@homeflare/alchemy 0.1.0

package/dist/openbao/ssh-role-form.d.ts

@@ -0,0 +1,99 @@
+export interface BaoSshRoleProps {
+    /** Role name, as `<mount>/roles/{name}` takes it. */
+    name: string;
+    /** Secrets engine mount, no trailing slash. Defaults to `ssh`; `ssh-host` also exists. */
+    mount?: string;
+    /** Principals a certificate may carry. `['*']` is OpenBao's wildcard. */
+    allowedUsers: readonly string[];
+    /** Principal used when a sign request does not name one. */
+    defaultUser?: string;
+    /** Sign user certificates. Defaults to false — OpenBao's own default. */
+    allowUserCertificates?: boolean;
+    /** Sign host certificates. Defaults to false — OpenBao's own default. */
+    allowHostCertificates?: boolean;
+    /** Host-cert roles only: the domains a host certificate may claim. */
+    allowedDomains?: readonly string[];
+    /** Host-cert roles only: allow `host.example.com` under an allowed `example.com`. */
+    allowSubdomains?: boolean;
+    /** Host-cert roles only: allow the bare allowed domain itself. */
+    allowBareDomains?: boolean;
+    /**
+     * Extensions a REQUESTER may ask for — not the ones that get stamped on. `[]` means none
+     * may be requested, which is what all three live roles carry; `['*']` allows any.
+     */
+    allowedExtensions?: readonly string[];
+    /** Extensions stamped on every certificate, e.g. `{ 'permit-pty': '' }`. */
+    defaultExtensions?: Readonly<Record<string, string>>;
+    /** Critical options a requester may ask for — `force-command`, `source-address`. */
+    allowedCriticalOptions?: readonly string[];
+    /** Critical options stamped on every certificate. See the ⛔ on erasure in ssh-role.ts. */
+    defaultCriticalOptions?: Readonly<Record<string, string>>;
+    /** ⛔ Skeleton-key flag — read the ⛔ in ssh-role.ts before setting this true. */
+    allowEmptyPrincipals?: boolean;
+    /** Certificate lifetime, e.g. `4h`. ⛔ `0` is NOT "no expiry" — see ssh-role.ts. */
+    ttl: string;
+    /** Ceiling on a requested lifetime, e.g. `8h`. */
+    maxTtl: string;
+}
+/**
+ * Every prop resolved to the value the full-replace write will actually produce.
+ *
+ * ★ Derived rather than retyped: `Required` is the whole difference between the two, and a
+ *   hand-copied twin is the kind of thing that silently loses a field in review.
+ */
+export type BaoSshRoleForm = Required<BaoSshRoleProps>;
+/** ⛔ NO SECRET HERE — names, flags, TTLs and a digest. The CA key is out of scope. */
+export interface BaoSshRoleAttributes extends Omit<BaoSshRoleForm, 'maxTtl' | 'ttl'> {
+    /**
+     * ⚠️ SECONDS, NOT A DURATION STRING. OpenBao stores seconds and a plan should show what is
+     *   stored; `4h` in the props and 14400 here are the same role. Rendering seconds back
+     *   into `4h` needs a table of unit rules that mount-form.ts and auth-role-form.ts each
+     *   already carry a private copy of — a third copy is how the three drift apart.
+     */
+    ttlSeconds: number;
+    maxTtlSeconds: number;
+    /** Always `ca` on a healthy role. Stored so an otp/dynamic role reads as a mismatch. */
+    keyType: string;
+    /** SHA-256 of the managed fields — safe to persist; see policy.ts. */
+    digest: string;
+}
+/** Mount path without a trailing slash; `ssh` when the caller did not say. */
+export declare const mountOf: (mount: string | undefined) => string;
+export declare const readPath: (mount: string | undefined, name: string) => string;
+/**
+ * ⚠️ SETS, NOT SEQUENCES. OpenBao stores these as one comma-separated string and promises
+ *   nothing about the order it hands back. Sorting and de-duplicating on BOTH sides is what
+ *   stops every plan from reporting an update on a role nobody touched.
+ */
+export declare const csvList: (value: unknown) => readonly string[];
+/**
+ * ⚠️ A MAP WITH NO PROMISED ORDER. Key order also decides the digest and the argv, so it is
+ *   normalised once here and everything else reads the sorted copy.
+ */
+export declare const extMap: (value: unknown) => Record<string, string>;
+/** ⛔ Every default here is what the WRITE produces, not what felt sensible. */
+export declare const resolve: (props: BaoSshRoleProps) => BaoSshRoleForm;
+export declare const attributesOf: (form: BaoSshRoleForm, live: Record<string, unknown>) => BaoSshRoleAttributes;
+/**
+ * ⛔ EVERY MANAGED FIELD IS SENT ON EVERY WRITE, INCLUDING THE FALSE ONES. The role write is
+ *   a full replace (see ssh-role.ts), so an omitted field is not "left alone" — it is reset.
+ *   Sending the resolved form makes the body and the declaration the same statement. All
+ *   strings, exactly the `k=v` pairs `bao write` sent, for `PUT <mount>/roles/<name>`.
+ */
+export declare const writeBody: (form: BaoSshRoleForm) => Record<string, string>;
+/**
+ * ⛔ AN UNPARSEABLE TTL IS A PLAN THAT NEVER GOES GREEN. parseDuration understands `0` and
+ *   `<n>[smhd]` and nothing else. A prop like `4h30m` writes fine, reads back as 16200,
+ *   fails to parse on the want side, and reports `update` forever — and a resource that is
+ *   always dirty is one nobody reads the plan for any more.
+ */
+export declare const badDurations: (form: BaoSshRoleForm) => readonly string[];
+/**
+ * True when live already matches the declaration on every managed field.
+ * ⛔ NOTHING IS SKIPPED FOR BEING UNDEFINED. mount.ts and auth-role.ts can treat an absent
+ *   prop as "don't care" because their writes are partial tunes; this one cannot, because
+ *   the write resets whatever it omits. Comparing the resolved form is what keeps a
+ *   hand-edited role from surviving forever behind a green plan.
+ */
+export declare const matches: (attributes: BaoSshRoleAttributes, form: BaoSshRoleForm) => boolean;
+//# sourceMappingURL=ssh-role-form.d.ts.map

