@absolutejs/deploy 0.18.0 → 0.20.0

package/dist/tls.js.map

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../src/tls.ts"],
   "sourcesContent": [
-    "/**\n * @absolutejs/deploy/tls — ACME (RFC 8555) client for Let's Encrypt and\n * compatible CAs. DNS-01 challenges only — uses the {@link DnsProvider}\n * abstraction from `./dns`, so the same Cloudflare / Route 53 /\n * Hetzner-DNS providers that point hostnames at boxes also satisfy\n * ACME's challenge requirement.\n *\n * Zero peer deps. Bun's `crypto.subtle` covers JWS signing and ECDSA\n * key generation; a small DER encoder builds the CSR.\n *\n * Public API:\n *\n *   issueCertificate({ domains, dnsProvider, email })\n *     → { certificatePem, privateKeyPem, account, domains }\n *\n *   installCertificateOnTarget(target, cert, { certPath, keyPath, reload? })\n *     → uploads PEM files via Target.upload + optional reload exec\n *\n *   exportAccountKey / importAccountKey for persistence between runs\n *     (reuse the same account across cert renewals — cheaper, doesn't\n *      hit Let's Encrypt's account-creation rate limit)\n */\n\nimport { X509Certificate } from 'node:crypto';\nimport type { Target } from './targets';\nimport type { DnsProvider } from './dns';\n\n// =============================================================================\n// Constants\n// =============================================================================\n\nexport const LETSENCRYPT_PRODUCTION =\n\t'https://acme-v02.api.letsencrypt.org/directory';\nexport const LETSENCRYPT_STAGING =\n\t'https://acme-staging-v02.api.letsencrypt.org/directory';\n\n// =============================================================================\n// base64url\n// =============================================================================\n\nconst base64UrlEncode = (bytes: Uint8Array | ArrayBuffer): string => {\n\tconst buf = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);\n\tlet binary = '';\n\tfor (const byte of buf) binary += String.fromCharCode(byte);\n\treturn btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');\n};\n\nconst base64UrlEncodeString = (value: string): string =>\n\tbase64UrlEncode(new TextEncoder().encode(value));\n\nconst base64UrlDecode = (value: string): Uint8Array => {\n\tconst padded = value.replaceAll('-', '+').replaceAll('_', '/').padEnd(\n\t\tMath.ceil(value.length / 4) * 4,\n\t\t'='\n\t);\n\tconst binary = atob(padded);\n\tconst bytes = new Uint8Array(binary.length);\n\tfor (let index = 0; index < binary.length; index += 1) {\n\t\tbytes[index] = binary.charCodeAt(index);\n\t}\n\treturn bytes;\n};\n\n// =============================================================================\n// DER encoding (minimal subset for CSR)\n// =============================================================================\n\nconst derLength = (length: number): Uint8Array => {\n\tif (length < 0x80) return Uint8Array.from([length]);\n\tconst bytes: number[] = [];\n\tlet remaining = length;\n\twhile (remaining > 0) {\n\t\tbytes.unshift(remaining & 0xff);\n\t\tremaining >>= 8;\n\t}\n\treturn Uint8Array.from([0x80 | bytes.length, ...bytes]);\n};\n\nconst derTag = (tag: number, payload: Uint8Array): Uint8Array => {\n\tconst length = derLength(payload.length);\n\tconst out = new Uint8Array(1 + length.length + payload.length);\n\tout[0] = tag;\n\tout.set(length, 1);\n\tout.set(payload, 1 + length.length);\n\treturn out;\n};\n\nconst derSeq = (children: Uint8Array[]): Uint8Array => {\n\tconst total = children.reduce((sum, child) => sum + child.length, 0);\n\tconst payload = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const child of children) {\n\t\tpayload.set(child, offset);\n\t\toffset += child.length;\n\t}\n\treturn derTag(0x30, payload);\n};\n\nconst derSet = (children: Uint8Array[]): Uint8Array => {\n\tconst total = children.reduce((sum, child) => sum + child.length, 0);\n\tconst payload = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const child of children) {\n\t\tpayload.set(child, offset);\n\t\toffset += child.length;\n\t}\n\treturn derTag(0x31, payload);\n};\n\nconst derInt = (value: number | Uint8Array): Uint8Array => {\n\tif (typeof value === 'number') {\n\t\t// Small unsigned int — used for the CSR version field (0).\n\t\tif (value === 0) return derTag(0x02, Uint8Array.from([0]));\n\t\tconst bytes: number[] = [];\n\t\tlet remaining = value;\n\t\twhile (remaining > 0) {\n\t\t\tbytes.unshift(remaining & 0xff);\n\t\t\tremaining >>= 8;\n\t\t}\n\t\tif ((bytes[0] as number) & 0x80) bytes.unshift(0); // ensure positive\n\t\treturn derTag(0x02, Uint8Array.from(bytes));\n\t}\n\t// Big-endian unsigned bytes — strip leading zeros, then prepend 0x00 if\n\t// the high bit is set (DER INTEGER is signed two's complement).\n\tlet start = 0;\n\twhile (start < value.length - 1 && value[start] === 0) start += 1;\n\tlet payload = value.subarray(start);\n\tif ((payload[0] as number) & 0x80) {\n\t\tconst padded = new Uint8Array(payload.length + 1);\n\t\tpadded.set(payload, 1);\n\t\tpayload = padded;\n\t}\n\treturn derTag(0x02, payload);\n};\n\nconst derOid = (oid: string): Uint8Array => {\n\tconst parts = oid.split('.').map((part) => Number.parseInt(part, 10));\n\tconst first = parts[0];\n\tconst second = parts[1];\n\tif (first === undefined || second === undefined) {\n\t\tthrow new Error(`[deploy/tls] invalid OID: ${oid}`);\n\t}\n\tconst bytes: number[] = [first * 40 + second];\n\tfor (let index = 2; index < parts.length; index += 1) {\n\t\tconst value = parts[index] as number;\n\t\tconst chunks: number[] = [];\n\t\tlet remaining = value;\n\t\tdo {\n\t\t\tchunks.unshift(remaining & 0x7f);\n\t\t\tremaining >>= 7;\n\t\t} while (remaining > 0);\n\t\tfor (let chunkIndex = 0; chunkIndex < chunks.length - 1; chunkIndex += 1) {\n\t\t\tchunks[chunkIndex] = (chunks[chunkIndex] as number) | 0x80;\n\t\t}\n\t\tbytes.push(...chunks);\n\t}\n\treturn derTag(0x06, Uint8Array.from(bytes));\n};\n\nconst derPrintableString = (value: string): Uint8Array =>\n\tderTag(0x13, new TextEncoder().encode(value));\n\nconst derUtf8String = (value: string): Uint8Array =>\n\tderTag(0x0c, new TextEncoder().encode(value));\n\nconst derIa5String = (value: string): Uint8Array =>\n\tderTag(0x16, new TextEncoder().encode(value));\n\nconst derOctetString = (payload: Uint8Array): Uint8Array =>\n\tderTag(0x04, payload);\n\nconst derBitString = (payload: Uint8Array): Uint8Array => {\n\t// 0x00 prefix = number of unused bits in the final byte; for byte-aligned\n\t// signatures + keys this is always zero.\n\tconst bits = new Uint8Array(payload.length + 1);\n\tbits[0] = 0;\n\tbits.set(payload, 1);\n\treturn derTag(0x03, bits);\n};\n\nconst derContextTag = (\n\ttag: number,\n\tpayload: Uint8Array,\n\tconstructed = true\n): Uint8Array => derTag(0xa0 + tag + (constructed ? 0 : -0x20), payload);\n\n// =============================================================================\n// ECDSA signature: raw r||s ↔ DER SEQUENCE\n// =============================================================================\n\nconst ecdsaRawToDer = (rawSig: Uint8Array): Uint8Array => {\n\tconst half = rawSig.length / 2;\n\tconst r = rawSig.subarray(0, half);\n\tconst s = rawSig.subarray(half);\n\treturn derSeq([derInt(r), derInt(s)]);\n};\n\n// =============================================================================\n// JWS (RFC 7515) Flattened JSON Serialization for ACME\n// =============================================================================\n\ntype JwsHeader = {\n\talg: 'ES256';\n\tnonce: string;\n\turl: string;\n\tjwk?: JsonWebKey;\n\tkid?: string;\n};\n\ntype JwsBody = {\n\tprotected: string;\n\tpayload: string;\n\tsignature: string;\n};\n\nconst signJws = async (\n\tprivateKey: CryptoKey,\n\theader: JwsHeader,\n\tpayload: object | string\n): Promise<JwsBody> => {\n\tconst protectedHeader = base64UrlEncodeString(JSON.stringify(header));\n\tconst payloadEncoded =\n\t\tpayload === ''\n\t\t\t? '' // POST-as-GET: empty string, NOT empty object\n\t\t\t: base64UrlEncodeString(JSON.stringify(payload));\n\tconst signingInput = new TextEncoder().encode(\n\t\t`${protectedHeader}.${payloadEncoded}`\n\t);\n\tconst rawSig = new Uint8Array(\n\t\tawait crypto.subtle.sign(\n\t\t\t{ hash: 'SHA-256', name: 'ECDSA' },\n\t\t\tprivateKey,\n\t\t\tsigningInput\n\t\t)\n\t);\n\treturn {\n\t\tpayload: payloadEncoded,\n\t\tprotected: protectedHeader,\n\t\tsignature: base64UrlEncode(rawSig)\n\t};\n};\n\n// =============================================================================\n// JWK helpers — canonical thumbprint, public-key extraction\n// =============================================================================\n\nconst exportPublicJwk = async (publicKey: CryptoKey): Promise<JsonWebKey> => {\n\tconst jwk = await crypto.subtle.exportKey('jwk', publicKey);\n\t// Strip private fields if the export included them (shouldn't, on a\n\t// public key, but be defensive).\n\treturn {\n\t\tcrv: jwk.crv,\n\t\tkty: jwk.kty,\n\t\tx: jwk.x,\n\t\ty: jwk.y\n\t};\n};\n\nconst jwkThumbprint = async (publicJwk: JsonWebKey): Promise<string> => {\n\t// RFC 7638 — canonical JSON: required fields only, lex order.\n\tconst canonical = JSON.stringify({\n\t\tcrv: publicJwk.crv,\n\t\tkty: publicJwk.kty,\n\t\tx: publicJwk.x,\n\t\ty: publicJwk.y\n\t});\n\tconst hash = await crypto.subtle.digest(\n\t\t'SHA-256',\n\t\tnew TextEncoder().encode(canonical)\n\t);\n\treturn base64UrlEncode(hash);\n};\n\n// =============================================================================\n// Account key — generation + JSON export/import for persistence\n// =============================================================================\n\nexport type AcmeAccount = {\n\tkey: CryptoKeyPair;\n\t/** Account URL — set after first registration; persisted for renewals. */\n\tkid?: string;\n};\n\nexport type AcmeAccountJson = {\n\tpublicJwk: JsonWebKey;\n\tprivateJwk: JsonWebKey;\n\tkid?: string;\n};\n\nexport const generateAccountKey = async (): Promise<AcmeAccount> => {\n\tconst key = await crypto.subtle.generateKey(\n\t\t{ name: 'ECDSA', namedCurve: 'P-256' },\n\t\ttrue,\n\t\t['sign', 'verify']\n\t);\n\treturn { key };\n};\n\nexport const exportAccount = async (\n\taccount: AcmeAccount\n): Promise<AcmeAccountJson> => {\n\tconst publicJwk = await crypto.subtle.exportKey('jwk', account.key.publicKey);\n\tconst privateJwk = await crypto.subtle.exportKey(\n\t\t'jwk',\n\t\taccount.key.privateKey\n\t);\n\treturn {\n\t\tprivateJwk,\n\t\tpublicJwk,\n\t\t...(account.kid !== undefined ? { kid: account.kid } : {})\n\t};\n};\n\nexport const importAccount = async (\n\tjson: AcmeAccountJson\n): Promise<AcmeAccount> => {\n\tconst publicKey = await crypto.subtle.importKey(\n\t\t'jwk',\n\t\tjson.publicJwk,\n\t\t{ name: 'ECDSA', namedCurve: 'P-256' },\n\t\ttrue,\n\t\t['verify']\n\t);\n\tconst privateKey = await crypto.subtle.importKey(\n\t\t'jwk',\n\t\tjson.privateJwk,\n\t\t{ name: 'ECDSA', namedCurve: 'P-256' },\n\t\ttrue,\n\t\t['sign']\n\t);\n\treturn {\n\t\tkey: { privateKey, publicKey },\n\t\t...(json.kid !== undefined ? { kid: json.kid } : {})\n\t};\n};\n\n// =============================================================================\n// CSR — Certificate Signing Request\n// =============================================================================\n\nconst buildSanExtension = (domains: string[]): Uint8Array => {\n\t// SubjectAltName extension value: SEQUENCE OF GeneralName\n\tconst generalNames = domains.map((domain) =>\n\t\tderTag(0x82, new TextEncoder().encode(domain))\n\t);\n\tconst sanSequence = derSeq(generalNames);\n\tconst extensionValue = derOctetString(sanSequence);\n\treturn derSeq([derOid('2.5.29.17'), extensionValue]);\n};\n\nconst buildExtensionRequestAttribute = (domains: string[]): Uint8Array => {\n\tconst extensions = derSeq([buildSanExtension(domains)]);\n\treturn derSeq([\n\t\tderOid('1.2.840.113549.1.9.14'), // PKCS#9 extensionRequest\n\t\tderSet([extensions])\n\t]);\n};\n\nconst generateCertKeyPair = async (): Promise<CryptoKeyPair> =>\n\tcrypto.subtle.generateKey(\n\t\t{ name: 'ECDSA', namedCurve: 'P-256' },\n\t\ttrue,\n\t\t['sign', 'verify']\n\t);\n\nconst buildCsr = async (\n\tdomains: string[],\n\tkeypair: CryptoKeyPair\n): Promise<Uint8Array> => {\n\tif (domains.length === 0) {\n\t\tthrow new Error('[deploy/tls] CSR requires at least one domain');\n\t}\n\tconst commonName = domains[0] as string;\n\n\tconst spkiDer = new Uint8Array(\n\t\tawait crypto.subtle.exportKey('spki', keypair.publicKey)\n\t);\n\n\tconst version = derInt(0);\n\tconst subject = derSeq([\n\t\tderSet([\n\t\t\tderSeq([\n\t\t\t\tderOid('2.5.4.3'), // commonName\n\t\t\t\tderUtf8String(commonName)\n\t\t\t])\n\t\t])\n\t]);\n\n\tconst attributes = derContextTag(0, buildExtensionRequestAttribute(domains));\n\n\tconst certificationRequestInfo = derSeq([\n\t\tversion,\n\t\tsubject,\n\t\tspkiDer,\n\t\tattributes\n\t]);\n\n\tconst rawSig = new Uint8Array(\n\t\tawait crypto.subtle.sign(\n\t\t\t{ hash: 'SHA-256', name: 'ECDSA' },\n\t\t\tkeypair.privateKey,\n\t\t\tcertificationRequestInfo as BufferSource\n\t\t)\n\t);\n\tconst sigDer = ecdsaRawToDer(rawSig);\n\n\tconst sigAlgorithm = derSeq([derOid('1.2.840.10045.4.3.2')]);\n\t// ecdsa-with-SHA256\n\tconst signatureBits = derBitString(sigDer);\n\n\treturn derSeq([certificationRequestInfo, sigAlgorithm, signatureBits]);\n};\n\n// =============================================================================\n// PEM\n// =============================================================================\n\nconst derToPem = (label: string, der: Uint8Array): string => {\n\tconst b64 = btoa(String.fromCharCode(...der));\n\tconst lines = b64.match(/.{1,64}/g) ?? [];\n\treturn `-----BEGIN ${label}-----\\n${lines.join('\\n')}\\n-----END ${label}-----\\n`;\n};\n\nconst exportEcPrivateKeyPem = async (\n\tkeypair: CryptoKeyPair\n): Promise<string> => {\n\tconst pkcs8 = new Uint8Array(\n\t\tawait crypto.subtle.exportKey('pkcs8', keypair.privateKey)\n\t);\n\treturn derToPem('PRIVATE KEY', pkcs8);\n};\n\n// =============================================================================\n// ACME client\n// =============================================================================\n\ntype AcmeDirectory = {\n\tnewNonce: string;\n\tnewAccount: string;\n\tnewOrder: string;\n};\n\ntype AcmeOrder = {\n\tstatus: string;\n\tidentifiers: Array<{ type: string; value: string }>;\n\tauthorizations: string[];\n\tfinalize: string;\n\tcertificate?: string;\n};\n\ntype AcmeAuthorization = {\n\tstatus: string;\n\tidentifier: { type: string; value: string };\n\tchallenges: Array<{\n\t\ttype: string;\n\t\tstatus: string;\n\t\turl: string;\n\t\ttoken: string;\n\t}>;\n};\n\nexport type IssueCertificateOptions = {\n\t/** Domain(s) to include. First is the CN; all are SANs. */\n\tdomains: string[];\n\t/** DNS provider used for DNS-01 challenges (must own the zone). */\n\tdnsProvider: DnsProvider;\n\t/**\n\t * Map the public ACME challenge name to the record name written through\n\t * `dnsProvider`. Use this for CNAME-delegated DNS-01, where customers point\n\t * `_acme-challenge.app.example.com` at a platform-owned validation zone.\n\t * The propagation checker still receives the public challenge name because\n\t * that is what the certificate authority resolves.\n\t */\n\tmapDnsChallengeRecord?: (context: {\n\t\tdomain: string;\n\t\trecordName: string;\n\t}) => string;\n\t/** Contact email for the ACME account. */\n\temail: string;\n\t/** ACME directory URL. Default Let's Encrypt production. */\n\tdirectoryUrl?: string;\n\t/** Reuse an existing account. Pass `exportAccount`'s output via `importAccount`. */\n\taccount?: AcmeAccount;\n\t/** Override fetch (tests). Default global fetch. */\n\tfetch?: typeof fetch;\n\t/** Poll interval. Default 3 s. */\n\tpollIntervalMs?: number;\n\t/**\n\t * Max wait before notifying ACME that the DNS challenge is ready.\n\t * Set ~30-60s for Cloudflare; longer for slower providers. Default 30 s.\n\t */\n\tdnsPropagationDelayMs?: number;\n\t/** Max wait for the order to become valid. Default 5 min. */\n\torderTimeoutMs?: number;\n\t/** Status log lines. */\n\tonLog?: (line: string) => void;\n\t/** Override sleep (tests). */\n\tsleep?: (ms: number) => Promise<void>;\n\t/**\n\t * Optional pre-check: returns true when DNS has propagated globally.\n\t * Default: just wait `dnsPropagationDelayMs` then proceed. Override\n\t * for production to actually verify (e.g. resolve from multiple\n\t * public resolvers).\n\t */\n\tcheckDnsPropagated?: (\n\t\trecordName: string,\n\t\texpectedValue: string\n\t) => Promise<boolean>;\n};\n\nexport type IssuedCertificate = {\n\tcertificatePem: string;\n\tprivateKeyPem: string;\n\taccount: AcmeAccount;\n\tdomains: string[];\n};\n\nexport class AcmeError extends Error {\n\treadonly status: number;\n\treadonly body: unknown;\n\tconstructor(message: string, status: number, body: unknown) {\n\t\tsuper(message);\n\t\tthis.name = 'AcmeError';\n\t\tthis.status = status;\n\t\tthis.body = body;\n\t}\n}\n\nconst defaultSleep = (ms: number): Promise<void> =>\n\tnew Promise((resolve) => setTimeout(resolve, ms));\n\nexport const issueCertificate = async (\n\toptions: IssueCertificateOptions\n): Promise<IssuedCertificate> => {\n\tconst log = options.onLog ?? (() => {});\n\tconst sleep = options.sleep ?? defaultSleep;\n\tconst fetcher = options.fetch ?? fetch;\n\tconst directoryUrl = options.directoryUrl ?? LETSENCRYPT_PRODUCTION;\n\tconst pollMs = options.pollIntervalMs ?? 3_000;\n\tconst dnsDelay = options.dnsPropagationDelayMs ?? 30_000;\n\tconst orderTimeout = options.orderTimeoutMs ?? 5 * 60_000;\n\tconst account = options.account ?? (await generateAccountKey());\n\n\tif (options.domains.length === 0) {\n\t\tthrow new Error('[deploy/tls] at least one domain is required');\n\t}\n\n\t// 1. Fetch directory.\n\tlog(`[tls] fetching ACME directory ${directoryUrl}`);\n\tconst directoryResponse = await fetcher(directoryUrl);\n\tif (!directoryResponse.ok) {\n\t\tthrow new AcmeError(\n\t\t\t`failed to fetch ACME directory: ${directoryResponse.status}`,\n\t\t\tdirectoryResponse.status,\n\t\t\tawait directoryResponse.text()\n\t\t);\n\t}\n\tconst directory = (await directoryResponse.json()) as AcmeDirectory;\n\n\t// 2. Get initial nonce.\n\tlet nonce = await fetchNonce(fetcher, directory.newNonce);\n\n\t// Helper: signed POST. Tracks nonce; returns parsed JSON body + headers.\n\tconst post = async (\n\t\turl: string,\n\t\tpayload: object | string,\n\t\tidentification: { kid?: string; jwk?: JsonWebKey }\n\t): Promise<{ status: number; body: unknown; headers: Headers }> => {\n\t\tconst header: JwsHeader = {\n\t\t\talg: 'ES256',\n\t\t\tnonce,\n\t\t\turl,\n\t\t\t...(identification.kid !== undefined ? { kid: identification.kid } : {}),\n\t\t\t...(identification.jwk !== undefined ? { jwk: identification.jwk } : {})\n\t\t};\n\t\tconst jws = await signJws(account.key.privateKey, header, payload);\n\t\tconst response = await fetcher(url, {\n\t\t\tbody: JSON.stringify(jws),\n\t\t\theaders: { 'content-type': 'application/jose+json' },\n\t\t\tmethod: 'POST'\n\t\t});\n\t\tconst newNonce = response.headers.get('replay-nonce');\n\t\tif (newNonce !== null) nonce = newNonce;\n\t\tconst text = await response.text();\n\t\tconst body =\n\t\t\ttext.length > 0 && response.headers.get('content-type')?.includes('json')\n\t\t\t\t? JSON.parse(text)\n\t\t\t\t: text;\n\t\tif (!response.ok) {\n\t\t\tthrow new AcmeError(\n\t\t\t\t`ACME ${url} → ${response.status}`,\n\t\t\t\tresponse.status,\n\t\t\t\tbody\n\t\t\t);\n\t\t}\n\t\treturn { body, headers: response.headers, status: response.status };\n\t};\n\n\t// 3. Register the account (or reuse if kid is set).\n\tconst publicJwk = await exportPublicJwk(account.key.publicKey);\n\tif (account.kid === undefined) {\n\t\tlog(`[tls] registering ACME account for ${options.email}`);\n\t\tconst result = await post(\n\t\t\tdirectory.newAccount,\n\t\t\t{\n\t\t\t\tcontact: [`mailto:${options.email}`],\n\t\t\t\ttermsOfServiceAgreed: true\n\t\t\t},\n\t\t\t{ jwk: publicJwk }\n\t\t);\n\t\taccount.kid = result.headers.get('location') ?? undefined;\n\t\tif (account.kid === undefined) {\n\t\t\tthrow new Error(\n\t\t\t\t'[deploy/tls] ACME newAccount response missing Location header'\n\t\t\t);\n\t\t}\n\t\tlog(`[tls] account registered: ${account.kid}`);\n\t} else {\n\t\tlog(`[tls] reusing account ${account.kid}`);\n\t}\n\n\tconst accountKid = account.kid;\n\n\t// 4. Submit the order.\n\tlog(`[tls] submitting order for ${options.domains.join(', ')}`);\n\tconst orderResult = await post(\n\t\tdirectory.newOrder,\n\t\t{\n\t\t\tidentifiers: options.domains.map((domain) => ({\n\t\t\t\ttype: 'dns',\n\t\t\t\tvalue: domain\n\t\t\t}))\n\t\t},\n\t\t{ kid: accountKid }\n\t);\n\tlet order = orderResult.body as AcmeOrder;\n\tconst orderUrl = orderResult.headers.get('location');\n\tif (orderUrl === null) {\n\t\tthrow new Error(\n\t\t\t'[deploy/tls] ACME newOrder response missing Location header'\n\t\t);\n\t}\n\n\t// 5. For each authorization, complete the DNS-01 challenge.\n\tconst cleanups: Array<() => Promise<void>> = [];\n\tconst dnsCreated: Array<{\n\t\trecordId: string;\n\t\trecordName: string;\n\t\trecordValue: string;\n\t}> = [];\n\n\ttry {\n\t\tconst thumbprint = await jwkThumbprint(publicJwk);\n\n\t\tfor (const authUrl of order.authorizations) {\n\t\t\tconst authResult = await post(authUrl, '', { kid: accountKid });\n\t\t\tconst auth = authResult.body as AcmeAuthorization;\n\t\t\tconst challenge = auth.challenges.find((c) => c.type === 'dns-01');\n\t\t\tif (challenge === undefined) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[deploy/tls] no dns-01 challenge for ${auth.identifier.value}`\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst keyAuthorization = `${challenge.token}.${thumbprint}`;\n\t\t\tconst txtBytes = new Uint8Array(\n\t\t\t\tawait crypto.subtle.digest(\n\t\t\t\t\t'SHA-256',\n\t\t\t\t\tnew TextEncoder().encode(keyAuthorization)\n\t\t\t\t)\n\t\t\t);\n\t\t\tconst txtValue = base64UrlEncode(txtBytes);\n\t\t\tconst recordName = `_acme-challenge.${auth.identifier.value}`;\n\t\t\tconst providerRecordName =\n\t\t\t\toptions.mapDnsChallengeRecord?.({\n\t\t\t\t\tdomain: auth.identifier.value,\n\t\t\t\t\trecordName\n\t\t\t\t}) ?? recordName;\n\t\t\tif (providerRecordName.trim().length === 0) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t'[deploy/tls] mapped DNS-01 record name must not be empty'\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog(\n\t\t\t\tproviderRecordName === recordName\n\t\t\t\t\t? `[tls] DNS-01: setting ${recordName} = \"${txtValue}\"`\n\t\t\t\t\t: `[tls] DNS-01: setting delegated ${providerRecordName} for ${recordName} = \"${txtValue}\"`\n\t\t\t);\n\t\t\tconst record = await options.dnsProvider.upsert({\n\t\t\t\tcontent: txtValue,\n\t\t\t\tname: providerRecordName,\n\t\t\t\tttl: 60,\n\t\t\t\ttype: 'TXT'\n\t\t\t});\n\t\t\tdnsCreated.push({\n\t\t\t\trecordId: record.id,\n\t\t\t\trecordName: providerRecordName,\n\t\t\t\trecordValue: txtValue\n\t\t\t});\n\t\t\tcleanups.push(() => options.dnsProvider.delete(record.id));\n\n\t\t\tif (options.checkDnsPropagated !