@homeflare/alchemy 0.20.0 → 0.21.0

package/dist/caddy/index.js.map

@@ -1,7 +1,8 @@
 {
   "version": 3,
-  "sources": ["../src/caddy/admin.ts", "../src/launchd/job-form.ts", "../src/launchd/plist.ts", "../src/caddy/digest.ts", "../src/caddy/admin-calls.ts", "../src/caddy/config.ts", "../src/launchd/host-effect.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/caddy/admin-guard.ts", "../src/launchd/secret-tripwire.ts", "../src/caddy/caddyfile-tripwire.ts", "../src/caddy/config-form.ts", "../src/caddy/config-lifecycle.ts", "../src/caddy/local-admin.ts", "../src/caddy/providers.ts", "../src/caddy/with-file.ts", "../src/launchd/host-file.ts", "../src/launchd/host-file-form.ts", "../src/launchd/runner.ts", "../src/launchd/host-file-lifecycle.ts"],
+  "sources": ["../src/caddy/access-forward-auth.ts", "../src/caddy/admin.ts", "../src/launchd/job-form.ts", "../src/launchd/plist.ts", "../src/caddy/digest.ts", "../src/caddy/admin-calls.ts", "../src/caddy/config.ts", "../src/launchd/host-effect.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/caddy/admin-guard.ts", "../src/launchd/secret-tripwire.ts", "../src/caddy/caddyfile-tripwire.ts", "../src/caddy/config-form.ts", "../src/caddy/config-lifecycle.ts", "../src/caddy/local-admin.ts", "../src/caddy/providers.ts", "../src/caddy/with-file.ts", "../src/launchd/host-file.ts", "../src/launchd/file-identity.ts", "../src/launchd/runner.ts", "../src/launchd/file-converge.ts", "../src/launchd/host-file-form.ts", "../src/launchd/host-file-lifecycle.ts"],
   "sourcesContent": [
+    "/**\n * The Caddyfile half of \"protect this route with Cloudflare Access\": a `forward_auth` block\n * pointing at a verifier that speaks the contract in `@homeflare/cloudflare/access-auth`.\n *\n * ★ A BUILDER, NOT A RESOURCE. Nothing here is created, adopted or destroyed — it is Caddyfile\n *   TEXT that a caller drops into the `caddyfile` prop of a `CaddyConfig` / `caddyWithFile()`.\n *   A resource would own a fragment of a config that `CaddyConfig` already owns whole, and two\n *   owners of one file is the drift this package exists to prevent.\n *\n * ⛔ WHY IT IS GENERATED RATHER THAN COPY-PASTED. Every field below is load-bearing, and the\n *   failure mode of getting one wrong is a route that looks protected and is not:\n *   · a missing `copy_headers` — the upstream gets no identity and either breaks or, worse,\n *     falls back to trusting a header the CLIENT set;\n *   · the verifier on anything but loopback — the JWT check becomes advisory, because the\n *     verifier itself can be reached and answered around;\n *   · `uri` pointing at a path the verifier does not route — every request 404s, which is\n *     non-2xx, which Caddy correctly treats as a denial, so the symptom is \"Access is broken\".\n */\n\n/** ⚠️ Kept in step with `granted()` in @homeflare/cloudflare/access-auth. */\nconst DEFAULT_COPY_HEADERS = ['X-Access-Email', 'X-Access-Sub'] as const;\n\nexport interface AccessForwardAuthProps {\n  /**\n   * Where the verifier listens, e.g. `127.0.0.1:9101`.\n   * ⛔ LOOPBACK OR A UNIX SOCKET. See `verifierProblems` — a routable verifier is not a check.\n   */\n  readonly verifier: string;\n  /** The path the verifier answers on. @default '/access/verify' */\n  readonly uri?: string;\n  /**\n   * Response headers copied from the verifier onto the upstream request.\n   * @default ['X-Access-Email', 'X-Access-Sub']\n   */\n  readonly copyHeaders?: readonly string[];\n  /** Lines placed inside the route BEFORE `forward_auth` — typically the upstream. */\n  readonly body?: readonly string[];\n  /** Indent applied to every emitted line. @default '\\t' */\n  readonly indent?: string;\n}\n\n/**\n * Problems that make a `forward_auth` block unsafe rather than merely wrong.\n *\n * ⛔ THE LOOPBACK RULE IS THE IMPORTANT ONE. If the verifier answers on a routable address, an\n *   attacker reaches the UPSTREAM directly and never involves Caddy at all — or reaches the\n *   verifier and reads identities out of it. The whole design assumes both the verifier and the\n *   upstream are bound to loopback and that Caddy is the only way in.\n */\nconst LOOPBACK = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);\n\n/**\n * The host part of a Caddy upstream address.\n *\n * ⚠️ NOT `split(':')[0]`. That returns `'['` for `[::1]:9101`, so an IPv6 loopback verifier\n *   was rejected as routable — caught by the test below, not by reading the code.\n */\nconst hostOf = (verifier: string): string => {\n  const address = verifier.replace(/^https?:\\/\\//, '');\n  if (address.startsWith('unix/')) return 'unix';\n\n  // Bracketed IPv6 keeps its brackets; the port is whatever follows the closing one.\n  if (address.startsWith('[')) return address.slice(0, address.indexOf(']') + 1);\n\n  const colon = address.indexOf(':');\n  return colon === -1 ? address : address.slice(0, colon);\n};\n\nexport const verifierProblems = (verifier: string): string[] => {\n  const found: string[] = [];\n  const host = hostOf(verifier.trim());\n\n  if (verifier.trim() === '') found.push('verifier is empty');\n  else if (host !== 'unix' && !LOOPBACK.has(host)) {\n    found.push(\n      `verifier must be loopback or a unix socket, got ${verifier} — a routable verifier can be bypassed`,\n    );\n  }\n  return found;\n};\n\n/**\n * Render the `forward_auth` block for one protected route.\n *\n * ```ts\n * const caddyfile = `vnc.example.com {\n * ${accessForwardAuth({ verifier: '127.0.0.1:9101', body: ['reverse_proxy 127.0.0.1:6080'] })}\n * }\n * `;\n * ```\n *\n * ⛔ ONE VERIFIER ENDPOINT PER ACCESS APPLICATION. The AUD is fixed in the verifier's own config,\n *   never carried in this request — so two applications mean two `uri`s (or two verifiers), not\n *   one endpoint told which app to check. An AUD the request can influence is the vulnerability.\n *\n * ⚠️ `forward_auth` COPIES THE VERIFIER'S RESPONSE BACK TO THE CLIENT on any non-2xx, which is why\n *   the verifier answers a bare 401 with no body: whatever it returns is what the browser sees.\n */\nexport const accessForwardAuth = (props: AccessForwardAuthProps): string => {\n  const problems = verifierProblems(props.verifier);\n  if (problems.length > 0) throw new Error(`accessForwardAuth: ${problems.join('; ')}`);\n\n  const indent = props.indent ?? '\\t';\n  const uri = props.uri ?? '/access/verify';\n  const headers = props.copyHeaders ?? DEFAULT_COPY_HEADERS;\n\n  const lines = [\n    ...(props.body ?? []),\n    `forward_auth ${props.verifier} {`,\n    `${indent}uri ${uri}`,\n    // ⚠️ `copy_headers` with a block, one field per line: the single-line form is also valid but\n    //   diffs badly, and this list is exactly where a security review needs to read a change.\n    `${indent}copy_headers {`,\n    ...headers.map((header) => `${indent}${indent}${header}`),\n    `${indent}}`,\n    '}',\n  ];\n\n  return lines.map((line) => `${indent}${line}`).join('\\n');\n};\n",
     "/**\n * The one seam between the Caddy provider and a running Caddy: every call to Caddy's admin API goes\n * through a CaddyAdmin, and nothing in this directory reaches Caddy any other way.\n *\n * ★ CADDY's OWN MANAGEMENT API, NOT A FILE AND A SIGNAL. Decision 23 (vault consolidation plan,\n *   2026-09-21): `POST /load` applies a Caddyfile with a graceful reload and rolls back a config\n *   Caddy refuses; `GET /config/` reports what is running. Read in caddyserver/caddy v2.11.4,\n *   caddyconfig/load.go and admin.go, and in the API docs (caddyserver.com/docs/api).\n * ★ A SEAM, THE SAME SHAPE AS launchd's HostRunner, so the lifecycle runs against a fake admin\n *   server in tests and a consumer can plug in another route to the API (an SSH-forwarded socket\n *   today; a remote runner later) without touching the provider. PROMISES, NOT EFFECTS, for the\n *   same reason as HostRunner: a consumer writing their own implements plain async functions.\n * ⛔ THE ADMIN API HAS NO AUTHENTICATION. Anyone who reaches it can replace every site. It stays on\n *   loopback or a unix socket; localCaddyAdmin() refuses anything else (local-admin.ts).\n */\nimport * as Context from 'effect/Context';\nimport * as Layer from 'effect/Layer';\n\n/** One admin API exchange. ⛔ `body` may hold the running config — never log it whole. */\nexport type CaddyAdminResponse = {\n  readonly status: number;\n  readonly body: string;\n};\n\nexport type CaddyAdminRequest = {\n  readonly method: 'GET' | 'POST';\n  /** Absolute API path: `/load`, `/adapt`, `/config/`. */\n  readonly path: string;\n  readonly headers?: Readonly<Record<string, string>>;\n  readonly body?: string;\n};\n\n/**\n * Where the admin listener is, in the terms Caddy's own `admin` option uses — so a Caddyfile that\n * would move the listener away from where the provider talks to it can be refused (admin-guard.ts).\n */\nexport type CaddyAdminListener =\n  | { readonly kind: 'tcp'; readonly hostHeader: string; readonly port: number }\n  | { readonly kind: 'unix'; readonly path: string };\n\nexport interface CaddyAdmin {\n  /** Where requests go, for error messages and the resource's attributes. Never a credential. */\n  readonly endpoint: string;\n  /**\n   * The listener as Caddy sees it. `hostHeader` is the Host every request carries: Caddy checks it\n   * against `admin.origins` (admin.go checkHost) on any loopback TCP listener.\n   */\n  readonly listener: CaddyAdminListener;\n  /**\n   * Send one request. Resolves with ANY status — classifying it is the caller's job\n   * (admin-calls.ts). Rejects only when there was no HTTP exchange at all: with a\n   * CaddyUnreachableError when nothing accepted the connection, any other Error otherwise.\n   */\n  request(request: CaddyAdminRequest): Promise<CaddyAdminResponse>;\n}\n\n/**\n * Nothing accepted the connection — Caddy is not running, or not listening yet. A transport rejects\n * with THIS only when the request provably never reached Caddy (refused, no socket file), because\n * the provider treats it differently from every other failure: a stopped Caddy must not fail the\n * PLAN that would bring it back (its launchd job in the same stack) — see config.ts.\n */\nexport class CaddyUnreachableError extends Error {\n  override readonly name = 'CaddyUnreachableError';\n}\n\n/** The Effect service the Caddy provider reads its admin transport from. */\nexport class CaddyAdminService extends Context.Service<CaddyAdminService, CaddyAdmin>()(\n  'homeflare/caddy/CaddyAdmin',\n) {}\n\n/** Provide a transport to the provider: `Layer.provide(caddyAdminLayer(localCaddyAdmin()))`. */\nexport const caddyAdminLayer = (admin: CaddyAdmin): Layer.Layer<CaddyAdminService> =>\n  Layer.succeed(CaddyAdminService, admin);\n",
     "/**\n * LaunchdJob's props, attributes and the pure half of the provider: domain parsing, the plist path,\n * and the props → plist mapping whose SHA-256 is the whole diff.\n *\n * ★ KEY NAMES AND MEANINGS FROM launchd.plist(5), checked against the 148 nix-darwin daemons on a\n *   macOS 27.2 host on 2026-09-21 (read-only, from /nix/store): Label, ProgramArguments, RunAtLoad,\n *   KeepAlive (boolean or {SuccessfulExit}), ThrottleInterval, StandardOutPath/StandardErrorPath,\n *   EnvironmentVariables, UserName, StartInterval and StartCalendarInterval are the keys in real\n *   use. Everything rarer goes through `extraKeys`.\n */\nimport { createHash } from 'node:crypto';\nimport { type PlistDict, type PlistValue, renderPlist } from './plist.ts';\n\n/** `system` (LaunchDaemons, root) or one user's login session, `gui/<uid>` (LaunchAgents). */\nexport type LaunchdDomain = 'system' | `gui/${number}`;\n\n/** One StartCalendarInterval entry. An omitted field is a wildcard, as in cron. */\nexport type CalendarInterval = {\n  readonly minute?: number;\n  readonly hour?: number;\n  readonly day?: number;\n  /** 0 and 7 are both Sunday. */\n  readonly weekday?: number;\n  readonly month?: number;\n};\n\n/** `true` = always restart; the object form restarts only on the named conditions. */\nexport type KeepAlive = boolean | { readonly successfulExit?: boolean; readonly crashed?: boolean };\n\nexport interface LaunchdJobProps {\n  /** Reverse-DNS label. Unique per domain; also the plist's file name. */\n  label: string;\n  domain: LaunchdDomain;\n  /** argv; the first element must be an absolute path. */\n  programArguments: readonly string[];\n  /**\n   * ⛔ NON-SECRET VALUES ONLY. Props are stored unencrypted in Alchemy state, and these also land in\n   *   the plist on disk and in `launchctl print`. Pass a secret as a FILE PATH that a secret renderer\n   *   (openbao-agent) maintains — secret-tripwire.ts refuses the obvious mistakes.\n   */\n  environment?: Readonly<Record<string, string>>;\n  runAtLoad?: boolean;\n  keepAlive?: KeepAlive;\n  /** Seconds between starts. */\n  startInterval?: number;\n  startCalendarInterval?: CalendarInterval | readonly CalendarInterval[];\n  /** Minimum seconds between (re)starts; launchd's default is 10. */\n  throttleInterval?: number;\n  standardOutPath?: string;\n  standardErrorPath?: string;\n  workingDirectory?: string;\n  /** Run as this user. ⚠️ System domain only — launchd ignores it for agents, so it is refused. */\n  userName?: string;\n  /** Run as this group. ⚠️ System domain only, like `userName`. */\n  groupName?: string;\n  /**\n   * Any other launchd.plist(5) key, verbatim (`ProcessType`, `SoftResourceLimits`, …).\n   * ⛔ A key the typed props own is refused, so one job can never say two things.\n   */\n  extraKeys?: PlistDict;\n}\n\nexport interface LaunchdJobAttributes {\n  label: string;\n  domain: LaunchdDomain;\n  /** `<domain>/<label>` — what `launchctl print` / `bootout` take. */\n  serviceTarget: string;\n  plistPath: string;\n  /** SHA-256 of the plist bytes last bootstrapped (reconcile) or found on disk (read). */\n  plistSha256: string;\n  /** Bootstrapped into the domain — not necessarily running. */\n  loaded: boolean;\n  /** launchd's own word: `running`, `not running`, … */\n  state?: string;\n  pid?: number;\n  lastExitCode?: number;\n}\n\nexport type ParsedDomain =\n  | { readonly kind: 'system' }\n  | { readonly kind: 'gui'; readonly uid: number };\n\nexport const parseDomain = (domain: string): ParsedDomain | undefined => {\n  if (domain === 'system') return { kind: 'system' };\n  const match = /^gui\\/(\\d+)$/.exec(domain);\n  return match?.[1] === undefined ? undefined : { kind: 'gui', uid: Number(match[1]) };\n};\n\nexport const serviceTarget = (label: string, domain: LaunchdDomain): string => `${domain}/${label}`;\n\n/**\n * Where launchd expects the job's plist. ★ Derived, never declared: a daemon's plist outside\n *   /Library/LaunchDaemons is not bootstrapped at boot, so a free-form path would be a job that\n *   silently stops existing after the next restart.\n */\nexport const plistPathFor = (\n  label: string,\n  domain: ParsedDomain,\n  home: string | undefined,\n): string => {\n  if (domain.kind === 'system') return `/Library/LaunchDaemons/${label}.plist`;\n  // ⛔ No `~` fallback: the provider may run as root, whose `~` is not the agent owner's home.\n  if (home === undefined || !home.startsWith('/')) {\n    throw new Error(`gui/${String(domain.uid)}: no home directory for that uid on this host`);\n  }\n  return `${home}/Library/LaunchAgents/${label}.plist`;\n};\n\n/** Plist keys the typed props own — `extraKeys` may not name them. `Program` is refused too. */\nexport const OWNED_KEYS: readonly string[] = [\n  'EnvironmentVariables',\n  'GroupName',\n  'KeepAlive',\n  'Label',\n  'Program',\n  'ProgramArguments',\n  'RunAtLoad',\n  'StandardErrorPath',\n  'StandardOutPath',\n  'StartCalendarInterval',\n  'StartInterval',\n  'ThrottleInterval',\n  'UserName',\n  'WorkingDirectory',\n];\n\nconst calendarDict = (entry: CalendarInterval): PlistDict => {\n  const dict: Record<string, PlistValue> = {};\n  if (entry.minute !== undefined) dict['Minute'] = entry.minute;\n  if (entry.hour !== undefined) dict['Hour'] = entry.hour;\n  if (entry.day !== undefined) dict['Day'] = entry.day;\n  if (entry.weekday !== undefined) dict['Weekday'] = entry.weekday;\n  if (entry.month !== undefined) dict['Month'] = entry.month;\n  return dict;\n};\n\nconst keepAliveValue = (keepAlive: KeepAlive): PlistValue => {\n  if (typeof keepAlive === 'boolean') return keepAlive;\n  const dict: Record<string, PlistValue> = {};\n  if (keepAlive.successfulExit !== undefined) dict['SuccessfulExit'] = keepAlive.successfulExit;\n  if (keepAlive.crashed !== undefined) dict['Crashed'] = keepAlive.crashed;\n  return dict;\n};\n\n/** The plist dict for a job. ⚠️ Assumes jobProblems() came back empty. */\nexport const jobPlistDict = (props: LaunchdJobProps): PlistDict => {\n  const dict: Record<string, PlistValue> = { ...props.extraKeys };\n  dict['Label'] = props.label;\n  dict['ProgramArguments'] = [...props.programArguments];\n  const env = props.environment ?? {};\n  if (Object.keys(env).length > 0) dict['EnvironmentVariables'] = { ...env };\n  if (props.runAtLoad !== undefined) dict['RunAtLoad'] = props.runAtLoad;\n  if (props.keepAlive !== undefined) dict['KeepAlive'] = keepAliveValue(props.keepAlive);\n  if (props.startInterval !== undefined) dict['StartInterval'] = props.startInterval;\n  const calendar = props.startCalendarInterval;\n  if (calendar !== undefined) {\n    dict['StartCalendarInterval'] = Array.isArray(calendar)\n      ? (calendar as readonly CalendarInterval[]).map(calendarDict)\n      : calendarDict(calendar as CalendarInterval);\n  }\n  if (props.throttleInterval !== undefined) dict['ThrottleInterval'] = props.throttleInterval;\n  if (props.standardOutPath !== undefined) dict['StandardOutPath'] = props.standardOutPath;\n  if (props.standardErrorPath !== undefined) dict['StandardErrorPath'] = props.standardErrorPath;\n  if (props.workingDirectory !== undefined) dict['WorkingDirectory'] = props.workingDirectory;\n  if (props.userName !== undefined) dict['UserName'] = props.userName;\n  if (props.groupName !== undefined) dict['GroupName'] = props.groupName;\n  return dict;\n};\n\nexport const sha256Hex = (bytes: Uint8Array | string): string =>\n  createHash('sha256').update(bytes).digest('hex');\n\n/** The rendered plist and its digest — the only thing LaunchdJob compares. */\nexport const renderJob = (\n  props: LaunchdJobProps,\n): { text: string; bytes: Uint8Array; sha256: string } => {\n  const text = renderPlist(jobPlistDict(props));\n  const bytes = new TextEncoder().encode(text);\n  return { bytes, sha256: sha256Hex(bytes), text };\n};\n",