package/dist/openbao/ssh-role-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role-form.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,yEAAyE;IACzE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,sEAAsE;IACtE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,qFAAqF;IACrF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,oFAAoF;IACpF,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,0FAA0F;IAC1F,sBAAsB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;AAEvD,sFAAsF;AACtF,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,KAAK,CAAC;IAClF;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,eAAO,MAAM,OAAO,UAAW,MAAM,GAAG,SAAS,WAAyC,CAAC;AAE3F,eAAO,MAAM,QAAQ,UAAW,MAAM,GAAG,SAAS,QAAQ,MAAM,WAC7B,CAAC;AAMpC;;;;GAIG;AACH,eAAO,MAAM,OAAO,UAAW,OAAO,KAAG,SAAS,MAAM,EAOvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,MAAM,UAAW,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAM5D,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,OAAO,UAAW,eAAe,KAAG,cAiB/C,CAAC;AAEH,eAAO,MAAM,YAAY,SACjB,cAAc,QACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,oBAqBF,CAAC;AAgBF;;;;;GAKG;AACH,eAAO,MAAM,SAAS,SAAU,cAAc,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAgBpE,CAAC;AAoBH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SAAU,cAAc,KAAG,SAAS,MAAM,EACuB,CAAC;AAE3F;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,eAAgB,oBAAoB,QAAQ,cAAc,YAe9B,CAAC"}

package/dist/openbao/ssh-role.d.ts

@@ -0,0 +1,43 @@
+/**
+ * An OpenBao SSH secrets-engine role — `<mount>/roles/{name}`, `key_type=ca`. METADATA ONLY.
+ *
+ * ⛔ THE SIGNING KEY IS OUT OF SCOPE AND MUST STAY OUT. `ssh/config/ca` holds (or generates)
+ *   the CA private key and `ssh/sign/<role>` issues certificates. Neither is declarable
+ *   here, for the reason policy.ts spells out: Alchemy persists attributes to its state
+ *   store WITHOUT encrypting them, that store is the `alchemy` Postgres, and pg-backup.sh
+ *   dumps it nightly to CT100. A CA key there would outlive the vault that guards it. This
+ *   resource declares the SHAPE a signature must satisfy — principals, extensions, TTLs.
+ *
+ * ⛔ THE ROLE WRITE IS A FULL REPLACE, NOT A PATCH. OpenBao rebuilds the role entry from the
+ *   request body, so any field the write omits reverts to its ZERO value. Two things follow:
+ *   `resolve` in ssh-role-form.ts fills every optional prop with the default the write would
+ *   produce and `matches` compares all of it (an omitted prop asserts the default, it never
+ *   means "don't care"); and `wouldErase` below names the fields this resource does NOT
+ *   declare, so reconcile can REFUSE instead of quietly dropping someone's key-length floor.
+ *
+ * ⛔ `allowEmptyPrincipals: true` WITH AN EMPTY `allowedUsers` IS A SKELETON KEY. OpenBao
+ *   will sign a certificate carrying no principals, and OpenSSH accepts such a certificate
+ *   for ANY user on ANY host that trusts the CA. It defaults to false, and all three roles
+ *   on the live engine carry false (MEASURED). Do not set it true without pinning
+ *   `defaultCriticalOptions['force-command']` in the same declaration.
+ *
+ * ⛔ `ttl: '0'` DOES NOT MEAN "NO EXPIRY" AND IT DOES NOT MEAN "SHORT". It means the mount's
+ *   `default_lease_ttl`, and the live `ssh` mount leaves that at 0, which means the SYSTEM
+ *   default — 768h. A 32-day SSH certificate is the opposite of what an SSH CA is for.
+ *   State the duration. MEASURED: the live `node-admin` and `tim` roles are ttl 14400 /
+ *   max_ttl 28800 (4h / 8h); `ssh-host/roles/host` is 31536000 (365d), as a host cert should.
+ *
+ * ★ `defaultRemovalPolicy: 'retain'`. Deleting this role locks every operator out of the
+ *   estate — the memory note "operator SSH is homeflare-bot@<host>" is this CA. Opt in with
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type BaoSshRoleAttributes, type BaoSshRoleProps } from './ssh-role-form.ts';
+export type { BaoSshRoleAttributes, BaoSshRoleProps };
+export interface BaoSshRole extends Resource<'Bao.SshRole', BaoSshRoleProps, BaoSshRoleAttributes, never, HttpClient.HttpClient> {
+}
+export declare const BaoSshRole: import("alchemy").ResourceClass<BaoSshRole>;
+export declare const BaoSshRoleProvider: () => import("effect/Layer").Layer<Provider.Provider<BaoSshRole>, never, HttpClient.HttpClient>;
+//# sourceMappingURL=ssh-role.d.ts.map