== undefined) {\n\t\t\t\tlog('[tls] waiting for DNS propagation (custom checker)…');\n\t\t\t\tconst deadline = Date.now() + dnsDelay;\n\t\t\t\twhile (Date.now() < deadline) {\n\t\t\t\t\tif (\n\t\t\t\t\t\tawait options.checkDnsPropagated(recordName, txtValue)\n\t\t\t\t\t) break;\n\t\t\t\t\tawait sleep(pollMs);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tlog(`[tls] sleeping ${dnsDelay}ms for DNS propagation`);\n\t\t\t\tawait sleep(dnsDelay);\n\t\t\t}\n\n\t\t\tlog(`[tls] notifying ACME of dns-01 readiness for ${auth.identifier.value}`);\n\t\t\tawait post(challenge.url, {}, { kid: accountKid });\n\n\t\t\t// Poll the authorization until valid/invalid.\n\t\t\tconst authDeadline = Date.now() + orderTimeout;\n\t\t\twhile (Date.now() < authDeadline) {\n\t\t\t\tconst polledResult = await post(authUrl, '', { kid: accountKid });\n\t\t\t\tconst polled = polledResult.body as AcmeAuthorization;\n\t\t\t\tif (polled.status === 'valid') break;\n\t\t\t\tif (polled.status === 'invalid') {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`[deploy/tls] authorization failed for ${auth.identifier.value}: ${JSON.stringify(polled.challenges)}`\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tawait sleep(pollMs);\n\t\t\t}\n\t\t}\n\n\t\t// 6. Finalize — generate cert keypair + CSR.\n\t\tlog('[tls] generating cert keypair + CSR');\n\t\tconst certKey = await generateCertKeyPair();\n\t\tconst csrDer = await buildCsr(options.domains, certKey);\n\t\tconst csr = base64UrlEncode(csrDer);\n\n\t\tawait post(order.finalize, { csr }, { kid: accountKid });\n\n\t\t// 7. Poll the order until valid + certificate URL appears.\n\t\tconst orderDeadline = Date.now() + orderTimeout;\n\t\twhile (Date.now() < orderDeadline) {\n\t\t\tconst refreshed = await post(orderUrl, '', { kid: accountKid });\n\t\t\torder = refreshed.body as AcmeOrder;\n\t\t\tif (order.status === 'valid' && order.certificate !== undefined) break;\n\t\t\tif (order.status === 'invalid') {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[deploy/tls] order failed: ${JSON.stringify(order)}`\n\t\t\t\t);\n\t\t\t}\n\t\t\tawait sleep(pollMs);\n\t\t}\n\n\t\tif (order.certificate === undefined) {\n\t\t\tthrow new Error('[deploy/tls] order timed out before issuing certificate');\n\t\t}\n\n\t\t// 8. Download the cert (PEM bundle).\n\t\tlog(`[tls] downloading certificate from ${order.certificate}`);\n\t\tconst certResult = await post(order.certificate, '', { kid: accountKid });\n\t\tconst certificatePem =\n\t\t\ttypeof certResult.body === 'string'\n\t\t\t\t? certResult.body\n\t\t\t\t: String(certResult.body);\n\n\t\tconst privateKeyPem = await exportEcPrivateKeyPem(certKey);\n\n\t\treturn {\n\t\t\taccount,\n\t\t\tcertificatePem,\n\t\t\tdomains: options.domains,\n\t\t\tprivateKeyPem\n\t\t};\n\t} finally {\n\t\tfor (const cleanup of cleanups) {\n\t\t\ttry {\n\t\t\t\tawait cleanup();\n\t\t\t} catch (error) {\n\t\t\t\tlog(`[tls] cleanup failed (continuing): ${String(error)}`);\n\t\t\t}\n\t\t}\n\t\t// Suppress unused-variable lint without changing behavior.\n\t\tvoid dnsCreated;\n\t}\n};\n\nconst fetchNonce = async (\n\tfetcher: typeof fetch,\n\turl: string\n): Promise<string> => {\n\tconst response = await fetcher(url, { method: 'HEAD' });\n\tconst nonce = response.headers.get('replay-nonce');\n\tif (nonce === null) {\n\t\tthrow new Error('[deploy/tls] newNonce response missing Replay-Nonce header');\n\t}\n\treturn nonce;\n};\n\n// =============================================================================\n// installCertificateOnTarget\n// =============================================================================\n\nexport type InstallCertificateOptions = {\n\t/** Remote path for the cert chain. Default `/etc/ssl/<firstDomain>/fullchain.pem`. */\n\tcertPath?: string;\n\t/** Remote path for the private key. Default `/etc/ssl/<firstDomain>/privkey.pem`. */\n\tkeyPath?: string;\n\t/** Mode (chmod) for the cert + key. Default `600`. */\n\tmode?: string;\n\t/** Owner (chown) for the cert + key. Default unchanged. */\n\towner?: string;\n\t/** Optional reload command run after install (e.g. `'systemctl reload nginx'`). */\n\treload?: string;\n\t/** Override the writeTo helper (tests). */\n\twriteFile?: (target: Target, path: string, contents: string) => Promise<void>;\n};\n\nconst defaultWriteFile = async (\n\ttarget: Target,\n\tremotePath: string,\n\tcontents: string\n): Promise<void> => {\n\tconst escaped = contents.replaceAll(\"'\", \"'\\\\''\");\n\tawait target.exec(`mkdir -p \"$(dirname '${remotePath}')\"`);\n\tawait target.exec(`cat > '${remotePath}' <<'__ABS_TLS_EOF__'\\n${contents}__ABS_TLS_EOF__\\n`);\n\tvoid escaped;\n};\n\n/**\n * @internal — exposed for unit testing of cryptographic primitives.\n * Not part of the public API; consumers should NOT depend on this.\n */\nexport const __testing = {\n\tbase64UrlDecode,\n\tbase64UrlEncode,\n\tbase64UrlEncodeString,\n\tbuildCsr,\n\tderBitString,\n\tderInt,\n\tderOid,\n\tderSeq,\n\tderSet,\n\tecdsaRawToDer,\n\texportEcPrivateKeyPem,\n\texportPublicJwk,\n\tgenerateCertKeyPair,\n\tjwkThumbprint,\n\tsignJws\n};\n\n/**\n * Upload cert + private key to the target. Composable with the deploy\n * pipeline as a verify-step or post-deploy hook.\n */\nexport const installCertificateOnTarget = async (\n\ttarget: Target,\n\tcert: IssuedCertificate,\n\toptions: InstallCertificateOptions = {}\n): Promise<{ certPath: string; keyPath: string }> => {\n\tconst domain = cert.domains[0];\n\tif (domain === undefined) {\n\t\tthrow new Error('[deploy/tls] certificate has no domains');\n\t}\n\tconst certPath = options.certPath ?? `/etc/ssl/${domain}/fullchain.pem`;\n\tconst keyPath = options.keyPath ?? `/etc/ssl/${domain}/privkey.pem`;\n\tconst mode = options.mode ?? '600';\n\tconst writer = options.writeFile ?? defaultWriteFile;\n\n\tawait writer(target, certPath, cert.certificatePem);\n\tawait writer(target, keyPath, cert.privateKeyPem);\n\tawait target.exec(`chmod ${mode} '${certPath}' '${keyPath}'`);\n\tif (options.owner !== undefined) {\n\t\tawait target.exec(`chown ${options.owner} '${certPath}' '${keyPath}'`);\n\t}\n\tif (options.reload !== undefined) {\n\t\tawait target.exec(options.reload);\n\t}\n\n\treturn { certPath, keyPath };\n};\n\n// =============================================================================\n// Certificate inspection + renewal scheduling\n// =============================================================================\n\nexport type CertificateInspection = {\n\t/** CN + every SAN, deduplicated. */\n\tsubjects: string[];\n\t/** Issuance time, ms since epoch. */\n\tvalidFrom: number;\n\t/** Expiration time, ms since epoch. */\n\tvalidTo: number;\n\t/** Whole days remaining before `validTo`. Negative if expired. */\n\tdaysRemaining: number;\n\t/** True when the cert is past `validTo`. */\n\texpired: boolean;\n\t/** Issuer DN string (for \"Let's Encrypt vs staging vs other CA\" checks). */\n\tissuer: string;\n};\n\nconst parseSubjects = (x509: X509Certificate): string[] => {\n\tconst subjects = new Set<string>();\n\tconst cnMatch = x509.subject.match(/CN=([^,\\n]+)/);\n\tif (cnMatch !== null && cnMatch[1] !== undefined) {\n\t\tsubjects.add(cnMatch[1].trim());\n\t}\n\tconst san = x509.subjectAltName;\n\tif (san !== undefined && san !== null) {\n\t\tfor (const part of san.split(',')) {\n\t\t\tconst dnsMatch = part.trim().match(/^DNS:(.+)$/);\n\t\t\tif (dnsMatch !== null && dnsMatch[1] !== undefined) {\n\t\t\t\tsubjects.add(dnsMatch[1].trim());\n\t\t\t}\n\t\t}\n\t}\n\treturn [...subjects];\n};\n\n/**\n * Parse a PEM certificate into operator-shaped metadata. Used by\n * {@link renewCertificate} to decide whether to re-issue; also fine\n * for status pages and observability.\n */\nexport const inspectCertificate = (\n\tpem: string,\n\toptions: { now?: () => number } = {}\n): CertificateInspection => {\n\tconst x509 = new X509Certificate(pem);\n\tconst validFrom = new Date(x509.validFrom).getTime();\n\tconst validTo = new Date(x509.validTo).getTime();\n\tconst now = (options.now ?? Date.now)();\n\tconst daysRemaining = Math.floor(\n\t\t(validTo - now) / (24 * 60 * 60 * 1000)\n\t);\n\treturn {\n\t\tdaysRemaining,\n\t\texpired: validTo < now,\n\t\tissuer: x509.issuer,\n\t\tsubjects: parseSubjects(x509),\n\t\tvalidFrom,\n\t\tvalidTo\n\t};\n};\n\nexport type RenewCertificateOptions = IssueCertificateOptions & {\n\t/**\n\t * Current cert PEM. When provided, the cert's `validTo` decides\n\t * whether to re-issue; when absent, renewal always issues.\n\t */\n\tcurrentCertificatePem?: string;\n\t/**\n\t * Re-issue when fewer than this many days remain. Default 30,\n\t * matching certbot's standard schedule (Let's Encrypt issues 90-day\n\t * certs; renewing at 30 days leaves a 60-day error budget).\n\t */\n\trenewWhenDaysRemaining?: number;\n\t/** Force re-issue regardless of remaining days. Default false. */\n\tforce?: boolean;\n\t/** Override `Date.now()` for testing. */\n\tnow?: () => number;\n};\n\nexport type RenewalResult =\n\t| {\n\t\t\trenewed: true;\n\t\t\tcertificate: IssuedCertificate;\n\t\t\treason: 'forced' | 'no-current-cert' | 'expiring-soon';\n\t  }\n\t| {\n\t\t\trenewed: false;\n\t\t\treason: 'still-fresh';\n\t\t\tinspection: CertificateInspection;\n\t  };\n\n/**\n * Conditional cert renewal. Parses the supplied cert (if any),\n * decides whether to re-issue based on remaining days, and either\n * returns the existing cert info (\"still fresh\") or issues a new\n * one via {@link issueCertificate}.\n *\n * Wire to a scheduled function (cron / @absolutejs/sync schedule /\n * GitHub Action) running at least once a week. Idempotent: a fresh\n * cert returns `renewed: false` cheaply (one PEM parse, zero\n * network IO).\n *\n * @example\n *   const result = await renewCertificate({\n *     currentCertificatePem: existingPem,  // omit to force first-issue\n *     domains: ['api.example.com'],\n *     dnsProvider: dns,\n *     email: 'ops@example.com',\n *     account: persistedAccount,           // reuse to avoid CA rate limit\n *   });\n *   if (result.renewed) {\n *     await installCertificateOnTarget(target, result.certificate, { reload });\n *   }\n */\nexport const renewCertificate = async (\n\toptions: RenewCertificateOptions\n): Promise<RenewalResult> => {\n\tconst threshold = options.renewWhenDaysRemaining ?? 30;\n\tif (threshold < 0) {\n\t\tthrow new Error(\n\t\t\t'[deploy/tls] renewWhenDaysRemaining must be non-negative'\n\t\t);\n\t}\n\n\tif (options.force === true) {\n\t\tconst certificate = await issueCertificate(options);\n\t\treturn { certificate, reason: 'forced', renewed: true };\n\t}\n\n\tif (options.currentCertificatePem === undefined) {\n\t\tconst certificate = await issueCertificate(options);\n\t\treturn { certificate, reason: 'no-current-cert', renewed: true };\n\t}\n\n\tconst nowFn = options.now ?? Date.now;\n\tconst inspection = inspectCertificate(options.currentCertificatePem, {\n\t\tnow: nowFn\n\t});\n\n\tif (!inspection.expired && inspection.daysRemaining >= threshold) {\n\t\treturn { inspection, reason: 'still-fresh', renewed: false };\n\t}\n\n\tconst certificate = await issueCertificate(options);\n\treturn { certificate, reason: 'expiring-soon', renewed: true };\n};\n"
+    "/**\n * @absolutejs/deploy/tls — ACME (RFC 8555) client for Let's Encrypt and\n * compatible CAs. DNS-01 challenges only — uses the {@link DnsProvider}\n * abstraction from `./dns`, so the same Cloudflare / Route 53 /\n * Hetzner-DNS providers that point hostnames at boxes also satisfy\n * ACME's challenge requirement.\n *\n * Zero peer deps. Bun's `crypto.subtle` covers JWS signing and ECDSA\n * key generation; a small DER encoder builds the CSR.\n *\n * Public API:\n *\n *   issueCertificate({ domains, dnsProvider, email })\n *     → { certificatePem, privateKeyPem, account, domains }\n *\n *   installCertificateOnTarget(target, cert, { certPath, keyPath, reload? })\n *     → uploads PEM files via Target.upload + optional reload exec\n *\n *   exportAccountKey / importAccountKey for persistence between runs\n *     (reuse the same account across cert renewals — cheaper, doesn't\n *      hit Let's Encrypt's account-creation rate limit)\n */\n\nimport { X509Certificate } from \"node:crypto\";\nimport type { Target } from \"./targets\";\nimport type { DnsProvider } from \"./dns\";\n\n// =============================================================================\n// Constants\n// =============================================================================\n\nexport const LETSENCRYPT_PRODUCTION =\n  \"https://acme-v02.api.letsencrypt.org/directory\";\nexport const LETSENCRYPT_STAGING =\n  \"https://acme-staging-v02.api.letsencrypt.org/directory\";\n\n// =============================================================================\n// base64url\n// =============================================================================\n\nconst base64UrlEncode = (bytes: Uint8Array | ArrayBuffer): string => {\n  const buf = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);\n  let binary = \"\";\n  for (const byte of buf) binary += String.fromCharCode(byte);\n  return btoa(binary)\n    .replaceAll(\"+\", \"-\")\n    .replaceAll(\"/\", \"_\")\n    .replaceAll(\"=\", \"\");\n};\n\nconst base64UrlEncodeString = (value: string): string =>\n  base64UrlEncode(new TextEncoder().encode(value));\n\nconst base64UrlDecode = (value: string): Uint8Array => {\n  const padded = value\n    .replaceAll(\"-\", \"+\")\n    .replaceAll(\"_\", \"/\")\n    .padEnd(Math.ceil(value.length / 4) * 4, \"=\");\n  const binary = atob(padded);\n  const bytes = new Uint8Array(binary.length);\n  for (let index = 0; index < binary.length; index += 1) {\n    bytes[index] = binary.charCodeAt(index);\n  }\n  return bytes;\n};\n\n// =============================================================================\n// DER encoding (minimal subset for CSR)\n// =============================================================================\n\nconst derLength = (length: number): Uint8Array => {\n  if (length < 0x80) return Uint8Array.from([length]);\n  const bytes: number[] = [];\n  let remaining = length;\n  while (remaining > 0) {\n    bytes.unshift(remaining & 0xff);\n    remaining >>= 8;\n  }\n  return Uint8Array.from([0x80 | bytes.length, ...bytes]);\n};\n\nconst derTag = (tag: number, payload: Uint8Array): Uint8Array => {\n  const length = derLength(payload.length);\n  const out = new Uint8Array(1 + length.length + payload.length);\n  out[0] = tag;\n  out.set(length, 1);\n  out.set(payload, 1 + length.length);\n  return out;\n};\n\nconst derSeq = (children: Uint8Array[]): Uint8Array => {\n  const total = children.reduce((sum, child) => sum + child.length, 0);\n  const payload = new Uint8Array(total);\n  let offset = 0;\n  for (const child of children) {\n    payload.set(child, offset);\n    offset += child.length;\n  }\n  return derTag(0x30, payload);\n};\n\nconst derSet = (children: Uint8Array[]): Uint8Array => {\n  const total = children.reduce((sum, child) => sum + child.length, 0);\n  const payload = new Uint8Array(total);\n  let offset = 0;\n  for (const child of children) {\n    payload.set(child, offset);\n    offset += child.length;\n  }\n  return derTag(0x31, payload);\n};\n\nconst derInt = (value: number | Uint8Array): Uint8Array => {\n  if (typeof value === \"number\") {\n    // Small unsigned int — used for the CSR version field (0).\n    if (value === 0) return derTag(0x02, Uint8Array.from([0]));\n    const bytes: number[] = [];\n    let remaining = value;\n    while (remaining > 0) {\n      bytes.unshift(remaining & 0xff);\n      remaining >>= 8;\n    }\n    if ((bytes[0] as number) & 0x80) bytes.unshift(0); // ensure positive\n    return derTag(0x02, Uint8Array.from(bytes));\n  }\n  // Big-endian unsigned bytes — strip leading zeros, then prepend 0x00 if\n  // the high bit is set (DER INTEGER is signed two's complement).\n  let start = 0;\n  while (start < value.length - 1 && value[start] === 0) start += 1;\n  let payload = value.subarray(start);\n  if ((payload[0] as number) & 0x80) {\n    const padded = new Uint8Array(payload.length + 1);\n    padded.set(payload, 1);\n    payload = padded;\n  }\n  return derTag(0x02, payload);\n};\n\nconst derOid = (oid: string): Uint8Array => {\n  const parts = oid.split(\".\").map((part) => Number.parseInt(part, 10));\n  const first = parts[0];\n  const second = parts[1];\n  if (first === undefined || second === undefined) {\n    throw new Error(`[deploy/tls] invalid OID: ${oid}`);\n  }\n  const bytes: number[] = [first * 40 + second];\n  for (let index = 2; index < parts.length; index += 1) {\n    const value = parts[index] as number;\n    const chunks: number[] = [];\n    let remaining = value;\n    do {\n      chunks.unshift(remaining & 0x7f);\n      remaining >>= 7;\n    } while (remaining > 0);\n    for (let chunkIndex = 0; chunkIndex < chunks.length - 1; chunkIndex += 1) {\n      chunks[chunkIndex] = (chunks[chunkIndex] as number) | 0x80;\n    }\n    bytes.push(...chunks);\n  }\n  return derTag(0x06, Uint8Array.from(bytes));\n};\n\nconst derPrintableString = (value: string): Uint8Array =>\n  derTag(0x13, new TextEncoder().encode(value));\n\nconst derUtf8String = (value: string): Uint8Array =>\n  derTag(0x0c, new TextEncoder().encode(value));\n\nconst derIa5String = (value: string): Uint8Array =>\n  derTag(0x16, new TextEncoder().encode(value));\n\nconst derOctetString = (payload: Uint8Array): Uint8Array =>\n  derTag(0x04, payload);\n\nconst derBitString = (payload: Uint8Array): Uint8Array => {\n  // 0x00 prefix = number of unused bits in the final byte; for byte-aligned\n  // signatures + keys this is always zero.\n  const bits = new Uint8Array(payload.length + 1);\n  bits[0] = 0;\n  bits.set(payload, 1);\n  return derTag(0x03, bits);\n};\n\nconst derContextTag = (\n  tag: number,\n  payload: Uint8Array,\n  constructed = true,\n): Uint8Array => derTag(0xa0 + tag + (constructed ? 0 : -0x20), payload);\n\n// =============================================================================\n// ECDSA signature: raw r||s ↔ DER SEQUENCE\n// =============================================================================\n\nconst ecdsaRawToDer = (rawSig: Uint8Array): Uint8Array => {\n  const half = rawSig.length / 2;\n  const r = rawSig.subarray(0, half);\n  const s = rawSig.subarray(half);\n  return derSeq([derInt(r), derInt(s)]);\n};\n\n// =============================================================================\n// JWS (RFC 7515) Flattened JSON Serialization for ACME\n// =============================================================================\n\ntype JwsHeader = {\n  alg: \"ES256\";\n  nonce: string;\n  url: string;\n  jwk?: JsonWebKey;\n  kid?: string;\n};\n\ntype JwsBody = {\n  protected: string;\n  payload: string;\n  signature: string;\n};\n\nconst signJws = async (\n  privateKey: CryptoKey,\n  header: JwsHeader,\n  payload: object | string,\n): Promise<JwsBody> => {\n  const protectedHeader = base64UrlEncodeString(JSON.stringify(header));\n  const payloadEncoded =\n    payload === \"\"\n      ? \"\" // POST-as-GET: empty string, NOT empty object\n      : base64UrlEncodeString(JSON.stringify(payload));\n  const signingInput = new TextEncoder().encode(\n    `${protectedHeader}.${payloadEncoded}`,\n  );\n  const rawSig = new Uint8Array(\n    await crypto.subtle.sign(\n      { hash: \"SHA-256\", name: \"ECDSA\" },\n      privateKey,\n      signingInput,\n    ),\n  );\n  return {\n    payload: payloadEncoded,\n    protected: protectedHeader,\n    signature: base64UrlEncode(rawSig),\n  };\n};\n\n// =============================================================================\n// JWK helpers — canonical thumbprint, public-key extraction\n// =============================================================================\n\nconst exportPublicJwk = async (publicKey: CryptoKey): Promise<JsonWebKey> => {\n  const jwk = await crypto.subtle.exportKey(\"jwk\", publicKey);\n  // Strip private fields if the export included them (shouldn't, on a\n  // public key, but be defensive).\n  return {\n    crv: jwk.crv,\n    kty: jwk.kty,\n    x: jwk.x,\n    y: jwk.y,\n  };\n};\n\nconst jwkThumbprint = async (publicJwk: JsonWebKey): Promise<string> => {\n  // RFC 7638 — canonical JSON: required fields only, lex order.\n  const canonical = JSON.stringify({\n    crv: publicJwk.crv,\n    kty: publicJwk.kty,\n    x: publicJwk.x,\n    y: publicJwk.y,\n  });\n  const hash = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(canonical),\n  );\n  return base64UrlEncode(hash);\n};\n\n// =============================================================================\n// Account key — generation + JSON export/import for persistence\n// =============================================================================\n\nexport type AcmeAccount = {\n  key: CryptoKeyPair;\n  /** Account URL — set after first registration; persisted for renewals. */\n  kid?: string;\n};\n\nexport type AcmeAccountJson = {\n  publicJwk: JsonWebKey;\n  privateJwk: JsonWebKey;\n  kid?: string;\n};\n\nexport const generateAccountKey = async (): Promise<AcmeAccount> => {\n  const key = await crypto.subtle.generateKey(\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"sign\", \"verify\"],\n  );\n  return { key };\n};\n\nexport const exportAccount = async (\n  account: AcmeAccount,\n): Promise<AcmeAccountJson> => {\n  const publicJwk = await crypto.subtle.exportKey(\"jwk\", account.key.publicKey);\n  const privateJwk = await crypto.subtle.exportKey(\n    \"jwk\",\n    account.key.privateKey,\n  );\n  return {\n    privateJwk,\n    publicJwk,\n    ...(account.kid !== undefined ? { kid: account.kid } : {}),\n  };\n};\n\nexport const importAccount = async (\n  json: AcmeAccountJson,\n): Promise<AcmeAccount> => {\n  const publicKey = await crypto.subtle.importKey(\n    \"jwk\",\n    json.publicJwk,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"verify\"],\n  );\n  const privateKey = await crypto.subtle.importKey(\n    \"jwk\",\n    json.privateJwk,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"sign\"],\n  );\n  return {\n    key: { privateKey, publicKey },\n    ...(json.kid !