     "/**\n * An XML property list serializer — the subset launchd.plist(5) reads, and nothing else.\n *\n * ★ WHY NOT AN npm LIBRARY. Nothing in this workspace depends on one (checked 2026-09-21: no\n *   `plist`, `xmlbuilder` or `@xmldom/xmldom` anywhere under node_modules), and the common one pulls\n *   an XML DOM in for PARSING, which a provider that only RENDERS never does. The subset a launchd\n *   job needs is five node types, so this is ~100 lines plus exhaustive tests (plist.test.ts), which\n *   also round-trip every case through Apple's own `plutil` when the tests run on macOS.\n *\n * ⛔ THE OUTPUT MUST BE DETERMINISTIC. LaunchdJob diffs by the SHA-256 of these bytes, so two\n *   renders of one declaration must be byte-identical: dict keys are sorted, indentation is fixed,\n *   and nothing depends on insertion order. A non-deterministic render is a forever-`update`.\n * ⚠️ AND A CHANGE TO THIS FILE'S OUTPUT RESTARTS EVERY JOB. A new header, indent or escape changes\n *   every digest, so the next deploy after the kit upgrade updates — restarts — every declared\n *   job at once. Treat any byte change here as a breaking change and say so in its changeset.\n *\n * ⛔ REFUSE, NEVER COERCE. `undefined`, `null`, a fraction, NaN, a class instance or a character XML\n *   1.0 cannot carry is a thrown PlistError naming the path, not a silently dropped key. A dropped\n *   `KeepAlive` is a daemon that never restarts, and nothing downstream would say why.\n */\n\n/** Every value launchd reads. ⚠️ No `<real>`, `<date>` or `<data>`: no launchd key needs one. */\nexport type PlistValue =\n  | string\n  | number\n  | boolean\n  | readonly PlistValue[]\n  | { readonly [key: string]: PlistValue };\n\nexport type PlistDict = { readonly [key: string]: PlistValue };\n\nexport class PlistError extends Error {\n  constructor(\n    readonly path: string,\n    detail: string,\n  ) {\n    super(`plist ${path === '' ? '(root)' : path}: ${detail}`);\n    this.name = 'PlistError';\n  }\n}\n\nconst HEADER =\n  '<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n' +\n  '<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" ' +\n  '\"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\\n' +\n  '<plist version=\"1.0\">\\n';\n\n/** ⚠️ A cycle, or a runaway generator, would otherwise recurse until the stack dies. */\nconst MAX_DEPTH = 32;\n\n/**\n * ⛔ CHARACTERS XML 1.0 CANNOT CARRY AT ALL — not even escaped (XML 1.0 §2.2 `Char`). C0 controls\n *   other than tab, LF and CR; U+FFFE / U+FFFF; and an unpaired surrogate, which has no UTF-8 form.\n */\n// ★ The `u` flag makes a VALID surrogate pair one code point above U+FFFF, outside this class, so\n//   only an unpaired half matches the \\uD800-\\uDFFF range.\n// oxlint-disable-next-line no-control-regex -- matching control characters is the point\nconst FORBIDDEN = /[\\x00-\\x08\\x0B\\x0C\\x0E-\\x1F\\uD800-\\uDFFF\\uFFFE\\uFFFF]/u;\n\n/**\n * Escape text content.\n * ⚠️ CR IS A CHARACTER REFERENCE, NOT A LITERAL. An XML parser normalises a literal CR (and CRLF)\n *   to LF before the application sees it (XML 1.0 §2.11), so `a\\r\\nb` would come back as `a\\nb` and\n *   the argument launchd passes would differ from the one declared. `&#13;` survives normalisation.\n */\nexport const escapeText = (text: string, path: string): string => {\n  const bad = FORBIDDEN.exec(text);\n  if (bad !== null) {\n    const code = bad[0].codePointAt(0) ?? 0;\n    throw new PlistError(\n      path,\n      `U+${code.toString(16).toUpperCase().padStart(4, '0')} cannot appear in XML 1.0`,\n    );\n  }\n  return text\n    .replaceAll('&', '&amp;')\n    .replaceAll('<', '&lt;')\n    .replaceAll('>', '&gt;')\n    .replaceAll('\\r', '&#13;');\n};\n\nconst isPlainObject = (value: object): boolean => {\n  const proto = Object.getPrototypeOf(value) as unknown;\n  return proto === Object.prototype || proto === null;\n};\n\nconst renderValue = (value: unknown, path: string, depth: number, out: string[]): void => {\n  const pad = '\\t'.repeat(depth);\n  if (depth > MAX_DEPTH) throw new PlistError(path, `nested deeper than ${String(MAX_DEPTH)}`);\n  if (typeof value === 'string') {\n    out.push(`${pad}<string>${escapeText(value, path)}</string>`);\n    return;\n  }\n  if (typeof value === 'boolean') {\n    out.push(`${pad}<${value ? 'true' : 'false'}/>`);\n    return;\n  }\n  if (typeof value === 'number') {\n    // ⛔ launchd reads every numeric key as an integer; 1.5 would be a silently different job.\n    if (!Number.isSafeInteger(value)) {\n      throw new PlistError(path, `${String(value)} is not a safe integer (no <real> support)`);\n    }\n    out.push(`${pad}<integer>${String(value === 0 ? 0 : value)}</integer>`);\n    return;\n  }\n  if (Array.isArray(value)) {\n    if (value.length === 0) {\n      out.push(`${pad}<array/>`);\n      return;\n    }\n    out.push(`${pad}<array>`);\n    for (const [index, item] of (value as readonly unknown[]).entries()) {\n      renderValue(item, `${path}[${String(index)}]`, depth + 1, out);\n    }\n    out.push(`${pad}</array>`);\n    return;\n  }\n  if (typeof value === 'object' && value !== null && isPlainObject(value)) {\n    renderDict(value as Record<string, unknown>, path, depth, out);\n    return;\n  }\n  const kind = value === null ? 'null' : typeof value;\n  throw new PlistError(path, `${kind} has no plist form — omit the key instead`);\n};\n\nconst renderDict = (\n  dict: Record<string, unknown>,\n  path: string,\n  depth: number,\n  out: string[],\n): void => {\n  const pad = '\\t'.repeat(depth);\n  // ★ Code-unit order, not localeCompare: the same bytes on every machine and every locale.\n  const keys = Object.keys(dict).sort();\n  if (keys.length === 0) {\n    out.push(`${pad}<dict/>`);\n    return;\n  }\n  out.push(`${pad}<dict>`);\n  for (const key of keys) {\n    const child = path === '' ? key : `${path}.${key}`;\n    out.push(`${pad}\\t<key>${escapeText(key, child)}</key>`);\n    renderValue(dict[key], child, depth + 1, out);\n  }\n  out.push(`${pad}</dict>`);\n};\n\n/** Render a top-level dict as a complete XML plist document, ending in a newline. */\nexport const renderPlist = (dict: PlistDict): string => {\n  if (typeof dict !== 'object' || dict === null || Array.isArray(dict) || !isPlainObject(dict)) {\n    throw new PlistError('', 'the top level of a launchd plist must be a dict');\n  }\n  const out: string[] = [];\n  renderDict(dict as Record<string, unknown>, '', 0, out);\n  return `${HEADER}${out.join('\\n')}\\n</plist>\\n`;\n};\n",
@@ -21,12 +22,14 @@
     "/**\n * The real CaddyAdmin: this machine's Caddy, over loopback TCP or a unix socket.\n *\n * ★ node:http, NOT fetch. MEASURED 2026-09-21 on bun 1.4.0 and node 26.7.0: node:http sends a Host\n *   override and dials a unix socket on BOTH runtimes, while node's fetch silently drops a `Host`\n *   header (it sent the URL's host) and only Bun's fetch has a `unix` option. The published dist\n *   loads under node too (launchd's local-runner.ts makes the same call for the same reason).\n * ⛔ LOOPBACK OR A UNIX SOCKET, NOTHING ELSE. The admin API is unauthenticated plaintext; an\n *   address off this machine means it is reachable from the network, which decision 23 forbids.\n *   Reaching another host's Caddy means forwarding its socket or port to here (SSH), never\n *   exposing :2019.\n * ★ HOST AND ORIGIN, AS CADDY's OWN CLI SENDS THEM (cmd/commandfuncs.go AdminAPIRequest): over\n *   TCP, `Host` and `Origin: http://<host>`; over a socket, `Host: 127.0.0.1` and no Origin, because\n *   Caddy skips the Host check on unix listeners (admin.go allowedOrigins). MEASURED against the\n *   a Mac host's Caddy 2.11.4: any other Host gets 403 `host not allowed`, a forwarded port included —\n *   hence `hostHeader`.\n */\nimport { request as httpRequest } from 'node:http';\nimport {\n  type CaddyAdmin,\n  type CaddyAdminListener,\n  type CaddyAdminResponse,\n  CaddyUnreachableError,\n} from './admin.ts';\n\nexport type LocalCaddyAdminOptions = {\n  /**\n   * `http://<loopback>:<port>` or `unix:///absolute/path.sock`.\n   * @default 'http://127.0.0.1:2019' — Caddy's default admin listener (`localhost:2019`).\n   */\n  readonly address?: string;\n  /**\n   * The Host (and Origin) to send over TCP, when it is not the address's own: the Caddyfile\n   * narrowed `admin { origins … }`, or the port is an SSH forward of the real one (Caddy checks\n   * the Host against ITS port, not yours). Form `host:port`.\n   */\n  readonly hostHeader?: string;\n  /**\n   * Abort an exchange after this long. @default 60_000\n   * ⚠️ A `shutdown_delay` in the Caddyfile makes `/load` block that long (caddyhttp app.go Stop);\n   *   a timeout then fails the deploy while Caddy goes on to apply — the next plan converges.\n   */\n  readonly timeoutMs?: number;\n  /**\n   * Retries when the connection is REFUSED (nothing listening yet — a Caddy launchd job that was\n   * bootstrapped a moment ago). Only refusals: those never reached Caddy, so re-sending a\n   * `POST /load` cannot apply it twice. @default 2\n   */\n  readonly retries?: number;\n  /** @default 500 */\n  readonly retryDelayMs?: number;\n};\n\nexport const DEFAULT_ADMIN_ADDRESS = 'http://127.0.0.1:2019';\n\ntype Target =\n  | { readonly kind: 'tcp'; readonly host: string; readonly port: number }\n  | { readonly kind: 'unix'; readonly socketPath: string };\n\nconst UNIX = 'unix://';\nconst HOST_PORT = /^(?:[A-Za-z0-9.-]+|\\[[0-9A-Fa-f:.]+\\]):\\d{1,5}$/;\n\nconst refuse = (address: string, why: string): Error =>\n  new Error(`Caddy admin address ${JSON.stringify(address)}: ${why}`);\n\nconst isLoopback = (hostname: string): boolean =>\n  hostname === 'localhost' || hostname === '[::1]' || /^127(?:\\.\\d{1,3}){3}$/.test(hostname);\n\n/** The dial target and listener for an address, or a refusal naming what is wrong with it. */\nexport const parseAdminAddress = (\n  address: string,\n  hostHeader?: string,\n): { target: Target; listener: CaddyAdminListener } => {\n  if (hostHeader !== undefined && !HOST_PORT.test(hostHeader)) {\n    throw refuse(address, `hostHeader ${JSON.stringify(hostHeader)} must be host:port`);\n  }\n  if (address.startsWith(UNIX)) {\n    const socketPath = address.slice(UNIX.length);\n    if (!socketPath.startsWith('/')) throw refuse(address, 'the socket path must be absolute');\n    return { listener: { kind: 'unix', path: socketPath }, target: { kind: 'unix', socketPath } };\n  }\n  let url: URL;\n  try {\n    url = new URL(address);\n  } catch {\n    throw refuse(address, 'not a URL (http://127.0.0.1:2019 or unix:///path)');\n  }\n  // ⛔ Caddy's local admin endpoint is plaintext by design; its TLS one (`admin.remote`, mTLS on\n  //   :2021) is a different, network-facing API this transport deliberately does not speak.\n  if (url.protocol !== 'http:') throw refuse(address, 'only http:// (loopback) or unix://');\n  if (!isLoopback(url.hostname)) {\n    throw refuse(address, 'not loopback — the admin API is unauthenticated; forward it to here');\n  }\n  if (url.pathname !== '/' || url.search !== '' || url.username !== '') {\n    throw refuse(address, 'no path, query or credentials — the API lives at the root');\n  }\n  const port = url.port === '' ? 80 : Number(url.port);\n  // ⚠️ NOT `url.host`: WHATWG URL drops a default port (`http://127.0.0.1:80` has host\n  //   `127.0.0.1`), and Caddy compares the Host against `host:port` (admin.go allowedOrigins), so\n  //   a portless Host is a 403 on every call. The Caddy CLI always sends the port (JoinHostPort).\n  const host = hostHeader ?? `${url.hostname}:${String(port)}`;\n  return {\n    listener: {\n      hostHeader: host,\n      kind: 'tcp',\n      port: Number(host.slice(host.lastIndexOf(':') + 1)),\n    },\n    // ★ `hostname` keeps IPv6 brackets; node:http wants them off.\n    target: { host: url.hostname.replace(/^\\[(.*)\\]$/, '$1'), kind: 'tcp', port },\n  };\n};\n\nconst code = (cause: unknown): string | undefined =>\n  typeof cause === 'object' && cause !== null && 'code' in cause\n    ? String((cause as { code: unknown }).code)\n    : undefined;\n\n/** Nothing accepted the connection: refused TCP, or no socket file yet. The request never left. */\nconst neverConnected = (cause: unknown): boolean =>\n  code(cause) === 'ECONNREFUSED' || code(cause) === 'ENOENT';\n\nconst exchange = (\n  target: Target,\n  method: string,\n  path: string,\n  headers: Record<string, string>,\n  body: string | undefined,\n  timeoutMs: number,\n): Promise<CaddyAdminResponse> =>\n  new Promise((resolve, reject) => {\n    const bytes = body === undefined ? undefined : Buffer.from(body, 'utf8');\n    const request = httpRequest(\n      {\n        ...(target.kind === 'tcp'\n          ? { host: target.host, port: target.port }\n          : { socketPath: target.socketPath }),\n        headers: bytes === undefined ? headers : { ...headers, 'Content-Length': bytes.length },\n        method,\n        path,\n        timeout: timeoutMs,\n      },\n      (response) => {\n        const chunks: Buffer[] = [];\n        response.on('data', (chunk: Buffer) => chunks.push(chunk));\n        response.on('error', reject);\n        response.on('end', () =>\n          resolve({\n            body: Buffer.concat(chunks).toString('utf8'),\n            status: response.statusCode ?? 0,\n          }),\n        );\n      },\n    );\n    request.on('timeout', () => request.destroy(new Error(`no answer in ${String(timeoutMs)} ms`)));\n    request.on('error', reject);\n    request.end(bytes);\n  });\n\nexport const localCaddyAdmin = (options: LocalCaddyAdminOptions = {}): CaddyAdmin => {\n  const address = options.address ?? DEFAULT_ADMIN_ADDRESS;\n  const { listener, target } = parseAdminAddress(address, options.hostHeader);\n  const timeoutMs = options.timeoutMs ?? 60_000;\n  const retries = options.retries ?? 2;\n  const delay = options.retryDelayMs ?? 500;\n  const fixed: Record<string, string> =\n    listener.kind === 'tcp'\n      ? { Host: listener.hostHeader, Origin: `http://${listener.hostHeader}` }\n      : { Host: '127.0.0.1' };\n  return {\n    endpoint: address,\n    listener,\n    request: async ({ body, headers, method, path }) => {\n      for (let attempt = 0; ; attempt += 1) {\n        try {\n          // oxlint-disable-next-line no-await-in-loop -- sequential by design: retry after a wait\n          return await exchange(target, method, path, { ...headers, ...fixed }, body, timeoutMs);\n        } catch (cause) {\n          if (!neverConnected(cause) || attempt >= retries) {\n            const reason = cause instanceof Error ? cause.message : String(cause);\n            const message = `Caddy admin ${method} ${path} at ${address}: ${reason}`;\n            throw neverConnected(cause) ? new CaddyUnreachableError(message) : new Error(message);\n          }\n          // oxlint-disable-next-line no-await-in-loop -- the wait between attempts\n          await new Promise((resolve) => setTimeout(resolve, delay));\n        }\n      }\n    },\n  };\n};\n",
     "/**\n * The Caddy provider with its admin transport, as a single layer for a host stack.\n *\n *     Layer.mergeAll(caddyProviders(), launchdProviders(), …the stack's other providers)\n *\n * ★ launchdProviders() TOO when the stack uses caddyWithFile(): the file is a launchd-subpath\n *   HostFile, written through that subpath's HostRunner.\n * ⚠️ The default is localCaddyAdmin(): `http://127.0.0.1:2019`, Caddy's default admin listener.\n *   Pass another CaddyAdmin for a unix socket, a narrowed `admin { origins }`, or an SSH forward.\n */\nimport * as Layer from 'effect/Layer';\nimport { type CaddyAdmin, caddyAdminLayer } from './admin.ts';\nimport { CaddyConfigProvider } from './config.ts';\nimport { localCaddyAdmin } from './local-admin.ts';\n\nexport const caddyProviders = (admin: CaddyAdmin = localCaddyAdmin()) =>\n  CaddyConfigProvider().pipe(Layer.provide(caddyAdminLayer(admin)));\n",
     "/**\n * `caddyWithFile` — one Caddyfile, applied to the running Caddy AND written to the file Caddy\n * starts from, so a restart keeps it (decision 23: \"the file also lands on disk\").\n *\n * ★ REUSES launchd's HostFile, NOT A SECOND FILE WRITER. The file is an ordinary `Host.File`\n *   (atomic write, digest diff, symlink refusal, `--adopt` for a file already there); the config is\n *   a `Caddy.Config` whose `sourceFile` is that HostFile's `path` Output — which is what orders them.\n *\n * ⛔ THE ORDER IS FILE, THEN `/load`. The dependency makes Alchemy write the file first, and it is the\n *   only order that bootstraps: a new host's Caddy launchd job starts from the file, before any\n *   admin API exists to load into. Its cost, and what bounds it:\n *   · A Caddyfile that does not ADAPT never reaches disk once the config has state: CaddyConfig's\n *     diff adapts it at PLAN time and fails the plan. (On the very first deploy the file's path is\n *     still an Output, Alchemy skips the adoption probe, and the check runs at apply instead.)\n *   · A Caddyfile that adapts but that Caddy then REFUSES (a port in use, a missing cert file) is\n *     on disk when `/load` fails. Caddy keeps serving the old config, the deploy fails with Caddy's\n *     reason — and a Caddy started without `--resume` would load the refused file on its next\n *     restart. Managed Caddies run with `--resume` (decision, 2026-09-21; docs/caddy.md): they\n *     restart from `autosave.json`, the last config Caddy ACCEPTED, and the file is only the\n *     first-boot fallback.\n *   · The skipped probe is also why the ADOPTION check of a first deploy happens at apply: a Caddy\n *     running a config this stack did not load is refused before `/load` unless the deploy runs\n *     with `--adopt` (config-lifecycle.ts reconcileConfig) — after this file is written.\n * ⛔ SECRETS ARE REFUSED HERE, AT DECLARATION, before the HostFile exists: its `content` is a prop\n *   too, and would carry a literal into state even if the CaddyConfig then refused it.\n * ★ BOTH RETAIN. Removing this from a stack must not delete the file a restart needs.\n */\nimport * as Effect from 'effect/Effect';\nimport * as RemovalPolicy from 'alchemy/RemovalPolicy';\nimport { HostFile } from '../launchd/host-file.ts';\nimport { CaddyConfig } from './config.ts';\nimport { configProblems } from './config-form.ts';\n\nexport interface CaddyWithFileProps {\n  /** The whole Caddyfile. ⛔ Never a secret — use `{env.NAME}` / `{file./path}` placeholders. */\n  readonly caddyfile: string;\n  /** Absolute path Caddy is started with: `caddy run --config <path> --adapter caddyfile`. */\n  readonly path: string;\n  /** @default 0o644 */\n  readonly mode?: number;\n  readonly owner?: string | number;\n  readonly group?: string | number;\n}\n\n/**\n * Declare the file (`<id>-file`) and the config (`<id>`). Provide `launchdProviders()` for the\n * file and `caddyProviders()` for the config.\n *\n *     const { config, file } = yield* caddyWithFile('caddy', { caddyfile, path: '/usr/local/etc/Caddyfile' });\n */\nexport const caddyWithFile = (id: string, props: CaddyWithFileProps) =>\n  Effect.gen(function* () {\n    const found = configProblems({ caddyfile: props.caddyfile, sourceFile: props.path });\n    if (found.length > 0) {\n      return yield* Effect.fail(new Error(`caddyWithFile ${id}: ${found.join('; ')}`));\n    }\n    const file = yield* HostFile(`${id}-file`, {\n      content: props.caddyfile,\n      mode: props.mode ?? 0o644,\n      path: props.path,\n      ...(props.owner === undefined ? {} : { owner: props.owner }),\n      ...(props.group === undefined ? {} : { group: props.group }),\n    }).pipe(RemovalPolicy.retain());\n    const config = yield* CaddyConfig(id, { caddyfile: props.caddyfile, sourceFile: file.path });\n    return { config, file };\n  });\n",
-    "/**\n * `Host.File` — one text file on the host, declared: content, mode, owner, group.\n *\n * - create / update — atomic write (temp file in the same directory, mode and owner set, rename),\n *   skipped when the file already matches; then read back and compared.\n * - read — lstat plus the SHA-256 of the bytes.\n * - diff — declared SHA-256 against the stored and on-disk digest, plus mode and owner.\n * - replace — only when `path` changes; create-before-delete.\n * - delete — removes the file.\n *\n * ⛔ NEVER A SECRET — see host-file-form.ts. Secret files stay rendered by openbao-agent.\n * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`: a file already at the path reads as `Unowned`, and where\n *   the plan never asked, reconcile refuses it unless adoption is on (docs/ownership.md).\n * ★ IT LIVES IN THE launchd SUBPATH because the two travel together: a Mac host stack declares a\n *   daemon's config file and the daemon that reads it, through the same HostRunner.\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { adoptsAtApply } from '../ownership/adopt.ts';\nimport { noteUnfinished } from '../ownership/resume.ts';\nimport { lift, resolvedString } from './host-effect.ts';\nimport type { HostFileAttributes, HostFileProps } from './host-file-form.ts';\nimport { deleteFile, diffFile, readFileAttributes, reconcileFile } from './host-file-lifecycle.ts';\nimport { HostRunnerService } from './runner.ts';\n\nexport type { HostFileAttributes, HostFileProps } from './host-file-form.ts';\n\nexport interface HostFile extends Resource<'Host.File', HostFileProps, HostFileAttributes> {}\n\nexport const HostFile = Resource<HostFile>('Host.File');\n\nexport const HostFileProvider = () =>\n  Provider.effect(\n    HostFile,\n    Effect.gen(function* () {\n      const runner = yield* HostRunnerService;\n      return HostFile.Provider.of({\n        list: () => Effect.succeed([]),\n\n        read: ({ olds, output }) =>\n          lift(async () => {\n            const found = await readFileAttributes(runner, olds.path);\n            if (found === undefined) return undefined;\n            return output === undefined ? Unowned(found) : found;\n          }),\n\n        diff: ({ instanceId, news, output }) => {\n          // ★ An unfinished generation of our own: `--adopt` may resume it (ownership/resume.ts).\n          if (output === undefined) return noteUnfinished(instanceId);\n          if (isResolved(news)) return lift(() => diffFile(runner, news, output));\n          // ⛔ A new path is a replace even while `content` is unresolved (an Output templated in):\n          //   the engine's default would be an update, which writes the new path and never\n          //   removes the old one. reconcileFile also defends, for a path that is an Output.\n          const path = resolvedString(news, 'path');\n          return Effect.succeed(\n            path !== undefined && path !== output.path ? { action: 'replace' as const } : undefined,\n          );\n        },\n\n        // ★ `--adopt` reaches the apply too: the probe never ran for a create with an Output prop.\n        //   ⛔ A create or an unfinished generation — never a fresh replace's, never offered it.\n        reconcile: ({ fqn, instanceId, news, output }) =>\n          Effect.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) =>\n            lift(() => reconcileFile(runner, news, output, adopt)),\n          ),\n\n        delete: ({ output }) => lift(() => deleteFile(runner, output)),\n      });\n    }),\n  );\n",
