@homeflare/alchemy 0.28.0 → 0.29.0

package/dist/caddy/index.js.map

@@ -1,26 +1,30 @@
 {
   "version": 3,
-  "sources": ["../src/caddy/access-forward-auth.ts", "../src/caddy/admin.ts", "../src/launchd/job-form.ts", "../src/launchd/plist.ts", "../src/caddy/digest.ts", "../src/caddy/admin-calls.ts", "../src/caddy/config.ts", "../src/launchd/host-effect.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/caddy/admin-guard.ts", "../src/launchd/secret-tripwire.ts", "../src/caddy/caddyfile-tripwire.ts", "../src/caddy/config-form.ts", "../src/caddy/config-lifecycle.ts", "../src/caddy/local-admin.ts", "../src/caddy/providers.ts", "../src/caddy/with-file.ts", "../src/launchd/host-file.ts", "../src/launchd/file-identity.ts", "../src/launchd/runner.ts", "../src/launchd/file-converge.ts", "../src/launchd/host-file-form.ts", "../src/launchd/host-file-lifecycle.ts"],
+  "sources": ["../src/caddy/access-forward-auth.ts", "../src/caddy/admin.ts", "../src/caddy/caddy-http-client.ts", "../src/caddy/config.ts", "../src/launchd/host-effect.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/caddy/config-lifecycle.ts", "../src/caddy/admin-calls.ts", "../src/caddy/admin-guard.ts", "../src/caddy/config-errors.ts", "../src/launchd/secret-tripwire.ts", "../src/caddy/caddyfile-tripwire.ts", "../src/caddy/config-form.ts", "../src/launchd/job-form.ts", "../src/launchd/plist.ts", "../src/caddy/digest.ts", "../src/caddy/config-reconcile.ts", "../src/caddy/local-admin.ts", "../src/caddy/admin-address.ts", "../src/caddy/providers.ts", "../src/caddy/with-file.ts", "../src/launchd/host-file.ts", "../src/launchd/file-identity.ts", "../src/launchd/runner.ts", "../src/launchd/file-converge.ts", "../src/launchd/host-file-form.ts", "../src/launchd/host-file-lifecycle.ts"],
   "sourcesContent": [
     "/**\n * The Caddyfile half of \"protect this route with Cloudflare Access\": a `forward_auth` block\n * pointing at a verifier that speaks the contract in `@homeflare/cloudflare/access-auth`.\n *\n * ★ A BUILDER, NOT A RESOURCE. Nothing here is created, adopted or destroyed — it is Caddyfile\n *   TEXT that a caller drops into the `caddyfile` prop of a `CaddyConfig` / `caddyWithFile()`.\n *   A resource would own a fragment of a config that `CaddyConfig` already owns whole, and two\n *   owners of one file is the drift this package exists to prevent.\n *\n * ⛔ WHY IT IS GENERATED RATHER THAN COPY-PASTED. Every field below is load-bearing, and the\n *   failure mode of getting one wrong is a route that looks protected and is not:\n *   · a missing `copy_headers` — the upstream gets no identity and either breaks or, worse,\n *     falls back to trusting a header the CLIENT set;\n *   · the verifier on anything but loopback — the JWT check becomes advisory, because the\n *     verifier itself can be reached and answered around;\n *   · `uri` pointing at a path the verifier does not route — every request 404s, which is\n *     non-2xx, which Caddy correctly treats as a denial, so the symptom is \"Access is broken\".\n */\n\n/** ⚠️ Kept in step with `granted()` in @homeflare/cloudflare/access-auth. */\nconst DEFAULT_COPY_HEADERS = ['X-Access-Email', 'X-Access-Sub'] as const;\n\nexport interface AccessForwardAuthProps {\n  /**\n   * Where the verifier listens, e.g. `127.0.0.1:9101`.\n   * ⛔ LOOPBACK OR A UNIX SOCKET. See `verifierProblems` — a routable verifier is not a check.\n   */\n  readonly verifier: string;\n  /** The path the verifier answers on. @default '/access/verify' */\n  readonly uri?: string;\n  /**\n   * Response headers copied from the verifier onto the upstream request.\n   * @default ['X-Access-Email', 'X-Access-Sub']\n   */\n  readonly copyHeaders?: readonly string[];\n  /** Lines placed inside the route BEFORE `forward_auth` — typically the upstream. */\n  readonly body?: readonly string[];\n  /** Indent applied to every emitted line. @default '\\t' */\n  readonly indent?: string;\n}\n\n/**\n * Problems that make a `forward_auth` block unsafe rather than merely wrong.\n *\n * ⛔ THE LOOPBACK RULE IS THE IMPORTANT ONE. If the verifier answers on a routable address, an\n *   attacker reaches the UPSTREAM directly and never involves Caddy at all — or reaches the\n *   verifier and reads identities out of it. The whole design assumes both the verifier and the\n *   upstream are bound to loopback and that Caddy is the only way in.\n */\nconst LOOPBACK = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);\n\n/**\n * The host part of a Caddy upstream address.\n *\n * ⚠️ NOT `split(':')[0]`. That returns `'['` for `[::1]:9101`, so an IPv6 loopback verifier\n *   was rejected as routable — caught by the test below, not by reading the code.\n */\nconst hostOf = (verifier: string): string => {\n  const address = verifier.replace(/^https?:\\/\\//, '');\n  if (address.startsWith('unix/')) return 'unix';\n\n  // Bracketed IPv6 keeps its brackets; the port is whatever follows the closing one.\n  if (address.startsWith('[')) return address.slice(0, address.indexOf(']') + 1);\n\n  const colon = address.indexOf(':');\n  return colon === -1 ? address : address.slice(0, colon);\n};\n\nexport const verifierProblems = (verifier: string): string[] => {\n  const found: string[] = [];\n  const host = hostOf(verifier.trim());\n\n  if (verifier.trim() === '') found.push('verifier is empty');\n  else if (host !== 'unix' && !LOOPBACK.has(host)) {\n    found.push(\n      `verifier must be loopback or a unix socket, got ${verifier} — a routable verifier can be bypassed`,\n    );\n  }\n  return found;\n};\n\n/**\n * Render the `forward_auth` block for one protected route.\n *\n * ```ts\n * const caddyfile = `vnc.example.com {\n * ${accessForwardAuth({ verifier: '127.0.0.1:9101', body: ['reverse_proxy 127.0.0.1:6080'] })}\n * }\n * `;\n * ```\n *\n * ⛔ ONE VERIFIER ENDPOINT PER ACCESS APPLICATION. The AUD is fixed in the verifier's own config,\n *   never carried in this request — so two applications mean two `uri`s (or two verifiers), not\n *   one endpoint told which app to check. An AUD the request can influence is the vulnerability.\n *\n * ⚠️ `forward_auth` COPIES THE VERIFIER'S RESPONSE BACK TO THE CLIENT on any non-2xx, which is why\n *   the verifier answers a bare 401 with no body: whatever it returns is what the browser sees.\n */\nexport const accessForwardAuth = (props: AccessForwardAuthProps): string => {\n  const problems = verifierProblems(props.verifier);\n  if (problems.length > 0) throw new Error(`accessForwardAuth: ${problems.join('; ')}`);\n\n  const indent = props.indent ?? '\\t';\n  const uri = props.uri ?? '/access/verify';\n  const headers = props.copyHeaders ?? DEFAULT_COPY_HEADERS;\n\n  const lines = [\n    ...(props.body ?? []),\n    `forward_auth ${props.verifier} {`,\n    `${indent}uri ${uri}`,\n    // ⚠️ `copy_headers` with a block, one field per line: the single-line form is also valid but\n    //   diffs badly, and this list is exactly where a security review needs to read a change.\n    `${indent}copy_headers {`,\n    ...headers.map((header) => `${indent}${indent}${header}`),\n    `${indent}}`,\n    '}',\n  ];\n\n  return lines.map((line) => `${indent}${line}`).join('\\n');\n};\n",
-    "/**\n * The one seam between the Caddy provider and a running Caddy: every call to Caddy's admin API goes\n * through a CaddyAdmin, and nothing in this directory reaches Caddy any other way.\n *\n * ★ CADDY's OWN MANAGEMENT API, NOT A FILE AND A SIGNAL. Decision 23 (vault consolidation plan,\n *   2026-09-21): `POST /load` applies a Caddyfile with a graceful reload and rolls back a config\n *   Caddy refuses; `GET /config/` reports what is running. Read in caddyserver/caddy v2.11.4,\n *   caddyconfig/load.go and admin.go, and in the API docs (caddyserver.com/docs/api).\n * ★ A SEAM, THE SAME SHAPE AS launchd's HostRunner, so the lifecycle runs against a fake admin\n *   server in tests and a consumer can plug in another route to the API (an SSH-forwarded socket\n *   today; a remote runner later) without touching the provider. PROMISES, NOT EFFECTS, for the\n *   same reason as HostRunner: a consumer writing their own implements plain async functions.\n * ⛔ THE ADMIN API HAS NO AUTHENTICATION. Anyone who reaches it can replace every site. It stays on\n *   loopback or a unix socket; localCaddyAdmin() refuses anything else (local-admin.ts).\n */\nimport * as Context from 'effect/Context';\nimport * as Layer from 'effect/Layer';\n\n/** One admin API exchange. ⛔ `body` may hold the running config — never log it whole. */\nexport type CaddyAdminResponse = {\n  readonly status: number;\n  readonly body: string;\n};\n\nexport type CaddyAdminRequest = {\n  readonly method: 'GET' | 'POST';\n  /** Absolute API path: `/load`, `/adapt`, `/config/`. */\n  readonly path: string;\n  readonly headers?: Readonly<Record<string, string>>;\n  readonly body?: string;\n};\n\n/**\n * Where the admin listener is, in the terms Caddy's own `admin` option uses — so a Caddyfile that\n * would move the listener away from where the provider talks to it can be refused (admin-guard.ts).\n */\nexport type CaddyAdminListener =\n  | { readonly kind: 'tcp'; readonly hostHeader: string; readonly port: number }\n  | { readonly kind: 'unix'; readonly path: string };\n\nexport interface CaddyAdmin {\n  /** Where requests go, for error messages and the resource's attributes. Never a credential. */\n  readonly endpoint: string;\n  /**\n   * The listener as Caddy sees it. `hostHeader` is the Host every request carries: Caddy checks it\n   * against `admin.origins` (admin.go checkHost) on any loopback TCP listener.\n   */\n  readonly listener: CaddyAdminListener;\n  /**\n   * Send one request. Resolves with ANY status — classifying it is the caller's job\n   * (admin-calls.ts). Rejects only when there was no HTTP exchange at all: with a\n   * CaddyUnreachableError when nothing accepted the connection, any other Error otherwise.\n   */\n  request(request: CaddyAdminRequest): Promise<CaddyAdminResponse>;\n}\n\n/**\n * Nothing accepted the connection — Caddy is not running, or not listening yet. A transport rejects\n * with THIS only when the request provably never reached Caddy (refused, no socket file), because\n * the provider treats it differently from every other failure: a stopped Caddy must not fail the\n * PLAN that would bring it back (its launchd job in the same stack) — see config.ts.\n */\nexport class CaddyUnreachableError extends Error {\n  override readonly name = 'CaddyUnreachableError';\n}\n\n/** The Effect service the Caddy provider reads its admin transport from. */\nexport class CaddyAdminService extends Context.Service<CaddyAdminService, CaddyAdmin>()(\n  'homeflare/caddy/CaddyAdmin',\n) {}\n\n/** Provide a transport to the provider: `Layer.provide(caddyAdminLayer(localCaddyAdmin()))`. */\nexport const caddyAdminLayer = (admin: CaddyAdmin): Layer.Layer<CaddyAdminService> =>\n  Layer.succeed(CaddyAdminService, admin);\n",
