ,QAAQ;AAAA,sBACR,SAAS;AAAA,sBACT,UAAU;AAAA,oBACZ,CAAC;AACD,mCAAe,YAAY;AAC3B,2BAAO;AAAA,kBACT;AAAA,gBACF;AAEA,sBAAM,SAAS,MAAM,SAAS,mBAAmB;AAEjD,sBAAM,qBAAsB,QAAwD,sBAAsB;AAC1G,+BAAe,cAAc;AAAA,kBAC3B,UAAU;AAAA,kBACV,YAAY;AAAA,kBACZ,QAAQ,OAAO,UACV,OAAO,QAAQ,YACf,OAAO,SAAS;AAAA,kBACrB,SAAS,CAAC,OAAO;AAAA,kBACjB,UAAU;AAAA,gBACZ,CAAC;AAED,+BAAe,YAAY;AAE3B,sBAAM,MAAM,aAAa,QAAQ;AAAA,kBAC/B;AAAA,kBACA,YAAY;AAAA,kBACZ,UAAU;AAAA,oBACR,QAAQ;AAAA,oBACR,YAAY;AAAA,oBACZ,cAAc,SAAS;AAAA,kBACzB;AAAA,kBACA;AAAA,gBACF,CAAC;AAED,uBAAO;AAAA,cACT,SAASA,QAAO;AACd,uBAAO,MAAM,0BAA0B,cAAc,IAAIA,MAAK;AAE9D,+BAAe,cAAc;AAAA,kBAC3B,UAAU;AAAA,kBACV,YAAY,SAAS;AAAA,kBACrB,QAAQA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,kBAC7D,SAAS;AAAA,kBACT,UAAU;AAAA,gBACZ,CAAC;AAED,+BAAe,YAAY;AAE3B,sBAAM,MAAM,aAAa,QAAQ;AAAA,kBAC/B;AAAA,kBACA,YAAY;AAAA,oBACV,SAAS;AAAA,oBACT,OAAOA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAAA,kBAC9D;AAAA,kBACA,UAAU;AAAA,oBACR,QAAQ;AAAA,oBACR,YAAY,SAAS,cAAc,CAAC;AAAA,kBACtC;AAAA,gBACF,CAAC;AAED,uBAAO;AAAA,cACT;AAAA,YACF;AAAA,YAEA,eAAe,CAAC,YAAkC;AAChD,kBAAI,gBAAgB,QAAQ;AAC5B,kBAAI,cAAc,SAAS,uBAAuB;AAChD,sBAAM,YAAY,cAAc,MAAM,GAAG,qBAAqB;AAC9D,gCAAgB,GAAG,SAAS;AAAA;AAAA,mCAAmC,QAAQ,OAAO,MAAM,yBAAyB,qBAAqB;AAAA,cACpI;AAEA,oBAAM,WAAoB,MAAM;AAC9B,oBAAI;AACF,yBAAO,KAAK,MAAM,aAAa;AAAA,gBACjC,QAAQ;AACN,yBAAO;AAAA,gBACT;AAAA,cACF,GAAG;AAEH,oBAAM,oBAAiC,kBAAkB;AAAA,gBACvD,WAAW,eAAe,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,gBAC9E,gBAAgB,sBAAsB,MAAM;AAAA,gBAC5C,cAAc;AAAA,gBACd,cAAc;AAAA,gBACd,MAAM;AAAA,gBACN,OAAO,CAAC;AAAA,kBACN,MAAM;AAAA,kBACN,UAAU,QAAQ;AAAA,kBAClB,YAAY,QAAQ;AAAA,kBACpB,QAAQ;AAAA,kBACR,SAAS,QAAQ,WAAW;AAAA,kBAC5B;AAAA,gBACF,CAAC;AAAA,gBACD,UAAU,QAAQ,YAAY;AAAA,gBAC9B,UAAU;AAAA,kBACR,cAAc;AAAA,kBACd,SAAS,QAAQ,WAAW;AAAA,kBAC5B,QAAQ,QAAQ;AAAA,kBAChB,gBAAgB,QAAQ;AAAA,kBACxB,aAAa;AAAA,kBACb,YAAY;AAAA,gBACd;AAAA,cACF,CAAC;AAED,oCAAsB,MAAM,SAAS,KAAK,iBAAiB;AAE3D,oBAAM,aAAa,sBAAsB,MAAM,SAAS;AAAA,gBACtD,CAAC,MAAM,EAAE,SAAS;AAAA,cACpB;AACA,kBAAI,WAAW,SAAS,GAAG;AACzB,sBAAM,kBAAkB,WAAW,WAAW,SAAS,CAAC;AACxD,oBACE,gBAAgB,YAAY,SAAS,WACrC,CAAC,gBAAgB,UAAU,kBAC3B;AACA,kCAAgB,WAAW;AAC3B,kCAAgB,WAAW;AAAA,oBACzB,GAAG,gBAAgB;AAAA,oBACnB,kBAAkB;AAAA,oBAClB,QAAQ,QAAQ;AAAA,oBAChB,aAAa;AAAA,kBACf;AAEA,sBAAI,SAAS;AACX,0BAAM,YAAY;AAChB,0BAAI;AACF,8BAAM,QAAQ,eAAe;AAAA,sBAC/B,SAASA,QAAO;AACd,+BAAO,KAAK,+CAA+C;AAAA,0BACzD,OAAAA;AAAA,0BACA,WAAW,gBAAgB;AAAA,wBAC7B,CAAC;AAAA,sBACH;AAAA,oBACF,GAAG;AAAA,kBACL;AAAA,gBACF;AAAA,cACF;AAEA,kBAAI,SAAS;AACX,sBAAM,YAAY;AAChB,sBAAI;AACF,0BAAM,QAAQ,iBAAiB;AAC/B,sCAAkB,WAAW;AAAA,sBAC3B,GAAG,kBAAkB;AAAA,sBACrB,aAAa;AAAA,oBACf;AAAA,kBACF,SAASA,QAAO;AACd,2BAAO,KAAK,iCAAiC;AAAA,sBAC3C,OAAAA;AAAA,sBACA,WAAW,kBAAkB;AAAA,oBAC/B,CAAC;AAAA,kBACH;AAAA,gBACF,GAAG;AAAA,cACL;AAAA,YACF;AAAA,YAEA,aAAa,MAAM;AACjB,oBAAM,WAAW;AACjB,kBAAI,CAAC,SAAS,SAAS;AACrB,yBAAS,UAAU,CAAC;AAAA,cACtB;AACA,uBAAS,QAAQ,mBAAmB;AAAA,YACtC;AAAA,YAEA,cAAc,MAAM;AAClB,oBAAM,WAAW;AACjB,kBAAI,CAAC,SAAS,SAAS;AACrB,yBAAS,UAAU,CAAC;AAAA,cACtB;AACA,uBAAS,QAAQ,mBAAmB;AAAA,YACtC;AAAA,YAEA,6BAA6B,OAC3B,UACA,UAGA,YACoB;AACpB,oBAAM,iBAAiB,OAAO,QAAQ;AACtC,oBAAM,gBAAgB,SAAS,OAAO,CAAC,SAAS,KAAK,WAAW,cAAc;AAC9E,kBAAI,cAAc,WAAW,EAAG,QAAO;AAEvC,oBAAM,aAAa,iBAAiB,QAAQ;AAC5C,kBAAI,CAAC,YAAY;AACf,uBAAO,MAAM,6BAA6B,cAAc,EAAE;AAC1D,uBAAO;AAAA,cACT;AAEA,oBAAM,qBAAsB,QAAwD,sBAAsB;AAE1G,oBAAM,UAID,CAAC;AAEN,oBAAM,iBAAiB,cAAc;AACrC,oBAAM,gBAAgB;AAAA,gBACpB;AAAA,gBACA;AAAA,gBACA,cAAc,CAAC,GAAG,cAAc,CAAC;AAAA,cACnC;AACA,kBAAI,kBAAkB,QAAQ;AAC5B,2BAAW,QAAQ,eAAe;AAChC,iCAAe,cAAc;AAAA,oBAC3B,UAAU;AAAA,oBACV,YAAY,KAAK;AAAA,oBACjB,QAAQ;AAAA,oBACR,SAAS;AAAA,oBACT,UAAU;AAAA,kBACZ,CAAC;AAAA,gBACH;AACA,+BAAe,YAAY;AAC3B,uBAAO,cAAc;AAAA,cACvB;AACA,kBAAI,kBAAkB,WAAW;AAC/B,sBAAM,aAAa,kBAAkB,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AACzF,sBAAM,eAAe,MAAM,gBAAgB;AAAA,kBACzC;AAAA,kBACA,SAAS,sBAAsB,MAAM;AAAA,kBACrC,UAAU;AAAA,kBACV,YAAY;AAAA,oBACV,YAAY,cAAc;AAAA,oBAC1B,kBAAkB,cAAc,CAAC,GAAG;AAAA,kBACtC;AAAA,kBACA,SAAS,oBAAI,KAAK;AAAA,gBACpB,CAAC;AACD,oBAAI,iBAAiB,QAAQ;AAC3B,6BAAW,QAAQ,eAAe;AAChC,mCAAe,cAAc;AAAA,sBAC3B,UAAU;AAAA,sBACV,YAAY,KAAK;AAAA,sBACjB,QAAQ;AAAA,sBACR,SAAS;AAAA,sBACT,UAAU;AAAA,oBACZ,CAAC;AAAA,kBACH;AACA,iCAAe,YAAY;AAC3B,yBAAO,cAAc;AAAA,gBACvB;AAAA,cACF;AAEA,yBAAW,QAAQ,eAAe;AAChC,oBAAI;AACF,wBAAM,sBAAsB,WAAW,MAAM,KAAK,UAAU;AAG5D,0BAAQ,KAAK;AAAA,oBACX;AAAA,oBACA,UAAU,YAAY,SAAS,mBAAmB;AAAA,oBAClD,WAAW,SAAS;AAAA,kBACtB,CAAC;