@homeflare/alchemy 0.22.0 → 0.24.0

package/dist/release/index.js.map

@@ -1,10 +1,11 @@
 {
   "version": 3,
-  "sources": ["../src/launchd/secret-tripwire.ts", "../src/launchd/host-file-form.ts", "../src/release/binary-form.ts", "../src/release/binary.ts", "../src/launchd/host-effect.ts", "../src/launchd/runner.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/release/binary-diff.ts", "../src/launchd/file-identity.ts", "../src/launchd/job-form.ts", "../src/launchd/plist.ts", "../src/launchd/file-converge.ts", "../src/release/binary-claim.ts", "../src/release/refused.ts", "../src/release/tar.ts", "../src/release/archive.ts", "../src/release/binary-lifecycle.ts", "../src/release/binary-read.ts", "../src/release/declared-pins.ts", "../src/release/download.ts", "../src/release/catalog.ts", "../src/release/openbao.ts", "../src/release/providers.ts", "../src/release/victoria.ts"],
+  "sources": ["../src/launchd/secret-tripwire.ts", "../src/launchd/host-file-form.ts", "../src/release/binary-pins.ts", "../src/release/binary-form.ts", "../src/release/binary.ts", "../src/launchd/host-effect.ts", "../src/launchd/runner.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/release/binary-diff.ts", "../src/launchd/file-identity.ts", "../src/launchd/job-form.ts", "../src/launchd/plist.ts", "../src/launchd/file-converge.ts", "../src/release/binary-claim.ts", "../src/release/refused.ts", "../src/release/tar.ts", "../src/release/archive.ts", "../src/release/binary-lifecycle.ts", "../src/release/binary-read.ts", "../src/release/declared-pins.ts", "../src/release/download.ts", "../src/release/catalog.ts", "../src/release/openbao.ts", "../src/release/providers.ts", "../src/release/victoria.ts"],
   "sourcesContent": [
     "/**\n * A tripwire for the obvious ways a secret ends up in Alchemy state through these providers.\n *\n * ⛔ WHY IT EXISTS. Alchemy persists every prop UNENCRYPTED in its state store — the same reason\n *   the OpenBao families are metadata-only (openbao/policy.ts). A LaunchdJob's `environment` and\n *   `programArguments`, and a HostFile's `content`, are props. A token declared there is a token\n *   copied into the state store, into every plan diff, and into the plist or file on disk.\n * ★ THE ALTERNATIVE, NAMED IN EVERY REFUSAL: let a secret renderer (openbao-agent, or any other)\n *   write the secret to a root-owned file, and declare only its PATH — `FOO_TOKEN_FILE=/path`,\n *   `--token-file /path`. The job reads the file at start; the state holds a path.\n *\n * ⚠️ A TRIPWIRE, NOT A SCANNER. It catches the names and shapes people actually type. A token in\n *   an innocently named variable passes; nothing here can make a secret safe to declare.\n */\nimport type { PlistDict, PlistValue } from './plist.ts';\n\nconst ALTERNATIVE =\n  'props are stored unencrypted in Alchemy state. Have a secret renderer (e.g. openbao-agent) ' +\n  'write it to a root-owned file and declare the file path instead (FOO_FILE=/path, --foo-file /path).';\n\n/** Names that end in a word meaning \"this is the secret itself\". `*_FILE`, `*_PATH` never match. */\nconst SECRET_NAME =\n  /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|API_?KEY|ACCESS_KEY|PRIVATE_KEY|SECRET_KEY|CREDENTIALS?)$/i;\n\n/** `--token=…` / `-password=…` style flags carrying their value inline. */\nconst INLINE_FLAG = /^--?[a-z0-9-]*(?:token|password|passwd|passphrase|secret|api-?key)=./i;\n\n/** A flag whose NEXT argv element is the secret: `--token abc`. */\nconst BARE_FLAG = /^--?(?:[a-z0-9]+-)*(?:token|password|passwd|passphrase|secret|api-?key)$/i;\n\nexport const PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;\n\n/** Paths of every string leaf in a plist value holding a private key. */\nconst keyLeaves = (value: PlistValue, path: string): string[] => {\n  if (typeof value === 'string') return PRIVATE_KEY.test(value) ? [path] : [];\n  if (Array.isArray(value)) {\n    return (value as readonly PlistValue[]).flatMap((item, index) =>\n      keyLeaves(item, `${path}[${String(index)}]`),\n    );\n  }\n  if (typeof value === 'object' && value !== null) {\n    return Object.entries(value).flatMap(([key, item]) => keyLeaves(item, `${path}.${key}`));\n  }\n  return [];\n};\n\n/**\n * Refusals for a job's environment, argv and extraKeys. Empty means nothing tripped.\n * ★ extraKeys too: it is a prop like the others, so it lands in state just the same.\n */\nexport const jobSecretProblems = (\n  environment: Readonly<Record<string, string>> | undefined,\n  argv: readonly string[],\n  extraKeys?: PlistDict,\n): string[] => {\n  const found: string[] = [];\n  for (const [name, value] of Object.entries(environment ?? {})) {\n    if (SECRET_NAME.test(name))\n      found.push(`environment ${name} looks like a secret: ${ALTERNATIVE}`);\n    else if (PRIVATE_KEY.test(value))\n      found.push(`environment ${name} holds a private key: ${ALTERNATIVE}`);\n  }\n  for (const [index, arg] of argv.entries()) {\n    // ⛔ Never echo the argument itself: if it IS a secret, the refusal would print it.\n    if (INLINE_FLAG.test(arg)) {\n      found.push(`programArguments[${String(index)}] passes a secret inline: ${ALTERNATIVE}`);\n    } else if (BARE_FLAG.test(arg) && index + 1 < argv.length) {\n      found.push(`programArguments[${String(index + 1)}] follows a secret flag: ${ALTERNATIVE}`);\n    } else if (PRIVATE_KEY.test(arg)) {\n      found.push(`programArguments[${String(index)}] holds a private key: ${ALTERNATIVE}`);\n    }\n  }\n  for (const path of keyLeaves(extraKeys ?? {}, 'extraKeys')) {\n    found.push(`${path} holds a private key: ${ALTERNATIVE}`);\n  }\n  return found;\n};\n\n/** Refusals for a HostFile's content. */\nexport const fileSecretProblems = (content: string): string[] =>\n  PRIVATE_KEY.test(content) ? [`content holds a private key: ${ALTERNATIVE}`] : [];\n",
     "/**\n * HostFile's props, attributes and validation — the pure half of the provider.\n *\n * ⛔ `content` IS NEVER A SECRET. Alchemy stores props unencrypted, so the content of every HostFile\n *   sits in the state store and in every plan diff. A secret file stays RENDERED BY A SECRET\n *   RENDERER (openbao-agent templates, on this estate) that fetches it at run time; the stack\n *   declares only non-secret config, and at most the PATH the renderer writes to.\n *   secret-tripwire.ts refuses the obvious case (a PEM private key); nothing can catch all of them.\n */\nimport { fileSecretProblems } from './secret-tripwire.ts';\n\nexport interface HostFileProps {\n  /** Absolute path. The parent directory must already exist. */\n  path: string;\n  /** UTF-8 text. ⛔ Never a secret — see the file header. */\n  content: string;\n  /** Permission bits. @default 0o644 */\n  mode?: number;\n  /** User name or numeric uid. Omitted: whoever the runner writes as (a rewrite keeps no owner). */\n  owner?: string | number;\n  /** Group name or numeric gid. Omitted: the directory's default group. */\n  group?: string | number;\n}\n\nexport interface HostFileAttributes {\n  path: string;\n  /** SHA-256 of the bytes on disk. */\n  sha256: string;\n  mode: number;\n  uid: number;\n  gid: number;\n  size: number;\n}\n\nexport const DEFAULT_MODE = 0o644;\n\n/** A user or group as declared: a non-negative id, or a name the host could have. */\nexport const identityProblems = (name: string, value: string | number | undefined): string[] => {\n  if (value === undefined) return [];\n  if (typeof value === 'number') {\n    return Number.isSafeInteger(value) && value >= 0\n      ? []\n      : [`${name} must be a non-negative integer id`];\n  }\n  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\\d+$/.test(value)\n    ? []\n    : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];\n};\n\n/**\n * An absolute, normalised path, or the reasons it is not. ★ Shared with sudo-allowlist.ts, so a\n *   path the sudo runner may touch as root obeys exactly the rule a declared file does.\n */\nexport const pathProblems = (path: string): string[] => {\n  const found: string[] = [];\n  if (!path.startsWith('/')) found.push('path must be absolute');\n  // ★ One spelling per file: `a/./b`, `a//b` and `a/../b` would each be a second resource for the\n  //   same inode, and `..` is how a derived path walks out of the directory it was meant for.\n  if (\n    path.endsWith('/') ||\n    path\n      .split('/')\n      .slice(1)\n      .some((part) => part === '' || part === '.' || part === '..')\n  ) {\n    found.push('path must be normalised (no trailing slash, no empty, \".\" or \"..\" segments)');\n  }\n  if (path.includes('\\x00')) found.push('path contains NUL');\n  return found;\n};\n\nexport const fileProblems = (props: HostFileProps): string[] => {\n  const found = pathProblems(props.path);\n  const mode = props.mode ?? DEFAULT_MODE;\n  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 0o7777) found.push('mode must be 0–0o7777');\n  found.push(...identityProblems('owner', props.owner));\n  found.push(...identityProblems('group', props.group));\n  found.push(...fileSecretProblems(props.content));\n  return found;\n};\n",
-    "/**\n * Release.Binary's props, attributes and validation — the pure half of the provider.\n *\n * ★ THE PINNED ARCHIVE IS A PROP, NOT A LOOKUP. Repository, tag, exact asset name, size, the\n *   archive's SHA-256, the member and the member's SHA-256 all arrive as props — usually spread from\n *   a vendor data set (victoria.ts) by `catalogBinary()`. So the resource knows no vendor at all: a\n *   second vendor is a second data module, never a change here, and the resource is the shape\n *   Alchemy could accept (docs/release-binary-upstream.md).\n * ⛔ NOTHING ESTATE-SPECIFIC IS A CONSTANT HERE. The install directory, owner, group and mode are\n *   the consuming stack's props. A stack that keeps binaries under `/opt/<estate>/obs/bin` says so\n *   in its own code.\n * ⛔ EVERY PIN IS REQUIRED, AND WELL-FORMED OR REFUSED. There is no \"latest\", no optional digest and\n *   no fallback to a checksum file fetched at apply — see victoria.ts for why a pin beats a fetch.\n */\nimport type { HostFileAttributes } from '../launchd/host-file-form.ts';\nimport { identityProblems, pathProblems } from '../launchd/host-file-form.ts';\n\n/** One release archive, pinned: where it is published, and the bytes it must be. */\nexport interface ReleaseArchive {\n  /** The GitHub repository that publishes it, `owner/name`: `'VictoriaMetrics/VictoriaMetrics'`. */\n  readonly repo: string;\n  /** The release tag, exactly as published: `'v1.151.0'`. */\n  readonly tag: string;\n  /**\n   * The asset's file name, whole: `'vmutils-darwin-arm64-v1.151.0.tar.gz'`. ⛔ Never a prefix or a\n   * pattern — `-enterprise` and `-cluster` siblings share every prefix with it.\n   */\n  readonly asset: string;\n  /** Bytes, per the release API. A download that runs past this is cut off and refused. */\n  readonly size: number;\n  /** The archive's SHA-256, lower-case hex, as the vendor's checksum file lists it. */\n  readonly sha256: string;\n}\n\nexport interface ReleaseBinaryProps {\n  /** The pinned archive the binary comes out of. `catalogBinary()` fills it from a data set. */\n  archive: ReleaseArchive;\n  /** The archive member to extract, by its exact name: `'vmalert-prod'`. Nothing else is unpacked. */\n  member: string;\n  /** The member's own SHA-256 — what the installed file must hash to. */\n  sha256: string;\n  /**\n   * The installed file name: `'vmalert'`. ★ Separate from `member` on purpose — VictoriaMetrics\n   * names every member `<binary>-prod`, and a job's argv[0] should not carry that.\n   */\n  name: string;\n  /**\n   * The directory the binary is written into. ⛔ It must already exist — declare it with\n   * `HostDirectory` and pass that resource's `path`, which also orders it first. ★ Give each\n   * version its own directory (`catalogDirectory()`): an upgrade is then a new path — a\n   * create-before-delete replace, never an overwrite under a running daemon — and a rollback is a\n   * path. A new pin at the SAME path is refused (binary-diff.ts).\n   */\n  directory: string;\n  /**\n   * Permission bits. ⛔ Owner-readable and -executable, never group- or world-writable, never\n   * setuid, setgid or sticky — a writable binary is whoever-can-write's code, run as whoever runs\n   * the daemon. Its directory must not be group- or world-writable either (binary-lifecycle.ts).\n   * @default 0o755\n   */\n  mode?: number;\n  /** User name or numeric uid. Omitted: whoever the runner writes as. */\n  owner?: string | number;\n  /** Group name or numeric gid. Omitted: the directory's default group. */\n  group?: string | number;\n}\n\nexport interface ReleaseBinaryAttributes extends HostFileAttributes {\n  /** The archive the bytes came from, whole. */\n  url: string;\n  /** The archive member installed, by its exact name: `vmalert-prod`. */\n  member: string;\n}\n\n/** Everything a download and its two checks need: one archive, one member, both digests. */\nexport type PinnedDownload = {\n  readonly url: string;\n  readonly size: number;\n  /** The archive's pinned SHA-256. */\n  readonly sha256: string;\n  /** The archive member to extract, by exact name. */\n  readonly member: string;\n  /** The member's pinned SHA-256. */\n  readonly memberSha256: string;\n};\n\nexport const DEFAULT_BINARY_MODE = 0o755;\n\n/**\n * The release-asset URL. ★ GITHUB'S DOWNLOAD PATH, NOT THE API: it needs no token and spends no rate\n *   limit (it redirects to a signed CDN URL — measured 2026-09-22 with HEAD). Every consumer the\n *   estate census found publishes on GitHub except Grafana (grafana.com), which is not a\n *   single-binary consumer anyway (docs/release-binary-catalogs.md). A second source kind arrives\n *   with its first consumer, not before.\n */\nexport const releaseUrl = (repo: string, tag: string, asset: string): string =>\n  `https://github.com/${repo}/releases/download/${tag}/${asset}`;\n\n/** Where a declaration puts its binary: `<directory>/<name>`. */\nexport const releaseBinaryPath = (props: {\n  readonly directory: string;\n  readonly name: string;\n}): string => `${props.directory}/${props.name}`;\n\n/** The download a declaration means. ⚠️ Validate first (binaryProblems): this trusts its input. */\nexport const pinnedDownload = (props: ReleaseBinaryProps): PinnedDownload => ({\n  member: props.member,\n  memberSha256: props.sha256,\n  sha256: props.archive.sha256,\n  size: props.archive.size,\n  url: releaseUrl(props.archive.repo, props.archive.tag, props.archive.asset),\n});\n\nexport const modeProblems = (mode: number): string[] => {\n  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 0o7777) return ['mode must be 0–0o7777'];\n  const found: string[] = [];\n  if ((mode & 0o7000) !== 0) found.push('mode must not set setuid, setgid or sticky');\n  if ((mode & 0o022) !== 0) found.push('mode must not be group- or world-writable');\n  if ((mode & 0o100) === 0) found.push('mode must let the owner execute it');\n  // ⛔ AND READ IT: every plan re-hashes the binary, and a write is read back. MEASURED 2026-09-22,\n  //   an execute-only 0111 written by a non-root operator failed its read-back with EACCES.\n  if ((mode & 0o400) === 0) found.push('mode must let the owner read it (it is re-hashed)');\n  return found;\n};\n\nconst HEX64 = /^[0-9a-f]{64}$/;\nexport const MAX_ARCHIVE = 1 << 30;\n// ⛔ Strict on purpose: each is written into a URL or a path. GitHub's own owner and name alphabet.\nconst REPO = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?\\/[A-Za-z0-9._-]+$/;\nconst SEGMENT = /^[A-Za-z0-9._-]+$/;\n// ★ ONLY WHAT THE READER HANDLES: a gzipped tar. A `.zip` or a bare binary is a new capability\n//   with its own walk-down, not a name this should accept and then fail to unpack.\nconst TARBALL = /\\.(tar\\.gz|tgz)$/;\n\n/** A single path segment that cannot climb, hide or name the directory itself. */\nconst segmentProblem = (what: string, value: string): string | undefined =>\n  !SEGMENT.test(value) || value === '.' || value === '..'\n    ? `${what} must be one path segment of letters, digits, '.', '_' or '-': ${JSON.stringify(value)}`\n    : undefined;\n\n/** Everything wrong with the pins alone — plain strings in any declaration, resolved or not. */\nexport const pinProblems = (props: {\n  readonly archive?: Partial<ReleaseArchive>;\n  readonly member?: unknown;\n  readonly sha256?: unknown;\n  readonly name?: unknown;\n}): string[] => {\n  const archive = props.archive ?? {};\n  const found: string[] = [];\n  const text = (what: string, value: unknown): string | undefined => {\n    if (typeof value === 'string') return value;\n    found.push(`${what} is required, as a plain string`);\n    return undefined;\n  };\n  const repo = text('archive.repo', archive.repo);\n  // ⚠️ `owner/..` passes the alphabet, and a URL parser normalises it away: the request would go\n  //   to `github.com/releases/…`, somewhere nobody pinned. Refused by name.\n  const repoName = repo?.slice(repo.indexOf('/') + 1);\n  if (repo !== undefined && (!REPO.test(repo) || repoName === '.' || repoName === '..'))\n    found.push(`archive.repo must be \"owner/name\": ${JSON.stringify(repo)}`);\n  for (const [what, value] of [\n    ['archive.tag', archive.tag],\n    ['name', props.name],\n  ] as const) {\n    const given = text(what, value);\n    const problem = given === undefined ? undefined : segmentProblem(what, given);\n    if (problem !== undefined) found.push(problem);\n  }\n  const asset = text('archive.asset', archive.asset);\n  if (asset !== undefined) {\n    const problem = segmentProblem('archive.asset', asset);\n    if (problem !== undefined) found.push(problem);\n    else if (!TARBALL.test(asset))\n      found.push(`archive.asset must be a .tar.gz or .tgz: \"${asset}\"`);\n  }\n  // ⛔ THE SIZE IS ALLOCATED UP FRONT (download.ts fills one buffer of exactly this many bytes), so\n  //   a typo'd size is a memory bomb in the deploying process. vmutils, the largest archive pinned,\n  //   is 123.6 MB; a gibibyte is a ceiling nothing single-binary should reach.\n  const size = archive.size;\n  if (typeof size !== 'number' || !Number.isSafeInteger(size) || size <= 0 || size > MAX_ARCHIVE) {\n    found.push(`archive.size must be the asset's byte count, 1 to ${String(MAX_ARCHIVE)}`);\n  }\n  for (const [what, value] of [\n    ['archive.sha256', archive.sha256],\n    ['sha256', props.sha256],\n  ] as const) {\n    const given = text(what, value);\n    if (given !== undefined && !HEX64.test(given))\n      found.push(`${what} must be 64 lower-case hex digits`);\n  }\n  const member = text('member', props.member);\n  // ⛔ The tar reader refuses these entries anyway; asking for one is a mistake to name at plan.\n  if (\n    member !== undefined &&\n    (member === '' || member.startsWith('/') || member.split('/').includes('..'))\n  ) {\n    found.push(`member must be a relative name inside the archive: ${JSON.stringify(member)}`);\n  }\n  return found;\n};\n\nconst ARCHIVE_KEYS = ['repo', 'tag', 'asset', 'size', 'sha256'] as const;\n\ntype Pins = Pick<ReleaseBinaryProps, 'archive' | 'member' | 'sha256'>;\n\n/** Whether two declarations pin different bytes: another archive, member or member digest. */\nexport const pinsMoved = (olds: Pins, news: Pins): boolean =>\n  olds.member !== news.member ||\n  olds.sha256 !== news.sha256 ||\n  ARCHIVE_KEYS.some((key) => olds.archive[key] !== news.archive[key]);\n\n/**\n * ⛔ A NEW PIN IS A NEW PATH. The same path with other bytes would overwrite a binary under the\n *   daemon running it, and leave no rollback but a re-download — so it is refused, at plan when the\n *   path is resolved (binary-diff.ts) and at apply otherwise (binary-lifecycle.ts).\n */\nexport const inPlaceRefusal = (olds: Pins, news: Pins): string =>\n  `a new pin (${news.archive.tag} ${news.member} ${news.sha256}) at the path of the installed ` +\n  `one (${olds.archive.tag} ${olds.member} ${olds.sha256}) would overwrite it in place; give each ` +\n  'version its own directory (catalogDirectory), so an upgrade is a new path';\n\n/** Everything wrong with a declaration, before any host or network is asked anything. */\nexport const binaryProblems = (props: ReleaseBinaryProps): string[] => [\n  ...pinProblems(props),\n  ...pathProblems(props.directory).map((problem) => `directory: ${problem}`),\n  ...modeProblems(props.mode ?? DEFAULT_BINARY_MODE),\n  ...identityProblems('owner', props.owner),\n  ...identityProblems('group', props.group),\n];\n",
+    "/**\n * `pinProblems` — everything wrong with a declaration's pins alone, as plain strings, checked\n * before a plan resolves a directory or a host is asked anything. Split out of binary-form.ts\n * 2026-09-23 to keep that file under the house's 250-line cap (it was 229, heading for ~250 once\n * `archive.root` needed its own validation and JSDoc). binary-form.ts re-exports `pinProblems` and\n * `MAX_ARCHIVE`, so nothing that imported them moves.\n */\nimport type { ReleaseArchive } from './binary-form.ts';\n\nconst HEX64 = /^[0-9a-f]{64}$/;\nexport const MAX_ARCHIVE = 1 << 30;\n// ⛔ Strict on purpose: each is written into a URL or a path. GitHub's own owner and name alphabet.\nconst REPO = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?\\/[A-Za-z0-9._-]+$/;\nconst SEGMENT = /^[A-Za-z0-9._-]+$/;\n// ★ ONLY WHAT THE READER HANDLES: a gzipped tar. A `.zip` or a bare binary is a new capability\n//   with its own walk-down, not a name this should accept and then fail to unpack.\nconst TARBALL = /\\.(tar\\.gz|tgz)$/;\n\n/** A single path segment that cannot climb, hide or name the directory itself. */\nconst segmentProblem = (what: string, value: string): string | undefined =>\n  !SEGMENT.test(value) || value === '.' || value === '..'\n    ? `${what} must be one path segment of letters, digits, '.', '_' or '-': ${JSON.stringify(value)}`\n    : undefined;\n\n/** Everything wrong with the pins alone — plain strings in any declaration, resolved or not. */\nexport const pinProblems = (props: {\n  readonly archive?: Partial<ReleaseArchive>;\n  readonly member?: unknown;\n  readonly sha256?: unknown;\n  readonly name?: unknown;\n}): string[] => {\n  const archive = props.archive ?? {};\n  const found: string[] = [];\n  const text = (what: string, value: unknown): string | undefined => {\n    if (typeof value === 'string') return value;\n    found.push(`${what} is required, as a plain string`);\n    return undefined;\n  };\n  const repo = text('archive.repo', archive.repo);\n  // ⚠️ `owner/..` passes the alphabet, and a URL parser normalises it away: the request would go\n  //   to `github.com/releases/…`, somewhere nobody pinned. Refused by name.\n  const repoName = repo?.slice(repo.indexOf('/') + 1);\n  if (repo !== undefined && (!REPO.test(repo) || repoName === '.' || repoName === '..'))\n    found.push(`archive.repo must be \"owner/name\": ${JSON.stringify(repo)}`);\n  for (const [what, value] of [\n    ['archive.tag', archive.tag],\n    ['name', props.name],\n  ] as const) {\n    const given = text(what, value);\n    const problem = given === undefined ? undefined : segmentProblem(what, given);\n    if (problem !== undefined) found.push(problem);\n  }\n  const asset = text('archive.asset', archive.asset);\n  if (asset !== undefined) {\n    const problem = segmentProblem('archive.asset', asset);\n    if (problem !== undefined) found.push(problem);\n    else if (!TARBALL.test(asset))\n      found.push(`archive.asset must be a .tar.gz or .tgz: \"${asset}\"`);\n  }\n  // ★ ONE DECLARED DIRECTORY, NEVER DERIVED. Optional: most archives (Victoria, OpenBao) are flat.\n  //   Where given, it is the vendor's own wrapper (measured, not guessed — tar.ts's header comment)\n  //   and must be exactly one safe segment, the same alphabet as a tag or an asset name.\n  if (archive.root !== undefined) {\n    if (typeof archive.root !== 'string') {\n      found.push('archive.root must be a plain string when given');\n    } else {\n      const problem = segmentProblem('archive.root', archive.root);\n      if (problem !== undefined) found.push(problem);\n    }\n  }\n  // ⛔ THE SIZE IS ALLOCATED UP FRONT (download.ts fills one buffer of exactly this many bytes), so\n  //   a typo'd size is a memory bomb in the deploying process. vmutils, the largest archive pinned,\n  //   is 123.6 MB; a gibibyte is a ceiling nothing single-binary should reach.\n  const size = archive.size;\n  if (typeof size !== 'number' || !Number.isSafeInteger(size) || size <= 0 || size > MAX_ARCHIVE) {\n    found.push(`archive.size must be the asset's byte count, 1 to ${String(MAX_ARCHIVE)}`);\n  }\n  for (const [what, value] of [\n    ['archive.sha256', archive.sha256],\n    ['sha256', props.sha256],\n  ] as const) {\n    const given = text(what, value);\n    if (given !== undefined && !HEX64.test(given))\n      found.push(`${what} must be 64 lower-case hex digits`);\n  }\n  const member = text('member', props.member);\n  // ⛔ The tar reader refuses these entries anyway; asking for one is a mistake to name at plan.\n  if (\n    member !== undefined &&\n    (member === '' || member.startsWith('/') || member.split('/').includes('..'))\n  ) {\n    found.push(`member must be a relative name inside the archive: ${JSON.stringify(member)}`);\n  }\n  return found;\n};\n",