package/dist/openbao/ssh-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-role.d.ts","sourceRoot":"","sources":["../../src/openbao/ssh-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,eAAe,EAQrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAErB,CAAC;AAyDH,eAAO,MAAM,kBAAkB,iGAsH5B,CAAC"}

package/dist/proxmox/acl.d.ts

@@ -0,0 +1,72 @@
+/**
+ * `Proxmox.Acl` — one grant: a role bound to a subject at a path. The line that makes a role real.
+ *
+ * ★ USERS, GROUPS, ROLES AND TOKENS ARE ALL INERT UNTIL AN ACL BINDS THEM. A role is a named list
+ *   of privileges that grants nothing by itself; a user can do nothing until
+ *   {path, user|group|token, role} exists. That is what makes those four families worth declaring,
+ *   and why the grants that let OpenBao mint a PVE token today are only clicks somebody made once.
+ *
+ * ⛔ THE ONE FAMILY THAT DOES NOT FIT `pveOperations` AS WRITTEN, AND THE MISFIT IS MEASURED. The
+ *   cluster's own schema — `/pve-docs/api-viewer/apidoc.js`, read unauthenticated 2026-09-13 —
+ *   lists exactly TWO methods on `/access/acl`: GET and PUT. There is no DELETE (it answers
+ *   "Method 'DELETE /access/acl' not implemented") and, less famously, NO POST either. So create
+ *   and update are the SAME call, `PUT /access/acl`, and removal is that PUT with `delete=1` —
+ *   which is why `delete` below does not use `ops.destroy`.
+ *   ⚠️ THE REAL FIX BELONGS IN `resource.ts`: give `PveSpec` a `deleteForm` and the method to go
+ *     with it, and this override disappears. Until then it is local and loud — do not "restore
+ *     symmetry" by pointing `delete` at `ops.destroy`, which reports every removal as a 501 while
+ *     the grant stays exactly where it was.
+ *
+ * ⛔ A SINGLE GRANT HAS NO URL OF ITS OWN. `GET /access/acl` answers ONE FLAT LIST for the whole
+ *   cluster, so identity is the tuple (path, type, ugid, roleid), matched client-side in
+ *   `attributes` below. Two resources declaring the SAME tuple are the SAME grant — Alchemy sees
+ *   two resource ids, not one collision — and deleting either takes the access away from both,
+ *   the same hazard as two guests declaring one vmid.
+ *
+ * ⛔ AND THAT LIST IS FILTERED BY WHO IS ASKING. The schema's own words for GET: "The returned list
+ *   is restricted to objects where you have rights to modify permissions." A credential that can
+ *   read the cluster but not modify permissions is answered `[]` — not a 403, not an error — so
+ *   the mount's `read` role needs permission-modify rights on the declared path exactly as
+ *   `provision` does. Work reported on a grant that is plainly there means that role is too narrow.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import { type PveRequirements, type WithTarget } from './resource.ts';
+/** PVE's three kinds of subject. The read answers this word; the write wants its plural. */
+export type AclSubjectType = 'user' | 'group' | 'token';
+export interface AclProps extends WithTarget {
+    /**
+     * The PVE object path the grant is ON — `/`, `/pool/house`, `/vms/101`, `/storage/local-zfs`.
+     * ⚠️ NOT THE API PATH: `spec.path` below is the endpoint (`access/acl`). PVE's API overloads the
+     *   word, so this file does too rather than renaming a field the cluster calls `path`.
+     */
+    path: string;
+    /** Which kind of subject `ugid` names. Identity: changing it is a different grant. */
+    type: AclSubjectType;
+    /** `tim@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */
+    ugid: string;
+    /** The role bound here, e.g. `PVEAuditor`. ⚠️ It must exist — PVE refuses an unknown roleid. */
+    roleid: string;
+    /** Inherit down the path. PVE's default is ON, and this is the grant's ONLY mutable field. */
+    propagate?: boolean;
+}
+export interface AclAttributes {
+    path: string;
+    type: AclSubjectType;
+    ugid: string;
+    roleid: string;
+    propagate: boolean;
+    /**
+     * ⛔ PRESENCE AS AN ATTRIBUTE, AND IT IS WHAT MAKES THE FACTORY WORK HERE. `attributes` never
+     *   returns undefined: if it did, `reconcile` would take the create branch and POST to
+     *   `access/acl`, which PVE does not implement. Present-but-unbound sends every write down the
+     *   PUT branch instead, the only branch PVE has. The cost: the factory's read-back guard cannot
+     *   fire, so `reconcile` below re-checks this field itself and dies with the same honesty.
+     */
+    bound: boolean;
+}
+export interface ProxmoxAcl extends Resource<'Proxmox.Acl', AclProps, AclAttributes, never, PveRequirements> {
+}
+export declare const ProxmoxAcl: import("alchemy").ResourceClass<ProxmoxAcl>;
+export declare const ProxmoxAclProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxAcl>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=acl.d.ts.map