-    "/**\n * LaunchdJob's props, attributes and the pure half of the provider: domain parsing, the plist path,\n * and the props → plist mapping whose SHA-256 is the whole diff.\n *\n * ★ KEY NAMES AND MEANINGS FROM launchd.plist(5), checked against the 148 nix-darwin daemons on a\n *   macOS 27.2 host on 2026-09-21 (read-only, from /nix/store): Label, ProgramArguments, RunAtLoad,\n *   KeepAlive (boolean or {SuccessfulExit}), ThrottleInterval, StandardOutPath/StandardErrorPath,\n *   EnvironmentVariables, UserName, StartInterval and StartCalendarInterval are the keys in real\n *   use. Everything rarer goes through `extraKeys`.\n */\nimport { createHash } from 'node:crypto';\nimport { type PlistDict, type PlistValue, renderPlist } from './plist.ts';\n\n/** `system` (LaunchDaemons, root) or one user's login session, `gui/<uid>` (LaunchAgents). */\nexport type LaunchdDomain = 'system' | `gui/${number}`;\n\n/** One StartCalendarInterval entry. An omitted field is a wildcard, as in cron. */\nexport type CalendarInterval = {\n  readonly minute?: number;\n  readonly hour?: number;\n  readonly day?: number;\n  /** 0 and 7 are both Sunday. */\n  readonly weekday?: number;\n  readonly month?: number;\n};\n\n/** `true` = always restart; the object form restarts only on the named conditions. */\nexport type KeepAlive = boolean | { readonly successfulExit?: boolean; readonly crashed?: boolean };\n\nexport interface LaunchdJobProps {\n  /** Reverse-DNS label. Unique per domain; also the plist's file name. */\n  label: string;\n  domain: LaunchdDomain;\n  /** argv; the first element must be an absolute path. */\n  programArguments: readonly string[];\n  /**\n   * ⛔ NON-SECRET VALUES ONLY. Props are stored unencrypted in Alchemy state, and these also land in\n   *   the plist on disk and in `launchctl print`. Pass a secret as a FILE PATH that a secret renderer\n   *   (openbao-agent) maintains — secret-tripwire.ts refuses the obvious mistakes.\n   */\n  environment?: Readonly<Record<string, string>>;\n  runAtLoad?: boolean;\n  keepAlive?: KeepAlive;\n  /** Seconds between starts. */\n  startInterval?: number;\n  startCalendarInterval?: CalendarInterval | readonly CalendarInterval[];\n  /** Minimum seconds between (re)starts; launchd's default is 10. */\n  throttleInterval?: number;\n  standardOutPath?: string;\n  standardErrorPath?: string;\n  workingDirectory?: string;\n  /** Run as this user. ⚠️ System domain only — launchd ignores it for agents, so it is refused. */\n  userName?: string;\n  /** Run as this group. ⚠️ System domain only, like `userName`. */\n  groupName?: string;\n  /**\n   * Any other launchd.plist(5) key, verbatim (`ProcessType`, `SoftResourceLimits`, …).\n   * ⛔ A key the typed props own is refused, so one job can never say two things.\n   */\n  extraKeys?: PlistDict;\n}\n\nexport interface LaunchdJobAttributes {\n  label: string;\n  domain: LaunchdDomain;\n  /** `<domain>/<label>` — what `launchctl print` / `bootout` take. */\n  serviceTarget: string;\n  plistPath: string;\n  /** SHA-256 of the plist bytes last bootstrapped (reconcile) or found on disk (read). */\n  plistSha256: string;\n  /** Bootstrapped into the domain — not necessarily running. */\n  loaded: boolean;\n  /** launchd's own word: `running`, `not running`, … */\n  state?: string;\n  pid?: number;\n  lastExitCode?: number;\n}\n\nexport type ParsedDomain =\n  | { readonly kind: 'system' }\n  | { readonly kind: 'gui'; readonly uid: number };\n\nexport const parseDomain = (domain: string): ParsedDomain | undefined => {\n  if (domain === 'system') return { kind: 'system' };\n  const match = /^gui\\/(\\d+)$/.exec(domain);\n  return match?.[1] === undefined ? undefined : { kind: 'gui', uid: Number(match[1]) };\n};\n\nexport const serviceTarget = (label: string, domain: LaunchdDomain): string => `${domain}/${label}`;\n\n/**\n * Where launchd expects the job's plist. ★ Derived, never declared: a daemon's plist outside\n *   /Library/LaunchDaemons is not bootstrapped at boot, so a free-form path would be a job that\n *   silently stops existing after the next restart.\n */\nexport const plistPathFor = (\n  label: string,\n  domain: ParsedDomain,\n  home: string | undefined,\n): string => {\n  if (domain.kind === 'system') return `/Library/LaunchDaemons/${label}.plist`;\n  // ⛔ No `~` fallback: the provider may run as root, whose `~` is not the agent owner's home.\n  if (home === undefined || !home.startsWith('/')) {\n    throw new Error(`gui/${String(domain.uid)}: no home directory for that uid on this host`);\n  }\n  return `${home}/Library/LaunchAgents/${label}.plist`;\n};\n\n/** Plist keys the typed props own — `extraKeys` may not name them. `Program` is refused too. */\nexport const OWNED_KEYS: readonly string[] = [\n  'EnvironmentVariables',\n  'GroupName',\n  'KeepAlive',\n  'Label',\n  'Program',\n  'ProgramArguments',\n  'RunAtLoad',\n  'StandardErrorPath',\n  'StandardOutPath',\n  'StartCalendarInterval',\n  'StartInterval',\n  'ThrottleInterval',\n  'UserName',\n  'WorkingDirectory',\n];\n\nconst calendarDict = (entry: CalendarInterval): PlistDict => {\n  const dict: Record<string, PlistValue> = {};\n  if (entry.minute !== undefined) dict['Minute'] = entry.minute;\n  if (entry.hour !== undefined) dict['Hour'] = entry.hour;\n  if (entry.day !== undefined) dict['Day'] = entry.day;\n  if (entry.weekday !== undefined) dict['Weekday'] = entry.weekday;\n  if (entry.month !== undefined) dict['Month'] = entry.month;\n  return dict;\n};\n\nconst keepAliveValue = (keepAlive: KeepAlive): PlistValue => {\n  if (typeof keepAlive === 'boolean') return keepAlive;\n  const dict: Record<string, PlistValue> = {};\n  if (keepAlive.successfulExit !== undefined) dict['SuccessfulExit'] = keepAlive.successfulExit;\n  if (keepAlive.crashed !== undefined) dict['Crashed'] = keepAlive.crashed;\n  return dict;\n};\n\n/** The plist dict for a job. ⚠️ Assumes jobProblems() came back empty. */\nexport const jobPlistDict = (props: LaunchdJobProps): PlistDict => {\n  const dict: Record<string, PlistValue> = { ...props.extraKeys };\n  dict['Label'] = props.label;\n  dict['ProgramArguments'] = [...props.programArguments];\n  const env = props.environment ?? {};\n  if (Object.keys(env).length > 0) dict['EnvironmentVariables'] = { ...env };\n  if (props.runAtLoad !== undefined) dict['RunAtLoad'] = props.runAtLoad;\n  if (props.keepAlive !== undefined) dict['KeepAlive'] = keepAliveValue(props.keepAlive);\n  if (props.startInterval !== undefined) dict['StartInterval'] = props.startInterval;\n  const calendar = props.startCalendarInterval;\n  if (calendar !== undefined) {\n    dict['StartCalendarInterval'] = Array.isArray(calendar)\n      ? (calendar as readonly CalendarInterval[]).map(calendarDict)\n      : calendarDict(calendar as CalendarInterval);\n  }\n  if (props.throttleInterval !== undefined) dict['ThrottleInterval'] = props.throttleInterval;\n  if (props.standardOutPath !== undefined) dict['StandardOutPath'] = props.standardOutPath;\n  if (props.standardErrorPath !== undefined) dict['StandardErrorPath'] = props.standardErrorPath;\n  if (props.workingDirectory !== undefined) dict['WorkingDirectory'] = props.workingDirectory;\n  if (props.userName !== undefined) dict['UserName'] = props.userName;\n  if (props.groupName !== undefined) dict['GroupName'] = props.groupName;\n  return dict;\n};\n\nexport const sha256Hex = (bytes: Uint8Array | string): string =>\n  createHash('sha256').update(bytes).digest('hex');\n\n/** The rendered plist and its digest — the only thing LaunchdJob compares. */\nexport const renderJob = (\n  props: LaunchdJobProps,\n): { text: string; bytes: Uint8Array; sha256: string } => {\n  const text = renderPlist(jobPlistDict(props));\n  const bytes = new TextEncoder().encode(text);\n  return { bytes, sha256: sha256Hex(bytes), text };\n};\n",
-    "/**\n * An XML property list serializer — the subset launchd.plist(5) reads, and nothing else.\n *\n * ★ WHY NOT AN npm LIBRARY. Nothing in this workspace depends on one (checked 2026-09-21: no\n *   `plist`, `xmlbuilder` or `@xmldom/xmldom` anywhere under node_modules), and the common one pulls\n *   an XML DOM in for PARSING, which a provider that only RENDERS never does. The subset a launchd\n *   job needs is five node types, so this is ~100 lines plus exhaustive tests (plist.test.ts), which\n *   also round-trip every case through Apple's own `plutil` when the tests run on macOS.\n *\n * ⛔ THE OUTPUT MUST BE DETERMINISTIC. LaunchdJob diffs by the SHA-256 of these bytes, so two\n *   renders of one declaration must be byte-identical: dict keys are sorted, indentation is fixed,\n *   and nothing depends on insertion order. A non-deterministic render is a forever-`update`.\n * ⚠️ AND A CHANGE TO THIS FILE'S OUTPUT RESTARTS EVERY JOB. A new header, indent or escape changes\n *   every digest, so the next deploy after the kit upgrade updates — restarts — every declared\n *   job at once. Treat any byte change here as a breaking change and say so in its changeset.\n *\n * ⛔ REFUSE, NEVER COERCE. `undefined`, `null`, a fraction, NaN, a class instance or a character XML\n *   1.0 cannot carry is a thrown PlistError naming the path, not a silently dropped key. A dropped\n *   `KeepAlive` is a daemon that never restarts, and nothing downstream would say why.\n */\n\n/** Every value launchd reads. ⚠️ No `<real>`, `<date>` or `<data>`: no launchd key needs one. */\nexport type PlistValue =\n  | string\n  | number\n  | boolean\n  | readonly PlistValue[]\n  | { readonly [key: string]: PlistValue };\n\nexport type PlistDict = { readonly [key: string]: PlistValue };\n\nexport class PlistError extends Error {\n  constructor(\n    readonly path: string,\n    detail: string,\n  ) {\n    super(`plist ${path === '' ? '(root)' : path}: ${detail}`);\n    this.name = 'PlistError';\n  }\n}\n\nconst HEADER =\n  '<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n' +\n  '<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" ' +\n  '\"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\\n' +\n  '<plist version=\"1.0\">\\n';\n\n/** ⚠️ A cycle, or a runaway generator, would otherwise recurse until the stack dies. */\nconst MAX_DEPTH = 32;\n\n/**\n * ⛔ CHARACTERS XML 1.0 CANNOT CARRY AT ALL — not even escaped (XML 1.0 §2.2 `Char`). C0 controls\n *   other than tab, LF and CR; U+FFFE / U+FFFF; and an unpaired surrogate, which has no UTF-8 form.\n */\n// ★ The `u` flag makes a VALID surrogate pair one code point above U+FFFF, outside this class, so\n//   only an unpaired half matches the \\uD800-\\uDFFF range.\n// oxlint-disable-next-line no-control-regex -- matching control characters is the point\nconst FORBIDDEN = /[\\x00-\\x08\\x0B\\x0C\\x0E-\\x1F\\uD800-\\uDFFF\\uFFFE\\uFFFF]/u;\n\n/**\n * Escape text content.\n * ⚠️ CR IS A CHARACTER REFERENCE, NOT A LITERAL. An XML parser normalises a literal CR (and CRLF)\n *   to LF before the application sees it (XML 1.0 §2.11), so `a\\r\\nb` would come back as `a\\nb` and\n *   the argument launchd passes would differ from the one declared. `&#13;` survives normalisation.\n */\nexport const escapeText = (text: string, path: string): string => {\n  const bad = FORBIDDEN.exec(text);\n  if (bad !== null) {\n    const code = bad[0].codePointAt(0) ?? 0;\n    throw new PlistError(\n      path,\n      `U+${code.toString(16).toUpperCase().padStart(4, '0')} cannot appear in XML 1.0`,\n    );\n  }\n  return text\n    .replaceAll('&', '&amp;')\n    .replaceAll('<', '&lt;')\n    .replaceAll('>', '&gt;')\n    .replaceAll('\\r', '&#13;');\n};\n\nconst isPlainObject = (value: object): boolean => {\n  const proto = Object.getPrototypeOf(value) as unknown;\n  return proto === Object.prototype || proto === null;\n};\n\nconst renderValue = (value: unknown, path: string, depth: number, out: string[]): void => {\n  const pad = '\\t'.repeat(depth);\n  if (depth > MAX_DEPTH) throw new PlistError(path, `nested deeper than ${String(MAX_DEPTH)}`);\n  if (typeof value === 'string') {\n    out.push(`${pad}<string>${escapeText(value, path)}</string>`);\n    return;\n  }\n  if (typeof value === 'boolean') {\n    out.push(`${pad}<${value ? 'true' : 'false'}/>`);\n    return;\n  }\n  if (typeof value === 'number') {\n    // ⛔ launchd reads every numeric key as an integer; 1.5 would be a silently different job.\n    if (!Number.isSafeInteger(value)) {\n      throw new PlistError(path, `${String(value)} is not a safe integer (no <real> support)`);\n    }\n    out.push(`${pad}<integer>${String(value === 0 ? 0 : value)}</integer>`);\n    return;\n  }\n  if (Array.isArray(value)) {\n    if (value.length === 0) {\n      out.push(`${pad}<array/>`);\n      return;\n    }\n    out.push(`${pad}<array>`);\n    for (const [index, item] of (value as readonly unknown[]).entries()) {\n      renderValue(item, `${path}[${String(index)}]`, depth + 1, out);\n    }\n    out.push(`${pad}</array>`);\n    return;\n  }\n  if (typeof value === 'object' && value !== null && isPlainObject(value)) {\n    renderDict(value as Record<string, unknown>, path, depth, out);\n    return;\n  }\n  const kind = value === null ? 'null' : typeof value;\n  throw new PlistError(path, `${kind} has no plist form — omit the key instead`);\n};\n\nconst renderDict = (\n  dict: Record<string, unknown>,\n  path: string,\n  depth: number,\n  out: string[],\n): void => {\n  const pad = '\\t'.repeat(depth);\n  // ★ Code-unit order, not localeCompare: the same bytes on every machine and every locale.\n  const keys = Object.keys(dict).sort();\n  if (keys.length === 0) {\n    out.push(`${pad}<dict/>`);\n    return;\n  }\n  out.push(`${pad}<dict>`);\n  for (const key of keys) {\n    const child = path === '' ? key : `${path}.${key}`;\n    out.push(`${pad}\\t<key>${escapeText(key, child)}</key>`);\n    renderValue(dict[key], child, depth + 1, out);\n  }\n  out.push(`${pad}</dict>`);\n};\n\n/** Render a top-level dict as a complete XML plist document, ending in a newline. */\nexport const renderPlist = (dict: PlistDict): string => {\n  if (typeof dict !== 'object' || dict === null || Array.isArray(dict) || !isPlainObject(dict)) {\n    throw new PlistError('', 'the top level of a launchd plist must be a dict');\n  }\n  const out: string[] = [];\n  renderDict(dict as Record<string, unknown>, '', 0, out);\n  return `${HEADER}${out.join('\\n')}\\n</plist>\\n`;\n};\n",