+    "/**\n * Release.Binary's props, attributes and validation — the pure half of the provider.\n *\n * ★ THE PINNED ARCHIVE IS A PROP, NOT A LOOKUP. Repository, tag, exact asset name, size, the\n *   archive's SHA-256, the member and the member's SHA-256 all arrive as props — usually spread from\n *   a vendor data set (victoria.ts) by `catalogBinary()`. So the resource knows no vendor at all: a\n *   second vendor is a second data module, never a change here, and the resource is the shape\n *   Alchemy could accept (docs/release-binary-upstream.md).\n * ⛔ NOTHING ESTATE-SPECIFIC IS A CONSTANT HERE. The install directory, owner, group and mode are\n *   the consuming stack's props. A stack that keeps binaries under `/opt/<estate>/obs/bin` says so\n *   in its own code.\n * ⛔ EVERY PIN IS REQUIRED, AND WELL-FORMED OR REFUSED. There is no \"latest\", no optional digest and\n *   no fallback to a checksum file fetched at apply — see victoria.ts for why a pin beats a fetch.\n */\nimport type { HostFileAttributes } from '../launchd/host-file-form.ts';\nimport { identityProblems, pathProblems } from '../launchd/host-file-form.ts';\nimport { pinProblems } from './binary-pins.ts';\n\n/** One release archive, pinned: where it is published, and the bytes it must be. */\nexport interface ReleaseArchive {\n  /** The GitHub repository that publishes it, `owner/name`: `'VictoriaMetrics/VictoriaMetrics'`. */\n  readonly repo: string;\n  /** The release tag, exactly as published: `'v1.151.0'`. */\n  readonly tag: string;\n  /**\n   * The asset's file name, whole: `'vmutils-darwin-arm64-v1.151.0.tar.gz'`. ⛔ Never a prefix or a\n   * pattern — `-enterprise` and `-cluster` siblings share every prefix with it.\n   */\n  readonly asset: string;\n  /** Bytes, per the release API. A download that runs past this is cut off and refused. */\n  readonly size: number;\n  /** The archive's SHA-256, lower-case hex, as the vendor's checksum file lists it. */\n  readonly sha256: string;\n  /**\n   * The one directory the vendor wraps every entry in, exactly as its own archive names it —\n   * `'alertmanager-0.33.1.darwin-arm64'`, never `'alertmanager-0.33.1.darwin-arm64/'` (no trailing\n   * slash). Pinned from the walk-down, never derived from `asset` or `tag`: the vendor spells its\n   * wrapper however it likes (`darwin_arm64`, an `-enterprise` suffix, no version at all), so a\n   * computed name would drift onto a sibling the moment one vendor's naming changes. Omit it for a\n   * flat archive (Victoria, OpenBao); the tar reader then refuses a directory entry exactly as it\n   * always has (tar.ts).\n   * @default undefined — no wrapping directory; the archive is flat.\n   */\n  readonly root?: string;\n}\n\nexport interface ReleaseBinaryProps {\n  /** The pinned archive the binary comes out of. `catalogBinary()` fills it from a data set. */\n  archive: ReleaseArchive;\n  /** The archive member to extract, by its exact name: `'vmalert-prod'`. Nothing else is unpacked. */\n  member: string;\n  /** The member's own SHA-256 — what the installed file must hash to. */\n  sha256: string;\n  /**\n   * The installed file name: `'vmalert'`. ★ Separate from `member` on purpose — VictoriaMetrics\n   * names every member `<binary>-prod`, and a job's argv[0] should not carry that.\n   */\n  name: string;\n  /**\n   * The directory the binary is written into. ⛔ It must already exist — declare it with\n   * `HostDirectory` and pass that resource's `path`, which also orders it first. ★ Give each\n   * version its own directory (`catalogDirectory()`): an upgrade is then a new path — a\n   * create-before-delete replace, never an overwrite under a running daemon — and a rollback is a\n   * path. A new pin at the SAME path is refused (binary-diff.ts).\n   */\n  directory: string;\n  /**\n   * Permission bits. ⛔ Owner-readable and -executable, never group- or world-writable, never\n   * setuid, setgid or sticky — a writable binary is whoever-can-write's code, run as whoever runs\n   * the daemon. Its directory must not be group- or world-writable either (binary-lifecycle.ts).\n   * @default 0o755\n   */\n  mode?: number;\n  /** User name or numeric uid. Omitted: whoever the runner writes as. */\n  owner?: string | number;\n  /** Group name or numeric gid. Omitted: the directory's default group. */\n  group?: string | number;\n}\n\nexport interface ReleaseBinaryAttributes extends HostFileAttributes {\n  /** The archive the bytes came from, whole. */\n  url: string;\n  /** The archive member installed, by its exact name: `vmalert-prod`. */\n  member: string;\n}\n\n/** Everything a download and its two checks need: one archive, one member, both digests. */\nexport type PinnedDownload = {\n  readonly url: string;\n  readonly size: number;\n  /** The archive's pinned SHA-256. */\n  readonly sha256: string;\n  /** The archive member to extract, by exact name. */\n  readonly member: string;\n  /** The member's pinned SHA-256. */\n  readonly memberSha256: string;\n  /** The one declared leading directory to strip, if the archive has one — `archive.root`. */\n  readonly root?: string;\n};\n\nexport const DEFAULT_BINARY_MODE = 0o755;\n\n/**\n * The release-asset URL. ★ GITHUB'S DOWNLOAD PATH, NOT THE API: it needs no token and spends no rate\n *   limit (it redirects to a signed CDN URL — measured 2026-09-22 with HEAD). Every consumer the\n *   estate census found publishes on GitHub except Grafana (grafana.com), which is not a\n *   single-binary consumer anyway (docs/release-binary-catalogs.md). A second source kind arrives\n *   with its first consumer, not before.\n */\nexport const releaseUrl = (repo: string, tag: string, asset: string): string =>\n  `https://github.com/${repo}/releases/download/${tag}/${asset}`;\n\n/** Where a declaration puts its binary: `<directory>/<name>`. */\nexport const releaseBinaryPath = (props: {\n  readonly directory: string;\n  readonly name: string;\n}): string => `${props.directory}/${props.name}`;\n\n/** The download a declaration means. ⚠️ Validate first (binaryProblems): this trusts its input. */\nexport const pinnedDownload = (props: ReleaseBinaryProps): PinnedDownload => ({\n  member: props.member,\n  memberSha256: props.sha256,\n  sha256: props.archive.sha256,\n  size: props.archive.size,\n  url: releaseUrl(props.archive.repo, props.archive.tag, props.archive.asset),\n  // ⚠️ exactOptionalPropertyTypes: never spell out `root: undefined`; leave the key off entirely.\n  ...(props.archive.root === undefined ? {} : { root: props.archive.root }),\n});\n\nexport const modeProblems = (mode: number): string[] => {\n  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 0o7777) return ['mode must be 0–0o7777'];\n  const found: string[] = [];\n  if ((mode & 0o7000) !== 0) found.push('mode must not set setuid, setgid or sticky');\n  if ((mode & 0o022) !== 0) found.push('mode must not be group- or world-writable');\n  if ((mode & 0o100) === 0) found.push('mode must let the owner execute it');\n  // ⛔ AND READ IT: every plan re-hashes the binary, and a write is read back. MEASURED 2026-09-22,\n  //   an execute-only 0111 written by a non-root operator failed its read-back with EACCES.\n  if ((mode & 0o400) === 0) found.push('mode must let the owner read it (it is re-hashed)');\n  return found;\n};\n\n// `pinProblems` (imported above, for `binaryProblems` below) and the constant it needs,\n// `MAX_ARCHIVE`, moved to binary-pins.ts, split out to stay under the file-size cap; re-exported\n// here so every importer of './binary-form.ts' is unchanged.\nexport { MAX_ARCHIVE, pinProblems } from './binary-pins.ts';\n\n// ★ 'root' JOINED THIS LIST 2026-09-23. A state row from before this unit has no `root` at all\n//   (`undefined`), and `undefined !== undefined` is false, so an old row with no root and a new\n//   declaration that still has none does not move; declaring — or changing — a root does.\nconst ARCHIVE_KEYS = ['repo', 'tag', 'asset', 'size', 'sha256', 'root'] as const;\n\ntype Pins = Pick<ReleaseBinaryProps, 'archive' | 'member' | 'sha256'>;\n\n/** Whether two declarations pin different bytes: another archive, member or member digest. */\nexport const pinsMoved = (olds: Pins, news: Pins): boolean =>\n  olds.member !== news.member ||\n  olds.sha256 !== news.sha256 ||\n  ARCHIVE_KEYS.some((key) => olds.archive[key] !== news.archive[key]);\n\n/**\n * ⛔ A NEW PIN IS A NEW PATH. The same path with other bytes would overwrite a binary under the\n *   daemon running it, and leave no rollback but a re-download — so it is refused, at plan when the\n *   path is resolved (binary-diff.ts) and at apply otherwise (binary-lifecycle.ts).\n */\nexport const inPlaceRefusal = (olds: Pins, news: Pins): string =>\n  `a new pin (${news.archive.tag} ${news.member} ${news.sha256}) at the path of the installed ` +\n  `one (${olds.archive.tag} ${olds.member} ${olds.sha256}) would overwrite it in place; give each ` +\n  'version its own directory (catalogDirectory), so an upgrade is a new path';\n\n/** Everything wrong with a declaration, before any host or network is asked anything. */\nexport const binaryProblems = (props: ReleaseBinaryProps): string[] => [\n  ...pinProblems(props),\n  ...pathProblems(props.directory).map((problem) => `directory: ${problem}`),\n  ...modeProblems(props.mode ?? DEFAULT_BINARY_MODE),\n  ...identityProblems('owner', props.owner),\n  ...identityProblems('group', props.group),\n];\n",
     "/**\n * `Release.Binary` — one binary out of a pinned release archive, written onto a host and verified\n * twice: the archive against its pinned SHA-256, then the binary against its own.\n *\n * - reconcile — validate every prop; download the archive by its exact URL; verify it; unpack ONLY\n *   the declared member; verify that; write it atomically through the HostRunner; read it back. A\n *   file already holding the pinned bytes is never downloaded again.\n * - read — lstat plus the SHA-256 of the bytes; never runs the binary.\n * - diff — the pins, the path, then mode and owner against the live file (binary-diff.ts).\n * - replace — when the path moves (a new version is a new directory): create-before-delete.\n * - delete — removes the file, never the directory.\n *\n * ★ VENDOR-NEUTRAL. The pinned archive arrives as props, usually from a data set beside this\n *   (victoria.ts) through `catalogBinary()`; nothing here knows a vendor, a package or a version.\n * ⛔ IT INSTALLS; IT NEVER STARTS. No launchctl, no systemctl, no restart: the job that runs the\n *   binary is the stack's own `LaunchdJob`, which puts this resource's `path` in its argv so the\n *   engine installs first and restarts the job when the path moves.\n * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`, AT PLAN OR AT APPLY: the probe reads a file already at\n *   the path as `Unowned` — even one holding exactly the pinned bytes (docs/ownership.md) — and\n *   where the probe never ran (a prop was an Output) reconcile refuses it the same way. With\n *   `--adopt`, a file holding the pinned bytes is recognised by its digest and taken over without\n *   a download. ⛔ A file with OTHER bytes is never adopted, `--adopt` or not: that would be an\n *   overwrite in place that the plan prints as `adopted` (binary-claim.ts, both halves).\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport { lift } from '../launchd/host-effect.ts';\nimport { HostRunnerService } from '../launchd/runner.ts';\nimport { adoptsAtApply } from '../ownership/adopt.ts';\nimport { noteUnfinished } from '../ownership/resume.ts';\nimport { diffBinary } from './binary-diff.ts';\nimport {\n  type ReleaseBinaryAttributes,\n  type ReleaseBinaryProps,\n  releaseBinaryPath,\n} from './binary-form.ts';\nimport {\n  NOTHING,\n  deleteBinary,\n  reconcileBinary,\n  refreshBinary,\n  refuse,\n} from './binary-lifecycle.ts';\nimport { readWithoutState } from './binary-read.ts';\nimport { declaredPinProblems } from './declared-pins.ts';\nimport { type DownloadPolicy, httpFetchArchive, sharingInFlight } from './download.ts';\n\nexport type { ReleaseBinaryAttributes, ReleaseBinaryProps } from './binary-form.ts';\n\nexport interface ReleaseBinary extends Resource<\n  'Release.Binary',\n  ReleaseBinaryProps,\n  ReleaseBinaryAttributes\n> {}\n\n/**\n * One binary from a pinned release archive, installed onto a host and verified against digests\n * the stack pins in code — the archive's, then the binary's own.\n *\n * ### Installing a binary\n *\n * The directory is declared first and passed by its `path`, which orders the two; the job that\n * runs the binary references the binary's `path`, which orders the job after it.\n *\n * **Example:**\n *\n * ```ts\n * const vmalertOf = { package: 'vmutils', version: '1.151.0', platform: 'darwin-arm64', binary: 'vmalert' };\n * const dir = yield* HostDirectory('vmutils-1.151.0', {\n *   path: catalogDirectory('/opt/example/bin', vmalertOf),\n *   mode: 0o755,\n * });\n * const vmalert = yield* ReleaseBinary('vmalert', {\n *   ...catalogBinary(VICTORIA_RELEASES, vmalertOf),\n *   directory: dir.path,\n * });\n * // LaunchdJob(…, { programArguments: [vmalert.path, '--httpListenAddr=127.0.0.1:8880'] })\n * ```\n *\n * @resource\n */\nexport const ReleaseBinary = Resource<ReleaseBinary>('Release.Binary');\n\n/** Test seams — NOT on the barrel. Every caller outside tests uses the defaults. */\nexport type ReleaseBinaryInternals = { readonly download?: DownloadPolicy };\n\nexport const makeReleaseBinaryProvider = (internals: ReleaseBinaryInternals = {}) =>\n  Provider.effect(\n    ReleaseBinary,\n    Effect.gen(function* () {\n      const runner = yield* HostRunnerService;\n      const client = yield* HttpClient.HttpClient;\n      const fetch = sharingInFlight(httpFetchArchive(client, internals.download));\n      /**\n       * ⛔ ONE PATH, ONE DECLARATION. MEASURED 2026-09-22 (binary-claims.test.ts, before this): two\n       *   resources installing one path in one deploy both planned `create`, shared one download,\n       *   and both recorded the file as theirs. Dropping either later — gating vmalert-logs off\n       *   along with its own ReleaseBinary, say — deleted the file the other still declared, and\n       *   that deploy reported the survivor `noop`. So a second resource claiming a path in the\n       *   same run is refused before it touches anything. Two jobs that run one binary share ONE\n       *   ReleaseBinary. ⚠️ Keyed by spelling: one file under two spellings is not caught here.\n       */\n      const claims = new Map<string, string>();\n      const claim = (fqn: string, props: ReleaseBinaryProps): void => {\n        const path = releaseBinaryPath(props);\n        const holder = claims.get(path);\n        if (holder !== undefined && holder !== fqn) {\n          throw refuse(\n            path,\n            `is already installed by ${holder} in this deploy; declare each binary path once, ` +\n              `and let every job that runs it share that one resource. ${NOTHING}`,\n          );\n        }\n        claims.set(path, fqn);\n      };\n      return ReleaseBinary.Provider.of({\n        list: () => Effect.succeed([]),\n\n        // ⛔ The probe (no `output`) validates every prop first, so a malformed pin fails the plan\n        //   here — before any host call, let alone a download. A recovery read never fails its\n        //   caller (binary-read.ts): its props are the failed deploy's.\n        read: ({ fqn, instanceId, olds, output }) =>\n          output === undefined\n            ? readWithoutState(runner, { fqn, instanceId, olds })\n            : lift(() => refreshBinary(runner, output)),\n\n        diff: ({ instanceId, news, olds, output }) =>\n          output === undefined\n            ? noteUnfinished(instanceId)\n            : lift(() => diffBinary(runner, news, olds, output)),\n\n        // ★ `--adopt` reaches the apply too: the probe never ran for a create with an Output prop.\n        // ⛔ So do the pins AS DECLARED: `news` is resolved by now, and a first deploy is never\n        //   diffed, so only the stack's own record can show a digest that was an Output.\n        reconcile: ({ fqn, instanceId, news, olds, output, session }) =>\n          Effect.gen(function* () {\n            const declared = yield* declaredPinProblems(fqn);\n            const adopt = yield* adoptsAtApply({ fqn, instanceId, output });\n            return yield* lift(async () => {\n              claim(fqn, news);\n              return reconcileBinary(runner, fetch, news, {\n                adopt,\n                declared,\n                note: (message) => Effect.runPromise(session.note(message)),\n                olds,\n                output,\n              });\n            });\n          }),\n\n        /**\n         * ⛔ NEVER REMOVE A FILE ANOTHER DECLARATION INSTALLED IN THIS DEPLOY. Alchemy runs every\n         *   delete (Apply.ts collectGarbage, Phase 2) only after every reconcile has succeeded, so a\n         *   claim by another name means the file is that resource's now, verified as its pin.\n         *   🔴 MEASURED 2026-09-22 (adopt-parity.test.ts): a rename under --adopt — the new name\n         *   claimed the file, the old name's orphan delete removed it, and the deploy succeeded\n         *   with the binary gone. ★ Left in place rather than removed: a stray file is a tidy-up, a\n         *   missing binary is an outage. ⚠️ Keyed by spelling, like the claims themselves.\n         * ★ A deleted resource gives its claim back, so a provider that outlives one deploy never\n         *   refuses the next resource declared at that path.\n         */\n        delete: ({ fqn, output, session }) =>\n          lift(async () => {\n            const holder = claims.get(output.path);\n            if (holder !== undefined && holder !== fqn) {\n              await Effect.runPromise(\n                session.note(`${output.path} was installed by ${holder} in this deploy; kept`),\n              );\n              return;\n            }\n            await deleteBinary(runner, output);\n            if (holder === fqn) claims.delete(output.path);\n          }),\n      });\n    }),\n  );\n\n/** The provider, as a stack uses it. It needs a HostRunnerService and an HttpClient. */\nexport const ReleaseBinaryProvider = () => makeReleaseBinaryProvider();\n",
     "/**\n * The one place a HostRunner's promises become Effects — plus the one probe of an unresolved\n * `news` both providers' diffs share. (The engine's adopt setting lives in ownership/adopt.ts.)\n *\n * ★ The lifecycle files are plain async functions over a HostRunner (see runner.ts for why the\n *   runner is promise-based), so each provider handler is a single `lift(() => step(runner, …))`.\n * ⚠️ A thrown Error stays that Error — its message is the refusal a deploy prints. Anything else\n *   thrown is wrapped, so the failure channel is always an Error with a readable message.\n */\nimport * as Effect from 'effect/Effect';\n\nexport const lift = <A>(step: () => Promise<A>): Effect.Effect<A, Error> =>\n  Effect.tryPromise({\n    catch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),\n    try: step,\n  });\n\n/**\n * A string prop of a diff's `news`, when that one prop is already resolved; `undefined` while it\n * is still an Output (a function-typed proxy), an Effect or a Config.\n * ★ For the identity props a diff must see even when the rest of `news` is unresolved — a plain\n *   string is resolved by definition, so `typeof` is the whole test.\n */\nexport const resolvedString = (news: unknown, key: string): string | undefined => {\n  if (typeof news !== 'object' || news === null) return undefined;\n  const value = (news as Record<string, unknown>)[key];\n  return typeof value === 'string' ? value : undefined;\n};\n",
     "/**\n * The one seam between the launchd providers and the host: every file read, file write and\n * `launchctl` call goes through a HostRunner, and nothing in this directory touches the host any\n * other way.\n *\n * ★ WHY A SEAM AND NOT DIRECT node:fs CALLS. launchd has no SDK — the provider renders a plist and\n *   drives `launchctl` — so the only way to test the lifecycle without a real launchd (and without\n *   writing /Library) is to swap the host out. fake-runner.ts is an in-memory host with a scripted\n *   launchd; local-runner.ts is the real one. The same seam is where a consumer plugs in a runner\n *   that reaches a host some other way.\n *\n * ★ PROMISES, NOT EFFECTS, ON PURPOSE. A consumer writing their own runner implements plain async\n *   functions; the providers lift them into Effect at the call site (host-effect.ts).\n */\nimport * as Context from 'effect/Context';\nimport * as Layer from 'effect/Layer';\n\n/** One finished process. ⛔ `stdout` may carry anything the job's environment holds — never log it. */\nexport type ExecResult = {\n  readonly exitCode: number;\n  readonly stdout: string;\n  readonly stderr: string;\n};\n\n/**\n * What `lstat` says about a path. ⚠️ lstat, not stat: a symlink is reported as a symlink, because\n *   writing through one would change a file this resource never named.\n */\nexport type FileStat = {\n  readonly kind: 'file' | 'directory' | 'symlink' | 'other';\n  /** Permission bits only (`& 0o7777`), never the file-type bits. */\n  readonly mode: number;\n  readonly uid: number;\n  readonly gid: number;\n  readonly size: number;\n  /**\n   * The entry's identity, device and inode, when the runner can say. ★ Two spellings of ONE file\n   *   (`/tmp/x` and `/private/tmp/x`; `Bin` and `bin` on case-insensitive APFS) differ as strings\n   *   and match here, and a move must not delete its old path when that path IS the new file\n   *   (file-identity.ts). Optional: a runner that leaves them out gets a check after the fact.\n   */\n  readonly dev?: number;\n  readonly ino?: number;\n};\n\nexport type WriteOptions = {\n  /**\n   * Permission bits for the final file. localRunner applies them BEFORE the file is visible at\n   * `path`. ⚠️ sudoRunner's `install -S` does NOT: MEASURED 2026-09-22 on macOS 27.2 (an lstat\n   *   poller racing /usr/bin/install), the new inode appears at `path` as 0600 and is chmodded\n   *   0.2–0.4 ms later. Never torn, never wider than declared, but briefly not executable.\n   */\n  readonly mode: number;\n  /** Numeric owner; omitted means whoever the runner writes as. */\n  readonly uid?: number;\n  /** Numeric group; omitted means the directory's default. */\n  readonly gid?: number;\n};\n\nexport type HostUser = { readonly uid: number; readonly gid: number; readonly home: string };\n\nexport interface HostRunner {\n  /**\n   * ⛔ DECLARED, NEVER INFERRED. `true` only when this runner can do every root-needing call the\n   *   providers make of it: every call already runs as root (a runner that talks to a root helper,\n   *   say), or the runner elevates exactly those calls (sudoRunner). The providers refuse\n   *   system-domain writes unless `effectiveUid()` is 0 or this is `true`, so claiming it falsely\n   *   turns that refusal into an EACCES halfway through a deploy.\n   * ⛔ THE KIT NEVER ELEVATES SILENTLY. localRunner() never calls `sudo`: a deploy that prompts for\n   *   a password mid-plan, or quietly borrows a cached sudo ticket, is exactly the \"no silent sudo\"\n   *   failure. sudoRunner() does call `sudo -n`, but only when a stack passes it explicitly, only\n   *   for the argv shapes in sudo-allowlist.ts, and logging each one (decided 2026-09-21).\n   */\n  readonly privileged: boolean;\n  /** The uid file writes and launchctl calls run as. */\n  effectiveUid(): number;\n  /** Run a program with an argv — ⛔ never through a shell. */\n  exec(argv: readonly string[]): Promise<ExecResult>;\n  /** File bytes, or `undefined` when nothing is at `path`. */\n  readFile(path: string): Promise<Uint8Array | undefined>;\n  /** lstat, or `undefined` when nothing is at `path`. */\n  stat(path: string): Promise<FileStat | undefined>;\n  /**\n   * Write `bytes` so that `path` holds either the old file or the new one, never a torn mix:\n   * a temporary file in the same directory, mode and owner set on it, then rename(2) over `path`\n   * (sudoRunner: the mode just after the rename, measured — see WriteOptions.mode; the owner too,\n   * ⚠️ REASONED NOT MEASURED, since measuring it needs root).\n   * ⚠️ The parent directory must exist; creating it would invent an owner and mode nobody declared.\n   */\n  writeFileAtomic(path: string, bytes: Uint8Array, options: WriteOptions): Promise<void>;\n  /**\n   * PLAN TIME: refuse, reading only and writing nothing, a write this runner would refuse at\n   * apply — so the plan shows it before any resource is applied. Optional: a runner without it\n   * refuses at the write. ★ sudoRunner implements it with the checks it makes before `sudo -n`;\n   *   ⛔ it never elevates, so a plan still never calls sudo.\n   */\n  checkWrite?(path: string, options: WriteOptions): Promise<void>;\n  /** Remove a file. Idempotent: nothing at `path` is success. */\n  removeFile(path: string): Promise<void>;\n  /** A user by name or numeric id, or `undefined` when the host has none. */\n  lookupUser(nameOrId: string): Promise<HostUser | undefined>;\n  /** A group's gid by name or numeric id, or `undefined` when the host has none. */\n  lookupGroup(nameOrId: string): Promise<number | undefined>;\n  /** Wait between launchctl polls. ★ Injected so a test never sleeps for real. */\n  sleep(ms: number): Promise<void>;\n}\n\n/** The Effect service every launchd provider reads its runner from. */\nexport class HostRunnerService extends Context.Service<HostRunnerService, HostRunner>()(\n  'homeflare/launchd/HostRunner',\n) {}\n\n/** Provide a runner to the providers: `Layer.provide(hostRunnerLayer(localRunner()))`. */\nexport const hostRunnerLayer = (runner: HostRunner): Layer.Layer<HostRunnerService> =>\n  Layer.succeed(HostRunnerService, runner);\n\n/** True when this runner may write root-owned paths and drive the system domain. */\nexport const canActAsRoot = (runner: HostRunner): boolean =>\n  runner.privileged || runner.effectiveUid() === 0;\n",
@@ -19,18 +20,18 @@
     "/**\n * The one path a declared file's bytes take onto a host, shared by every resource that owns ONE\n * whole file: `Host.File` (text it was handed) and `Release.Binary` (bytes it downloaded and\n * verified). Read, diff, converge and delete, as plain async functions over a HostRunner.\n *\n * ★ EXTRACTED FROM host-file-lifecycle.ts, NOT COPIED (2026-09-22). The ownership rules below — a\n *   file this resource does not own is never overwritten, a move onto an occupied path stays\n *   refused, a failed create is rolled back — were red-teamed on Host.File (docs/ownership.md). A\n *   second resource that writes a whole file gets them by calling this, so a fix lands in both.\n * ★ THE BYTES ARE ASKED FOR ONLY WHEN A WRITE IS DUE (`bytesFor`). Host.File has them already; a\n *   binary has only a pinned digest until it downloads, and a host whose file already matches\n *   must not cost a 120 MB download to prove it.\n * ⛔ SYMLINKS AND DIRECTORIES ARE REFUSED, NOT REPLACED. rename(2) over a symlink replaces the LINK,\n *   so a path that is a symlink (nix-darwin's /etc entries point into /nix/store) would be quietly\n *   taken from the tool that owns it — which puts it back, or refuses its next activation. Remove\n *   the path from its owner first, then declare it here.\n */\nimport type { Diff } from 'alchemy/Diff';\nimport { leaveOldPath, oneFile } from './file-identity.ts';\nimport type { HostFileAttributes } from './host-file-form.ts';\nimport { sha256Hex } from './job-form.ts';\nimport { type HostRunner, type WriteOptions, canActAsRoot } from './runner.ts';\n\n/** What a whole file must be: where, which bytes (by digest), which mode and owner. */\nexport type FileTarget = {\n  readonly path: string;\n  readonly sha256: string;\n  readonly mode: number;\n  readonly uid?: number;\n  readonly gid?: number;\n};\n\n/** A family's refusal: `<Type> <path>: <message>`, so a deploy log names the resource that said no. */\nexport type Refuse = (path: string, message: string) => Error;\n\nconst numericId = (value: string | number): number | undefined =>\n  typeof value === 'number' ? value : /^\\d+$/.test(value) ? Number(value) : undefined;\n\n/** Resolve a declared owner and group (names or ids) to ids through the runner. */\nexport const resolveIds = async (\n  runner: HostRunner,\n  declared: { readonly owner?: string | number; readonly group?: string | number },\n  path: string,\n  refuse: Refuse,\n): Promise<{ uid?: number; gid?: number }> => {\n  let uid: number | undefined;\n  let gid: number | undefined;\n  if (declared.owner !== undefined) {\n    uid = numericId(declared.owner) ?? (await runner.lookupUser(String(declared.owner)))?.uid;\n    if (uid === undefined) throw refuse(path, `no user ${String(declared.owner)} on this host`);\n  }\n  if (declared.group !== undefined) {\n    gid = numericId(declared.group) ?? (await runner.lookupGroup(String(declared.group)));\n    if (gid === undefined) throw refuse(path, `no group ${String(declared.group)} on this host`);\n  }\n  return { ...(uid === undefined ? {} : { uid }), ...(gid === undefined ? {} : { gid }) };\n};\n\n/** The file as it is now, or `undefined` when nothing is at the path. Non-files read with no digest. */\nexport const readFileAttributes = async (\n  runner: HostRunner,\n  path: string,\n): Promise<HostFileAttributes | undefined> => {\n  const stat = await runner.stat(path);\n  if (stat === undefined) return undefined;\n  const bytes = stat.kind === 'file' ? await runner.readFile(path) : undefined;\n  return {\n    gid: stat.gid,\n    mode: stat.mode,\n    path,\n    sha256: bytes === undefined ? '' : sha256Hex(bytes),\n    size: stat.size,\n    uid: stat.uid,\n  };\n};\n\nexport const writeOptionsOf = (want: FileTarget): WriteOptions => ({\n  mode: want.mode,\n  ...(want.uid === undefined ? {} : { uid: want.uid }),\n  ...(want.gid === undefined ? {} : { gid: want.gid }),\n});\n\nexport const fileMatches = (live: HostFileAttributes, want: FileTarget): boolean =>\n  live.sha256 === want.sha256 &&\n  live.mode === want.mode &&\n  (want.uid === undefined || live.uid === want.uid) &&\n  (want.gid === undefined || live.gid === want.gid);\n\n/**\n * ★ A PLAN THAT WILL WRITE ASKS THE RUNNER FIRST (`checkWrite`, when it has one): sudoRunner's\n *   refusals — a setuid or group-writable root file, a directory under a prefix another user may\n *   change — then fail the plan, before any resource is applied, instead of halfway through it.\n */\nexport const diffTarget = async (\n  runner: HostRunner,\n  want: FileTarget,\n  output: HostFileAttributes,\n): Promise<Diff> => {\n  const writes = async (diff: Diff): Promise<Diff> => {\n    await runner.checkWrite?.(want.path, writeOptionsOf(want));\n    return diff;\n  };\n  // ★ Create-before-delete: two paths can hold two files at once, so nothing forces deleteFirst.\n  // ⛔ …unless the two paths are ONE file (file-identity.ts). That is a respelling, not a move: a\n  //   replace would let Phase 2 delete the old generation's path, which is the new one's file. An\n  //   update records the new spelling, and convergeFile keeps the file.\n  if (want.path !== output.path) {\n    const same = await oneFile(runner, want.path, output.path);\n    return writes({ action: same === true ? 'update' : 'replace' });\n  }\n  if (want.sha256 !== output.sha256) return writes({ action: 'update' });\n  const live = await readFileAttributes(runner, want.path);\n  return live !== undefined && fileMatches(live, want)\n    ? { action: 'noop' }\n    : writes({ action: 'update' });\n};\n\nexport type Converge = {\n  readonly want: FileTarget;\n  /** The owner as declared (a name or an id), for the chown refusal's wording. */\n  readonly owner?: string | number | undefined;\n  /** The bytes to write, asked for only when a write is due; `before` is what is there now. */\n  readonly bytesFor: (before: HostFileAttributes | undefined) => Promise<Uint8Array>;\n  readonly refuse: Refuse;\n};\n\n/**\n * Make the file at `want.path` match `want`, and return it as read back.