@homeflare/alchemy 0.25.1 → 0.27.0

package/dist/linux/index.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
-  "sources": ["../src/linux/directory.ts", "../src/launchd/host-effect.ts", "../src/launchd/runner.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/launchd/secret-tripwire.ts", "../src/launchd/host-file-form.ts", "../src/linux/directory-lifecycle.ts", "../src/linux/providers.ts", "../src/linux/remote-file.ts", "../src/launchd/job-form.ts", "../src/launchd/plist.ts", "../src/linux/region.ts", "../src/linux/remote-file-form.ts", "../src/linux/remote-file-plan.ts", "../src/linux/remote-file-lifecycle.ts", "../src/linux/unit.ts", "../src/linux/unit-handlers.ts", "../src/linux/systemctl.ts", "../src/linux/unit-form.ts", "../src/linux/unit-settle.ts", "../src/linux/unit-preflight.ts", "../src/linux/unit-lifecycle.ts", "../src/linux/ssh-runner.ts", "../src/launchd/host-lookup.ts", "../src/linux/ssh-command.ts", "../src/linux/ssh-scripts.ts"],
+  "sources": ["../src/linux/directory.ts", "../src/launchd/host-effect.ts", "../src/launchd/runner.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/launchd/secret-tripwire.ts", "../src/launchd/host-file-form.ts", "../src/linux/directory-lifecycle.ts", "../src/linux/providers.ts", "../src/linux/remote-file.ts", "../src/launchd/job-form.ts", "../src/launchd/plist.ts", "../src/linux/region.ts", "../src/linux/remote-file-form.ts", "../src/linux/remote-file-plan.ts", "../src/linux/remote-file-lifecycle.ts", "../src/linux/unit.ts", "../src/linux/unit-handlers.ts", "../src/linux/systemctl.ts", "../src/linux/unit-form.ts", "../src/linux/unit-settle.ts", "../src/linux/unit-preflight.ts", "../src/linux/unit-lifecycle.ts", "../src/linux/ssh-runner.ts", "../src/launchd/host-lookup.ts", "../src/linux/ssh-command.ts", "../src/linux/ssh-scripts.ts", "../src/launchd/local-runner.ts", "../src/launchd/job-validate.ts", "../src/launchd/launchctl.ts", "../src/launchd/sudo-allowlist.ts", "../src/launchd/sudo-said.ts", "../src/linux/sudo-allowlist-dir.ts", "../src/linux/sudo-allowlist-chown.ts", "../src/linux/sudo-allowlist.ts", "../src/launchd/sudo-acl.ts", "../src/launchd/sudo-guard-mode.ts", "../src/launchd/sudo-guard.ts", "../src/linux/sudo-listing.ts", "../src/linux/sudo-guard.ts", "../src/linux/sudo-exec.ts", "../src/linux/sudo-stage.ts", "../src/linux/sudo-write.ts", "../src/linux/sudo-runner.ts"],
   "sourcesContent": [
     "/**\n * `Host.Directory` — one directory on the host, declared: path, mode, owner, group.\n *\n * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`: a directory already at the path reads as `Unowned`, and\n *   where the plan never asked, reconcile honours the same flag (docs/ownership.md).\n * ★ IT IS NOT LINUX-ONLY. `mkdir`, `chmod`, `chown` and `rmdir` are the same argv on macOS, so this\n *   resource works through any HostRunner; it lives in the linux subpath because the gap it closes\n *   was found there (a first deploy into a new tree, which every file resource refuses to create).\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { lift, resolvedString } from '../launchd/host-effect.ts';\nimport { HostRunnerService } from '../launchd/runner.ts';\nimport { adoptsAtApply } from '../ownership/adopt.ts';\nimport { noteUnfinished } from '../ownership/resume.ts';\nimport type { HostDirectoryAttributes, HostDirectoryProps } from './directory-lifecycle.ts';\nimport {\n  deleteDirectory,\n  diffDirectory,\n  readDirectory,\n  reconcileDirectory,\n} from './directory-lifecycle.ts';\n\nexport type { HostDirectoryAttributes, HostDirectoryProps } from './directory-lifecycle.ts';\n\nexport interface HostDirectory extends Resource<\n  'Host.Directory',\n  HostDirectoryProps,\n  HostDirectoryAttributes\n> {}\n\nexport const HostDirectory = Resource<HostDirectory>('Host.Directory');\n\nexport const HostDirectoryProvider = () =>\n  Provider.effect(\n    HostDirectory,\n    Effect.gen(function* () {\n      const runner = yield* HostRunnerService;\n      return HostDirectory.Provider.of({\n        list: () => Effect.succeed([]),\n\n        read: ({ olds, output }) =>\n          lift(async () => {\n            const found = await readDirectory(runner, olds.path);\n            if (found === undefined) return undefined;\n            return output === undefined ? Unowned(found) : found;\n          }),\n\n        diff: ({ instanceId, news, output }) => {\n          if (output === undefined) return noteUnfinished(instanceId);\n          if (isResolved(news)) return lift(() => diffDirectory(runner, news, output));\n          // ⛔ A new path is a replace even while the rest is unresolved: the engine's default\n          //   update would create the new directory and leave the old one behind forever.\n          const path = resolvedString(news, 'path');\n          return Effect.succeed(\n            path !== undefined && path !== output.path ? { action: 'replace' as const } : undefined,\n          );\n        },\n\n        reconcile: ({ fqn, instanceId, news, output }) =>\n          Effect.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) =>\n            lift(() => reconcileDirectory(runner, news, output, adopt)),\n          ),\n\n        delete: ({ output }) => lift(() => deleteDirectory(runner, output)),\n      });\n    }),\n  );\n",
     "/**\n * The one place a HostRunner's promises become Effects — plus the one probe of an unresolved\n * `news` both providers' diffs share. (The engine's adopt setting lives in ownership/adopt.ts.)\n *\n * ★ The lifecycle files are plain async functions over a HostRunner (see runner.ts for why the\n *   runner is promise-based), so each provider handler is a single `lift(() => step(runner, …))`.\n * ⚠️ A thrown Error stays that Error — its message is the refusal a deploy prints. Anything else\n *   thrown is wrapped, so the failure channel is always an Error with a readable message.\n */\nimport * as Effect from 'effect/Effect';\n\nexport const lift = <A>(step: () => Promise<A>): Effect.Effect<A, Error> =>\n  Effect.tryPromise({\n    catch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),\n    try: step,\n  });\n\n/**\n * A string prop of a diff's `news`, when that one prop is already resolved; `undefined` while it\n * is still an Output (a function-typed proxy), an Effect or a Config.\n * ★ For the identity props a diff must see even when the rest of `news` is unresolved — a plain\n *   string is resolved by definition, so `typeof` is the whole test.\n */\nexport const resolvedString = (news: unknown, key: string): string | undefined => {\n  if (typeof news !== 'object' || news === null) return undefined;\n  const value = (news as Record<string, unknown>)[key];\n  return typeof value === 'string' ? value : undefined;\n};\n",
@@ -23,16 +23,33 @@
     "/**\n * `Systemd.Unit` and `Systemd.Timer` — one systemd unit file and systemd's view of it, declared.\n *\n * - create / update — write the unit file atomically, `daemon-reload`, enable or disable, then\n *   start, stop, or RESTART ONLY when something actually changed (unit-lifecycle.ts settle).\n * - read — the unit file's SHA-256 plus `systemctl show` (load state, active state, enablement).\n * - diff — the rendered digest against the stored AND the on-disk one, the declared enablement and\n *   running state against systemd's, and systemd's own `NeedDaemonReload`.\n * - replace — only when the unit's name or directory changes, and DELETE FIRST: two unit files for\n *   one name cannot both be the one systemd reads.\n * - delete — stop, disable, remove the file, reload.\n *\n * ⛔ A DEPLOY NEVER MASS-RESTARTS — see the ⛔ at the top of unit-lifecycle.ts. It is the property\n *   that lets this family reach a host holding a vault, a clock or a UPS handler.\n * ⛔ THE UNIT FILE IS NEVER A SECRET (unit-form.ts): it is 0644 and its props sit in state.\n * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`. A unit already on the host reads as `Unowned`; adopting\n *   one that already matches the declaration does not restart it.\n * ★ TWO RESOURCES, ONE LIFECYCLE. A timer is a unit whose file ends `.timer` and carries a\n *   `[Timer]` section; splitting the TYPE rather than the code means a plan says which of the two\n *   a row is, and a `.service` declared as a timer is a refusal instead of a puzzle.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { HostRunnerService } from '../launchd/runner.ts';\nimport type { SystemdUnitAttributes, SystemdUnitProps } from './unit-form.ts';\nimport { deleteHandler, diffHandler, readHandler, reconcileHandler } from './unit-handlers.ts';\n\nexport type { SystemdUnitAttributes, SystemdUnitProps, UnitSection } from './unit-form.ts';\n\nexport interface SystemdUnit extends Resource<\n  'Systemd.Unit',\n  SystemdUnitProps,\n  SystemdUnitAttributes\n> {}\n\nexport interface SystemdTimer extends Resource<\n  'Systemd.Timer',\n  SystemdUnitProps,\n  SystemdUnitAttributes\n> {}\n\nexport const SystemdUnit = Resource<SystemdUnit>('Systemd.Unit');\nexport const SystemdTimer = Resource<SystemdTimer>('Systemd.Timer');\n\nexport const SystemdUnitProvider = () =>\n  Provider.effect(\n    SystemdUnit,\n    Effect.gen(function* () {\n      const runner = yield* HostRunnerService;\n      return SystemdUnit.Provider.of({\n        /**\n         * ⛔ systemd's unit list is not a list of things this stack owns — it is every vendor,\n         *   package and hand-written unit on the host. Returning them would invite a nuke to stop\n         *   services nothing here declared.\n         */\n        list: () => Effect.succeed([]),\n        read: ({ olds, output }) => readHandler(runner, olds, output),\n        diff: ({ instanceId, news, output }) => diffHandler(runner, instanceId, news, output),\n        reconcile: (args) => reconcileHandler(runner, args),\n        delete: ({ output }) => deleteHandler(runner, output),\n      });\n    }),\n  );\n\nexport const SystemdTimerProvider = () =>\n  Provider.effect(\n    SystemdTimer,\n    Effect.gen(function* () {\n      const runner = yield* HostRunnerService;\n      return SystemdTimer.Provider.of({\n        list: () => Effect.succeed([]),\n        read: ({ olds, output }) => readHandler(runner, olds, output),\n        // ★ `'timer'` is the whole difference: the same lifecycle, refusing a name that is not one.\n        diff: ({ instanceId, news, output }) =>\n          diffHandler(runner, instanceId, news, output, 'timer'),\n        reconcile: (args) => reconcileHandler(runner, args, 'timer'),\n        delete: ({ output }) => deleteHandler(runner, output),\n      });\n    }),\n  );\n",
     "/**\n * The four provider handlers `Systemd.Unit` and `Systemd.Timer` share, as plain functions over a\n * HostRunner — so the two Resources differ only in their TYPE and the unit suffix they insist on.\n *\n * ★ WHY NOT ONE SHARED HANDLER OBJECT. `Provider.of` is typed per Resource, so an object built once\n *   and passed to both would have to be widened or cast; functions with their arguments spelled out\n *   keep both call sites fully checked and still say each rule once.\n */\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport type { Diff } from 'alchemy/Diff';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport { lift, resolvedString } from '../launchd/host-effect.ts';\nimport type { HostRunner } from '../launchd/runner.ts';\nimport { adoptsAtApply } from '../ownership/adopt.ts';\nimport { noteUnfinished } from '../ownership/resume.ts';\nimport type { SystemdUnitAttributes, SystemdUnitProps } from './unit-form.ts';\nimport { deleteUnit, diffUnit, readUnit, reconcileUnit } from './unit-lifecycle.ts';\nimport { assertRenameTarget } from './unit-preflight.ts';\n\nexport const readHandler = (\n  runner: HostRunner,\n  olds: SystemdUnitProps,\n  output: SystemdUnitAttributes | undefined,\n): Effect.Effect<SystemdUnitAttributes | undefined, Error> =>\n  lift(async () => {\n    const found = await readUnit(runner, olds);\n    if (found === undefined) return undefined;\n    return output === undefined ? Unowned(found) : found;\n  });\n\nexport const diffHandler = (\n  runner: HostRunner,\n  instanceId: string,\n  news: Input<SystemdUnitProps>,\n  output: SystemdUnitAttributes | undefined,\n  expect?: string,\n): Effect.Effect<Diff | undefined, Error> => {\n  // ★ An unfinished generation of our own: `--adopt` may resume it (ownership/resume.ts).\n  if (output === undefined) return noteUnfinished(instanceId);\n  if (isResolved(news)) return lift(() => diffUnit(runner, news, output, expect));\n  /**\n   * ⛔ A RENAME MUST BE SEEN EVEN WHILE OTHER PROPS ARE UNRESOLVED. The engine's default for a prop\n   *   change is `update`, and an update under a new name writes the new unit file and leaves the old\n   *   unit running with nothing in state to ever remove it. `content` is exactly what is unresolved\n   *   when a rendered config file's digest is templated into the same deploy.\n   */\n  const name = resolvedString(news, 'name');\n  if (name === undefined || name === output.name) return Effect.succeed(undefined);\n  /**\n   * ⛔ THE NAME IS ENOUGH TO REFUSE A MASKED TARGET, and the refusal has to happen here: the old\n   *   unit is removed before the new one is reconciled. The unit file cannot be compared while\n   *   `content` is still an Output, so this is the name-only half of assertReplaceable\n   *   (unit-preflight.ts).\n   */\n  return lift(async () => {\n    await assertRenameTarget(runner, output, name);\n    return { action: 'replace' as const, deleteFirst: true };\n  });\n};\n\nexport const reconcileHandler = (\n  runner: HostRunner,\n  args: {\n    fqn: string;\n    instanceId: string;\n    news: SystemdUnitProps;\n    output: SystemdUnitAttributes | undefined;\n  },\n  expect?: string,\n): Effect.Effect<SystemdUnitAttributes, Error> =>\n  Effect.flatMap(adoptsAtApply(args), (adopt) =>\n    lift(() => reconcileUnit(runner, args.news, args.output, adopt, expect)),\n  );\n\nexport const deleteHandler = (\n  runner: HostRunner,\n  output: SystemdUnitAttributes,\n): Effect.Effect<void, Error> => lift(() => deleteUnit(runner, output));\n",
     "/**\n * The `systemctl` subcommands the systemd family uses, over a HostRunner, plus the parser for the\n * one that returns data.\n *\n * ★ MEASURED 2026-09-22 on Debian 13, systemd 257 (257.13-1~deb13u1), read-only — nothing was\n *   enabled, started or reloaded to write this:\n *\n *   - `systemctl show -p <list> <unit>` EXITS 0 FOR A UNIT THAT DOES NOT EXIST, and answers with\n *     the properties it would have had:\n *         Id=hf-nonexistent-xyz.service   LoadState=not-found\n *         ActiveState=inactive            SubState=dead\n *         FragmentPath=                   UnitFileState=\n *     ⛔ SO THE EXIT CODE IS NOT THE ANSWER — `LoadState` is. A provider that read exit 0 as \"the\n *       unit is there\" would adopt a unit that does not exist and then never write its file.\n *   - The properties come back in systemd's own order, not the order asked for, so the output is a\n *     map and never positional.\n *   - `systemctl is-enabled <unknown>` exits **4** and prints `not-found`; `is-active <unknown>`\n *     exits **4** and prints `inactive`. Both are answers, not errors.\n *   - `UnitFileState=static` is exactly systemd's name for a unit file with no `[Install]` section\n *     (measured: the journal daemon is `static`, the ssh daemon is `enabled`).\n *   - `/etc/systemd/system` is `root:root 0755` — the admin drop-in directory, ahead of the\n *     vendor's `/usr/lib/systemd/system` in systemd's own search order.\n * ⚠️ REASONED, NOT MEASURED: the write subcommands. `daemon-reload`, `enable`, `disable`, `start`,\n *   `stop` and `restart` were never run for this file, because running them would change a live\n *   host. Each is therefore checked the same way: exit 0 or an Error carrying systemd's stderr, and\n *   the state is read back with `show` afterwards rather than assumed.\n * ⛔ NEVER PUT `show` STDOUT WITH NO PROPERTY FILTER IN AN ERROR: the unfiltered property set\n *   carries the unit's whole environment block.\n */\nimport type { HostRunner } from '../launchd/runner.ts';\n\nexport const SYSTEMCTL = 'systemctl';\n\n/** The properties every read asks for. ⛔ Never `Environment` — see the header. */\nexport const SHOW_PROPERTIES = [\n  'Id',\n  'LoadState',\n  'ActiveState',\n  'SubState',\n  'UnitFileState',\n  'FragmentPath',\n  'NeedDaemonReload',\n] as const;\n\nexport class SystemctlError extends Error {\n  constructor(command: string, exitCode: number, stderr: string) {\n    super(`systemctl ${command} -> ${String(exitCode)}: ${stderr.trim().slice(0, 300)}`);\n    this.name = 'SystemctlError';\n  }\n}\n\nexport type UnitStatus = {\n  /** `loaded`, `not-found`, `masked`, `error`, `bad-setting`. ⛔ The authority on existence. */\n  readonly loadState: string;\n  /** systemd knows this unit: it has a unit file or is loaded. */\n  readonly known: boolean;\n  readonly activeState: string;\n  readonly subState?: string;\n  /** `enabled`, `disabled`, `static`, `masked`, … Empty for a unit with no unit file. */\n  readonly unitFileState?: string;\n  /** The unit file systemd would read. Empty when there is none. */\n  readonly fragmentPath?: string;\n  /** systemd's own view that its on-disk unit files are newer than what it has loaded. */\n  readonly needDaemonReload: boolean;\n};\n\n/** `key=value` lines into a map. ⚠️ First wins: systemd never repeats a key, a truncated read might. */\nexport const parseShow = (stdout: string): Map<string, string> => {\n  const fields = new Map<string, string>();\n  for (const line of stdout.split('\\n')) {\n    const at = line.indexOf('=');\n    if (at <= 0) continue;\n    const key = line.slice(0, at);\n    if (!fields.has(key)) fields.set(key, line.slice(at + 1));\n  }\n  return fields;\n};\n\nexport const statusOf = (stdout: string): UnitStatus => {\n  const fields = parseShow(stdout);\n  const loadState = fields.get('LoadState') ?? 'not-found';\n  const unitFileState = fields.get('UnitFileState') ?? '';\n  const fragmentPath = fields.get('FragmentPath') ?? '';\n  const subState = fields.get('SubState') ?? '';\n  return {\n    activeState: fields.get('ActiveState') ?? 'inactive',\n    // ⛔ MEASURED: `show` answers for a unit that does not exist, so \"known\" is LoadState plus\n    //   whether systemd found a unit file at all — never the exit code.\n    known: loadState !== 'not-found' || unitFileState !== '',\n    loadState,\n    needDaemonReload: fields.get('NeedDaemonReload') === 'yes',\n    ...(subState === '' ? {} : { subState }),\n    ...(unitFileState === '' ? {} : { unitFileState }),\n    ...(fragmentPath === '' ? {} : { fragmentPath }),\n  };\n};\n\nexport const showUnit = async (runner: HostRunner, name: string): Promise<UnitStatus> => {\n  const result = await runner.exec([\n    SYSTEMCTL,\n    'show',\n    '--no-pager',\n    '-p',\n    SHOW_PROPERTIES.join(','),\n    '--',\n    name,\n  ]);\n  // ⚠️ A non-zero `show` means systemctl itself failed (no bus, a malformed name) — not a missing\n  //   unit, which exits 0. Failing closed here is what keeps a broken connection from reading as\n  //   \"the unit is gone\", which would make the next deploy write its file and restart it.\n  if (result.exitCode !== 0)\n    throw new SystemctlError(`show ${name}`, result.exitCode, result.stderr);\n  return statusOf(result.stdout);\n};\n\n/** One write subcommand, checked. ⚠️ stderr only; `show` output never reaches an error. */\nconst run = async (runner: HostRunner, args: readonly string[]): Promise<void> => {\n  const result = await runner.exec([SYSTEMCTL, ...args]);\n  if (result.exitCode !== 0) {\n    throw new SystemctlError(args.join(' '), result.exitCode, result.stderr);\n  }\n};\n\n/** ⛔ After every unit-file write or removal, and before enable/start reads it. */\nexport const daemonReload = (runner: HostRunner): Promise<void> => run(runner, ['daemon-reload']);\n\nexport const enableUnit = (runner: HostRunner, name: string): Promise<void> =>\n  run(runner, ['enable', '--', name]);\n\nexport const disableUnit = (runner: HostRunner, name: string): Promise<void> =>\n  run(runner, ['disable', '--', name]);\n\nexport const startUnit = (runner: HostRunner, name: string): Promise<void> =>\n  run(runner, ['start', '--', name]);\n\nexport const stopUnit = (runner: HostRunner, name: string): Promise<void> =>\n  run(runner, ['stop', '--', name]);\n\n/**\n * ⛔ `restart`, NOT `reload-or-restart`. The reloading form asks the unit to re-read its config in\n *   place when it declares `ExecReload=`, which means \"did the change take effect?\" has two\n *   different answers depending on the unit — and a deploy cannot report a half-applied change.\n */\nexport const restartUnit = (runner: HostRunner, name: string): Promise<void> =>\n  run(runner, ['restart', '--', name]);\n",
-    "/**\n * Systemd.Unit / Systemd.Timer props, attributes, the unit-file renderer and the validation — the\n * pure half of the family.\n *\n * ⛔ THE DIRECTIVE SET IS SYSTEMD'S, NOT THIS FILE'S. There is no machine-readable schema of\n *   `systemd.unit(5)` / `systemd.service(5)` directives to generate from, so this renders SECTIONS\n *   AND LINES VERBATIM and claims to know nothing about what the keys mean. What it validates is\n *   only what an INI file must be true of — a section name, a key shape, no embedded newline —\n *   plus the two structural rules systemd's own output proves (see `unitProblems`). ★ That is the\n *   honest boundary: invent no vendor shapes, and let `systemd-analyze verify` be the deep check a\n *   host stack runs on the host.\n * ⛔ `content` IS NEVER A SECRET. Props sit unencrypted in Alchemy state and the unit file is\n *   world-readable at 0644; a unit that needs a secret takes `EnvironmentFile=` pointing at a file\n *   a secret renderer maintains.\n */\nimport { sha256Hex } from '../launchd/job-form.ts';\n\nexport type UnitSection = {\n  /** `Unit`, `Service`, `Timer`, `Install`, … — verbatim, including its capitalisation. */\n  readonly name: string;\n  /**\n   * The section's lines, in order. A repeated key is allowed and meaningful in systemd\n   * (`ExecStartPre=` twice runs twice), so this is a list of pairs, never an object.\n   */\n  readonly lines: readonly (readonly [key: string, value: string])[];\n};\n\nexport type SystemdUnitProps = {\n  /** Unit name WITH its suffix, e.g. `thing.service`. The unit file's name on disk. */\n  name: string;\n  /** The whole unit file, verbatim. Mutually exclusive with `sections`. */\n  content?: string;\n  /** The unit file as sections, rendered in the order given. Mutually exclusive with `content`. */\n  sections?: readonly UnitSection[];\n  /** Directory the unit file goes in. @default '/etc/systemd/system' */\n  directory?: string;\n  /** `systemctl enable` / `disable`. @default true */\n  enabled?: boolean;\n  /** `systemctl start` / `stop`. @default true */\n  started?: boolean;\n  /**\n   * Digests of things this unit READS that live outside its unit file — a rendered config file's\n   * `sha256` attribute, most often. A change here restarts the unit; nothing else does.\n   * ⚠️ A hand edit of that file is NOT noticed: the digest in state still matches what the stack\n   *   declared, so the unit reads converged. That limit is the same one the Mac side records.\n   */\n  restartOn?: readonly string[];\n};\n\nexport type SystemdUnitAttributes = {\n  name: string;\n  unitPath: string;\n  /** SHA-256 of the unit file this resource wrote. */\n  unitSha256: string;\n  /** SHA-256 of `restartOn`, so a config change is a diff. */\n  configSha256: string;\n  loadState: string;\n  activeState: string;\n  unitFileState?: string;\n  enabled: boolean;\n  active: boolean;\n};\n\n/** ★ systemd's admin drop-in directory, ahead of the vendor's in its search order (measured). */\nexport const DEFAULT_UNIT_DIRECTORY = '/etc/systemd/system';\n\n/**\n * Directories systemd looks in for a unit file it can enable.\n * ★ MEASURED 2026-09-22 with `systemd-analyze unit-paths` on Debian 13 / systemd 257, minus the\n *   per-user and generator directories, which are not places a stack writes. `/lib/systemd/system`\n *   is the same directory before the /usr merge, where the measured host has only the merged name.\n * ⛔ WHY IT IS ENFORCED. `systemctl enable <name>` looks the unit up BY NAME; a unit file outside\n *   these directories is invisible to that lookup, so an enabled unit declared into, say, `/opt`\n *   writes its file, reloads, and then fails at `enable` with the file already on disk.\n */\nexport const UNIT_SEARCH_DIRECTORIES = [\n  '/etc/systemd/system',\n  '/run/systemd/system',\n  '/usr/local/lib/systemd/system',\n  '/usr/lib/systemd/system',\n  '/lib/systemd/system',\n] as const;\n\n/** ⛔ The unit file's mode and owner are systemd's rule, not a choice: readable, never writable. */\nexport const UNIT_WRITE = { gid: 0, mode: 0o644, uid: 0 } as const;\n\nexport const digestOf = (text: string): string => sha256Hex(new TextEncoder().encode(text));\n\n/** The digests of everything outside the unit file that should restart it, as one value. */\nexport const configDigest = (restartOn: readonly string[] | undefined): string =>\n  digestOf((restartOn ?? []).join('\\n'));\n\n/**\n * Whether `activeState`/`subState` count as \"the unit is running\" against a declared `started` —\n * the ONE place this decision is made, so `diffUnit` (unit-lifecycle.ts) and `settle`\n * (unit-settle.ts) can never disagree about it.\n *\n * ⛔ WHY THIS EXISTS: a `Type=oneshot` service driven by a `.timer` (no `[Install]`, declared\n *   `started: false, enabled: false` — its timer starts it, not this resource) reports\n *   `ActiveState=activating` for the run's whole duration, not an instant. Written for the PVE\n *   node-check unit that first hit this: ~1.2s, every 60s. A plan taken mid-run must not read that\n *   run as drift, and a deploy must not `systemctl stop` a check that is already in flight.\n * ★ systemd.service(5) §`Type=`, `oneshot` (man7.org mirror, read 2026-09-23): with no\n *   `RemainAfterExit=`, the service manager holds the unit `activating` for as long as\n *   `ExecStart=` runs, then moves it straight to `dead`/`inactive` (or `failed`) — it never passes\n *   through `active`. So for `started: false`, `activating` is exactly a run in progress, and\n *   `active` is the one state a oneshot never reaches on its own: that is the drift, and the only\n *   thing settle stops.\n * ⛔ CRASH-LOOP GUARD, added on adversarial review: `ActiveState=activating` is not only \"starting\n *   for the first time\" — a service with `Restart=` waiting out its `RestartSec=` backoff between\n *   crash attempts is ALSO `activating`, with `SubState=auto-restart` (or `auto-restart-queued`).\n *   A unit declared `started: false` that is crash-looping sits there for nearly all of its\n *   wall-clock time. Without this guard the oneshot exemption above would read that loop as\n *   converged forever, and a deploy would never again issue the `stop` that ends it — silently\n *   defeating `started: false` on exactly the unit that most needs it enforced. So only a genuine\n *   start (`SubState` anything else — `start`, `start-pre`, `start-post`, …) gets the exemption;\n *   an auto-restart substate counts as running regardless of `started`, same as `active` does.\n * ★ SOURCE, not measured against a live host: systemd's own `service.c`\n *   `state_translation_table` (github.com/systemd/systemd, read 2026-09-23) maps both\n *   `SERVICE_AUTO_RESTART` and `SERVICE_AUTO_RESTART_QUEUED` to `UNIT_ACTIVATING`, and\n *   `unit-def.c`'s `service_state_table` names their `SubState` strings `\"auto-restart\"` and\n *   `\"auto-restart-queued\"`. ⚠️ REASONED NOT MEASURED: no unit was actually crash-looped and read\n *   back with `systemctl show` for this change — the systemd source is the citation, unlike\n *   systemctl.ts's own header, which is a live-host trace.\n * ⚠️ THE TRADE-OFF THIS ACCEPTS: a `Type=notify` (or other long-running type) unit stuck in a\n *   genuine `activating`/`start` with `started: false` — never reaching `active` and never\n *   crash-looping either — reads as converged, not drift, until it reaches `active`. A unit hung\n *   like that is exactly the case a human should look at, not one this predicate auto-corrects by\n *   stopping it out from under whatever else depends on it.\n * ★ `started: true` (the default, when omitted) is unchanged: `active` or `activating` (any\n *   `subState`) both count as running, so a start already in flight is never started twice.\n */\nexport const isUnitRunning = (\n  activeState: string,\n  subState: string | undefined,\n  started: boolean,\n): boolean => {\n  if (activeState === 'active') return true;\n  if (activeState !== 'activating') return false;\n  if (subState === 'auto-restart' || subState === 'auto-restart-queued') return true;\n  return started;\n};\n\n/** Sections → an INI unit file. ★ Keys and values pass through untouched; see the file header. */\nexport const renderUnit = (sections: readonly UnitSection[]): string =>\n  `${sections\n    .map((section) =>\n      [`[${section.name}]`, ...section.lines.map(([key, value]) => `${key}=${value}`)].join('\\n'),\n    )\n    .join('\\n\\n')}\\n`;\n\nexport const unitText = (props: SystemdUnitProps): string =>\n  props.content ?? renderUnit(props.sections ?? []);\n\nexport const unitPathFor = (props: SystemdUnitProps): string =>\n  `${props.directory ?? DEFAULT_UNIT_DIRECTORY}/${props.name}`;\n\nconst NAME = /^[A-Za-z0-9][A-Za-z0-9_.@:-]*\\.([a-z]+)$/;\n/** systemd's own unit types. ★ Fixed vocabulary from `systemd.unit(5)`, not a guess at directives. */\nconst TYPES = new Set([\n  'automount',\n  'device',\n  'mount',\n  'path',\n  'scope',\n  'service',\n  'slice',\n  'socket',\n  'swap',\n  'target',\n  'timer',\n]);\n\nconst INSTALL_KEYS = new Set(['WantedBy', 'RequiredBy', 'UpsertedBy', 'Also', 'Alias']);\n\n/**\n * Every refusal at once, so one plan shows the whole list.\n * ⛔ THE TWO STRUCTURAL RULES, both proven by systemd's own output rather than assumed:\n *   - `enabled: true` needs an `[Install]` section. `systemctl enable` has nothing to link without\n *     one, and systemd's name for a unit file that has none is `UnitFileState=static` — measured on\n *     a live host, where the journal daemon reads `static` and the ssh daemon reads `enabled`.\n *   - A `.timer` needs a `[Timer]` section, and a timer's `[Install]` is what arms it at boot.\n */\nexport const unitProblems = (props: SystemdUnitProps, expect?: string): string[] => {\n  const found: string[] = [];\n  const type = NAME.exec(props.name)?.[1];\n  if (type === undefined || !TYPES.has(type)) {\n    found.push(\n      `name must be <unit>.<type> with a systemd unit type, got ${JSON.stringify(props.name)}`,\n    );\n  } else if (expect !== undefined && type !== expect) {\n    found.push(`this resource declares a .${expect} unit; ${props.name} is a .${type}`);\n  }\n  if ((props.content === undefined) === (props.sections === undefined)) {\n    found.push('declare exactly one of content or sections');\n  }\n  const directory = props.directory ?? DEFAULT_UNIT_DIRECTORY;\n  if (!directory.startsWith('/') || directory.endsWith('/') || directory.includes('/..')) {\n    found.push('directory must be an absolute, normalised path with no trailing slash');\n  }\n  found.push(...textProblems(unitText(props)));\n  if (props.enabled !== false && !UNIT_SEARCH_DIRECTORIES.includes(directory as never)) {\n    found.push(\n      `an enabled unit must live where systemd looks for it by name (${UNIT_SEARCH_DIRECTORIES.join(', ')}); ` +\n        `${directory} is not one of them. Move it, or declare enabled: false.`,\n    );\n  }\n  if (props.enabled !== false && !hasInstall(props)) {\n    found.push(\n      'enabled units need an [Install] section with WantedBy/RequiredBy/Also/Alias; without one ' +\n        'systemd calls the unit \"static\" and `systemctl enable` has nothing to link. Add one, or ' +\n        'declare enabled: false and let something else pull it in.',\n    );\n  }\n  if (type === 'timer' && !unitText(props).includes('[Timer]')) {\n    found.push('a .timer needs a [Timer] section');\n  }\n  return found;\n};\n\nconst hasInstall = (props: SystemdUnitProps): boolean => {\n  const text = unitText(props);\n  if (!text.includes('[Install]')) return false;\n  const after = text.slice(text.indexOf('[Install]'));\n  return [...INSTALL_KEYS].some((key) => new RegExp(`^${key}=`, 'm').test(after));\n};\n\nconst textProblems = (text: string): string[] => {\n  const found: string[] = [];\n  if (text.trim() === '') found.push('the unit file is empty');\n  if (text.includes('\\u0000')) found.push('the unit file contains NUL');\n  if (!/^\\s*\\[[A-Za-z]+]/.test(text)) found.push('a unit file must begin with a [Section]');\n  return found;\n};\n",
+    "/**\n * Systemd.Unit / Systemd.Timer props, attributes, the unit-file renderer and the validation — the\n * pure half of the family.\n *\n * ⛔ THE DIRECTIVE SET IS SYSTEMD'S, NOT THIS FILE'S. There is no machine-readable schema of\n *   `systemd.unit(5)` / `systemd.service(5)` directives to generate from, so this renders SECTIONS\n *   AND LINES VERBATIM and claims to know nothing about what the keys mean. What it validates is\n *   only what an INI file must be true of — a section name, a key shape, no embedded newline —\n *   plus the two structural rules systemd's own output proves (see `unitProblems`). ★ That is the\n *   honest boundary: invent no vendor shapes, and let `systemd-analyze verify` be the deep check a\n *   host stack runs on the host.\n * ⛔ `content` IS NEVER A SECRET. Props sit unencrypted in Alchemy state and the unit file is\n *   world-readable at 0644; a unit that needs a secret takes `EnvironmentFile=` pointing at a file\n *   a secret renderer maintains.\n */\nimport { sha256Hex } from '../launchd/job-form.ts';\n\nexport type UnitSection = {\n  /** `Unit`, `Service`, `Timer`, `Install`, … — verbatim, including its capitalisation. */\n  readonly name: string;\n  /**\n   * The section's lines, in order. A repeated key is allowed and meaningful in systemd\n   * (`ExecStartPre=` twice runs twice), so this is a list of pairs, never an object.\n   */\n  readonly lines: readonly (readonly [key: string, value: string])[];\n};\n\nexport type SystemdUnitProps = {\n  /** Unit name WITH its suffix, e.g. `thing.service`. The unit file's name on disk. */\n  name: string;\n  /** The whole unit file, verbatim. Mutually exclusive with `sections`. */\n  content?: string;\n  /** The unit file as sections, rendered in the order given. Mutually exclusive with `content`. */\n  sections?: readonly UnitSection[];\n  /** Directory the unit file goes in. @default '/etc/systemd/system' */\n  directory?: string;\n  /** `systemctl enable` / `disable`. @default true */\n  enabled?: boolean;\n  /** `systemctl start` / `stop`. @default true */\n  started?: boolean;\n  /**\n   * Digests of things this unit READS that live outside its unit file — a rendered config file's\n   * `sha256` attribute, most often. A change here restarts the unit; nothing else does.\n   * ⚠️ A hand edit of that file is NOT noticed: the digest in state still matches what the stack\n   *   declared, so the unit reads converged. That limit is the same one the Mac side records.\n   */\n  restartOn?: readonly string[];\n};\n\nexport type SystemdUnitAttributes = {\n  name: string;\n  unitPath: string;\n  /** SHA-256 of the unit file this resource wrote. */\n  unitSha256: string;\n  /** SHA-256 of `restartOn`, so a config change is a diff. */\n  configSha256: string;\n  loadState: string;\n  activeState: string;\n  unitFileState?: string;\n  enabled: boolean;\n  active: boolean;\n};\n\n/** ★ systemd's admin drop-in directory, ahead of the vendor's in its search order (measured). */\nexport const DEFAULT_UNIT_DIRECTORY = '/etc/systemd/system';\n\n/**\n * Directories systemd looks in for a unit file it can enable.\n * ★ MEASURED 2026-09-22 with `systemd-analyze unit-paths` on Debian 13 / systemd 257, minus the\n *   per-user and generator directories, which are not places a stack writes. `/lib/systemd/system`\n *   is the same directory before the /usr merge, where the measured host has only the merged name.\n * ⛔ WHY IT IS ENFORCED. `systemctl enable <name>` looks the unit up BY NAME; a unit file outside\n *   these directories is invisible to that lookup, so an enabled unit declared into, say, `/opt`\n *   writes its file, reloads, and then fails at `enable` with the file already on disk.\n */\nexport const UNIT_SEARCH_DIRECTORIES = [\n  '/etc/systemd/system',\n  '/run/systemd/system',\n  '/usr/local/lib/systemd/system',\n  '/usr/lib/systemd/system',\n  '/lib/systemd/system',\n] as const;\n\n/** ⛔ The unit file's mode and owner are systemd's rule, not a choice: readable, never writable. */\nexport const UNIT_WRITE = { gid: 0, mode: 0o644, uid: 0 } as const;\n\nexport const digestOf = (text: string): string => sha256Hex(new TextEncoder().encode(text));\n\n/** The digests of everything outside the unit file that should restart it, as one value. */\nexport const configDigest = (restartOn: readonly string[] | undefined): string =>\n  digestOf((restartOn ?? []).join('\\n'));\n\n/**\n * Whether `activeState`/`subState` count as \"the unit is running\" against a declared `started` —\n * the ONE place this decision is made, so `diffUnit` (unit-lifecycle.ts) and `settle`\n * (unit-settle.ts) can never disagree about it.\n *\n * ⛔ WHY THIS EXISTS: a `Type=oneshot` service driven by a `.timer` (no `[Install]`, declared\n *   `started: false, enabled: false` — its timer starts it, not this resource) reports\n *   `ActiveState=activating` for the run's whole duration, not an instant. Written for the PVE\n *   node-check unit that first hit this: ~1.2s, every 60s. A plan taken mid-run must not read that\n *   run as drift, and a deploy must not `systemctl stop` a check that is already in flight.\n * ★ systemd.service(5) §`Type=`, `oneshot` (man7.org mirror, read 2026-09-23): with no\n *   `RemainAfterExit=`, the service manager holds the unit `activating` for as long as\n *   `ExecStart=` runs, then moves it straight to `dead`/`inactive` (or `failed`) — it never passes\n *   through `active`. So for `started: false`, `activating` is exactly a run in progress, and\n *   `active` is the one state a oneshot never reaches on its own: that is the drift, and the only\n *   thing settle stops.\n * ⛔ CRASH-LOOP GUARD, added on adversarial review: `ActiveState=activating` is not only \"starting\n *   for the first time\" — a service with `Restart=` waiting out its `RestartSec=` backoff between\n *   crash attempts is ALSO `activating`, with `SubState=auto-restart` (or `auto-restart-queued`).\n *   A unit declared `started: false` that is crash-looping sits there for nearly all of its\n *   wall-clock time. Without this guard the oneshot exemption above would read that loop as\n *   converged forever, and a deploy would never again issue the `stop` that ends it — silently\n *   defeating `started: false` on exactly the unit that most needs it enforced. So only a genuine\n *   start (`SubState` anything else — `start`, `start-pre`, `start-post`, …) gets the exemption;\n *   an auto-restart substate counts as running regardless of `started`, same as `active` does.\n * ★ SOURCE, not measured against a live host: systemd's own `service.c`\n *   `state_translation_table` (github.com/systemd/systemd, read 2026-09-23) maps both\n *   `SERVICE_AUTO_RESTART` and `SERVICE_AUTO_RESTART_QUEUED` to `UNIT_ACTIVATING`, and\n *   `unit-def.c`'s `service_state_table` names their `SubState` strings `\"auto-restart\"` and\n *   `\"auto-restart-queued\"`. ⚠️ REASONED NOT MEASURED: no unit was actually crash-looped and read\n *   back with `systemctl show` for this change — the systemd source is the citation, unlike\n *   systemctl.ts's own header, which is a live-host trace.\n * ⚠️ THE TRADE-OFF THIS ACCEPTS: a `Type=notify` (or other long-running type) unit stuck in a\n *   genuine `activating`/`start` with `started: false` — never reaching `active` and never\n *   crash-looping either — reads as converged, not drift, until it reaches `active`. A unit hung\n *   like that is exactly the case a human should look at, not one this predicate auto-corrects by\n *   stopping it out from under whatever else depends on it.\n * ★ `started: true` (the default, when omitted) is unchanged: `active` or `activating` (any\n *   `subState`) both count as running, so a start already in flight is never started twice.\n */\nexport const isUnitRunning = (\n  activeState: string,\n  subState: string | undefined,\n  started: boolean,\n): boolean => {\n  if (activeState === 'active') return true;\n  if (activeState !== 'activating') return false;\n  if (subState === 'auto-restart' || subState === 'auto-restart-queued') return true;\n  return started;\n};\n\n/** Sections → an INI unit file. ★ Keys and values pass through untouched; see the file header. */\nexport const renderUnit = (sections: readonly UnitSection[]): string =>\n  `${sections\n    .map((section) =>\n      [`[${section.name}]`, ...section.lines.map(([key, value]) => `${key}=${value}`)].join('\\n'),\n    )\n    .join('\\n\\n')}\\n`;\n\nexport const unitText = (props: SystemdUnitProps): string =>\n  props.content ?? renderUnit(props.sections ?? []);\n\nexport const unitPathFor = (props: SystemdUnitProps): string =>\n  `${props.directory ?? DEFAULT_UNIT_DIRECTORY}/${props.name}`;\n\n/** ★ Exported so sudo-allowlist.ts validates a systemctl unit operand against the same pattern. */\nexport const NAME = /^[A-Za-z0-9][A-Za-z0-9_.@:-]*\\.([a-z]+)$/;\n/** systemd's own unit types. ★ Fixed vocabulary from `systemd.unit(5)`, not a guess at directives. */\nconst TYPES = new Set([\n  'automount',\n  'device',\n  'mount',\n  'path',\n  'scope',\n  'service',\n  'slice',\n  'socket',\n  'swap',\n  'target',\n  'timer',\n]);\n\nconst INSTALL_KEYS = new Set(['WantedBy', 'RequiredBy', 'UpsertedBy', 'Also', 'Alias']);\n\n/**\n * Every refusal at once, so one plan shows the whole list.\n * ⛔ THE TWO STRUCTURAL RULES, both proven by systemd's own output rather than assumed:\n *   - `enabled: true` needs an `[Install]` section. `systemctl enable` has nothing to link without\n *     one, and systemd's name for a unit file that has none is `UnitFileState=static` — measured on\n *     a live host, where the journal daemon reads `static` and the ssh daemon reads `enabled`.\n *   - A `.timer` needs a `[Timer]` section, and a timer's `[Install]` is what arms it at boot.\n */\nexport const unitProblems = (props: SystemdUnitProps, expect?: string): string[] => {\n  const found: string[] = [];\n  const type = NAME.exec(props.name)?.[1];\n  if (type === undefined || !TYPES.has(type)) {\n    found.push(\n      `name must be <unit>.<type> with a systemd unit type, got ${JSON.stringify(props.name)}`,\n    );\n  } else if (expect !== undefined && type !== expect) {\n    found.push(`this resource declares a .${expect} unit; ${props.name} is a .${type}`);\n  }\n  if ((props.content === undefined) === (props.sections === undefined)) {\n    found.push('declare exactly one of content or sections');\n  }\n  const directory = props.directory ?? DEFAULT_UNIT_DIRECTORY;\n  if (!directory.startsWith('/') || directory.endsWith('/') || directory.includes('/..')) {\n    found.push('directory must be an absolute, normalised path with no trailing slash');\n  }\n  found.push(...textProblems(unitText(props)));\n  if (props.enabled !== false && !UNIT_SEARCH_DIRECTORIES.includes(directory as never)) {\n    found.push(\n      `an enabled unit must live where systemd looks for it by name (${UNIT_SEARCH_DIRECTORIES.join(', ')}); ` +\n        `${directory} is not one of them. Move it, or declare enabled: false.`,\n    );\n  }\n  if (props.enabled !== false && !hasInstall(props)) {\n    found.push(\n      'enabled units need an [Install] section with WantedBy/RequiredBy/Also/Alias; without one ' +\n        'systemd calls the unit \"static\" and `systemctl enable` has nothing to link. Add one, or ' +\n        'declare enabled: false and let something else pull it in.',\n    );\n  }\n  if (type === 'timer' && !unitText(props).includes('[Timer]')) {\n    found.push('a .timer needs a [Timer] section');\n  }\n  return found;\n};\n\nconst hasInstall = (props: SystemdUnitProps): boolean => {\n  const text = unitText(props);\n  if (!text.includes('[Install]')) return false;\n  const after = text.slice(text.indexOf('[Install]'));\n  return [...INSTALL_KEYS].some((key) => new RegExp(`^${key}=`, 'm').test(after));\n};\n\nconst textProblems = (text: string): string[] => {\n  const found: string[] = [];\n  if (text.trim() === '') found.push('the unit file is empty');\n  if (text.includes('\\u0000')) found.push('the unit file contains NUL');\n  if (!/^\\s*\\[[A-Za-z]+]/.test(text)) found.push('a unit file must begin with a [Section]');\n  return found;\n};\n",