-    "/**\n * The one form an adapted Caddy config is hashed in — so what `POST /adapt` returns for the\n * declared Caddyfile and what `GET /config/` reports after the load hash the same.\n *\n * ⛔ THE TWO ARE NOT THE SAME BYTES, AND COMPARING BYTES WOULD BE A FOREVER-`update`. Read in\n *   caddyserver/caddy v2.11.4:\n *   · `/adapt` returns the adapter's `json.Marshal(cfg)` of Go STRUCTS — keys in field order\n *     (caddyconfig/caddyfile/adapter.go Adapt; load.go handleAdapt).\n *   · `/load` decodes that JSON into a generic `any` and re-marshals it (caddy.go changeConfig):\n *     Go sorts MAP keys, so the stored config has every object's keys sorted.\n *   · `GET /config/` streams that stored value through `json.Encoder`, which appends a newline\n *     (admin.go unsyncedConfigAccess), and escapes `<`, `>` and `&` as `\\u003c`, `\\u003e`, `\\u0026`.\n *   Parsing both and re-serialising with sorted keys erases all three differences. MEASURED\n *   2026-09-21 on a throwaway Caddy 2.11.4: the digest of `GET /config/` after `POST /load` equals\n *   the digest of `/adapt` for the same Caddyfile — and a Caddy started with `--config <file>`\n *   hashes the same as `/adapt` of that file's text, so adopting it is a noop.\n * ★ NUMBERS AGREE BY CONSTRUCTION. Go decodes every JSON number in that generic `any` as float64\n *   (caddy.go indexConfigObjects says so), and JSON.parse does too — the same double on both sides\n *   serialises the same way here.\n */\nimport { sha256Hex } from '../launchd/job-form.ts';\n\ntype Json = null | boolean | number | string | readonly Json[] | { readonly [key: string]: Json };\n\nconst sorted = (value: Json): Json => {\n  if (Array.isArray(value)) return (value as readonly Json[]).map(sorted);\n  if (typeof value === 'object' && value !== null) {\n    const object = value as { readonly [key: string]: Json };\n    const out: Record<string, Json> = {};\n    for (const key of Object.keys(object).sort()) out[key] = sorted(object[key] ?? null);\n    return out;\n  }\n  return value;\n};\n\n/** Parse a config body Caddy returned. ⚠️ An empty config is the JSON `null`, not an error. */\nexport const parseConfig = (text: string): unknown => JSON.parse(text) as unknown;\n\n/** The canonical text of a parsed config: sorted keys, no whitespace. */\nexport const canonicalConfig = (config: unknown): string =>\n  JSON.stringify(sorted((config ?? null) as Json));\n\n/** SHA-256 of the canonical form — what the resource stores and compares, never the config. */\nexport const configDigest = (config: unknown): string => sha256Hex(canonicalConfig(config));\n",
-    "/**\n * The three admin API calls the provider makes, each classified into a value or a readable Error\n * that carries Caddy's own message.\n *\n * Read in caddyserver/caddy v2.11.4 (and the API docs, caddyserver.com/docs/api):\n *   · `POST /adapt` — adapts without running (load.go handleAdapt): 200 `{warnings?, result}`,\n *     or 400 `{\"error\": …}`. Side-effect free, so it is what plan-time validation uses.\n *   · `POST /load` — Content-Type `text/caddyfile` picks the adapter (load.go adaptByContentType);\n *     \"if the new config fails for any reason, the old config is rolled back into place without\n *     downtime\" (docs; caddy.go changeConfig restores the previous raw config). An identical\n *     config is a no-op without `Cache-Control: must-revalidate`.\n *   · `GET /config/` — the running config as JSON, `null` when empty (admin.go handleConfig).\n * ⛔ A FAILED LOAD CAN ANSWER 200. load.go writes the adapter's WARNINGS to the body before it\n *   runs the config; if the run then fails, the error JSON is appended to a response whose status\n *   is already 200 (Go's first Write sends 200; the later WriteHeader(400) is ignored). The\n *   Caddyfile adapter warns on every unformatted input (adapter.go FormattingDifference), so this\n *   is the COMMON failure shape, not an edge. Hence: look for the error in the body whatever the\n *   status — and the lifecycle reads the config back after every load anyway.\n *   MEASURED 2026-09-21 on a throwaway Caddy 2.11.4 (loopback ports, isolated XDG dirs): an\n *   unformatted Caddyfile whose port was taken answered `200` with body\n *   `[{\"file\":\"Caddyfile\",\"line\":8,\"message\":\"Caddyfile input is not formatted; …\"}]{\"error\":\"loading\n *   config: … bind: address already in use\"}`, and Caddy kept serving the previous config.\n */\nimport type { CaddyAdmin, CaddyAdminResponse } from './admin.ts';\nimport { parseConfig } from './digest.ts';\n\nexport class CaddyAdminError extends Error {\n  constructor(\n    readonly status: number,\n    readonly method: string,\n    readonly path: string,\n    reason: string,\n  ) {\n    super(`Caddy ${method} ${path} → ${String(status)}: ${reason}`);\n    this.name = 'CaddyAdminError';\n  }\n}\n\nconst CADDYFILE = 'text/caddyfile';\n/** APIError marshals as exactly this key (admin.go APIError, `json:\"error\"`). */\nconst ERROR_OPEN = '{\"error\":';\n\ntype Warning = { file?: string; line?: number; message?: string };\n\nconst describe = (warning: Warning): string =>\n  `${warning.file ?? 'Caddyfile'}:${String(warning.line ?? 0)}: ${warning.message ?? '(no message)'}`;\n\n/** Caddy's `error` string from a body that holds one, or `undefined`. */\nconst errorIn = (body: string): string | undefined => {\n  const at = body.lastIndexOf(ERROR_OPEN);\n  if (at === -1) return undefined;\n  try {\n    const parsed = JSON.parse(body.slice(at)) as { error?: unknown };\n    return typeof parsed.error === 'string' ? parsed.error : undefined;\n  } catch {\n    return undefined;\n  }\n};\n\nconst warningsIn = (text: string): string[] => {\n  if (text.trim() === '') return [];\n  try {\n    const parsed = JSON.parse(text) as unknown;\n    return Array.isArray(parsed) ? (parsed as Warning[]).map(describe) : [];\n  } catch {\n    return [];\n  }\n};\n\nconst fail = (response: CaddyAdminResponse, method: string, path: string): never => {\n  const reason = errorIn(response.body) ?? (response.body.trim().slice(0, 500) || '(empty body)');\n  // ⚠️ Say so when the status lied (the ⛔ above), or \"→ 200\" reads like success.\n  const shown = response.status === 200 ? `${reason} (error in a 200 body)` : reason;\n  throw new CaddyAdminError(response.status, method, path, shown);\n};\n\nexport type Adapted = { readonly config: unknown; readonly warnings: readonly string[] };\n\n/** Adapt a Caddyfile to JSON on the running Caddy, without loading it. */\nexport const adaptCaddyfile = async (admin: CaddyAdmin, caddyfile: string): Promise<Adapted> => {\n  const response = await admin.request({\n    body: caddyfile,\n    headers: { 'Content-Type': CADDYFILE },\n    method: 'POST',\n    path: '/adapt',\n  });\n  // ★ Status alone here: /adapt writes its body once, and a successful result is config JSON in\n  //   which an `error` handler's key could look like an error object to a substring search.\n  if (response.status !== 200) fail(response, 'POST', '/adapt');\n  const parsed = JSON.parse(response.body) as { result?: unknown; warnings?: Warning[] };\n  return { config: parsed.result ?? null, warnings: (parsed.warnings ?? []).map(describe) };\n};\n\n/** The running config, parsed; `null` when Caddy runs with none. */\nexport const readRunningConfig = async (admin: CaddyAdmin): Promise<unknown> => {\n  const response = await admin.request({ method: 'GET', path: '/config/' });\n  if (response.status !== 200) fail(response, 'GET', '/config/');\n  return parseConfig(response.body);\n};\n\n/**\n * Apply a Caddyfile with `POST /load`; resolves with the adapter's warnings.\n *\n * ★ `sourceFile` RIDES AS `Caddy-Config-Source-File` (+ `-Adapter: caddyfile`), the headers\n *   `caddy reload` sends (cmd/commandfuncs.go). A load WITHOUT them makes Caddy forget the file it\n *   was started with (caddy.go ClearLastConfigIfDifferent), and SIGUSR1 then no longer reloads\n *   from that file. With them, and the same path, it keeps it.\n */\nexport const loadCaddyfile = async (\n  admin: CaddyAdmin,\n  caddyfile: string,\n  sourceFile?: string,\n): Promise<readonly string[]> => {\n  const response = await admin.request({\n    body: caddyfile,\n    headers: {\n      'Content-Type': CADDYFILE,\n      ...(sourceFile === undefined\n        ? {}\n        : { 'Caddy-Config-Source-Adapter': 'caddyfile', 'Caddy-Config-Source-File': sourceFile }),\n    },\n    method: 'POST',\n    path: '/load',\n  });\n  const refused = errorIn(response.body);\n  if (response.status !== 200 || refused !== undefined) fail(response, 'POST', '/load');\n  return warningsIn(response.body);\n};\n",
-    "/**\n * `Caddy.Config` — a running Caddy's whole config, declared as Caddyfile text and applied through\n * Caddy's own admin API (decision 23).\n *\n * - create / update — `POST /adapt` (validate), `POST /load` with `text/caddyfile` (a graceful\n *   reload; Caddy keeps the old config if it refuses the new one, and the error names why), then\n *   `GET /config/` and insist it matches. Skipped when Caddy already runs this config.\n * - read — the digest of `GET /config/`. With no state it is the adoption probe (below).\n * - diff — declared, live and stored digests (config-lifecycle.ts). Never `replace`.\n * - delete — ⛔ NOTHING. See below.\n *\n * ⛔ DELETE NEVER TOUCHES CADDY, UNDER EITHER REMOVAL POLICY. Removing this declaration must not take\n *   every site down: there is no \"less config\" to fall back to, and an empty config stops all\n *   servers. `retain` is the default (the engine never calls delete); with `destroy` the handler\n *   still only forgets. It never calls `/stop` (which exits the process) or `DELETE /config/`.\n *   To empty a Caddy, do it by hand at its admin API.\n * ⛔ NOTHING IS ADOPTED SILENTLY (decision, 2026-09-21 — the house rule HostFile and LaunchdJob\n *   keep). With no state, a running Caddy whose live config IS the declared one reads as ours (the\n *   adoption changes nothing); any other config reads as `Unowned`, and the plan refuses it unless\n *   the deploy runs with `--adopt`. A Caddy serving nothing reads as absent: a create. Where the\n *   engine skips that probe, reconcile refuses the same takeover (config-lifecycle.ts).\n * ⛔ `caddyfile` IS NEVER A SECRET — see config-form.ts; refused before anything is sent.\n * ⚠️ WHICH CADDY is the transport's (providers.ts), not a prop: one CaddyAdmin per stack.\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { lift, resolvedString } from '../launchd/host-effect.ts';\nimport { adoptEnabled } from '../ownership/adopt.ts';\nimport { CaddyAdminService, CaddyUnreachableError } from './admin.ts';\nimport type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';\nimport { diffConfig, probeLive, readLive, reconcileConfig } from './config-lifecycle.ts';\n\nexport type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';\n\nexport interface CaddyConfig extends Resource<\n  'Caddy.Config',\n  CaddyConfigProps,\n  CaddyConfigAttributes\n> {}\n\nexport const CaddyConfig = Resource<CaddyConfig>('Caddy.Config', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst unreachable = (error: Error): error is CaddyUnreachableError =>\n  error instanceof CaddyUnreachableError;\n\n/**\n * ⚠️ A STOPPED CADDY MUST NOT FAIL THE PLAN THAT BRINGS IT BACK. Its launchd job usually sits in the\n *   same stack; if every plan died on `ECONNREFUSED`, the fix to that job could never be deployed.\n *   So at PLAN time only (read, diff) an unreachable Caddy plans an update — with a warning, because\n *   the plan-time `/adapt` check did not run — and reconcile, which needs Caddy, still fails loudly.