== undefined ? { kid: json.kid } : {}),\n  };\n};\n\n// =============================================================================\n// CSR — Certificate Signing Request\n// =============================================================================\n\nconst buildSanExtension = (domains: string[]): Uint8Array => {\n  // SubjectAltName extension value: SEQUENCE OF GeneralName\n  const generalNames = domains.map((domain) =>\n    derTag(0x82, new TextEncoder().encode(domain)),\n  );\n  const sanSequence = derSeq(generalNames);\n  const extensionValue = derOctetString(sanSequence);\n  return derSeq([derOid(\"2.5.29.17\"), extensionValue]);\n};\n\nconst buildExtensionRequestAttribute = (domains: string[]): Uint8Array => {\n  const extensions = derSeq([buildSanExtension(domains)]);\n  return derSeq([\n    derOid(\"1.2.840.113549.1.9.14\"), // PKCS#9 extensionRequest\n    derSet([extensions]),\n  ]);\n};\n\nconst generateCertKeyPair = async (): Promise<CryptoKeyPair> =>\n  crypto.subtle.generateKey({ name: \"ECDSA\", namedCurve: \"P-256\" }, true, [\n    \"sign\",\n    \"verify\",\n  ]);\n\nconst buildCsr = async (\n  domains: string[],\n  keypair: CryptoKeyPair,\n): Promise<Uint8Array> => {\n  if (domains.length === 0) {\n    throw new Error(\"[deploy/tls] CSR requires at least one domain\");\n  }\n  const commonName = domains[0] as string;\n\n  const spkiDer = new Uint8Array(\n    await crypto.subtle.exportKey(\"spki\", keypair.publicKey),\n  );\n\n  const version = derInt(0);\n  const subject = derSeq([\n    derSet([\n      derSeq([\n        derOid(\"2.5.4.3\"), // commonName\n        derUtf8String(commonName),\n      ]),\n    ]),\n  ]);\n\n  const attributes = derContextTag(0, buildExtensionRequestAttribute(domains));\n\n  const certificationRequestInfo = derSeq([\n    version,\n    subject,\n    spkiDer,\n    attributes,\n  ]);\n\n  const rawSig = new Uint8Array(\n    await crypto.subtle.sign(\n      { hash: \"SHA-256\", name: \"ECDSA\" },\n      keypair.privateKey,\n      certificationRequestInfo as BufferSource,\n    ),\n  );\n  const sigDer = ecdsaRawToDer(rawSig);\n\n  const sigAlgorithm = derSeq([derOid(\"1.2.840.10045.4.3.2\")]);\n  // ecdsa-with-SHA256\n  const signatureBits = derBitString(sigDer);\n\n  return derSeq([certificationRequestInfo, sigAlgorithm, signatureBits]);\n};\n\n// =============================================================================\n// PEM\n// =============================================================================\n\nconst derToPem = (label: string, der: Uint8Array): string => {\n  const b64 = btoa(String.fromCharCode(...der));\n  const lines = b64.match(/.{1,64}/g) ?? [];\n  return `-----BEGIN ${label}-----\\n${lines.join(\"\\n\")}\\n-----END ${label}-----\\n`;\n};\n\nconst exportEcPrivateKeyPem = async (\n  keypair: CryptoKeyPair,\n): Promise<string> => {\n  const pkcs8 = new Uint8Array(\n    await crypto.subtle.exportKey(\"pkcs8\", keypair.privateKey),\n  );\n  return derToPem(\"PRIVATE KEY\", pkcs8);\n};\n\n// =============================================================================\n// ACME client\n// =============================================================================\n\ntype AcmeDirectory = {\n  newNonce: string;\n  newAccount: string;\n  newOrder: string;\n};\n\ntype AcmeOrder = {\n  status: string;\n  identifiers: Array<{ type: string; value: string }>;\n  authorizations: string[];\n  finalize: string;\n  certificate?: string;\n};\n\ntype AcmeAuthorization = {\n  status: string;\n  identifier: { type: string; value: string };\n  challenges: Array<{\n    type: string;\n    status: string;\n    url: string;\n    token: string;\n  }>;\n};\n\nexport type IssueCertificateOptions = {\n  /** Domain(s) to include. First is the CN; all are SANs. */\n  domains: string[];\n  /** DNS provider used for DNS-01 challenges (must own the zone). */\n  dnsProvider: DnsProvider;\n  /**\n   * Map the public ACME challenge name to the record name written through\n   * `dnsProvider`. Use this for CNAME-delegated DNS-01, where customers point\n   * `_acme-challenge.app.example.com` at a platform-owned validation zone.\n   * The propagation checker still receives the public challenge name because\n   * that is what the certificate authority resolves.\n   */\n  mapDnsChallengeRecord?: (context: {\n    domain: string;\n    recordName: string;\n  }) => string;\n  /** Contact email for the ACME account. */\n  email: string;\n  /** ACME directory URL. Default Let's Encrypt production. */\n  directoryUrl?: string;\n  /** Reuse an existing account. Pass `exportAccount`'s output via `importAccount`. */\n  account?: AcmeAccount;\n  /** Override fetch (tests). Default global fetch. */\n  fetch?: typeof fetch;\n  /** Poll interval. Default 3 s. */\n  pollIntervalMs?: number;\n  /**\n   * Max wait before notifying ACME that the DNS challenge is ready.\n   * Set ~30-60s for Cloudflare; longer for slower providers. Default 30 s.\n   */\n  dnsPropagationDelayMs?: number;\n  /** Max wait for the order to become valid. Default 5 min. */\n  orderTimeoutMs?: number;\n  /** Status log lines. */\n  onLog?: (line: string) => void;\n  /** Override sleep (tests). */\n  sleep?: (ms: number) => Promise<void>;\n  /**\n   * Optional pre-check: returns true when DNS has propagated globally.\n   * Default: just wait `dnsPropagationDelayMs` then proceed. Override\n   * for production to actually verify (e.g. resolve from multiple\n   * public resolvers).\n   */\n  checkDnsPropagated?: (\n    recordName: string,\n    expectedValue: string,\n  ) => Promise<boolean>;\n};\n\nexport type IssuedCertificate = {\n  certificatePem: string;\n  privateKeyPem: string;\n  account: AcmeAccount;\n  domains: string[];\n};\n\nexport class AcmeError extends Error {\n  readonly status: number;\n  readonly body: unknown;\n  constructor(message: string, status: number, body: unknown) {\n    super(message);\n    this.name = \"AcmeError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nconst defaultSleep = (ms: number): Promise<void> =>\n  new Promise((resolve) => setTimeout(resolve, ms));\n\nexport const issueCertificate = async (\n  options: IssueCertificateOptions,\n): Promise<IssuedCertificate> => {\n  const log = options.onLog ?? (() => {});\n  const sleep = options.sleep ?? defaultSleep;\n  const fetcher = options.fetch ?? fetch;\n  const directoryUrl = options.directoryUrl ?? LETSENCRYPT_PRODUCTION;\n  const pollMs = options.pollIntervalMs ?? 3_000;\n  const dnsDelay = options.dnsPropagationDelayMs ?? 30_000;\n  const orderTimeout = options.orderTimeoutMs ?? 5 * 60_000;\n  const account = options.account ?? (await generateAccountKey());\n\n  if (options.domains.length === 0) {\n    throw new Error(\"[deploy/tls] at least one domain is required\");\n  }\n\n  // 1. Fetch directory.\n  log(`[tls] fetching ACME directory ${directoryUrl}`);\n  const directoryResponse = await fetcher(directoryUrl);\n  if (!directoryResponse.ok) {\n    throw new AcmeError(\n      `failed to fetch ACME directory: ${directoryResponse.status}`,\n      directoryResponse.status,\n      await directoryResponse.text(),\n    );\n  }\n  const directory = (await directoryResponse.json()) as AcmeDirectory;\n\n  // 2. Get initial nonce.\n  let nonce = await fetchNonce(fetcher, directory.newNonce);\n\n  // Helper: signed POST. Tracks nonce; returns parsed JSON body + headers.\n  const post = async (\n    url: string,\n    payload: object | string,\n    identification: { kid?: string; jwk?: JsonWebKey },\n  ): Promise<{ status: number; body: unknown; headers: Headers }> => {\n    const header: JwsHeader = {\n      alg: \"ES256\",\n      nonce,\n      url,\n      ...(identification.kid !== undefined ? { kid: identification.kid } : {}),\n      ...(identification.jwk !== undefined ? { jwk: identification.jwk } : {}),\n    };\n    const jws = await signJws(account.key.privateKey, header, payload);\n    const response = await fetcher(url, {\n      body: JSON.stringify(jws),\n      headers: { \"content-type\": \"application/jose+json\" },\n      method: \"POST\",\n    });\n    const newNonce = response.headers.get(\"replay-nonce\");\n    if (newNonce !== null) nonce = newNonce;\n    const text = await response.text();\n    const body =\n      text.length > 0 && response.headers.get(\"content-type\")?.includes(\"json\")\n        ? JSON.parse(text)\n        : text;\n    if (!response.ok) {\n      throw new AcmeError(\n        `ACME ${url} → ${response.status}`,\n        response.status,\n        body,\n      );\n    }\n    return { body, headers: response.headers, status: response.status };\n  };\n\n  // 3. Register the account (or reuse if kid is set).\n  const publicJwk = await exportPublicJwk(account.key.publicKey);\n  if (account.kid === undefined) {\n    log(`[tls] registering ACME account for ${options.email}`);\n    const result = await post(\n      directory.newAccount,\n      {\n        contact: [`mailto:${options.email}`],\n        termsOfServiceAgreed: true,\n      },\n      { jwk: publicJwk },\n    );\n    account.kid = result.headers.get(\"location\") ?? undefined;\n    if (account.kid === undefined) {\n      throw new Error(\n        \"[deploy/tls] ACME newAccount response missing Location header\",\n      );\n    }\n    log(`[tls] account registered: ${account.kid}`);\n  } else {\n    log(`[tls] reusing account ${account.kid}`);\n  }\n\n  const accountKid = account.kid;\n\n  // 4. Submit the order.\n  log(`[tls] submitting order for ${options.domains.join(\", \")}`);\n  const orderResult = await post(\n    directory.newOrder,\n    {\n      identifiers: options.domains.map((domain) => ({\n        type: \"dns\",\n        value: domain,\n      })),\n    },\n    { kid: accountKid },\n  );\n  let order = orderResult.body as AcmeOrder;\n  const orderUrl = orderResult.headers.get(\"location\");\n  if (orderUrl === null) {\n    throw new Error(\n      \"[deploy/tls] ACME newOrder response missing Location header\",\n    );\n  }\n\n  // 5. For each authorization, complete the DNS-01 challenge.\n  const cleanups: Array<() => Promise<void>> = [];\n  const dnsCreated: Array<{\n    recordId: string;\n    recordName: string;\n    recordValue: string;\n  }> = [];\n\n  try {\n    const thumbprint = await jwkThumbprint(publicJwk);\n\n    for (const authUrl of order.authorizations) {\n      const authResult = await post(authUrl, \"\", { kid: accountKid });\n      const auth = authResult.body as AcmeAuthorization;\n      const challenge = auth.challenges.find((c) => c.type === \"dns-01\");\n      if (challenge === undefined) {\n        throw new Error(\n          `[deploy/tls] no dns-01 challenge for ${auth.identifier.value}`,\n        );\n      }\n      const keyAuthorization = `${challenge.token}.${thumbprint}`;\n      const txtBytes = new Uint8Array(\n        await crypto.subtle.digest(\n          \"SHA-256\",\n          new TextEncoder().encode(keyAuthorization),\n        ),\n      );\n      const txtValue = base64UrlEncode(txtBytes);\n      const recordName = `_acme-challenge.${auth.identifier.value}`;\n      const providerRecordName =\n        options.mapDnsChallengeRecord?.({\n          domain: auth.identifier.value,\n          recordName,\n        }) ?? recordName;\n      if (providerRecordName.trim().length === 0) {\n        throw new Error(\n          \"[deploy/tls] mapped DNS-01 record name must not be empty\",\n        );\n      }\n      log(\n        providerRecordName === recordName\n          ? `[tls] DNS-01: setting ${recordName} = \"${txtValue}\"`\n          : `[tls] DNS-01: setting delegated ${providerRecordName} for ${recordName} = \"${txtValue}\"`,\n      );\n      const record = await options.dnsProvider.upsert({\n        content: txtValue,\n        name: providerRecordName,\n        ttl: 60,\n        type: \"TXT\",\n      });\n      dnsCreated.push({\n        recordId: record.id,\n        recordName: providerRecordName,\n        recordValue: txtValue,\n      });\n      cleanups.push(() => options.dnsProvider.delete(record.id));\n\n      if (options.checkDnsPropagated !== undefined) {\n        log(\"[tls] waiting for DNS propagation (custom checker)…\");\n        const deadline = Date.now() + dnsDelay;\n        while (Date.now() < deadline) {\n          if (await options.checkDnsPropagated(recordName, txtValue)) break;\n          await sleep(pollMs);\n        }\n      } else {\n        log(`[tls] sleeping ${dnsDelay}ms for DNS propagation`);\n        await sleep(dnsDelay);\n      }\n\n      log(\n        `[tls] notifying ACME of dns-01 readiness for ${auth.identifier.value}`,\n      );\n      await post(challenge.url, {}, { kid: accountKid });\n\n      // Poll the authorization until valid/invalid.\n      const authDeadline = Date.now() + orderTimeout;\n      while (Date.now() < authDeadline) {\n        const polledResult = await post(authUrl, \"\", { kid: accountKid });\n        const polled = polledResult.body as AcmeAuthorization;\n        if (polled.status === \"valid\") break;\n        if (polled.status === \"invalid\") {\n          throw new Error(\n            `[deploy/tls] authorization failed for ${auth.identifier.value}: ${JSON.stringify(polled.challenges)}`,\n          );\n        }\n        await sleep(pollMs);\n      }\n    }\n\n    // 6. Finalize — generate cert keypair + CSR.\n    log(\"[tls] generating cert keypair + CSR\");\n    const certKey = await generateCertKeyPair();\n    const csrDer = await buildCsr(options.domains, certKey);\n    const csr = base64UrlEncode(csrDer);\n\n    await post(order.finalize, { csr }, { kid: accountKid });\n\n    // 7. Poll the order until valid + certificate URL appears.\n    const orderDeadline = Date.now() + orderTimeout;\n    while (Date.now() < orderDeadline) {\n      const refreshed = await post(orderUrl, \"\", { kid: accountKid });\n      order = refreshed.body as AcmeOrder;\n      if (order.status === \"valid\" && order.certificate !== undefined) break;\n      if (order.status === \"invalid\") {\n        throw new Error(`[deploy/tls] order failed: ${JSON.stringify(order)}`);\n      }\n      await sleep(pollMs);\n    }\n\n    if (order.certificate === undefined) {\n      throw new Error(\n        \"[deploy/tls] order timed out before issuing certificate\",\n      );\n    }\n\n    // 8. Download the cert (PEM bundle).\n    log(`[tls] downloading certificate from ${order.certificate}`);\n    const certResult = await post(order.certificate, \"\", { kid: accountKid });\n    const certificatePem =\n      typeof certResult.body === \"string\"\n        ? certResult.body\n        : String(certResult.body);\n\n    const privateKeyPem = await exportEcPrivateKeyPem(certKey);\n\n    return {\n      account,\n      certificatePem,\n      domains: options.domains,\n      privateKeyPem,\n    };\n  } finally {\n    for (const cleanup of cleanups) {\n      try {\n        await cleanup();\n      } catch (error) {\n        log(`[tls] cleanup failed (continuing): ${String(error)}`);\n      }\n    }\n    // Suppress unused-variable lint without changing behavior.\n    void dnsCreated;\n  }\n};\n\nconst fetchNonce = async (\n  fetcher: typeof fetch,\n  url: string,\n): Promise<string> => {\n  const response = await fetcher(url, { method: \"HEAD\" });\n  const nonce = response.headers.get(\"replay-nonce\");\n  if (nonce === null) {\n    throw new Error(\n      \"[deploy/tls] newNonce response missing Replay-Nonce header\",\n    );\n  }\n  return nonce;\n};\n\n// =============================================================================\n// installCertificateOnTarget\n// =============================================================================\n\nexport type InstallCertificateOptions = {\n  /** Remote path for the cert chain. Default `/etc/ssl/<firstDomain>/fullchain.pem`. */\n  certPath?: string;\n  /** Remote path for the private key. Default `/etc/ssl/<firstDomain>/privkey.pem`. */\n  keyPath?: string;\n  /** Mode (chmod) for the cert + key. Default `600`. */\n  mode?: string;\n  /** Owner (chown) for the cert + key. Default unchanged. */\n  owner?: string;\n  /** Optional reload command run after install (e.g. `'systemctl reload nginx'`). */\n  reload?: string;\n  /** Override the writeTo helper (tests). */\n  writeFile?: (target: Target, path: string, contents: string) => Promise<void>;\n};\n\nconst defaultWriteFile = async (\n  target: Target,\n  remotePath: string,\n  contents: string,\n): Promise<void> => {\n  const escaped = contents.replaceAll(\"'\", \"'\\\\''\");\n  await target.exec(`mkdir -p \"$(dirname '${remotePath}')\"`);\n  await target.exec(\n    `cat > '${remotePath}' <<'__ABS_TLS_EOF__'\\n${contents}__ABS_TLS_EOF__\\n`,\n  );\n  void escaped;\n};\n\n/**\n * @internal — exposed for unit testing of cryptographic primitives.\n * Not part of the public API; consumers should NOT depend on this.\n */\nexport const __testing = {\n  base64UrlDecode,\n  base64UrlEncode,\n  base64UrlEncodeString,\n  buildCsr,\n  derBitString,\n  derInt,\n  derOid,\n  derSeq,\n  derSet,\n  ecdsaRawToDer,\n  exportEcPrivateKeyPem,\n  exportPublicJwk,\n  generateCertKeyPair,\n  jwkThumbprint,\n  signJws,\n};\n\n/**\n * Upload cert + private key to the target. Composable with the deploy\n * pipeline as a verify-step or post-deploy hook.\n */\nexport const installCertificateOnTarget = async (\n  target: Target,\n  cert: IssuedCertificate,\n  options: InstallCertificateOptions = {},\n): Promise<{ certPath: string; keyPath: string }> => {\n  const domain = cert.domains[0];\n  if (domain === undefined) {\n    throw new Error(\"[deploy/tls] certificate has no domains\");\n  }\n  const certPath = options.certPath ?? `/etc/ssl/${domain}/fullchain.pem`;\n  const keyPath = options.keyPath ?? `/etc/ssl/${domain}/privkey.pem`;\n  const mode = options.mode ?? \"600\";\n  const writer = options.writeFile ?? defaultWriteFile;\n\n  await writer(target, certPath, cert.certificatePem);\n  await writer(target, keyPath, cert.privateKeyPem);\n  await target.exec(`chmod ${mode} '${certPath}' '${keyPath}'`);\n  if (options.owner !== undefined) {\n    await target.exec(`chown ${options.owner} '${certPath}' '${keyPath}'`);\n  }\n  if (options.reload !== undefined) {\n    await target.exec(options.reload);\n  }\n\n  return { certPath, keyPath };\n};\n\n// =============================================================================\n// Certificate inspection + renewal scheduling\n// =============================================================================\n\nexport type CertificateInspection = {\n  /** CN + every SAN, deduplicated. */\n  subjects: string[];\n  /** Issuance time, ms since epoch. */\n  validFrom: number;\n  /** Expiration time, ms since epoch. */\n  validTo: number;\n  /** Whole days remaining before `validTo`. Negative if expired. */\n  daysRemaining: number;\n  /** True when the cert is past `validTo`. */\n  expired: boolean;\n  /** Issuer DN string (for \"Let's Encrypt vs staging vs other CA\" checks). */\n  issuer: string;\n};\n\nconst parseSubjects = (x509: X509Certificate): string[] => {\n  const subjects = new Set<string>();\n  const cnMatch = x509.subject.match(/CN=([^,\\n]+)/);\n  if (cnMatch !== null && cnMatch[1] !== undefined) {\n    subjects.add(cnMatch[1].trim());\n  }\n  const san = x509.subjectAltName;\n  if (san !== undefined && san !== null) {\n    for (const part of san.split(\",\")) {\n      const dnsMatch = part.trim().match(/^DNS:(.+)$/);\n      if (dnsMatch !== null && dnsMatch[1] !== undefined) {\n        subjects.add(dnsMatch[1].trim());\n      }\n    }\n  }\n  return [...subjects];\n};\n\n/**\n * Parse a PEM certificate into operator-shaped metadata. Used by\n * {@link renewCertificate} to decide whether to re-issue; also fine\n * for status pages and observability.\n */\nexport const inspectCertificate = (\n  pem: string,\n  options: { now?: () => number } = {},\n): CertificateInspection => {\n  const x509 = new X509Certificate(pem);\n  const validFrom = new Date(x509.validFrom).getTime();\n  const validTo = new Date(x509.validTo).getTime();\n  const now = (options.now ?? Date.now)();\n  const daysRemaining = Math.floor((validTo - now) / (24 * 60 * 60 * 1000));\n  return {\n    daysRemaining,\n    expired: validTo < now,\n    issuer: x509.issuer,\n    subjects: parseSubjects(x509),\n    validFrom,\n    validTo,\n  };\n};\n\nexport type RenewCertificateOptions = IssueCertificateOptions & {\n  /**\n   * Current cert PEM. When provided, the cert's `validTo` decides\n   * whether to re-issue; when absent, renewal always issues.\n   */\n  currentCertificatePem?: string;\n  /**\n   * Re-issue when fewer than this many days remain. Default 30,\n   * matching certbot's standard schedule (Let's Encrypt issues 90-day\n   * certs; renewing at 30 days leaves a 60-day error budget).\n   */\n  renewWhenDaysRemaining?: number;\n  /** Force re-issue regardless of remaining days. Default false. */\n  force?: boolean;\n  /** Override `Date.now()` for testing. */\n  now?: () => number;\n};\n\nexport type RenewalResult =\n  | {\n      renewed: true;\n      certificate: IssuedCertificate;\n      reason: \"forced\" | \"no-current-cert\" | \"expiring-soon\";\n    }\n  | {\n      renewed: false;\n      reason: \"still-fresh\";\n      inspection: CertificateInspection;\n    };\n\n/**\n * Conditional cert renewal. Parses the supplied cert (if any),\n * decides whether to re-issue based on remaining days, and either\n * returns the existing cert info (\"still fresh\") or issues a new\n * one via {@link issueCertificate}.\n *\n * Wire to a scheduled function (cron / @absolutejs/sync schedule /\n * GitHub Action) running at least once a week. Idempotent: a fresh\n * cert returns `renewed: false` cheaply (one PEM parse, zero\n * network IO).\n *\n * @example\n *   const result = await renewCertificate({\n *     currentCertificatePem: existingPem,  // omit to force first-issue\n *     domains: ['api.example.com'],\n *     dnsProvider: dns,\n *     email: 'ops@example.com',\n *     account: persistedAccount,           // reuse to avoid CA rate limit\n *   });\n *   if (result.renewed) {\n *     await installCertificateOnTarget(target, result.certificate, { reload });\n *   }\n */\nexport const renewCertificate = async (\n  options: RenewCertificateOptions,\n): Promise<RenewalResult> => {\n  const threshold = options.renewWhenDaysRemaining ?? 