     "/**\n * The step that decides whether anything on the host actually moves: enablement, running state and\n * — only for a real change — a restart. Split from unit-lifecycle.ts because it is the rule the\n * whole family exists to keep, and it should be readable on its own.\n *\n * ⛔ THE RESTART CONDITION IS THE WHOLE CONTRACT. `changed` is set by the caller from the four\n *   things that earn one (unit-lifecycle.ts reconcileUnit); `configChanged` is a digest the\n *   DECLARATION itself listed. Nothing else restarts a unit — not a re-run, not an unrelated\n *   resource in the same deploy, not `--adopt`.\n */\nimport type { HostRunner } from '../launchd/runner.ts';\nimport {\n  type SystemdUnitAttributes,\n  type SystemdUnitProps,\n  configDigest,\n  isUnitRunning,\n  unitPathFor,\n} from './unit-form.ts';\nimport {\n  type UnitStatus,\n  daemonReload,\n  disableUnit,\n  enableUnit,\n  restartUnit,\n  showUnit,\n  startUnit,\n  stopUnit,\n} from './systemctl.ts';\n\nexport const refuse = (name: string, message: string): Error =>\n  new Error(`Systemd.Unit ${name}: ${message}`);\n\nexport const attributesOf = (\n  props: SystemdUnitProps,\n  unitSha256: string,\n  status: UnitStatus,\n): SystemdUnitAttributes => ({\n  active: status.activeState === 'active' || status.activeState === 'activating',\n  activeState: status.activeState,\n  configSha256: configDigest(props.restartOn),\n  enabled: status.unitFileState === 'enabled' || status.unitFileState === 'enabled-runtime',\n  loadState: status.loadState,\n  name: props.name,\n  unitPath: unitPathFor(props),\n  unitSha256,\n  ...(status.unitFileState === undefined ? {} : { unitFileState: status.unitFileState }),\n});\n\nexport type Settle = {\n  readonly before: Uint8Array | undefined;\n  /** The unit file or systemd's view of it changed in a way that earns a restart. */\n  readonly changed: boolean;\n  readonly configChanged: boolean;\n  readonly desired: string;\n  readonly path: string;\n  readonly status: UnitStatus;\n};\n\n/**\n * Bring enablement and running state to the declaration, restarting ONLY for a real change.\n * ⛔ THE RESTART CONDITION IS THE WHOLE CONTRACT: the unit file changed, or a digest the caller\n *   listed changed. Nothing else — not a re-run, not an unrelated resource, not `--adopt`.\n */\nexport const settle = async (\n  runner: HostRunner,\n  props: SystemdUnitProps,\n  step: Settle,\n): Promise<SystemdUnitAttributes> => {\n  const wantEnabled = props.enabled !== false;\n  const wantStarted = props.started !== false;\n  const isEnabled =\n    step.status.unitFileState === 'enabled' || step.status.unitFileState === 'enabled-runtime';\n  const undo = async (detail: string): Promise<never> => {\n    // ⚠️ A create that never came up leaves nothing behind; an update keeps the new file and the\n    //   old stored digest, so the next deploy retries.\n    if (step.before === undefined) {\n      await runner.removeFile(step.path).catch(() => undefined);\n      await daemonReload(runner).catch(() => undefined);\n    }\n    throw refuse(props.name, `${detail} The unit is NOT running.`);\n  };\n  try {\n    if (wantEnabled && (!isEnabled || step.changed)) await enableUnit(runner, props.name);\n    if (!wantEnabled && isEnabled) await disableUnit(runner, props.name);\n    // ★ isUnitRunning (unit-form.ts): the same started-aware policy diffUnit uses, so a unit this\n    //   deploy never touches — a `started: false` oneshot mid-run — is never stopped here either.\n    //   `subState` is what tells that mid-run apart from a crash-restart backoff, which still stops.\n    const running = isUnitRunning(step.status.activeState, step.status.subState, wantStarted);\n    if (!wantStarted) {\n      if (running) await stopUnit(runner, props.name);\n    } else if (!running) await startUnit(runner, props.name);\n    else if (step.changed || step.configChanged) await restartUnit(runner, props.name);\n  } catch (cause) {\n    return undo(cause instanceof Error ? cause.message : String(cause));\n  }\n  /**\n   * ⚠️ READ BACK, never echo the declaration. Returning `enabled: wantEnabled` because we called\n   *   `enable` would put a CLAIM in state instead of a reading, and the next plan would compare\n   *   the declaration against itself — so a link systemd did not actually make would never show up\n   *   as drift, in either direction.\n   */\n  const after = await showUnit(runner, props.name);\n  if (wantStarted && !isUnitRunning(after.activeState, after.subState, wantStarted)) {\n    return undo(`systemctl reported success but the unit is ${after.activeState}.`);\n  }\n  const settled = attributesOf(props, step.desired, after);\n  if (wantEnabled && !settled.enabled) {\n    return undo(\n      `systemctl enable reported success but systemd calls the unit ` +\n        `${JSON.stringify(after.unitFileState ?? '')}, not enabled.`,\n    );\n  }\n  return settled;\n};\n",
     "/**\n * Everything Systemd.Unit checks before it touches the host — split from unit-lifecycle.ts so that\n * a reconcile and a plan-time REPLACE run the very same checks.\n *\n * ★ WHY A REPLACE IS CHECKED AT PLAN TIME. A name or directory change is a delete-first replace,\n *   and Alchemy runs `delete` on the old unit BEFORE `reconcile` on the new one (Apply.ts,\n *   deleteOldGenerations under `node.deleteFirst`). A refusal that fired only in reconcile would\n *   therefore arrive after the old unit was already stopped and its file removed: nothing running,\n *   and a plan that had promised a clean swap.\n * ★ EVERY CHECK HERE IS READ-ONLY. systemd has no `print-disabled` equivalent in this family —\n *   masking is `systemctl show`'s LoadState / UnitFileState, which `showUnit` already returns.\n *   Validation, that show, a file read and `HostRunner.checkWrite` write nothing. `systemctl\n *   enable` itself stays an apply step; the ways it is known to fail (no `[Install]`, a directory\n *   systemd does not search) are `unitProblems`, checked here before the plan may promise a swap.\n */\nimport { type HostRunner, canActAsRoot } from '../launchd/runner.ts';\nimport { type UnitStatus, showUnit } from './systemctl.ts';\nimport {\n  type SystemdUnitAttributes,\n  type SystemdUnitProps,\n  UNIT_WRITE,\n  digestOf,\n  unitPathFor,\n  unitProblems,\n  unitText,\n} from './unit-form.ts';\nimport { refuse } from './unit-settle.ts';\n\nconst decoder = new TextDecoder();\n\n/** Throw every refusal at once, so one plan shows the whole list. */\nexport const assertValid = (props: SystemdUnitProps, expect?: string): void => {\n  const found = unitProblems(props, expect);\n  if (found.length > 0) throw refuse(props.name, found.join('; '));\n};\n\n/** ⛔ Writing a unit file and driving systemd are root's, so refuse up front rather than mid-apply. */\nexport const assertMayWrite = (runner: HostRunner, name: string): void => {\n  if (canActAsRoot(runner)) return;\n  throw refuse(\n    name,\n    'a systemd unit is root-owned and systemctl needs root. Point the runner at a destination ' +\n      'whose ssh user is root, or provide a privileged HostRunner. This provider never calls sudo.',\n  );\n};\n\n/**\n * ⛔ A MASKED UNIT IS SOMEONE'S DECISION, NOT DRIFT. `systemctl mask` survives reboots and makes\n *   start fail; unmasking here would silently overrule whoever masked it.\n */\nexport const assertUsable = (props: Pick<SystemdUnitProps, 'name'>, status: UnitStatus): void => {\n  if (status.loadState === 'masked' || status.unitFileState === 'masked') {\n    throw refuse(\n      props.name,\n      'is masked. If that is stale, `systemctl unmask` it deliberately, then redeploy. Nothing ' +\n        'was written.',\n    );\n  }\n};\n\n/**\n * ⛔ A UNIT THIS RESOURCE DOES NOT OWN IS NEVER OVERWRITTEN. Alchemy's adoption probe guards a\n *   create, but NOT the new name of a replace — the engine reads nothing there — so a rename onto\n *   a unit file someone else already has would stop the old unit and write ours over theirs.\n * ★ A file byte-identical to our render is exempt: it is this declaration's own leftover (a deploy\n *   that died between write and reload), and rewriting it changes nothing.\n */\nexport const assertUnclaimed = async (\n  runner: HostRunner,\n  props: SystemdUnitProps,\n): Promise<void> => {\n  const path = unitPathFor(props);\n  const bytes = await runner.readFile(path);\n  const live = bytes === undefined ? undefined : digestOf(decoder.decode(bytes));\n  if (live !== undefined && live !== digestOf(unitText(props))) {\n    throw refuse(\n      props.name,\n      `${path} is already on this host and is not this resource. Remove it, or declare it as a ` +\n        'new resource and deploy with --adopt.',\n    );\n  }\n};\n\n/**\n * The half of a rename check that needs only the NEW NAME: the old unit deletable, the new one\n * writable and not masked.\n * ★ ON ITS OWN it is for the rename unit-handlers.ts `diffHandler` spots while `content` is still\n *   an Output. That plan is a delete-first replace too, so a masked target refused only in\n *   reconcile would again arrive after the old unit was stopped. The unit file itself cannot be\n *   compared until `content` resolves, so `assertUnclaimed` stays reconcile's job there.\n */\nexport const assertRenameTarget = async (\n  runner: HostRunner,\n  old: SystemdUnitAttributes,\n  name: string,\n): Promise<void> => {\n  assertMayWrite(runner, old.name);\n  assertMayWrite(runner, name);\n  assertUsable({ name }, await showUnit(runner, name));\n};\n\n/**\n * A rename, checked at plan time: the new identity must be valid, writable, not masked and free,\n * and the old one deletable — before the plan may promise a delete-first replace.\n */\nexport const assertReplaceable = async (\n  runner: HostRunner,\n  next: SystemdUnitProps,\n  old: SystemdUnitAttributes,\n  expect?: string,\n): Promise<void> => {\n  assertValid(next, expect);\n  await assertRenameTarget(runner, old, next.name);\n  await assertUnclaimed(runner, next);\n  await runner.checkWrite?.(unitPathFor(next), UNIT_WRITE);\n};\n",
     "/**\n * Systemd.Unit's read / diff / reconcile / delete as plain async functions over a HostRunner, so\n * the whole lifecycle runs against a fake host with no real systemd.\n *\n * ⛔ WHAT A DEPLOY DOES NOT DO — the rule this family was built around. It NEVER mass-restarts.\n *   A unit is restarted only when THIS resource's unit file changed, or when a digest the\n *   declaration itself listed in `restartOn` changed. A unit that is already running the content\n *   we declare is left strictly alone: no restart, no reload, not even a `start`. An estate rebuild\n *   must be able to reach a host that holds a vault, a UPS handler or a clock without bouncing\n *   them, and \"the deploy ran\" must never be a reason anything went down.\n * ★ THE ORDER IS WRITE, RELOAD, ENABLE, THEN START OR RESTART. systemd reads the unit file at\n *   `daemon-reload`, so writing it while the old unit runs changes nothing yet, and a write that\n *   fails leaves the old unit running rather than leaving nothing running.\n * ⚠️ A FAILED START LEAVES THE UNIT DOWN. On an update the new unit file stays and state keeps the\n *   previous digest, so the next deploy retries. On a CREATE the file this deploy wrote is removed\n *   and systemd reloaded again: left behind, the next plan's recovery read finds a unit with no\n *   state, reports it `Unowned`, and every later deploy demands `--adopt` for our own file.\n * ⛔ A MASKED UNIT IS SOMEONE'S DECISION, NOT DRIFT. `systemctl mask` survives reboots and makes\n *   start fail; unmasking here would silently overrule whoever masked it.\n */\nimport type { Diff } from 'alchemy/Diff';\nimport type { HostRunner } from '../launchd/runner.ts';\nimport { daemonReload, disableUnit, showUnit, stopUnit } from './systemctl.ts';\nimport {\n  type SystemdUnitAttributes,\n  type SystemdUnitProps,\n  UNIT_WRITE,\n  configDigest,\n  digestOf,\n  isUnitRunning,\n  unitPathFor,\n  unitText,\n} from './unit-form.ts';\nimport { assertMayWrite, assertReplaceable, assertUsable, assertValid } from './unit-preflight.ts';\nimport { attributesOf, refuse, settle } from './unit-settle.ts';\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\n/** What is on the host now: the unit file's digest and systemd's view. `undefined` when neither. */\nexport const readUnit = async (\n  runner: HostRunner,\n  props: SystemdUnitProps,\n): Promise<SystemdUnitAttributes | undefined> => {\n  const bytes = await runner.readFile(unitPathFor(props));\n  const status = await showUnit(runner, props.name);\n  if (bytes === undefined && !status.known) return undefined;\n  return attributesOf(props, bytes === undefined ? '' : digestOf(decoder.decode(bytes)), status);\n};\n\nexport const diffUnit = async (\n  runner: HostRunner,\n  news: SystemdUnitProps,\n  output: SystemdUnitAttributes,\n  expect?: string,\n): Promise<Diff> => {\n  assertValid(news, expect);\n  // ★ The unit's name or its directory is its identity on the host: a change is a replace, and\n  //   delete-first, because two unit files for one name cannot both be the one systemd reads.\n  // ⛔ Which is why everything the new unit's reconcile would refuse is refused HERE, at plan\n  //   time (unit-preflight.ts): after the delete it would be too late.\n  if (news.name !== output.name || unitPathFor(news) !== output.unitPath) {\n    await assertReplaceable(runner, news, output, expect);\n    return { action: 'replace', deleteFirst: true };\n  }\n  const desired = digestOf(unitText(news));\n  const update = async (): Promise<Diff> => {\n    assertMayWrite(runner, news.name);\n    await runner.checkWrite?.(unitPathFor(news), UNIT_WRITE);\n    return { action: 'update' };\n  };\n  // ⛔ BOTH digests: the stored one catches a start that failed after the write landed, the live\n  //   one catches a hand edit. Either alone reports `noop` over a unit that is not what we say.\n  if (desired !== output.unitSha256) return update();\n  if (configDigest(news.restartOn) !== output.configSha256) return update();\n  const live = await readUnit(runner, news);\n  if (live === undefined || live.unitSha256 !== desired) return update();\n  if (live.enabled !== (news.enabled !== false)) return update();\n  // ⚠️ systemd's own word for \"the file on disk is newer than what I loaded\" — a write that landed\n  //   without its reload. It is drift that neither digest can see. ★ Also the freshest read of\n  //   ActiveState/SubState — not `live.active`, which is a raw \"active or activating\" reading with\n  //   no SubState in it. Whether the current state counts as drift against `started` is the\n  //   isUnitRunning policy (unit-form.ts), shared with settle so the two can never disagree.\n  const status = await showUnit(runner, news.name);\n  const wantStarted = news.started !== false;\n  if (isUnitRunning(status.activeState, status.subState, wantStarted) !== wantStarted) {\n    return update();\n  }\n  return status.needDaemonReload ? update() : { action: 'noop' };\n};\n\n/**\n * `adopt` is whether adoption is on AND this apply is a create or an unfinished generation of our\n * own (ownership/adopt.ts): it lets such a generation take over a unit already on the host.\n * ★ AN ADOPTED UNIT THAT ALREADY MATCHES IS NOT RESTARTED. That is the whole point of adopting one:\n *   the estate's live services come under declaration without a single bounce.\n */\nexport const reconcileUnit = async (\n  runner: HostRunner,\n  props: SystemdUnitProps,\n  output: SystemdUnitAttributes | undefined,\n  adopt = false,\n  expect?: string,\n): Promise<SystemdUnitAttributes> => {\n  assertValid(props, expect);\n  assertMayWrite(runner, props.name);\n  const path = unitPathFor(props);\n  const status = await showUnit(runner, props.name);\n  assertUsable(props, status);\n  const text = unitText(props);\n  const desired = digestOf(text);\n  const before = await runner.readFile(path);\n  const liveSha = before === undefined ? undefined : digestOf(decoder.decode(before));\n  const moved = output !== undefined && (output.name !== props.name || output.unitPath !== path);\n  /**\n   * ★ A rename the diff could not see — a name that was still an unresolved Output at plan time\n   *   (unit-handlers.ts diffHandler) — arrives here as an update. Run the same read-only checks a\n   *   plan-time replace runs, BEFORE deleteUnit, or the old unit is already gone when we refuse.\n   */\n  if (moved && output !== undefined) await assertReplaceable(runner, props, output, expect);\n  const prior = moved ? undefined : output;\n  /**\n   * ⛔ A UNIT THIS RESOURCE DOES NOT OWN IS NEVER OVERWRITTEN. Where the engine's probe never\n   *   looked — a replace's new name, a create whose props were still an Output at plan time — a\n   *   unit file already there with other content belongs to someone else, and writing ours over it\n   *   would take their service. ★ A byte-identical file is this declaration's own leftover.\n   */\n  if (\n    prior === undefined &&\n    !(adopt && output === undefined) &&\n    liveSha !== undefined &&\n    liveSha !== desired\n  ) {\n    throw refuse(\n      props.name,\n      `${path} is already on this host and is not this resource. Remove it, or declare it as a ` +\n        'new resource and deploy with --adopt.',\n    );\n  }\n  if (moved && output !== undefined) await deleteUnit(runner, output);\n  const wrote = liveSha !== desired;\n  /**\n   * ⛔ THE THREE THINGS THAT EARN A RESTART, and nothing else:\n   *   - the unit file's bytes changed (`wrote`);\n   *   - state holds an older digest than the file does — a previous deploy's write landed and its\n   *     reload or restart never ran, so systemd is still running the old content;\n   *   - systemd itself says its loaded unit is older than the file (`NeedDaemonReload`, measured);\n   *   - a digest the declaration listed in `restartOn` changed.\n   * ★ An adopted, converged unit hits none of them, which is why adoption never bounces a service.\n   */\n  const stale = prior !== undefined && prior.unitSha256 !== desired;\n  const configChanged = prior !== undefined && prior.configSha256 !== configDigest(props.restartOn);\n  if (wrote) await runner.writeFileAtomic(path, encoder.encode(text), UNIT_WRITE);\n  if (wrote || status.needDaemonReload) await daemonReload(runner);\n  const changed = wrote || stale || status.needDaemonReload;\n  return settle(runner, props, { before, changed, configChanged, desired, path, status });\n};\n\n/**\n * Stop, disable, remove the unit file, reload. Idempotent.\n * ⛔ DELETING THE DECLARATION STOPS THE SERVICE. That is what removing it from the stack means, and\n *   it is why a unit that must outlive its declaration is adopted rather than deleted.\n */\nexport const deleteUnit = async (\n  runner: HostRunner,\n  output: SystemdUnitAttributes,\n): Promise<void> => {\n  assertMayWrite(runner, output.name);\n  const status = await showUnit(runner, output.name);\n  if (status.activeState === 'active' || status.activeState === 'activating') {\n    await stopUnit(runner, output.name);\n  }\n  if (status.unitFileState === 'enabled' || status.unitFileState === 'enabled-runtime') {\n    await disableUnit(runner, output.name);\n  }\n  const stat = await runner.stat(output.unitPath);\n  if (stat !== undefined) {\n    if (stat.kind !== 'file') throw refuse(output.name, `${output.unitPath} is a ${stat.kind}`);\n    await runner.removeFile(output.unitPath);\n  }\n  await daemonReload(runner);\n};\n",
     "/**\n * `sshRunner()` — the estate's Linux hosts behind the SAME HostRunner seam the launchd family\n * already drives a Mac through (launchd/runner.ts). Every provider in this directory reaches its\n * host only through it, so the whole Linux lifecycle runs against a fake in tests.\n *\n * ★ WHY THE SAME SEAM AND NOT A SECOND ONE. HostRunner is nine promise-returning methods with no\n *   macOS in them; what was Mac-specific was launchctl and the plist, not the seam. Reusing it\n *   means HostFile, the ownership rules and `checkWrite` already work on Linux, and a stack can\n *   hand the same runner to a file, a directory and a unit.\n * ⛔ NO PASSWORDS AND NO SILENT SUDO. Every connection is `BatchMode=yes` (ssh-command.ts), and\n *   `privileged` is false: this runner never calls sudo. A root-owned path therefore needs a\n *   destination whose ssh user IS root — which is how the estate already reaches its hypervisors —\n *   or a privileged runner of the caller's own. See docs/linux-host.md; the Linux twin of\n *   sudoRunner is deliberately a later, separate change with its own allowlist.\n * ⛔ FAIL CLOSED. A connection that drops, a host key that changed, a shell that cannot parse the\n *   script: none of them produces a \"not found\". Without the framing marker the result is an\n *   Error, never data (ssh-command.ts parseFramed).\n * ★ EXERCISED READ-ONLY AGAINST A LIVE HOST, 2026-09-22 (Debian 13, systemd 257, ssh user uid\n *   1001): `stat` of a file, of a missing path and of a symlink (reported `symlink`, so the lstat\n *   contract holds over the wire); `readFile` of a file and of a missing path; `getent` user and\n *   group; a failing `exec`; and an argument of `a b '$HOME` + backtick + ` ;rm` arriving verbatim,\n *   which is the quoting proven rather than argued. Nothing was written.\n * ⚠️ ONE CONNECTION PER CALL. No multiplexing is configured here: a deploy over a slow link pays a\n *   handshake per read. Pass `sshArgs: ['-o', 'ControlMaster=auto', …]` to opt into your own\n *   ControlPersist socket — the kit does not create one behind your back, because a stale socket\n *   outliving the deploy is a surprise nobody declared.\n */\nimport { spawn } from 'node:child_process';\nimport { randomBytes } from 'node:crypto';\nimport { groupQuery, parseGroup, parseUser, userQuery } from '../launchd/host-lookup.ts';\nimport type { ExecResult, HostRunner } from '../launchd/runner.ts';\nimport { ABSENT, frameScript, parseFramed, sshArgv } from './ssh-command.ts';\nimport {\n  execScript,\n  parseStat,\n  readScript,\n  removeScript,\n  statScript,\n  writeScript,\n} from './ssh-scripts.ts';\n\nexport type SshRunnerOptions = {\n  /** The destination exactly as the operator's own ssh config names it (`Host` block or user@host). */\n  readonly host: string;\n  /** Extra ssh options, after the fixed safety set and before the destination. */\n  readonly sshArgs?: readonly string[];\n  /** Kill a connection after this long. @default 120_000 */\n  readonly execTimeoutMs?: number;\n  /** ssh's own `ConnectTimeout`. @default 10 */\n  readonly connectTimeoutSec?: number;\n};\n\ntype Raw = { exitCode: number; stdout: string; stderr: string; signal: string | null };\n\nconst spawnSsh = (argv: readonly string[], timeoutMs: number, stdin?: Uint8Array): Promise<Raw> =>\n  new Promise((resolve, reject) => {\n    const [program, ...args] = argv as [string, ...string[]];\n    const child = spawn(program, args, {\n      shell: false,\n      stdio: [stdin === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe'],\n      timeout: timeoutMs,\n    });\n    const out: Buffer[] = [];\n    const err: Buffer[] = [];\n    child.stdout?.on('data', (chunk: Buffer) => out.push(chunk));\n    child.stderr?.on('data', (chunk: Buffer) => err.push(chunk));\n    child.on('error', (cause) => {\n      reject(new Error(`ssh: ${cause.message}`));\n    });\n    if (stdin !== undefined && child.stdin !== null) {\n      // ⚠️ EPIPE is normal here: the remote `cat` can die before we finish writing, and the real\n      //   failure is the exit code we are about to read — not a crash in this process.\n      child.stdin.on('error', () => undefined);\n      child.stdin.end(stdin);\n    }\n    child.on('close', (exitCode, signal) => {\n      resolve({\n        exitCode: exitCode ?? -1,\n        signal,\n        stderr: Buffer.concat(err).toString('utf8'),\n        stdout: Buffer.concat(out).toString('utf8'),\n      });\n    });\n  });\n\n/** What the process on the far end did — or an Error, when we cannot say that it ran at all. */\nexport const runRemote = async (\n  options: Required<Pick<SshRunnerOptions, 'host' | 'connectTimeoutSec' | 'execTimeoutMs'>> &\n    Pick<SshRunnerOptions, 'sshArgs'>,\n  nonce: string,\n  script: string,\n  stdin?: Uint8Array,\n): Promise<ExecResult> => {\n  const argv = sshArgv(options.host, frameScript(script, nonce), {\n    connectTimeoutSec: options.connectTimeoutSec,\n    ...(options.sshArgs === undefined ? {} : { sshArgs: options.sshArgs }),\n  });\n  const raw = await spawnSsh(argv, options.execTimeoutMs, stdin);\n  const framed = parseFramed(raw.stderr, nonce);\n  if (framed === undefined) {\n    // ⛔ The command may or may not have run. Saying \"absent\" here is how a dropped link becomes a\n    //   deleted config, so it is an error with ssh's own words (truncated, never the stdout).\n    throw new Error(\n      `ssh ${options.host}: the remote command did not report a status (ssh exit ` +\n        `${String(raw.exitCode)}${raw.signal === null ? '' : `, killed by ${raw.signal}`}): ` +\n        `${raw.stderr.trim().slice(0, 300)}`,\n    );\n  }\n  return { exitCode: framed.exitCode, stderr: framed.stderr, stdout: raw.stdout };\n};\n\nconst decodeBase64 = (text: string): Uint8Array =>\n  new Uint8Array(Buffer.from(text.replaceAll('\\n', ''), 'base64'));\n\nconst failed = (host: string, what: string, result: ExecResult): Error =>\n  new Error(\n    `ssh ${host}: ${what} -> ${String(result.exitCode)}: ${result.stderr.trim().slice(0, 300)}`,\n  );\n\n/**\n * Connect once to learn who we are, then hand back the runner.\n * ⛔ THE PROBE IS THE FAIL-CLOSED GATE. `effectiveUid()` is synchronous on HostRunner, so the uid\n *   must be known before the first provider call; and `uname -s` refuses a host whose `stat -c`,\n *   `base64` and `mv -f` are not the Linux spellings this runner sends. A host that cannot answer\n *   both is a thrown Error at construction, not a stack that half-deploys.\n */\nexport const sshRunner = async (options: SshRunnerOptions): Promise<HostRunner> => {\n  const settings = {\n    connectTimeoutSec: options.connectTimeoutSec ?? 10,\n    execTimeoutMs: options.execTimeoutMs ?? 120_000,\n    host: options.host,\n    ...(options.sshArgs === undefined ? {} : { sshArgs: options.sshArgs }),\n  };\n  const nonce = randomBytes(8).toString('hex');\n  const run = (script: string, stdin?: Uint8Array) => runRemote(settings, nonce, script, stdin);\n  const probe = await run('uname -s; id -u');\n  if (probe.exitCode !== 0) throw failed(options.host, 'uname -s; id -u', probe);\n  const [system, uid] = probe.stdout.trim().split('\\n');\n  if (system !== 'Linux' || uid === undefined || !/^\\d+$/.test(uid)) {\n    throw new Error(\n      `ssh ${options.host}: expected a Linux host, got ${JSON.stringify(probe.stdout.trim())}. ` +\n        'sshRunner() sends GNU/BusyBox argv (stat -c, base64, mv -f); for a Mac use localRunner().',\n    );\n  }\n  const euid = Number(uid);\n  return {\n    effectiveUid: () => euid,\n    exec: (argv) => run(execScript(argv)),\n    lookupGroup: async (nameOrId) => {\n      const result = await run(execScript(groupQuery('linux', nameOrId)));\n      return result.exitCode === 0 ? parseGroup('linux', result.stdout) : undefined;\n    },\n    lookupUser: async (nameOrId) => {\n      const result = await run(execScript(userQuery('linux', nameOrId)));\n      return result.exitCode === 0 ? parseUser('linux', result.stdout) : undefined;\n    },\n    privileged: false,\n    readFile: async (path) => {\n      const result = await run(readScript(path));\n      if (result.exitCode === ABSENT) return undefined;\n      if (result.exitCode !== 0) throw failed(options.host, `read ${path}`, result);\n      return decodeBase64(result.stdout);\n    },\n    removeFile: async (path) => {\n      const result = await run(removeScript(path));\n      if (result.exitCode !== 0) throw failed(options.host, `remove ${path}`, result);\n    },\n    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),\n    stat: async (path) => {\n      const result = await run(statScript(path));\n      if (result.exitCode === ABSENT) return undefined;\n      if (result.exitCode !== 0) throw failed(options.host, `stat ${path}`, result);\n      const parsed = parseStat(result.stdout);\n      // ⛔ Unparseable is an error, not \"nothing there\": a `stat` that printed something we do not\n      //   understand is a host this runner does not know, and guessing would write over a file.\n      if (parsed === undefined) {\n        throw new Error(`ssh ${options.host}: stat ${path} printed an unexpected shape`);\n      }\n      return parsed;\n    },\n    writeFileAtomic: async (path, bytes, write) => {\n      const at = path.lastIndexOf('/');\n      const temp = `${path.slice(0, at)}/.${path.slice(at + 1)}.${randomBytes(6).toString('hex')}.tmp`;\n      const result = await run(writeScript(path, temp, write), bytes);\n      if (result.exitCode !== 0) throw failed(options.host, `write ${path}`, result);\n    },\n  };\n};\n",
     "/**\n * User and group lookups, as argv plus a parser — split out so the parsing is tested against the\n * real output shapes without running anything.\n *\n * ★ macOS FIRST, getent ELSEWHERE. macOS has no `getent`; its directory service answers through\n *   `dscacheutil`. Shape MEASURED 2026-09-21 on macOS 27.2 (read-only query):\n *\n *     name: someone\n *     password: ********\n *     uid: 501\n *     gid: 20\n *     dir: /Users/someone\n *     shell: /bin/zsh\n *\n *   An unknown uid printed NOTHING and exited 0 — so \"no record\" is an empty parse, never an\n *   exit code. `getent` exits 2 for an unknown key; that also parses as no record.\n * ⛔ NEVER PARSE OR KEEP THE `password:` LINE. It is a placeholder on macOS, but a parser that\n *   copies every field would carry a hash from any host where it is not.\n */\nimport type { HostUser } from './runner.ts';\n\nconst NUMERIC = /^\\d+$/;\n\n/** argv for looking up a user, by name or numeric id. */\nexport const userQuery = (platform: string, nameOrId: string): readonly string[] =>\n  platform === 'darwin'\n    ? [\n        '/usr/bin/dscacheutil',\n        '-q',\n        'user',\n        '-a',\n        NUMERIC.test(nameOrId) ? 'uid' : 'name',\n        nameOrId,\n      ]\n    : ['getent', 'passwd', nameOrId];\n\n/** argv for looking up a group, by name or numeric id. */\nexport const groupQuery = (platform: string, nameOrId: string): readonly string[] =>\n  platform === 'darwin'\n    ? [\n        '/usr/bin/dscacheutil',\n        '-q',\n        'group',\n        '-a',\n        NUMERIC.test(nameOrId) ? 'gid' : 'name',\n        nameOrId,\n      ]\n    : ['getent', 'group', nameOrId];\n\n/** The first `key: value` record in dscacheutil output, minus any password field. */\nconst firstRecord = (stdout: string): Map<string, string> => {\n  const fields = new Map<string, string>();\n  for (const line of stdout.split('\\n')) {\n    if (line.trim() === '') {\n      if (fields.size > 0) break; // ⚠️ records are blank-line separated; keep the first only\n      continue;\n    }\n    const at = line.indexOf(': ');\n    if (at <= 0) continue;\n    const key = line.slice(0, at);\n    if (key === 'password') continue;\n    fields.set(key, line.slice(at + 2).trim());\n  }\n  return fields;\n};\n\nconst toId = (text: string | undefined): number | undefined =>\n  text !== undefined && NUMERIC.test(text) ? Number(text) : undefined;\n\nexport const parseUser = (platform: string, stdout: string): HostUser | undefined => {\n  if (platform === 'darwin') {\n    const record = firstRecord(stdout);\n    const uid = toId(record.get('uid'));\n    const gid = toId(record.get('gid'));\n    const home = record.get('dir');\n    return uid === undefined || gid === undefined || home === undefined\n      ? undefined\n      : { gid, home, uid };\n  }\n  // getent passwd: name:x:uid:gid:gecos:home:shell\n  const fields = (stdout.split('\\n')[0] ?? '').split(':');\n  const uid = toId(fields[2]);\n  const gid = toId(fields[3]);\n  const home = fields[5];\n  return uid === undefined || gid === undefined || home === undefined || home === ''\n    ? undefined\n    : { gid, home, uid };\n};\n\nexport const parseGroup = (platform: string, stdout: string): number | undefined => {\n  if (platform === 'darwin') return toId(firstRecord(stdout).get('gid'));\n  // getent group: name:x:gid:members\n  return toId((stdout.split('\\n')[0] ?? '').split(':')[2]);\n};\n",
     "/**\n * The wire format the ssh runner speaks: how an argv becomes one remote `sh` script, and how that\n * script's real exit code comes back. Pure functions, so every quoting and framing rule is tested\n * without opening a connection.\n *\n * ⛔ `ssh host <words>` IS NOT AN EXECVE. ssh joins its trailing arguments with spaces and the\n *   REMOTE LOGIN SHELL parses the result, so an unquoted path with a space, a `$`, a backtick or a\n *   `;` is re-parsed as shell syntax on the other side. Everything therefore goes through\n *   `shellQuote`, and the remote command is always `/bin/sh -c '<script>'` — a POSIX shell named\n *   explicitly, so a csh or fish login shell only ever execs it.\n * ⛔ AN EXIT CODE FROM ssh IS AMBIGUOUS. ssh exits 255 for its own failures (connection refused,\n *   host key changed, auth) and otherwise passes the remote exit code through — and a remote\n *   command may itself exit 255. A runner that read the code alone would report \"the file is not\n *   there\" for a dropped connection, which is the exact \"never infer success from an empty result\"\n *   failure. So every script ends by printing its own status on stderr behind a PER-RUNNER NONCE,\n *   and a result without that line is a transport failure, never data.\n * ⚠️ THE NONCE IS NOT DECORATION. Without it a remote program that happens to print the marker on\n *   stderr could claim any exit code it liked; with a fresh random nonce per runner, the only thing\n *   that can produce the line is the script we sent.\n */\n\n/** A script whose work found nothing at the path. ★ Chosen from the 64–113 range sh leaves free. */\nexport const ABSENT = 66;\n\n/**\n * One argument, safe for a POSIX shell. ⛔ Single quotes, because they quote EVERYTHING; the\n *   `'\\''` dance is how a literal quote gets through.\n */\nexport const shellQuote = (arg: string): string => {\n  if (arg.includes('\\x00')) throw new Error('ssh: an argument contains NUL');\n  return `'${arg.replaceAll(\"'\", `'\\\\''`)}'`;\n};\n\n/** An argv as one shell command line. */\nexport const quoteArgv = (argv: readonly string[]): string => argv.map(shellQuote).join(' ');\n\nconst marker = (nonce: string) => `__HF_RC_${nonce}=`;\n\n/**\n * Wrap a script so its status comes back unambiguously.\n *\n * ⛔ THE SCRIPT RUNS IN A SUBSHELL, AND THAT IS NOT COSMETIC. Several of the scripts end a branch\n *   with `exit <code>` to say \"nothing was there\"; at the top level that exit leaves the shell\n *   immediately and the marker line NEVER PRINTS — so the caller sees a framed result missing its\n *   frame and, correctly, calls it a transport failure. 🔴 MEASURED 2026-09-22 against a live\n *   Debian 13 host: `stat` of a missing path came back as \"the remote command did not report a\n *   status (ssh exit 66)\" instead of \"nothing is at this path\". Inside `( … )` the exit leaves only\n *   the subshell, `$?` carries the code out, and the frame always runs.\n * ⚠️ The leading `\\n` matters too: a program whose last stderr line has no newline would otherwise\n *   glue itself to the marker and the marker would not be found.\n */\nexport const frameScript = (script: string, nonce: string): string =>\n  `(\\n${script}\\n)\\n__hf=$?\\nprintf '\\\\n${marker(nonce)}%s\\\\n' \"$__hf\" >&2\\nexit \"$__hf\"`;\n\nexport type Framed = { readonly exitCode: number; readonly stderr: string };\n\n/**\n * The remote exit code and the stderr that belongs to the command, or `undefined` when the marker\n * is absent — which means the script never ran to its end: ssh failed, the connection dropped, or\n * the remote shell could not parse what we sent. ⛔ The caller must treat `undefined` as an error,\n * never as an answer.\n */\nexport const parseFramed = (stderr: string, nonce: string): Framed | undefined => {\n  const at = stderr.lastIndexOf(`\\n${marker(nonce)}`);\n  if (at < 0) return undefined;\n  const digits = /^(\\d+)\\s*$/.exec(stderr.slice(at + marker(nonce).length + 1));\n  if (digits?.[1] === undefined) return undefined;\n  return { exitCode: Number(digits[1]), stderr: stderr.slice(0, at) };\n};\n\n/**\n * The fixed ssh options, in front of anything a caller adds.\n * ⛔ `BatchMode=yes` — a deploy that stops to ask for a passphrase is the failure \"no password\n *   prompts\" names, and with BatchMode ssh fails at once instead.\n * ⛔ NOTHING HERE WEAKENS HOST VERIFICATION. No `StrictHostKeyChecking`, no `UserKnownHostsFile`:\n *   the operator's own ssh config and known_hosts decide who the host is, and a changed key stays\n *   a refusal. A runner that turned that off would make a man-in-the-middle a deploy target.\n * ★ `-T`: no pseudo-terminal, so the remote shell's stdout stays the bytes the program wrote.\n */\nexport const sshArgv = (\n  host: string,\n  script: string,\n  options: { readonly connectTimeoutSec: number; readonly sshArgs?: readonly string[] },\n): readonly string[] => {\n  if (host === '' || host.startsWith('-')) {\n    throw new Error(`ssh: ${JSON.stringify(host)} is not a usable destination`);\n  }\n  return [\n    'ssh',\n    '-T',\n    '-o',\n    'BatchMode=yes',\n    '-o',\n    `ConnectTimeout=${String(options.connectTimeoutSec)}`,\n    ...(options.sshArgs ?? []),\n    host,\n    `/bin/sh -c ${shellQuote(script)}`,\n  ];\n};\n",