\n */\nconst planWithoutCaddy =\n  <A>(admin: { endpoint: string }, fallback: A) =>\n  (error: Error) =>\n    Effect.as(\n      Effect.logWarning(\n        `Caddy.Config: no Caddy at ${admin.endpoint} (${error.message}); planning without it — ` +\n          'the Caddyfile is validated when the deploy reaches Caddy',\n      ),\n      fallback,\n    );\n\nexport const CaddyConfigProvider = () =>\n  Provider.effect(\n    CaddyConfig,\n    Effect.gen(function* () {\n      const admin = yield* CaddyAdminService;\n      /** The probe, branded for the engine: plain when ours, `Unowned` otherwise. */\n      const probe = (caddyfile: string | undefined, sourceFile: string | undefined) =>\n        Effect.flatMap(\n          lift(() => probeLive(admin, caddyfile, sourceFile)),\n          (found) => {\n            if (found === undefined) return Effect.succeed(undefined);\n            if (found.ours) return Effect.succeed(found.attributes);\n            const unowned = Unowned(found.attributes);\n            return found.unchecked === undefined\n              ? Effect.succeed(unowned)\n              : Effect.as(\n                  Effect.logWarning(\n                    `Caddy.Config at ${admin.endpoint}: the running config could not be compared ` +\n                      `with the declared Caddyfile (${found.unchecked}), so it is not treated as ours`,\n                  ),\n                  unowned,\n                );\n          },\n        );\n      return CaddyConfig.Provider.of({\n        /** ⛔ A Caddy has one config; there is nothing to enumerate, and nothing for nuke to delete. */\n        list: () => Effect.succeed([]),\n\n        /**\n         * With state: the live attributes, which diff compares. With none, the ADOPTION PROBE —\n         * `olds` is the declaration (Plan.ts passes `news`), and only a live config equal to it is\n         * ours. ⚠️ A running Caddy is still the one the stack means (the transport reaches only\n         * loopback), but WHOSE CONFIG it runs is not: a person, another tool or another stack.\n         */\n        read: ({ olds, output }) =>\n          (output === undefined\n            ? probe(resolvedString(olds, 'caddyfile'), resolvedString(olds, 'sourceFile'))\n            : lift(() => readLive(admin, resolvedString(olds, 'sourceFile')))\n          ).pipe(\n            // ★ Nothing to adopt from a Caddy that is down: plan a create, which is the same load.\n            Effect.catchIf(unreachable, planWithoutCaddy(admin, undefined)),\n          ),\n\n        diff: ({ news, output }) => {\n          if (output === undefined) return Effect.succeed(undefined);\n          const update = planWithoutCaddy(admin, { action: 'update' as const });\n          if (isResolved(news)) {\n            return lift(() => diffConfig(admin, news, output)).pipe(\n              Effect.catchIf(unreachable, update),\n            );\n          }\n          /**\n           * ⚠️ `sourceFile` is an Output while its HostFile changes in the same deploy\n           *   (caddyWithFile). The Caddyfile itself is usually plain text, so validate and compare\n           *   it now — a bad Caddyfile must fail the PLAN, before the HostFile writes it to disk —\n           *   and plan an update, which reloads only if the config really differs.\n           */\n          const caddyfile = resolvedString(news, 'caddyfile');\n          if (caddyfile === undefined) return Effect.succeed(undefined);\n          return lift(async () => {\n            await diffConfig(admin, { caddyfile }, output);\n            return { action: 'update' as const };\n          }).pipe(Effect.catchIf(unreachable, update));\n        },\n\n        reconcile: ({ fqn, news, output }) =>\n          Effect.gen(function* () {\n            // ⛔ State is authority over the Caddy it was applied to, and no other. With none (the\n            //   engine may not have probed: see reconcileConfig), or with the transport now at\n            //   another endpoint, only adoption — `--adopt`, or this resource's own `adopt(…)`,\n            //   as the planner resolves it — loads over a config the stack cannot claim.\n            const sameCaddy = output !== undefined && output.endpoint === admin.endpoint;\n            const takeOver = sameCaddy || (yield* adoptEnabled(fqn));\n            const stored = output === undefined ? {} : { stored: output.configSha256 };\n            const applied = yield* lift(() =>\n              reconcileConfig(admin, news, { takeOver, ...stored }),\n            );\n            for (const warning of applied.warnings) {\n              yield* Effect.logWarning(`Caddy.Config at ${admin.endpoint}: ${warning}`);\n            }\n            return applied.attributes;\n          }),\n\n        delete: () => Effect.void,\n      });\n    }),\n  );\n",
+    "/**\n * The one seam between the Caddy provider and a running Caddy: every operation goes through\n * `@distilled.cloud/caddy`'s typed `Services.admin.*` calls (admin-calls.ts), over the\n * `CaddyAdminService` metadata and the `Credentials` + `HttpClient` layers `localCaddyAdmin()`\n * builds (local-admin.ts) — nothing in this directory reaches Caddy any other way.\n *\n * ★ CADDY's OWN MANAGEMENT API, NOT A FILE AND A SIGNAL. Decision 23 (vault consolidation plan,\n *   2026-09-21): `POST /load` applies a Caddyfile with a graceful reload and rolls back a config\n *   Caddy refuses; `GET /config/` reports what is running. Read in caddyserver/caddy v2.11.4,\n *   caddyconfig/load.go and admin.go, and in the API docs (caddyserver.com/docs/api).\n * ★ `CaddyAdminService` CARRIES ONLY MESSAGE/GUARD METADATA (endpoint, listener) — never a\n *   credential, and never the transport itself. The transport is `@distilled.cloud/caddy`'s own\n *   `Credentials` and `HttpClient.HttpClient` services, provided alongside it by `caddyAdminLayer`,\n *   so admin-calls.ts calls the SDK's operations directly rather than through a house-specific\n *   `.request()` seam. A consumer plugs in another route to the API (an SSH-forwarded socket today;\n *   a remote runner later) by providing a different `CaddyTransport` to `caddyAdminLayer`.\n * ⛔ THE ADMIN API HAS NO AUTHENTICATION. Anyone who reaches it can replace every site. It stays on\n *   loopback or a unix socket; localCaddyAdmin() refuses anything else (local-admin.ts).\n */\nimport type * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as Context from 'effect/Context';\nimport * as Layer from 'effect/Layer';\nimport type { Credentials } from '@distilled.cloud/caddy';\n\n/**\n * Where the admin listener is, in the terms Caddy's own `admin` option uses — so a Caddyfile that\n * would move the listener away from where the provider talks to it can be refused (admin-guard.ts).\n */\nexport type CaddyAdminListener =\n  | { readonly kind: 'tcp'; readonly hostHeader: string; readonly port: number }\n  | { readonly kind: 'unix'; readonly path: string };\n\n/** Message/guard metadata for the Caddy this stack talks to — never a credential. */\nexport interface CaddyTarget {\n  /** Where requests go, for error messages and the resource's attributes. */\n  readonly endpoint: string;\n  /**\n   * The listener as Caddy sees it. `hostHeader` is the Host every request carries: Caddy checks it\n   * against `admin.origins` (admin.go checkHost) on any loopback TCP listener.\n   */\n  readonly listener: CaddyAdminListener;\n}\n\n/** What `localCaddyAdmin()` (or a consumer's own transport) hands `caddyAdminLayer`. */\nexport interface CaddyTransport extends CaddyTarget {\n  /** Provides the SDK's own `Credentials` and `HttpClient.HttpClient` — see local-admin.ts. */\n  readonly layer: Layer.Layer<Credentials | HttpClient.HttpClient>;\n}\n\n/** The Effect service the Caddy provider reads its admin target's metadata from. */\nexport class CaddyAdminService extends Context.Service<CaddyAdminService, CaddyTarget>()(\n  'homeflare/caddy/CaddyAdmin',\n) {}\n\n/**\n * Provide a transport to the provider: `CaddyConfigProvider().pipe(Layer.provideMerge(caddyAdminLayer(localCaddyAdmin())))`\n * — never plain `Layer.provide` here (see providers.ts's own ⚠️): `CaddyConfigProvider()`'s handlers\n * keep needing these services every time the engine calls them, not just once while it is built. Merges\n * the target metadata with the SDK's `Credentials`/`HttpClient` layers `transport.layer` carries.\n */\nexport const caddyAdminLayer = (\n  transport: CaddyTransport,\n): Layer.Layer<CaddyAdminService | Credentials | HttpClient.HttpClient> =>\n  Layer.mergeAll(\n    Layer.succeed(CaddyAdminService, {\n      endpoint: transport.endpoint,\n      listener: transport.listener,\n    }),\n    transport.layer,\n  );\n",
+    "/**\n * An Effect `HttpClient.HttpClient` over `node:http`, dialling a unix socket or loopback TCP\n * directly — the SDK's own transport layer for `@distilled.cloud/caddy`'s typed operations.\n *\n * ★ node:http, NOT `effect/unstable/http/FetchHttpClient`. MEASURED 2026-09-21 on bun 1.4.0 and\n *   node 26.7.0 (local-admin.ts's history): node:http dials a unix socket on BOTH runtimes, while\n *   node's fetch has no `unix` option at all (only Bun's does) — `@effect/platform-node`'s own\n *   `FetchHttpClient`/`NodeHttpClient.makeNodeHttp` (node:http, but URL-only — no `socketPath` seam)\n *   cannot speak a unix socket either. The published dist loads under node too (launchd's\n *   local-runner.ts makes the same call for the same reason), so this stays runtime-agnostic.\n * ★ A CONNECTION NOTHING ACCEPTED IS RETRIED; ONE CADDY ALREADY SAW IS NEVER RE-SENT. Only\n *   `ECONNREFUSED` (nothing listening) and `ENOENT` (no unix socket file yet) mean the request\n *   never reached Caddy — a launchd job bootstrapped a moment ago. Anything else (a reset, a\n *   timeout) may have reached Caddy, so `POST /load` is never resent for it: `isUnreachable`\n *   (local-admin.ts) is what tells `Caddy.Config`'s plan-time read to proceed without Caddy instead\n *   of failing the whole plan (config.ts's `planWithoutCaddy`).\n */\nimport * as http from 'node:http';\nimport { Readable } from 'node:stream';\nimport * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\nimport * as Result from 'effect/Result';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientError from 'effect/unstable/http/HttpClientError';\nimport type * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\nimport * as HttpClientResponse from 'effect/unstable/http/HttpClientResponse';\nimport type { Target } from './admin-address.ts';\n\nexport type LocalHttpClientOptions = {\n  /**\n   * Abort an exchange after this long. @default 60_000\n   * ⚠️ A `shutdown_delay` in the Caddyfile makes `/load` block that long (caddyhttp app.go Stop);\n   *   a timeout then fails the deploy while Caddy goes on to apply — the next plan converges.\n   */\n  readonly timeoutMs?: number;\n  /** Retries when the connection is REFUSED — see the module doc. @default 2 */\n  readonly retries?: number;\n  /** @default 500 */\n  readonly retryDelayMs?: number;\n};\n\nconst NEVER_CONNECTED = new Set(['ECONNREFUSED', 'ENOENT']);\n\nconst codeOf = (cause: unknown): string | undefined =>\n  typeof cause === 'object' && cause !== null && 'code' in cause\n    ? String((cause as { code: unknown }).code)\n    : undefined;\n\n/**\n * Nothing accepted the connection — see the module doc's ★. A type guard, not just a predicate, so\n * config-lifecycle.ts's error-wrapping can pass through the raw error unchanged (still typed) and\n * config.ts's plan-time escape hatch (`Effect.catchIf`) narrows to it directly.\n */\nexport const isUnreachable = (error: unknown): error is HttpClientError.HttpClientError =>\n  error instanceof HttpClientError.HttpClientError &&\n  error.reason._tag === 'TransportError' &&\n  NEVER_CONNECTED.has(codeOf(error.reason.cause) ?? '');\n\nconst transportFailure = (request: HttpClientRequest.HttpClientRequest, cause: unknown) =>\n  new HttpClientError.HttpClientError({\n    reason: new HttpClientError.TransportError({ request, cause }),\n  });\n\n/** Node's response headers (string | string[] | undefined) → the single-valued form Web `Response` wants. Caddy never repeats a header this transport reads. */\nconst flattenHeaders = (headers: http.IncomingHttpHeaders): Record<string, string> => {\n  const flat: Record<string, string> = {};\n  for (const [key, value] of Object.entries(headers)) {\n    if (value !