30;\n  if (threshold < 0) {\n    throw new Error(\"[deploy/tls] renewWhenDaysRemaining must be non-negative\");\n  }\n\n  if (options.force === true) {\n    const certificate = await issueCertificate(options);\n    return { certificate, reason: \"forced\", renewed: true };\n  }\n\n  if (options.currentCertificatePem === undefined) {\n    const certificate = await issueCertificate(options);\n    return { certificate, reason: \"no-current-cert\", renewed: true };\n  }\n\n  const nowFn = options.now ?? Date.now;\n  const inspection = inspectCertificate(options.currentCertificatePem, {\n    now: nowFn,\n  });\n\n  if (!inspection.expired && inspection.daysRemaining >= threshold) {\n    return { inspection, reason: \"still-fresh\", renewed: false };\n  }\n\n  const certificate = await issueCertificate(options);\n  return { certificate, reason: \"expiring-soon\", renewed: true };\n};\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA;AAQO,IAAM,yBACZ;AACM,IAAM,sBACZ;AAMD,IAAM,kBAAkB,CAAC,UAA4C;AAAA,EACpE,MAAM,MAAM,iBAAiB,aAAa,QAAQ,IAAI,WAAW,KAAK;AAAA,EACtE,IAAI,SAAS;AAAA,EACb,WAAW,QAAQ;AAAA,IAAK,UAAU,OAAO,aAAa,IAAI;AAAA,EAC1D,OAAO,KAAK,MAAM,EAAE,WAAW,KAAK,GAAG,EAAE,WAAW,KAAK,GAAG,EAAE,WAAW,KAAK,EAAE;AAAA;AAGjF,IAAM,wBAAwB,CAAC,UAC9B,gBAAgB,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAEhD,IAAM,kBAAkB,CAAC,UAA8B;AAAA,EACtD,MAAM,SAAS,MAAM,WAAW,KAAK,GAAG,EAAE,WAAW,KAAK,GAAG,EAAE,OAC9D,KAAK,KAAK,MAAM,SAAS,CAAC,IAAI,GAC9B,GACD;AAAA,EACA,MAAM,SAAS,KAAK,MAAM;AAAA,EAC1B,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAAA,EAC1C,SAAS,QAAQ,EAAG,QAAQ,OAAO,QAAQ,SAAS,GAAG;AAAA,IACtD,MAAM,SAAS,OAAO,WAAW,KAAK;AAAA,EACvC;AAAA,EACA,OAAO;AAAA;AAOR,IAAM,YAAY,CAAC,WAA+B;AAAA,EACjD,IAAI,SAAS;AAAA,IAAM,OAAO,WAAW,KAAK,CAAC,MAAM,CAAC;AAAA,EAClD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,YAAY;AAAA,EAChB,OAAO,YAAY,GAAG;AAAA,IACrB,MAAM,QAAQ,YAAY,GAAI;AAAA,IAC9B,cAAc;AAAA,EACf;AAAA,EACA,OAAO,WAAW,KAAK,CAAC,MAAO,MAAM,QAAQ,GAAG,KAAK,CAAC;AAAA;AAGvD,IAAM,SAAS,CAAC,KAAa,YAAoC;AAAA,EAChE,MAAM,SAAS,UAAU,QAAQ,MAAM;AAAA,EACvC,MAAM,MAAM,IAAI,WAAW,IAAI,OAAO,SAAS,QAAQ,MAAM;AAAA,EAC7D,IAAI,KAAK;AAAA,EACT,IAAI,IAAI,QAAQ,CAAC;AAAA,EACjB,IAAI,IAAI,SAAS,IAAI,OAAO,MAAM;AAAA,EAClC,OAAO;AAAA;AAGR,IAAM,SAAS,CAAC,aAAuC;AAAA,EACtD,MAAM,QAAQ,SAAS,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,QAAQ,CAAC;AAAA,EACnE,MAAM,UAAU,IAAI,WAAW,KAAK;AAAA,EACpC,IAAI,SAAS;AAAA,EACb,WAAW,SAAS,UAAU;AAAA,IAC7B,QAAQ,IAAI,OAAO,MAAM;AAAA,IACzB,UAAU,MAAM;AAAA,EACjB;AAAA,EACA,OAAO,OAAO,IAAM,OAAO;AAAA;AAG5B,IAAM,SAAS,CAAC,aAAuC;AAAA,EACtD,MAAM,QAAQ,SAAS,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,QAAQ,CAAC;AAAA,EACnE,MAAM,UAAU,IAAI,WAAW,KAAK;AAAA,EACpC,IAAI,SAAS;AAAA,EACb,WAAW,SAAS,UAAU;AAAA,IAC7B,QAAQ,IAAI,OAAO,MAAM;AAAA,IACzB,UAAU,MAAM;AAAA,EACjB;AAAA,EACA,OAAO,OAAO,IAAM,OAAO;AAAA;AAG5B,IAAM,SAAS,CAAC,UAA2C;AAAA,EAC1D,IAAI,OAAO,UAAU,UAAU;AAAA,IAE9B,IAAI,UAAU;AAAA,MAAG,OAAO,OAAO,GAAM,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC;AAAA,IACzD,MAAM,QAAkB,CAAC;AAAA,IACzB,IAAI,YAAY;AAAA,IAChB,OAAO,YAAY,GAAG;AAAA,MACrB,MAAM,QAAQ,YAAY,GAAI;AAAA,MAC9B,cAAc;AAAA,IACf;AAAA,IACA,IAAK,MAAM,KAAgB;AAAA,MAAM,MAAM,QAAQ,CAAC;AAAA,IAChD,OAAO,OAAO,GAAM,WAAW,KAAK,KAAK,CAAC;AAAA,EAC3C;AAAA,EAGA,IAAI,QAAQ;AAAA,EACZ,OAAO,QAAQ,MAAM,SAAS,KAAK,MAAM,WAAW;AAAA,IAAG,SAAS;AAAA,EAChE,IAAI,UAAU,MAAM,SAAS,KAAK;AAAA,EAClC,IAAK,QAAQ,KAAgB,KAAM;AAAA,IAClC,MAAM,SAAS,IAAI,WAAW,QAAQ,SAAS,CAAC;AAAA,IAChD,OAAO,IAAI,SAAS,CAAC;AAAA,IACrB,UAAU;AAAA,EACX;AAAA,EACA,OAAO,OAAO,GAAM,OAAO;AAAA;AAG5B,IAAM,SAAS,CAAC,QAA4B;AAAA,EAC3C,MAAM,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,OAAO,SAAS,MAAM,EAAE,CAAC;AAAA,EACpE,MAAM,QAAQ,MAAM;AAAA,EACpB,MAAM,SAAS,MAAM;AAAA,EACrB,IAAI,UAAU,aAAa,WAAW,WAAW;AAAA,IAChD,MAAM,IAAI,MAAM,6BAA6B,KAAK;AAAA,EACnD;AAAA,EACA,MAAM,QAAkB,CAAC,QAAQ,KAAK,MAAM;AAAA,EAC5C,SAAS,QAAQ,EAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AAAA,IACrD,MAAM,QAAQ,MAAM;AAAA,IACpB,MAAM,SAAmB,CAAC;AAAA,IAC1B,IAAI,YAAY;AAAA,IAChB,GAAG;AAAA,MACF,OAAO,QAAQ,YAAY,GAAI;AAAA,MAC/B,cAAc;AAAA,IACf,SAAS,YAAY;AAAA,IACrB,SAAS,aAAa,EAAG,aAAa,OAAO,SAAS,GAAG,cAAc,GAAG;AAAA,MACzE,OAAO,cAAe,OAAO,cAAyB;AAAA,IACvD;AAAA,IACA,MAAM,KAAK,GAAG,MAAM;AAAA,EACrB;AAAA,EACA,OAAO,OAAO,GAAM,WAAW,KAAK,KAAK,CAAC;AAAA;AAM3C,IAAM,gBAAgB,CAAC,UACtB,OAAO,IAAM,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAK7C,IAAM,iBAAiB,CAAC,YACvB,OAAO,GAAM,OAAO;AAErB,IAAM,eAAe,CAAC,YAAoC;AAAA,EAGzD,MAAM,OAAO,IAAI,WAAW,QAAQ,SAAS,CAAC;AAAA,EAC9C,KAAK,KAAK;AAAA,EACV,KAAK,IAAI,SAAS,CAAC;AAAA,EACnB,OAAO,OAAO,GAAM,IAAI;AAAA;AAGzB,IAAM,gBAAgB,CACrB,KACA,SACA,cAAc,SACE,OAAO,MAAO,OAAO,cAAc,IAAI,MAAQ,OAAO;AAMvE,IAAM,gBAAgB,CAAC,WAAmC;AAAA,EACzD,MAAM,OAAO,OAAO,SAAS;AAAA,EAC7B,MAAM,IAAI,OAAO,SAAS,GAAG,IAAI;AAAA,EACjC,MAAM,IAAI,OAAO,SAAS,IAAI;AAAA,EAC9B,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;AAAA;AAqBrC,IAAM,UAAU,OACf,YACA,QACA,YACsB;AAAA,EACtB,MAAM,kBAAkB,sBAAsB,KAAK,UAAU,MAAM,CAAC;AAAA,EACpE,MAAM,iBACL,YAAY,KACT,KACA,sBAAsB,KAAK,UAAU,OAAO,CAAC;AAAA,EACjD,MAAM,eAAe,IAAI,YAAY,EAAE,OACtC,GAAG,mBAAmB,gBACvB;AAAA,EACA,MAAM,SAAS,IAAI,WAClB,MAAM,OAAO,OAAO,KACnB,EAAE,MAAM,WAAW,MAAM,QAAQ,GACjC,YACA,YACD,CACD;AAAA,EACA,OAAO;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,WAAW,gBAAgB,MAAM;AAAA,EAClC;AAAA;AAOD,IAAM,kBAAkB,OAAO,cAA8C;AAAA,EAC5E,MAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,SAAS;AAAA,EAG1D,OAAO;AAAA,IACN,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,GAAG,IAAI;AAAA,IACP,GAAG,IAAI;AAAA,EACR;AAAA;AAGD,IAAM,gBAAgB,OAAO,cAA2C;AAAA,EAEvE,MAAM,YAAY,KAAK,UAAU;AAAA,IAChC,KAAK,UAAU;AAAA,IACf,KAAK,UAAU;AAAA,IACf,GAAG,UAAU;AAAA,IACb,GAAG,UAAU;AAAA,EACd,CAAC;AAAA,EACD,MAAM,OAAO,MAAM,OAAO,OAAO,OAChC,WACA,IAAI,YAAY,EAAE,OAAO,SAAS,CACnC;AAAA,EACA,OAAO,gBAAgB,IAAI;AAAA;AAmBrB,IAAM,qBAAqB,YAAkC;AAAA,EACnE,MAAM,MAAM,MAAM,OAAO,OAAO,YAC/B,EAAE,MAAM,SAAS,YAAY,QAAQ,GACrC,MACA,CAAC,QAAQ,QAAQ,CAClB;AAAA,EACA,OAAO,EAAE,IAAI;AAAA;AAGP,IAAM,gBAAgB,OAC5B,YAC8B;AAAA,EAC9B,MAAM,YAAY,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,IAAI,SAAS;AAAA,EAC5E,MAAM,aAAa,MAAM,OAAO,OAAO,UACtC,OACA,QAAQ,IAAI,UACb;AAAA,EACA,OAAO;AAAA,IACN;AAAA,IACA;AAAA,OACI,QAAQ,QAAQ,YAAY,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,EACzD;AAAA;AAGM,IAAM,gBAAgB,OAC5B,SAC0B;AAAA,EAC1B,MAAM,YAAY,MAAM,OAAO,OAAO,UACrC,OACA,KAAK,WACL,EAAE,MAAM,SAAS,YAAY,QAAQ,GACrC,MACA,CAAC,QAAQ,CACV;AAAA,EACA,MAAM,aAAa,MAAM,OAAO,OAAO,UACtC,OACA,KAAK,YACL,EAAE,MAAM,SAAS,YAAY,QAAQ,GACrC,MACA,CAAC,MAAM,CACR;AAAA,EACA,OAAO;AAAA,IACN,KAAK,EAAE,YAAY,UAAU;AAAA,OACzB,KAAK,QAAQ,YAAY,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC;AAAA,EACnD;AAAA;AAOD,IAAM,oBAAoB,CAAC,YAAkC;AAAA,EAE5D,MAAM,eAAe,QAAQ,IAAI,CAAC,WACjC,OAAO,KAAM,IAAI,YAAY,EAAE,OAAO,MAAM,CAAC,CAC9C;AAAA,EACA,MAAM,cAAc,OAAO,YAAY;AAAA,EACvC,MAAM,iBAAiB,eAAe,WAAW;AAAA,EACjD,OAAO,OAAO,CAAC,OAAO,WAAW,GAAG,cAAc,CAAC;AAAA;AAGpD,IAAM,iCAAiC,CAAC,YAAkC;AAAA,EACzE,MAAM,aAAa,OAAO,CAAC,kBAAkB,OAAO,CAAC,CAAC;AAAA,EACtD,OAAO,OAAO;AAAA,IACb,OAAO,uBAAuB;AAAA,IAC9B,OAAO,CAAC,UAAU,CAAC;AAAA,EACpB,CAAC;AAAA;AAGF,IAAM,sBAAsB,YAC3B,OAAO,OAAO,YACb,EAAE,MAAM,SAAS,YAAY,QAAQ,GACrC,MACA,CAAC,QAAQ,QAAQ,CAClB;AAED,IAAM,WAAW,OAChB,SACA,YACyB;AAAA,EACzB,IAAI,QAAQ,WAAW,GAAG;AAAA,IACzB,MAAM,IAAI,MAAM,+CAA+C;AAAA,EAChE;AAAA,EACA,MAAM,aAAa,QAAQ;AAAA,EAE3B,MAAM,UAAU,IAAI,WACnB,MAAM,OAAO,OAAO,UAAU,QAAQ,QAAQ,SAAS,CACxD;AAAA,EAEA,MAAM,UAAU,OAAO,CAAC;AAAA,EACxB,MAAM,UAAU,OAAO;AAAA,IACtB,OAAO;AAAA,MACN,OAAO;AAAA,QACN,OAAO,SAAS;AAAA,QAChB,cAAc,UAAU;AAAA,MACzB,CAAC;AAAA,IACF,CAAC;AAAA,EACF,CAAC;AAAA,EAED,MAAM,aAAa,cAAc,GAAG,+BAA+B,OAAO,CAAC;AAAA,EAE3E,MAAM,2BAA2B,OAAO;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD,CAAC;AAAA,EAED,MAAM,SAAS,IAAI,WAClB,MAAM,OAAO,OAAO,KACnB,EAAE,MAAM,WAAW,MAAM,QAAQ,GACjC,QAAQ,YACR,wBACD,CACD;AAAA,EACA,MAAM,SAAS,cAAc,MAAM;AAAA,EAEnC,MAAM,eAAe,OAAO,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAAA,EAE3D,MAAM,gBAAgB,aAAa,MAAM;AAAA,EAEzC,OAAO,OAAO,CAAC,0BAA0B,cAAc,aAAa,CAAC;AAAA;AAOtE,IAAM,WAAW,CAAC,OAAe,QAA4B;AAAA,EAC5D,MAAM,MAAM,KAAK,OAAO,aAAa,GAAG,GAAG,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,MAAM,UAAU,KAAK,CAAC;AAAA,EACxC,OAAO,cAAc;AAAA,EAAe,MAAM,KAAK;AAAA,CAAI;AAAA,WAAe;AAAA;AAAA;AAGnE,IAAM,wBAAwB,OAC7B,YACqB;AAAA,EACrB,MAAM,QAAQ,IAAI,WACjB,MAAM,OAAO,OAAO,UAAU,SAAS,QAAQ,UAAU,CAC1D;AAAA,EACA,OAAO,SAAS,eAAe,KAAK;AAAA;AAAA;AAwF9B,MAAM,kBAAkB,MAAM;AAAA,EAC3B;AAAA,EACA;AAAA,EACT,WAAW,CAAC,SAAiB,QAAgB,MAAe;AAAA,IAC3D,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,KAAK,SAAS;AAAA,IACd,KAAK,OAAO;AAAA;AAEd;AAEA,IAAM,eAAe,CAAC,OACrB,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAE1C,IAAM,mBAAmB,OAC/B,YACgC;AAAA,EAChC,MAAM,MAAM,QAAQ,UAAU,MAAM;AAAA,EACpC,MAAM,QAAQ,QAAQ,SAAS;AAAA,EAC/B,MAAM,UAAU,QAAQ,SAAS;AAAA,EACjC,MAAM,eAAe,QAAQ,gBAAgB;AAAA,EAC7C,MAAM,SAAS,QAAQ,kBAAkB;AAAA,EACzC,MAAM,WAAW,QAAQ,yBAAyB;AAAA,EAClD,MAAM,eAAe,QAAQ,kBAAkB,IAAI;AAAA,EACnD,MAAM,UAAU,QAAQ,WAAY,MAAM,mBAAmB;AAAA,EAE7D,IAAI,QAAQ,QAAQ,WAAW,GAAG;AAAA,IACjC,MAAM,IAAI,MAAM,8CAA8C;AAAA,EAC/D;AAAA,EAGA,IAAI,iCAAiC,cAAc;AAAA,EACnD,MAAM,oBAAoB,MAAM,QAAQ,YAAY;AAAA,EACpD,IAAI,CAAC,kBAAkB,IAAI;AAAA,IAC1B,MAAM,IAAI,UACT,mCAAmC,kBAAkB,UACrD,kBAAkB,QAClB,MAAM,kBAAkB,KAAK,CAC9B;AAAA,EACD;AAAA,EACA,MAAM,YAAa,MAAM,kBAAkB,KAAK;AAAA,EAGhD,IAAI,QAAQ,MAAM,WAAW,SAAS,UAAU,QAAQ;AAAA,EAGxD,MAAM,OAAO,OACZ,KACA,SACA,mBACkE;AAAA,IAClE,MAAM,SAAoB;AAAA,MACzB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,SACI,eAAe,QAAQ,YAAY,EAAE,KAAK,eAAe,IAAI,IAAI,CAAC;AAAA,SAClE,eAAe,QAAQ,YAAY,EAAE,KAAK,eAAe,IAAI,IAAI,CAAC;AAAA,IACvE;AAAA,IACA,MAAM,MAAM,MAAM,QAAQ,QAAQ,IAAI,YAAY,QAAQ,OAAO;AAAA,IACjE,MAAM,WAAW,MAAM,QAAQ,KAAK;AAAA,MACnC,MAAM,KAAK,UAAU,GAAG;AAAA,MACxB,SAAS,EAAE,gBAAgB,wBAAwB;AAAA,MACnD,QAAQ;AAAA,IACT,CAAC;AAAA,IACD,MAAM,WAAW,SAAS,QAAQ,IAAI,cAAc;AAAA,IACpD,IAAI,aAAa;AAAA,MAAM,QAAQ;AAAA,IAC/B,MAAM,OAAO,MAAM,SAAS,KAAK;AAAA,IACjC,MAAM,OACL,KAAK,SAAS,KAAK,SAAS,QAAQ,IAAI,cAAc,GAAG,SAAS,MAAM,IACrE,KAAK,MAAM,IAAI,IACf;AAAA,IACJ,IAAI,CAAC,SAAS,IAAI;AAAA,MACjB,MAAM,IAAI,UACT,QAAQ,cAAQ,SAAS,UACzB,SAAS,QACT,IACD;AAAA,IACD;AAAA,IACA,OAAO,EAAE,MAAM,SAAS,SAAS,SAAS,QAAQ,SAAS,OAAO;AAAA;AAAA,EAInE,MAAM,YAAY,MAAM,gBAAgB,QAAQ,IAAI,SAAS;AAAA,EAC7D,IAAI,QAAQ,QAAQ,WAAW;AAAA,IAC9B,IAAI,sCAAsC,QAAQ,OAAO;AAAA,IACzD,MAAM,SAAS,MAAM,KACpB,UAAU,YACV;AAAA,MACC,SAAS,CAAC,UAAU,QAAQ,OAAO;AAAA,MACnC,sBAAsB;AAAA,IACvB,GACA,EAAE,KAAK,UAAU,CAClB;AAAA,IACA,QAAQ,MAAM,OAAO,QAAQ,IAAI,UAAU,KAAK;AAAA,IAChD,IAAI,QAAQ,QAAQ,WAAW;AAAA,MAC9B,MAAM,IAAI,MACT,+DACD;AAAA,IACD;AAAA,IACA,IAAI,6BAA6B,QAAQ,KAAK;AAAA,EAC/C,EAAO;AAAA,IACN,IAAI,yBAAyB,QAAQ,KAAK;AAAA;AAAA,EAG3C,MAAM,aAAa,QAAQ;AAAA,EAG3B,IAAI,8BAA8B,QAAQ,QAAQ,KAAK,IAAI,GAAG;AAAA,EAC9D,MAAM,cAAc,MAAM,KACzB,UAAU,UACV;AAAA,IACC,aAAa,QAAQ,QAAQ,IAAI,CAAC,YAAY;AAAA,MAC7C,MAAM;AAAA,MACN,OAAO;AAAA,IACR,EAAE;AAAA,EACH,GACA,EAAE,KAAK,WAAW,CACnB;AAAA,EACA,IAAI,QAAQ,YAAY;AAAA,EACxB,MAAM,WAAW,YAAY,QAAQ,IAAI,UAAU;AAAA,EACnD,IAAI,aAAa,MAAM;AAAA,IACtB,MAAM,IAAI,MACT,6DACD;AAAA,EACD;AAAA,EAGA,MAAM,WAAuC,CAAC;AAAA,EAC9C,MAAM,aAID,CAAC;AAAA,EAEN,IAAI;AAAA,IACH,MAAM,aAAa,MAAM,cAAc,SAAS;AAAA,IAEhD,WAAW,WAAW,MAAM,gBAAgB;AAAA,MAC3C,MAAM,aAAa,MAAM,KAAK,SAAS,IAAI,EAAE,KAAK,WAAW,CAAC;AAAA,MAC9D,MAAM,OAAO,WAAW;AAAA,MACxB,MAAM,YAAY,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AAAA,MACjE,IAAI,cAAc,WAAW;AAAA,QAC5B,MAAM,IAAI,MACT,wCAAwC,KAAK,WAAW,OACzD;AAAA,MACD;AAAA,MACA,MAAM,mBAAmB,GAAG,UAAU,SAAS;AAAA,MAC/C,MAAM,WAAW,IAAI,WACpB,MAAM,OAAO,OAAO,OACnB,WACA,IAAI,YAAY,EAAE,OAAO,gBAAgB,CAC1C,CACD;AAAA,MACA,MAAM,WAAW,gBAAgB,QAAQ;AAAA,MACzC,MAAM,aAAa,mBAAmB,KAAK,WAAW;AAAA,MACtD,MAAM,qBACL,QAAQ,wBAAwB;AAAA,QAC/B,QAAQ,KAAK,WAAW;AAAA,QACxB;AAAA,MACD,CAAC,KAAK;AAAA,MACP,IAAI,mBAAmB,KAAK,EAAE,WAAW,GAAG;AAAA,QAC3C,MAAM,IAAI,MACT,0DACD;AAAA,MACD;AAAA,MACA,IACC,uBAAuB,aACpB,yBAAyB,iBAAiB,cAC1C,mCAAmC,0BAA0B,iBAAiB,WAClF;AAAA,MACA,MAAM,SAAS,MAAM,QAAQ,YAAY,OAAO;AAAA,QAC/C,SAAS;AAAA,QACT,MAAM;AAAA,QACN,KAAK;AAAA,QACL,MAAM;AAAA,MACP,CAAC;AAAA,MACD,WAAW,KAAK;AAAA,QACf,UAAU,OAAO;AAAA,QACjB,YAAY;AAAA,QACZ,aAAa;AAAA,MACd,CAAC;AAAA,MACD,SAAS,KAAK,MAAM,QAAQ,YAAY,OAAO,OAAO,EAAE,CAAC;AAAA,MAEzD,IAAI,QAAQ,uBAAuB,WAAW;AAAA,QAC7C,IAAI,0DAAoD;AAAA,QACxD,MAAM,WAAW,KAAK,IAAI,IAAI;AAAA,QAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;AAAA,UAC7B,IACC,MAAM,QAAQ,mBAAmB,YAAY,QAAQ;AAAA,YACpD;AAAA,UACF,MAAM,MAAM,MAAM;AAAA,QACnB;AAAA,MACD,EAAO;AAAA,QACN,IAAI,kBAAkB,gCAAgC;AAAA,QACtD,MAAM,MAAM,QAAQ;AAAA;AAAA,MAGrB,IAAI,gDAAgD,KAAK,WAAW,OAAO;AAAA,MAC3E,MAAM,KAAK,UAAU,KAAK,CAAC,GAAG,EAAE,KAAK,WAAW,CAAC;AAAA,MAGjD,MAAM,eAAe,KAAK,IAAI,IAAI;AAAA,MAClC,OAAO,KAAK,IAAI,IAAI,cAAc;AAAA,QACjC,MAAM,eAAe,MAAM,KAAK,SAAS,IAAI,EAAE,KAAK,WAAW,CAAC;AAAA,QAChE,MAAM,SAAS,aAAa;AAAA,QAC5B,IAAI,OAAO,WAAW;AAAA,UAAS;AAAA,QAC/B,IAAI,OAAO,WAAW,WAAW;AAAA,UAChC,MAAM,IAAI,MACT,yCAAyC,KAAK,WAAW,UAAU,KAAK,UAAU,OAAO,UAAU,GACpG;AAAA,QACD;AAAA,QACA,MAAM,MAAM,MAAM;AAAA,MACnB;AAAA,IACD;AAAA,IAGA,IAAI,qCAAqC;AAAA,IACzC,MAAM,UAAU,MAAM,oBAAoB;AAAA,IAC1C,MAAM,SAAS,MAAM,SAAS,QAAQ,SAAS,OAAO;AAAA,IACtD,MAAM,MAAM,gBAAgB,MAAM;AAAA,IAElC,MAAM,KAAK,MAAM,UAAU,EAAE,IAAI,GAAG,EAAE,KAAK,WAAW,CAAC;AAAA,IAGvD,MAAM,gBAAgB,KAAK,IAAI,IAAI;AAAA,IACnC,OAAO,KAAK,IAAI,IAAI,eAAe;AAAA,MAClC,MAAM,YAAY,MAAM,KAAK,UAAU,IAAI,EAAE,KAAK,WAAW,CAAC;AAAA,MAC9D,QAAQ,UAAU;AAAA,MAClB,IAAI,MAAM,WAAW,WAAW,MAAM,gBAAgB;AAAA,QAAW;AAAA,MACjE,IAAI,MAAM,WAAW,WAAW;AAAA,QAC/B,MAAM,IAAI,MACT,8BAA8B,KAAK,UAAU,KAAK,GACnD;AAAA,MACD;AAAA,MACA,MAAM,MAAM,MAAM;AAAA,IACnB;AAAA,IAEA,IAAI,MAAM,gBAAgB,WAAW;AAAA,MACpC,MAAM,IAAI,MAAM,yDAAyD;AAAA,IAC1E;AAAA,IAGA,IAAI,sCAAsC,MAAM,aAAa;AAAA,IAC7D,MAAM,aAAa,MAAM,KAAK,MAAM,aAAa,IAAI,EAAE,KAAK,WAAW,CAAC;AAAA,IACxE,MAAM,iBACL,OAAO,WAAW,SAAS,WACxB,WAAW,OACX,OAAO,WAAW,IAAI;AAAA,IAE1B,MAAM,gBAAgB,MAAM,sBAAsB,OAAO;AAAA,IAEzD,OAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA,SAAS,QAAQ;AAAA,MACjB;AAAA,IACD;AAAA,YACC;AAAA,IACD,WAAW,WAAW,UAAU;AAAA,MAC/B,IAAI;AAAA,QACH,MAAM,QAAQ;AAAA,QACb,OAAO,OAAO;AAAA,QACf,IAAI,sCAAsC,OAAO,KAAK,GAAG;AAAA;AAAA,IAE3D;AAAA;AAAA;AAMF,IAAM,aAAa,OAClB,SACA,QACqB;AAAA,EACrB,MAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,QAAQ,OAAO,CAAC;AAAA,EACtD,MAAM,QAAQ,SAAS,QAAQ,IAAI,cAAc;AAAA,EACjD,IAAI,UAAU,MAAM;AAAA,IACnB,MAAM,IAAI,MAAM,4DAA4D;AAAA,EAC7E;AAAA,EACA,OAAO;AAAA;AAsBR,IAAM,mBAAmB,OACxB,QACA,YACA,aACmB;AAAA,EACnB,MAAM,UAAU,SAAS,WAAW,KAAK,OAAO;AAAA,EAChD,MAAM,OAAO,KAAK,wBAAwB,eAAe;AAAA,EACzD,MAAM,OAAO,KAAK,UAAU;AAAA,EAAoC;AAAA,CAA2B;AAAA;AAQrF,IAAM,YAAY;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAMO,IAAM,6BAA6B,OACzC,QACA,MACA,UAAqC,CAAC,MACc;AAAA,EACpD,MAAM,SAAS,KAAK,QAAQ;AAAA,EAC5B,IAAI,WAAW,WAAW;AAAA,IACzB,MAAM,IAAI,MAAM,yCAAyC;AAAA,EAC1D;AAAA,EACA,MAAM,WAAW,QAAQ,YAAY,YAAY;AAAA,EACjD,MAAM,UAAU,QAAQ,WAAW,YAAY;AAAA,EAC/C,MAAM,OAAO,QAAQ,QAAQ;AAAA,EAC7B,MAAM,SAAS,QAAQ,aAAa;AAAA,EAEpC,MAAM,OAAO,QAAQ,UAAU,KAAK,cAAc;AAAA,EAClD,MAAM,OAAO,QAAQ,SAAS,KAAK,aAAa;AAAA,EAChD,MAAM,OAAO,KAAK,SAAS,SAAS,cAAc,UAAU;AAAA,EAC5D,IAAI,QAAQ,UAAU,WAAW;AAAA,IAChC,MAAM,OAAO,KAAK,SAAS,QAAQ,UAAU,cAAc,UAAU;AAAA,EACtE;AAAA,EACA,IAAI,QAAQ,WAAW,WAAW;AAAA,IACjC,MAAM,OAAO,KAAK,QAAQ,MAAM;AAAA,EACjC;AAAA,EAEA,OAAO,EAAE,UAAU,QAAQ;AAAA;AAsB5B,IAAM,gBAAgB,CAAC,SAAoC;AAAA,EAC1D,MAAM,WAAW,IAAI;AAAA,EACrB,MAAM,UAAU,KAAK,QAAQ,MAAM,cAAc;AAAA,EACjD,IAAI,YAAY,QAAQ,QAAQ,OAAO,WAAW;AAAA,IACjD,SAAS,IAAI,QAAQ,GAAG,KAAK,CAAC;AAAA,EAC/B;AAAA,EACA,MAAM,MAAM,KAAK;AAAA,EACjB,IAAI,QAAQ,aAAa,QAAQ,MAAM;AAAA,IACtC,WAAW,QAAQ,IAAI,MAAM,GAAG,GAAG;AAAA,MAClC,MAAM,WAAW,KAAK,KAAK,EAAE,MAAM,YAAY;AAAA,MAC/C,IAAI,aAAa,QAAQ,SAAS,OAAO,WAAW;AAAA,QACnD,SAAS,IAAI,SAAS,GAAG,KAAK,CAAC;AAAA,MAChC;AAAA,IACD;AAAA,EACD;AAAA,EACA,OAAO,CAAC,GAAG,QAAQ;AAAA;AAQb,IAAM,qBAAqB,CACjC,KACA,UAAkC,CAAC,MACR;AAAA,EAC3B,MAAM,OAAO,IAAI,gBAAgB,GAAG;AAAA,EACpC,MAAM,YAAY,IAAI,KAAK,KAAK,SAAS,EAAE,QAAQ;AAAA,EACnD,MAAM,UAAU,IAAI,KAAK,KAAK,OAAO,EAAE,QAAQ;AAAA,EAC/C,MAAM,OAAO,QAAQ,OAAO,KAAK,KAAK;AAAA,EACtC,MAAM,gBAAgB,KAAK,OACzB,UAAU,QAAQ,KAAK,KAAK,KAAK,KACnC;AAAA,EACA,OAAO;AAAA,IACN;AAAA,IACA,SAAS,UAAU;AAAA,IACnB,QAAQ,KAAK;AAAA,IACb,UAAU,cAAc,IAAI;AAAA,IAC5B;AAAA,IACA;AAAA,EACD;AAAA;AAwDM,IAAM,mBAAmB,OAC/B,YAC4B;AAAA,EAC5B,MAAM,YAAY,QAAQ,0BAA0B;AAAA,EACpD,IAAI,YAAY,GAAG;AAAA,IAClB,MAAM,IAAI,MACT,0DACD;AAAA,EACD;AAAA,EAEA,IAAI,QAAQ,UAAU,MAAM;AAAA,IAC3B,MAAM,eAAc,MAAM,iBAAiB,OAAO;AAAA,IAClD,OAAO,EAAE,2BAAa,QAAQ,UAAU,SAAS,KAAK;AAAA,EACvD;AAAA,EAEA,IAAI,QAAQ,0BAA0B,WAAW;AAAA,IAChD,MAAM,eAAc,MAAM,iBAAiB,OAAO;AAAA,IAClD,OAAO,EAAE,2BAAa,QAAQ,mBAAmB,SAAS,KAAK;AAAA,EAChE;AAAA,EAEA,MAAM,QAAQ,QAAQ,OAAO,KAAK;AAAA,EAClC,MAAM,aAAa,mBAAmB,QAAQ,uBAAuB;AAAA,IACpE,KAAK;AAAA,EACN,CAAC;AAAA,EAED,IAAI,CAAC,WAAW,WAAW,WAAW,iBAAiB,WAAW;AAAA,IACjE,OAAO,EAAE,YAAY,QAAQ,eAAe,SAAS,MAAM;AAAA,EAC5D;AAAA,EAEA,MAAM,cAAc,MAAM,iBAAiB,OAAO;AAAA,EAClD,OAAO,EAAE,aAAa,QAAQ,iBAAiB,SAAS,KAAK;AAAA;",
-  "debugId": "6D2588C0F93BA9DA64756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA;AAQO,IAAM,yBACX;AACK,IAAM,sBACX;AAMF,IAAM,kBAAkB,CAAC,UAA4C;AAAA,EACnE,MAAM,MAAM,iBAAiB,aAAa,QAAQ,IAAI,WAAW,KAAK;AAAA,EACtE,IAAI,SAAS;AAAA,EACb,WAAW,QAAQ;AAAA,IAAK,UAAU,OAAO,aAAa,IAAI;AAAA,EAC1D,OAAO,KAAK,MAAM,EACf,WAAW,KAAK,GAAG,EACnB,WAAW,KAAK,GAAG,EACnB,WAAW,KAAK,EAAE;AAAA;AAGvB,IAAM,wBAAwB,CAAC,UAC7B,gBAAgB,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAEjD,IAAM,kBAAkB,CAAC,UAA8B;AAAA,EACrD,MAAM,SAAS,MACZ,WAAW,KAAK,GAAG,EACnB,WAAW,KAAK,GAAG,EACnB,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC,IAAI,GAAG,GAAG;AAAA,EAC9C,MAAM,SAAS,KAAK,MAAM;AAAA,EAC1B,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAAA,EAC1C,SAAS,QAAQ,EAAG,QAAQ,OAAO,QAAQ,SAAS,GAAG;AAAA,IACrD,MAAM,SAAS,OAAO,WAAW,KAAK;AAAA,EACxC;AAAA,EACA,OAAO;AAAA;AAOT,IAAM,YAAY,CAAC,WAA+B;AAAA,EAChD,IAAI,SAAS;AAAA,IAAM,OAAO,WAAW,KAAK,CAAC,MAAM,CAAC;AAAA,EAClD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,YAAY;AAAA,EAChB,OAAO,YAAY,GAAG;AAAA,IACpB,MAAM,QAAQ,YAAY,GAAI;AAAA,IAC9B,cAAc;AAAA,EAChB;AAAA,EACA,OAAO,WAAW,KAAK,CAAC,MAAO,MAAM,QAAQ,GAAG,KAAK,CAAC;AAAA;AAGxD,IAAM,SAAS,CAAC,KAAa,YAAoC;AAAA,EAC/D,MAAM,SAAS,UAAU,QAAQ,MAAM;AAAA,EACvC,MAAM,MAAM,IAAI,WAAW,IAAI,OAAO,SAAS,QAAQ,MAAM;AAAA,EAC7D,IAAI,KAAK;AAAA,EACT,IAAI,IAAI,QAAQ,CAAC;AAAA,EACjB,IAAI,IAAI,SAAS,IAAI,OAAO,MAAM;AAAA,EAClC,OAAO;AAAA;AAGT,IAAM,SAAS,CAAC,aAAuC;AAAA,EACrD,MAAM,QAAQ,SAAS,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,QAAQ,CAAC;AAAA,EACnE,MAAM,UAAU,IAAI,WAAW,KAAK;AAAA,EACpC,IAAI,SAAS;AAAA,EACb,WAAW,SAAS,UAAU;AAAA,IAC5B,QAAQ,IAAI,OAAO,MAAM;AAAA,IACzB,UAAU,MAAM;AAAA,EAClB;AAAA,EACA,OAAO,OAAO,IAAM,OAAO;AAAA;AAG7B,IAAM,SAAS,CAAC,aAAuC;AAAA,EACrD,MAAM,QAAQ,SAAS,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,QAAQ,CAAC;AAAA,EACnE,MAAM,UAAU,IAAI,WAAW,KAAK;AAAA,EACpC,IAAI,SAAS;AAAA,EACb,WAAW,SAAS,UAAU;AAAA,IAC5B,QAAQ,IAAI,OAAO,MAAM;AAAA,IACzB,UAAU,MAAM;AAAA,EAClB;AAAA,EACA,OAAO,OAAO,IAAM,OAAO;AAAA;AAG7B,IAAM,SAAS,CAAC,UAA2C;AAAA,EACzD,IAAI,OAAO,UAAU,UAAU;AAAA,IAE7B,IAAI,UAAU;AAAA,MAAG,OAAO,OAAO,GAAM,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC;AAAA,IACzD,MAAM,QAAkB,CAAC;AAAA,IACzB,IAAI,YAAY;AAAA,IAChB,OAAO,YAAY,GAAG;AAAA,MACpB,MAAM,QAAQ,YAAY,GAAI;AAAA,MAC9B,cAAc;AAAA,IAChB;AAAA,IACA,IAAK,MAAM,KAAgB;AAAA,MAAM,MAAM,QAAQ,CAAC;AAAA,IAChD,OAAO,OAAO,GAAM,WAAW,KAAK,KAAK,CAAC;AAAA,EAC5C;AAAA,EAGA,IAAI,QAAQ;AAAA,EACZ,OAAO,QAAQ,MAAM,SAAS,KAAK,MAAM,WAAW;AAAA,IAAG,SAAS;AAAA,EAChE,IAAI,UAAU,MAAM,SAAS,KAAK;AAAA,EAClC,IAAK,QAAQ,KAAgB,KAAM;AAAA,IACjC,MAAM,SAAS,IAAI,WAAW,QAAQ,SAAS,CAAC;AAAA,IAChD,OAAO,IAAI,SAAS,CAAC;AAAA,IACrB,UAAU;AAAA,EACZ;AAAA,EACA,OAAO,OAAO,GAAM,OAAO;AAAA;AAG7B,IAAM,SAAS,CAAC,QAA4B;AAAA,EAC1C,MAAM,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,OAAO,SAAS,MAAM,EAAE,CAAC;AAAA,EACpE,MAAM,QAAQ,MAAM;AAAA,EACpB,MAAM,SAAS,MAAM;AAAA,EACrB,IAAI,UAAU,aAAa,WAAW,WAAW;AAAA,IAC/C,MAAM,IAAI,MAAM,6BAA6B,KAAK;AAAA,EACpD;AAAA,EACA,MAAM,QAAkB,CAAC,QAAQ,KAAK,MAAM;AAAA,EAC5C,SAAS,QAAQ,EAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AAAA,IACpD,MAAM,QAAQ,MAAM;AAAA,IACpB,MAAM,SAAmB,CAAC;AAAA,IAC1B,IAAI,YAAY;AAAA,IAChB,GAAG;AAAA,MACD,OAAO,QAAQ,YAAY,GAAI;AAAA,MAC/B,cAAc;AAAA,IAChB,SAAS,YAAY;AAAA,IACrB,SAAS,aAAa,EAAG,aAAa,OAAO,SAAS,GAAG,cAAc,GAAG;AAAA,MACxE,OAAO,cAAe,OAAO,cAAyB;AAAA,IACxD;AAAA,IACA,MAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EACA,OAAO,OAAO,GAAM,WAAW,KAAK,KAAK,CAAC;AAAA;AAM5C,IAAM,gBAAgB,CAAC,UACrB,OAAO,IAAM,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAK9C,IAAM,iBAAiB,CAAC,YACtB,OAAO,GAAM,OAAO;AAEtB,IAAM,eAAe,CAAC,YAAoC;AAAA,EAGxD,MAAM,OAAO,IAAI,WAAW,QAAQ,SAAS,CAAC;AAAA,EAC9C,KAAK,KAAK;AAAA,EACV,KAAK,IAAI,SAAS,CAAC;AAAA,EACnB,OAAO,OAAO,GAAM,IAAI;AAAA;AAG1B,IAAM,gBAAgB,CACpB,KACA,SACA,cAAc,SACC,OAAO,MAAO,OAAO,cAAc,IAAI,MAAQ,OAAO;AAMvE,IAAM,gBAAgB,CAAC,WAAmC;AAAA,EACxD,MAAM,OAAO,OAAO,SAAS;AAAA,EAC7B,MAAM,IAAI,OAAO,SAAS,GAAG,IAAI;AAAA,EACjC,MAAM,IAAI,OAAO,SAAS,IAAI;AAAA,EAC9B,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;AAAA;AAqBtC,IAAM,UAAU,OACd,YACA,QACA,YACqB;AAAA,EACrB,MAAM,kBAAkB,sBAAsB,KAAK,UAAU,MAAM,CAAC;AAAA,EACpE,MAAM,iBACJ,YAAY,KACR,KACA,sBAAsB,KAAK,UAAU,OAAO,CAAC;AAAA,EACnD,MAAM,eAAe,IAAI,YAAY,EAAE,OACrC,GAAG,mBAAmB,gBACxB;AAAA,EACA,MAAM,SAAS,IAAI,WACjB,MAAM,OAAO,OAAO,KAClB,EAAE,MAAM,WAAW,MAAM,QAAQ,GACjC,YACA,YACF,CACF;AAAA,EACA,OAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW;AAAA,IACX,WAAW,gBAAgB,MAAM;AAAA,EACnC;AAAA;AAOF,IAAM,kBAAkB,OAAO,cAA8C;AAAA,EAC3E,MAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,SAAS;AAAA,EAG1D,OAAO;AAAA,IACL,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,GAAG,IAAI;AAAA,IACP,GAAG,IAAI;AAAA,EACT;AAAA;AAGF,IAAM,gBAAgB,OAAO,cAA2C;AAAA,EAEtE,MAAM,YAAY,KAAK,UAAU;AAAA,IAC/B,KAAK,UAAU;AAAA,IACf,KAAK,UAAU;AAAA,IACf,GAAG,UAAU;AAAA,IACb,GAAG,UAAU;AAAA,EACf,CAAC;AAAA,EACD,MAAM,OAAO,MAAM,OAAO,OAAO,OAC/B,WACA,IAAI,YAAY,EAAE,OAAO,SAAS,CACpC;AAAA,EACA,OAAO,gBAAgB,IAAI;AAAA;AAmBtB,IAAM,qBAAqB,YAAkC;AAAA,EAClE,MAAM,MAAM,MAAM,OAAO,OAAO,YAC9B,EAAE,MAAM,SAAS,YAAY,QAAQ,GACrC,MACA,CAAC,QAAQ,QAAQ,CACnB;AAAA,EACA,OAAO,EAAE,IAAI;AAAA;AAGR,IAAM,gBAAgB,OAC3B,YAC6B;AAAA,EAC7B,MAAM,YAAY,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,IAAI,SAAS;AAAA,EAC5E,MAAM,aAAa,MAAM,OAAO,OAAO,UACrC,OACA,QAAQ,IAAI,UACd;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,OACI,QAAQ,QAAQ,YAAY,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,EAC1D;AAAA;AAGK,IAAM,gBAAgB,OAC3B,SACyB;AAAA,EACzB,MAAM,YAAY,MAAM,OAAO,OAAO,UACpC,OACA,KAAK,WACL,EAAE,MAAM,SAAS,YAAY,QAAQ,GACrC,MACA,CAAC,QAAQ,CACX;AAAA,EACA,MAAM,aAAa,MAAM,OAAO,OAAO,UACrC,OACA,KAAK,YACL,EAAE,MAAM,SAAS,YAAY,QAAQ,GACrC,MACA,CAAC,MAAM,CACT;AAAA,EACA,OAAO;AAAA,IACL,KAAK,EAAE,YAAY,UAAU;AAAA,OACzB,KAAK,QAAQ,YAAY,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC;AAAA,EACpD;AAAA;AAOF,IAAM,oBAAoB,CAAC,YAAkC;AAAA,EAE3D,MAAM,eAAe,QAAQ,IAAI,CAAC,WAChC,OAAO,KAAM,IAAI,YAAY,EAAE,OAAO,MAAM,CAAC,CAC/C;AAAA,EACA,MAAM,cAAc,OAAO,YAAY;AAAA,EACvC,MAAM,iBAAiB,eAAe,WAAW;AAAA,EACjD,OAAO,OAAO,CAAC,OAAO,WAAW,GAAG,cAAc,CAAC;AAAA;AAGrD,IAAM,iCAAiC,CAAC,YAAkC;AAAA,EACxE,MAAM,aAAa,OAAO,CAAC,kBAAkB,OAAO,CAAC,CAAC;AAAA,EACtD,OAAO,OAAO;AAAA,IACZ,OAAO,uBAAuB;AAAA,IAC9B,OAAO,CAAC,UAAU,CAAC;AAAA,EACrB,CAAC;AAAA;AAGH,IAAM,sBAAsB,YAC1B,OAAO,OAAO,YAAY,EAAE,MAAM,SAAS,YAAY,QAAQ,GAAG,MAAM;AAAA,EACtE;AAAA,EACA;AACF,CAAC;AAEH,IAAM,WAAW,OACf,SACA,YACwB;AAAA,EACxB,IAAI,QAAQ,WAAW,GAAG;AAAA,IACxB,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EACA,MAAM,aAAa,QAAQ;AAAA,EAE3B,MAAM,UAAU,IAAI,WAClB,MAAM,OAAO,OAAO,UAAU,QAAQ,QAAQ,SAAS,CACzD;AAAA,EAEA,MAAM,UAAU,OAAO,CAAC;AAAA,EACxB,MAAM,UAAU,OAAO;AAAA,IACrB,OAAO;AAAA,MACL,OAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,cAAc,UAAU;AAAA,MAC1B,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AAAA,EAED,MAAM,aAAa,cAAc,GAAG,+BAA+B,OAAO,CAAC;AAAA,EAE3E,MAAM,2BAA2B,OAAO;AAAA,IACtC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EAED,MAAM,SAAS,IAAI,WACjB,MAAM,OAAO,OAAO,KAClB,EAAE,MAAM,WAAW,MAAM,QAAQ,GACjC,QAAQ,YACR,wBACF,CACF;AAAA,EACA,MAAM,SAAS,cAAc,MAAM;AAAA,EAEnC,MAAM,eAAe,OAAO,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAAA,EAE3D,MAAM,gBAAgB,aAAa,MAAM;AAAA,EAEzC,OAAO,OAAO,CAAC,0BAA0B,cAAc,aAAa,CAAC;AAAA;AAOvE,IAAM,WAAW,CAAC,OAAe,QAA4B;AAAA,EAC3D,MAAM,MAAM,KAAK,OAAO,aAAa,GAAG,GAAG,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,MAAM,UAAU,KAAK,CAAC;AAAA,EACxC,OAAO,cAAc;AAAA,EAAe,MAAM,KAAK;AAAA,CAAI;AAAA,WAAe;AAAA;AAAA;AAGpE,IAAM,wBAAwB,OAC5B,YACoB;AAAA,EACpB,MAAM,QAAQ,IAAI,WAChB,MAAM,OAAO,OAAO,UAAU,SAAS,QAAQ,UAAU,CAC3D;AAAA,EACA,OAAO,SAAS,eAAe,KAAK;AAAA;AAAA;AAwF/B,MAAM,kBAAkB,MAAM;AAAA,EAC1B;AAAA,EACA;AAAA,EACT,WAAW,CAAC,SAAiB,QAAgB,MAAe;AAAA,IAC1D,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,KAAK,SAAS;AAAA,IACd,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,eAAe,CAAC,OACpB,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAE3C,IAAM,mBAAmB,OAC9B,YAC+B;AAAA,EAC/B,MAAM,MAAM,QAAQ,UAAU,MAAM;AAAA,EACpC,MAAM,QAAQ,QAAQ,SAAS;AAAA,EAC/B,MAAM,UAAU,QAAQ,SAAS;AAAA,EACjC,MAAM,eAAe,QAAQ,gBAAgB;AAAA,EAC7C,MAAM,SAAS,QAAQ,kBAAkB;AAAA,EACzC,MAAM,WAAW,QAAQ,yBAAyB;AAAA,EAClD,MAAM,eAAe,QAAQ,kBAAkB,IAAI;AAAA,EACnD,MAAM,UAAU,QAAQ,WAAY,MAAM,mBAAmB;AAAA,EAE7D,IAAI,QAAQ,QAAQ,WAAW,GAAG;AAAA,IAChC,MAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