package/dist/proxmox/acl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../../src/proxmox/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAiB,MAAM,eAAe,CAAC;AAErF,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,IAAI,EAAE,cAAc,CAAC;IACrB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAmH9D,eAAO,MAAM,kBAAkB,gIAqE5B,CAAC"}

package/dist/proxmox/api-token-form.d.ts

@@ -0,0 +1,59 @@
+import type { ApiTokenAttributes, ApiTokenProps } from './api-token.ts';
+/**
+ * What a write to a PVE API token actually does, and the form that does it.
+ *
+ * ★ SPLIT OUT OF api-token.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is the one
+ *   metric-server-form.ts draws: this file answers "what does PVE store when this form arrives",
+ *   api-token.ts answers "what a token is and when it has changed". Nothing here reads the
+ *   cluster and nothing here decides a diff.
+ *
+ * ⚠️ THE `import type` BACK TO api-token.ts IS A CYCLE ON PAPER ONLY. It is type-only, so it is
+ *   erased before anything runs and `ApiTokenProps` stays in the file that declares the resource.
+ *
+ * ⛔ THE WRITE SEMANTICS BELOW ARE READ FROM THE CLUSTER'S OWN PERL RATHER THAN INFERRED FROM THE
+ *   API SCHEMA — `/usr/share/perl5/PVE/API2/User.pm`, subs `generate_token` and
+ *   `update_token_info`, read over SSH on n2 on 2026-09-13. The two disagree in exactly the place
+ *   that costs a forever-diff: the schema gives `expire` the default "same as user", and the code
+ *   never implements it. api-token.ts records what that means.
+ */
+import type { PveSpec } from './resource.ts';
+/**
+ * `<userid>!<tokenid>` — the name the rest of PVE calls this object by.
+ *
+ * ★ IT IS WHAT AN ACL BINDS. `Proxmox.Acl` with `type: 'token'` wants exactly this string as its
+ *   `ugid`, so reporting it as an attribute is what lets a privilege-separated token be granted
+ *   anything at all without somebody retyping the join by hand.
+ *
+ * ⚠️ DERIVED, NOT READ. MEASURED: `GET /access/users/monitoring@pve/token/exporter` answers
+ *   `{"expire":0,"privsep":0}` and echoes back neither half of its own identity. So this is built
+ *   from props, cannot disagree with the path the read used, and is therefore true by
+ *   construction — which is why it is reported and never compared.
+ */
+export declare const fullTokenid: (props: ApiTokenProps) => string;
+/**
+ * Everything a token has, in the form PVE wants. Create and update send exactly this.
+ *
+ * ⛔ `userid` AND `tokenid` ARE NOT IN IT, and that is not an omission. Both are path segments of
+ *   `access/users/{userid}/token/{tokenid}` — which is the path the POST goes to as well as the
+ *   PUT — so a second copy in the body can only ever disagree with the path it was sent to.
+ *   metric-server.ts omits its `id` for the same reason and says so there.
+ *
+ * ⚠️ EVERY FIELD IS SENT ON EVERY WRITE, THE EMPTY COMMENT INCLUDED, BECAUSE A PUT MERGES.
+ *   MEASURED in `update_token_info`: `$token->{comment} = $param->{comment} if defined(...)`
+ *   followed by `delete $token->{comment} if (!length $token->{comment})`. So `comment=` is how a
+ *   comment is CLEARED; omitting it leaves the old text in place while `matches` goes on asking
+ *   for an update the update cannot make. user.ts writes the same reasoning out for `groups`.
+ *   ⚠️ THE `delete=` PARAMETER IS NOT USED AND WOULD NOT HELP. Its whitelist in that sub is
+ *     literally `my $deletable = { comment => 1 };`, and anything else answers
+ *     "unknown option '<k>'" — so `expire` and `privsep` have no clear path at all, which is the
+ *     other half of why both are required props rather than optional ones.
+ *
+ * ⚠️ `flag()` FROM values.ts IS DELIBERATELY NOT USED FOR `privsep`. Its entire job is turning an
+ *   UNDECLARED boolean into `undefined` so the field is omitted from the form; `privsep` is a
+ *   required prop precisely so that it is never undeclared, so there is nothing for it to do and
+ *   its `string | undefined` return would have to be asserted away to fit `Record<string,string>`.
+ *   An assertion here would be a claim about the prop that the type already makes properly.
+ */
+export declare const shape: (props: ApiTokenProps) => Record<string, string>;
+export declare const apiTokenSpec: PveSpec<ApiTokenProps, ApiTokenAttributes>;
+//# sourceMappingURL=api-token-form.d.ts.map