-    "/**\n * The four remote scripts a HostRunner needs, and the parser for the one that returns data.\n * Pure: every shape here is asserted in ssh-scripts.test.ts without a connection.\n *\n * ★ MEASURED 2026-09-22 on Debian 13 (systemd 257, kernel 7.0.14-pve), read-only over ssh:\n *     $ stat -c '%f %a %u %g %s' /etc/hostname   →  81a4 644 0 0 4          (exit 0)\n *     $ stat -c '%f %a %u %g %s' /nonexistent    →  \"cannot statx\"          (exit 1)\n *   `%f` is the RAW mode in hex, so the file type is in it (0x8000 regular, 0x4000 directory,\n *   0xa000 symlink) and `%a` is the permission bits alone. ⛔ GNU `stat` does NOT follow symlinks\n *   without `-L`, which is what makes this an lstat — the FileStat contract (runner.ts) requires it,\n *   because writing through a symlink changes a file the resource never named.\n * ⚠️ COREUTILS, NOT POSIX. `stat -c`, `base64` and `mv -f` are GNU/BusyBox spellings, not POSIX\n *   ones; this runner is for Linux hosts and refuses anything else at the probe (ssh-runner.ts).\n */\nimport { ABSENT, quoteArgv, shellQuote } from './ssh-command.ts';\nimport type { FileStat, WriteOptions } from '../launchd/runner.ts';\n\n/** ★ `-e` is false for a dangling symlink and `-L` is true for it, so both tests together mean\n *    \"something is at this path\" — the question stat(2) answers and `-e` alone does not. */\nconst IF_PRESENT = (path: string) => `if [ -e ${path} ] || [ -L ${path} ]; then`;\n\nexport const statScript = (path: string): string => {\n  const quoted = shellQuote(path);\n  return `${IF_PRESENT(quoted)} stat -c '%f %a %u %g %s' -- ${quoted}; else exit ${String(ABSENT)}; fi`;\n};\n\n/** ★ base64 on the wire: stdout then carries no byte that a shell, a pty or a locale can alter. */\nexport const readScript = (path: string): string => {\n  const quoted = shellQuote(path);\n  return `${IF_PRESENT(quoted)} base64 -- ${quoted}; else exit ${String(ABSENT)}; fi`;\n};\n\n/** ⛔ `rm -f` is idempotent for an absent path and still FAILS for a directory, which is what keeps\n *    HostRunner.removeFile from quietly removing something that is not a file. */\nexport const removeScript = (path: string): string => `rm -f -- ${shellQuote(path)}`;\n\nexport const execScript = (argv: readonly string[]): string => quoteArgv(argv);\n\n/**\n * Write bytes (fed on stdin) so `path` holds the old file or the new one and never a torn mix.\n *\n * ⛔ NOT `install`. GNU coreutils `install` opens the destination and writes THROUGH it — unlike\n *   macOS's, which stages and renames — so a deploy interrupted mid-write would leave a truncated\n *   config where a whole one used to be. Staging beside the target and `mv` (rename(2), same\n *   directory so never EXDEV) is the only atomic spelling available over a shell.\n * ⛔ `set -C` and `umask 077`: the staged file is created O_EXCL, so a symlink or a file planted at\n *   the temp name is a refusal rather than a write through it, and it is unreadable by anyone else\n *   in the moment before its mode is set.\n * ⚠️ chown BEFORE chmod: chown by root clears setuid/setgid, so the other order silently drops a\n *   declared 4755 — the same ordering localRunner keeps for the same reason.\n * ⚠️ Each step removes the staged file before it fails, so a failed write leaves no litter beside\n *   a file someone else owns.\n */\nexport const writeScript = (path: string, temp: string, options: WriteOptions): string => {\n  const target = shellQuote(path);\n  const staged = shellQuote(temp);\n  const bail = `{ rm -f -- ${staged}; exit`;\n  /**\n   * ⛔ NEVER `chown <uid>:` — GNU chown reads a trailing colon as \"and that user's LOGIN GROUP\",\n   *   which is a gid nobody declared. Each half is spelled only when it was asked for.\n   */\n  const owner =\n    options.uid === undefined\n      ? options.gid === undefined\n        ? undefined\n        : `:${String(options.gid)}`\n      : options.gid === undefined\n        ? String(options.uid)\n        : `${String(options.uid)}:${String(options.gid)}`;\n  const chown = owner === undefined ? [] : [`chown ${owner} -- ${staged} || ${bail} 72; }`];\n  return [\n    'set -C',\n    'umask 077',\n    `cat > ${staged} || ${bail} 71; }`,\n    ...chown,\n    `chmod ${options.mode.toString(8).padStart(3, '0')} -- ${staged} || ${bail} 73; }`,\n    `mv -f -- ${staged} ${target} || ${bail} 74; }`,\n  ].join('\\n');\n};\n\nconst TYPE_BITS = 0xf000;\nconst KINDS = new Map<number, FileStat['kind']>([\n  [0x8000, 'file'],\n  [0x4000, 'directory'],\n  [0xa000, 'symlink'],\n]);\n\n/** `stat -c '%f %a %u %g %s'` output → a FileStat, or `undefined` when it is not that shape. */\nexport const parseStat = (stdout: string): FileStat | undefined => {\n  const fields = stdout.trim().split(/\\s+/);\n  if (fields.length !== 5) return undefined;\n  const [rawMode, perms, uid, gid, size] = fields as [string, string, string, string, string];\n  const raw = Number.parseInt(rawMode, 16);\n  const mode = Number.parseInt(perms, 8);\n  const numbers = [raw, mode, Number(uid), Number(gid), Number(size)];\n  if (numbers.some((value) => !Number.isSafeInteger(value) || value < 0)) return undefined;\n  return {\n    gid: Number(gid),\n    kind: KINDS.get(raw & TYPE_BITS) ?? 'other',\n    // ⚠️ `%a` alone, never `%f & 0o7777`: they agree, and the permission field is the documented one.\n    mode,\n    size: Number(size),\n    uid: Number(uid),\n  };\n};\n"
+    "/**\n * The four remote scripts a HostRunner needs, and the parser for the one that returns data.\n * Pure: every shape here is asserted in ssh-scripts.test.ts without a connection.\n *\n * ★ MEASURED 2026-09-22 on Debian 13 (systemd 257, kernel 7.0.14-pve), read-only over ssh:\n *     $ stat -c '%f %a %u %g %s' /etc/hostname   →  81a4 644 0 0 4          (exit 0)\n *     $ stat -c '%f %a %u %g %s' /nonexistent    →  \"cannot statx\"          (exit 1)\n *   `%f` is the RAW mode in hex, so the file type is in it (0x8000 regular, 0x4000 directory,\n *   0xa000 symlink) and `%a` is the permission bits alone. ⛔ GNU `stat` does NOT follow symlinks\n *   without `-L`, which is what makes this an lstat — the FileStat contract (runner.ts) requires it,\n *   because writing through a symlink changes a file the resource never named.\n * ⚠️ COREUTILS, NOT POSIX. `stat -c`, `base64` and `mv -f` are GNU/BusyBox spellings, not POSIX\n *   ones; this runner is for Linux hosts and refuses anything else at the probe (ssh-runner.ts).\n */\nimport { ABSENT, quoteArgv, shellQuote } from './ssh-command.ts';\nimport type { FileStat, WriteOptions } from '../launchd/runner.ts';\n\n/** ★ `-e` is false for a dangling symlink and `-L` is true for it, so both tests together mean\n *    \"something is at this path\" — the question stat(2) answers and `-e` alone does not. */\nconst IF_PRESENT = (path: string) => `if [ -e ${path} ] || [ -L ${path} ]; then`;\n\nexport const statScript = (path: string): string => {\n  const quoted = shellQuote(path);\n  return `${IF_PRESENT(quoted)} stat -c '%f %a %u %g %s' -- ${quoted}; else exit ${String(ABSENT)}; fi`;\n};\n\n/** ★ base64 on the wire: stdout then carries no byte that a shell, a pty or a locale can alter. */\nexport const readScript = (path: string): string => {\n  const quoted = shellQuote(path);\n  return `${IF_PRESENT(quoted)} base64 -- ${quoted}; else exit ${String(ABSENT)}; fi`;\n};\n\n/** ⛔ `rm -f` is idempotent for an absent path and still FAILS for a directory, which is what keeps\n *    HostRunner.removeFile from quietly removing something that is not a file. */\nexport const removeScript = (path: string): string => `rm -f -- ${shellQuote(path)}`;\n\nexport const execScript = (argv: readonly string[]): string => quoteArgv(argv);\n\n/**\n * Write bytes (fed on stdin) so `path` holds the old file or the new one and never a torn mix.\n *\n * ⛔ NOT `install`. GNU coreutils `install` opens the destination and writes THROUGH it — unlike\n *   macOS's, which stages and renames — so a deploy interrupted mid-write would leave a truncated\n *   config where a whole one used to be. Staging beside the target and `mv` (rename(2), same\n *   directory so never EXDEV) is the only atomic spelling available over a shell.\n * ⛔ `set -C` and `umask 077`: the staged file is created O_EXCL, so a symlink or a file planted at\n *   the temp name is a refusal rather than a write through it, and it is unreadable by anyone else\n *   in the moment before its mode is set.\n * ⚠️ chown BEFORE chmod: chown by root clears setuid/setgid, so the other order silently drops a\n *   declared 4755 — the same ordering localRunner keeps for the same reason.\n * ⚠️ Each step removes the staged file before it fails, so a failed write leaves no litter beside\n *   a file someone else owns.\n */\nexport const writeScript = (path: string, temp: string, options: WriteOptions): string => {\n  const target = shellQuote(path);\n  const staged = shellQuote(temp);\n  const bail = `{ rm -f -- ${staged}; exit`;\n  /**\n   * ⛔ NEVER `chown <uid>:` — GNU chown reads a trailing colon as \"and that user's LOGIN GROUP\",\n   *   which is a gid nobody declared. Each half is spelled only when it was asked for.\n   */\n  const owner =\n    options.uid === undefined\n      ? options.gid === undefined\n        ? undefined\n        : `:${String(options.gid)}`\n      : options.gid === undefined\n        ? String(options.uid)\n        : `${String(options.uid)}:${String(options.gid)}`;\n  const chown = owner === undefined ? [] : [`chown ${owner} -- ${staged} || ${bail} 72; }`];\n  return [\n    'set -C',\n    'umask 077',\n    `cat > ${staged} || ${bail} 71; }`,\n    ...chown,\n    `chmod ${options.mode.toString(8).padStart(3, '0')} -- ${staged} || ${bail} 73; }`,\n    `mv -f -- ${staged} ${target} || ${bail} 74; }`,\n  ].join('\\n');\n};\n\nconst TYPE_BITS = 0xf000;\nconst KINDS = new Map<number, FileStat['kind']>([\n  [0x8000, 'file'],\n  [0x4000, 'directory'],\n  [0xa000, 'symlink'],\n]);\n\n/** `stat -c '%f %a %u %g %s'` output → a FileStat, or `undefined` when it is not that shape. */\nexport const parseStat = (stdout: string): FileStat | undefined => {\n  const fields = stdout.trim().split(/\\s+/);\n  if (fields.length !== 5) return undefined;\n  const [rawMode, perms, uid, gid, size] = fields as [string, string, string, string, string];\n  const raw = Number.parseInt(rawMode, 16);\n  const mode = Number.parseInt(perms, 8);\n  const numbers = [raw, mode, Number(uid), Number(gid), Number(size)];\n  if (numbers.some((value) => !Number.isSafeInteger(value) || value < 0)) return undefined;\n  return {\n    gid: Number(gid),\n    kind: KINDS.get(raw & TYPE_BITS) ?? 'other',\n    // ⚠️ `%a` alone, never `%f & 0o7777`: they agree, and the permission field is the documented one.\n    mode,\n    size: Number(size),\n    uid: Number(uid),\n  };\n};\n",
+    "/**\n * The real HostRunner: this process, this machine, this uid.\n *\n * ★ node:fs AND node:child_process, NOT Bun APIs. An Alchemy stack usually runs under bun, but\n *   the published dist also loads under node (the package's smoke test and the kit's AGENTS.md:\n *   consumers run dist/, not src/), and both runtimes implement these modules.\n * ⛔ NO ELEVATION, EVER. `privileged` is false; a system-domain write succeeds only when the whole\n *   deploy was started as root. See the ⛔ on HostRunner.privileged for why nothing here calls sudo;\n *   the opt-in elevating runner is sudo-runner.ts, which wraps this one.\n * ⛔ NO SHELL. `exec` spawns argv directly, so a label, path or argument can never be re-parsed\n *   as shell syntax.\n */\nimport { spawn } from 'node:child_process';\nimport { randomBytes } from 'node:crypto';\nimport { lstat, open, readFile, rename, unlink } from 'node:fs/promises';\nimport { basename, dirname, join } from 'node:path';\nimport { groupQuery, parseGroup, parseUser, userQuery } from './host-lookup.ts';\nimport type { ExecResult, FileStat, HostRunner, WriteOptions } from './runner.ts';\n\nexport type LocalRunnerOptions = {\n  /** Kill a spawned program after this long. @default 120_000 */\n  readonly execTimeoutMs?: number;\n};\n\n/** The errno code of a thrown fs error (`ENOENT`, `EACCES`, …), if it has one. */\nexport const errnoCode = (cause: unknown): string | undefined =>\n  typeof cause === 'object' && cause !== null && 'code' in cause\n    ? String((cause as { code: unknown }).code)\n    : undefined;\n\n/** ENOENT and ENOTDIR both mean \"nothing is at this path\". */\nconst absent = (cause: unknown): boolean =>\n  errnoCode(cause) === 'ENOENT' || errnoCode(cause) === 'ENOTDIR';\n\nconst run = (argv: readonly string[], timeoutMs: number): Promise<ExecResult> =>\n  new Promise((resolve, reject) => {\n    const [program, ...args] = argv;\n    if (program === undefined) {\n      reject(new Error('exec: empty argv'));\n      return;\n    }\n    const child = spawn(program, args, {\n      shell: false,\n      stdio: ['ignore', 'pipe', 'pipe'],\n      timeout: timeoutMs,\n    });\n    const out: Buffer[] = [];\n    const err: Buffer[] = [];\n    child.stdout.on('data', (chunk: Buffer) => out.push(chunk));\n    child.stderr.on('data', (chunk: Buffer) => err.push(chunk));\n    child.on('error', (cause) => {\n      reject(new Error(`exec ${program}: ${cause.message}`));\n    });\n    child.on('close', (exitCode, signal) => {\n      const stderr = Buffer.concat(err).toString('utf8');\n      resolve({\n        // ⚠️ A signal (including our own timeout) has no exit code; -1 keeps it a failure.\n        exitCode: exitCode ?? -1,\n        stderr: signal === null ? stderr : `${stderr}\\n(killed by ${signal})`.trim(),\n        stdout: Buffer.concat(out).toString('utf8'),\n      });\n    });\n  });\n\nconst kindOf = (stats: Awaited<ReturnType<typeof lstat>>): FileStat['kind'] => {\n  if (stats.isSymbolicLink()) return 'symlink';\n  if (stats.isFile()) return 'file';\n  if (stats.isDirectory()) return 'directory';\n  return 'other';\n};\n\nconst writeAtomic = async (path: string, bytes: Uint8Array, options: WriteOptions) => {\n  // ★ Same directory as the target, so rename(2) never crosses a filesystem (which would EXDEV).\n  const temp = join(dirname(path), `.${basename(path)}.${randomBytes(6).toString('hex')}.tmp`);\n  // ⛔ 'wx' = O_CREAT|O_EXCL, and 0600 until the final mode: the temp file is never readable by\n  //   anyone else in the moment before its mode is set, and never follows a planted symlink.\n  const handle = await open(temp, 'wx', 0o600);\n  try {\n    try {\n      await handle.writeFile(bytes);\n      // ⚠️ chown BEFORE chmod: a chown by root clears setuid/setgid bits, so the other order\n      //   would silently drop a declared 4755.\n      if (options.uid !== undefined || options.gid !== undefined) {\n        await handle.chown(options.uid ?? -1, options.gid ?? -1);\n      }\n      await handle.chmod(options.mode);\n      await handle.sync();\n    } finally {\n      await handle.close();\n    }\n    await rename(temp, path);\n  } catch (cause) {\n    await unlink(temp).catch(() => undefined);\n    throw cause;\n  }\n};\n\nexport const localRunner = (options: LocalRunnerOptions = {}): HostRunner => {\n  const timeoutMs = options.execTimeoutMs ?? 120_000;\n  const platform = process.platform;\n  return {\n    effectiveUid: () => process.geteuid?.() ?? -1,\n    exec: (argv) => run(argv, timeoutMs),\n    lookupGroup: async (nameOrId) => {\n      const result = await run(groupQuery(platform, nameOrId), timeoutMs);\n      return result.exitCode === 0 ? parseGroup(platform, result.stdout) : undefined;\n    },\n    lookupUser: async (nameOrId) => {\n      const result = await run(userQuery(platform, nameOrId), timeoutMs);\n      return result.exitCode === 0 ? parseUser(platform, result.stdout) : undefined;\n    },\n    privileged: false,\n    readFile: async (path) => {\n      try {\n        return new Uint8Array(await readFile(path));\n      } catch (cause) {\n        if (absent(cause)) return undefined;\n        throw cause;\n      }\n    },\n    removeFile: async (path) => {\n      try {\n        await unlink(path);\n      } catch (cause) {\n        if (!absent(cause)) throw cause;\n      }\n    },\n    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),\n    stat: async (path) => {\n      try {\n        const stats = await lstat(path);\n        return {\n          dev: stats.dev,\n          gid: stats.gid,\n          ino: stats.ino,\n          kind: kindOf(stats),\n          mode: stats.mode & 0o7777,\n          size: stats.size,\n          uid: stats.uid,\n        };\n      } catch (cause) {\n        if (absent(cause)) return undefined;\n        throw cause;\n      }\n    },\n    writeFileAtomic: writeAtomic,\n  };\n};\n",
+    "/**\n * Everything LaunchdJob refuses before it touches the host. Run at plan time (diff) and again at\n * reconcile, so a bad declaration fails the plan instead of half-applying.\n *\n * ★ REFUSE WHAT launchd WOULD SILENTLY IGNORE OR MISREAD. launchd loads a plist with an out-of-range\n *   calendar field or a UserName on an agent without complaint and then simply never does what the\n *   declaration says; a plan that fails is cheaper than a job that quietly does nothing.\n */\nimport {\n  type CalendarInterval,\n  type LaunchdJobProps,\n  OWNED_KEYS,\n  parseDomain,\n} from './job-form.ts';\nimport { jobSecretProblems } from './secret-tripwire.ts';\n\n/** ★ Labels become file names: no `/`, no leading dot, nothing a path could re-interpret. */\nexport const LABEL = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;\n\n/**\n * ⛔ LABELS OTHER TOOLS OWN ARE NEVER DECLARED HERE. nix-darwin (`org.nixos.*`) rewrites its plists\n *   on every activation and unloads any it no longer lists; macOS owns `com.apple.*`; `brew\n *   services` owns `homebrew.mxcl.*`. Declaring one of those makes two tools fight over one file.\n *   To move a job off such a tool, declare a NEW label and cut over (docs/launchd.md).\n */\nexport const RESERVED_LABEL_PREFIXES: readonly string[] = [\n  'org.nixos.',\n  'com.apple.',\n  'homebrew.mxcl.',\n];\n\nconst ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\nconst RANGES: ReadonlyArray<readonly [keyof CalendarInterval, number, number]> = [\n  ['minute', 0, 59],\n  ['hour', 0, 23],\n  ['day', 1, 31],\n  ['weekday', 0, 7],\n  ['month', 1, 12],\n];\n\nconst isInt = (value: number, min: number, max = Number.MAX_SAFE_INTEGER) =>\n  Number.isSafeInteger(value) && value >= min && value <= max;\n\nconst calendarProblems = (entries: readonly CalendarInterval[]): string[] => {\n  if (entries.length === 0) return ['startCalendarInterval is an empty list; omit it instead'];\n  const found: string[] = [];\n  for (const [index, entry] of entries.entries()) {\n    for (const [field, min, max] of RANGES) {\n      const value = entry[field];\n      if (value !== undefined && !isInt(value, min, max)) {\n        found.push(\n          `startCalendarInterval[${String(index)}].${field} must be ${String(min)}–${String(max)}`,\n        );\n      }\n    }\n  }\n  return found;\n};\n\nconst absolute = (name: string, value: string | undefined): string[] =>\n  value === undefined || value.startsWith('/') ? [] : [`${name} must be an absolute path`];\n\n/**\n * The label and domain alone — the job's identity. ★ Split out because a rename is a delete-first\n *   replace, and it must be refusable at plan time even while other props are still unresolved\n *   Outputs (see job.ts diff): otherwise the old job is deleted and only then is the new label\n *   found to be invalid.\n */\nexport const identityProblems = (label: string, domainText: string): string[] => {\n  const found: string[] = [];\n  if (!LABEL.test(label)) {\n    found.push('label must be 1–200 of [A-Za-z0-9._-], starting with a letter or digit');\n  }\n  const reserved = RESERVED_LABEL_PREFIXES.find((prefix) => label.startsWith(prefix));\n  if (reserved !== undefined) {\n    found.push(`label ${label} is under ${reserved}, which another tool owns; declare a new label`);\n  }\n  if (parseDomain(domainText) === undefined)\n    found.push(`domain must be 'system' or 'gui/<uid>', not ${domainText}`);\n  return found;\n};\n\nexport const jobProblems = (props: LaunchdJobProps): string[] => {\n  const found = identityProblems(props.label, props.domain);\n  const domain = parseDomain(props.domain);\n\n  const [program] = props.programArguments;\n  // ★ Absolute, because launchd's PATH for a job is not the deploying shell's PATH.\n  if (program === undefined) found.push('programArguments must name a program');\n  else if (!program.startsWith('/')) found.push('programArguments[0] must be an absolute path');\n\n  for (const name of Object.keys(props.environment ?? {})) {\n    if (!ENV_NAME.test(name))\n      found.push(`environment name ${JSON.stringify(name)} is not a valid variable name`);\n  }\n  found.push(...jobSecretProblems(props.environment, props.programArguments, props.extraKeys));\n\n  if (props.startInterval !== undefined && !isInt(props.startInterval, 1)) {\n    found.push('startInterval must be a positive whole number of seconds');\n  }\n  if (props.throttleInterval !== undefined && !isInt(props.throttleInterval, 0)) {\n    found.push('throttleInterval must be a non-negative whole number of seconds');\n  }\n  const calendar = props.startCalendarInterval;\n  if (calendar !== undefined) {\n    found.push(\n      ...calendarProblems(Array.isArray(calendar) ? calendar : [calendar as CalendarInterval]),\n    );\n  }\n  const keepAlive = props.keepAlive;\n  if (\n    typeof keepAlive === 'object' &&\n    keepAlive.successfulExit === undefined &&\n    keepAlive.crashed === undefined\n  ) {\n    found.push('keepAlive {} names no condition; use true, false, or a condition');\n  }\n\n  found.push(...absolute('standardOutPath', props.standardOutPath));\n  found.push(...absolute('standardErrorPath', props.standardErrorPath));\n  found.push(...absolute('workingDirectory', props.workingDirectory));\n\n  if (domain?.kind === 'gui' && (props.userName !== undefined || props.groupName !== undefined)) {\n    found.push(\n      'userName/groupName apply only to the system domain; launchd ignores them for agents',\n    );\n  }\n  for (const key of Object.keys(props.extraKeys ?? {})) {\n    if (OWNED_KEYS.includes(key))\n      found.push(`extraKeys.${key} is owned by a typed prop; use that instead`);\n  }\n  return found;\n};\n",
+    "/**\n * The four `launchctl` subcommands LaunchdJob uses — print, print-disabled, bootstrap, bootout —\n * over a HostRunner, plus the parsers for the two read-only ones.\n *\n * ★ MEASURED 2026-09-21 ON macOS 27.2 (read-only `print` / `print-disabled` only; nothing was\n *   bootstrapped or booted out to write this):\n *   - `print system/<unknown>` exits **113** with \"Could not find service … in domain for system\"\n *     on stderr. 113 is therefore \"not loaded\", not an error.\n *   - `print` of a loaded job is a `<target> = {` block. Its own fields sit one tab deep\n *     (`\\tstate = running`, `\\tpid = 1219`, `\\tlast exit code = 0` or `(never exited)`); nested\n *     blocks (`resource coalition`, `semaphores`) repeat names like `state` two tabs deep.\n *   - `print-disabled <domain>` lists `\"label\" => enabled|disabled`.\n *   - reading needs no root: a uid-501 shell printed system-domain jobs.\n *   - `print gui/<uid>/<label>` for a uid with NO LOGIN SESSION exits **112** with \"Could not find\n *     domain for user gui: <uid>\" (and so does `print-disabled gui/<uid>`); a malformed target is\n *     64, a missing service in a live gui domain is 113. So 112 + that text is \"the domain does\n *     not exist\", which means the job cannot be loaded — not an error for a read or a delete.\n * ⚠️ REASONED, NOT MEASURED: bootstrap/bootout exit codes. nix-darwin's own activation script on the\n *   same host notes \"`bootout` on an already-absent job is a no-op that returns non-zero\", which is\n *   why bootout here is always preceded by a print and followed by a poll, never trusted alone.\n * ⛔ NEVER PUT `print` STDOUT IN AN ERROR. It contains the job's whole environment.\n */\nimport type { HostRunner } from './runner.ts';\n\nexport const LAUNCHCTL = '/bin/launchctl';\n/** `launchctl print` of an unknown service — measured, see above. */\nexport const NOT_FOUND = 113;\n/** `launchctl print` into a gui domain with no login session — measured, see above. */\nexport const NO_DOMAIN = 112;\nconst NO_DOMAIN_TEXT = 'Could not find domain';\n\nexport class LaunchctlError extends Error {\n  constructor(command: string, exitCode: number, stderr: string) {\n    super(`launchctl ${command} -> ${String(exitCode)}: ${stderr.trim().slice(0, 300)}`);\n    this.name = 'LaunchctlError';\n  }\n}\n\nexport type ServiceStatus = {\n  readonly loaded: boolean;\n  /** The domain itself is absent (a gui/<uid> with no login session). Implies `loaded: false`. */\n  readonly domainMissing?: true;\n  readonly state?: string;\n  readonly pid?: number;\n  readonly lastExitCode?: number;\n};\n\n/**\n * The job block's own `key = value` lines, ignoring nested blocks.\n * ⚠️ A multi-line ProgramArguments entry is printed raw inside `arguments = {`, so a close is only\n *   accepted when its indentation matches the open. An argument that itself contains a line of\n *   exactly one tab and `}` would still desynchronise this; no real job has one.\n */\nexport const printFields = (stdout: string): Map<string, string> => {\n  const fields = new Map<string, string>();\n  const closers: string[] = [];\n  for (const line of stdout.split('\\n')) {\n    if (closers.length === 0) {\n      if (fields.size === 0 && line.endsWith(' = {')) closers.push('}');\n      continue;\n    }\n    if (line === closers[closers.length - 1]) {\n      closers.pop();\n      continue;\n    }\n    const opened = /^(\\t+)\\S.* = \\{$/.exec(line);\n    if (opened?.[1] !== undefined && opened[1].length === closers.length) {\n      closers.push(`${opened[1]}}`);\n      continue;\n    }\n    const field = closers.length === 1 ? /^\\t([a-z][a-z ]*[a-z]) = (.*)$/.exec(line) : null;\n    if (field?.[1] !== undefined && field[2] !== undefined && !fields.has(field[1])) {\n      fields.set(field[1], field[2]);\n    }\n  }\n  return fields;\n};\n\nconst leadingInt = (text: string | undefined): number | undefined => {\n  const match = text === undefined ? null : /^(-?\\d+)/.exec(text);\n  return match?.[1] === undefined ? undefined : Number(match[1]);\n};\n\nexport const parsePrint = (stdout: string): ServiceStatus => {\n  const fields = printFields(stdout);\n  const state = fields.get('state');\n  const pid = leadingInt(fields.get('pid'));\n  // \"(never exited)\" parses to undefined; \"78: EX_CONFIG\" to 78.\n  const lastExitCode = leadingInt(fields.get('last exit code'));\n  return {\n    loaded: true,\n    ...(state === undefined ? {} : { state }),\n    ...(pid === undefined ? {} : { pid }),\n    ...(lastExitCode === undefined ? {} : { lastExitCode }),\n  };\n};\n\n/** Labels `print-disabled` reports as disabled. Older releases printed `=> true` for disabled. */\nexport const parseDisabled = (stdout: string): Set<string> => {\n  const disabled = new Set<string>();\n  for (const match of stdout.matchAll(/^\\s*\"([^\"]+)\" => (\\w+)\\s*$/gm)) {\n    if (match[1] !== undefined && (match[2] === 'disabled' || match[2] === 'true')) {\n      disabled.add(match[1]);\n    }\n  }\n  return disabled;\n};\n\nexport const printService = async (runner: HostRunner, target: string): Promise<ServiceStatus> => {\n  const result = await runner.exec([LAUNCHCTL, 'print', target]);\n  if (result.exitCode === NOT_FOUND) return { loaded: false };\n  // ⚠️ Without this, deleting an agent while its user is logged out fails on the read, and the\n  //   plist stays in LaunchAgents — where launchd loads it again at that user's next login.\n  if (result.exitCode === NO_DOMAIN && result.stderr.includes(NO_DOMAIN_TEXT)) {\n    return { domainMissing: true, loaded: false };\n  }\n  if (result.exitCode !== 0)\n    throw new LaunchctlError(`print ${target}`, result.exitCode, result.stderr);\n  return parsePrint(result.stdout);\n};\n\nexport const isDisabled = async (\n  runner: HostRunner,\n  domain: string,\n  label: string,\n): Promise<boolean> => {\n  const result = await runner.exec([LAUNCHCTL, 'print-disabled', domain]);\n  if (result.exitCode !== 0) {\n    throw new LaunchctlError(`print-disabled ${domain}`, result.exitCode, result.stderr);\n  }\n  return parseDisabled(result.stdout).has(label);\n};\n\nexport const bootstrap = async (\n  runner: HostRunner,\n  domain: string,\n  plistPath: string,\n): Promise<void> => {\n  const result = await runner.exec([LAUNCHCTL, 'bootstrap', domain, plistPath]);\n  if (result.exitCode !== 0) {\n    throw new LaunchctlError(`bootstrap ${domain} ${plistPath}`, result.exitCode, result.stderr);\n  }\n};\n\n/**\n * Poll `print` until the service is gone. ⚠️ bootout can return before launchd lets go of it.\n * ★ 30 s, because a job gets SIGTERM and then its ExitTimeOut before SIGKILL: launchd.plist(5)\n *   documents a 20 s default (a macOS 27.2 `print` showed `exit timeout = 5` for a job that sets\n *   none). Giving up sooner would fail a deploy over a job that was, correctly, still exiting.\n */\nexport const waitUnloaded = async (\n  runner: HostRunner,\n  target: string,\n  attempts = 120,\n  intervalMs = 250,\n): Promise<void> => {\n  for (let attempt = 0; attempt < attempts; attempt += 1) {\n    if (!(await printService(runner, target)).loaded) return;\n    await runner.sleep(intervalMs);\n  }\n  throw new Error(\n    `${target} is still loaded ${String((attempts * intervalMs) / 1000)}s after bootout`,\n  );\n};\n\n/** Boot a service out if it is loaded, and wait until launchd has let go. Idempotent. */\nexport const bootoutIfLoaded = async (runner: HostRunner, target: string): Promise<void> => {\n  if (!(await printService(runner, target)).loaded) return;\n  const result = await runner.exec([LAUNCHCTL, 'bootout', target]);\n  /**\n   * ⚠️ A non-zero bootout is only an error if the service is STILL there after the wait (see\n   *   header) — so wait FIRST, then judge. A job slower to exit than launchctl's own wait is widely\n   *   reported to fail bootout with `36: Operation now in progress` (EINPROGRESS) while it is\n   *   still going away; REASONED from those reports, not measured here. Judging on an immediate\n   *   print would fail the deploy with the new plist written and the old job already exiting —\n   *   the job ends up down either way, and the error would blame the wrong step.\n   */\n  try {\n    await waitUnloaded(runner, target);\n  } catch (cause) {\n    if (result.exitCode === 0) throw cause;\n    throw new LaunchctlError(\n      `bootout ${target}`,\n      result.exitCode,\n      `${result.stderr.trim()} (and still loaded after waiting)`,\n    );\n  }\n};\n",
+    "/**\n * Everything sudo-runner.ts may run as root, as exact argv shapes, plus the rule for which calls\n * need root at all. Pure: no I/O, so every shape is tested without sudo (sudo-allowlist.test.ts).\n *\n * ⛔ AN ALLOWLIST OF SHAPES, NOT OF PROGRAMS. Allowing \"launchctl\" would allow `bootout system` with\n *   no service, which removes the whole system domain, and `bootstrap system <directory>`, which\n *   loads every plist in that directory (launchctl(1), read on macOS 27.2 on 2026-09-21). Each shape\n *   below fixes the subcommand, the domain, the flags and the number of operands, so neither of\n *   those can be written.\n * ⛔ PATHS ARE CHECKED LEXICALLY HERE: absolute, normalised (the same rule a HostFile path obeys,\n *   host-file-form.ts) and STRICTLY under a prefix the stack declared. sudo-guard.ts then checks\n *   the host with lstat: the prefix a root-only directory, no symlinks, and only regular files.\n * ⛔ `install` COPIES ONLY THE FILE THIS RUNNER STAGED. Any other source would let the runner copy\n *   a file only root can read (/etc/master.passwd, say) to a path the deploying user can read.\n */\nimport { pathProblems } from './host-file-form.ts';\nimport { plistPathFor } from './job-form.ts';\nimport { LABEL, RESERVED_LABEL_PREFIXES } from './job-validate.ts';\nimport { LAUNCHCTL } from './launchctl.ts';\n\n/**\n * A privileged call that was refused before it ran: by the allowlist, by a host check\n * (sudo-guard.ts), or by sudo itself. ★ Here, beside the allowlist, so the guard and the runner\n *   throw the same class and a caller can tell \"nothing ran as root\" from \"it ran and failed\".\n */\nexport class SudoRefusedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SudoRefusedError';\n  }\n}\n\n/** ★ Absolute program paths, so neither sudo nor the command is looked up on the caller's PATH. */\nexport const SUDO = '/usr/bin/sudo';\nexport const INSTALL = '/usr/bin/install';\nexport const RM = '/bin/rm';\n\n/** The launchctl subcommands that change a domain. Everything else launchctl does is a read. */\nconst WRITES: ReadonlySet<string> = new Set(['bootstrap', 'bootout', 'kickstart']);\n\n/** A mode as `install -m` takes it: four octal digits, so `0644` and `4755` are both exact. */\nexport const octalMode = (mode: number): string | undefined =>\n  Number.isSafeInteger(mode) && mode >= 0 && mode <= 0o7777\n    ? mode.toString(8).padStart(4, '0')\n    : undefined;\n\n/** Validate the stack's prefixes once, when the runner is built. */\nexport const checkPrefixes = (prefixes: readonly string[]): readonly string[] => {\n  if (prefixes.length === 0) {\n    throw new Error(\n      'sudoRunner: no prefixes. Name the directories root may write, e.g. /Library/LaunchDaemons.',\n    );\n  }\n  for (const prefix of prefixes) {\n    const found = prefix === '/' ? ['\"/\" would allow every path'] : pathProblems(prefix);\n    if (found.length > 0) {\n      throw new Error(`sudoRunner: prefix ${JSON.stringify(prefix)}: ${found.join('; ')}`);\n    }\n  }\n  return [...prefixes];\n};\n\n/**\n * The declared prefix `path` is strictly under, or `undefined`.\n * ⚠️ `${prefix}/`, never a bare startsWith: `/opt/example` must not admit `/opt/example-other`.\n */\nexport const prefixOf = (path: string, prefixes: readonly string[]): string | undefined =>\n  pathProblems(path).length > 0\n    ? undefined\n    : prefixes.find((prefix) => path.startsWith(`${prefix}/`));\n\nconst labelOk = (label: string): boolean =>\n  LABEL.test(label) && !RESERVED_LABEL_PREFIXES.some((prefix) => label.startsWith(prefix));\n\n/** The label of `system/<label>`, when it is one LaunchdJob itself would accept. */\nconst systemLabel = (target: string | undefined): string | undefined => {\n  const label = target?.startsWith('system/') === true ? target.slice('system/'.length) : undefined;\n  return label !== undefined && labelOk(label) ? label : undefined;\n};\n\n/**\n * A label's daemon plist, when that path is under a declared prefix.\n * ★ ONLY `/Library/LaunchDaemons/<label>.plist`, derived by the same plistPathFor LaunchdJob uses:\n *   it is the one directory launchd loads daemons from at boot, so a plist anywhere else under a\n *   prefix would be a root daemon that silently vanishes at the next restart. Root never loads one.\n */\nconst daemonPlist = (label: string, prefixes: readonly string[]): string | undefined => {\n  const path = plistPathFor(label, { kind: 'system' }, undefined);\n  return prefixOf(path, prefixes) === undefined ? undefined : path;\n};\n\nconst NO_DAEMON_PREFIX =\n  'needs /Library/LaunchDaemons among the prefixes, where the job’s plist is written and removed';\n\nconst launchctlProblem = (\n  args: readonly string[],\n  prefixes: readonly string[],\n): string | undefined => {\n  const [sub, ...rest] = args;\n  if (sub === 'bootstrap') {\n    const given = rest[1] ?? '';\n    const name = given.slice(given.lastIndexOf('/') + 1);\n    const label = name.endsWith('.plist') ? name.slice(0, -'.plist'.length) : '';\n    const shaped = rest.length === 2 && rest[0] === 'system' && labelOk(label);\n    if (!shaped) return 'bootstrap takes exactly `system /Library/LaunchDaemons/<label>.plist`';\n    const plist = daemonPlist(label, prefixes);\n    if (plist === undefined) return `bootstrap ${NO_DAEMON_PREFIX}`;\n    return given === plist ? undefined : `bootstrap loads only ${plist}, never another path`;\n  }\n  if (sub === 'bootout') {\n    const label = rest.length === 1 ? systemLabel(rest[0]) : undefined;\n    if (label === undefined) return 'bootout takes exactly `system/<label>`, never a bare domain';\n    /**\n     * ⚠️ WITHOUT THE PREFIX, A DELETE STOPS HALFWAY. deleteJob boots the job out, then removes its\n     *   plist; with /Library/LaunchDaemons undeclared the removal is refused AFTER the bootout, the\n     *   plist stays, and launchd loads the job again at the next boot. Refused here, nothing moves.\n     */\n    return daemonPlist(label, prefixes) === undefined ? `bootout ${NO_DAEMON_PREFIX}` : undefined;\n  }\n  if (sub === 'kickstart') {\n    const flags = rest.slice(0, -1);\n    const flagsOk =\n      flags.every((flag) => flag === '-k' || flag === '-p') && new Set(flags).size === flags.length;\n    return flagsOk && systemLabel(rest[rest.length - 1]) !== undefined\n      ? undefined\n      : 'kickstart takes only -k / -p, then `system/<label>`';\n  }\n  return `launchctl ${String(sub)} is never run as root`;\n};\n\nconst ID = /^\\d+$/;\n\n/** `install`'s optional owner flags: none, `-o N`, `-g N`, or `-o N -g N`. Numeric ids only. */\nconst idsOk = (ids: readonly string[]): boolean => {\n  const [flag, id, second, secondId] = ids;\n  if (ids.length === 0) return true;\n  if (ids.length === 2) return (flag === '-o' || flag === '-g') && ID.test(id ?? '');\n  return (\n    ids.length === 4 &&\n    flag === '-o' &&\n    ID.test(id ?? '') &&\n    second === '-g' &&\n    ID.test(secondId ?? '')\n  );\n};\n\n/** The one source `install` may copy and the prefixes, for the call being checked. */\nexport type AllowContext = { readonly prefixes: readonly string[]; readonly staged?: string };\n\n/** `undefined` when `argv` is exactly an allowed privileged shape, else the reason it is not. */\nexport const privilegedProblem = (\n  argv: readonly string[],\n  context: AllowContext,\n): string | undefined => {\n  const [program, ...args] = argv;\n  const under = (path: string | undefined) =>\n    path !== undefined && prefixOf(path, context.prefixes) !== undefined;\n  if (program === LAUNCHCTL) return launchctlProblem(args, context.prefixes);\n  if (program === INSTALL) {\n    // -S -m MODE [-o UID] [-g GID] STAGED DEST: nothing else, in this order.\n    const [safe, m, mode, ...rest] = args;\n    if (safe !== '-S' || m !== '-m' || mode === undefined || !/^[0-7]{4}$/.test(mode)) {\n      return 'install takes exactly `-S -m <4 octal digits> [-o <uid>] [-g <gid>] <staged> <dest>`';\n    }\n    if (rest.length < 2 || !idsOk(rest.slice(0, -2))) return 'install takes only -o <uid> -g <gid>';\n    const [source, dest] = rest.slice(-2);\n    if (source === undefined || source !== context.staged) {\n      return 'install copies only the file this runner staged';\n    }\n    return under(dest) ? undefined : 'install destination is not under a declared prefix';\n  }\n  if (program === RM) {\n    const [force, end, path, ...extra] = args;\n    return force === '-f' && end === '--' && extra.length === 0 && under(path)\n      ? undefined\n      : 'rm takes exactly `-f -- <path under a declared prefix>`';\n  }\n  return `${String(program)} is not on the sudo allowlist`;\n};\n\n/** Where one exec goes: run as the deploying user, run as root through the allowlist, or refused. */\nexport type Route =\n  | { readonly as: 'operator' }\n  | { readonly as: 'root' }\n  | { readonly refuse: string };\n\n/**\n * ★ WHY THIS REFUSES AS WELL AS ROUTES. sudoRunner reports `privileged: true`, which switches off\n *   the providers' own \"another user's gui domain needs root\" refusal (job-preflight.ts). This\n *   runner elevates only the system domain, so it gives that refusal back itself. (A write into\n *   another user's LaunchAgents is refused by the writer first: outside every prefix, a foreign\n *   owner needs root. This covers the delete, which reaches launchctl before any file.)\n * ⚠️ Reads (`print`, `print-disabled`) always run as the deploying user: launchctl(1) says anyone\n *   may read or query the system domain, and launchctl.ts measured it on 2026-09-21.\n */\nexport const routeExec = (argv: readonly string[], operatorUid: number): Route => {\n  const [program, sub] = argv;\n  if (program === 'sudo' || program?.endsWith('/sudo') === true) {\n    return {\n      refuse: 'sudoRunner never passes a sudo argv through; it elevates only its allowlist',\n    };\n  }\n  if (program !== LAUNCHCTL || sub === undefined || !WRITES.has(sub)) return { as: 'operator' };\n  const target = sub === 'kickstart' ? argv[argv.length - 1] : argv[2];\n  if (target === 'system' || target?.startsWith('system/') === true) return { as: 'root' };\n  const owner = /^(?:gui|user)\\/(\\d+)(?:\\/|$)/.exec(target ?? '')?.[1];\n  if (owner === undefined || Number(owner) === operatorUid) return { as: 'operator' };\n  return {\n    refuse:\n      `launchctl ${sub} ${String(target)}: that domain belongs to uid ${owner}, and sudoRunner ` +\n      'elevates only the system domain. Deploy as that user, or as root.',\n  };\n};\n",