\n *\n * `adopt` is whether adoption is on AND this apply is a create or an unfinished generation of our\n * own (ownership/adopt.ts adoptsAtApply). It lets such a generation take over a file already at the\n * path — the takeover the plan's probe would have allowed, had it run. ⛔ A move onto an occupied\n *   path stays refused, both ways the engine drives one: an `update` across the move (`moved`,\n *   below), and a fresh replace's new generation, which the caller never marks adoptable (its\n *   `output` is undefined too, so this function cannot tell it from a create by itself).\n */\nexport const convergeFile = async (\n  runner: HostRunner,\n  spec: Converge,\n  output?: HostFileAttributes,\n  adopt = false,\n): Promise<HostFileAttributes> => {\n  const { want, refuse } = spec;\n  const path = want.path;\n  // ⛔ NO SILENT SUDO: handing a file to another user is root's call (chown(2)), so say so up front.\n  if (want.uid !== undefined && want.uid !== runner.effectiveUid() && !canActAsRoot(runner)) {\n    throw refuse(\n      path,\n      `owner ${String(spec.owner)} is not the deploying user; only root may chown. Deploy as root ` +\n        'or through a privileged HostRunner (sudoRunner() with this path under a prefix). This ' +\n        'provider never calls sudo itself.',\n    );\n  }\n  const stat = await runner.stat(path);\n  if (stat !== undefined && stat.kind !== 'file') {\n    throw refuse(\n      path,\n      `is a ${stat.kind}; remove it from whatever owns it before declaring it here`,\n    );\n  }\n  const before = stat === undefined ? undefined : await readFileAttributes(runner, path);\n  // ⚠️ An `output` at another path: the engine planned an UPDATE across a move, which it does\n  //   when diff could not see the new path (host-file.ts). Finish it the way a replace would.\n  //   ★ A respelling of ONE file (file-identity.ts) still counts as moved here, so a file there\n  //   that does not match is refused below — never rewritten in place under the old spelling's pins.\n  const moved = output !== undefined && output.path !== path;\n  const prior = moved ? undefined : output;\n  /**\n   * ⛔ A FILE THIS RESOURCE DOES NOT OWN IS NEVER OVERWRITTEN. With no prior state for this path,\n   *   the engine's adoption probe has already refused anything it found — except where it never\n   *   looked: the new path of a replace, and a create whose props still held an Output at plan\n   *   time. A path typo there would otherwise overwrite, say, a system file that a fresh\n   *   declaration of the same path would have been refused as `Unowned`. ★ With adoption on, a\n   *   create takes it over, as the probe would have let it (decided 2026-09-21).\n   */\n  const takeOver = adopt && output === undefined;\n  if (prior === undefined && before !== undefined && !fileMatches(before, want) && !takeOver) {\n    throw refuse(\n      path,\n      'already exists and is not this resource. Remove it, or declare it as a new resource and ' +\n        'deploy with --adopt.',\n    );\n  }\n  if (before === undefined || !fileMatches(before, want)) {\n    const bytes = await spec.bytesFor(before);\n    // ⛔ THE ONE WRITER NEVER WRITES BYTES THAT ARE NOT THE DECLARED ONES. Host.File's always are;\n    //   a supplier that verifies elsewhere (a download) is held to the same digest here, last.\n    if (sha256Hex(bytes) !== want.sha256) {\n      throw refuse(path, `the bytes to write do not hash to ${want.sha256}. Nothing was written.`);\n    }\n    await runner.writeFileAtomic(path, bytes, writeOptionsOf(want));\n  }\n  // ⚠️ READ BACK, never echo the declaration: a umask, an ACL or a runner that ignored `uid` shows\n  //   up here as a refusal instead of as a forever-`update`.\n  // ⚠️ Roll back a CREATE: left behind, the next plan's recovery `read` finds a file with no state,\n  //   reports it `Unowned`, and every later deploy demands --adopt for our own file. ⛔ Also when\n  //   the read-back THROWS: MEASURED 2026-09-22, a 0111 binary written as a non-root operator read\n  //   back EACCES and stayed, and every later plan's probe failed with the same EACCES.\n  const rollBack = async () => {\n    if (before === undefined) await runner.removeFile(path).catch(() => undefined);\n  };\n  const after = await readFileAttributes(runner, path).catch(async (cause: unknown) => {\n    await rollBack();\n    throw refuse(path, `the write returned but reading it back failed: ${String(cause)}`);\n  });\n  if (after === undefined || !fileMatches(after, want)) {\n    await rollBack();\n    throw refuse(path, 'the write returned but the file on disk does not match the declaration');\n  }\n  // ★ Create-before-delete, as the replace would have been: the old path goes only once the new\n  //   one is written and verified — and ⛔ never when the old path IS this file (file-identity.ts).\n  if (moved)\n    await leaveOldPath(\n      runner,\n      output.path,\n      path,\n      () => removeWholeFile(runner, output, refuse),\n      refuse,\n    );\n  return after;\n};\n\n/** Remove the file. Idempotent. ⛔ Refuses a path that has since become a symlink or directory. */\nexport const removeWholeFile = async (\n  runner: HostRunner,\n  output: HostFileAttributes,\n  refuse: Refuse,\n): Promise<void> => {\n  const stat = await runner.stat(output.path);\n  if (stat === undefined) return;\n  if (stat.kind !== 'file') throw refuse(output.path, `is now a ${stat.kind}; not removing it`);\n  await runner.removeFile(output.path);\n};\n",
     "/**\n * What a Release.Binary may take over at a path it holds no state for: ONLY the pinned binary, and\n * only under `--adopt`. Asked the same way at plan (binary-diff.ts) and at apply\n * (binary-lifecycle.ts), so a plan never says `adopted` or `create` for a file the apply would then\n * overwrite or silently claim.\n *\n * ⛔ OTHER BYTES ARE NEVER ADOPTED, `--adopt` OR NOT. 🔴 MEASURED 2026-09-22 (adopt-parity.test.ts,\n *   through Alchemy's own Plan and Apply): under `--adopt`, a file with other bytes at the path\n *   planned as `adopted` — beta.79 forces an `adopted` update after every takeover and prints it for\n *   drift too — and the apply downloaded the archive and overwrote that file in place. With the\n *   directory an Output (the probe skipped) the same file planned as `create`, and was overwritten.\n *   ★ Refused rather than converged, which is what Host.File does with a file it adopts: a binary's\n *   content is named entirely by its pin, so \"adopting\" other bytes is replacing them under\n *   whatever runs them, with no rollback but a re-download — the very overwrite binary-form.ts\n *   inPlaceRefusal refuses for a re-pin. The pinned bytes with another mode or owner ARE adopted;\n *   the apply re-writes the bytes already on disk.\n * ⛔ THE PINNED BYTES WITH NO STATE ARE NOT OURS WITHOUT `--adopt` — AT APPLY AS AT PLAN. The probe\n *   already says `Unowned` for them (docs/ownership.md: identical is not ours). file-converge.ts\n *   accepts them at apply as the resume of an interrupted install, and that gap is where the probe\n *   never runs: every first deploy that passes `directory: dir.path`. 🔴 MEASURED 2026-09-22: a\n *   declaration renamed (a new logical id, the same path) in a deploy that also changed its\n *   HostDirectory's mode claimed the identical file at apply without `--adopt`; the orphan delete of\n *   the old name then removed it, and the deploy reported success with the binary gone. With the\n *   directory unchanged, the probe refused that same rename.\n *   ⚠️ THE COST: an install interrupted between its write and its commit while a prop was an\n *   Output now resumes only with `--adopt` — as the same install with every prop resolved already\n *   did (its recovery read is `Unowned`), and as ownership.md says a create or replace interrupted\n *   while a prop was an Output does. A retained old version is not re-claimed by a rollback either.\n *   ★ `renamedFrom()` IS THE REMEDY FOR A RENAME: `.pipe(renamedFrom('old-id'))` migrates the row\n *   and keeps the file (adopt-parity.test.ts). 🔴 MEASURED 2026-09-22: the same rename under\n *   `--adopt` claimed the file, the old name's delete then removed it, and the deploy succeeded\n *   with the binary gone. binary.ts's delete now leaves a path another declaration installed in\n *   the same deploy, so that is kept too — as an adoption, not as the old row. ⚠️ That guard sees\n *   only this deploy's claims, by spelling; nothing here sees another row's claim in state.\n * ★ HOW DIFF TELLS A TAKEOVER FROM ITS OWN ROW. Every row this resource commits records the digest\n *   reconcile READ BACK, which it checked equal to the pin — so `output.sha256 === olds.sha256` for\n *   every row of its own, and an update never changes the digest (a new digest is a new path, a\n *   `replace`). The engine hands diff anything else only after a read of a path it holds no state\n *   for: the adoption probe (`olds` = the declaration) or the recovery read of an interrupted\n *   create (`olds` = its row). A non-file reads with digest '' (file-converge.ts).\n */\nimport { type FileTarget, readFileAttributes } from '../launchd/file-converge.ts';\nimport type { HostRunner } from '../launchd/runner.ts';\n\nconst TAKEN = 'already exists and is not this resource';\n\nconst otherBytes = (found: string, pinned: string): string =>\n  `${found === '' ? 'something that is not a regular file' : `a file hashing to ${found}`} is ` +\n  `there, not the pinned binary (${pinned}). --adopt takes over only the pinned binary: taking ` +\n  'over other bytes would overwrite them in place. Remove it (or move it aside) and deploy again';\n\n/** Plan side: why diff must refuse `found` — a digest read at a path with no state — or undefined. */\nexport const adoptionProblem = (found: string, pinned: string): string | undefined =>\n  found === pinned ? undefined : `${TAKEN}: ${otherBytes(found, pinned)}`;\n\n/**\n * Apply side, for a reconcile with no `output` — a create, a replace's new generation, or the\n * resume of either: why it must not write, or undefined. `adopt` is adoptsAtApply's answer (never\n * true for a fresh replace). A symlink or directory is left to convergeFile, which refuses it by\n * kind.\n */\nexport const claimProblem = async (\n  runner: HostRunner,\n  want: FileTarget,\n  adopt: boolean,\n): Promise<string | undefined> => {\n  const stat = await runner.stat(want.path);\n  if (stat?.kind !== 'file') return undefined;\n  const found = (await readFileAttributes(runner, want.path))?.sha256 ?? '';\n  if (found !== want.sha256) return adoptionProblem(found, want.sha256);\n  if (adopt) return undefined;\n  return (\n    `${TAKEN}: it holds the pinned binary, but this stack holds no state for it and the plan ` +\n    'could not ask first (a prop was still an Output, or a replace landed on it). ' +\n    'Identical is not ours: once claimed, a later delete removes it from whoever put it there. ' +\n    'Deploy with --adopt to take it over (a create, or an interrupted install of this one), or ' +\n    'remove it. If another declaration in this stack owned it under another name, declare the ' +\n    'rename with renamedFrom() instead'\n  );\n};\n",
     "/**\n * Release.Binary's failures as tagged errors — each carrying the house refusal sentence\n * (`Release.Binary <path>: …`) as its `message`.\n *\n * ★ TAGGED BECAUSE ALCHEMY UPSTREAM REQUIRES IT (its AGENTS.md at v2.0.0-beta.79: Data.TaggedError,\n *   `catchTag`, never a cast on `_tag`), so the classes need no rewrite on the way there. The\n *   MESSAGE stays the kit's wording, so a deploy log reads the same as every other house family's.\n * ⚠️ TAGGED IS NOT YET TYPED END TO END — measured in error-channel.test.ts. catalogBinary() throws,\n *   so in a stack program its BinaryRefused is a DEFECT that `catchTag` never sees; and the provider\n *   runs every lifecycle call through the house `lift()`, which keeps the instance at runtime but\n *   types the channel as `Error`. No caller can name one of these tags today without a cast.\n * ★ THE TAGS NAME NO VENDOR. Downloading a pinned archive, refusing an unsafe one and comparing\n *   digests are the same for every catalog (docs/release-binary-upstream.md).\n */\nimport * as Data from 'effect/Data';\n\n/** The declaration itself: a version no catalog pins, a malformed pin, a bad path or mode. */\nexport class BinaryRefused extends Data.TaggedError('BinaryRefused')<{\n  readonly message: string;\n}> {}\n\n/** The download: a status that is not 200, a body that is not the pinned size, a dead transport. */\nexport class DownloadFailed extends Data.TaggedError('DownloadFailed')<{\n  readonly message: string;\n  /** Worth another attempt: a transport failure or a 5xx, never a wrong size or a 404. */\n  readonly retryable: boolean;\n}> {}\n\n/** Bytes that do not hash to their pin — the archive, or a member extracted from it. */\nexport class ChecksumMismatch extends Data.TaggedError('ChecksumMismatch')<{\n  readonly message: string;\n  readonly subject: string;\n  readonly expected: string;\n  readonly actual: string;\n}> {}\n\n/** An archive this reader will not trust: an unsafe or unexpected entry, a missing member. */\nexport class ArchiveRefused extends Data.TaggedError('ArchiveRefused')<{\n  readonly message: string;\n}> {}\n",
-    "/**\n * A tar reader with one job: hand back the NAMED regular files of a vendor archive, and refuse the\n * whole archive if any entry could make a name mean something other than what it says.\n *\n * ★ IN PROCESS, NOT `tar` ON THE HOST. An exec'd tar writes through its own path — past the\n *   HostRunner seam, past sudoRunner's allowlist, and past the member digest check, which has to\n *   see the bytes BEFORE they exist on any disk. Nothing this file reads is ever written by it.\n * ★ STREAMING. It is fed the gunzip output chunk by chunk; an entry nobody asked for is counted\n *   past, never held. vmutils unpacks to 264 MB across seven binaries (measured 2026-09-22) and a\n *   stack wants two, so the unpacked archive never exists whole in memory.\n * ⛔ REFUSED, WHOLE ARCHIVE, whichever entry it is and whether or not it was asked for:\n *   an absolute name; a `..` segment; a hard link, symlink, directory, device, FIFO or contiguous\n *   file (only a regular file is accepted); a name given twice; a header whose checksum fails; a\n *   size in GNU base-256; a header that is neither ustar nor GNU; a lone zero block between entries;\n *   non-zero bytes after the end marker; an archive that stops before it.\n * ★ GNU LONG NAMES ('L', 'K') AND PAX HEADERS ('x', 'g') ARE REFUSED, NOT INTERPRETED. Each renames\n *   the entry after it: a reader that honours them must get them exactly right to match exactly,\n *   and one that skips them matches under the wrong name. The four pinned archives use neither\n *   (measured 2026-09-22 with `tar -tvzf` on each: every entry a root-level regular file with a\n *   short name), so refusing costs nothing today, and a vendor format change becomes a refusal that\n *   says what changed instead of a silent mis-read.\n */\nimport { ArchiveRefused } from './refused.ts';\n\nconst BLOCK = 512;\n\nconst KINDS: Readonly<Record<string, string>> = {\n  '1': 'a hard link',\n  '2': 'a symlink',\n  '3': 'a character device',\n  '4': 'a block device',\n  '5': 'a directory',\n  '6': 'a FIFO',\n  '7': 'a contiguous file',\n  K: 'a GNU long-link header',\n  L: 'a GNU long-name header',\n  g: 'a PAX global header',\n  x: 'a PAX extended header',\n};\n\nconst refuse = (message: string): ArchiveRefused => new ArchiveRefused({ message });\nconst strict = new TextDecoder('utf-8', { fatal: true });\nconst ascii = new TextDecoder('latin1');\n\n/** One NUL-terminated header field. */\nconst field = (block: Uint8Array, start: number, length: number): Uint8Array => {\n  const slice = block.subarray(start, start + length);\n  const end = slice.indexOf(0);\n  return end === -1 ? slice : slice.subarray(0, end);\n};\n\nconst text = (block: Uint8Array, start: number, length: number): string => {\n  try {\n    return strict.decode(field(block, start, length));\n  } catch {\n    throw refuse('an entry name is not UTF-8');\n  }\n};\n\nconst octal = (block: Uint8Array, start: number, length: number, what: string): number => {\n  const raw = block.subarray(start, start + length);\n  if (((raw[0] ?? 0) & 0x80) !== 0) throw refuse(`${what} is base-256 encoded`);\n  const digits = ascii\n    .decode(raw)\n    .replace(/[\\0 ]+$/, '')\n    .replace(/^ +/, '');\n  if (!/^[0-7]+$/.test(digits)) throw refuse(`${what} is not octal: ${JSON.stringify(digits)}`);\n  return Number.parseInt(digits, 8);\n};\n\nconst checksumHolds = (block: Uint8Array): boolean => {\n  let sum = 0;\n  // The checksum field itself counts as eight spaces (POSIX ustar).\n  for (let at = 0; at < BLOCK; at += 1) sum += at >= 148 && at < 156 ? 0x20 : (block[at] ?? 0);\n  return sum === octal(block, 148, 8, 'a header checksum');\n};\n\n/** Why an entry name is unsafe to trust, or undefined. */\nconst nameProblem = (name: string): string | undefined => {\n  if (name === '') return 'has an empty name';\n  if (name.startsWith('/')) return 'is absolute';\n  if (name.split('/').includes('..')) return 'climbs out of the archive with \"..\"';\n  return undefined;\n};\n\n/** Concatenate chunks into one buffer. */\nexport const concatBytes = (parts: readonly Uint8Array[]): Uint8Array => {\n  const out = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));\n  let at = 0;\n  for (const part of parts) {\n    out.set(part, at);\n    at += part.length;\n  }\n  return out;\n};\n\nexport type TarContents = {\n  /** The asked-for regular files, by exact name. An asked-for name that is absent is absent here. */\n  readonly members: ReadonlyMap<string, Uint8Array>;\n  /** Every entry name, in archive order — so a refusal can say what the archive did hold. */\n  readonly names: readonly string[];\n};\n\n/** A push parser: `push` each chunk of the unzipped stream, then `finish`. Either may throw. */\nexport const tarReader = (wanted: ReadonlySet<string>) => {\n  const header = new Uint8Array(BLOCK);\n  const members = new Map<string, Uint8Array>();\n  const names: string[] = [];\n  const seen = new Set<string>();\n  let phase: 'header' | 'data' | 'pad' | 'end' = 'header';\n  let filled = 0;\n  let remaining = 0;\n  let padding = 0;\n  let zeros = 0;\n  let name = '';\n  let parts: Uint8Array[] | undefined;\n\n  const endEntry = () => {\n    if (parts !== undefined) members.set(name, concatBytes(parts));\n    parts = undefined;\n    phase = padding > 0 ? 'pad' : 'header';\n  };\n\n  const startEntry = () => {\n    if (header.every((byte) => byte === 0)) {\n      zeros += 1;\n      if (zeros === 2) phase = 'end';\n      return;\n    }\n    if (zeros > 0) throw refuse('a zero block sits between entries (truncated or spliced)');\n    if (!checksumHolds(header)) throw refuse('an entry header fails its checksum');\n    const magic = ascii.decode(header.subarray(257, 265));\n    const posix = magic === 'ustar\\u000000';\n    if (!posix && magic !== 'ustar  \\u0000')\n      throw refuse('an entry header is neither ustar nor GNU');\n    const prefix = posix ? text(header, 345, 155) : '';\n    name = prefix === '' ? text(header, 0, 100) : `${prefix}/${text(header, 0, 100)}`;\n    const problem = nameProblem(name);\n    if (problem !== undefined) throw refuse(`entry ${JSON.stringify(name)} ${problem}`);\n    const type = String.fromCharCode(header[156] ?? 0);\n    if (type !== '0' && type !== '\\0') {\n      const kind = KINDS[type] ?? `of unknown type ${JSON.stringify(type)}`;\n      throw refuse(`entry \"${name}\" is ${kind}; only regular files are accepted`);\n    }\n    if (seen.has(name)) throw refuse(`entry \"${name}\" appears twice`);\n    seen.add(name);\n    names.push(name);\n    remaining = octal(header, 124, 12, `entry \"${name}\"'s size`);\n    padding = (BLOCK - (remaining % BLOCK)) % BLOCK;\n    parts = wanted.has(name) ? [] : undefined;\n    phase = 'data';\n    if (remaining === 0) endEntry();\n  };\n\n  const push = (chunk: Uint8Array): void => {\n    let at = 0;\n    while (at < chunk.length) {\n      if (phase === 'end') {\n        if (chunk.subarray(at).some((byte) => byte !== 0)) {\n          throw refuse('data follows the end-of-archive marker');\n        }\n        return;\n      }\n      if (phase === 'header') {\n        const take = Math.min(BLOCK - filled, chunk.length - at);\n        header.set(chunk.subarray(at, at + take), filled);\n        filled += take;\n        at += take;\n        if (filled === BLOCK) {\n          filled = 0;\n          startEntry();\n        }\n      } else if (phase === 'data') {\n        const take = Math.min(remaining, chunk.length - at);\n        // ⚠️ slice, not subarray: a chunk's buffer may be reused by the stream after this returns.\n        parts?.push(chunk.slice(at, at + take));\n        remaining -= take;\n        at += take;\n        if (remaining === 0) endEntry();\n      } else {\n        const take = Math.min(padding, chunk.length - at);\n        padding -= take;\n        at += take;\n        if (padding === 0) phase = 'header';\n      }\n    }\n  };\n\n  const finish = (): TarContents => {\n    if (phase !== 'end') throw refuse('the archive stops before its end-of-archive marker');\n    return { members, names };\n  };\n\n  return { finish, push };\n};\n",
-    "/**\n * A pinned archive, verified, to the one member a declaration names, verified — the order the\n * checks run in is the point of the file.\n *\n *   1. the archive's SHA-256 against its pin — BEFORE a single byte is unpacked;\n *   2. gunzip and tar-read as one stream, keeping only the declared member (tar.ts refuses anything\n *      unsafe in the archive, asked-for or not);\n *   3. that member's SHA-256 against its own pin.\n *\n * ★ BOTH LAYERS, BECAUSE THE VENDOR HASHES BOTH. Each checksum file lists the archive AND every\n *   binary inside it (measured 2026-09-22, all four). The archive check says the download is the\n *   published file; the member check says the bytes about to be written are the published binary —\n *   and it is the only check that still holds if the tar reader were ever wrong about a boundary.\n * ★ DecompressionStream, THE WEB STANDARD: node and bun both ship it, so dist behaves the same\n *   under either runtime — no zlib binding, no dependency.\n * ⛔ IN MEMORY ONLY. Nothing here touches a disk, so no failure below can leave a staged download\n *   behind; the bytes reach a host only through HostRunner.writeFileAtomic (file-converge.ts).\n */\nimport { sha256Hex } from '../launchd/job-form.ts';\nimport type { PinnedDownload } from './binary-form.ts';\nimport { ArchiveRefused, ChecksumMismatch } from './refused.ts';\nimport { type TarContents, tarReader } from './tar.ts';\n\n/** How much gzip is handed to the inflater at a time. */\nconst SLICE = 1 << 20;\n\n/** Gunzip and read a tar, keeping only `wanted`. Throws ArchiveRefused. */\nexport const extractMembers = async (\n  gzipped: Uint8Array,\n  wanted: ReadonlySet<string>,\n): Promise<TarContents> => {\n  const tar = tarReader(wanted);\n  // ⚠️ FED IN SLICES, ON DEMAND. Enqueued whole, the 123.6 MB vmutils archive is inflated in one\n  //   transform step and all 264 MB of output queue up before the first read: MEASURED 2026-09-22,\n  //   a peak RSS of 1116 MB for vmalert alone under bun 1.4.0. `pull` hands over the next slice only\n  //   when the stream asks, so backpressure bounds what is inflated ahead of the tar reader.\n  let offset = 0;\n  const source = new ReadableStream<Uint8Array>({\n    pull(controller) {\n      if (offset >= gzipped.length) {\n        controller.close();\n        return;\n      }\n      controller.enqueue(gzipped.slice(offset, offset + SLICE));\n      offset += SLICE;\n    },\n  });\n  const unzipped = source.pipeThrough(new DecompressionStream('gzip')).getReader();\n  try {\n    for (;;) {\n      const { done, value } = await unzipped.read();\n      if (done) break;\n      tar.push(value);\n    }\n  } catch (cause) {\n    await unzipped.cancel().catch(() => undefined);\n    if (cause instanceof ArchiveRefused) throw cause;\n    throw new ArchiveRefused({ message: `not a gzip stream (${String(cause)})` });\n  }\n  return tar.finish();\n};\n\nconst mismatch = (subject: string, expected: string, actual: string): ChecksumMismatch =>\n  new ChecksumMismatch({\n    actual,\n    expected,\n    message: `${subject} hashes to ${actual}, not the pinned ${expected}`,\n    subject,\n  });\n\n/**\n * The declared member's bytes out of a downloaded archive, both layers checked.\n * ⚠️ `archive` may be shared with another resource's extraction (download.ts sharingInFlight):\n *   this only reads it.\n */\nexport const verifiedMember = async (\n  archive: Uint8Array,\n  release: PinnedDownload,\n): Promise<Uint8Array> => {\n  const archiveSha = sha256Hex(archive);\n  if (archiveSha !== release.sha256) throw mismatch(release.url, release.sha256, archiveSha);\n  const { members, names } = await extractMembers(archive, new Set([release.member]));\n  const bytes = members.get(release.member);\n  if (bytes === undefined) {\n    throw new ArchiveRefused({\n      message: `${release.url} has no member named exactly \"${release.member}\" (it has ${names.map((n) => `\"${n}\"`).join(', ') || 'none'})`,\n    });\n  }\n  const memberSha = sha256Hex(bytes);\n  if (memberSha !== release.memberSha256) {\n    throw mismatch(`member \"${release.member}\"`, release.memberSha256, memberSha);\n  }\n  return bytes;\n};\n",