AAAA,gBACH,SAAS,iBAAiB;AACxB,iCAAe,cAAc;AAAA,oBAC3B,UAAU;AAAA,oBACV,YAAY,KAAK;AAAA,oBACjB,QAAQ,gCAAgC,2BAA2B,QAAQ,gBAAgB,UAAU,OAAO,eAAe,CAAC;AAAA,oBAC5H,SAAS;AAAA,oBACT,UAAU;AAAA,kBACZ,CAAC;AAAA,gBACH;AAAA,cACF;AAEA,kBAAI,QAAQ,WAAW,EAAG,QAAO,cAAc;AAE/C,kBAAI;AAMJ,kBAAI,YAAY;AACd,0BAAU,MAAM,yBAAyB,OAAO;AAAA,cAClD,OAAO;AACL,0BAAU,MAAM,2BAA2B,OAAO;AAAA,cACpD;AAEA,yBAAW,UAAU,SAAS;AAC5B,sBAAM,UAAU,OAAO,WAAW,eAC/B,OAAO,WAAW,UAAa,CAAC,OAAO,OAAO;AACjD,sBAAM,aAAa,OAAO,WAAW,YAChC,OAAO,SAAS,6BACjB,OAAO,WAAW,aACjB,OAAO,SAAS,0BACjB,OAAO,QAAQ,UACd,OAAO,OAAO,QAAQ,YACtB,OAAO,QAAQ,SAAS;AAE7B,+BAAe,cAAc;AAAA,kBAC3B,UAAU;AAAA,kBACV,YAAY,OAAO,KAAK;AAAA,kBACxB,QAAQ;AAAA,kBACR;AAAA,kBACA,UAAU;AAAA,gBACZ,CAAC;AAED,sBAAM,MAAM,aAAa,QAAQ;AAAA,kBAC/B;AAAA,kBACA,YAAY,OAAO,UAAU,EAAE,SAAS,OAAO,OAAO,WAAW;AAAA,kBACjE,UAAU;AAAA,oBACR,QAAQ;AAAA,oBACR,YAAY,OAAO,KAAK,cAAc,CAAC;AAAA,oBACvC,cAAc,OAAO,KAAK;AAAA,kBAC5B;AAAA,kBACA;AAAA,gBACF,CAAC;AAAA,cACH;AAEA,6BAAe,YAAY;AAC3B,qBAAO,cAAc;AAAA,YACvB;AAAA,UACF;AAEA,gBAAM,mBAAmB,cAAc;AACvC,mBAAS;AAAA,QACX,SAASA,QAAO;AACd,iBAAO,MAAM,YAAY,MAAM,6BAA6BA,MAAK;AACjE,mBAAS;AAAA,QACX;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,eAAe;AACjB,YAAM,YAAY;AAAA,QAChB,GAAG,MAAM;AAAA,QACT,OAAO,SAA6B,aAAa;AAC/C,cAAI;AACF,kBAAM,EAAE,YAAY,SAAS,UAAU,uBAAuB,aAAa,UAAU,IAAI;AAEzF,gBAAI,WAAW,WAAW,QAAQ;AAChC,uBAAS;AACT;AAAA,YACF;AAEA,gBAAI,WAAW,YAAY,OAAO;AAChC,uBAAS;AACT;AAAA,YACF;AAEA,kBAAM,YAAqB,WAAW,YAAY;AAClD,gBAAI,CAAC,WAAW;AACd,uBAAS;AACT;AAAA,YACF;AAEA,kBAAM,SAAS,aAAa,MAAM,SAAS;AAE3C,kBAAM,iBAA2D;AAAA,cAC/D;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cAEA,YAAY,CAAC,OAAe,eAAe,SAAS,EAAE;AAAA,cAEtD,gBAAgB,MAAM;AACpB,uBAAO,KAAK,wDAAwD;AAAA,cACtE;AAAA,cAEA,eAAe,MAAM;AACnB,uBAAO,KAAK,uDAAuD;AAAA,cACrE;AAAA,YACF;AAEA,kBAAM,cAAc,cAAc;AAClC,qBAAS;AAAA,UACX,SAASA,QAAO;AACd,mBAAO,MAAM,YAAY,MAAM,wBAAwBA,MAAK;AAC5D,qBAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,0BAAwB,EAAE,IAAI,QAAQ,IAAI;AAE1C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa,WAAW;AAAA,IACxB,aAAa,WAAW;AAAA,EAC1B;AACF;;;ACxrBA,SAAS,eAAe,OAAwE;AAC9F,SAAO,OAAO,UAAU,YAAY,UAAU;AAChD;AAEO,SAAS,mCACd,iBACA,YACsB;AACtB,QAAM,aAAa,EAAE,GAAI,mBAAmB,CAAC,EAAG;AAChD,QAAM,aAAa,MAAM,QAAQ,