== undefined) flat[key] = Array.isArray(value) ? value.join(', ') : value;\n  }\n  return flat;\n};\n\nconst waitForResponse = (\n  nodeRequest: http.ClientRequest,\n  request: HttpClientRequest.HttpClientRequest,\n) =>\n  Effect.callback<http.IncomingMessage, HttpClientError.HttpClientError>((resume) => {\n    const onError = (cause: Error): void => {\n      resume(Effect.fail(transportFailure(request, cause)));\n    };\n    nodeRequest.on('error', onError);\n    const onResponse = (response: http.IncomingMessage): void => {\n      nodeRequest.off('error', onError);\n      resume(Effect.succeed(response));\n    };\n    nodeRequest.on('response', onResponse);\n    return Effect.sync(() => {\n      nodeRequest.off('error', onError);\n      nodeRequest.off('response', onResponse);\n    });\n  });\n\nconst waitForFinish = (\n  nodeRequest: http.ClientRequest,\n  request: HttpClientRequest.HttpClientRequest,\n) =>\n  Effect.callback<void, HttpClientError.HttpClientError>((resume) => {\n    const onError = (cause: Error): void => {\n      resume(Effect.fail(transportFailure(request, cause)));\n    };\n    nodeRequest.once('error', onError);\n    const onFinish = (): void => {\n      nodeRequest.off('error', onError);\n      resume(Effect.void);\n    };\n    nodeRequest.once('finish', onFinish);\n    return Effect.sync(() => {\n      nodeRequest.off('error', onError);\n      nodeRequest.off('finish', onFinish);\n    });\n  });\n\n/**\n * Every Caddy operation's request body is `Empty` (GET/DELETE/`/stop`) or a `Uint8Array` — the\n * `T.HttpBody()`/JSON-body cascade never produces `Raw`, `FormData` or `Stream` for this SDK\n * (protocol.ts). A typed refusal, not a defect (S20), for a body shape that would mean the SDK grew\n * an operation this transport was never taught to send.\n */\nconst sendBody = (\n  nodeRequest: http.ClientRequest,\n  request: HttpClientRequest.HttpClientRequest,\n): Effect.Effect<void, HttpClientError.HttpClientError> =>\n  Effect.suspend(() => {\n    const body = request.body;\n    if (body._tag === 'Empty') {\n      nodeRequest.end();\n      return waitForFinish(nodeRequest, request);\n    }\n    if (body._tag === 'Uint8Array') {\n      // ⚠️ `body.contentLength` is never nullish, so `?? body.body.byteLength` reads as dead code\n      //   to TypeScript's `??` narrowing — which then (a real quirk, not a defect here) infers\n      //   `body` itself as `never` on that unreachable side. Two plain statements instead.\n      nodeRequest.setHeader('content-length', body.contentLength);\n      nodeRequest.end(body.body);\n      return waitForFinish(nodeRequest, request);\n    }\n    return Effect.fail(\n      new HttpClientError.HttpClientError({\n        reason: new HttpClientError.EncodeError({\n          request,\n          description: `Caddy admin transport: unsupported request body \"${body._tag}\" — every Caddy operation sends Empty or a Uint8Array body`,\n        }),\n      }),\n    );\n  });\n\nconst toWebResponse = (source: http.IncomingMessage): Response =>\n  new Response(Readable.toWeb(source) as unknown as ReadableStream, {\n    headers: flattenHeaders(source.headers),\n    status: source.statusCode ?? 0,\n  });\n\nconst exchangeOnce = (\n  target: Target,\n  request: HttpClientRequest.HttpClientRequest,\n  url: URL,\n  signal: AbortSignal,\n  timeoutMs: number,\n): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError> =>\n  Effect.suspend(() => {\n    const nodeRequest = http.request({\n      headers: request.headers,\n      method: request.method,\n      path: `${url.pathname}${url.search}`,\n      signal,\n      timeout: timeoutMs,\n      ...(target.kind === 'unix'\n        ? { socketPath: target.socketPath }\n        : { host: target.host, port: target.port }),\n    });\n    // node:http's own inactivity timeout — a hang (e.g. a `shutdown_delay` blocking `/load`, see\n    // the module doc) destroys the request, which then surfaces through the same 'error' handler\n    // `waitForResponse`/`waitForFinish` already listen on.\n    nodeRequest.on('timeout', () => {\n      nodeRequest.destroy(new Error(`no answer in ${String(timeoutMs)} ms`));\n    });\n    return Effect.raceFirst(\n      waitForResponse(nodeRequest, request),\n      sendBody(nodeRequest, request).pipe(Effect.andThen(Effect.never)),\n    ).pipe(\n      Effect.onError(() => Effect.sync(() => nodeRequest.destroy())),\n      Effect.map((source) => HttpClientResponse.fromWeb(request, toWebResponse(source))),\n    );\n  });\n\n/**\n * Retry ONLY a connection nothing accepted, up to `retries` times, spaced `retryDelayMs` apart —\n * a plain loop over `Effect.result`, not `Effect.retry`'s `{schedule, times, while}` options\n * object. MEASURED 2026-09-23: with a `Schedule` given alongside `times`/`while`, that combined\n * form retried an ECONNRESET past both — `while` kept correctly returning `false` every attempt,\n * logged and confirmed, yet the schedule's own unbounded `spaced` kept driving retries anyway. A\n * loop leaves no such ambiguity: the SAME `isUnreachable` check that would gate `while` here gates\n * every iteration directly, one attempt at a time.\n */\nconst withUnreachableRetry = (\n  attempt: Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError>,\n  retries: number,\n  retryDelayMs: number,\n): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError> =>\n  Effect.gen(function* () {\n    let attemptsLeft = retries;\n    for (;;) {\n      const outcome = yield* Effect.result(attempt);\n      if (Result.isSuccess(outcome)) return outcome.success;\n      if (attemptsLeft <= 0 || !isUnreachable(outcome.failure)) {\n        return yield* Effect.fail(outcome.failure);\n      }\n      attemptsLeft -= 1;\n      yield* Effect.sleep(Duration.millis(retryDelayMs));\n    }\n  });\n\n/** The transport `localCaddyAdmin()` provides as `HttpClient.HttpClient` — see local-admin.ts. */\nexport const makeLocalHttpClient = (\n  target: Target,\n  options: LocalHttpClientOptions = {},\n): Layer.Layer<HttpClient.HttpClient> => {\n  const timeoutMs = options.timeoutMs ?? 60_000;\n  const retries = options.retries ?? 2;\n  const retryDelayMs = options.retryDelayMs ?? 500;\n  return Layer.succeed(\n    HttpClient.HttpClient,\n    HttpClient.make((request, url, signal) => {\n      const attempt = exchangeOnce(target, request, url, signal, timeoutMs);\n      return retries <= 0 ? attempt : withUnreachableRetry(attempt, retries, retryDelayMs);\n    }),\n  );\n};\n",
+    "/**\n * `Caddy.Config` — a running Caddy's whole config, declared as Caddyfile text and applied through\n * Caddy's own admin API (decision 23), via `@distilled.cloud/caddy`'s typed `admin` operations.\n *\n * - create / update — `POST /adapt` (validate), `POST /load` with `text/caddyfile` (a graceful\n *   reload; Caddy keeps the old config if it refuses the new one, and the error names why), then\n *   `GET /config/` and insist it matches. Skipped when Caddy already runs this config.\n * - read — the digest of `GET /config/`. With no state it is the adoption probe (below).\n * - diff — declared, live and stored digests (config-lifecycle.ts). Never `replace`.\n * - delete — ⛔ NOTHING. See below.\n *\n * ⛔ DELETE NEVER TOUCHES CADDY, UNDER EITHER REMOVAL POLICY. Removing this declaration must not take\n *   every site down: there is no \"less config\" to fall back to, and an empty config stops all\n *   servers. `retain` is the default (the engine never calls delete); with `destroy` the handler\n *   still only forgets. It never calls `/stop` (which exits the process) or `DELETE /config/`.\n *   To empty a Caddy, do it by hand at its admin API.\n * ⛔ NOTHING IS ADOPTED SILENTLY (decision, 2026-09-21 — the house rule HostFile and LaunchdJob\n *   keep). With no state, a running Caddy whose live config IS the declared one reads as ours (the\n *   adoption changes nothing); any other config reads as `Unowned`, and the plan refuses it unless\n *   the deploy runs with `--adopt`. A Caddy serving nothing reads as absent: a create. Where the\n *   engine skips that probe, reconcile refuses the same takeover (config-lifecycle.ts).\n * ⛔ `caddyfile` IS NEVER A SECRET — see config-form.ts; refused before anything is sent.\n * ⚠️ WHICH CADDY is the transport's (providers.ts): `CaddyAdminService` plus the `Credentials`/\n *   `HttpClient` layers `caddyAdminLayer` merges — one per stack, not a prop.\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { resolvedString } from '../launchd/host-effect.ts';\nimport { adoptEnabled } from '../ownership/adopt.ts';\nimport { CaddyAdminService } from './admin.ts';\nimport { isUnreachable } from './caddy-http-client.ts';\nimport type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';\nimport { probeLive, readLive } from './config-lifecycle.ts';\nimport { diffConfig, reconcileConfig } from './config-reconcile.ts';\n\nexport type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';\n\nexport interface CaddyConfig extends Resource<\n  'Caddy.Config',\n  CaddyConfigProps,\n  CaddyConfigAttributes\n> {}\n\nexport const CaddyConfig = Resource<CaddyConfig>('Caddy.Config', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * ⚠️ A STOPPED CADDY MUST NOT FAIL THE PLAN THAT BRINGS IT BACK. Its launchd job usually sits in the\n *   same stack; if every plan died on `ECONNREFUSED`, the fix to that job could never be deployed.\n *   So at PLAN time only (read, diff) an unreachable Caddy plans an update — with a warning, because\n *   the plan-time `/adapt` check did not run — and reconcile, which needs Caddy, still fails loudly.\n */\nconst planWithoutCaddy =\n  <A>(admin: { endpoint: string }, fallback: A) =>\n  (error: unknown) =>\n    Effect.as(\n      Effect.logWarning(\n        `Caddy.Config: no Caddy at ${admin.endpoint} ` +\n          `(${error instanceof Error ? error.message : String(error)}); planning without it — ` +\n          'the Caddyfile is validated when the deploy reaches Caddy',\n      ),\n      fallback,\n    );\n\nexport const CaddyConfigProvider = () =>\n  Provider.effect(\n    CaddyConfig,\n    Effect.gen(function* () {\n      const admin = yield* CaddyAdminService;\n      /** The probe, branded for the engine: plain when ours, `Unowned` otherwise. */\n      const probe = (caddyfile: string | undefined, sourceFile: string | undefined) =>\n        Effect.flatMap(probeLive(caddyfile, sourceFile), (found) => {\n          if (found === undefined) return Effect.succeed(undefined);\n          if (found.ours) return Effect.succeed(found.attributes);\n          const unowned = Unowned(found.attributes);\n          return found.unchecked === undefined\n            ? Effect.succeed(unowned)\n            : Effect.as(\n                Effect.logWarning(\n                  `Caddy.Config at ${admin.endpoint}: the running config could not be compared ` +\n                    `with the declared Caddyfile (${found.unchecked}), so it is not treated as ours`,\n                ),\n                unowned,\n              );\n        });\n      return CaddyConfig.Provider.of({\n        /** ⛔ A Caddy has one config; there is nothing to enumerate, and nothing for nuke to delete. */\n        list: () => Effect.succeed([]),\n\n        /**\n         * With state: the live attributes, which diff compares. With none, the ADOPTION PROBE —\n         * `olds` is the declaration (Plan.ts passes `news`), and only a live config equal to it is\n         * ours. ⚠️ A running Caddy is still the one the stack means (the transport reaches only\n         * loopback), but WHOSE CONFIG it runs is not: a person, another tool or another stack.\n         */\n        read: ({ olds, output }) =>\n          Effect.gen(function* () {\n            return output === undefined\n              ? yield* probe(resolvedString(olds, 'caddyfile'), resolvedString(olds, 'sourceFile'))\n              : yield* readLive(resolvedString(olds, 'sourceFile'));\n          }).pipe(\n            // ★ Nothing to adopt from a Caddy that is down: plan a create, which is the same load.\n            Effect.catchIf(isUnreachable, planWithoutCaddy(admin, undefined)),\n          ),\n\n        diff: ({ news, output }) => {\n          if (output === undefined) return Effect.succeed(undefined);\n          const update = planWithoutCaddy(admin, { action: 'update' as const });\n          if (isResolved(news)) {\n            return diffConfig(news, output).pipe(Effect.catchIf(isUnreachable, update));\n          }\n          /**\n           * ⚠️ `sourceFile` is an Output while its HostFile changes in the same deploy\n           *   (caddyWithFile). The Caddyfile itself is usually plain text, so validate and compare\n           *   it now — a bad Caddyfile must fail the PLAN, before the HostFile writes it to disk —\n           *   and plan an update, which reloads only if the config really differs.\n           */\n          const caddyfile = resolvedString(news, 'caddyfile');\n          if (caddyfile === undefined) return Effect.succeed(undefined);\n          return Effect.as(diffConfig({ caddyfile }, output), { action: 'update' as const }).pipe(\n            Effect.catchIf(isUnreachable, update),\n          );\n        },\n\n        reconcile: ({ fqn, news, output }) =>\n          Effect.gen(function* () {\n            // ⛔ State is authority over the Caddy it was applied to, and no other. With none (the\n            //   engine may not have probed: see reconcileConfig), or with the transport now at\n            //   another endpoint, only adoption — `--adopt`, or this resource's own `adopt(…)`,\n            //   as the planner resolves it — loads over a config the stack cannot claim.\n            const sameCaddy = output !== undefined && output.endpoint === admin.endpoint;\n            const takeOver = sameCaddy || (yield* adoptEnabled(fqn));\n            const stored = output === undefined ? {} : { stored: output.configSha256 };\n            const applied = yield* reconcileConfig(news, { takeOver, ...stored });\n            for (const warning of applied.warnings) {\n              yield* Effect.logWarning(`Caddy.Config at ${admin.endpoint}: ${warning}`);\n            }\n            return applied.attributes;\n          }),\n\n        delete: () => Effect.void,\n      });\n    }),\n  );\n",