+    "/**\n * A tar reader with one job: hand back the NAMED regular files of a vendor archive, and refuse the\n * whole archive if any entry could make a name mean something other than what it says.\n *\n * ★ IN PROCESS, NOT `tar` ON THE HOST. An exec'd tar writes through its own path — past the\n *   HostRunner seam, past sudoRunner's allowlist, and past the member digest check, which has to\n *   see the bytes BEFORE they exist on any disk. Nothing this file reads is ever written by it.\n * ★ STREAMING. It is fed the gunzip output chunk by chunk; an entry nobody asked for is counted\n *   past, never held. vmutils unpacks to 264 MB across seven binaries (measured 2026-09-22) and a\n *   stack wants two, so the unpacked archive never exists whole in memory.\n * ⛔ REFUSED, WHOLE ARCHIVE, whichever entry it is and whether or not it was asked for:\n *   an absolute name; a `..` segment; a hard link, symlink, directory, device, FIFO or contiguous\n *   file (only a regular file is accepted); a name given twice; a header whose checksum fails; a\n *   size in GNU base-256; a header that is neither ustar nor GNU; a lone zero block between entries;\n *   non-zero bytes after the end marker; an archive that stops before it.\n * ★ GNU LONG NAMES ('L', 'K') AND PAX HEADERS ('x', 'g') ARE REFUSED, NOT INTERPRETED. Each renames\n *   the entry after it: a reader that honours them must get them exactly right to match exactly,\n *   and one that skips them matches under the wrong name. Refusing costs nothing for an archive\n *   that carries neither, and a vendor format change becomes a refusal that says what changed\n *   instead of a silent mis-read.\n * ★ AN OPTIONAL `root`: ONE DECLARED LEADING DIRECTORY, STRIPPED, NEVER GUESSED. Measured\n *   2026-09-23: `gh api repos/<o>/<r>/releases/tags/<tag>` for each asset URL and digest, the\n *   archive downloaded into a scratch directory (never executed), re-hashed against GitHub's\n *   `digest`, then read by THIS reader (a driver script importing `tarReader`) both before and\n *   after this change — refused whole either way without `root`, and, with it, parsed to\n *   completion: `alertmanager-0.33.1.darwin-arm64.tar.gz` (37,247,168 B),\n *   `blackbox_exporter-0.28.0.darwin-arm64.tar.gz` (15,705,022 B),\n *   `node_exporter-1.12.1.darwin-arm64.tar.gz` (5,368,643 B) and\n *   `postgres_exporter-0.20.1.darwin-arm64.tar.gz` (10,072,235 B) each recompute to GitHub's own\n *   `digest`, and each wraps every entry in exactly one directory (typeflag '5', size 0, first)\n *   named `<binary>-<version>.darwin-arm64/`, holding only root-level regular files (the binary,\n *   `LICENSE`, `NOTICE`, and for alertmanager also `amtool` and `alertmanager.yml`) — no PAX or\n *   GNU long-name entries, so this reader's refusal of both stays exactly as costly as before.\n *   Without `root`, EVERY refusal above still holds byte-for-byte: a directory entry — the wrapper\n *   included — is refused the same way it always was (docs/release-binary-catalogs.md,\n *   docs/release-binary-upstream.md gap 11).\n */\nimport { ArchiveRefused } from './refused.ts';\n\nconst BLOCK = 512;\n\nconst KINDS: Readonly<Record<string, string>> = {\n  '1': 'a hard link',\n  '2': 'a symlink',\n  '3': 'a character device',\n  '4': 'a block device',\n  '5': 'a directory',\n  '6': 'a FIFO',\n  '7': 'a contiguous file',\n  K: 'a GNU long-link header',\n  L: 'a GNU long-name header',\n  g: 'a PAX global header',\n  x: 'a PAX extended header',\n};\n\nconst refuse = (message: string): ArchiveRefused => new ArchiveRefused({ message });\nconst strict = new TextDecoder('utf-8', { fatal: true });\nconst ascii = new TextDecoder('latin1');\n\n/** One NUL-terminated header field. */\nconst field = (block: Uint8Array, start: number, length: number): Uint8Array => {\n  const slice = block.subarray(start, start + length);\n  const end = slice.indexOf(0);\n  return end === -1 ? slice : slice.subarray(0, end);\n};\n\nconst text = (block: Uint8Array, start: number, length: number): string => {\n  try {\n    return strict.decode(field(block, start, length));\n  } catch {\n    throw refuse('an entry name is not UTF-8');\n  }\n};\n\nconst octal = (block: Uint8Array, start: number, length: number, what: string): number => {\n  const raw = block.subarray(start, start + length);\n  if (((raw[0] ?? 0) & 0x80) !== 0) throw refuse(`${what} is base-256 encoded`);\n  const digits = ascii\n    .decode(raw)\n    .replace(/[\\0 ]+$/, '')\n    .replace(/^ +/, '');\n  if (!/^[0-7]+$/.test(digits)) throw refuse(`${what} is not octal: ${JSON.stringify(digits)}`);\n  return Number.parseInt(digits, 8);\n};\n\nconst checksumHolds = (block: Uint8Array): boolean => {\n  let sum = 0;\n  // The checksum field itself counts as eight spaces (POSIX ustar).\n  for (let at = 0; at < BLOCK; at += 1) sum += at >= 148 && at < 156 ? 0x20 : (block[at] ?? 0);\n  return sum === octal(block, 148, 8, 'a header checksum');\n};\n\n/** Why an entry name is unsafe to trust, or undefined. */\nconst nameProblem = (name: string): string | undefined => {\n  if (name === '') return 'has an empty name';\n  if (name.startsWith('/')) return 'is absolute';\n  if (name.split('/').includes('..')) return 'climbs out of the archive with \"..\"';\n  return undefined;\n};\n\n/** Concatenate chunks into one buffer. */\nexport const concatBytes = (parts: readonly Uint8Array[]): Uint8Array => {\n  const out = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));\n  let at = 0;\n  for (const part of parts) {\n    out.set(part, at);\n    at += part.length;\n  }\n  return out;\n};\n\nexport type TarContents = {\n  /** The asked-for regular files, by exact name. An asked-for name that is absent is absent here. */\n  readonly members: ReadonlyMap<string, Uint8Array>;\n  /** Every entry name, in archive order — so a refusal can say what the archive did hold. */\n  readonly names: readonly string[];\n};\n\n/**\n * A push parser: `push` each chunk of the unzipped stream, then `finish`. Either may throw.\n *\n * @param root When given, exactly one typeflag-'5' entry named `<root>/`, size 0, is accepted and\n *   dropped rather than refused as a directory; every OTHER entry name must begin with the SEGMENT\n *   `<root>/` (a `<root>-evil/x` sibling does not) and is reported, matched and kept under that\n *   prefix stripped off. Omitted, behaviour is byte-identical to a reader with no root at all.\n */\nexport const tarReader = (wanted: ReadonlySet<string>, root?: string) => {\n  const header = new Uint8Array(BLOCK);\n  const members = new Map<string, Uint8Array>();\n  const names: string[] = [];\n  const seen = new Set<string>();\n  let phase: 'header' | 'data' | 'pad' | 'end' = 'header';\n  let filled = 0;\n  let remaining = 0;\n  let padding = 0;\n  let zeros = 0;\n  let name = '';\n  let parts: Uint8Array[] | undefined;\n  let rootSeen = false;\n  const rootPrefix = root === undefined ? undefined : `${root}/`;\n\n  const endEntry = () => {\n    if (parts !== undefined) members.set(name, concatBytes(parts));\n    parts = undefined;\n    phase = padding > 0 ? 'pad' : 'header';\n  };\n\n  const startEntry = () => {\n    if (header.every((byte) => byte === 0)) {\n      zeros += 1;\n      if (zeros === 2) phase = 'end';\n      return;\n    }\n    if (zeros > 0) throw refuse('a zero block sits between entries (truncated or spliced)');\n    if (!checksumHolds(header)) throw refuse('an entry header fails its checksum');\n    const magic = ascii.decode(header.subarray(257, 265));\n    const posix = magic === 'ustar\\u000000';\n    if (!posix && magic !== 'ustar  \\u0000')\n      throw refuse('an entry header is neither ustar nor GNU');\n    const prefix = posix ? text(header, 345, 155) : '';\n    const rawName = prefix === '' ? text(header, 0, 100) : `${prefix}/${text(header, 0, 100)}`;\n    const problem = nameProblem(rawName);\n    if (problem !== undefined) throw refuse(`entry ${JSON.stringify(rawName)} ${problem}`);\n    // ★ THE DECLARED ROOT IS RECOGNISED BEFORE THE GENERAL TYPE CHECK, and only by exact name: a\n    //   directory entry under any other name — nested, or a second copy of the root itself — still\n    //   falls through to that check below and is refused as a directory, same as with no root.\n    if (rootPrefix !== undefined && rawName === rootPrefix) {\n      if (rootSeen) {\n        // ⚠️ Whatever type THIS entry is, its name is already taken: refused for reusing the\n        //   root's name, not necessarily for being a second directory (it need not be one).\n        throw refuse(`entry \"${rawName}\" reuses the declared root's own name, appearing twice`);\n      }\n      const type = String.fromCharCode(header[156] ?? 0);\n      const size = octal(header, 124, 12, `entry \"${rawName}\"'s size`);\n      if (type !== '5' || size !== 0) {\n        throw refuse(`entry \"${rawName}\" is the declared root but is not an empty directory`);\n      }\n      rootSeen = true;\n      phase = 'header';\n      return;\n    }\n    let stripped = rawName;\n    if (rootPrefix !== undefined) {\n      if (!rawName.startsWith(rootPrefix)) {\n        throw refuse(`entry \"${rawName}\" is outside the declared root \"${rootPrefix}\"`);\n      }\n      // ⛔ THE STRIPPED NAME GETS THE SAME SAFETY CHECK AS A RAW ONE. `rawName` already passed\n      //   `nameProblem` above, but stripping a prefix can UNCOVER a `/` or `..` that was hiding\n      //   past it: `<root>//x` is not absolute as a whole name, but strips to `/x`, which is —\n      //   the exact thing this reader refuses a plain (rootless) archive for. MEASURED: without\n      //   this check, `<root>//x` beside `<root>/x` parsed to completion as two distinct entries,\n      //   `x` and `/x`, neither refused. `stripped` can never be empty here: the one raw name that\n      //   strips to '' is `rootPrefix` itself, handled above.\n      stripped = rawName.slice(rootPrefix.length);\n      const strippedProblem = nameProblem(stripped);\n      if (strippedProblem !== undefined) {\n        throw refuse(\n          `entry \"${rawName}\" strips to ${JSON.stringify(stripped)}, which ${strippedProblem}`,\n        );\n      }\n    }\n    name = stripped;\n    const type = String.fromCharCode(header[156] ?? 0);\n    if (type !== '0' && type !== '\\0') {\n      const kind = KINDS[type] ?? `of unknown type ${JSON.stringify(type)}`;\n      throw refuse(`entry \"${rawName}\" is ${kind}; only regular files are accepted`);\n    }\n    if (seen.has(name)) throw refuse(`entry \"${rawName}\" appears twice`);\n    seen.add(name);\n    names.push(name);\n    remaining = octal(header, 124, 12, `entry \"${rawName}\"'s size`);\n    padding = (BLOCK - (remaining % BLOCK)) % BLOCK;\n    parts = wanted.has(name) ? [] : undefined;\n    phase = 'data';\n    if (remaining === 0) endEntry();\n  };\n\n  const push = (chunk: Uint8Array): void => {\n    let at = 0;\n    while (at < chunk.length) {\n      if (phase === 'end') {\n        if (chunk.subarray(at).some((byte) => byte !== 0)) {\n          throw refuse('data follows the end-of-archive marker');\n        }\n        return;\n      }\n      if (phase === 'header') {\n        const take = Math.min(BLOCK - filled, chunk.length - at);\n        header.set(chunk.subarray(at, at + take), filled);\n        filled += take;\n        at += take;\n        if (filled === BLOCK) {\n          filled = 0;\n          startEntry();\n        }\n      } else if (phase === 'data') {\n        const take = Math.min(remaining, chunk.length - at);\n        // ⚠️ slice, not subarray: a chunk's buffer may be reused by the stream after this returns.\n        parts?.push(chunk.slice(at, at + take));\n        remaining -= take;\n        at += take;\n        if (remaining === 0) endEntry();\n      } else {\n        const take = Math.min(padding, chunk.length - at);\n        padding -= take;\n        at += take;\n        if (padding === 0) phase = 'header';\n      }\n    }\n  };\n\n  const finish = (): TarContents => {\n    if (phase !== 'end') throw refuse('the archive stops before its end-of-archive marker');\n    if (rootPrefix !== undefined && !rootSeen) {\n      throw refuse(`the declared root \"${rootPrefix}\" never appears in the archive`);\n    }\n    return { members, names };\n  };\n\n  return { finish, push };\n};\n",
+    "/**\n * A pinned archive, verified, to the one member a declaration names, verified — the order the\n * checks run in is the point of the file.\n *\n *   1. the archive's SHA-256 against its pin — BEFORE a single byte is unpacked;\n *   2. gunzip and tar-read as one stream, keeping only the declared member (tar.ts refuses anything\n *      unsafe in the archive, asked-for or not);\n *   3. that member's SHA-256 against its own pin.\n *\n * ★ BOTH LAYERS, BECAUSE THE VENDOR HASHES BOTH. Each checksum file lists the archive AND every\n *   binary inside it (measured 2026-09-22, all four). The archive check says the download is the\n *   published file; the member check says the bytes about to be written are the published binary —\n *   and it is the only check that still holds if the tar reader were ever wrong about a boundary.\n * ★ DecompressionStream, THE WEB STANDARD: node and bun both ship it, so dist behaves the same\n *   under either runtime — no zlib binding, no dependency.\n * ⛔ IN MEMORY ONLY. Nothing here touches a disk, so no failure below can leave a staged download\n *   behind; the bytes reach a host only through HostRunner.writeFileAtomic (file-converge.ts).\n */\nimport { sha256Hex } from '../launchd/job-form.ts';\nimport type { PinnedDownload } from './binary-form.ts';\nimport { ArchiveRefused, ChecksumMismatch } from './refused.ts';\nimport { type TarContents, tarReader } from './tar.ts';\n\n/** How much gzip is handed to the inflater at a time. */\nconst SLICE = 1 << 20;\n\n/**\n * Gunzip and read a tar, keeping only `wanted`. Throws ArchiveRefused.\n * @param root The one declared leading directory to strip (tar.ts) — a directory-wrapped vendor\n *   archive (the Prometheus family, measured 2026-09-23) without it, or one that carries no root.\n */\nexport const extractMembers = async (\n  gzipped: Uint8Array,\n  wanted: ReadonlySet<string>,\n  root?: string,\n): Promise<TarContents> => {\n  const tar = tarReader(wanted, root);\n  // ⚠️ FED IN SLICES, ON DEMAND. Enqueued whole, the 123.6 MB vmutils archive is inflated in one\n  //   transform step and all 264 MB of output queue up before the first read: MEASURED 2026-09-22,\n  //   a peak RSS of 1116 MB for vmalert alone under bun 1.4.0. `pull` hands over the next slice only\n  //   when the stream asks, so backpressure bounds what is inflated ahead of the tar reader.\n  let offset = 0;\n  const source = new ReadableStream<Uint8Array>({\n    pull(controller) {\n      if (offset >= gzipped.length) {\n        controller.close();\n        return;\n      }\n      controller.enqueue(gzipped.slice(offset, offset + SLICE));\n      offset += SLICE;\n    },\n  });\n  const unzipped = source.pipeThrough(new DecompressionStream('gzip')).getReader();\n  try {\n    for (;;) {\n      const { done, value } = await unzipped.read();\n      if (done) break;\n      tar.push(value);\n    }\n  } catch (cause) {\n    await unzipped.cancel().catch(() => undefined);\n    if (cause instanceof ArchiveRefused) throw cause;\n    throw new ArchiveRefused({ message: `not a gzip stream (${String(cause)})` });\n  }\n  return tar.finish();\n};\n\nconst mismatch = (subject: string, expected: string, actual: string): ChecksumMismatch =>\n  new ChecksumMismatch({\n    actual,\n    expected,\n    message: `${subject} hashes to ${actual}, not the pinned ${expected}`,\n    subject,\n  });\n\n/**\n * The declared member's bytes out of a downloaded archive, both layers checked.\n * ⚠️ `archive` may be shared with another resource's extraction (download.ts sharingInFlight):\n *   this only reads it.\n */\nexport const verifiedMember = async (\n  archive: Uint8Array,\n  release: PinnedDownload,\n): Promise<Uint8Array> => {\n  const archiveSha = sha256Hex(archive);\n  if (archiveSha !== release.sha256) throw mismatch(release.url, release.sha256, archiveSha);\n  const { members, names } = await extractMembers(archive, new Set([release.member]), release.root);\n  const bytes = members.get(release.member);\n  if (bytes === undefined) {\n    const under = release.root === undefined ? '' : ` under root \"${release.root}/\"`;\n    throw new ArchiveRefused({\n      message: `${release.url} has no member named exactly \"${release.member}\"${under} (it has ${names.map((n) => `\"${n}\"`).join(', ') || 'none'})`,\n    });\n  }\n  const memberSha = sha256Hex(bytes);\n  if (memberSha !== release.memberSha256) {\n    throw mismatch(`member \"${release.member}\"`, release.memberSha256, memberSha);\n  }\n  return bytes;\n};\n",
     "/**\n * Release.Binary's read / reconcile / delete as plain async functions over a HostRunner and a\n * FetchArchive, so the lifecycle runs against fakes of both in tests. (diff: binary-diff.ts.)\n *\n * ⛔ ONE WRITER. The verified bytes reach the host through file-converge.ts — the path Host.File's\n *   bytes take — and so through `HostRunner.writeFileAtomic` alone: a temp file in the same\n *   directory, mode and owner set, rename. Under sudoRunner that is its staged `install -S`.\n *   Nothing here opens a file, spawns `tar`, or stages a download on disk.\n * ★ REFUSE BEFORE TOUCHING ANYTHING. Validation runs before the first host call, the host checks\n *   run before the first download, and the digest checks run before the one write — so every\n *   refusal but a failed read-back can say \"Nothing was written.\"\n * ★ AN INSTALLED BINARY IS RECOGNISED BY ITS DIGEST. A file whose SHA-256 is the pin needs no\n *   download to confirm, and a mode or owner fix re-writes the bytes already on disk.\n */\nimport {\n  type FileTarget,\n  convergeFile,\n  readFileAttributes,\n  removeWholeFile,\n  resolveIds,\n} from '../launchd/file-converge.ts';\nimport type { HostFileAttributes } from '../launchd/host-file-form.ts';\nimport { sha256Hex } from '../launchd/job-form.ts';\nimport type { HostRunner } from '../launchd/runner.ts';\nimport { verifiedMember } from './archive.ts';\nimport { claimProblem } from './binary-claim.ts';\nimport {\n  DEFAULT_BINARY_MODE,\n  type PinnedDownload,\n  type ReleaseBinaryAttributes,\n  type ReleaseBinaryProps,\n  binaryProblems,\n  inPlaceRefusal,\n  pinnedDownload,\n  pinsMoved,\n  releaseBinaryPath,\n} from './binary-form.ts';\nimport type { FetchArchive } from './download.ts';\nimport { ArchiveRefused, BinaryRefused, ChecksumMismatch, DownloadFailed } from './refused.ts';\n\nexport const NOTHING = 'Nothing was written.';\n\nexport const refuse = (path: string, message: string): BinaryRefused =>\n  new BinaryRefused({ message: `Release.Binary ${path}: ${message}` });\n\n/** Re-say a download or archive failure as this resource's, keeping its tag. */\nconst restated = (path: string, cause: unknown): unknown => {\n  const say = (message: string) => `Release.Binary ${path}: ${message}. ${NOTHING}`;\n  if (cause instanceof ChecksumMismatch) {\n    const { actual, expected, subject } = cause;\n    return new ChecksumMismatch({ actual, expected, message: say(cause.message), subject });\n  }\n  if (cause instanceof ArchiveRefused) return new ArchiveRefused({ message: say(cause.message) });\n  if (cause instanceof DownloadFailed) {\n    return new DownloadFailed({ message: say(cause.message), retryable: cause.retryable });\n  }\n  return cause;\n};\n\nexport type Desired = { readonly want: FileTarget; readonly download: PinnedDownload };\n\n/** Validate every prop, then resolve owner and group through the runner. */\nexport const desiredBinary = async (\n  runner: HostRunner,\n  props: ReleaseBinaryProps,\n): Promise<Desired> => {\n  const path = releaseBinaryPath(props);\n  const problems = binaryProblems(props);\n  if (problems.length > 0) throw refuse(path, `${problems.join('; ')}. ${NOTHING}`);\n  const ids = await resolveIds(runner, props, path, refuse);\n  const mode = props.mode ?? DEFAULT_BINARY_MODE;\n  return { download: pinnedDownload(props), want: { mode, path, sha256: props.sha256, ...ids } };\n};\n\nconst withSource = (\n  found: HostFileAttributes,\n  download: PinnedDownload,\n): ReleaseBinaryAttributes => ({ ...found, member: download.member, url: download.url });\n\n/**\n * The file at the declaration's path, or undefined when absent — the adoption probe's answer.\n * ★ Its `sha256` is the digest of the bytes on disk, so a caller sees at once whether it is the\n *   pinned binary (equal to `props.sha256`) without anything being executed.\n */\nexport const readBinary = async (\n  runner: HostRunner,\n  props: ReleaseBinaryProps,\n): Promise<ReleaseBinaryAttributes | undefined> => {\n  const { download, want } = await desiredBinary(runner, props);\n  const found = await readFileAttributes(runner, want.path);\n  return found === undefined ? undefined : withSource(found, download);\n};\n\n/** An owned binary as it is now, at the path state recorded — no pins needed to find it. */\nexport const refreshBinary = async (\n  runner: HostRunner,\n  output: ReleaseBinaryAttributes,\n): Promise<ReleaseBinaryAttributes | undefined> => {\n  const found = await readFileAttributes(runner, output.path);\n  return found === undefined ? undefined : { ...found, member: output.member, url: output.url };\n};\n\n/**\n * ⛔ THE DIRECTORY IS DECLARED, NEVER INVENTED. Checked before any download: a missing directory\n *   would otherwise cost 123 MB and then fail at the write. A symlink is refused as well — the\n *   write would land wherever it points, under an owner nobody declared.\n */\nconst directoryReady = async (runner: HostRunner, props: ReleaseBinaryProps): Promise<void> => {\n  const stat = await runner.stat(props.directory);\n  /**\n   * ⛔ AND ONE ONLY ITS OWNER MAY WRITE. The mode rule (binary-form.ts modeProblems) refuses a\n   *   group- or world-writable binary because its writers could change the code a daemon runs. A\n   *   directory they may write gives them the same power by another call: rename(2) their own file\n   *   over the binary, and the next launchd start runs theirs. The sticky bit is no excuse — a\n   *   binary directory has no business being shared.\n   */\n  if (stat?.kind === 'directory' && (stat.mode & 0o022) !== 0) {\n    throw refuse(\n      releaseBinaryPath(props),\n      `directory ${props.directory} is writable by group or other (mode ` +\n        `${stat.mode.toString(8).padStart(4, '0')}), so whoever may write it may replace the ` +\n        `binary; declare it 0755 or narrower. ${NOTHING}`,\n    );\n  }\n  if (stat?.kind === 'directory') return;\n  const why = stat === undefined ? 'does not exist' : `is a ${stat.kind}, not a directory`;\n  throw refuse(\n    releaseBinaryPath(props),\n    `directory ${props.directory} ${why}; declare it (HostDirectory) and pass its path. ${NOTHING}`,\n  );\n};\n\nexport type ReconcileOptions = {\n  /** The attributes state holds; undefined on a create. */\n  readonly output?: ReleaseBinaryAttributes | undefined;\n  /** The props state holds; undefined on a create and on an adoption. */\n  readonly olds?: ReleaseBinaryProps | undefined;\n  /** adoptsAtApply's answer. What it may take over is convergeFile's ⛔. @default false */\n  readonly adopt?: boolean;\n  /** Progress for the deploy log — the engine's `session.note`. */\n  readonly note?: (message: string) => Promise<void>;\n  /**\n   * What is wrong with the pins as the stack program DECLARED them (declared-pins.ts) — an Output\n   * there resolves to a plausible plain string by the time it reaches `props`. @default []\n   */\n  readonly declared?: readonly string[];\n};\n\n/** Install the declared binary unless it is already there, and return it as read back. */\nexport const reconcileBinary = async (\n  runner: HostRunner,\n  fetch: FetchArchive,\n  props: ReleaseBinaryProps,\n  options: ReconcileOptions = {},\n): Promise<ReleaseBinaryAttributes> => {\n  const { adopt = false, declared = [], note = async () => undefined } = options;\n  // ⛔ FIRST, before any host call: a digest the deploy computed is a fetch by another name.\n  if (declared.length > 0) {\n    throw refuse(\n      releaseBinaryPath(props),\n      `${declared.join('; ')}. A pin is copied into reviewed code, never computed during the ` +\n        `deploy (declared-pins.ts). ${NOTHING}`,\n    );\n  }\n  const { download, want } = await desiredBinary(runner, props);\n  // ⛔ The apply-time half of binary-diff.ts's in-place refusal, for an update whose `olds` say so.\n  const olds = options.olds;\n  if (olds !== undefined && releaseBinaryPath(olds) === want.path && pinsMoved(olds, props)) {\n    throw refuse(want.path, `${inPlaceRefusal(olds, props)}. ${NOTHING}`);\n  }\n  await directoryReady(runner, props);\n  // ⛔ WITH NO STATE, ONLY THE PINNED BINARY UNDER --adopt (binary-claim.ts).\n  // ⚠️ NOT an update across a move (`output` at another path): --adopt can never speak for one, so\n  //   refusing identical bytes there would strand the resume of our own interrupted move with no\n  //   remedy but a hand removal. Other bytes there stay refused (file-converge.ts).\n  if (options.output === undefined) {\n    const problem = await claimProblem(runner, want, adopt);\n    if (problem !== undefined) throw refuse(want.path, `${problem}. ${NOTHING}`);\n  }\n  const bytesFor = async (before: HostFileAttributes | undefined): Promise<Uint8Array> => {\n    // ★ The right bytes with the wrong mode or owner: re-write what is there, re-hashed, rather\n    //   than download 123 MB to get the same bytes back.\n    if (before?.sha256 === want.sha256) {\n      const local = await runner.readFile(want.path);\n      if (local !== undefined && sha256Hex(local) === want.sha256) return local;\n    }\n    await note(`downloading ${download.url} (${String(download.size)} bytes)`);\n    try {\n      const bytes = await verifiedMember(await fetch(download.url, download.size), download);\n      await note(`verified ${download.member} ${download.memberSha256}`);\n      return bytes;\n    } catch (cause) {\n      throw restated(want.path, cause);\n    }\n  };\n  const spec = { bytesFor, owner: props.owner, refuse, want };\n  return withSource(await convergeFile(runner, spec, options.output, adopt), download);\n};\n\n/** Remove the binary. Idempotent. ⛔ Refuses a path that has since become a symlink or directory. */\nexport const deleteBinary = (runner: HostRunner, output: ReleaseBinaryAttributes): Promise<void> =>\n  removeWholeFile(runner, output, refuse);\n",
     "/**\n * Release.Binary's `read` with no attributes. Alchemy asks it twice over (ownership/probe.ts): as\n * the ADOPTION PROBE (no row; `olds` is the declaration, `instanceId` fresh) and as the RECOVERY\n * READ of a row whose create never recorded attributes (`olds` and `instanceId` are the row's —\n * Plan.ts for a `creating` row, Apply.ts for such a row it must delete).\n *\n * ⛔ THE PROBE VALIDATES; THE RECOVERY READ NEVER FAILS ITS CALLER. The probe's `olds` is today's\n *   declaration, so a malformed prop fails the plan there, before anything is touched. The recovery\n *   read's `olds` is the FAILED deploy's props, and with `directory: dir.path` — the documented\n *   usage — a first deploy commits its `creating` row while the directory is still an Output, so\n *   the row has no `directory` at all. 🔴 MEASURED 2026-09-22 (adopt-parity.test.ts): after ANY\n *   failed first install — a 404, a checksum mismatch, a mode refused at apply — every later plan\n *   died with `TypeError: undefined is not an object (evaluating 'path.startsWith')`, the fixed\n *   declaration included, and removing the declaration failed too (DestroyError: the orphan's\n *   recovery read crashed the same way). The stage was bricked until a hand `alchemy state delete`.\n *   ownership/probe.ts states the rule this broke: the recovery read \"NEVER FAILS THE CALLER\".\n * ★ \"NOTHING RECOVERED\" IS THE SAFE ANSWER, NOT `Unowned`. The plan then re-drives the create, and\n *   reconcile looks at the path itself with every prop resolved: a file there is refused unless\n *   `--adopt` (binary-claim.ts), exactly as ownership.md says a create interrupted while a prop was\n *   an Output resumes. An orphan's row is dropped and its path left alone — a leak at worst, never\n *   a delete of something unproven.\n * ★ THE ROW, NOT THE SHAPE OF `olds`, SAYS WHICH READ THIS IS: a probe's instance id is minted for\n *   the probe, so no row holds it (ownership/rows.ts). Without a Stack or State in context a row\n *   reads as absent, and this validates as the probe does — the behaviour before this file.\n */\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport * as Effect from 'effect/Effect';\nimport { lift } from '../launchd/host-effect.ts';\nimport type { HostRunner } from '../launchd/runner.ts';\nimport { recordedGeneration } from '../ownership/rows.ts';\nimport type { ReleaseBinaryProps } from './binary-form.ts';\nimport { readBinary } from './binary-lifecycle.ts';\n\ntype Ask = { readonly fqn: string; readonly instanceId: string; readonly olds: unknown };\n\n/** The file a declaration (or a row) names, as `Unowned` — or undefined when there is none. */\nexport const readWithoutState = (runner: HostRunner, ask: Ask) =>\n  Effect.gen(function* () {\n    const recovering = (yield* recordedGeneration(ask.fqn, ask.instanceId)) !== undefined;\n    const read = lift(() => readBinary(runner, ask.olds as ReleaseBinaryProps));\n    const found = recovering\n      ? yield* read.pipe(\n          Effect.catch((cause) =>\n            Effect.as(\n              Effect.logWarning(\n                `${ask.fqn}: the interrupted create's row cannot locate its binary (${cause.message}); ` +\n                  'nothing is recovered, and the create is re-driven with the declaration as it is now',\n              ),\n              undefined,\n            ),\n          ),\n        )\n      : yield* read;\n    return found === undefined ? undefined : Unowned(found);\n  });\n",
     "/**\n * The pins as the STACK PROGRAM declared them — before the engine resolved a single Output — checked\n * at apply. The half of \"a pin is never computed during the deploy\" that a FIRST deploy needs.\n *\n * ⛔ WHY APPLY HAS TO ASK THE STACK, NOT `news`. By the time `reconcile` runs, the engine has\n *   resolved every Output in `news`, so a digest wired from another resource (a checksum file read\n *   at apply, a lookup, a computed value) arrives as a well-formed plain string, indistinguishable\n *   from a reviewed pin. And on a first deploy nothing else looked: Alchemy never diffs a create,\n *   and skips the adoption probe while `news` holds an Output (beta.79 Plan.ts). 🔴 MEASURED\n *   2026-09-22 (apply-pins.test.ts): a swapped archive plus the swapped digests, wired in as an\n *   Output, installed the swapped bytes and the deploy reported success. binary-diff.ts refused the\n *   same declaration only from the SECOND plan on, after the wrong binary was on the host.\n * ★ `Stack.resources[fqn].Props` IS WHAT THE PROGRAM PASSED, Outputs and all: Alchemy's\n *   `Resource` records it at registration (beta.79 Resource.ts, `Props: props`), and the same Stack\n *   reaches the apply (ownership/adopt.ts reads `Adopt` from the same record for the same reason).\n *   pinProblems then sees the Output itself — a function-typed proxy, an Effect or a Config — and\n *   refuses it as \"not a plain string\".\n * ⚠️ NO STACK, NO ANSWER. A handler called outside the engine (the fake-provider.ts harness) has no\n *   Stack service and no registration to read, so this says nothing there; the engine always has\n *   one. apply-pins.test.ts runs the real Plan and Apply, so an Alchemy upgrade that stops\n *   recording `Props` there makes the swapped bytes install again, and fails that test by name.\n */\nimport { Stack } from 'alchemy/Stack';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\nimport { pinProblems } from './binary-form.ts';\n\n/** Everything wrong with the pins of the resource at `fqn` as its stack program declared them. */\nexport const declaredPinProblems = (fqn: string): Effect.Effect<string[]> =>\n  Effect.gen(function* () {\n    const stack = yield* Effect.serviceOption(Stack);\n    if (Option.isNone(stack)) return [];\n    const declared: unknown = stack.value.resources[fqn]?.Props;\n    if (typeof declared !== 'object' && typeof declared !== 'function') return [];\n    if (declared === null) return [];\n    return pinProblems(declared as Parameters<typeof pinProblems>[0]).map(\n      (problem) => `as declared in the stack program, ${problem}`,\n    );\n  });\n",