WAAW,OAAO,IAAI,WAAW,UAAU,CAAC;AAC7E,QAAM,iBAAiB,oBAAI,IAAqC;AAChE,QAAM,sBAAiC,CAAC;AAExC,aAAW,UAAU,YAAY;AAC/B,QAAI,eAAe,MAAM,KAAK,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,SAAS,GAAG;AAC3F,qBAAe,IAAI,OAAO,QAAQ,MAAM;AAAA,IAC1C,OAAO;AACL,0BAAoB,KAAK,MAAM;AAAA,IACjC;AAAA,EACF;AAEA,aAAW,QAAQ,cAAc,CAAC,GAAG;AACnC,QAAI,CAAC,KAAK,OAAQ;AAClB,mBAAe,IAAI,KAAK,QAAQ;AAAA,MAC9B,IAAI,GAAG,KAAK,MAAM;AAAA,MAClB,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK,WAAW;AAAA,MACzB,GAAI,KAAK,cAAc,CAAC;AAAA,IAC1B,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,MAAM,QAAQ,WAAW,OAAO,IAAI,WAAW,UAAU,CAAC;AAAA,IACnE,UAAU,MAAM,QAAQ,WAAW,QAAQ,IAAI,WAAW,WAAW;AAAA,IACrE,SAAS,CAAC,GAAG,qBAAqB,GAAG,eAAe,OAAO,CAAC;AAAA,EAC9D;AACF;;;AClCO,IAAM,yBAAN,MAA6B;AAAA,EACjB,WAAW,oBAAI,IAAyB;AAAA,EAEzD,uBAGE,YAAyG;AACzG,UAAM,iBAAiB,WAAW,UAAU;AAE5C,gCAA4B,eAAe,QAAQ,eAAe,cAAwB;AAAA,MACxF,aAAa,eAAe;AAAA,MAC5B,aAAa,eAAe;AAAA,IAC9B,CAAC;AAED,SAAK,SAAS,IAAI,eAAe,QAAQ,cAA6B;AACtE,WAAO;AAAA,EACT;AAAA,EAEA,wBAAkD;AAChD,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,kBAAkB,QAAyC;AACzD,WAAO,KAAK,SAAS,IAAI,MAAM;AAAA,EACjC;AACF;AAIA,IAAM,gCAAgC,IAAI,uBAAuB;AAE1D,SAAS,mCAA2D;AACzE,SAAO;AACT;AAEO,SAAS,uBAGd,YAAyG;AACzG,SAAO,8BAA8B,uBAAuB,UAAU;AACxE;AAEO,SAAS,wBAAkD;AAChE,SAAO,8BAA8B,sBAAsB;AAC7D;AAEO,SAAS,kBAAkB,QAAyC;AACzE,SAAO,8BAA8B,kBAAkB,MAAM;AAC/D;","names":["error","targets","maxConcurrency","newEvidence","error","error","fields","SHA256","invalid","exactFields","boundedString","digest","fields","decisions","error","error","error","invalid","invalid","isRecord","invalid","exactFields","error","fields","invalid","unsupported","operationKey","stage","publication","digest","invalid","exactFields","fields","invalid","unsupported","digest","exactFields","fields","error","record","error","error","error","error","createAgentLoopRunner","createAgentLoopScriptRunner","TRUST_RANK","TRUST_RANK","CLASSIFICATION_RANK","SHA256","FORBIDDEN_ATTRIBUTE","encoder","forbidden","DEFAULT_RATE_PER_MINUTE","isRecord","error","encoder","canonicalize","TRUST_RANK","withScheduledCondition","error","error","message","digest","error","error","digest","isRecord","reject","o","error","error","error"]}