+    "/**\n * What sudo's own failure means, for sudo-runner.ts: which exit-1 answers are sudo refusing to run\n * the command (so NOTHING ran as root), and what an EACCES outside every prefix most likely means.\n * Split out of sudo-runner.ts, which keeps only the runner.\n *\n * ⚠️ REASONED, NOT MEASURED: sudo's failure text. The kit never runs sudo. The strings below follow\n *   sudoers(5) for sudo 1.9.17p2 on macOS 27.2 (\"a password is required\": -n was given but a\n *   password was needed) and sudo(8) (sudo exits 1 when it fails itself).\n */\nimport { errnoCode } from './local-runner.ts';\nimport type { ExecResult } from './runner.ts';\nimport { SudoRefusedError } from './sudo-allowlist.ts';\n\n/**\n * ⚠️ ANCHORED TO sudo'S OWN MESSAGE FORMS (`sudo: …` lines, `Sorry, user …`), so a launchctl or\n *   install error that happens to say \"not allowed\" is never reported as \"the command did not run\".\n *   The refusals are the three a sudoers denial prints: the command not allowed, the user not in\n *   sudoers, and the user not allowed on this host (`<user> is not allowed to run sudo on <host>.`).\n *   REASONED from sudo 1.9's sudoers plugin, like the rest (header).\n */\nconst PASSWORD =\n  /^sudo: (?:a password is required|a terminal is required|sorry, you must have a tty)/m;\nconst NOT_ALLOWED =\n  /^(?:Sorry, user \\S+ (?:is not allowed to execute|may not run sudo)|\\S+ is not (?:in the sudoers file|allowed to run sudo on ))/m;\n\n/** ★ An EACCES outside every prefix is almost always a directory the stack forgot to declare. */\nexport const undeclared =\n  (path: string, prefixes: readonly string[]) =>\n  (cause: unknown): never => {\n    const code = errnoCode(cause);\n    if (code !== 'EACCES' && code !== 'EPERM') throw cause;\n    throw new Error(\n      `sudoRunner ${path}: ${code} as the deploying user, and the path is under no declared prefix ` +\n        `(${prefixes.join(', ')}). If root owns its directory, declare that directory as a prefix.`,\n      { cause },\n    );\n  };\n\n/**\n * The refusal sudo itself answered for `shown` (the argv as JSON), or `undefined` when the command\n * ran — whatever its own exit code. ★ `SudoRefusedError` always means nothing ran as root.\n */\nexport const sudoRefusal = (shown: string, result: ExecResult): SudoRefusedError | undefined => {\n  if (result.exitCode !== 1) return undefined;\n  if (PASSWORD.test(result.stderr)) {\n    return new SudoRefusedError(\n      `sudo -n ${shown}: a password is required, and this runner never prompts. Run \\`sudo -v\\` ` +\n        'in the deploying terminal just before the deploy, or grant exactly these commands ' +\n        'NOPASSWD (docs/launchd-sudo.md). The command did not run.',\n    );\n  }\n  if (NOT_ALLOWED.test(result.stderr)) {\n    return new SudoRefusedError(\n      `sudo -n ${shown}: sudoers does not let the deploying user run this. The command did not run.`,\n    );\n  }\n  return undefined;\n};\n",
+    "/**\n * The `mkdir` / `chmod` / `chown` / `rmdir` half of sudo-allowlist.ts, split out to keep that file\n * under the house's 250-line cap. These four are `Host.Directory`'s whole write surface\n * (directory-lifecycle.ts): this file fixes their argv to the EXACT shapes that file emits.\n *\n * ⛔ `chown` TAKES ONLY NUMERIC IDS, NEVER A NAME. `directory-lifecycle.ts`'s `ownerArg()` already\n *   resolves a name to a uid/gid before building argv, so a name here would mean some other code\n *   path built this argv — refused rather than trusted.\n * 🔴 MEASURED (adversarial review, 2026-09-23, against this file's first shipped version): NEITHER\n *   the mode nor the owner was checked for anything but shape. `mkdir -m 0777 -- <path>` and\n *   `chown 1001:1001 -- <path>` both passed the allowlist untouched. A stack could declare\n *   `HostDirectory({ path: '/etc/systemd/system/x.service.d', mode: 0o777 })`, drop a\n *   `ExecStart=` override into it, and the runner's own next `daemon-reload` + `restart` would run\n *   it as root — a local privilege escalation reachable through this runner's own allowlist, not a\n *   bug in the guard (which never runs against a path this permissive by design).\n * ⛔ SO: NO SPECIAL BITS, NO GROUP/OTHER WRITE, EVER — mirroring the file half's `modeProblem`\n *   (`../launchd/sudo-guard.ts`) but WITHOUT its \"handed to another owner\" exemption. A directory's\n *   OWNER always has write access through the owner bits alone, so no mode restriction can make a\n *   non-root-owned directory here safe — which is why `chown` below is refused to anything but\n *   root outright, not merely mode-restricted.\n * 🔴 MEASURED (adversarial review, round 2, 2026-09-23, cited against gnulib's `lib/userspec.c`,\n *   used by GNU `chown`): a purely-numeric owner string is looked up as a NAME first —\n *   `*u == '+' ? NULL : getpwnam(u)` — and only parsed as a raw number when no such account\n *   exists. If a host ever had a user or group literally NAMED `\"0\"`, `chown 0 -- path` would\n *   silently chown to THAT account, not uid 0 — bypassing this file's own root-only restriction\n *   without tripping it. `+` skips the name lookup outright (`if it starts with '+', skip the\n *   look-up`, `userspec.c`), so the allowlist now requires it: `sudo-allowlist.ts`'s\n *   `canonicalize()` rewrites the bare `0`/`:0`/`0:0` argv `directory-lifecycle.ts` actually sends\n *   into the forced-numeric form below before this check ever runs, so the unprivileged caller\n *   never has to know this syntax exists.\n */\nimport { prefixOf } from '../launchd/sudo-allowlist.ts';\n\nexport const MKDIR = '/usr/bin/mkdir';\nexport const CHMOD = '/usr/bin/chmod';\nexport const CHOWN = '/usr/bin/chown';\nexport const RMDIR = '/usr/bin/rmdir';\n\n/**\n * `mkdir -m` / `chmod`'s mode, exactly as `directory-lifecycle.ts`'s own `octal()` formats it:\n * `mode.toString(8).padStart(3, '0')` — 3 digits, or 4 when a special bit makes it longer.\n * Parsed to a number so the setuid/setgid/group/other-write bits can be checked directly, the same\n * mask `modeProblem` uses (`0o6000 | 0o022`).\n */\nconst parseDirMode = (text: string): number | undefined =>\n  /^([0-7]{3}|[1-7][0-7]{3})$/.test(text) ? Number.parseInt(text, 8) : undefined;\n\nconst DANGEROUS_MODE_BITS = 0o6022;\n\n/** `undefined` when `mode` is a safe directory mode: no setuid/setgid, no group/other write. */\nconst dirModeProblem = (mode: number | undefined): string | undefined => {\n  if (mode === undefined) return 'mode';\n  return (mode & DANGEROUS_MODE_BITS) !== 0\n    ? 'a mode with setuid/setgid or group/other write (this runner installs only 0–0o777 minus 0o022, no special bits)'\n    : undefined;\n};\n\n/**\n * `chown`'s owner argument — root only, and `+`-forced so a same-named account can never be\n * resolved instead of uid/gid `0`. `canonicalize()` builds these from the bare `0`/`:0`/`0:0`\n * `directory-lifecycle.ts`'s `ownerArg()` sends; this checks what actually reaches `sudo`.\n */\nconst ROOT_OWNER = /^(\\+0|:\\+0|\\+0:\\+0)$/;\n\nexport const dirProgramProblem = (\n  program: string,\n  args: readonly string[],\n  prefixes: readonly string[],\n): string | undefined => {\n  const under = (path: string | undefined) =>\n    path !== undefined && prefixOf(path, prefixes) !== undefined;\n  if (program === MKDIR) {\n    const [m, modeText, end, path, ...extra] = args;\n    const mode = modeText === undefined ? undefined : parseDirMode(modeText);\n    if (m !== '-m' || mode === undefined || end !== '--' || extra.length !== 0 || !under(path)) {\n      return 'mkdir takes exactly `-m <octal> -- <path under a declared prefix>`';\n    }\n    return dirModeProblem(mode);\n  }\n  if (program === CHMOD) {\n    const [modeText, end, path, ...extra] = args;\n    const mode = modeText === undefined ? undefined : parseDirMode(modeText);\n    if (mode === undefined || end !== '--' || extra.length !== 0 || !under(path)) {\n      return 'chmod takes exactly `<octal> -- <path under a declared prefix>`';\n    }\n    return dirModeProblem(mode);\n  }\n  if (program === CHOWN) {\n    const [owner, end, path, ...extra] = args;\n    return owner !== undefined &&\n      ROOT_OWNER.test(owner) &&\n      end === '--' &&\n      extra.length === 0 &&\n      under(path)\n      ? undefined\n      : 'chown takes exactly `+0`, `:+0` or `+0:+0` -- <path under a declared prefix>` — root ' +\n          'only, forced numeric; a directory this runner elevates never hands ownership to anyone else';\n  }\n  const [end, path, ...extra] = args;\n  return end === '--' && extra.length === 0 && under(path)\n    ? undefined\n    : 'rmdir takes exactly `-- <path under a declared prefix>`';\n};\n",
+    "/**\n * `chown`'s two privileged shapes, split out of sudo-allowlist.ts to keep it under the house's\n * 250-line cap: the ROOT-ONLY directory form (sudo-allowlist-dir.ts owns that check) and the\n * FILE-ownership form used only on the derived temp file `sudo-write.ts` `install`s into, for a\n * `RemoteFile` whose declared owner or group is not root.\n *\n * ⛔ `install`'S OWN `-o`/`-g` ARE NEVER USED, ON EITHER PLATFORM'S ALLOWLIST NOW. 🔴 MEASURED\n *   (adversarial review, round 2, 2026-09-23, against coreutils 9.7 `src/install.c` `get_ids()`):\n *   unlike `chown`, `install` does NOT go through gnulib's `+`-aware `userspec.c` at all — its own\n *   `get_ids()` calls `getpwnam(owner_name)` / `getgrnam(group_name)` FIRST for ANY string,\n *   falling back to `xstrtoumax` only when no such account exists, with no `+`-prefix escape of\n *   any kind. So `install -o 0` on a host with a user or group literally named `\"0\"` installs\n *   owned by THAT account, not uid 0 — and there is no argv shape that closes this for `install`\n *   itself. The fix is to never let `install` set ownership: it always runs with no `-o`/`-g` (so\n *   the fresh temp file lands owned by whoever `sudo` runs it as — root:root, with no name lookup\n *   at all, since omitting the flags skips `get_ids` entirely), and this file's `chown` shape sets\n *   the FINAL ownership afterward, on the same temp file, before `mv`. `chown` DOES support `+`\n *   (gnulib `userspec.c`: `*u == '+' ? NULL : getpwnam(u)`, \"if it starts with '+', skip the\n *   look-up\") — repeated on each side of a `user:group` spec independently — so this is where the\n *   fix actually lands: `+<uid>`, `:+<gid>`, or `+<uid>:+<gid>`, never a bare digit string.\n */\nimport { CHOWN, dirProgramProblem } from './sudo-allowlist-dir.ts';\n\n/** Bare `directory-lifecycle.ts` argv (`0`, `:0`, `0:0`, …) → the `+`-forced form sudo may run. */\nexport const forceNumericOwner = (spec: string): string => {\n  const [uidPart, gidPart] = spec.includes(':') ? spec.split(':') : [spec, undefined];\n  const uid = uidPart === undefined || uidPart === '' ? '' : `+${uidPart}`;\n  const gid = gidPart === undefined ? '' : `:+${gidPart}`;\n  return `${uid}${gid}`;\n};\n\n/** `+<uid>`, `:+<gid>`, or `+<uid>:+<gid>` — numeric, `+`-forced, either or both sides. */\nconst SAFE_OWNER = /^(\\+\\d+(:\\+\\d+)?|:\\+\\d+)$/;\n\n/**\n * `chown <safe spec> -- <temp>`, bound to the exact temp `install` just wrote — the file-ownership\n * half of `writeUnderPrefix`'s sequence. Any owner/group is allowed (a `RemoteFile` may declare\n * one), as long as it is numeric and forced; the temp binding is what stops it reaching anywhere\n * else, the same way `mv`'s own binding does.\n */\nconst fileChownProblem = (args: readonly string[], temp: string): string | undefined => {\n  const [owner, end, path, ...extra] = args;\n  if (\n    owner !== undefined &&\n    SAFE_OWNER.test(owner) &&\n    end === '--' &&\n    extra.length === 0 &&\n    path === temp\n  ) {\n    return undefined;\n  }\n  return (\n    'chown on the staged temp takes exactly `+<uid>`, `:+<gid>` or `+<uid>:+<gid>` -- ' +\n    '<the exact temp install just wrote>, numeric and +-forced'\n  );\n};\n\n/**\n * `chown`'s dispatch: a call bound to `context.temp` (its last argument equals it) is the\n * file-ownership form above; everything else is the directory form, root-only\n * (`sudo-allowlist-dir.ts`'s own `ROOT_OWNER`, `+`-forced the same way).\n */\nexport const chownProblem = (\n  args: readonly string[],\n  context: { readonly prefixes: readonly string[]; readonly temp?: string },\n): string | undefined => {\n  const path = args[args.length - 1];\n  if (context.temp !== undefined && path === context.temp)\n    return fileChownProblem(args, context.temp);\n  return dirProgramProblem(CHOWN, args, context.prefixes);\n};\n",
+    "/**\n * Everything sshSudoRunner may run as root, as exact argv shapes, plus the rule for which calls\n * need root at all. Pure: no I/O, so every shape is tested without ssh (sudo-allowlist.test.ts).\n * The Linux twin of `../launchd/sudo-allowlist.ts` — reused directly where the rule is generic\n * (prefixes, octal 4-digit modes, `SudoRefusedError`), rewritten where GNU coreutils and systemd\n * need a different shape than macOS's `install -S` and `launchctl`.\n *\n * ⛔ AN ALLOWLIST OF SHAPES, NOT OF PROGRAMS. `chown` unqualified would let a bug hand any file to\n *   any uid; `systemctl` unqualified would let `disable --global` reach every user's units. Each\n *   shape below fixes the flags, the operand count and (for install/mv) which paths may appear.\n * ⛔ `install` COPIES ONLY THE FILE THIS RUNNER STAGED, into ONLY the temp path this runner derived\n *   for the current write — never argv's own idea of either. Binding both stops a bug (or a future\n *   change) from turning this into \"install any file the operator can read to any path root can\n *   reach\".\n * ⛔ GNU `install` WRITES THROUGH ITS DESTINATION (ssh-scripts.ts's header), unlike macOS's, which\n *   stages and renames on its own. So there is no `-S`: this allowlist's `install` writes a FRESH\n *   temp file (never the live path), and only `mv` — a rename(2), atomic by construction — ever\n *   touches the path a provider declared.\n */\nimport { NAME as UNIT_NAME } from './unit-form.ts';\nimport {\n  INSTALL,\n  SUDO,\n  SudoRefusedError,\n  checkPrefixes,\n  octalMode,\n  prefixOf,\n} from '../launchd/sudo-allowlist.ts';\nimport { chownProblem, forceNumericOwner } from './sudo-allowlist-chown.ts';\nimport { CHMOD, CHOWN, MKDIR, RMDIR, dirProgramProblem } from './sudo-allowlist-dir.ts';\n\nexport { INSTALL, SUDO, SudoRefusedError, checkPrefixes, octalMode, prefixOf };\nexport { CHMOD, CHOWN, MKDIR, RMDIR } from './sudo-allowlist-dir.ts';\n\n/** ★ Absolute program paths, so neither sudo nor the command is looked up on the operator's PATH. */\nexport const MV = '/usr/bin/mv';\nexport const RM = '/usr/bin/rm';\nexport const SYSTEMCTL_ABS = '/usr/bin/systemctl';\n\n/** The bare names `directory-lifecycle.ts` and `systemctl.ts` already send through `exec()`. */\nexport const DIRECTORY_PROGRAMS: ReadonlySet<string> = new Set([\n  'mkdir',\n  'chmod',\n  'chown',\n  'rmdir',\n]);\nconst DIRECTORY_PROGRAMS_ABS: ReadonlySet<string> = new Set([MKDIR, CHMOD, CHOWN, RMDIR]);\nconst ABS_OF: Readonly<Record<string, string>> = {\n  chmod: CHMOD,\n  chown: CHOWN,\n  mkdir: MKDIR,\n  rmdir: RMDIR,\n  systemctl: SYSTEMCTL_ABS,\n};\n/**\n * The bare argv a provider sends → the absolute argv sudo may run. Unknown programs pass through.\n * ★ `chown`'s owner argument is ALSO rewritten here, to the `+`-forced form `sudo-allowlist-dir.ts`\n *   and `sudo-allowlist-chown.ts` now require — `directory-lifecycle.ts` never has to know that\n *   syntax exists, and the allowlist checks exactly what will actually reach `sudo`.\n */\nexport const canonicalize = (argv: readonly string[]): readonly string[] => {\n  const abs = ABS_OF[argv[0] ?? ''];\n  const program = abs ?? argv[0];\n  if (program === CHOWN) {\n    const [owner, ...rest] = argv.slice(1);\n    return [CHOWN, owner === undefined ? '' : forceNumericOwner(owner), ...rest];\n  }\n  return abs === undefined ? argv : [abs, ...argv.slice(1)];\n};\n\nconst dirOf = (path: string): string => path.slice(0, path.lastIndexOf('/')) || '/';\n\n/** The one source `install` may copy, the one temp `install`/`mv` may touch, and the prefixes. */\nexport type AllowContext = {\n  readonly prefixes: readonly string[];\n  readonly staged?: string;\n  readonly temp?: string;\n};\n\n/**\n * ⛔ NEVER `-o`/`-g` — see sudo-allowlist-chown.ts's header. `install` always writes the fresh temp\n *   owned by whoever `sudo` runs it as (root:root), with no name lookup at all; a non-root owner or\n *   group is set afterward by a separate, `+`-forced `chown` on that same temp, before `mv`.\n */\nconst installProblem = (args: readonly string[], context: AllowContext): string | undefined => {\n  const [m, mode, t, dd, source, dest, ...extra] = args;\n  if (\n    m !== '-m' ||\n    mode === undefined ||\n    !/^[0-7]{4}$/.test(mode) ||\n    t !== '-T' ||\n    dd !== '--' ||\n    extra.length !== 0\n  ) {\n    return 'install takes exactly `-m <4 octal digits> -T -- <staged> <temp>`';\n  }\n  if (source === undefined || source !== context.staged) {\n    return 'install copies only the file this runner staged';\n  }\n  if (dest === undefined || dest !== context.temp) {\n    return 'install writes only the derived temp path for this write';\n  }\n  return prefixOf(dest, context.prefixes) === undefined\n    ? 'install destination is not under a declared prefix'\n    : undefined;\n};\n\nconst mvProblem = (args: readonly string[], context: AllowContext): string | undefined => {\n  const [f, t, dd, source, dest] = args;\n  if (f !== '-f' || t !== '-T' || dd !== '--' || args.length !== 5) {\n    return 'mv takes exactly `-f -T -- <temp> <dest>`';\n  }\n  if (source === undefined || source !== context.temp) {\n    return 'mv moves only the temp path this runner just installed to';\n  }\n  if (dest === undefined || prefixOf(dest, context.prefixes) === undefined) {\n    return 'mv destination is not under a declared prefix';\n  }\n  return dirOf(source) === dirOf(dest)\n    ? undefined\n    : 'mv must stay inside the destination’s directory';\n};\n\nconst rmProblem = (args: readonly string[], context: AllowContext): string | undefined => {\n  const [force, end, path, ...extra] = args;\n  return force === '-f' &&\n    end === '--' &&\n    extra.length === 0 &&\n    path !== undefined &&\n    prefixOf(path, context.prefixes) !== undefined\n    ? undefined\n    : 'rm takes exactly `-f -- <path under a declared prefix>`';\n};\n\nconst BANNED_SYSTEMCTL_FLAGS: ReadonlySet<string> = new Set([\n  '--user',\n  '--global',\n  '-H',\n  '-M',\n  '--root',\n]);\nconst UNIT_WRITE_VERBS: ReadonlySet<string> = new Set([\n  'enable',\n  'disable',\n  'start',\n  'stop',\n  'restart',\n]);\n\nconst systemctlProblem = (\n  args: readonly string[],\n  prefixes: readonly string[],\n): string | undefined => {\n  if (args.some((arg) => BANNED_SYSTEMCTL_FLAGS.has(arg))) {\n    return 'systemctl --user/--global/-H/-M/--root is never run as root';\n  }\n  const [verb, ...rest] = args;\n  if (verb === 'daemon-reload')\n    return rest.length === 0 ? undefined : 'daemon-reload takes no operands';\n  if (verb !== undefined && UNIT_WRITE_VERBS.has(verb)) {\n    const [dd, unit, ...extra] = rest;\n    return dd === '--' && unit !== undefined && UNIT_NAME.test(unit) && extra.length === 0\n      ? undefined\n      : `${verb} takes exactly \\`-- <unit>\\``;\n  }\n  return `systemctl ${String(verb)} is never run as root`;\n};\n\n/** `undefined` when `argv` is exactly an allowed privileged shape, else the reason it is not. */\nexport const privilegedProblem = (\n  argv: readonly string[],\n  context: AllowContext,\n): string | undefined => {\n  const [program, ...args] = argv;\n  if (program === INSTALL) return installProblem(args, context);\n  if (program === MV) return mvProblem(args, context);\n  if (program === RM) return rmProblem(args, context);\n  if (program === SYSTEMCTL_ABS) return systemctlProblem(args, context.prefixes);\n  if (program === CHOWN) return chownProblem(args, context);\n  if (program === MKDIR || program === CHMOD || program === RMDIR) {\n    return dirProgramProblem(program, args, context.prefixes);\n  }\n  return `${String(program)} is not on the sudo allowlist`;\n};\n\n/** Where one exec goes: run as the operator, run as root through the allowlist, or refused. */\nexport type Route =\n  | { readonly as: 'operator' }\n  | { readonly as: 'root' }\n  | { readonly refuse: string };\n\n/**\n * ★ ROUTING NEVER TOUCHES THE HOST. mkdir/chmod/chown/rmdir go to root only under a declared\n *   prefix — outside one they run as the operator, who may well own that path (H3/rule 7).\n *   systemctl's write verbs always ATTEMPT root; the FragmentPath check that can still refuse one\n *   needs a host read, so it runs in the runner's `before` hook, not here.\n */\nexport const routeExec = (argv: readonly string[], prefixes: readonly string[]): Route => {\n  const [program, ...args] = argv;\n  if (program === 'sudo' || program?.endsWith('/sudo') === true) {\n    return {\n      refuse: 'sshSudoRunner never passes a sudo argv through; it elevates only its allowlist',\n    };\n  }\n  if (program === 'systemctl' || program === SYSTEMCTL_ABS) {\n    if (args.some((arg) => BANNED_SYSTEMCTL_FLAGS.has(arg))) {\n      return { refuse: 'sshSudoRunner refuses systemctl --user/--global/-H/-M/--root' };\n    }\n    const [verb] = args;\n    return verb === 'daemon-reload' || (verb !== undefined && UNIT_WRITE_VERBS.has(verb))\n      ? { as: 'root' }\n      : { as: 'operator' };\n  }\n  // ★ Both spellings route the same way — a caller that happened to pass the absolute program\n  //   (nothing in this repo does today) must not silently fall through to the operator branch.\n  if (DIRECTORY_PROGRAMS.has(program ?? '') || DIRECTORY_PROGRAMS_ABS.has(program ?? '')) {\n    const path = args[args.length - 1];\n    return path !== undefined && prefixOf(path, prefixes) !== undefined\n      ? { as: 'root' }\n      : { as: 'operator' };\n  }\n  return { as: 'operator' };\n};\n",
+    "/**\n * The ACL half of sudo-guard.ts: mode bits say a directory is root's alone, and an ACL can say\n * otherwise. On macOS an `allow add_file,add_subdirectory,delete_child` entry lets its holder swap\n * what lies under a root-owned `0755` directory — a symlink where the file was — between the\n * guard's lstat checks and the privileged call, exactly as group write would. An inheritable\n * `allow write` hands every file root installs there to its holder.\n *\n * ★ READ WITH `ls -lden`, AS THE OPERATOR — no sudo, and the same read at plan time and before the\n *   write. MEASURED 2026-09-21 on macOS 27.2: each entry prints on its own line after the path's,\n *   as ` 0: <qualifier> [inherited ]allow|deny <perms>`; `-n` makes the qualifier a UUID, never a\n *   name with a space in it. The `+` flag after the mode is NOT reliable — `@` (extended\n *   attributes) replaces it in the listing — so the entries are what is read.\n * ⚠️ A DENY ENTRY GRANTS NOTHING (macOS puts `everyone deny delete` on home folders), and an allow\n *   of read-only rights (`list`, `search`, `readattr` …) swaps nothing, so neither refuses.\n */\nimport type { HostRunner } from './runner.ts';\nimport { SudoRefusedError } from './sudo-allowlist.ts';\n\nexport const LS = '/bin/ls';\n\n/** Rights that let the holder add, remove, rename or re-permission what a directory holds. */\nconst WRITE_RIGHTS: ReadonlySet<string> = new Set([\n  'add_file',\n  'add_subdirectory',\n  'append',\n  'chown',\n  'delete',\n  'delete_child',\n  'write',\n  'writesecurity',\n]);\n\nconst ENTRY = /^\\s*\\d+:\\s+\\S+\\s+(?:inherited\\s+)?allow\\s+(\\S+)/;\n\n/** The allow entries in `ls -lden` output that grant a write right, as printed. */\nexport const aclGrants = (listing: string): string[] =>\n  listing\n    .split('\\n')\n    .filter((line) => {\n      const rights = ENTRY.exec(line)?.[1];\n      return rights !== undefined && rights.split(',').some((right) => WRITE_RIGHTS.has(right));\n    })\n    .map((line) => line.trim());\n\n/**\n * ⛔ Refuse when any directory in `chain` carries an ACL entry that lets someone write it, or when\n *   the ACLs cannot be read at all (fail closed). `path` names the file in the refusal.\n */\nexport const assertNoAclGrants = async (\n  base: HostRunner,\n  path: string,\n  chain: readonly string[],\n): Promise<void> => {\n  const listed = await base.exec([LS, '-lden', '--', ...chain]);\n  if (listed.exitCode !== 0) {\n    throw new SudoRefusedError(\n      `sudoRunner ${path}: could not read the ACLs of the directories from / down to it ` +\n        `(${LS} -lden exit ${String(listed.exitCode)}). Nothing ran as root.`,\n    );\n  }\n  const grants = aclGrants(listed.stdout);\n  if (grants.length === 0) return;\n  throw new SudoRefusedError(\n    `sudoRunner ${path}: a directory from / down to it carries an ACL that lets someone other ` +\n      `than root change what it holds (${grants.join('; ')}). Remove the entry (chmod -a), or ` +\n      'declare a prefix without one. Nothing ran as root.',\n  );\n};\n",
+    "/**\n * The mode/owner and read-back half of sudo-guard.ts, split out to keep that file under the\n * house's 250-line cap. `assertPlainPath` (path chain) stays there; this is \"is the mode/owner\n * safe, and can the deploying user read the result back\" — re-exported from sudo-guard.ts so\n * nothing importing from there has to know this file exists.\n */\nimport type { HostRunner, WriteOptions } from './runner.ts';\nimport { SudoRefusedError } from './sudo-allowlist.ts';\n\nconst refuse = (path: string, message: string): Error =>\n  new SudoRefusedError(`sudoRunner ${path}: ${message}`);\n\n/**\n * ⛔ A ROOT-OWNED FILE UNDER A PREFIX IS ROOT'S TO CHANGE, AND ONLY ROOT'S (decided 2026-09-21).\n *   Group- or world-writable, anyone in that class rewrites a file root installed — a daemon's\n *   config, a script a LaunchDaemon runs as root — which is root by another name. Setuid or setgid,\n *   it runs as root (or its group) for whoever executes it. install(1) would apply either, as root.\n * ★ Root-owned is an omitted owner (the runner installs as root under a prefix) or uid 0. A file\n *   handed to another user is that user's to change; the sticky bit changes nothing on a file.\n * 🔴 MEASURED (adversarial review, 2026-09-23, round 1): \"handed to another user\" checked only\n *   `uid`, never `gid`. `{ uid: 501, gid: 0, mode: 0o2775 }` — a setgid file owned by an\n *   unprivileged uid but GROUPED to root — passed untouched, because a non-zero uid alone skipped\n *   every check below. Fixed by also treating `gid: 0` as root-adjacent.\n * 🔴 MEASURED (adversarial review, round 2, same day): the round-1 fix still missed an OMITTED\n *   `gid`. `remote-file-plan.ts`'s `identity()` returns no `gid` key at all when a `RemoteFile`\n *   declares no `group`, so `{ uid: 501, mode: 0o2775 }` reaches this check with `gid: undefined`\n *   — neither `0` nor genuinely someone else's. `sudo-write.ts` then omits `-g` from `install`\n *   entirely, and GNU `install`, run as root via `sudo -n`, defaults an omitted `-g` to the\n *   INVOKING PROCESS's group — root's own — whenever the destination directory is not itself\n *   setgid (which none of this runner's declared prefixes are, measured in linux-host-measured.md).\n *   The file lands exactly as `{ uid: 501, gid: 0, mode: 0o2775 }` — the identical escalation the\n *   round-1 fix closed, reached by OMISSION instead of an explicit `group: 0`. So \"root-adjacent\"\n *   now also means an omitted `gid`: only a file with a genuinely non-root, EXPLICITLY GIVEN owner\n *   AND group is someone else's alone to make setuid/setgid or writable — an omission is never\n *   read as a safe default on either side, uid or gid.\n */\nexport const modeProblem = (options: WriteOptions): string | undefined => {\n  const rootAdjacent =\n    options.uid === undefined ||\n    options.uid === 0 ||\n    options.gid === undefined ||\n    options.gid === 0;\n  if (!rootAdjacent) return undefined;\n  const found: string[] = [];\n  if ((options.mode & 0o6000) !== 0) found.push('setuid/setgid');\n  if ((options.mode & 0o022) !== 0) found.push('writable by group or other');\n  if (found.length === 0) return undefined;\n  return `mode ${options.mode.toString(8).padStart(4, '0')} is ${found.join(' and ')} on a root-owned file`;\n};\n\n/**\n * POSIX read permission for one uid: owner class, else group class, else other. `undefined` when\n * only group membership could decide and the groups are unknown.\n * ⚠️ EXACTLY ONE CLASS APPLIES. A group member gets the group bits even when the other bits are\n *   wider (`0604` hides a file from its group), so \"other can read\" is not enough on its own.\n */\nexport const canRead = (\n  file: { readonly uid: number; readonly gid: number; readonly mode: number },\n  uid: number,\n  groups: readonly number[] | undefined,\n): boolean | undefined => {\n  if (uid === 0) return true;\n  if (file.uid === uid) return (file.mode & 0o400) !== 0;\n  const groupRead = (file.mode & 0o040) !== 0;\n  const otherRead = (file.mode & 0o004) !== 0;\n  // Membership cannot change the answer when both classes agree.\n  if (groupRead === otherRead) return groupRead;\n  if (groups === undefined) return undefined;\n  return groups.includes(file.gid) ? groupRead : otherRead;\n};\n\n/**\n * ⛔ REFUSE A FILE THE DEPLOYING USER COULD NOT READ BACK, before writing it. Both providers read\n *   every write back to verify it (host-file-lifecycle.ts, job-lifecycle.ts) and read it again at\n *   every plan, as the deploying user; this runner elevates writes, never reads. A root-only\n *   `0600` would be installed, then fail the read-back with EACCES and stay on disk with no state,\n *   so every later plan would fail too.\n * ★ An omitted owner is root (under a prefix the runner writes as root). An omitted group is the\n *   parent directory's, which is the group a new file gets on macOS.\n * ⚠️ Unknown groups never refuse: the read-back after the write stays the final judge.\n */\nexport const assertReadableBack = async (\n  base: HostRunner,\n  path: string,\n  options: WriteOptions,\n  groups: readonly number[] | undefined,\n): Promise<void> => {\n  const operator = base.effectiveUid();\n  const parent = path.slice(0, path.lastIndexOf('/')) || '/';\n  const gid = options.gid ?? (await base.stat(parent))?.gid ?? 0;\n  const file = { gid, mode: options.mode, uid: options.uid ?? 0 };\n  if (canRead(file, operator, groups) !== false) return;\n  throw refuse(\n    path,\n    `owner ${String(file.uid)}, group ${String(gid)}, mode ${file.mode.toString(8)} would hide it ` +\n      `from the deploying user (uid ${String(operator)}), who reads every file back. Declare a ` +\n      'mode that user can read, or deploy as root. Nothing was written.',\n  );\n};\n\n/**\n * The deploying user's groups, from `id -G`; `undefined` when that fails.\n * ⚠️ NOT process.getgroups(). MEASURED 2026-09-21 on macOS 27.2: getgroups() returned 16 groups\n *   where `id -G` returned 18, because macOS caps a process's own list at 16. A group past the\n *   16th would read as \"not a member\" and refuse a file the user can in fact read.\n */\nexport const operatorGroups = async (base: HostRunner): Promise<readonly number[] | undefined> => {\n  const result = await base.exec(['/usr/bin/id', '-G']);\n  const ids = result.stdout.trim().split(/\\s+/);\n  return result.exitCode === 0 && ids.every((id) => /^\\d+$/.test(id)) ? ids.map(Number) : undefined;\n};\n",
+    "/**\n * The checks sudo-runner.ts makes against the host, as the deploying user, before it runs anything\n * as root. sudo-allowlist.ts checks the argv; this checks what the paths in it actually are.\n *\n * ⛔ WHAT IS LOGGED IS WHAT IS WRITTEN. A symlinked directory under a prefix would make\n *   `install` or `rm`, running as root, act on a path the log never named. So every directory\n *   between the prefix and the file must be a real directory.\n * ⛔ EVERY DIRECTORY FROM THE PREFIX DOWN IS ROOT'S ALONE (decided 2026-09-21). A directory below\n *   the prefix that another user owns, or that group or other may write, lets that user swap what\n *   lies under it — a symlink where the file was — between these checks and the privileged call.\n *   So each one must be owned by root and not group/other-writable (rootOnlyProblem), exactly as\n *   the prefix itself must.\n * ⛔ AND EVERY DIRECTORY ABOVE THE PREFIX (red team, 2026-09-21). Whoever may write the prefix's\n *   parent may rename the prefix away and put a symlink in its place between these checks and the\n *   privileged call — the same swap one level up. So `/` down to the prefix's parent must be\n *   root-only too (a root-owned symlink among them, `/etc` -> `private/etc`, is root's own and is\n *   followed; its target is root's choice, and not walked).\n * ⛔ AND NO ACL THAT SAYS OTHERWISE (sudo-acl.ts): mode bits are not the whole answer on macOS.\n * ⚠️ These checks run before the privileged call, as the deploying user. They guard against a\n *   mistaken declaration and against every user but root; root itself could still change a path\n *   in that window.\n */\nimport type { FileStat, HostRunner, WriteOptions } from './runner.ts';\nimport { assertNoAclGrants } from './sudo-acl.ts';\nimport { SudoRefusedError } from './sudo-allowlist.ts';\nimport { assertReadableBack, modeProblem } from './sudo-guard-mode.ts';\n\nexport { assertReadableBack, canRead, modeProblem, operatorGroups } from './sudo-guard-mode.ts';\n\nconst refuse = (path: string, message: string): Error =>\n  new SudoRefusedError(`sudoRunner ${path}: ${message}`);\n\n/** The directories strictly between `prefix` and the file at `path`. */\nexport const betweenDirs = (prefix: string, path: string): string[] => {\n  const parts = path\n    .slice(prefix.length + 1)\n    .split('/')\n    .slice(0, -1);\n  return parts.map((_, index) => `${prefix}/${parts.slice(0, index + 1).join('/')}`);\n};\n\n/** The directories strictly above `prefix`: `/`, then each one down to the prefix's parent. */\nexport const aboveDirs = (prefix: string): string[] => {\n  const parts = prefix.split('/').slice(1, -1);\n  return ['/', ...parts.map((_, index) => `/${parts.slice(0, index + 1).join('/')}`)];\n};\n\n/**\n * What must be at `path` itself: a regular file, or (for a write or a remove) nothing yet.\n * ⚠️ A DIRECTORY AT THE DESTINATION IS THE TRAP: `install src dir` copies INTO the directory\n *   (install(1)), and install decides that with stat, so a symlink to a directory does the same.\n */\nexport type Expect = 'file' | 'file-or-absent';\n\n/**\n * ⛔ THE PREFIX, AND EVERY DIRECTORY BELOW IT ON THE WAY TO THE FILE, MUST BE A DIRECTORY ONLY ROOT\n *   CAN CHANGE, checked at every call rather than trusted from the declaration. A symlinked prefix makes root write wherever it points, which the\n *   log never names (`/opt/example` -> `/etc` turns a HostFile at `/opt/example/sudoers` into\n *   `/etc/sudoers`). A prefix another user owns or may write lets that user swap a directory below\n *   it for a symlink between this check and the privileged call.\n * ⚠️ lstat of the prefix itself: a symlink ABOVE it (`/etc` -> `/private/etc` on macOS) is the\n *   system's and is followed, as every path lookup does — when root owns it (aboveDirs).\n * ★ MEASURED 2026-09-21 on macOS 27.2 (`ls -ldn`): /Library/LaunchDaemons, /private/etc, /opt and\n *   /usr/local are uid 0, mode 0755, so the prefixes a host stack declares pass as they are.\n */\nconst rootOnlyProblem = (stat: FileStat | undefined): string | undefined => {\n  if (stat === undefined) return 'is missing';\n  if (stat.kind !== 'directory') return `is a ${stat.kind}, not a directory`;\n  if (stat.uid !== 0) return `is owned by uid ${String(stat.uid)}, not root`;\n  if ((stat.mode & 0o022) !== 0) {\n    return `is writable by group or other (mode ${stat.mode.toString(8).padStart(4, '0')})`;\n  }\n  return undefined;\n};\n\n/**\n * Refuse a prefix that is not a root-only directory, a symlink or a non-directory between the\n * prefix and `path`, and anything but a file at it.\n */\nexport const assertPlainPath = async (\n  base: HostRunner,\n  prefix: string,\n  path: string,\n  expect: Expect,\n): Promise<'file' | 'absent'> => {\n  const above = aboveDirs(prefix);\n  for (const [index, stat] of (await Promise.all(above.map((dir) => base.stat(dir)))).entries()) {\n    const up = stat?.kind === 'symlink' && stat.uid === 0 ? undefined : rootOnlyProblem(stat);\n    if (up !== undefined) {\n      throw refuse(\n        path,\n        `${String(above[index])}, above the declared prefix ${prefix}, ${up}. Whoever may change it ` +\n          'may swap the prefix itself; every directory from / down must be root-only. Nothing ran as root.',\n      );\n    }\n  }\n  const dirs = betweenDirs(prefix, path);\n  const [prefixStat, ...stats] = await Promise.all([prefix, ...dirs].map((dir) => base.stat(dir)));\n  const bad = rootOnlyProblem(prefixStat);\n  if (bad !== undefined) {\n    throw refuse(\n      path,\n      `the declared prefix ${prefix} ${bad}. Declare only a real directory that root owns and ` +\n        'only root may write. Nothing ran as root.',\n    );\n  }\n  for (const [index, stat] of stats.entries()) {\n    const dir = String(dirs[index]);\n    if (stat?.kind !== 'directory') {\n      throw refuse(\n        path,\n        `${dir} is ${stat === undefined ? 'missing' : `a ${stat.kind}`}; root ` +\n          'writes only through real directories under a declared prefix.',\n      );\n    }\n    const below = rootOnlyProblem(stat);\n    if (below !== undefined) {\n      throw refuse(\n        path,\n        `${dir} ${below}. Every directory from the prefix ${prefix} down to the file must be one ` +\n          'that root owns and only root may write. Nothing ran as root.',\n      );\n    }\n  }\n  await assertNoAclGrants(base, path, [...above, prefix, ...dirs]);\n  const target = await base.stat(path);\n  if (target === undefined && expect === 'file-or-absent') return 'absent';\n  if (target?.kind === 'file') return 'file';\n  throw refuse(path, `is ${target === undefined ? 'missing' : `a ${target.kind}`}, not a file`);\n};\n\n/**\n * Every check a write under `prefix` meets before anything is staged or run as root: the mode, the\n * path (assertPlainPath) and the read-back (assertReadableBack). ★ Reads only, as the deploying\n *   user — so sudoRunner's `checkWrite` runs it at PLAN time too, and a plan still never calls sudo.\n */\nexport const assertInstallable = async (\n  base: HostRunner,\n  prefix: string,\n  path: string,\n  options: WriteOptions,\n  groups: readonly number[] | undefined,\n): Promise<void> => {\n  const mode = modeProblem(options);\n  if (mode !== undefined) {\n    throw refuse(\n      path,\n      `${mode}. Declare a mode without those bits (0644, 0640, 0755), or give the file to its ` +\n        'real owner. Nothing ran as root.',\n    );\n  }\n  await assertPlainPath(base, prefix, path, 'file-or-absent');\n  await assertReadableBack(base, path, options, groups);\n};\n",