     "/**\n * One pinned release archive over Effect's `HttpClient`: status first, then the body read against\n * the pinned size, into memory.\n *\n * ★ `HttpClient`, THE HOUSE TRANSPORT (openbao/bao-http.ts, decided 2026-09-14) and Alchemy's own:\n *   a typed error channel, interruption, and a client a test swaps for a fake. releaseProviders()\n *   provides `FetchHttpClient.layer` itself, so a host stack that has no HTTP layer yet (the Mac\n *   stack's has none) cannot forget it. ⚠️ fetch follows GitHub's 302 to its asset CDN (measured\n *   2026-09-22 with HEAD: a signed, expiring URL), so the status judged here is the CDN's.\n * ★ THE PINNED SIZE BOUNDS MEMORY. A body that runs past it is cut off at that byte, so a\n *   misbehaving server or a swapped asset cannot stream an unbounded file into the deploy.\n * ★ NO API CALL. The browser-download URL needs no token and spends no API rate limit; the pins\n *   say everything the release API would.\n * ⚠️ IN MEMORY: vmutils is 123.6 MB. Nothing is staged on disk, so no failure leaves a file behind.\n */\nimport type * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Schedule from 'effect/Schedule';\nimport * as Stream from 'effect/Stream';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport { DownloadFailed } from './refused.ts';\n\n/** The provider's view of a transport: an archive's bytes by URL, never longer than `size`. */\nexport type FetchArchive = (url: string, size: number) => Promise<Uint8Array>;\n\n/** How patient a download is. ★ Parameters so a test never waits for real. */\nexport type DownloadPolicy = {\n  /** @default '10 minutes' — 123.6 MB on a slow link, and still a bounded wait. */\n  readonly timeout?: Duration.Input;\n  /** Retries after the first attempt, transport failures and 5xx only. @default 2 */\n  readonly retries?: number;\n  /** @default '2 seconds' */\n  readonly spacing?: Duration.Input;\n};\n\nconst failed = (message: string, retryable: boolean) => new DownloadFailed({ message, retryable });\n\nconst attempt = (url: string, size: number) =>\n  Effect.gen(function* () {\n    const client = yield* HttpClient.HttpClient;\n    const response = yield* client.get(url);\n    if (response.status !== 200) {\n      return yield* failed(`${url}: HTTP ${String(response.status)}`, response.status >= 500);\n    }\n    // ★ ONE BUFFER OF THE PINNED SIZE, filled in place: no chunk list and no concatenating copy,\n    //   so the archive costs its own size in memory and not twice it.\n    const archive = new Uint8Array(size);\n    let total = 0;\n    yield* Stream.runForEach(response.stream, (chunk) => {\n      if (total + chunk.length > size) {\n        return Effect.fail(failed(`${url}: runs past the pinned ${String(size)} bytes`, false));\n      }\n      archive.set(chunk, total);\n      total += chunk.length;\n      return Effect.void;\n    });\n    if (total !== size) {\n      return yield* failed(`${url}: ${String(total)} bytes, the pin says ${String(size)}`, true);\n    }\n    return archive;\n  }).pipe(\n    // ⛔ `.message` only: it carries the reason, method and URL, and nothing else goes to the log.\n    Effect.catchTag('HttpClientError', (cause) => Effect.fail(failed(cause.message, true))),\n  );\n\n/** The archive's bytes, exactly `size` of them, or DownloadFailed. */\nexport const downloadPinned = (\n  url: string,\n  size: number,\n  policy: DownloadPolicy = {},\n): Effect.Effect<Uint8Array, DownloadFailed, HttpClient.HttpClient> =>\n  attempt(url, size).pipe(\n    Effect.timeoutOrElse({\n      duration: policy.timeout ?? '10 minutes',\n      orElse: () => Effect.fail(failed(`${url}: no complete response in time`, false)),\n    }),\n    Effect.retry({\n      schedule: Schedule.spaced(policy.spacing ?? '2 seconds'),\n      times: policy.retries ?? 2,\n      while: (error: DownloadFailed) => error.retryable,\n    }),\n  );\n\n/** A FetchArchive over one HttpClient. ⚠️ Rejects with the DownloadFailed itself. */\nexport const httpFetchArchive =\n  (client: HttpClient.HttpClient, policy: DownloadPolicy = {}): FetchArchive =>\n  (url, size) =>\n    Effect.runPromise(\n      downloadPinned(url, size, policy).pipe(Effect.provideService(HttpClient.HttpClient, client)),\n    );\n\n/**\n * ★ ONE DOWNLOAD PER ARCHIVE AT A TIME, NOT ONE PER BINARY. vmagent and vmalert are two resources\n *   in one 123.6 MB archive, and Alchemy reconciles independent resources concurrently (its fan-out\n *   is unbounded, Apply.ts), so two requests for one URL share the download already in flight.\n *   The entry goes when it settles: a later request downloads again rather than pinning 123 MB in\n *   memory for the rest of the deploy.\n * ⚠️ The buffer is shared, so nothing downstream may write into it (archive.ts only reads).\n */\nexport const sharingInFlight = (fetch: FetchArchive): FetchArchive => {\n  const inFlight = new Map<string, Promise<Uint8Array>>();\n  return (url, size) => {\n    const key = `${String(size)} ${url}`;\n    const running = inFlight.get(key);\n    if (running !== undefined) return running;\n    const started = fetch(url, size).finally(() => inFlight.delete(key));\n    inFlight.set(key, started);\n    return started;\n  };\n};\n",
-    "/**\n * A vendor's pinned releases as DATA, and the one way to turn an entry into Release.Binary props —\n * or into the reasons there is none. Pure: no network, no host.\n *\n * ★ THE DATA SITS BESIDE THE RESOURCE, NOT INSIDE IT. A catalog (victoria.ts is the first) is the\n *   reviewed record of what one vendor published: exact asset names, sizes, both digest layers and\n *   where each was copied from. The resource takes one pinned archive as props and never reads a\n *   catalog, so adding a vendor is a data module with its own walk-down, never a resource change.\n * ★ A VERSION THE CATALOG DOES NOT LIST IS A REFUSAL, NOT A DOWNLOAD ATTEMPT. `catalogBinary()` runs\n *   in the stack's own program — which `alchemy plan` evaluates — so an unknown version, a\n *   `-enterprise` spelling or a `v` prefix fails the plan before any resource is asked anything,\n *   let alone fetches a byte.\n * ⛔ ADD A VENDOR ONLY AFTER ITS OWN WALK-DOWN (docs/release-binary-catalogs.md): its checksum\n *   format read byte-exact, and its binary's linkage measured (`otool -L`). Vendor binaries were\n *   measured self-contained ONLY for the five Victoria ones; that is not a property of \"Go\".\n * ★ `computed` IS A SECOND, LESSER OWNER OF A MEMBER'S DIGEST — never the vendor's, always ours,\n *   for a checksum file that never lists the member at all (OpenBao: archives and SBOMs only,\n *   never `bao`; docs/release-binary-openbao.md is the walk-down). `checksums.signature` records\n *   how the checksum file's OWN authorship was checked, if a vendor publishes one to check.\n */\nimport type { ReleaseArchive, ReleaseBinaryProps } from './binary-form.ts';\nimport { BinaryRefused } from './refused.ts';\n\n/**\n * A member digest WE computed, because the vendor's checksum file never lists it — read\n * checksums.ts's header before adding one: most vendors list archives only.\n */\nexport interface ComputedDigest {\n  readonly sha256: string;\n  /** The date it was computed, from the archive whose pinned SHA-256 matched that day. */\n  readonly recorded: string;\n}\n\n/** How the checksum file itself was checked, beyond its own SHA-256 — openpgp today. */\nexport interface ChecksumSignature {\n  readonly kind: 'openpgp';\n  /** The detached signature asset's URL. */\n  readonly url: string;\n  readonly sha256: string;\n  /** The public key it was checked against. */\n  readonly key: { readonly url: string; readonly sha256: string; readonly fingerprint: string };\n  /** The date `gpgv` was run, recorded once — never re-run at apply or by CI. */\n  readonly verified: string;\n}\n\n/** One release archive as a catalog records it: the pin, plus where every digest came from. */\nexport interface PinnedArchive extends ReleaseArchive {\n  /** Archive member → its SHA-256. Every member the vendor's checksum file lists, not just ours. */\n  readonly members: Readonly<Record<string, string>>;\n  /**\n   * Archive member → a digest WE computed, for a checksum file that never lists it (OpenBao's\n   * lists archives and SBOMs, never `bao`). ⛔ NOT A VENDOR FACT: computed from the bytes of an\n   * archive whose own SHA-256 already matched the pin, never filed beside `members`. A member in\n   * both is refused (catalogProblems) — two owners of one pin is a data-set bug, not a choice.\n   */\n  readonly computed?: Readonly<Record<string, ComputedDigest>>;\n  /** The checksum file the digests were copied from, its own SHA-256, and when. Never fetched. */\n  readonly checksums: {\n    readonly url: string;\n    readonly sha256: string;\n    readonly recorded: string;\n    /** How the checksum file's own authorship was checked, if at all. Optional: not every vendor publishes one. */\n    readonly signature?: ChecksumSignature;\n  };\n}\n\n/** One package (one archive per version and platform) of a vendor. */\nexport interface CatalogPackage {\n  /**\n   * Installed name → archive member, written out, never derived: a member the vendor adds is\n   * installable only once somebody names it here.\n   */\n  readonly binaries: Readonly<Record<string, string>>;\n  /** Version (as the catalog spells it) → platform (the vendor's spelling) → archive. */\n  readonly versions: Readonly<Record<string, Readonly<Record<string, PinnedArchive>>>>;\n}\n\n/** A vendor's pinned releases. */\nexport interface ReleaseCatalog {\n  /** Who publishes these, for refusals: `'VictoriaMetrics'`. */\n  readonly vendor: string;\n  readonly packages: Readonly<Record<string, CatalogPackage>>;\n}\n\n/** Which binary a stack asks a catalog for. */\nexport type CatalogRequest = {\n  readonly package: string;\n  readonly version: string;\n  readonly platform: string;\n  /** The installed name — `vmalert`, not the member `vmalert-prod`. */\n  readonly binary: string;\n};\n\n/** The pinned half of Release.Binary's props; the stack adds `directory`, `mode` and owner. */\nexport type PinnedBinary = Pick<ReleaseBinaryProps, 'archive' | 'member' | 'sha256' | 'name'>;\n\nconst quoted = (names: Iterable<string>): string => [...names].map((n) => `\"${n}\"`).join(', ');\n\n// ★ A plain boolean, not a type guard: on a `Record<string, …>` a guard narrows the miss to `never`.\nconst has = (record: object, key: string): boolean => Object.hasOwn(record, key);\n\n/**\n * A member's SHA-256, vendor digest first, then computed — or `'both'` when it is pinned in both,\n * which is refused rather than silently preferring one owner over the other.\n */\nconst memberDigest = (archive: PinnedArchive, member: string): string | 'both' | undefined => {\n  const vendor = has(archive.members, member) ? archive.members[member] : undefined;\n  const computed =\n    archive.computed !== undefined && has(archive.computed, member)\n      ? archive.computed[member]?.sha256\n      : undefined;\n  if (vendor !== undefined && computed !== undefined) return 'both';\n  return vendor ?? computed;\n};\n\n/** Everything wrong with a request against a catalog; empty when it resolves. */\nexport const catalogProblems = (catalog: ReleaseCatalog, request: CatalogRequest): string[] => {\n  const entry = has(catalog.packages, request.package)\n    ? catalog.packages[request.package]\n    : undefined;\n  if (entry === undefined) {\n    return [\n      `${catalog.vendor} package \"${request.package}\" is not in the catalog (${quoted(Object.keys(catalog.packages))})`,\n    ];\n  }\n  const found: string[] = [];\n  if (!has(entry.binaries, request.binary)) {\n    // ⚠️ The vendor spelling is the likeliest mistake: the member is `vmalert-prod`, the binary\n    //   this installs is `vmalert`.\n    const member = Object.values(entry.binaries).includes(request.binary);\n    const hint = member ? ' (that is the archive member; name the installed binary)' : '';\n    found.push(\n      `${request.package} has no binary \"${request.binary}\"${hint}; it has ${quoted(Object.keys(entry.binaries))}`,\n    );\n  }\n  const platforms = has(entry.versions, request.version)\n    ? entry.versions[request.version]\n    : undefined;\n  if (platforms === undefined) {\n    found.push(\n      `${request.package} ${request.version} is not in the catalog (it pins ${quoted(Object.keys(entry.versions))}); ` +\n        'a new version is a reviewed change that pins its digests, never a download of whatever is there',\n    );\n    return found;\n  }\n  const archive = has(platforms, request.platform) ? platforms[request.platform] : undefined;\n  if (archive === undefined) {\n    found.push(\n      `${request.package} ${request.version} is not pinned for platform \"${request.platform}\" (${quoted(Object.keys(platforms))})`,\n    );\n  } else if (found.length === 0) {\n    const member = entry.binaries[request.binary] ?? '';\n    const digest = memberDigest(archive, member);\n    if (digest === 'both') {\n      found.push(\n        `${request.package} ${request.version}'s member \"${member}\" is pinned twice — once as a ` +\n          'vendor digest and once as a computed one; a member has exactly one owner',\n      );\n    } else if (digest === undefined) {\n      found.push(\n        `${request.package} ${request.version} pins no digest for member \"${member}\" (checked ` +\n          'the vendor checksum file and any computed record)',\n      );\n    }\n  }\n  return found;\n};\n\n/**\n * The pinned props for one binary out of a catalog. ⛔ Throws BinaryRefused for anything the\n * catalog does not pin — in a stack program, that fails the plan before anything is fetched.\n */\nexport const catalogBinary = (catalog: ReleaseCatalog, request: CatalogRequest): PinnedBinary => {\n  const problems = catalogProblems(catalog, request);\n  // ⚠️ Own keys only: `packages.constructor` is Object's, and would read as a package.\n  const own = <V>(record: Readonly<Record<string, V>> | undefined, key: string): V | undefined =>\n    record !== undefined && has(record, key) ? record[key] : undefined;\n  const entry = own(catalog.packages, request.package);\n  const archive = own(own(entry?.versions, request.version), request.platform);\n  const member = own(entry?.binaries, request.binary);\n  const digest =\n    member === undefined || archive === undefined ? undefined : memberDigest(archive, member);\n  const sha256 = digest === 'both' ? undefined : digest;\n  if (\n    problems.length > 0 ||\n    archive === undefined ||\n    member === undefined ||\n    sha256 === undefined\n  ) {\n    throw new BinaryRefused({\n      message: `Release.Binary ${request.binary}: ${problems.join('; ')}. Nothing was fetched.`,\n    });\n  }\n  const { asset, repo, sha256: archiveSha256, size, tag } = archive;\n  return {\n    archive: { asset, repo, sha256: archiveSha256, size, tag },\n    member,\n    name: request.binary,\n    sha256,\n  };\n};\n\n/** `<root>/<package>-<version>`: one directory per version, so an upgrade is a new path. */\nexport const catalogDirectory = (\n  root: string,\n  request: Pick<CatalogRequest, 'package' | 'version'>,\n): string => `${root}/${request.package}-${request.version}`;\n\n/** What a catalog says an installed binary is, found by its SHA-256 alone. */\nexport type IdentifiedBinary = CatalogRequest & { readonly vendor: string };\n\n/**\n * Name an installed file by its digest — never by running it. ★ IDENTITY BY SHA-256: the running\n *   Nix victoria-traces reports an empty version (`vm_app_version{version=\"\"}` on /metrics, measured\n *   2026-09-22 — its build sets no buildinfo), a stamped build prints `-version` to STDERR, not\n *   stdout (lib/buildinfo, read, not run), and executing a binary to learn what it is runs the very\n *   bytes whose provenance is the question. A digest needs a read, nothing more.\n */\nexport const identifyBinary = (\n  catalogs: readonly ReleaseCatalog[],\n  sha256: string,\n): IdentifiedBinary | undefined => {\n  for (const catalog of catalogs) {\n    for (const [pkg, entry] of Object.entries(catalog.packages)) {\n      for (const [version, platforms] of Object.entries(entry.versions)) {\n        for (const [platform, archive] of Object.entries(platforms)) {\n          for (const [binary, member] of Object.entries(entry.binaries)) {\n            const digest = memberDigest(archive, member);\n            if (digest !== 'both' && digest === sha256) {\n              return { binary, package: pkg, platform, vendor: catalog.vendor, version };\n            }\n          }\n        }\n      }\n    }\n  }\n  return undefined;\n};\n",
+    "/**\n * A vendor's pinned releases as DATA, and the one way to turn an entry into Release.Binary props —\n * or into the reasons there is none. Pure: no network, no host.\n *\n * ★ THE DATA SITS BESIDE THE RESOURCE, NOT INSIDE IT. A catalog (victoria.ts is the first) is the\n *   reviewed record of what one vendor published: exact asset names, sizes, both digest layers and\n *   where each was copied from. The resource takes one pinned archive as props and never reads a\n *   catalog, so adding a vendor is a data module with its own walk-down, never a resource change.\n * ★ A VERSION THE CATALOG DOES NOT LIST IS A REFUSAL, NOT A DOWNLOAD ATTEMPT. `catalogBinary()` runs\n *   in the stack's own program — which `alchemy plan` evaluates — so an unknown version, a\n *   `-enterprise` spelling or a `v` prefix fails the plan before any resource is asked anything,\n *   let alone fetches a byte.\n * ⛔ ADD A VENDOR ONLY AFTER ITS OWN WALK-DOWN (docs/release-binary-catalogs.md): its checksum\n *   format read byte-exact, and its binary's linkage measured (`otool -L`). Vendor binaries were\n *   measured self-contained ONLY for the five Victoria ones; that is not a property of \"Go\".\n * ★ `computed` IS A SECOND, LESSER OWNER OF A MEMBER'S DIGEST — never the vendor's, always ours,\n *   for a checksum file that never lists the member at all (OpenBao: archives and SBOMs only,\n *   never `bao`; docs/release-binary-openbao.md is the walk-down). `checksums.signature` records\n *   how the checksum file's OWN authorship was checked, if a vendor publishes one to check.\n */\nimport type { ReleaseArchive, ReleaseBinaryProps } from './binary-form.ts';\nimport { BinaryRefused } from './refused.ts';\n\n/**\n * A member digest WE computed, because the vendor's checksum file never lists it — read\n * checksums.ts's header before adding one: most vendors list archives only.\n */\nexport interface ComputedDigest {\n  readonly sha256: string;\n  /** The date it was computed, from the archive whose pinned SHA-256 matched that day. */\n  readonly recorded: string;\n}\n\n/** How the checksum file itself was checked, beyond its own SHA-256 — openpgp today. */\nexport interface ChecksumSignature {\n  readonly kind: 'openpgp';\n  /** The detached signature asset's URL. */\n  readonly url: string;\n  readonly sha256: string;\n  /** The public key it was checked against. */\n  readonly key: { readonly url: string; readonly sha256: string; readonly fingerprint: string };\n  /** The date `gpgv` was run, recorded once — never re-run at apply or by CI. */\n  readonly verified: string;\n}\n\n/** One release archive as a catalog records it: the pin, plus where every digest came from. */\nexport interface PinnedArchive extends ReleaseArchive {\n  /** Archive member → its SHA-256. Every member the vendor's checksum file lists, not just ours. */\n  readonly members: Readonly<Record<string, string>>;\n  /**\n   * Archive member → a digest WE computed, for a checksum file that never lists it (OpenBao's\n   * lists archives and SBOMs, never `bao`). ⛔ NOT A VENDOR FACT: computed from the bytes of an\n   * archive whose own SHA-256 already matched the pin, never filed beside `members`. A member in\n   * both is refused (catalogProblems) — two owners of one pin is a data-set bug, not a choice.\n   */\n  readonly computed?: Readonly<Record<string, ComputedDigest>>;\n  /** The checksum file the digests were copied from, its own SHA-256, and when. Never fetched. */\n  readonly checksums: {\n    readonly url: string;\n    readonly sha256: string;\n    readonly recorded: string;\n    /** How the checksum file's own authorship was checked, if at all. Optional: not every vendor publishes one. */\n    readonly signature?: ChecksumSignature;\n  };\n}\n\n/** One package (one archive per version and platform) of a vendor. */\nexport interface CatalogPackage {\n  /**\n   * Installed name → archive member, written out, never derived: a member the vendor adds is\n   * installable only once somebody names it here.\n   */\n  readonly binaries: Readonly<Record<string, string>>;\n  /** Version (as the catalog spells it) → platform (the vendor's spelling) → archive. */\n  readonly versions: Readonly<Record<string, Readonly<Record<string, PinnedArchive>>>>;\n}\n\n/** A vendor's pinned releases. */\nexport interface ReleaseCatalog {\n  /** Who publishes these, for refusals: `'VictoriaMetrics'`. */\n  readonly vendor: string;\n  readonly packages: Readonly<Record<string, CatalogPackage>>;\n}\n\n/** Which binary a stack asks a catalog for. */\nexport type CatalogRequest = {\n  readonly package: string;\n  readonly version: string;\n  readonly platform: string;\n  /** The installed name — `vmalert`, not the member `vmalert-prod`. */\n  readonly binary: string;\n};\n\n/** The pinned half of Release.Binary's props; the stack adds `directory`, `mode` and owner. */\nexport type PinnedBinary = Pick<ReleaseBinaryProps, 'archive' | 'member' | 'sha256' | 'name'>;\n\nconst quoted = (names: Iterable<string>): string => [...names].map((n) => `\"${n}\"`).join(', ');\n\n// ★ A plain boolean, not a type guard: on a `Record<string, …>` a guard narrows the miss to `never`.\nconst has = (record: object, key: string): boolean => Object.hasOwn(record, key);\n\n/**\n * A member's SHA-256, vendor digest first, then computed — or `'both'` when it is pinned in both,\n * which is refused rather than silently preferring one owner over the other.\n */\nconst memberDigest = (archive: PinnedArchive, member: string): string | 'both' | undefined => {\n  const vendor = has(archive.members, member) ? archive.members[member] : undefined;\n  const computed =\n    archive.computed !== undefined && has(archive.computed, member)\n      ? archive.computed[member]?.sha256\n      : undefined;\n  if (vendor !== undefined && computed !== undefined) return 'both';\n  return vendor ?? computed;\n};\n\n/** Everything wrong with a request against a catalog; empty when it resolves. */\nexport const catalogProblems = (catalog: ReleaseCatalog, request: CatalogRequest): string[] => {\n  const entry = has(catalog.packages, request.package)\n    ? catalog.packages[request.package]\n    : undefined;\n  if (entry === undefined) {\n    return [\n      `${catalog.vendor} package \"${request.package}\" is not in the catalog (${quoted(Object.keys(catalog.packages))})`,\n    ];\n  }\n  const found: string[] = [];\n  if (!has(entry.binaries, request.binary)) {\n    // ⚠️ The vendor spelling is the likeliest mistake: the member is `vmalert-prod`, the binary\n    //   this installs is `vmalert`.\n    const member = Object.values(entry.binaries).includes(request.binary);\n    const hint = member ? ' (that is the archive member; name the installed binary)' : '';\n    found.push(\n      `${request.package} has no binary \"${request.binary}\"${hint}; it has ${quoted(Object.keys(entry.binaries))}`,\n    );\n  }\n  const platforms = has(entry.versions, request.version)\n    ? entry.versions[request.version]\n    : undefined;\n  if (platforms === undefined) {\n    found.push(\n      `${request.package} ${request.version} is not in the catalog (it pins ${quoted(Object.keys(entry.versions))}); ` +\n        'a new version is a reviewed change that pins its digests, never a download of whatever is there',\n    );\n    return found;\n  }\n  const archive = has(platforms, request.platform) ? platforms[request.platform] : undefined;\n  if (archive === undefined) {\n    found.push(\n      `${request.package} ${request.version} is not pinned for platform \"${request.platform}\" (${quoted(Object.keys(platforms))})`,\n    );\n  } else if (found.length === 0) {\n    const member = entry.binaries[request.binary] ?? '';\n    const digest = memberDigest(archive, member);\n    if (digest === 'both') {\n      found.push(\n        `${request.package} ${request.version}'s member \"${member}\" is pinned twice — once as a ` +\n          'vendor digest and once as a computed one; a member has exactly one owner',\n      );\n    } else if (digest === undefined) {\n      found.push(\n        `${request.package} ${request.version} pins no digest for member \"${member}\" (checked ` +\n          'the vendor checksum file and any computed record)',\n      );\n    }\n  }\n  return found;\n};\n\n/**\n * The pinned props for one binary out of a catalog. ⛔ Throws BinaryRefused for anything the\n * catalog does not pin — in a stack program, that fails the plan before anything is fetched.\n */\nexport const catalogBinary = (catalog: ReleaseCatalog, request: CatalogRequest): PinnedBinary => {\n  const problems = catalogProblems(catalog, request);\n  // ⚠️ Own keys only: `packages.constructor` is Object's, and would read as a package.\n  const own = <V>(record: Readonly<Record<string, V>> | undefined, key: string): V | undefined =>\n    record !== undefined && has(record, key) ? record[key] : undefined;\n  const entry = own(catalog.packages, request.package);\n  const archive = own(own(entry?.versions, request.version), request.platform);\n  const member = own(entry?.binaries, request.binary);\n  const digest =\n    member === undefined || archive === undefined ? undefined : memberDigest(archive, member);\n  const sha256 = digest === 'both' ? undefined : digest;\n  if (\n    problems.length > 0 ||\n    archive === undefined ||\n    member === undefined ||\n    sha256 === undefined\n  ) {\n    throw new BinaryRefused({\n      message: `Release.Binary ${request.binary}: ${problems.join('; ')}. Nothing was fetched.`,\n    });\n  }\n  const { asset, repo, root, sha256: archiveSha256, size, tag } = archive;\n  return {\n    // ⚠️ exactOptionalPropertyTypes: a conditional spread, never `root: undefined` spelled out.\n    archive: {\n      asset,\n      repo,\n      sha256: archiveSha256,\n      size,\n      tag,\n      ...(root === undefined ? {} : { root }),\n    },\n    member,\n    name: request.binary,\n    sha256,\n  };\n};\n\n/** `<root>/<package>-<version>`: one directory per version, so an upgrade is a new path. */\nexport const catalogDirectory = (\n  root: string,\n  request: Pick<CatalogRequest, 'package' | 'version'>,\n): string => `${root}/${request.package}-${request.version}`;\n\n/** What a catalog says an installed binary is, found by its SHA-256 alone. */\nexport type IdentifiedBinary = CatalogRequest & { readonly vendor: string };\n\n/**\n * Name an installed file by its digest — never by running it. ★ IDENTITY BY SHA-256: the running\n *   Nix victoria-traces reports an empty version (`vm_app_version{version=\"\"}` on /metrics, measured\n *   2026-09-22 — its build sets no buildinfo), a stamped build prints `-version` to STDERR, not\n *   stdout (lib/buildinfo, read, not run), and executing a binary to learn what it is runs the very\n *   bytes whose provenance is the question. A digest needs a read, nothing more.\n */\nexport const identifyBinary = (\n  catalogs: readonly ReleaseCatalog[],\n  sha256: string,\n): IdentifiedBinary | undefined => {\n  for (const catalog of catalogs) {\n    for (const [pkg, entry] of Object.entries(catalog.packages)) {\n      for (const [version, platforms] of Object.entries(entry.versions)) {\n        for (const [platform, archive] of Object.entries(platforms)) {\n          for (const [binary, member] of Object.entries(entry.binaries)) {\n            const digest = memberDigest(archive, member);\n            if (digest !== 'both' && digest === sha256) {\n              return { binary, package: pkg, platform, vendor: catalog.vendor, version };\n            }\n          }\n        }\n      }\n    }\n  }\n  return undefined;\n};\n",