-    "/**\n * HostFile's props, attributes and validation — the pure half of the provider.\n *\n * ⛔ `content` IS NEVER A SECRET. Alchemy stores props unencrypted, so the content of every HostFile\n *   sits in the state store and in every plan diff. A secret file stays RENDERED BY A SECRET\n *   RENDERER (openbao-agent templates, on this estate) that fetches it at run time; the stack\n *   declares only non-secret config, and at most the PATH the renderer writes to.\n *   secret-tripwire.ts refuses the obvious case (a PEM private key); nothing can catch all of them.\n */\nimport { fileSecretProblems } from './secret-tripwire.ts';\n\nexport interface HostFileProps {\n  /** Absolute path. The parent directory must already exist. */\n  path: string;\n  /** UTF-8 text. ⛔ Never a secret — see the file header. */\n  content: string;\n  /** Permission bits. @default 0o644 */\n  mode?: number;\n  /** User name or numeric uid. Omitted: whoever the runner writes as (a rewrite keeps no owner). */\n  owner?: string | number;\n  /** Group name or numeric gid. Omitted: the directory's default group. */\n  group?: string | number;\n}\n\nexport interface HostFileAttributes {\n  path: string;\n  /** SHA-256 of the bytes on disk. */\n  sha256: string;\n  mode: number;\n  uid: number;\n  gid: number;\n  size: number;\n}\n\nexport const DEFAULT_MODE = 0o644;\n\nconst identityProblems = (name: string, value: string | number | undefined): string[] => {\n  if (value === undefined) return [];\n  if (typeof value === 'number') {\n    return Number.isSafeInteger(value) && value >= 0\n      ? []\n      : [`${name} must be a non-negative integer id`];\n  }\n  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\\d+$/.test(value)\n    ? []\n    : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];\n};\n\n/**\n * An absolute, normalised path, or the reasons it is not. ★ Shared with sudo-allowlist.ts, so a\n *   path the sudo runner may touch as root obeys exactly the rule a declared file does.\n */\nexport const pathProblems = (path: string): string[] => {\n  const found: string[] = [];\n  if (!path.startsWith('/')) found.push('path must be absolute');\n  // ★ One spelling per file: `a/./b`, `a//b` and `a/../b` would each be a second resource for the\n  //   same inode, and `..` is how a derived path walks out of the directory it was meant for.\n  if (\n    path.endsWith('/') ||\n    path\n      .split('/')\n      .slice(1)\n      .some((part) => part === '' || part === '.' || part === '..')\n  ) {\n    found.push('path must be normalised (no trailing slash, no empty, \".\" or \"..\" segments)');\n  }\n  if (path.includes('\\x00')) found.push('path contains NUL');\n  return found;\n};\n\nexport const fileProblems = (props: HostFileProps): string[] => {\n  const found = pathProblems(props.path);\n  const mode = props.mode ?? DEFAULT_MODE;\n  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 0o7777) found.push('mode must be 0–0o7777');\n  found.push(...identityProblems('owner', props.owner));\n  found.push(...identityProblems('group', props.group));\n  found.push(...fileSecretProblems(props.content));\n  return found;\n};\n",
-    "/**\n * The one seam between the launchd providers and the host: every file read, file write and\n * `launchctl` call goes through a HostRunner, and nothing in this directory touches the host any\n * other way.\n *\n * ★ WHY A SEAM AND NOT DIRECT node:fs CALLS. launchd has no SDK — the provider renders a plist and\n *   drives `launchctl` — so the only way to test the lifecycle without a real launchd (and without\n *   writing /Library) is to swap the host out. fake-runner.ts is an in-memory host with a scripted\n *   launchd; local-runner.ts is the real one. The same seam is where a consumer plugs in a runner\n *   that reaches a host some other way.\n *\n * ★ PROMISES, NOT EFFECTS, ON PURPOSE. A consumer writing their own runner implements plain async\n *   functions; the providers lift them into Effect at the call site (host-effect.ts).\n */\nimport * as Context from 'effect/Context';\nimport * as Layer from 'effect/Layer';\n\n/** One finished process. ⛔ `stdout` may carry anything the job's environment holds — never log it. */\nexport type ExecResult = {\n  readonly exitCode: number;\n  readonly stdout: string;\n  readonly stderr: string;\n};\n\n/**\n * What `lstat` says about a path. ⚠️ lstat, not stat: a symlink is reported as a symlink, because\n *   writing through one would change a file this resource never named.\n */\nexport type FileStat = {\n  readonly kind: 'file' | 'directory' | 'symlink' | 'other';\n  /** Permission bits only (`& 0o7777`), never the file-type bits. */\n  readonly mode: number;\n  readonly uid: number;\n  readonly gid: number;\n  readonly size: number;\n};\n\nexport type WriteOptions = {\n  /** Permission bits for the final file, applied BEFORE it becomes visible at `path`. */\n  readonly mode: number;\n  /** Numeric owner; omitted means whoever the runner writes as. */\n  readonly uid?: number;\n  /** Numeric group; omitted means the directory's default. */\n  readonly gid?: number;\n};\n\nexport type HostUser = { readonly uid: number; readonly gid: number; readonly home: string };\n\nexport interface HostRunner {\n  /**\n   * ⛔ DECLARED, NEVER INFERRED. `true` only when this runner can do every root-needing call the\n   *   providers make of it: every call already runs as root (a runner that talks to a root helper,\n   *   say), or the runner elevates exactly those calls (sudoRunner). The providers refuse\n   *   system-domain writes unless `effectiveUid()` is 0 or this is `true`, so claiming it falsely\n   *   turns that refusal into an EACCES halfway through a deploy.\n   * ⛔ THE KIT NEVER ELEVATES SILENTLY. localRunner() never calls `sudo`: a deploy that prompts for\n   *   a password mid-plan, or quietly borrows a cached sudo ticket, is exactly the \"no silent sudo\"\n   *   failure. sudoRunner() does call `sudo -n`, but only when a stack passes it explicitly, only\n   *   for the argv shapes in sudo-allowlist.ts, and logging each one (decided 2026-09-21).\n   */\n  readonly privileged: boolean;\n  /** The uid file writes and launchctl calls run as. */\n  effectiveUid(): number;\n  /** Run a program with an argv — ⛔ never through a shell. */\n  exec(argv: readonly string[]): Promise<ExecResult>;\n  /** File bytes, or `undefined` when nothing is at `path`. */\n  readFile(path: string): Promise<Uint8Array | undefined>;\n  /** lstat, or `undefined` when nothing is at `path`. */\n  stat(path: string): Promise<FileStat | undefined>;\n  /**\n   * Write `bytes` so that `path` holds either the old file or the new one, never a torn mix:\n   * a temporary file in the same directory, mode and owner set on it, then rename(2) over `path`.\n   * ⚠️ The parent directory must exist; creating it would invent an owner and mode nobody declared.\n   */\n  writeFileAtomic(path: string, bytes: Uint8Array, options: WriteOptions): Promise<void>;\n  /**\n   * PLAN TIME: refuse, reading only and writing nothing, a write this runner would refuse at\n   * apply — so the plan shows it before any resource is applied. Optional: a runner without it\n   * refuses at the write. ★ sudoRunner implements it with the checks it makes before `sudo -n`;\n   *   ⛔ it never elevates, so a plan still never calls sudo.\n   */\n  checkWrite?(path: string, options: WriteOptions): Promise<void>;\n  /** Remove a file. Idempotent: nothing at `path` is success. */\n  removeFile(path: string): Promise<void>;\n  /** A user by name or numeric id, or `undefined` when the host has none. */\n  lookupUser(nameOrId: string): Promise<HostUser | undefined>;\n  /** A group's gid by name or numeric id, or `undefined` when the host has none. */\n  lookupGroup(nameOrId: string): Promise<number | undefined>;\n  /** Wait between launchctl polls. ★ Injected so a test never sleeps for real. */\n  sleep(ms: number): Promise<void>;\n}\n\n/** The Effect service every launchd provider reads its runner from. */\nexport class HostRunnerService extends Context.Service<HostRunnerService, HostRunner>()(\n  'homeflare/launchd/HostRunner',\n) {}\n\n/** Provide a runner to the providers: `Layer.provide(hostRunnerLayer(localRunner()))`. */\nexport const hostRunnerLayer = (runner: HostRunner): Layer.Layer<HostRunnerService> =>\n  Layer.succeed(HostRunnerService, runner);\n\n/** True when this runner may write root-owned paths and drive the system domain. */\nexport const canActAsRoot = (runner: HostRunner): boolean =>\n  runner.privileged || runner.effectiveUid() === 0;\n",
-    "/**\n * HostFile's read / diff / reconcile / delete as plain async functions over a HostRunner, so the\n * lifecycle runs against fake-runner.ts in tests.\n *\n * ⛔ SYMLINKS AND DIRECTORIES ARE REFUSED, NOT REPLACED. rename(2) over a symlink replaces the LINK,\n *   so a path that is a symlink (nix-darwin's /etc entries point into /nix/store) would be quietly\n *   taken from the tool that owns it — which puts it back, or refuses its next activation. Remove\n *   the path from its owner first, then declare it here.\n */\nimport type { Diff } from 'alchemy/Diff';\nimport {\n  DEFAULT_MODE,\n  type HostFileAttributes,\n  type HostFileProps,\n  fileProblems,\n} from './host-file-form.ts';\nimport { sha256Hex } from './job-form.ts';\nimport { type HostRunner, type WriteOptions, canActAsRoot } from './runner.ts';\n\ntype Desired = {\n  readonly bytes: Uint8Array;\n  readonly sha256: string;\n  readonly mode: number;\n  readonly uid?: number;\n  readonly gid?: number;\n};\n\nconst refuse = (path: string, message: string): Error => new Error(`Host.File ${path}: ${message}`);\n\nconst numericId = (value: string | number): number | undefined =>\n  typeof value === 'number' ? value : /^\\d+$/.test(value) ? Number(value) : undefined;\n\n/** Validate, then resolve owner/group names to ids through the runner. */\nexport const desiredFile = async (runner: HostRunner, props: HostFileProps): Promise<Desired> => {\n  const found = fileProblems(props);\n  if (found.length > 0) throw refuse(props.path, found.join('; '));\n  const bytes = new TextEncoder().encode(props.content);\n  let uid: number | undefined;\n  let gid: number | undefined;\n  if (props.owner !== undefined) {\n    uid = numericId(props.owner) ?? (await runner.lookupUser(String(props.owner)))?.uid;\n    if (uid === undefined) throw refuse(props.path, `no user ${String(props.owner)} on this host`);\n  }\n  if (props.group !== undefined) {\n    gid = numericId(props.group) ?? (await runner.lookupGroup(String(props.group)));\n    if (gid === undefined) throw refuse(props.path, `no group ${String(props.group)} on this host`);\n  }\n  return {\n    bytes,\n    mode: props.mode ?? DEFAULT_MODE,\n    sha256: sha256Hex(bytes),\n    ...(uid === undefined ? {} : { uid }),\n    ...(gid === undefined ? {} : { gid }),\n  };\n};\n\n/** The file as it is now, or `undefined` when nothing is at the path. Non-files read with no digest. */\nexport const readFileAttributes = async (\n  runner: HostRunner,\n  path: string,\n): Promise<HostFileAttributes | undefined> => {\n  const stat = await runner.stat(path);\n  if (stat === undefined) return undefined;\n  const bytes = stat.kind === 'file' ? await runner.readFile(path) : undefined;\n  return {\n    gid: stat.gid,\n    mode: stat.mode,\n    path,\n    sha256: bytes === undefined ? '' : sha256Hex(bytes),\n    size: stat.size,\n    uid: stat.uid,\n  };\n};\n\nconst writeOptionsOf = (want: Desired): WriteOptions => ({\n  mode: want.mode,\n  ...(want.uid === undefined ? {} : { uid: want.uid }),\n  ...(want.gid === undefined ? {} : { gid: want.gid }),\n});\n\nconst matches = (live: HostFileAttributes, want: Desired): boolean =>\n  live.sha256 === want.sha256 &&\n  live.mode === want.mode &&\n  (want.uid === undefined || live.uid === want.uid) &&\n  (want.gid === undefined || live.gid === want.gid);\n\n/**\n * ★ A PLAN THAT WILL WRITE ASKS THE RUNNER FIRST (`checkWrite`, when it has one): sudoRunner's\n *   refusals — a setuid or group-writable root file, a directory under a prefix another user may\n *   change — then fail the plan, before any resource is applied, instead of halfway through it.\n */\nexport const diffFile = async (\n  runner: HostRunner,\n  news: HostFileProps,\n  output: HostFileAttributes,\n): Promise<Diff> => {\n  const want = await desiredFile(runner, news);\n  const writes = async (diff: Diff): Promise<Diff> => {\n    await runner.checkWrite?.(news.path, writeOptionsOf(want));\n    return diff;\n  };\n  // ★ Create-before-delete: two paths can hold two files at once, so nothing forces deleteFirst.\n  if (news.path !== output.path) return writes({ action: 'replace' });\n  if (want.sha256 !== output.sha256) return writes({ action: 'update' });\n  const live = await readFileAttributes(runner, news.path);\n  return live !== undefined && matches(live, want)\n    ? { action: 'noop' }\n    : writes({ action: 'update' });\n};\n\n/**\n * `adopt` is whether adoption is on AND this apply is a create or an unfinished generation of our\n * own (ownership/adopt.ts adoptsAtApply). It lets such a generation take over a file already at the\n * path — the takeover the plan's probe would have allowed, had it run. ⛔ A move onto an occupied\n *   path stays refused, both ways the engine drives one: an `update` across the move (`moved`,\n *   below), and a fresh replace's new generation, which the caller never marks adoptable (its\n *   `output` is undefined too, so this function cannot tell it from a create by itself).\n */\nexport const reconcileFile = async (\n  runner: HostRunner,\n  props: HostFileProps,\n  output?: HostFileAttributes,\n  adopt = false,\n): Promise<HostFileAttributes> => {\n  const want = await desiredFile(runner, props);\n  // ⛔ NO SILENT SUDO: handing a file to another user is root's call (chown(2)), so say so up front.\n  if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {\n    throw refuse(\n      props.path,\n      `owner ${String(props.owner)} is not the deploying user; only root may chown. Deploy as root ` +\n        'or through a privileged HostRunner (sudoRunner() with this path under a prefix). This ' +\n        'provider never calls sudo itself.',\n    );\n  }\n  const stat = await runner.stat(props.path);\n  if (stat !== undefined && stat.kind !== 'file') {\n    throw refuse(\n      props.path,\n      `is a ${stat.kind}; remove it from whatever owns it before declaring it here`,\n    );\n  }\n  const before = stat === undefined ? undefined : await readFileAttributes(runner, props.path);\n  // ⚠️ An `output` at another path: the engine planned an UPDATE across a move, which it does\n  //   when diff could not see the new path (host-file.ts). Finish it the way a replace would.\n  const moved = output !== undefined && output.path !== props.path;\n  const prior = moved ? undefined : output;\n  /**\n   * ⛔ A FILE THIS RESOURCE DOES NOT OWN IS NEVER OVERWRITTEN. With no prior state for this path,\n   *   the engine's adoption probe has already refused anything it found — except where it never\n   *   looked: the new path of a replace, and a create whose props still held an Output at plan\n   *   time. A path typo there would otherwise overwrite, say, a system file that a fresh\n   *   declaration of the same path would have been refused as `Unowned`. ★ With adoption on, a\n   *   create takes it over, as the probe would have let it (decided 2026-09-21).\n   */\n  const takeOver = adopt && output === undefined;\n  if (prior === undefined && before !== undefined && !matches(before, want) && !takeOver) {\n    throw refuse(\n      props.path,\n      'already exists and is not this resource. Remove it, or declare it as a new resource and ' +\n        'deploy with --adopt.',\n    );\n  }\n  if (before === undefined || !matches(before, want)) {\n    await runner.writeFileAtomic(props.path, want.bytes, writeOptionsOf(want));\n  }\n  // ⚠️ READ BACK, never echo the declaration: a umask, an ACL or a runner that ignored `uid` shows\n  //   up here as a refusal instead of as a forever-`update`.\n  const after = await readFileAttributes(runner, props.path);\n  if (after === undefined || !matches(after, want)) {\n    // ⚠️ Roll back a CREATE: left behind, the next plan's recovery `read` finds a file with no\n    //   state, reports it `Unowned`, and every later deploy demands --adopt for our own file.\n    if (before === undefined) await runner.removeFile(props.path).catch(() => undefined);\n    throw refuse(\n      props.path,\n      'the write returned but the file on disk does not match the declaration',\n    );\n  }\n  // ★ Create-before-delete, as the replace would have been: the old path goes only once the new\n  //   one is written and verified.\n  if (moved) await deleteFile(runner, output);\n  return after;\n};\n\n/** Remove the file. Idempotent. ⛔ Refuses a path that has since become a symlink or directory. */\nexport const deleteFile = async (runner: HostRunner, output: HostFileAttributes): Promise<void> => {\n  const stat = await runner.stat(output.path);\n  if (stat === undefined) return;\n  if (stat.kind !== 'file') throw refuse(output.path, `is now a ${stat.kind}; not removing it`);\n  await runner.removeFile(output.path);\n};\n"
+    "/**\n * `Host.File` — one text file on the host, declared: content, mode, owner, group.\n *\n * - create / update — atomic write (temp file in the same directory, mode and owner set, rename),\n *   skipped when the file already matches; then read back and compared.\n * - read — lstat plus the SHA-256 of the bytes.\n * - diff — declared SHA-256 against the stored and on-disk digest, plus mode and owner.\n * - replace — only when `path` changes; create-before-delete.\n * - delete — removes the file.\n *\n * ⛔ NEVER A SECRET — see host-file-form.ts. Secret files stay rendered by openbao-agent.\n * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`: a file already at the path reads as `Unowned`, and where\n *   the plan never asked, reconcile refuses it unless adoption is on (docs/ownership.md).\n * ★ IT LIVES IN THE launchd SUBPATH because the two travel together: a Mac host stack declares a\n *   daemon's config file and the daemon that reads it, through the same HostRunner.\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { adoptsAtApply } from '../ownership/adopt.ts';\nimport { noteUnfinished } from '../ownership/resume.ts';\nimport { oneFile } from './file-identity.ts';\nimport { lift, resolvedString } from './host-effect.ts';\nimport type { HostFileAttributes, HostFileProps } from './host-file-form.ts';\nimport { deleteFile, diffFile, readFileAttributes, reconcileFile } from './host-file-lifecycle.ts';\nimport { HostRunnerService } from './runner.ts';\n\nexport type { HostFileAttributes, HostFileProps } from './host-file-form.ts';\n\nexport interface HostFile extends Resource<'Host.File', HostFileProps, HostFileAttributes> {}\n\nexport const HostFile = Resource<HostFile>('Host.File');\n\nexport const HostFileProvider = () =>\n  Provider.effect(\n    HostFile,\n    Effect.gen(function* () {\n      const runner = yield* HostRunnerService;\n      return HostFile.Provider.of({\n        list: () => Effect.succeed([]),\n\n        read: ({ olds, output }) =>\n          lift(async () => {\n            const found = await readFileAttributes(runner, olds.path);\n            if (found === undefined) return undefined;\n            return output === undefined ? Unowned(found) : found;\n          }),\n\n        diff: ({ instanceId, news, output }) => {\n          // ★ An unfinished generation of our own: `--adopt` may resume it (ownership/resume.ts).\n          if (output === undefined) return noteUnfinished(instanceId);\n          if (isResolved(news)) return lift(() => diffFile(runner, news, output));\n          // ⛔ A new path is a replace even while `content` is unresolved (an Output templated in):\n          //   the engine's default would be an update, which writes the new path and never\n          //   removes the old one. reconcileFile also defends, for a path that is an Output.\n          //   ⛔ Unless the new path is the old FILE under another spelling (file-identity.ts):\n          //   a replace's Phase 2 would delete it. The update then records the new spelling.\n          const path = resolvedString(news, 'path');\n          if (path === undefined || path === output.path) return Effect.succeed(undefined);\n          return lift(async () =>\n            (await oneFile(runner, path, output.path)) === true\n              ? undefined\n              : { action: 'replace' as const },\n          );\n        },\n\n        // ★ `--adopt` reaches the apply too: the probe never ran for a create with an Output prop.\n        //   ⛔ A create or an unfinished generation — never a fresh replace's, never offered it.\n        reconcile: ({ fqn, instanceId, news, output }) =>\n          Effect.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) =>\n            lift(() => reconcileFile(runner, news, output, adopt)),\n          ),\n\n        delete: ({ output }) => lift(() => deleteFile(runner, output)),\n      });\n    }),\n  );\n",