package/dist/proxmox/api-token-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/api-token-form.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxE;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG7C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,UAAW,aAAa,WAAuC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,KAAK,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAIhE,CAAC;AAEH,eAAO,MAAM,YAAY,EAAE,OAAO,CAAC,aAAa,EAAE,kBAAkB,CAwDnE,CAAC"}

package/dist/proxmox/api-token.d.ts

@@ -0,0 +1,159 @@
+/**
+ * `Proxmox.ApiToken` — a PVE API token: the thing a service actually authenticates as.
+ *
+ * ⛔ THE SECRET EXISTS FOR ONE HTTP RESPONSE AND THEN NOWHERE. MEASURED from the cluster's own
+ *   schema (`/usr/share/pve-docs/api-viewer/apidoc.js` on n2, 2026-09-13): POST returns
+ *   `["full-tokenid","info","value"]`; PUT returns `["comment","expire","full-tokenid","privsep",
+ *   "value"]` with `value` present ONLY when `regenerate` was set; GET returns
+ *   `["comment","expire","privsep"]` and never the secret. A live token agrees —
+ *   `GET /access/users/monitoring@pve/token/exporter` answers `{"expire":0,"privsep":0}`. PVE says
+ *   it plainly on the POST: the value "needs to be stored as it cannot be retrieved afterwards".
+ *
+ * ⛔ SO A TOKEN THIS RESOURCE CREATES IS UNUSABLE, AND SAYING SO IS THE POINT OF THIS BLOCK. The
+ *   secret may not become an attribute: Alchemy persists attributes UNENCRYPTED, and this estate's
+ *   state store is a Postgres dumped nightly (the ⛔ in credentials.ts). So `reconcile` drops the
+ *   value on the floor, and what lands is a live credential in `/etc/pve/user.cfg` whose secret
+ *   nobody holds. No `regenerate` rescues it, because a regenerated value is discarded the same
+ *   way. The only escape is an operator who captured the value out of band — which this provider
+ *   gives them no way to do.
+ *   ★ SO POINT THIS FAMILY AT TOKENS THAT ALREADY EXIST. `comment`, `expire` and `privsep` are the
+ *     whole of a token's policy, and declaring them is real work: it is how `expire` stops being
+ *     whatever somebody typed in 2024. Mint NEW tokens where the secret can be caught — OpenBao's
+ *     `proxmox-tb4` mount, or a human at `pveum user token add`.
+ *   ⚠️ THE CREATE PATH IS LEFT REACHABLE RATHER THAN STUBBED. A create that silently did nothing
+ *     would be the same lie as the stubbed delete resource.ts's ★ refuses; the honest arrangement
+ *     is a create that works and a header that says what it produces.
+ *
+ * ⛔ THERE IS NO `regenerate` PROP, AND IT IS NOT AN OVERSIGHT. PVE's own description: "All users
+ *   of the previous secret will lose access after this operation." A prop for it would revoke a
+ *   live credential during a deploy whose plan said `update`, and hand back a replacement this
+ *   provider is obliged to throw away — breakage with no recovery. Rotation belongs to the mount
+ *   that owns the lease, or to a human who is watching.
+ *
+ * ⚠️ THERE IS A SECOND WRITER TO THESE OBJECTS AND IT IS THE ONE THIS PROVIDER RUNS ON. OpenBao's
+ *   `proxmox-tb4` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` — read from
+ *   `house/platform/secrets/vault/plugin-proxmox/proxmox/`: `privsep=0` (client.go), `expire` set
+ *   to the lease deadline, and an id the plugin CHOOSES,
+ *   `hf-<role>-<actor>-<entity6>-<stamp>-<nonce>` (tokenname.go). Revocation and WAL rollback look
+ *   up that one exact id (wal.go); neither sweeps a prefix. So the two systems cannot collide on
+ *   one object by accident — but they share the USER: `hf-read@pve` held three live leases when
+ *   this was written, and `Proxmox.User` deleting that account takes every one of them with it.
+ *   ⛔ DO NOT DECLARE A TOKEN UNDER A MINT USER. `expire` is what makes that dangerous rather than
+ *     untidy: point this resource at a lease token with the wrong expire and a 300-second