AAAA,EAGA,IAAI,iCAAiC,cAAc;AAAA,EACnD,MAAM,oBAAoB,MAAM,QAAQ,YAAY;AAAA,EACpD,IAAI,CAAC,kBAAkB,IAAI;AAAA,IACzB,MAAM,IAAI,UACR,mCAAmC,kBAAkB,UACrD,kBAAkB,QAClB,MAAM,kBAAkB,KAAK,CAC/B;AAAA,EACF;AAAA,EACA,MAAM,YAAa,MAAM,kBAAkB,KAAK;AAAA,EAGhD,IAAI,QAAQ,MAAM,WAAW,SAAS,UAAU,QAAQ;AAAA,EAGxD,MAAM,OAAO,OACX,KACA,SACA,mBACiE;AAAA,IACjE,MAAM,SAAoB;AAAA,MACxB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,SACI,eAAe,QAAQ,YAAY,EAAE,KAAK,eAAe,IAAI,IAAI,CAAC;AAAA,SAClE,eAAe,QAAQ,YAAY,EAAE,KAAK,eAAe,IAAI,IAAI,CAAC;AAAA,IACxE;AAAA,IACA,MAAM,MAAM,MAAM,QAAQ,QAAQ,IAAI,YAAY,QAAQ,OAAO;AAAA,IACjE,MAAM,WAAW,MAAM,QAAQ,KAAK;AAAA,MAClC,MAAM,KAAK,UAAU,GAAG;AAAA,MACxB,SAAS,EAAE,gBAAgB,wBAAwB;AAAA,MACnD,QAAQ;AAAA,IACV,CAAC;AAAA,IACD,MAAM,WAAW,SAAS,QAAQ,IAAI,cAAc;AAAA,IACpD,IAAI,aAAa;AAAA,MAAM,QAAQ;AAAA,IAC/B,MAAM,OAAO,MAAM,SAAS,KAAK;AAAA,IACjC,MAAM,OACJ,KAAK,SAAS,KAAK,SAAS,QAAQ,IAAI,cAAc,GAAG,SAAS,MAAM,IACpE,KAAK,MAAM,IAAI,IACf;AAAA,IACN,IAAI,CAAC,SAAS,IAAI;AAAA,MAChB,MAAM,IAAI,UACR,QAAQ,cAAQ,SAAS,UACzB,SAAS,QACT,IACF;AAAA,IACF;AAAA,IACA,OAAO,EAAE,MAAM,SAAS,SAAS,SAAS,QAAQ,SAAS,OAAO;AAAA;AAAA,EAIpE,MAAM,YAAY,MAAM,gBAAgB,QAAQ,IAAI,SAAS;AAAA,EAC7D,IAAI,QAAQ,QAAQ,WAAW;AAAA,IAC7B,IAAI,sCAAsC,QAAQ,OAAO;AAAA,IACzD,MAAM,SAAS,MAAM,KACnB,UAAU,YACV;AAAA,MACE,SAAS,CAAC,UAAU,QAAQ,OAAO;AAAA,MACnC,sBAAsB;AAAA,IACxB,GACA,EAAE,KAAK,UAAU,CACnB;AAAA,IACA,QAAQ,MAAM,OAAO,QAAQ,IAAI,UAAU,KAAK;AAAA,IAChD,IAAI,QAAQ,QAAQ,WAAW;AAAA,MAC7B,MAAM,IAAI,MACR,+DACF;AAAA,IACF;AAAA,IACA,IAAI,6BAA6B,QAAQ,KAAK;AAAA,EAChD,EAAO;AAAA,IACL,IAAI,yBAAyB,QAAQ,KAAK;AAAA;AAAA,EAG5C,MAAM,aAAa,QAAQ;AAAA,EAG3B,IAAI,8BAA8B,QAAQ,QAAQ,KAAK,IAAI,GAAG;AAAA,EAC9D,MAAM,cAAc,MAAM,KACxB,UAAU,UACV;AAAA,IACE,aAAa,QAAQ,QAAQ,IAAI,CAAC,YAAY;AAAA,MAC5C,MAAM;AAAA,MACN,OAAO;AAAA,IACT,EAAE;AAAA,EACJ,GACA,EAAE,KAAK,WAAW,CACpB;AAAA,EACA,IAAI,QAAQ,YAAY;AAAA,EACxB,MAAM,WAAW,YAAY,QAAQ,IAAI,UAAU;AAAA,EACnD,IAAI,aAAa,MAAM;AAAA,IACrB,MAAM,IAAI,MACR,6DACF;AAAA,EACF;AAAA,EAGA,MAAM,WAAuC,CAAC;AAAA,EAC9C,MAAM,aAID,CAAC;AAAA,EAEN,IAAI;AAAA,IACF,MAAM,aAAa,MAAM,cAAc,SAAS;AAAA,IAEhD,WAAW,WAAW,MAAM,gBAAgB;AAAA,MAC1C,MAAM,aAAa,MAAM,KAAK,SAAS,IAAI,EAAE,KAAK,WAAW,CAAC;AAAA,MAC9D,MAAM,OAAO,WAAW;AAAA,MACxB,MAAM,YAAY,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AAAA,MACjE,IAAI,cAAc,WAAW;AAAA,QAC3B,MAAM,IAAI,MACR,wCAAwC,KAAK,WAAW,OAC1D;AAAA,MACF;AAAA,MACA,MAAM,mBAAmB,GAAG,UAAU,SAAS;AAAA,MAC/C,MAAM,WAAW,IAAI,WACnB,MAAM,OAAO,OAAO,OAClB,WACA,IAAI,YAAY,EAAE,OAAO,gBAAgB,CAC3C,CACF;AAAA,MACA,MAAM,WAAW,gBAAgB,QAAQ;AAAA,MACzC,MAAM,aAAa,mBAAmB,KAAK,WAAW;AAAA,MACtD,MAAM,qBACJ,QAAQ,wBAAwB;AAAA,QAC9B,QAAQ,KAAK,WAAW;AAAA,QACxB;AAAA,MACF,CAAC,KAAK;AAAA,MACR,IAAI,mBAAmB,KAAK,EAAE,WAAW,GAAG;AAAA,QAC1C,MAAM,IAAI,MACR,0DACF;AAAA,MACF;AAAA,MACA,IACE,uBAAuB,aACnB,yBAAyB,iBAAiB,cAC1C,mCAAmC,0BAA0B,iBAAiB,WACpF;AAAA,MACA,MAAM,SAAS,MAAM,QAAQ,YAAY,OAAO;AAAA,QAC9C,SAAS;AAAA,QACT,MAAM;AAAA,QACN,KAAK;AAAA,QACL,MAAM;AAAA,MACR,CAAC;AAAA,MACD,WAAW,KAAK;AAAA,QACd,UAAU,OAAO;AAAA,QACjB,YAAY;AAAA,QACZ,aAAa;AAAA,MACf,CAAC;AAAA,MACD,SAAS,KAAK,MAAM,QAAQ,YAAY,OAAO,OAAO,EAAE,CAAC;AAAA,MAEzD,IAAI,QAAQ,uBAAuB,WAAW;AAAA,QAC5C,IAAI,0DAAoD;AAAA,QACxD,MAAM,WAAW,KAAK,IAAI,IAAI;AAAA,QAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;AAAA,UAC5B,IAAI,MAAM,QAAQ,mBAAmB,YAAY,QAAQ;AAAA,YAAG;AAAA,UAC5D,MAAM,MAAM,MAAM;AAAA,QACpB;AAAA,MACF,EAAO;AAAA,QACL,IAAI,kBAAkB,gCAAgC;AAAA,QACtD,MAAM,MAAM,QAAQ;AAAA;AAAA,MAGtB,IACE,gDAAgD,KAAK,WAAW,OAClE;AAAA,MACA,MAAM,KAAK,UAAU,KAAK,CAAC,GAAG,EAAE,KAAK,WAAW,CAAC;AAAA,MAGjD,MAAM,eAAe,KAAK,IAAI,IAAI;AAAA,MAClC,OAAO,KAAK,IAAI,IAAI,cAAc;AAAA,QAChC,MAAM,eAAe,MAAM,KAAK,SAAS,IAAI,EAAE,KAAK,WAAW,CAAC;AAAA,QAChE,MAAM,SAAS,aAAa;AAAA,QAC5B,IAAI,OAAO,WAAW;AAAA,UAAS;AAAA,QAC/B,IAAI,OAAO,WAAW,WAAW;AAAA,UAC/B,MAAM,IAAI,MACR,yCAAyC,KAAK,WAAW,UAAU,KAAK,UAAU,OAAO,UAAU,GACrG;AAAA,QACF;AAAA,QACA,MAAM,MAAM,MAAM;AAAA,MACpB;AAAA,IACF;AAAA,IAGA,IAAI,qCAAqC;AAAA,IACzC,MAAM,UAAU,MAAM,oBAAoB;AAAA,IAC1C,MAAM,SAAS,MAAM,SAAS,QAAQ,SAAS,OAAO;AAAA,IACtD,MAAM,MAAM,gBAAgB,MAAM;AAAA,IAElC,MAAM,KAAK,MAAM,UAAU,EAAE,IAAI,GAAG,EAAE,KAAK,WAAW,CAAC;AAAA,IAGvD,MAAM,gBAAgB,KAAK,IAAI,IAAI;AAAA,IACnC,OAAO,KAAK,IAAI,IAAI,eAAe;AAAA,MACjC,MAAM,YAAY,MAAM,KAAK,UAAU,IAAI,EAAE,KAAK,WAAW,CAAC;AAAA,MAC9D,QAAQ,UAAU;AAAA,MAClB,IAAI,MAAM,WAAW,WAAW,MAAM,gBAAgB;AAAA,QAAW;AAAA,MACjE,IAAI,MAAM,WAAW,WAAW;AAAA,QAC9B,MAAM,IAAI,MAAM,8BAA8B,KAAK,UAAU,KAAK,GAAG;AAAA,MACvE;AAAA,MACA,MAAM,MAAM,MAAM;AAAA,IACpB;AAAA,IAEA,IAAI,MAAM,gBAAgB,WAAW;AAAA,MACnC,MAAM,IAAI,MACR,yDACF;AAAA,IACF;AAAA,IAGA,IAAI,sCAAsC,MAAM,aAAa;AAAA,IAC7D,MAAM,aAAa,MAAM,KAAK,MAAM,aAAa,IAAI,EAAE,KAAK,WAAW,CAAC;AAAA,IACxE,MAAM,iBACJ,OAAO,WAAW,SAAS,WACvB,WAAW,OACX,OAAO,WAAW,IAAI;AAAA,IAE5B,MAAM,gBAAgB,MAAM,sBAAsB,OAAO;AAAA,IAEzD,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,SAAS,QAAQ;AAAA,MACjB;AAAA,IACF;AAAA,YACA;AAAA,IACA,WAAW,WAAW,UAAU;AAAA,MAC9B,IAAI;AAAA,QACF,MAAM,QAAQ;AAAA,QACd,OAAO,OAAO;AAAA,QACd,IAAI,sCAAsC,OAAO,KAAK,GAAG;AAAA;AAAA,IAE7D;AAAA;AAAA;AAMJ,IAAM,aAAa,OACjB,SACA,QACoB;AAAA,EACpB,MAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,QAAQ,OAAO,CAAC;AAAA,EACtD,MAAM,QAAQ,SAAS,QAAQ,IAAI,cAAc;AAAA,EACjD,IAAI,UAAU,MAAM;AAAA,IAClB,MAAM,IAAI,MACR,4DACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAsBT,IAAM,mBAAmB,OACvB,QACA,YACA,aACkB;AAAA,EAClB,MAAM,UAAU,SAAS,WAAW,KAAK,OAAO;AAAA,EAChD,MAAM,OAAO,KAAK,wBAAwB,eAAe;AAAA,EACzD,MAAM,OAAO,KACX,UAAU;AAAA,EAAoC;AAAA,CAChD;AAAA;AAQK,IAAM,YAAY;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMO,IAAM,6BAA6B,OACxC,QACA,MACA,UAAqC,CAAC,MACa;AAAA,EACnD,MAAM,SAAS,KAAK,QAAQ;AAAA,EAC5B,IAAI,WAAW,WAAW;AAAA,IACxB,MAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAAA,EACA,MAAM,WAAW,QAAQ,YAAY,YAAY;AAAA,EACjD,MAAM,UAAU,QAAQ,WAAW,YAAY;AAAA,EAC/C,MAAM,OAAO,QAAQ,QAAQ;AAAA,EAC7B,MAAM,SAAS,QAAQ,aAAa;AAAA,EAEpC,MAAM,OAAO,QAAQ,UAAU,KAAK,cAAc;AAAA,EAClD,MAAM,OAAO,QAAQ,SAAS,KAAK,aAAa;AAAA,EAChD,MAAM,OAAO,KAAK,SAAS,SAAS,cAAc,UAAU;AAAA,EAC5D,IAAI,QAAQ,UAAU,WAAW;AAAA,IAC/B,MAAM,OAAO,KAAK,SAAS,QAAQ,UAAU,cAAc,UAAU;AAAA,EACvE;AAAA,EACA,IAAI,QAAQ,WAAW,WAAW;AAAA,IAChC,MAAM,OAAO,KAAK,QAAQ,MAAM;AAAA,EAClC;AAAA,EAEA,OAAO,EAAE,UAAU,QAAQ;AAAA;AAsB7B,IAAM,gBAAgB,CAAC,SAAoC;AAAA,EACzD,MAAM,WAAW,IAAI;AAAA,EACrB,MAAM,UAAU,KAAK,QAAQ,MAAM,cAAc;AAAA,EACjD,IAAI,YAAY,QAAQ,QAAQ,OAAO,WAAW;AAAA,IAChD,SAAS,IAAI,QAAQ,GAAG,KAAK,CAAC;AAAA,EAChC;AAAA,EACA,MAAM,MAAM,KAAK;AAAA,EACjB,IAAI,QAAQ,aAAa,QAAQ,MAAM;AAAA,IACrC,WAAW,QAAQ,IAAI,MAAM,GAAG,GAAG;AAAA,MACjC,MAAM,WAAW,KAAK,KAAK,EAAE,MAAM,YAAY;AAAA,MAC/C,IAAI,aAAa,QAAQ,SAAS,OAAO,WAAW;AAAA,QAClD,SAAS,IAAI,SAAS,GAAG,KAAK,CAAC;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO,CAAC,GAAG,QAAQ;AAAA;AAQd,IAAM,qBAAqB,CAChC,KACA,UAAkC,CAAC,MACT;AAAA,EAC1B,MAAM,OAAO,IAAI,gBAAgB,GAAG;AAAA,EACpC,MAAM,YAAY,IAAI,KAAK,KAAK,SAAS,EAAE,QAAQ;AAAA,EACnD,MAAM,UAAU,IAAI,KAAK,KAAK,OAAO,EAAE,QAAQ;AAAA,EAC/C,MAAM,OAAO,QAAQ,OAAO,KAAK,KAAK;AAAA,EACtC,MAAM,gBAAgB,KAAK,OAAO,UAAU,QAAQ,KAAK,KAAK,KAAK,KAAK;AAAA,EACxE,OAAO;AAAA,IACL;AAAA,IACA,SAAS,UAAU;AAAA,IACnB,QAAQ,KAAK;AAAA,IACb,UAAU,cAAc,IAAI;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AAAA;AAwDK,IAAM,mBAAmB,OAC9B,YAC2B;AAAA,EAC3B,MAAM,YAAY,QAAQ,0BAA0B;AAAA,EACpD,IAAI,YAAY,GAAG;AAAA,IACjB,MAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAAA,EAEA,IAAI,QAAQ,UAAU,MAAM;AAAA,IAC1B,MAAM,eAAc,MAAM,iBAAiB,OAAO;AAAA,IAClD,OAAO,EAAE,2BAAa,QAAQ,UAAU,SAAS,KAAK;AAAA,EACxD;AAAA,EAEA,IAAI,QAAQ,0BAA0B,WAAW;AAAA,IAC/C,MAAM,eAAc,MAAM,iBAAiB,OAAO;AAAA,IAClD,OAAO,EAAE,2BAAa,QAAQ,mBAAmB,SAAS,KAAK;AAAA,EACjE;AAAA,EAEA,MAAM,QAAQ,QAAQ,OAAO,KAAK;AAAA,EAClC,MAAM,aAAa,mBAAmB,QAAQ,uBAAuB;AAAA,IACnE,KAAK;AAAA,EACP,CAAC;AAAA,EAED,IAAI,CAAC,WAAW,WAAW,WAAW,iBAAiB,WAAW;AAAA,IAChE,OAAO,EAAE,YAAY,QAAQ,eAAe,SAAS,MAAM;AAAA,EAC7D;AAAA,EAEA,MAAM,cAAc,MAAM,iBAAiB,OAAO;AAAA,EAClD,OAAO,EAAE,aAAa,QAAQ,iBAAiB,SAAS,KAAK;AAAA;",
+  "debugId": "E1547F90274E984D64756E2164756E21",
   "names": []
 }

package/dist/vultr.d.ts

@@ -8,16 +8,16 @@
  * Vultr and referenced by UUID — different from Linode (raw keys)
  * and DO/Hetzner (fingerprints/ids/names).
  */
-import type { Target } from './targets';
+import type { Target } from "./targets";
 export type VultrClientLike = {
-    request: <T = unknown>(method: 'GET' | 'POST' | 'DELETE' | 'PATCH', path: string, body?: unknown) => Promise<T>;
+    request: <T = unknown>(method: "GET" | "POST" | "DELETE" | "PATCH", path: string, body?: unknown) => Promise<T>;
 };
 /** A Vultr instance, narrowed to what we inspect. */
 export type VultrInstance = {
     id: string;
     label: string;
-    status: 'active' | 'pending' | 'suspended' | 'resizing';
-    power_status?: 'running' | 'stopped' | 'starting';
+    status: "active" | "pending" | "suspended" | "resizing";
+    power_status?: "running" | "stopped" | "starting";
     server_status?: string;
     main_ip: string;
     internal_ip?: string;

package/dist/vultr.js

@@ -199,7 +199,13 @@ var sshTarget = (options) => {
         }
         return;
       }
-      const argv = ["scp", "-r", ...sshBaseFlags(options), localPath, `${remote}:${remotePath}`];
+      const argv = [
+        "scp",
+        "-r",
+        ...sshBaseFlags(options),
+        localPath,
+        `${remote}:${remotePath}`
+      ];
       const result = await runSpawn(argv, { timeoutMs: 600000 });
       if (result.exitCode !== 0) {
         throw new Error(`scp upload failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`);
@@ -449,5 +455,5 @@ export {
   VultrError
 };
 
-//# debugId=286A0E555C5A4E1A64756E2164756E21
+//# debugId=64197F9EAB115CA564756E2164756E21
 //# sourceMappingURL=vultr.js.map

package/dist/vultr.js.map

@@ -2,11 +2,11 @@
   "version": 3,
   "sources": ["../src/targets.ts", "../src/cloudTarget.ts", "../src/vultr.ts"],
   "sourcesContent": [
-    "/**\n * Target interface + bundled adapters (localTarget, sshTarget).\n *\n * A Target is the narrowest abstraction over \"a place I can deploy to\":\n *\n *   - `exec(cmd, opts?)` — run a shell command, capture stdout/stderr/exitCode.\n *   - `upload(localPath, remotePath, opts?)` — copy a local file or directory\n *     to the target. Implementation is free to use whatever is fast (rsync,\n *     scp, mv).\n *   - `close?()` — optional teardown.\n *\n * Two adapters are bundled:\n *\n *   - `localTarget` runs in a temp directory on the local filesystem. Useful\n *     for tests and for \"deploy\" workflows that happen on the same host.\n *   - `sshTarget` shells out to the system `ssh` and `rsync` binaries. No\n *     `ssh2` npm dependency — the controller machine just needs `ssh` and\n *     (optionally) `rsync` in PATH, which is universal on Mac/Linux/WSL.\n *\n * Provider-specific targets (Cloudflare Workers HTTP API, Fly Machines API,\n * AWS Fargate) don't fit \"exec + upload\" and ship as siblings later.\n */\n\nimport { mkdir } from 'node:fs/promises';\nimport { join } from 'node:path';\n\nexport type ExecOptions = {\n\t/** Working directory on the target. Default: target's root. */\n\tcwd?: string;\n\t/** Env vars to set for this command (merged onto target.env). */\n\tenv?: Record<string, string>;\n\t/** Hard kill after this many ms. Default 600_000 (10 min). 0 disables. */\n\ttimeoutMs?: number;\n\t/** Pipe stdout/stderr through here as it streams (lines, newline-stripped). */\n\tonLog?: (line: string, stream: 'stdout' | 'stderr') => void;\n\t/** Stdin payload — a string is written verbatim. */\n\tstdin?: string;\n};\n\nexport type ExecResult = {\n\tstdout: string;\n\tstderr: string;\n\texitCode: number;\n};\n\nexport type UploadOptions = {\n\t/** Exclude paths matching these globs from a directory upload. */\n\texclude?: string[];\n\t/** When uploading a directory, delete remote files not present locally. */\n\tdeleteOrphans?: boolean;\n};\n\nexport type Target = {\n\t/** Human-readable description (e.g. \"ssh root@droplet-1.example.com\"). */\n\treadonly description: string;\n\texec: (cmd: string, opts?: ExecOptions) => Promise<ExecResult>;\n\tupload: (localPath: string, remotePath: string, opts?: UploadOptions) => Promise<void>;\n\tclose?: () => Promise<void>;\n};\n\n// -----------------------------------------------------------------------------\n// localTarget\n// -----------------------------------------------------------------------------\n\nexport type LocalTargetOptions = {\n\t/** Root directory the target operates in. Created if missing. */\n\troot: string;\n\t/** Env merged into every exec. */\n\tenv?: Record<string, string>;\n};\n\nconst decodeChunks = async (\n\treader: ReadableStream<Uint8Array> | null,\n\tonLine: ((line: string) => void) | undefined,\n): Promise<string> => {\n\tif (!reader) return '';\n\tconst decoder = new TextDecoder();\n\tlet buffer = '';\n\tlet collected = '';\n\tconst stream = reader.getReader();\n\ttry {\n\t\twhile (true) {\n\t\t\tconst { done, value } = await stream.read();\n\t\t\tif (done) break;\n\t\t\tconst chunk = decoder.decode(value, { stream: true });\n\t\t\tcollected += chunk;\n\t\t\tif (!onLine) continue;\n\t\t\tbuffer += chunk;\n\t\t\tlet newline = buffer.indexOf('\\n');\n\t\t\twhile (newline !== -1) {\n\t\t\t\tconst line = buffer.slice(0, newline).replace(/\\r$/, '');\n\t\t\t\tif (line.length > 0) onLine(line);\n\t\t\t\tbuffer = buffer.slice(newline + 1);\n\t\t\t\tnewline = buffer.indexOf('\\n');\n\t\t\t}\n\t\t}\n\t\tconst tail = decoder.decode();\n\t\tcollected += tail;\n\t\tif (onLine && (buffer + tail).length > 0) onLine((buffer + tail).replace(/\\r$/, ''));\n\t} finally {\n\t\tstream.releaseLock();\n\t}\n\treturn collected;\n};\n\nconst runSpawn = async (\n\targv: string[],\n\toptions: {\n\t\tcwd?: string;\n\t\tenv?: Record<string, string>;\n\t\ttimeoutMs?: number;\n\t\tonLog?: ExecOptions['onLog'];\n\t\tstdin?: string;\n\t},\n): Promise<ExecResult> => {\n\tconst proc = Bun.spawn(argv, {\n\t\tcwd: options.cwd,\n\t\tenv: options.env,\n\t\tstderr: 'pipe',\n\t\tstdin: options.stdin === undefined ? 'ignore' : 'pipe',\n\t\tstdout: 'pipe',\n\t});\n\n\tif (options.stdin !== undefined && proc.stdin) {\n\t\t// Bun.spawn returns a FileSink for piped stdin — `write` + `end`, not a\n\t\t// WritableStream. (We use a permissive cast because @types/bun's\n\t\t// Subprocess.stdin discriminant flips based on the stdin generic.)\n\t\tconst sink = proc.stdin as unknown as {\n\t\t\twrite: (chunk: string | Uint8Array) => number | Promise<number>;\n\t\t\tend: () => void | Promise<void>;\n\t\t};\n\t\tconst wrote = sink.write(options.stdin);\n\t\tif (wrote && typeof (wrote as Promise<number>).then === 'function') {\n\t\t\tawait wrote;\n\t\t}\n\t\tconst ended = sink.end();\n\t\tif (ended && typeof (ended as Promise<void>).then === 'function') {\n\t\t\tawait ended;\n\t\t}\n\t}\n\n\tconst timeout = options.timeoutMs ?? 600_000;\n\tlet timer: ReturnType<typeof setTimeout> | undefined;\n\tif (timeout > 0) {\n\t\ttimer = setTimeout(() => {\n\t\t\ttry { proc.kill(); } catch { /* already gone */ }\n\t\t}, timeout);\n\t}\n\n\tconst stdoutPromise = decodeChunks(\n\t\tproc.stdout as unknown as ReadableStream<Uint8Array>,\n\t\toptions.onLog ? (line) => options.onLog!(line, 'stdout') : undefined,\n\t);\n\tconst stderrPromise = decodeChunks(\n\t\tproc.stderr as unknown as ReadableStream<Uint8Array>,\n\t\toptions.onLog ? (line) => options.onLog!(line, 'stderr') : undefined,\n\t);\n\n\tconst [stdout, stderr, exitCode] = await Promise.all([\n\t\tstdoutPromise,\n\t\tstderrPromise,\n\t\tproc.exited,\n\t]);\n\tif (timer) clearTimeout(timer);\n\n\treturn { exitCode: exitCode ?? -1, stderr, stdout };\n};\n\nexport const localTarget = (options: LocalTargetOptions): Target => {\n\tconst baseEnv = { ...options.env };\n\tconst ensureRoot = async () => { await mkdir(options.root, { recursive: true }); };\n\n\treturn {\n\t\tdescription: `local ${options.root}`,\n\t\texec: async (cmd, opts) => {\n\t\t\tawait ensureRoot();\n\t\t\treturn runSpawn(['sh', '-c', cmd], {\n\t\t\t\tcwd: opts?.cwd ?? options.root,\n\t\t\t\tenv: { ...process.env, ...baseEnv, ...(opts?.env ?? {}) } as Record<string, string>,\n\t\t\t\tonLog: opts?.onLog,\n\t\t\t\tstdin: opts?.stdin,\n\t\t\t\ttimeoutMs: opts?.timeoutMs,\n\t\t\t});\n\t\t},\n\t\tupload: async (localPath, remotePath, opts) => {\n\t\t\tawait ensureRoot();\n\t\t\tconst dest = remotePath.startsWith('/') ? remotePath : join(options.root, remotePath);\n\t\t\tconst argv = ['rsync', '-a'];\n\t\t\tif (opts?.deleteOrphans) argv.push('--delete');\n\t\t\tfor (const pattern of opts?.exclude ?? []) argv.push('--exclude', pattern);\n\t\t\t// rsync semantics: a trailing slash on the source copies *contents*; without it the dir itself is nested.\n\t\t\targv.push(localPath, dest);\n\t\t\tconst result = await runSpawn(argv, { timeoutMs: 600_000 });\n\t\t\tif (result.exitCode !== 0) {\n\t\t\t\tthrow new Error(`local upload failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`);\n\t\t\t}\n\t\t},\n\t};\n};\n\n// -----------------------------------------------------------------------------\n// sshTarget\n// -----------------------------------------------------------------------------\n\nexport type SshTargetOptions = {\n\t/** Hostname or IP of the remote. */\n\thost: string;\n\t/** Login user. Default `root`. */\n\tuser?: string;\n\t/** SSH port. Default 22. */\n\tport?: number;\n\t/** Path to SSH identity file. Default: ssh's own search. */\n\tidentity?: string;\n\t/** Extra flags appended to every `ssh` invocation. */\n\tsshFlags?: string[];\n\t/**\n\t * Use rsync for `upload`. Default true. When false, falls back to `scp`\n\t * which is universal but doesn't support delete / exclude.\n\t */\n\trsync?: boolean;\n\t/**\n\t * Env vars to forward via `ssh -o SendEnv=...`. Most remote sshd configs\n\t * accept only `LANG` and `LC_*` by default; for app env vars use the\n\t * step `env` option instead, which prepends `KEY=value` to the command.\n\t */\n\tforwardEnv?: string[];\n};\n\nconst sshTargetString = (options: SshTargetOptions): string => {\n\tconst user = options.user ?? 'root';\n\treturn `${user}@${options.host}`;\n};\n\nconst sshBaseFlags = (options: SshTargetOptions): string[] => {\n\tconst flags: string[] = [];\n\tif (options.port !== undefined && options.port !== 22) flags.push('-p', String(options.port));\n\tif (options.identity !== undefined) flags.push('-i', options.identity);\n\t// Never get stuck on a host-key prompt; treat unknown hosts as a fatal config issue rather than a UX detour.\n\tflags.push('-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=accept-new');\n\tfor (const flag of options.sshFlags ?? []) flags.push(flag);\n\treturn flags;\n};\n\nconst shellQuote = (value: string): string => `'${value.replace(/'/g, `'\\\\''`)}'`;\n\nconst buildRemoteCmd = (cmd: string, opts: ExecOptions | undefined): string => {\n\tconst env = opts?.env;\n\tconst envPrefix = env\n\t\t? Object.entries(env).map(([k, v]) => `${k}=${shellQuote(v)}`).join(' ') + ' '\n\t\t: '';\n\tif (opts?.cwd) {\n\t\treturn `cd ${shellQuote(opts.cwd)} && ${envPrefix}${cmd}`;\n\t}\n\treturn `${envPrefix}${cmd}`;\n};\n\nexport const sshTarget = (options: SshTargetOptions): Target => {\n\tconst remote = sshTargetString(options);\n\tconst useRsync = options.rsync ?? true;\n\n\treturn {\n\t\tdescription: `ssh ${remote}${options.port && options.port !== 22 ? `:${options.port}` : ''}`,\n\t\texec: async (cmd, opts) => {\n\t\t\tconst argv = ['ssh', ...sshBaseFlags(options)];\n\t\t\tfor (const name of options.forwardEnv ?? []) argv.push('-o', `SendEnv=${name}`);\n\t\t\targv.push(remote, buildRemoteCmd(cmd, opts));\n\t\t\treturn runSpawn(argv, {\n\t\t\t\tonLog: opts?.onLog,\n\t\t\t\tstdin: opts?.stdin,\n\t\t\t\ttimeoutMs: opts?.timeoutMs,\n\t\t\t});\n\t\t},\n\t\tupload: async (localPath, remotePath, opts) => {\n\t\t\tif (useRsync) {\n\t\t\t\tconst sshCmd = ['ssh', ...sshBaseFlags(options)].map((part) => part.includes(' ') ? `'${part}'` : part).join(' ');\n\t\t\t\tconst argv = ['rsync', '-az', '-e', sshCmd];\n\t\t\t\tif (opts?.deleteOrphans) argv.push('--delete');\n\t\t\t\tfor (const pattern of opts?.exclude ?? []) argv.push('--exclude', pattern);\n\t\t\t\targv.push(localPath, `${remote}:${remotePath}`);\n\t\t\t\tconst result = await runSpawn(argv, { timeoutMs: 600_000 });\n\t\t\t\tif (result.exitCode !== 0) {\n\t\t\t\t\tthrow new Error(`rsync upload failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`);\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t// scp fallback — no exclude, no delete. We still need -r to copy directories.\n\t\t\tconst argv = ['scp', '-r', ...sshBaseFlags(options), localPath, `${remote}:${remotePath}`];\n\t\t\tconst result = await runSpawn(argv, { timeoutMs: 600_000 });\n\t\t\tif (result.exitCode !== 0) {\n\t\t\t\tthrow new Error(`scp upload failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`);\n\t\t\t}\n\t\t},\n\t};\n};\n",