     "/**\n * The one place a HostRunner's promises become Effects — plus the one probe of an unresolved\n * `news` both providers' diffs share. (The engine's adopt setting lives in ownership/adopt.ts.)\n *\n * ★ The lifecycle files are plain async functions over a HostRunner (see runner.ts for why the\n *   runner is promise-based), so each provider handler is a single `lift(() => step(runner, …))`.\n * ⚠️ A thrown Error stays that Error — its message is the refusal a deploy prints. Anything else\n *   thrown is wrapped, so the failure channel is always an Error with a readable message.\n */\nimport * as Effect from 'effect/Effect';\n\nexport const lift = <A>(step: () => Promise<A>): Effect.Effect<A, Error> =>\n  Effect.tryPromise({\n    catch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),\n    try: step,\n  });\n\n/**\n * A string prop of a diff's `news`, when that one prop is already resolved; `undefined` while it\n * is still an Output (a function-typed proxy), an Effect or a Config.\n * ★ For the identity props a diff must see even when the rest of `news` is unresolved — a plain\n *   string is resolved by definition, so `typeof` is the whole test.\n */\nexport const resolvedString = (news: unknown, key: string): string | undefined => {\n  if (typeof news !== 'object' || news === null) return undefined;\n  const value = (news as Record<string, unknown>)[key];\n  return typeof value === 'string' ? value : undefined;\n};\n",
     "/**\n * Whether a live object this stack holds no state for may be written — the apply-time half of the\n * house rule that NOTHING IS ADOPTED WITHOUT `--adopt` (decided 2026-09-21 for HostFile, LaunchdJob,\n * CaddyConfig and every Bao.* family). probe.ts is the plan-time half.\n *\n * ★ FAMILY-NEUTRAL ON PURPOSE. The engine questions here — what `--adopt` resolves to for one FQN,\n *   whether this apply resumes the resource's own interrupted create — are the same for a vault\n *   role, a launchd plist and a Caddy config, so they live once, outside every subpath's directory.\n */\nimport { AdoptPolicy } from 'alchemy/AdoptPolicy';\nimport { AlchemyContext } from 'alchemy/AlchemyContext';\nimport { Stack } from 'alchemy/Stack';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\nimport { resumes, unfinished } from './resume.ts';\nimport { forgetRefusedCreate, isCreate } from './rows.ts';\n\n/**\n * Whether the resource at `fqn` may be adopted, resolved exactly as the planner resolves it (alchemy\n * beta.79 Plan.ts: `resource.Adopt ?? shouldAdopt`): a resource-scoped `adopt(…)`, else the\n * `AdoptPolicy` service, else `AlchemyContext.adopt`, else off.\n * ★ FOR A CREATE THE ENGINE NEVER PROBED. Alchemy skips the adoption probe while `news` holds an\n *   Output, so an ownership check that must still honour `--adopt` can only run at apply. All three\n *   reach the apply: Alchemist runs plan AND apply under the session context, which provides the\n *   services from the CLI flag and the Stack the resources registered on (Alchemist/Session.ts,\n *   routes/stack.ts; Apply.ts reads the same Stack).\n * ⛔ THE RESOURCE-SCOPED SETTING WINS, BOTH WAYS. The engine captures `adopt(…)` on the resource at\n *   registration (Resource.ts `Adopt`, into `Stack.resources[fqn]`) and never hands it to a\n *   provider. Reading only the deploy-wide flag let `--adopt` take over a resource declared\n *   `.pipe(adopt(false))` — which the planner refuses — and refused one declared `adopt(true)`.\n * ⚠️ `resources` carries an `@internal` comment in Alchemy's source, but it is in the published types\n *   and the planner reads `Adopt` from it. caddy/adopt-scope.test.ts registers through the real\n *   `Resource`, so an upgrade that stops recording it there fails the suite.\n */\nexport const adoptEnabled = (fqn: string): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    const stack = yield* Effect.serviceOption(Stack);\n    const scoped = Option.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;\n    if (scoped !== undefined) return scoped;\n    const policy = yield* Effect.serviceOption(AdoptPolicy);\n    if (Option.isSome(policy)) return policy.value;\n    const context = yield* Effect.serviceOption(AlchemyContext);\n    return Option.isSome(context) ? context.value.adopt : false;\n  });\n\n/** The three fields of a `reconcile` (or `read`) call that say whose object this is. */\nexport type Owner = {\n  readonly fqn: string;\n  readonly instanceId: string;\n  /** The attributes state holds; `undefined` on a create. */\n  readonly output: unknown;\n};\n\n/**\n * Whether `--adopt` may speak for this apply's generation: a CREATE (rows.ts isCreate), or an\n * UNFINISHED generation whose row this plan's diff saw with no attributes (resume.ts) — the\n * resume Alchemy itself offers `--adopt` for (\"Cannot resume creating … Re-run with --adopt\").\n * ⛔ NOT A FRESH REPLACE'S NEW GENERATION. The planner never probes it and never offers it adoption,\n *   so the identity it moves to was never asked about under `--adopt`: 🔴 MEASURED 2026-09-21\n *   (launchd/adopt-apply.test.ts), a HostFile whose path changed onto a file it did not own\n *   overwrote that file under a deploy-wide `--adopt` meant for something else. A Bao rename onto a\n *   taken identity already fails the plan, `--adopt` or not (rename.ts judgeMove); this keeps the\n *   apply to the same answer.\n */\nconst adoptable = (owner: Owner): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    if (yield* isCreate(owner.fqn, owner.instanceId)) return true;\n    return yield* unfinished(owner.instanceId);\n  });\n\n/** Whether a stateless `reconcile` may take over a live object: adoption on, for an adoptable one. */\nexport const adoptsAtApply = (owner: Owner): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    if (!(yield* adoptEnabled(owner.fqn))) return false;\n    return yield* adoptable(owner);\n  });\n\n/** A lifecycle helper's hook for refuseTakeover, bound to one call's Owner: `(what) => …`. */\nexport type Claim = (what: string) => Effect.Effect<void>;\n\n/**\n * `reconcile`'s check, called with the live object it found BEFORE any write: dies unless that\n * object may be written. It may when state already vouches for it (`output`), when this apply\n * resumes the resource's own interrupted create or replace and its diff proved the object that\n * generation's (resume.ts), or when adoption is on for a create or an unfinished generation\n * (adoptable).\n * ⛔ WHY IT EXISTS AT ALL: THE PROBE DOES NOT GUARD EVERY CREATE. Alchemy skips it while `news` holds\n *   an Output (Plan.ts), a new generation of a replace is never probed, and an object can appear\n *   between plan and apply. Each of those used to be a silent takeover: written over, then recorded\n *   as ours, and deleted with the stack under `destroy`.\n * ⚠️ A CHECK, THEN A WRITE — NOT A LOCK. Two creates of one name in the same deploy run\n *   concurrently, both read nothing, and both write (measured with the fakes, 2026-09-21). Nothing\n *   between a read and a write can close that; declare each name once.\n * ⚠️ AN IDENTICAL OBJECT IS STILL A TAKEOVER (decided 2026-09-21). Nothing would be written, but the\n *   state row would claim it, and a later delete would remove what another owner still relies on.\n * ⛔ A REFUSED CREATE FORGETS ITS `creating` ROW (rows.ts forgetRefusedCreate), or the next plan's\n *   recovery read would adopt the very object this refused.\n */\nexport const refuseTakeover = (owner: Owner, what: string): Effect.Effect<void> =>\n  Effect.gen(function* () {\n    if (owner.output !== undefined) return;\n    if (yield* resumes(owner.instanceId)) return;\n    const may = yield* adoptable(owner);\n    if (may && (yield* adoptEnabled(owner.fqn))) return;\n    yield* forgetRefusedCreate(owner.fqn, owner.instanceId);\n    const remedy = may\n      ? 'Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first.'\n      : 'It is the new identity of a replace, which --adopt does not cover: remove it first.';\n    return yield* Effect.die(\n      new Error(\n        `${what}: already exists, and this stack holds no state for it — the plan could not ask ` +\n          'first (a prop was still an Output, a replace moved onto it, or it appeared after the ' +\n          `plan). Nothing was written. ${remedy}`,\n      ),\n    );\n  });\n\n/** refuseTakeover bound to one call's Owner, for a lifecycle helper that finds the live object. */\nexport const claimFor =\n  (owner: Owner): Claim =>\n  (what) =>\n    refuseTakeover(owner, what);\n",
     "/**\n * Whether this apply RESUMES a create or replace the engine already started for this resource AND\n * the live object it will find is proven that generation's own — the one case in which a stateless\n * `reconcile` may write over a live object without `--adopt`.\n *\n * ★ HOW THE ENGINE TELLS US. Alchemy calls `diff` whenever a state row exists, and hands it `output`\n *   = that row's attributes (alchemy beta.79 Plan.ts). A row with NO attributes is exactly an\n *   unfinished generation: `creating` (a create interrupted after its write, before its commit),\n *   `replacing` (the same for a replace), or `deleting` re-driven as a create. A fresh create is\n *   never diffed at all. So the diff of such a row decides, and the apply that follows (the same\n *   instance id: Apply.ts reuses the row's) finds the note.\n * ⛔ A ROW PROVES NOTHING BY ITSELF (red team, 2026-09-21). Apply commits it BEFORE reconcile runs, so\n *   a deploy killed before the claim — an upstream that failed, a Ctrl-C — leaves a row whose create\n *   never asked whose object sat at its identity. 🔴 MEASURED (openbao/adopt-holes.test.ts): with the\n *   name an Output, the next deploy \"resumed\" that create and wrote over another owner's role, in\n *   every family that had a note on the row alone. So the note is left only when the family's own\n *   `read`, asked as the recovery read (probe.ts ownedRead: a recorded instance, a row carrying the\n *   whole declaration, and a live object that matches it), answers \"ours\". For a `creating` row\n *   that is the question Plan.ts already asked; for a `replacing` row it is the only time it is asked.\n * ⚠️ WHY NOT THE STATE STORE ALONE. At reconcile both look the same: Apply commits the fresh create's\n *   `creating` row before calling reconcile, so a row with this instance id is always there.\n * ★ THE CHANNEL IS ALCHEMY'S OWN: `Artifacts`, the per-FQN bag the engine shares between one plan\n *   and its apply (Artifacts.ts: \"diff computes … create / update reads the same artifact\").\n *   Deploy.ts and the Alchemist session both hold one store across the pair.\n * ⚠️ IT FAILS CLOSED. No bag, a bag the plan never wrote, or an object the read cannot prove ours\n *   reads as a fresh create, and adopt.ts then asks for `--adopt` — the safe direction.\n * ★ AN UNPROVEN RESUME IS STILL MARKED UNFINISHED (`noteUnfinished`), so `--adopt` can take it over\n *   the way Alchemy's own \"Cannot resume creating … Re-run with --adopt\" offers for a create — while\n *   a FRESH replace's new generation, which no diff ever saw without attributes, stays unadoptable.