     "/**\n * OpenBao's release archives, pinned — the second data set for Release.Binary, walked down\n * 2026-09-23 (packages/alchemy/docs/release-binary-openbao.md has every command).\n *\n * ★ THE MEMBER DIGEST IS OURS, NOT THE VENDOR'S. `checksums.txt` lists 83 lines: every archive and\n *   every `.sbom.json`, never `bao` itself (measured 2026-09-23 — see checksums.ts's header on why\n *   that is normal for this vendor). So `bao`'s SHA-256 sits under `computed`, hashed from the one\n *   archive whose OWN SHA-256 already matched the checksums-file pin — never filed under `members`,\n *   which is vendor lines only.\n * ★ PLATFORM KEY IS THE VENDOR'S OWN SPELLING: `darwin_arm64`, underscore — OpenBao's asset names\n *   read `openbao_2.6.2_darwin_arm64.tar.gz`. Victoria's catalog spells the same idea\n *   `darwin-arm64`, hyphen, because THAT vendor's asset names use a hyphen. Nothing here picks one\n *   estate-wide convention; a consumer names the platform its data set actually uses. If a reviewer\n *   would rather the estate pick one spelling, that is a one-line change to this rule, not to any\n *   consumer, made in the same PR that adds the second spelling.\n * ★ GPG, MEASURED, TWO INDEPENDENT CHANNELS: `gpgv` against the dearmored key from openbao.org\n *   returned \"Good signature from OpenBao <openbao@lists.lfedge.org>\" over `checksums.txt` using\n *   subkey E617DCD4065C2AFC0B2CF7A7BA8BC08C0F691F94 of primary 66D15FDD87287219C8E15478D200CD702853E6D0\n *   (both fingerprints published in OpenBao's own install.mdx at this tag). ⚠️ TRUST ON FIRST USE\n *   ACROSS TWO CHANNELS ONE PROJECT RUNS: the release asset and openbao.org are both OpenBao's own\n *   infrastructure, so this is not a third party attesting to the key — it raises the bar over no\n *   check at all (a swap needs both channels, not one), it does not reach independent provenance.\n * ⛔ SIGSTORE WAS NOT CHECKED: `cosign` is not installed on the mini (measured 2026-09-23). The\n *   bundle's certificate SAN (read, not verified) names\n *   `https://github.com/openbao/openbao/.github/workflows/release.yml@refs/heads/release/2.6.x`,\n *   issuer `https://token.actions.githubusercontent.com` — recorded here as an UNVERIFIED identity,\n *   never as a passing check. \"GPG or Sigstore\" is met by the GPG half alone.\n * ⚠️ THE BUILD THIS PINS IS NOT THE ONE THE VAULT SERVER RUNS. Read from goreleaser.other.yaml at\n *   v2.6.2: `CGO_ENABLED=0`, build tag `ui`. Expected to differ from the Nix build in nothing an\n *   agent (approle auto-auth, templates, exec) depends on; nobody has run this binary to confirm —\n *   docs/release-binary-openbao.md says so and stops there, by house rule (never execute `bao`).\n */\nimport type { ReleaseCatalog } from './catalog.ts';\n\nconst RECORDED = '2026-09-23';\nconst REPO = 'openbao/openbao';\nconst TAG = 'v2.6.2';\nconst DOWNLOAD = `https://github.com/${REPO}/releases/download/${TAG}`;\n\nexport const OPENBAO_RELEASES: ReleaseCatalog = {\n  packages: {\n    openbao: {\n      // ★ The member is named `bao` itself — no `-prod`-style suffix; the vendor tarball unpacks\n      //   CHANGELOG.md, LICENSE, README.md and `bao` at its root (measured, full stream, 2026-09-23).\n      binaries: { bao: 'bao' },\n      versions: {\n        '2.6.2': {\n          darwin_arm64: {\n            asset: 'openbao_2.6.2_darwin_arm64.tar.gz',\n            checksums: {\n              recorded: RECORDED,\n              sha256: '3d4a19fdc54a86fd94ce59ea91316dbf4304180bb27ae818e78e85c7f2164645',\n              signature: {\n                kind: 'openpgp',\n                key: {\n                  fingerprint: '66D15FDD87287219C8E15478D200CD702853E6D0',\n                  sha256: '1862a196422947124282e026ea4e09d6f7c5d383b628d90c17906936e6e5a8e0',\n                  url: 'https://openbao.org/assets/openbao-gpg-pub-20240618.asc',\n                },\n                sha256: '40f294d642a2b4e9adac766ca6b8b2633e15b3dbfdf63969dedbf46d94df53e8',\n                url: `${DOWNLOAD}/checksums.txt.gpgsig`,\n                verified: RECORDED,\n              },\n              url: `${DOWNLOAD}/checksums.txt`,\n            },\n            // ★ NOT a vendor fact — see the header. Hashed from THIS archive after its own SHA-256\n            //   (below) already matched the checksums.txt pin; confirmed two ways\n            //   (extractMembers and `tar -xzOf … bao | shasum -a 256`) and against `tar -tvzf -`.\n            computed: {\n              bao: {\n                recorded: RECORDED,\n                sha256: 'd476d17e81a35e6d70dd7e86a8ab2a3664313525118f1f1cfe0130e7a2b95f3a',\n              },\n            },\n            members: {},\n            repo: REPO,\n            sha256: '4e495376174accc0e014d31e9901f518a974f966850c839f626347eaac05fd52',\n            size: 76_833_570,\n            tag: TAG,\n          },\n        },\n      },\n    },\n  },\n  vendor: 'OpenBao',\n};\n",
     "/**\n * The release-binary provider with ONE HostRunner and its own HTTP client, as a single layer for a\n * host stack:\n *\n *     const runner = localRunner();\n *     Layer.mergeAll(launchdProviders(runner), releaseProviders(runner), …the stack's others)\n *\n * ★ PASS THE SAME RUNNER THE JOBS USE, so the binary and the daemon that runs it are written by one\n *   identity on one host — a stack cannot install as one user and bootstrap as another by accident.\n * ⛔ THERE IS NO DEFAULT RUNNER. A binary is written wherever the runner reaches; a silent default to\n *   \"this machine\" would install a Mac's daemons onto whichever laptop ran the deploy (the same\n *   reasoning as linuxProviders()).\n * ★ `FetchHttpClient.layer` IS PROVIDED HERE, not left to the stack: the Mac host stack this exists\n *   for provides no HTTP layer, and a missing one fails only at the first install.\n */\nimport * as Layer from 'effect/Layer';\nimport * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';\nimport { type HostRunner, hostRunnerLayer } from '../launchd/runner.ts';\nimport { ReleaseBinaryProvider } from './binary.ts';\n\nexport const releaseProviders = (runner: HostRunner) =>\n  ReleaseBinaryProvider().pipe(\n    Layer.provide(Layer.mergeAll(hostRunnerLayer(runner), FetchHttpClient.layer)),\n  );\n",
     "/**\n * VictoriaMetrics' release archives, pinned — the first data set for Release.Binary, and vendor\n * facts only: every digest copied from the vendor's own checksum file for that archive and\n * cross-checked against GitHub's asset digest ON THE RECORDED DATE. Nothing here names a host, a\n * path, a user or an estate. victoria.test.ts holds every pin to the committed checksum files\n * (fixtures/victoria/) — ⚠️ consistency, not provenance: it cannot re-read GitHub, so a fixture\n * edited together with its pins passes, and review is the gate for that.\n *\n * ★ PINNED IN CODE, NOT FETCHED AT APPLY. The checksum file is published by the same account, on\n *   the same release, over the same channel as the archive it describes — and these releases are\n *   MUTABLE (`\"immutable\": false` on v1.151.0, v1.52.0 and v0.10.0, measured 2026-09-22; the\n *   vendor's own release Makefile says to delete an asset in the UI to re-upload it). Whoever can\n *   swap an archive can swap its checksum file in the same minute, and a provider that trusts\n *   whatever checksum file it finds would install the new bytes and call them verified. A pin\n *   committed here changes only through a reviewed kit release, so a swapped asset is a REFUSAL\n *   that names the digest it expected. It also means an apply makes one request, not two, and a\n *   plan knows exactly which bytes it will install without touching the network.\n * ⚠️ TRUST ROOT. At apply, these pins alone: the transport (TLS, the redirect, the CDN) can fail\n *   a download, never pass other bytes. The pins' own root is the GitHub release over TLS as read\n *   on RECORDED (trust on first use), uploaded from a maintainer's personal account.\n *   VictoriaMetrics publishes no signature, cosign bundle, SLSA provenance or GitHub artifact\n *   attestation for these archives (measured 2026-09-22: no .sig/.asc/.pem/.bundle assets; the\n *   attestations API answers 404 for all four digests, next to a positive control that answers\n *   200). A checksum file proves the download is not corrupt — integrity — not who built it.\n * ⛔ A NEW VERSION IS A NEW ENTRY, WALKED DOWN THE SAME WAY — docs/release-binary-catalogs.md.\n *   Never `latest`, never sorted by publish date: VictoriaLogs v1.51.1 was published AFTER v1.52.0.\n * ⛔ EXACT NAMES. `-enterprise`, `-cluster` and `-enterprise-cluster` archives sit beside each of\n *   these with every prefix in common, so each asset name below is written out whole — never\n *   composed from a package and a version, which is how a template drifts onto a sibling.\n * ★ THE VENDOR'S `-prod` SUFFIX IS DROPPED ON PURPOSE: every member is `<binary>-prod`, and\n *   installing it as `<binary>` keeps a job's argv[0], `ps` and `pgrep` names identical to the\n *   builds it replaces. The map is written out per package, never derived.\n */\nimport type { ReleaseCatalog } from './catalog.ts';\n\nconst RECORDED = '2026-09-22';\nconst DOWNLOAD = 'https://github.com/VictoriaMetrics';\n\nexport const VICTORIA_RELEASES: ReleaseCatalog = {\n  packages: {\n    'victoria-logs': {\n      binaries: { 'victoria-logs': 'victoria-logs-prod' },\n      versions: {\n        '1.52.0': {\n          'darwin-arm64': {\n            asset: 'victoria-logs-darwin-arm64-v1.52.0.tar.gz',\n            checksums: {\n              recorded: RECORDED,\n              sha256: 'd4ca686c3cceec78a0f4e733ef9ab3f857549131ea48cd6f89f701cda406ac4b',\n              url: `${DOWNLOAD}/VictoriaLogs/releases/download/v1.52.0/victoria-logs-darwin-arm64-v1.52.0_checksums.txt`,\n            },\n            members: {\n              'victoria-logs-prod':\n                '9e48809e314902782959b3a4e683a3087476759d0293791a0564921c676ca7be',\n            },\n            repo: 'VictoriaMetrics/VictoriaLogs',\n            sha256: '3157d4b6181d8a7e3e30918e2cbfcd4cc4cb66263e3ef21ea91e4f20f8980883',\n            size: 10_943_697,\n            tag: 'v1.52.0',\n          },\n        },\n      },\n    },\n    'victoria-metrics': {\n      // ⛔ The SINGLE-NODE archive. `…-cluster.tar.gz` holds vminsert/vmselect/vmstorage instead.\n      binaries: { 'victoria-metrics': 'victoria-metrics-prod' },\n      versions: {\n        '1.151.0': {\n          'darwin-arm64': {\n            asset: 'victoria-metrics-darwin-arm64-v1.151.0.tar.gz',\n            checksums: {\n              recorded: RECORDED,\n              sha256: '735745ee0e7b2d5b8118883f2d0ed124c2a12d70261c16380128f5e362566d1e',\n              url: `${DOWNLOAD}/VictoriaMetrics/releases/download/v1.151.0/victoria-metrics-darwin-arm64-v1.151.0_checksums.txt`,\n            },\n            members: {\n              'victoria-metrics-prod':\n                '3c493a95ac1e9034a3261b230c4d62f3b186a04aafcdbacc99bfc110dc5de6a1',\n            },\n            repo: 'VictoriaMetrics/VictoriaMetrics',\n            sha256: '8792437c4c0b63719fed7b44ad18d4b4167bbe6861ab3e84c7bb010c922e7582',\n            size: 12_739_105,\n            tag: 'v1.151.0',\n          },\n        },\n      },\n    },\n    'victoria-traces': {\n      binaries: { 'victoria-traces': 'victoria-traces-prod' },\n      versions: {\n        '0.10.0': {\n          'darwin-arm64': {\n            asset: 'victoria-traces-darwin-arm64-v0.10.0.tar.gz',\n            checksums: {\n              recorded: RECORDED,\n              sha256: 'cd32bfc21900b48ba543124e43827a1d13d735e45d50dbfd742c0ca6640e1aae',\n              url: `${DOWNLOAD}/VictoriaTraces/releases/download/v0.10.0/victoria-traces-darwin-arm64-v0.10.0_checksums.txt`,\n            },\n            members: {\n              'victoria-traces-prod':\n                '4759ec89a466129b9eefc22244a111e1f489739340747805fd93b58fd0f7b2dd',\n            },\n            repo: 'VictoriaMetrics/VictoriaTraces',\n            sha256: 'cbe83f1d409cbb85fbf1c890c4a9b7fd34c1d74acec4dce2e0ebe46fcb260e38',\n            size: 11_126_077,\n            tag: 'v0.10.0',\n          },\n        },\n      },\n    },\n    vmutils: {\n      // ★ ONE ARCHIVE, SEVEN TOOLS (measured: 264 MB unpacked). Only a declared member is extracted.\n      //   vmalert-logs is not a tool of its own: it is vmalert run with `--rule.defaultRuleType=vlogs`.\n      binaries: {\n        vmagent: 'vmagent-prod',\n        vmalert: 'vmalert-prod',\n        'vmalert-tool': 'vmalert-tool-prod',\n        vmauth: 'vmauth-prod',\n        vmbackup: 'vmbackup-prod',\n        vmctl: 'vmctl-prod',\n        vmrestore: 'vmrestore-prod',\n      },\n      versions: {\n        '1.151.0': {\n          'darwin-arm64': {\n            asset: 'vmutils-darwin-arm64-v1.151.0.tar.gz',\n            checksums: {\n              recorded: RECORDED,\n              sha256: 'fda5a64fce9022bee7614c3fda27271c0826f1d7b90f8b162e1f48c77c0df04b',\n              url: `${DOWNLOAD}/VictoriaMetrics/releases/download/v1.151.0/vmutils-darwin-arm64-v1.151.0_checksums.txt`,\n            },\n            members: {\n              'vmagent-prod': 'd3b6fa1f71ef48beac619f15f8adfa7610e76605caf37db1ebfbb379b6692329',\n              'vmalert-prod': '62845795167e9ff47890e83ac4ac5934693c105767db88591c95a08f3c4fb354',\n              'vmalert-tool-prod':\n                'cbffb9495e4bb1457c9d45e0a7064b3a3a29b2cfd1ae24bfe8f00ec327c26998',\n              // ⚠️ gitleaks' generic-api-key rule reads this one public digest as a key (its\n              //   entropy; measured 2026-09-22). It is the vendor's published SHA-256 of vmauth-prod.\n              'vmauth-prod': '398df9e0f5b7035d037e39ee9ff66a10ddde5333d832602463aa4d2865fdb508', // gitleaks:allow\n              'vmbackup-prod': '1974a2ee211b49bf581287808e010846f6c47ff135276214c6da628567777b9e',\n              'vmctl-prod': '998b111eee206b98e6d25fdf2fbaa455ecc17c7f9e7c3b2373e127cef762459f',\n              'vmrestore-prod': 'fc824df7215b01b57921ed46afde7fea6b6698adf13d9ea8e3fe36e194ef8190',\n            },\n            repo: 'VictoriaMetrics/VictoriaMetrics',\n            sha256: '27d68bac90e28929214091ed9d27f2e9fef25a080407e2c8661ea9b52dd6b183',\n            size: 123_584_800,\n            tag: 'v1.151.0',\n          },\n        },\n      },\n    },\n  },\n  vendor: 'VictoriaMetrics',\n};\n"
   ],
-  "mappings": ";AAgBA,IAAM,cACJ,gGACA;AAGF,IAAM,cACJ;AAGF,IAAM,cAAc;AAGpB,IAAM,YAAY;AAEX,IAAM,cAAc;AAG3B,IAAM,YAAY,CAAC,OAAmB,SAA2B;AAAA,EAC/D,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1E,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAQ,MAAgC,QAAQ,CAAC,MAAM,UACrD,UAAU,MAAM,GAAG,QAAQ,OAAO,KAAK,IAAI,CAC7C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,OAAO,OAAO,QAAQ,KAAK,EAAE,QAAQ,EAAE,KAAK,UAAU,UAAU,MAAM,GAAG,QAAQ,KAAK,CAAC;AAAA,EACzF;AAAA,EACA,OAAO,CAAC;AAAA;AAOH,IAAM,oBAAoB,CAC/B,aACA,MACA,cACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,MAAM,UAAU,OAAO,QAAQ,eAAe,CAAC,CAAC,GAAG;AAAA,IAC7D,IAAI,YAAY,KAAK,IAAI;AAAA,MACvB,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,IACjE,SAAI,YAAY,KAAK,KAAK;AAAA,MAC7B,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,EACxE;AAAA,EACA,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAEzC,IAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MACzB,MAAM,KAAK,oBAAoB,OAAO,KAAK,8BAA8B,aAAa;AAAA,IACxF,EAAO,SAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAAA,MACzD,MAAM,KAAK,oBAAoB,OAAO,QAAQ,CAAC,6BAA6B,aAAa;AAAA,IAC3F,EAAO,SAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MAChC,MAAM,KAAK,oBAAoB,OAAO,KAAK,2BAA2B,aAAa;AAAA,IACrF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,UAAU,aAAa,CAAC,GAAG,WAAW,GAAG;AAAA,IAC1D,MAAM,KAAK,GAAG,6BAA6B,aAAa;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,qBAAqB,CAAC,YACjC,YAAY,KAAK,OAAO,IAAI,CAAC,gCAAgC,aAAa,IAAI,CAAC;;;AC9C1E,IAAM,eAAe;AAGrB,IAAM,mBAAmB,CAAC,MAAc,UAAiD;AAAA,EAC9F,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAOpE,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,KAAK,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,uBAAuB;AAAA,EAG7D,IACE,KAAK,SAAS,GAAG,KACjB,KACG,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAC9D;AAAA,IACA,MAAM,KAAK,6EAA6E;AAAA,EAC1F;AAAA,EACA,IAAI,KAAK,SAAS,MAAM;AAAA,IAAG,MAAM,KAAK,mBAAmB;AAAA,EACzD,OAAO;AAAA;AAGF,IAAM,eAAe,CAAC,UAAmC;AAAA,EAC9D,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,OAAO;AAAA;;;ACQF,IAAM,sBAAsB;AAS5B,IAAM,aAAa,CAAC,MAAc,KAAa,UACpD,sBAAsB,0BAA0B,OAAO;AAGlD,IAAM,oBAAoB,CAAC,UAGpB,GAAG,MAAM,aAAa,MAAM;AAGnC,IAAM,iBAAiB,CAAC,WAA+C;AAAA,EAC5E,QAAQ,MAAM;AAAA,EACd,cAAc,MAAM;AAAA,EACpB,QAAQ,MAAM,QAAQ;AAAA,EACtB,MAAM,MAAM,QAAQ;AAAA,EACpB,KAAK,WAAW,MAAM,QAAQ,MAAM,MAAM,QAAQ,KAAK,MAAM,QAAQ,KAAK;AAC5E;AAEO,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,OAAO,CAAC,uBAAuB;AAAA,EAC7F,MAAM,QAAkB,CAAC;AAAA,EACzB,KAAK,OAAO,UAAY;AAAA,IAAG,MAAM,KAAK,4CAA4C;AAAA,EAClF,KAAK,OAAO,QAAW;AAAA,IAAG,MAAM,KAAK,2CAA2C;AAAA,EAChF,KAAK,OAAO,QAAW;AAAA,IAAG,MAAM,KAAK,oCAAoC;AAAA,EAGzE,KAAK,OAAO,SAAW;AAAA,IAAG,MAAM,KAAK,mDAAmD;AAAA,EACxF,OAAO;AAAA;AAGT,IAAM,QAAQ;AACP,IAAM,cAAc,KAAK;AAEhC,IAAM,OAAO;AACb,IAAM,UAAU;AAGhB,IAAM,UAAU;AAGhB,IAAM,iBAAiB,CAAC,MAAc,UACpC,CAAC,QAAQ,KAAK,KAAK,KAAK,UAAU,OAAO,UAAU,OAC/C,GAAG,sEAAsE,KAAK,UAAU,KAAK,MAC7F;AAGC,IAAM,cAAc,CAAC,UAKZ;AAAA,EACd,MAAM,UAAU,MAAM,WAAW,CAAC;AAAA,EAClC,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OAAO,CAAC,MAAc,UAAuC;AAAA,IACjE,IAAI,OAAO,UAAU;AAAA,MAAU,OAAO;AAAA,IACtC,MAAM,KAAK,GAAG,qCAAqC;AAAA,IACnD;AAAA;AAAA,EAEF,MAAM,OAAO,KAAK,gBAAgB,QAAQ,IAAI;AAAA,EAG9C,MAAM,WAAW,MAAM,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC;AAAA,EAClD,IAAI,SAAS,cAAc,CAAC,KAAK,KAAK,IAAI,KAAK,aAAa,OAAO,aAAa;AAAA,IAC9E,MAAM,KAAK,sCAAsC,KAAK,UAAU,IAAI,GAAG;AAAA,EACzE,YAAY,MAAM,UAAU;AAAA,IAC1B,CAAC,eAAe,QAAQ,GAAG;AAAA,IAC3B,CAAC,QAAQ,MAAM,IAAI;AAAA,EACrB,GAAY;AAAA,IACV,MAAM,QAAQ,KAAK,MAAM,KAAK;AAAA,IAC9B,MAAM,UAAU,UAAU,YAAY,YAAY,eAAe,MAAM,KAAK;AAAA,IAC5E,IAAI,YAAY;AAAA,MAAW,MAAM,KAAK,OAAO;AAAA,EAC/C;AAAA,EACA,MAAM,QAAQ,KAAK,iBAAiB,QAAQ,KAAK;AAAA,EACjD,IAAI,UAAU,WAAW;AAAA,IACvB,MAAM,UAAU,eAAe,iBAAiB,KAAK;AAAA,IACrD,IAAI,YAAY;AAAA,MAAW,MAAM,KAAK,OAAO;AAAA,IACxC,SAAI,CAAC,QAAQ,KAAK,KAAK;AAAA,MAC1B,MAAM,KAAK,6CAA6C,QAAQ;AAAA,EACpE;AAAA,EAIA,MAAM,OAAO,QAAQ;AAAA,EACrB,IAAI,OAAO,SAAS,YAAY,CAAC,OAAO,cAAc,IAAI,KAAK,QAAQ,KAAK,OAAO,aAAa;AAAA,IAC9F,MAAM,KAAK,qDAAqD,OAAO,WAAW,GAAG;AAAA,EACvF;AAAA,EACA,YAAY,MAAM,UAAU;AAAA,IAC1B,CAAC,kBAAkB,QAAQ,MAAM;AAAA,IACjC,CAAC,UAAU,MAAM,MAAM;AAAA,EACzB,GAAY;AAAA,IACV,MAAM,QAAQ,KAAK,MAAM,KAAK;AAAA,IAC9B,IAAI,UAAU,aAAa,CAAC,MAAM,KAAK,KAAK;AAAA,MAC1C,MAAM,KAAK,GAAG,uCAAuC;AAAA,EACzD;AAAA,EACA,MAAM,SAAS,KAAK,UAAU,MAAM,MAAM;AAAA,EAE1C,IACE,WAAW,cACV,WAAW,MAAM,OAAO,WAAW,GAAG,KAAK,OAAO,MAAM,GAAG,EAAE,SAAS,IAAI,IAC3E;AAAA,IACA,MAAM,KAAK,sDAAsD,KAAK,UAAU,MAAM,GAAG;AAAA,EAC3F;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,eAAe,CAAC,QAAQ,OAAO,SAAS,QAAQ,QAAQ;AAKvD,IAAM,YAAY,CAAC,MAAY,SACpC,KAAK,WAAW,KAAK,UACrB,KAAK,WAAW,KAAK,UACrB,aAAa,KAAK,CAAC,QAAQ,KAAK,QAAQ,SAAS,KAAK,QAAQ,IAAI;AAO7D,IAAM,iBAAiB,CAAC,MAAY,SACzC,cAAc,KAAK,QAAQ,OAAO,KAAK,UAAU,KAAK,0CACtD,QAAQ,KAAK,QAAQ,OAAO,KAAK,UAAU,KAAK,oDAChD;AAGK,IAAM,iBAAiB,CAAC,UAAwC;AAAA,EACrE,GAAG,YAAY,KAAK;AAAA,EACpB,GAAG,aAAa,MAAM,SAAS,EAAE,IAAI,CAAC,YAAY,cAAc,SAAS;AAAA,EACzE,GAAG,aAAa,MAAM,QAAQ,mBAAmB;AAAA,EACjD,GAAG,iBAAiB,SAAS,MAAM,KAAK;AAAA,EACxC,GAAG,iBAAiB,SAAS,MAAM,KAAK;AAC1C;;AC5MA;AACA;AACA;AACA;;;AClBA;AAEO,IAAM,OAAO,CAAI,SACf,kBAAW;AAAA,EAChB,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,EAC3E,KAAK;AACP,CAAC;AAQI,IAAM,iBAAiB,CAAC,MAAe,QAAoC;AAAA,EAChF,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,QAAS,KAAiC;AAAA,EAChD,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA;;;ACZ7C;AACA;AAAA;AA6FO,MAAM,0BAAkC,gBAAuC,EACpF,8BACF,EAAE;AAAC;AAGI,IAAM,kBAAkB,CAAC,WACxB,cAAQ,mBAAmB,MAAM;AAGlC,IAAM,eAAe,CAAC,WAC3B,OAAO,cAAc,OAAO,aAAa,MAAM;;;AC7GjD;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,WAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,YAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,gBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,cAAM,QAAQ,GAAU,oBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,gBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,cAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,cAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,YAAW,sBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,YAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,sBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,sBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,YACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAaK,IAAM,sBAAsB,CAAC,KAAa,eACxC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,cAAM;AAAA,CACtE;;;AFxFI,IAAM,eAAe,CAAC,QACpB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,sBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,sBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AIzF9B;;;ACTO,IAAM,YAAY,CACvB,GACA,MACwB;AAAA,EACxB,IAAI,MAAM,aAAa,MAAM;AAAA,IAAW,OAAO;AAAA,EAC/C,IAAI,EAAE,QAAQ,aAAa,EAAE,QAAQ,aAAa,EAAE,QAAQ,aAAa,EAAE,QAAQ,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAIjC,IAAM,UAAU,OACrB,QACA,GACA,MACiC;AAAA,EACjC,IAAI,MAAM;AAAA,IAAG,OAAO;AAAA,EACpB,OAAO,MAAM,SAAS,MAAM,QAAQ,IAAI,CAAC,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,EACxE,OAAO,UAAU,MAAM,KAAK;AAAA;AAQvB,IAAM,eAAe,OAC1B,QACA,SACA,MACA,QACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,QAAQ,QAAQ,SAAS,IAAI;AAAA,EAChD,IAAI,SAAS;AAAA,IAAM;AAAA,EACnB,MAAM,OAAO;AAAA,EACb,IAAI,SAAS,aAAc,MAAM,OAAO,KAAK,IAAI,MAAO,WAAW;AAAA,IACjE,MAAM,OACJ,MACA,yBAAyB,gEACvB,2FACA,sCACJ;AAAA,EACF;AAAA;;;ACzDF;;;ACqBO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EADX,WAAW,CACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,SAAS,KAAK,WAAW,SAAS,QAAQ;AAAA,IAHhD;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,SACJ;AAAA,IACA,0DACA;AAAA,IACA;AAAA;AAGF,IAAM,YAAY;AASlB,IAAM,YAAY;AAQX,IAAM,aAAa,CAAC,MAAc,SAAyB;AAAA,EAChE,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,EAC/B,IAAI,QAAQ,MAAM;AAAA,IAChB,MAAM,OAAO,IAAI,GAAG,YAAY,CAAC,KAAK;AAAA,IACtC,MAAM,IAAI,WACR,MACA,KAAK,KAAK,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,4BACtD;AAAA,EACF;AAAA,EACA,OAAO,KACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,MAAM,OAAO;AAAA;AAG7B,IAAM,iBAAgB,CAAC,UAA2B;AAAA,EAChD,MAAM,QAAQ,OAAO,eAAe,KAAK;AAAA,EACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAGjD,IAAM,cAAc,CAAC,OAAgB,MAAc,OAAe,QAAwB;AAAA,EACxF,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAC7B,IAAI,QAAQ;AAAA,IAAW,MAAM,IAAI,WAAW,MAAM,sBAAsB,OAAO,SAAS,GAAG;AAAA,EAC3F,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,IAAI,KAAK,GAAG,cAAc,WAAW,OAAO,IAAI,YAAY;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,IAAI,KAAK,GAAG,OAAO,QAAQ,SAAS,WAAW;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAE7B,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAAA,MAChC,MAAM,IAAI,WAAW,MAAM,GAAG,OAAO,KAAK,6CAA6C;AAAA,IACzF;AAAA,IACA,IAAI,KAAK,GAAG,eAAe,OAAO,UAAU,IAAI,IAAI,KAAK,aAAa;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,IAAI,KAAK,GAAG,aAAa;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB,YAAY,OAAO,SAAU,MAA6B,QAAQ,GAAG;AAAA,MACnE,YAAY,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG,GAAG;AAAA,IAC/D;AAAA,IACA,IAAI,KAAK,GAAG,aAAa;AAAA,IACzB;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,eAAc,KAAK,GAAG;AAAA,IACvE,WAAW,OAAkC,MAAM,OAAO,GAAG;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAM,OAAO,UAAU,OAAO,SAAS,OAAO;AAAA,EAC9C,MAAM,IAAI,WAAW,MAAM,GAAG,+CAA+C;AAAA;AAG/E,IAAM,aAAa,CACjB,MACA,MACA,OACA,QACS;AAAA,EACT,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAE7B,MAAM,OAAO,OAAO,KAAK,IAAI,EAAE,KAAK;AAAA,EACpC,IAAI,KAAK,WAAW,GAAG;AAAA,IACrB,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB;AAAA,EACF;AAAA,EACA,IAAI,KAAK,GAAG,WAAW;AAAA,EACvB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,QAAQ;AAAA,IAC7C,IAAI,KAAK,GAAG,YAAa,WAAW,KAAK,KAAK,SAAS;AAAA,IACvD,YAAY,KAAK,MAAM,OAAO,QAAQ,GAAG,GAAG;AAAA,EAC9C;AAAA,EACA,IAAI,KAAK,GAAG,YAAY;AAAA;AAInB,IAAM,cAAc,CAAC,SAA4B;AAAA,EACtD,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,KAAK,CAAC,eAAc,IAAI,GAAG;AAAA,IAC5F,MAAM,IAAI,WAAW,IAAI,iDAAiD;AAAA,EAC5E;AAAA,EACA,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAiC,IAAI,GAAG,GAAG;AAAA,EACtD,OAAO,GAAG,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;;;ADxE3B,IAAM,cAAc,CAAC,WAA6C;AAAA,EACvE,IAAI,WAAW;AAAA,IAAU,OAAO,EAAE,MAAM,SAAS;AAAA,EACjD,MAAM,QAAQ,eAAe,KAAK,MAAM;AAAA,EACxC,OAAO,QAAQ,OAAO,YAAY,YAAY,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,EAAE,EAAE;AAAA;AAG9E,IAAM,gBAAgB,CAAC,OAAe,WAAkC,GAAG,UAAU;AAOrF,IAAM,eAAe,CAC1B,OACA,QACA,SACW;AAAA,EACX,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,0BAA0B;AAAA,EAE/D,IAAI,SAAS,aAAa,CAAC,KAAK,WAAW,GAAG,GAAG;AAAA,IAC/C,MAAM,IAAI,MAAM,OAAO,OAAO,OAAO,GAAG,gDAAgD;AAAA,EAC1F;AAAA,EACA,OAAO,GAAG,6BAA6B;AAAA;AAIlC,IAAM,aAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAAe,CAAC,UAAuC;AAAA,EAC3D,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,MAAM,WAAW;AAAA,IAAW,KAAK,YAAY,MAAM;AAAA,EACvD,IAAI,MAAM,SAAS;AAAA,IAAW,KAAK,UAAU,MAAM;AAAA,EACnD,IAAI,MAAM,QAAQ;AAAA,IAAW,KAAK,SAAS,MAAM;AAAA,EACjD,IAAI,MAAM,YAAY;AAAA,IAAW,KAAK,aAAa,MAAM;AAAA,EACzD,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,MAAM;AAAA,EACrD,OAAO;AAAA;AAGT,IAAM,iBAAiB,CAAC,cAAqC;AAAA,EAC3D,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO;AAAA,EAC3C,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,UAAU,mBAAmB;AAAA,IAAW,KAAK,oBAAoB,UAAU;AAAA,EAC/E,IAAI,UAAU,YAAY;AAAA,IAAW,KAAK,aAAa,UAAU;AAAA,EACjE,OAAO;AAAA;AAIF,IAAM,eAAe,CAAC,UAAsC;AAAA,EACjE,MAAM,OAAmC,KAAK,MAAM,UAAU;AAAA,EAC9D,KAAK,WAAW,MAAM;AAAA,EACtB,KAAK,sBAAsB,CAAC,GAAG,MAAM,gBAAgB;AAAA,EACrD,MAAM,MAAM,MAAM,eAAe,CAAC;AAAA,EAClC,IAAI,OAAO,KAAK,GAAG,EAAE,SAAS;AAAA,IAAG,KAAK,0BAA0B,KAAK,IAAI;AAAA,EACzE,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,eAAe,MAAM,SAAS;AAAA,EACrF,IAAI,MAAM,kBAAkB;AAAA,IAAW,KAAK,mBAAmB,MAAM;AAAA,EACrE,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,KAAK,2BAA2B,MAAM,QAAQ,QAAQ,IACjD,SAAyC,IAAI,YAAY,IAC1D,aAAa,QAA4B;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,oBAAoB;AAAA,IAAW,KAAK,qBAAqB,MAAM;AAAA,EACzE,IAAI,MAAM,sBAAsB;AAAA,IAAW,KAAK,uBAAuB,MAAM;AAAA,EAC7E,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,aAAa;AAAA,IAAW,KAAK,cAAc,MAAM;AAAA,EAC3D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,OAAO;AAAA;AAGF,IAAM,YAAY,CAAC,UACxB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAG1C,IAAM,YAAY,CACvB,UACwD;AAAA,EACxD,MAAM,OAAO,YAAY,aAAa,KAAK,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC3C,OAAO,EAAE,OAAO,QAAQ,UAAU,KAAK,GAAG,KAAK;AAAA;;;AE/IjD,IAAM,YAAY,CAAC,UACjB,OAAO,UAAU,WAAW,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;AAGrE,IAAM,aAAa,OACxB,QACA,UACA,MACA,WAC4C;AAAA,EAC5C,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI,SAAS,UAAU,WAAW;AAAA,IAChC,MAAM,UAAU,SAAS,KAAK,MAAM,MAAM,OAAO,WAAW,OAAO,SAAS,KAAK,CAAC,IAAI;AAAA,IACtF,IAAI,QAAQ;AAAA,MAAW,MAAM,OAAO,MAAM,WAAW,OAAO,SAAS,KAAK,gBAAgB;AAAA,EAC5F;AAAA,EACA,IAAI,SAAS,UAAU,WAAW;AAAA,IAChC,MAAM,UAAU,SAAS,KAAK,KAAM,MAAM,OAAO,YAAY,OAAO,SAAS,KAAK,CAAC;AAAA,IACnF,IAAI,QAAQ;AAAA,MAAW,MAAM,OAAO,MAAM,YAAY,OAAO,SAAS,KAAK,gBAAgB;AAAA,EAC7F;AAAA,EACA,OAAO,KAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,MAAQ,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,EAAG;AAAA;AAIjF,IAAM,qBAAqB,OAChC,QACA,SAC4C;AAAA,EAC5C,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,KAAK,SAAS,SAAS,MAAM,OAAO,SAAS,IAAI,IAAI;AAAA,EACnE,OAAO;AAAA,IACL,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,IACX;AAAA,IACA,QAAQ,UAAU,YAAY,KAAK,UAAU,KAAK;AAAA,IAClD,MAAM,KAAK;AAAA,IACX,KAAK,KAAK;AAAA,EACZ;AAAA;AAGK,IAAM,iBAAiB,CAAC,UAAoC;AAAA,EACjE,MAAM,KAAK;AAAA,KACP,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AAAA,KAC9C,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AACpD;AAEO,IAAM,cAAc,CAAC,MAA0B,SACpD,KAAK,WAAW,KAAK,UACrB,KAAK,SAAS,KAAK,SAClB,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK,SAC5C,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK;AAOxC,IAAM,aAAa,OACxB,QACA,MACA,WACkB;AAAA,EAClB,MAAM,SAAS,OAAO,SAA8B;AAAA,IAClD,MAAM,OAAO,aAAa,KAAK,MAAM,eAAe,IAAI,CAAC;AAAA,IACzD,OAAO;AAAA;AAAA,EAMT,IAAI,KAAK,SAAS,OAAO,MAAM;AAAA,IAC7B,MAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK,MAAM,OAAO,IAAI;AAAA,IACzD,OAAO,OAAO,EAAE,QAAQ,SAAS,OAAO,WAAW,UAAU,CAAC;AAAA,EAChE;AAAA,EACA,IAAI,KAAK,WAAW,OAAO;AAAA,IAAQ,OAAO,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA,EACrE,MAAM,OAAO,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,EACvD,OAAO,SAAS,aAAa,YAAY,MAAM,IAAI,IAC/C,EAAE,QAAQ,OAAO,IACjB,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA;AAsB1B,IAAM,eAAe,OAC1B,QACA,MACA,QACA,QAAQ,UACwB;AAAA,EAChC,QAAQ,MAAM,WAAW;AAAA,EACzB,MAAM,OAAO,KAAK;AAAA,EAElB,IAAI,KAAK,QAAQ,aAAa,KAAK,QAAQ,OAAO,aAAa,KAAK,CAAC,aAAa,MAAM,GAAG;AAAA,IACzF,MAAM,OACJ,MACA,SAAS,OAAO,KAAK,KAAK,sEACxB,2FACA,mCACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS,aAAa,KAAK,SAAS,QAAQ;AAAA,IAC9C,MAAM,OACJ,MACA,QAAQ,KAAK,gEACf;AAAA,EACF;AAAA,EACA,MAAM,SAAS,SAAS,YAAY,YAAY,MAAM,mBAAmB,QAAQ,IAAI;AAAA,EAKrF,MAAM,QAAQ,WAAW,aAAa,OAAO,SAAS;AAAA,