+    "/**\n * ONE READ OF `ls -ldn --` FOR A WHOLE LIST OF PATHS, parsed into the same FileStat the seam uses\n * plus the one thing `stat` cannot say on Linux: whether the path carries a POSIX ACL.\n *\n * ★ WHY `ls` AND NOT `stat`, AND WHY ONE CALL. The Mac guard lstats every directory from `/` down\n *   with a local syscall each; over ssh each of those is a TCP connection with no multiplexing\n *   (ssh-runner.ts), so a five-deep chain would be five handshakes per check and per plan. `ls -ldn`\n *   takes every path as an operand and answers in one connection, and its mode column carries the\n *   ACL flag the chain check needs anyway.\n * ★ MEASURED 2026-09-22, read-only over ssh, on two host classes — an unprivileged LXC container\n *   and a Proxmox VE node, both Debian 13 / coreutils 9.7, LANG=C, ssh user uid 1001 and 1000:\n *     $ ls -ldn / /etc /etc/systemd /etc/systemd/system /usr /usr/lib /usr/lib/systemd …\n *       drwxr-xr-x 18 0 0 4096 Sep 22 10:12 /etc          (all ten root:root 0755, no flag)\n *     $ ls -ld /var/log/journal\n *       drwxr-sr-x+ 3 root systemd-journal …              (the `+` IS the POSIX ACL flag here)\n *     $ ls -lden …  →  ls: invalid option -- 'e'          (the Mac's spelling does not exist)\n *     $ command -v getfacl  →  absent on both Debian classes (present on the NixOS class)\n *   ⛔ SO THE ACL SIGNAL IS THE `+` FLAG, NOT `getfacl`: the tool that would enumerate the entries\n *     is not installed on the hosts this runner is for, and a guard that shells out to a missing\n *     program and fails closed would refuse every write on them. `ls` is coreutils, always there.\n *   ⚠️ THE PRICE, STATED: we learn THAT a directory has an ACL, never WHAT it grants, so any ACL on\n *     the chain is a refusal — including a read-only one the Mac guard would allow. Fail closed and\n *     say so; the remedy is a prefix without one.\n * ⚠️ `.` in that column is an SELinux context, not an ACL, and is not a grant. `@` is macOS's.\n * ⛔ FAIL CLOSED ON ANYTHING WE DO NOT UNDERSTAND. A line that does not parse, a path that no line\n *   named, two lines for one path, or a non-zero exit is an error — never \"nothing is there\".\n */\nimport type { FileStat, HostRunner } from '../launchd/runner.ts';\nimport { SudoRefusedError } from '../launchd/sudo-allowlist.ts';\n\n/** What one `ls -ldn` line says: the lstat fields, plus whether the path carries an ACL. */\nexport type Listed = FileStat & { readonly acl: boolean };\n\nconst KINDS = new Map<string, FileStat['kind']>([\n  ['-', 'file'],\n  ['d', 'directory'],\n  ['l', 'symlink'],\n]);\n\n/**\n * `rwxr-x---` → 0o750, with the three special bits `ls` hides in the execute columns:\n * `s`/`S` = setuid (user) or setgid (group), `t`/`T` = sticky; the capital is the bit without\n * execute. ⚠️ Anything else in a column is a shape we do not know, and returns undefined.\n */\nexport const permBits = (perms: string): number | undefined => {\n  if (perms.length !== 9) return undefined;\n  let mode = 0;\n  for (const index of [0, 1, 2]) {\n    const at = index * 3;\n    const shift = 6 - at;\n    const [read, write, exec] = [perms[at], perms[at + 1], perms[at + 2]];\n    if ((read !== 'r' && read !== '-') || (write !== 'w' && write !== '-')) return undefined;\n    if (read === 'r') mode |= 0o4 << shift;\n    if (write === 'w') mode |= 0o2 << shift;\n    const [set, unset] = index === 2 ? ['t', 'T'] : ['s', 'S'];\n    if (exec === 'x' || exec === set) mode |= 0o1 << shift;\n    else if (exec !== '-' && exec !== unset) return undefined;\n    if (exec === set || exec === unset) mode |= 0o4000 >> index;\n  }\n  return mode;\n};\n\n/** `drwxr-xr-x+ 4 0 0 4096 Sep 22 10:12 /etc/systemd` — the tail holds the date and the name. */\nconst LINE = /^([-dlbcps])(\\S{9})([+.@]?)\\s+\\d+\\s+(\\d+)\\s+(\\d+)\\s+(\\d+)\\s+(.*)$/;\n\n/**\n * Match each line to the path that asked for it, by NAME rather than by position.\n * ⚠️ `ls` SORTS ITS OPERANDS, so the answers do not come back in the order they were asked; and a\n *   symlink's line ends `<path> -> <target>`, so it is not a suffix match either. The longest\n *   candidate wins, so a path that is a tail of another cannot steal its line.\n */\nconst nameOf = (tail: string, paths: readonly string[]): string | undefined =>\n  [...paths]\n    .sort((left, right) => right.length - left.length)\n    .find((path) => tail.endsWith(` ${path}`) || tail.includes(` ${path} -> `));\n\n/** Every requested path's entry, or `undefined` when the listing is not exactly that. */\nexport const parseListing = (\n  stdout: string,\n  paths: readonly string[],\n): Map<string, Listed> | undefined => {\n  const entries = new Map<string, Listed>();\n  for (const line of stdout.split('\\n').filter((text) => text.trim() !== '')) {\n    const match = LINE.exec(line);\n    if (match === null) return undefined;\n    const [, type, perms, flag, uid, gid, size, tail] = match;\n    const mode = permBits(perms ?? '');\n    const path = nameOf(tail ?? '', paths);\n    if (mode === undefined || path === undefined || entries.has(path)) return undefined;\n    entries.set(path, {\n      acl: flag === '+',\n      gid: Number(gid),\n      kind: KINDS.get(type ?? '') ?? 'other',\n      mode,\n      size: Number(size),\n      uid: Number(uid),\n    });\n  }\n  return entries.size === paths.length ? entries : undefined;\n};\n\n/**\n * Read every path in one call, as the deploying user — no sudo, the same read at plan time and\n * before the write. ⛔ Anything but a complete, understood listing is a SudoRefusedError: a chain\n *   we could not read is a chain we cannot say is root's alone.\n */\nexport const readListing = async (\n  base: HostRunner,\n  ls: string,\n  what: string,\n  paths: readonly string[],\n): Promise<Map<string, Listed>> => {\n  const result = await base.exec([ls, '-ldn', '--', ...paths]);\n  const entries = result.exitCode === 0 ? parseListing(result.stdout, paths) : undefined;\n  if (entries === undefined) {\n    throw new SudoRefusedError(\n      `sudoRunner ${what}: could not read ${paths.join(', ')} (${ls} -ldn exit ` +\n        `${String(result.exitCode)}: ${result.stderr.trim().slice(0, 200)}). Nothing ran as root.`,\n    );\n  }\n  return entries;\n};\n",
+    "/**\n * The checks sudo-runner.ts makes against the host, as the operator, before it runs a file or\n * directory operation as root. sudo-allowlist.ts checks the argv; this checks what the paths in\n * it actually are — the Linux twin of `../launchd/sudo-guard.ts`, rebuilt on `sudo-listing.ts`'s\n * ONE `ls -ldn` call instead of an lstat per directory, because ssh pays a handshake per call\n * (ssh-runner.ts: no multiplexing unless the caller opts in) where a local syscall pays nothing.\n *\n * ⛔ EVERY DIRECTORY FROM `/` DOWN TO THE FILE MUST BE ROOT'S ALONE, for the same reason the Mac\n *   guard insists on it: a directory anyone else may write lets them swap what lies under it — a\n *   symlink where the file was — between this read and the privileged call. A root-owned symlink\n *   ABOVE the prefix (Debian's merged-`/usr`, `/lib` -> `usr/lib`) is the system's own and is\n *   followed, exactly as `aboveDirs`/`betweenDirs` from the Mac guard already encode; a symlink AT\n *   or BELOW the prefix is refused outright — a write should never chase one there.\n * ⛔ THE ACL SIGNAL IS THE `+` FLAG ALONE (sudo-listing.ts header): `ls`, not `getfacl`, which is\n *   absent on the estate's Debian hosts. A directory that carries one is refused whatever it\n *   grants — the guard cannot tell a read-only entry from a write one, so it fails closed.\n */\nimport type { FileStat, HostRunner, WriteOptions } from '../launchd/runner.ts';\nimport {\n  aboveDirs,\n  assertReadableBack,\n  betweenDirs,\n  canRead,\n  modeProblem,\n  operatorGroups,\n} from '../launchd/sudo-guard.ts';\nimport { SudoRefusedError } from './sudo-allowlist.ts';\nimport { type Listed, readListing } from './sudo-listing.ts';\n\nexport { aboveDirs, assertReadableBack, betweenDirs, canRead, modeProblem, operatorGroups };\n\nconst refuse = (path: string, message: string): Error =>\n  new SudoRefusedError(`sshSudoRunner ${path}: ${message}`);\n\nconst rootOnlyProblem = (entry: Listed | undefined): string | undefined => {\n  if (entry === undefined) return 'is missing';\n  if (entry.kind !== 'directory') return `is a ${entry.kind}, not a directory`;\n  if (entry.uid !== 0) return `is owned by uid ${String(entry.uid)}, not root`;\n  if ((entry.mode & 0o022) !== 0) {\n    return `is writable by group or other (mode ${entry.mode.toString(8).padStart(4, '0')})`;\n  }\n  if (entry.acl) return 'carries a POSIX ACL this runner cannot verify the grants of (ls -ldn `+`)';\n  return undefined;\n};\n\n/** What must be at `path` itself, for the operation about to run there. */\nexport type ChainExpect = 'file' | 'file-or-absent' | 'directory' | 'absent';\n\n/**\n * ⚠️ NOT PART OF THE `ls -ldn` BATCH, on purpose — mirroring the Mac guard's own\n *   `assertPlainPath`, whose ACL check also excludes `path` itself (`assertNoAclGrants(base,\n *   path, [...above, prefix, ...dirs])`, never `path` in that list). `readListing`'s\n *   `parseListing` requires every requested path to have a line (sudo-listing.ts), so a target\n *   that is legitimately ABSENT — the common case for a create — would make the whole batched\n *   read look unparseable if it were included. A plain `stat` handles \"nothing there\" correctly.\n */\nconst targetProblem = (entry: FileStat | undefined, expect: ChainExpect): string | undefined => {\n  if (expect === 'absent')\n    return entry === undefined ? undefined : `already exists (a ${entry.kind})`;\n  if (entry === undefined) return expect === 'file-or-absent' ? undefined : 'is missing';\n  if (expect === 'file-or-absent')\n    return entry.kind === 'file' ? undefined : `is a ${entry.kind}, not a file`;\n  return entry.kind === expect ? undefined : `is a ${entry.kind}, not a ${expect}`;\n};\n\n/**\n * Refuse a prefix that is not root-only, a symlink or wrong kind between the prefix and `path`,\n * an ACL anywhere in the chain, or a target that is not what `expect` says. ONE `ls -ldn` for the\n * directory chain, plus one plain `stat` for the target (see `targetProblem`'s note on why they\n * are separate calls). ⚠️ Reads only, as the operator — so `checkWrite` runs this at plan time too.\n */\nexport const assertGuardedChain = async (\n  base: HostRunner,\n  prefix: string,\n  path: string,\n  expect: ChainExpect,\n): Promise<FileStat | undefined> => {\n  const above = aboveDirs(prefix);\n  const between = betweenDirs(prefix, path);\n  const chain = [...above, prefix, ...between];\n  const listed = await readListing(base, '/usr/bin/ls', path, chain);\n  for (const dir of above) {\n    const entry = listed.get(dir);\n    // ★ A root-owned symlink ABOVE the prefix is the system's own and is followed, as every path\n    //   lookup does; a symlink anywhere else in the chain is refused by rootOnlyProblem below.\n    const problem =\n      entry?.kind === 'symlink' && entry.uid === 0 ? undefined : rootOnlyProblem(entry);\n    if (problem !== undefined) {\n      throw refuse(\n        path,\n        `${dir}, above the declared prefix ${prefix}, ${problem}. Whoever may change it may swap ` +\n          'the prefix itself; every directory from / down must be root-only. Nothing ran as root.',\n      );\n    }\n  }\n  const prefixProblem = rootOnlyProblem(listed.get(prefix));\n  if (prefixProblem !== undefined) {\n    throw refuse(\n      path,\n      `the declared prefix ${prefix} ${prefixProblem}. Declare only a real directory that root ` +\n        'owns and only root may write. Nothing ran as root.',\n    );\n  }\n  for (const dir of between) {\n    const problem = rootOnlyProblem(listed.get(dir));\n    if (problem !== undefined) {\n      throw refuse(\n        path,\n        `${dir} ${problem}. Every directory from the prefix ${prefix} down to the file must be ` +\n          'one that root owns and only root may write. Nothing ran as root.',\n      );\n    }\n  }\n  const target = await base.stat(path);\n  const problem = targetProblem(target, expect);\n  if (problem !== undefined) throw refuse(path, `${problem}. Nothing ran as root.`);\n  return target;\n};\n\n/**\n * The mode/owner and read-back checks for a file write under `prefix`, plus the path chain.\n * ★ Reads only, as the operator — the same checks run at plan time (`checkWrite`) and before the\n *   install/mv pair. `expect` is `'file-or-absent'`: a write may create or replace.\n */\nexport const assertInstallable = async (\n  base: HostRunner,\n  prefix: string,\n  path: string,\n  options: WriteOptions,\n  groups: readonly number[] | undefined,\n): Promise<void> => {\n  const mode = modeProblem(options);\n  if (mode !== undefined) {\n    throw refuse(\n      path,\n      `${mode}. Declare a mode without those bits (0644, 0640, 0755), or give the file to its ` +\n        'real owner. Nothing ran as root.',\n    );\n  }\n  await assertGuardedChain(base, prefix, path, 'file-or-absent');\n  await assertReadableBack(base, path, options, groups);\n};\n",
+    "/**\n * `sshSudoRunner.exec()`'s root branch: the host reads that decide whether a routed-to-root\n * directory or systemctl call may actually elevate. Split out of sudo-runner.ts, which keeps only\n * the wiring. sudo-allowlist.ts's `routeExec` already decided root vs operator vs refuse from the\n * argv alone; this is the part that needs the host.\n *\n * ⛔ THE FragmentPath CHECK IS WHAT MAKES `pveproxy.service` UNREACHABLE. A vendor unit's file\n *   lives under `/usr/lib/systemd/system` or `/lib/systemd/system` — never a prefix this runner\n *   would declare — so `enable`/`start`/… on it is refused before sudo runs. A unit with NO file\n *   at all (FragmentPath empty) is let through for `stop`/`disable` only, because\n *   `unit-lifecycle.ts` `deleteUnit` calls exactly those two on a unit whose file this same\n *   delete already removed a moment before — refusing that would make a second, idempotent\n *   delete pass fail.\n * 🔴 MEASURED (adversarial review, round 2, 2026-09-23): two gaps in this check, both closed here.\n *   (1) A MASKED unit (`systemctl mask`, a symlink to `/dev/null`) also reads `FragmentPath=`\n *   empty, so `enable`/`start`/`restart` on a masked `pveproxy.service` would have elevated —\n *   `systemctl` itself would then refuse the write, but nothing here should even try; masking is\n *   someone's deliberate decision (`unit-preflight.ts`'s `assertUsable` already refuses it at the\n *   PROVIDER layer, and this is the same rule enforced again at the lowest level, in case a\n *   caller reaches `exec()` directly). (2) The empty-FragmentPath exemption applied to EVERY\n *   write verb, not just the two `deleteUnit` actually needs — so `enable`/`start`/`restart` on a\n *   kernel-generated pseudo-unit with no file at all (`init.scope`, a `session-N.scope`; `.scope`\n *   is a valid type in `unit-form.ts`'s `TYPES` set) would also have elevated. Grepped: no code\n *   in this package ever calls `enable`/`start`/`restart` on a unit it has not itself just\n *   written a file for, so narrowing the exemption to `stop`/`disable` costs nothing legitimate.\n */\nimport type { ExecResult, HostRunner } from '../launchd/runner.ts';\nimport { SYSTEMCTL_ABS, SudoRefusedError, canonicalize, prefixOf } from './sudo-allowlist.ts';\nimport { type ChainExpect, assertGuardedChain } from './sudo-guard.ts';\nimport type { Elevate } from './sudo-write.ts';\nimport { parseShow } from './systemctl.ts';\n\nconst DIR_EXPECT: Readonly<Record<string, ChainExpect>> = {\n  chmod: 'directory',\n  chown: 'directory',\n  mkdir: 'absent',\n  rmdir: 'directory',\n};\n\n/** The only two verbs `deleteUnit` ever sends against a unit whose file may already be gone. */\nconst EMPTY_FRAGMENT_OK: ReadonlySet<string> = new Set(['stop', 'disable']);\n\nconst unitStatusOf = async (\n  base: HostRunner,\n  unit: string,\n): Promise<{ readonly fragmentPath: string; readonly loadState: string }> => {\n  const result = await base.exec([\n    SYSTEMCTL_ABS,\n    'show',\n    '--no-pager',\n    '-p',\n    'FragmentPath,LoadState',\n    '--',\n    unit,\n  ]);\n  if (result.exitCode !== 0) {\n    throw new SudoRefusedError(\n      `sshSudoRunner ${unit}: could not read FragmentPath/LoadState (systemctl show exit ` +\n        `${String(result.exitCode)}). Nothing ran as root.`,\n    );\n  }\n  const fields = parseShow(result.stdout);\n  return {\n    fragmentPath: fields.get('FragmentPath') ?? '',\n    loadState: fields.get('LoadState') ?? '',\n  };\n};\n\n/** `argv` has already been routed to root; canonicalise it and run the read this shape needs. */\nexport const elevatedExec = (\n  base: HostRunner,\n  elevate: Elevate,\n  prefixes: readonly string[],\n  argv: readonly string[],\n): Promise<ExecResult> => {\n  const canonical = canonicalize(argv);\n  const expect = DIR_EXPECT[argv[0] ?? ''];\n  if (expect !== undefined) {\n    const path = argv[argv.length - 1] ?? '';\n    const prefix = prefixOf(path, prefixes);\n    return elevate(canonical, {}, async () => {\n      // ★ routeExec already required a prefix to route here; this re-derives it rather than\n      //   trust the caller, so a future routing bug fails the guard instead of skipping it.\n      if (prefix === undefined) {\n        throw new SudoRefusedError(\n          `sshSudoRunner ${path}: not under a declared prefix. Nothing ran as root.`,\n        );\n      }\n      await assertGuardedChain(base, prefix, path, expect);\n    });\n  }\n  if (canonical[0] !== SYSTEMCTL_ABS || canonical[1] === 'daemon-reload') return elevate(canonical);\n  const verb = canonical[1] ?? '';\n  const unit = canonical[3] ?? '';\n  return elevate(canonical, {}, async () => {\n    const { fragmentPath, loadState } = await unitStatusOf(base, unit);\n    if (loadState === 'masked') {\n      throw new SudoRefusedError(\n        `sshSudoRunner ${unit}: is masked. Masking is someone's decision, not drift; unmask it ` +\n          'deliberately, then redeploy. Nothing ran as root.',\n      );\n    }\n    if (fragmentPath === '') {\n      if (EMPTY_FRAGMENT_OK.has(verb)) return;\n      throw new SudoRefusedError(\n        `sshSudoRunner ${unit}: has no unit file (FragmentPath empty), and ${verb} is not ` +\n          'stop/disable — refusing rather than run it against whatever systemd currently thinks ' +\n          `${unit} is (a kernel-generated unit, say). Nothing ran as root.`,\n      );\n    }\n    if (prefixOf(fragmentPath, prefixes) === undefined) {\n      throw new SudoRefusedError(\n        `sshSudoRunner ${unit}: FragmentPath ${fragmentPath} is outside every declared prefix ` +\n          `(${prefixes.join(', ')}); refusing to touch a unit this runner does not own. Nothing ran as root.`,\n      );\n    }\n  });\n};\n",
+    "/**\n * Where sudo-runner.ts puts a file's bytes before `install` copies them into a fresh temp file\n * that `mv` then renames into place. The Linux twin of `../launchd/sudo-stage.ts` — rewritten,\n * not reused, because staging happens ON THE REMOTE HOST through the base runner's own calls,\n * never through `node:fs` against this process's local disk.\n *\n * ★ WHY STAGE AT ALL. The operator cannot write inside a root-owned directory, and the bytes must\n *   not travel through argv (they would reach the log and `ps`). So they are written, as the\n *   operator, to a private file on the SAME host, and `install` copies that one file.\n * ⛔ A 0700 DIRECTORY, A 0600 FILE: between the write and the install, nobody but the operator and\n *   root can read the bytes or swap the file. `mktemp -d` creates its directory 0700 by\n *   construction (GNU coreutils); the payload's own mode is asked for explicitly.\n */\nimport type { HostRunner } from '../launchd/runner.ts';\n\n/** A file staged for `install`, and how to remove it again. */\nexport type Staged = { readonly path: string; readonly dispose: () => Promise<void> };\n\nconst refuse = (message: string): Error => new Error(`sshSudoRunner stage: ${message}`);\n\n/** `stage` in `SshSudoDeps` — closes over the base runner so every call writes to the same host. */\nexport const stageRemote =\n  (base: HostRunner) =>\n  async (bytes: Uint8Array): Promise<Staged> => {\n    const made = await base.exec(['/usr/bin/mktemp', '-d']);\n    if (made.exitCode !== 0)\n      throw refuse(`mktemp -d -> ${String(made.exitCode)}: ${made.stderr.trim()}`);\n    const dir = made.stdout.trim();\n    if (dir === '' || !dir.startsWith('/')) {\n      throw refuse(`mktemp -d printed ${JSON.stringify(made.stdout)}, not an absolute path`);\n    }\n    const dispose = async () => {\n      const removed = await base.exec(['/usr/bin/rm', '-rf', '--', dir]);\n      // ⚠️ Best-effort: a leaked 0700 temp dir the operator owns is a nuisance, never a secret\n      //   exposure, so disposal failing never masks the write's own success or failure.\n      if (removed.exitCode !== 0) {\n        process.stderr.write(\n          `sshSudoRunner: could not remove staging dir ${dir}: ${removed.stderr.trim()}\\n`,\n        );\n      }\n    };\n    try {\n      const path = `${dir}/staged`;\n      await base.writeFileAtomic(path, bytes, { mode: 0o600 });\n      return { dispose, path };\n    } catch (cause) {\n      await dispose();\n      throw cause;\n    }\n  };\n",
+    "/**\n * sshSudoRunner's `writeFileAtomic`, split out of sudo-runner.ts so that file stays the wiring.\n *\n * ⛔ WHY NOT `install` STRAIGHT TO `path`, THE WAY THE MAC RUNNER DOES. GNU `install` opens the\n *   destination and writes THROUGH it (ssh-scripts.ts's header); there is no macOS-style stage-\n *   and-rename built in. So this stages the bytes, `install`s them into a FRESH temp file in the\n *   destination's own directory (fresh, so \"writes through\" changes nothing that mattered), then\n *   `mv`s that temp file onto `path` — rename(2), same directory, so the swap is atomic and never\n *   torn, exactly what `ssh-scripts.ts writeScript` already does for the unprivileged case.\n * ⛔ `install` NEVER TAKES `-o`/`-g` — see sudo-allowlist-chown.ts's header (coreutils' own\n *   `get_ids()` has no way to force numeric ids, unlike `chown`). It always installs owned by\n *   whoever `sudo` runs it as; a non-root owner or group is set afterward by a separate,\n *   `+`-forced `chown` on that same temp file, before `mv`.\n * ⛔ THE DERIVED TEMP IS VERIFIED ABSENT, AS THE OPERATOR, BEFORE `install` RUNS. A 12-hex-char\n *   collision is astronomically unlikely, but \"unlikely\" is not the bar a privileged write is held\n *   to elsewhere in this runner, and the check costs one `stat` this runner already knows how to do.\n * ⛔ ON ANY FAILURE AFTER `install` SUCCEEDS, THE TEMP IS REMOVED (also as root, since only root\n *   can now touch it). A left-behind `.foo.hf-xxxx.tmp` would read, on the next plan, as an extra\n *   file under the prefix that guard would find and no code would explain — and if THAT cleanup\n *   itself fails, the thrown error says so and names the path, rather than silently swallowing it.\n */\nimport { randomBytes } from 'node:crypto';\nimport type { ExecResult, HostRunner, WriteOptions } from '../launchd/runner.ts';\nimport { CHOWN, INSTALL, MV, RM, SudoRefusedError, octalMode, prefixOf } from './sudo-allowlist.ts';\nimport { assertInstallable, operatorGroups } from './sudo-guard.ts';\nimport type { Staged } from './sudo-stage.ts';\n\nconst basename = (path: string): string => path.slice(path.lastIndexOf('/') + 1);\nconst dirOf = (path: string): string => path.slice(0, path.lastIndexOf('/')) || '/';\n\n/** `<dir>/.<basename>.hf-<12 hex>.tmp`, in `dest`'s own directory — never anywhere else. */\nexport const deriveTemp = (dest: string): string =>\n  `${dirOf(dest)}/.${basename(dest)}.hf-${randomBytes(6).toString('hex')}.tmp`;\n\n/** What one privileged call, already checked against the allowlist, comes back as when it fails. */\nconst mustSucceed = (result: ExecResult, argv: readonly string[]): void => {\n  if (result.exitCode !== 0) {\n    throw new Error(\n      `sudo -n ${JSON.stringify(argv)} -> ${String(result.exitCode)}: ${result.stderr.trim().slice(0, 300)}`,\n    );\n  }\n};\n\n/**\n * The cleanup `rm`'s own failure, for the merged error below. 🔴 MEASURED (adversarial review,\n *   round 3, 2026-09-23): a plain `ExecResult` (the shape `elevate()` resolves with for a command\n *   that RAN but exited non-zero) has no useful `toString()` — `String(cleaned)` printed\n *   `[object Object]`, silently dropping the one thing an operator doing manual cleanup needs:\n *   what `rm` actually said. A thrown `Error` (a refused or transport-failed `rm`) still prints\n *   its own message correctly, so only the `ExecResult` shape needed a name.\n */\nconst describeCleanupFailure = (cleaned: unknown): string => {\n  if (\n    typeof cleaned === 'object' &&\n    cleaned !== null &&\n    'exitCode' in cleaned &&\n    'stderr' in cleaned\n  ) {\n    const result = cleaned as ExecResult;\n    return `exit ${String(result.exitCode)}: ${result.stderr.trim().slice(0, 300)}`;\n  }\n  return cleaned instanceof Error ? cleaned.message : String(cleaned);\n};\n\n/** A privileged call: allowlisted, logged, run. Shared with sudo-runner.ts's own exec() routing. */\nexport type Elevate = (\n  argv: readonly string[],\n  context?: { readonly staged?: string; readonly temp?: string },\n  before?: () => Promise<unknown>,\n) => Promise<ExecResult>;\n\n/**\n * Plan-time and write-time share this: valid mode, the path chain, mode/owner refusals and the\n * read-back — everything a write can be refused for before anything is staged or run as root.\n * `undefined` outside every prefix, where the caller falls back to `base` directly.\n */\nexport const vetWrite = async (\n  base: HostRunner,\n  prefixes: readonly string[],\n  path: string,\n  options: WriteOptions,\n): Promise<{ readonly mode: string; readonly prefix: string } | undefined> => {\n  const prefix = prefixOf(path, prefixes);\n  if (prefix === undefined) return undefined;\n  const mode = octalMode(options.mode);\n  if (mode === undefined)\n    throw new SudoRefusedError(`sshSudoRunner ${path}: mode must be 0–0o7777`);\n  const groups = await operatorGroups(base);\n  await assertInstallable(base, prefix, path, options, groups);\n  return { mode, prefix };\n};\n\n/** `+<uid>`, `:+<gid>`, or `+<uid>:+<gid>` — omitted sides leave that half of ownership alone. */\nconst safeOwnerSpec = (uid: number | undefined, gid: number | undefined): string =>\n  `${uid === undefined ? '' : `+${uid}`}${gid === undefined ? '' : `:+${gid}`}`;\n\n/**\n * A non-root owner or group, when one was declared: `install` leaves the temp root:root (see the\n * file header), so this is the ONLY call that can hand it to someone else. `undefined` from either\n * side when that half already matches `install`'s own default (0/omitted), so a plain root-owned\n * write costs nothing extra here.\n */\nconst chownNeeded = (\n  options: WriteOptions,\n): { readonly uid?: number; readonly gid?: number } | undefined => {\n  const uid = options.uid !== undefined && options.uid !== 0 ? options.uid : undefined;\n  const gid = options.gid !== undefined && options.gid !== 0 ? options.gid : undefined;\n  return uid === undefined && gid === undefined\n    ? undefined\n    : { ...(uid === undefined ? {} : { uid }), ...(gid === undefined ? {} : { gid }) };\n};\n\n/**\n * Stage, `install` into a fresh temp file beside `path`, `chown` it if a non-root owner was\n * declared, `mv` it into place. Cleans up the temp on a failed `mv`, and always disposes the\n * stage — whether or not the write succeeded.\n */\nexport const writeUnderPrefix = async (\n  base: HostRunner,\n  elevate: Elevate,\n  stage: (bytes: Uint8Array) => Promise<Staged>,\n  path: string,\n  bytes: Uint8Array,\n  options: WriteOptions,\n  mode: string,\n): Promise<void> => {\n  const temp = deriveTemp(path);\n  const staged = await stage(bytes);\n  try {\n    const installArgv = [INSTALL, '-m', mode, '-T', '--', staged.path, temp];\n    const before = async () => {\n      const existing = await base.stat(temp);\n      if (existing !== undefined) {\n        throw new SudoRefusedError(\n          `sshSudoRunner ${temp}: already exists (a ${existing.kind}); refusing to install over ` +\n            'it. Nothing ran as root.',\n        );\n      }\n    };\n    mustSucceed(await elevate(installArgv, { staged: staged.path, temp }, before), installArgv);\n    try {\n      const owner = chownNeeded(options);\n      if (owner !== undefined) {\n        const chownArgv = [CHOWN, safeOwnerSpec(owner.uid, owner.gid), '--', temp];\n        mustSucceed(await elevate(chownArgv, { temp }), chownArgv);\n      }\n      const mvArgv = [MV, '-f', '-T', '--', temp, path];\n      mustSucceed(await elevate(mvArgv, { temp }), mvArgv);\n    } catch (cause) {\n      const rmArgv = [RM, '-f', '--', temp];\n      const cleaned = await elevate(rmArgv, { temp })\n        .then((result) => (result.exitCode === 0 ? undefined : result))\n        .catch((rmCause: unknown) => rmCause);\n      if (cleaned !== undefined) {\n        throw new Error(\n          `${cause instanceof Error ? cause.message : String(cause)} — AND removing the leftover ` +\n            `temp ${temp} also failed (${describeCleanupFailure(cleaned)}); it needs manual ` +\n            'cleanup as root.',\n          { cause },\n        );\n      }\n      throw cause;\n    }\n  } finally {\n    await staged.dispose();\n  }\n};\n",
+    "/**\n * sshSudoRunner(): the Linux twin of `../launchd/sudo-runner.ts` — the same idea (the deploy runs\n * as the operator, and only a fixed allowlist of calls goes through `sudo -n`), rebuilt for a\n * non-root ssh user with passwordless sudo instead of a local macOS session. See\n * docs/linux-sudo.md for the full argv table and what is measured versus reasoned.\n *\n * ⛔ `sudo -n`, NEVER A PROMPT — same rule, same reason: a deploy that stops to ask for a password\n *   is the \"no silent sudo\" failure this exists to prevent.\n * ⛔ EVERY PRIVILEGED ARGV IS LOGGED BEFORE IT RUNS, and a file's bytes never reach argv or the\n *   log: they travel through the staged file (sudo-stage.ts) alone.\n * ⛔ A PLAN NEVER ELEVATES. `checkWrite` and every read run through `base` — the plain\n *   `sshRunner()` — never through sudo. Nothing here probes sudo at construction.\n * ★ PROMISES, NOT EFFECTS, ON PURPOSE — the same divergence `../launchd/runner.ts` documents\n *   (H3 in the provider-standard skill): a consumer's own runner is a plain async implementation.\n */\nimport type { HostRunner } from '../launchd/runner.ts';\nimport { sudoRefusal } from '../launchd/sudo-said.ts';\nimport { type SshRunnerOptions, sshRunner } from './ssh-runner.ts';\nimport { elevatedExec } from './sudo-exec.ts';\nimport {\n  CHMOD,\n  CHOWN,\n  INSTALL,\n  MKDIR,\n  MV,\n  RM,\n  RMDIR,\n  SUDO,\n  SYSTEMCTL_ABS,\n  SudoRefusedError,\n  checkPrefixes,\n  prefixOf,\n  privilegedProblem,\n  routeExec,\n} from './sudo-allowlist.ts';\nimport { assertGuardedChain } from './sudo-guard.ts';\nimport { type Staged, stageRemote } from './sudo-stage.ts';\nimport { type Elevate, vetWrite, writeUnderPrefix } from './sudo-write.ts';\n\nexport { SudoRefusedError };\n\nexport type SshSudoRunnerOptions = SshRunnerOptions & {\n  /** Directories root may write under. Required; absolute, normalised, never `/`. */\n  readonly prefixes: readonly string[];\n  /** One line per privileged argv, before it runs. @default a line on stderr */\n  readonly log?: (line: string) => void;\n};\n\n/** What a sudo runner is built from. ★ Split out so the tests swap the host, never the logic. */\nexport type SshSudoDeps = {\n  /** Runs everything, including `sudo` itself. `await sshRunner(options)` for the real one. */\n  readonly base: HostRunner;\n  readonly stage: (bytes: Uint8Array) => Promise<Staged>;\n  readonly log: (line: string) => void;\n};\n\nconst outsidePrefixHint =\n  (path: string, prefixes: readonly string[]) =>\n  (cause: unknown): never => {\n    const message = cause instanceof Error ? cause.message : String(cause);\n    if (!/permission denied|operation not permitted/i.test(message)) throw cause;\n    throw new Error(\n      `sshSudoRunner ${path}: the operator could not do this, and the path is under no declared ` +\n        `prefix (${prefixes.join(', ')}). If root owns its directory, declare that directory as ` +\n        'a prefix.',\n      { cause },\n    );\n  };\n\nexport const makeSshSudoRunner = (prefixList: readonly string[], deps: SshSudoDeps): HostRunner => {\n  const prefixes = checkPrefixes(prefixList);\n  const { base } = deps;\n\n  /** ⛔ THE ONE PLACE `sudo` IS SPAWNED: allowlist, then any host check (`before`), then the log\n   *    line, then `sudo -n -- argv`. Shared by exec()'s root branch and by writeFileAtomic. */\n  const elevate: Elevate = async (argv, context, before) => {\n    const shown = JSON.stringify(argv);\n    const problem = privilegedProblem(argv, { prefixes, ...context });\n    if (problem !== undefined)\n      throw new SudoRefusedError(`sshSudoRunner refused ${shown}: ${problem}`);\n    await before?.();\n    deps.log(`homeflare/linux sudo -n ${shown}`);\n    const result = await base.exec([SUDO, '-n', '--', ...argv]);\n    const refused = sudoRefusal(shown, result);\n    if (refused !== undefined) throw refused;\n    return result;\n  };\n\n  return {\n    checkWrite: async (path, options) => {\n      await vetWrite(base, prefixes, path, options);\n    },\n    effectiveUid: () => base.effectiveUid(),\n    exec: async (argv) => {\n      const route = routeExec(argv, prefixes);\n      if ('refuse' in route) throw new SudoRefusedError(`sshSudoRunner: ${route.refuse}`);\n      if (route.as === 'operator') return base.exec(argv);\n      return elevatedExec(base, elevate, prefixes, argv);\n    },\n    lookupGroup: (nameOrId) => base.lookupGroup(nameOrId),\n    lookupUser: (nameOrId) => base.lookupUser(nameOrId),\n    privileged: true,\n    readFile: (path) => base.readFile(path),\n    removeFile: async (path) => {\n      const prefix = prefixOf(path, prefixes);\n      if (prefix === undefined)\n        return base.removeFile(path).catch(outsidePrefixHint(path, prefixes));\n      // ★ Nothing there is success without a privileged call, so an idempotent delete logs nothing.\n      const target = await assertGuardedChain(base, prefix, path, 'file-or-absent');\n      if (target === undefined) return;\n      const argv = [RM, '-f', '--', path];\n      const result = await elevate(argv);\n      if (result.exitCode !== 0) {\n        throw new Error(\n          `sudo -n ${JSON.stringify(argv)} -> ${String(result.exitCode)}: ${result.stderr.trim().slice(0, 300)}`,\n        );\n      }\n    },\n    sleep: (ms) => base.sleep(ms),\n    stat: (path) => base.stat(path),\n    writeFileAtomic: async (path, bytes, options) => {\n      const vetted = await vetWrite(base, prefixes, path, options);\n      if (vetted === undefined) {\n        return base.writeFileAtomic(path, bytes, options).catch(outsidePrefixHint(path, prefixes));\n      }\n      await writeUnderPrefix(base, elevate, deps.stage, path, bytes, options, vetted.mode);\n    },\n  };\n};\n\nconst REQUIRED_PROGRAMS = [SUDO, INSTALL, MV, RM, MKDIR, CHMOD, CHOWN, RMDIR, SYSTEMCTL_ABS];\n\n/**\n * ★ READ-ONLY, OPTIONAL. One combined `test -x` so a missing coreutils package or a systemd-free\n *   container fails at construction with a clear message, instead of at the first deploy step\n *   that happens to need it. Never probes sudo itself.\n */\nconst checkProgramsExist = async (base: HostRunner, host: string): Promise<void> => {\n  const script = REQUIRED_PROGRAMS.map(\n    (p) => `test -x '${p}' || { echo \"$0: ${p}\"; exit 1; }`,\n  ).join(' && ');\n  const result = await base.exec(['/bin/sh', '-c', script, 'sshSudoRunner']);\n  if (result.exitCode !== 0) {\n    throw new Error(\n      `sshSudoRunner ${host}: ${result.stdout.trim() || result.stderr.trim()} is missing or not ` +\n        'executable on this host. sshSudoRunner sends absolute GNU coreutils and systemd paths.',\n    );\n  }\n};\n\n/** The real sudo runner: `sshRunner()` for everything, `/usr/bin/sudo -n` for the allowlist. */\nexport const sshSudoRunner = async (options: SshSudoRunnerOptions): Promise<HostRunner> => {\n  const base = await sshRunner(options);\n  await checkProgramsExist(base, options.host);\n  return makeSshSudoRunner(options.prefixes, {\n    base,\n    log:\n      options.log ??\n      ((line) => {\n        process.stderr.write(`${line}\\n`);\n      }),\n    stage: stageRemote(base),\n  });\n};\n"
   ],