+    "/**\n * Whether two paths name ONE file — the question a move must answer before it deletes its old\n * path, and a plan before it answers `replace`.\n *\n * 🔴 MEASURED 2026-09-22 (release/binary-alias.test.ts, localRunner over a real temp directory,\n *   through Alchemy's own Plan and Apply): a Release.Binary whose directory was respelled to\n *   another path for the SAME file — through a symlinked parent (`/tmp` → `/private/tmp`, `/etc`\n *   → `/private/etc`), or by case alone on case-insensitive APFS, macOS's default — planned a\n *   `replace`. The new generation took the file already there as its own (same bytes, same mode:\n *   file-converge.ts's resume rule), then Phase 2 deleted the old generation's path, which was that\n *   same file. The deploy SUCCEEDED and the binary was gone. The `update` route lost it in one step:\n *   convergeFile's move removed the old path after \"writing\" the new one. Host.File shares both.\n * ★ IDENTITY, NOT SPELLING. Case-folding the strings would be wrong on a case-sensitive volume and\n *   blind to a symlinked parent; device and inode from lstat are what the kernel itself compares.\n * ⚠️ A HARD LINK also shares an inode. At the old path of a move it is therefore kept, not removed:\n *   one stray link left behind, rather than the risk of deleting the file just verified.\n */\nimport type { FileStat, HostRunner } from './runner.ts';\n\n/**\n * `true` when both entries exist and are one file; `false` when either is absent or they differ;\n * `undefined` when the runner reported no identity, so nobody can tell (fakes, custom runners).\n */\nexport const sameEntry = (\n  a: FileStat | undefined,\n  b: FileStat | undefined,\n): boolean | undefined => {\n  if (a === undefined || b === undefined) return false;\n  if (a.dev === undefined || a.ino === undefined || b.dev === undefined || b.ino === undefined) {\n    return undefined;\n  }\n  return a.dev === b.dev && a.ino === b.ino;\n};\n\n/** Whether `a` and `b` are one file on this host right now. Equal strings always are. */\nexport const oneFile = async (\n  runner: HostRunner,\n  a: string,\n  b: string,\n): Promise<boolean | undefined> => {\n  if (a === b) return true;\n  const [left, right] = await Promise.all([runner.stat(a), runner.stat(b)]);\n  return sameEntry(left, right);\n};\n\n/**\n * The last step of a move: `remove` the old path unless it is the file just verified at `path`.\n * ⚠️ A runner that reports no identity cannot be asked beforehand, so `path` is checked after: a\n *   file lost to a respelling then fails the deploy instead of reporting success.\n */\nexport const leaveOldPath = async (\n  runner: HostRunner,\n  oldPath: string,\n  path: string,\n  remove: () => Promise<void>,\n  refuse: (path: string, message: string) => Error,\n): Promise<void> => {\n  const same = await oneFile(runner, oldPath, path);\n  if (same === true) return;\n  await remove();\n  if (same === undefined && (await runner.stat(path)) === undefined) {\n    throw refuse(\n      path,\n      `removing the old path ${oldPath} removed this file too: they are one file under two ` +\n        'spellings (a symlinked parent, or case on a case-insensitive volume). Deploy again to ' +\n        'reinstall it, and keep one spelling.',\n    );\n  }\n};\n",
+    "/**\n * The one seam between the launchd providers and the host: every file read, file write and\n * `launchctl` call goes through a HostRunner, and nothing in this directory touches the host any\n * other way.\n *\n * ★ WHY A SEAM AND NOT DIRECT node:fs CALLS. launchd has no SDK — the provider renders a plist and\n *   drives `launchctl` — so the only way to test the lifecycle without a real launchd (and without\n *   writing /Library) is to swap the host out. fake-runner.ts is an in-memory host with a scripted\n *   launchd; local-runner.ts is the real one. The same seam is where a consumer plugs in a runner\n *   that reaches a host some other way.\n *\n * ★ PROMISES, NOT EFFECTS, ON PURPOSE. A consumer writing their own runner implements plain async\n *   functions; the providers lift them into Effect at the call site (host-effect.ts).\n */\nimport * as Context from 'effect/Context';\nimport * as Layer from 'effect/Layer';\n\n/** One finished process. ⛔ `stdout` may carry anything the job's environment holds — never log it. */\nexport type ExecResult = {\n  readonly exitCode: number;\n  readonly stdout: string;\n  readonly stderr: string;\n};\n\n/**\n * What `lstat` says about a path. ⚠️ lstat, not stat: a symlink is reported as a symlink, because\n *   writing through one would change a file this resource never named.\n */\nexport type FileStat = {\n  readonly kind: 'file' | 'directory' | 'symlink' | 'other';\n  /** Permission bits only (`& 0o7777`), never the file-type bits. */\n  readonly mode: number;\n  readonly uid: number;\n  readonly gid: number;\n  readonly size: number;\n  /**\n   * The entry's identity, device and inode, when the runner can say. ★ Two spellings of ONE file\n   *   (`/tmp/x` and `/private/tmp/x`; `Bin` and `bin` on case-insensitive APFS) differ as strings\n   *   and match here, and a move must not delete its old path when that path IS the new file\n   *   (file-identity.ts). Optional: a runner that leaves them out gets a check after the fact.\n   */\n  readonly dev?: number;\n  readonly ino?: number;\n};\n\nexport type WriteOptions = {\n  /**\n   * Permission bits for the final file. localRunner applies them BEFORE the file is visible at\n   * `path`. ⚠️ sudoRunner's `install -S` does NOT: MEASURED 2026-09-22 on macOS 27.2 (an lstat\n   *   poller racing /usr/bin/install), the new inode appears at `path` as 0600 and is chmodded\n   *   0.2–0.4 ms later. Never torn, never wider than declared, but briefly not executable.\n   */\n  readonly mode: number;\n  /** Numeric owner; omitted means whoever the runner writes as. */\n  readonly uid?: number;\n  /** Numeric group; omitted means the directory's default. */\n  readonly gid?: number;\n};\n\nexport type HostUser = { readonly uid: number; readonly gid: number; readonly home: string };\n\nexport interface HostRunner {\n  /**\n   * ⛔ DECLARED, NEVER INFERRED. `true` only when this runner can do every root-needing call the\n   *   providers make of it: every call already runs as root (a runner that talks to a root helper,\n   *   say), or the runner elevates exactly those calls (sudoRunner). The providers refuse\n   *   system-domain writes unless `effectiveUid()` is 0 or this is `true`, so claiming it falsely\n   *   turns that refusal into an EACCES halfway through a deploy.\n   * ⛔ THE KIT NEVER ELEVATES SILENTLY. localRunner() never calls `sudo`: a deploy that prompts for\n   *   a password mid-plan, or quietly borrows a cached sudo ticket, is exactly the \"no silent sudo\"\n   *   failure. sudoRunner() does call `sudo -n`, but only when a stack passes it explicitly, only\n   *   for the argv shapes in sudo-allowlist.ts, and logging each one (decided 2026-09-21).\n   */\n  readonly privileged: boolean;\n  /** The uid file writes and launchctl calls run as. */\n  effectiveUid(): number;\n  /** Run a program with an argv — ⛔ never through a shell. */\n  exec(argv: readonly string[]): Promise<ExecResult>;\n  /** File bytes, or `undefined` when nothing is at `path`. */\n  readFile(path: string): Promise<Uint8Array | undefined>;\n  /** lstat, or `undefined` when nothing is at `path`. */\n  stat(path: string): Promise<FileStat | undefined>;\n  /**\n   * Write `bytes` so that `path` holds either the old file or the new one, never a torn mix:\n   * a temporary file in the same directory, mode and owner set on it, then rename(2) over `path`\n   * (sudoRunner: the mode just after the rename, measured — see WriteOptions.mode; the owner too,\n   * ⚠️ REASONED NOT MEASURED, since measuring it needs root).\n   * ⚠️ The parent directory must exist; creating it would invent an owner and mode nobody declared.\n   */\n  writeFileAtomic(path: string, bytes: Uint8Array, options: WriteOptions): Promise<void>;\n  /**\n   * PLAN TIME: refuse, reading only and writing nothing, a write this runner would refuse at\n   * apply — so the plan shows it before any resource is applied. Optional: a runner without it\n   * refuses at the write. ★ sudoRunner implements it with the checks it makes before `sudo -n`;\n   *   ⛔ it never elevates, so a plan still never calls sudo.\n   */\n  checkWrite?(path: string, options: WriteOptions): Promise<void>;\n  /** Remove a file. Idempotent: nothing at `path` is success. */\n  removeFile(path: string): Promise<void>;\n  /** A user by name or numeric id, or `undefined` when the host has none. */\n  lookupUser(nameOrId: string): Promise<HostUser | undefined>;\n  /** A group's gid by name or numeric id, or `undefined` when the host has none. */\n  lookupGroup(nameOrId: string): Promise<number | undefined>;\n  /** Wait between launchctl polls. ★ Injected so a test never sleeps for real. */\n  sleep(ms: number): Promise<void>;\n}\n\n/** The Effect service every launchd provider reads its runner from. */\nexport class HostRunnerService extends Context.Service<HostRunnerService, HostRunner>()(\n  'homeflare/launchd/HostRunner',\n) {}\n\n/** Provide a runner to the providers: `Layer.provide(hostRunnerLayer(localRunner()))`. */\nexport const hostRunnerLayer = (runner: HostRunner): Layer.Layer<HostRunnerService> =>\n  Layer.succeed(HostRunnerService, runner);\n\n/** True when this runner may write root-owned paths and drive the system domain. */\nexport const canActAsRoot = (runner: HostRunner): boolean =>\n  runner.privileged || runner.effectiveUid() === 0;\n",
+    "/**\n * The one path a declared file's bytes take onto a host, shared by every resource that owns ONE\n * whole file: `Host.File` (text it was handed) and `Release.Binary` (bytes it downloaded and\n * verified). Read, diff, converge and delete, as plain async functions over a HostRunner.\n *\n * ★ EXTRACTED FROM host-file-lifecycle.ts, NOT COPIED (2026-09-22). The ownership rules below — a\n *   file this resource does not own is never overwritten, a move onto an occupied path stays\n *   refused, a failed create is rolled back — were red-teamed on Host.File (docs/ownership.md). A\n *   second resource that writes a whole file gets them by calling this, so a fix lands in both.\n * ★ THE BYTES ARE ASKED FOR ONLY WHEN A WRITE IS DUE (`bytesFor`). Host.File has them already; a\n *   binary has only a pinned digest until it downloads, and a host whose file already matches\n *   must not cost a 120 MB download to prove it.\n * ⛔ SYMLINKS AND DIRECTORIES ARE REFUSED, NOT REPLACED. rename(2) over a symlink replaces the LINK,\n *   so a path that is a symlink (nix-darwin's /etc entries point into /nix/store) would be quietly\n *   taken from the tool that owns it — which puts it back, or refuses its next activation. Remove\n *   the path from its owner first, then declare it here.\n */\nimport type { Diff } from 'alchemy/Diff';\nimport { leaveOldPath, oneFile } from './file-identity.ts';\nimport type { HostFileAttributes } from './host-file-form.ts';\nimport { sha256Hex } from './job-form.ts';\nimport { type HostRunner, type WriteOptions, canActAsRoot } from './runner.ts';\n\n/** What a whole file must be: where, which bytes (by digest), which mode and owner. */\nexport type FileTarget = {\n  readonly path: string;\n  readonly sha256: string;\n  readonly mode: number;\n  readonly uid?: number;\n  readonly gid?: number;\n};\n\n/** A family's refusal: `<Type> <path>: <message>`, so a deploy log names the resource that said no. */\nexport type Refuse = (path: string, message: string) => Error;\n\nconst numericId = (value: string | number): number | undefined =>\n  typeof value === 'number' ? value : /^\\d+$/.test(value) ? Number(value) : undefined;\n\n/** Resolve a declared owner and group (names or ids) to ids through the runner. */\nexport const resolveIds = async (\n  runner: HostRunner,\n  declared: { readonly owner?: string | number; readonly group?: string | number },\n  path: string,\n  refuse: Refuse,\n): Promise<{ uid?: number; gid?: number }> => {\n  let uid: number | undefined;\n  let gid: number | undefined;\n  if (declared.owner !== undefined) {\n    uid = numericId(declared.owner) ?? (await runner.lookupUser(String(declared.owner)))?.uid;\n    if (uid === undefined) throw refuse(path, `no user ${String(declared.owner)} on this host`);\n  }\n  if (declared.group !== undefined) {\n    gid = numericId(declared.group) ?? (await runner.lookupGroup(String(declared.group)));\n    if (gid === undefined) throw refuse(path, `no group ${String(declared.group)} on this host`);\n  }\n  return { ...(uid === undefined ? {} : { uid }), ...(gid === undefined ? {} : { gid }) };\n};\n\n/** The file as it is now, or `undefined` when nothing is at the path. Non-files read with no digest. */\nexport const readFileAttributes = async (\n  runner: HostRunner,\n  path: string,\n): Promise<HostFileAttributes | undefined> => {\n  const stat = await runner.stat(path);\n  if (stat === undefined) return undefined;\n  const bytes = stat.kind === 'file' ? await runner.readFile(path) : undefined;\n  return {\n    gid: stat.gid,\n    mode: stat.mode,\n    path,\n    sha256: bytes === undefined ? '' : sha256Hex(bytes),\n    size: stat.size,\n    uid: stat.uid,\n  };\n};\n\nexport const writeOptionsOf = (want: FileTarget): WriteOptions => ({\n  mode: want.mode,\n  ...(want.uid === undefined ? {} : { uid: want.uid }),\n  ...(want.gid === undefined ? {} : { gid: want.gid }),\n});\n\nexport const fileMatches = (live: HostFileAttributes, want: FileTarget): boolean =>\n  live.sha256 === want.sha256 &&\n  live.mode === want.mode &&\n  (want.uid === undefined || live.uid === want.uid) &&\n  (want.gid === undefined || live.gid === want.gid);\n\n/**\n * ★ A PLAN THAT WILL WRITE ASKS THE RUNNER FIRST (`checkWrite`, when it has one): sudoRunner's\n *   refusals — a setuid or group-writable root file, a directory under a prefix another user may\n *   change — then fail the plan, before any resource is applied, instead of halfway through it.\n */\nexport const diffTarget = async (\n  runner: HostRunner,\n  want: FileTarget,\n  output: HostFileAttributes,\n): Promise<Diff> => {\n  const writes = async (diff: Diff): Promise<Diff> => {\n    await runner.checkWrite?.(want.path, writeOptionsOf(want));\n    return diff;\n  };\n  // ★ Create-before-delete: two paths can hold two files at once, so nothing forces deleteFirst.\n  // ⛔ …unless the two paths are ONE file (file-identity.ts). That is a respelling, not a move: a\n  //   replace would let Phase 2 delete the old generation's path, which is the new one's file. An\n  //   update records the new spelling, and convergeFile keeps the file.\n  if (want.path !== output.path) {\n    const same = await oneFile(runner, want.path, output.path);\n    return writes({ action: same === true ? 'update' : 'replace' });\n  }\n  if (want.sha256 !== output.sha256) return writes({ action: 'update' });\n  const live = await readFileAttributes(runner, want.path);\n  return live !== undefined && fileMatches(live, want)\n    ? { action: 'noop' }\n    : writes({ action: 'update' });\n};\n\nexport type Converge = {\n  readonly want: FileTarget;\n  /** The owner as declared (a name or an id), for the chown refusal's wording. */\n  readonly owner?: string | number | undefined;\n  /** The bytes to write, asked for only when a write is due; `before` is what is there now. */\n  readonly bytesFor: (before: HostFileAttributes | undefined) => Promise<Uint8Array>;\n  readonly refuse: Refuse;\n};\n\n/**\n * Make the file at `want.path` match `want`, and return it as read back.\n *\n * `adopt` is whether adoption is on AND this apply is a create or an unfinished generation of our\n * own (ownership/adopt.ts adoptsAtApply). It lets such a generation take over a file already at the\n * path — the takeover the plan's probe would have allowed, had it run. ⛔ A move onto an occupied\n *   path stays refused, both ways the engine drives one: an `update` across the move (`moved`,\n *   below), and a fresh replace's new generation, which the caller never marks adoptable (its\n *   `output` is undefined too, so this function cannot tell it from a create by itself).\n */\nexport const convergeFile = async (\n  runner: HostRunner,\n  spec: Converge,\n  output?: HostFileAttributes,\n  adopt = false,\n): Promise<HostFileAttributes> => {\n  const { want, refuse } = spec;\n  const path = want.path;\n  // ⛔ NO SILENT SUDO: handing a file to another user is root's call (chown(2)), so say so up front.\n  if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {\n    throw refuse(\n      path,\n      `owner ${String(spec.owner)} is not the deploying user; only root may chown. Deploy as root ` +\n        'or through a privileged HostRunner (sudoRunner() with this path under a prefix). This ' +\n        'provider never calls sudo itself.',\n    );\n  }\n  const stat = await runner.stat(path);\n  if (stat !== undefined && stat.kind !== 'file') {\n    throw refuse(\n      path,\n      `is a ${stat.kind}; remove it from whatever owns it before declaring it here`,\n    );\n  }\n  const before = stat === undefined ? undefined : await readFileAttributes(runner, path);\n  // ⚠️ An `output` at another path: the engine planned an UPDATE across a move, which it does\n  //   when diff could not see the new path (host-file.ts). Finish it the way a replace would.\n  //   ★ A respelling of ONE file (file-identity.ts) still counts as moved here, so a file there\n  //   that does not match is refused below — never rewritten in place under the old spelling's pins.\n  const moved = output !== undefined && output.path !== path;\n  const prior = moved ? undefined : output;\n  /**\n   * ⛔ A FILE THIS RESOURCE DOES NOT OWN IS NEVER OVERWRITTEN. With no prior state for this path,\n   *   the engine's adoption probe has already refused anything it found — except where it never\n   *   looked: the new path of a replace, and a create whose props still held an Output at plan\n   *   time. A path typo there would otherwise overwrite, say, a system file that a fresh\n   *   declaration of the same path would have been refused as `Unowned`. ★ With adoption on, a\n   *   create takes it over, as the probe would have let it (decided 2026-09-21).\n   */\n  const takeOver = adopt && output === undefined;\n  if (prior === undefined && before !== undefined && !fileMatches(before, want) && !takeOver) {\n    throw refuse(\n      path,\n      'already exists and is not this resource. Remove it, or declare it as a new resource and ' +\n        'deploy with --adopt.',\n    );\n  }\n  if (before === undefined || !fileMatches(before, want)) {\n    const bytes = await spec.bytesFor(before);\n    // ⛔ THE ONE WRITER NEVER WRITES BYTES THAT ARE NOT THE DECLARED ONES. Host.File's always are;\n    //   a supplier that verifies elsewhere (a download) is held to the same digest here, last.\n    if (sha256Hex(bytes) !== want.sha256) {\n      throw refuse(path, `the bytes to write do not hash to ${want.sha256}. Nothing was written.`);\n    }\n    await runner.writeFileAtomic(path, bytes, writeOptionsOf(want));\n  }\n  // ⚠️ READ BACK, never echo the declaration: a umask, an ACL or a runner that ignored `uid` shows\n  //   up here as a refusal instead of as a forever-`update`.\n  // ⚠️ Roll back a CREATE: left behind, the next plan's recovery `read` finds a file with no state,\n  //   reports it `Unowned`, and every later deploy demands --adopt for our own file. ⛔ Also when\n  //   the read-back THROWS: MEASURED 2026-09-22, a 0111 binary written as a non-root operator read\n  //   back EACCES and stayed, and every later plan's probe failed with the same EACCES.\n  const rollBack = async () => {\n    if (before === undefined) await runner.removeFile(path).catch(() => undefined);\n  };\n  const after = await readFileAttributes(runner, path).catch(async (cause: unknown) => {\n    await rollBack();\n    throw refuse(path, `the write returned but reading it back failed: ${String(cause)}`);\n  });\n  if (after === undefined || !fileMatches(after, want)) {\n    await rollBack();\n    throw refuse(path, 'the write returned but the file on disk does not match the declaration');\n  }\n  // ★ Create-before-delete, as the replace would have been: the old path goes only once the new\n  //   one is written and verified — and ⛔ never when the old path IS this file (file-identity.ts).\n  if (moved)\n    await leaveOldPath(\n      runner,\n      output.path,\n      path,\n      () => removeWholeFile(runner, output, refuse),\n      refuse,\n    );\n  return after;\n};\n\n/** Remove the file. Idempotent. ⛔ Refuses a path that has since become a symlink or directory. */\nexport const removeWholeFile = async (\n  runner: HostRunner,\n  output: HostFileAttributes,\n  refuse: Refuse,\n): Promise<void> => {\n  const stat = await runner.stat(output.path);\n  if (stat === undefined) return;\n  if (stat.kind !== 'file') throw refuse(output.path, `is now a ${stat.kind}; not removing it`);\n  await runner.removeFile(output.path);\n};\n",