+ *     credential becomes a permanent one — and on `hf-provision@pve` that credential carries
+ *     `Permissions.Modify` at `/`. docs/privileges.md records what those 27 privileges buy.
+ *
+ * ⚠️ PRIVILEGES, AND THE READ LANE CANNOT DO IT. MEASURED: all four methods on this path check
+ *   `['or', ['userid-param','self'], ['userid-group', ['User.Modify']]]` — with no `Sys.Audit`
+ *   alternative, unlike `GET /access/users/{userid}`, which has one. And
+ *   `pvesh get /access/permissions --userid hf-read@pve --path /access/groups` answers the seven
+ *   PVEAuditor audit privileges and no `User.Modify`, while `hf-provision@pve` has it. So the
+ *   3600s read lease reaches at most its OWN account's tokens and is refused for every other
+ *   userid — which `read` in resource.ts folds into "absent", so the plan says create and the POST
+ *   then fails with "Token already exists". Hence `readRole: 'provision'` below, for the same
+ *   reason storage.ts, sdn-zone.ts and sdn-vnet.ts set it, at the same cost: every plan mints a
+ *   300s non-renewable provision lease just to read.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import { type PveRequirements, type WithTarget } from './resource.ts';
+export interface ApiTokenProps extends WithTarget {
+    /**
+     * The account that owns the token, realm-qualified: `tofu@pve`, `root@pam`. Identity.
+     *
+     * ⚠️ THE ACCOUNT MUST ALREADY EXIST. Every method here runs `check_user_exist` first, so a
+     *   token named under a missing user fails the READ (folded to "absent") and then fails the
+     *   create with "no such user" — the honest error, arriving one step after the misleading plan.
+     *   Sequence a `Proxmox.User` ahead of it and the ordering takes care of itself.
+     */
+    userid: string;
+    /**
+     * The token's own name, unique within the account. Identity.
+     *
+     * ⚠️ PVE HAS NO RENAME, AND HERE THAT COSTS MORE THAN IT DOES FOR A USER. Editing this prop (or
+     *   `userid`) points `path` at a DIFFERENT token, which reads as absent and is then created —
+     *   leaving the old token LIVE, with its secret still working, invisible to the plan, while the
+     *   new one is the unusable kind described at the top. Rename by declaring a delete and a
+     *   create, the way user.ts says for an account.
+     *   ⛔ `diff` IS NOT OVERRIDDEN TO SAY `replace` THE WAY acl.ts DOES, AND THE DIFFERENCE IS THE
+     *     OBJECT. There, replace removes a grant that can be rebuilt from its own tuple; here it
+     *     would DELETE a live token — destroying an irrecoverable secret, and everything using it —
+     *     to tidy up a name. Leaving the old token standing is the lesser harm, and saying so here
+     *     is what keeps it from looking like an omission.
+     * ⚠️ PATTERN `[A-Za-z][A-Za-z0-9.\-_]+`: a letter first, two characters minimum. The schema
+     *   declares no maxLength; the OpenBao plugin assumes a conservative 64 rather than finding the
+     *   real limit in production, and so should anything else.
+     */
+    tokenid: string;
+    /**
+     * Free text in `pveum user token list` and the UI. Empty is how it is cleared — see `shape`.
+     * ⚠️ ANY CHARACTER IS SAFE HERE, MEASURED, and it was worth checking: `user.cfg` is a
+     *   colon-delimited line, so a comment holding a colon or a newline is the obvious place for a
+     *   round-trip to lose a character and diff forever. PVE escapes it — `encode_text` turns
+     *   `a:b\nc%d` into `a%3Ab%0Ac%25d` and `decode_text` gives it back byte for byte.
+     */
+    comment?: string;
+    /**
+     * Seconds since the epoch, or 0 for "never expires".
+     *
+     * ⛔ REQUIRED, AND THE SCHEMA WILL TELL YOU IT NEED NOT BE. It declares the default "same as
+     *   user", and the code never implements it: `generate_token` writes `expire` only when the
+     *   parameter is defined, `user.cfg` stores a token as `token:<id>:<expire>:<privsep>:<comment>:`