-  "mappings": ";AASA;AACA,oBAAS;AACT;AACA;AACA;;;ACJA;AAEO,IAAM,OAAO,CAAI,SACf,kBAAW;AAAA,EAChB,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,EAC3E,KAAK;AACP,CAAC;AAQI,IAAM,iBAAiB,CAAC,MAAe,QAAoC;AAAA,EAChF,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,QAAS,KAAiC;AAAA,EAChD,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA;;;ACZ7C;AACA;AAAA;AA6FO,MAAM,0BAAkC,gBAAuC,EACpF,8BACF,EAAE;AAAC;AAGI,IAAM,kBAAkB,CAAC,WACxB,cAAQ,mBAAmB,MAAM;AAGlC,IAAM,eAAe,CAAC,WAC3B,OAAO,cAAc,OAAO,aAAa,MAAM;;;AC7GjD;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,WAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,YAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,gBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,cAAM,QAAQ,GAAU,oBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,gBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,cAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,cAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,YAAW,sBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,YAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,sBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,sBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,YACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAaK,IAAM,sBAAsB,CAAC,KAAa,eACxC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,cAAM;AAAA,CACtE;;;AFxFI,IAAM,eAAe,CAAC,QACpB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,sBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,sBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AIzG9B,IAAM,cACJ,gGACA;AAGF,IAAM,cACJ;AAGF,IAAM,cAAc;AAGpB,IAAM,YAAY;AAEX,IAAM,cAAc;AAG3B,IAAM,YAAY,CAAC,OAAmB,SAA2B;AAAA,EAC/D,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1E,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAQ,MAAgC,QAAQ,CAAC,MAAM,UACrD,UAAU,MAAM,GAAG,QAAQ,OAAO,KAAK,IAAI,CAC7C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,OAAO,OAAO,QAAQ,KAAK,EAAE,QAAQ,EAAE,KAAK,UAAU,UAAU,MAAM,GAAG,QAAQ,KAAK,CAAC;AAAA,EACzF;AAAA,EACA,OAAO,CAAC;AAAA;AAOH,IAAM,oBAAoB,CAC/B,aACA,MACA,cACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,MAAM,UAAU,OAAO,QAAQ,eAAe,CAAC,CAAC,GAAG;AAAA,IAC7D,IAAI,YAAY,KAAK,IAAI;AAAA,MACvB,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,IACjE,SAAI,YAAY,KAAK,KAAK;AAAA,MAC7B,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,EACxE;AAAA,EACA,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAEzC,IAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MACzB,MAAM,KAAK,oBAAoB,OAAO,KAAK,8BAA8B,aAAa;AAAA,IACxF,EAAO,SAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAAA,MACzD,MAAM,KAAK,oBAAoB,OAAO,QAAQ,CAAC,6BAA6B,aAAa;AAAA,IAC3F,EAAO,SAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MAChC,MAAM,KAAK,oBAAoB,OAAO,KAAK,2BAA2B,aAAa;AAAA,IACrF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,UAAU,aAAa,CAAC,GAAG,WAAW,GAAG;AAAA,IAC1D,MAAM,KAAK,GAAG,6BAA6B,aAAa;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,qBAAqB,CAAC,YACjC,YAAY,KAAK,OAAO,IAAI,CAAC,gCAAgC,aAAa,IAAI,CAAC;;;AC9C1E,IAAM,eAAe;AAGrB,IAAM,mBAAmB,CAAC,MAAc,UAAiD;AAAA,EAC9F,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAOpE,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,KAAK,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,uBAAuB;AAAA,EAG7D,IACE,KAAK,SAAS,GAAG,KACjB,KACG,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAC9D;AAAA,IACA,MAAM,KAAK,6EAA6E;AAAA,EAC1F;AAAA,EACA,IAAI,KAAK,SAAS,MAAM;AAAA,IAAG,MAAM,KAAK,mBAAmB;AAAA,EACzD,OAAO;AAAA;AAGF,IAAM,eAAe,CAAC,UAAmC;AAAA,EAC9D,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,OAAO;AAAA;;;AC3CF,IAAM,mBAAmB;AAEzB,IAAM,SAAS,CAAC,MAAc,YACnC,IAAI,MAAM,kBAAkB,SAAS,SAAS;AAEhD,IAAM,aAAa,CAAC,MAAc,UAAiD;AAAA,EACjF,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,gCAAgC;AAAA,EAC9F;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAGpE,IAAM,oBAAoB,CAAC,UAAwC;AAAA,EACxE,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,WAAW,SAAS,MAAM,KAAK,GAAG,GAAG,WAAW,SAAS,MAAM,KAAK,CAAC;AAAA,EACnF,OAAO;AAAA;AAGT,IAAM,YAAY,CAAC,UACjB,OAAO,UAAU,WAAW,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;AAI5E,IAAM,UAAU,OAAO,QAAoB,UAAgD;AAAA,EACzF,MAAM,QAAQ,kBAAkB,KAAK;AAAA,EACrC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,OAAO,MAAM,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,EAC/D,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI,MAAM,UAAU,WAAW;AAAA,IAC7B,MAAM,UAAU,MAAM,KAAK,MAAM,MAAM,OAAO,WAAW,OAAO,MAAM,KAAK,CAAC,IAAI;AAAA,IAChF,IAAI,QAAQ;AAAA,MAAW,MAAM,OAAO,MAAM,MAAM,WAAW,OAAO,MAAM,KAAK,gBAAgB;AAAA,EAC/F;AAAA,EACA,IAAI,MAAM,UAAU,WAAW;AAAA,IAC7B,MAAM,UAAU,MAAM,KAAK,KAAM,MAAM,OAAO,YAAY,OAAO,MAAM,KAAK,CAAC;AAAA,IAC7E,IAAI,QAAQ;AAAA,MAAW,MAAM,OAAO,MAAM,MAAM,YAAY,OAAO,MAAM,KAAK,gBAAgB;AAAA,EAChG;AAAA,EACA,OAAO;AAAA,IACL,MAAM,MAAM,QAAQ;AAAA,OAChB,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,OAC/B,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,EACrC;AAAA;AAGK,IAAM,gBAAgB,OAC3B,QACA,SACiD;AAAA,EACjD,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS,aAAa,KAAK,SAAS;AAAA,IAAa;AAAA,EACrD,OAAO,EAAE,KAAK,KAAK,KAAK,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA;AAG/D,IAAM,QAAQ,CAAC,SAAiB,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG;AAGhE,IAAM,OAAO,OAAO,QAAoB,MAAc,SAA2C;AAAA,EAC/F,MAAM,SAAS,MAAM,OAAO,KAAK,IAAI;AAAA,EACrC,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,OACJ,MACA,GAAG,KAAK,KAAK,GAAG,QAAQ,OAAO,OAAO,QAAQ,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GACvF;AAAA,EACF;AAAA;AAQK,IAAM,qBAAqB,OAChC,QACA,OACA,QACA,QAAQ,UAC6B;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AAAA,EACxC,IAAI,KAAK,QAAQ,aAAa,KAAK,QAAQ,OAAO,aAAa,KAAK,CAAC,aAAa,MAAM,GAAG;AAAA,IACzF,MAAM,OACJ,MAAM,MACN,SAAS,OAAO,MAAM,KAAK,sEACzB,uFACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,IAAI;AAAA,EACzC,IAAI,SAAS,aAAa,KAAK,SAAS,aAAa;AAAA,IACnD,MAAM,OAAO,MAAM,MAAM,QAAQ,KAAK,uBAAuB;AAAA,EAC/D;AAAA,EAMA,IAAI,WAAW,aAAa,SAAS,aAAa,CAAC,OAAO;AAAA,IACxD,MAAM,UAAU,KAAK,SAAS,KAAK,QAAS,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK;AAAA,IACxF,IAAI,SAAS;AAAA,MACX,MAAM,OACJ,MAAM,MACN,uFACE,uDACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,SAAS,MAAM,KAAK,MAAM,GAAG,MAAM,KAAK,YAAY,GAAG,CAAC,KAAK;AAAA,IACnE,MAAM,QAAQ,MAAM,OAAO,KAAK,MAAM;AAAA,IACtC,IAAI,UAAU,aAAa,MAAM,SAAS,aAAa;AAAA,MACrD,MAAM,OAAO,MAAM,MAAM,cAAc,mDAAmD;AAAA,IAC5F;AAAA,IACA,MAAM,KAAK,QAAQ,MAAM,MAAM,CAAC,SAAS,MAAM,MAAM,KAAK,IAAI,GAAG,MAAM,MAAM,IAAI,CAAC;AAAA,EACpF,EAAO,SAAI,KAAK,SAAS,KAAK,MAAM;AAAA,IAClC,MAAM,KAAK,QAAQ,MAAM,MAAM,CAAC,SAAS,MAAM,KAAK,IAAI,GAAG,MAAM,MAAM,IAAI,CAAC;AAAA,EAC9E;AAAA,EAMA,MAAM,QAAQ,aACZ,EAAE,KAAK,MAAM,OAAO,IAAI,MAAM,GAAG,MAAM,MAAM,MAAM,KAAK,MAAM,OAAO,GAAG,GACxE,IACF,IACI,YACA,SAAS,IAAI;AAAA,EACjB,IAAI,UAAU;AAAA,IAAW,MAAM,KAAK,QAAQ,MAAM,MAAM,CAAC,SAAS,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,EAC1F,MAAM,QAAQ,MAAM,cAAc,QAAQ,MAAM,IAAI;AAAA,EAEpD,IAAI,UAAU,aAAa,MAAM,SAAS,KAAK,QAAQ,CAAC,aAAa,OAAO,IAAI,GAAG;AAAA,IACjF,MAAM,OAAO,MAAM,MAAM,0DAA0D;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AAIT,IAAM,WAAW,CAAC,SAAsC;AAAA,EACtD,IAAI,KAAK,QAAQ;AAAA,IAAW,OAAO,KAAK,QAAQ,YAAY,YAAY,IAAI,OAAO,KAAK,GAAG;AAAA,EAC3F,OAAO,KAAK,QAAQ,YAAY,OAAO,KAAK,GAAG,IAAI,GAAG,OAAO,KAAK,GAAG,KAAK,OAAO,KAAK,GAAG;AAAA;AAG3F,IAAM,eAAe,CAAC,MAA+B,UAClD,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK,SAC5C,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK;AAOxC,IAAM,gBAAgB,OAC3B,QACA,MACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI;AAAA,EACvC,IAAI,KAAK,SAAS,OAAO;AAAA,IAAM,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC1D,MAAM,OAAO,MAAM,cAAc,QAAQ,KAAK,IAAI;AAAA,EAGlD,MAAM,YACJ,SAAS,aACT,KAAK,SAAS,KAAK,QACnB,aAAa,MAAM,IAAI,KACvB,OAAO,SAAS,KAAK,QACrB,aAAa,QAAQ,IAAI;AAAA,EAC3B,IAAI;AAAA,IAAW,OAAO,EAAE,QAAQ,OAAO;AAAA,EACvC,MAAM,OAAO,aAAa,KAAK,MAAM,IAAI;AAAA,EACzC,OAAO,EAAE,QAAQ,SAAS;AAAA;AAIrB,IAAM,kBAAkB,OAC7B,QACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,OAAO,KAAK,OAAO,IAAI;AAAA,EAC1C,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAChB,MAAM,OAAO,OAAO,MAAM,YAAY,KAAK,uBAAuB;AAAA,EACpE,MAAM,KAAK,QAAQ,OAAO,MAAM,CAAC,SAAS,MAAM,OAAO,IAAI,CAAC;AAAA;;;ATxLvD,IAAM,gBAAgB,SAAwB,gBAAgB;AAE9D,IAAM,wBAAwB,MAC1B,gBACP,eACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,cAAc,SAAS,GAAG;AAAA,IAC/B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAE7B,MAAM,GAAG,MAAM,aACb,KAAK,YAAY;AAAA,MACf,MAAM,QAAQ,MAAM,cAAc,QAAQ,KAAK,IAAI;AAAA,MACnD,IAAI,UAAU;AAAA,QAAW;AAAA,MACzB,OAAO,WAAW,YAAY,SAAQ,KAAK,IAAI;AAAA,KAChD;AAAA,IAEH,MAAM,GAAG,YAAY,MAAM,aAAa;AAAA,MACtC,IAAI,WAAW;AAAA,QAAW,OAAO,eAAe,UAAU;AAAA,MAC1D,IAAI,WAAW,IAAI;AAAA,QAAG,OAAO,KAAK,MAAM,cAAc,QAAQ,MAAM,MAAM,CAAC;AAAA,MAG3E,MAAM,OAAO,eAAe,MAAM,MAAM;AAAA,MACxC,OAAc,gBACZ,SAAS,aAAa,SAAS,OAAO,OAAO,EAAE,QAAQ,UAAmB,IAAI,SAChF;AAAA;AAAA,IAGF,WAAW,GAAG,KAAK,YAAY,MAAM,aAC5B,gBAAQ,cAAc,EAAE,KAAK,YAAY,OAAO,CAAC,GAAG,CAAC,UAC1D,KAAK,MAAM,mBAAmB,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAC5D;AAAA,IAEF,QAAQ,GAAG,aAAa,KAAK,MAAM,gBAAgB,QAAQ,MAAM,CAAC;AAAA,EACpE,CAAC;AAAA,CACF,CACH;;AUzDF;;;ACQA,qBAAS;AACT,oBAAS;AACT,uBAAS;AACT;AACA;;;ACfA;;;ACqBO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EADX,WAAW,CACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,SAAS,KAAK,WAAW,SAAS,QAAQ;AAAA,IAHhD;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,SACJ;AAAA,IACA,0DACA;AAAA,IACA;AAAA;AAGF,IAAM,YAAY;AASlB,IAAM,YAAY;AAQX,IAAM,aAAa,CAAC,MAAc,SAAyB;AAAA,EAChE,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,EAC/B,IAAI,QAAQ,MAAM;AAAA,IAChB,MAAM,OAAO,IAAI,GAAG,YAAY,CAAC,KAAK;AAAA,IACtC,MAAM,IAAI,WACR,MACA,KAAK,KAAK,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,4BACtD;AAAA,EACF;AAAA,EACA,OAAO,KACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,MAAM,OAAO;AAAA;AAG7B,IAAM,iBAAgB,CAAC,UAA2B;AAAA,EAChD,MAAM,QAAQ,OAAO,eAAe,KAAK;AAAA,EACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAGjD,IAAM,cAAc,CAAC,OAAgB,MAAc,OAAe,QAAwB;AAAA,EACxF,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAC7B,IAAI,QAAQ;AAAA,IAAW,MAAM,IAAI,WAAW,MAAM,sBAAsB,OAAO,SAAS,GAAG;AAAA,EAC3F,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,IAAI,KAAK,GAAG,cAAc,WAAW,OAAO,IAAI,YAAY;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,IAAI,KAAK,GAAG,OAAO,QAAQ,SAAS,WAAW;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAE7B,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAAA,MAChC,MAAM,IAAI,WAAW,MAAM,GAAG,OAAO,KAAK,6CAA6C;AAAA,IACzF;AAAA,IACA,IAAI,KAAK,GAAG,eAAe,OAAO,UAAU,IAAI,IAAI,KAAK,aAAa;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,IAAI,KAAK,GAAG,aAAa;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB,YAAY,OAAO,SAAU,MAA6B,QAAQ,GAAG;AAAA,MACnE,YAAY,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG,GAAG;AAAA,IAC/D;AAAA,IACA,IAAI,KAAK,GAAG,aAAa;AAAA,IACzB;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,eAAc,KAAK,GAAG;AAAA,IACvE,WAAW,OAAkC,MAAM,OAAO,GAAG;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAM,OAAO,UAAU,OAAO,SAAS,OAAO;AAAA,EAC9C,MAAM,IAAI,WAAW,MAAM,GAAG,+CAA+C;AAAA;AAG/E,IAAM,aAAa,CACjB,MACA,MACA,OACA,QACS;AAAA,EACT,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAE7B,MAAM,OAAO,OAAO,KAAK,IAAI,EAAE,KAAK;AAAA,EACpC,IAAI,KAAK,WAAW,GAAG;AAAA,IACrB,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB;AAAA,EACF;AAAA,EACA,IAAI,KAAK,GAAG,WAAW;AAAA,EACvB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,QAAQ;AAAA,IAC7C,IAAI,KAAK,GAAG,YAAa,WAAW,KAAK,KAAK,SAAS;AAAA,IACvD,YAAY,KAAK,MAAM,OAAO,QAAQ,GAAG,GAAG;AAAA,EAC9C;AAAA,EACA,IAAI,KAAK,GAAG,YAAY;AAAA;AAInB,IAAM,cAAc,CAAC,SAA4B;AAAA,EACtD,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,KAAK,CAAC,eAAc,IAAI,GAAG;AAAA,IAC5F,MAAM,IAAI,WAAW,IAAI,iDAAiD;AAAA,EAC5E;AAAA,EACA,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAiC,IAAI,GAAG,GAAG;AAAA,EACtD,OAAO,GAAG,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;;;ADxE3B,IAAM,cAAc,CAAC,WAA6C;AAAA,EACvE,IAAI,WAAW;AAAA,IAAU,OAAO,EAAE,MAAM,SAAS;AAAA,EACjD,MAAM,QAAQ,eAAe,KAAK,MAAM;AAAA,EACxC,OAAO,QAAQ,OAAO,YAAY,YAAY,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,EAAE,EAAE;AAAA;AAG9E,IAAM,gBAAgB,CAAC,OAAe,WAAkC,GAAG,UAAU;AAOrF,IAAM,eAAe,CAC1B,OACA,QACA,SACW;AAAA,EACX,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,0BAA0B;AAAA,EAE/D,IAAI,SAAS,aAAa,CAAC,KAAK,WAAW,GAAG,GAAG;AAAA,IAC/C,MAAM,IAAI,MAAM,OAAO,OAAO,OAAO,GAAG,gDAAgD;AAAA,EAC1F;AAAA,EACA,OAAO,GAAG,6BAA6B;AAAA;AAIlC,IAAM,aAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAAe,CAAC,UAAuC;AAAA,EAC3D,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,MAAM,WAAW;AAAA,IAAW,KAAK,YAAY,MAAM;AAAA,EACvD,IAAI,MAAM,SAAS;AAAA,IAAW,KAAK,UAAU,MAAM;AAAA,EACnD,IAAI,MAAM,QAAQ;AAAA,IAAW,KAAK,SAAS,MAAM;AAAA,EACjD,IAAI,MAAM,YAAY;AAAA,IAAW,KAAK,aAAa,MAAM;AAAA,EACzD,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,MAAM;AAAA,EACrD,OAAO;AAAA;AAGT,IAAM,iBAAiB,CAAC,cAAqC;AAAA,EAC3D,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO;AAAA,EAC3C,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,UAAU,mBAAmB;AAAA,IAAW,KAAK,oBAAoB,UAAU;AAAA,EAC/E,IAAI,UAAU,YAAY;AAAA,IAAW,KAAK,aAAa,UAAU;AAAA,EACjE,OAAO;AAAA;AAIF,IAAM,eAAe,CAAC,UAAsC;AAAA,EACjE,MAAM,OAAmC,KAAK,MAAM,UAAU;AAAA,EAC9D,KAAK,WAAW,MAAM;AAAA,EACtB,KAAK,sBAAsB,CAAC,GAAG,MAAM,gBAAgB;AAAA,EACrD,MAAM,MAAM,MAAM,eAAe,CAAC;AAAA,EAClC,IAAI,OAAO,KAAK,GAAG,EAAE,SAAS;AAAA,IAAG,KAAK,0BAA0B,KAAK,IAAI;AAAA,EACzE,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,eAAe,MAAM,SAAS;AAAA,EACrF,IAAI,MAAM,kBAAkB;AAAA,IAAW,KAAK,mBAAmB,MAAM;AAAA,EACrE,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,KAAK,2BAA2B,MAAM,QAAQ,QAAQ,IACjD,SAAyC,IAAI,YAAY,IAC1D,aAAa,QAA4B;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,oBAAoB;AAAA,IAAW,KAAK,qBAAqB,MAAM;AAAA,EACzE,IAAI,MAAM,sBAAsB;AAAA,IAAW,KAAK,uBAAuB,MAAM;AAAA,EAC7E,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,aAAa;AAAA,IAAW,KAAK,cAAc,MAAM;AAAA,EAC3D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,OAAO;AAAA;AAGF,IAAM,YAAY,CAAC,UACxB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAG1C,IAAM,YAAY,CACvB,UACwD;AAAA,EACxD,MAAM,OAAO,YAAY,aAAa,KAAK,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC3C,OAAO,EAAE,OAAO,QAAQ,UAAU,KAAK,GAAG,KAAK;AAAA;;;AExJ1C,IAAM,kBAAkB;AAE/B,IAAM,SAAS,CAAC,SAAqB;AAAA,EACnC,MAAM,UAAU,KAAK,WAAW;AAAA,EAChC,OAAO;AAAA,IACL,OAAO,GAAG,iBAAiB,KAAK;AAAA,IAChC,KAAK,GAAG,eAAe,KAAK;AAAA,EAC9B;AAAA;AAaK,IAAM,aAAa,CAAC,GAA2B,MACpD,MAAM,aAAa,MAAM,YACrB,MAAM,aAAa,MAAM,YACzB,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,sBAAsB,EAAE,WAAW;AAErE,IAAM,iBAAiB,CAAC,SAA+B;AAAA,EAC5D,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,UAAU,KAAK,WAAW;AAAA,EAChC,IAAI,CAAC,YAAY,KAAK,OAAO,KAAK,QAAQ,SAAS,MAAQ,GAAG;AAAA,IAC5D,MAAM,KAAK,iDAAiD;AAAA,EAC9D;AAAA,EAGA,IAAI,CAAC,wCAAwC,KAAK,KAAK,IAAI,GAAG;AAAA,IAC5D,MAAM,KAAK,sEAAsE;AAAA,EACnF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,UAAS,CAAC,YAA2B,IAAI,MAAM,mBAAmB,SAAS;AAEjF,IAAM,YAAY,CAAC,MAAc,IAAuB,SACtD,QACE,GAAG,YAAY,KAAK,UAAU,IAAI,YAAY,GAAG,IAAI,CAAC,UAAU,QAAQ,CAAC,EAAE,KAAK,IAAI,SAClF,mEACJ;AAGF,IAAM,SAAS,CAAC,OAA0B,SAAqB;AAAA,EAC7D,QAAQ,OAAO,QAAQ,OAAO,IAAI;AAAA,EAClC,MAAM,SAAS,MAAM,QAAQ,CAAC,MAAM,UAAW,SAAS,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAE;AAAA,EAC7E,MAAM,OAAO,MAAM,QAAQ,CAAC,MAAM,UAAW,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC,CAAE;AAAA,EACzE,IAAI,OAAO,SAAS;AAAA,IAAG,MAAM,UAAU,qBAAqB,QAAQ,KAAK;AAAA,EACzE,IAAI,KAAK,SAAS;AAAA,IAAG,MAAM,UAAU,mBAAmB,MAAM,GAAG;AAAA,EACjE,OAAO,QAAQ;AAAA,EACf,OAAO,MAAM;AAAA,EACb,IAAI,SAAS,aAAa,OAAO;AAAA,IAAW;AAAA,EAC5C,IAAI,SAAS,aAAa,OAAO,WAAW;AAAA,IAC1C,MAAM,QACJ,GAAG,KAAK,UAAU,KAAK,IAAI,WAAW,SAAS,YAAY,QAAQ,2BACjE,+EACJ;AAAA,EACF;AAAA,EACA,IAAI,KAAK;AAAA,IAAM,MAAM,QAAO,GAAG,KAAK,UAAU,KAAK,IAAI,uCAAuC;AAAA,EAC9F,OAAO,EAAE,MAAM,GAAG;AAAA;AASb,IAAM,eAAe,CAAC,MAAc,MAAkB,SAAyB;AAAA,EACpF,QAAQ,OAAO,QAAQ,OAAO,IAAI;AAAA,EAElC,MAAM,QAAQ,CAAC,OAAO,GAAI,SAAS,KAAK,CAAC,IAAI,KAAK,QAAQ,OAAO,EAAE,EAAE,MAAM;AAAA,CAAI,GAAI,GAAG;AAAA,EACtF,MAAM,QAAQ,KAAK,MAAM;AAAA,CAAI;AAAA,EAC7B,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,EAChC,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,CAAC,GAAG,MAAM,MAAM,GAAG,MAAM,IAAI,GAAG,GAAG,OAAO,GAAG,MAAM,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA,EAC1F;AAAA,EACA,MAAM,SAAS,SAAS,MAAM,KAAK,SAAS;AAAA,CAAI,IAAI,OAAO,GAAG;AAAA;AAAA,EAC9D,OAAO,GAAG,SAAS,MAAM,KAAK;AAAA,CAAI;AAAA;AAAA;AAI7B,IAAM,aAAa,CAAC,MAAc,SAAyC;AAAA,EAChF,MAAM,QAAQ,KAAK,MAAM;AAAA,CAAI;AAAA,EAC7B,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,EAChC,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,OAAO,MAAM,MAAM,MAAM,OAAO,GAAG,MAAM,EAAE;AAAA,EACjD,OAAO,KAAK,WAAW,IAAI,KAAK,GAAG,KAAK,KAAK;AAAA,CAAI;AAAA;AAAA;AAS5C,IAAM,eAAe,CAAC,MAAc,SAA6B;AAAA,EACtE,MAAM,QAAQ,KAAK,MAAM;AAAA,CAAI;AAAA,EAC7B,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,EAChC,IAAI,UAAU;AAAA,IAAW,OAAO;AAAA,EAChC,OAAO,CAAC,GAAG,MAAM,MAAM,GAAG,MAAM,IAAI,GAAG,GAAG,MAAM,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA;;;ACtEzE,IAAM,gBAAe;AAE5B,IAAM,oBAAmB,CAAC,MAAc,UAAiD;AAAA,EACvF,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAGpE,IAAM,gBAAe,CAAC,UAAqC;AAAA,EAChE,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,kBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,kBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,IAAI,MAAM,WAAW,WAAW;AAAA,IAC9B,MAAM,KAAK,GAAG,eAAe,MAAM,MAAM,CAAC;AAAA,IAG1C,IAAI,MAAM,WAAW,SAAS,MAAM,SAAS,aAAa,MAAM,UAAU,YAAY;AAAA,MACpF,MAAM,KACJ,2FACF;AAAA,IACF;AAAA,EACF,EAAO,SAAI,MAAM,WAAW,MAAM;AAAA,IAChC,MAAM,KAAK,kFAAkF;AAAA,EAC/F;AAAA,EACA,OAAO;AAAA;;;AC5EF,IAAM,UAAU,IAAI;AACpB,IAAM,UAAU,IAAI;AAEpB,IAAM,UAAS,CAAC,MAAc,YACnC,IAAI,MAAM,eAAe,SAAS,SAAS;AAE7C,IAAM,aAAY,CAAC,UACjB,OAAO,UAAU,WAAW,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;AAKrE,IAAM,WAAW,OAAO,QAAoB,UAA8C;AAAA,EAC/F,MAAM,QAAQ,cAAa,KAAK;AAAA,EAChC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,QAAO,MAAM,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,EAC/D,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI,MAAM,UAAU,WAAW;AAAA,IAC7B,MAAM,WAAU,MAAM,KAAK,MAAM,MAAM,OAAO,WAAW,OAAO,MAAM,KAAK,CAAC,IAAI;AAAA,IAChF,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,MAAM,WAAW,OAAO,MAAM,KAAK,gBAAgB;AAAA,EAC/F;AAAA,EACA,IAAI,MAAM,UAAU,WAAW;AAAA,IAC7B,MAAM,WAAU,MAAM,KAAK,KAAM,MAAM,OAAO,YAAY,OAAO,MAAM,KAAK,CAAC;AAAA,IAC7E,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,MAAM,YAAY,OAAO,MAAM,KAAK,gBAAgB;AAAA,EAChG;AAAA,EACA,OAAO,KAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,MAAQ,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,EAAG;AAAA;AAGjF,IAAM,WAAW,CAAC,SAAyB,UAAU,QAAQ,OAAO,IAAI,CAAC;AAwBzE,IAAM,aAAa,CAAC,OAAwB,WAAuC;AAAA,EACxF,IAAI,MAAM,SAAS,OAAO;AAAA,IAAM,OAAO;AAAA,EACvC,IAAI,WAAW,MAAM,QAAQ,OAAO,MAAM;AAAA,IAAG,OAAO;AAAA,EACpD,IAAI,MAAM,WAAW,aAAa,OAAO,WAAW,WAAW;AAAA,IAC7D,MAAM,QACJ,MAAM,MACN,yEACE,GAAG,KAAK,WAAW,MAAM,UAAU,OAAO,SAAS,QAAQ,EAAE,+BAC7D,oFACJ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,cAAc,CACzB,MACA,WACuB;AAAA,EACvB,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,WAAW;AAAA,IAAW,OAAO,SAAS,IAAI;AAAA,EAC9C,MAAM,OAAO,WAAW,MAAM,MAAM;AAAA,EACpC,OAAO,SAAS,YAAY,YAAY,SAAS,IAAI;AAAA;AAIhD,IAAM,qBAAqB,OAChC,QACA,MACA,WAC8C;AAAA,EAC9C,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,KAAK,SAAS,SAAS,MAAM,OAAO,SAAS,IAAI,IAAI;AAAA,EACnE,MAAM,OAAO,UAAU,YAAY,YAAY,QAAQ,OAAO,KAAK;AAAA,EACnE,OAAO;AAAA,IACL,eAAe,YAAY,MAAM,MAAM,KAAK;AAAA,IAC5C,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,IACX;AAAA,OACI,WAAW,YAAY,CAAC,IAAI,EAAE,OAAO;AAAA,IACzC,QAAQ,UAAU,YAAY,KAAK,UAAU,KAAK;AAAA,IAClD,MAAM,KAAK;AAAA,IACX,KAAK,KAAK;AAAA,EACZ;AAAA;AAGF,IAAM,UAAU,CAAC,MAA4B,UAC3C,SAAS,aACT,KAAK,SAAS,MAAM,SACnB,MAAM,QAAQ,aAAa,KAAK,QAAQ,MAAM,SAC9C,MAAM,QAAQ,aAAa,KAAK,QAAQ,MAAM;AAiB1C,IAAM,YAAY,OACvB,QACA,OACA,SACkB;AAAA,EAClB,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,IAAI;AAAA,EACzC,IAAI,SAAS,aAAa,KAAK,SAAS,QAAQ;AAAA,IAC9C,MAAM,QACJ,MAAM,MACN,QAAQ,KAAK,gEACf;AAAA,EACF;AAAA,EACA,MAAM,UAAU,SAAS,YAAY,YAAY,MAAM,OAAO,SAAS,MAAM,IAAI;AAAA,EACjF,MAAM,SAAS,YAAY,YAAY,YAAY,QAAQ,OAAO,OAAO;AAAA,EACzE,MAAM,eAAe,MAAM,QAAQ;AAAA,EACnC,IAAI,MAAM,WAAW,WAAW;AAAA,IAC9B,MAAM,QAAsB,EAAE,MAAM,iBAAiB,KAAK;AAAA,IAC1D,OAAO;AAAA,MACL;AAAA,MACA,OAAO,QAAQ,OAAO,MAAM,OAAO;AAAA,MACnC,WAAW,WAAW,MAAM,WAAW,QAAQ,MAAM,KAAK;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA,EACA,IAAI,WAAW,WAAW;AAAA,IACxB,IAAI,MAAM,WAAW,MAAM;AAAA,MACzB,MAAM,QACJ,MAAM,MACN,0FACE,sDACJ;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA,OAAO,QAAQ,OAAO,aAAa,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AAAA,MACnE,WAAW;AAAA,MACX,OAAO,EAAE,MAAM,iBAAiB,KAAK;AAAA,IACvC;AAAA,EACF;AAAA,EACA,MAAM,OAAO,aAAa,QAAQ,MAAM,QAAQ,MAAM,OAAO;AAAA,EAM7D,OAAO;AAAA,IACL;AAAA,IACA,OAAO,QAAQ,OAAO,IAAI;AAAA,IAC1B,WAAW,SAAS;AAAA,IACpB,OAAO,EAAE,KAAK,MAAM,OAAO,GAAG,MAAM,MAAM,QAAQ,cAAc,KAAK,MAAM,OAAO,EAAE;AAAA,EACtF;AAAA;;;ACrJK,IAAM,WAAW,OACtB,QACA,MACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI;AAAA,EAExC,IAAI,WAAW,MAAM,MAAM,MAAM,QAAQ;AAAA,IAEvC,MAAM,OAAO,aAAa,KAAK,MAAM,EAAE,MAAM,KAAK,QAAQ,kBAAiB,KAAK,CAAC;AAAA,IACjF,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC7B;AAAA,EACA,MAAM,UAAU,MAAM,UAAU,QAAQ,MAAM,IAAI;AAAA,EAGlD,IAAI,QAAQ,aAAa,OAAO,kBAAkB,SAAS,KAAK,OAAO,GAAG;AAAA,IACxE,OAAO,EAAE,QAAQ,OAAO;AAAA,EAC1B;AAAA,EACA,MAAM,OAAO,aAAa,KAAK,MAAM,QAAQ,KAAK;AAAA,EAClD,OAAO,EAAE,QAAQ,SAAS;AAAA;AAWrB,IAAM,gBAAgB,OAC3B,QACA,OACA,QACA,QAAQ,UAC0B;AAAA,EAClC,MAAM,OAAO,MAAM,SAAS,QAAQ,KAAK;AAAA,EAEzC,IAAI,KAAK,QAAQ,aAAa,KAAK,QAAQ,OAAO,aAAa,KAAK,CAAC,aAAa,MAAM,GAAG;AAAA,IACzF,MAAM,QACJ,MAAM,MACN,SAAS,OAAO,MAAM,KAAK,sEACzB,uFACJ;AAAA,EACF;AAAA,EAMA,MAAM,OAAO,WAAW,YAAY,SAAS,WAAW,OAAO,MAAM;AAAA,EACrE,MAAM,QAAQ,SAAS,SAAS,SAAS;AAAA,EACzC,MAAM,UAAU,MAAM,UAAU,QAAQ,OAAO,IAAI;AAAA,EACnD,MAAM,OAAO,YAAY,QAAQ,QAAQ,MAAM,MAAM;AAAA,EACrD,MAAM,WAAW,SAAS,MAAM,OAAO;AAAA,EAOvC,IACE,UAAU,aACV,SAAS,aACT,SAAS,YACT,EAAE,SAAS,WAAW,YACtB;AAAA,IACA,MAAM,QACJ,MAAM,MACN,GAAG,MAAM,WAAW,YAAY,mBAAmB,0CACjD,2FACJ;AAAA,EACF;AAAA,EACA,IAAI,CAAC,QAAQ;AAAA,IAAW,MAAM,OAAO,gBAAgB,MAAM,MAAM,QAAQ,OAAO,QAAQ,KAAK;AAAA,EAK7F,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,MAAM,MAAM,MAAM,MAAM;AAAA,EACvE,IACE,UAAU,aACV,MAAM,WAAW,UAAU,QAAQ,KAAK,KACxC,MAAM,kBAAkB,UACxB;AAAA,IAMA,IAAI,QAAQ,WAAW,aAAa,MAAM,WAAW,WAAW;AAAA,MAC9D,MAAM,OAAO,WAAW,MAAM,IAAI,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA,IAC3D;AAAA,IACA,MAAM,QACJ,MAAM,MACN,wEACF;AAAA,EACF;AAAA,EAGA,IAAI,SAAS,UAAU,WAAW;AAAA,IAAW,OAAO;AAAA,EACpD,MAAM,WAAW,QAAQ,MAAM;AAAA,EAC/B,IAAI,SAAS;AAAA,IAAQ,OAAO;AAAA,EAM5B,MAAM,UAAU,MAAM,mBAAmB,QAAQ,MAAM,MAAM,MAAM,MAAM;AAAA,EACzE,IAAI,YAAY,aAAa,QAAQ,kBAAkB,UAAU;AAAA,IAC/D,MAAM,QAAO,MAAM,MAAM,+DAA+D;AAAA,EAC1F;AAAA,EACA,OAAO;AAAA;AAOF,IAAM,aAAa,OACxB,QACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,OAAO,KAAK,OAAO,IAAI;AAAA,EAC1C,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAAQ,MAAM,QAAO,OAAO,MAAM,YAAY,KAAK,uBAAuB;AAAA,EAC5F,IAAI,OAAO,WAAW,WAAW;AAAA,IAC/B,MAAM,OAAO,WAAW,OAAO,IAAI;AAAA,IACnC;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,MAAM,OAAO,SAAS,OAAO,IAAI;AAAA,EAC/C,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,SAAS,QAAQ,OAAO,KAAK;AAAA,EACnC,MAAM,OAAO,aAAa,QAAQ,OAAO,MAAM;AAAA,EAC/C,IAAI,SAAS;AAAA,IAAQ;AAAA,EACrB,MAAM,OAAO,gBAAgB,OAAO,MAAM,QAAQ,OAAO,IAAI,GAAG;AAAA,IAC9D,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,IACX,KAAK,KAAK;AAAA,EACZ,CAAC;AAAA;;;ANnII,IAAM,aAAa,UAAqB,aAAa;AAErD,IAAM,qBAAqB,MACvB,iBACP,YACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,WAAW,SAAS,GAAG;AAAA,IAE5B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAE7B,MAAM,GAAG,MAAM,aACb,KAAK,YAAY;AAAA,MACf,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,KAAK,MAAM,KAAK,MAAM;AAAA,MACrE,IAAI,UAAU;AAAA,QAAW;AAAA,MAIzB,IAAI,KAAK,WAAW,aAAa,MAAM,kBAAkB;AAAA,QAAI;AAAA,MAC7D,OAAO,WAAW,YAAY,SAAQ,KAAK,IAAI;AAAA,KAChD;AAAA,IAEH,MAAM,GAAG,YAAY,MAAM,aAAa;AAAA,MAEtC,IAAI,WAAW;AAAA,QAAW,OAAO,eAAe,UAAU;AAAA,MAC1D,IAAI,YAAW,IAAI;AAAA,QAAG,OAAO,KAAK,MAAM,SAAS,QAAQ,MAAM,MAAM,CAAC;AAAA,MAItE,MAAM,OAAO,eAAe,MAAM,MAAM;AAAA,MACxC,OAAc,gBACZ,SAAS,aAAa,SAAS,OAAO,OAAO,EAAE,QAAQ,UAAmB,IAAI,SAChF;AAAA;AAAA,IAIF,WAAW,GAAG,KAAK,YAAY,MAAM,aAC5B,gBAAQ,cAAc,EAAE,KAAK,YAAY,OAAO,CAAC,GAAG,CAAC,UAC1D,KAAK,MAAM,cAAc,QAAQ,MAAM,QAAQ,KAAK,CAAC,CACvD;AAAA,IAEF,QAAQ,GAAG,aAAa,KAAK,MAAM,WAAW,QAAQ,MAAM,CAAC;AAAA,EAC/D,CAAC;AAAA,CACF,CACH;;;AOrEF,qBAAS;AACT;AACA;;;ACfA,oBAAS;AAET,uBAAS;AAET;;;ACmBO,IAAM,YAAY;AAGlB,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAAA;AAEO,MAAM,uBAAuB,MAAM;AAAA,EACxC,WAAW,CAAC,SAAiB,UAAkB,QAAgB;AAAA,IAC7D,MAAM,aAAa,cAAc,OAAO,QAAQ,MAAM,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG;AAAA,IACnF,KAAK,OAAO;AAAA;AAEhB;AAkBO,IAAM,YAAY,CAAC,WAAwC;AAAA,EAChE,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,QAAQ,OAAO,MAAM;AAAA,CAAI,GAAG;AAAA,IACrC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC3B,IAAI,MAAM;AAAA,MAAG;AAAA,IACb,MAAM,MAAM,KAAK,MAAM,GAAG,EAAE;AAAA,IAC5B,IAAI,CAAC,OAAO,IAAI,GAAG;AAAA,MAAG,OAAO,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,WAAW,CAAC,WAA+B;AAAA,EACtD,MAAM,SAAS,UAAU,MAAM;AAAA,EAC/B,MAAM,YAAY,OAAO,IAAI,WAAW,KAAK;AAAA,EAC7C,MAAM,gBAAgB,OAAO,IAAI,eAAe,KAAK;AAAA,EACrD,MAAM,eAAe,OAAO,IAAI,cAAc,KAAK;AAAA,EACnD,MAAM,WAAW,OAAO,IAAI,UAAU,KAAK;AAAA,EAC3C,OAAO;AAAA,IACL,aAAa,OAAO,IAAI,aAAa,KAAK;AAAA,IAG1C,OAAO,cAAc,eAAe,kBAAkB;AAAA,IACtD;AAAA,IACA,kBAAkB,OAAO,IAAI,kBAAkB,MAAM;AAAA,OACjD,aAAa,KAAK,CAAC,IAAI,EAAE,SAAS;AAAA,OAClC,kBAAkB,KAAK,CAAC,IAAI,EAAE,cAAc;AAAA,OAC5C,iBAAiB,KAAK,CAAC,IAAI,EAAE,aAAa;AAAA,EAChD;AAAA;AAGK,IAAM,WAAW,OAAO,QAAoB,SAAsC;AAAA,EACvF,MAAM,SAAS,MAAM,OAAO,KAAK;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,KAAK,GAAG;AAAA,IACxB;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EAID,IAAI,OAAO,aAAa;AAAA,IACtB,MAAM,IAAI,eAAe,QAAQ,QAAQ,OAAO,UAAU,OAAO,MAAM;AAAA,EACzE,OAAO,SAAS,OAAO,MAAM;AAAA;AAI/B,IAAM,MAAM,OAAO,QAAoB,SAA2C;AAAA,EAChF,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;AAAA,EACrD,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,eAAe,KAAK,KAAK,GAAG,GAAG,OAAO,UAAU,OAAO,MAAM;AAAA,EACzE;AAAA;AAIK,IAAM,eAAe,CAAC,WAAsC,IAAI,QAAQ,CAAC,eAAe,CAAC;AAEzF,IAAM,aAAa,CAAC,QAAoB,SAC7C,IAAI,QAAQ,CAAC,UAAU,MAAM,IAAI,CAAC;AAE7B,IAAM,cAAc,CAAC,QAAoB,SAC9C,IAAI,QAAQ,CAAC,WAAW,MAAM,IAAI,CAAC;AAE9B,IAAM,YAAY,CAAC,QAAoB,SAC5C,IAAI,QAAQ,CAAC,SAAS,MAAM,IAAI,CAAC;AAE5B,IAAM,WAAW,CAAC,QAAoB,SAC3C,IAAI,QAAQ,CAAC,QAAQ,MAAM,IAAI,CAAC;AAO3B,IAAM,cAAc,CAAC,QAAoB,SAC9C,IAAI,QAAQ,CAAC,WAAW,MAAM,IAAI,CAAC;;;AChF9B,IAAM,yBAAyB;AAW/B,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,aAAa,EAAE,KAAK,GAAG,MAAM,KAAO,KAAK,EAAE;AAEjD,IAAM,YAAW,CAAC,SAAyB,UAAU,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC;AAGnF,IAAM,eAAe,CAAC,cAC3B,WAAU,aAAa,CAAC,GAAG,KAAK;AAAA,CAAI,CAAC;AA0ChC,IAAM,gBAAgB,CAC3B,aACA,UACA,YACY;AAAA,EACZ,IAAI,gBAAgB;AAAA,IAAU,OAAO;AAAA,EACrC,IAAI,gBAAgB;AAAA,IAAc,OAAO;AAAA,EACzC,IAAI,aAAa,kBAAkB,aAAa;AAAA,IAAuB,OAAO;AAAA,EAC9E,OAAO;AAAA;AAIF,IAAM,aAAa,CAAC,aACzB,GAAG,SACA,IAAI,CAAC,YACJ,CAAC,IAAI,QAAQ,SAAS,GAAG,QAAQ,MAAM,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,CAAC,EAAE,KAAK;AAAA,CAAI,CAC5F,EACC,KAAK;AAAA;AAAA,CAAM;AAAA;AAET,IAAM,WAAW,CAAC,UACvB,MAAM,WAAW,WAAW,MAAM,YAAY,CAAC,CAAC;AAE3C,IAAM,cAAc,CAAC,UAC1B,GAAG,MAAM,aAAa,0BAA0B,MAAM;AAExD,IAAM,OAAO;AAEb,IAAM,QAAQ,IAAI,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,eAAe,IAAI,IAAI,CAAC,YAAY,cAAc,cAAc,QAAQ,OAAO,CAAC;AAU/E,IAAM,eAAe,CAAC,OAAyB,WAA8B;AAAA,EAClF,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OAAO,KAAK,KAAK,MAAM,IAAI,IAAI;AAAA,EACrC,IAAI,SAAS,aAAa,CAAC,MAAM,IAAI,IAAI,GAAG;AAAA,IAC1C,MAAM,KACJ,4DAA4D,KAAK,UAAU,MAAM,IAAI,GACvF;AAAA,EACF,EAAO,SAAI,WAAW,aAAa,SAAS,QAAQ;AAAA,IAClD,MAAM,KAAK,6BAA6B,gBAAgB,MAAM,cAAc,MAAM;AAAA,EACpF;AAAA,EACA,IAAK,MAAM,YAAY,eAAgB,MAAM,aAAa,YAAY;AAAA,IACpE,MAAM,KAAK,4CAA4C;AAAA,EACzD;AAAA,EACA,MAAM,YAAY,MAAM,aAAa;AAAA,EACrC,IAAI,CAAC,UAAU,WAAW,GAAG,KAAK,UAAU,SAAS,GAAG,KAAK,UAAU,SAAS,KAAK,GAAG;AAAA,IACtF,MAAM,KAAK,uEAAuE;AAAA,EACpF;AAAA,EACA,MAAM,KAAK,GAAG,aAAa,SAAS,KAAK,CAAC,CAAC;AAAA,EAC3C,IAAI,MAAM,YAAY,SAAS,CAAC,wBAAwB,SAAS,SAAkB,GAAG;AAAA,IACpF,MAAM,KACJ,iEAAiE,wBAAwB,KAAK,IAAI,SAChG,GAAG,mEACP;AAAA,EACF;AAAA,EACA,IAAI,MAAM,YAAY,SAAS,CAAC,WAAW,KAAK,GAAG;AAAA,IACjD,MAAM,KACJ,8FACE,6FACA,2DACJ;AAAA,EACF;AAAA,EACA,IAAI,SAAS,WAAW,CAAC,SAAS,KAAK,EAAE,SAAS,SAAS,GAAG;AAAA,IAC5D,MAAM,KAAK,kCAAkC;AAAA,EAC/C;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,aAAa,CAAC,UAAqC;AAAA,EACvD,MAAM,OAAO,SAAS,KAAK;AAAA,EAC3B,IAAI,CAAC,KAAK,SAAS,WAAW;AAAA,IAAG,OAAO;AAAA,EACxC,MAAM,QAAQ,KAAK,MAAM,KAAK,QAAQ,WAAW,CAAC;AAAA,EAClD,OAAO,CAAC,GAAG,YAAY,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,IAAI,QAAQ,GAAG,EAAE,KAAK,KAAK,CAAC;AAAA;AAGhF,IAAM,eAAe,CAAC,SAA2B;AAAA,EAC/C,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,KAAK,KAAK,MAAM;AAAA,IAAI,MAAM,KAAK,wBAAwB;AAAA,EAC3D,IAAI,KAAK,SAAS,MAAQ;AAAA,IAAG,MAAM,KAAK,4BAA4B;AAAA,EACpE,IAAI,CAAC,mBAAmB,KAAK,IAAI;AAAA,IAAG,MAAM,KAAK,yCAAyC;AAAA,EACxF,OAAO;AAAA;;;AC3MF,IAAM,UAAS,CAAC,MAAc,YACnC,IAAI,MAAM,gBAAgB,SAAS,SAAS;AAEvC,IAAM,eAAe,CAC1B,OACA,YACA,YAC2B;AAAA,EAC3B,QAAQ,OAAO,gBAAgB,YAAY,OAAO,gBAAgB;AAAA,EAClE,aAAa,OAAO;AAAA,EACpB,cAAc,aAAa,MAAM,SAAS;AAAA,EAC1C,SAAS,OAAO,kBAAkB,aAAa,OAAO,kBAAkB;AAAA,EACxE,WAAW,OAAO;AAAA,EAClB,MAAM,MAAM;AAAA,EACZ,UAAU,YAAY,KAAK;AAAA,EAC3B;AAAA,KACI,OAAO,kBAAkB,YAAY,CAAC,IAAI,EAAE,eAAe,OAAO,cAAc;AACtF;AAiBO,IAAM,SAAS,OACpB,QACA,OACA,SACmC;AAAA,EACnC,MAAM,cAAc,MAAM,YAAY;AAAA,EACtC,MAAM,cAAc,MAAM,YAAY;AAAA,EACtC,MAAM,YACJ,KAAK,OAAO,kBAAkB,aAAa,KAAK,OAAO,kBAAkB;AAAA,EAC3E,MAAM,OAAO,OAAO,WAAmC;AAAA,IAGrD,IAAI,KAAK,WAAW,WAAW;AAAA,MAC7B,MAAM,OAAO,WAAW,KAAK,IAAI,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA,MACxD,MAAM,aAAa,MAAM,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA,IAClD;AAAA,IACA,MAAM,QAAO,MAAM,MAAM,GAAG,iCAAiC;AAAA;AAAA,EAE/D,IAAI;AAAA,IACF,IAAI,gBAAgB,CAAC,aAAa,KAAK;AAAA,MAAU,MAAM,WAAW,QAAQ,MAAM,IAAI;AAAA,IACpF,IAAI,CAAC,eAAe;AAAA,MAAW,MAAM,YAAY,QAAQ,MAAM,IAAI;AAAA,IAInE,MAAM,UAAU,cAAc,KAAK,OAAO,aAAa,KAAK,OAAO,UAAU,WAAW;AAAA,IACxF,IAAI,CAAC,aAAa;AAAA,MAChB,IAAI;AAAA,QAAS,MAAM,SAAS,QAAQ,MAAM,IAAI;AAAA,IAChD,EAAO,SAAI,CAAC;AAAA,MAAS,MAAM,UAAU,QAAQ,MAAM,IAAI;AAAA,IAClD,SAAI,KAAK,WAAW,KAAK;AAAA,MAAe,MAAM,YAAY,QAAQ,MAAM,IAAI;AAAA,IACjF,OAAO,OAAO;AAAA,IACd,OAAO,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA;AAAA,EAQpE,MAAM,QAAQ,MAAM,SAAS,QAAQ,MAAM,IAAI;AAAA,EAC/C,IAAI,eAAe,CAAC,cAAc,MAAM,aAAa,MAAM,UAAU,WAAW,GAAG;AAAA,IACjF,OAAO,KAAK,8CAA8C,MAAM,cAAc;AAAA,EAChF;AAAA,EACA,MAAM,UAAU,aAAa,OAAO,KAAK,SAAS,KAAK;AAAA,EACvD,IAAI,eAAe,CAAC,QAAQ,SAAS;AAAA,IACnC,OAAO,KACL,kEACE,GAAG,KAAK,UAAU,MAAM,iBAAiB,EAAE,iBAC/C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACpFT,IAAM,WAAU,IAAI;AAGb,IAAM,cAAc,CAAC,OAAyB,WAA0B;AAAA,EAC7E,MAAM,QAAQ,aAAa,OAAO,MAAM;AAAA,EACxC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,QAAO,MAAM,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA;AAI1D,IAAM,iBAAiB,CAAC,QAAoB,SAAuB;AAAA,EACxE,IAAI,aAAa,MAAM;AAAA,IAAG;AAAA,EAC1B,MAAM,QACJ,MACA,8FACE,6FACJ;AAAA;AAOK,IAAM,eAAe,CAAC,OAAuC,WAA6B;AAAA,EAC/F,IAAI,OAAO,cAAc,YAAY,OAAO,kBAAkB,UAAU;AAAA,IACtE,MAAM,QACJ,MAAM,MACN,6FACE,cACJ;AAAA,EACF;AAAA;AAUK,IAAM,kBAAkB,OAC7B,QACA,UACkB;AAAA,EAClB,MAAM,OAAO,YAAY,KAAK;AAAA,EAC9B,MAAM,QAAQ,MAAM,OAAO,SAAS,IAAI;AAAA,EACxC,MAAM,OAAO,UAAU,YAAY,YAAY,UAAS,SAAQ,OAAO,KAAK,CAAC;AAAA,EAC7E,IAAI,SAAS,aAAa,SAAS,UAAS,SAAS,KAAK,CAAC,GAAG;AAAA,IAC5D,MAAM,QACJ,MAAM,MACN,GAAG,0FACD,uCACJ;AAAA,EACF;AAAA;AAWK,IAAM,qBAAqB,OAChC,QACA,KACA,SACkB;AAAA,EAClB,eAAe,QAAQ,IAAI,IAAI;AAAA,EAC/B,eAAe,QAAQ,IAAI;AAAA,EAC3B,aAAa,EAAE,KAAK,GAAG,MAAM,SAAS,QAAQ,IAAI,CAAC;AAAA;AAO9C,IAAM,oBAAoB,OAC/B,QACA,MACA,KACA,WACkB;AAAA,EAClB,YAAY,MAAM,MAAM;AAAA,EACxB,MAAM,mBAAmB,QAAQ,KAAK,KAAK,IAAI;AAAA,EAC/C,MAAM,gBAAgB,QAAQ,IAAI;AAAA,EAClC,MAAM,OAAO,aAAa,YAAY,IAAI,GAAG,UAAU;AAAA;;;AC9EzD,IAAM,WAAU,IAAI;AACpB,IAAM,WAAU,IAAI;AAGb,IAAM,WAAW,OACtB,QACA,UAC+C;AAAA,EAC/C,MAAM,QAAQ,MAAM,OAAO,SAAS,YAAY,KAAK,CAAC;AAAA,EACtD,MAAM,SAAS,MAAM,SAAS,QAAQ,MAAM,IAAI;AAAA,EAChD,IAAI,UAAU,aAAa,CAAC,OAAO;AAAA,IAAO;AAAA,EAC1C,OAAO,aAAa,OAAO,UAAU,YAAY,KAAK,UAAS,SAAQ,OAAO,KAAK,CAAC,GAAG,MAAM;AAAA;AAGxF,IAAM,WAAW,OACtB,QACA,MACA,QACA,WACkB;AAAA,EAClB,YAAY,MAAM,MAAM;AAAA,EAKxB,IAAI,KAAK,SAAS,OAAO,QAAQ,YAAY,IAAI,MAAM,OAAO,UAAU;AAAA,IACtE,MAAM,kBAAkB,QAAQ,MAAM,QAAQ,MAAM;AAAA,IACpD,OAAO,EAAE,QAAQ,WAAW,aAAa,KAAK;AAAA,EAChD;AAAA,EACA,MAAM,WAAU,UAAS,SAAS,IAAI,CAAC;AAAA,EACvC,MAAM,SAAS,YAA2B;AAAA,IACxC,eAAe,QAAQ,KAAK,IAAI;AAAA,IAChC,MAAM,OAAO,aAAa,YAAY,IAAI,GAAG,UAAU;AAAA,IACvD,OAAO,EAAE,QAAQ,SAAS;AAAA;AAAA,EAI5B,IAAI,aAAY,OAAO;AAAA,IAAY,OAAO,OAAO;AAAA,EACjD,IAAI,aAAa,KAAK,SAAS,MAAM,OAAO;AAAA,IAAc,OAAO,OAAO;AAAA,EACxE,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI;AAAA,EACxC,IAAI,SAAS,aAAa,KAAK,eAAe;AAAA,IAAS,OAAO,OAAO;AAAA,EACrE,IAAI,KAAK,aAAa,KAAK,YAAY;AAAA,IAAQ,OAAO,OAAO;AAAA,EAM7D,MAAM,SAAS,MAAM,SAAS,QAAQ,KAAK,IAAI;AAAA,EAC/C,MAAM,cAAc,KAAK,YAAY;AAAA,EACrC,IAAI,cAAc,OAAO,aAAa,OAAO,UAAU,WAAW,MAAM,aAAa;AAAA,IACnF,OAAO,OAAO;AAAA,EAChB;AAAA,EACA,OAAO,OAAO,mBAAmB,OAAO,IAAI,EAAE,QAAQ,OAAO;AAAA;AASxD,IAAM,gBAAgB,OAC3B,QACA,OACA,QACA,QAAQ,OACR,WACmC;AAAA,EACnC,YAAY,OAAO,MAAM;AAAA,EACzB,eAAe,QAAQ,MAAM,IAAI;AAAA,EACjC,MAAM,OAAO,YAAY,KAAK;AAAA,EAC9B,MAAM,SAAS,MAAM,SAAS,QAAQ,MAAM,IAAI;AAAA,EAChD,aAAa,OAAO,MAAM;AAAA,EAC1B,MAAM,OAAO,SAAS,KAAK;AAAA,EAC3B,MAAM,WAAU,UAAS,IAAI;AAAA,EAC7B,MAAM,SAAS,MAAM,OAAO,SAAS,IAAI;AAAA,EACzC,MAAM,UAAU,WAAW,YAAY,YAAY,UAAS,SAAQ,OAAO,MAAM,CAAC;AAAA,EAClF,MAAM,QAAQ,WAAW,cAAc,OAAO,SAAS,MAAM,QAAQ,OAAO,aAAa;AAAA,EAMzF,IAAI,SAAS,WAAW;AAAA,IAAW,MAAM,kBAAkB,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACxF,MAAM,QAAQ,QAAQ,YAAY;AAAA,EAOlC,IACE,UAAU,aACV,EAAE,SAAS,WAAW,cACtB,YAAY,aACZ,YAAY,UACZ;AAAA,IACA,MAAM,QACJ,MAAM,MACN,GAAG,0FACD,uCACJ;AAAA,EACF;AAAA,EACA,IAAI,SAAS,WAAW;AAAA,IAAW,MAAM,WAAW,QAAQ,MAAM;AAAA,EAClE,MAAM,QAAQ,YAAY;AAAA,EAU1B,MAAM,QAAQ,UAAU,aAAa,MAAM,eAAe;AAAA,EAC1D,MAAM,gBAAgB,UAAU,aAAa,MAAM,iBAAiB,aAAa,MAAM,SAAS;AAAA,EAChG,IAAI;AAAA,IAAO,MAAM,OAAO,gBAAgB,MAAM,SAAQ,OAAO,IAAI,GAAG,UAAU;AAAA,EAC9E,IAAI,SAAS,OAAO;AAAA,IAAkB,MAAM,aAAa,MAAM;AAAA,EAC/D,MAAM,UAAU,SAAS,SAAS,OAAO;AAAA,EACzC,OAAO,OAAO,QAAQ,OAAO,EAAE,QAAQ,SAAS,eAAe,mBAAS,MAAM,OAAO,CAAC;AAAA;AAQjF,IAAM,aAAa,OACxB,QACA,WACkB;AAAA,EAClB,eAAe,QAAQ,OAAO,IAAI;AAAA,EAClC,MAAM,SAAS,MAAM,SAAS,QAAQ,OAAO,IAAI;AAAA,EACjD,IAAI,OAAO,gBAAgB,YAAY,OAAO,gBAAgB,cAAc;AAAA,IAC1E,MAAM,SAAS,QAAQ,OAAO,IAAI;AAAA,EACpC;AAAA,EACA,IAAI,OAAO,kBAAkB,aAAa,OAAO,kBAAkB,mBAAmB;AAAA,IACpF,MAAM,YAAY,QAAQ,OAAO,IAAI;AAAA,EACvC;AAAA,EACA,MAAM,OAAO,MAAM,OAAO,KAAK,OAAO,QAAQ;AAAA,EAC9C,IAAI,SAAS,WAAW;AAAA,IACtB,IAAI,KAAK,SAAS;AAAA,MAAQ,MAAM,QAAO,OAAO,MAAM,GAAG,OAAO,iBAAiB,KAAK,MAAM;AAAA,IAC1F,MAAM,OAAO,WAAW,OAAO,QAAQ;AAAA,EACzC;AAAA,EACA,MAAM,aAAa,MAAM;AAAA;;;AL/JpB,IAAM,cAAc,CACzB,QACA,MACA,WAEA,KAAK,YAAY;AAAA,EACf,MAAM,QAAQ,MAAM,SAAS,QAAQ,IAAI;AAAA,EACzC,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,OAAO,WAAW,YAAY,SAAQ,KAAK,IAAI;AAAA,CAChD;AAEI,IAAM,cAAc,CACzB,QACA,YACA,MACA,QACA,WAC2C;AAAA,EAE3C,IAAI,WAAW;AAAA,IAAW,OAAO,eAAe,UAAU;AAAA,EAC1D,IAAI,YAAW,IAAI;AAAA,IAAG,OAAO,KAAK,MAAM,SAAS,QAAQ,MAAM,QAAQ,MAAM,CAAC;AAAA,EAO9E,MAAM,OAAO,eAAe,MAAM,MAAM;AAAA,EACxC,IAAI,SAAS,aAAa,SAAS,OAAO;AAAA,IAAM,OAAc,gBAAQ,SAAS;AAAA,EAO/E,OAAO,KAAK,YAAY;AAAA,IACtB,MAAM,mBAAmB,QAAQ,QAAQ,IAAI;AAAA,IAC7C,OAAO,EAAE,QAAQ,WAAoB,aAAa,KAAK;AAAA,GACxD;AAAA;AAGI,IAAM,mBAAmB,CAC9B,QACA,MAMA,WAEO,gBAAQ,cAAc,IAAI,GAAG,CAAC,UACnC,KAAK,MAAM,cAAc,QAAQ,KAAK,MAAM,KAAK,QAAQ,OAAO,MAAM,CAAC,CACzE;AAEK,IAAM,gBAAgB,CAC3B,QACA,WAC+B,KAAK,MAAM,WAAW,QAAQ,MAAM,CAAC;;;ADrC/D,IAAM,cAAc,UAAsB,cAAc;AACxD,IAAM,eAAe,UAAuB,eAAe;AAE3D,IAAM,sBAAsB,MACxB,iBACP,aACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,YAAY,SAAS,GAAG;AAAA,IAM7B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,GAAG,MAAM,aAAa,YAAY,QAAQ,MAAM,MAAM;AAAA,IAC5D,MAAM,GAAG,YAAY,MAAM,aAAa,YAAY,QAAQ,YAAY,MAAM,MAAM;AAAA,IACpF,WAAW,CAAC,SAAS,iBAAiB,QAAQ,IAAI;AAAA,IAClD,QAAQ,GAAG,aAAa,cAAc,QAAQ,MAAM;AAAA,EACtD,CAAC;AAAA,CACF,CACH;AAEK,IAAM,uBAAuB,MACzB,iBACP,cACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,aAAa,SAAS,GAAG;AAAA,IAC9B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,GAAG,MAAM,aAAa,YAAY,QAAQ,MAAM,MAAM;AAAA,IAE5D,MAAM,GAAG,YAAY,MAAM,aACzB,YAAY,QAAQ,YAAY,MAAM,QAAQ,OAAO;AAAA,IACvD,WAAW,CAAC,SAAS,iBAAiB,QAAQ,MAAM,OAAO;AAAA,IAC3D,QAAQ,GAAG,aAAa,cAAc,QAAQ,MAAM;AAAA,EACtD,CAAC;AAAA,CACF,CACH;;;AR7DK,IAAM,iBAAiB,CAAC,WACvB,gBACJ,sBAAsB,GACtB,mBAAmB,GACnB,qBAAqB,GACrB,oBAAoB,CACtB,EAAE,KAAW,eAAQ,gBAAgB,MAAM,CAAC,CAAC;;AeE/C;AACA;;;ACPA,IAAM,UAAU;AAGT,IAAM,YAAY,CAAC,UAAkB,aAC1C,aAAa,WACT;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ,KAAK,QAAQ,IAAI,QAAQ;AAAA,EACjC;AACF,IACA,CAAC,UAAU,UAAU,QAAQ;AAG5B,IAAM,aAAa,CAAC,UAAkB,aAC3C,aAAa,WACT;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ,KAAK,QAAQ,IAAI,QAAQ;AAAA,EACjC;AACF,IACA,CAAC,UAAU,SAAS,QAAQ;AAGlC,IAAM,cAAc,CAAC,WAAwC;AAAA,EAC3D,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,QAAQ,OAAO,MAAM;AAAA,CAAI,GAAG;AAAA,IACrC,IAAI,KAAK,KAAK,MAAM,IAAI;AAAA,MACtB,IAAI,OAAO,OAAO;AAAA,QAAG;AAAA,MACrB;AAAA,IACF;AAAA,IACA,MAAM,KAAK,KAAK,QAAQ,IAAI;AAAA,IAC5B,IAAI,MAAM;AAAA,MAAG;AAAA,IACb,MAAM,MAAM,KAAK,MAAM,GAAG,EAAE;AAAA,IAC5B,IAAI,QAAQ;AAAA,MAAY;AAAA,IACxB,OAAO,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,EAC3C;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,OAAO,CAAC,SACZ,SAAS,aAAa,QAAQ,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI;AAErD,IAAM,YAAY,CAAC,UAAkB,WAAyC;AAAA,EACnF,IAAI,aAAa,UAAU;AAAA,IACzB,MAAM,SAAS,YAAY,MAAM;AAAA,IACjC,MAAM,OAAM,KAAK,OAAO,IAAI,KAAK,CAAC;AAAA,IAClC,MAAM,OAAM,KAAK,OAAO,IAAI,KAAK,CAAC;AAAA,IAClC,MAAM,QAAO,OAAO,IAAI,KAAK;AAAA,IAC7B,OAAO,SAAQ,aAAa,SAAQ,aAAa,UAAS,YACtD,YACA,EAAE,WAAK,aAAM,UAAI;AAAA,EACvB;AAAA,EAEA,MAAM,UAAU,OAAO,MAAM;AAAA,CAAI,EAAE,MAAM,IAAI,MAAM,GAAG;AAAA,EACtD,MAAM,MAAM,KAAK,OAAO,EAAE;AAAA,EAC1B,MAAM,MAAM,KAAK,OAAO,EAAE;AAAA,EAC1B,MAAM,OAAO,OAAO;AAAA,EACpB,OAAO,QAAQ,aAAa,QAAQ,aAAa,SAAS,aAAa,SAAS,KAC5E,YACA,EAAE,KAAK,MAAM,IAAI;AAAA;AAGhB,IAAM,aAAa,CAAC,UAAkB,WAAuC;AAAA,EAClF,IAAI,aAAa;AAAA,IAAU,OAAO,KAAK,YAAY,MAAM,EAAE,IAAI,KAAK,CAAC;AAAA,EAErE,OAAO,MAAM,OAAO,MAAM;AAAA,CAAI,EAAE,MAAM,IAAI,MAAM,GAAG,EAAE,EAAE;AAAA;;;ACtElD,IAAM,SAAS;AAMf,IAAM,aAAa,CAAC,QAAwB;AAAA,EACjD,IAAI,IAAI,SAAS,MAAM;AAAA,IAAG,MAAM,IAAI,MAAM,+BAA+B;AAAA,EACzE,OAAO,IAAI,IAAI,WAAW,KAAK,OAAO;AAAA;AAIjC,IAAM,YAAY,CAAC,SAAoC,KAAK,IAAI,UAAU,EAAE,KAAK,GAAG;AAE3F,IAAM,SAAS,CAAC,UAAkB,WAAW;AAetC,IAAM,cAAc,CAAC,QAAgB,UAC1C;AAAA,EAAM;AAAA;AAAA;AAAA,aAAkC,OAAO,KAAK;AAAA;AAU/C,IAAM,cAAc,CAAC,QAAgB,UAAsC;AAAA,EAChF,MAAM,KAAK,OAAO,YAAY;AAAA,EAAK,OAAO,KAAK,GAAG;AAAA,EAClD,IAAI,KAAK;AAAA,IAAG;AAAA,EACZ,MAAM,SAAS,aAAa,KAAK,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE,SAAS,CAAC,CAAC;AAAA,EAC5E,IAAI,SAAS,OAAO;AAAA,IAAW;AAAA,EAC/B,OAAO,EAAE,UAAU,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA;AAY7D,IAAM,UAAU,CACrB,MACA,QACA,YACsB;AAAA,EACtB,IAAI,SAAS,MAAM,KAAK,WAAW,GAAG,GAAG;AAAA,IACvC,MAAM,IAAI,MAAM,QAAQ,KAAK,UAAU,IAAI,+BAA+B;AAAA,EAC5E;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,OAAO,QAAQ,iBAAiB;AAAA,IAClD,GAAI,QAAQ,WAAW,CAAC;AAAA,IACxB;AAAA,IACA,cAAc,WAAW,MAAM;AAAA,EACjC;AAAA;;;AC9EF,IAAM,aAAa,CAAC,SAAiB,WAAW,kBAAkB;AAE3D,IAAM,aAAa,CAAC,SAAyB;AAAA,EAClD,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,OAAO,GAAG,WAAW,MAAM,iCAAiC,qBAAqB,OAAO,MAAM;AAAA;AAIzF,IAAM,aAAa,CAAC,SAAyB;AAAA,EAClD,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,OAAO,GAAG,WAAW,MAAM,eAAe,qBAAqB,OAAO,MAAM;AAAA;AAKvE,IAAM,eAAe,CAAC,SAAyB,YAAY,WAAW,IAAI;AAE1E,IAAM,aAAa,CAAC,SAAoC,UAAU,IAAI;AAiBtE,IAAM,cAAc,CAAC,MAAc,MAAc,YAAkC;AAAA,EACxF,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,MAAM,OAAO,cAAc;AAAA,EAK3B,MAAM,QACJ,QAAQ,QAAQ,YACZ,QAAQ,QAAQ,YACd,YACA,IAAI,OAAO,QAAQ,GAAG,MACxB,QAAQ,QAAQ,YACd,OAAO,QAAQ,GAAG,IAClB,GAAG,OAAO,QAAQ,GAAG,KAAK,OAAO,QAAQ,GAAG;AAAA,EACpD,MAAM,QAAQ,UAAU,YAAY,CAAC,IAAI,CAAC,SAAS,YAAY,aAAa,YAAY;AAAA,EACxF,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,SAAS,aAAa;AAAA,IACtB,GAAG;AAAA,IACH,SAAS,QAAQ,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,QAAQ,aAAa;AAAA,IACtE,YAAY,UAAU,aAAa;AAAA,EACrC,EAAE,KAAK;AAAA,CAAI;AAAA;AAGb,IAAM,YAAY;AAClB,IAAM,QAAQ,IAAI,IAA8B;AAAA,EAC9C,CAAC,OAAQ,MAAM;AAAA,EACf,CAAC,OAAQ,WAAW;AAAA,EACpB,CAAC,OAAQ,SAAS;AACpB,CAAC;AAGM,IAAM,YAAY,CAAC,WAAyC;AAAA,EACjE,MAAM,SAAS,OAAO,KAAK,EAAE,MAAM,KAAK;AAAA,EACxC,IAAI,OAAO,WAAW;AAAA,IAAG;AAAA,EACzB,OAAO,SAAS,OAAO,KAAK,KAAK,QAAQ;AAAA,EACzC,MAAM,MAAM,OAAO,SAAS,SAAS,EAAE;AAAA,EACvC,MAAM,OAAO,OAAO,SAAS,OAAO,CAAC;AAAA,EACrC,MAAM,UAAU,CAAC,KAAK,MAAM,OAAO,GAAG,GAAG,OAAO,GAAG,GAAG,OAAO,IAAI,CAAC;AAAA,EAClE,IAAI,QAAQ,KAAK,CAAC,UAAU,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,CAAC;AAAA,IAAG;AAAA,EACxE,OAAO;AAAA,IACL,KAAK,OAAO,GAAG;AAAA,IACf,MAAM,MAAM,IAAI,MAAM,SAAS,KAAK;AAAA,IAEpC;AAAA,IACA,MAAM,OAAO,IAAI;AAAA,IACjB,KAAK,OAAO,GAAG;AAAA,EACjB;AAAA;;;AHjDF,IAAM,WAAW,CAAC,MAAyB,WAAmB,UAC5D,IAAI,QAAQ,CAAC,SAAS,WAAW;AAAA,EAC/B,OAAO,YAAY,QAAQ;AAAA,EAC3B,MAAM,QAAQ,MAAM,SAAS,MAAM;AAAA,IACjC,OAAO;AAAA,IACP,OAAO,CAAC,UAAU,YAAY,WAAW,QAAQ,QAAQ,MAAM;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC;AAAA,EACD,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3D,MAAM,GAAG,SAAS,CAAC,UAAU;AAAA,IAC3B,OAAO,IAAI,MAAM,QAAQ,MAAM,SAAS,CAAC;AAAA,GAC1C;AAAA,EACD,IAAI,UAAU,aAAa,MAAM,UAAU,MAAM;AAAA,IAG/C,MAAM,MAAM,GAAG,SAAS,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA,IACvC,MAAM,MAAM,IAAI,KAAK;AAAA,EACvB;AAAA,EACA,MAAM,GAAG,SAAS,CAAC,UAAU,WAAW;AAAA,IACtC,QAAQ;AAAA,MACN,UAAU,YAAY;AAAA,MACtB;AAAA,MACA,QAAQ,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM;AAAA,MAC1C,QAAQ,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM;AAAA,IAC5C,CAAC;AAAA,GACF;AAAA,CACF;AAGI,IAAM,YAAY,OACvB,SAEA,OACA,QACA,UACwB;AAAA,EACxB,MAAM,OAAO,QAAQ,QAAQ,MAAM,YAAY,QAAQ,KAAK,GAAG;AAAA,IAC7D,mBAAmB,QAAQ;AAAA,OACvB,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE,CAAC;AAAA,EACD,MAAM,MAAM,MAAM,SAAS,MAAM,QAAQ,eAAe,KAAK;AAAA,EAC7D,MAAM,SAAS,YAAY,IAAI,QAAQ,KAAK;AAAA,EAC5C,IAAI,WAAW,WAAW;AAAA,IAGxB,MAAM,IAAI,MACR,OAAO,QAAQ,gEACb,GAAG,OAAO,IAAI,QAAQ,IAAI,IAAI,WAAW,OAAO,KAAK,eAAe,IAAI,gBACxE,GAAG,IAAI,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GACrC;AAAA,EACF;AAAA,EACA,OAAO,EAAE,UAAU,OAAO,UAAU,QAAQ,OAAO,QAAQ,QAAQ,IAAI,OAAO;AAAA;AAGhF,IAAM,eAAe,CAAC,SACpB,IAAI,WAAW,OAAO,KAAK,KAAK,WAAW;AAAA,GAAM,EAAE,GAAG,QAAQ,CAAC;AAEjE,IAAM,SAAS,CAAC,MAAc,MAAc,WAC1C,IAAI,MACF,OAAO,SAAS,WAAW,OAAO,OAAO,QAAQ,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAC1F;AASK,IAAM,YAAY,OAAO,YAAmD;AAAA,EACjF,MAAM,WAAW;AAAA,IACf,mBAAmB,QAAQ,qBAAqB;AAAA,IAChD,eAAe,QAAQ,iBAAiB;AAAA,IACxC,MAAM,QAAQ;AAAA,OACV,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE;AAAA,EACA,MAAM,QAAQ,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EAC3C,MAAM,OAAM,CAAC,QAAgB,UAAuB,UAAU,UAAU,OAAO,QAAQ,KAAK;AAAA,EAC5F,MAAM,QAAQ,MAAM,KAAI,iBAAiB;AAAA,EACzC,IAAI,MAAM,aAAa;AAAA,IAAG,MAAM,OAAO,QAAQ,MAAM,mBAAmB,KAAK;AAAA,EAC7E,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,EAAE,MAAM;AAAA,CAAI;AAAA,EACpD,IAAI,WAAW,WAAW,QAAQ,aAAa,CAAC,QAAQ,KAAK,GAAG,GAAG;AAAA,IACjE,MAAM,IAAI,MACR,OAAO,QAAQ,oCAAoC,KAAK,UAAU,MAAM,OAAO,KAAK,CAAC,QACnF,2FACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAO,GAAG;AAAA,EACvB,OAAO;AAAA,IACL,cAAc,MAAM;AAAA,IACpB,MAAM,CAAC,SAAS,KAAI,WAAW,IAAI,CAAC;AAAA,IACpC,aAAa,OAAO,aAAa;AAAA,MAC/B,MAAM,SAAS,MAAM,KAAI,WAAW,WAAW,SAAS,QAAQ,CAAC,CAAC;AAAA,MAClE,OAAO,OAAO,aAAa,IAAI,WAAW,SAAS,OAAO,MAAM,IAAI;AAAA;AAAA,IAEtE,YAAY,OAAO,aAAa;AAAA,MAC9B,MAAM,SAAS,MAAM,KAAI,WAAW,UAAU,SAAS,QAAQ,CAAC,CAAC;AAAA,MACjE,OAAO,OAAO,aAAa,IAAI,UAAU,SAAS,OAAO,MAAM,IAAI;AAAA;AAAA,IAErE,YAAY;AAAA,IACZ,UAAU,OAAO,SAAS;AAAA,MACxB,MAAM,SAAS,MAAM,KAAI,WAAW,IAAI,CAAC;AAAA,MACzC,IAAI,OAAO,aAAa;AAAA,QAAQ;AAAA,MAChC,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,QAAQ,MAAM;AAAA,MAC5E,OAAO,aAAa,OAAO,MAAM;AAAA;AAAA,IAEnC,YAAY,OAAO,SAAS;AAAA,MAC1B,MAAM,SAAS,MAAM,KAAI,aAAa,IAAI,CAAC;AAAA,MAC3C,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,UAAU,QAAQ,MAAM;AAAA;AAAA,IAEhF,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,IAC/D,MAAM,OAAO,SAAS;AAAA,MACpB,MAAM,SAAS,MAAM,KAAI,WAAW,IAAI,CAAC;AAAA,MACzC,IAAI,OAAO,aAAa;AAAA,QAAQ;AAAA,MAChC,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,QAAQ,MAAM;AAAA,MAC5E,MAAM,SAAS,UAAU,OAAO,MAAM;AAAA,MAGtC,IAAI,WAAW,WAAW;AAAA,QACxB,MAAM,IAAI,MAAM,OAAO,QAAQ,cAAc,kCAAkC;AAAA,MACjF;AAAA,MACA,OAAO;AAAA;AAAA,IAET,iBAAiB,OAAO,MAAM,OAAO,UAAU;AAAA,MAC7C,MAAM,KAAK,KAAK,YAAY,GAAG;AAAA,MAC/B,MAAM,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,MAAM,KAAK,MAAM,KAAK,CAAC,KAAK,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,MACzF,MAAM,SAAS,MAAM,KAAI,YAAY,MAAM,MAAM,KAAK,GAAG,KAAK;AAAA,MAC9D,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,SAAS,QAAQ,MAAM;AAAA;AAAA,EAEjF;AAAA;",