+    "/**\n * HostFile's props, attributes and validation — the pure half of the provider.\n *\n * ⛔ `content` IS NEVER A SECRET. Alchemy stores props unencrypted, so the content of every HostFile\n *   sits in the state store and in every plan diff. A secret file stays RENDERED BY A SECRET\n *   RENDERER (openbao-agent templates, on this estate) that fetches it at run time; the stack\n *   declares only non-secret config, and at most the PATH the renderer writes to.\n *   secret-tripwire.ts refuses the obvious case (a PEM private key); nothing can catch all of them.\n */\nimport { fileSecretProblems } from './secret-tripwire.ts';\n\nexport interface HostFileProps {\n  /** Absolute path. The parent directory must already exist. */\n  path: string;\n  /** UTF-8 text. ⛔ Never a secret — see the file header. */\n  content: string;\n  /** Permission bits. @default 0o644 */\n  mode?: number;\n  /** User name or numeric uid. Omitted: whoever the runner writes as (a rewrite keeps no owner). */\n  owner?: string | number;\n  /** Group name or numeric gid. Omitted: the directory's default group. */\n  group?: string | number;\n}\n\nexport interface HostFileAttributes {\n  path: string;\n  /** SHA-256 of the bytes on disk. */\n  sha256: string;\n  mode: number;\n  uid: number;\n  gid: number;\n  size: number;\n}\n\nexport const DEFAULT_MODE = 0o644;\n\n/** A user or group as declared: a non-negative id, or a name the host could have. */\nexport const identityProblems = (name: string, value: string | number | undefined): string[] => {\n  if (value === undefined) return [];\n  if (typeof value === 'number') {\n    return Number.isSafeInteger(value) && value >= 0\n      ? []\n      : [`${name} must be a non-negative integer id`];\n  }\n  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\\d+$/.test(value)\n    ? []\n    : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];\n};\n\n/**\n * An absolute, normalised path, or the reasons it is not. ★ Shared with sudo-allowlist.ts, so a\n *   path the sudo runner may touch as root obeys exactly the rule a declared file does.\n */\nexport const pathProblems = (path: string): string[] => {\n  const found: string[] = [];\n  if (!path.startsWith('/')) found.push('path must be absolute');\n  // ★ One spelling per file: `a/./b`, `a//b` and `a/../b` would each be a second resource for the\n  //   same inode, and `..` is how a derived path walks out of the directory it was meant for.\n  if (\n    path.endsWith('/') ||\n    path\n      .split('/')\n      .slice(1)\n      .some((part) => part === '' || part === '.' || part === '..')\n  ) {\n    found.push('path must be normalised (no trailing slash, no empty, \".\" or \"..\" segments)');\n  }\n  if (path.includes('\\x00')) found.push('path contains NUL');\n  return found;\n};\n\nexport const fileProblems = (props: HostFileProps): string[] => {\n  const found = pathProblems(props.path);\n  const mode = props.mode ?? DEFAULT_MODE;\n  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 0o7777) found.push('mode must be 0–0o7777');\n  found.push(...identityProblems('owner', props.owner));\n  found.push(...identityProblems('group', props.group));\n  found.push(...fileSecretProblems(props.content));\n  return found;\n};\n",
+    "/**\n * HostFile's read / diff / reconcile / delete as plain async functions over a HostRunner, so the\n * lifecycle runs against fake-runner.ts in tests.\n *\n * ★ THE CONVERGENCE ITSELF IS file-converge.ts, shared with every resource that owns one whole file\n *   (Release.Binary is the second). What stays here is what makes a HOST FILE: text content, its\n *   validation (never a secret — host-file-form.ts), and the refusal wording `Host.File <path>: …`.\n * ⛔ SYMLINKS AND DIRECTORIES ARE REFUSED, NOT REPLACED — see file-converge.ts for why.\n */\nimport type { Diff } from 'alchemy/Diff';\nimport {\n  type FileTarget,\n  convergeFile,\n  diffTarget,\n  removeWholeFile,\n  resolveIds,\n} from './file-converge.ts';\nimport {\n  DEFAULT_MODE,\n  type HostFileAttributes,\n  type HostFileProps,\n  fileProblems,\n} from './host-file-form.ts';\nimport { sha256Hex } from './job-form.ts';\nimport type { HostRunner } from './runner.ts';\n\nexport { readFileAttributes } from './file-converge.ts';\n\ntype Desired = FileTarget & { readonly bytes: Uint8Array };\n\nconst refuse = (path: string, message: string): Error => new Error(`Host.File ${path}: ${message}`);\n\n/** Validate, then resolve owner/group names to ids through the runner. */\nexport const desiredFile = async (runner: HostRunner, props: HostFileProps): Promise<Desired> => {\n  const found = fileProblems(props);\n  if (found.length > 0) throw refuse(props.path, found.join('; '));\n  const bytes = new TextEncoder().encode(props.content);\n  return {\n    bytes,\n    mode: props.mode ?? DEFAULT_MODE,\n    path: props.path,\n    sha256: sha256Hex(bytes),\n    ...(await resolveIds(runner, props, props.path, refuse)),\n  };\n};\n\n/** Declared digest, mode and owner against state and the live file — see diffTarget. */\nexport const diffFile = async (\n  runner: HostRunner,\n  news: HostFileProps,\n  output: HostFileAttributes,\n): Promise<Diff> => diffTarget(runner, await desiredFile(runner, news), output);\n\n/**\n * Write the declared text, unless the file already matches. `adopt` is adoptsAtApply's answer;\n * what it may and may not take over is convergeFile's ⛔.\n */\nexport const reconcileFile = async (\n  runner: HostRunner,\n  props: HostFileProps,\n  output?: HostFileAttributes,\n  adopt = false,\n): Promise<HostFileAttributes> => {\n  const want = await desiredFile(runner, props);\n  const spec = { bytesFor: async () => want.bytes, owner: props.owner, refuse, want };\n  return convergeFile(runner, spec, output, adopt);\n};\n\n/** Remove the file. Idempotent. ⛔ Refuses a path that has since become a symlink or directory. */\nexport const deleteFile = (runner: HostRunner, output: HostFileAttributes): Promise<void> =>\n  removeWholeFile(runner, output, refuse);\n"
   ],
-  "mappings": ";AAeA;AACA;AAAA;AA8CO,MAAM,8BAA8B,MAAM;AAAA,EAC7B,OAAO;AAC3B;AAAA;AAGO,MAAM,0BAAkC,gBAAuC,EACpF,4BACF,EAAE;AAAC;AAGI,IAAM,kBAAkB,CAAC,UACxB,cAAQ,mBAAmB,KAAK;;AC/DxC;;;ACqBO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EADX,WAAW,CACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,SAAS,KAAK,WAAW,SAAS,QAAQ;AAAA,IAHhD;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,SACJ;AAAA,IACA,0DACA;AAAA,IACA;AAAA;AAGF,IAAM,YAAY;AASlB,IAAM,YAAY;AAQX,IAAM,aAAa,CAAC,MAAc,SAAyB;AAAA,EAChE,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,EAC/B,IAAI,QAAQ,MAAM;AAAA,IAChB,MAAM,OAAO,IAAI,GAAG,YAAY,CAAC,KAAK;AAAA,IACtC,MAAM,IAAI,WACR,MACA,KAAK,KAAK,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,4BACtD;AAAA,EACF;AAAA,EACA,OAAO,KACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,MAAM,OAAO;AAAA;AAG7B,IAAM,gBAAgB,CAAC,UAA2B;AAAA,EAChD,MAAM,QAAQ,OAAO,eAAe,KAAK;AAAA,EACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAGjD,IAAM,cAAc,CAAC,OAAgB,MAAc,OAAe,QAAwB;AAAA,EACxF,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAC7B,IAAI,QAAQ;AAAA,IAAW,MAAM,IAAI,WAAW,MAAM,sBAAsB,OAAO,SAAS,GAAG;AAAA,EAC3F,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,IAAI,KAAK,GAAG,cAAc,WAAW,OAAO,IAAI,YAAY;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,IAAI,KAAK,GAAG,OAAO,QAAQ,SAAS,WAAW;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAE7B,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAAA,MAChC,MAAM,IAAI,WAAW,MAAM,GAAG,OAAO,KAAK,6CAA6C;AAAA,IACzF;AAAA,IACA,IAAI,KAAK,GAAG,eAAe,OAAO,UAAU,IAAI,IAAI,KAAK,aAAa;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,IAAI,KAAK,GAAG,aAAa;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB,YAAY,OAAO,SAAU,MAA6B,QAAQ,GAAG;AAAA,MACnE,YAAY,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG,GAAG;AAAA,IAC/D;AAAA,IACA,IAAI,KAAK,GAAG,aAAa;AAAA,IACzB;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,cAAc,KAAK,GAAG;AAAA,IACvE,WAAW,OAAkC,MAAM,OAAO,GAAG;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAM,OAAO,UAAU,OAAO,SAAS,OAAO;AAAA,EAC9C,MAAM,IAAI,WAAW,MAAM,GAAG,+CAA+C;AAAA;AAG/E,IAAM,aAAa,CACjB,MACA,MACA,OACA,QACS;AAAA,EACT,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAE7B,MAAM,OAAO,OAAO,KAAK,IAAI,EAAE,KAAK;AAAA,EACpC,IAAI,KAAK,WAAW,GAAG;AAAA,IACrB,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB;AAAA,EACF;AAAA,EACA,IAAI,KAAK,GAAG,WAAW;AAAA,EACvB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,QAAQ;AAAA,IAC7C,IAAI,KAAK,GAAG,YAAa,WAAW,KAAK,KAAK,SAAS;AAAA,IACvD,YAAY,KAAK,MAAM,OAAO,QAAQ,GAAG,GAAG;AAAA,EAC9C;AAAA,EACA,IAAI,KAAK,GAAG,YAAY;AAAA;AAInB,IAAM,cAAc,CAAC,SAA4B;AAAA,EACtD,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,KAAK,CAAC,cAAc,IAAI,GAAG;AAAA,IAC5F,MAAM,IAAI,WAAW,IAAI,iDAAiD;AAAA,EAC5E;AAAA,EACA,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAiC,IAAI,GAAG,GAAG;AAAA,EACtD,OAAO,GAAG,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;;;ADxE3B,IAAM,cAAc,CAAC,WAA6C;AAAA,EACvE,IAAI,WAAW;AAAA,IAAU,OAAO,EAAE,MAAM,SAAS;AAAA,EACjD,MAAM,QAAQ,eAAe,KAAK,MAAM;AAAA,EACxC,OAAO,QAAQ,OAAO,YAAY,YAAY,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,EAAE,EAAE;AAAA;AAG9E,IAAM,gBAAgB,CAAC,OAAe,WAAkC,GAAG,UAAU;AAOrF,IAAM,eAAe,CAC1B,OACA,QACA,SACW;AAAA,EACX,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,0BAA0B;AAAA,EAE/D,IAAI,SAAS,aAAa,CAAC,KAAK,WAAW,GAAG,GAAG;AAAA,IAC/C,MAAM,IAAI,MAAM,OAAO,OAAO,OAAO,GAAG,gDAAgD;AAAA,EAC1F;AAAA,EACA,OAAO,GAAG,6BAA6B;AAAA;AAIlC,IAAM,aAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAAe,CAAC,UAAuC;AAAA,EAC3D,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,MAAM,WAAW;AAAA,IAAW,KAAK,YAAY,MAAM;AAAA,EACvD,IAAI,MAAM,SAAS;AAAA,IAAW,KAAK,UAAU,MAAM;AAAA,EACnD,IAAI,MAAM,QAAQ;AAAA,IAAW,KAAK,SAAS,MAAM;AAAA,EACjD,IAAI,MAAM,YAAY;AAAA,IAAW,KAAK,aAAa,MAAM;AAAA,EACzD,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,MAAM;AAAA,EACrD,OAAO;AAAA;AAGT,IAAM,iBAAiB,CAAC,cAAqC;AAAA,EAC3D,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO;AAAA,EAC3C,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,UAAU,mBAAmB;AAAA,IAAW,KAAK,oBAAoB,UAAU;AAAA,EAC/E,IAAI,UAAU,YAAY;AAAA,IAAW,KAAK,aAAa,UAAU;AAAA,EACjE,OAAO;AAAA;AAIF,IAAM,eAAe,CAAC,UAAsC;AAAA,EACjE,MAAM,OAAmC,KAAK,MAAM,UAAU;AAAA,EAC9D,KAAK,WAAW,MAAM;AAAA,EACtB,KAAK,sBAAsB,CAAC,GAAG,MAAM,gBAAgB;AAAA,EACrD,MAAM,MAAM,MAAM,eAAe,CAAC;AAAA,EAClC,IAAI,OAAO,KAAK,GAAG,EAAE,SAAS;AAAA,IAAG,KAAK,0BAA0B,KAAK,IAAI;AAAA,EACzE,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,eAAe,MAAM,SAAS;AAAA,EACrF,IAAI,MAAM,kBAAkB;AAAA,IAAW,KAAK,mBAAmB,MAAM;AAAA,EACrE,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,KAAK,2BAA2B,MAAM,QAAQ,QAAQ,IACjD,SAAyC,IAAI,YAAY,IAC1D,aAAa,QAA4B;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,oBAAoB;AAAA,IAAW,KAAK,qBAAqB,MAAM;AAAA,EACzE,IAAI,MAAM,sBAAsB;AAAA,IAAW,KAAK,uBAAuB,MAAM;AAAA,EAC7E,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,aAAa;AAAA,IAAW,KAAK,cAAc,MAAM;AAAA,EAC3D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,OAAO;AAAA;AAGF,IAAM,YAAY,CAAC,UACxB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAG1C,IAAM,YAAY,CACvB,UACwD;AAAA,EACxD,MAAM,OAAO,YAAY,aAAa,KAAK,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC3C,OAAO,EAAE,OAAO,QAAQ,UAAU,KAAK,GAAG,KAAK;AAAA;;;AE1JjD,IAAM,SAAS,CAAC,UAAsB;AAAA,EACpC,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAQ,MAA0B,IAAI,MAAM;AAAA,EACtE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,MAAM,SAAS;AAAA,IACf,MAAM,MAA4B,CAAC;AAAA,IACnC,WAAW,OAAO,OAAO,KAAK,MAAM,EAAE,KAAK;AAAA,MAAG,IAAI,OAAO,OAAO,OAAO,QAAQ,IAAI;AAAA,IACnF,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,cAAc,CAAC,SAA0B,KAAK,MAAM,IAAI;AAG9D,IAAM,kBAAkB,CAAC,WAC9B,KAAK,UAAU,OAAQ,UAAU,IAAa,CAAC;AAG1C,IAAM,eAAe,CAAC,WAA4B,UAAU,gBAAgB,MAAM,CAAC;;;ACjBnF,MAAM,wBAAwB,MAAM;AAAA,EAE9B;AAAA,EACA;AAAA,EACA;AAAA,EAHX,WAAW,CACA,QACA,QACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,UAAU,UAAU,OAAO,MAAM,MAAM,QAAQ;AAAA,IALrD;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,YAAY;AAElB,IAAM,aAAa;AAInB,IAAM,WAAW,CAAC,YAChB,GAAG,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,CAAC,MAAM,QAAQ,WAAW;AAGrF,IAAM,UAAU,CAAC,SAAqC;AAAA,EACpD,MAAM,KAAK,KAAK,YAAY,UAAU;AAAA,EACtC,IAAI,OAAO;AAAA,IAAI;AAAA,EACf,IAAI;AAAA,IACF,MAAM,SAAS,KAAK,MAAM,KAAK,MAAM,EAAE,CAAC;AAAA,IACxC,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAAA,IACzD,MAAM;AAAA,IACN;AAAA;AAAA;AAIJ,IAAM,aAAa,CAAC,SAA2B;AAAA,EAC7C,IAAI,KAAK,KAAK,MAAM;AAAA,IAAI,OAAO,CAAC;AAAA,EAChC,IAAI;AAAA,IACF,MAAM,SAAS,KAAK,MAAM,IAAI;AAAA,IAC9B,OAAO,MAAM,QAAQ,MAAM,IAAK,OAAqB,IAAI,QAAQ,IAAI,CAAC;AAAA,IACtE,MAAM;AAAA,IACN,OAAO,CAAC;AAAA;AAAA;AAIZ,IAAM,OAAO,CAAC,UAA8B,QAAgB,SAAwB;AAAA,EAClF,MAAM,SAAS,QAAQ,SAAS,IAAI,MAAM,SAAS,KAAK,KAAK,EAAE,MAAM,GAAG,GAAG,KAAK;AAAA,EAEhF,MAAM,QAAQ,SAAS,WAAW,MAAM,GAAG,iCAAiC;AAAA,EAC5E,MAAM,IAAI,gBAAgB,SAAS,QAAQ,QAAQ,MAAM,KAAK;AAAA;AAMzD,IAAM,iBAAiB,OAAO,OAAmB,cAAwC;AAAA,EAC9F,MAAM,WAAW,MAAM,MAAM,QAAQ;AAAA,IACnC,MAAM;AAAA,IACN,SAAS,EAAE,gBAAgB,UAAU;AAAA,IACrC,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AAAA,EAGD,IAAI,SAAS,WAAW;AAAA,IAAK,KAAK,UAAU,QAAQ,QAAQ;AAAA,EAC5D,MAAM,SAAS,KAAK,MAAM,SAAS,IAAI;AAAA,EACvC,OAAO,EAAE,QAAQ,OAAO,UAAU,MAAM,WAAW,OAAO,YAAY,CAAC,GAAG,IAAI,QAAQ,EAAE;AAAA;AAInF,IAAM,oBAAoB,OAAO,UAAwC;AAAA,EAC9E,MAAM,WAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,OAAO,MAAM,WAAW,CAAC;AAAA,EACxE,IAAI,SAAS,WAAW;AAAA,IAAK,KAAK,UAAU,OAAO,UAAU;AAAA,EAC7D,OAAO,YAAY,SAAS,IAAI;AAAA;AAW3B,IAAM,gBAAgB,OAC3B,OACA,WACA,eAC+B;AAAA,EAC/B,MAAM,WAAW,MAAM,MAAM,QAAQ;AAAA,IACnC,MAAM;AAAA,IACN,SAAS;AAAA,MACP,gBAAgB;AAAA,SACZ,eAAe,YACf,CAAC,IACD,EAAE,+BAA+B,aAAa,4BAA4B,WAAW;AAAA,IAC3F;AAAA,IACA,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AAAA,EACD,MAAM,UAAU,QAAQ,SAAS,IAAI;AAAA,EACrC,IAAI,SAAS,WAAW,OAAO,YAAY;AAAA,IAAW,KAAK,UAAU,QAAQ,OAAO;AAAA,EACpF,OAAO,WAAW,SAAS,IAAI;AAAA;;ACtGjC;AACA,oBAAS;AACT;AACA;AACA;;;ACnBA;AAEO,IAAM,OAAO,CAAI,SACf,kBAAW;AAAA,EAChB,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,EAC3E,KAAK;AACP,CAAC;AAQI,IAAM,iBAAiB,CAAC,MAAe,QAAoC;AAAA,EAChF,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,QAAS,KAAiC;AAAA,EAChD,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA;;;ACjB7C;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,WAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,YAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,gBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,cAAM,QAAQ,GAAU,oBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,iBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,eAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,eAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,YAAW,sBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,YAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,sBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,sBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,YACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAaK,IAAM,sBAAsB,CAAC,KAAa,eACxC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,cAAM;AAAA,CACtE;;;AFxFI,IAAM,eAAe,CAAC,QACpB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,sBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,sBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AIzE9B,IAAM,qBAAqB;AAE3B,IAAM,gBAAgB;AAKtB,IAAM,cAAc,CAAC,WAAoC;AAAA,EACvD,IAAI,OAAO,SAAS,GAAG;AAAA,IAAG,OAAO;AAAA,EACjC,MAAM,OAAO,iDAAiD,KAAK,MAAM;AAAA,EACzE,IAAI,SAAS;AAAA,IAAM,OAAO,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,GAAG;AAAA,EAC9D,IAAI,eAAe,KAAK,MAAM,KAAK,CAAC,cAAc,KAAK,MAAM,GAAG;AAAA,IAC9D,OAAO,WAAW,KAAK,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA,EACvD;AAAA,EACA,MAAM,UAAU,OAAO,QAAQ,eAAe,EAAE;AAAA,EAChD,MAAM,QAAQ,QAAQ,YAAY,GAAG;AAAA,EACrC,MAAM,OAAO,OAAO,QAAQ,MAAM,QAAQ,CAAC,CAAC;AAAA,EAC5C,IAAI,UAAU,MAAM,CAAC,OAAO,UAAU,IAAI,KAAK,QAAQ;AAAA,IAAG,OAAO;AAAA,EACjE,OAAO,EAAE,MAAM,QAAQ,MAAM,GAAG,KAAK,GAAG,MAAM,OAAO,KAAK;AAAA;AAG5D,IAAM,YAAY,CAAC,SAAyB,KAAK,QAAQ,cAAc,IAAI;AAS3E,IAAM,UAAU,CAAC,YAAoB,eAAgC;AAAA,EACnE,MAAM,UAAU,UAAU,WAAW,MAAM,GAAG,WAAW,YAAY,GAAG,CAAC,CAAC;AAAA,EAC1E,MAAM,YAAY,UAAU,UAAU;AAAA,EACtC,OACE,YAAY,eAAe,aAAa,cAAc,cAAc,cAAc;AAAA;AAItF,IAAM,eAAe,CAAC,QAAgB,cACpC,OAAO,SAAS,QACZ,UAAU,SAAS,SACnB,OAAO,SAAS,UAAU,QAC1B,QAAQ,UAAU,YAAY,OAAO,IAAI,IACzC,UAAU,SAAS,UAAU,OAAO,SAAS,UAAU;AAG7D,IAAM,iBAAiB,CAAC,SACtB,CAAC,aAAa,SAAS,WAAW,EAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,OAAO,IAAI,GAAG;AAE7E,IAAM,aAAa,CAAC,WAAuC;AAAA,EACzD,IAAI,CAAC,OAAO,SAAS,KAAK;AAAA,IAAG,OAAO;AAAA,EACpC,IAAI;AAAA,IACF,MAAM,MAAM,IAAI,IAAI,MAAM;AAAA,IAE1B,OAAO,IAAI,aAAa,UAAU,IAAI,OAAO;AAAA,IAC7C,MAAM;AAAA,IACN;AAAA;AAAA;AAIJ,IAAM,gBAAgB,CAAC,OAAmB,cAAsD;AAAA,EAC9F,IAAI,MAAM,WAAW,WAAW;AAAA,IAC9B,MAAM,YACJ,UAAU,SAAS,SACnB,UAAU,SAAS,sBACnB,QAAQ,UAAU,YAAY,WAAW;AAAA,IAC3C,OAAO,YACH,YACA,2FACE;AAAA,EACR;AAAA,EACA,MAAM,SAAS,YAAY,MAAM,MAAM;AAAA,EACvC,MAAM,QAAQ,KAAK,UAAU,MAAM,MAAM;AAAA,EACzC,IAAI,OAAO,WAAW,UAAU;AAAA,IAC9B,OAAO,gBAAgB,YAAY;AAAA,EACrC;AAAA,EACA,IAAI,OAAO,SAAS,SAAS,CAAC,cAAc,KAAK,OAAO,IAAI,GAAG;AAAA,IAC7D,OAAO,gBAAgB;AAAA,EACzB;AAAA,EACA,OAAO,aAAa,QAAQ,SAAS,IACjC,YACA,gBAAgB;AAAA;AAIf,IAAM,gBAAgB,CAAC,SAAkB,cAA4C;AAAA,EAC1F,MAAM,QACJ,OAAO,YAAY,YAAY,YAAY,OACrC,QAAmC,SAAS,CAAC,IAC/C,CAAC;AAAA,EACP,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,MAAM,aAAa,MAAM;AAAA,IAC3B,OAAO,CAAC,6EAA6E;AAAA,EACvF;AAAA,EACA,IAAI,MAAM,WAAW;AAAA,IAAW,MAAM,KAAK,iDAAiD;AAAA,EAC5F,IAAI,MAAM,QAAQ,SAAS,WAAW;AAAA,IACpC,MAAM,KACJ,oFACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,cAAc,OAAO,SAAS;AAAA,EAC5C,IAAI,UAAU;AAAA,IAAW,MAAM,KAAK,KAAK;AAAA,EACzC,IAAI,UAAU,SAAS,OAAO;AAAA,IAC5B,MAAM,UAAU,MAAM,SAAS,IAAI,UAAU,KAAK,eAAe,UAAU,IAAI;AAAA,IAC/E,IAAI,CAAC,QAAQ,SAAS,UAAU,UAAU,GAAG;AAAA,MAC3C,MAAM,QACJ,MAAM,YAAY,YACd,qDAAqD,KAAK,UAAU,OAAO,MAC3E,iBAAiB,KAAK,UAAU,MAAM,OAAO;AAAA,MACnD,MAAM,KACJ,GAAG,2BAA2B,UAAU,6CACtC,iDACJ;AAAA,IACF;AAAA,EACF,EAAO,SAAI,MAAM,mBAAmB,MAAM;AAAA,IACxC,MAAM,KACJ,8FACE,gDACJ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACxJT,IAAM,cACJ,gGACA;AAGF,IAAM,cACJ;AAGF,IAAM,cAAc;AAGpB,IAAM,YAAY;AAEX,IAAM,cAAc;AAG3B,IAAM,YAAY,CAAC,OAAmB,SAA2B;AAAA,EAC/D,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1E,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAQ,MAAgC,QAAQ,CAAC,MAAM,UACrD,UAAU,MAAM,GAAG,QAAQ,OAAO,KAAK,IAAI,CAC7C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,OAAO,OAAO,QAAQ,KAAK,EAAE,QAAQ,EAAE,KAAK,UAAU,UAAU,MAAM,GAAG,QAAQ,KAAK,CAAC;AAAA,EACzF;AAAA,EACA,OAAO,CAAC;AAAA;AAOH,IAAM,oBAAoB,CAC/B,aACA,MACA,cACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,MAAM,UAAU,OAAO,QAAQ,eAAe,CAAC,CAAC,GAAG;AAAA,IAC7D,IAAI,YAAY,KAAK,IAAI;AAAA,MACvB,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,IACjE,SAAI,YAAY,KAAK,KAAK;AAAA,MAC7B,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,EACxE;AAAA,EACA,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAEzC,IAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