-    "/**\n * Shared \"cloud-provider Target\" plumbing used by the\n * provider-specific adapters (`./digitalocean`, `./hetzner`, future\n * `./linode`, `./vultr`, etc.).\n *\n * The provider supplies a small `CloudTargetHooks` bag that knows\n * the provider's:\n *\n *   - find-by-name lookup\n *   - create call (closure over create params)\n *   - fetch-by-id (used to poll for `active`)\n *   - destroy-by-id\n *   - status + ipv4 + id extraction from the provider's Server shape\n *   - readiness predicate (status reached the terminal \"running\" value)\n *\n * `createCloudTarget()` does the universal machinery: provision-or-\n * reuse, poll until ready + IPv4, wait for SSH probe, build\n * `sshTarget` against the IPv4, return the Target wrapped with\n * `{ id, ipv4, destroy() }`.\n *\n * The public adapter (e.g. `digitalOceanTarget`) is a 30-line facade\n * that wires its provider-specific bits and renames `id` → `dropletId`\n * on the way out.\n */\n\nimport type { Target } from './targets';\nimport { sshTarget } from './targets';\n\n/** Provider-specific hooks. Keep these pure of network IO timing — the helper schedules. */\nexport type CloudTargetHooks<Server, Id = number> = {\n\t/** Find a server by name. Returns undefined if absent. */\n\tfindByName: (name: string) => Promise<Server | undefined>;\n\t/** Create the server. Closure over provider-specific create params. */\n\tcreate: () => Promise<Server>;\n\t/** Fetch a fresh copy of the server by id. Used to poll. */\n\tfetch: (id: Id) => Promise<Server>;\n\t/** Destroy a server by id. 404 should be treated as idempotent success. */\n\tdestroy: (id: Id) => Promise<void>;\n\t/** True when the server has reached its terminal \"running\" status. */\n\tisReady: (server: Server) => boolean;\n\t/** Extract the provider-assigned id (number for DO/Hetzner/Linode, string for Vultr). */\n\tgetId: (server: Server) => Id;\n\t/** Extract the public IPv4. Returns undefined while one is being assigned. */\n\tgetIpv4: (server: Server) => string | undefined;\n\t/** Extract the current status as a string (for log lines). */\n\tgetStatus: (server: Server) => string;\n};\n\nexport type CloudTargetOptions = {\n\t/** Provider's idempotency key (server name). */\n\tname: string;\n\t/** Region / location label — used in the \"creating\" log line. */\n\tregion: string;\n\n\t/** SSH login user. Default `'root'`. */\n\tuser?: string;\n\t/** SSH identity file. */\n\tidentity?: string;\n\t/** SSH port. Default 22. */\n\tport?: number;\n\n\t/** Default 5 min. */\n\tprovisionTimeoutMs?: number;\n\t/** Default 2 min. */\n\tsshReadinessTimeoutMs?: number;\n\t/** Default 5 s. */\n\tpollIntervalMs?: number;\n\n\t/** Called with status updates. */\n\tonLog?: (line: string) => void;\n\t/** Override SSH probe — tests skip real TCP IO. */\n\tprobeSsh?: (host: string, port: number) => Promise<boolean>;\n\t/** Override sleep — tests skip real waits. */\n\tsleep?: (ms: number) => Promise<void>;\n\t/** Override clock — tests inject deterministic timestamps. */\n\tnow?: () => number;\n\n\t/**\n\t * Short log prefix, e.g. `'[do]'` or `'[hetzner]'`. Threaded through\n\t * every log line so multi-provider deploys distinguish output.\n\t */\n\tlogPrefix: string;\n\t/**\n\t * Provider's word for the entity in log copy — `'droplet'` for DO,\n\t * `'server'` for Hetzner. Preserves provider-accurate output.\n\t */\n\tentityWord: string;\n\t/**\n\t * Build the Target's `description` field. Receives the resolved\n\t * IPv4 + the wrapped sshTarget description.\n\t */\n\tdescribeTarget: (sshDescription: string) => string;\n};\n\nexport type CloudTargetResult<Id = number> = {\n\tid: Id;\n\tipv4: string;\n\tdescription: string;\n\texec: Target['exec'];\n\tupload: Target['upload'];\n\tclose?: Target['close'];\n\tdestroy: () => Promise<void>;\n};\n\nconst defaultSleep = (ms: number): Promise<void> =>\n\tnew Promise((resolve) => setTimeout(resolve, ms));\n\nconst defaultProbeSsh = async (host: string, port: number): Promise<boolean> => {\n\tconst PROBE_TIMEOUT_MS = 2_000;\n\treturn new Promise<boolean>((resolve) => {\n\t\tlet settled = false;\n\t\tconst settle = (value: boolean) => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tresolve(value);\n\t\t};\n\t\tconst timer = setTimeout(() => settle(false), PROBE_TIMEOUT_MS);\n\t\tBun.connect({\n\t\t\thostname: host,\n\t\t\tport,\n\t\t\tsocket: {\n\t\t\t\tdata: () => {},\n\t\t\t\terror: () => {\n\t\t\t\t\tclearTimeout(timer);\n\t\t\t\t\tsettle(false);\n\t\t\t\t},\n\t\t\t\topen: (socket) => {\n\t\t\t\t\tclearTimeout(timer);\n\t\t\t\t\tsocket.end();\n\t\t\t\t\tsettle(true);\n\t\t\t\t}\n\t\t\t}\n\t\t}).catch(() => {\n\t\t\tclearTimeout(timer);\n\t\t\tsettle(false);\n\t\t});\n\t});\n};\n\n/**\n * The shared provision-or-reuse + wait-for-ready + wait-for-SSH\n * pipeline. Provider-specific adapters wire their `CloudTargetHooks`\n * + their option-shape mapping and return a typed result.\n */\nexport const createCloudTarget = async <Server, Id = number>(\n\thooks: CloudTargetHooks<Server, Id>,\n\toptions: CloudTargetOptions\n): Promise<CloudTargetResult<Id>> => {\n\tconst log = options.onLog ?? (() => {});\n\tconst probeSsh = options.probeSsh ?? defaultProbeSsh;\n\tconst sleep = options.sleep ?? defaultSleep;\n\tconst now = options.now ?? Date.now;\n\tconst pollMs = options.pollIntervalMs ?? 5_000;\n\tconst provisionTimeout = options.provisionTimeoutMs ?? 5 * 60_000;\n\tconst sshTimeout = options.sshReadinessTimeoutMs ?? 2 * 60_000;\n\tconst port = options.port ?? 22;\n\tconst prefix = options.logPrefix;\n\tconst noun = options.entityWord;\n\n\tconst existing = await hooks.findByName(options.name);\n\tlet current: Server;\n\tif (existing === undefined) {\n\t\tlog(`${prefix} creating ${noun} \"${options.name}\" in ${options.region}`);\n\t\tcurrent = await hooks.create();\n\t} else {\n\t\tlog(\n\t\t\t`${prefix} reusing ${noun} \"${options.name}\" (id ${hooks.getId(existing)}, status ${hooks.getStatus(existing)})`\n\t\t);\n\t\tcurrent = existing;\n\t}\n\n\t// Wait for status=ready AND public IPv4 assigned.\n\tconst provisionStart = now();\n\tlet ipv4 = hooks.getIpv4(current);\n\twhile (!hooks.isReady(current) || ipv4 === undefined) {\n\t\tif (now() - provisionStart > provisionTimeout) {\n\t\t\tthrow new Error(\n\t\t\t\t`${prefix} provision timeout after ${provisionTimeout}ms — ${noun} ${hooks.getId(current)} status \"${hooks.getStatus(current)}\", ipv4 ${ipv4 ?? '(unassigned)'}`\n\t\t\t);\n\t\t}\n\t\tawait sleep(pollMs);\n\t\tcurrent = await hooks.fetch(hooks.getId(current));\n\t\tipv4 = hooks.getIpv4(current);\n\t\tlog(\n\t\t\t`${prefix} poll: status=${hooks.getStatus(current)} ipv4=${ipv4 ?? '(none yet)'}`\n\t\t);\n\t}\n\tlog(`${prefix} ${noun} ready at ${ipv4}`);\n\n\t// Wait for SSH readiness.\n\tconst sshStart = now();\n\twhile (!(await probeSsh(ipv4, port))) {\n\t\tif (now() - sshStart > sshTimeout) {\n\t\t\tthrow new Error(\n\t\t\t\t`${prefix} SSH readiness timeout after ${sshTimeout}ms — ${ipv4}:${port} did not accept connections`\n\t\t\t);\n\t\t}\n\t\tawait sleep(pollMs);\n\t\tlog(`${prefix} waiting on ssh ${ipv4}:${port}`);\n\t}\n\tlog(`${prefix} ssh ready at ${ipv4}:${port}`);\n\n\tconst ssh = sshTarget({\n\t\thost: ipv4,\n\t\t...(options.user !== undefined ? { user: options.user } : {}),\n\t\t...(options.identity !== undefined ? { identity: options.identity } : {}),\n\t\t...(options.port !== undefined ? { port: options.port } : {})\n\t});\n\n\tconst id = hooks.getId(current);\n\tconst resolvedIpv4 = ipv4;\n\n\treturn {\n\t\tdescription: options.describeTarget(ssh.description),\n\t\tdestroy: () =>\n\t\t\thooks.destroy(id).then(() => {\n\t\t\t\tlog(`${prefix} destroyed ${noun} ${id}`);\n\t\t\t}),\n\t\texec: ssh.exec,\n\t\tid,\n\t\tipv4: resolvedIpv4,\n\t\tupload: ssh.upload,\n\t\t...(ssh.close !== undefined ? { close: ssh.close } : {})\n\t};\n};\n",
-    "/**\n * @absolutejs/deploy/vultr — provision-or-reuse Target adapter for\n * Vultr instances. Sibling to digitalOceanTarget + hetznerTarget +\n * linodeTarget; same shape, Vultr v2 API mappings.\n *\n * Idempotent by label. Vultr stores the public IP as `main_ip`\n * (single string, not an array). SSH keys are pre-registered with\n * Vultr and referenced by UUID — different from Linode (raw keys)\n * and DO/Hetzner (fingerprints/ids/names).\n */\n\nimport type { Target } from './targets';\nimport { createCloudTarget, type CloudTargetHooks } from './cloudTarget';\n\nconst VULTR_API_BASE = 'https://api.vultr.com/v2';\n\nexport type VultrClientLike = {\n\trequest: <T = unknown>(\n\t\tmethod: 'GET' | 'POST' | 'DELETE' | 'PATCH',\n\t\tpath: string,\n\t\tbody?: unknown\n\t) => Promise<T>;\n};\n\n/** A Vultr instance, narrowed to what we inspect. */\nexport type VultrInstance = {\n\tid: string;\n\tlabel: string;\n\tstatus: 'active' | 'pending' | 'suspended' | 'resizing';\n\tpower_status?: 'running' | 'stopped' | 'starting';\n\tserver_status?: string;\n\tmain_ip: string;\n\tinternal_ip?: string;\n\tregion?: string;\n\tplan?: string;\n\ttags?: string[];\n};\n\nexport type VultrTargetOptions = {\n\t/** Vultr API key. Required unless `client` is set. */\n\ttoken?: string;\n\tclient?: VultrClientLike;\n\n\t// ── Instance shape ──────────────────────────────────────────────\n\t/** Instance label. Idempotency key. */\n\tname: string;\n\t/** Region slug — `'ewr'`, `'lax'`, `'sgp'`, etc. */\n\tregion: string;\n\t/** Plan slug — `'vc2-1c-1gb'`, `'vc2-2c-4gb'`, etc. */\n\tplan: string;\n\t/** OS id. Numeric — e.g. `1743` for Ubuntu 22.04. */\n\tosId: number;\n\t/**\n\t * SSH key UUIDs already registered in your Vultr account\n\t * (https://my.vultr.com/settings/#ssh-keys). Vultr does NOT accept\n\t * raw key strings — you upload them once, then reference the UUIDs.\n\t */\n\tsshKeys: ReadonlyArray<string>;\n\t/** Tags applied to the instance. */\n\ttags?: ReadonlyArray<string>;\n\t/** Cloud-init user data (will be base64-encoded by us). */\n\tuserData?: string;\n\t/** Enable IPv6. Default false. */\n\tenableIpv6?: boolean;\n\t/** Enable backups. Default false. */\n\tbackups?: boolean;\n\t/** Enable DDoS protection. Default false. */\n\tddosProtection?: boolean;\n\t/** Hostname (Vultr distinguishes label from hostname). Default = name. */\n\thostname?: string;\n\n\t// ── SSH wrap ────────────────────────────────────────────────────\n\tuser?: string;\n\tidentity?: string;\n\tport?: number;\n\n\t// ── Timing ──────────────────────────────────────────────────────\n\tprovisionTimeoutMs?: number;\n\tsshReadinessTimeoutMs?: number;\n\tpollIntervalMs?: number;\n\n\t// ── Observability + injection ───────────────────────────────────\n\tonLog?: (line: string) => void;\n\tprobeSsh?: (host: string, port: number) => Promise<boolean>;\n\tsleep?: (ms: number) => Promise<void>;\n\tnow?: () => number;\n};\n\nexport type VultrTarget = Target & {\n\treadonly instanceId: string;\n\treadonly ipv4: string;\n\tdestroy: () => Promise<void>;\n};\n\nexport class VultrError extends Error {\n\treadonly status: number;\n\treadonly body: unknown;\n\tconstructor(message: string, status: number, body: unknown) {\n\t\tsuper(message);\n\t\tthis.name = 'VultrError';\n\t\tthis.status = status;\n\t\tthis.body = body;\n\t}\n}\n\nexport const createVultrClient = (\n\ttoken: string,\n\toptions: { baseUrl?: string; fetch?: typeof fetch } = {}\n): VultrClientLike => {\n\tconst base = options.baseUrl ?? VULTR_API_BASE;\n\tconst f = options.fetch ?? fetch;\n\treturn {\n\t\trequest: async <T>(\n\t\t\tmethod: 'GET' | 'POST' | 'DELETE' | 'PATCH',\n\t\t\tpath: string,\n\t\t\tbody?: unknown\n\t\t): Promise<T> => {\n\t\t\tconst init: RequestInit = {\n\t\t\t\theaders: {\n\t\t\t\t\tauthorization: `Bearer ${token}`,\n\t\t\t\t\t'content-type': 'application/json'\n\t\t\t\t},\n\t\t\t\tmethod\n\t\t\t};\n\t\t\tif (body !== undefined) init.body = JSON.stringify(body);\n\t\t\tconst response = await f(`${base}${path}`, init);\n\t\t\tif (response.status === 204) return undefined as T;\n\t\t\tconst text = await response.text();\n\t\t\tconst parsed = text.length > 0 ? JSON.parse(text) : undefined;\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new VultrError(\n\t\t\t\t\t`Vultr API ${method} ${path} failed: ${response.status} ${response.statusText}`,\n\t\t\t\t\tresponse.status,\n\t\t\t\t\tparsed\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn parsed as T;\n\t\t}\n\t};\n};\n\nconst resolveClient = (\n\toptions: Pick<VultrTargetOptions, 'client' | 'token'>\n): VultrClientLike => {\n\tif (options.client !== undefined) return options.client;\n\tif (options.token !== undefined && options.token.length > 0) {\n\t\treturn createVultrClient(options.token);\n\t}\n\tthrow new Error(\n\t\t'[deploy/vultr] either `token` or `client` must be provided'\n\t);\n};\n\nconst publicIpv4 = (instance: VultrInstance): string | undefined => {\n\tif (instance.main_ip === '' || instance.main_ip === '0.0.0.0') {\n\t\treturn undefined;\n\t}\n\treturn instance.main_ip;\n};\n\n/** Find an instance by label. Throws on ambiguous duplicates. */\nexport const findVultrInstance = async (\n\tclient: VultrClientLike,\n\tname: string\n): Promise<VultrInstance | undefined> => {\n\tconst body = await client.request<{ instances: VultrInstance[] }>(\n\t\t'GET',\n\t\t`/instances?label=${encodeURIComponent(name)}&per_page=500`\n\t);\n\tconst matches = body.instances.filter((instance) => instance.label === name);\n\tif (matches.length === 0) return undefined;\n\tif (matches.length > 1) {\n\t\tthrow new Error(\n\t\t\t`[deploy/vultr] multiple instances labeled \"${name}\" (${matches\n\t\t\t\t.map((instance) => instance.id)\n\t\t\t\t.join(', ')}). Resolve manually before adopting.`\n\t\t);\n\t}\n\treturn matches[0];\n};\n\nexport const listVultrInstances = async (options: {\n\ttoken?: string;\n\tclient?: VultrClientLike;\n\ttag?: string;\n}): Promise<VultrInstance[]> => {\n\tconst client = resolveClient(options);\n\tconst path =\n\t\toptions.tag !== undefined\n\t\t\t? `/instances?tag=${encodeURIComponent(options.tag)}&per_page=500`\n\t\t\t: '/instances?per_page=500';\n\tconst body = await client.request<{ instances: VultrInstance[] }>('GET', path);\n\treturn body.instances;\n};\n\nexport const destroyVultrInstance = async (options: {\n\ttoken?: string;\n\tclient?: VultrClientLike;\n\tid: string;\n}): Promise<void> => {\n\tconst client = resolveClient(options);\n\ttry {\n\t\tawait client.request('DELETE', `/instances/${options.id}`);\n\t} catch (error) {\n\t\tif (error instanceof VultrError && error.status === 404) return;\n\t\tthrow error;\n\t}\n};\n\nexport const vultrTarget = async (\n\toptions: VultrTargetOptions\n): Promise<VultrTarget> => {\n\tconst client = resolveClient(options);\n\n\tconst hooks: CloudTargetHooks<VultrInstance, string> = {\n\t\tcreate: async () => {\n\t\t\tconst created = await client.request<{ instance: VultrInstance }>(\n\t\t\t\t'POST',\n\t\t\t\t'/instances',\n\t\t\t\t{\n\t\t\t\t\thostname: options.hostname ?? options.name,\n\t\t\t\t\tlabel: options.name,\n\t\t\t\t\tos_id: options.osId,\n\t\t\t\t\tplan: options.plan,\n\t\t\t\t\tregion: options.region,\n\t\t\t\t\tsshkey_id: [...options.sshKeys],\n\t\t\t\t\t...(options.tags !== undefined ? { tags: [...options.tags] } : {}),\n\t\t\t\t\t...(options.userData !== undefined\n\t\t\t\t\t\t? { user_data: btoa(options.userData) }\n\t\t\t\t\t\t: {}),\n\t\t\t\t\t...(options.enableIpv6 === true ? { enable_ipv6: true } : {}),\n\t\t\t\t\t...(options.backups === true ? { backups: 'enabled' } : {}),\n\t\t\t\t\t...(options.ddosProtection === true ? { ddos_protection: true } : {})\n\t\t\t\t}\n\t\t\t);\n\t\t\treturn created.instance;\n\t\t},\n\t\tdestroy: (id) => destroyVultrInstance({ client, id }),\n\t\tfetch: async (id) => {\n\t\t\tconst body = await client.request<{ instance: VultrInstance }>(\n\t\t\t\t'GET',\n\t\t\t\t`/instances/${id}`\n\t\t\t);\n\t\t\treturn body.instance;\n\t\t},\n\t\tfindByName: (name) => findVultrInstance(client, name),\n\t\tgetId: (instance) => instance.id,\n\t\tgetIpv4: publicIpv4,\n\t\tgetStatus: (instance) =>\n\t\t\tinstance.power_status ?? instance.server_status ?? instance.status,\n\t\tisReady: (instance) =>\n\t\t\tinstance.status === 'active' &&\n\t\t\t(instance.power_status === 'running' || instance.power_status === undefined)\n\t};\n\n\tconst result = await createCloudTarget<VultrInstance, string>(hooks, {\n\t\tdescribeTarget: (sshDescription) =>\n\t\t\t`vultr \"${options.name}\" (${sshDescription})`,\n\t\tentityWord: 'instance',\n\t\tlogPrefix: '[vultr]',\n\t\tname: options.name,\n\t\tregion: options.region,\n\t\t...(options.user !== undefined ? { user: options.user } : {}),\n\t\t...(options.identity !== undefined ? { identity: options.identity } : {}),\n\t\t...(options.port !== undefined ? { port: options.port } : {}),\n\t\t...(options.provisionTimeoutMs !== undefined\n\t\t\t? { provisionTimeoutMs: options.provisionTimeoutMs }\n\t\t\t: {}),\n\t\t...(options.sshReadinessTimeoutMs !== undefined\n\t\t\t? { sshReadinessTimeoutMs: options.sshReadinessTimeoutMs }\n\t\t\t: {}),\n\t\t...(options.pollIntervalMs !== undefined\n\t\t\t? { pollIntervalMs: options.pollIntervalMs }\n\t\t\t: {}),\n\t\t...(options.onLog !== undefined ? { onLog: options.onLog } : {}),\n\t\t...(options.probeSsh !== undefined ? { probeSsh: options.probeSsh } : {}),\n\t\t...(options.sleep !== undefined ? { sleep: options.sleep } : {}),\n\t\t...(options.now !== undefined ? { now: options.now } : {})\n\t});\n\n\treturn {\n\t\tdescription: result.description,\n\t\tdestroy: result.destroy,\n\t\texec: result.exec,\n\t\tinstanceId: result.id,\n\t\tipv4: result.ipv4,\n\t\tupload: result.upload,\n\t\t...(result.close !== undefined ? { close: result.close } : {})\n\t};\n};\n"
+    "/**\n * Target interface + bundled adapters (localTarget, sshTarget).\n *\n * A Target is the narrowest abstraction over \"a place I can deploy to\":\n *\n *   - `exec(cmd, opts?)` — run a shell command, capture stdout/stderr/exitCode.\n *   - `upload(localPath, remotePath, opts?)` — copy a local file or directory\n *     to the target. Implementation is free to use whatever is fast (rsync,\n *     scp, mv).\n *   - `close?()` — optional teardown.\n *\n * Two adapters are bundled:\n *\n *   - `localTarget` runs in a temp directory on the local filesystem. Useful\n *     for tests and for \"deploy\" workflows that happen on the same host.\n *   - `sshTarget` shells out to the system `ssh` and `rsync` binaries. No\n *     `ssh2` npm dependency — the controller machine just needs `ssh` and\n *     (optionally) `rsync` in PATH, which is universal on Mac/Linux/WSL.\n *\n * Provider-specific targets (Cloudflare Workers HTTP API, Fly Machines API,\n * AWS Fargate) don't fit \"exec + upload\" and ship as siblings later.\n */\n\nimport { mkdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nexport type ExecOptions = {\n  /** Working directory on the target. Default: target's root. */\n  cwd?: string;\n  /** Env vars to set for this command (merged onto target.env). */\n  env?: Record<string, string>;\n  /** Hard kill after this many ms. Default 600_000 (10 min). 0 disables. */\n  timeoutMs?: number;\n  /** Pipe stdout/stderr through here as it streams (lines, newline-stripped). */\n  onLog?: (line: string, stream: \"stdout\" | \"stderr\") => void;\n  /** Stdin payload — a string is written verbatim. */\n  stdin?: string;\n};\n\nexport type ExecResult = {\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n};\n\nexport type UploadOptions = {\n  /** Exclude paths matching these globs from a directory upload. */\n  exclude?: string[];\n  /** When uploading a directory, delete remote files not present locally. */\n  deleteOrphans?: boolean;\n};\n\nexport type Target = {\n  /** Human-readable description (e.g. \"ssh root@droplet-1.example.com\"). */\n  readonly description: string;\n  exec: (cmd: string, opts?: ExecOptions) => Promise<ExecResult>;\n  upload: (\n    localPath: string,\n    remotePath: string,\n    opts?: UploadOptions,\n  ) => Promise<void>;\n  close?: () => Promise<void>;\n};\n\n// -----------------------------------------------------------------------------\n// localTarget\n// -----------------------------------------------------------------------------\n\nexport type LocalTargetOptions = {\n  /** Root directory the target operates in. Created if missing. */\n  root: string;\n  /** Env merged into every exec. */\n  env?: Record<string, string>;\n};\n\nconst decodeChunks = async (\n  reader: ReadableStream<Uint8Array> | null,\n  onLine: ((line: string) => void) | undefined,\n): Promise<string> => {\n  if (!reader) return \"\";\n  const decoder = new TextDecoder();\n  let buffer = \"\";\n  let collected = \"\";\n  const stream = reader.getReader();\n  try {\n    while (true) {\n      const { done, value } = await stream.read();\n      if (done) break;\n      const chunk = decoder.decode(value, { stream: true });\n      collected += chunk;\n      if (!onLine) continue;\n      buffer += chunk;\n      let newline = buffer.indexOf(\"\\n\");\n      while (newline !== -1) {\n        const line = buffer.slice(0, newline).replace(/\\r$/, \"\");\n        if (line.length > 0) onLine(line);\n        buffer = buffer.slice(newline + 1);\n        newline = buffer.indexOf(\"\\n\");\n      }\n    }\n    const tail = decoder.decode();\n    collected += tail;\n    if (onLine && (buffer + tail).length > 0)\n      onLine((buffer + tail).replace(/\\r$/, \"\"));\n  } finally {\n    stream.releaseLock();\n  }\n  return collected;\n};\n\nconst runSpawn = async (\n  argv: string[],\n  options: {\n    cwd?: string;\n    env?: Record<string, string>;\n    timeoutMs?: number;\n    onLog?: ExecOptions[\"onLog\"];\n    stdin?: string;\n  },\n): Promise<ExecResult> => {\n  const proc = Bun.spawn(argv, {\n    cwd: options.cwd,\n    env: options.env,\n    stderr: \"pipe\",\n    stdin: options.stdin === undefined ? \"ignore\" : \"pipe\",\n    stdout: \"pipe\",\n  });\n\n  if (options.stdin !== undefined && proc.stdin) {\n    // Bun.spawn returns a FileSink for piped stdin — `write` + `end`, not a\n    // WritableStream. (We use a permissive cast because @types/bun's\n    // Subprocess.stdin discriminant flips based on the stdin generic.)\n    const sink = proc.stdin as unknown as {\n      write: (chunk: string | Uint8Array) => number | Promise<number>;\n      end: () => void | Promise<void>;\n    };\n    const wrote = sink.write(options.stdin);\n    if (wrote && typeof (wrote as Promise<number>).then === \"function\") {\n      await wrote;\n    }\n    const ended = sink.end();\n    if (ended && typeof (ended as Promise<void>).then === \"function\") {\n      await ended;\n    }\n  }\n\n  const timeout = options.timeoutMs ?? 600_000;\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  if (timeout > 0) {\n    timer = setTimeout(() => {\n      try {\n        proc.kill();\n      } catch {\n        /* already gone */\n      }\n    }, timeout);\n  }\n\n  const stdoutPromise = decodeChunks(\n    proc.stdout as unknown as ReadableStream<Uint8Array>,\n    options.onLog ? (line) => options.onLog!(line, \"stdout\") : undefined,\n  );\n  const stderrPromise = decodeChunks(\n    proc.stderr as unknown as ReadableStream<Uint8Array>,\n    options.onLog ? (line) => options.onLog!(line, \"stderr\") : undefined,\n  );\n\n  const [stdout, stderr, exitCode] = await Promise.all([\n    stdoutPromise,\n    stderrPromise,\n    proc.exited,\n  ]);\n  if (timer) clearTimeout(timer);\n\n  return { exitCode: exitCode ?? -1, stderr, stdout };\n};\n\nexport const localTarget = (options: LocalTargetOptions): Target => {\n  const baseEnv = { ...options.env };\n  const ensureRoot = async () => {\n    await mkdir(options.root, { recursive: true });\n  };\n\n  return {\n    description: `local ${options.root}`,\n    exec: async (cmd, opts) => {\n      await ensureRoot();\n      return runSpawn([\"sh\", \"-c\", cmd], {\n        cwd: opts?.cwd ?? options.root,\n        env: { ...process.env, ...baseEnv, ...(opts?.env ?? {}) } as Record<\n          string,\n          string\n        >,\n        onLog: opts?.onLog,\n        stdin: opts?.stdin,\n        timeoutMs: opts?.timeoutMs,\n      });\n    },\n    upload: async (localPath, remotePath, opts) => {\n      await ensureRoot();\n      const dest = remotePath.startsWith(\"/\")\n        ? remotePath\n        : join(options.root, remotePath);\n      const argv = [\"rsync\", \"-a\"];\n      if (opts?.deleteOrphans) argv.push(\"--delete\");\n      for (const pattern of opts?.exclude ?? [])\n        argv.push(\"--exclude\", pattern);\n      // rsync semantics: a trailing slash on the source copies *contents*; without it the dir itself is nested.\n      argv.push(localPath, dest);\n      const result = await runSpawn(argv, { timeoutMs: 600_000 });\n      if (result.exitCode !== 0) {\n        throw new Error(\n          `local upload failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`,\n        );\n      }\n    },\n  };\n};\n\n// -----------------------------------------------------------------------------\n// sshTarget\n// -----------------------------------------------------------------------------\n\nexport type SshTargetOptions = {\n  /** Hostname or IP of the remote. */\n  host: string;\n  /** Login user. Default `root`. */\n  user?: string;\n  /** SSH port. Default 22. */\n  port?: number;\n  /** Path to SSH identity file. Default: ssh's own search. */\n  identity?: string;\n  /** Extra flags appended to every `ssh` invocation. */\n  sshFlags?: string[];\n  /**\n   * Use rsync for `upload`. Default true. When false, falls back to `scp`\n   * which is universal but doesn't support delete / exclude.