-  "debugId": "EAA28AD7F62613BA64756E2164756E21",
+  "mappings": ";AASA;AACA,oBAAS;AACT;AACA;AACA;;;ACJA;AAEO,IAAM,OAAO,CAAI,SACf,kBAAW;AAAA,EAChB,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,EAC3E,KAAK;AACP,CAAC;AAQI,IAAM,iBAAiB,CAAC,MAAe,QAAoC;AAAA,EAChF,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,QAAS,KAAiC;AAAA,EAChD,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA;;;ACZ7C;AACA;AAAA;AA6FO,MAAM,0BAAkC,gBAAuC,EACpF,8BACF,EAAE;AAAC;AAGI,IAAM,kBAAkB,CAAC,WACxB,cAAQ,mBAAmB,MAAM;AAGlC,IAAM,eAAe,CAAC,WAC3B,OAAO,cAAc,OAAO,aAAa,MAAM;;;AC7GjD;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,WAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,YAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,gBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,cAAM,QAAQ,GAAU,oBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,gBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,cAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,cAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,YAAW,sBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,YAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,sBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,sBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,YACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAaK,IAAM,sBAAsB,CAAC,KAAa,eACxC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,cAAM;AAAA,CACtE;;;AFxFI,IAAM,eAAe,CAAC,QACpB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,sBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,sBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AIzG9B,IAAM,cACJ,gGACA;AAGF,IAAM,cACJ;AAGF,IAAM,cAAc;AAGpB,IAAM,YAAY;AAEX,IAAM,cAAc;AAG3B,IAAM,YAAY,CAAC,OAAmB,SAA2B;AAAA,EAC/D,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1E,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAQ,MAAgC,QAAQ,CAAC,MAAM,UACrD,UAAU,MAAM,GAAG,QAAQ,OAAO,KAAK,IAAI,CAC7C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,OAAO,OAAO,QAAQ,KAAK,EAAE,QAAQ,EAAE,KAAK,UAAU,UAAU,MAAM,GAAG,QAAQ,KAAK,CAAC;AAAA,EACzF;AAAA,EACA,OAAO,CAAC;AAAA;AAOH,IAAM,oBAAoB,CAC/B,aACA,MACA,cACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,MAAM,UAAU,OAAO,QAAQ,eAAe,CAAC,CAAC,GAAG;AAAA,IAC7D,IAAI,YAAY,KAAK,IAAI;AAAA,MACvB,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,IACjE,SAAI,YAAY,KAAK,KAAK;AAAA,MAC7B,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,EACxE;AAAA,EACA,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAEzC,IAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MACzB,MAAM,KAAK,oBAAoB,OAAO,KAAK,8BAA8B,aAAa;AAAA,IACxF,EAAO,SAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAAA,MACzD,MAAM,KAAK,oBAAoB,OAAO,QAAQ,CAAC,6BAA6B,aAAa;AAAA,IAC3F,EAAO,SAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MAChC,MAAM,KAAK,oBAAoB,OAAO,KAAK,2BAA2B,aAAa;AAAA,IACrF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,UAAU,aAAa,CAAC,GAAG,WAAW,GAAG;AAAA,IAC1D,MAAM,KAAK,GAAG,6BAA6B,aAAa;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,qBAAqB,CAAC,YACjC,YAAY,KAAK,OAAO,IAAI,CAAC,gCAAgC,aAAa,IAAI,CAAC;;;AC9C1E,IAAM,eAAe;AAGrB,IAAM,mBAAmB,CAAC,MAAc,UAAiD;AAAA,EAC9F,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAOpE,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,KAAK,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,uBAAuB;AAAA,EAG7D,IACE,KAAK,SAAS,GAAG,KACjB,KACG,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAC9D;AAAA,IACA,MAAM,KAAK,6EAA6E;AAAA,EAC1F;AAAA,EACA,IAAI,KAAK,SAAS,MAAM;AAAA,IAAG,MAAM,KAAK,mBAAmB;AAAA,EACzD,OAAO;AAAA;AAGF,IAAM,eAAe,CAAC,UAAmC;AAAA,EAC9D,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,OAAO;AAAA;;;AC3CF,IAAM,mBAAmB;AAEzB,IAAM,SAAS,CAAC,MAAc,YACnC,IAAI,MAAM,kBAAkB,SAAS,SAAS;AAEhD,IAAM,aAAa,CAAC,MAAc,UAAiD;AAAA,EACjF,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,gCAAgC;AAAA,EAC9F;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAGpE,IAAM,oBAAoB,CAAC,UAAwC;AAAA,EACxE,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,WAAW,SAAS,MAAM,KAAK,GAAG,GAAG,WAAW,SAAS,MAAM,KAAK,CAAC;AAAA,EACnF,OAAO;AAAA;AAGT,IAAM,YAAY,CAAC,UACjB,OAAO,UAAU,WAAW,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;AAI5E,IAAM,UAAU,OAAO,QAAoB,UAAgD;AAAA,EACzF,MAAM,QAAQ,kBAAkB,KAAK;AAAA,EACrC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,OAAO,MAAM,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,EAC/D,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI,MAAM,UAAU,WAAW;AAAA,IAC7B,MAAM,UAAU,MAAM,KAAK,MAAM,MAAM,OAAO,WAAW,OAAO,MAAM,KAAK,CAAC,IAAI;AAAA,IAChF,IAAI,QAAQ;AAAA,MAAW,MAAM,OAAO,MAAM,MAAM,WAAW,OAAO,MAAM,KAAK,gBAAgB;AAAA,EAC/F;AAAA,EACA,IAAI,MAAM,UAAU,WAAW;AAAA,IAC7B,MAAM,UAAU,MAAM,KAAK,KAAM,MAAM,OAAO,YAAY,OAAO,MAAM,KAAK,CAAC;AAAA,IAC7E,IAAI,QAAQ;AAAA,MAAW,MAAM,OAAO,MAAM,MAAM,YAAY,OAAO,MAAM,KAAK,gBAAgB;AAAA,EAChG;AAAA,EACA,OAAO;AAAA,IACL,MAAM,MAAM,QAAQ;AAAA,OAChB,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,OAC/B,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,EACrC;AAAA;AAGK,IAAM,gBAAgB,OAC3B,QACA,SACiD;AAAA,EACjD,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS,aAAa,KAAK,SAAS;AAAA,IAAa;AAAA,EACrD,OAAO,EAAE,KAAK,KAAK,KAAK,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA;AAG/D,IAAM,QAAQ,CAAC,SAAiB,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG;AAGhE,IAAM,OAAO,OAAO,QAAoB,MAAc,SAA2C;AAAA,EAC/F,MAAM,SAAS,MAAM,OAAO,KAAK,IAAI;AAAA,EACrC,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,OACJ,MACA,GAAG,KAAK,KAAK,GAAG,QAAQ,OAAO,OAAO,QAAQ,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GACvF;AAAA,EACF;AAAA;AAQK,IAAM,qBAAqB,OAChC,QACA,OACA,QACA,QAAQ,UAC6B;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AAAA,EACxC,IAAI,KAAK,QAAQ,aAAa,KAAK,QAAQ,OAAO,aAAa,KAAK,CAAC,aAAa,MAAM,GAAG;AAAA,IACzF,MAAM,OACJ,MAAM,MACN,SAAS,OAAO,MAAM,KAAK,sEACzB,uFACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,IAAI;AAAA,EACzC,IAAI,SAAS,aAAa,KAAK,SAAS,aAAa;AAAA,IACnD,MAAM,OAAO,MAAM,MAAM,QAAQ,KAAK,uBAAuB;AAAA,EAC/D;AAAA,EAMA,IAAI,WAAW,aAAa,SAAS,aAAa,CAAC,OAAO;AAAA,IACxD,MAAM,UAAU,KAAK,SAAS,KAAK,QAAS,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK;AAAA,IACxF,IAAI,SAAS;AAAA,MACX,MAAM,OACJ,MAAM,MACN,uFACE,uDACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,SAAS,MAAM,KAAK,MAAM,GAAG,MAAM,KAAK,YAAY,GAAG,CAAC,KAAK;AAAA,IACnE,MAAM,QAAQ,MAAM,OAAO,KAAK,MAAM;AAAA,IACtC,IAAI,UAAU,aAAa,MAAM,SAAS,aAAa;AAAA,MACrD,MAAM,OAAO,MAAM,MAAM,cAAc,mDAAmD;AAAA,IAC5F;AAAA,IACA,MAAM,KAAK,QAAQ,MAAM,MAAM,CAAC,SAAS,MAAM,MAAM,KAAK,IAAI,GAAG,MAAM,MAAM,IAAI,CAAC;AAAA,EACpF,EAAO,SAAI,KAAK,SAAS,KAAK,MAAM;AAAA,IAClC,MAAM,KAAK,QAAQ,MAAM,MAAM,CAAC,SAAS,MAAM,KAAK,IAAI,GAAG,MAAM,MAAM,IAAI,CAAC;AAAA,EAC9E;AAAA,EAMA,MAAM,QAAQ,aACZ,EAAE,KAAK,MAAM,OAAO,IAAI,MAAM,GAAG,MAAM,MAAM,MAAM,KAAK,MAAM,OAAO,GAAG,GACxE,IACF,IACI,YACA,SAAS,IAAI;AAAA,EACjB,IAAI,UAAU;AAAA,IAAW,MAAM,KAAK,QAAQ,MAAM,MAAM,CAAC,SAAS,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,EAC1F,MAAM,QAAQ,MAAM,cAAc,QAAQ,MAAM,IAAI;AAAA,EAEpD,IAAI,UAAU,aAAa,MAAM,SAAS,KAAK,QAAQ,CAAC,aAAa,OAAO,IAAI,GAAG;AAAA,IACjF,MAAM,OAAO,MAAM,MAAM,0DAA0D;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AAIT,IAAM,WAAW,CAAC,SAAsC;AAAA,EACtD,IAAI,KAAK,QAAQ;AAAA,IAAW,OAAO,KAAK,QAAQ,YAAY,YAAY,IAAI,OAAO,KAAK,GAAG;AAAA,EAC3F,OAAO,KAAK,QAAQ,YAAY,OAAO,KAAK,GAAG,IAAI,GAAG,OAAO,KAAK,GAAG,KAAK,OAAO,KAAK,GAAG;AAAA;AAG3F,IAAM,eAAe,CAAC,MAA+B,UAClD,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK,SAC5C,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK;AAOxC,IAAM,gBAAgB,OAC3B,QACA,MACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI;AAAA,EACvC,IAAI,KAAK,SAAS,OAAO;AAAA,IAAM,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC1D,MAAM,OAAO,MAAM,cAAc,QAAQ,KAAK,IAAI;AAAA,EAGlD,MAAM,YACJ,SAAS,aACT,KAAK,SAAS,KAAK,QACnB,aAAa,MAAM,IAAI,KACvB,OAAO,SAAS,KAAK,QACrB,aAAa,QAAQ,IAAI;AAAA,EAC3B,IAAI;AAAA,IAAW,OAAO,EAAE,QAAQ,OAAO;AAAA,EACvC,MAAM,OAAO,aAAa,KAAK,MAAM,IAAI;AAAA,EACzC,OAAO,EAAE,QAAQ,SAAS;AAAA;AAIrB,IAAM,kBAAkB,OAC7B,QACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,OAAO,KAAK,OAAO,IAAI;AAAA,EAC1C,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAChB,MAAM,OAAO,OAAO,MAAM,YAAY,KAAK,uBAAuB;AAAA,EACpE,MAAM,KAAK,QAAQ,OAAO,MAAM,CAAC,SAAS,MAAM,OAAO,IAAI,CAAC;AAAA;;;ATxLvD,IAAM,gBAAgB,SAAwB,gBAAgB;AAE9D,IAAM,wBAAwB,MAC1B,gBACP,eACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,cAAc,SAAS,GAAG;AAAA,IAC/B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAE7B,MAAM,GAAG,MAAM,aACb,KAAK,YAAY;AAAA,MACf,MAAM,QAAQ,MAAM,cAAc,QAAQ,KAAK,IAAI;AAAA,MACnD,IAAI,UAAU;AAAA,QAAW;AAAA,MACzB,OAAO,WAAW,YAAY,SAAQ,KAAK,IAAI;AAAA,KAChD;AAAA,IAEH,MAAM,GAAG,YAAY,MAAM,aAAa;AAAA,MACtC,IAAI,WAAW;AAAA,QAAW,OAAO,eAAe,UAAU;AAAA,MAC1D,IAAI,WAAW,IAAI;AAAA,QAAG,OAAO,KAAK,MAAM,cAAc,QAAQ,MAAM,MAAM,CAAC;AAAA,MAG3E,MAAM,OAAO,eAAe,MAAM,MAAM;AAAA,MACxC,OAAc,gBACZ,SAAS,aAAa,SAAS,OAAO,OAAO,EAAE,QAAQ,UAAmB,IAAI,SAChF;AAAA;AAAA,IAGF,WAAW,GAAG,KAAK,YAAY,MAAM,aAC5B,gBAAQ,cAAc,EAAE,KAAK,YAAY,OAAO,CAAC,GAAG,CAAC,UAC1D,KAAK,MAAM,mBAAmB,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAC5D;AAAA,IAEF,QAAQ,GAAG,aAAa,KAAK,MAAM,gBAAgB,QAAQ,MAAM,CAAC;AAAA,EACpE,CAAC;AAAA,CACF,CACH;;AUzDF;;;ACQA,qBAAS;AACT,oBAAS;AACT,uBAAS;AACT;AACA;;;ACfA;;;ACqBO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EADX,WAAW,CACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,SAAS,KAAK,WAAW,SAAS,QAAQ;AAAA,IAHhD;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,SACJ;AAAA,IACA,0DACA;AAAA,IACA;AAAA;AAGF,IAAM,YAAY;AASlB,IAAM,YAAY;AAQX,IAAM,aAAa,CAAC,MAAc,SAAyB;AAAA,EAChE,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,EAC/B,IAAI,QAAQ,MAAM;AAAA,IAChB,MAAM,OAAO,IAAI,GAAG,YAAY,CAAC,KAAK;AAAA,IACtC,MAAM,IAAI,WACR,MACA,KAAK,KAAK,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,4BACtD;AAAA,EACF;AAAA,EACA,OAAO,KACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,MAAM,OAAO;AAAA;AAG7B,IAAM,iBAAgB,CAAC,UAA2B;AAAA,EAChD,MAAM,QAAQ,OAAO,eAAe,KAAK;AAAA,EACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAGjD,IAAM,cAAc,CAAC,OAAgB,MAAc,OAAe,QAAwB;AAAA,EACxF,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAC7B,IAAI,QAAQ;AAAA,IAAW,MAAM,IAAI,WAAW,MAAM,sBAAsB,OAAO,SAAS,GAAG;AAAA,EAC3F,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,IAAI,KAAK,GAAG,cAAc,WAAW,OAAO,IAAI,YAAY;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,IAAI,KAAK,GAAG,OAAO,QAAQ,SAAS,WAAW;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAE7B,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAAA,MAChC,MAAM,IAAI,WAAW,MAAM,GAAG,OAAO,KAAK,6CAA6C;AAAA,IACzF;AAAA,IACA,IAAI,KAAK,GAAG,eAAe,OAAO,UAAU,IAAI,IAAI,KAAK,aAAa;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,IAAI,KAAK,GAAG,aAAa;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB,YAAY,OAAO,SAAU,MAA6B,QAAQ,GAAG;AAAA,MACnE,YAAY,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG,GAAG;AAAA,IAC/D;AAAA,IACA,IAAI,KAAK,GAAG,aAAa;AAAA,IACzB;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,eAAc,KAAK,GAAG;AAAA,IACvE,WAAW,OAAkC,MAAM,OAAO,GAAG;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAM,OAAO,UAAU,OAAO,SAAS,OAAO;AAAA,EAC9C,MAAM,IAAI,WAAW,MAAM,GAAG,+CAA+C;AAAA;AAG/E,IAAM,aAAa,CACjB,MACA,MACA,OACA,QACS;AAAA,EACT,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAE7B,MAAM,OAAO,OAAO,KAAK,IAAI,EAAE,KAAK;AAAA,EACpC,IAAI,KAAK,WAAW,GAAG;AAAA,IACrB,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB;AAAA,EACF;AAAA,EACA,IAAI,KAAK,GAAG,WAAW;AAAA,EACvB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,QAAQ;AAAA,IAC7C,IAAI,KAAK,GAAG,YAAa,WAAW,KAAK,KAAK,SAAS;AAAA,IACvD,YAAY,KAAK,MAAM,OAAO,QAAQ,GAAG,GAAG;AAAA,EAC9C;AAAA,EACA,IAAI,KAAK,GAAG,YAAY;AAAA;AAInB,IAAM,cAAc,CAAC,SAA4B;AAAA,EACtD,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,KAAK,CAAC,eAAc,IAAI,GAAG;AAAA,IAC5F,MAAM,IAAI,WAAW,IAAI,iDAAiD;AAAA,EAC5E;AAAA,EACA,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAiC,IAAI,GAAG,GAAG;AAAA,EACtD,OAAO,GAAG,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;;;ADxE3B,IAAM,cAAc,CAAC,WAA6C;AAAA,EACvE,IAAI,WAAW;AAAA,IAAU,OAAO,EAAE,MAAM,SAAS;AAAA,EACjD,MAAM,QAAQ,eAAe,KAAK,MAAM;AAAA,EACxC,OAAO,QAAQ,OAAO,YAAY,YAAY,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,EAAE,EAAE;AAAA;AAG9E,IAAM,gBAAgB,CAAC,OAAe,WAAkC,GAAG,UAAU;AAOrF,IAAM,eAAe,CAC1B,OACA,QACA,SACW;AAAA,EACX,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,0BAA0B;AAAA,EAE/D,IAAI,SAAS,aAAa,CAAC,KAAK,WAAW,GAAG,GAAG;AAAA,IAC/C,MAAM,IAAI,MAAM,OAAO,OAAO,OAAO,GAAG,gDAAgD;AAAA,EAC1F;AAAA,EACA,OAAO,GAAG,6BAA6B;AAAA;AAIlC,IAAM,aAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAAe,CAAC,UAAuC;AAAA,EAC3D,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,MAAM,WAAW;AAAA,IAAW,KAAK,YAAY,MAAM;AAAA,EACvD,IAAI,MAAM,SAAS;AAAA,IAAW,KAAK,UAAU,MAAM;AAAA,EACnD,IAAI,MAAM,QAAQ;AAAA,IAAW,KAAK,SAAS,MAAM;AAAA,EACjD,IAAI,MAAM,YAAY;AAAA,IAAW,KAAK,aAAa,MAAM;AAAA,EACzD,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,MAAM;AAAA,EACrD,OAAO;AAAA;AAGT,IAAM,iBAAiB,CAAC,cAAqC;AAAA,EAC3D,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO;AAAA,EAC3C,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,UAAU,mBAAmB;AAAA,IAAW,KAAK,oBAAoB,UAAU;AAAA,EAC/E,IAAI,UAAU,YAAY;AAAA,IAAW,KAAK,aAAa,UAAU;AAAA,EACjE,OAAO;AAAA;AAIF,IAAM,eAAe,CAAC,UAAsC;AAAA,EACjE,MAAM,OAAmC,KAAK,MAAM,UAAU;AAAA,EAC9D,KAAK,WAAW,MAAM;AAAA,EACtB,KAAK,sBAAsB,CAAC,GAAG,MAAM,gBAAgB;AAAA,EACrD,MAAM,MAAM,MAAM,eAAe,CAAC;AAAA,EAClC,IAAI,OAAO,KAAK,GAAG,EAAE,SAAS;AAAA,IAAG,KAAK,0BAA0B,KAAK,IAAI;AAAA,EACzE,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,eAAe,MAAM,SAAS;AAAA,EACrF,IAAI,MAAM,kBAAkB;AAAA,IAAW,KAAK,mBAAmB,MAAM;AAAA,EACrE,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,KAAK,2BAA2B,MAAM,QAAQ,QAAQ,IACjD,SAAyC,IAAI,YAAY,IAC1D,aAAa,QAA4B;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,oBAAoB;AAAA,IAAW,KAAK,qBAAqB,MAAM;AAAA,EACzE,IAAI,MAAM,sBAAsB;AAAA,IAAW,KAAK,uBAAuB,MAAM;AAAA,EAC7E,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,aAAa;AAAA,IAAW,KAAK,cAAc,MAAM;AAAA,EAC3D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,OAAO;AAAA;AAGF,IAAM,YAAY,CAAC,UACxB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAG1C,IAAM,YAAY,CACvB,UACwD;AAAA,EACxD,MAAM,OAAO,YAAY,aAAa,KAAK,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC3C,OAAO,EAAE,OAAO,QAAQ,UAAU,KAAK,GAAG,KAAK;AAAA;;;AExJ1C,IAAM,kBAAkB;AAE/B,IAAM,SAAS,CAAC,SAAqB;AAAA,EACnC,MAAM,UAAU,KAAK,WAAW;AAAA,EAChC,OAAO;AAAA,IACL,OAAO,GAAG,iBAAiB,KAAK;AAAA,IAChC,KAAK,GAAG,eAAe,KAAK;AAAA,EAC9B;AAAA;AAaK,IAAM,aAAa,CAAC,GAA2B,MACpD,MAAM,aAAa,MAAM,YACrB,MAAM,aAAa,MAAM,YACzB,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,sBAAsB,EAAE,WAAW;AAErE,IAAM,iBAAiB,CAAC,SAA+B;AAAA,EAC5D,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,UAAU,KAAK,WAAW;AAAA,EAChC,IAAI,CAAC,YAAY,KAAK,OAAO,KAAK,QAAQ,SAAS,MAAQ,GAAG;AAAA,IAC5D,MAAM,KAAK,iDAAiD;AAAA,EAC9D;AAAA,EAGA,IAAI,CAAC,wCAAwC,KAAK,KAAK,IAAI,GAAG;AAAA,IAC5D,MAAM,KAAK,sEAAsE;AAAA,EACnF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,UAAS,CAAC,YAA2B,IAAI,MAAM,mBAAmB,SAAS;AAEjF,IAAM,YAAY,CAAC,MAAc,IAAuB,SACtD,QACE,GAAG,YAAY,KAAK,UAAU,IAAI,YAAY,GAAG,IAAI,CAAC,UAAU,QAAQ,CAAC,EAAE,KAAK,IAAI,SAClF,mEACJ;AAGF,IAAM,SAAS,CAAC,OAA0B,SAAqB;AAAA,EAC7D,QAAQ,OAAO,QAAQ,OAAO,IAAI;AAAA,EAClC,MAAM,SAAS,MAAM,QAAQ,CAAC,MAAM,UAAW,SAAS,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAE;AAAA,EAC7E,MAAM,OAAO,MAAM,QAAQ,CAAC,MAAM,UAAW,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC,CAAE;AAAA,EACzE,IAAI,OAAO,SAAS;AAAA,IAAG,MAAM,UAAU,qBAAqB,QAAQ,KAAK;AAAA,EACzE,IAAI,KAAK,SAAS;AAAA,IAAG,MAAM,UAAU,mBAAmB,MAAM,GAAG;AAAA,EACjE,OAAO,QAAQ;AAAA,EACf,OAAO,MAAM;AAAA,EACb,IAAI,SAAS,aAAa,OAAO;AAAA,IAAW;AAAA,EAC5C,IAAI,SAAS,aAAa,OAAO,WAAW;AAAA,IAC1C,MAAM,QACJ,GAAG,KAAK,UAAU,KAAK,IAAI,WAAW,SAAS,YAAY,QAAQ,2BACjE,+EACJ;AAAA,EACF;AAAA,EACA,IAAI,KAAK;AAAA,IAAM,MAAM,QAAO,GAAG,KAAK,UAAU,KAAK,IAAI,uCAAuC;AAAA,EAC9F,OAAO,EAAE,MAAM,GAAG;AAAA;AASb,IAAM,eAAe,CAAC,MAAc,MAAkB,SAAyB;AAAA,EACpF,QAAQ,OAAO,QAAQ,OAAO,IAAI;AAAA,EAElC,MAAM,QAAQ,CAAC,OAAO,GAAI,SAAS,KAAK,CAAC,IAAI,KAAK,QAAQ,OAAO,EAAE,EAAE,MAAM;AAAA,CAAI,GAAI,GAAG;AAAA,EACtF,MAAM,QAAQ,KAAK,MAAM;AAAA,CAAI;AAAA,EAC7B,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,EAChC,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,CAAC,GAAG,MAAM,MAAM,GAAG,MAAM,IAAI,GAAG,GAAG,OAAO,GAAG,MAAM,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA,EAC1F;AAAA,EACA,MAAM,SAAS,SAAS,MAAM,KAAK,SAAS;AAAA,CAAI,IAAI,OAAO,GAAG;AAAA;AAAA,EAC9D,OAAO,GAAG,SAAS,MAAM,KAAK;AAAA,CAAI;AAAA;AAAA;AAI7B,IAAM,aAAa,CAAC,MAAc,SAAyC;AAAA,EAChF,MAAM,QAAQ,KAAK,MAAM;AAAA,CAAI;AAAA,EAC7B,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,EAChC,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,OAAO,MAAM,MAAM,MAAM,OAAO,GAAG,MAAM,EAAE;AAAA,EACjD,OAAO,KAAK,WAAW,IAAI,KAAK,GAAG,KAAK,KAAK;AAAA,CAAI;AAAA;AAAA;AAS5C,IAAM,eAAe,CAAC,MAAc,SAA6B;AAAA,EACtE,MAAM,QAAQ,KAAK,MAAM;AAAA,CAAI;AAAA,EAC7B,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,EAChC,IAAI,UAAU;AAAA,IAAW,OAAO;AAAA,EAChC,OAAO,CAAC,GAAG,MAAM,MAAM,GAAG,MAAM,IAAI,GAAG,GAAG,MAAM,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA;;;ACtEzE,IAAM,gBAAe;AAE5B,IAAM,oBAAmB,CAAC,MAAc,UAAiD;AAAA,EACvF,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAGpE,IAAM,gBAAe,CAAC,UAAqC;AAAA,EAChE,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,kBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,kBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,IAAI,MAAM,WAAW,WAAW;AAAA,IAC9B,MAAM,KAAK,GAAG,eAAe,MAAM,MAAM,CAAC;AAAA,IAG1C,IAAI,MAAM,WAAW,SAAS,MAAM,SAAS,aAAa,MAAM,UAAU,YAAY;AAAA,MACpF,MAAM,KACJ,2FACF;AAAA,IACF;AAAA,EACF,EAAO,SAAI,MAAM,WAAW,MAAM;AAAA,IAChC,MAAM,KAAK,kFAAkF;AAAA,EAC/F;AAAA,EACA,OAAO;AAAA;;;AC5EF,IAAM,UAAU,IAAI;AACpB,IAAM,UAAU,IAAI;AAEpB,IAAM,UAAS,CAAC,MAAc,YACnC,IAAI,MAAM,eAAe,SAAS,SAAS;AAE7C,IAAM,aAAY,CAAC,UACjB,OAAO,UAAU,WAAW,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;AAKrE,IAAM,WAAW,OAAO,QAAoB,UAA8C;AAAA,EAC/F,MAAM,QAAQ,cAAa,KAAK;AAAA,EAChC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,QAAO,MAAM,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,EAC/D,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI,MAAM,UAAU,WAAW;AAAA,IAC7B,MAAM,WAAU,MAAM,KAAK,MAAM,MAAM,OAAO,WAAW,OAAO,MAAM,KAAK,CAAC,IAAI;AAAA,IAChF,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,MAAM,WAAW,OAAO,MAAM,KAAK,gBAAgB;AAAA,EAC/F;AAAA,EACA,IAAI,MAAM,UAAU,WAAW;AAAA,IAC7B,MAAM,WAAU,MAAM,KAAK,KAAM,MAAM,OAAO,YAAY,OAAO,MAAM,KAAK,CAAC;AAAA,IAC7E,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,MAAM,YAAY,OAAO,MAAM,KAAK,gBAAgB;AAAA,EAChG;AAAA,EACA,OAAO,KAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,MAAQ,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,EAAG;AAAA;AAGjF,IAAM,WAAW,CAAC,SAAyB,UAAU,QAAQ,OAAO,IAAI,CAAC;AAwBzE,IAAM,aAAa,CAAC,OAAwB,WAAuC;AAAA,EACxF,IAAI,MAAM,SAAS,OAAO;AAAA,IAAM,OAAO;AAAA,EACvC,IAAI,WAAW,MAAM,QAAQ,OAAO,MAAM;AAAA,IAAG,OAAO;AAAA,EACpD,IAAI,MAAM,WAAW,aAAa,OAAO,WAAW,WAAW;AAAA,IAC7D,MAAM,QACJ,MAAM,MACN,yEACE,GAAG,KAAK,WAAW,MAAM,UAAU,OAAO,SAAS,QAAQ,EAAE,+BAC7D,oFACJ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,cAAc,CACzB,MACA,WACuB;AAAA,EACvB,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,WAAW;AAAA,IAAW,OAAO,SAAS,IAAI;AAAA,EAC9C,MAAM,OAAO,WAAW,MAAM,MAAM;AAAA,EACpC,OAAO,SAAS,YAAY,YAAY,SAAS,IAAI;AAAA;AAIhD,IAAM,qBAAqB,OAChC,QACA,MACA,WAC8C;AAAA,EAC9C,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,KAAK,SAAS,SAAS,MAAM,OAAO,SAAS,IAAI,IAAI;AAAA,EACnE,MAAM,OAAO,UAAU,YAAY,YAAY,QAAQ,OAAO,KAAK;AAAA,EACnE,OAAO;AAAA,IACL,eAAe,YAAY,MAAM,MAAM,KAAK;AAAA,IAC5C,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,IACX;AAAA,OACI,WAAW,YAAY,CAAC,IAAI,EAAE,OAAO;AAAA,IACzC,QAAQ,UAAU,YAAY,KAAK,UAAU,KAAK;AAAA,IAClD,MAAM,KAAK;AAAA,IACX,KAAK,KAAK;AAAA,EACZ;AAAA;AAGF,IAAM,UAAU,CAAC,MAA4B,UAC3C,SAAS,aACT,KAAK,SAAS,MAAM,SACnB,MAAM,QAAQ,aAAa,KAAK,QAAQ,MAAM,SAC9C,MAAM,QAAQ,aAAa,KAAK,QAAQ,MAAM;AAiB1C,IAAM,YAAY,OACvB,QACA,OACA,SACkB;AAAA,EAClB,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,IAAI;AAAA,EACzC,IAAI,SAAS,aAAa,KAAK,SAAS,QAAQ;AAAA,IAC9C,MAAM,QACJ,MAAM,MACN,QAAQ,KAAK,gEACf;AAAA,EACF;AAAA,EACA,MAAM,UAAU,SAAS,YAAY,YAAY,MAAM,OAAO,SAAS,MAAM,IAAI;AAAA,EACjF,MAAM,SAAS,YAAY,YAAY,YAAY,QAAQ,OAAO,OAAO;AAAA,EACzE,MAAM,eAAe,MAAM,QAAQ;AAAA,EACnC,IAAI,MAAM,WAAW,WAAW;AAAA,IAC9B,MAAM,QAAsB,EAAE,MAAM,iBAAiB,KAAK;AAAA,IAC1D,OAAO;AAAA,MACL;AAAA,MACA,OAAO,QAAQ,OAAO,MAAM,OAAO;AAAA,MACnC,WAAW,WAAW,MAAM,WAAW,QAAQ,MAAM,KAAK;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA,EACA,IAAI,WAAW,WAAW;AAAA,IACxB,IAAI,MAAM,WAAW,MAAM;AAAA,MACzB,MAAM,QACJ,MAAM,MACN,0FACE,sDACJ;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA,OAAO,QAAQ,OAAO,aAAa,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AAAA,MACnE,WAAW;AAAA,MACX,OAAO,EAAE,MAAM,iBAAiB,KAAK;AAAA,IACvC;AAAA,EACF;AAAA,EACA,MAAM,OAAO,aAAa,QAAQ,MAAM,QAAQ,MAAM,OAAO;AAAA,EAM7D,OAAO;AAAA,IACL;AAAA,IACA,OAAO,QAAQ,OAAO,IAAI;AAAA,IAC1B,WAAW,SAAS;AAAA,IACpB,OAAO,EAAE,KAAK,MAAM,OAAO,GAAG,MAAM,MAAM,QAAQ,cAAc,KAAK,MAAM,OAAO,EAAE;AAAA,EACtF;AAAA;;;ACrJK,IAAM,WAAW,OACtB,QACA,MACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI;AAAA,EAExC,IAAI,WAAW,MAAM,MAAM,MAAM,QAAQ;AAAA,IAEvC,MAAM,OAAO,aAAa,KAAK,MAAM,EAAE,MAAM,KAAK,QAAQ,kBAAiB,KAAK,CAAC;AAAA,IACjF,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC7B;AAAA,EACA,MAAM,UAAU,MAAM,UAAU,QAAQ,MAAM,IAAI;AAAA,EAGlD,IAAI,QAAQ,aAAa,OAAO,kBAAkB,SAAS,KAAK,OAAO,GAAG;AAAA,IACxE,OAAO,EAAE,QAAQ,OAAO;AAAA,EAC1B;AAAA,EACA,MAAM,OAAO,aAAa,KAAK,MAAM,QAAQ,KAAK;AAAA,EAClD,OAAO,EAAE,QAAQ,SAAS;AAAA;AAWrB,IAAM,gBAAgB,OAC3B,QACA,OACA,QACA,QAAQ,UAC0B;AAAA,EAClC,MAAM,OAAO,MAAM,SAAS,QAAQ,KAAK;AAAA,EAEzC,IAAI,KAAK,QAAQ,aAAa,KAAK,QAAQ,OAAO,aAAa,KAAK,CAAC,aAAa,MAAM,GAAG;AAAA,IACzF,MAAM,QACJ,MAAM,MACN,SAAS,OAAO,MAAM,KAAK,sEACzB,uFACJ;AAAA,EACF;AAAA,EAMA,MAAM,OAAO,WAAW,YAAY,SAAS,WAAW,OAAO,MAAM;AAAA,EACrE,MAAM,QAAQ,SAAS,SAAS,SAAS;AAAA,EACzC,MAAM,UAAU,MAAM,UAAU,QAAQ,OAAO,IAAI;AAAA,EACnD,MAAM,OAAO,YAAY,QAAQ,QAAQ,MAAM,MAAM;AAAA,EACrD,MAAM,WAAW,SAAS,MAAM,OAAO;AAAA,EAOvC,IACE,UAAU,aACV,SAAS,aACT,SAAS,YACT,EAAE,SAAS,WAAW,YACtB;AAAA,IACA,MAAM,QACJ,MAAM,MACN,GAAG,MAAM,WAAW,YAAY,mBAAmB,0CACjD,2FACJ;AAAA,EACF;AAAA,EACA,IAAI,CAAC,QAAQ;AAAA,IAAW,MAAM,OAAO,gBAAgB,MAAM,MAAM,QAAQ,OAAO,QAAQ,KAAK;AAAA,EAK7F,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,MAAM,MAAM,MAAM,MAAM;AAAA,EACvE,IACE,UAAU,aACV,MAAM,WAAW,UAAU,QAAQ,KAAK,KACxC,MAAM,kBAAkB,UACxB;AAAA,IAMA,IAAI,QAAQ,WAAW,aAAa,MAAM,WAAW,WAAW;AAAA,MAC9D,MAAM,OAAO,WAAW,MAAM,IAAI,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA,IAC3D;AAAA,IACA,MAAM,QACJ,MAAM,MACN,wEACF;AAAA,EACF;AAAA,EAGA,IAAI,SAAS,UAAU,WAAW;AAAA,IAAW,OAAO;AAAA,EACpD,MAAM,WAAW,QAAQ,MAAM;AAAA,EAC/B,IAAI,SAAS;AAAA,IAAQ,OAAO;AAAA,EAM5B,MAAM,UAAU,MAAM,mBAAmB,QAAQ,MAAM,MAAM,MAAM,MAAM;AAAA,EACzE,IAAI,YAAY,aAAa,QAAQ,kBAAkB,UAAU;AAAA,IAC/D,MAAM,QAAO,MAAM,MAAM,+DAA+D;AAAA,EAC1F;AAAA,EACA,OAAO;AAAA;AAOF,IAAM,aAAa,OACxB,QACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,OAAO,KAAK,OAAO,IAAI;AAAA,EAC1C,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAAQ,MAAM,QAAO,OAAO,MAAM,YAAY,KAAK,uBAAuB;AAAA,EAC5F,IAAI,OAAO,WAAW,WAAW;AAAA,IAC/B,MAAM,OAAO,WAAW,OAAO,IAAI;AAAA,IACnC;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,MAAM,OAAO,SAAS,OAAO,IAAI;AAAA,EAC/C,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,SAAS,QAAQ,OAAO,KAAK;AAAA,EACnC,MAAM,OAAO,aAAa,QAAQ,OAAO,MAAM;AAAA,EAC/C,IAAI,SAAS;AAAA,IAAQ;AAAA,EACrB,MAAM,OAAO,gBAAgB,OAAO,MAAM,QAAQ,OAAO,IAAI,GAAG;AAAA,IAC9D,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,IACX,KAAK,KAAK;AAAA,EACZ,CAAC;AAAA;;;ANnII,IAAM,aAAa,UAAqB,aAAa;AAErD,IAAM,qBAAqB,MACvB,iBACP,YACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,WAAW,SAAS,GAAG;AAAA,IAE5B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAE7B,MAAM,GAAG,MAAM,aACb,KAAK,YAAY;AAAA,MACf,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,KAAK,MAAM,KAAK,MAAM;AAAA,MACrE,IAAI,UAAU;AAAA,QAAW;AAAA,MAIzB,IAAI,KAAK,WAAW,aAAa,MAAM,kBAAkB;AAAA,QAAI;AAAA,MAC7D,OAAO,WAAW,YAAY,SAAQ,KAAK,IAAI;AAAA,KAChD;AAAA,IAEH,MAAM,GAAG,YAAY,MAAM,aAAa;AAAA,MAEtC,IAAI,WAAW;AAAA,QAAW,OAAO,eAAe,UAAU;AAAA,MAC1D,IAAI,YAAW,IAAI;AAAA,QAAG,OAAO,KAAK,MAAM,SAAS,QAAQ,MAAM,MAAM,CAAC;AAAA,MAItE,MAAM,OAAO,eAAe,MAAM,MAAM;AAAA,MACxC,OAAc,gBACZ,SAAS,aAAa,SAAS,OAAO,OAAO,EAAE,QAAQ,UAAmB,IAAI,SAChF;AAAA;AAAA,IAIF,WAAW,GAAG,KAAK,YAAY,MAAM,aAC5B,gBAAQ,cAAc,EAAE,KAAK,YAAY,OAAO,CAAC,GAAG,CAAC,UAC1D,KAAK,MAAM,cAAc,QAAQ,MAAM,QAAQ,KAAK,CAAC,CACvD;AAAA,IAEF,QAAQ,GAAG,aAAa,KAAK,MAAM,WAAW,QAAQ,MAAM,CAAC;AAAA,EAC/D,CAAC;AAAA,CACF,CACH;;;AOrEF,qBAAS;AACT;AACA;;;ACfA,oBAAS;AAET,uBAAS;AAET;;;ACmBO,IAAM,YAAY;AAGlB,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAAA;AAEO,MAAM,uBAAuB,MAAM;AAAA,EACxC,WAAW,CAAC,SAAiB,UAAkB,QAAgB;AAAA,IAC7D,MAAM,aAAa,cAAc,OAAO,QAAQ,MAAM,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG;AAAA,IACnF,KAAK,OAAO;AAAA;AAEhB;AAkBO,IAAM,YAAY,CAAC,WAAwC;AAAA,EAChE,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,QAAQ,OAAO,MAAM;AAAA,CAAI,GAAG;AAAA,IACrC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC3B,IAAI,MAAM;AAAA,MAAG;AAAA,IACb,MAAM,MAAM,KAAK,MAAM,GAAG,EAAE;AAAA,IAC5B,IAAI,CAAC,OAAO,IAAI,GAAG;AAAA,MAAG,OAAO,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,WAAW,CAAC,WAA+B;AAAA,EACtD,MAAM,SAAS,UAAU,MAAM;AAAA,EAC/B,MAAM,YAAY,OAAO,IAAI,WAAW,KAAK;AAAA,EAC7C,MAAM,gBAAgB,OAAO,IAAI,eAAe,KAAK;AAAA,EACrD,MAAM,eAAe,OAAO,IAAI,cAAc,KAAK;AAAA,EACnD,MAAM,WAAW,OAAO,IAAI,UAAU,KAAK;AAAA,EAC3C,OAAO;AAAA,IACL,aAAa,OAAO,IAAI,aAAa,KAAK;AAAA,IAG1C,OAAO,cAAc,eAAe,kBAAkB;AAAA,IACtD;AAAA,IACA,kBAAkB,OAAO,IAAI,kBAAkB,MAAM;AAAA,OACjD,aAAa,KAAK,CAAC,IAAI,EAAE,SAAS;AAAA,OAClC,kBAAkB,KAAK,CAAC,IAAI,EAAE,cAAc;AAAA,OAC5C,iBAAiB,KAAK,CAAC,IAAI,EAAE,aAAa;AAAA,EAChD;AAAA;AAGK,IAAM,WAAW,OAAO,QAAoB,SAAsC;AAAA,EACvF,MAAM,SAAS,MAAM,OAAO,KAAK;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,KAAK,GAAG;AAAA,IACxB;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EAID,IAAI,OAAO,aAAa;AAAA,IACtB,MAAM,IAAI,eAAe,QAAQ,QAAQ,OAAO,UAAU,OAAO,MAAM;AAAA,EACzE,OAAO,SAAS,OAAO,MAAM;AAAA;AAI/B,IAAM,MAAM,OAAO,QAAoB,SAA2C;AAAA,EAChF,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;AAAA,EACrD,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,eAAe,KAAK,KAAK,GAAG,GAAG,OAAO,UAAU,OAAO,MAAM;AAAA,EACzE;AAAA;AAIK,IAAM,eAAe,CAAC,WAAsC,IAAI,QAAQ,CAAC,eAAe,CAAC;AAEzF,IAAM,aAAa,CAAC,QAAoB,SAC7C,IAAI,QAAQ,CAAC,UAAU,MAAM,IAAI,CAAC;AAE7B,IAAM,cAAc,CAAC,QAAoB,SAC9C,IAAI,QAAQ,CAAC,WAAW,MAAM,IAAI,CAAC;AAE9B,IAAM,YAAY,CAAC,QAAoB,SAC5C,IAAI,QAAQ,CAAC,SAAS,MAAM,IAAI,CAAC;AAE5B,IAAM,WAAW,CAAC,QAAoB,SAC3C,IAAI,QAAQ,CAAC,QAAQ,MAAM,IAAI,CAAC;AAO3B,IAAM,cAAc,CAAC,QAAoB,SAC9C,IAAI,QAAQ,CAAC,WAAW,MAAM,IAAI,CAAC;;;AChF9B,IAAM,yBAAyB;AAW/B,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,aAAa,EAAE,KAAK,GAAG,MAAM,KAAO,KAAK,EAAE;AAEjD,IAAM,YAAW,CAAC,SAAyB,UAAU,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC;AAGnF,IAAM,eAAe,CAAC,cAC3B,WAAU,aAAa,CAAC,GAAG,KAAK;AAAA,CAAI,CAAC;AA0ChC,IAAM,gBAAgB,CAC3B,aACA,UACA,YACY;AAAA,EACZ,IAAI,gBAAgB;AAAA,IAAU,OAAO;AAAA,EACrC,IAAI,gBAAgB;AAAA,IAAc,OAAO;AAAA,EACzC,IAAI,aAAa,kBAAkB,aAAa;AAAA,IAAuB,OAAO;AAAA,EAC9E,OAAO;AAAA;AAIF,IAAM,aAAa,CAAC,aACzB,GAAG,SACA,IAAI,CAAC,YACJ,CAAC,IAAI,QAAQ,SAAS,GAAG,QAAQ,MAAM,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,CAAC,EAAE,KAAK;AAAA,CAAI,CAC5F,EACC,KAAK;AAAA;AAAA,CAAM;AAAA;AAET,IAAM,WAAW,CAAC,UACvB,MAAM,WAAW,WAAW,MAAM,YAAY,CAAC,CAAC;AAE3C,IAAM,cAAc,CAAC,UAC1B,GAAG,MAAM,aAAa,0BAA0B,MAAM;AAGjD,IAAM,OAAO;AAEpB,IAAM,QAAQ,IAAI,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,eAAe,IAAI,IAAI,CAAC,YAAY,cAAc,cAAc,QAAQ,OAAO,CAAC;AAU/E,IAAM,eAAe,CAAC,OAAyB,WAA8B;AAAA,EAClF,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OAAO,KAAK,KAAK,MAAM,IAAI,IAAI;AAAA,EACrC,IAAI,SAAS,aAAa,CAAC,MAAM,IAAI,IAAI,GAAG;AAAA,IAC1C,MAAM,KACJ,4DAA4D,KAAK,UAAU,MAAM,IAAI,GACvF;AAAA,EACF,EAAO,SAAI,WAAW,aAAa,SAAS,QAAQ;AAAA,IAClD,MAAM,KAAK,6BAA6B,gBAAgB,MAAM,cAAc,MAAM;AAAA,EACpF;AAAA,EACA,IAAK,MAAM,YAAY,eAAgB,MAAM,aAAa,YAAY;AAAA,IACpE,MAAM,KAAK,4CAA4C;AAAA,EACzD;AAAA,EACA,MAAM,YAAY,MAAM,aAAa;AAAA,EACrC,IAAI,CAAC,UAAU,WAAW,GAAG,KAAK,UAAU,SAAS,GAAG,KAAK,UAAU,SAAS,KAAK,GAAG;AAAA,IACtF,MAAM,KAAK,uEAAuE;AAAA,EACpF;AAAA,EACA,MAAM,KAAK,GAAG,aAAa,SAAS,KAAK,CAAC,CAAC;AAAA,EAC3C,IAAI,MAAM,YAAY,SAAS,CAAC,wBAAwB,SAAS,SAAkB,GAAG;AAAA,IACpF,MAAM,KACJ,iEAAiE,wBAAwB,KAAK,IAAI,SAChG,GAAG,mEACP;AAAA,EACF;AAAA,EACA,IAAI,MAAM,YAAY,SAAS,CAAC,WAAW,KAAK,GAAG;AAAA,IACjD,MAAM,KACJ,8FACE,6FACA,2DACJ;AAAA,EACF;AAAA,EACA,IAAI,SAAS,WAAW,CAAC,SAAS,KAAK,EAAE,SAAS,SAAS,GAAG;AAAA,IAC5D,MAAM,KAAK,kCAAkC;AAAA,EAC/C;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,aAAa,CAAC,UAAqC;AAAA,EACvD,MAAM,OAAO,SAAS,KAAK;AAAA,EAC3B,IAAI,CAAC,KAAK,SAAS,WAAW;AAAA,IAAG,OAAO;AAAA,EACxC,MAAM,QAAQ,KAAK,MAAM,KAAK,QAAQ,WAAW,CAAC;AAAA,EAClD,OAAO,CAAC,GAAG,YAAY,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,IAAI,QAAQ,GAAG,EAAE,KAAK,KAAK,CAAC;AAAA;AAGhF,IAAM,eAAe,CAAC,SAA2B;AAAA,EAC/C,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,KAAK,KAAK,MAAM;AAAA,IAAI,MAAM,KAAK,wBAAwB;AAAA,EAC3D,IAAI,KAAK,SAAS,MAAQ;AAAA,IAAG,MAAM,KAAK,4BAA4B;AAAA,EACpE,IAAI,CAAC,mBAAmB,KAAK,IAAI;AAAA,IAAG,MAAM,KAAK,yCAAyC;AAAA,EACxF,OAAO;AAAA;;;AC5MF,IAAM,UAAS,CAAC,MAAc,YACnC,IAAI,MAAM,gBAAgB,SAAS,SAAS;AAEvC,IAAM,eAAe,CAC1B,OACA,YACA,YAC2B;AAAA,EAC3B,QAAQ,OAAO,gBAAgB,YAAY,OAAO,gBAAgB;AAAA,EAClE,aAAa,OAAO;AAAA,EACpB,cAAc,aAAa,MAAM,SAAS;AAAA,EAC1C,SAAS,OAAO,kBAAkB,aAAa,OAAO,kBAAkB;AAAA,EACxE,WAAW,OAAO;AAAA,EAClB,MAAM,MAAM;AAAA,EACZ,UAAU,YAAY,KAAK;AAAA,EAC3B;AAAA,KACI,OAAO,kBAAkB,YAAY,CAAC,IAAI,EAAE,eAAe,OAAO,cAAc;AACtF;AAiBO,IAAM,SAAS,OACpB,QACA,OACA,SACmC;AAAA,EACnC,MAAM,cAAc,MAAM,YAAY;AAAA,EACtC,MAAM,cAAc,MAAM,YAAY;AAAA,EACtC,MAAM,YACJ,KAAK,OAAO,kBAAkB,aAAa,KAAK,OAAO,kBAAkB;AAAA,EAC3E,MAAM,OAAO,OAAO,WAAmC;AAAA,IAGrD,IAAI,KAAK,WAAW,WAAW;AAAA,MAC7B,MAAM,OAAO,WAAW,KAAK,IAAI,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA,MACxD,MAAM,aAAa,MAAM,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA,IAClD;AAAA,IACA,MAAM,QAAO,MAAM,MAAM,GAAG,iCAAiC;AAAA;AAAA,EAE/D,IAAI;AAAA,IACF,IAAI,gBAAgB,CAAC,aAAa,KAAK;AAAA,MAAU,MAAM,WAAW,QAAQ,MAAM,IAAI;AAAA,IACpF,IAAI,CAAC,eAAe;AAAA,MAAW,MAAM,YAAY,QAAQ,MAAM,IAAI;AAAA,IAInE,MAAM,UAAU,cAAc,KAAK,OAAO,aAAa,KAAK,OAAO,UAAU,WAAW;AAAA,IACxF,IAAI,CAAC,aAAa;AAAA,MAChB,IAAI;AAAA,QAAS,MAAM,SAAS,QAAQ,MAAM,IAAI;AAAA,IAChD,EAAO,SAAI,CAAC;AAAA,MAAS,MAAM,UAAU,QAAQ,MAAM,IAAI;AAAA,IAClD,SAAI,KAAK,WAAW,KAAK;AAAA,MAAe,MAAM,YAAY,QAAQ,MAAM,IAAI;AAAA,IACjF,OAAO,OAAO;AAAA,IACd,OAAO,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA;AAAA,EAQpE,MAAM,QAAQ,MAAM,SAAS,QAAQ,MAAM,IAAI;AAAA,EAC/C,IAAI,eAAe,CAAC,cAAc,MAAM,aAAa,MAAM,UAAU,WAAW,GAAG;AAAA,IACjF,OAAO,KAAK,8CAA8C,MAAM,cAAc;AAAA,EAChF;AAAA,EACA,MAAM,UAAU,aAAa,OAAO,KAAK,SAAS,KAAK;AAAA,EACvD,IAAI,eAAe,CAAC,QAAQ,SAAS;AAAA,IACnC,OAAO,KACL,kEACE,GAAG,KAAK,UAAU,MAAM,iBAAiB,EAAE,iBAC/C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACpFT,IAAM,WAAU,IAAI;AAGb,IAAM,cAAc,CAAC,OAAyB,WAA0B;AAAA,EAC7E,MAAM,QAAQ,aAAa,OAAO,MAAM;AAAA,EACxC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,QAAO,MAAM,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA;AAI1D,IAAM,iBAAiB,CAAC,QAAoB,SAAuB;AAAA,EACxE,IAAI,aAAa,MAAM;AAAA,IAAG;AAAA,EAC1B,MAAM,QACJ,MACA,8FACE,6FACJ;AAAA;AAOK,IAAM,eAAe,CAAC,OAAuC,WAA6B;AAAA,EAC/F,IAAI,OAAO,cAAc,YAAY,OAAO,kBAAkB,UAAU;AAAA,IACtE,MAAM,QACJ,MAAM,MACN,6FACE,cACJ;AAAA,EACF;AAAA;AAUK,IAAM,kBAAkB,OAC7B,QACA,UACkB;AAAA,EAClB,MAAM,OAAO,YAAY,KAAK;AAAA,EAC9B,MAAM,QAAQ,MAAM,OAAO,SAAS,IAAI;AAAA,EACxC,MAAM,OAAO,UAAU,YAAY,YAAY,UAAS,SAAQ,OAAO,KAAK,CAAC;AAAA,EAC7E,IAAI,SAAS,aAAa,SAAS,UAAS,SAAS,KAAK,CAAC,GAAG;AAAA,IAC5D,MAAM,QACJ,MAAM,MACN,GAAG,0FACD,uCACJ;AAAA,EACF;AAAA;AAWK,IAAM,qBAAqB,OAChC,QACA,KACA,SACkB;AAAA,EAClB,eAAe,QAAQ,IAAI,IAAI;AAAA,EAC/B,eAAe,QAAQ,IAAI;AAAA,EAC3B,aAAa,EAAE,KAAK,GAAG,MAAM,SAAS,QAAQ,IAAI,CAAC;AAAA;AAO9C,IAAM,oBAAoB,OAC/B,QACA,MACA,KACA,WACkB;AAAA,EAClB,YAAY,MAAM,MAAM;AAAA,EACxB,MAAM,mBAAmB,QAAQ,KAAK,KAAK,IAAI;AAAA,EAC/C,MAAM,gBAAgB,QAAQ,IAAI;AAAA,EAClC,MAAM,OAAO,aAAa,YAAY,IAAI,GAAG,UAAU;AAAA;;;AC9EzD,IAAM,WAAU,IAAI;AACpB,IAAM,WAAU,IAAI;AAGb,IAAM,WAAW,OACtB,QACA,UAC+C;AAAA,EAC/C,MAAM,QAAQ,MAAM,OAAO,SAAS,YAAY,KAAK,CAAC;AAAA,EACtD,MAAM,SAAS,MAAM,SAAS,QAAQ,MAAM,IAAI;AAAA,EAChD,IAAI,UAAU,aAAa,CAAC,OAAO;AAAA,IAAO;AAAA,EAC1C,OAAO,aAAa,OAAO,UAAU,YAAY,KAAK,UAAS,SAAQ,OAAO,KAAK,CAAC,GAAG,MAAM;AAAA;AAGxF,IAAM,WAAW,OACtB,QACA,MACA,QACA,WACkB;AAAA,EAClB,YAAY,MAAM,MAAM;AAAA,EAKxB,IAAI,KAAK,SAAS,OAAO,QAAQ,YAAY,IAAI,MAAM,OAAO,UAAU;AAAA,IACtE,MAAM,kBAAkB,QAAQ,MAAM,QAAQ,MAAM;AAAA,IACpD,OAAO,EAAE,QAAQ,WAAW,aAAa,KAAK;AAAA,EAChD;AAAA,EACA,MAAM,WAAU,UAAS,SAAS,IAAI,CAAC;AAAA,EACvC,MAAM,SAAS,YAA2B;AAAA,IACxC,eAAe,QAAQ,KAAK,IAAI;AAAA,IAChC,MAAM,OAAO,aAAa,YAAY,IAAI,GAAG,UAAU;AAAA,IACvD,OAAO,EAAE,QAAQ,SAAS;AAAA;AAAA,EAI5B,IAAI,aAAY,OAAO;AAAA,IAAY,OAAO,OAAO;AAAA,EACjD,IAAI,aAAa,KAAK,SAAS,MAAM,OAAO;AAAA,IAAc,OAAO,OAAO;AAAA,EACxE,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI;AAAA,EACxC,IAAI,SAAS,aAAa,KAAK,eAAe;AAAA,IAAS,OAAO,OAAO;AAAA,EACrE,IAAI,KAAK,aAAa,KAAK,YAAY;AAAA,IAAQ,OAAO,OAAO;AAAA,EAM7D,MAAM,SAAS,MAAM,SAAS,QAAQ,KAAK,IAAI;AAAA,EAC/C,MAAM,cAAc,KAAK,YAAY;AAAA,EACrC,IAAI,cAAc,OAAO,aAAa,OAAO,UAAU,WAAW,MAAM,aAAa;AAAA,IACnF,OAAO,OAAO;AAAA,EAChB;AAAA,EACA,OAAO,OAAO,mBAAmB,OAAO,IAAI,EAAE,QAAQ,OAAO;AAAA;AASxD,IAAM,gBAAgB,OAC3B,QACA,OACA,QACA,QAAQ,OACR,WACmC;AAAA,EACnC,YAAY,OAAO,MAAM;AAAA,EACzB,eAAe,QAAQ,MAAM,IAAI;AAAA,EACjC,MAAM,OAAO,YAAY,KAAK;AAAA,EAC9B,MAAM,SAAS,MAAM,SAAS,QAAQ,MAAM,IAAI;AAAA,EAChD,aAAa,OAAO,MAAM;AAAA,EAC1B,MAAM,OAAO,SAAS,KAAK;AAAA,EAC3B,MAAM,WAAU,UAAS,IAAI;AAAA,EAC7B,MAAM,SAAS,MAAM,OAAO,SAAS,IAAI;AAAA,EACzC,MAAM,UAAU,WAAW,YAAY,YAAY,UAAS,SAAQ,OAAO,MAAM,CAAC;AAAA,EAClF,MAAM,QAAQ,WAAW,cAAc,OAAO,SAAS,MAAM,QAAQ,OAAO,aAAa;AAAA,EAMzF,IAAI,SAAS,WAAW;AAAA,IAAW,MAAM,kBAAkB,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACxF,MAAM,QAAQ,QAAQ,YAAY;AAAA,EAOlC,IACE,UAAU,aACV,EAAE,SAAS,WAAW,cACtB,YAAY,aACZ,YAAY,UACZ;AAAA,IACA,MAAM,QACJ,MAAM,MACN,GAAG,0FACD,uCACJ;AAAA,EACF;AAAA,EACA,IAAI,SAAS,WAAW;AAAA,IAAW,MAAM,WAAW,QAAQ,MAAM;AAAA,EAClE,MAAM,QAAQ,YAAY;AAAA,EAU1B,MAAM,QAAQ,UAAU,aAAa,MAAM,eAAe;AAAA,EAC1D,MAAM,gBAAgB,UAAU,aAAa,MAAM,iBAAiB,aAAa,MAAM,SAAS;AAAA,EAChG,IAAI;AAAA,IAAO,MAAM,OAAO,gBAAgB,MAAM,SAAQ,OAAO,IAAI,GAAG,UAAU;AAAA,EAC9E,IAAI,SAAS,OAAO;AAAA,IAAkB,MAAM,aAAa,MAAM;AAAA,EAC/D,MAAM,UAAU,SAAS,SAAS,OAAO;AAAA,EACzC,OAAO,OAAO,QAAQ,OAAO,EAAE,QAAQ,SAAS,eAAe,mBAAS,MAAM,OAAO,CAAC;AAAA;AAQjF,IAAM,aAAa,OACxB,QACA,WACkB;AAAA,EAClB,eAAe,QAAQ,OAAO,IAAI;AAAA,EAClC,MAAM,SAAS,MAAM,SAAS,QAAQ,OAAO,IAAI;AAAA,EACjD,IAAI,OAAO,gBAAgB,YAAY,OAAO,gBAAgB,cAAc;AAAA,IAC1E,MAAM,SAAS,QAAQ,OAAO,IAAI;AAAA,EACpC;AAAA,EACA,IAAI,OAAO,kBAAkB,aAAa,OAAO,kBAAkB,mBAAmB;AAAA,IACpF,MAAM,YAAY,QAAQ,OAAO,IAAI;AAAA,EACvC;AAAA,EACA,MAAM,OAAO,MAAM,OAAO,KAAK,OAAO,QAAQ;AAAA,EAC9C,IAAI,SAAS,WAAW;AAAA,IACtB,IAAI,KAAK,SAAS;AAAA,MAAQ,MAAM,QAAO,OAAO,MAAM,GAAG,OAAO,iBAAiB,KAAK,MAAM;AAAA,IAC1F,MAAM,OAAO,WAAW,OAAO,QAAQ;AAAA,EACzC;AAAA,EACA,MAAM,aAAa,MAAM;AAAA;;;AL/JpB,IAAM,cAAc,CACzB,QACA,MACA,WAEA,KAAK,YAAY;AAAA,EACf,MAAM,QAAQ,MAAM,SAAS,QAAQ,IAAI;AAAA,EACzC,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,OAAO,WAAW,YAAY,SAAQ,KAAK,IAAI;AAAA,CAChD;AAEI,IAAM,cAAc,CACzB,QACA,YACA,MACA,QACA,WAC2C;AAAA,EAE3C,IAAI,WAAW;AAAA,IAAW,OAAO,eAAe,UAAU;AAAA,EAC1D,IAAI,YAAW,IAAI;AAAA,IAAG,OAAO,KAAK,MAAM,SAAS,QAAQ,MAAM,QAAQ,MAAM,CAAC;AAAA,EAO9E,MAAM,OAAO,eAAe,MAAM,MAAM;AAAA,EACxC,IAAI,SAAS,aAAa,SAAS,OAAO;AAAA,IAAM,OAAc,gBAAQ,SAAS;AAAA,EAO/E,OAAO,KAAK,YAAY;AAAA,IACtB,MAAM,mBAAmB,QAAQ,QAAQ,IAAI;AAAA,IAC7C,OAAO,EAAE,QAAQ,WAAoB,aAAa,KAAK;AAAA,GACxD;AAAA;AAGI,IAAM,mBAAmB,CAC9B,QACA,MAMA,WAEO,gBAAQ,cAAc,IAAI,GAAG,CAAC,UACnC,KAAK,MAAM,cAAc,QAAQ,KAAK,MAAM,KAAK,QAAQ,OAAO,MAAM,CAAC,CACzE;AAEK,IAAM,gBAAgB,CAC3B,QACA,WAC+B,KAAK,MAAM,WAAW,QAAQ,MAAM,CAAC;;;ADrC/D,IAAM,cAAc,UAAsB,cAAc;AACxD,IAAM,eAAe,UAAuB,eAAe;AAE3D,IAAM,sBAAsB,MACxB,iBACP,aACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,YAAY,SAAS,GAAG;AAAA,IAM7B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,GAAG,MAAM,aAAa,YAAY,QAAQ,MAAM,MAAM;AAAA,IAC5D,MAAM,GAAG,YAAY,MAAM,aAAa,YAAY,QAAQ,YAAY,MAAM,MAAM;AAAA,IACpF,WAAW,CAAC,SAAS,iBAAiB,QAAQ,IAAI;AAAA,IAClD,QAAQ,GAAG,aAAa,cAAc,QAAQ,MAAM;AAAA,EACtD,CAAC;AAAA,CACF,CACH;AAEK,IAAM,uBAAuB,MACzB,iBACP,cACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,aAAa,SAAS,GAAG;AAAA,IAC9B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,GAAG,MAAM,aAAa,YAAY,QAAQ,MAAM,MAAM;AAAA,IAE5D,MAAM,GAAG,YAAY,MAAM,aACzB,YAAY,QAAQ,YAAY,MAAM,QAAQ,OAAO;AAAA,IACvD,WAAW,CAAC,SAAS,iBAAiB,QAAQ,MAAM,OAAO;AAAA,IAC3D,QAAQ,GAAG,aAAa,cAAc,QAAQ,MAAM;AAAA,EACtD,CAAC;AAAA,CACF,CACH;;;AR7DK,IAAM,iBAAiB,CAAC,WACvB,gBACJ,sBAAsB,GACtB,mBAAmB,GACnB,qBAAqB,GACrB,oBAAoB,CACtB,EAAE,KAAW,eAAQ,gBAAgB,MAAM,CAAC,CAAC;;AeE/C;AACA;;;ACPA,IAAM,UAAU;AAGT,IAAM,YAAY,CAAC,UAAkB,aAC1C,aAAa,WACT;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ,KAAK,QAAQ,IAAI,QAAQ;AAAA,EACjC;AACF,IACA,CAAC,UAAU,UAAU,QAAQ;AAG5B,IAAM,aAAa,CAAC,UAAkB,aAC3C,aAAa,WACT;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ,KAAK,QAAQ,IAAI,QAAQ;AAAA,EACjC;AACF,IACA,CAAC,UAAU,SAAS,QAAQ;AAGlC,IAAM,cAAc,CAAC,WAAwC;AAAA,EAC3D,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,QAAQ,OAAO,MAAM;AAAA,CAAI,GAAG;AAAA,IACrC,IAAI,KAAK,KAAK,MAAM,IAAI;AAAA,MACtB,IAAI,OAAO,OAAO;AAAA,QAAG;AAAA,MACrB;AAAA,IACF;AAAA,IACA,MAAM,KAAK,KAAK,QAAQ,IAAI;AAAA,IAC5B,IAAI,MAAM;AAAA,MAAG;AAAA,IACb,MAAM,MAAM,KAAK,MAAM,GAAG,EAAE;AAAA,IAC5B,IAAI,QAAQ;AAAA,MAAY;AAAA,IACxB,OAAO,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,EAC3C;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,OAAO,CAAC,SACZ,SAAS,aAAa,QAAQ,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI;AAErD,IAAM,YAAY,CAAC,UAAkB,WAAyC;AAAA,EACnF,IAAI,aAAa,UAAU;AAAA,IACzB,MAAM,SAAS,YAAY,MAAM;AAAA,IACjC,MAAM,OAAM,KAAK,OAAO,IAAI,KAAK,CAAC;AAAA,IAClC,MAAM,OAAM,KAAK,OAAO,IAAI,KAAK,CAAC;AAAA,IAClC,MAAM,QAAO,OAAO,IAAI,KAAK;AAAA,IAC7B,OAAO,SAAQ,aAAa,SAAQ,aAAa,UAAS,YACtD,YACA,EAAE,WAAK,aAAM,UAAI;AAAA,EACvB;AAAA,EAEA,MAAM,UAAU,OAAO,MAAM;AAAA,CAAI,EAAE,MAAM,IAAI,MAAM,GAAG;AAAA,EACtD,MAAM,MAAM,KAAK,OAAO,EAAE;AAAA,EAC1B,MAAM,MAAM,KAAK,OAAO,EAAE;AAAA,EAC1B,MAAM,OAAO,OAAO;AAAA,EACpB,OAAO,QAAQ,aAAa,QAAQ,aAAa,SAAS,aAAa,SAAS,KAC5E,YACA,EAAE,KAAK,MAAM,IAAI;AAAA;AAGhB,IAAM,aAAa,CAAC,UAAkB,WAAuC;AAAA,EAClF,IAAI,aAAa;AAAA,IAAU,OAAO,KAAK,YAAY,MAAM,EAAE,IAAI,KAAK,CAAC;AAAA,EAErE,OAAO,MAAM,OAAO,MAAM;AAAA,CAAI,EAAE,MAAM,IAAI,MAAM,GAAG,EAAE,EAAE;AAAA;;;ACtElD,IAAM,SAAS;AAMf,IAAM,aAAa,CAAC,QAAwB;AAAA,EACjD,IAAI,IAAI,SAAS,MAAM;AAAA,IAAG,MAAM,IAAI,MAAM,+BAA+B;AAAA,EACzE,OAAO,IAAI,IAAI,WAAW,KAAK,OAAO;AAAA;AAIjC,IAAM,YAAY,CAAC,SAAoC,KAAK,IAAI,UAAU,EAAE,KAAK,GAAG;AAE3F,IAAM,SAAS,CAAC,UAAkB,WAAW;AAetC,IAAM,cAAc,CAAC,QAAgB,UAC1C;AAAA,EAAM;AAAA;AAAA;AAAA,aAAkC,OAAO,KAAK;AAAA;AAU/C,IAAM,cAAc,CAAC,QAAgB,UAAsC;AAAA,EAChF,MAAM,KAAK,OAAO,YAAY;AAAA,EAAK,OAAO,KAAK,GAAG;AAAA,EAClD,IAAI,KAAK;AAAA,IAAG;AAAA,EACZ,MAAM,SAAS,aAAa,KAAK,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE,SAAS,CAAC,CAAC;AAAA,EAC5E,IAAI,SAAS,OAAO;AAAA,IAAW;AAAA,EAC/B,OAAO,EAAE,UAAU,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA;AAY7D,IAAM,UAAU,CACrB,MACA,QACA,YACsB;AAAA,EACtB,IAAI,SAAS,MAAM,KAAK,WAAW,GAAG,GAAG;AAAA,IACvC,MAAM,IAAI,MAAM,QAAQ,KAAK,UAAU,IAAI,+BAA+B;AAAA,EAC5E;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,OAAO,QAAQ,iBAAiB;AAAA,IAClD,GAAI,QAAQ,WAAW,CAAC;AAAA,IACxB;AAAA,IACA,cAAc,WAAW,MAAM;AAAA,EACjC;AAAA;;;AC9EF,IAAM,aAAa,CAAC,SAAiB,WAAW,kBAAkB;AAE3D,IAAM,aAAa,CAAC,SAAyB;AAAA,EAClD,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,OAAO,GAAG,WAAW,MAAM,iCAAiC,qBAAqB,OAAO,MAAM;AAAA;AAIzF,IAAM,aAAa,CAAC,SAAyB;AAAA,EAClD,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,OAAO,GAAG,WAAW,MAAM,eAAe,qBAAqB,OAAO,MAAM;AAAA;AAKvE,IAAM,eAAe,CAAC,SAAyB,YAAY,WAAW,IAAI;AAE1E,IAAM,aAAa,CAAC,SAAoC,UAAU,IAAI;AAiBtE,IAAM,cAAc,CAAC,MAAc,MAAc,YAAkC;AAAA,EACxF,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