MACzB,MAAM,KAAK,oBAAoB,OAAO,KAAK,8BAA8B,aAAa;AAAA,IACxF,EAAO,SAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAAA,MACzD,MAAM,KAAK,oBAAoB,OAAO,QAAQ,CAAC,6BAA6B,aAAa;AAAA,IAC3F,EAAO,SAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MAChC,MAAM,KAAK,oBAAoB,OAAO,KAAK,2BAA2B,aAAa;AAAA,IACrF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,UAAU,aAAa,CAAC,GAAG,WAAW,GAAG;AAAA,IAC1D,MAAM,KAAK,GAAG,6BAA6B,aAAa;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,qBAAqB,CAAC,YACjC,YAAY,KAAK,OAAO,IAAI,CAAC,gCAAgC,aAAa,IAAI,CAAC;;;AC1DjF,IAAM,eACJ,kGACA;AAGF,IAAM,cACJ;AAGF,IAAM,gBAAgB;AAEtB,IAAM,mBAAmB;AACzB,IAAM,oBACJ;AAGF,IAAM,SAAiD;AAAA,EACrD,CAAC,iEAAiE,gBAAgB;AAAA,EAClF,CAAC,+BAA+B,sBAAsB;AAAA,EACtD,CAAC,mCAAmC,eAAe;AAAA,EACnD,CAAC,0CAA0C,mBAAmB;AAAA,EAC9D,CAAC,mEAAmE,OAAO;AAAA,EAG3E,CAAC,0CAA0C,wBAAwB;AAAA,EACnE,CAAC,yBAAyB,yBAAyB;AACrD;AAEA,IAAM,cAAc;AACpB,IAAM,cAAc;AAUpB,IAAM,cAAc;AACpB,IAAM,eAAe,CAAC,SAAyB,KAAK,QAAQ,aAAa,IAAI;AAGtE,IAAM,WAAW,CAAC,SAA2B;AAAA,EAClD,MAAM,SAAmB,CAAC;AAAA,EAC1B,IAAI,UAAU;AAAA,EACd,IAAI;AAAA,EACJ,SAAS,QAAQ,EAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AAAA,IACnD,MAAM,OAAO,KAAK,UAAU;AAAA,IAC5B,IAAI,UAAU,WAAW;AAAA,MACvB,IAAI,SAAS,QAAQ,UAAU,OAAO,QAAQ,IAAI,KAAK,QAAQ;AAAA,QAC7D,SAAS;AAAA,QACT,WAAW,KAAK,UAAU;AAAA,MAC5B,EAAO,SAAI,SAAS;AAAA,QAAO,QAAQ;AAAA,MAC9B;AAAA,mBAAW;AAAA,IAClB,EAAO,SAAI,SAAS,OAAO,SAAS,KAAK;AAAA,MACvC,QAAQ;AAAA,IACV,EAAO,SAAI,KAAK,KAAK,IAAI,GAAG;AAAA,MAC1B,IAAI,YAAY;AAAA,QAAI,OAAO,KAAK,OAAO;AAAA,MACvC,UAAU;AAAA,IACZ,EAAO,SAAI,SAAS,OAAO,YAAY,IAAI;AAAA,MACzC;AAAA,IACF,EAAO;AAAA,iBAAW;AAAA,EACpB;AAAA,EACA,IAAI,YAAY;AAAA,IAAI,OAAO,KAAK,OAAO;AAAA,EACvC,OAAO;AAAA;AAQT,IAAM,kBAAkB,CAAC,WACvB,OACG,QAAQ,CAAC,UAAU,MAAM,QAAQ,aAAa,GAAG,EAAE,MAAM,KAAK,CAAC,EAC/D,OAAO,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,EACvF,WAAW;AAEhB,IAAM,eAAe,CAAC,QAA2B,UAA4B;AAAA,EAC3E,OAAO,QAAQ,IAAI,UAAU;AAAA,EAC7B,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,YAAY,KAAK,KAAK,KAAK,OAAO,SAAS,KAAK,CAAC,gBAAgB,OAAO,MAAM,CAAC,CAAC,GAAG;AAAA,IACrF,MAAM,KAAK,GAAG,YAAY,6BAA6B;AAAA,EACzD;AAAA,EACA,IAAI,cAAc,KAAK,KAAK,KAAK,OAAO,SAAS,KAAK,CAAC,gBAAgB,OAAO,MAAM,CAAC,CAAC,GAAG;AAAA,IACvF,MAAM,KAAK,GAAG,YAAY,SAAS,UAAU,+BAA+B;AAAA,EAC9E;AAAA,EACA,IAAI,iBAAiB,KAAK,KAAK,GAAG;AAAA,IAChC,MAAM,KAAK,OAAO,UAAU,CAAC,OAAO,UAAU,QAAQ,KAAK,kBAAkB,KAAK,KAAK,CAAC;AAAA,IACxF,IAAI,OAAO,MAAM,OAAO,SAAS,KAAK,KAAK,CAAC,gBAAgB,OAAO,MAAM,KAAK,CAAC,CAAC,GAAG;AAAA,MACjF,MAAM,KAAK,GAAG,YAAY,SAAS,OAAO,OAAO,gCAAgC;AAAA,IACnF;AAAA,EACF;AAAA,EACA,WAAW,SAAS,QAAQ;AAAA,IAC1B,MAAM,QAAQ,OAAO,KAAK,EAAE,aAAa,QAAQ,KAAK,KAAK,CAAC;AAAA,IAE5D,IAAI,UAAU;AAAA,MAAW,MAAM,KAAK,GAAG,gCAAgC,MAAM,IAAI;AAAA,EACnF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,0BAA0B,CAAC,cAAgC;AAAA,EACtE,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,YAAY,KAAK,SAAS;AAAA,IAAG,MAAM,KAAK,uCAAuC;AAAA,EACnF,YAAY,OAAO,SAAS,UAAU,MAAM;AAAA,CAAI,EAAE,QAAQ,GAAG;AAAA,IAC3D,MAAM,KAAK,GAAG,aAAa,SAAS,aAAa,IAAI,CAAC,GAAG,QAAQ,OAAO,QAAQ,CAAC,GAAG,CAAC;AAAA,EACvF;AAAA,EACA,OAAO,MAAM,IAAI,CAAC,YAAY,GAAG,YAAY,cAAa;AAAA;;;AC9F5D,IAAM,qBAAqB,CAAC,SAC1B,KAAK,WAAW,GAAG,KACnB,CAAC,KAAK,SAAS,GAAG,KAClB,CAAC,KAAK,SAAS,MAAM,KACrB,CAAC,KACE,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI;AAEzD,IAAM,iBAAiB,CAAC,UAAsC;AAAA,EACnE,MAAM,QAAkB,CAAC;AAAA,EAQzB,IAAI,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,IACjC,MAAM,KAAK,oEAAoE;AAAA,EACjF;AAAA,EACA,IAAI,MAAM,eAAe,aAAa,CAAC,mBAAmB,MAAM,UAAU,GAAG;AAAA,IAC3E,MAAM,KAAK,iDAAiD;AAAA,EAC9D;AAAA,EACA,MAAM,KAAK,GAAG,wBAAwB,MAAM,SAAS,CAAC;AAAA,EACtD,OAAO;AAAA;;;AChCT,IAAM,SAAS,CAAC,OAAmB,YACjC,IAAI,MAAM,mBAAmB,MAAM,aAAa,SAAS;AAE3D,IAAM,QAAQ,CAAC,WAA2B,OAAO,MAAM,GAAG,EAAE;AAU5D,IAAM,gBAAgB,CAAC,WAA6B;AAAA,EAClD,MAAM,OACJ,OAAO,WAAW,YAAY,WAAW,OAAQ,OAA8B,OAAO;AAAA,EACxF,OAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,OAAO,KAAK,IAAI,EAAE,WAAW;AAAA;AAS5E,IAAM,gBAAgB,OAC3B,OACA,UACqB;AAAA,EACrB,MAAM,QAAQ,eAAe,KAAK;AAAA,EAClC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,OAAO,OAAO,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1D,MAAM,UAAU,MAAM,eAAe,OAAO,MAAM,SAAS;AAAA,EAC3D,IAAI,cAAc,QAAQ,MAAM,GAAG;AAAA,IACjC,MAAM,OAAO,OAAO,oEAAoE;AAAA,EAC1F;AAAA,EACA,MAAM,QAAQ,cAAc,QAAQ,QAAQ,MAAM,QAAQ;AAAA,EAC1D,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,OAAO,OAAO,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1D,OAAO,EAAE,QAAQ,aAAa,QAAQ,MAAM,GAAG,UAAU,QAAQ,SAAS;AAAA;AAG5E,IAAM,eAAe,CACnB,OACA,SACA,gBAC2B;AAAA,EAC3B,cAAc,aAAa,OAAO;AAAA,EAClC,UAAU,MAAM;AAAA,KACZ,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AACnD;AAGO,IAAM,WAAW,OACtB,OACA,eAEA,aAAa,OAAO,MAAM,kBAAkB,KAAK,GAAG,UAAU;AASzD,IAAM,YAAY,CAAC,SAAkB,mBAC1C,cAAc,OAAO,KAAK,aAAa,OAAO,MAAM;AAmB/C,IAAM,YAAY,OACvB,OACA,WACA,eAC+B;AAAA,EAC/B,MAAM,UAAU,MAAM,kBAAkB,KAAK;AAAA,EAC7C,IAAI,cAAc,OAAO;AAAA,IAAG;AAAA,EAC5B,MAAM,aAAa,aAAa,OAAO,SAAS,UAAU;AAAA,EAC1D,IAAI,cAAc,WAAW;AAAA,IAC3B,OAAO,EAAE,YAAY,MAAM,OAAO,WAAW,yCAAyC;AAAA,EACxF;AAAA,EACA,IAAI;AAAA,IACF,MAAM,OAAO,MAAM,cAAc,OAAO,EAAE,UAAU,CAAC;AAAA,IACrD,OAAO,EAAE,YAAY,MAAM,UAAU,SAAS,KAAK,MAAM,EAAE;AAAA,IAC3D,OAAO,OAAO;AAAA,IAEd,IAAI,iBAAiB;AAAA,MAAuB,MAAM;AAAA,IAClD,OAAO;AAAA,MACL;AAAA,MACA,MAAM;AAAA,MACN,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAClE;AAAA;AAAA;AASG,IAAM,aAAa,OACxB,OACA,MACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,cAAc,OAAO,IAAI;AAAA,EAC5C,MAAM,OAAO,MAAM,SAAS,KAAK;AAAA,EACjC,MAAM,YACJ,KAAK,WAAW,KAAK,gBACrB,KAAK,iBAAiB,OAAO,gBAC7B,KAAK,eAAe,OAAO,cAI3B,MAAM,aAAa,OAAO;AAAA,EAC5B,OAAO,YAAY,EAAE,QAAQ,OAAO,IAAI,EAAE,QAAQ,SAAS;AAAA;AA6BtD,IAAM,kBAAkB,OAC7B,OACA,OACA,cACqB;AAAA,EACrB,MAAM,OAAO,MAAM,cAAc,OAAO,KAAK;AAAA,EAC7C,MAAM,UAAU,MAAM,kBAAkB,KAAK;AAAA,EAC7C,MAAM,SAAS,aAAa,OAAO;AAAA,EACnC,MAAM,QAAQ,WAAW,UAAU,UAAU,UAAU,SAAS,KAAK,MAAM;AAAA,EAC3E,IAAI,CAAC,UAAU,YAAY,CAAC,OAAO;AAAA,IACjC,MAAM,OACJ,OACA,qBAAqB,MAAM,MAAM,gEAC/B,MAAM,MAAM,KAAK,MAAM,iEACvB,2FACA,gDACJ;AAAA,EACF;AAAA,EACA,IAAI,WAAW,KAAK;AAAA,EACpB,MAAM,SAAS,WAAW,KAAK;AAAA,EAC/B,IAAI,QAAQ;AAAA,IACV,IAAI;AAAA,MACF,WAAW,MAAM,cAAc,OAAO,MAAM,WAAW,MAAM,UAAU;AAAA,MACvE,OAAO,OAAO;AAAA,MACd,IAAI,EAAE,iBAAiB;AAAA,QAAkB,MAAM;AAAA,MAI/C,MAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA,MACzD,MAAM,QACJ,UAAU,YACN,kDACA,MAAM,iBAAiB,SACrB,mDACA,iCAAiC,MAAM,MAAM,YAAY,uBAAuB,MAAM,MAAM;AAAA,MACpG,MAAM,OAAO,OAAO,iCAAiC,MAAM,YAAY,OAAO;AAAA;AAAA,EAElF;AAAA,EAIA,MAAM,aAAa,MAAM,SAAS,OAAO,MAAM,UAAU;AAAA,EACzD,IAAI,WAAW,iBAAiB,KAAK,QAAQ;AAAA,IAC3C,MAAM,OACJ,OACA,oCAAoC,MAAM,WAAW,YAAY,gBAC/D,GAAG,MAAM,KAAK,MAAM,+EACxB;AAAA,EACF;AAAA,EACA,OAAO,EAAE,YAAY,QAAQ,SAAS;AAAA;;;AVlMjC,IAAM,cAAc,SAAsB,gBAAgB;AAAA,EAC/D,sBAAsB;AACxB,CAAC;AAED,IAAM,cAAc,CAAC,UACnB,iBAAiB;AAQnB,IAAM,mBACJ,CAAI,OAA6B,aACjC,CAAC,UACQ,WACE,mBACL,6BAA6B,MAAM,aAAa,MAAM,qCACpD,0DACJ,GACA,QACF;AAEG,IAAM,sBAAsB,MACxB,gBACP,aACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EAErB,MAAM,QAAQ,CAAC,WAA+B,eACrC,gBACL,KAAK,MAAM,UAAU,OAAO,WAAW,UAAU,CAAC,GAClD,CAAC,UAAU;AAAA,IACT,IAAI,UAAU;AAAA,MAAW,OAAc,gBAAQ,SAAS;AAAA,IACxD,IAAI,MAAM;AAAA,MAAM,OAAc,gBAAQ,MAAM,UAAU;AAAA,IACtD,MAAM,UAAU,SAAQ,MAAM,UAAU;AAAA,IACxC,OAAO,MAAM,cAAc,YAChB,gBAAQ,OAAO,IACf,WACE,mBACL,mBAAmB,MAAM,wDACvB,gCAAgC,MAAM,0CAC1C,GACA,OACF;AAAA,GAER;AAAA,EACF,OAAO,YAAY,SAAS,GAAG;AAAA,IAE7B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAQ7B,MAAM,GAAG,MAAM,cACZ,WAAW,YACR,MAAM,eAAe,MAAM,WAAW,GAAG,eAAe,MAAM,YAAY,CAAC,IAC3E,KAAK,MAAM,SAAS,OAAO,eAAe,MAAM,YAAY,CAAC,CAAC,GAChE,KAEO,gBAAQ,aAAa,iBAAiB,OAAO,SAAS,CAAC,CAChE;AAAA,IAEF,MAAM,GAAG,MAAM,aAAa;AAAA,MAC1B,IAAI,WAAW;AAAA,QAAW,OAAc,gBAAQ,SAAS;AAAA,MACzD,MAAM,SAAS,iBAAiB,OAAO,EAAE,QAAQ,SAAkB,CAAC;AAAA,MACpE,IAAI,WAAW,IAAI,GAAG;AAAA,QACpB,OAAO,KAAK,MAAM,WAAW,OAAO,MAAM,MAAM,CAAC,EAAE,KAC1C,gBAAQ,aAAa,MAAM,CACpC;AAAA,MACF;AAAA,MAOA,MAAM,YAAY,eAAe,MAAM,WAAW;AAAA,MAClD,IAAI,cAAc;AAAA,QAAW,OAAc,gBAAQ,SAAS;AAAA,MAC5D,OAAO,KAAK,YAAY;AAAA,QACtB,MAAM,WAAW,OAAO,EAAE,UAAU,GAAG,MAAM;AAAA,QAC7C,OAAO,EAAE,QAAQ,SAAkB;AAAA,OACpC,EAAE,KAAY,gBAAQ,aAAa,MAAM,CAAC;AAAA;AAAA,IAG7C,WAAW,GAAG,KAAK,MAAM,aAChB,YAAI,UAAU,GAAG;AAAA,MAKtB,MAAM,YAAY,WAAW,aAAa,OAAO,aAAa,MAAM;AAAA,MACpE,MAAM,WAAW,cAAc,OAAO,aAAa,GAAG;AAAA,MACtD,MAAM,SAAS,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,aAAa;AAAA,MACzE,MAAM,UAAU,OAAO,KAAK,MAC1B,gBAAgB,OAAO,MAAM,EAAE,aAAa,OAAO,CAAC,CACtD;AAAA,MACA,WAAW,WAAW,QAAQ,UAAU;AAAA,QACtC,OAAc,mBAAW,mBAAmB,MAAM,aAAa,SAAS;AAAA,MAC1E;AAAA,MACA,OAAO,QAAQ;AAAA,KAChB;AAAA,IAEH,QAAQ,MAAa;AAAA,EACvB,CAAC;AAAA,CACF,CACH;;AWxIF,oBAAS;AAoCF,IAAM,wBAAwB;AAMrC,IAAM,OAAO;AACb,IAAM,YAAY;AAElB,IAAM,UAAS,CAAC,SAAiB,QAC/B,IAAI,MAAM,uBAAuB,KAAK,UAAU,OAAO,MAAM,KAAK;AAEpE,IAAM,aAAa,CAAC,aAClB,aAAa,eAAe,aAAa,WAAW,wBAAwB,KAAK,QAAQ;AAGpF,IAAM,oBAAoB,CAC/B,SACA,eACqD;AAAA,EACrD,IAAI,eAAe,aAAa,CAAC,UAAU,KAAK,UAAU,GAAG;AAAA,IAC3D,MAAM,QAAO,SAAS,cAAc,KAAK,UAAU,UAAU,qBAAqB;AAAA,EACpF;AAAA,EACA,IAAI,QAAQ,WAAW,IAAI,GAAG;AAAA,IAC5B,MAAM,aAAa,QAAQ,MAAM,KAAK,MAAM;AAAA,IAC5C,IAAI,CAAC,WAAW,WAAW,GAAG;AAAA,MAAG,MAAM,QAAO,SAAS,kCAAkC;AAAA,IACzF,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,WAAW,GAAG,QAAQ,EAAE,MAAM,QAAQ,WAAW,EAAE;AAAA,EAC9F;AAAA,EACA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,MAAM,IAAI,IAAI,OAAO;AAAA,IACrB,MAAM;AAAA,IACN,MAAM,QAAO,SAAS,mDAAmD;AAAA;AAAA,EAI3E,IAAI,IAAI,aAAa;AAAA,IAAS,MAAM,QAAO,SAAS,oCAAoC;AAAA,EACxF,IAAI,CAAC,WAAW,IAAI,QAAQ,GAAG;AAAA,IAC7B,MAAM,QAAO,SAAS,qEAAqE;AAAA,EAC7F;AAAA,EACA,IAAI,IAAI,aAAa,OAAO,IAAI,WAAW,MAAM,IAAI,aAAa,IAAI;AAAA,IACpE,MAAM,QAAO,SAAS,2DAA2D;AAAA,EACnF;AAAA,EACA,MAAM,OAAO,IAAI,SAAS,KAAK,KAAK,OAAO,IAAI,IAAI;AAAA,EAInD,MAAM,OAAO,cAAc,GAAG,IAAI,YAAY,OAAO,IAAI;AAAA,EACzD,OAAO;AAAA,IACL,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,OAAO,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC;AAAA,IACpD;AAAA,IAEA,QAAQ,EAAE,MAAM,IAAI,SAAS,QAAQ,cAAc,IAAI,GAAG,MAAM,OAAO,KAAK;AAAA,EAC9E;AAAA;AAGF,IAAM,OAAO,CAAC,UACZ,OAAO,UAAU,YAAY,UAAU,SAAQ,UAAU,SACrD,OAAQ,MAA4B,IAAI,IACxC;AAGN,IAAM,iBAAiB,CAAC,UACtB,KAAK,KAAK,MAAM,kBAAkB,KAAK,KAAK,MAAM;AAEpD,IAAM,WAAW,CACf,QACA,QACA,MACA,SACA,MACA,cAEA,IAAI,QAAQ,CAAC,SAAS,WAAW;AAAA,EAC/B,MAAM,QAAQ,SAAS,YAAY,YAAY,OAAO,KAAK,MAAM,MAAM;AAAA,EACvE,MAAM,UAAU,YACd;AAAA,OACM,OAAO,SAAS,QAChB,EAAE,MAAM,OAAO,MAAM,MAAM,OAAO,KAAK,IACvC,EAAE,YAAY,OAAO,WAAW;AAAA,IACpC,SAAS,UAAU,YAAY,UAAU,KAAK,SAAS,kBAAkB,MAAM,OAAO;AAAA,IACtF;AAAA,IACA;AAAA,IACA,SAAS;AAAA,EACX,GACA,CAAC,aAAa;AAAA,IACZ,MAAM,SAAmB,CAAC;AAAA,IAC1B,SAAS,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AAAA,IACzD,SAAS,GAAG,SAAS,MAAM;AAAA,IAC3B,SAAS,GAAG,OAAO,MACjB,QAAQ;AAAA,MACN,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AAAA,MAC3C,QAAQ,SAAS,cAAc;AAAA,IACjC,CAAC,CACH;AAAA,GAEJ;AAAA,EACA,QAAQ,GAAG,WAAW,MAAM,QAAQ,QAAQ,IAAI,MAAM,gBAAgB,OAAO,SAAS,MAAM,CAAC,CAAC;AAAA,EAC9F,QAAQ,GAAG,SAAS,MAAM;AAAA,EAC1B,QAAQ,IAAI,KAAK;AAAA,CAClB;AAEI,IAAM,kBAAkB,CAAC,UAAkC,CAAC,MAAkB;AAAA,EACnF,MAAM,UAAU,QAAQ,WAAW;AAAA,EACnC,QAAQ,UAAU,WAAW,kBAAkB,SAAS,QAAQ,UAAU;AAAA,EAC1E,MAAM,YAAY,QAAQ,aAAa;AAAA,EACvC,MAAM,UAAU,QAAQ,WAAW;AAAA,EACnC,MAAM,QAAQ,QAAQ,gBAAgB;AAAA,EACtC,MAAM,QACJ,SAAS,SAAS,QACd,EAAE,MAAM,SAAS,YAAY,QAAQ,UAAU,SAAS,aAAa,IACrE,EAAE,MAAM,YAAY;AAAA,EAC1B,OAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA,SAAS,SAAS,MAAM,SAAS,QAAQ,WAAW;AAAA,MAClD,SAAS,UAAU,IAAK,WAAW,GAAG;AAAA,QACpC,IAAI;AAAA,UAEF,OAAO,MAAM,SAAS,QAAQ,QAAQ,MAAM,KAAK,YAAY,MAAM,GAAG,MAAM,SAAS;AAAA,UACrF,OAAO,OAAO;AAAA,UACd,IAAI,CAAC,eAAe,KAAK,KAAK,WAAW,SAAS;AAAA,YAChD,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,YACpE,MAAM,UAAU,eAAe,UAAU,WAAW,YAAY;AAAA,YAChE,MAAM,eAAe,KAAK,IAAI,IAAI,sBAAsB,OAAO,IAAI,IAAI,MAAM,OAAO;AAAA,UACtF;AAAA,UAEA,MAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,KAAK,CAAC;AAAA;AAAA,MAE7D;AAAA;AAAA,EAEJ;AAAA;;ACjLF;AAKO,IAAM,iBAAiB,CAAC,QAAoB,gBAAgB,MACjE,oBAAoB,EAAE,KAAW,eAAQ,gBAAgB,KAAK,CAAC,CAAC;;ACWlE;AACA;;;ACZA,qBAAS;AACT,oBAAS;AACT,uBAAS;AACT;AACA;;;ACcO,IAAM,eAAe;AAE5B,IAAM,mBAAmB,CAAC,MAAc,UAAiD;AAAA,EACvF,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAOpE,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,KAAK,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,uBAAuB;AAAA,EAG7D,IACE,KAAK,SAAS,GAAG,KACjB,KACG,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAC9D;AAAA,IACA,MAAM,KAAK,6EAA6E;AAAA,EAC1F;AAAA,EACA,IAAI,KAAK,SAAS,MAAM;AAAA,IAAG,MAAM,KAAK,mBAAmB;AAAA,EACzD,OAAO;AAAA;AAGF,IAAM,eAAe,CAAC,UAAmC;AAAA,EAC9D,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,OAAO;AAAA;;;AC/DT;AACA;AAAA;AA8EO,MAAM,0BAAkC,iBAAuC,EACpF,8BACF,EAAE;AAAC;AAGI,IAAM,kBAAkB,CAAC,WACxB,eAAQ,mBAAmB,MAAM;AAGlC,IAAM,eAAe,CAAC,WAC3B,OAAO,cAAc,OAAO,aAAa,MAAM;;;AC5EjD,IAAM,UAAS,CAAC,MAAc,YAA2B,IAAI,MAAM,aAAa,SAAS,SAAS;AAElG,IAAM,YAAY,CAAC,UACjB,OAAO,UAAU,WAAW,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;AAGrE,IAAM,cAAc,OAAO,QAAoB,UAA2C;AAAA,EAC/F,MAAM,QAAQ,aAAa,KAAK;AAAA,EAChC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,QAAO,MAAM,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,EAC/D,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,MAAM,OAAO;AAAA,EACpD,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI,MAAM,UAAU,WAAW;AAAA,IAC7B,MAAM,UAAU,MAAM,KAAK,MAAM,MAAM,OAAO,WAAW,OAAO,MAAM,KAAK,CAAC,IAAI;AAAA,IAChF,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,MAAM,WAAW,OAAO,MAAM,KAAK,gBAAgB;AAAA,EAC/F;AAAA,EACA,IAAI,MAAM,UAAU,WAAW;AAAA,IAC7B,MAAM,UAAU,MAAM,KAAK,KAAM,MAAM,OAAO,YAAY,OAAO,MAAM,KAAK,CAAC;AAAA,IAC7E,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,MAAM,YAAY,OAAO,MAAM,KAAK,gBAAgB;AAAA,EAChG;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA,MAAM,MAAM,QAAQ;AAAA,IACpB,QAAQ,UAAU,KAAK;AAAA,OACnB,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,OAC/B,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,EACrC;AAAA;AAIK,IAAM,qBAAqB,OAChC,QACA,SAC4C;AAAA,EAC5C,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,KAAK,SAAS,SAAS,MAAM,OAAO,SAAS,IAAI,IAAI;AAAA,EACnE,OAAO;AAAA,IACL,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,IACX;AAAA,IACA,QAAQ,UAAU,YAAY,KAAK,UAAU,KAAK;AAAA,IAClD,MAAM,KAAK;AAAA,IACX,KAAK,KAAK;AAAA,EACZ;AAAA;AAGF,IAAM,iBAAiB,CAAC,UAAiC;AAAA,EACvD,MAAM,KAAK;AAAA,KACP,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AAAA,KAC9C,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AACpD;AAEA,IAAM,UAAU,CAAC,MAA0B,SACzC,KAAK,WAAW,KAAK,UACrB,KAAK,SAAS,KAAK,SAClB,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK,SAC5C,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK;AAOxC,IAAM,WAAW,OACtB,QACA,MACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,YAAY,QAAQ,IAAI;AAAA,EAC3C,MAAM,SAAS,OAAO,SAA8B;AAAA,IAClD,MAAM,OAAO,aAAa,KAAK,MAAM,eAAe,IAAI,CAAC;AAAA,IACzD,OAAO;AAAA;AAAA,EAGT,IAAI,KAAK,SAAS,OAAO;AAAA,IAAM,OAAO,OAAO,EAAE,QAAQ,UAAU,CAAC;AAAA,EAClE,IAAI,KAAK,WAAW,OAAO;AAAA,IAAQ,OAAO,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA,EACrE,MAAM,OAAO,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,EACvD,OAAO,SAAS,aAAa,QAAQ,MAAM,IAAI,IAC3C,EAAE,QAAQ,OAAO,IACjB,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA;AAW1B,IAAM,gBAAgB,OAC3B,QACA,OACA,QACA,QAAQ,UACwB;AAAA,EAChC,MAAM,OAAO,MAAM,YAAY,QAAQ,KAAK;AAAA,EAE5C,IAAI,KAAK,QAAQ,aAAa,KAAK,QAAQ,OAAO,aAAa,KAAK,CAAC,aAAa,MAAM,GAAG;AAAA,IACzF,MAAM,QACJ,MAAM,MACN,SAAS,OAAO,MAAM,KAAK,sEACzB,2FACA,mCACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,IAAI;AAAA,EACzC,IAAI,SAAS,aAAa,KAAK,SAAS,QAAQ;AAAA,IAC9C,MAAM,QACJ,MAAM,MACN,QAAQ,KAAK,gEACf;AAAA,EACF;AAAA,EACA,MAAM,SAAS,SAAS,YAAY,YAAY,MAAM,mBAAmB,QAAQ,MAAM,IAAI;AAAA,EAG3F,MAAM,QAAQ,WAAW,aAAa,OAAO,SAAS,MAAM;AAAA,EAC5D,MAAM,QAAQ,QAAQ,YAAY;AAAA,EASlC,MAAM,WAAW,SAAS,WAAW;AAAA,EACrC,IAAI,UAAU,aAAa,WAAW,aAAa,CAAC,QAAQ,QAAQ,IAAI,KAAK,CAAC,UAAU;AAAA,IACtF,MAAM,QACJ,MAAM,MACN,6FACE,sBACJ;AAAA,EACF;AAAA,EACA,IAAI,WAAW,aAAa,CAAC,QAAQ,QAAQ,IAAI,GAAG;AAAA,IAClD,MAAM,OAAO,gBAAgB,MAAM,MAAM,KAAK,OAAO,eAAe,IAAI,CAAC;AAAA,EAC3E;AAAA,EAGA,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,MAAM,IAAI;AAAA,EACzD,IAAI,UAAU,aAAa,CAAC,QAAQ,OAAO,IAAI,GAAG;AAAA,IAGhD,IAAI,WAAW;AAAA,MAAW,MAAM,OAAO,WAAW,MAAM,IAAI,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA,IACnF,MAAM,QACJ,MAAM,MACN,wEACF;AAAA,EACF;AAAA,EAGA,IAAI;AAAA,IAAO,MAAM,WAAW,QAAQ,MAAM;AAAA,EAC1C,OAAO;AAAA;AAIF,IAAM,aAAa,OAAO,QAAoB,WAA8C;AAAA,EACjG,MAAM,OAAO,MAAM,OAAO,KAAK,OAAO,IAAI;AAAA,EAC1C,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAAQ,MAAM,QAAO,OAAO,MAAM,YAAY,KAAK,uBAAuB;AAAA,EAC5F,MAAM,OAAO,WAAW,OAAO,IAAI;AAAA;;;AH5J9B,IAAM,WAAW,UAAmB,WAAW;AAE/C,IAAM,mBAAmB,MACrB,iBACP,UACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,SAAS,SAAS,GAAG;AAAA,IAC1B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAE7B,MAAM,GAAG,MAAM,aACb,KAAK,YAAY;AAAA,MACf,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,MACxD,IAAI,UAAU;AAAA,QAAW;AAAA,MACzB,OAAO,WAAW,YAAY,SAAQ,KAAK,IAAI;AAAA,KAChD;AAAA,IAEH,MAAM,GAAG,YAAY,MAAM,aAAa;AAAA,MAEtC,IAAI,WAAW;AAAA,QAAW,OAAO,eAAe,UAAU;AAAA,MAC1D,IAAI,YAAW,IAAI;AAAA,QAAG,OAAO,KAAK,MAAM,SAAS,QAAQ,MAAM,MAAM,CAAC;AAAA,MAItE,MAAM,OAAO,eAAe,MAAM,MAAM;AAAA,MACxC,OAAc,gBACZ,SAAS,aAAa,SAAS,OAAO,OAAO,EAAE,QAAQ,UAAmB,IAAI,SAChF;AAAA;AAAA,IAKF,WAAW,GAAG,KAAK,YAAY,MAAM,aAC5B,gBAAQ,cAAc,EAAE,KAAK,YAAY,OAAO,CAAC,GAAG,CAAC,UAC1D,KAAK,MAAM,cAAc,QAAQ,MAAM,QAAQ,KAAK,CAAC,CACvD;AAAA,IAEF,QAAQ,GAAG,aAAa,KAAK,MAAM,WAAW,QAAQ,MAAM,CAAC;AAAA,EAC/D,CAAC;AAAA,CACF,CACH;;;ADtBK,IAAM,gBAAgB,CAAC,IAAY,UACjC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,eAAe,EAAE,WAAW,MAAM,WAAW,YAAY,MAAM,KAAK,CAAC;AAAA,EACnF,IAAI,MAAM,SAAS,GAAG;AAAA,IACpB,OAAO,OAAc,aAAK,IAAI,MAAM,iBAAiB,OAAO,MAAM,KAAK,IAAI,GAAG,CAAC;AAAA,EACjF;AAAA,EACA,MAAM,OAAO,OAAO,SAAS,GAAG,WAAW;AAAA,IACzC,SAAS,MAAM;AAAA,IACf,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM;AAAA,OACR,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,OACtD,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,EAC5D,CAAC,EAAE,KAAmB,qBAAO,CAAC;AAAA,EAC9B,MAAM,SAAS,OAAO,YAAY,IAAI,EAAE,WAAW,MAAM,WAAW,YAAY,KAAK,KAAK,CAAC;AAAA,EAC3F,OAAO,EAAE,QAAQ,KAAK;AAAA,CACvB;",
-  "debugId": "13AB2C6EDF123C4E64756E2164756E21",