\n   */\n  rsync?: boolean;\n  /**\n   * Env vars to forward via `ssh -o SendEnv=...`. Most remote sshd configs\n   * accept only `LANG` and `LC_*` by default; for app env vars use the\n   * step `env` option instead, which prepends `KEY=value` to the command.\n   */\n  forwardEnv?: string[];\n};\n\nconst sshTargetString = (options: SshTargetOptions): string => {\n  const user = options.user ?? \"root\";\n  return `${user}@${options.host}`;\n};\n\nconst sshBaseFlags = (options: SshTargetOptions): string[] => {\n  const flags: string[] = [];\n  if (options.port !== undefined && options.port !== 22)\n    flags.push(\"-p\", String(options.port));\n  if (options.identity !== undefined) flags.push(\"-i\", options.identity);\n  // Never get stuck on a host-key prompt; treat unknown hosts as a fatal config issue rather than a UX detour.\n  flags.push(\"-o\", \"BatchMode=yes\", \"-o\", \"StrictHostKeyChecking=accept-new\");\n  for (const flag of options.sshFlags ?? []) flags.push(flag);\n  return flags;\n};\n\nconst shellQuote = (value: string): string =>\n  `'${value.replace(/'/g, `'\\\\''`)}'`;\n\nconst buildRemoteCmd = (cmd: string, opts: ExecOptions | undefined): string => {\n  const env = opts?.env;\n  const envPrefix = env\n    ? Object.entries(env)\n        .map(([k, v]) => `${k}=${shellQuote(v)}`)\n        .join(\" \") + \" \"\n    : \"\";\n  if (opts?.cwd) {\n    return `cd ${shellQuote(opts.cwd)} && ${envPrefix}${cmd}`;\n  }\n  return `${envPrefix}${cmd}`;\n};\n\nexport const sshTarget = (options: SshTargetOptions): Target => {\n  const remote = sshTargetString(options);\n  const useRsync = options.rsync ?? true;\n\n  return {\n    description: `ssh ${remote}${options.port && options.port !== 22 ? `:${options.port}` : \"\"}`,\n    exec: async (cmd, opts) => {\n      const argv = [\"ssh\", ...sshBaseFlags(options)];\n      for (const name of options.forwardEnv ?? [])\n        argv.push(\"-o\", `SendEnv=${name}`);\n      argv.push(remote, buildRemoteCmd(cmd, opts));\n      return runSpawn(argv, {\n        onLog: opts?.onLog,\n        stdin: opts?.stdin,\n        timeoutMs: opts?.timeoutMs,\n      });\n    },\n    upload: async (localPath, remotePath, opts) => {\n      if (useRsync) {\n        const sshCmd = [\"ssh\", ...sshBaseFlags(options)]\n          .map((part) => (part.includes(\" \") ? `'${part}'` : part))\n          .join(\" \");\n        const argv = [\"rsync\", \"-az\", \"-e\", sshCmd];\n        if (opts?.deleteOrphans) argv.push(\"--delete\");\n        for (const pattern of opts?.exclude ?? [])\n          argv.push(\"--exclude\", pattern);\n        argv.push(localPath, `${remote}:${remotePath}`);\n        const result = await runSpawn(argv, { timeoutMs: 600_000 });\n        if (result.exitCode !== 0) {\n          throw new Error(\n            `rsync upload failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`,\n          );\n        }\n        return;\n      }\n      // scp fallback — no exclude, no delete. We still need -r to copy directories.\n      const argv = [\n        \"scp\",\n        \"-r\",\n        ...sshBaseFlags(options),\n        localPath,\n        `${remote}:${remotePath}`,\n      ];\n      const result = await runSpawn(argv, { timeoutMs: 600_000 });\n      if (result.exitCode !== 0) {\n        throw new Error(\n          `scp upload failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`,\n        );\n      }\n    },\n  };\n};\n",
+    "/**\n * Shared \"cloud-provider Target\" plumbing used by the\n * provider-specific adapters (`./digitalocean`, `./hetzner`, future\n * `./linode`, `./vultr`, etc.).\n *\n * The provider supplies a small `CloudTargetHooks` bag that knows\n * the provider's:\n *\n *   - find-by-name lookup\n *   - create call (closure over create params)\n *   - fetch-by-id (used to poll for `active`)\n *   - destroy-by-id\n *   - status + ipv4 + id extraction from the provider's Server shape\n *   - readiness predicate (status reached the terminal \"running\" value)\n *\n * `createCloudTarget()` does the universal machinery: provision-or-\n * reuse, poll until ready + IPv4, wait for SSH probe, build\n * `sshTarget` against the IPv4, return the Target wrapped with\n * `{ id, ipv4, destroy() }`.\n *\n * The public adapter (e.g. `digitalOceanTarget`) is a 30-line facade\n * that wires its provider-specific bits and renames `id` → `dropletId`\n * on the way out.\n */\n\nimport type { Target } from \"./targets\";\nimport { sshTarget } from \"./targets\";\n\n/** Provider-specific hooks. Keep these pure of network IO timing — the helper schedules. */\nexport type CloudTargetHooks<Server, Id = number> = {\n  /** Find a server by name. Returns undefined if absent. */\n  findByName: (name: string) => Promise<Server | undefined>;\n  /** Create the server. Closure over provider-specific create params. */\n  create: () => Promise<Server>;\n  /** Fetch a fresh copy of the server by id. Used to poll. */\n  fetch: (id: Id) => Promise<Server>;\n  /** Destroy a server by id. 404 should be treated as idempotent success. */\n  destroy: (id: Id) => Promise<void>;\n  /** True when the server has reached its terminal \"running\" status. */\n  isReady: (server: Server) => boolean;\n  /** Extract the provider-assigned id (number for DO/Hetzner/Linode, string for Vultr). */\n  getId: (server: Server) => Id;\n  /** Extract the public IPv4. Returns undefined while one is being assigned. */\n  getIpv4: (server: Server) => string | undefined;\n  /** Extract the current status as a string (for log lines). */\n  getStatus: (server: Server) => string;\n};\n\nexport type CloudTargetOptions = {\n  /** Provider's idempotency key (server name). */\n  name: string;\n  /** Region / location label — used in the \"creating\" log line. */\n  region: string;\n\n  /** SSH login user. Default `'root'`. */\n  user?: string;\n  /** SSH identity file. */\n  identity?: string;\n  /** SSH port. Default 22. */\n  port?: number;\n\n  /** Default 5 min. */\n  provisionTimeoutMs?: number;\n  /** Default 2 min. */\n  sshReadinessTimeoutMs?: number;\n  /** Default 5 s. */\n  pollIntervalMs?: number;\n\n  /** Called with status updates. */\n  onLog?: (line: string) => void;\n  /** Override SSH probe — tests skip real TCP IO. */\n  probeSsh?: (host: string, port: number) => Promise<boolean>;\n  /** Override sleep — tests skip real waits. */\n  sleep?: (ms: number) => Promise<void>;\n  /** Override clock — tests inject deterministic timestamps. */\n  now?: () => number;\n\n  /**\n   * Short log prefix, e.g. `'[do]'` or `'[hetzner]'`. Threaded through\n   * every log line so multi-provider deploys distinguish output.\n   */\n  logPrefix: string;\n  /**\n   * Provider's word for the entity in log copy — `'droplet'` for DO,\n   * `'server'` for Hetzner. Preserves provider-accurate output.\n   */\n  entityWord: string;\n  /**\n   * Build the Target's `description` field. Receives the resolved\n   * IPv4 + the wrapped sshTarget description.\n   */\n  describeTarget: (sshDescription: string) => string;\n};\n\nexport type CloudTargetResult<Id = number> = {\n  id: Id;\n  ipv4: string;\n  description: string;\n  exec: Target[\"exec\"];\n  upload: Target[\"upload\"];\n  close?: Target[\"close\"];\n  destroy: () => Promise<void>;\n};\n\nconst defaultSleep = (ms: number): Promise<void> =>\n  new Promise((resolve) => setTimeout(resolve, ms));\n\nconst defaultProbeSsh = async (\n  host: string,\n  port: number,\n): Promise<boolean> => {\n  const PROBE_TIMEOUT_MS = 2_000;\n  return new Promise<boolean>((resolve) => {\n    let settled = false;\n    const settle = (value: boolean) => {\n      if (settled) return;\n      settled = true;\n      resolve(value);\n    };\n    const timer = setTimeout(() => settle(false), PROBE_TIMEOUT_MS);\n    Bun.connect({\n      hostname: host,\n      port,\n      socket: {\n        data: () => {},\n        error: () => {\n          clearTimeout(timer);\n          settle(false);\n        },\n        open: (socket) => {\n          clearTimeout(timer);\n          socket.end();\n          settle(true);\n        },\n      },\n    }).catch(() => {\n      clearTimeout(timer);\n      settle(false);\n    });\n  });\n};\n\n/**\n * The shared provision-or-reuse + wait-for-ready + wait-for-SSH\n * pipeline. Provider-specific adapters wire their `CloudTargetHooks`\n * + their option-shape mapping and return a typed result.\n */\nexport const createCloudTarget = async <Server, Id = number>(\n  hooks: CloudTargetHooks<Server, Id>,\n  options: CloudTargetOptions,\n): Promise<CloudTargetResult<Id>> => {\n  const log = options.onLog ?? (() => {});\n  const probeSsh = options.probeSsh ?? defaultProbeSsh;\n  const sleep = options.sleep ?? defaultSleep;\n  const now = options.now ?? Date.now;\n  const pollMs = options.pollIntervalMs ?? 5_000;\n  const provisionTimeout = options.provisionTimeoutMs ?? 5 * 60_000;\n  const sshTimeout = options.sshReadinessTimeoutMs ?? 2 * 60_000;\n  const port = options.port ?? 22;\n  const prefix = options.logPrefix;\n  const noun = options.entityWord;\n\n  const existing = await hooks.findByName(options.name);\n  let current: Server;\n  if (existing === undefined) {\n    log(`${prefix} creating ${noun} \"${options.name}\" in ${options.region}`);\n    current = await hooks.create();\n  } else {\n    log(\n      `${prefix} reusing ${noun} \"${options.name}\" (id ${hooks.getId(existing)}, status ${hooks.getStatus(existing)})`,\n    );\n    current = existing;\n  }\n\n  // Wait for status=ready AND public IPv4 assigned.\n  const provisionStart = now();\n  let ipv4 = hooks.getIpv4(current);\n  while (!hooks.isReady(current) || ipv4 === undefined) {\n    if (now() - provisionStart > provisionTimeout) {\n      throw new Error(\n        `${prefix} provision timeout after ${provisionTimeout}ms — ${noun} ${hooks.getId(current)} status \"${hooks.getStatus(current)}\", ipv4 ${ipv4 ?? \"(unassigned)\"}`,\n      );\n    }\n    await sleep(pollMs);\n    current = await hooks.fetch(hooks.getId(current));\n    ipv4 = hooks.getIpv4(current);\n    log(\n      `${prefix} poll: status=${hooks.getStatus(current)} ipv4=${ipv4 ?? \"(none yet)\"}`,\n    );\n  }\n  log(`${prefix} ${noun} ready at ${ipv4}`);\n\n  // Wait for SSH readiness.\n  const sshStart = now();\n  while (!(await probeSsh(ipv4, port))) {\n    if (now() - sshStart > sshTimeout) {\n      throw new Error(\n        `${prefix} SSH readiness timeout after ${sshTimeout}ms — ${ipv4}:${port} did not accept connections`,\n      );\n    }\n    await sleep(pollMs);\n    log(`${prefix} waiting on ssh ${ipv4}:${port}`);\n  }\n  log(`${prefix} ssh ready at ${ipv4}:${port}`);\n\n  const ssh = sshTarget({\n    host: ipv4,\n    ...(options.user !== undefined ? { user: options.user } : {}),\n    ...(options.identity !== undefined ? { identity: options.identity } : {}),\n    ...(options.port !== undefined ? { port: options.port } : {}),\n  });\n\n  const id = hooks.getId(current);\n  const resolvedIpv4 = ipv4;\n\n  return {\n    description: options.describeTarget(ssh.description),\n    destroy: () =>\n      hooks.destroy(id).then(() => {\n        log(`${prefix} destroyed ${noun} ${id}`);\n      }),\n    exec: ssh.exec,\n    id,\n    ipv4: resolvedIpv4,\n    upload: ssh.upload,\n    ...(ssh.close !== undefined ? { close: ssh.close } : {}),\n  };\n};\n",
+    "/**\n * @absolutejs/deploy/vultr — provision-or-reuse Target adapter for\n * Vultr instances. Sibling to digitalOceanTarget + hetznerTarget +\n * linodeTarget; same shape, Vultr v2 API mappings.\n *\n * Idempotent by label. Vultr stores the public IP as `main_ip`\n * (single string, not an array). SSH keys are pre-registered with\n * Vultr and referenced by UUID — different from Linode (raw keys)\n * and DO/Hetzner (fingerprints/ids/names).\n */\n\nimport type { Target } from \"./targets\";\nimport { createCloudTarget, type CloudTargetHooks } from \"./cloudTarget\";\n\nconst VULTR_API_BASE = \"https://api.vultr.com/v2\";\n\nexport type VultrClientLike = {\n  request: <T = unknown>(\n    method: \"GET\" | \"POST\" | \"DELETE\" | \"PATCH\",\n    path: string,\n    body?: unknown,\n  ) => Promise<T>;\n};\n\n/** A Vultr instance, narrowed to what we inspect. */\nexport type VultrInstance = {\n  id: string;\n  label: string;\n  status: \"active\" | \"pending\" | \"suspended\" | \"resizing\";\n  power_status?: \"running\" | \"stopped\" | \"starting\";\n  server_status?: string;\n  main_ip: string;\n  internal_ip?: string;\n  region?: string;\n  plan?: string;\n  tags?: string[];\n};\n\nexport type VultrTargetOptions = {\n  /** Vultr API key. Required unless `client` is set. */\n  token?: string;\n  client?: VultrClientLike;\n\n  // ── Instance shape ──────────────────────────────────────────────\n  /** Instance label. Idempotency key. */\n  name: string;\n  /** Region slug — `'ewr'`, `'lax'`, `'sgp'`, etc. */\n  region: string;\n  /** Plan slug — `'vc2-1c-1gb'`, `'vc2-2c-4gb'`, etc. */\n  plan: string;\n  /** OS id. Numeric — e.g. `1743` for Ubuntu 22.04. */\n  osId: number;\n  /**\n   * SSH key UUIDs already registered in your Vultr account\n   * (https://my.vultr.com/settings/#ssh-keys). Vultr does NOT accept\n   * raw key strings — you upload them once, then reference the UUIDs.\n   */\n  sshKeys: ReadonlyArray<string>;\n  /** Tags applied to the instance. */\n  tags?: ReadonlyArray<string>;\n  /** Cloud-init user data (will be base64-encoded by us). */\n  userData?: string;\n  /** Enable IPv6. Default false. */\n  enableIpv6?: boolean;\n  /** Enable backups. Default false. */\n  backups?: boolean;\n  /** Enable DDoS protection. Default false. */\n  ddosProtection?: boolean;\n  /** Hostname (Vultr distinguishes label from hostname). Default = name. */\n  hostname?: string;\n\n  // ── SSH wrap ────────────────────────────────────────────────────\n  user?: string;\n  identity?: string;\n  port?: number;\n\n  // ── Timing ──────────────────────────────────────────────────────\n  provisionTimeoutMs?: number;\n  sshReadinessTimeoutMs?: number;\n  pollIntervalMs?: number;\n\n  // ── Observability + injection ───────────────────────────────────\n  onLog?: (line: string) => void;\n  probeSsh?: (host: string, port: number) => Promise<boolean>;\n  sleep?: (ms: number) => Promise<void>;\n  now?: () => number;\n};\n\nexport type VultrTarget = Target & {\n  readonly instanceId: string;\n  readonly ipv4: string;\n  destroy: () => Promise<void>;\n};\n\nexport class VultrError extends Error {\n  readonly status: number;\n  readonly body: unknown;\n  constructor(message: string, status: number, body: unknown) {\n    super(message);\n    this.name = \"VultrError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport const createVultrClient = (\n  token: string,\n  options: { baseUrl?: string; fetch?: typeof fetch } = {},\n): VultrClientLike => {\n  const base = options.baseUrl ?? VULTR_API_BASE;\n  const f = options.fetch ?? fetch;\n  return {\n    request: async <T>(\n      method: \"GET\" | \"POST\" | \"DELETE\" | \"PATCH\",\n      path: string,\n      body?: unknown,\n    ): Promise<T> => {\n      const init: RequestInit = {\n        headers: {\n          authorization: `Bearer ${token}`,\n          \"content-type\": \"application/json\",\n        },\n        method,\n      };\n      if (body !== undefined) init.body = JSON.stringify(body);\n      const response = await f(`${base}${path}`, init);\n      if (response.status === 204) return undefined as T;\n      const text = await response.text();\n      const parsed = text.length > 0 ? JSON.parse(text) : undefined;\n      if (!response.ok) {\n        throw new VultrError(\n          `Vultr API ${method} ${path} failed: ${response.status} ${response.statusText}`,\n          response.status,\n          parsed,\n        );\n      }\n      return parsed as T;\n    },\n  };\n};\n\nconst resolveClient = (\n  options: Pick<VultrTargetOptions, \"client\" | \"token\">,\n): VultrClientLike => {\n  if (options.client !== undefined) return options.client;\n  if (options.token !== undefined && options.token.length > 0) {\n    return createVultrClient(options.token);\n  }\n  throw new Error(\"[deploy/vultr] either `token` or `client` must be provided\");\n};\n\nconst publicIpv4 = (instance: VultrInstance): string | undefined => {\n  if (instance.main_ip === \"\" || instance.main_ip === \"0.0.0.0\") {\n    return undefined;\n  }\n  return instance.main_ip;\n};\n\n/** Find an instance by label. Throws on ambiguous duplicates. */\nexport const findVultrInstance = async (\n  client: VultrClientLike,\n  name: string,\n): Promise<VultrInstance | undefined> => {\n  const body = await client.request<{ instances: VultrInstance[] }>(\n    \"GET\",\n    `/instances?label=${encodeURIComponent(name)}&per_page=500`,\n  );\n  const matches = body.instances.filter((instance) => instance.label === name);\n  if (matches.length === 0) return undefined;\n  if (matches.length > 1) {\n    throw new Error(\n      `[deploy/vultr] multiple instances labeled \"${name}\" (${matches\n        .map((instance) => instance.id)\n        .join(\", \")}). Resolve manually before adopting.`,\n    );\n  }\n  return matches[0];\n};\n\nexport const listVultrInstances = async (options: {\n  token?: string;\n  client?: VultrClientLike;\n  tag?: string;\n}): Promise<VultrInstance[]> => {\n  const client = resolveClient(options);\n  const path =\n    options.tag !== undefined\n      ? `/instances?tag=${encodeURIComponent(options.tag)}&per_page=500`\n      : \"/instances?per_page=500\";\n  const body = await client.request<{ instances: VultrInstance[] }>(\n    \"GET\",\n    path,\n  );\n  return body.instances;\n};\n\nexport const destroyVultrInstance = async (options: {\n  token?: string;\n  client?: VultrClientLike;\n  id: string;\n}): Promise<void> => {\n  const client = resolveClient(options);\n  try {\n    await client.request(\"DELETE\", `/instances/${options.id}`);\n  } catch (error) {\n    if (error instanceof VultrError && error.status === 404) return;\n    throw error;\n  }\n};\n\nexport const vultrTarget = async (\n  options: VultrTargetOptions,\n): Promise<VultrTarget> => {\n  const client = resolveClient(options);\n\n  const hooks: CloudTargetHooks<VultrInstance, string> = {\n    create: async () => {\n      const created = await client.request<{ instance: VultrInstance }>(\n        \"POST\",\n        \"/instances\",\n        {\n          hostname: options.hostname ?? options.name,\n          label: options.name,\n          os_id: options.osId,\n          plan: options.plan,\n          region: options.region,\n          sshkey_id: [...options.sshKeys],\n          ...(options.tags !== undefined ? { tags: [...options.tags] } : {}),\n          ...(options.userData !== undefined\n            ? { user_data: btoa(options.userData) }\n            : {}),\n          ...(options.enableIpv6 === true ? { enable_ipv6: true } : {}),\n          ...(options.backups === true ? { backups: \"enabled\" } : {}),\n          ...(options.ddosProtection === true ? { ddos_protection: true } : {}),\n        },\n      );\n      return created.instance;\n    },\n    destroy: (id) => destroyVultrInstance({ client, id }),\n    fetch: async (id) => {\n      const body = await client.request<{ instance: VultrInstance }>(\n        \"GET\",\n        `/instances/${id}`,\n      );\n      return body.instance;\n    },\n    findByName: (name) => findVultrInstance(client, name),\n    getId: (instance) => instance.id,\n    getIpv4: publicIpv4,\n    getStatus: (instance) =>\n      instance.power_status ?? instance.server_status ?? instance.status,\n    isReady: (instance) =>\n      instance.status === \"active\" &&\n      (instance.power_status === \"running\" ||\n        instance.power_status === undefined),\n  };\n\n  const result = await createCloudTarget<VultrInstance, string>(hooks, {\n    describeTarget: (sshDescription) =>\n      `vultr \"${options.name}\" (${sshDescription})`,\n    entityWord: \"instance\",\n    logPrefix: \"[vultr]\",\n    name: options.name,\n    region: options.region,\n    ...(options.user !== undefined ? { user: options.user } : {}),\n    ...(options.identity !== undefined ? { identity: options.identity } : {}),\n    ...(options.port !== undefined ? { port: options.port } : {}),\n    ...(options.provisionTimeoutMs !== undefined\n      ? { provisionTimeoutMs: options.provisionTimeoutMs }\n      : {}),\n    ...(options.sshReadinessTimeoutMs !== undefined\n      ? { sshReadinessTimeoutMs: options.sshReadinessTimeoutMs }\n      : {}),\n    ...(options.pollIntervalMs !== undefined\n      ? { pollIntervalMs: options.pollIntervalMs }\n      : {}),\n    ...(options.onLog !== undefined ? { onLog: options.onLog } : {}),\n    ...(options.probeSsh !== undefined ? { probeSsh: options.probeSsh } : {}),\n    ...(options.sleep !== undefined ? { sleep: options.sleep } : {}),\n    ...(options.now !== undefined ? { now: options.now } : {}),\n  });\n\n  return {\n    description: result.description,\n    destroy: result.destroy,\n    exec: result.exec,\n    instanceId: result.id,\n    ipv4: result.ipv4,\n    upload: result.upload,\n    ...(result.close !