EACtD,MAAM,QAAQ,QAAQ,YAAY;AAAA,EASlC,MAAM,WAAW,SAAS,WAAW;AAAA,EACrC,IAAI,UAAU,aAAa,WAAW,aAAa,CAAC,YAAY,QAAQ,IAAI,KAAK,CAAC,UAAU;AAAA,IAC1F,MAAM,OACJ,MACA,6FACE,sBACJ;AAAA,EACF;AAAA,EACA,IAAI,WAAW,aAAa,CAAC,YAAY,QAAQ,IAAI,GAAG;AAAA,IACtD,MAAM,QAAQ,MAAM,KAAK,SAAS,MAAM;AAAA,IAGxC,IAAI,UAAU,KAAK,MAAM,KAAK,QAAQ;AAAA,MACpC,MAAM,OAAO,MAAM,qCAAqC,KAAK,8BAA8B;AAAA,IAC7F;AAAA,IACA,MAAM,OAAO,gBAAgB,MAAM,OAAO,eAAe,IAAI,CAAC;AAAA,EAChE;AAAA,EAOA,MAAM,WAAW,YAAY;AAAA,IAC3B,IAAI,WAAW;AAAA,MAAW,MAAM,OAAO,WAAW,IAAI,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA;AAAA,EAE/E,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,IAAI,EAAE,MAAM,OAAO,UAAmB;AAAA,IACnF,MAAM,SAAS;AAAA,IACf,MAAM,OAAO,MAAM,kDAAkD,OAAO,KAAK,GAAG;AAAA,GACrF;AAAA,EACD,IAAI,UAAU,aAAa,CAAC,YAAY,OAAO,IAAI,GAAG;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,MAAM,OAAO,MAAM,wEAAwE;AAAA,EAC7F;AAAA,EAGA,IAAI;AAAA,IACF,MAAM,aACJ,QACA,OAAO,MACP,MACA,MAAM,gBAAgB,QAAQ,QAAQ,MAAM,GAC5C,MACF;AAAA,EACF,OAAO;AAAA;AAIF,IAAM,kBAAkB,OAC7B,QACA,QACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,OAAO,KAAK,OAAO,IAAI;AAAA,EAC1C,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAAQ,MAAM,OAAO,OAAO,MAAM,YAAY,KAAK,uBAAuB;AAAA,EAC5F,MAAM,OAAO,WAAW,OAAO,IAAI;AAAA;;;AC3LrC,IAAM,QAAQ;AAEd,IAAM,aAAa,CAAC,OAAe,WACjC,GAAG,UAAU,KAAK,yCAAyC,qBAAqB,gBAChF,iCAAiC,gEACjC;AAGK,IAAM,kBAAkB,CAAC,OAAe,WAC7C,UAAU,SAAS,YAAY,GAAG,UAAU,WAAW,OAAO,MAAM;AAQ/D,IAAM,eAAe,OAC1B,QACA,MACA,UACgC;AAAA,EAChC,MAAM,OAAO,MAAM,OAAO,KAAK,KAAK,IAAI;AAAA,EACxC,IAAI,MAAM,SAAS;AAAA,IAAQ;AAAA,EAC3B,MAAM,SAAS,MAAM,mBAAmB,QAAQ,KAAK,IAAI,IAAI,UAAU;AAAA,EACvE,IAAI,UAAU,KAAK;AAAA,IAAQ,OAAO,gBAAgB,OAAO,KAAK,MAAM;AAAA,EACpE,IAAI;AAAA,IAAO;AAAA,EACX,OACE,GAAG,0FACH,kFACA,+FACA,+FACA,8FACA;AAAA;;;AC/DJ;AAAA;AAGO,MAAM,sBAA2B,iBAAY,eAAe,EAEhE;AAAC;AAAA;AAGG,MAAM,uBAA4B,iBAAY,gBAAgB,EAIlE;AAAC;AAAA;AAGG,MAAM,yBAA8B,iBAAY,kBAAkB,EAKtE;AAAC;AAAA;AAGG,MAAM,uBAA4B,iBAAY,gBAAgB,EAElE;AAAC;;;ACfJ,IAAM,QAAQ;AAEd,IAAM,QAA0C;AAAA,EAC9C,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL;AAEA,IAAM,SAAS,CAAC,YAAoC,IAAI,eAAe,EAAE,QAAQ,CAAC;AAClF,IAAM,SAAS,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AACvD,IAAM,QAAQ,IAAI,YAAY,QAAQ;AAGtC,IAAM,QAAQ,CAAC,OAAmB,OAAe,WAA+B;AAAA,EAC9E,MAAM,QAAQ,MAAM,SAAS,OAAO,QAAQ,MAAM;AAAA,EAClD,MAAM,MAAM,MAAM,QAAQ,CAAC;AAAA,EAC3B,OAAO,QAAQ,KAAK,QAAQ,MAAM,SAAS,GAAG,GAAG;AAAA;AAGnD,IAAM,OAAO,CAAC,OAAmB,OAAe,WAA2B;AAAA,EACzE,IAAI;AAAA,IACF,OAAO,OAAO,OAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AAAA,IAChD,MAAM;AAAA,IACN,MAAM,OAAO,4BAA4B;AAAA;AAAA;AAI7C,IAAM,QAAQ,CAAC,OAAmB,OAAe,QAAgB,SAAyB;AAAA,EACxF,MAAM,MAAM,MAAM,SAAS,OAAO,QAAQ,MAAM;AAAA,EAChD,MAAM,IAAI,MAAM,KAAK,SAAU;AAAA,IAAG,MAAM,OAAO,GAAG,0BAA0B;AAAA,EAC5E,MAAM,SAAS,MACZ,OAAO,GAAG,EACV,QAAQ,WAAW,EAAE,EACrB,QAAQ,OAAO,EAAE;AAAA,EACpB,IAAI,CAAC,WAAW,KAAK,MAAM;AAAA,IAAG,MAAM,OAAO,GAAG,sBAAsB,KAAK,UAAU,MAAM,GAAG;AAAA,EAC5F,OAAO,OAAO,SAAS,QAAQ,CAAC;AAAA;AAGlC,IAAM,gBAAgB,CAAC,UAA+B;AAAA,EACpD,IAAI,MAAM;AAAA,EAEV,SAAS,KAAK,EAAG,KAAK,OAAO,MAAM;AAAA,IAAG,OAAO,MAAM,OAAO,KAAK,MAAM,KAAQ,MAAM,OAAO;AAAA,EAC1F,OAAO,QAAQ,MAAM,OAAO,KAAK,GAAG,mBAAmB;AAAA;AAIzD,IAAM,cAAc,CAAC,SAAqC;AAAA,EACxD,IAAI,SAAS;AAAA,IAAI,OAAO;AAAA,EACxB,IAAI,KAAK,WAAW,GAAG;AAAA,IAAG,OAAO;AAAA,EACjC,IAAI,KAAK,MAAM,GAAG,EAAE,SAAS,IAAI;AAAA,IAAG,OAAO;AAAA,EAC3C;AAAA;AAIK,IAAM,cAAc,CAAC,UAA6C;AAAA,EACvE,MAAM,MAAM,IAAI,WAAW,MAAM,OAAO,CAAC,OAAO,SAAS,QAAQ,KAAK,QAAQ,CAAC,CAAC;AAAA,EAChF,IAAI,KAAK;AAAA,EACT,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,IAAI,MAAM,EAAE;AAAA,IAChB,MAAM,KAAK;AAAA,EACb;AAAA,EACA,OAAO;AAAA;AAWF,IAAM,YAAY,CAAC,WAAgC;AAAA,EACxD,MAAM,SAAS,IAAI,WAAW,KAAK;AAAA,EACnC,MAAM,UAAU,IAAI;AAAA,EACpB,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OAAO,IAAI;AAAA,EACjB,IAAI,QAA2C;AAAA,EAC/C,IAAI,SAAS;AAAA,EACb,IAAI,YAAY;AAAA,EAChB,IAAI,UAAU;AAAA,EACd,IAAI,QAAQ;AAAA,EACZ,IAAI,OAAO;AAAA,EACX,IAAI;AAAA,EAEJ,MAAM,WAAW,MAAM;AAAA,IACrB,IAAI,UAAU;AAAA,MAAW,QAAQ,IAAI,MAAM,YAAY,KAAK,CAAC;AAAA,IAC7D,QAAQ;AAAA,IACR,QAAQ,UAAU,IAAI,QAAQ;AAAA;AAAA,EAGhC,MAAM,aAAa,MAAM;AAAA,IACvB,IAAI,OAAO,MAAM,CAAC,SAAS,SAAS,CAAC,GAAG;AAAA,MACtC,SAAS;AAAA,MACT,IAAI,UAAU;AAAA,QAAG,QAAQ;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,QAAQ;AAAA,MAAG,MAAM,OAAO,0DAA0D;AAAA,IACtF,IAAI,CAAC,cAAc,MAAM;AAAA,MAAG,MAAM,OAAO,oCAAoC;AAAA,IAC7E,MAAM,QAAQ,MAAM,OAAO,OAAO,SAAS,KAAK,GAAG,CAAC;AAAA,IACpD,MAAM,QAAQ,UAAU;AAAA,IACxB,IAAI,CAAC,SAAS,UAAU;AAAA,MACtB,MAAM,OAAO,0CAA0C;AAAA,IACzD,MAAM,SAAS,QAAQ,KAAK,QAAQ,KAAK,GAAG,IAAI;AAAA,IAChD,OAAO,WAAW,KAAK,KAAK,QAAQ,GAAG,GAAG,IAAI,GAAG,UAAU,KAAK,QAAQ,GAAG,GAAG;AAAA,IAC9E,MAAM,UAAU,YAAY,IAAI;AAAA,IAChC,IAAI,YAAY;AAAA,MAAW,MAAM,OAAO,SAAS,KAAK,UAAU,IAAI,KAAK,SAAS;AAAA,IAClF,MAAM,OAAO,OAAO,aAAa,OAAO,QAAQ,CAAC;AAAA,IACjD,IAAI,SAAS,OAAO,SAAS,QAAM;AAAA,MACjC,MAAM,OAAO,MAAM,SAAS,mBAAmB,KAAK,UAAU,IAAI;AAAA,MAClE,MAAM,OAAO,UAAU,YAAY,uCAAuC;AAAA,IAC5E;AAAA,IACA,IAAI,KAAK,IAAI,IAAI;AAAA,MAAG,MAAM,OAAO,UAAU,qBAAqB;AAAA,IAChE,KAAK,IAAI,IAAI;AAAA,IACb,MAAM,KAAK,IAAI;AAAA,IACf,YAAY,MAAM,QAAQ,KAAK,IAAI,UAAU,cAAc;AAAA,IAC3D,WAAW,QAAS,YAAY,SAAU;AAAA,IAC1C,QAAQ,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI;AAAA,IAChC,QAAQ;AAAA,IACR,IAAI,cAAc;AAAA,MAAG,SAAS;AAAA;AAAA,EAGhC,MAAM,OAAO,CAAC,UAA4B;AAAA,IACxC,IAAI,KAAK;AAAA,IACT,OAAO,KAAK,MAAM,QAAQ;AAAA,MACxB,IAAI,UAAU,OAAO;AAAA,QACnB,IAAI,MAAM,SAAS,EAAE,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC,GAAG;AAAA,UACjD,MAAM,OAAO,wCAAwC;AAAA,QACvD;AAAA,QACA;AAAA,MACF;AAAA,MACA,IAAI,UAAU,UAAU;AAAA,QACtB,MAAM,OAAO,KAAK,IAAI,QAAQ,QAAQ,MAAM,SAAS,EAAE;AAAA,QACvD,OAAO,IAAI,MAAM,SAAS,IAAI,KAAK,IAAI,GAAG,MAAM;AAAA,QAChD,UAAU;AAAA,QACV,MAAM;AAAA,QACN,IAAI,WAAW,OAAO;AAAA,UACpB,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,MACF,EAAO,SAAI,UAAU,QAAQ;AAAA,QAC3B,MAAM,OAAO,KAAK,IAAI,WAAW,MAAM,SAAS,EAAE;AAAA,QAElD,OAAO,KAAK,MAAM,MAAM,IAAI,KAAK,IAAI,CAAC;AAAA,QACtC,aAAa;AAAA,QACb,MAAM;AAAA,QACN,IAAI,cAAc;AAAA,UAAG,SAAS;AAAA,MAChC,EAAO;AAAA,QACL,MAAM,OAAO,KAAK,IAAI,SAAS,MAAM,SAAS,EAAE;AAAA,QAChD,WAAW;AAAA,QACX,MAAM;AAAA,QACN,IAAI,YAAY;AAAA,UAAG,QAAQ;AAAA;AAAA,IAE/B;AAAA;AAAA,EAGF,MAAM,SAAS,MAAmB;AAAA,IAChC,IAAI,UAAU;AAAA,MAAO,MAAM,OAAO,oDAAoD;AAAA,IACtF,OAAO,EAAE,SAAS,MAAM;AAAA;AAAA,EAG1B,OAAO,EAAE,QAAQ,KAAK;AAAA;;;ACzKxB,IAAM,QAAQ,KAAK;AAGZ,IAAM,iBAAiB,OAC5B,SACA,WACyB;AAAA,EACzB,MAAM,MAAM,UAAU,MAAM;AAAA,EAK5B,IAAI,SAAS;AAAA,EACb,MAAM,SAAS,IAAI,eAA2B;AAAA,IAC5C,IAAI,CAAC,YAAY;AAAA,MACf,IAAI,UAAU,QAAQ,QAAQ;AAAA,QAC5B,WAAW,MAAM;AAAA,QACjB;AAAA,MACF;AAAA,MACA,WAAW,QAAQ,QAAQ,MAAM,QAAQ,SAAS,KAAK,CAAC;AAAA,MACxD,UAAU;AAAA;AAAA,EAEd,CAAC;AAAA,EACD,MAAM,WAAW,OAAO,YAAY,IAAI,oBAAoB,MAAM,CAAC,EAAE,UAAU;AAAA,EAC/E,IAAI;AAAA,IACF,UAAS;AAAA,MACP,QAAQ,MAAM,UAAU,MAAM,SAAS,KAAK;AAAA,MAC5C,IAAI;AAAA,QAAM;AAAA,MACV,IAAI,KAAK,KAAK;AAAA,IAChB;AAAA,IACA,OAAO,OAAO;AAAA,IACd,MAAM,SAAS,OAAO,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA,IAC7C,IAAI,iBAAiB;AAAA,MAAgB,MAAM;AAAA,IAC3C,MAAM,IAAI,eAAe,EAAE,SAAS,sBAAsB,OAAO,KAAK,KAAK,CAAC;AAAA;AAAA,EAE9E,OAAO,IAAI,OAAO;AAAA;AAGpB,IAAM,WAAW,CAAC,SAAiB,UAAkB,WACnD,IAAI,iBAAiB;AAAA,EACnB;AAAA,EACA;AAAA,EACA,SAAS,GAAG,qBAAqB,0BAA0B;AAAA,EAC3D;AACF,CAAC;AAOI,IAAM,iBAAiB,OAC5B,SACA,YACwB;AAAA,EACxB,MAAM,aAAa,UAAU,OAAO;AAAA,EACpC,IAAI,eAAe,QAAQ;AAAA,IAAQ,MAAM,SAAS,QAAQ,KAAK,QAAQ,QAAQ,UAAU;AAAA,EACzF,QAAQ,SAAS,UAAU,MAAM,eAAe,SAAS,IAAI,IAAI,CAAC,QAAQ,MAAM,CAAC,CAAC;AAAA,EAClF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,MAAM;AAAA,EACxC,IAAI,UAAU,WAAW;AAAA,IACvB,MAAM,IAAI,eAAe;AAAA,MACvB,SAAS,GAAG,QAAQ,oCAAoC,QAAQ,mBAAmB,MAAM,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,IAAI,KAAK;AAAA,IAC9H,CAAC;AAAA,EACH;AAAA,EACA,MAAM,YAAY,UAAU,KAAK;AAAA,EACjC,IAAI,cAAc,QAAQ,cAAc;AAAA,IACtC,MAAM,SAAS,WAAW,QAAQ,WAAW,QAAQ,cAAc,SAAS;AAAA,EAC9E;AAAA,EACA,OAAO;AAAA;;;ACpDF,IAAM,UAAU;AAEhB,IAAM,UAAS,CAAC,MAAc,YACnC,IAAI,cAAc,EAAE,SAAS,kBAAkB,SAAS,UAAU,CAAC;AAGrE,IAAM,WAAW,CAAC,MAAc,UAA4B;AAAA,EAC1D,MAAM,MAAM,CAAC,YAAoB,kBAAkB,SAAS,YAAY;AAAA,EACxE,IAAI,iBAAiB,kBAAkB;AAAA,IACrC,QAAQ,QAAQ,UAAU,YAAY;AAAA,IACtC,OAAO,IAAI,iBAAiB,EAAE,QAAQ,UAAU,SAAS,IAAI,MAAM,OAAO,GAAG,QAAQ,CAAC;AAAA,EACxF;AAAA,EACA,IAAI,iBAAiB;AAAA,IAAgB,OAAO,IAAI,eAAe,EAAE,SAAS,IAAI,MAAM,OAAO,EAAE,CAAC;AAAA,EAC9F,IAAI,iBAAiB,gBAAgB;AAAA,IACnC,OAAO,IAAI,eAAe,EAAE,SAAS,IAAI,MAAM,OAAO,GAAG,WAAW,MAAM,UAAU,CAAC;AAAA,EACvF;AAAA,EACA,OAAO;AAAA;AAMF,IAAM,gBAAgB,OAC3B,QACA,UACqB;AAAA,EACrB,MAAM,OAAO,kBAAkB,KAAK;AAAA,EACpC,MAAM,WAAW,eAAe,KAAK;AAAA,EACrC,IAAI,SAAS,SAAS;AAAA,IAAG,MAAM,QAAO,MAAM,GAAG,SAAS,KAAK,IAAI,MAAM,SAAS;AAAA,EAChF,MAAM,MAAM,MAAM,WAAW,QAAQ,OAAO,MAAM,OAAM;AAAA,EACxD,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,OAAO,EAAE,UAAU,eAAe,KAAK,GAAG,MAAM,EAAE,MAAM,MAAM,QAAQ,MAAM,WAAW,IAAI,EAAE;AAAA;AAG/F,IAAM,aAAa,CACjB,OACA,cAC6B,KAAK,OAAO,QAAQ,SAAS,QAAQ,KAAK,SAAS,IAAI;AAO/E,IAAM,aAAa,OACxB,QACA,UACiD;AAAA,EACjD,QAAQ,UAAU,SAAS,MAAM,cAAc,QAAQ,KAAK;AAAA,EAC5D,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,EACxD,OAAO,UAAU,YAAY,YAAY,WAAW,OAAO,QAAQ;AAAA;AAI9D,IAAM,gBAAgB,OAC3B,QACA,WACiD;AAAA,EACjD,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,OAAO,IAAI;AAAA,EAC1D,OAAO,UAAU,YAAY,YAAY,KAAK,OAAO,QAAQ,OAAO,QAAQ,KAAK,OAAO,IAAI;AAAA;AAQ9F,IAAM,iBAAiB,OAAO,QAAoB,UAA6C;AAAA,EAC7F,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,SAAS;AAAA,EAQ9C,IAAI,MAAM,SAAS,gBAAgB,KAAK,OAAO,QAAW,GAAG;AAAA,IAC3D,MAAM,QACJ,kBAAkB,KAAK,GACvB,aAAa,MAAM,mDACjB,GAAG,KAAK,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,iDACxC,wCAAwC,SAC5C;AAAA,EACF;AAAA,EACA,IAAI,MAAM,SAAS;AAAA,IAAa;AAAA,EAChC,MAAM,MAAM,SAAS,YAAY,mBAAmB,QAAQ,KAAK;AAAA,EACjE,MAAM,QACJ,kBAAkB,KAAK,GACvB,aAAa,MAAM,aAAa,sDAAsD,SACxF;AAAA;AAoBK,IAAM,kBAAkB,OAC7B,QACA,OACA,OACA,UAA4B,CAAC,MACQ;AAAA,EACrC,QAAQ,QAAQ,OAAO,WAAW,CAAC,GAAG,cAAO,YAAS;AAAA,IAAG;AAAA,QAAc;AAAA,EAEvE,IAAI,SAAS,SAAS,GAAG;AAAA,IACvB,MAAM,QACJ,kBAAkB,KAAK,GACvB,GAAG,SAAS,KAAK,IAAI,sEACnB,8BAA8B,SAClC;AAAA,EACF;AAAA,EACA,QAAQ,UAAU,SAAS,MAAM,cAAc,QAAQ,KAAK;AAAA,EAE5D,MAAM,OAAO,QAAQ;AAAA,EACrB,IAAI,SAAS,aAAa,kBAAkB,IAAI,MAAM,KAAK,QAAQ,UAAU,MAAM,KAAK,GAAG;AAAA,IACzF,MAAM,QAAO,KAAK,MAAM,GAAG,eAAe,MAAM,KAAK,MAAM,SAAS;AAAA,EACtE;AAAA,EACA,MAAM,eAAe,QAAQ,KAAK;AAAA,EAKlC,IAAI,QAAQ,WAAW,WAAW;AAAA,IAChC,MAAM,UAAU,MAAM,aAAa,QAAQ,MAAM,KAAK;AAAA,IACtD,IAAI,YAAY;AAAA,MAAW,MAAM,QAAO,KAAK,MAAM,GAAG,YAAY,SAAS;AAAA,EAC7E;AAAA,EACA,MAAM,WAAW,OAAO,WAAgE;AAAA,IAGtF,IAAI,QAAQ,WAAW,KAAK,QAAQ;AAAA,MAClC,MAAM,QAAQ,MAAM,OAAO,SAAS,KAAK,IAAI;AAAA,MAC7C,IAAI,UAAU,aAAa,UAAU,KAAK,MAAM,KAAK;AAAA,QAAQ,OAAO;AAAA,IACtE;AAAA,IACA,MAAM,MAAK,eAAe,SAAS,QAAQ,OAAO,SAAS,IAAI,UAAU;AAAA,IACzE,IAAI;AAAA,MACF,MAAM,QAAQ,MAAM,eAAe,MAAM,MAAM,SAAS,KAAK,SAAS,IAAI,GAAG,QAAQ;AAAA,MACrF,MAAM,MAAK,YAAY,SAAS,UAAU,SAAS,cAAc;AAAA,MACjE,OAAO;AAAA,MACP,OAAO,OAAO;AAAA,MACd,MAAM,SAAS,KAAK,MAAM,KAAK;AAAA;AAAA;AAAA,EAGnC,MAAM,OAAO,EAAE,UAAU,OAAO,MAAM,OAAO,iBAAQ,KAAK;AAAA,EAC1D,OAAO,WAAW,MAAM,aAAa,QAAQ,MAAM,QAAQ,QAAQ,KAAK,GAAG,QAAQ;AAAA;AAI9E,IAAM,eAAe,CAAC,QAAoB,WAC/C,gBAAgB,QAAQ,QAAQ,OAAM;;;AT1JjC,IAAM,aAAa,OACxB,QACA,MACA,MACA,WAC8B;AAAA,EAC9B,MAAM,WAAW,YAAa,QAAQ,CAAC,CAAuC;AAAA,EAC9E,IAAI,SAAS,SAAS;AAAA,IAAG,MAAM,QAAO,OAAO,MAAM,GAAG,SAAS,KAAK,IAAI,MAAM,SAAS;AAAA,EAGvF,MAAM,WAAW,gBAAgB,OAAO,QAAQ,KAAK,MAAM;AAAA,EAC3D,IAAI,aAAa;AAAA,IAAW,MAAM,QAAO,OAAO,MAAM,GAAG,aAAa,SAAS;AAAA,EAE/E,MAAM,OAAO;AAAA,EACb,MAAM,YAAY,eAAe,MAAM,WAAW;AAAA,EAClD,MAAM,OAAO,cAAc,YAAY,YAAY,GAAG,aAAa,KAAK;AAAA,EACxE,MAAM,SAAS,UAAU,MAAM,IAAI;AAAA,EACnC,IAAI,UAAU,SAAS,OAAO,MAAM;AAAA,IAClC,MAAM,QAAO,OAAO,MAAM,GAAG,eAAe,MAAM,IAAI,MAAM,SAAS;AAAA,EACvE;AAAA,EAEA,IAAI,WAAW,IAAI;AAAA,IAAG,OAAO,WAAW,SAAS,MAAM,cAAc,QAAQ,IAAI,GAAG,MAAM,MAAM;AAAA,EAChG,IAAI,SAAS;AAAA,IAAW,OAAO,SAAS,OAAO,OAAO,YAAY,EAAE,QAAQ,UAAU;AAAA,EACtF,IAAI,KAAK,SAAS,KAAK,QAAQ,KAAK,WAAW,KAAK;AAAA,IAAQ,OAAO,EAAE,QAAQ,UAAU;AAAA,EACvF,OAAO,SAAS,EAAE,QAAQ,SAAS,IAAI;AAAA;;;AU9CzC,oBAAS;AACT;AAUO,IAAM,mBAAmB,CAAC,QAAoB,QAC5C,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,cAAc,OAAO,mBAAmB,IAAI,KAAK,IAAI,UAAU,OAAO;AAAA,EAC5E,MAAM,OAAO,KAAK,MAAM,WAAW,QAAQ,IAAI,IAA0B,CAAC;AAAA,EAC1E,MAAM,QAAQ,aACV,OAAO,KAAK,KACH,cAAM,CAAC,UACL,WACE,mBACL,GAAG,IAAI,+DAA+D,MAAM,eAC1E,qFACJ,GACA,SACF,CACF,CACF,IACA,OAAO;AAAA,EACX,OAAO,UAAU,YAAY,YAAY,SAAQ,KAAK;AAAA,CACvD;;;AChCH,kBAAS;AACT;AACA;AAIO,IAAM,sBAAsB,CAAC,QAC3B,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,IAAW,eAAO,KAAK;AAAA,IAAG,OAAO,CAAC;AAAA,EAClC,MAAM,WAAoB,MAAM,MAAM,UAAU,MAAM;AAAA,EACtD,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa;AAAA,IAAY,OAAO,CAAC;AAAA,EAC5E,IAAI,aAAa;AAAA,IAAM,OAAO,CAAC;AAAA,EAC/B,OAAO,YAAY,QAA6C,EAAE,IAChE,CAAC,YAAY,qCAAqC,SACpD;AAAA,CACD;;;ACtBH;AACA;AACA;AACA;AAgBA,IAAM,SAAS,CAAC,SAAiB,cAAuB,IAAI,eAAe,EAAE,SAAS,UAAU,CAAC;AAEjG,IAAM,UAAU,CAAC,KAAa,SACrB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,WAAW,OAAO,OAAO,IAAI,GAAG;AAAA,EACtC,IAAI,SAAS,WAAW,KAAK;AAAA,IAC3B,OAAO,OAAO,OAAO,GAAG,aAAa,OAAO,SAAS,MAAM,KAAK,SAAS,UAAU,GAAG;AAAA,EACxF;AAAA,EAGA,MAAM,UAAU,IAAI,WAAW,IAAI;AAAA,EACnC,IAAI,QAAQ;AAAA,EACZ,OAAc,kBAAW,SAAS,QAAQ,CAAC,UAAU;AAAA,IACnD,IAAI,QAAQ,MAAM,SAAS,MAAM;AAAA,MAC/B,OAAc,aAAK,OAAO,GAAG,6BAA6B,OAAO,IAAI,WAAW,KAAK,CAAC;AAAA,IACxF;AAAA,IACA,QAAQ,IAAI,OAAO,KAAK;AAAA,IACxB,SAAS,MAAM;AAAA,IACf,OAAc;AAAA,GACf;AAAA,EACD,IAAI,UAAU,MAAM;AAAA,IAClB,OAAO,OAAO,OAAO,GAAG,QAAQ,OAAO,KAAK,yBAAyB,OAAO,IAAI,KAAK,IAAI;AAAA,EAC3F;AAAA,EACA,OAAO;AAAA,CACR,EAAE,KAEM,iBAAS,mBAAmB,CAAC,UAAiB,aAAK,OAAO,MAAM,SAAS,IAAI,CAAC,CAAC,CACxF;AAGK,IAAM,iBAAiB,CAC5B,KACA,MACA,SAAyB,CAAC,MAE1B,QAAQ,KAAK,IAAI,EAAE,KACV,sBAAc;AAAA,EACnB,UAAU,OAAO,WAAW;AAAA,EAC5B,QAAQ,MAAa,aAAK,OAAO,GAAG,qCAAqC,KAAK,CAAC;AACjF,CAAC,GACM,cAAM;AAAA,EACX,UAAmB,gBAAO,OAAO,WAAW,WAAW;AAAA,EACvD,OAAO,OAAO,WAAW;AAAA,EACzB,OAAO,CAAC,UAA0B,MAAM;AAC1C,CAAC,CACH;AAGK,IAAM,mBACX,CAAC,QAA+B,SAAyB,CAAC,MAC1D,CAAC,KAAK,SACG,mBACL,eAAe,KAAK,MAAM,MAAM,EAAE,KAAY,uBAA0B,uBAAY,MAAM,CAAC,CAC7F;AAUG,IAAM,kBAAkB,CAAC,UAAsC;AAAA,EACpE,MAAM,WAAW,IAAI;AAAA,EACrB,OAAO,CAAC,KAAK,SAAS;AAAA,IACpB,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK;AAAA,IAC/B,MAAM,UAAU,SAAS,IAAI,GAAG;AAAA,IAChC,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,IAClC,MAAM,UAAU,MAAM,KAAK,IAAI,EAAE,QAAQ,MAAM,SAAS,OAAO,GAAG,CAAC;AAAA,IACnE,SAAS,IAAI,KAAK,OAAO;AAAA,IACzB,OAAO;AAAA;AAAA;;;AnBxBJ,IAAM,gBAAgB,SAAwB,gBAAgB;AAK9D,IAAM,4BAA4B,CAAC,YAAoC,CAAC,MACpE,gBACP,eACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,QAAQ,gBAAgB,iBAAiB,QAAQ,UAAU,QAAQ,CAAC;AAAA,EAU1E,MAAM,SAAS,IAAI;AAAA,EACnB,MAAM,QAAQ,CAAC,KAAa,UAAoC;AAAA,IAC9D,MAAM,OAAO,kBAAkB,KAAK;AAAA,IACpC,MAAM,SAAS,OAAO,IAAI,IAAI;AAAA,IAC9B,IAAI,WAAW,aAAa,WAAW,KAAK;AAAA,MAC1C,MAAM,QACJ,MACA,2BAA2B,2DACzB,2DAA2D,SAC/D;AAAA,IACF;AAAA,IACA,OAAO,IAAI,MAAM,GAAG;AAAA;AAAA,EAEtB,OAAO,cAAc,SAAS,GAAG;AAAA,IAC/B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAK7B,MAAM,GAAG,KAAK,YAAY,MAAM,aAC9B,WAAW,YACP,iBAAiB,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,IAClD,KAAK,MAAM,cAAc,QAAQ,MAAM,CAAC;AAAA,IAE9C,MAAM,GAAG,YAAY,MAAM,MAAM,aAC/B,WAAW,YACP,eAAe,UAAU,IACzB,KAAK,MAAM,WAAW,QAAQ,MAAM,MAAM,MAAM,CAAC;AAAA,IAKvD,WAAW,GAAG,KAAK,YAAY,MAAM,MAAM,QAAQ,cAC1C,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,WAAW,OAAO,oBAAoB,GAAG;AAAA,MAC/C,MAAM,QAAQ,OAAO,cAAc,EAAE,KAAK,YAAY,OAAO,CAAC;AAAA,MAC9D,OAAO,OAAO,KAAK,YAAY;AAAA,QAC7B,MAAM,KAAK,IAAI;AAAA,QACf,OAAO,gBAAgB,QAAQ,OAAO,MAAM;AAAA,UAC1C;AAAA,UACA;AAAA,UACA,MAAM,CAAC,YAAmB,mBAAW,QAAQ,KAAK,OAAO,CAAC;AAAA,UAC1D;AAAA,UACA;AAAA,QACF,CAAC;AAAA,OACF;AAAA,KACF;AAAA,IAaH,QAAQ,GAAG,KAAK,QAAQ,cACtB,KAAK,YAAY;AAAA,MACf,MAAM,SAAS,OAAO,IAAI,OAAO,IAAI;AAAA,MACrC,IAAI,WAAW,aAAa,WAAW,KAAK;AAAA,QAC1C,MAAa,mBACX,QAAQ,KAAK,GAAG,OAAO,yBAAyB,6BAA6B,CAC/E;AAAA,QACA;AAAA,MACF;AAAA,MACA,MAAM,aAAa,QAAQ,MAAM;AAAA,MACjC,IAAI,WAAW;AAAA,QAAK,OAAO,OAAO,OAAO,IAAI;AAAA,KAC9C;AAAA,EACL,CAAC;AAAA,CACF,CACH;AAGK,IAAM,wBAAwB,MAAM,0BAA0B;;AoBpFrE,IAAM,SAAS,CAAC,UAAoC,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,IAAI;AAG7F,IAAM,MAAM,CAAC,QAAgB,QAAyB,OAAO,OAAO,QAAQ,GAAG;AAM/E,IAAM,eAAe,CAAC,SAAwB,WAAgD;AAAA,EAC5F,MAAM,SAAS,IAAI,QAAQ,SAAS,MAAM,IAAI,QAAQ,QAAQ,UAAU;AAAA,EACxE,MAAM,WACJ,QAAQ,aAAa,aAAa,IAAI,QAAQ,UAAU,MAAM,IAC1D,QAAQ,SAAS,SAAS,SAC1B;AAAA,EACN,IAAI,WAAW,aAAa,aAAa;AAAA,IAAW,OAAO;AAAA,EAC3D,OAAO,UAAU;AAAA;AAIZ,IAAM,kBAAkB,CAAC,SAAyB,YAAsC;AAAA,EAC7F,MAAM,QAAQ,IAAI,QAAQ,UAAU,QAAQ,OAAO,IAC/C,QAAQ,SAAS,QAAQ,WACzB;AAAA,EACJ,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO;AAAA,MACL,GAAG,QAAQ,mBAAmB,QAAQ,mCAAmC,OAAO,OAAO,KAAK,QAAQ,QAAQ,CAAC;AAAA,IAC/G;AAAA,EACF;AAAA,EACA,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,IAAI,MAAM,UAAU,QAAQ,MAAM,GAAG;AAAA,IAGxC,MAAM,SAAS,OAAO,OAAO,MAAM,QAAQ,EAAE,SAAS,QAAQ,MAAM;AAAA,IACpE,MAAM,OAAO,SAAS,6DAA6D;AAAA,IACnF,MAAM,KACJ,GAAG,QAAQ,0BAA0B,QAAQ,UAAU,gBAAgB,OAAO,OAAO,KAAK,MAAM,QAAQ,CAAC,GAC3G;AAAA,EACF;AAAA,EACA,MAAM,YAAY,IAAI,MAAM,UAAU,QAAQ,OAAO,IACjD,MAAM,SAAS,QAAQ,WACvB;AAAA,EACJ,IAAI,cAAc,WAAW;AAAA,IAC3B,MAAM,KACJ,GAAG,QAAQ,WAAW,QAAQ,0CAA0C,OAAO,OAAO,KAAK,MAAM,QAAQ,CAAC,SACxG,iGACJ;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,UAAU,IAAI,WAAW,QAAQ,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAAA,EACjF,IAAI,YAAY,WAAW;AAAA,IACzB,MAAM,KACJ,GAAG,QAAQ,WAAW,QAAQ,uCAAuC,QAAQ,cAAc,OAAO,OAAO,KAAK,SAAS,CAAC,IAC1H;AAAA,EACF,EAAO,SAAI,MAAM,WAAW,GAAG;AAAA,IAC7B,MAAM,SAAS,MAAM,SAAS,QAAQ,WAAW;AAAA,IACjD,MAAM,SAAS,aAAa,SAAS,MAAM;AAAA,IAC3C,IAAI,WAAW,QAAQ;AAAA,MACrB,MAAM,KACJ,GAAG,QAAQ,WAAW,QAAQ,qBAAqB,yCACjD,0EACJ;AAAA,IACF,EAAO,SAAI,WAAW,WAAW;AAAA,MAC/B,MAAM,KACJ,GAAG,QAAQ,WAAW,QAAQ,sCAAsC,sBAClE,mDACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAOF,IAAM,gBAAgB,CAAC,SAAyB,YAA0C;AAAA,EAC/F,MAAM,WAAW,gBAAgB,SAAS,OAAO;AAAA,EAEjD,MAAM,MAAM,CAAI,QAAiD,QAC/D,WAAW,aAAa,IAAI,QAAQ,GAAG,IAAI,OAAO,OAAO;AAAA,EAC3D,MAAM,QAAQ,IAAI,QAAQ,UAAU,QAAQ,OAAO;AAAA,EACnD,MAAM,UAAU,IAAI,IAAI,OAAO,UAAU,QAAQ,OAAO,GAAG,QAAQ,QAAQ;AAAA,EAC3E,MAAM,SAAS,IAAI,OAAO,UAAU,QAAQ,MAAM;AAAA,EAClD,MAAM,SACJ,WAAW,aAAa,YAAY,YAAY,YAAY,aAAa,SAAS,MAAM;AAAA,EAC1F,MAAM,SAAS,WAAW,SAAS,YAAY;AAAA,EAC/C,IACE,SAAS,SAAS,KAClB,YAAY,aACZ,WAAW,aACX,WAAW,WACX;AAAA,IACA,MAAM,IAAI,cAAc;AAAA,MACtB,SAAS,kBAAkB,QAAQ,WAAW,SAAS,KAAK,IAAI;AAAA,IAClE,CAAC;AAAA,EACH;AAAA,EACA,QAAQ,OAAO,MAAM,QAAQ,eAAe,MAAM,QAAQ;AAAA,EAC1D,OAAO;AAAA,IACL,SAAS,EAAE,OAAO,MAAM,QAAQ,eAAe,MAAM,IAAI;AAAA,IACzD;AAAA,IACA,MAAM,QAAQ;AAAA,IACd;AAAA,EACF;AAAA;AAIK,IAAM,mBAAmB,CAC9B,MACA,YACW,GAAG,QAAQ,QAAQ,WAAW,QAAQ;AAY5C,IAAM,iBAAiB,CAC5B,UACA,WACiC;AAAA,EACjC,WAAW,WAAW,UAAU;AAAA,IAC9B,YAAY,KAAK,UAAU,OAAO,QAAQ,QAAQ,QAAQ,GAAG;AAAA,MAC3D,YAAY,SAAS,cAAc,OAAO,QAAQ,MAAM,QAAQ,GAAG;AAAA,QACjE,YAAY,UAAU,YAAY,OAAO,QAAQ,SAAS,GAAG;AAAA,UAC3D,YAAY,QAAQ,WAAW,OAAO,QAAQ,MAAM,QAAQ,GAAG;AAAA,YAC7D,MAAM,SAAS,aAAa,SAAS,MAAM;AAAA,YAC3C,IAAI,WAAW,UAAU,WAAW,QAAQ;AAAA,cAC1C,OAAO,EAAE,QAAQ,SAAS,KAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,YAC3E;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA;;AC1MF,IAAM,WAAW;AACjB,IAAM,QAAO;AACb,IAAM,MAAM;AACZ,IAAM,WAAW,sBAAsB,2BAA0B;AAE1D,IAAM,mBAAmC;AAAA,EAC9C,UAAU;AAAA,IACR,SAAS;AAAA,MAGP,UAAU,EAAE,KAAK,MAAM;AAAA,MACvB,UAAU;AAAA,QACR,SAAS;AAAA,UACP,cAAc;AAAA,YACZ,OAAO;AAAA,YACP,WAAW;AAAA,cACT,UAAU;AAAA,cACV,QAAQ;AAAA,cACR,WAAW;AAAA,gBACT,MAAM;AAAA,gBACN,KAAK;AAAA,kBACH,aAAa;AAAA,kBACb,QAAQ;AAAA,kBACR,KAAK;AAAA,gBACP;AAAA,gBACA,QAAQ;AAAA,gBACR,KAAK,GAAG;AAAA,gBACR,UAAU;AAAA,cACZ;AAAA,cACA,KAAK,GAAG;AAAA,YACV;AAAA,YAIA,UAAU;AAAA,cACR,KAAK;AAAA,gBACH,UAAU;AAAA,gBACV,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,YACA,SAAS,CAAC;AAAA,YACV,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,KAAK;AAAA,UACP;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AACV;;ACtEA;AACA;AAIO,IAAM,mBAAmB,CAAC,WAC/B,sBAAsB,EAAE,KAChB,eAAc,gBAAS,gBAAgB,MAAM,GAAmB,qBAAK,CAAC,CAC9E;;ACYF,IAAM,YAAW;AACjB,IAAM,YAAW;AAEV,IAAM,oBAAoC;AAAA,EAC/C,UAAU;AAAA,IACR,iBAAiB;AAAA,MACf,UAAU,EAAE,iBAAiB,qBAAqB;AAAA,MAClD,UAAU;AAAA,QACR,UAAU;AAAA,UACR,gBAAgB;AAAA,YACd,OAAO;AAAA,YACP,WAAW;AAAA,cACT,UAAU;AAAA,cACV,QAAQ;AAAA,cACR,KAAK,GAAG;AAAA,YACV;AAAA,YACA,SAAS;AAAA,cACP,sBACE;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,KAAK;AAAA,UACP;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,oBAAoB;AAAA,MAElB,UAAU,EAAE,oBAAoB,wBAAwB;AAAA,MACxD,UAAU;AAAA,QACR,WAAW;AAAA,UACT,gBAAgB;AAAA,YACd,OAAO;AAAA,YACP,WAAW;AAAA,cACT,UAAU;AAAA,cACV,QAAQ;AAAA,cACR,KAAK,GAAG;AAAA,YACV;AAAA,YACA,SAAS;AAAA,cACP,yBACE;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,KAAK;AAAA,UACP;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,mBAAmB;AAAA,MACjB,UAAU,EAAE,mBAAmB,uBAAuB;AAAA,MACtD,UAAU;AAAA,QACR,UAAU;AAAA,UACR,gBAAgB;AAAA,YACd,OAAO;AAAA,YACP,WAAW;AAAA,cACT,UAAU;AAAA,cACV,QAAQ;AAAA,cACR,KAAK,GAAG;AAAA,YACV;AAAA,YACA,SAAS;AAAA,cACP,wBACE;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,KAAK;AAAA,UACP;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MAGP,UAAU;AAAA,QACR,SAAS;AAAA,QACT,SAAS;AAAA,QACT,gBAAgB;AAAA,QAChB,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,MACb;AAAA,MACA,UAAU;AAAA,QACR,WAAW;AAAA,UACT,gBAAgB;AAAA,YACd,OAAO;AAAA,YACP,WAAW;AAAA,cACT,UAAU;AAAA,cACV,QAAQ;AAAA,cACR,KAAK,GAAG;AAAA,YACV;AAAA,YACA,SAAS;AAAA,cACP,gBAAgB;AAAA,cAChB,gBAAgB;AAAA,cAChB,qBACE;AAAA,cAGF,eAAe;AAAA,cACf,iBAAiB;AAAA,cACjB,cAAc;AAAA,cACd,kBAAkB;AAAA,YACpB;AAAA,YACA,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,KAAK;AAAA,UACP;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AACV;",
-  "debugId": "95AC8419C10B267864756E2164756E21",
+  "mappings": ";AAgBA,IAAM,cACJ,gGACA;AAGF,IAAM,cACJ;AAGF,IAAM,cAAc;AAGpB,IAAM,YAAY;AAEX,IAAM,cAAc;AAG3B,IAAM,YAAY,CAAC,OAAmB,SAA2B;AAAA,EAC/D,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1E,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAQ,MAAgC,QAAQ,CAAC,MAAM,UACrD,UAAU,MAAM,GAAG,QAAQ,OAAO,KAAK,IAAI,CAC7C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,OAAO,OAAO,QAAQ,KAAK,EAAE,QAAQ,EAAE,KAAK,UAAU,UAAU,MAAM,GAAG,QAAQ,KAAK,CAAC;AAAA,EACzF;AAAA,EACA,OAAO,CAAC;AAAA;AAOH,IAAM,oBAAoB,CAC/B,aACA,MACA,cACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,MAAM,UAAU,OAAO,QAAQ,eAAe,CAAC,CAAC,GAAG;AAAA,IAC7D,IAAI,YAAY,KAAK,IAAI;AAAA,MACvB,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,IACjE,SAAI,YAAY,KAAK,KAAK;AAAA,MAC7B,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,EACxE;AAAA,EACA,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAEzC,IAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MACzB,MAAM,KAAK,oBAAoB,OAAO,KAAK,8BAA8B,aAAa;AAAA,IACxF,EAAO,SAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAAA,MACzD,MAAM,KAAK,oBAAoB,OAAO,QAAQ,CAAC,6BAA6B,aAAa;AAAA,IAC3F,EAAO,SAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MAChC,MAAM,KAAK,oBAAoB,OAAO,KAAK,2BAA2B,aAAa;AAAA,IACrF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,UAAU,aAAa,CAAC,GAAG,WAAW,GAAG;AAAA,IAC1D,MAAM,KAAK,GAAG,6BAA6B,aAAa;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,qBAAqB,CAAC,YACjC,YAAY,KAAK,OAAO,IAAI,CAAC,gCAAgC,aAAa,IAAI,CAAC;;;AC9C1E,IAAM,eAAe;AAGrB,IAAM,mBAAmB,CAAC,MAAc,UAAiD;AAAA,EAC9F,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAOpE,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,KAAK,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,uBAAuB;AAAA,EAG7D,IACE,KAAK,SAAS,GAAG,KACjB,KACG,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAC9D;AAAA,IACA,MAAM,KAAK,6EAA6E;AAAA,EAC1F;AAAA,EACA,IAAI,KAAK,SAAS,MAAM;AAAA,IAAG,MAAM,KAAK,mBAAmB;AAAA,EACzD,OAAO;AAAA;AAGF,IAAM,eAAe,CAAC,UAAmC;AAAA,EAC9D,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,OAAO;AAAA;;;ACrET,IAAM,QAAQ;AACP,IAAM,cAAc,KAAK;AAEhC,IAAM,OAAO;AACb,IAAM,UAAU;AAGhB,IAAM,UAAU;AAGhB,IAAM,iBAAiB,CAAC,MAAc,UACpC,CAAC,QAAQ,KAAK,KAAK,KAAK,UAAU,OAAO,UAAU,OAC/C,GAAG,sEAAsE,KAAK,UAAU,KAAK,MAC7F;AAGC,IAAM,cAAc,CAAC,UAKZ;AAAA,EACd,MAAM,UAAU,MAAM,WAAW,CAAC;AAAA,EAClC,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OAAO,CAAC,MAAc,UAAuC;AAAA,IACjE,IAAI,OAAO,UAAU;AAAA,MAAU,OAAO;AAAA,IACtC,MAAM,KAAK,GAAG,qCAAqC;AAAA,IACnD;AAAA;AAAA,EAEF,MAAM,OAAO,KAAK,gBAAgB,QAAQ,IAAI;AAAA,EAG9C,MAAM,WAAW,MAAM,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC;AAAA,EAClD,IAAI,SAAS,cAAc,CAAC,KAAK,KAAK,IAAI,KAAK,aAAa,OAAO,aAAa;AAAA,IAC9E,MAAM,KAAK,sCAAsC,KAAK,UAAU,IAAI,GAAG;AAAA,EACzE,YAAY,MAAM,UAAU;AAAA,IAC1B,CAAC,eAAe,QAAQ,GAAG;AAAA,IAC3B,CAAC,QAAQ,MAAM,IAAI;AAAA,EACrB,GAAY;AAAA,IACV,MAAM,QAAQ,KAAK,MAAM,KAAK;AAAA,IAC9B,MAAM,UAAU,UAAU,YAAY,YAAY,eAAe,MAAM,KAAK;AAAA,IAC5E,IAAI,YAAY;AAAA,MAAW,MAAM,KAAK,OAAO;AAAA,EAC/C;AAAA,EACA,MAAM,QAAQ,KAAK,iBAAiB,QAAQ,KAAK;AAAA,EACjD,IAAI,UAAU,WAAW;AAAA,IACvB,MAAM,UAAU,eAAe,iBAAiB,KAAK;AAAA,IACrD,IAAI,YAAY;AAAA,MAAW,MAAM,KAAK,OAAO;AAAA,IACxC,SAAI,CAAC,QAAQ,KAAK,KAAK;AAAA,MAC1B,MAAM,KAAK,6CAA6C,QAAQ;AAAA,EACpE;AAAA,EAIA,IAAI,QAAQ,SAAS,WAAW;AAAA,IAC9B,IAAI,OAAO,QAAQ,SAAS,UAAU;AAAA,MACpC,MAAM,KAAK,gDAAgD;AAAA,IAC7D,EAAO;AAAA,MACL,MAAM,UAAU,eAAe,gBAAgB,QAAQ,IAAI;AAAA,MAC3D,IAAI,YAAY;AAAA,QAAW,MAAM,KAAK,OAAO;AAAA;AAAA,EAEjD;AAAA,EAIA,MAAM,OAAO,QAAQ;AAAA,EACrB,IAAI,OAAO,SAAS,YAAY,CAAC,OAAO,cAAc,IAAI,KAAK,QAAQ,KAAK,OAAO,aAAa;AAAA,IAC9F,MAAM,KAAK,qDAAqD,OAAO,WAAW,GAAG;AAAA,EACvF;AAAA,EACA,YAAY,MAAM,UAAU;AAAA,IAC1B,CAAC,kBAAkB,QAAQ,MAAM;AAAA,IACjC,CAAC,UAAU,MAAM,MAAM;AAAA,EACzB,GAAY;AAAA,IACV,MAAM,QAAQ,KAAK,MAAM,KAAK;AAAA,IAC9B,IAAI,UAAU,aAAa,CAAC,MAAM,KAAK,KAAK;AAAA,MAC1C,MAAM,KAAK,GAAG,uCAAuC;AAAA,EACzD;AAAA,EACA,MAAM,SAAS,KAAK,UAAU,MAAM,MAAM;AAAA,EAE1C,IACE,WAAW,cACV,WAAW,MAAM,OAAO,WAAW,GAAG,KAAK,OAAO,MAAM,GAAG,EAAE,SAAS,IAAI,IAC3E;AAAA,IACA,MAAM,KAAK,sDAAsD,KAAK,UAAU,MAAM,GAAG;AAAA,EAC3F;AAAA,EACA,OAAO;AAAA;;;ACOF,IAAM,sBAAsB;AAS5B,IAAM,aAAa,CAAC,MAAc,KAAa,UACpD,sBAAsB,0BAA0B,OAAO;AAGlD,IAAM,oBAAoB,CAAC,UAGpB,GAAG,MAAM,aAAa,MAAM;AAGnC,IAAM,iBAAiB,CAAC,WAA+C;AAAA,EAC5E,QAAQ,MAAM;AAAA,EACd,cAAc,MAAM;AAAA,EACpB,QAAQ,MAAM,QAAQ;AAAA,EACtB,MAAM,MAAM,QAAQ;AAAA,EACpB,KAAK,WAAW,MAAM,QAAQ,MAAM,MAAM,QAAQ,KAAK,MAAM,QAAQ,KAAK;AAAA,KAEtE,MAAM,QAAQ,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,QAAQ,KAAK;AACzE;AAEO,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,OAAO,CAAC,uBAAuB;AAAA,EAC7F,MAAM,QAAkB,CAAC;AAAA,EACzB,KAAK,OAAO,UAAY;AAAA,IAAG,MAAM,KAAK,4CAA4C;AAAA,EAClF,KAAK,OAAO,QAAW;AAAA,IAAG,MAAM,KAAK,2CAA2C;AAAA,EAChF,KAAK,OAAO,QAAW;AAAA,IAAG,MAAM,KAAK,oCAAoC;AAAA,EAGzE,KAAK,OAAO,SAAW;AAAA,IAAG,MAAM,KAAK,mDAAmD;AAAA,EACxF,OAAO;AAAA;AAWT,IAAM,eAAe,CAAC,QAAQ,OAAO,SAAS,QAAQ,UAAU,MAAM;AAK/D,IAAM,YAAY,CAAC,MAAY,SACpC,KAAK,WAAW,KAAK,UACrB,KAAK,WAAW,KAAK,UACrB,aAAa,KAAK,CAAC,QAAQ,KAAK,QAAQ,SAAS,KAAK,QAAQ,IAAI;AAO7D,IAAM,iBAAiB,CAAC,MAAY,SACzC,cAAc,KAAK,QAAQ,OAAO,KAAK,UAAU,KAAK,0CACtD,QAAQ,KAAK,QAAQ,OAAO,KAAK,UAAU,KAAK,oDAChD;AAGK,IAAM,iBAAiB,CAAC,UAAwC;AAAA,EACrE,GAAG,YAAY,KAAK;AAAA,EACpB,GAAG,aAAa,MAAM,SAAS,EAAE,IAAI,CAAC,YAAY,cAAc,SAAS;AAAA,EACzE,GAAG,aAAa,MAAM,QAAQ,mBAAmB;AAAA,EACjD,GAAG,iBAAiB,SAAS,MAAM,KAAK;AAAA,EACxC,GAAG,iBAAiB,SAAS,MAAM,KAAK;AAC1C;;ACxJA;AACA;AACA;AACA;;;AClBA;AAEO,IAAM,OAAO,CAAI,SACf,kBAAW;AAAA,EAChB,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,EAC3E,KAAK;AACP,CAAC;AAQI,IAAM,iBAAiB,CAAC,MAAe,QAAoC;AAAA,EAChF,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,QAAS,KAAiC;AAAA,EAChD,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA;;;ACZ7C;AACA;AAAA;AA6FO,MAAM,0BAAkC,gBAAuC,EACpF,8BACF,EAAE;AAAC;AAGI,IAAM,kBAAkB,CAAC,WACxB,cAAQ,mBAAmB,MAAM;AAGlC,IAAM,eAAe,CAAC,WAC3B,OAAO,cAAc,OAAO,aAAa,MAAM;;;AC7GjD;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,WAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,YAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,gBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,cAAM,QAAQ,GAAU,oBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,gBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,cAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,cAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,YAAW,sBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,YAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,sBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,sBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,YACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAaK,IAAM,sBAAsB,CAAC,KAAa,eACxC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,cAAM;AAAA,CACtE;;;AFxFI,IAAM,eAAe,CAAC,QACpB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,sBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,sBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AIzF9B;;;ACTO,IAAM,YAAY,CACvB,GACA,MACwB;AAAA,EACxB,IAAI,MAAM,aAAa,MAAM;AAAA,IAAW,OAAO;AAAA,EAC/C,IAAI,EAAE,QAAQ,aAAa,EAAE,QAAQ,aAAa,EAAE,QAAQ,aAAa,EAAE,QAAQ,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAIjC,IAAM,UAAU,OACrB,QACA,GACA,MACiC;AAAA,EACjC,IAAI,MAAM;AAAA,IAAG,OAAO;AAAA,EACpB,OAAO,MAAM,SAAS,MAAM,QAAQ,IAAI,CAAC,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,EACxE,OAAO,UAAU,MAAM,KAAK;AAAA;AAQvB,IAAM,eAAe,OAC1B,QACA,SACA,MACA,QACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,QAAQ,QAAQ,SAAS,IAAI;AAAA,EAChD,IAAI,SAAS;AAAA,IAAM;AAAA,EACnB,MAAM,OAAO;AAAA,EACb,IAAI,SAAS,aAAc,MAAM,OAAO,KAAK,IAAI,MAAO,WAAW;AAAA,IACjE,MAAM,OACJ,MACA,yBAAyB,gEACvB,2FACA,sCACJ;AAAA,EACF;AAAA;;;ACzDF;;;ACqBO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EADX,WAAW,CACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,SAAS,KAAK,WAAW,SAAS,QAAQ;AAAA,IAHhD;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,SACJ;AAAA,IACA,0DACA;AAAA,IACA;AAAA;AAGF,IAAM,YAAY;AASlB,IAAM,YAAY;AAQX,IAAM,aAAa,CAAC,MAAc,SAAyB;AAAA,EAChE,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,EAC/B,IAAI,QAAQ,MAAM;AAAA,IAChB,MAAM,OAAO,IAAI,GAAG,YAAY,CAAC,KAAK;AAAA,IACtC,MAAM,IAAI,WACR,MACA,KAAK,KAAK,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,4BACtD;AAAA,EACF;AAAA,EACA,OAAO,KACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,MAAM,OAAO;AAAA;AAG7B,IAAM,iBAAgB,CAAC,UAA2B;AAAA,EAChD,MAAM,QAAQ,OAAO,eAAe,KAAK;AAAA,EACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAGjD,IAAM,cAAc,CAAC,OAAgB,MAAc,OAAe,QAAwB;AAAA,EACxF,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAC7B,IAAI,QAAQ;AAAA,IAAW,MAAM,IAAI,WAAW,MAAM,sBAAsB,OAAO,SAAS,GAAG;AAAA,EAC3F,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,IAAI,KAAK,GAAG,cAAc,WAAW,OAAO,IAAI,YAAY;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,IAAI,KAAK,GAAG,OAAO,QAAQ,SAAS,WAAW;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAE7B,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAAA,MAChC,MAAM,IAAI,WAAW,MAAM,GAAG,OAAO,KAAK,6CAA6C;AAAA,IACzF;AAAA,IACA,IAAI,KAAK,GAAG,eAAe,OAAO,UAAU,IAAI,IAAI,KAAK,aAAa;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,IAAI,KAAK,GAAG,aAAa;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB,YAAY,OAAO,SAAU,MAA6B,QAAQ,GAAG;AAAA,MACnE,YAAY,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG,GAAG;AAAA,IAC/D;AAAA,IACA,IAAI,KAAK,GAAG,aAAa;AAAA,IACzB;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,eAAc,KAAK,GAAG;AAAA,IACvE,WAAW,OAAkC,MAAM,OAAO,GAAG;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAM,OAAO,UAAU,OAAO,SAAS,OAAO;AAAA,EAC9C,MAAM,IAAI,WAAW,MAAM,GAAG,+CAA+C;AAAA;AAG/E,IAAM,aAAa,CACjB,MACA,MACA,OACA,QACS;AAAA,EACT,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAE7B,MAAM,OAAO,OAAO,KAAK,IAAI,EAAE,KAAK;AAAA,EACpC,IAAI,KAAK,WAAW,GAAG;AAAA,IACrB,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB;AAAA,EACF;AAAA,EACA,IAAI,KAAK,GAAG,WAAW;AAAA,EACvB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,QAAQ;AAAA,IAC7C,IAAI,KAAK,GAAG,YAAa,WAAW,KAAK,KAAK,SAAS;AAAA,IACvD,YAAY,KAAK,MAAM,OAAO,QAAQ,GAAG,GAAG;AAAA,EAC9C;AAAA,EACA,IAAI,KAAK,GAAG,YAAY;AAAA;AAInB,IAAM,cAAc,CAAC,SAA4B;AAAA,EACtD,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,KAAK,CAAC,eAAc,IAAI,GAAG;AAAA,IAC5F,MAAM,IAAI,WAAW,IAAI,iDAAiD;AAAA,EAC5E;AAAA,EACA,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAiC,IAAI,GAAG,GAAG;AAAA,EACtD,OAAO,GAAG,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;;;ADxE3B,IAAM,cAAc,CAAC,WAA6C;AAAA,EACvE,IAAI,WAAW;AAAA,IAAU,OAAO,EAAE,MAAM,SAAS;AAAA,EACjD,MAAM,QAAQ,eAAe,KAAK,MAAM;AAAA,EACxC,OAAO,QAAQ,OAAO,YAAY,YAAY,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,EAAE,EAAE;AAAA;AAG9E,IAAM,gBAAgB,CAAC,OAAe,WAAkC,GAAG,UAAU;AAOrF,IAAM,eAAe,CAC1B,OACA,QACA,SACW;AAAA,EACX,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,0BAA0B;AAAA,EAE/D,IAAI,SAAS,aAAa,CAAC,KAAK,WAAW,GAAG,GAAG;AAAA,IAC/C,MAAM,IAAI,MAAM,OAAO,OAAO,OAAO,GAAG,gDAAgD;AAAA,EAC1F;AAAA,EACA,OAAO,GAAG,6BAA6B;AAAA;AAIlC,IAAM,aAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAAe,CAAC,UAAuC;AAAA,EAC3D,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,MAAM,WAAW;AAAA,IAAW,KAAK,YAAY,MAAM;AAAA,EACvD,IAAI,MAAM,SAAS;AAAA,IAAW,KAAK,UAAU,MAAM;AAAA,EACnD,IAAI,MAAM,QAAQ;AAAA,IAAW,KAAK,SAAS,MAAM;AAAA,EACjD,IAAI,MAAM,YAAY;AAAA,IAAW,KAAK,aAAa,MAAM;AAAA,EACzD,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,MAAM;AAAA,EACrD,OAAO;AAAA;AAGT,IAAM,iBAAiB,CAAC,cAAqC;AAAA,EAC3D,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO;AAAA,EAC3C,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,UAAU,mBAAmB;AAAA,IAAW,KAAK,oBAAoB,UAAU;AAAA,EAC/E,IAAI,UAAU,YAAY;AAAA,IAAW,KAAK,aAAa,UAAU;AAAA,EACjE,OAAO;AAAA;AAIF,IAAM,eAAe,CAAC,UAAsC;AAAA,EACjE,MAAM,OAAmC,KAAK,MAAM,UAAU;AAAA,EAC9D,KAAK,WAAW,MAAM;AAAA,EACtB,KAAK,sBAAsB,CAAC,GAAG,MAAM,gBAAgB;AAAA,EACrD,MAAM,MAAM,MAAM,eAAe,CAAC;AAAA,EAClC,IAAI,OAAO,KAAK,GAAG,EAAE,SAAS;AAAA,IAAG,KAAK,0BAA0B,KAAK,IAAI;AAAA,EACzE,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,eAAe,MAAM,SAAS;AAAA,EACrF,IAAI,MAAM,kBAAkB;AAAA,IAAW,KAAK,mBAAmB,MAAM;AAAA,EACrE,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,KAAK,2BAA2B,MAAM,QAAQ,QAAQ,IACjD,SAAyC,IAAI,YAAY,IAC1D,aAAa,QAA4B;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,oBAAoB;AAAA,IAAW,KAAK,qBAAqB,MAAM;AAAA,EACzE,IAAI,MAAM,sBAAsB;AAAA,IAAW,KAAK,uBAAuB,MAAM;AAAA,EAC7E,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,aAAa;AAAA,IAAW,KAAK,cAAc,MAAM;AAAA,EAC3D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,OAAO;AAAA;AAGF,IAAM,YAAY,CAAC,UACxB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAG1C,IAAM,YAAY,CACvB,UACwD;AAAA,EACxD,MAAM,OAAO,YAAY,aAAa,KAAK,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC3C,OAAO,EAAE,OAAO,QAAQ,UAAU,KAAK,GAAG,KAAK;AAAA;;;AE/IjD,IAAM,YAAY,CAAC,UACjB,OAAO,UAAU,WAAW,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;AAGrE,IAAM,aAAa,OACxB,QACA,UACA,MACA,WAC4C;AAAA,EAC5C,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI,SAAS,UAAU,WAAW;AAAA,IAChC,MAAM,UAAU,SAAS,KAAK,MAAM,MAAM,OAAO,WAAW,OAAO,SAAS,KAAK,CAAC,IAAI;AAAA,IACtF,IAAI,QAAQ;AAAA,MAAW,MAAM,OAAO,MAAM,WAAW,OAAO,SAAS,KAAK,gBAAgB;AAAA,EAC5F;AAAA,EACA,IAAI,SAAS,UAAU,WAAW;AAAA,IAChC,MAAM,UAAU,SAAS,KAAK,KAAM,MAAM,OAAO,YAAY,OAAO,SAAS,KAAK,CAAC;AAAA,IACnF,IAAI,QAAQ;AAAA,MAAW,MAAM,OAAO,MAAM,YAAY,OAAO,SAAS,KAAK,gBAAgB;AAAA,EAC7F;AAAA,EACA,OAAO,KAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,MAAQ,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,EAAG;AAAA;AAIjF,IAAM,qBAAqB,OAChC,QACA,SAC4C;AAAA,EAC5C,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,KAAK,SAAS,SAAS,MAAM,OAAO,SAAS,IAAI,IAAI;AAAA,EACnE,OAAO;AAAA,IACL,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,IACX;AAAA,IACA,QAAQ,UAAU,YAAY,KAAK,UAAU,KAAK;AAAA,IAClD,MAAM,KAAK;AAAA,IACX,KAAK,KAAK;AAAA,EACZ;AAAA;AAGK,IAAM,iBAAiB,CAAC,UAAoC;AAAA,EACjE,MAAM,KAAK;AAAA,KACP,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AAAA,KAC9C,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AACpD;AAEO,IAAM,cAAc,CAAC,MAA0B,SACpD,KAAK,WAAW,KAAK,UACrB,KAAK,SAAS,KAAK,SAClB,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK,SAC5C,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK;AAOxC,IAAM,aAAa,OACxB,QACA,MACA,WACkB;AAAA,EAClB,MAAM,SAAS,OAAO,SAA8B;AAAA,IAClD,MAAM,OAAO,aAAa,KAAK,MAAM,eAAe,IAAI,CAAC;AAAA,IACzD,OAAO;AAAA;AAAA,EAMT,IAAI,KAAK,SAAS,OAAO,MAAM;AAAA,IAC7B,MAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK,MAAM,OAAO,IAAI;AAAA,IACzD,OAAO,OAAO,EAAE,QAAQ,SAAS,OAAO,WAAW,UAAU,CAAC;AAAA,EAChE;AAAA,EACA,IAAI,KAAK,WAAW,OAAO;AAAA,IAAQ,OAAO,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA,EACrE,MAAM,OAAO,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,EACvD,OAAO,SAAS,aAAa,YAAY,MAAM,IAAI,IAC/C,EAAE,QAAQ,OAAO,IACjB,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA;AAsB1B,IAAM,eAAe,OAC1B,QACA,MACA,QACA,QAAQ,UACwB;AAAA,EAChC,QAAQ,MAAM,WAAW;AAAA,EACzB,MAAM,OAAO,KAAK;AAAA,EAElB,IAAI,KAAK,QAAQ,aAAa,KAAK,QAAQ,OAAO,aAAa,KAAK,CAAC,aAAa,MAAM,GAAG;AAAA,IACzF,MAAM,OACJ,MACA,SAAS,OAAO,KAAK,KAAK,sEACxB,2FACA,mCACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS,aAAa,KAAK,SAAS,QAAQ;AAAA,IAC9C,MAAM,OACJ,MACA,QAAQ,KAAK,gEACf;AAAA,EACF;AAAA,EACA,MAAM,SAAS,SAAS,YAAY,YAAY,MAAM,mBAAmB,QAAQ,IAAI;AAAA,EAKrF,MAAM,QAAQ,WAAW,aAAa,OAAO,SAAS;AAAA,EACtD,MAAM,QAAQ,QAAQ,YAAY;AAAA,EASlC,MAAM,WAAW,SAAS,WAAW;AAAA,EACrC,IAAI,UAAU,aAAa,WAAW,aAAa,CAAC,YAAY,QAAQ,IAAI,KAAK,CAAC,UAAU;AAAA,IAC1F,MAAM,OACJ,MACA,6FACE,sBACJ;AAAA,EACF;AAAA,EACA,IAAI,WAAW,aAAa,CAAC,YAAY,QAAQ,IAAI,GAAG;AAAA,IACtD,MAAM,QAAQ,MAAM,KAAK,SAAS,MAAM;AAAA,IAGxC,IAAI,UAAU,KAAK,MAAM,KAAK,QAAQ;AAAA,MACpC,MAAM,OAAO,MAAM,qCAAqC,KAAK,8BAA8B;AAAA,IAC7F;AAAA,IACA,MAAM,OAAO,gBAAgB,MAAM,OAAO,eAAe,IAAI,CAAC;AAAA,EAChE;AAAA,EAOA,MAAM,WAAW,YAAY;AAAA,IAC3B,IAAI,WAAW;AAAA,MAAW,MAAM,OAAO,WAAW,IAAI,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA;AAAA,EAE/E,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,IAAI,EAAE,MAAM,OAAO,UAAmB;AAAA,IACnF,MAAM,SAAS;AAAA,IACf,MAAM,OAAO,MAAM,kDAAkD,OAAO,KAAK,GAAG;AAAA,GACrF;AAAA,EACD,IAAI,UAAU,aAAa,CAAC,YAAY,OAAO,IAAI,GAAG;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,MAAM,OAAO,MAAM,wEAAwE;AAAA,EAC7F;AAAA,EAGA,IAAI;AAAA,IACF,MAAM,aACJ,QACA,OAAO,MACP,MACA,MAAM,gBAAgB,QAAQ,QAAQ,MAAM,GAC5C,MACF;AAAA,EACF,OAAO;AAAA;AAIF,IAAM,kBAAkB,OAC7B,QACA,QACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,OAAO,KAAK,OAAO,IAAI;AAAA,EAC1C,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAAQ,MAAM,OAAO,OAAO,MAAM,YAAY,KAAK,uBAAuB;AAAA,EAC5F,MAAM,OAAO,WAAW,OAAO,IAAI;AAAA;;;AC3LrC,IAAM,QAAQ;AAEd,IAAM,aAAa,CAAC,OAAe,WACjC,GAAG,UAAU,KAAK,yCAAyC,qBAAqB,gBAChF,iCAAiC,gEACjC;AAGK,IAAM,kBAAkB,CAAC,OAAe,WAC7C,UAAU,SAAS,YAAY,GAAG,UAAU,WAAW,OAAO,MAAM;AAQ/D,IAAM,eAAe,OAC1B,QACA,MACA,UACgC;AAAA,EAChC,MAAM,OAAO,MAAM,OAAO,KAAK,KAAK,IAAI;AAAA,EACxC,IAAI,MAAM,SAAS;AAAA,IAAQ;AAAA,EAC3B,MAAM,SAAS,MAAM,mBAAmB,QAAQ,KAAK,IAAI,IAAI,UAAU;AAAA,EACvE,IAAI,UAAU,KAAK;AAAA,IAAQ,OAAO,gBAAgB,OAAO,KAAK,MAAM;AAAA,EACpE,IAAI;AAAA,IAAO;AAAA,EACX,OACE,GAAG,0FACH,kFACA,+FACA,+FACA,8FACA;AAAA;;;AC/DJ;AAAA;AAGO,MAAM,sBAA2B,iBAAY,eAAe,EAEhE;AAAC;AAAA;AAGG,MAAM,uBAA4B,iBAAY,gBAAgB,EAIlE;AAAC;AAAA;AAGG,MAAM,yBAA8B,iBAAY,kBAAkB,EAKtE;AAAC;AAAA;AAGG,MAAM,uBAA4B,iBAAY,gBAAgB,EAElE;AAAC;;;ACAJ,IAAM,QAAQ;AAEd,IAAM,QAA0C;AAAA,EAC9C,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL;AAEA,IAAM,SAAS,CAAC,YAAoC,IAAI,eAAe,EAAE,QAAQ,CAAC;AAClF,IAAM,SAAS,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AACvD,IAAM,QAAQ,IAAI,YAAY,QAAQ;AAGtC,IAAM,QAAQ,CAAC,OAAmB,OAAe,WAA+B;AAAA,EAC9E,MAAM,QAAQ,MAAM,SAAS,OAAO,QAAQ,MAAM;AAAA,EAClD,MAAM,MAAM,MAAM,QAAQ,CAAC;AAAA,EAC3B,OAAO,QAAQ,KAAK,QAAQ,MAAM,SAAS,GAAG,GAAG;AAAA;AAGnD,IAAM,OAAO,CAAC,OAAmB,OAAe,WAA2B;AAAA,EACzE,IAAI;AAAA,IACF,OAAO,OAAO,OAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AAAA,IAChD,MAAM;AAAA,IACN,MAAM,OAAO,4BAA4B;AAAA;AAAA;AAI7C,IAAM,QAAQ,CAAC,OAAmB,OAAe,QAAgB,SAAyB;AAAA,EACxF,MAAM,MAAM,MAAM,SAAS,OAAO,QAAQ,MAAM;AAAA,EAChD,MAAM,IAAI,MAAM,KAAK,SAAU;AAAA,IAAG,MAAM,OAAO,GAAG,0BAA0B;AAAA,EAC5E,MAAM,SAAS,MACZ,OAAO,GAAG,EACV,QAAQ,WAAW,EAAE,EACrB,QAAQ,OAAO,EAAE;AAAA,EACpB,IAAI,CAAC,WAAW,KAAK,MAAM;AAAA,IAAG,MAAM,OAAO,GAAG,sBAAsB,KAAK,UAAU,MAAM,GAAG;AAAA,EAC5F,OAAO,OAAO,SAAS,QAAQ,CAAC;AAAA;AAGlC,IAAM,gBAAgB,CAAC,UAA+B;AAAA,EACpD,IAAI,MAAM;AAAA,EAEV,SAAS,KAAK,EAAG,KAAK,OAAO,MAAM;AAAA,IAAG,OAAO,MAAM,OAAO,KAAK,MAAM,KAAQ,MAAM,OAAO;AAAA,EAC1F,OAAO,QAAQ,MAAM,OAAO,KAAK,GAAG,mBAAmB;AAAA;AAIzD,IAAM,cAAc,CAAC,SAAqC;AAAA,EACxD,IAAI,SAAS;AAAA,IAAI,OAAO;AAAA,EACxB,IAAI,KAAK,WAAW,GAAG;AAAA,IAAG,OAAO;AAAA,EACjC,IAAI,KAAK,MAAM,GAAG,EAAE,SAAS,IAAI;AAAA,IAAG,OAAO;AAAA,EAC3C;AAAA;AAIK,IAAM,cAAc,CAAC,UAA6C;AAAA,EACvE,MAAM,MAAM,IAAI,WAAW,MAAM,OAAO,CAAC,OAAO,SAAS,QAAQ,KAAK,QAAQ,CAAC,CAAC;AAAA,EAChF,IAAI,KAAK;AAAA,EACT,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,IAAI,MAAM,EAAE;AAAA,IAChB,MAAM,KAAK;AAAA,EACb;AAAA,EACA,OAAO;AAAA;AAkBF,IAAM,YAAY,CAAC,QAA6B,SAAkB;AAAA,EACvE,MAAM,SAAS,IAAI,WAAW,KAAK;AAAA,EACnC,MAAM,UAAU,IAAI;AAAA,EACpB,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OAAO,IAAI;AAAA,EACjB,IAAI,QAA2C;AAAA,EAC/C,IAAI,SAAS;AAAA,EACb,IAAI,YAAY;AAAA,EAChB,IAAI,UAAU;AAAA,EACd,IAAI,QAAQ;AAAA,EACZ,IAAI,OAAO;AAAA,EACX,IAAI;AAAA,EACJ,IAAI,WAAW;AAAA,EACf,MAAM,aAAa,SAAS,YAAY,YAAY,GAAG;AAAA,EAEvD,MAAM,WAAW,MAAM;AAAA,IACrB,IAAI,UAAU;AAAA,MAAW,QAAQ,IAAI,MAAM,YAAY,KAAK,CAAC;AAAA,IAC7D,QAAQ;AAAA,IACR,QAAQ,UAAU,IAAI,QAAQ;AAAA;AAAA,EAGhC,MAAM,aAAa,MAAM;AAAA,IACvB,IAAI,OAAO,MAAM,CAAC,SAAS,SAAS,CAAC,GAAG;AAAA,MACtC,SAAS;AAAA,MACT,IAAI,UAAU;AAAA,QAAG,QAAQ;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,QAAQ;AAAA,MAAG,MAAM,OAAO,0DAA0D;AAAA,IACtF,IAAI,CAAC,cAAc,MAAM;AAAA,MAAG,MAAM,OAAO,oCAAoC;AAAA,IAC7E,MAAM,QAAQ,MAAM,OAAO,OAAO,SAAS,KAAK,GAAG,CAAC;AAAA,IACpD,MAAM,QAAQ,UAAU;AAAA,IACxB,IAAI,CAAC,SAAS,UAAU;AAAA,MACtB,MAAM,OAAO,0CAA0C;AAAA,IACzD,MAAM,SAAS,QAAQ,KAAK,QAAQ,KAAK,GAAG,IAAI;AAAA,IAChD,MAAM,UAAU,WAAW,KAAK,KAAK,QAAQ,GAAG,GAAG,IAAI,GAAG,UAAU,KAAK,QAAQ,GAAG,GAAG;AAAA,IACvF,MAAM,UAAU,YAAY,OAAO;AAAA,IACnC,IAAI,YAAY;AAAA,MAAW,MAAM,OAAO,SAAS,KAAK,UAAU,OAAO,KAAK,SAAS;AAAA,IAIrF,IAAI,eAAe,aAAa,YAAY,YAAY;AAAA,MACtD,IAAI,UAAU;AAAA,QAGZ,MAAM,OAAO,UAAU,+DAA+D;AAAA,MACxF;AAAA,MACA,MAAM,QAAO,OAAO,aAAa,OAAO,QAAQ,CAAC;AAAA,MACjD,MAAM,OAAO,MAAM,QAAQ,KAAK,IAAI,UAAU,iBAAiB;AAAA,MAC/D,IAAI,UAAS,OAAO,SAAS,GAAG;AAAA,QAC9B,MAAM,OAAO,UAAU,6DAA6D;AAAA,MACtF;AAAA,MACA,WAAW;AAAA,MACX,QAAQ;AAAA,MACR;AAAA,IACF;AAAA,IACA,IAAI,WAAW;AAAA,IACf,IAAI,eAAe,WAAW;AAAA,MAC5B,IAAI,CAAC,QAAQ,WAAW,UAAU,GAAG;AAAA,QACnC,MAAM,OAAO,UAAU,0CAA0C,aAAa;AAAA,MAChF;AAAA,MAQA,WAAW,QAAQ,MAAM,WAAW,MAAM;AAAA,MAC1C,MAAM,kBAAkB,YAAY,QAAQ;AAAA,MAC5C,IAAI,oBAAoB,WAAW;AAAA,QACjC,MAAM,OACJ,UAAU,sBAAsB,KAAK,UAAU,QAAQ,YAAY,iBACrE;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,IACP,MAAM,OAAO,OAAO,aAAa,OAAO,QAAQ,CAAC;AAAA,IACjD,IAAI,SAAS,OAAO,SAAS,QAAM;AAAA,MACjC,MAAM,OAAO,MAAM,SAAS,mBAAmB,KAAK,UAAU,IAAI;AAAA,MAClE,MAAM,OAAO,UAAU,eAAe,uCAAuC;AAAA,IAC/E;AAAA,IACA,IAAI,KAAK,IAAI,IAAI;AAAA,MAAG,MAAM,OAAO,UAAU,wBAAwB;AAAA,IACnE,KAAK,IAAI,IAAI;AAAA,IACb,MAAM,KAAK,IAAI;AAAA,IACf,YAAY,MAAM,QAAQ,KAAK,IAAI,UAAU,iBAAiB;AAAA,IAC9D,WAAW,QAAS,YAAY,SAAU;AAAA,IAC1C,QAAQ,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI;AAAA,IAChC,QAAQ;AAAA,IACR,IAAI,cAAc;AAAA,MAAG,SAAS;AAAA;AAAA,EAGhC,MAAM,OAAO,CAAC,UAA4B;AAAA,IACxC,IAAI,KAAK;AAAA,IACT,OAAO,KAAK,MAAM,QAAQ;AAAA,MACxB,IAAI,UAAU,OAAO;AAAA,QACnB,IAAI,MAAM,SAAS,EAAE,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC,GAAG;AAAA,UACjD,MAAM,OAAO,wCAAwC;AAAA,QACvD;AAAA,QACA;AAAA,MACF;AAAA,MACA,IAAI,UAAU,UAAU;AAAA,QACtB,MAAM,OAAO,KAAK,IAAI,QAAQ,QAAQ,MAAM,SAAS,EAAE;AAAA,QACvD,OAAO,IAAI,MAAM,SAAS,IAAI,KAAK,IAAI,GAAG,MAAM;AAAA,QAChD,UAAU;AAAA,QACV,MAAM;AAAA,QACN,IAAI,WAAW,OAAO;AAAA,UACpB,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,MACF,EAAO,SAAI,UAAU,QAAQ;AAAA,QAC3B,MAAM,OAAO,KAAK,IAAI,WAAW,MAAM,SAAS,EAAE;AAAA,QAElD,OAAO,KAAK,MAAM,MAAM,IAAI,KAAK,IAAI,CAAC;AAAA,QACtC,aAAa;AAAA,QACb,MAAM;AAAA,QACN,IAAI,cAAc;AAAA,UAAG,SAAS;AAAA,MAChC,EAAO;AAAA,QACL,MAAM,OAAO,KAAK,IAAI,SAAS,MAAM,SAAS,EAAE;AAAA,QAChD,WAAW;AAAA,QACX,MAAM;AAAA,QACN,IAAI,YAAY;AAAA,UAAG,QAAQ;AAAA;AAAA,IAE/B;AAAA;AAAA,EAGF,MAAM,SAAS,MAAmB;AAAA,IAChC,IAAI,UAAU;AAAA,MAAO,MAAM,OAAO,oDAAoD;AAAA,IACtF,IAAI,eAAe,aAAa,CAAC,UAAU;AAAA,MACzC,MAAM,OAAO,sBAAsB,0CAA0C;AAAA,IAC/E;AAAA,IACA,OAAO,EAAE,SAAS,MAAM;AAAA;AAAA,EAG1B,OAAO,EAAE,QAAQ,KAAK;AAAA;;;AC3OxB,IAAM,QAAQ,KAAK;AAOZ,IAAM,iBAAiB,OAC5B,SACA,QACA,SACyB;AAAA,EACzB,MAAM,MAAM,UAAU,QAAQ,IAAI;AAAA,EAKlC,IAAI,SAAS;AAAA,EACb,MAAM,SAAS,IAAI,eAA2B;AAAA,IAC5C,IAAI,CAAC,YAAY;AAAA,MACf,IAAI,UAAU,QAAQ,QAAQ;AAAA,QAC5B,WAAW,MAAM;AAAA,QACjB;AAAA,MACF;AAAA,MACA,WAAW,QAAQ,QAAQ,MAAM,QAAQ,SAAS,KAAK,CAAC;AAAA,MACxD,UAAU;AAAA;AAAA,EAEd,CAAC;AAAA,EACD,MAAM,WAAW,OAAO,YAAY,IAAI,oBAAoB,MAAM,CAAC,EAAE,UAAU;AAAA,EAC/E,IAAI;AAAA,IACF,UAAS;AAAA,MACP,QAAQ,MAAM,UAAU,MAAM,SAAS,KAAK;AAAA,MAC5C,IAAI;AAAA,QAAM;AAAA,MACV,IAAI,KAAK,KAAK;AAAA,IAChB;AAAA,IACA,OAAO,OAAO;AAAA,IACd,MAAM,SAAS,OAAO,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA,IAC7C,IAAI,iBAAiB;AAAA,MAAgB,MAAM;AAAA,IAC3C,MAAM,IAAI,eAAe,EAAE,SAAS,sBAAsB,OAAO,KAAK,KAAK,CAAC;AAAA;AAAA,EAE9E,OAAO,IAAI,OAAO;AAAA;AAGpB,IAAM,WAAW,CAAC,SAAiB,UAAkB,WACnD,IAAI,iBAAiB;AAAA,EACnB;AAAA,EACA;AAAA,EACA,SAAS,GAAG,qBAAqB,0BAA0B;AAAA,EAC3D;AACF,CAAC;AAOI,IAAM,iBAAiB,OAC5B,SACA,YACwB;AAAA,EACxB,MAAM,aAAa,UAAU,OAAO;AAAA,EACpC,IAAI,eAAe,QAAQ;AAAA,IAAQ,MAAM,SAAS,QAAQ,KAAK,QAAQ,QAAQ,UAAU;AAAA,EACzF,QAAQ,SAAS,UAAU,MAAM,eAAe,SAAS,IAAI,IAAI,CAAC,QAAQ,MAAM,CAAC,GAAG,QAAQ,IAAI;AAAA,EAChG,MAAM,QAAQ,QAAQ,IAAI,QAAQ,MAAM;AAAA,EACxC,IAAI,UAAU,WAAW;AAAA,IACvB,MAAM,QAAQ,QAAQ,SAAS,YAAY,KAAK,gBAAgB,QAAQ;AAAA,IACxE,MAAM,IAAI,eAAe;AAAA,MACvB,SAAS,GAAG,QAAQ,oCAAoC,QAAQ,UAAU,iBAAiB,MAAM,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,IAAI,KAAK;AAAA,IACtI,CAAC;AAAA,EACH;AAAA,EACA,MAAM,YAAY,UAAU,KAAK;AAAA,EACjC,IAAI,cAAc,QAAQ,cAAc;AAAA,IACtC,MAAM,SAAS,WAAW,QAAQ,WAAW,QAAQ,cAAc,SAAS;AAAA,EAC9E;AAAA,EACA,OAAO;AAAA;;;AC1DF,IAAM,UAAU;AAEhB,IAAM,UAAS,CAAC,MAAc,YACnC,IAAI,cAAc,EAAE,SAAS,kBAAkB,SAAS,UAAU,CAAC;AAGrE,IAAM,WAAW,CAAC,MAAc,UAA4B;AAAA,EAC1D,MAAM,MAAM,CAAC,YAAoB,kBAAkB,SAAS,YAAY;AAAA,EACxE,IAAI,iBAAiB,kBAAkB;AAAA,IACrC,QAAQ,QAAQ,UAAU,YAAY;AAAA,IACtC,OAAO,IAAI,iBAAiB,EAAE,QAAQ,UAAU,SAAS,IAAI,MAAM,OAAO,GAAG,QAAQ,CAAC;AAAA,EACxF;AAAA,EACA,IAAI,iBAAiB;AAAA,IAAgB,OAAO,IAAI,eAAe,EAAE,SAAS,IAAI,MAAM,OAAO,EAAE,CAAC;AAAA,EAC9F,IAAI,iBAAiB,gBAAgB;AAAA,IACnC,OAAO,IAAI,eAAe,EAAE,SAAS,IAAI,MAAM,OAAO,GAAG,WAAW,MAAM,UAAU,CAAC;AAAA,EACvF;AAAA,EACA,OAAO;AAAA;AAMF,IAAM,gBAAgB,OAC3B,QACA,UACqB;AAAA,EACrB,MAAM,OAAO,kBAAkB,KAAK;AAAA,EACpC,MAAM,WAAW,eAAe,KAAK;AAAA,EACrC,IAAI,SAAS,SAAS;AAAA,IAAG,MAAM,QAAO,MAAM,GAAG,SAAS,KAAK,IAAI,MAAM,SAAS;AAAA,EAChF,MAAM,MAAM,MAAM,WAAW,QAAQ,OAAO,MAAM,OAAM;AAAA,EACxD,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,OAAO,EAAE,UAAU,eAAe,KAAK,GAAG,MAAM,EAAE,MAAM,MAAM,QAAQ,MAAM,WAAW,IAAI,EAAE;AAAA;AAG/F,IAAM,aAAa,CACjB,OACA,cAC6B,KAAK,OAAO,QAAQ,SAAS,QAAQ,KAAK,SAAS,IAAI;AAO/E,IAAM,aAAa,OACxB,QACA,UACiD;AAAA,EACjD,QAAQ,UAAU,SAAS,MAAM,cAAc,QAAQ,KAAK;AAAA,EAC5D,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,EACxD,OAAO,UAAU,YAAY,YAAY,WAAW,OAAO,QAAQ;AAAA;AAI9D,IAAM,gBAAgB,OAC3B,QACA,WACiD;AAAA,EACjD,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,OAAO,IAAI;AAAA,EAC1D,OAAO,UAAU,YAAY,YAAY,KAAK,OAAO,QAAQ,OAAO,QAAQ,KAAK,OAAO,IAAI;AAAA;AAQ9F,IAAM,iBAAiB,OAAO,QAAoB,UAA6C;AAAA,EAC7F,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,SAAS;AAAA,EAQ9C,IAAI,MAAM,SAAS,gBAAgB,KAAK,OAAO,QAAW,GAAG;AAAA,IAC3D,MAAM,QACJ,kBAAkB,KAAK,GACvB,aAAa,MAAM,mDACjB,GAAG,KAAK,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,iDACxC,wCAAwC,SAC5C;AAAA,EACF;AAAA,EACA,IAAI,MAAM,SAAS;AAAA,IAAa;AAAA,EAChC,MAAM,MAAM,SAAS,YAAY,mBAAmB,QAAQ,KAAK;AAAA,EACjE,MAAM,QACJ,kBAAkB,KAAK,GACvB,aAAa,MAAM,aAAa,sDAAsD,SACxF;AAAA;AAoBK,IAAM,kBAAkB,OAC7B,QACA,OACA,OACA,UAA4B,CAAC,MACQ;AAAA,EACrC,QAAQ,QAAQ,OAAO,WAAW,CAAC,GAAG,cAAO,YAAS;AAAA,IAAG;AAAA,QAAc;AAAA,EAEvE,IAAI,SAAS,SAAS,GAAG;AAAA,IACvB,MAAM,QACJ,kBAAkB,KAAK,GACvB,GAAG,SAAS,KAAK,IAAI,sEACnB,8BAA8B,SAClC;AAAA,EACF;AAAA,EACA,QAAQ,UAAU,SAAS,MAAM,cAAc,QAAQ,KAAK;AAAA,EAE5D,MAAM,OAAO,QAAQ;AAAA,EACrB,IAAI,SAAS,aAAa,kBAAkB,IAAI,MAAM,KAAK,QAAQ,UAAU,MAAM,KAAK,GAAG;AAAA,IACzF,MAAM,QAAO,KAAK,MAAM,GAAG,eAAe,MAAM,KAAK,MAAM,SAAS;AAAA,EACtE;AAAA,EACA,MAAM,eAAe,QAAQ,KAAK;AAAA,EAKlC,IAAI,QAAQ,WAAW,WAAW;AAAA,IAChC,MAAM,UAAU,MAAM,aAAa,QAAQ,MAAM,KAAK;AAAA,IACtD,IAAI,YAAY;AAAA,MAAW,MAAM,QAAO,KAAK,MAAM,GAAG,YAAY,SAAS;AAAA,EAC7E;AAAA,EACA,MAAM,WAAW,OAAO,WAAgE;AAAA,IAGtF,IAAI,QAAQ,WAAW,KAAK,QAAQ;AAAA,MAClC,MAAM,QAAQ,MAAM,OAAO,SAAS,KAAK,IAAI;AAAA,MAC7C,IAAI,UAAU,aAAa,UAAU,KAAK,MAAM,KAAK;AAAA,QAAQ,OAAO;AAAA,IACtE;AAAA,IACA,MAAM,MAAK,eAAe,SAAS,QAAQ,OAAO,SAAS,IAAI,UAAU;AAAA,IACzE,IAAI;AAAA,MACF,MAAM,QAAQ,MAAM,eAAe,MAAM,MAAM,SAAS,KAAK,SAAS,IAAI,GAAG,QAAQ;AAAA,MACrF,MAAM,MAAK,YAAY,SAAS,UAAU,SAAS,cAAc;AAAA,MACjE,OAAO;AAAA,MACP,OAAO,OAAO;AAAA,MACd,MAAM,SAAS,KAAK,MAAM,KAAK;AAAA;AAAA;AAAA,EAGnC,MAAM,OAAO,EAAE,UAAU,OAAO,MAAM,OAAO,iBAAQ,KAAK;AAAA,EAC1D,OAAO,WAAW,MAAM,aAAa,QAAQ,MAAM,QAAQ,QAAQ,KAAK,GAAG,QAAQ;AAAA;AAI9E,IAAM,eAAe,CAAC,QAAoB,WAC/C,gBAAgB,QAAQ,QAAQ,OAAM;;;AT1JjC,IAAM,aAAa,OACxB,QACA,MACA,MACA,WAC8B;AAAA,EAC9B,MAAM,WAAW,YAAa,QAAQ,CAAC,CAAuC;AAAA,EAC9E,IAAI,SAAS,SAAS;AAAA,IAAG,MAAM,QAAO,OAAO,MAAM,GAAG,SAAS,KAAK,IAAI,MAAM,SAAS;AAAA,EAGvF,MAAM,WAAW,gBAAgB,OAAO,QAAQ,KAAK,MAAM;AAAA,EAC3D,IAAI,aAAa;AAAA,IAAW,MAAM,QAAO,OAAO,MAAM,GAAG,aAAa,SAAS;AAAA,EAE/E,MAAM,OAAO;AAAA,EACb,MAAM,YAAY,eAAe,MAAM,WAAW;AAAA,EAClD,MAAM,OAAO,cAAc,YAAY,YAAY,GAAG,aAAa,KAAK;AAAA,EACxE,MAAM,SAAS,UAAU,MAAM,IAAI;AAAA,EACnC,IAAI,UAAU,SAAS,OAAO,MAAM;AAAA,IAClC,MAAM,QAAO,OAAO,MAAM,GAAG,eAAe,MAAM,IAAI,MAAM,SAAS;AAAA,EACvE;AAAA,EAEA,IAAI,WAAW,IAAI;AAAA,IAAG,OAAO,WAAW,SAAS,MAAM,cAAc,QAAQ,IAAI,GAAG,MAAM,MAAM;AAAA,EAChG,IAAI,SAAS;AAAA,IAAW,OAAO,SAAS,OAAO,OAAO,YAAY,EAAE,QAAQ,UAAU;AAAA,EACtF,IAAI,KAAK,SAAS,KAAK,QAAQ,KAAK,WAAW,KAAK;AAAA,IAAQ,OAAO,EAAE,QAAQ,UAAU;AAAA,EACvF,OAAO,SAAS,EAAE,QAAQ,SAAS,IAAI;AAAA;;;AU9CzC,oBAAS;AACT;AAUO,IAAM,mBAAmB,CAAC,QAAoB,QAC5C,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,cAAc,OAAO,mBAAmB,IAAI,KAAK,IAAI,UAAU,OAAO;AAAA,EAC5E,MAAM,OAAO,KAAK,MAAM,WAAW,QAAQ,IAAI,IAA0B,CAAC;AAAA,EAC1E,MAAM,QAAQ,aACV,OAAO,KAAK,KACH,cAAM,CAAC,UACL,WACE,mBACL,GAAG,IAAI,+DAA+D,MAAM,eAC1E,qFACJ,GACA,SACF,CACF,CACF,IACA,OAAO;AAAA,EACX,OAAO,UAAU,YAAY,YAAY,SAAQ,KAAK;AAAA,CACvD;;;AChCH,kBAAS;AACT;AACA;AAIO,IAAM,sBAAsB,CAAC,QAC3B,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,IAAW,eAAO,KAAK;AAAA,IAAG,OAAO,CAAC;AAAA,EAClC,MAAM,WAAoB,MAAM,MAAM,UAAU,MAAM;AAAA,EACtD,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa;AAAA,IAAY,OAAO,CAAC;AAAA,EAC5E,IAAI,aAAa;AAAA,IAAM,OAAO,CAAC;AAAA,EAC/B,OAAO,YAAY,QAA6C,EAAE,IAChE,CAAC,YAAY,qCAAqC,SACpD;AAAA,CACD;;;ACtBH;AACA;AACA;AACA;AAgBA,IAAM,SAAS,CAAC,SAAiB,cAAuB,IAAI,eAAe,EAAE,SAAS,UAAU,CAAC;AAEjG,IAAM,UAAU,CAAC,KAAa,SACrB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,WAAW,OAAO,OAAO,IAAI,GAAG;AAAA,EACtC,IAAI,SAAS,WAAW,KAAK;AAAA,IAC3B,OAAO,OAAO,OAAO,GAAG,aAAa,OAAO,SAAS,MAAM,KAAK,SAAS,UAAU,GAAG;AAAA,EACxF;AAAA,EAGA,MAAM,UAAU,IAAI,WAAW,IAAI;AAAA,EACnC,IAAI,QAAQ;AAAA,EACZ,OAAc,kBAAW,SAAS,QAAQ,CAAC,UAAU;AAAA,IACnD,IAAI,QAAQ,MAAM,SAAS,MAAM;AAAA,MAC/B,OAAc,aAAK,OAAO,GAAG,6BAA6B,OAAO,IAAI,WAAW,KAAK,CAAC;AAAA,IACxF;AAAA,IACA,QAAQ,IAAI,OAAO,KAAK;AAAA,IACxB,SAAS,MAAM;AAAA,IACf,OAAc;AAAA,GACf;AAAA,EACD,IAAI,UAAU,MAAM;AAAA,IAClB,OAAO,OAAO,OAAO,GAAG,QAAQ,OAAO,KAAK,yBAAyB,OAAO,IAAI,KAAK,IAAI;AAAA,EAC3F;AAAA,EACA,OAAO;AAAA,CACR,EAAE,KAEM,iBAAS,mBAAmB,CAAC,UAAiB,aAAK,OAAO,MAAM,SAAS,IAAI,CAAC,CAAC,CACxF;AAGK,IAAM,iBAAiB,CAC5B,KACA,MACA,SAAyB,CAAC,MAE1B,QAAQ,KAAK,IAAI,EAAE,KACV,sBAAc;AAAA,EACnB,UAAU,OAAO,WAAW;AAAA,EAC5B,QAAQ,MAAa,aAAK,OAAO,GAAG,qCAAqC,KAAK,CAAC;AACjF,CAAC,GACM,cAAM;AAAA,EACX,UAAmB,gBAAO,OAAO,WAAW,WAAW;AAAA,EACvD,OAAO,OAAO,WAAW;AAAA,EACzB,OAAO,CAAC,UAA0B,MAAM;AAC1C,CAAC,CACH;AAGK,IAAM,mBACX,CAAC,QAA+B,SAAyB,CAAC,MAC1D,CAAC,KAAK,SACG,mBACL,eAAe,KAAK,MAAM,MAAM,EAAE,KAAY,uBAA0B,uBAAY,MAAM,CAAC,CAC7F;AAUG,IAAM,kBAAkB,CAAC,UAAsC;AAAA,EACpE,MAAM,WAAW,IAAI;AAAA,EACrB,OAAO,CAAC,KAAK,SAAS;AAAA,IACpB,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK;AAAA,IAC/B,MAAM,UAAU,SAAS,IAAI,GAAG;AAAA,IAChC,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,IAClC,MAAM,UAAU,MAAM,KAAK,IAAI,EAAE,QAAQ,MAAM,SAAS,OAAO,GAAG,CAAC;AAAA,IACnE,SAAS,IAAI,KAAK,OAAO;AAAA,IACzB,OAAO;AAAA;AAAA;;;AnBxBJ,IAAM,gBAAgB,SAAwB,gBAAgB;AAK9D,IAAM,4BAA4B,CAAC,YAAoC,CAAC,MACpE,gBACP,eACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,QAAQ,gBAAgB,iBAAiB,QAAQ,UAAU,QAAQ,CAAC;AAAA,EAU1E,MAAM,SAAS,IAAI;AAAA,EACnB,MAAM,QAAQ,CAAC,KAAa,UAAoC;AAAA,IAC9D,MAAM,OAAO,kBAAkB,KAAK;AAAA,IACpC,MAAM,SAAS,OAAO,IAAI,IAAI;AAAA,IAC9B,IAAI,WAAW,aAAa,WAAW,KAAK;AAAA,MAC1C,MAAM,QACJ,MACA,2BAA2B,2DACzB,2DAA2D,SAC/D;AAAA,IACF;AAAA,IACA,OAAO,IAAI,MAAM,GAAG;AAAA;AAAA,EAEtB,OAAO,cAAc,SAAS,GAAG;AAAA,IAC/B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAK7B,MAAM,GAAG,KAAK,YAAY,MAAM,aAC9B,WAAW,YACP,iBAAiB,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,IAClD,KAAK,MAAM,cAAc,QAAQ,MAAM,CAAC;AAAA,IAE9C,MAAM,GAAG,YAAY,MAAM,MAAM,aAC/B,WAAW,YACP,eAAe,UAAU,IACzB,KAAK,MAAM,WAAW,QAAQ,MAAM,MAAM,MAAM,CAAC;AAAA,IAKvD,WAAW,GAAG,KAAK,YAAY,MAAM,MAAM,QAAQ,cAC1C,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,WAAW,OAAO,oBAAoB,GAAG;AAAA,MAC/C,MAAM,QAAQ,OAAO,cAAc,EAAE,KAAK,YAAY,OAAO,CAAC;AAAA,MAC9D,OAAO,OAAO,KAAK,YAAY;AAAA,QAC7B,MAAM,KAAK,IAAI;AAAA,QACf,OAAO,gBAAgB,QAAQ,OAAO,MAAM;AAAA,UAC1C;AAAA,UACA;AAAA,UACA,MAAM,CAAC,YAAmB,mBAAW,QAAQ,KAAK,OAAO,CAAC;AAAA,UAC1D;AAAA,UACA;AAAA,QACF,CAAC;AAAA,OACF;AAAA,KACF;AAAA,IAaH,QAAQ,GAAG,KAAK,QAAQ,cACtB,KAAK,YAAY;AAAA,MACf,MAAM,SAAS,OAAO,IAAI,OAAO,IAAI;AAAA,MACrC,IAAI,WAAW,aAAa,WAAW,KAAK;AAAA,QAC1C,MAAa,mBACX,QAAQ,KAAK,GAAG,OAAO,yBAAyB,6BAA6B,CAC/E;AAAA,QACA;AAAA,MACF;AAAA,MACA,MAAM,aAAa,QAAQ,MAAM;AAAA,MACjC,IAAI,WAAW;AAAA,QAAK,OAAO,OAAO,OAAO,IAAI;AAAA,KAC9C;AAAA,EACL,CAAC;AAAA,CACF,CACH;AAGK,IAAM,wBAAwB,MAAM,0BAA0B;;AoBpFrE,IAAM,SAAS,CAAC,UAAoC,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,IAAI;AAG7F,IAAM,MAAM,CAAC,QAAgB,QAAyB,OAAO,OAAO,QAAQ,GAAG;AAM/E,IAAM,eAAe,CAAC,SAAwB,WAAgD;AAAA,EAC5F,MAAM,SAAS,IAAI,QAAQ,SAAS,MAAM,IAAI,QAAQ,QAAQ,UAAU;AAAA,EACxE,MAAM,WACJ,QAAQ,aAAa,aAAa,IAAI,QAAQ,UAAU,MAAM,IAC1D,QAAQ,SAAS,SAAS,SAC1B;AAAA,EACN,IAAI,WAAW,aAAa,aAAa;AAAA,IAAW,OAAO;AAAA,EAC3D,OAAO,UAAU;AAAA;AAIZ,IAAM,kBAAkB,CAAC,SAAyB,YAAsC;AAAA,EAC7F,MAAM,QAAQ,IAAI,QAAQ,UAAU,QAAQ,OAAO,IAC/C,QAAQ,SAAS,QAAQ,WACzB;AAAA,EACJ,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO;AAAA,MACL,GAAG,QAAQ,mBAAmB,QAAQ,mCAAmC,OAAO,OAAO,KAAK,QAAQ,QAAQ,CAAC;AAAA,IAC/G;AAAA,EACF;AAAA,EACA,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,IAAI,MAAM,UAAU,QAAQ,MAAM,GAAG;AAAA,IAGxC,MAAM,SAAS,OAAO,OAAO,MAAM,QAAQ,EAAE,SAAS,QAAQ,MAAM;AAAA,IACpE,MAAM,OAAO,SAAS,6DAA6D;AAAA,IACnF,MAAM,KACJ,GAAG,QAAQ,0BAA0B,QAAQ,UAAU,gBAAgB,OAAO,OAAO,KAAK,MAAM,QAAQ,CAAC,GAC3G;AAAA,EACF;AAAA,EACA,MAAM,YAAY,IAAI,MAAM,UAAU,QAAQ,OAAO,IACjD,MAAM,SAAS,QAAQ,WACvB;AAAA,EACJ,IAAI,cAAc,WAAW;AAAA,IAC3B,MAAM,KACJ,GAAG,QAAQ,WAAW,QAAQ,0CAA0C,OAAO,OAAO,KAAK,MAAM,QAAQ,CAAC,SACxG,iGACJ;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,UAAU,IAAI,WAAW,QAAQ,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAAA,EACjF,IAAI,YAAY,WAAW;AAAA,IACzB,MAAM,KACJ,GAAG,QAAQ,WAAW,QAAQ,uCAAuC,QAAQ,cAAc,OAAO,OAAO,KAAK,SAAS,CAAC,IAC1H;AAAA,EACF,EAAO,SAAI,MAAM,WAAW,GAAG;AAAA,IAC7B,MAAM,SAAS,MAAM,SAAS,QAAQ,WAAW;AAAA,IACjD,MAAM,SAAS,aAAa,SAAS,MAAM;AAAA,IAC3C,IAAI,WAAW,QAAQ;AAAA,MACrB,MAAM,KACJ,GAAG,QAAQ,WAAW,QAAQ,qBAAqB,yCACjD,0EACJ;AAAA,IACF,EAAO,SAAI,WAAW,WAAW;AAAA,MAC/B,MAAM,KACJ,GAAG,QAAQ,WAAW,QAAQ,sCAAsC,sBAClE,mDACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAOF,IAAM,gBAAgB,CAAC,SAAyB,YAA0C;AAAA,EAC/F,MAAM,WAAW,gBAAgB,SAAS,OAAO;AAAA,EAEjD,MAAM,MAAM,CAAI,QAAiD,QAC/D,WAAW,aAAa,IAAI,QAAQ,GAAG,IAAI,OAAO,OAAO;AAAA,EAC3D,MAAM,QAAQ,IAAI,QAAQ,UAAU,QAAQ,OAAO;AAAA,EACnD,MAAM,UAAU,IAAI,IAAI,OAAO,UAAU,QAAQ,OAAO,GAAG,QAAQ,QAAQ;AAAA,EAC3E,MAAM,SAAS,IAAI,OAAO,UAAU,QAAQ,MAAM;AAAA,EAClD,MAAM,SACJ,WAAW,aAAa,YAAY,YAAY,YAAY,aAAa,SAAS,MAAM;AAAA,EAC1F,MAAM,SAAS,WAAW,SAAS,YAAY;AAAA,EAC/C,IACE,SAAS,SAAS,KAClB,YAAY,aACZ,WAAW,aACX,WAAW,WACX;AAAA,IACA,MAAM,IAAI,cAAc;AAAA,MACtB,SAAS,kBAAkB,QAAQ,WAAW,SAAS,KAAK,IAAI;AAAA,IAClE,CAAC;AAAA,EACH;AAAA,EACA,QAAQ,OAAO,MAAM,MAAM,QAAQ,eAAe,MAAM,QAAQ;AAAA,EAChE,OAAO;AAAA,IAEL,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,SACI,SAAS,YAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACvC;AAAA,IACA;AAAA,IACA,MAAM,QAAQ;AAAA,IACd;AAAA,EACF;AAAA;AAIK,IAAM,mBAAmB,CAC9B,MACA,YACW,GAAG,QAAQ,QAAQ,WAAW,QAAQ;AAY5C,IAAM,iBAAiB,CAC5B,UACA,WACiC;AAAA,EACjC,WAAW,WAAW,UAAU;AAAA,IAC9B,YAAY,KAAK,UAAU,OAAO,QAAQ,QAAQ,QAAQ,GAAG;AAAA,MAC3D,YAAY,SAAS,cAAc,OAAO,QAAQ,MAAM,QAAQ,GAAG;AAAA,QACjE,YAAY,UAAU,YAAY,OAAO,QAAQ,SAAS,GAAG;AAAA,UAC3D,YAAY,QAAQ,WAAW,OAAO,QAAQ,MAAM,QAAQ,GAAG;AAAA,YAC7D,MAAM,SAAS,aAAa,SAAS,MAAM;AAAA,YAC3C,IAAI,WAAW,UAAU,WAAW,QAAQ;AAAA,cAC1C,OAAO,EAAE,QAAQ,SAAS,KAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,YAC3E;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA;;AClNF,IAAM,WAAW;AACjB,IAAM,QAAO;AACb,IAAM,MAAM;AACZ,IAAM,WAAW,sBAAsB,2BAA0B;AAE1D,IAAM,mBAAmC;AAAA,EAC9C,UAAU;AAAA,IACR,SAAS;AAAA,MAGP,UAAU,EAAE,KAAK,MAAM;AAAA,MACvB,UAAU;AAAA,QACR,SAAS;AAAA,UACP,cAAc;AAAA,YACZ,OAAO;AAAA,YACP,WAAW;AAAA,cACT,UAAU;AAAA,cACV,QAAQ;AAAA,cACR,WAAW;AAAA,gBACT,MAAM;AAAA,gBACN,KAAK;AAAA,kBACH,aAAa;AAAA,kBACb,QAAQ;AAAA,kBACR,KAAK;AAAA,gBACP;AAAA,gBACA,QAAQ;AAAA,gBACR,KAAK,GAAG;AAAA,gBACR,UAAU;AAAA,cACZ;AAAA,cACA,KAAK,GAAG;AAAA,YACV;AAAA,YAIA,UAAU;AAAA,cACR,KAAK;AAAA,gBACH,UAAU;AAAA,gBACV,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,YACA,SAAS,CAAC;AAAA,YACV,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,KAAK;AAAA,UACP;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AACV;;ACtEA;AACA;AAIO,IAAM,mBAAmB,CAAC,WAC/B,sBAAsB,EAAE,KAChB,eAAc,gBAAS,gBAAgB,MAAM,GAAmB,qBAAK,CAAC,CAC9E;;ACYF,IAAM,YAAW;AACjB,IAAM,YAAW;AAEV,IAAM,oBAAoC;AAAA,EAC/C,UAAU;AAAA,IACR,iBAAiB;AAAA,MACf,UAAU,EAAE,iBAAiB,qBAAqB;AAAA,MAClD,UAAU;AAAA,QACR,UAAU;AAAA,UACR,gBAAgB;AAAA,YACd,OAAO;AAAA,YACP,WAAW;AAAA,cACT,UAAU;AAAA,cACV,QAAQ;AAAA,cACR,KAAK,GAAG;AAAA,YACV;AAAA,YACA,SAAS;AAAA,cACP,sBACE;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,KAAK;AAAA,UACP;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,oBAAoB;AAAA,MAElB,UAAU,EAAE,oBAAoB,wBAAwB;AAAA,MACxD,UAAU;AAAA,QACR,WAAW;AAAA,UACT,gBAAgB;AAAA,YACd,OAAO;AAAA,YACP,WAAW;AAAA,cACT,UAAU;AAAA,cACV,QAAQ;AAAA,cACR,KAAK,GAAG;AAAA,YACV;AAAA,YACA,SAAS;AAAA,cACP,yBACE;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,KAAK;AAAA,UACP;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,mBAAmB;AAAA,MACjB,UAAU,EAAE,mBAAmB,uBAAuB;AAAA,MACtD,UAAU;AAAA,QACR,UAAU;AAAA,UACR,gBAAgB;AAAA,YACd,OAAO;AAAA,YACP,WAAW;AAAA,cACT,UAAU;AAAA,cACV,QAAQ;AAAA,cACR,KAAK,GAAG;AAAA,YACV;AAAA,YACA,SAAS;AAAA,cACP,wBACE;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,KAAK;AAAA,UACP;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MAGP,UAAU;AAAA,QACR,SAAS;AAAA,QACT,SAAS;AAAA,QACT,gBAAgB;AAAA,QAChB,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,MACb;AAAA,MACA,UAAU;AAAA,QACR,WAAW;AAAA,UACT,gBAAgB;AAAA,YACd,OAAO;AAAA,YACP,WAAW;AAAA,cACT,UAAU;AAAA,cACV,QAAQ;AAAA,cACR,KAAK,GAAG;AAAA,YACV;AAAA,YACA,SAAS;AAAA,cACP,gBAAgB;AAAA,cAChB,gBAAgB;AAAA,cAChB,qBACE;AAAA,cAGF,eAAe;AAAA,cACf,iBAAiB;AAAA,cACjB,cAAc;AAAA,cACd,kBAAkB;AAAA,YACpB;AAAA,YACA,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,KAAK;AAAA,UACP;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AACV;",
+  "debugId": "684C5D2BD8F11B9A64756E2164756E21",
   "names": []
 }