+  "mappings": ";AAoBA,IAAM,uBAAuB,CAAC,kBAAkB,cAAc;AA6B9D,IAAM,WAAW,IAAI,IAAI,CAAC,aAAa,aAAa,OAAO,OAAO,CAAC;AAQnE,IAAM,SAAS,CAAC,aAA6B;AAAA,EAC3C,MAAM,UAAU,SAAS,QAAQ,gBAAgB,EAAE;AAAA,EACnD,IAAI,QAAQ,WAAW,OAAO;AAAA,IAAG,OAAO;AAAA,EAGxC,IAAI,QAAQ,WAAW,GAAG;AAAA,IAAG,OAAO,QAAQ,MAAM,GAAG,QAAQ,QAAQ,GAAG,IAAI,CAAC;AAAA,EAE7E,MAAM,QAAQ,QAAQ,QAAQ,GAAG;AAAA,EACjC,OAAO,UAAU,KAAK,UAAU,QAAQ,MAAM,GAAG,KAAK;AAAA;AAGjD,IAAM,mBAAmB,CAAC,aAA+B;AAAA,EAC9D,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OAAO,OAAO,SAAS,KAAK,CAAC;AAAA,EAEnC,IAAI,SAAS,KAAK,MAAM;AAAA,IAAI,MAAM,KAAK,mBAAmB;AAAA,EACrD,SAAI,SAAS,UAAU,CAAC,SAAS,IAAI,IAAI,GAAG;AAAA,IAC/C,MAAM,KACJ,mDAAmD,gDACrD;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAoBF,IAAM,oBAAoB,CAAC,UAA0C;AAAA,EAC1E,MAAM,WAAW,iBAAiB,MAAM,QAAQ;AAAA,EAChD,IAAI,SAAS,SAAS;AAAA,IAAG,MAAM,IAAI,MAAM,sBAAsB,SAAS,KAAK,IAAI,GAAG;AAAA,EAEpF,MAAM,SAAS,MAAM,UAAU;AAAA,EAC/B,MAAM,MAAM,MAAM,OAAO;AAAA,EACzB,MAAM,UAAU,MAAM,eAAe;AAAA,EAErC,MAAM,QAAQ;AAAA,IACZ,GAAI,MAAM,QAAQ,CAAC;AAAA,IACnB,gBAAgB,MAAM;AAAA,IACtB,GAAG,aAAa;AAAA,IAGhB,GAAG;AAAA,IACH,GAAG,QAAQ,IAAI,CAAC,WAAW,GAAG,SAAS,SAAS,QAAQ;AAAA,IACxD,GAAG;AAAA,IACH;AAAA,EACF;AAAA,EAEA,OAAO,MAAM,IAAI,CAAC,SAAS,GAAG,SAAS,MAAM,EAAE,KAAK;AAAA,CAAI;AAAA;;ACvG1D;AACA;AAAA;AA8CO,MAAM,8BAA8B,MAAM;AAAA,EAC7B,OAAO;AAC3B;AAAA;AAGO,MAAM,0BAAkC,gBAAuC,EACpF,4BACF,EAAE;AAAC;AAGI,IAAM,kBAAkB,CAAC,UACxB,cAAQ,mBAAmB,KAAK;;AC/DxC;;;ACqBO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EADX,WAAW,CACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,SAAS,KAAK,WAAW,SAAS,QAAQ;AAAA,IAHhD;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,SACJ;AAAA,IACA,0DACA;AAAA,IACA;AAAA;AAGF,IAAM,YAAY;AASlB,IAAM,YAAY;AAQX,IAAM,aAAa,CAAC,MAAc,SAAyB;AAAA,EAChE,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,EAC/B,IAAI,QAAQ,MAAM;AAAA,IAChB,MAAM,OAAO,IAAI,GAAG,YAAY,CAAC,KAAK;AAAA,IACtC,MAAM,IAAI,WACR,MACA,KAAK,KAAK,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,4BACtD;AAAA,EACF;AAAA,EACA,OAAO,KACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,MAAM,OAAO;AAAA;AAG7B,IAAM,gBAAgB,CAAC,UAA2B;AAAA,EAChD,MAAM,QAAQ,OAAO,eAAe,KAAK;AAAA,EACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAGjD,IAAM,cAAc,CAAC,OAAgB,MAAc,OAAe,QAAwB;AAAA,EACxF,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAC7B,IAAI,QAAQ;AAAA,IAAW,MAAM,IAAI,WAAW,MAAM,sBAAsB,OAAO,SAAS,GAAG;AAAA,EAC3F,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,IAAI,KAAK,GAAG,cAAc,WAAW,OAAO,IAAI,YAAY;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,IAAI,KAAK,GAAG,OAAO,QAAQ,SAAS,WAAW;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAE7B,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAAA,MAChC,MAAM,IAAI,WAAW,MAAM,GAAG,OAAO,KAAK,6CAA6C;AAAA,IACzF;AAAA,IACA,IAAI,KAAK,GAAG,eAAe,OAAO,UAAU,IAAI,IAAI,KAAK,aAAa;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,IAAI,KAAK,GAAG,aAAa;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB,YAAY,OAAO,SAAU,MAA6B,QAAQ,GAAG;AAAA,MACnE,YAAY,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG,GAAG;AAAA,IAC/D;AAAA,IACA,IAAI,KAAK,GAAG,aAAa;AAAA,IACzB;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,cAAc,KAAK,GAAG;AAAA,IACvE,WAAW,OAAkC,MAAM,OAAO,GAAG;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAM,OAAO,UAAU,OAAO,SAAS,OAAO;AAAA,EAC9C,MAAM,IAAI,WAAW,MAAM,GAAG,+CAA+C;AAAA;AAG/E,IAAM,aAAa,CACjB,MACA,MACA,OACA,QACS;AAAA,EACT,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAE7B,MAAM,OAAO,OAAO,KAAK,IAAI,EAAE,KAAK;AAAA,EACpC,IAAI,KAAK,WAAW,GAAG;AAAA,IACrB,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB;AAAA,EACF;AAAA,EACA,IAAI,KAAK,GAAG,WAAW;AAAA,EACvB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,QAAQ;AAAA,IAC7C,IAAI,KAAK,GAAG,YAAa,WAAW,KAAK,KAAK,SAAS;AAAA,IACvD,YAAY,KAAK,MAAM,OAAO,QAAQ,GAAG,GAAG;AAAA,EAC9C;AAAA,EACA,IAAI,KAAK,GAAG,YAAY;AAAA;AAInB,IAAM,cAAc,CAAC,SAA4B;AAAA,EACtD,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,KAAK,CAAC,cAAc,IAAI,GAAG;AAAA,IAC5F,MAAM,IAAI,WAAW,IAAI,iDAAiD;AAAA,EAC5E;AAAA,EACA,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAiC,IAAI,GAAG,GAAG;AAAA,EACtD,OAAO,GAAG,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;;;ADxE3B,IAAM,cAAc,CAAC,WAA6C;AAAA,EACvE,IAAI,WAAW;AAAA,IAAU,OAAO,EAAE,MAAM,SAAS;AAAA,EACjD,MAAM,QAAQ,eAAe,KAAK,MAAM;AAAA,EACxC,OAAO,QAAQ,OAAO,YAAY,YAAY,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,EAAE,EAAE;AAAA;AAG9E,IAAM,gBAAgB,CAAC,OAAe,WAAkC,GAAG,UAAU;AAOrF,IAAM,eAAe,CAC1B,OACA,QACA,SACW;AAAA,EACX,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,0BAA0B;AAAA,EAE/D,IAAI,SAAS,aAAa,CAAC,KAAK,WAAW,GAAG,GAAG;AAAA,IAC/C,MAAM,IAAI,MAAM,OAAO,OAAO,OAAO,GAAG,gDAAgD;AAAA,EAC1F;AAAA,EACA,OAAO,GAAG,6BAA6B;AAAA;AAIlC,IAAM,aAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAAe,CAAC,UAAuC;AAAA,EAC3D,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,MAAM,WAAW;AAAA,IAAW,KAAK,YAAY,MAAM;AAAA,EACvD,IAAI,MAAM,SAAS;AAAA,IAAW,KAAK,UAAU,MAAM;AAAA,EACnD,IAAI,MAAM,QAAQ;AAAA,IAAW,KAAK,SAAS,MAAM;AAAA,EACjD,IAAI,MAAM,YAAY;AAAA,IAAW,KAAK,aAAa,MAAM;AAAA,EACzD,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,MAAM;AAAA,EACrD,OAAO;AAAA;AAGT,IAAM,iBAAiB,CAAC,cAAqC;AAAA,EAC3D,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO;AAAA,EAC3C,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,UAAU,mBAAmB;AAAA,IAAW,KAAK,oBAAoB,UAAU;AAAA,EAC/E,IAAI,UAAU,YAAY;AAAA,IAAW,KAAK,aAAa,UAAU;AAAA,EACjE,OAAO;AAAA;AAIF,IAAM,eAAe,CAAC,UAAsC;AAAA,EACjE,MAAM,OAAmC,KAAK,MAAM,UAAU;AAAA,EAC9D,KAAK,WAAW,MAAM;AAAA,EACtB,KAAK,sBAAsB,CAAC,GAAG,MAAM,gBAAgB;AAAA,EACrD,MAAM,MAAM,MAAM,eAAe,CAAC;AAAA,EAClC,IAAI,OAAO,KAAK,GAAG,EAAE,SAAS;AAAA,IAAG,KAAK,0BAA0B,KAAK,IAAI;AAAA,EACzE,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,eAAe,MAAM,SAAS;AAAA,EACrF,IAAI,MAAM,kBAAkB;AAAA,IAAW,KAAK,mBAAmB,MAAM;AAAA,EACrE,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,KAAK,2BAA2B,MAAM,QAAQ,QAAQ,IACjD,SAAyC,IAAI,YAAY,IAC1D,aAAa,QAA4B;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,oBAAoB;AAAA,IAAW,KAAK,qBAAqB,MAAM;AAAA,EACzE,IAAI,MAAM,sBAAsB;AAAA,IAAW,KAAK,uBAAuB,MAAM;AAAA,EAC7E,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,aAAa;AAAA,IAAW,KAAK,cAAc,MAAM;AAAA,EAC3D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,OAAO;AAAA;AAGF,IAAM,YAAY,CAAC,UACxB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAG1C,IAAM,YAAY,CACvB,UACwD;AAAA,EACxD,MAAM,OAAO,YAAY,aAAa,KAAK,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC3C,OAAO,EAAE,OAAO,QAAQ,UAAU,KAAK,GAAG,KAAK;AAAA;;;AE1JjD,IAAM,SAAS,CAAC,UAAsB;AAAA,EACpC,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAQ,MAA0B,IAAI,MAAM;AAAA,EACtE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,MAAM,SAAS;AAAA,IACf,MAAM,MAA4B,CAAC;AAAA,IACnC,WAAW,OAAO,OAAO,KAAK,MAAM,EAAE,KAAK;AAAA,MAAG,IAAI,OAAO,OAAO,OAAO,QAAQ,IAAI;AAAA,IACnF,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,cAAc,CAAC,SAA0B,KAAK,MAAM,IAAI;AAG9D,IAAM,kBAAkB,CAAC,WAC9B,KAAK,UAAU,OAAQ,UAAU,IAAa,CAAC;AAG1C,IAAM,eAAe,CAAC,WAA4B,UAAU,gBAAgB,MAAM,CAAC;;;ACjBnF,MAAM,wBAAwB,MAAM;AAAA,EAE9B;AAAA,EACA;AAAA,EACA;AAAA,EAHX,WAAW,CACA,QACA,QACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,UAAU,UAAU,OAAO,MAAM,MAAM,QAAQ;AAAA,IALrD;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,YAAY;AAElB,IAAM,aAAa;AAInB,IAAM,WAAW,CAAC,YAChB,GAAG,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,CAAC,MAAM,QAAQ,WAAW;AAGrF,IAAM,UAAU,CAAC,SAAqC;AAAA,EACpD,MAAM,KAAK,KAAK,YAAY,UAAU;AAAA,EACtC,IAAI,OAAO;AAAA,IAAI;AAAA,EACf,IAAI;AAAA,IACF,MAAM,SAAS,KAAK,MAAM,KAAK,MAAM,EAAE,CAAC;AAAA,IACxC,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAAA,IACzD,MAAM;AAAA,IACN;AAAA;AAAA;AAIJ,IAAM,aAAa,CAAC,SAA2B;AAAA,EAC7C,IAAI,KAAK,KAAK,MAAM;AAAA,IAAI,OAAO,CAAC;AAAA,EAChC,IAAI;AAAA,IACF,MAAM,SAAS,KAAK,MAAM,IAAI;AAAA,IAC9B,OAAO,MAAM,QAAQ,MAAM,IAAK,OAAqB,IAAI,QAAQ,IAAI,CAAC;AAAA,IACtE,MAAM;AAAA,IACN,OAAO,CAAC;AAAA;AAAA;AAIZ,IAAM,OAAO,CAAC,UAA8B,QAAgB,SAAwB;AAAA,EAClF,MAAM,SAAS,QAAQ,SAAS,IAAI,MAAM,SAAS,KAAK,KAAK,EAAE,MAAM,GAAG,GAAG,KAAK;AAAA,EAEhF,MAAM,QAAQ,SAAS,WAAW,MAAM,GAAG,iCAAiC;AAAA,EAC5E,MAAM,IAAI,gBAAgB,SAAS,QAAQ,QAAQ,MAAM,KAAK;AAAA;AAMzD,IAAM,iBAAiB,OAAO,OAAmB,cAAwC;AAAA,EAC9F,MAAM,WAAW,MAAM,MAAM,QAAQ;AAAA,IACnC,MAAM;AAAA,IACN,SAAS,EAAE,gBAAgB,UAAU;AAAA,IACrC,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AAAA,EAGD,IAAI,SAAS,WAAW;AAAA,IAAK,KAAK,UAAU,QAAQ,QAAQ;AAAA,EAC5D,MAAM,SAAS,KAAK,MAAM,SAAS,IAAI;AAAA,EACvC,OAAO,EAAE,QAAQ,OAAO,UAAU,MAAM,WAAW,OAAO,YAAY,CAAC,GAAG,IAAI,QAAQ,EAAE;AAAA;AAInF,IAAM,oBAAoB,OAAO,UAAwC;AAAA,EAC9E,MAAM,WAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,OAAO,MAAM,WAAW,CAAC;AAAA,EACxE,IAAI,SAAS,WAAW;AAAA,IAAK,KAAK,UAAU,OAAO,UAAU;AAAA,EAC7D,OAAO,YAAY,SAAS,IAAI;AAAA;AAW3B,IAAM,gBAAgB,OAC3B,OACA,WACA,eAC+B;AAAA,EAC/B,MAAM,WAAW,MAAM,MAAM,QAAQ;AAAA,IACnC,MAAM;AAAA,IACN,SAAS;AAAA,MACP,gBAAgB;AAAA,SACZ,eAAe,YACf,CAAC,IACD,EAAE,+BAA+B,aAAa,4BAA4B,WAAW;AAAA,IAC3F;AAAA,IACA,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AAAA,EACD,MAAM,UAAU,QAAQ,SAAS,IAAI;AAAA,EACrC,IAAI,SAAS,WAAW,OAAO,YAAY;AAAA,IAAW,KAAK,UAAU,QAAQ,OAAO;AAAA,EACpF,OAAO,WAAW,SAAS,IAAI;AAAA;;ACtGjC;AACA,oBAAS;AACT;AACA;AACA;;;ACnBA;AAEO,IAAM,OAAO,CAAI,SACf,kBAAW;AAAA,EAChB,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,EAC3E,KAAK;AACP,CAAC;AAQI,IAAM,iBAAiB,CAAC,MAAe,QAAoC;AAAA,EAChF,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,QAAS,KAAiC;AAAA,EAChD,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA;;;ACjB7C;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,WAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,YAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,gBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,cAAM,QAAQ,GAAU,oBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,iBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,eAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,eAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,YAAW,sBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,YAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,sBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,sBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,YACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAaK,IAAM,sBAAsB,CAAC,KAAa,eACxC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,cAAM;AAAA,CACtE;;;AFxFI,IAAM,eAAe,CAAC,QACpB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,sBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,sBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AIzE9B,IAAM,qBAAqB;AAE3B,IAAM,gBAAgB;AAKtB,IAAM,cAAc,CAAC,WAAoC;AAAA,EACvD,IAAI,OAAO,SAAS,GAAG;AAAA,IAAG,OAAO;AAAA,EACjC,MAAM,OAAO,iDAAiD,KAAK,MAAM;AAAA,EACzE,IAAI,SAAS;AAAA,IAAM,OAAO,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,GAAG;AAAA,EAC9D,IAAI,eAAe,KAAK,MAAM,KAAK,CAAC,cAAc,KAAK,MAAM,GAAG;AAAA,IAC9D,OAAO,WAAW,KAAK,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA,EACvD;AAAA,EACA,MAAM,UAAU,OAAO,QAAQ,eAAe,EAAE;AAAA,EAChD,MAAM,QAAQ,QAAQ,YAAY,GAAG;AAAA,EACrC,MAAM,OAAO,OAAO,QAAQ,MAAM,QAAQ,CAAC,CAAC;AAAA,EAC5C,IAAI,UAAU,MAAM,CAAC,OAAO,UAAU,IAAI,KAAK,QAAQ;AAAA,IAAG,OAAO;AAAA,EACjE,OAAO,EAAE,MAAM,QAAQ,MAAM,GAAG,KAAK,GAAG,MAAM,OAAO,KAAK;AAAA;AAG5D,IAAM,YAAY,CAAC,SAAyB,KAAK,QAAQ,cAAc,IAAI;AAS3E,IAAM,UAAU,CAAC,YAAoB,eAAgC;AAAA,EACnE,MAAM,UAAU,UAAU,WAAW,MAAM,GAAG,WAAW,YAAY,GAAG,CAAC,CAAC;AAAA,EAC1E,MAAM,YAAY,UAAU,UAAU;AAAA,EACtC,OACE,YAAY,eAAe,aAAa,cAAc,cAAc,cAAc;AAAA;AAItF,IAAM,eAAe,CAAC,QAAgB,cACpC,OAAO,SAAS,QACZ,UAAU,SAAS,SACnB,OAAO,SAAS,UAAU,QAC1B,QAAQ,UAAU,YAAY,OAAO,IAAI,IACzC,UAAU,SAAS,UAAU,OAAO,SAAS,UAAU;AAG7D,IAAM,iBAAiB,CAAC,SACtB,CAAC,aAAa,SAAS,WAAW,EAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,OAAO,IAAI,GAAG;AAE7E,IAAM,aAAa,CAAC,WAAuC;AAAA,EACzD,IAAI,CAAC,OAAO,SAAS,KAAK;AAAA,IAAG,OAAO;AAAA,EACpC,IAAI;AAAA,IACF,MAAM,MAAM,IAAI,IAAI,MAAM;AAAA,IAE1B,OAAO,IAAI,aAAa,UAAU,IAAI,OAAO;AAAA,IAC7C,MAAM;AAAA,IACN;AAAA;AAAA;AAIJ,IAAM,gBAAgB,CAAC,OAAmB,cAAsD;AAAA,EAC9F,IAAI,MAAM,WAAW,WAAW;AAAA,IAC9B,MAAM,YACJ,UAAU,SAAS,SACnB,UAAU,SAAS,sBACnB,QAAQ,UAAU,YAAY,WAAW;AAAA,IAC3C,OAAO,YACH,YACA,2FACE;AAAA,EACR;AAAA,EACA,MAAM,SAAS,YAAY,MAAM,MAAM;AAAA,EACvC,MAAM,QAAQ,KAAK,UAAU,MAAM,MAAM;AAAA,EACzC,IAAI,OAAO,WAAW,UAAU;AAAA,IAC9B,OAAO,gBAAgB,YAAY;AAAA,EACrC;AAAA,EACA,IAAI,OAAO,SAAS,SAAS,CAAC,cAAc,KAAK,OAAO,IAAI,GAAG;AAAA,IAC7D,OAAO,gBAAgB;AAAA,EACzB;AAAA,EACA,OAAO,aAAa,QAAQ,SAAS,IACjC,YACA,gBAAgB;AAAA;AAIf,IAAM,gBAAgB,CAAC,SAAkB,cAA4C;AAAA,EAC1F,MAAM,QACJ,OAAO,YAAY,YAAY,YAAY,OACrC,QAAmC,SAAS,CAAC,IAC/C,CAAC;AAAA,EACP,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,MAAM,aAAa,MAAM;AAAA,IAC3B,OAAO,CAAC,6EAA6E;AAAA,EACvF;AAAA,EACA,IAAI,MAAM,WAAW;AAAA,IAAW,MAAM,KAAK,iDAAiD;AAAA,EAC5F,IAAI,MAAM,QAAQ,SAAS,WAAW;AAAA,IACpC,MAAM,KACJ,oFACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,cAAc,OAAO,SAAS;AAAA,EAC5C,IAAI,UAAU;AAAA,IAAW,MAAM,KAAK,KAAK;AAAA,EACzC,IAAI,UAAU,SAAS,OAAO;AAAA,IAC5B,MAAM,UAAU,MAAM,SAAS,IAAI,UAAU,KAAK,eAAe,UAAU,IAAI;AAAA,IAC/E,IAAI,CAAC,QAAQ,SAAS,UAAU,UAAU,GAAG;AAAA,MAC3C,MAAM,QACJ,MAAM,YAAY,YACd,qDAAqD,KAAK,UAAU,OAAO,MAC3E,iBAAiB,KAAK,UAAU,MAAM,OAAO;AAAA,MACnD,MAAM,KACJ,GAAG,2BAA2B,UAAU,6CACtC,iDACJ;AAAA,IACF;AAAA,EACF,EAAO,SAAI,MAAM,mBAAmB,MAAM;AAAA,IACxC,MAAM,KACJ,8FACE,gDACJ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACxJT,IAAM,cACJ,gGACA;AAGF,IAAM,cACJ;AAGF,IAAM,cAAc;AAGpB,IAAM,YAAY;AAEX,IAAM,cAAc;AAG3B,IAAM,YAAY,CAAC,OAAmB,SAA2B;AAAA,EAC/D,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1E,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAQ,MAAgC,QAAQ,CAAC,MAAM,UACrD,UAAU,MAAM,GAAG,QAAQ,OAAO,KAAK,IAAI,CAC7C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,OAAO,OAAO,QAAQ,KAAK,EAAE,QAAQ,EAAE,KAAK,UAAU,UAAU,MAAM,GAAG,QAAQ,KAAK,CAAC;AAAA,EACzF;AAAA,EACA,OAAO,CAAC;AAAA;AAOH,IAAM,oBAAoB,CAC/B,aACA,MACA,cACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,MAAM,UAAU,OAAO,QAAQ,eAAe,CAAC,CAAC,GAAG;AAAA,IAC7D,IAAI,YAAY,KAAK,IAAI;AAAA,MACvB,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,IACjE,SAAI,YAAY,KAAK,KAAK;AAAA,MAC7B,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,EACxE;AAAA,EACA,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAEzC,IAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MACzB,MAAM,KAAK,oBAAoB,OAAO,KAAK,8BAA8B,aAAa;AAAA,IACxF,EAAO,SAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAAA,MACzD,MAAM,KAAK,oBAAoB,OAAO,QAAQ,CAAC,6BAA6B,aAAa;AAAA,IAC3F,EAAO,SAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MAChC,MAAM,KAAK,oBAAoB,OAAO,KAAK,2BAA2B,aAAa;AAAA,IACrF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,UAAU,aAAa,CAAC,GAAG,WAAW,GAAG;AAAA,IAC1D,MAAM,KAAK,GAAG,6BAA6B,aAAa;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,qBAAqB,CAAC,YACjC,YAAY,KAAK,OAAO,IAAI,CAAC,gCAAgC,aAAa,IAAI,CAAC;;;AC1DjF,IAAM,eACJ,kGACA;AAGF,IAAM,cACJ;AAGF,IAAM,gBAAgB;AAEtB,IAAM,mBAAmB;AACzB,IAAM,oBACJ;AAGF,IAAM,SAAiD;AAAA,EACrD,CAAC,iEAAiE,gBAAgB;AAAA,EAClF,CAAC,+BAA+B,sBAAsB;AAAA,EACtD,CAAC,mCAAmC,eAAe;AAAA,EACnD,CAAC,0CAA0C,mBAAmB;AAAA,EAC9D,CAAC,mEAAmE,OAAO;AAAA,EAG3E,CAAC,0CAA0C,wBAAwB;AAAA,EACnE,CAAC,yBAAyB,yBAAyB;AACrD;AAEA,IAAM,cAAc;AACpB,IAAM,cAAc;AAUpB,IAAM,cAAc;AACpB,IAAM,eAAe,CAAC,SAAyB,KAAK,QAAQ,aAAa,IAAI;AAGtE,IAAM,WAAW,CAAC,SAA2B;AAAA,EAClD,MAAM,SAAmB,CAAC;AAAA,EAC1B,IAAI,UAAU;AAAA,EACd,IAAI;AAAA,EACJ,SAAS,QAAQ,EAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AAAA,IACnD,MAAM,OAAO,KAAK,UAAU;AAAA,IAC5B,IAAI,UAAU,WAAW;AAAA,MACvB,IAAI,SAAS,QAAQ,UAAU,OAAO,QAAQ,IAAI,KAAK,QAAQ;AAAA,QAC7D,SAAS;AAAA,QACT,WAAW,KAAK,UAAU;AAAA,MAC5B,EAAO,SAAI,SAAS;AAAA,QAAO,QAAQ;AAAA,MAC9B;AAAA,mBAAW;AAAA,IAClB,EAAO,SAAI,SAAS,OAAO,SAAS,KAAK;AAAA,MACvC,QAAQ;AAAA,IACV,EAAO,SAAI,KAAK,KAAK,IAAI,GAAG;AAAA,MAC1B,IAAI,YAAY;AAAA,QAAI,OAAO,KAAK,OAAO;AAAA,MACvC,UAAU;AAAA,IACZ,EAAO,SAAI,SAAS,OAAO,YAAY,IAAI;AAAA,MACzC;AAAA,IACF,EAAO;AAAA,iBAAW;AAAA,EACpB;AAAA,EACA,IAAI,YAAY;AAAA,IAAI,OAAO,KAAK,OAAO;AAAA,EACvC,OAAO;AAAA;AAQT,IAAM,kBAAkB,CAAC,WACvB,OACG,QAAQ,CAAC,UAAU,MAAM,QAAQ,aAAa,GAAG,EAAE,MAAM,KAAK,CAAC,EAC/D,OAAO,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,EACvF,WAAW;AAEhB,IAAM,eAAe,CAAC,QAA2B,UAA4B;AAAA,EAC3E,OAAO,QAAQ,IAAI,UAAU;AAAA,EAC7B,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,YAAY,KAAK,KAAK,KAAK,OAAO,SAAS,KAAK,CAAC,gBAAgB,OAAO,MAAM,CAAC,CAAC,GAAG;AAAA,IACrF,MAAM,KAAK,GAAG,YAAY,6BAA6B;AAAA,EACzD;AAAA,EACA,IAAI,cAAc,KAAK,KAAK,KAAK,OAAO,SAAS,KAAK,CAAC,gBAAgB,OAAO,MAAM,CAAC,CAAC,GAAG;AAAA,IACvF,MAAM,KAAK,GAAG,YAAY,SAAS,UAAU,+BAA+B;AAAA,EAC9E;AAAA,EACA,IAAI,iBAAiB,KAAK,KAAK,GAAG;AAAA,IAChC,MAAM,KAAK,OAAO,UAAU,CAAC,OAAO,UAAU,QAAQ,KAAK,kBAAkB,KAAK,KAAK,CAAC;AAAA,IACxF,IAAI,OAAO,MAAM,OAAO,SAAS,KAAK,KAAK,CAAC,gBAAgB,OAAO,MAAM,KAAK,CAAC,CAAC,GAAG;AAAA,MACjF,MAAM,KAAK,GAAG,YAAY,SAAS,OAAO,OAAO,gCAAgC;AAAA,IACnF;AAAA,EACF;AAAA,EACA,WAAW,SAAS,QAAQ;AAAA,IAC1B,MAAM,QAAQ,OAAO,KAAK,EAAE,aAAa,QAAQ,KAAK,KAAK,CAAC;AAAA,IAE5D,IAAI,UAAU;AAAA,MAAW,MAAM,KAAK,GAAG,gCAAgC,MAAM,IAAI;AAAA,EACnF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,0BAA0B,CAAC,cAAgC;AAAA,EACtE,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,YAAY,KAAK,SAAS;AAAA,IAAG,MAAM,KAAK,uCAAuC;AAAA,EACnF,YAAY,OAAO,SAAS,UAAU,MAAM;AAAA,CAAI,EAAE,QAAQ,GAAG;AAAA,IAC3D,MAAM,KAAK,GAAG,aAAa,SAAS,aAAa,IAAI,CAAC,GAAG,QAAQ,OAAO,QAAQ,CAAC,GAAG,CAAC;AAAA,EACvF;AAAA,EACA,OAAO,MAAM,IAAI,CAAC,YAAY,GAAG,YAAY,cAAa;AAAA;;;AC9F5D,IAAM,qBAAqB,CAAC,SAC1B,KAAK,WAAW,GAAG,KACnB,CAAC,KAAK,SAAS,GAAG,KAClB,CAAC,KAAK,SAAS,MAAM,KACrB,CAAC,KACE,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI;AAEzD,IAAM,iBAAiB,CAAC,UAAsC;AAAA,EACnE,MAAM,QAAkB,CAAC;AAAA,EAQzB,IAAI,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,IACjC,MAAM,KAAK,oEAAoE;AAAA,EACjF;AAAA,EACA,IAAI,MAAM,eAAe,aAAa,CAAC,mBAAmB,MAAM,UAAU,GAAG;AAAA,IAC3E,MAAM,KAAK,iDAAiD;AAAA,EAC9D;AAAA,EACA,MAAM,KAAK,GAAG,wBAAwB,MAAM,SAAS,CAAC;AAAA,EACtD,OAAO;AAAA;;;AChCT,IAAM,SAAS,CAAC,OAAmB,YACjC,IAAI,MAAM,mBAAmB,MAAM,aAAa,SAAS;AAE3D,IAAM,QAAQ,CAAC,WAA2B,OAAO,MAAM,GAAG,EAAE;AAU5D,IAAM,gBAAgB,CAAC,WAA6B;AAAA,EAClD,MAAM,OACJ,OAAO,WAAW,YAAY,WAAW,OAAQ,OAA8B,OAAO;AAAA,EACxF,OAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,OAAO,KAAK,IAAI,EAAE,WAAW;AAAA;AAS5E,IAAM,gBAAgB,OAC3B,OACA,UACqB;AAAA,EACrB,MAAM,QAAQ,eAAe,KAAK;AAAA,EAClC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,OAAO,OAAO,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1D,MAAM,UAAU,MAAM,eAAe,OAAO,MAAM,SAAS;AAAA,EAC3D,IAAI,cAAc,QAAQ,MAAM,GAAG;AAAA,IACjC,MAAM,OAAO,OAAO,oEAAoE;AAAA,EAC1F;AAAA,EACA,MAAM,QAAQ,cAAc,QAAQ,QAAQ,MAAM,QAAQ;AAAA,EAC1D,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,OAAO,OAAO,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1D,OAAO,EAAE,QAAQ,aAAa,QAAQ,MAAM,GAAG,UAAU,QAAQ,SAAS;AAAA;AAG5E,IAAM,eAAe,CACnB,OACA,SACA,gBAC2B;AAAA,EAC3B,cAAc,aAAa,OAAO;AAAA,EAClC,UAAU,MAAM;AAAA,KACZ,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AACnD;AAGO,IAAM,WAAW,OACtB,OACA,eAEA,aAAa,OAAO,MAAM,kBAAkB,KAAK,GAAG,UAAU;AASzD,IAAM,YAAY,CAAC,SAAkB,mBAC1C,cAAc,OAAO,KAAK,aAAa,OAAO,MAAM;AAmB/C,IAAM,YAAY,OACvB,OACA,WACA,eAC+B;AAAA,EAC/B,MAAM,UAAU,MAAM,kBAAkB,KAAK;AAAA,EAC7C,IAAI,cAAc,OAAO;AAAA,IAAG;AAAA,EAC5B,MAAM,aAAa,aAAa,OAAO,SAAS,UAAU;AAAA,EAC1D,IAAI,cAAc,WAAW;AAAA,IAC3B,OAAO,EAAE,YAAY,MAAM,OAAO,WAAW,yCAAyC;AAAA,EACxF;AAAA,EACA,IAAI;AAAA,IACF,MAAM,OAAO,MAAM,cAAc,OAAO,EAAE,UAAU,CAAC;AAAA,IACrD,OAAO,EAAE,YAAY,MAAM,UAAU,SAAS,KAAK,MAAM,EAAE;AAAA,IAC3D,OAAO,OAAO;AAAA,IAEd,IAAI,iBAAiB;AAAA,MAAuB,MAAM;AAAA,IAClD,OAAO;AAAA,MACL;AAAA,MACA,MAAM;AAAA,MACN,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAClE;AAAA;AAAA;AASG,IAAM,aAAa,OACxB,OACA,MACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,cAAc,OAAO,IAAI;AAAA,EAC5C,MAAM,OAAO,MAAM,SAAS,KAAK;AAAA,EACjC,MAAM,YACJ,KAAK,WAAW,KAAK,gBACrB,KAAK,iBAAiB,OAAO,gBAC7B,KAAK,eAAe,OAAO,cAI3B,MAAM,aAAa,OAAO;AAAA,EAC5B,OAAO,YAAY,EAAE,QAAQ,OAAO,IAAI,EAAE,QAAQ,SAAS;AAAA;AA6BtD,IAAM,kBAAkB,OAC7B,OACA,OACA,cACqB;AAAA,EACrB,MAAM,OAAO,MAAM,cAAc,OAAO,KAAK;AAAA,EAC7C,MAAM,UAAU,MAAM,kBAAkB,KAAK;AAAA,EAC7C,MAAM,SAAS,aAAa,OAAO;AAAA,EACnC,MAAM,QAAQ,WAAW,UAAU,UAAU,UAAU,SAAS,KAAK,MAAM;AAAA,EAC3E,IAAI,CAAC,UAAU,YAAY,CAAC,OAAO;AAAA,IACjC,MAAM,OACJ,OACA,qBAAqB,MAAM,MAAM,gEAC/B,MAAM,MAAM,KAAK,MAAM,iEACvB,2FACA,gDACJ;AAAA,EACF;AAAA,EACA,IAAI,WAAW,KAAK;AAAA,EACpB,MAAM,SAAS,WAAW,KAAK;AAAA,EAC/B,IAAI,QAAQ;AAAA,IACV,IAAI;AAAA,MACF,WAAW,MAAM,cAAc,OAAO,MAAM,WAAW,MAAM,UAAU;AAAA,MACvE,OAAO,OAAO;AAAA,MACd,IAAI,EAAE,iBAAiB;AAAA,QAAkB,MAAM;AAAA,MAI/C,MAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA,MACzD,MAAM,QACJ,UAAU,YACN,kDACA,MAAM,iBAAiB,SACrB,mDACA,iCAAiC,MAAM,MAAM,YAAY,uBAAuB,MAAM,MAAM;AAAA,MACpG,MAAM,OAAO,OAAO,iCAAiC,MAAM,YAAY,OAAO;AAAA;AAAA,EAElF;AAAA,EAIA,MAAM,aAAa,MAAM,SAAS,OAAO,MAAM,UAAU;AAAA,EACzD,IAAI,WAAW,iBAAiB,KAAK,QAAQ;AAAA,IAC3C,MAAM,OACJ,OACA,oCAAoC,MAAM,WAAW,YAAY,gBAC/D,GAAG,MAAM,KAAK,MAAM,+EACxB;AAAA,EACF;AAAA,EACA,OAAO,EAAE,YAAY,QAAQ,SAAS;AAAA;;;AVlMjC,IAAM,cAAc,SAAsB,gBAAgB;AAAA,EAC/D,sBAAsB;AACxB,CAAC;AAED,IAAM,cAAc,CAAC,UACnB,iBAAiB;AAQnB,IAAM,mBACJ,CAAI,OAA6B,aACjC,CAAC,UACQ,WACE,mBACL,6BAA6B,MAAM,aAAa,MAAM,qCACpD,0DACJ,GACA,QACF;AAEG,IAAM,sBAAsB,MACxB,gBACP,aACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EAErB,MAAM,QAAQ,CAAC,WAA+B,eACrC,gBACL,KAAK,MAAM,UAAU,OAAO,WAAW,UAAU,CAAC,GAClD,CAAC,UAAU;AAAA,IACT,IAAI,UAAU;AAAA,MAAW,OAAc,gBAAQ,SAAS;AAAA,IACxD,IAAI,MAAM;AAAA,MAAM,OAAc,gBAAQ,MAAM,UAAU;AAAA,IACtD,MAAM,UAAU,SAAQ,MAAM,UAAU;AAAA,IACxC,OAAO,MAAM,cAAc,YAChB,gBAAQ,OAAO,IACf,WACE,mBACL,mBAAmB,MAAM,wDACvB,gCAAgC,MAAM,0CAC1C,GACA,OACF;AAAA,GAER;AAAA,EACF,OAAO,YAAY,SAAS,GAAG;AAAA,IAE7B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAQ7B,MAAM,GAAG,MAAM,cACZ,WAAW,YACR,MAAM,eAAe,MAAM,WAAW,GAAG,eAAe,MAAM,YAAY,CAAC,IAC3E,KAAK,MAAM,SAAS,OAAO,eAAe,MAAM,YAAY,CAAC,CAAC,GAChE,KAEO,gBAAQ,aAAa,iBAAiB,OAAO,SAAS,CAAC,CAChE;AAAA,IAEF,MAAM,GAAG,MAAM,aAAa;AAAA,MAC1B,IAAI,WAAW;AAAA,QAAW,OAAc,gBAAQ,SAAS;AAAA,MACzD,MAAM,SAAS,iBAAiB,OAAO,EAAE,QAAQ,SAAkB,CAAC;AAAA,MACpE,IAAI,WAAW,IAAI,GAAG;AAAA,QACpB,OAAO,KAAK,MAAM,WAAW,OAAO,MAAM,MAAM,CAAC,EAAE,KAC1C,gBAAQ,aAAa,MAAM,CACpC;AAAA,MACF;AAAA,MAOA,MAAM,YAAY,eAAe,MAAM,WAAW;AAAA,MAClD,IAAI,cAAc;AAAA,QAAW,OAAc,gBAAQ,SAAS;AAAA,MAC5D,OAAO,KAAK,YAAY;AAAA,QACtB,MAAM,WAAW,OAAO,EAAE,UAAU,GAAG,MAAM;AAAA,QAC7C,OAAO,EAAE,QAAQ,SAAkB;AAAA,OACpC,EAAE,KAAY,gBAAQ,aAAa,MAAM,CAAC;AAAA;AAAA,IAG7C,WAAW,GAAG,KAAK,MAAM,aAChB,YAAI,UAAU,GAAG;AAAA,MAKtB,MAAM,YAAY,WAAW,aAAa,OAAO,aAAa,MAAM;AAAA,MACpE,MAAM,WAAW,cAAc,OAAO,aAAa,GAAG;AAAA,MACtD,MAAM,SAAS,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,aAAa;AAAA,MACzE,MAAM,UAAU,OAAO,KAAK,MAC1B,gBAAgB,OAAO,MAAM,EAAE,aAAa,OAAO,CAAC,CACtD;AAAA,MACA,WAAW,WAAW,QAAQ,UAAU;AAAA,QACtC,OAAc,mBAAW,mBAAmB,MAAM,aAAa,SAAS;AAAA,MAC1E;AAAA,MACA,OAAO,QAAQ;AAAA,KAChB;AAAA,IAEH,QAAQ,MAAa;AAAA,EACvB,CAAC;AAAA,CACF,CACH;;AWxIF,oBAAS;AAoCF,IAAM,wBAAwB;AAMrC,IAAM,OAAO;AACb,IAAM,YAAY;AAElB,IAAM,UAAS,CAAC,SAAiB,QAC/B,IAAI,MAAM,uBAAuB,KAAK,UAAU,OAAO,MAAM,KAAK;AAEpE,IAAM,aAAa,CAAC,aAClB,aAAa,eAAe,aAAa,WAAW,wBAAwB,KAAK,QAAQ;AAGpF,IAAM,oBAAoB,CAC/B,SACA,eACqD;AAAA,EACrD,IAAI,eAAe,aAAa,CAAC,UAAU,KAAK,UAAU,GAAG;AAAA,IAC3D,MAAM,QAAO,SAAS,cAAc,KAAK,UAAU,UAAU,qBAAqB;AAAA,EACpF;AAAA,EACA,IAAI,QAAQ,WAAW,IAAI,GAAG;AAAA,IAC5B,MAAM,aAAa,QAAQ,MAAM,KAAK,MAAM;AAAA,IAC5C,IAAI,CAAC,WAAW,WAAW,GAAG;AAAA,MAAG,MAAM,QAAO,SAAS,kCAAkC;AAAA,IACzF,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,WAAW,GAAG,QAAQ,EAAE,MAAM,QAAQ,WAAW,EAAE;AAAA,EAC9F;AAAA,EACA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,MAAM,IAAI,IAAI,OAAO;AAAA,IACrB,MAAM;AAAA,IACN,MAAM,QAAO,SAAS,mDAAmD;AAAA;AAAA,EAI3E,IAAI,IAAI,aAAa;AAAA,IAAS,MAAM,QAAO,SAAS,oCAAoC;AAAA,EACxF,IAAI,CAAC,WAAW,IAAI,QAAQ,GAAG;AAAA,IAC7B,MAAM,QAAO,SAAS,qEAAqE;AAAA,EAC7F;AAAA,EACA,IAAI,IAAI,aAAa,OAAO,IAAI,WAAW,MAAM,IAAI,aAAa,IAAI;AAAA,IACpE,MAAM,QAAO,SAAS,2DAA2D;AAAA,EACnF;AAAA,EACA,MAAM,OAAO,IAAI,SAAS,KAAK,KAAK,OAAO,IAAI,IAAI;AAAA,EAInD,MAAM,OAAO,cAAc,GAAG,IAAI,YAAY,OAAO,IAAI;AAAA,EACzD,OAAO;AAAA,IACL,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,OAAO,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC;AAAA,IACpD;AAAA,IAEA,QAAQ,EAAE,MAAM,IAAI,SAAS,QAAQ,cAAc,IAAI,GAAG,MAAM,OAAO,KAAK;AAAA,EAC9E;AAAA;AAGF,IAAM,OAAO,CAAC,UACZ,OAAO,UAAU,YAAY,UAAU,SAAQ,UAAU,SACrD,OAAQ,MAA4B,IAAI,IACxC;AAGN,IAAM,iBAAiB,CAAC,UACtB,KAAK,KAAK,MAAM,kBAAkB,KAAK,KAAK,MAAM;AAEpD,IAAM,WAAW,CACf,QACA,QACA,MACA,SACA,MACA,cAEA,IAAI,QAAQ,CAAC,SAAS,WAAW;AAAA,EAC/B,MAAM,QAAQ,SAAS,YAAY,YAAY,OAAO,KAAK,MAAM,MAAM;AAAA,EACvE,MAAM,UAAU,YACd;AAAA,OACM,OAAO,SAAS,QAChB,EAAE,MAAM,OAAO,MAAM,MAAM,OAAO,KAAK,IACvC,EAAE,YAAY,OAAO,WAAW;AAAA,IACpC,SAAS,UAAU,YAAY,UAAU,KAAK,SAAS,kBAAkB,MAAM,OAAO;AAAA,IACtF;AAAA,IACA;AAAA,IACA,SAAS;AAAA,EACX,GACA,CAAC,aAAa;AAAA,IACZ,MAAM,SAAmB,CAAC;AAAA,IAC1B,SAAS,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AAAA,IACzD,SAAS,GAAG,SAAS,MAAM;AAAA,IAC3B,SAAS,GAAG,OAAO,MACjB,QAAQ;AAAA,MACN,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AAAA,MAC3C,QAAQ,SAAS,cAAc;AAAA,IACjC,CAAC,CACH;AAAA,GAEJ;AAAA,EACA,QAAQ,GAAG,WAAW,MAAM,QAAQ,QAAQ,IAAI,MAAM,gBAAgB,OAAO,SAAS,MAAM,CAAC,CAAC;AAAA,EAC9F,QAAQ,GAAG,SAAS,MAAM;AAAA,EAC1B,QAAQ,IAAI,KAAK;AAAA,CAClB;AAEI,IAAM,kBAAkB,CAAC,UAAkC,CAAC,MAAkB;AAAA,EACnF,MAAM,UAAU,QAAQ,WAAW;AAAA,EACnC,QAAQ,UAAU,WAAW,kBAAkB,SAAS,QAAQ,UAAU;AAAA,EAC1E,MAAM,YAAY,QAAQ,aAAa;AAAA,EACvC,MAAM,UAAU,QAAQ,WAAW;AAAA,EACnC,MAAM,QAAQ,QAAQ,gBAAgB;AAAA,EACtC,MAAM,QACJ,SAAS,SAAS,QACd,EAAE,MAAM,SAAS,YAAY,QAAQ,UAAU,SAAS,aAAa,IACrE,EAAE,MAAM,YAAY;AAAA,EAC1B,OAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA,SAAS,SAAS,MAAM,SAAS,QAAQ,WAAW;AAAA,MAClD,SAAS,UAAU,IAAK,WAAW,GAAG;AAAA,QACpC,IAAI;AAAA,UAEF,OAAO,MAAM,SAAS,QAAQ,QAAQ,MAAM,KAAK,YAAY,MAAM,GAAG,MAAM,SAAS;AAAA,UACrF,OAAO,OAAO;AAAA,UACd,IAAI,CAAC,eAAe,KAAK,KAAK,WAAW,SAAS;AAAA,YAChD,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,YACpE,MAAM,UAAU,eAAe,UAAU,WAAW,YAAY;AAAA,YAChE,MAAM,eAAe,KAAK,IAAI,IAAI,sBAAsB,OAAO,IAAI,IAAI,MAAM,OAAO;AAAA,UACtF;AAAA,UAEA,MAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,KAAK,CAAC;AAAA;AAAA,MAE7D;AAAA;AAAA,EAEJ;AAAA;;ACjLF;AAKO,IAAM,iBAAiB,CAAC,QAAoB,gBAAgB,MACjE,oBAAoB,EAAE,KAAW,eAAQ,gBAAgB,KAAK,CAAC,CAAC;;ACWlE;AACA;;;ACZA,qBAAS;AACT,oBAAS;AACT,uBAAS;AACT;AACA;;;ACGO,IAAM,YAAY,CACvB,GACA,MACwB;AAAA,EACxB,IAAI,MAAM,aAAa,MAAM;AAAA,IAAW,OAAO;AAAA,EAC/C,IAAI,EAAE,QAAQ,aAAa,EAAE,QAAQ,aAAa,EAAE,QAAQ,aAAa,EAAE,QAAQ,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAIjC,IAAM,UAAU,OACrB,QACA,GACA,MACiC;AAAA,EACjC,IAAI,MAAM;AAAA,IAAG,OAAO;AAAA,EACpB,OAAO,MAAM,SAAS,MAAM,QAAQ,IAAI,CAAC,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,EACxE,OAAO,UAAU,MAAM,KAAK;AAAA;AAQvB,IAAM,eAAe,OAC1B,QACA,SACA,MACA,QACA,YACkB;AAAA,EAClB,MAAM,OAAO,MAAM,QAAQ,QAAQ,SAAS,IAAI;AAAA,EAChD,IAAI,SAAS;AAAA,IAAM;AAAA,EACnB,MAAM,OAAO;AAAA,EACb,IAAI,SAAS,aAAc,MAAM,OAAO,KAAK,IAAI,MAAO,WAAW;AAAA,IACjE,MAAM,QACJ,MACA,yBAAyB,gEACvB,2FACA,sCACJ;AAAA,EACF;AAAA;;;ACrDF;AACA;AAAA;AA6FO,MAAM,0BAAkC,iBAAuC,EACpF,8BACF,EAAE;AAAC;AAGI,IAAM,kBAAkB,CAAC,WACxB,eAAQ,mBAAmB,MAAM;AAGlC,IAAM,eAAe,CAAC,WAC3B,OAAO,cAAc,OAAO,aAAa,MAAM;;;ACnFjD,IAAM,YAAY,CAAC,UACjB,OAAO,UAAU,WAAW,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;AAGrE,IAAM,aAAa,OACxB,QACA,UACA,MACA,YAC4C;AAAA,EAC5C,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI,SAAS,UAAU,WAAW;AAAA,IAChC,MAAM,UAAU,SAAS,KAAK,MAAM,MAAM,OAAO,WAAW,OAAO,SAAS,KAAK,CAAC,IAAI;AAAA,IACtF,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,WAAW,OAAO,SAAS,KAAK,gBAAgB;AAAA,EAC5F;AAAA,EACA,IAAI,SAAS,UAAU,WAAW;AAAA,IAChC,MAAM,UAAU,SAAS,KAAK,KAAM,MAAM,OAAO,YAAY,OAAO,SAAS,KAAK,CAAC;AAAA,IACnF,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,YAAY,OAAO,SAAS,KAAK,gBAAgB;AAAA,EAC7F;AAAA,EACA,OAAO,KAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,MAAQ,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,EAAG;AAAA;AAIjF,IAAM,qBAAqB,OAChC,QACA,SAC4C;AAAA,EAC5C,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,KAAK,SAAS,SAAS,MAAM,OAAO,SAAS,IAAI,IAAI;AAAA,EACnE,OAAO;AAAA,IACL,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,IACX;AAAA,IACA,QAAQ,UAAU,YAAY,KAAK,UAAU,KAAK;AAAA,IAClD,MAAM,KAAK;AAAA,IACX,KAAK,KAAK;AAAA,EACZ;AAAA;AAGK,IAAM,iBAAiB,CAAC,UAAoC;AAAA,EACjE,MAAM,KAAK;AAAA,KACP,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AAAA,KAC9C,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AACpD;AAEO,IAAM,cAAc,CAAC,MAA0B,SACpD,KAAK,WAAW,KAAK,UACrB,KAAK,SAAS,KAAK,SAClB,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK,SAC5C,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK;AAOxC,IAAM,aAAa,OACxB,QACA,MACA,WACkB;AAAA,EAClB,MAAM,SAAS,OAAO,SAA8B;AAAA,IAClD,MAAM,OAAO,aAAa,KAAK,MAAM,eAAe,IAAI,CAAC;AAAA,IACzD,OAAO;AAAA;AAAA,EAMT,IAAI,KAAK,SAAS,OAAO,MAAM;AAAA,IAC7B,MAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK,MAAM,OAAO,IAAI;AAAA,IACzD,OAAO,OAAO,EAAE,QAAQ,SAAS,OAAO,WAAW,UAAU,CAAC;AAAA,EAChE;AAAA,EACA,IAAI,KAAK,WAAW,OAAO;AAAA,IAAQ,OAAO,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA,EACrE,MAAM,OAAO,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,EACvD,OAAO,SAAS,aAAa,YAAY,MAAM,IAAI,IAC/C,EAAE,QAAQ,OAAO,IACjB,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA;AAsB1B,IAAM,eAAe,OAC1B,QACA,MACA,QACA,QAAQ,UACwB;AAAA,EAChC,QAAQ,MAAM,oBAAW;AAAA,EACzB,MAAM,OAAO,KAAK;AAAA,EAElB,IAAI,KAAK,QAAQ,aAAa,KAAK,QAAQ,OAAO,aAAa,KAAK,CAAC,aAAa,MAAM,GAAG;AAAA,IACzF,MAAM,QACJ,MACA,SAAS,OAAO,KAAK,KAAK,sEACxB,2FACA,mCACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS,aAAa,KAAK,SAAS,QAAQ;AAAA,IAC9C,MAAM,QACJ,MACA,QAAQ,KAAK,gEACf;AAAA,EACF;AAAA,EACA,MAAM,SAAS,SAAS,YAAY,YAAY,MAAM,mBAAmB,QAAQ,IAAI;AAAA,EAKrF,MAAM,QAAQ,WAAW,aAAa,OAAO,SAAS;AAAA,EACtD,MAAM,QAAQ,QAAQ,YAAY;AAAA,EASlC,MAAM,WAAW,SAAS,WAAW;AAAA,EACrC,IAAI,UAAU,aAAa,WAAW,aAAa,CAAC,YAAY,QAAQ,IAAI,KAAK,CAAC,UAAU;AAAA,IAC1F,MAAM,QACJ,MACA,6FACE,sBACJ;AAAA,EACF;AAAA,EACA,IAAI,WAAW,aAAa,CAAC,YAAY,QAAQ,IAAI,GAAG;AAAA,IACtD,MAAM,QAAQ,MAAM,KAAK,SAAS,MAAM;AAAA,IAGxC,IAAI,UAAU,KAAK,MAAM,KAAK,QAAQ;AAAA,MACpC,MAAM,QAAO,MAAM,qCAAqC,KAAK,8BAA8B;AAAA,IAC7F;AAAA,IACA,MAAM,OAAO,gBAAgB,MAAM,OAAO,eAAe,IAAI,CAAC;AAAA,EAChE;AAAA,EAOA,MAAM,WAAW,YAAY;AAAA,IAC3B,IAAI,WAAW;AAAA,MAAW,MAAM,OAAO,WAAW,IAAI,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA;AAAA,EAE/E,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,IAAI,EAAE,MAAM,OAAO,UAAmB;AAAA,IACnF,MAAM,SAAS;AAAA,IACf,MAAM,QAAO,MAAM,kDAAkD,OAAO,KAAK,GAAG;AAAA,GACrF;AAAA,EACD,IAAI,UAAU,aAAa,CAAC,YAAY,OAAO,IAAI,GAAG;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,MAAM,QAAO,MAAM,wEAAwE;AAAA,EAC7F;AAAA,EAGA,IAAI;AAAA,IACF,MAAM,aACJ,QACA,OAAO,MACP,MACA,MAAM,gBAAgB,QAAQ,QAAQ,OAAM,GAC5C,OACF;AAAA,EACF,OAAO;AAAA;AAIF,IAAM,kBAAkB,OAC7B,QACA,QACA,YACkB;AAAA,EAClB,MAAM,OAAO,MAAM,OAAO,KAAK,OAAO,IAAI;AAAA,EAC1C,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAAQ,MAAM,QAAO,OAAO,MAAM,YAAY,KAAK,uBAAuB;AAAA,EAC5F,MAAM,OAAO,WAAW,OAAO,IAAI;AAAA;;;ACrM9B,IAAM,eAAe;AAGrB,IAAM,mBAAmB,CAAC,MAAc,UAAiD;AAAA,EAC9F,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAOpE,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,KAAK,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,uBAAuB;AAAA,EAG7D,IACE,KAAK,SAAS,GAAG,KACjB,KACG,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAC9D;AAAA,IACA,MAAM,KAAK,6EAA6E;AAAA,EAC1F;AAAA,EACA,IAAI,KAAK,SAAS,MAAM;AAAA,IAAG,MAAM,KAAK,mBAAmB;AAAA,EACzD,OAAO;AAAA;AAGF,IAAM,eAAe,CAAC,UAAmC;AAAA,EAC9D,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,OAAO;AAAA;;;AChDT,IAAM,UAAS,CAAC,MAAc,YAA2B,IAAI,MAAM,aAAa,SAAS,SAAS;AAG3F,IAAM,cAAc,OAAO,QAAoB,UAA2C;AAAA,EAC/F,MAAM,QAAQ,aAAa,KAAK;AAAA,EAChC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,QAAO,MAAM,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,EAC/D,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,MAAM,OAAO;AAAA,EACpD,OAAO;AAAA,IACL;AAAA,IACA,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM;AAAA,IACZ,QAAQ,UAAU,KAAK;AAAA,OACnB,MAAM,WAAW,QAAQ,OAAO,MAAM,MAAM,OAAM;AAAA,EACxD;AAAA;AAIK,IAAM,WAAW,OACtB,QACA,MACA,WACkB,WAAW,QAAQ,MAAM,YAAY,QAAQ,IAAI,GAAG,MAAM;AAMvE,IAAM,gBAAgB,OAC3B,QACA,OACA,QACA,QAAQ,UACwB;AAAA,EAChC,MAAM,OAAO,MAAM,YAAY,QAAQ,KAAK;AAAA,EAC5C,MAAM,OAAO,EAAE,UAAU,YAAY,KAAK,OAAO,OAAO,MAAM,OAAO,iBAAQ,KAAK;AAAA,EAClF,OAAO,aAAa,QAAQ,MAAM,QAAQ,KAAK;AAAA;AAI1C,IAAM,aAAa,CAAC,QAAoB,WAC7C,gBAAgB,QAAQ,QAAQ,OAAM;;;ALrCjC,IAAM,WAAW,UAAmB,WAAW;AAE/C,IAAM,mBAAmB,MACrB,iBACP,UACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,SAAS,SAAS,GAAG;AAAA,IAC1B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAE7B,MAAM,GAAG,MAAM,aACb,KAAK,YAAY;AAAA,MACf,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,MACxD,IAAI,UAAU;AAAA,QAAW;AAAA,MACzB,OAAO,WAAW,YAAY,SAAQ,KAAK,IAAI;AAAA,KAChD;AAAA,IAEH,MAAM,GAAG,YAAY,MAAM,aAAa;AAAA,MAEtC,IAAI,WAAW;AAAA,QAAW,OAAO,eAAe,UAAU;AAAA,MAC1D,IAAI,YAAW,IAAI;AAAA,QAAG,OAAO,KAAK,MAAM,SAAS,QAAQ,MAAM,MAAM,CAAC;AAAA,MAMtE,MAAM,OAAO,eAAe,MAAM,MAAM;AAAA,MACxC,IAAI,SAAS,aAAa,SAAS,OAAO;AAAA,QAAM,OAAc,gBAAQ,SAAS;AAAA,MAC/E,OAAO,KAAK,YACT,MAAM,QAAQ,QAAQ,MAAM,OAAO,IAAI,MAAO,OAC3C,YACA,EAAE,QAAQ,UAAmB,CACnC;AAAA;AAAA,IAKF,WAAW,GAAG,KAAK,YAAY,MAAM,aAC5B,gBAAQ,cAAc,EAAE,KAAK,YAAY,OAAO,CAAC,GAAG,CAAC,UAC1D,KAAK,MAAM,cAAc,QAAQ,MAAM,QAAQ,KAAK,CAAC,CACvD;AAAA,IAEF,QAAQ,GAAG,aAAa,KAAK,MAAM,WAAW,QAAQ,MAAM,CAAC;AAAA,EAC/D,CAAC;AAAA,CACF,CACH;;;AD5BK,IAAM,gBAAgB,CAAC,IAAY,UACjC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,eAAe,EAAE,WAAW,MAAM,WAAW,YAAY,MAAM,KAAK,CAAC;AAAA,EACnF,IAAI,MAAM,SAAS,GAAG;AAAA,IACpB,OAAO,OAAc,aAAK,IAAI,MAAM,iBAAiB,OAAO,MAAM,KAAK,IAAI,GAAG,CAAC;AAAA,EACjF;AAAA,EACA,MAAM,OAAO,OAAO,SAAS,GAAG,WAAW;AAAA,IACzC,SAAS,MAAM;AAAA,IACf,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM;AAAA,OACR,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,OACtD,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,EAC5D,CAAC,EAAE,KAAmB,qBAAO,CAAC;AAAA,EAC9B,MAAM,SAAS,OAAO,YAAY,IAAI,EAAE,WAAW,MAAM,WAAW,YAAY,KAAK,KAAK,CAAC;AAAA,EAC3F,OAAO,EAAE,QAAQ,KAAK;AAAA,CACvB;",
+  "debugId": "A91D75C3B7D7145864756E2164756E21",
   "names": []
 }

package/dist/cloudflare/mcp-server-api.d.ts

@@ -0,0 +1,135 @@
+/**
+ * The Access **AI Controls MCP server** calls a portal entry needs, and nothing else.
+ *
+ * ★ A PORTAL ENTRY IS ITS OWN OBJECT, NOT AN ACCESS APPLICATION. Cloudflare's MCP server portals
+ *   model one upstream server as THREE objects: this one
+ *   (`/accounts/{account_id}/access/ai-controls/mcp/servers`), the portal that aggregates it, and
+ *   an Access application of type `mcp` whose only destination is
+ *   `{ type: "via_mcp_server_portal", mcp_server_id: <this id> }`, which carries the policies that
+ *   decide who SEES the server in the portal (developers.cloudflare.com/cloudflare-one/
+ *   access-controls/ai-controls/secure-mcp-servers/ and .../mcp-portals/, read 2026-09-22).
+ *   Alchemy beta.79 ships `Cloudflare.Access.McpPortal` for the second and says in its own doc
+ *   comment that the first is "managed out of band (a future `Cloudflare.Access.McpServer`
+ *   resource)". This is that resource; mcp-access-app.ts covers the third.
+ *
+ * ★ OVER `@distilled.cloud/cloudflare`, THE SDK ALCHEMY'S OWN CLOUDFLARE PROVIDERS USE. Measured
+ *   2026-09-22: the official `cloudflare` npm SDK 4.5.0 has no AI Controls resources at all — its
+ *   `src/resources/zero-trust/` stops at access/devices/dex/dlp/gateway/identity-providers/
+ *   networks/organizations/risk-scoring/tunnels — while distilled `1.0.0-rc.12` carries all six
+ *   verbs used below. So there is no path string this file invents.
+ *
+ * ⛔ THE SERVER ID IS CLIENT-SUPPLIED AND REQUIRED ON CREATE. `CreateAccessAiControlMcpServer
+ *   Request.id` is a request field, not a server-generated one, which is why the resource takes it
+ *   as a required prop: the Access application that governs the entry names the SAME id in its
+ *   destination, so a generated id would have to be read back before the app could be declared.
+ *
+ * ⛔ NO TYPED `NotFound` EXISTS FOR THESE OPERATIONS. Measured 2026-09-22: every MCP-server verb
+ *   declares its error channel as the bare `CloudflareOpError`, whose `DefaultErrors` are
+ *   Unauthorized / TooManyRequests / InternalServerError / BadGateway / ServiceUnavailable /
+ *   GatewayTimeout — `NotFound` and `Forbidden` are NOT in the union, though distilled's protocol
+ *   constructs both at runtime from `HTTP_STATUS_MAP` (protocol.js, the 4xx branch). So "gone" is
+ *   matched on the runtime `_tag` through `Effect.catchIf`; `Effect.catchTag('NotFound', …)` does
+ *   not typecheck here, and a reviewer who "fixes" it to `catchTag` breaks the build, not the
+ *   behaviour.
+ */
+import * as zeroTrust from '@distilled.cloud/cloudflare/zero-trust';
+import * as Effect from 'effect/Effect';
+/** How the portal authenticates to the upstream MCP server. */
+export type McpServerAuthType = 'oauth' | 'bearer' | 'unauthenticated';
+/** Cloudflare's four sync states for a portal entry's tool/prompt catalog. */
+export type McpServerStatus = 'waiting' | 'ready' | 'stale' | 'error';
+/** Whether an administrator still has to authenticate before a catalog sync can succeed. */
+export type McpServerAuthenticationStatus = 'not_required' | 'required' | 'connected' | 'stale' | 'manual';
+/** A server-wide override for one tool or prompt the upstream server advertises. */
+export interface McpCapabilityOverride {
+    /** Name of the upstream capability being overridden. */
+    readonly name: string;
+    /** Custom name exposed through the portal. */
+    readonly alias?: string;
+    /** Custom description exposed through the portal. */
+    readonly description?: string;
+    /** Whether the capability is available through the portal at all. */
+    readonly enabled?: boolean;
+}
+/** A live portal entry as this package sees it. ⛔ There is no credential field here, on purpose. */
+export interface ObservedServer {
+    readonly id: string;
+    readonly name: string;
+    readonly hostname: string;
+    readonly authType: McpServerAuthType;
+    readonly description: string | undefined;
+    readonly isSharedOauthCallbackEnabled: boolean;
+    readonly secureWebGateway: boolean;
+    readonly status: McpServerStatus | undefined;
+    readonly authenticationStatus: McpServerAuthenticationStatus | undefined;
+    readonly lastSynced: string | undefined;
+    readonly createdAt: string | undefined;
+}
+declare const McpServerError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "McpServerError";
+} & Readonly<A>;
+/** A refusal or failure, carrying the sentence an operator needs. Never a credential. */
+export declare class McpServerError extends McpServerError_base<{
+    readonly message: string;
+}> {
+}
+type Raw = {
+    readonly id?: string | null;
+    readonly name?: string | null;
+    readonly hostname?: string | null;
+    readonly authType?: string | null;
+    readonly description?: string | null;
+    readonly isSharedOauthCallbackEnabled?: boolean | null;
+    readonly secureWebGateway?: boolean | null;
+    readonly status?: string | null;
+    readonly authenticationStatus?: string | null;
+    readonly lastSynced?: string | null;
+    readonly createdAt?: string | null;
+};
+/**
+ * ⚠️ AN UNRECOGNISED `auth_type` IS NOT A PORTAL ENTRY THIS RESOURCE UNDERSTANDS. The field is
+ *   required on every documented response, so `undefined` means Cloudflare grew a fourth mode —
+ *   dropping the row is safer than recording a value the diff would then compare against.
+ */
+export declare const observe: (raw: Raw) => ObservedServer | undefined;
+/** The portal entry with this id, or `undefined` when it does not exist. */
+export declare const getServer: (accountId: string, serverId: string) => Effect.Effect<ObservedServer | undefined, unknown, zeroTrust.CloudflareOpContext>;
+/** Every portal entry in the account. ⚠️ An account without the entitlement has none. */
+export declare const listServers: (accountId: string) => Effect.Effect<readonly ObservedServer[], unknown, zeroTrust.CloudflareOpContext>;
+/** The fields a create carries beyond the identity. `undefined` keys are omitted, never sent. */
+export interface ServerWrite {
+    readonly name: string;
+    readonly description?: string;
+    readonly isSharedOauthCallbackEnabled?: boolean;
+    readonly secureWebGateway?: boolean;
+    readonly updatedTools?: readonly McpCapabilityOverride[];
+    readonly updatedPrompts?: readonly McpCapabilityOverride[];
+    /** Resolved at call time from the deploying process's environment. Never stored. */
+    readonly authCredentials?: string;
+    /** Resolved at call time from the deploying process's environment. Never stored. */
+    readonly clientSecret?: string;
+}
+/**
+ * ⛔ `hostname` AND `authType` ARE SENT ON CREATE AND NOWHERE ELSE. Measured 2026-09-22 against
+ *   the SDK: `UpdateAccessAiControlMcpServerRequest` carries `authCredentials`, `clientSecret`,
+ *   `description`, `isSharedOauthCallbackEnabled`, `name`, `secureWebGateway`, `updatedPrompts`
+ *   and `updatedTools` — and NEITHER `hostname` NOR `authType`. So changing either is a replace,
+ *   not an update, and mcp-server-form.ts says so in `diff`.
+ */
+export declare const createServer: (accountId: string, serverId: string, hostname: string, authType: McpServerAuthType, write: ServerWrite) => Effect.Effect<ObservedServer, unknown, zeroTrust.CloudflareOpContext>;
+/** An in-place update of the mutable fields. The identity, hostname and auth type never move. */
+export declare const updateServer: (accountId: string, serverId: string, write: ServerWrite) => Effect.Effect<ObservedServer | undefined, unknown, zeroTrust.CloudflareOpContext>;
+/**
+ * Refresh the entry's tool and prompt catalog from the upstream server.
+ *
+ * ⛔ BEST EFFORT, AND THE DEPLOY NEVER FAILS ON IT. An `oauth` entry reports
+ *   `authentication_status: "required"` until an administrator completes the upstream OAuth flow
+ *   in the dashboard, and a sync before that cannot succeed. Failing the create over it would make
+ *   the FIRST deploy of every Access-protected MCP server red while the object it created is
+ *   correct. The observed `status` is recorded instead, so a plan shows `waiting` or `error`.
+ */
+export declare const syncServer: (accountId: string, serverId: string) => Effect.Effect<McpServerStatus | undefined, never, zeroTrust.CloudflareOpContext>;
+/** Idempotent: an entry already gone is a successful delete. */
+export declare const deleteServer: (accountId: string, serverId: string) => Effect.Effect<void, unknown, zeroTrust.CloudflareOpContext>;
+export {};
+//# sourceMappingURL=mcp-server-api.d.ts.map

package/dist/cloudflare/mcp-server-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-api.d.ts","sourceRoot":"","sources":["../../src/cloudflare/mcp-server-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AAEpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,+DAA+D;AAC/D,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,QAAQ,GAAG,iBAAiB,CAAC;AAEvE,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEtE,4FAA4F;AAC5F,MAAM,MAAM,6BAA6B,GACrC,cAAc,GACd,UAAU,GACV,WAAW,GACX,OAAO,GACP,QAAQ,CAAC;AAEb,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,oGAAoG;AACpG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,4BAA4B,EAAE,OAAO,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,oBAAoB,EAAE,6BAA6B,GAAG,SAAS,CAAC;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;;;;AAED,yFAAyF;AACzF,qBAAa,cAAe,SAAQ,oBAAmC;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AAEL,KAAK,GAAG,GAAG;IACT,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACvD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC,CAAC;AAeF;;;;GAIG;AACH,eAAO,MAAM,OAAO,QAAS,GAAG,KAAG,cAAc,GAAG,SAoBnD,CAAC;AAwBF,4EAA4E;AAC5E,eAAO,MAAM,SAAS,cACT,MAAM,YACP,MAAM,KACf,MAAM,CAAC,MAAM,CAAC,cAAc,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,mBAAmB,CAId,CAAC;AAEtE,yFAAyF;AACzF,eAAO,MAAM,WAAW,cACX,MAAM,KAChB,MAAM,CAAC,MAAM,CAAC,SAAS,cAAc,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,mBAAmB,CAO/E,CAAC;AAEJ,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAChD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC3D,oFAAoF;IACpF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAcD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,cACZ,MAAM,YACP,MAAM,YACN,MAAM,YACN,iBAAiB,SACpB,WAAW,KACjB,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,EAAE,SAAS,CAAC,mBAAmB,CAwBpE,CAAC;AAEJ,iGAAiG;AACjG,eAAO,MAAM,YAAY,cACZ,MAAM,YACP,MAAM,SACT,WAAW,KACjB,MAAM,CAAC,MAAM,CAAC,cAAc,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,mBAAmB,CAWhF,CAAC;AAEJ;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,cACV,MAAM,YACP,MAAM,KACf,MAAM,CAAC,MAAM,CAAC,eAAe,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,mBAAmB,CAI/E,CAAC;AAEJ,gEAAgE;AAChE,eAAO,MAAM,YAAY,cACZ,MAAM,YACP,MAAM,KACf,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,mBAAmB,CAIN,CAAC"}