== undefined ? { close: result.close } : {}),\n  };\n};\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA;AACA;AA+CA,IAAM,eAAe,OACpB,QACA,WACqB;AAAA,EACrB,IAAI,CAAC;AAAA,IAAQ,OAAO;AAAA,EACpB,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,SAAS;AAAA,EACb,IAAI,YAAY;AAAA,EAChB,MAAM,SAAS,OAAO,UAAU;AAAA,EAChC,IAAI;AAAA,IACH,OAAO,MAAM;AAAA,MACZ,QAAQ,MAAM,UAAU,MAAM,OAAO,KAAK;AAAA,MAC1C,IAAI;AAAA,QAAM;AAAA,MACV,MAAM,QAAQ,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,MACpD,aAAa;AAAA,MACb,IAAI,CAAC;AAAA,QAAQ;AAAA,MACb,UAAU;AAAA,MACV,IAAI,UAAU,OAAO,QAAQ;AAAA,CAAI;AAAA,MACjC,OAAO,YAAY,IAAI;AAAA,QACtB,MAAM,OAAO,OAAO,MAAM,GAAG,OAAO,EAAE,QAAQ,OAAO,EAAE;AAAA,QACvD,IAAI,KAAK,SAAS;AAAA,UAAG,OAAO,IAAI;AAAA,QAChC,SAAS,OAAO,MAAM,UAAU,CAAC;AAAA,QACjC,UAAU,OAAO,QAAQ;AAAA,CAAI;AAAA,MAC9B;AAAA,IACD;AAAA,IACA,MAAM,OAAO,QAAQ,OAAO;AAAA,IAC5B,aAAa;AAAA,IACb,IAAI,WAAW,SAAS,MAAM,SAAS;AAAA,MAAG,QAAQ,SAAS,MAAM,QAAQ,OAAO,EAAE,CAAC;AAAA,YAClF;AAAA,IACD,OAAO,YAAY;AAAA;AAAA,EAEpB,OAAO;AAAA;AAGR,IAAM,WAAW,OAChB,MACA,YAOyB;AAAA,EACzB,MAAM,OAAO,IAAI,MAAM,MAAM;AAAA,IAC5B,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,IACb,QAAQ;AAAA,IACR,OAAO,QAAQ,UAAU,YAAY,WAAW;AAAA,IAChD,QAAQ;AAAA,EACT,CAAC;AAAA,EAED,IAAI,QAAQ,UAAU,aAAa,KAAK,OAAO;AAAA,IAI9C,MAAM,OAAO,KAAK;AAAA,IAIlB,MAAM,QAAQ,KAAK,MAAM,QAAQ,KAAK;AAAA,IACtC,IAAI,SAAS,OAAQ,MAA0B,SAAS,YAAY;AAAA,MACnE,MAAM;AAAA,IACP;AAAA,IACA,MAAM,QAAQ,KAAK,IAAI;AAAA,IACvB,IAAI,SAAS,OAAQ,MAAwB,SAAS,YAAY;AAAA,MACjE,MAAM;AAAA,IACP;AAAA,EACD;AAAA,EAEA,MAAM,UAAU,QAAQ,aAAa;AAAA,EACrC,IAAI;AAAA,EACJ,IAAI,UAAU,GAAG;AAAA,IAChB,QAAQ,WAAW,MAAM;AAAA,MACxB,IAAI;AAAA,QAAE,KAAK,KAAK;AAAA,QAAK,MAAM;AAAA,OACzB,OAAO;AAAA,EACX;AAAA,EAEA,MAAM,gBAAgB,aACrB,KAAK,QACL,QAAQ,QAAQ,CAAC,SAAS,QAAQ,MAAO,MAAM,QAAQ,IAAI,SAC5D;AAAA,EACA,MAAM,gBAAgB,aACrB,KAAK,QACL,QAAQ,QAAQ,CAAC,SAAS,QAAQ,MAAO,MAAM,QAAQ,IAAI,SAC5D;AAAA,EAEA,OAAO,QAAQ,QAAQ,YAAY,MAAM,QAAQ,IAAI;AAAA,IACpD;AAAA,IACA;AAAA,IACA,KAAK;AAAA,EACN,CAAC;AAAA,EACD,IAAI;AAAA,IAAO,aAAa,KAAK;AAAA,EAE7B,OAAO,EAAE,UAAU,YAAY,IAAI,QAAQ,OAAO;AAAA;AAG5C,IAAM,cAAc,CAAC,YAAwC;AAAA,EACnE,MAAM,UAAU,KAAK,QAAQ,IAAI;AAAA,EACjC,MAAM,aAAa,YAAY;AAAA,IAAE,MAAM,MAAM,QAAQ,MAAM,EAAE,WAAW,KAAK,CAAC;AAAA;AAAA,EAE9E,OAAO;AAAA,IACN,aAAa,SAAS,QAAQ;AAAA,IAC9B,MAAM,OAAO,KAAK,SAAS;AAAA,MAC1B,MAAM,WAAW;AAAA,MACjB,OAAO,SAAS,CAAC,MAAM,MAAM,GAAG,GAAG;AAAA,QAClC,KAAK,MAAM,OAAO,QAAQ;AAAA,QAC1B,KAAK,KAAK,QAAQ,QAAQ,YAAa,MAAM,OAAO,CAAC,EAAG;AAAA,QACxD,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,WAAW,MAAM;AAAA,MAClB,CAAC;AAAA;AAAA,IAEF,QAAQ,OAAO,WAAW,YAAY,SAAS;AAAA,MAC9C,MAAM,WAAW;AAAA,MACjB,MAAM,OAAO,WAAW,WAAW,GAAG,IAAI,aAAa,KAAK,QAAQ,MAAM,UAAU;AAAA,MACpF,MAAM,OAAO,CAAC,SAAS,IAAI;AAAA,MAC3B,IAAI,MAAM;AAAA,QAAe,KAAK,KAAK,UAAU;AAAA,MAC7C,WAAW,WAAW,MAAM,WAAW,CAAC;AAAA,QAAG,KAAK,KAAK,aAAa,OAAO;AAAA,MAEzE,KAAK,KAAK,WAAW,IAAI;AAAA,MACzB,MAAM,SAAS,MAAM,SAAS,MAAM,EAAE,WAAW,OAAQ,CAAC;AAAA,MAC1D,IAAI,OAAO,aAAa,GAAG;AAAA,QAC1B,MAAM,IAAI,MAAM,6BAA6B,OAAO,cAAc,OAAO,UAAU,OAAO,QAAQ;AAAA,MACnG;AAAA;AAAA,EAEF;AAAA;AA+BD,IAAM,kBAAkB,CAAC,YAAsC;AAAA,EAC9D,MAAM,OAAO,QAAQ,QAAQ;AAAA,EAC7B,OAAO,GAAG,QAAQ,QAAQ;AAAA;AAG3B,IAAM,eAAe,CAAC,YAAwC;AAAA,EAC7D,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,QAAQ,SAAS,aAAa,QAAQ,SAAS;AAAA,IAAI,MAAM,KAAK,MAAM,OAAO,QAAQ,IAAI,CAAC;AAAA,EAC5F,IAAI,QAAQ,aAAa;AAAA,IAAW,MAAM,KAAK,MAAM,QAAQ,QAAQ;AAAA,EAErE,MAAM,KAAK,MAAM,iBAAiB,MAAM,kCAAkC;AAAA,EAC1E,WAAW,QAAQ,QAAQ,YAAY,CAAC;AAAA,IAAG,MAAM,KAAK,IAAI;AAAA,EAC1D,OAAO;AAAA;AAGR,IAAM,aAAa,CAAC,UAA0B,IAAI,MAAM,QAAQ,MAAM,OAAO;AAE7E,IAAM,iBAAiB,CAAC,KAAa,SAA0C;AAAA,EAC9E,MAAM,MAAM,MAAM;AAAA,EAClB,MAAM,YAAY,MACf,OAAO,QAAQ,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,GAAG,KAAK,WAAW,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,MACzE;AAAA,EACH,IAAI,MAAM,KAAK;AAAA,IACd,OAAO,MAAM,WAAW,KAAK,GAAG,QAAQ,YAAY;AAAA,EACrD;AAAA,EACA,OAAO,GAAG,YAAY;AAAA;AAGhB,IAAM,YAAY,CAAC,YAAsC;AAAA,EAC/D,MAAM,SAAS,gBAAgB,OAAO;AAAA,EACtC,MAAM,WAAW,QAAQ,SAAS;AAAA,EAElC,OAAO;AAAA,IACN,aAAa,OAAO,SAAS,QAAQ,QAAQ,QAAQ,SAAS,KAAK,IAAI,QAAQ,SAAS;AAAA,IACxF,MAAM,OAAO,KAAK,SAAS;AAAA,MAC1B,MAAM,OAAO,CAAC,OAAO,GAAG,aAAa,OAAO,CAAC;AAAA,MAC7C,WAAW,QAAQ,QAAQ,cAAc,CAAC;AAAA,QAAG,KAAK,KAAK,MAAM,WAAW,MAAM;AAAA,MAC9E,KAAK,KAAK,QAAQ,eAAe,KAAK,IAAI,CAAC;AAAA,MAC3C,OAAO,SAAS,MAAM;AAAA,QACrB,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,WAAW,MAAM;AAAA,MAClB,CAAC;AAAA;AAAA,IAEF,QAAQ,OAAO,WAAW,YAAY,SAAS;AAAA,MAC9C,IAAI,UAAU;AAAA,QACb,MAAM,SAAS,CAAC,OAAO,GAAG,aAAa,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,GAAG,IAAI,IAAI,UAAU,IAAI,EAAE,KAAK,GAAG;AAAA,QAChH,MAAM,QAAO,CAAC,SAAS,OAAO,MAAM,MAAM;AAAA,QAC1C,IAAI,MAAM;AAAA,UAAe,MAAK,KAAK,UAAU;AAAA,QAC7C,WAAW,WAAW,MAAM,WAAW,CAAC;AAAA,UAAG,MAAK,KAAK,aAAa,OAAO;AAAA,QACzE,MAAK,KAAK,WAAW,GAAG,UAAU,YAAY;AAAA,QAC9C,MAAM,UAAS,MAAM,SAAS,OAAM,EAAE,WAAW,OAAQ,CAAC;AAAA,QAC1D,IAAI,QAAO,aAAa,GAAG;AAAA,UAC1B,MAAM,IAAI,MAAM,6BAA6B,QAAO,cAAc,QAAO,UAAU,QAAO,QAAQ;AAAA,QACnG;AAAA,QACA;AAAA,MACD;AAAA,MAEA,MAAM,OAAO,CAAC,OAAO,MAAM,GAAG,aAAa,OAAO,GAAG,WAAW,GAAG,UAAU,YAAY;AAAA,MACzF,MAAM,SAAS,MAAM,SAAS,MAAM,EAAE,WAAW,OAAQ,CAAC;AAAA,MAC1D,IAAI,OAAO,aAAa,GAAG;AAAA,QAC1B,MAAM,IAAI,MAAM,2BAA2B,OAAO,cAAc,OAAO,UAAU,OAAO,QAAQ;AAAA,MACjG;AAAA;AAAA,EAEF;AAAA;;;AC5LD,IAAM,eAAe,CAAC,OACrB,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAEjD,IAAM,kBAAkB,OAAO,MAAc,SAAmC;AAAA,EAC/E,MAAM,mBAAmB;AAAA,EACzB,OAAO,IAAI,QAAiB,CAAC,YAAY;AAAA,IACxC,IAAI,UAAU;AAAA,IACd,MAAM,SAAS,CAAC,UAAmB;AAAA,MAClC,IAAI;AAAA,QAAS;AAAA,MACb,UAAU;AAAA,MACV,QAAQ,KAAK;AAAA;AAAA,IAEd,MAAM,QAAQ,WAAW,MAAM,OAAO,KAAK,GAAG,gBAAgB;AAAA,IAC9D,IAAI,QAAQ;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA,QAAQ;AAAA,QACP,MAAM,MAAM;AAAA,QACZ,OAAO,MAAM;AAAA,UACZ,aAAa,KAAK;AAAA,UAClB,OAAO,KAAK;AAAA;AAAA,QAEb,MAAM,CAAC,WAAW;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,OAAO,IAAI;AAAA,UACX,OAAO,IAAI;AAAA;AAAA,MAEb;AAAA,IACD,CAAC,EAAE,MAAM,MAAM;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,KACZ;AAAA,GACD;AAAA;AAQK,IAAM,oBAAoB,OAChC,OACA,YACoC;AAAA,EACpC,MAAM,MAAM,QAAQ,UAAU,MAAM;AAAA,EACpC,MAAM,WAAW,QAAQ,YAAY;AAAA,EACrC,MAAM,QAAQ,QAAQ,SAAS;AAAA,EAC/B,MAAM,MAAM,QAAQ,OAAO,KAAK;AAAA,EAChC,MAAM,SAAS,QAAQ,kBAAkB;AAAA,EACzC,MAAM,mBAAmB,QAAQ,sBAAsB,IAAI;AAAA,EAC3D,MAAM,aAAa,QAAQ,yBAAyB,IAAI;AAAA,EACxD,MAAM,OAAO,QAAQ,QAAQ;AAAA,EAC7B,MAAM,SAAS,QAAQ;AAAA,EACvB,MAAM,OAAO,QAAQ;AAAA,EAErB,MAAM,WAAW,MAAM,MAAM,WAAW,QAAQ,IAAI;AAAA,EACpD,IAAI;AAAA,EACJ,IAAI,aAAa,WAAW;AAAA,IAC3B,IAAI,GAAG,mBAAmB,SAAS,QAAQ,YAAY,QAAQ,QAAQ;AAAA,IACvE,UAAU,MAAM,MAAM,OAAO;AAAA,EAC9B,EAAO;AAAA,IACN,IACC,GAAG,kBAAkB,SAAS,QAAQ,aAAa,MAAM,MAAM,QAAQ,aAAa,MAAM,UAAU,QAAQ,IAC7G;AAAA,IACA,UAAU;AAAA;AAAA,EAIX,MAAM,iBAAiB,IAAI;AAAA,EAC3B,IAAI,OAAO,MAAM,QAAQ,OAAO;AAAA,EAChC,OAAO,CAAC,MAAM,QAAQ,OAAO,KAAK,SAAS,WAAW;AAAA,IACrD,IAAI,IAAI,IAAI,iBAAiB,kBAAkB;AAAA,MAC9C,MAAM,IAAI,MACT,GAAG,kCAAkC,6BAAuB,QAAQ,MAAM,MAAM,OAAO,aAAa,MAAM,UAAU,OAAO,YAAY,QAAQ,gBAChJ;AAAA,IACD;AAAA,IACA,MAAM,MAAM,MAAM;AAAA,IAClB,UAAU,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,CAAC;AAAA,IAChD,OAAO,MAAM,QAAQ,OAAO;AAAA,IAC5B,IACC,GAAG,uBAAuB,MAAM,UAAU,OAAO,UAAU,QAAQ,cACpE;AAAA,EACD;AAAA,EACA,IAAI,GAAG,UAAU,iBAAiB,MAAM;AAAA,EAGxC,MAAM,WAAW,IAAI;AAAA,EACrB,OAAO,CAAE,MAAM,SAAS,MAAM,IAAI,GAAI;AAAA,IACrC,IAAI,IAAI,IAAI,WAAW,YAAY;AAAA,MAClC,MAAM,IAAI,MACT,GAAG,sCAAsC,uBAAiB,QAAQ,iCACnE;AAAA,IACD;AAAA,IACA,MAAM,MAAM,MAAM;AAAA,IAClB,IAAI,GAAG,yBAAyB,QAAQ,MAAM;AAAA,EAC/C;AAAA,EACA,IAAI,GAAG,uBAAuB,QAAQ,MAAM;AAAA,EAE5C,MAAM,MAAM,UAAU;AAAA,IACrB,MAAM;AAAA,OACF,QAAQ,SAAS,YAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,OACvD,QAAQ,aAAa,YAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,OACnE,QAAQ,SAAS,YAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC5D,CAAC;AAAA,EAED,MAAM,KAAK,MAAM,MAAM,OAAO;AAAA,EAC9B,MAAM,eAAe;AAAA,EAErB,OAAO;AAAA,IACN,aAAa,QAAQ,eAAe,IAAI,WAAW;AAAA,IACnD,SAAS,MACR,MAAM,QAAQ,EAAE,EAAE,KAAK,MAAM;AAAA,MAC5B,IAAI,GAAG,oBAAoB,QAAQ,IAAI;AAAA,KACvC;AAAA,IACF,MAAM,IAAI;AAAA,IACV;AAAA,IACA,MAAM;AAAA,IACN,QAAQ,IAAI;AAAA,OACR,IAAI,UAAU,YAAY,EAAE,OAAO,IAAI,MAAM,IAAI,CAAC;AAAA,EACvD;AAAA;;;ACjND,IAAM,iBAAiB;AAAA;AAgFhB,MAAM,mBAAmB,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EACT,WAAW,CAAC,SAAiB,QAAgB,MAAe;AAAA,IAC3D,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,KAAK,SAAS;AAAA,IACd,KAAK,OAAO;AAAA;AAEd;AAEO,IAAM,oBAAoB,CAChC,OACA,UAAsD,CAAC,MAClC;AAAA,EACrB,MAAM,OAAO,QAAQ,WAAW;AAAA,EAChC,MAAM,IAAI,QAAQ,SAAS;AAAA,EAC3B,OAAO;AAAA,IACN,SAAS,OACR,QACA,MACA,SACgB;AAAA,MAChB,MAAM,OAAoB;AAAA,QACzB,SAAS;AAAA,UACR,eAAe,UAAU;AAAA,UACzB,gBAAgB;AAAA,QACjB;AAAA,QACA;AAAA,MACD;AAAA,MACA,IAAI,SAAS;AAAA,QAAW,KAAK,OAAO,KAAK,UAAU,IAAI;AAAA,MACvD,MAAM,WAAW,MAAM,EAAE,GAAG,OAAO,QAAQ,IAAI;AAAA,MAC/C,IAAI,SAAS,WAAW;AAAA,QAAK;AAAA,MAC7B,MAAM,OAAO,MAAM,SAAS,KAAK;AAAA,MACjC,MAAM,SAAS,KAAK,SAAS,IAAI,KAAK,MAAM,IAAI,IAAI;AAAA,MACpD,IAAI,CAAC,SAAS,IAAI;AAAA,QACjB,MAAM,IAAI,WACT,aAAa,UAAU,gBAAgB,SAAS,UAAU,SAAS,cACnE,SAAS,QACT,MACD;AAAA,MACD;AAAA,MACA,OAAO;AAAA;AAAA,EAET;AAAA;AAGD,IAAM,gBAAgB,CACrB,YACqB;AAAA,EACrB,IAAI,QAAQ,WAAW;AAAA,IAAW,OAAO,QAAQ;AAAA,EACjD,IAAI,QAAQ,UAAU,aAAa,QAAQ,MAAM,SAAS,GAAG;AAAA,IAC5D,OAAO,kBAAkB,QAAQ,KAAK;AAAA,EACvC;AAAA,EACA,MAAM,IAAI,MACT,4DACD;AAAA;AAGD,IAAM,aAAa,CAAC,aAAgD;AAAA,EACnE,IAAI,SAAS,YAAY,MAAM,SAAS,YAAY,WAAW;AAAA,IAC9D;AAAA,EACD;AAAA,EACA,OAAO,SAAS;AAAA;AAIV,IAAM,oBAAoB,OAChC,QACA,SACwC;AAAA,EACxC,MAAM,OAAO,MAAM,OAAO,QACzB,OACA,oBAAoB,mBAAmB,IAAI,gBAC5C;AAAA,EACA,MAAM,UAAU,KAAK,UAAU,OAAO,CAAC,aAAa,SAAS,UAAU,IAAI;AAAA,EAC3E,IAAI,QAAQ,WAAW;AAAA,IAAG;AAAA,EAC1B,IAAI,QAAQ,SAAS,GAAG;AAAA,IACvB,MAAM,IAAI,MACT,8CAA8C,UAAU,QACtD,IAAI,CAAC,aAAa,SAAS,EAAE,EAC7B,KAAK,IAAI,uCACZ;AAAA,EACD;AAAA,EACA,OAAO,QAAQ;AAAA;AAGT,IAAM,qBAAqB,OAAO,YAIT;AAAA,EAC/B,MAAM,SAAS,cAAc,OAAO;AAAA,EACpC,MAAM,OACL,QAAQ,QAAQ,YACb,kBAAkB,mBAAmB,QAAQ,GAAG,mBAChD;AAAA,EACJ,MAAM,OAAO,MAAM,OAAO,QAAwC,OAAO,IAAI;AAAA,EAC7E,OAAO,KAAK;AAAA;AAGN,IAAM,uBAAuB,OAAO,YAItB;AAAA,EACpB,MAAM,SAAS,cAAc,OAAO;AAAA,EACpC,IAAI;AAAA,IACH,MAAM,OAAO,QAAQ,UAAU,cAAc,QAAQ,IAAI;AAAA,IACxD,OAAO,OAAO;AAAA,IACf,IAAI,iBAAiB,cAAc,MAAM,WAAW;AAAA,MAAK;AAAA,IACzD,MAAM;AAAA;AAAA;AAID,IAAM,cAAc,OAC1B,YAC0B;AAAA,EAC1B,MAAM,SAAS,cAAc,OAAO;AAAA,EAEpC,MAAM,QAAiD;AAAA,IACtD,QAAQ,YAAY;AAAA,MACnB,MAAM,UAAU,MAAM,OAAO,QAC5B,QACA,cACA;AAAA,QACC,UAAU,QAAQ,YAAY,QAAQ;AAAA,QACtC,OAAO,QAAQ;AAAA,QACf,OAAO,QAAQ;AAAA,QACf,MAAM,QAAQ;AAAA,QACd,QAAQ,QAAQ;AAAA,QAChB,WAAW,CAAC,GAAG,QAAQ,OAAO;AAAA,WAC1B,QAAQ,SAAS,YAAY,EAAE,MAAM,CAAC,GAAG,QAAQ,IAAI,EAAE,IAAI,CAAC;AAAA,WAC5D,QAAQ,aAAa,YACtB,EAAE,WAAW,KAAK,QAAQ,QAAQ,EAAE,IACpC,CAAC;AAAA,WACA,QAAQ,eAAe,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;AAAA,WACvD,QAAQ,YAAY,OAAO,EAAE,SAAS,UAAU,IAAI,CAAC;AAAA,WACrD,QAAQ,mBAAmB,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC;AAAA,MACpE,CACD;AAAA,MACA,OAAO,QAAQ;AAAA;AAAA,IAEhB,SAAS,CAAC,OAAO,qBAAqB,EAAE,QAAQ,GAAG,CAAC;AAAA,IACpD,OAAO,OAAO,OAAO;AAAA,MACpB,MAAM,OAAO,MAAM,OAAO,QACzB,OACA,cAAc,IACf;AAAA,MACA,OAAO,KAAK;AAAA;AAAA,IAEb,YAAY,CAAC,SAAS,kBAAkB,QAAQ,IAAI;AAAA,IACpD,OAAO,CAAC,aAAa,SAAS;AAAA,IAC9B,SAAS;AAAA,IACT,WAAW,CAAC,aACX,SAAS,gBAAgB,SAAS,iBAAiB,SAAS;AAAA,IAC7D,SAAS,CAAC,aACT,SAAS,WAAW,aACnB,SAAS,iBAAiB,aAAa,SAAS,iBAAiB;AAAA,EACpE;AAAA,EAEA,MAAM,SAAS,MAAM,kBAAyC,OAAO;AAAA,IACpE,gBAAgB,CAAC,mBAChB,UAAU,QAAQ,UAAU;AAAA,IAC7B,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,MAAM,QAAQ;AAAA,IACd,QAAQ,QAAQ;AAAA,OACZ,QAAQ,SAAS,YAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,OACvD,QAAQ,aAAa,YAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,OACnE,QAAQ,SAAS,YAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,OACvD,QAAQ,uBAAuB,YAChC,EAAE,oBAAoB,QAAQ,mBAAmB,IACjD,CAAC;AAAA,OACA,QAAQ,0BAA0B,YACnC,EAAE,uBAAuB,QAAQ,sBAAsB,IACvD,CAAC;AAAA,OACA,QAAQ,mBAAmB,YAC5B,EAAE,gBAAgB,QAAQ,eAAe,IACzC,CAAC;AAAA,OACA,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,aAAa,YAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,OACnE,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,QAAQ,YAAY,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,EACzD,CAAC;AAAA,EAED,OAAO;AAAA,IACN,aAAa,OAAO;AAAA,IACpB,SAAS,OAAO;AAAA,IAChB,MAAM,OAAO;AAAA,IACb,YAAY,OAAO;AAAA,IACnB,MAAM,OAAO;AAAA,IACb,QAAQ,OAAO;AAAA,OACX,OAAO,UAAU,YAAY,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,EAC7D;AAAA;",
-  "debugId": "286A0E555C5A4E1A64756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA;AACA;AAmDA,IAAM,eAAe,OACnB,QACA,WACoB;AAAA,EACpB,IAAI,CAAC;AAAA,IAAQ,OAAO;AAAA,EACpB,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,SAAS;AAAA,EACb,IAAI,YAAY;AAAA,EAChB,MAAM,SAAS,OAAO,UAAU;AAAA,EAChC,IAAI;AAAA,IACF,OAAO,MAAM;AAAA,MACX,QAAQ,MAAM,UAAU,MAAM,OAAO,KAAK;AAAA,MAC1C,IAAI;AAAA,QAAM;AAAA,MACV,MAAM,QAAQ,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,MACpD,aAAa;AAAA,MACb,IAAI,CAAC;AAAA,QAAQ;AAAA,MACb,UAAU;AAAA,MACV,IAAI,UAAU,OAAO,QAAQ;AAAA,CAAI;AAAA,MACjC,OAAO,YAAY,IAAI;AAAA,QACrB,MAAM,OAAO,OAAO,MAAM,GAAG,OAAO,EAAE,QAAQ,OAAO,EAAE;AAAA,QACvD,IAAI,KAAK,SAAS;AAAA,UAAG,OAAO,IAAI;AAAA,QAChC,SAAS,OAAO,MAAM,UAAU,CAAC;AAAA,QACjC,UAAU,OAAO,QAAQ;AAAA,CAAI;AAAA,MAC/B;AAAA,IACF;AAAA,IACA,MAAM,OAAO,QAAQ,OAAO;AAAA,IAC5B,aAAa;AAAA,IACb,IAAI,WAAW,SAAS,MAAM,SAAS;AAAA,MACrC,QAAQ,SAAS,MAAM,QAAQ,OAAO,EAAE,CAAC;AAAA,YAC3C;AAAA,IACA,OAAO,YAAY;AAAA;AAAA,EAErB,OAAO;AAAA;AAGT,IAAM,WAAW,OACf,MACA,YAOwB;AAAA,EACxB,MAAM,OAAO,IAAI,MAAM,MAAM;AAAA,IAC3B,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,IACb,QAAQ;AAAA,IACR,OAAO,QAAQ,UAAU,YAAY,WAAW;AAAA,IAChD,QAAQ;AAAA,EACV,CAAC;AAAA,EAED,IAAI,QAAQ,UAAU,aAAa,KAAK,OAAO;AAAA,IAI7C,MAAM,OAAO,KAAK;AAAA,IAIlB,MAAM,QAAQ,KAAK,MAAM,QAAQ,KAAK;AAAA,IACtC,IAAI,SAAS,OAAQ,MAA0B,SAAS,YAAY;AAAA,MAClE,MAAM;AAAA,IACR;AAAA,IACA,MAAM,QAAQ,KAAK,IAAI;AAAA,IACvB,IAAI,SAAS,OAAQ,MAAwB,SAAS,YAAY;AAAA,MAChE,MAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,UAAU,QAAQ,aAAa;AAAA,EACrC,IAAI;AAAA,EACJ,IAAI,UAAU,GAAG;AAAA,IACf,QAAQ,WAAW,MAAM;AAAA,MACvB,IAAI;AAAA,QACF,KAAK,KAAK;AAAA,QACV,MAAM;AAAA,OAGP,OAAO;AAAA,EACZ;AAAA,EAEA,MAAM,gBAAgB,aACpB,KAAK,QACL,QAAQ,QAAQ,CAAC,SAAS,QAAQ,MAAO,MAAM,QAAQ,IAAI,SAC7D;AAAA,EACA,MAAM,gBAAgB,aACpB,KAAK,QACL,QAAQ,QAAQ,CAAC,SAAS,QAAQ,MAAO,MAAM,QAAQ,IAAI,SAC7D;AAAA,EAEA,OAAO,QAAQ,QAAQ,YAAY,MAAM,QAAQ,IAAI;AAAA,IACnD;AAAA,IACA;AAAA,IACA,KAAK;AAAA,EACP,CAAC;AAAA,EACD,IAAI;AAAA,IAAO,aAAa,KAAK;AAAA,EAE7B,OAAO,EAAE,UAAU,YAAY,IAAI,QAAQ,OAAO;AAAA;AAG7C,IAAM,cAAc,CAAC,YAAwC;AAAA,EAClE,MAAM,UAAU,KAAK,QAAQ,IAAI;AAAA,EACjC,MAAM,aAAa,YAAY;AAAA,IAC7B,MAAM,MAAM,QAAQ,MAAM,EAAE,WAAW,KAAK,CAAC;AAAA;AAAA,EAG/C,OAAO;AAAA,IACL,aAAa,SAAS,QAAQ;AAAA,IAC9B,MAAM,OAAO,KAAK,SAAS;AAAA,MACzB,MAAM,WAAW;AAAA,MACjB,OAAO,SAAS,CAAC,MAAM,MAAM,GAAG,GAAG;AAAA,QACjC,KAAK,MAAM,OAAO,QAAQ;AAAA,QAC1B,KAAK,KAAK,QAAQ,QAAQ,YAAa,MAAM,OAAO,CAAC,EAAG;AAAA,QAIxD,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,WAAW,MAAM;AAAA,MACnB,CAAC;AAAA;AAAA,IAEH,QAAQ,OAAO,WAAW,YAAY,SAAS;AAAA,MAC7C,MAAM,WAAW;AAAA,MACjB,MAAM,OAAO,WAAW,WAAW,GAAG,IAClC,aACA,KAAK,QAAQ,MAAM,UAAU;AAAA,MACjC,MAAM,OAAO,CAAC,SAAS,IAAI;AAAA,MAC3B,IAAI,MAAM;AAAA,QAAe,KAAK,KAAK,UAAU;AAAA,MAC7C,WAAW,WAAW,MAAM,WAAW,CAAC;AAAA,QACtC,KAAK,KAAK,aAAa,OAAO;AAAA,MAEhC,KAAK,KAAK,WAAW,IAAI;AAAA,MACzB,MAAM,SAAS,MAAM,SAAS,MAAM,EAAE,WAAW,OAAQ,CAAC;AAAA,MAC1D,IAAI,OAAO,aAAa,GAAG;AAAA,QACzB,MAAM,IAAI,MACR,6BAA6B,OAAO,cAAc,OAAO,UAAU,OAAO,QAC5E;AAAA,MACF;AAAA;AAAA,EAEJ;AAAA;AA+BF,IAAM,kBAAkB,CAAC,YAAsC;AAAA,EAC7D,MAAM,OAAO,QAAQ,QAAQ;AAAA,EAC7B,OAAO,GAAG,QAAQ,QAAQ;AAAA;AAG5B,IAAM,eAAe,CAAC,YAAwC;AAAA,EAC5D,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,QAAQ,SAAS,aAAa,QAAQ,SAAS;AAAA,IACjD,MAAM,KAAK,MAAM,OAAO,QAAQ,IAAI,CAAC;AAAA,EACvC,IAAI,QAAQ,aAAa;AAAA,IAAW,MAAM,KAAK,MAAM,QAAQ,QAAQ;AAAA,EAErE,MAAM,KAAK,MAAM,iBAAiB,MAAM,kCAAkC;AAAA,EAC1E,WAAW,QAAQ,QAAQ,YAAY,CAAC;AAAA,IAAG,MAAM,KAAK,IAAI;AAAA,EAC1D,OAAO;AAAA;AAGT,IAAM,aAAa,CAAC,UAClB,IAAI,MAAM,QAAQ,MAAM,OAAO;AAEjC,IAAM,iBAAiB,CAAC,KAAa,SAA0C;AAAA,EAC7E,MAAM,MAAM,MAAM;AAAA,EAClB,MAAM,YAAY,MACd,OAAO,QAAQ,GAAG,EACf,IAAI,EAAE,GAAG,OAAO,GAAG,KAAK,WAAW,CAAC,GAAG,EACvC,KAAK,GAAG,IAAI,MACf;AAAA,EACJ,IAAI,MAAM,KAAK;AAAA,IACb,OAAO,MAAM,WAAW,KAAK,GAAG,QAAQ,YAAY;AAAA,EACtD;AAAA,EACA,OAAO,GAAG,YAAY;AAAA;AAGjB,IAAM,YAAY,CAAC,YAAsC;AAAA,EAC9D,MAAM,SAAS,gBAAgB,OAAO;AAAA,EACtC,MAAM,WAAW,QAAQ,SAAS;AAAA,EAElC,OAAO;AAAA,IACL,aAAa,OAAO,SAAS,QAAQ,QAAQ,QAAQ,SAAS,KAAK,IAAI,QAAQ,SAAS;AAAA,IACxF,MAAM,OAAO,KAAK,SAAS;AAAA,MACzB,MAAM,OAAO,CAAC,OAAO,GAAG,aAAa,OAAO,CAAC;AAAA,MAC7C,WAAW,QAAQ,QAAQ,cAAc,CAAC;AAAA,QACxC,KAAK,KAAK,MAAM,WAAW,MAAM;AAAA,MACnC,KAAK,KAAK,QAAQ,eAAe,KAAK,IAAI,CAAC;AAAA,MAC3C,OAAO,SAAS,MAAM;AAAA,QACpB,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,WAAW,MAAM;AAAA,MACnB,CAAC;AAAA;AAAA,IAEH,QAAQ,OAAO,WAAW,YAAY,SAAS;AAAA,MAC7C,IAAI,UAAU;AAAA,QACZ,MAAM,SAAS,CAAC,OAAO,GAAG,aAAa,OAAO,CAAC,EAC5C,IAAI,CAAC,SAAU,KAAK,SAAS,GAAG,IAAI,IAAI,UAAU,IAAK,EACvD,KAAK,GAAG;AAAA,QACX,MAAM,QAAO,CAAC,SAAS,OAAO,MAAM,MAAM;AAAA,QAC1C,IAAI,MAAM;AAAA,UAAe,MAAK,KAAK,UAAU;AAAA,QAC7C,WAAW,WAAW,MAAM,WAAW,CAAC;AAAA,UACtC,MAAK,KAAK,aAAa,OAAO;AAAA,QAChC,MAAK,KAAK,WAAW,GAAG,UAAU,YAAY;AAAA,QAC9C,MAAM,UAAS,MAAM,SAAS,OAAM,EAAE,WAAW,OAAQ,CAAC;AAAA,QAC1D,IAAI,QAAO,aAAa,GAAG;AAAA,UACzB,MAAM,IAAI,MACR,6BAA6B,QAAO,cAAc,QAAO,UAAU,QAAO,QAC5E;AAAA,QACF;AAAA,QACA;AAAA,MACF;AAAA,MAEA,MAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA,GAAG,aAAa,OAAO;AAAA,QACvB;AAAA,QACA,GAAG,UAAU;AAAA,MACf;AAAA,MACA,MAAM,SAAS,MAAM,SAAS,MAAM,EAAE,WAAW,OAAQ,CAAC;AAAA,MAC1D,IAAI,OAAO,aAAa,GAAG;AAAA,QACzB,MAAM,IAAI,MACR,2BAA2B,OAAO,cAAc,OAAO,UAAU,OAAO,QAC1E;AAAA,MACF;AAAA;AAAA,EAEJ;AAAA;;;ACjOF,IAAM,eAAe,CAAC,OACpB,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAElD,IAAM,kBAAkB,OACtB,MACA,SACqB;AAAA,EACrB,MAAM,mBAAmB;AAAA,EACzB,OAAO,IAAI,QAAiB,CAAC,YAAY;AAAA,IACvC,IAAI,UAAU;AAAA,IACd,MAAM,SAAS,CAAC,UAAmB;AAAA,MACjC,IAAI;AAAA,QAAS;AAAA,MACb,UAAU;AAAA,MACV,QAAQ,KAAK;AAAA;AAAA,IAEf,MAAM,QAAQ,WAAW,MAAM,OAAO,KAAK,GAAG,gBAAgB;AAAA,IAC9D,IAAI,QAAQ;AAAA,MACV,UAAU;AAAA,MACV;AAAA,MACA,QAAQ;AAAA,QACN,MAAM,MAAM;AAAA,QACZ,OAAO,MAAM;AAAA,UACX,aAAa,KAAK;AAAA,UAClB,OAAO,KAAK;AAAA;AAAA,QAEd,MAAM,CAAC,WAAW;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,OAAO,IAAI;AAAA,UACX,OAAO,IAAI;AAAA;AAAA,MAEf;AAAA,IACF,CAAC,EAAE,MAAM,MAAM;AAAA,MACb,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,KACb;AAAA,GACF;AAAA;AAQI,IAAM,oBAAoB,OAC/B,OACA,YACmC;AAAA,EACnC,MAAM,MAAM,QAAQ,UAAU,MAAM;AAAA,EACpC,MAAM,WAAW,QAAQ,YAAY;AAAA,EACrC,MAAM,QAAQ,QAAQ,SAAS;AAAA,EAC/B,MAAM,MAAM,QAAQ,OAAO,KAAK;AAAA,EAChC,MAAM,SAAS,QAAQ,kBAAkB;AAAA,EACzC,MAAM,mBAAmB,QAAQ,sBAAsB,IAAI;AAAA,EAC3D,MAAM,aAAa,QAAQ,yBAAyB,IAAI;AAAA,EACxD,MAAM,OAAO,QAAQ,QAAQ;AAAA,EAC7B,MAAM,SAAS,QAAQ;AAAA,EACvB,MAAM,OAAO,QAAQ;AAAA,EAErB,MAAM,WAAW,MAAM,MAAM,WAAW,QAAQ,IAAI;AAAA,EACpD,IAAI;AAAA,EACJ,IAAI,aAAa,WAAW;AAAA,IAC1B,IAAI,GAAG,mBAAmB,SAAS,QAAQ,YAAY,QAAQ,QAAQ;AAAA,IACvE,UAAU,MAAM,MAAM,OAAO;AAAA,EAC/B,EAAO;AAAA,IACL,IACE,GAAG,kBAAkB,SAAS,QAAQ,aAAa,MAAM,MAAM,QAAQ,aAAa,MAAM,UAAU,QAAQ,IAC9G;AAAA,IACA,UAAU;AAAA;AAAA,EAIZ,MAAM,iBAAiB,IAAI;AAAA,EAC3B,IAAI,OAAO,MAAM,QAAQ,OAAO;AAAA,EAChC,OAAO,CAAC,MAAM,QAAQ,OAAO,KAAK,SAAS,WAAW;AAAA,IACpD,IAAI,IAAI,IAAI,iBAAiB,kBAAkB;AAAA,MAC7C,MAAM,IAAI,MACR,GAAG,kCAAkC,6BAAuB,QAAQ,MAAM,MAAM,OAAO,aAAa,MAAM,UAAU,OAAO,YAAY,QAAQ,gBACjJ;AAAA,IACF;AAAA,IACA,MAAM,MAAM,MAAM;AAAA,IAClB,UAAU,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,CAAC;AAAA,IAChD,OAAO,MAAM,QAAQ,OAAO;AAAA,IAC5B,IACE,GAAG,uBAAuB,MAAM,UAAU,OAAO,UAAU,QAAQ,cACrE;AAAA,EACF;AAAA,EACA,IAAI,GAAG,UAAU,iBAAiB,MAAM;AAAA,EAGxC,MAAM,WAAW,IAAI;AAAA,EACrB,OAAO,CAAE,MAAM,SAAS,MAAM,IAAI,GAAI;AAAA,IACpC,IAAI,IAAI,IAAI,WAAW,YAAY;AAAA,MACjC,MAAM,IAAI,MACR,GAAG,sCAAsC,uBAAiB,QAAQ,iCACpE;AAAA,IACF;AAAA,IACA,MAAM,MAAM,MAAM;AAAA,IAClB,IAAI,GAAG,yBAAyB,QAAQ,MAAM;AAAA,EAChD;AAAA,EACA,IAAI,GAAG,uBAAuB,QAAQ,MAAM;AAAA,EAE5C,MAAM,MAAM,UAAU;AAAA,IACpB,MAAM;AAAA,OACF,QAAQ,SAAS,YAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,OACvD,QAAQ,aAAa,YAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,OACnE,QAAQ,SAAS,YAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC7D,CAAC;AAAA,EAED,MAAM,KAAK,MAAM,MAAM,OAAO;AAAA,EAC9B,MAAM,eAAe;AAAA,EAErB,OAAO;AAAA,IACL,aAAa,QAAQ,eAAe,IAAI,WAAW;AAAA,IACnD,SAAS,MACP,MAAM,QAAQ,EAAE,EAAE,KAAK,MAAM;AAAA,MAC3B,IAAI,GAAG,oBAAoB,QAAQ,IAAI;AAAA,KACxC;AAAA,IACH,MAAM,IAAI;AAAA,IACV;AAAA,IACA,MAAM;AAAA,IACN,QAAQ,IAAI;AAAA,OACR,IAAI,UAAU,YAAY,EAAE,OAAO,IAAI,MAAM,IAAI,CAAC;AAAA,EACxD;AAAA;;;ACpNF,IAAM,iBAAiB;AAAA;AAgFhB,MAAM,mBAAmB,MAAM;AAAA,EAC3B;AAAA,EACA;AAAA,EACT,WAAW,CAAC,SAAiB,QAAgB,MAAe;AAAA,IAC1D,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,KAAK,SAAS;AAAA,IACd,KAAK,OAAO;AAAA;AAEhB;AAEO,IAAM,oBAAoB,CAC/B,OACA,UAAsD,CAAC,MACnC;AAAA,EACpB,MAAM,OAAO,QAAQ,WAAW;AAAA,EAChC,MAAM,IAAI,QAAQ,SAAS;AAAA,EAC3B,OAAO;AAAA,IACL,SAAS,OACP,QACA,MACA,SACe;AAAA,MACf,MAAM,OAAoB;AAAA,QACxB,SAAS;AAAA,UACP,eAAe,UAAU;AAAA,UACzB,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,MACF;AAAA,MACA,IAAI,SAAS;AAAA,QAAW,KAAK,OAAO,KAAK,UAAU,IAAI;AAAA,MACvD,MAAM,WAAW,MAAM,EAAE,GAAG,OAAO,QAAQ,IAAI;AAAA,MAC/C,IAAI,SAAS,WAAW;AAAA,QAAK;AAAA,MAC7B,MAAM,OAAO,MAAM,SAAS,KAAK;AAAA,MACjC,MAAM,SAAS,KAAK,SAAS,IAAI,KAAK,MAAM,IAAI,IAAI;AAAA,MACpD,IAAI,CAAC,SAAS,IAAI;AAAA,QAChB,MAAM,IAAI,WACR,aAAa,UAAU,gBAAgB,SAAS,UAAU,SAAS,cACnE,SAAS,QACT,MACF;AAAA,MACF;AAAA,MACA,OAAO;AAAA;AAAA,EAEX;AAAA;AAGF,IAAM,gBAAgB,CACpB,YACoB;AAAA,EACpB,IAAI,QAAQ,WAAW;AAAA,IAAW,OAAO,QAAQ;AAAA,EACjD,IAAI,QAAQ,UAAU,aAAa,QAAQ,MAAM,SAAS,GAAG;AAAA,IAC3D,OAAO,kBAAkB,QAAQ,KAAK;AAAA,EACxC;AAAA,EACA,MAAM,IAAI,MAAM,4DAA4D;AAAA;AAG9E,IAAM,aAAa,CAAC,aAAgD;AAAA,EAClE,IAAI,SAAS,YAAY,MAAM,SAAS,YAAY,WAAW;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,OAAO,SAAS;AAAA;AAIX,IAAM,oBAAoB,OAC/B,QACA,SACuC;AAAA,EACvC,MAAM,OAAO,MAAM,OAAO,QACxB,OACA,oBAAoB,mBAAmB,IAAI,gBAC7C;AAAA,EACA,MAAM,UAAU,KAAK,UAAU,OAAO,CAAC,aAAa,SAAS,UAAU,IAAI;AAAA,EAC3E,IAAI,QAAQ,WAAW;AAAA,IAAG;AAAA,EAC1B,IAAI,QAAQ,SAAS,GAAG;AAAA,IACtB,MAAM,IAAI,MACR,8CAA8C,UAAU,QACrD,IAAI,CAAC,aAAa,SAAS,EAAE,EAC7B,KAAK,IAAI,uCACd;AAAA,EACF;AAAA,EACA,OAAO,QAAQ;AAAA;AAGV,IAAM,qBAAqB,OAAO,YAIT;AAAA,EAC9B,MAAM,SAAS,cAAc,OAAO;AAAA,EACpC,MAAM,OACJ,QAAQ,QAAQ,YACZ,kBAAkB,mBAAmB,QAAQ,GAAG,mBAChD;AAAA,EACN,MAAM,OAAO,MAAM,OAAO,QACxB,OACA,IACF;AAAA,EACA,OAAO,KAAK;AAAA;AAGP,IAAM,uBAAuB,OAAO,YAItB;AAAA,EACnB,MAAM,SAAS,cAAc,OAAO;AAAA,EACpC,IAAI;AAAA,IACF,MAAM,OAAO,QAAQ,UAAU,cAAc,QAAQ,IAAI;AAAA,IACzD,OAAO,OAAO;AAAA,IACd,IAAI,iBAAiB,cAAc,MAAM,WAAW;AAAA,MAAK;AAAA,IACzD,MAAM;AAAA;AAAA;AAIH,IAAM,cAAc,OACzB,YACyB;AAAA,EACzB,MAAM,SAAS,cAAc,OAAO;AAAA,EAEpC,MAAM,QAAiD;AAAA,IACrD,QAAQ,YAAY;AAAA,MAClB,MAAM,UAAU,MAAM,OAAO,QAC3B,QACA,cACA;AAAA,QACE,UAAU,QAAQ,YAAY,QAAQ;AAAA,QACtC,OAAO,QAAQ;AAAA,QACf,OAAO,QAAQ;AAAA,QACf,MAAM,QAAQ;AAAA,QACd,QAAQ,QAAQ;AAAA,QAChB,WAAW,CAAC,GAAG,QAAQ,OAAO;AAAA,WAC1B,QAAQ,SAAS,YAAY,EAAE,MAAM,CAAC,GAAG,QAAQ,IAAI,EAAE,IAAI,CAAC;AAAA,WAC5D,QAAQ,aAAa,YACrB,EAAE,WAAW,KAAK,QAAQ,QAAQ,EAAE,IACpC,CAAC;AAAA,WACD,QAAQ,eAAe,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;AAAA,WACvD,QAAQ,YAAY,OAAO,EAAE,SAAS,UAAU,IAAI,CAAC;AAAA,WACrD,QAAQ,mBAAmB,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC;AAAA,MACrE,CACF;AAAA,MACA,OAAO,QAAQ;AAAA;AAAA,IAEjB,SAAS,CAAC,OAAO,qBAAqB,EAAE,QAAQ,GAAG,CAAC;AAAA,IACpD,OAAO,OAAO,OAAO;AAAA,MACnB,MAAM,OAAO,MAAM,OAAO,QACxB,OACA,cAAc,IAChB;AAAA,MACA,OAAO,KAAK;AAAA;AAAA,IAEd,YAAY,CAAC,SAAS,kBAAkB,QAAQ,IAAI;AAAA,IACpD,OAAO,CAAC,aAAa,SAAS;AAAA,IAC9B,SAAS;AAAA,IACT,WAAW,CAAC,aACV,SAAS,gBAAgB,SAAS,iBAAiB,SAAS;AAAA,IAC9D,SAAS,CAAC,aACR,SAAS,WAAW,aACnB,SAAS,iBAAiB,aACzB,SAAS,iBAAiB;AAAA,EAChC;AAAA,EAEA,MAAM,SAAS,MAAM,kBAAyC,OAAO;AAAA,IACnE,gBAAgB,CAAC,mBACf,UAAU,QAAQ,UAAU;AAAA,IAC9B,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,MAAM,QAAQ;AAAA,IACd,QAAQ,QAAQ;AAAA,OACZ,QAAQ,SAAS,YAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,OACvD,QAAQ,aAAa,YAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,OACnE,QAAQ,SAAS,YAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,OACvD,QAAQ,uBAAuB,YAC/B,EAAE,oBAAoB,QAAQ,mBAAmB,IACjD,CAAC;AAAA,OACD,QAAQ,0BAA0B,YAClC,EAAE,uBAAuB,QAAQ,sBAAsB,IACvD,CAAC;AAAA,OACD,QAAQ,mBAAmB,YAC3B,EAAE,gBAAgB,QAAQ,eAAe,IACzC,CAAC;AAAA,OACD,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,aAAa,YAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,OACnE,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,QAAQ,YAAY,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,EAC1D,CAAC;AAAA,EAED,OAAO;AAAA,IACL,aAAa,OAAO;AAAA,IACpB,SAAS,OAAO;AAAA,IAChB,MAAM,OAAO;AAAA,IACb,YAAY,OAAO;AAAA,IACnB,MAAM,OAAO;AAAA,IACb,QAAQ,OAAO;AAAA,OACX,OAAO,UAAU,YAAY,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,EAC9D;AAAA;",
+  "debugId": "64197F9EAB115CA564756E2164756E21",
   "names": []
 }

package/dist/vultrInfrastructure.js

@@ -199,7 +199,13 @@ var sshTarget = (options) => {
         }
         return;
       }
-      const argv = ["scp", "-r", ...sshBaseFlags(options), localPath, `${remote}:${remotePath}`];
+      const argv = [
+        "scp",
+        "-r",
+        ...sshBaseFlags(options),
+        localPath,
+        `${remote}:${remotePath}`
+      ];
       const result = await runSpawn(argv, { timeoutMs: 600000 });
       if (result.exitCode !== 0) {
         throw new Error(`scp upload failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`);
@@ -548,5 +554,5 @@ export {
   createVultrInfrastructureProvider
 };
 
-//# debugId=9022826B32D944F164756E2164756E21
+//# debugId=5F59A3DCDD07E8D464756E2164756E21
 //# sourceMappingURL=vultrInfrastructure.js.map