+     *   with no absent state, and the parser does `$expire = 0 if !$expire` (AccessControl.pm:1624).
+     *   MEASURED end to end: every token on this cluster that was created without an expire reads
+     *   back `"expire":0`. So "same as user" is documentation of an intention, not behaviour.
+     * ⛔ WHICH IS WHY IT IS NOT OPTIONAL-DEFAULTING-TO-0. That spelling reads identically and is far
+     *   worse: an omitted `expire` would then quietly WRITE 0 over a live deadline, turning an
+     *   expiring credential into a permanent one, and the plan would call it an update. Requiring
+     *   the field makes "this token never expires" a sentence somebody had to type.
+     */
+    expire: number;
+    /**
+     * True keeps the token's privileges separate from its owner's — it gets NOTHING until an ACL
+     *   names `fullTokenid`. False gives it the owner's privileges entire.
+     *
+     * ⛔ REQUIRED FOR THE SAME REASON AS `expire`, AND THE BLAST RADIUS IS LARGER. PVE's API default
+     *   is 1, every token on this cluster is 0 (measured), and `user.cfg` materialises it either way
+     *   — `$privsep = $privsep ? 1 : 0` (AccessControl.pm:1622), so there is no unset state to
+     *   preserve. Were this optional, adopting a live token without mentioning `privsep` would plan
+     *   an update to 1 and STRIP a working credential of every privilege it has, silently: PVE
+     *   returns 401/403 to the service, nothing errors here, and `tofu@pve!apply` simply stops
+     *   working. Required, so adopting a token is a sentence that states what it is.
+     * ⚠️ AND `false` IS NOT A SHRUG. It is a token with its owner's whole privilege set; under a
+     *   provisioning account that is the account's full authority with a separate secret.
+     */
+    privsep: boolean;
+}
+export interface ApiTokenAttributes {
+    userid: string;
+    tokenid: string;
+    /** `<userid>!<tokenid>` — what `Proxmox.Acl` binds as its `ugid`. Derived; never compared. */
+    fullTokenid: string;
+    comment: string;
+    expire: number;
+    privsep: boolean;
+}
+export interface ProxmoxApiToken extends Resource<'Proxmox.ApiToken', ApiTokenProps, ApiTokenAttributes, never, PveRequirements> {
+}
+/**
+ * ★ `retain` BY DEFAULT, AND THIS IS THE PLAINEST CASE FOR IT IN THE PACKAGE. A token's contents
+ *   are one irreplaceable secret: delete it and the value is gone, a replacement is a DIFFERENT
+ *   value, and every holder loses access the instant `cfs_write_file` returns — with no error
+ *   raised anywhere near them. The live cluster's tokens are `monitoring@pve!exporter` (the PVE
+ *   exporter feeding VictoriaMetrics), `mcp@pve!executor`, `tofu@pve!apply`, `tofu@pve!ro`,
+ *   `sablier@pve!sablier` and `vaultmint@pve!engine` — the last being the parent credential the
+ *   OpenBao mount itself authenticates with, so orphaning that one would stop every plan in this
+ *   package, this resource included. `delete` is FULLY IMPLEMENTED (DELETE is a real method on
+ *   this path, measured) and runs the moment a caller opts in with `.pipe(RemovalPolicy.destroy())`.
+ *   See the ★ in resource.ts, which explains the convention once.
+ */
+export declare const ProxmoxApiToken: import("alchemy").ResourceClass<ProxmoxApiToken>;
+/**
+ * ⛔ `list` IS EMPTY, AND FOR THIS FAMILY THAT MATTERS MORE THAN THE GENERIC ARGUMENT IN
+ *   resource.ts. A token index handed to Alchemy would offer up `vaultmint@pve!engine` and every
+ *   live OpenBao lease for adoption — and adoption is what makes a later plan willing to delete.
+ *   The mount's leases in particular appear and vanish on their own; anything that adopted one
+ *   would report drift against a credential that was never its to hold.
+ */
+export declare const ProxmoxApiTokenProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxApiToken>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=api-token.d.ts.map