\n */\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { Artifacts } from 'alchemy/Artifacts';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\n\nconst PROVEN = 'homeflare/ownership/resumes';\nconst UNFINISHED = 'homeflare/ownership/unfinished';\n\nconst note = (key: string, instanceId: string): Effect.Effect<void> =>\n  Effect.gen(function* () {\n    const bag = yield* Effect.serviceOption(Artifacts);\n    if (Option.isSome(bag)) yield* bag.value.set(key, instanceId);\n  });\n\nconst noted = (key: string, instanceId: string): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    const bag = yield* Effect.serviceOption(Artifacts);\n    if (Option.isNone(bag)) return false;\n    return (yield* bag.value.get<string>(key)) === instanceId;\n  });\n\n/**\n * `diff`'s note for a row with no attributes: `instanceId` is an unfinished generation of this\n * resource's own, which `--adopt` may resume when nothing proves it (adopt.ts adoptable). Returns\n * `undefined`, a diff's \"defer to the engine\".\n */\nexport const noteUnfinished = (instanceId: string): Effect.Effect<undefined> =>\n  Effect.as(note(UNFINISHED, instanceId), undefined);\n\n/**\n * Note `instanceId` unfinished, and a proven resume when `recovered` — the family's `read` of the\n * row's props, asked with no attributes — answers a plain object: ours. `Unowned`, nothing, or a\n * read that fails or dies proves nothing. ⚠️ Never fails the plan: an unproven resume is refused\n * at apply instead, unless `--adopt`.\n */\nexport const noteResume = <R>(\n  instanceId: string,\n  recovered: Effect.Effect<unknown, unknown, R>,\n): Effect.Effect<void, never, R> =>\n  Effect.gen(function* () {\n    yield* noteUnfinished(instanceId);\n    const unproven = () => Effect.succeed(undefined);\n    const found = yield* recovered.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));\n    if (found === undefined || found === null || Unowned.is(found)) return;\n    yield* note(PROVEN, instanceId);\n  });\n\n/** Whether the plan for this apply noted `instanceId` as a proven resumed create or replace. */\nexport const resumes = (instanceId: string): Effect.Effect<boolean> => noted(PROVEN, instanceId);\n\n/** Whether the plan for this apply saw `instanceId` as an unfinished generation (proven or not). */\nexport const unfinished = (instanceId: string): Effect.Effect<boolean> =>\n  noted(UNFINISHED, instanceId);\n\n/** The fields of a `read` or `diff` call provingResumes uses; a family's own input carries more. */\ntype Ask = {\n  readonly id: string;\n  readonly fqn: string;\n  readonly instanceId: string;\n  readonly olds: unknown;\n  readonly output: unknown;\n};\ntype Hook = Effect.Effect<unknown, unknown, unknown>;\n\n/** The two hooks provingResumes wraps, as Alchemy's ProviderService declares them. */\ninterface Resumable {\n  read?(input: Ask): Hook;\n  diff?(input: Ask): Hook;\n}\n\n/**\n * A provider whose `diff`, for a row with no attributes, first asks the provider's own `read` whether\n * the live object is that unfinished generation's (noteResume), then runs as written. Every Bao.*\n * family is built through it, so their diffs answer such a row with a plain `undefined`.\n */\nexport const provingResumes = <S extends Resumable>(service: S): S => {\n  const { diff, read } = service;\n  if (diff === undefined || read === undefined) return service;\n  const proving: Resumable['diff'] = (input) =>\n    Effect.gen(function* () {\n      if (input.output === undefined) {\n        yield* noteResume(input.instanceId, read({ ...input, output: undefined }));\n      }\n      return yield* diff(input);\n    });\n  // ⚠️ The one cast: `diff` keeps the family's own signature — it is the family's diff, run after.\n  return { ...service, diff: proving } as S;\n};\n",
     "/**\n * The questions ownership/ asks of Alchemy's state store: does a row record this instance, and with\n * its whole declaration (probe.ts); is this apply a create rather than a replace's new generation\n * (adopt.ts); and — when reconcile refuses a create — forget the row Apply committed for it\n * (adopt.ts). Alchemy's own AWS.EC2.SecurityGroup provider reads the store the same way: the Stack\n * service names the stack and stage, and `State` yields the store.\n *\n * ⚠️ WITHOUT A STACK OR STATE IN CONTEXT, or with a store that errors, a row reads as \"not\n *   recorded\" — the object is then `Unowned`, the safe answer — and nothing is forgotten, which\n *   leaves the one gap forgetRefusedCreate exists to close. `alchemy deploy` and the Alchemist\n *   session provide both.\n */\nimport { Stack } from 'alchemy/Stack';\nimport { State, type StateService, isActionState } from 'alchemy/State/State';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\nimport { wholeDeclaration } from './whole.ts';\n\ntype Where = { readonly stack: string; readonly stage: string };\n\n/** The store, where this stack lives, and what it declares — or undefined outside a stack. */\nconst storeOf = Effect.gen(function* () {\n  const stack = yield* Effect.serviceOption(Stack);\n  const state = yield* Effect.serviceOption(State);\n  if (Option.isNone(stack) || Option.isNone(state)) return undefined;\n  const store: StateService = yield* state.value;\n  const where: Where = { stack: stack.value.name, stage: stack.value.stage };\n  return { resources: stack.value.resources, store, where };\n});\n\nconst rowAt = (store: StateService, where: Where, fqn: string) =>\n  store.get({ ...where, fqn }).pipe(Effect.orElseSucceed(() => undefined));\n\n/** One generation of a persisted row, as far as ownership/ reads it. */\nexport type Generation = {\n  readonly instanceId?: unknown;\n  readonly status?: unknown;\n  readonly props?: unknown;\n  readonly attr?: unknown;\n  readonly old?: unknown;\n  /** Set by Apply on the `updating` row of an adoption, until that update commits (Apply.ts). */\n  readonly adopting?: unknown;\n};\n\n/** The generation of a persisted row that carries `instanceId`: the row itself, or one in `old`. */\nconst generationOf = (row: unknown, instanceId: string): Generation | undefined => {\n  let at = row;\n  while (typeof at === 'object' && at !== null && !isActionState(at as never)) {\n    const generation = at as Generation;\n    if (generation.instanceId === instanceId) return generation;\n    at = generation.old;\n  }\n  return undefined;\n};\n\n/** The generation `instanceId` names — at the FQN, or at a former FQN `renamedFrom` names. */\nexport const recordedGeneration = (\n  fqn: string,\n  instanceId: string,\n): Effect.Effect<Generation | undefined> =>\n  Effect.gen(function* () {\n    const found = yield* storeOf;\n    if (found === undefined) return undefined;\n    for (const at of [fqn, ...(found.resources[fqn]?.FormerFqns ?? [])]) {\n      const generation = generationOf(yield* rowAt(found.store, found.where, at), instanceId);\n      if (generation !== undefined) return generation;\n    }\n    return undefined;\n  });\n\n/**\n * What the state store says of `instanceId` for this resource (at its FQN, or at a former FQN its\n * `renamedFrom` names — the planner migrates that row before it recovers it):\n *   · `absent`  — no row holds it. ★ This is what separates the probe from the recovery read: the\n *     probe's instance id is minted for the probe (Plan.ts `generateInstanceId()`), 128 random bits\n *     no row can hold.\n *   · `partial` — a row holds it, but its props lack part of the declaration: a prop stripped at\n *     commit because it was still an Output (whole.ts). Those props cannot prove an object ours.\n *   · `whole`   — a row holds it with every prop the declaration names.\n */\nexport type Recorded = 'absent' | 'partial' | 'whole';\n\nexport const recordedInstance = (fqn: string, instanceId: string): Effect.Effect<Recorded> =>\n  Effect.gen(function* () {\n    const generation = yield* recordedGeneration(fqn, instanceId);\n    if (generation === undefined) return 'absent';\n    return (yield* wholeDeclaration(fqn, generation.props)) ? 'whole' : 'partial';\n  });\n\n/**\n * Whether this apply's `instanceId` is a CREATE: the row Apply committed for it is `creating`.\n * ⛔ A REPLACE'S NEW GENERATION IS NOT ONE. Apply commits it as `replacing`, and the planner never\n *   offers it adoption — the probe runs only for a resource with no state — so `--adopt` must not\n *   let it write over whatever sits at its new identity (adopt.ts adoptsAtApply).\n */\nexport const isCreate = (fqn: string, instanceId: string): Effect.Effect<boolean> =>\n  Effect.map(\n    recordedGeneration(fqn, instanceId),\n    (generation) => generation?.status === 'creating',\n  );\n\n/**\n * ⛔ A REFUSED CREATE MUST NOT LEAVE A ROW THAT CLAIMS THE OBJECT IT REFUSED. Apply commits a\n *   `creating` row for this instance before it calls reconcile, and a failed reconcile leaves it\n *   there. The next plan's recovery read would then find our instance id and an object that can\n *   match its props — a prop that was an Output is stripped from the row, and an omitted prop is\n *   \"not managed\" — and adopt exactly what this apply refused. 🔴 MEASURED 2026-09-21: Bao.Mount\n *   and Bao.AuthMethod did (openbao/adopt-core.test.ts). So the row goes, and state reads as if\n *   the create never started: the next plan probes, and the probe answers `Unowned`.\n * ⚠️ ONLY a `creating` row of THIS instance with no attributes — the one Apply just wrote. A\n *   `replacing` row carries the previous generation in `old` and is never touched.\n */\nexport const forgetRefusedCreate = (fqn: string, instanceId: string): Effect.Effect<void> =>\n  Effect.gen(function* () {\n    const found = yield* storeOf;\n    if (found === undefined) return;\n    const row = yield* rowAt(found.store, found.where, fqn);\n    const mine = row as { status?: unknown; instanceId?: unknown; attr?: unknown } | undefined;\n    if (mine?.status !== 'creating' || mine.instanceId !== instanceId || mine.attr !== undefined) {\n      return;\n    }\n    yield* found.store.delete({ ...found.where, fqn }).pipe(Effect.ignore);\n  });\n",
     "/**\n * Whether a state row's props say everything the declaration says — the test that separates a row\n * whose props can prove an object ours from one that cannot (probe.ts, rows.ts).\n *\n * ★ WHY A ROW CAN BE MISSING PART OF ITS DECLARATION. Apply commits the `creating` (or `replacing`)\n *   row BEFORE reconcile runs, and strips every prop still an Output at that moment (alchemy\n *   beta.79 Apply.ts `commit` → Diff.ts `stripUnresolved`); a JSON store then drops the key. So a\n *   row written while an upstream was still being created carries a HOLE where that prop was.\n * ⛔ A HOLE IS \"UNKNOWN\", NOT \"UNMANAGED\". Most families read an absent prop as \"not managed\", so a\n *   recovery read comparing the live object with holed props proves nothing: 🔴 MEASURED 2026-09-21\n *   (openbao/adopt-holes.test.ts), a Bao.Mount whose `defaultLeaseTtl` was an Output, killed before\n *   its reconcile ran, adopted — and tuned — another owner's mount on the next deploy; with the\n *   NAME an Output, every role family read an empty name, found nothing, and the resumed create\n *   wrote over another owner's role. Neither deploy had ever asked whose object it was.\n * ★ THE DECLARATION IS WHAT TELLS A HOLE FROM AN OMISSION. It still holds the Output (or the literal)\n *   the row lacks, while an optional prop left out is absent from both.\n * ⚠️ CONSERVATIVE BY DESIGN: a prop added to the declaration after the crash also reads as a hole.\n *   That costs one `--adopt`, never a takeover.\n */\nimport { Stack } from 'alchemy/Stack';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\n\nconst absent = (value: unknown): boolean => value === undefined || value === null;\n\nconst isPlainObject = (value: unknown): value is Record<string, unknown> => {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;\n  const proto: unknown = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n};\n\n/**\n * Whether `recorded` carries a value everywhere `declared` does. Plain objects and arrays are\n * walked; any other declared value — a literal, an Output, an Effect — needs a value in the row.\n */\nexport const carries = (declared: unknown, recorded: unknown): boolean => {\n  if (absent(declared)) return true;\n  if (absent(recorded)) return false;\n  if (Array.isArray(declared)) {\n    if (!Array.isArray(recorded)) return false;\n    return declared.every((each, index) => carries(each, recorded[index]));\n  }\n  if (isPlainObject(declared)) {\n    if (!isPlainObject(recorded)) return false;\n    return Object.entries(declared).every(([key, each]) => carries(each, recorded[key]));\n  }\n  return true;\n};\n\n/**\n * Whether `props` — one generation's, from the state store — carry the whole declaration of the\n * resource at `fqn`. ⛔ FALSE WITH NOTHING TO COMPARE: no Stack in context, or a resource no longer\n *   declared (an orphan's delete). That object then reads as `Unowned` and Apply leaves it in place\n *   with a note, rather than deleting what it cannot prove it made.\n */\nexport const wholeDeclaration = (fqn: string, props: unknown): Effect.Effect<boolean> =>\n  Effect.map(Effect.serviceOption(Stack), (stack) => {\n    const declared = Option.isSome(stack) ? stack.value.resources[fqn] : undefined;\n    return declared !== undefined && carries(declared.Props, props);\n  });\n",