,MAAM,OAAO,cAAc;AAAA,EAK3B,MAAM,QACJ,QAAQ,QAAQ,YACZ,QAAQ,QAAQ,YACd,YACA,IAAI,OAAO,QAAQ,GAAG,MACxB,QAAQ,QAAQ,YACd,OAAO,QAAQ,GAAG,IAClB,GAAG,OAAO,QAAQ,GAAG,KAAK,OAAO,QAAQ,GAAG;AAAA,EACpD,MAAM,QAAQ,UAAU,YAAY,CAAC,IAAI,CAAC,SAAS,YAAY,aAAa,YAAY;AAAA,EACxF,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,SAAS,aAAa;AAAA,IACtB,GAAG;AAAA,IACH,SAAS,QAAQ,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,QAAQ,aAAa;AAAA,IACtE,YAAY,UAAU,aAAa;AAAA,EACrC,EAAE,KAAK;AAAA,CAAI;AAAA;AAGb,IAAM,YAAY;AAClB,IAAM,QAAQ,IAAI,IAA8B;AAAA,EAC9C,CAAC,OAAQ,MAAM;AAAA,EACf,CAAC,OAAQ,WAAW;AAAA,EACpB,CAAC,OAAQ,SAAS;AACpB,CAAC;AAGM,IAAM,YAAY,CAAC,WAAyC;AAAA,EACjE,MAAM,SAAS,OAAO,KAAK,EAAE,MAAM,KAAK;AAAA,EACxC,IAAI,OAAO,WAAW;AAAA,IAAG;AAAA,EACzB,OAAO,SAAS,OAAO,KAAK,KAAK,QAAQ;AAAA,EACzC,MAAM,MAAM,OAAO,SAAS,SAAS,EAAE;AAAA,EACvC,MAAM,OAAO,OAAO,SAAS,OAAO,CAAC;AAAA,EACrC,MAAM,UAAU,CAAC,KAAK,MAAM,OAAO,GAAG,GAAG,OAAO,GAAG,GAAG,OAAO,IAAI,CAAC;AAAA,EAClE,IAAI,QAAQ,KAAK,CAAC,UAAU,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,CAAC;AAAA,IAAG;AAAA,EACxE,OAAO;AAAA,IACL,KAAK,OAAO,GAAG;AAAA,IACf,MAAM,MAAM,IAAI,MAAM,SAAS,KAAK;AAAA,IAEpC;AAAA,IACA,MAAM,OAAO,IAAI;AAAA,IACjB,KAAK,OAAO,GAAG;AAAA,EACjB;AAAA;;;AHjDF,IAAM,WAAW,CAAC,MAAyB,WAAmB,UAC5D,IAAI,QAAQ,CAAC,SAAS,WAAW;AAAA,EAC/B,OAAO,YAAY,QAAQ;AAAA,EAC3B,MAAM,QAAQ,MAAM,SAAS,MAAM;AAAA,IACjC,OAAO;AAAA,IACP,OAAO,CAAC,UAAU,YAAY,WAAW,QAAQ,QAAQ,MAAM;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC;AAAA,EACD,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3D,MAAM,GAAG,SAAS,CAAC,UAAU;AAAA,IAC3B,OAAO,IAAI,MAAM,QAAQ,MAAM,SAAS,CAAC;AAAA,GAC1C;AAAA,EACD,IAAI,UAAU,aAAa,MAAM,UAAU,MAAM;AAAA,IAG/C,MAAM,MAAM,GAAG,SAAS,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA,IACvC,MAAM,MAAM,IAAI,KAAK;AAAA,EACvB;AAAA,EACA,MAAM,GAAG,SAAS,CAAC,UAAU,WAAW;AAAA,IACtC,QAAQ;AAAA,MACN,UAAU,YAAY;AAAA,MACtB;AAAA,MACA,QAAQ,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM;AAAA,MAC1C,QAAQ,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM;AAAA,IAC5C,CAAC;AAAA,GACF;AAAA,CACF;AAGI,IAAM,YAAY,OACvB,SAEA,OACA,QACA,UACwB;AAAA,EACxB,MAAM,OAAO,QAAQ,QAAQ,MAAM,YAAY,QAAQ,KAAK,GAAG;AAAA,IAC7D,mBAAmB,QAAQ;AAAA,OACvB,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE,CAAC;AAAA,EACD,MAAM,MAAM,MAAM,SAAS,MAAM,QAAQ,eAAe,KAAK;AAAA,EAC7D,MAAM,SAAS,YAAY,IAAI,QAAQ,KAAK;AAAA,EAC5C,IAAI,WAAW,WAAW;AAAA,IAGxB,MAAM,IAAI,MACR,OAAO,QAAQ,gEACb,GAAG,OAAO,IAAI,QAAQ,IAAI,IAAI,WAAW,OAAO,KAAK,eAAe,IAAI,gBACxE,GAAG,IAAI,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GACrC;AAAA,EACF;AAAA,EACA,OAAO,EAAE,UAAU,OAAO,UAAU,QAAQ,OAAO,QAAQ,QAAQ,IAAI,OAAO;AAAA;AAGhF,IAAM,eAAe,CAAC,SACpB,IAAI,WAAW,OAAO,KAAK,KAAK,WAAW;AAAA,GAAM,EAAE,GAAG,QAAQ,CAAC;AAEjE,IAAM,SAAS,CAAC,MAAc,MAAc,WAC1C,IAAI,MACF,OAAO,SAAS,WAAW,OAAO,OAAO,QAAQ,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAC1F;AASK,IAAM,YAAY,OAAO,YAAmD;AAAA,EACjF,MAAM,WAAW;AAAA,IACf,mBAAmB,QAAQ,qBAAqB;AAAA,IAChD,eAAe,QAAQ,iBAAiB;AAAA,IACxC,MAAM,QAAQ;AAAA,OACV,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE;AAAA,EACA,MAAM,QAAQ,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EAC3C,MAAM,OAAM,CAAC,QAAgB,UAAuB,UAAU,UAAU,OAAO,QAAQ,KAAK;AAAA,EAC5F,MAAM,QAAQ,MAAM,KAAI,iBAAiB;AAAA,EACzC,IAAI,MAAM,aAAa;AAAA,IAAG,MAAM,OAAO,QAAQ,MAAM,mBAAmB,KAAK;AAAA,EAC7E,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,EAAE,MAAM;AAAA,CAAI;AAAA,EACpD,IAAI,WAAW,WAAW,QAAQ,aAAa,CAAC,QAAQ,KAAK,GAAG,GAAG;AAAA,IACjE,MAAM,IAAI,MACR,OAAO,QAAQ,oCAAoC,KAAK,UAAU,MAAM,OAAO,KAAK,CAAC,QACnF,2FACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAO,GAAG;AAAA,EACvB,OAAO;AAAA,IACL,cAAc,MAAM;AAAA,IACpB,MAAM,CAAC,SAAS,KAAI,WAAW,IAAI,CAAC;AAAA,IACpC,aAAa,OAAO,aAAa;AAAA,MAC/B,MAAM,SAAS,MAAM,KAAI,WAAW,WAAW,SAAS,QAAQ,CAAC,CAAC;AAAA,MAClE,OAAO,OAAO,aAAa,IAAI,WAAW,SAAS,OAAO,MAAM,IAAI;AAAA;AAAA,IAEtE,YAAY,OAAO,aAAa;AAAA,MAC9B,MAAM,SAAS,MAAM,KAAI,WAAW,UAAU,SAAS,QAAQ,CAAC,CAAC;AAAA,MACjE,OAAO,OAAO,aAAa,IAAI,UAAU,SAAS,OAAO,MAAM,IAAI;AAAA;AAAA,IAErE,YAAY;AAAA,IACZ,UAAU,OAAO,SAAS;AAAA,MACxB,MAAM,SAAS,MAAM,KAAI,WAAW,IAAI,CAAC;AAAA,MACzC,IAAI,OAAO,aAAa;AAAA,QAAQ;AAAA,MAChC,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,QAAQ,MAAM;AAAA,MAC5E,OAAO,aAAa,OAAO,MAAM;AAAA;AAAA,IAEnC,YAAY,OAAO,SAAS;AAAA,MAC1B,MAAM,SAAS,MAAM,KAAI,aAAa,IAAI,CAAC;AAAA,MAC3C,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,UAAU,QAAQ,MAAM;AAAA;AAAA,IAEhF,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,IAC/D,MAAM,OAAO,SAAS;AAAA,MACpB,MAAM,SAAS,MAAM,KAAI,WAAW,IAAI,CAAC;AAAA,MACzC,IAAI,OAAO,aAAa;AAAA,QAAQ;AAAA,MAChC,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,QAAQ,MAAM;AAAA,MAC5E,MAAM,SAAS,UAAU,OAAO,MAAM;AAAA,MAGtC,IAAI,WAAW,WAAW;AAAA,QACxB,MAAM,IAAI,MAAM,OAAO,QAAQ,cAAc,kCAAkC;AAAA,MACjF;AAAA,MACA,OAAO;AAAA;AAAA,IAET,iBAAiB,OAAO,MAAM,OAAO,UAAU;AAAA,MAC7C,MAAM,KAAK,KAAK,YAAY,GAAG;AAAA,MAC/B,MAAM,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,MAAM,KAAK,MAAM,KAAK,CAAC,KAAK,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,MACzF,MAAM,SAAS,MAAM,KAAI,YAAY,MAAM,MAAM,KAAK,GAAG,KAAK;AAAA,MAC9D,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,SAAS,QAAQ,MAAM;AAAA;AAAA,EAEjF;AAAA;;AI9KF,kBAAS;AACT,wBAAS;AACT;AACA;AAUO,IAAM,YAAY,CAAC,UACxB,OAAO,UAAU,YAAY,UAAU,SAAQ,UAAU,SACrD,OAAQ,MAA4B,IAAI,IACxC;AAGN,IAAM,UAAS,CAAC,UACd,UAAU,KAAK,MAAM,YAAY,UAAU,KAAK,MAAM;AAExD,IAAM,OAAM,CAAC,MAAyB,cACpC,IAAI,QAAQ,CAAC,SAAS,WAAW;AAAA,EAC/B,OAAO,YAAY,QAAQ;AAAA,EAC3B,IAAI,YAAY,WAAW;AAAA,IACzB,OAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,IACpC;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,OAAM,SAAS,MAAM;AAAA,IACjC,OAAO;AAAA,IACP,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,SAAS;AAAA,EACX,CAAC;AAAA,EACD,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB,IAAI,KAAK,KAAK,CAAC;AAAA,EAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB,IAAI,KAAK,KAAK,CAAC;AAAA,EAC1D,MAAM,GAAG,SAAS,CAAC,UAAU;AAAA,IAC3B,OAAO,IAAI,MAAM,QAAQ,YAAY,MAAM,SAAS,CAAC;AAAA,GACtD;AAAA,EACD,MAAM,GAAG,SAAS,CAAC,UAAU,WAAW;AAAA,IACtC,MAAM,SAAS,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM;AAAA,IACjD,QAAQ;AAAA,MAEN,UAAU,YAAY;AAAA,MACtB,QAAQ,WAAW,OAAO,SAAS,GAAG;AAAA,aAAsB,UAAU,KAAK;AAAA,MAC3E,QAAQ,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM;AAAA,IAC5C,CAAC;AAAA,GACF;AAAA,CACF;AAEH,IAAM,SAAS,CAAC,UAA+D;AAAA,EAC7E,IAAI,MAAM,eAAe;AAAA,IAAG,OAAO;AAAA,EACnC,IAAI,MAAM,OAAO;AAAA,IAAG,OAAO;AAAA,EAC3B,IAAI,MAAM,YAAY;AAAA,IAAG,OAAO;AAAA,EAChC,OAAO;AAAA;AAGT,IAAM,cAAc,OAAO,MAAc,OAAmB,YAA0B;AAAA,EAEpF,MAAM,OAAO,KAAK,QAAQ,IAAI,GAAG,IAAI,SAAS,IAAI,KAAK,aAAY,CAAC,EAAE,SAAS,KAAK,OAAO;AAAA,EAG3F,MAAM,SAAS,MAAM,KAAK,MAAM,MAAM,GAAK;AAAA,EAC3C,IAAI;AAAA,IACF,IAAI;AAAA,MACF,MAAM,OAAO,UAAU,KAAK;AAAA,MAG5B,IAAI,QAAQ,QAAQ,aAAa,QAAQ,QAAQ,WAAW;AAAA,QAC1D,MAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,QAAQ,OAAO,EAAE;AAAA,MACzD;AAAA,MACA,MAAM,OAAO,MAAM,QAAQ,IAAI;AAAA,MAC/B,MAAM,OAAO,KAAK;AAAA,cAClB;AAAA,MACA,MAAM,OAAO,MAAM;AAAA;AAAA,IAErB,MAAM,OAAO,MAAM,IAAI;AAAA,IACvB,OAAO,OAAO;AAAA,IACd,MAAM,OAAO,IAAI,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA,IACxC,MAAM;AAAA;AAAA;AAIH,IAAM,cAAc,CAAC,UAA8B,CAAC,MAAkB;AAAA,EAC3E,MAAM,YAAY,QAAQ,iBAAiB;AAAA,EAC3C,MAAM,WAAW,QAAQ;AAAA,EACzB,OAAO;AAAA,IACL,cAAc,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,MAAM,CAAC,SAAS,KAAI,MAAM,SAAS;AAAA,IACnC,aAAa,OAAO,aAAa;AAAA,MAC/B,MAAM,SAAS,MAAM,KAAI,WAAW,UAAU,QAAQ,GAAG,SAAS;AAAA,MAClE,OAAO,OAAO,aAAa,IAAI,WAAW,UAAU,OAAO,MAAM,IAAI;AAAA;AAAA,IAEvE,YAAY,OAAO,aAAa;AAAA,MAC9B,MAAM,SAAS,MAAM,KAAI,UAAU,UAAU,QAAQ,GAAG,SAAS;AAAA,MACjE,OAAO,OAAO,aAAa,IAAI,UAAU,UAAU,OAAO,MAAM,IAAI;AAAA;AAAA,IAEtE,YAAY;AAAA,IACZ,UAAU,OAAO,SAAS;AAAA,MACxB,IAAI;AAAA,QACF,OAAO,IAAI,WAAW,MAAM,SAAS,IAAI,CAAC;AAAA,QAC1C,OAAO,OAAO;AAAA,QACd,IAAI,QAAO,KAAK;AAAA,UAAG;AAAA,QACnB,MAAM;AAAA;AAAA;AAAA,IAGV,YAAY,OAAO,SAAS;AAAA,MAC1B,IAAI;AAAA,QACF,MAAM,OAAO,IAAI;AAAA,QACjB,OAAO,OAAO;AAAA,QACd,IAAI,CAAC,QAAO,KAAK;AAAA,UAAG,MAAM;AAAA;AAAA;AAAA,IAG9B,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,IAC/D,MAAM,OAAO,SAAS;AAAA,MACpB,IAAI;AAAA,QACF,MAAM,QAAQ,MAAM,MAAM,IAAI;AAAA,QAC9B,OAAO;AAAA,UACL,KAAK,MAAM;AAAA,UACX,KAAK,MAAM;AAAA,UACX,KAAK,MAAM;AAAA,UACX,MAAM,OAAO,KAAK;AAAA,UAClB,MAAM,MAAM,OAAO;AAAA,UACnB,MAAM,MAAM;AAAA,UACZ,KAAK,MAAM;AAAA,QACb;AAAA,QACA,OAAO,OAAO;AAAA,QACd,IAAI,QAAO,KAAK;AAAA,UAAG;AAAA,QACnB,MAAM;AAAA;AAAA;AAAA,IAGV,iBAAiB;AAAA,EACnB;AAAA;;;ACjIK,IAAM,QAAQ;AAQd,IAAM,0BAA6C;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,WAAW;AAEjB,IAAM,SAA2E;AAAA,EAC/E,CAAC,UAAU,GAAG,EAAE;AAAA,EAChB,CAAC,QAAQ,GAAG,EAAE;AAAA,EACd,CAAC,OAAO,GAAG,EAAE;AAAA,EACb,CAAC,WAAW,GAAG,CAAC;AAAA,EAChB,CAAC,SAAS,GAAG,EAAE;AACjB;AAEA,IAAM,QAAQ,CAAC,OAAe,KAAa,MAAM,OAAO,qBACtD,OAAO,cAAc,KAAK,KAAK,SAAS,OAAO,SAAS;AAE1D,IAAM,mBAAmB,CAAC,YAAmD;AAAA,EAC3E,IAAI,QAAQ,WAAW;AAAA,IAAG,OAAO,CAAC,yDAAyD;AAAA,EAC3F,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,OAAO,UAAU,QAAQ,QAAQ,GAAG;AAAA,IAC9C,YAAY,OAAO,KAAK,QAAQ,QAAQ;AAAA,MACtC,MAAM,QAAQ,MAAM;AAAA,MACpB,IAAI,UAAU,aAAa,CAAC,MAAM,OAAO,KAAK,GAAG,GAAG;AAAA,QAClD,MAAM,KACJ,yBAAyB,OAAO,KAAK,MAAM,iBAAiB,OAAO,GAAG,KAAK,OAAO,GAAG,GACvF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,WAAW,CAAC,MAAc,UAC9B,UAAU,aAAa,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,+BAA+B;AAQlF,IAAM,oBAAmB,CAAC,OAAe,eAAiC;AAAA,EAC/E,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,MAAM,KAAK,KAAK,GAAG;AAAA,IACtB,MAAM,KAAK,wEAAwE;AAAA,EACrF;AAAA,EACA,MAAM,WAAW,wBAAwB,KAAK,CAAC,WAAW,MAAM,WAAW,MAAM,CAAC;AAAA,EAClF,IAAI,aAAa,WAAW;AAAA,IAC1B,MAAM,KAAK,SAAS,kBAAkB,wDAAwD;AAAA,EAChG;AAAA,EACA,IAAI,YAAY,UAAU,MAAM;AAAA,IAC9B,MAAM,KAAK,+CAA+C,YAAY;AAAA,EACxE,OAAO;AAAA;AAGF,IAAM,cAAc,CAAC,UAAqC;AAAA,EAC/D,MAAM,QAAQ,kBAAiB,MAAM,OAAO,MAAM,MAAM;AAAA,EACxD,MAAM,SAAS,YAAY,MAAM,MAAM;AAAA,EAEvC,OAAO,WAAW,MAAM;AAAA,EAExB,IAAI,YAAY;AAAA,IAAW,MAAM,KAAK,sCAAsC;AAAA,EACvE,SAAI,CAAC,QAAQ,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,8CAA8C;AAAA,EAE5F,WAAW,QAAQ,OAAO,KAAK,MAAM,eAAe,CAAC,CAAC,GAAG;AAAA,IACvD,IAAI,CAAC,SAAS,KAAK,IAAI;AAAA,MACrB,MAAM,KAAK,oBAAoB,KAAK,UAAU,IAAI,gCAAgC;AAAA,EACtF;AAAA,EACA,MAAM,KAAK,GAAG,kBAAkB,MAAM,aAAa,MAAM,kBAAkB,MAAM,SAAS,CAAC;AAAA,EAE3F,IAAI,MAAM,kBAAkB,aAAa,CAAC,MAAM,MAAM,eAAe,CAAC,GAAG;AAAA,IACvE,MAAM,KAAK,0DAA0D;AAAA,EACvE;AAAA,EACA,IAAI,MAAM,qBAAqB,aAAa,CAAC,MAAM,MAAM,kBAAkB,CAAC,GAAG;AAAA,IAC7E,MAAM,KAAK,iEAAiE;AAAA,EAC9E;AAAA,EACA,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,MAAM,KACJ,GAAG,iBAAiB,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAA4B,CAAC,CACzF;AAAA,EACF;AAAA,EACA,MAAM,YAAY,MAAM;AAAA,EACxB,IACE,OAAO,cAAc,YACrB,UAAU,mBAAmB,aAC7B,UAAU,YAAY,WACtB;AAAA,IACA,MAAM,KAAK,kEAAkE;AAAA,EAC/E;AAAA,EAEA,MAAM,KAAK,GAAG,SAAS,mBAAmB,MAAM,eAAe,CAAC;AAAA,EAChE,MAAM,KAAK,GAAG,SAAS,qBAAqB,MAAM,iBAAiB,CAAC;AAAA,EACpE,MAAM,KAAK,GAAG,SAAS,oBAAoB,MAAM,gBAAgB,CAAC;AAAA,EAElE,IAAI,QAAQ,SAAS,UAAU,MAAM,aAAa,aAAa,MAAM,cAAc,YAAY;AAAA,IAC7F,MAAM,KACJ,qFACF;AAAA,EACF;AAAA,EACA,WAAW,OAAO,OAAO,KAAK,MAAM,aAAa,CAAC,CAAC,GAAG;AAAA,IACpD,IAAI,WAAW,SAAS,GAAG;AAAA,MACzB,MAAM,KAAK,aAAa,gDAAgD;AAAA,EAC5E;AAAA,EACA,OAAO;AAAA;;;AC5GF,IAAM,YAAY;AAElB,IAAM,YAAY;AAElB,IAAM,YAAY;AACzB,IAAM,iBAAiB;AAAA;AAEhB,MAAM,uBAAuB,MAAM;AAAA,EACxC,WAAW,CAAC,SAAiB,UAAkB,QAAgB;AAAA,IAC7D,MAAM,aAAa,cAAc,OAAO,QAAQ,MAAM,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG;AAAA,IACnF,KAAK,OAAO;AAAA;AAEhB;AAiBO,IAAM,cAAc,CAAC,WAAwC;AAAA,EAClE,MAAM,SAAS,IAAI;AAAA,EACnB,MAAM,UAAoB,CAAC;AAAA,EAC3B,WAAW,QAAQ,OAAO,MAAM;AAAA,CAAI,GAAG;AAAA,IACrC,IAAI,QAAQ,WAAW,GAAG;AAAA,MACxB,IAAI,OAAO,SAAS,KAAK,KAAK,SAAS,MAAM;AAAA,QAAG,QAAQ,KAAK,GAAG;AAAA,MAChE;AAAA,IACF;AAAA,IACA,IAAI,SAAS,QAAQ,QAAQ,SAAS,IAAI;AAAA,MACxC,QAAQ,IAAI;AAAA,MACZ;AAAA,IACF;AAAA,IACA,MAAM,SAAS,mBAAmB,KAAK,IAAI;AAAA,IAC3C,IAAI,SAAS,OAAO,aAAa,OAAO,GAAG,WAAW,QAAQ,QAAQ;AAAA,MACpE,QAAQ,KAAK,GAAG,OAAO,KAAK;AAAA,MAC5B;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,QAAQ,WAAW,IAAI,iCAAiC,KAAK,IAAI,IAAI;AAAA,IACnF,IAAI,QAAQ,OAAO,aAAa,MAAM,OAAO,aAAa,CAAC,OAAO,IAAI,MAAM,EAAE,GAAG;AAAA,MAC/E,OAAO,IAAI,MAAM,IAAI,MAAM,EAAE;AAAA,IAC/B;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,aAAa,CAAC,SAAiD;AAAA,EACnE,MAAM,QAAQ,SAAS,YAAY,OAAO,WAAW,KAAK,IAAI;AAAA,EAC9D,OAAO,QAAQ,OAAO,YAAY,YAAY,OAAO,MAAM,EAAE;AAAA;AAGxD,IAAM,aAAa,CAAC,WAAkC;AAAA,EAC3D,MAAM,SAAS,YAAY,MAAM;AAAA,EACjC,MAAM,QAAQ,OAAO,IAAI,OAAO;AAAA,EAChC,MAAM,MAAM,WAAW,OAAO,IAAI,KAAK,CAAC;AAAA,EAExC,MAAM,eAAe,WAAW,OAAO,IAAI,gBAAgB,CAAC;AAAA,EAC5D,OAAO;AAAA,IACL,QAAQ;AAAA,OACJ,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM;AAAA,OACnC,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,OAC/B,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa;AAAA,EACvD;AAAA;AAIK,IAAM,gBAAgB,CAAC,WAAgC;AAAA,EAC5D,MAAM,WAAW,IAAI;AAAA,EACrB,WAAW,SAAS,OAAO,SAAS,8BAA8B,GAAG;AAAA,IACnE,IAAI,MAAM,OAAO,cAAc,MAAM,OAAO,cAAc,MAAM,OAAO,SAAS;AAAA,MAC9E,SAAS,IAAI,MAAM,EAAE;AAAA,IACvB;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,eAAe,OAAO,QAAoB,WAA2C;AAAA,EAChG,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,SAAS,MAAM,CAAC;AAAA,EAC7D,IAAI,OAAO,aAAa;AAAA,IAAW,OAAO,EAAE,QAAQ,MAAM;AAAA,EAG1D,IAAI,OAAO,aAAa,aAAa,OAAO,OAAO,SAAS,cAAc,GAAG;AAAA,IAC3E,OAAO,EAAE,eAAe,MAAM,QAAQ,MAAM;AAAA,EAC9C;AAAA,EACA,IAAI,OAAO,aAAa;AAAA,IACtB,MAAM,IAAI,eAAe,SAAS,UAAU,OAAO,UAAU,OAAO,MAAM;AAAA,EAC5E,OAAO,WAAW,OAAO,MAAM;AAAA;AAG1B,IAAM,aAAa,OACxB,QACA,QACA,UACqB;AAAA,EACrB,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,kBAAkB,MAAM,CAAC;AAAA,EACtE,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,eAAe,kBAAkB,UAAU,OAAO,UAAU,OAAO,MAAM;AAAA,EACrF;AAAA,EACA,OAAO,cAAc,OAAO,MAAM,EAAE,IAAI,KAAK;AAAA;AAGxC,IAAM,YAAY,OACvB,QACA,QACA,cACkB;AAAA,EAClB,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,aAAa,QAAQ,SAAS,CAAC;AAAA,EAC5E,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,eAAe,aAAa,UAAU,aAAa,OAAO,UAAU,OAAO,MAAM;AAAA,EAC7F;AAAA;AASK,IAAM,eAAe,OAC1B,QACA,QACA,WAAW,KACX,aAAa,QACK;AAAA,EAClB,SAAS,UAAU,EAAG,UAAU,UAAU,WAAW,GAAG;AAAA,IACtD,IAAI,EAAE,MAAM,aAAa,QAAQ,MAAM,GAAG;AAAA,MAAQ;AAAA,IAClD,MAAM,OAAO,MAAM,UAAU;AAAA,EAC/B;AAAA,EACA,MAAM,IAAI,MACR,GAAG,0BAA0B,OAAQ,WAAW,aAAc,IAAI,kBACpE;AAAA;AAIK,IAAM,kBAAkB,OAAO,QAAoB,WAAkC;AAAA,EAC1F,IAAI,EAAE,MAAM,aAAa,QAAQ,MAAM,GAAG;AAAA,IAAQ;AAAA,EAClD,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,WAAW,MAAM,CAAC;AAAA,EAS/D,IAAI;AAAA,IACF,MAAM,aAAa,QAAQ,MAAM;AAAA,IACjC,OAAO,OAAO;AAAA,IACd,IAAI,OAAO,aAAa;AAAA,MAAG,MAAM;AAAA,IACjC,MAAM,IAAI,eACR,WAAW,UACX,OAAO,UACP,GAAG,OAAO,OAAO,KAAK,oCACxB;AAAA;AAAA;;;AChKG,MAAM,yBAAyB,MAAM;AAAA,EAC1C,WAAW,CAAC,SAAiB;AAAA,IAC3B,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA;AAEhB;AAGO,IAAM,OAAO;AACb,IAAM,UAAU;AAChB,IAAM,KAAK;AAGlB,IAAM,SAA8B,IAAI,IAAI,CAAC,aAAa,WAAW,WAAW,CAAC;AAG1E,IAAM,YAAY,CAAC,SACxB,OAAO,cAAc,IAAI,KAAK,QAAQ,KAAK,QAAQ,OAC/C,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,IAChC;AAGC,IAAM,gBAAgB,CAAC,aAAmD;AAAA,EAC/E,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,MAAM,IAAI,MACR,4FACF;AAAA,EACF;AAAA,EACA,WAAW,UAAU,UAAU;AAAA,IAC7B,MAAM,QAAQ,WAAW,MAAM,CAAC,4BAA4B,IAAI,aAAa,MAAM;AAAA,IACnF,IAAI,MAAM,SAAS,GAAG;AAAA,MACpB,MAAM,IAAI,MAAM,sBAAsB,KAAK,UAAU,MAAM,MAAM,MAAM,KAAK,IAAI,GAAG;AAAA,IACrF;AAAA,EACF;AAAA,EACA,OAAO,CAAC,GAAG,QAAQ;AAAA;AAOd,IAAM,WAAW,CAAC,MAAc,aACrC,aAAa,IAAI,EAAE,SAAS,IACxB,YACA,SAAS,KAAK,CAAC,WAAW,KAAK,WAAW,GAAG,SAAS,CAAC;AAE7D,IAAM,UAAU,CAAC,UACf,MAAM,KAAK,KAAK,KAAK,CAAC,wBAAwB,KAAK,CAAC,WAAW,MAAM,WAAW,MAAM,CAAC;AAGzF,IAAM,cAAc,CAAC,WAAmD;AAAA,EACtE,MAAM,QAAQ,QAAQ,WAAW,SAAS,MAAM,OAAO,OAAO,MAAM,UAAU,MAAM,IAAI;AAAA,EACxF,OAAO,UAAU,aAAa,QAAQ,KAAK,IAAI,QAAQ;AAAA;AASzD,IAAM,cAAc,CAAC,OAAe,aAAoD;AAAA,EACtF,MAAM,OAAO,aAAa,OAAO,EAAE,MAAM,SAAS,GAAG,SAAS;AAAA,EAC9D,OAAO,SAAS,MAAM,QAAQ,MAAM,YAAY,YAAY;AAAA;AAG9D,IAAM,mBACJ;AAEF,IAAM,mBAAmB,CACvB,MACA,aACuB;AAAA,EACvB,OAAO,QAAQ,QAAQ;AAAA,EACvB,IAAI,QAAQ,aAAa;AAAA,IACvB,MAAM,QAAQ,KAAK,MAAM;AAAA,IACzB,MAAM,OAAO,MAAM,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC;AAAA,IACnD,MAAM,QAAQ,KAAK,SAAS,QAAQ,IAAI,KAAK,MAAM,GAAG,CAAC,SAAS,MAAM,IAAI;AAAA,IAC1E,MAAM,SAAS,KAAK,WAAW,KAAK,KAAK,OAAO,YAAY,QAAQ,KAAK;AAAA,IACzE,IAAI,CAAC;AAAA,MAAQ,OAAO;AAAA,IACpB,MAAM,QAAQ,YAAY,OAAO,QAAQ;AAAA,IACzC,IAAI,UAAU;AAAA,MAAW,OAAO,aAAa;AAAA,IAC7C,OAAO,UAAU,QAAQ,YAAY,wBAAwB;AAAA,EAC/D;AAAA,EACA,IAAI,QAAQ,WAAW;AAAA,IACrB,MAAM,QAAQ,KAAK,WAAW,IAAI,YAAY,KAAK,EAAE,IAAI;AAAA,IACzD,IAAI,UAAU;AAAA,MAAW,OAAO;AAAA,IAMhC,OAAO,YAAY,OAAO,QAAQ,MAAM,YAAY,WAAW,qBAAqB;AAAA,EACtF;AAAA,EACA,IAAI,QAAQ,aAAa;AAAA,IACvB,MAAM,QAAQ,KAAK,MAAM,GAAG,EAAE;AAAA,IAC9B,MAAM,UACJ,MAAM,MAAM,CAAC,SAAS,SAAS,QAAQ,SAAS,IAAI,KAAK,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM;AAAA,IACzF,OAAO,WAAW,YAAY,KAAK,KAAK,SAAS,EAAE,MAAM,YACrD,YACA;AAAA,EACN;AAAA,EACA,OAAO,aAAa,OAAO,GAAG;AAAA;AAGhC,IAAM,KAAK;AAGX,IAAM,QAAQ,CAAC,QAAoC;AAAA,EACjD,OAAO,MAAM,IAAI,QAAQ,YAAY;AAAA,EACrC,IAAI,IAAI,WAAW;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,IAAI,WAAW;AAAA,IAAG,QAAQ,SAAS,QAAQ,SAAS,SAAS,GAAG,KAAK,MAAM,EAAE;AAAA,EACjF,OACE,IAAI,WAAW,KACf,SAAS,QACT,GAAG,KAAK,MAAM,EAAE,KAChB,WAAW,QACX,GAAG,KAAK,YAAY,EAAE;AAAA;AAQnB,IAAM,oBAAoB,CAC/B,MACA,YACuB;AAAA,EACvB,OAAO,YAAY,QAAQ;AAAA,EAC3B,MAAM,QAAQ,CAAC,SACb,SAAS,aAAa,SAAS,MAAM,QAAQ,QAAQ,MAAM;AAAA,EAC7D,IAAI,YAAY;AAAA,IAAW,OAAO,iBAAiB,MAAM,QAAQ,QAAQ;AAAA,EACzE,IAAI,YAAY,SAAS;AAAA,IAEvB,OAAO,MAAM,GAAG,SAAS,QAAQ;AAAA,IACjC,IAAI,SAAS,QAAQ,MAAM,QAAQ,SAAS,aAAa,CAAC,aAAa,KAAK,IAAI,GAAG;AAAA,MACjF,OAAO;AAAA,IACT;AAAA,IACA,IAAI,KAAK,SAAS,KAAK,CAAC,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC;AAAA,MAAG,OAAO;AAAA,IACzD,OAAO,QAAQ,QAAQ,KAAK,MAAM,EAAE;AAAA,IACpC,IAAI,WAAW,aAAa,WAAW,QAAQ,QAAQ;AAAA,MACrD,OAAO;AAAA,IACT;AAAA,IACA,OAAO,MAAM,IAAI,IAAI,YAAY;AAAA,EACnC;AAAA,EACA,IAAI,YAAY,IAAI;AAAA,IAClB,OAAO,OAAO,KAAK,SAAS,SAAS;AAAA,IACrC,OAAO,UAAU,QAAQ,QAAQ,QAAQ,MAAM,WAAW,KAAK,MAAM,IAAI,IACrE,YACA;AAAA,EACN;AAAA,EACA,OAAO,GAAG,OAAO,OAAO;AAAA;AAkBnB,IAAM,YAAY,CAAC,MAAyB,gBAA+B;AAAA,EAChF,OAAO,SAAS,OAAO;AAAA,EACvB,IAAI,YAAY,UAAU,SAAS,SAAS,OAAO,MAAM,MAAM;AAAA,IAC7D,OAAO;AAAA,MACL,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,IAAI,YAAY,aAAa,QAAQ,aAAa,CAAC,OAAO,IAAI,GAAG;AAAA,IAAG,OAAO,EAAE,IAAI,WAAW;AAAA,EAC5F,MAAM,SAAS,QAAQ,cAAc,KAAK,KAAK,SAAS,KAAK,KAAK;AAAA,EAClE,IAAI,WAAW,YAAY,QAAQ,WAAW,SAAS,MAAM;AAAA,IAAM,OAAO,EAAE,IAAI,OAAO;AAAA,EACvF,MAAM,QAAQ,+BAA+B,KAAK,UAAU,EAAE,IAAI;AAAA,EAClE,IAAI,UAAU,aAAa,OAAO,KAAK,MAAM;AAAA,IAAa,OAAO,EAAE,IAAI,WAAW;AAAA,EAClF,OAAO;AAAA,IACL,QACE,aAAa,OAAO,OAAO,MAAM,iCAAiC,2BAClE;AAAA,EACJ;AAAA;;;AC/LF,IAAM,WACJ;AACF,IAAM,cACJ;AAGK,IAAM,aACX,CAAC,MAAc,aACf,CAAC,UAA0B;AAAA,EACzB,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,IAAI,SAAS,YAAY,SAAS;AAAA,IAAS,MAAM;AAAA,EACjD,MAAM,IAAI,MACR,cAAc,SAAS,0EACrB,IAAI,SAAS,KAAK,IAAI,uEACxB,EAAE,MAAM,CACV;AAAA;AAOG,IAAM,cAAc,CAAC,OAAe,WAAqD;AAAA,EAC9F,IAAI,OAAO,aAAa;AAAA,IAAG;AAAA,EAC3B,IAAI,SAAS,KAAK,OAAO,MAAM,GAAG;AAAA,IAChC,OAAO,IAAI,iBACT,WAAW,mFACT,uFACA,2DACJ;AAAA,EACF;AAAA,EACA,IAAI,YAAY,KAAK,OAAO,MAAM,GAAG;AAAA,IACnC,OAAO,IAAI,iBACT,WAAW,mFACb;AAAA,EACF;AAAA,EACA;AAAA;;;ACvBK,IAAM,QAAQ;AACd,IAAM,QAAQ;AACd,IAAM,QAAQ;AACd,IAAM,QAAQ;AAQrB,IAAM,eAAe,CAAC,SACpB,6BAA6B,KAAK,IAAI,IAAI,OAAO,SAAS,MAAM,CAAC,IAAI;AAEvE,IAAM,sBAAsB;AAG5B,IAAM,iBAAiB,CAAC,SAAiD;AAAA,EACvE,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,QAAQ,OAAO,yBAAyB,IACpC,oHACA;AAAA;AAQN,IAAM,aAAa;AAEZ,IAAM,oBAAoB,CAC/B,SACA,MACA,aACuB;AAAA,EACvB,MAAM,QAAQ,CAAC,UACb,UAAS,aAAa,SAAS,OAAM,QAAQ,MAAM;AAAA,EACrD,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,GAAG,UAAU,MAAK,UAAS,UAAS;AAAA,IAC3C,MAAM,OAAO,aAAa,YAAY,YAAY,aAAa,QAAQ;AAAA,IACvE,IAAI,MAAM,QAAQ,SAAS,aAAa,SAAQ,QAAQ,OAAM,WAAW,KAAK,CAAC,MAAM,KAAI,GAAG;AAAA,MAC1F,OAAO;AAAA,IACT;AAAA,IACA,OAAO,eAAe,IAAI;AAAA,EAC5B;AAAA,EACA,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,UAAU,MAAK,UAAS,UAAS;AAAA,IACxC,MAAM,OAAO,aAAa,YAAY,YAAY,aAAa,QAAQ;AAAA,IACvE,IAAI,SAAS,aAAa,SAAQ,QAAQ,OAAM,WAAW,KAAK,CAAC,MAAM,KAAI,GAAG;AAAA,MAC5E,OAAO;AAAA,IACT;AAAA,IACA,OAAO,eAAe,IAAI;AAAA,EAC5B;AAAA,EACA,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,OAAO,MAAK,UAAS,UAAS;AAAA,IACrC,OAAO,UAAU,aACf,WAAW,KAAK,KAAK,KACrB,SAAQ,QACR,OAAM,WAAW,KACjB,MAAM,KAAI,IACR,YACA,0FACE;AAAA,EACR;AAAA,EACA,OAAO,KAAK,SAAS,SAAS;AAAA,EAC9B,OAAO,QAAQ,QAAQ,MAAM,WAAW,KAAK,MAAM,IAAI,IACnD,YACA;AAAA;;;AC7EC,IAAM,oBAAoB,CAAC,SAAyB;AAAA,EACzD,OAAO,SAAS,WAAW,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,SAAS;AAAA,EAClF,MAAM,MAAM,YAAY,aAAa,YAAY,KAAK,KAAK,IAAI;AAAA,EAC/D,MAAM,MAAM,YAAY,YAAY,KAAK,KAAK;AAAA,EAC9C,OAAO,GAAG,MAAM;AAAA;AAIlB,IAAM,aAAa;AAQnB,IAAM,mBAAmB,CAAC,MAAyB,SAAqC;AAAA,EACtF,OAAO,OAAO,KAAK,SAAS,SAAS;AAAA,EACrC,IACE,UAAU,aACV,WAAW,KAAK,KAAK,KACrB,QAAQ,QACR,MAAM,WAAW,KACjB,SAAS,MACT;AAAA,IACA;AAAA,EACF;AAAA,EACA,OACE,sFACA;AAAA;AASG,IAAM,eAAe,CAC1B,MACA,YACuB;AAAA,EACvB,MAAM,OAAO,KAAK,KAAK,SAAS;AAAA,EAChC,IAAI,QAAQ,SAAS,aAAa,SAAS,QAAQ;AAAA,IACjD,OAAO,iBAAiB,MAAM,QAAQ,IAAI;AAAA,EAC5C,OAAO,kBAAkB,OAAO,MAAM,QAAQ,QAAQ;AAAA;;AClCjD,IAAM,KAAK;AACX,IAAM,MAAK;AACX,IAAM,gBAAgB;AAGtB,IAAM,qBAA0C,IAAI,IAAI;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,yBAA8C,IAAI,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,CAAC;AACxF,IAAM,SAA2C;AAAA,EAC/C,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AAAA,EACP,WAAW;AACb;AAOO,IAAM,eAAe,CAAC,SAA+C;AAAA,EAC1E,MAAM,MAAM,OAAO,KAAK,MAAM;AAAA,EAC9B,MAAM,UAAU,OAAO,KAAK;AAAA,EAC5B,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,UAAU,QAAQ,KAAK,MAAM,CAAC;AAAA,IACrC,OAAO,CAAC,OAAO,UAAU,YAAY,KAAK,kBAAkB,KAAK,GAAG,GAAG,IAAI;AAAA,EAC7E;AAAA,EACA,OAAO,QAAQ,YAAY,OAAO,CAAC,KAAK,GAAG,KAAK,MAAM,CAAC,CAAC;AAAA;AAG1D,IAAM,QAAQ,CAAC,SAAyB,KAAK,MAAM,GAAG,KAAK,YAAY,GAAG,CAAC,KAAK;AAchF,IAAM,iBAAiB,CAAC,MAAyB,YAA8C;AAAA,EAC7F,OAAO,GAAG,MAAM,GAAG,IAAI,QAAQ,SAAS,SAAS;AAAA,EACjD,IACE,MAAM,QACN,SAAS,aACT,CAAC,aAAa,KAAK,IAAI,KACvB,MAAM,QACN,OAAO,QACP,MAAM,WAAW,GACjB;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,IAAI,WAAW,aAAa,WAAW,QAAQ,QAAQ;AAAA,IACrD,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,aAAa,SAAS,QAAQ,MAAM;AAAA,IAC/C,OAAO;AAAA,EACT;AAAA,EACA,OAAO,SAAS,MAAM,QAAQ,QAAQ,MAAM,YACxC,uDACA;AAAA;AAGN,IAAM,YAAY,CAAC,MAAyB,YAA8C;AAAA,EACxF,OAAO,GAAG,GAAG,IAAI,QAAQ,QAAQ;AAAA,EACjC,IAAI,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,KAAK,WAAW,GAAG;AAAA,IAChE,OAAO;AAAA,EACT;AAAA,EACA,IAAI,WAAW,aAAa,WAAW,QAAQ,MAAM;AAAA,IACnD,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,aAAa,SAAS,MAAM,QAAQ,QAAQ,MAAM,WAAW;AAAA,IACxE,OAAO;AAAA,EACT;AAAA,EACA,OAAO,MAAM,MAAM,MAAM,MAAM,IAAI,IAC/B,YACA;AAAA;AAGN,IAAM,YAAY,CAAC,MAAyB,YAA8C;AAAA,EACxF,OAAO,OAAO,KAAK,SAAS,SAAS;AAAA,EACrC,OAAO,UAAU,QACf,QAAQ,QACR,MAAM,WAAW,KACjB,SAAS,aACT,SAAS,MAAM,QAAQ,QAAQ,MAAM,YACnC,YACA;AAAA;AAGN,IAAM,yBAA8C,IAAI,IAAI;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,mBAAwC,IAAI,IAAI;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,mBAAmB,CACvB,MACA,aACuB;AAAA,EACvB,IAAI,KAAK,KAAK,CAAC,QAAQ,uBAAuB,IAAI,GAAG,CAAC,GAAG;AAAA,IACvD,OAAO;AAAA,EACT;AAAA,EACA,OAAO,SAAS,QAAQ;AAAA,EACxB,IAAI,SAAS;AAAA,IACX,OAAO,KAAK,WAAW,IAAI,YAAY;AAAA,EACzC,IAAI,SAAS,aAAa,iBAAiB,IAAI,IAAI,GAAG;AAAA,IACpD,OAAO,IAAI,SAAS,SAAS;AAAA,IAC7B,OAAO,OAAO,QAAQ,SAAS,aAAa,KAAU,KAAK,IAAI,KAAK,MAAM,WAAW,IACjF,YACA,GAAG;AAAA,EACT;AAAA,EACA,OAAO,aAAa,OAAO,IAAI;AAAA;AAI1B,IAAM,qBAAoB,CAC/B,MACA,YACuB;AAAA,EACvB,OAAO,YAAY,QAAQ;AAAA,EAC3B,IAAI,YAAY;AAAA,IAAS,OAAO,eAAe,MAAM,OAAO;AAAA,EAC5D,IAAI,YAAY;AAAA,IAAI,OAAO,UAAU,MAAM,OAAO;AAAA,EAClD,IAAI,YAAY;AAAA,IAAI,OAAO,UAAU,MAAM,OAAO;AAAA,EAClD,IAAI,YAAY;AAAA,IAAe,OAAO,iBAAiB,MAAM,QAAQ,QAAQ;AAAA,EAC7E,IAAI,YAAY;AAAA,IAAO,OAAO,aAAa,MAAM,OAAO;AAAA,EACxD,IAAI,YAAY,SAAS,YAAY,SAAS,YAAY,OAAO;AAAA,IAC/D,OAAO,kBAAkB,SAAS,MAAM,QAAQ,QAAQ;AAAA,EAC1D;AAAA,EACA,OAAO,GAAG,OAAO,OAAO;AAAA;AAenB,IAAM,aAAY,CAAC,MAAyB,aAAuC;AAAA,EACxF,OAAO,YAAY,QAAQ;AAAA,EAC3B,IAAI,YAAY,UAAU,SAAS,SAAS,OAAO,MAAM,MAAM;AAAA,IAC7D,OAAO;AAAA,MACL,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,IAAI,YAAY,eAAe,YAAY,eAAe;AAAA,IACxD,IAAI,KAAK,KAAK,CAAC,QAAQ,uBAAuB,IAAI,GAAG,CAAC,GAAG;AAAA,MACvD,OAAO,EAAE,QAAQ,+DAA+D;AAAA,IAClF;AAAA,IACA,OAAO,QAAQ;AAAA,IACf,OAAO,SAAS,mBAAoB,SAAS,aAAa,iBAAiB,IAAI,IAAI,IAC/E,EAAE,IAAI,OAAO,IACb,EAAE,IAAI,WAAW;AAAA,EACvB;AAAA,EAGA,IAAI,mBAAmB,IAAI,WAAW,EAAE,KAAK,uBAAuB,IAAI,WAAW,EAAE,GAAG;AAAA,IACtF,MAAM,OAAO,KAAK,KAAK,SAAS;AAAA,IAChC,OAAO,SAAS,aAAa,SAAS,MAAM,QAAQ,MAAM,YACtD,EAAE,IAAI,OAAO,IACb,EAAE,IAAI,WAAW;AAAA,EACvB;AAAA,EACA,OAAO,EAAE,IAAI,WAAW;AAAA;;;AC3MnB,IAAM,KAAK;AAGlB,IAAM,eAAoC,IAAI,IAAI;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,QAAQ;AAGP,IAAM,YAAY,CAAC,YACxB,QACG,MAAM;AAAA,CAAI,EACV,OAAO,CAAC,SAAS;AAAA,EAChB,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI;AAAA,EAClC,OAAO,WAAW,aAAa,OAAO,MAAM,GAAG,EAAE,KAAK,CAAC,UAAU,aAAa,IAAI,KAAK,CAAC;AAAA,CACzF,EACA,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;AAMvB,IAAM,oBAAoB,OAC/B,MACA,MACA,UACkB;AAAA,EAClB,MAAM,SAAS,MAAM,KAAK,KAAK,CAAC,IAAI,SAAS,MAAM,GAAG,KAAK,CAAC;AAAA,EAC5D,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,iBACR,cAAc,wEACZ,IAAI,iBAAiB,OAAO,OAAO,QAAQ,0BAC/C;AAAA,EACF;AAAA,EACA,MAAM,SAAS,UAAU,OAAO,MAAM;AAAA,EACtC,IAAI,OAAO,WAAW;AAAA,IAAG;AAAA,EACzB,MAAM,IAAI,iBACR,cAAc,gFACZ,mCAAmC,OAAO,KAAK,IAAI,yCACnD,oDACJ;AAAA;;;ACzDF,IAAM,UAAS,CAAC,MAAc,YAC5B,IAAI,iBAAiB,cAAc,SAAS,SAAS;AA0BhD,IAAM,cAAc,CAAC,YAA8C;AAAA,EACxE,MAAM,eACJ,QAAQ,QAAQ,aAChB,QAAQ,QAAQ,KAChB,QAAQ,QAAQ,aAChB,QAAQ,QAAQ;AAAA,EAClB,IAAI,CAAC;AAAA,IAAc;AAAA,EACnB,MAAM,QAAkB,CAAC;AAAA,EACzB,KAAK,QAAQ,OAAO,UAAY;AAAA,IAAG,MAAM,KAAK,eAAe;AAAA,EAC7D,KAAK,QAAQ,OAAO,QAAW;AAAA,IAAG,MAAM,KAAK,4BAA4B;AAAA,EACzE,IAAI,MAAM,WAAW;AAAA,IAAG;AAAA,EACxB,OAAO,QAAQ,QAAQ,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,QAAQ,MAAM,KAAK,OAAO;AAAA;AAS5E,IAAM,UAAU,CACrB,MACA,KACA,WACwB;AAAA,EACxB,IAAI,QAAQ;AAAA,IAAG,OAAO;AAAA,EACtB,IAAI,KAAK,QAAQ;AAAA,IAAK,QAAQ,KAAK,OAAO,SAAW;AAAA,EACrD,MAAM,aAAa,KAAK,OAAO,QAAW;AAAA,EAC1C,MAAM,aAAa,KAAK,OAAO,OAAW;AAAA,EAE1C,IAAI,cAAc;AAAA,IAAW,OAAO;AAAA,EACpC,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,OAAO,OAAO,SAAS,KAAK,GAAG,IAAI,YAAY;AAAA;AAa1C,IAAM,qBAAqB,OAChC,MACA,MACA,SACA,WACkB;AAAA,EAClB,MAAM,WAAW,KAAK,aAAa;AAAA,EACnC,MAAM,SAAS,KAAK,MAAM,GAAG,KAAK,YAAY,GAAG,CAAC,KAAK;AAAA,EACvD,MAAM,MAAM,QAAQ,QAAQ,MAAM,KAAK,KAAK,MAAM,IAAI,OAAO;AAAA,EAC7D,MAAM,OAAO,EAAE,KAAK,MAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,EAAE;AAAA,EAC9D,IAAI,QAAQ,MAAM,UAAU,MAAM,MAAM;AAAA,IAAO;AAAA,EAC/C,MAAM,QACJ,MACA,SAAS,OAAO,KAAK,GAAG,YAAY,OAAO,GAAG,WAAW,KAAK,KAAK,SAAS,CAAC,qBAC3E,gCAAgC,OAAO,QAAQ,8CAC/C,kEACJ;AAAA;AASK,IAAM,iBAAiB,OAAO,SAA6D;AAAA,EAChG,MAAM,SAAS,MAAM,KAAK,KAAK,CAAC,eAAe,IAAI,CAAC;AAAA,EACpD,MAAM,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,KAAK;AAAA,EAC5C,OAAO,OAAO,aAAa,KAAK,IAAI,MAAM,CAAC,OAAO,QAAQ,KAAK,EAAE,CAAC,IAAI,IAAI,IAAI,MAAM,IAAI;AAAA;;;AChF1F,IAAM,UAAS,CAAC,MAAc,YAC5B,IAAI,iBAAiB,cAAc,SAAS,SAAS;AAGhD,IAAM,cAAc,CAAC,QAAgB,SAA2B;AAAA,EACrE,MAAM,QAAQ,KACX,MAAM,OAAO,SAAS,CAAC,EACvB,MAAM,GAAG,EACT,MAAM,GAAG,EAAE;AAAA,EACd,OAAO,MAAM,IAAI,CAAC,GAAG,UAAU,GAAG,UAAU,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,KAAK,GAAG,GAAG;AAAA;AAI5E,IAAM,YAAY,CAAC,WAA6B;AAAA,EACrD,MAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,MAAM,GAAG,EAAE;AAAA,EAC3C,OAAO,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,UAAU,IAAI,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC;AAAA;AAqBpF,IAAM,kBAAkB,CAAC,SAAmD;AAAA,EAC1E,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,IAAI,KAAK,SAAS;AAAA,IAAa,OAAO,QAAQ,KAAK;AAAA,EACnD,IAAI,KAAK,QAAQ;AAAA,IAAG,OAAO,mBAAmB,OAAO,KAAK,GAAG;AAAA,EAC7D,KAAK,KAAK,OAAO,QAAW,GAAG;AAAA,IAC7B,OAAO,uCAAuC,KAAK,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG;AAAA,EACrF;AAAA,EACA;AAAA;AAOK,IAAM,kBAAkB,OAC7B,MACA,QACA,MACA,WAC+B;AAAA,EAC/B,MAAM,QAAQ,UAAU,MAAM;AAAA,EAC9B,YAAY,OAAO,UAAU,MAAM,QAAQ,IAAI,MAAM,IAAI,CAAC,QAAQ,KAAK,KAAK,GAAG,CAAC,CAAC,GAAG,QAAQ,GAAG;AAAA,IAC7F,MAAM,KAAK,MAAM,SAAS,aAAa,KAAK,QAAQ,IAAI,YAAY,gBAAgB,IAAI;AAAA,IACxF,IAAI,OAAO,WAAW;AAAA,MACpB,MAAM,QACJ,MACA,GAAG,OAAO,MAAM,MAAM,gCAAgC,WAAW,+BAC/D,iGACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,YAAY,QAAQ,IAAI;AAAA,EACrC,OAAO,eAAe,SAAS,MAAM,QAAQ,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,IAAI,CAAC,QAAQ,KAAK,KAAK,GAAG,CAAC,CAAC;AAAA,EAC/F,MAAM,MAAM,gBAAgB,UAAU;AAAA,EACtC,IAAI,QAAQ,WAAW;AAAA,IACrB,MAAM,QACJ,MACA,uBAAuB,UAAU,2DAC/B,2CACJ;AAAA,EACF;AAAA,EACA,YAAY,OAAO,SAAS,MAAM,QAAQ,GAAG;AAAA,IAC3C,MAAM,MAAM,OAAO,KAAK,MAAM;AAAA,IAC9B,IAAI,MAAM,SAAS,aAAa;AAAA,MAC9B,MAAM,QACJ,MACA,GAAG,UAAU,SAAS,YAAY,YAAY,KAAK,KAAK,kBACtD,+DACJ;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,gBAAgB,IAAI;AAAA,IAClC,IAAI,UAAU,WAAW;AAAA,MACvB,MAAM,QACJ,MACA,GAAG,OAAO,0CAA0C,yCAClD,8DACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,kBAAkB,MAAM,MAAM,CAAC,GAAG,OAAO,QAAQ,GAAG,IAAI,CAAC;AAAA,EAC/D,MAAM,SAAS,MAAM,KAAK,KAAK,IAAI;AAAA,EACnC,IAAI,WAAW,aAAa,WAAW;AAAA,IAAkB,OAAO;AAAA,EAChE,IAAI,QAAQ,SAAS;AAAA,IAAQ,OAAO;AAAA,EACpC,MAAM,QAAO,MAAM,MAAM,WAAW,YAAY,YAAY,KAAK,OAAO,oBAAoB;AAAA;AAQvF,IAAM,oBAAoB,OAC/B,MACA,QACA,MACA,SACA,WACkB;AAAA,EAClB,MAAM,OAAO,YAAY,OAAO;AAAA,EAChC,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,QACJ,MACA,GAAG,yFACD,kCACJ;AAAA,EACF;AAAA,EACA,MAAM,gBAAgB,MAAM,QAAQ,MAAM,gBAAgB;AAAA,EAC1D,MAAM,mBAAmB,MAAM,MAAM,SAAS,MAAM;AAAA;;;ACvHtD,IAAM,SAAQ,IAAI,IAA8B;AAAA,EAC9C,CAAC,KAAK,MAAM;AAAA,EACZ,CAAC,KAAK,WAAW;AAAA,EACjB,CAAC,KAAK,SAAS;AACjB,CAAC;AAOM,IAAM,WAAW,CAAC,UAAsC;AAAA,EAC7D,IAAI,MAAM,WAAW;AAAA,IAAG;AAAA,EACxB,IAAI,OAAO;AAAA,EACX,WAAW,SAAS,CAAC,GAAG,GAAG,CAAC,GAAG;AAAA,IAC7B,MAAM,KAAK,QAAQ;AAAA,IACnB,MAAM,QAAQ,IAAI;AAAA,IAClB,OAAO,MAAM,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,KAAK,IAAI,MAAM,KAAK,EAAE;AAAA,IACpE,IAAK,SAAS,OAAO,SAAS,OAAS,UAAU,OAAO,UAAU;AAAA,MAAM;AAAA,IACxE,IAAI,SAAS;AAAA,MAAK,QAAQ,KAAO;AAAA,IACjC,IAAI,UAAU;AAAA,MAAK,QAAQ,KAAO;AAAA,IAClC,OAAO,KAAK,SAAS,UAAU,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;AAAA,IACzD,IAAI,SAAS,OAAO,SAAS;AAAA,MAAK,QAAQ,KAAO;AAAA,IAC5C,SAAI,SAAS,OAAO,SAAS;AAAA,MAAO;AAAA,IACzC,IAAI,SAAS,OAAO,SAAS;AAAA,MAAO,QAAQ,QAAU;AAAA,EACxD;AAAA,EACA,OAAO;AAAA;AAIT,IAAM,OAAO;AAQb,IAAM,SAAS,CAAC,MAAc,UAC5B,CAAC,GAAG,KAAK,EACN,KAAK,CAAC,MAAM,UAAU,MAAM,SAAS,KAAK,MAAM,EAChD,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC;AAGvE,IAAM,eAAe,CAC1B,QACA,UACoC;AAAA,EACpC,MAAM,UAAU,IAAI;AAAA,EACpB,WAAW,QAAQ,OAAO,MAAM;AAAA,CAAI,EAAE,OAAO,CAAC,SAAS,KAAK,KAAK,MAAM,EAAE,GAAG;AAAA,IAC1E,MAAM,QAAQ,KAAK,KAAK,IAAI;AAAA,IAC5B,IAAI,UAAU;AAAA,MAAM;AAAA,IACpB,SAAS,MAAM,OAAO,MAAM,KAAK,KAAK,MAAM,QAAQ;AAAA,IACpD,MAAM,OAAO,SAAS,SAAS,EAAE;AAAA,IACjC,MAAM,OAAO,OAAO,QAAQ,IAAI,KAAK;AAAA,IACrC,IAAI,SAAS,aAAa,SAAS,aAAa,QAAQ,IAAI,IAAI;AAAA,MAAG;AAAA,IACnE,QAAQ,IAAI,MAAM;AAAA,MAChB,KAAK,SAAS;AAAA,MACd,KAAK,OAAO,GAAG;AAAA,MACf,MAAM,OAAM,IAAI,QAAQ,EAAE,KAAK;AAAA,MAC/B;AAAA,MACA,MAAM,OAAO,IAAI;AAAA,MACjB,KAAK,OAAO,GAAG;AAAA,IACjB,CAAC;AAAA,EACH;AAAA,EACA,OAAO,QAAQ,SAAS,MAAM,SAAS,UAAU;AAAA;AAQ5C,IAAM,cAAc,OACzB,MACA,IACA,MACA,UACiC;AAAA,EACjC,MAAM,SAAS,MAAM,KAAK,KAAK,CAAC,IAAI,QAAQ,MAAM,GAAG,KAAK,CAAC;AAAA,EAC3D,MAAM,UAAU,OAAO,aAAa,IAAI,aAAa,OAAO,QAAQ,KAAK,IAAI;AAAA,EAC7E,IAAI,YAAY,WAAW;AAAA,IACzB,MAAM,IAAI,iBACR,cAAc,wBAAwB,MAAM,KAAK,IAAI,MAAM,kBACzD,GAAG,OAAO,OAAO,QAAQ,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,0BACpE;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACzFT,IAAM,UAAS,CAAC,MAAc,YAC5B,IAAI,iBAAiB,iBAAiB,SAAS,SAAS;AAE1D,IAAM,mBAAkB,CAAC,UAAkD;AAAA,EACzE,IAAI,UAAU;AAAA,IAAW,OAAO;AAAA,EAChC,IAAI,MAAM,SAAS;AAAA,IAAa,OAAO,QAAQ,MAAM;AAAA,EACrD,IAAI,MAAM,QAAQ;AAAA,IAAG,OAAO,mBAAmB,OAAO,MAAM,GAAG;AAAA,EAC/D,KAAK,MAAM,OAAO,QAAW,GAAG;AAAA,IAC9B,OAAO,uCAAuC,MAAM,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG;AAAA,EACtF;AAAA,EACA,IAAI,MAAM;AAAA,IAAK,OAAO;AAAA,EACtB;AAAA;AAcF,IAAM,gBAAgB,CAAC,OAA6B,WAA4C;AAAA,EAC9F,IAAI,WAAW;AAAA,IACb,OAAO,UAAU,YAAY,YAAY,qBAAqB,MAAM;AAAA,EACtE,IAAI,UAAU;AAAA,IAAW,OAAO,WAAW,mBAAmB,YAAY;AAAA,EAC1E,IAAI,WAAW;AAAA,IACb,OAAO,MAAM,SAAS,SAAS,YAAY,QAAQ,MAAM;AAAA,EAC3D,OAAO,MAAM,SAAS,SAAS,YAAY,QAAQ,MAAM,eAAe;AAAA;AASnE,IAAM,qBAAqB,OAChC,MACA,QACA,MACA,WACkC;AAAA,EAClC,MAAM,QAAQ,UAAU,MAAM;AAAA,EAC9B,MAAM,UAAU,YAAY,QAAQ,IAAI;AAAA,EACxC,MAAM,QAAQ,CAAC,GAAG,OAAO,QAAQ,GAAG,OAAO;AAAA,EAC3C,MAAM,SAAS,MAAM,YAAY,MAAM,eAAe,MAAM,KAAK;AAAA,EACjE,WAAW,OAAO,OAAO;AAAA,IACvB,MAAM,QAAQ,OAAO,IAAI,GAAG;AAAA,IAG5B,MAAM,WACJ,OAAO,SAAS,aAAa,MAAM,QAAQ,IAAI,YAAY,iBAAgB,KAAK;AAAA,IAClF,IAAI,aAAY,WAAW;AAAA,MACzB,MAAM,QACJ,MACA,GAAG,kCAAkC,WAAW,8CAC9C,wFACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,gBAAgB,iBAAgB,OAAO,IAAI,MAAM,CAAC;AAAA,EACxD,IAAI,kBAAkB,WAAW;AAAA,IAC/B,MAAM,QACJ,MACA,uBAAuB,UAAU,4DAC/B,oDACJ;AAAA,EACF;AAAA,EACA,WAAW,OAAO,SAAS;AAAA,IACzB,MAAM,WAAU,iBAAgB,OAAO,IAAI,GAAG,CAAC;AAAA,IAC/C,IAAI,aAAY,WAAW;AAAA,MACzB,MAAM,QACJ,MACA,GAAG,OAAO,6CAA4C,qCACpD,kEACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,SAAS,MAAM,KAAK,KAAK,IAAI;AAAA,EACnC,MAAM,UAAU,cAAc,QAAQ,MAAM;AAAA,EAC5C,IAAI,YAAY;AAAA,IAAW,MAAM,QAAO,MAAM,GAAG,+BAA+B;AAAA,EAChF,OAAO;AAAA;AAQF,IAAM,qBAAoB,OAC/B,MACA,QACA,MACA,SACA,WACkB;AAAA,EAClB,MAAM,OAAO,YAAY,OAAO;AAAA,EAChC,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,QACJ,MACA,GAAG,yFACD,kCACJ;AAAA,EACF;AAAA,EACA,MAAM,mBAAmB,MAAM,QAAQ,MAAM,gBAAgB;AAAA,EAC7D,MAAM,mBAAmB,MAAM,MAAM,SAAS,MAAM;AAAA;;;AC5GtD,IAAM,aAAoD;AAAA,EACxD,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AACT;AAGA,IAAM,oBAAyC,IAAI,IAAI,CAAC,QAAQ,SAAS,CAAC;AAE1E,IAAM,eAAe,OACnB,MACA,SAC2E;AAAA,EAC3E,MAAM,SAAS,MAAM,KAAK,KAAK;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,iBACR,iBAAiB,sEACf,GAAG,OAAO,OAAO,QAAQ,0BAC7B;AAAA,EACF;AAAA,EACA,MAAM,SAAS,UAAU,OAAO,MAAM;AAAA,EACtC,OAAO;AAAA,IACL,cAAc,OAAO,IAAI,cAAc,KAAK;AAAA,IAC5C,WAAW,OAAO,IAAI,WAAW,KAAK;AAAA,EACxC;AAAA;AAIK,IAAM,eAAe,CAC1B,MACA,SACA,UACA,SACwB;AAAA,EACxB,MAAM,YAAY,aAAa,IAAI;AAAA,EACnC,MAAM,SAAS,WAAW,KAAK,MAAM;AAAA,EACrC,IAAI,WAAW,WAAW;AAAA,IACxB,MAAM,OAAO,KAAK,KAAK,SAAS,MAAM;AAAA,IACtC,MAAM,SAAS,SAAS,MAAM,QAAQ;AAAA,IACtC,OAAO,QAAQ,WAAW,CAAC,GAAG,YAAY;AAAA,MAGxC,IAAI,WAAW,WAAW;AAAA,QACxB,MAAM,IAAI,iBACR,iBAAiB,yDACnB;AAAA,MACF;AAAA,MACA,MAAM,mBAAmB,MAAM,QAAQ,MAAM,MAAM;AAAA,KACpD;AAAA,EACH;AAAA,EACA,IAAI,UAAU,OAAO,iBAAiB,UAAU,OAAO;AAAA,IAAiB,OAAO,QAAQ,SAAS;AAAA,EAChG,MAAM,OAAO,UAAU,MAAM;AAAA,EAC7B,MAAM,OAAO,UAAU,MAAM;AAAA,EAC7B,OAAO,QAAQ,WAAW,CAAC,GAAG,YAAY;AAAA,IACxC,QAAQ,cAAc,cAAc,MAAM,aAAa,MAAM,IAAI;AAAA,IACjE,IAAI,cAAc,UAAU;AAAA,MAC1B,MAAM,IAAI,iBACR,iBAAiB,0EACf,mDACJ;AAAA,IACF;AAAA,IACA,IAAI,iBAAiB,IAAI;AAAA,MACvB,IAAI,kBAAkB,IAAI,IAAI;AAAA,QAAG;AAAA,MACjC,MAAM,IAAI,iBACR,iBAAiB,oDAAoD,iBACnE,0FACA,GAAG,8DACP;AAAA,IACF;AAAA,IACA,IAAI,SAAS,cAAc,QAAQ,MAAM,WAAW;AAAA,MAClD,MAAM,IAAI,iBACR,iBAAiB,sBAAsB,mDACrC,IAAI,SAAS,KAAK,IAAI,6EAC1B;AAAA,IACF;AAAA,GACD;AAAA;;;AClGH,IAAM,UAAS,CAAC,YAA2B,IAAI,MAAM,wBAAwB,SAAS;AAG/E,IAAM,cACX,CAAC,SACD,OAAO,UAAuC;AAAA,EAC5C,MAAM,OAAO,MAAM,KAAK,KAAK,CAAC,mBAAmB,IAAI,CAAC;AAAA,EACtD,IAAI,KAAK,aAAa;AAAA,IACpB,MAAM,QAAO,gBAAgB,OAAO,KAAK,QAAQ,MAAM,KAAK,OAAO,KAAK,GAAG;AAAA,EAC7E,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAC7B,IAAI,QAAQ,MAAM,CAAC,IAAI,WAAW,GAAG,GAAG;AAAA,IACtC,MAAM,QAAO,qBAAqB,KAAK,UAAU,KAAK,MAAM,yBAAyB;AAAA,EACvF;AAAA,EACA,MAAM,UAAU,YAAY;AAAA,IAC1B,MAAM,UAAU,MAAM,KAAK,KAAK,CAAC,eAAe,OAAO,MAAM,GAAG,CAAC;AAAA,IAGjE,IAAI,QAAQ,aAAa,GAAG;AAAA,MAC1B,QAAQ,OAAO,MACb,+CAA+C,QAAQ,QAAQ,OAAO,KAAK;AAAA,CAC7E;AAAA,IACF;AAAA;AAAA,EAEF,IAAI;AAAA,IACF,MAAM,OAAO,GAAG;AAAA,IAChB,MAAM,KAAK,gBAAgB,MAAM,OAAO,EAAE,MAAM,IAAM,CAAC;AAAA,IACvD,OAAO,EAAE,SAAS,KAAK;AAAA,IACvB,OAAO,OAAO;AAAA,IACd,MAAM,QAAQ;AAAA,IACd,MAAM;AAAA;AAAA;;;AC1BZ,wBAAS;AAMT,IAAM,YAAW,CAAC,SAAyB,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC;AAC/E,IAAM,SAAQ,CAAC,SAAyB,KAAK,MAAM,GAAG,KAAK,YAAY,GAAG,CAAC,KAAK;AAGzE,IAAM,aAAa,CAAC,SACzB,GAAG,OAAM,IAAI,MAAM,UAAS,IAAI,QAAQ,aAAY,CAAC,EAAE,SAAS,KAAK;AAGvE,IAAM,cAAc,CAAC,QAAoB,SAAkC;AAAA,EACzE,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,MACR,WAAW,KAAK,UAAU,IAAI,QAAQ,OAAO,OAAO,QAAQ,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GACrG;AAAA,EACF;AAAA;AAWF,IAAM,yBAAyB,CAAC,YAA6B;AAAA,EAC3D,IACE,OAAO,YAAY,YACnB,YAAY,QACZ,cAAc,WACd,YAAY,SACZ;AAAA,IACA,MAAM,SAAS;AAAA,IACf,OAAO,QAAQ,OAAO,OAAO,QAAQ,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG;AAAA,EAC9E;AAAA,EACA,OAAO,mBAAmB,QAAQ,QAAQ,UAAU,OAAO,OAAO;AAAA;AAe7D,IAAM,WAAW,OACtB,MACA,UACA,MACA,YAC4E;AAAA,EAC5E,MAAM,SAAS,SAAS,MAAM,QAAQ;AAAA,EACtC,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,MAAM,OAAO,UAAU,QAAQ,IAAI;AAAA,EACnC,IAAI,SAAS;AAAA,IACX,MAAM,IAAI,iBAAiB,iBAAiB,6BAA6B;AAAA,EAC3E,MAAM,SAAS,MAAM,eAAe,IAAI;AAAA,EACxC,MAAM,mBAAkB,MAAM,QAAQ,MAAM,SAAS,MAAM;AAAA,EAC3D,OAAO,EAAE,MAAM,OAAO;AAAA;AAIxB,IAAM,gBAAgB,CAAC,KAAyB,QAC9C,GAAG,QAAQ,YAAY,KAAK,IAAI,QAAQ,QAAQ,YAAY,KAAK,KAAK;AAQxE,IAAM,cAAc,CAClB,YACiE;AAAA,EACjE,MAAM,MAAM,QAAQ,QAAQ,aAAa,QAAQ,QAAQ,IAAI,QAAQ,MAAM;AAAA,EAC3E,MAAM,MAAM,QAAQ,QAAQ,aAAa,QAAQ,QAAQ,IAAI,QAAQ,MAAM;AAAA,EAC3E,OAAO,QAAQ,aAAa,QAAQ,YAChC,YACA,KAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,MAAQ,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,EAAG;AAAA;AAQ9E,IAAM,mBAAmB,OAC9B,MACA,SACA,OACA,MACA,OACA,SACA,SACkB;AAAA,EAClB,MAAM,OAAO,WAAW,IAAI;AAAA,EAC5B,MAAM,SAAS,MAAM,MAAM,KAAK;AAAA,EAChC,IAAI;AAAA,IACF,MAAM,cAAc,CAAC,SAAS,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,IAAI;AAAA,IACvE,MAAM,SAAS,YAAY;AAAA,MACzB,MAAM,WAAW,MAAM,KAAK,KAAK,IAAI;AAAA,MACrC,IAAI,aAAa,WAAW;AAAA,QAC1B,MAAM,IAAI,iBACR,iBAAiB,2BAA2B,SAAS,qCACnD,0BACJ;AAAA,MACF;AAAA;AAAA,IAEF,YAAY,MAAM,QAAQ,aAAa,EAAE,QAAQ,OAAO,MAAM,KAAK,GAAG,MAAM,GAAG,WAAW;AAAA,IAC1F,IAAI;AAAA,MACF,MAAM,QAAQ,YAAY,OAAO;AAAA,MACjC,IAAI,UAAU,WAAW;AAAA,QACvB,MAAM,YAAY,CAAC,OAAO,cAAc,MAAM,KAAK,MAAM,GAAG,GAAG,MAAM,IAAI;AAAA,QACzE,YAAY,MAAM,QAAQ,WAAW,EAAE,KAAK,CAAC,GAAG,SAAS;AAAA,MAC3D;AAAA,MACA,MAAM,SAAS,CAAC,IAAI,MAAM,MAAM,MAAM,MAAM,IAAI;AAAA,MAChD,YAAY,MAAM,QAAQ,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM;AAAA,MACnD,OAAO,OAAO;AAAA,MACd,MAAM,SAAS,CAAC,KAAI,MAAM,MAAM,IAAI;AAAA,MACpC,MAAM,UAAU,MAAM,QAAQ,QAAQ,EAAE,KAAK,CAAC,EAC3C,KAAK,CAAC,WAAY,OAAO,aAAa,IAAI,YAAY,MAAO,EAC7D,MAAM,CAAC,YAAqB,OAAO;AAAA,MACtC,IAAI,YAAY,WAAW;AAAA,QACzB,MAAM,IAAI,MACR,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,mCACtD,QAAQ,qBAAqB,uBAAuB,OAAO,yBAC3D,oBACF,EAAE,MAAM,CACV;AAAA,MACF;AAAA,MACA,MAAM;AAAA;AAAA,YAER;AAAA,IACA,MAAM,OAAO,QAAQ;AAAA;AAAA;;;AC5GzB,IAAM,oBACJ,CAAC,MAAc,aACf,CAAC,UAA0B;AAAA,EACzB,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EACrE,IAAI,CAAC,6CAA6C,KAAK,OAAO;AAAA,IAAG,MAAM;AAAA,EACvE,MAAM,IAAI,MACR,iBAAiB,6EACf,WAAW,SAAS,KAAK,IAAI,+DAC7B,aACF,EAAE,MAAM,CACV;AAAA;AAGG,IAAM,oBAAoB,CAAC,YAA+B,SAAkC;AAAA,EACjG,MAAM,WAAW,cAAc,UAAU;AAAA,EACzC,QAAQ,SAAS;AAAA,EAIjB,MAAM,UAAmB,OAAO,MAAM,SAAS,WAAW;AAAA,IACxD,MAAM,QAAQ,KAAK,UAAU,IAAI;AAAA,IACjC,MAAM,UAAU,mBAAkB,MAAM,EAAE,aAAa,QAAQ,CAAC;AAAA,IAChE,IAAI,YAAY;AAAA,MACd,MAAM,IAAI,iBAAiB,yBAAyB,UAAU,SAAS;AAAA,IACzE,MAAM,SAAS;AAAA,IACf,KAAK,IAAI,2BAA2B,OAAO;AAAA,IAC3C,MAAM,SAAS,MAAM,KAAK,KAAK,CAAC,MAAM,MAAM,MAAM,GAAG,IAAI,CAAC;AAAA,IAC1D,MAAM,UAAU,YAAY,OAAO,MAAM;AAAA,IACzC,IAAI,YAAY;AAAA,MAAW,MAAM;AAAA,IACjC,OAAO;AAAA;AAAA,EAGT,OAAO;AAAA,IACL,YAAY,OAAO,MAAM,YAAY;AAAA,MACnC,MAAM,SAAS,MAAM,UAAU,MAAM,OAAO;AAAA;AAAA,IAE9C,cAAc,MAAM,KAAK,aAAa;AAAA,IACtC,MAAM,OAAO,SAAS;AAAA,MACpB,MAAM,QAAQ,WAAU,MAAM,QAAQ;AAAA,MACtC,IAAI,YAAY;AAAA,QAAO,MAAM,IAAI,iBAAiB,kBAAkB,MAAM,QAAQ;AAAA,MAClF,IAAI,MAAM,OAAO;AAAA,QAAY,OAAO,KAAK,KAAK,IAAI;AAAA,MAClD,OAAO,aAAa,MAAM,SAAS,UAAU,IAAI;AAAA;AAAA,IAEnD,aAAa,CAAC,aAAa,KAAK,YAAY,QAAQ;AAAA,IACpD,YAAY,CAAC,aAAa,KAAK,WAAW,QAAQ;AAAA,IAClD,YAAY;AAAA,IACZ,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI;AAAA,IACtC,YAAY,OAAO,SAAS;AAAA,MAC1B,MAAM,SAAS,SAAS,MAAM,QAAQ;AAAA,MACtC,IAAI,WAAW;AAAA,QACb,OAAO,KAAK,WAAW,IAAI,EAAE,MAAM,kBAAkB,MAAM,QAAQ,CAAC;AAAA,MAEtE,MAAM,SAAS,MAAM,mBAAmB,MAAM,QAAQ,MAAM,gBAAgB;AAAA,MAC5E,IAAI,WAAW;AAAA,QAAW;AAAA,MAC1B,MAAM,OAAO,CAAC,KAAI,MAAM,MAAM,IAAI;AAAA,MAClC,MAAM,SAAS,MAAM,QAAQ,IAAI;AAAA,MACjC,IAAI,OAAO,aAAa,GAAG;AAAA,QACzB,MAAM,IAAI,MACR,WAAW,KAAK,UAAU,IAAI,QAAQ,OAAO,OAAO,QAAQ,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GACrG;AAAA,MACF;AAAA;AAAA,IAEF,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE;AAAA,IAC5B,MAAM,CAAC,SAAS,KAAK,KAAK,IAAI;AAAA,IAC9B,iBAAiB,OAAO,MAAM,OAAO,YAAY;AAAA,MAC/C,MAAM,SAAS,MAAM,SAAS,MAAM,UAAU,MAAM,OAAO;AAAA,MAC3D,IAAI,WAAW,WAAW;AAAA,QACxB,OAAO,KAAK,gBAAgB,MAAM,OAAO,OAAO,EAAE,MAAM,kBAAkB,MAAM,QAAQ,CAAC;AAAA,MAC3F;AAAA,MACA,MAAM,iBAAiB,MAAM,SAAS,KAAK,OAAO,MAAM,OAAO,SAAS,OAAO,IAAI;AAAA;AAAA,EAEvF;AAAA;AAGF,IAAM,oBAAoB,CAAC,MAAM,SAAS,IAAI,KAAI,OAAO,OAAO,OAAO,OAAO,aAAa;AAO3F,IAAM,qBAAqB,OAAO,MAAkB,SAAgC;AAAA,EAClF,MAAM,SAAS,kBAAkB,IAC/B,CAAC,MAAM,YAAY,qBAAqB,eAC1C,EAAE,KAAK,MAAM;AAAA,EACb,MAAM,SAAS,MAAM,KAAK,KAAK,CAAC,WAAW,MAAM,QAAQ,eAAe,CAAC;AAAA,EACzE,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,MACR,iBAAiB,SAAS,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO,KAAK,yBACnE,wFACJ;AAAA,EACF;AAAA;AAIK,IAAM,gBAAgB,OAAO,YAAuD;AAAA,EACzF,MAAM,OAAO,MAAM,UAAU,OAAO;AAAA,EACpC,MAAM,mBAAmB,MAAM,QAAQ,IAAI;AAAA,EAC3C,OAAO,kBAAkB,QAAQ,UAAU;AAAA,IACzC;AAAA,IACA,KACE,QAAQ,QACP,CAAC,SAAS;AAAA,MACT,QAAQ,OAAO,MAAM,GAAG;AAAA,CAAQ;AAAA;AAAA,IAEpC,OAAO,YAAY,IAAI;AAAA,EACzB,CAAC;AAAA;",
+  "debugId": "19CF970890A2548664756E2164756E21",
   "names": []
 }