package/dist/proxmox/api-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token.d.ts","sourceRoot":"","sources":["../../src/proxmox/api-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAA8B,MAAM,eAAe,CAAC;AAElG,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAOlB;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,kDAE1B,CAAC;AA6CH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,qIACqD,CAAC"}

package/dist/proxmox/backup-job.d.ts

@@ -0,0 +1,112 @@
+/**
+ * `Proxmox.BackupJob` — the vzdump schedule, declared. The one object whose drift nothing else on
+ * the cluster reveals.
+ *
+ * ★ WHY THIS ONE EARNS ITS PLACE. A hand-made vzdump job drifts silently: a schedule moved by an
+ *   hour, a retention trimmed to `keep-last=1`, or `enabled 0` set during a maintenance window and
+ *   never set back. All three look like a healthy cluster from every angle except a restore.
+ *   Declared here, `diff` reads the LIVE job on every plan, so a hand edit surfaces as
+ *   `1 to update` that day rather than on the day somebody needs last night's backup and finds a
+ *   week-old one, or none.
+ *
+ * ⛔ PVE GENERATES `id` WHEN YOU OMIT IT, WHICH MAKES OMITTING IT THE WORST BUG THIS RESOURCE
+ *   COULD CARRY. PVE's own API schema says so in one parenthesis — `id`: "Job ID (will be
+ *   autogenerated)." — and a generated id looks like `backup-f56d8ab7-d524`. A resource that
+ *   POSTed without an id would create a SECOND job beside the first on EVERY reconcile, and the
+ *   read-back in `pveOperations` would still pass, because a job did appear: that check asks "is
+ *   the object there", not "is it the one I meant". So `id` is a REQUIRED prop and is always sent
+ *   on create. To adopt a job that already exists, declare its existing id; any other id is a new
+ *   job beside it, not an adoption.
+ *   ★ AN EXPLICIT id ALSO CLOSES A SECOND HOLE. `pveOperations.read` turns ANY failed GET into
+ *     "absent" — an expired lease, a 403, a node that did not answer — and reconcile then POSTs.
+ *     With an id, PVE refuses a duplicate section id and the deploy fails loudly; without one, that
+ *     same swallowed error would have quietly doubled the cluster's backup jobs.
+ *
+ * ⚠️ `Sys.Modify` ON `/` IS THE GATE AND IT IS NOT A SMALL GRANT. PVE has no Backup.* privilege:
+ *   create, update and delete of a vzdump job are all checked against `Sys.Modify` at `/` — the
+ *   same privilege that covers node network configuration. A credential that can declare backup
+ *   jobs can also rewrite the cluster's networking. That is PVE's granularity rather than a choice
+ *   made here, and it is exactly why widening a role for this should be a decision rather than a
+ *   reaction to a 403.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import { type PveRequirements, type WithTarget } from './resource.ts';
+/**
+ * ⚠️ THE PROPS ARE PVE'S OWN KEY NAMES, DASHES INCLUDED. `notes-template` rather than
+ *   `notesTemplate` is deliberate: `createForm` is then a copy rather than a translation table,
+ *   and a translation table is one more place for a key to be renamed and silently never sent. A
+ *   field that is never sent reads back as whatever it already was, which is indistinguishable
+ *   from "PVE ignored me".
+ */
+export interface BackupJobProps extends WithTarget {
+    /** ⛔ The primary key, REQUIRED. Never let PVE generate it — see the ⛔ above. */
+    id: string;
+    /** A subset of systemd calendar events, e.g. `01:00` or `mon..fri 02:30`. */
+    schedule: string;
+    /** Target storage id. That storage's own retention applies unless `prune-backups` overrides it. */
+    storage?: string;
+    mode?: 'snapshot' | 'suspend' | 'stop';
+    /** PVE's default is enabled. A disabled job is a backup that silently is not happening. */
+    enabled?: boolean;
+    /** Back up every guest. ⚠️ Pick exactly one of `all`, `vmid` and `pool` — see `shape` below. */
+    all?: boolean;
+    vmid?: readonly number[];
+    pool?: string;
+    /** Guest ids to skip. PVE reads this as "all guests except these", so it belongs with `all`. */
+    exclude?: readonly number[];
+    /** Retention, as a property string: `keep-daily=7,keep-weekly=4`. */
+    'prune-backups'?: string;
+    /** Supports {{cluster}}, {{guestname}}, {{node}} and {{vmid}}. Single line only. */
+    'notes-template'?: string;
+    'notification-mode'?: 'auto' | 'legacy-sendmail' | 'notification-system';
+    /** Run a missed job as soon as the scheduler is back. */
+    'repeat-missed'?: boolean;
+    /** VM-only fleecing, as a property string: `enabled=1,storage=<id>`. See `propertyString`. */
+    fleecing?: string;
+    comment?: string;
+}
+export interface BackupJobAttributes {
+    id: string;
+    schedule: string;
+    storage: string;
+    mode: string;
+    enabled: boolean;
+    all: boolean;
+    /** Sorted and comma-joined, so re-ordering a declaration is not a diff. See `guestList`. */
+    vmid: string;
+    pool: string;
+    exclude: string;
+    /** Flattened and sorted — never the raw value PVE returned. See `propertyString`. */
+    'prune-backups': string;
+    'notes-template': string;
+    'notification-mode': string;
+    'repeat-missed': boolean;
+    fleecing: string;
+    comment: string;
+    /**
+     * PVE's own estimate, epoch seconds. REPORTED, NEVER COMPARED: `next-run` in `matches` would
+     * report an update every time the clock passed a scheduled run. It is here so a plan can show
+     * that a job is still due — a `next-run` of 0 is a job the scheduler will not run.
+     */
+    'next-run': number;
+}
+export interface ProxmoxBackupJob extends Resource<'Proxmox.BackupJob', BackupJobProps, BackupJobAttributes, never, PveRequirements> {
+}
+export declare const ProxmoxBackupJob: import("alchemy").ResourceClass<ProxmoxBackupJob>;
+/**
+* ⛔ Empty for the same reason as every other resource here: adoption must be explicit.
+*   `GET /cluster/backup` would hand back the job somebody made by hand, and adopting it
+*   implicitly would give Alchemy the right to DELETE a cluster's only backup schedule the
+*   first time a line left a stack file.
+ 
+ *
+* ⚠️ DELETING THE JOB DOES NOT DELETE THE BACKUPS, AND THAT CUTS BOTH WAYS. The archives
+*   stay on the storage, so this looks harmless today; it is destructive in six months,
+*   when the schedule that should have replaced them has not run since. PVE will not
+*   refuse this the way it refuses to delete a pool still holding guests — nothing depends
+*   on a backup job — so the plan line is the only warning anyone gets.
+ 
+ */
+export declare const ProxmoxBackupJobProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxBackupJob>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=backup-job.d.ts.map

package/dist/proxmox/backup-job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/backup-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAC;IACX,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,2FAA2F;IAC3F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gGAAgG;IAChG,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;IACzE,yDAAyD;IACzD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;IACb,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAAkD,CAAC;AA2FhF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,sIACsD,CAAC"}