+    "/**\n * CaddyConfig's validate / read / probe as Effects over `@distilled.cloud/caddy`'s typed `admin`\n * operations (admin-calls.ts), so the lifecycle runs against a fake admin server in tests — and,\n * since fake-caddy.ts is a real HTTP server, against the real distilled wire protocol too.\n * config-reconcile.ts covers `diff`/`reconcile`, the other half of the same lifecycle.\n *\n * The comparison is always between DIGESTS OF ADAPTED JSON (digest.ts): what `POST /adapt` makes\n * of the declared Caddyfile and what `GET /config/` reports — `claimable` below asks whether a\n * running config is provably the declared one, which both the adoption probe and the apply need.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Result from 'effect/Result';\nimport type * as Caddy from '@distilled.cloud/caddy';\nimport { CaddyAdminService } from './admin.ts';\nimport { adaptCaddyfile, readRunningConfig } from './admin-calls.ts';\nimport { adminProblems } from './admin-guard.ts';\nimport { isUnreachable } from './caddy-http-client.ts';\nimport { refuse, wrapOperation } from './config-errors.ts';\nimport {\n  type CaddyConfigAttributes,\n  type CaddyConfigProps,\n  configProblems,\n} from './config-form.ts';\nimport { configDigest } from './digest.ts';\n\ntype Desired = { readonly digest: string; readonly warnings: readonly string[] };\n\n/**\n * ⛔ A CONFIG WITH NO APPS SERVES NOTHING. A Caddyfile of only comments or only global options\n *   passes the empty-text check (config-form.ts) yet adapts to `{}` or `{\"admin\":…}` — MEASURED\n *   2026-09-21 on a throwaway Caddy 2.11.4 — and loading it stops every server: the same outage,\n *   from the same templating bug, that the empty check exists to prevent.\n */\nexport const servesNothing = (config: unknown): boolean => {\n  const apps =\n    typeof config === 'object' && config !== null ? (config as { apps?: unknown }).apps : undefined;\n  return typeof apps !== 'object' || apps === null || Object.keys(apps).length === 0;\n};\n\n/**\n * Validate the props, adapt the Caddyfile on the running Caddy, and check its `admin` block.\n * ★ Every refusal happens HERE, before anything is loaded — and diff calls this at plan time, so a\n *   Caddyfile that does not adapt, carries a literal secret, or would strand the admin API fails the\n *   PLAN, before any resource (a HostFile holding the same text included) is applied.\n */\nexport const desiredConfig = (\n  props: CaddyConfigProps,\n): Effect.Effect<Desired, Error | Caddy.CaddyOpError, CaddyAdminService | Caddy.CaddyOpContext> =>\n  Effect.gen(function* () {\n    const { endpoint, listener } = yield* CaddyAdminService;\n    const found = configProblems(props);\n    if (found.length > 0) return yield* Effect.fail(refuse(endpoint, found.join('; ')));\n    const adapted = yield* adaptCaddyfile(props.caddyfile).pipe(\n      wrapOperation(endpoint, 'POST /adapt'),\n    );\n    if (servesNothing(adapted.config)) {\n      return yield* Effect.fail(\n        refuse(endpoint, 'the Caddyfile adapts to no apps — loading it would stop every site'),\n      );\n    }\n    const guard = adminProblems(adapted.config, listener);\n    if (guard.length > 0) return yield* Effect.fail(refuse(endpoint, guard.join('; ')));\n    return { digest: configDigest(adapted.config), warnings: adapted.warnings };\n  });\n\nexport const attributesOf = (\n  endpoint: string,\n  running: unknown,\n  sourceFile?: string,\n): CaddyConfigAttributes => ({\n  configSha256: configDigest(running),\n  endpoint,\n  ...(sourceFile === undefined ? {} : { sourceFile }),\n});\n\n/** What is running now, as attributes. `sourceFile` is carried over, never discovered. */\nexport const readLive = (\n  sourceFile?: string,\n): Effect.Effect<\n  CaddyConfigAttributes,\n  Error | Caddy.CaddyOpError,\n  CaddyAdminService | Caddy.CaddyOpContext\n> =>\n  Effect.gen(function* () {\n    const { endpoint } = yield* CaddyAdminService;\n    const running = yield* readRunningConfig().pipe(wrapOperation(endpoint, 'GET /config/'));\n    return attributesOf(endpoint, running, sourceFile);\n  });\n\n/**\n * ⛔ WITH NO STATE, A RUNNING CONFIG IS THIS STACK'S ONLY IF IT IS THE DECLARED ONE (decision,\n *   2026-09-21: CaddyConfig must not adopt silently — the house rule HostFile and LaunchdJob keep).\n *   Anything else was put there by a person, another tool or another stack, and loading over it\n *   replaces every site it serves. ★ A config that serves nothing (`null`, or no apps) is claimable\n *   too: there is nothing to take over, as an empty R2 lock rule set reads as no lock.\n */\nexport const claimable = (running: unknown, declaredDigest: string): boolean =>\n  servesNothing(running) || configDigest(running) === declaredDigest;\n\nexport type Probe = {\n  readonly attributes: CaddyConfigAttributes;\n  /** The live config IS the declared one: adopting it changes nothing. */\n  readonly ours: boolean;\n  /** Why the declaration could not be compared, when it could not — the Caddy is then not ours. */\n  readonly unchecked?: string;\n};\n\n/**\n * The adoption probe — `read` with no state: `undefined` when Caddy serves nothing (plan a create),\n * else the live attributes and whether they are provably ours (the provider brands the rest\n * `Unowned`, and the plan refuses them without `--adopt`).\n * ⛔ IT NEVER THROWS OVER THE DECLARATION. The engine also runs this read to recover an interrupted\n *   create, with THAT deploy's props (Plan.ts, `status: \"creating\"`) — so a Caddyfile that failed to\n *   adapt then would fail every later plan, the one carrying the fix included. What cannot be\n *   compared is \"not proven ours\", with the reason; the next diff or apply validates the Caddyfile.\n */\nexport const probeLive = (\n  caddyfile: string | undefined,\n  sourceFile?: string,\n): Effect.Effect<Probe | undefined, Caddy.CaddyOpError, CaddyAdminService | Caddy.CaddyOpContext> =>\n  Effect.gen(function* () {\n    const { endpoint } = yield* CaddyAdminService;\n    // ⚠️ NOT wrapOperation here: an unreachable Caddy must still raise the raw, narrowable\n    //   HttpClientError (config.ts's plan-time escape hatch), and every OTHER failure reading the\n    //   running config mid-probe is \"not proven ours\" below, never a thrown refusal.\n    const running = yield* readRunningConfig();\n    if (servesNothing(running)) return undefined;\n    const attributes = attributesOf(endpoint, running, sourceFile);\n    if (caddyfile === undefined) {\n      return { attributes, ours: false, unchecked: 'the stored Caddyfile is not plain text' };\n    }\n    // ⚠️ Unreachable mid-probe is still \"no Caddy\" (config.ts plans without it), not \"not ours\" —\n    //   re-failed with the raw, still-narrowable error, never swallowed into `unchecked`. Every\n    //   OTHER refusal desiredConfig raises mid-probe (a bad admin block, a Caddyfile that will not\n    //   adapt) is \"not proven ours\", with the reason — never a thrown refusal over the DECLARATION\n    //   (the ⛔ above). `Effect.result`, per S20, rather than a `catchAll` this Effect version\n    //   does not export.\n    const desired = yield* Effect.result(desiredConfig({ caddyfile }));\n    if (Result.isSuccess(desired)) {\n      return { attributes, ours: claimable(running, desired.success.digest) };\n    }\n    if (isUnreachable(desired.failure)) return yield* Effect.fail(desired.failure);\n    const cause = desired.failure;\n    return {\n      attributes,\n      ours: false,\n      unchecked: cause instanceof Error ? cause.message : String(cause),\n    };\n  });\n",
+    "/**\n * The three admin API calls the provider makes, through `@distilled.cloud/caddy`'s typed `admin`\n * operations — `catchTag`-able errors, never a status check in this file.\n *\n * Read in caddyserver/caddy v2.11.4 (and the API docs, caddyserver.com/docs/api):\n *   · `POST /adapt` (`adaptConfig`) — adapts without running (load.go handleAdapt). Side-effect\n *     free, so it is what plan-time validation uses.\n *   · `POST /load` (`loadConfig`) — Content-Type `text/caddyfile` picks the adapter (load.go\n *     adaptByContentType); \"if the new config fails for any reason, the old config is rolled back\n *     into place without downtime\" (docs; caddy.go changeConfig restores the previous raw config).\n *     An identical config is a no-op without `Cache-Control: must-revalidate`.\n *   · `GET /config/` (`getConfig`) — the running config as JSON, `null` when empty (admin.go\n *     handleConfig).\n * ⛔ A FAILED LOAD CAN ANSWER 200. load.go writes the adapter's WARNINGS to the body before it\n *   runs the config; if the run then fails, the error JSON is appended to a response whose status\n *   is already 200. The Caddyfile adapter warns on every unformatted input (adapter.go\n *   FormattingDifference), so this is the COMMON failure shape, not an edge. The SDK's own\n *   `CaddyProtocol` (`packages/distilled-caddy/src/protocol.ts`) scans `loadConfig`'s body for the\n *   embedded error on every status and fails with the typed `LoadRefused` — `catchTag`'d below,\n *   never a status check here. The lifecycle also reads the config back after every load anyway\n *   (config-lifecycle.ts).\n */\nimport * as Effect from 'effect/Effect';\nimport * as Caddy from '@distilled.cloud/caddy';\n\nconst CADDYFILE = 'text/caddyfile';\n\ntype Warning = { readonly file?: string; readonly line?: number; readonly message?: string };\n\nconst describe = (warning: Warning): string =>\n  `${warning.file ?? 'Caddyfile'}:${String(warning.line ?? 0)}: ${warning.message ?? '(no message)'}`;\n\nexport type Adapted = { readonly config: unknown; readonly warnings: readonly string[] };\n\n/** Adapt a Caddyfile to JSON on the running Caddy, without loading it. */\nexport const adaptCaddyfile = (\n  caddyfile: string,\n): Effect.Effect<Adapted, Caddy.CaddyOpError, Caddy.CaddyOpContext> =>\n  Effect.map(\n    Caddy.Services.admin.adaptConfig({ config: caddyfile, contentType: CADDYFILE }),\n    (response) => ({\n      config: response.result ?? null,\n      warnings: (response.warnings ?? []).map(describe),\n    }),\n  );\n\n/** The running config, parsed; `null` when Caddy runs with none. */\nexport const readRunningConfig = (): Effect.Effect<\n  unknown,\n  Caddy.CaddyOpError,\n  Caddy.CaddyOpContext\n> => Effect.map(Caddy.Services.admin.getConfig({ path: '' }), (response) => response.value ?? null);\n\n/**\n * Apply a Caddyfile with `POST /load`; resolves with the adapter's warnings. A refused load\n * (`LoadRefused` — the ⛔ above) propagates as that typed error, unretried by anything in this\n * file — config-lifecycle.ts's `reconcileConfig` is where a refusal turns into a message naming\n * what is still running.\n *\n * ★ `sourceFile` RIDES AS `Caddy-Config-Source-File` (+ `-Adapter: caddyfile`), the headers\n *   `caddy reload` sends (cmd/commandfuncs.go). A load WITHOUT them makes Caddy forget the file it\n *   was started with (caddy.go ClearLastConfigIfDifferent), and SIGUSR1 then no longer reloads\n *   from that file. With them, and the same path, it keeps it.\n */\nexport const loadCaddyfile = (\n  caddyfile: string,\n  sourceFile?: string,\n): Effect.Effect<readonly string[], Caddy.CaddyOpError, Caddy.CaddyOpContext> =>\n  Effect.map(\n    Caddy.Services.admin.loadConfig({\n      config: caddyfile,\n      contentType: CADDYFILE,\n      ...(sourceFile === undefined ? {} : { sourceAdapter: 'caddyfile', sourceFile }),\n    }),\n    (response) => (response.warnings ?? []).map(describe),\n  );\n",
     "/**\n * Refuse a config whose `admin` block would cut the provider off from Caddy, or expose the admin\n * API — checked on the ADAPTED JSON (`POST /adapt`), before anything is loaded.\n *\n * ⛔ A Caddyfile can move its own admin endpoint. After `POST /load`, Caddy swaps the admin server\n *   to the new config's (admin.go replaceLocalAdminServer), so each of these would succeed ONCE and\n *   then strand the resource — no read-back, no drift check, no next deploy — or worse:\n *   · `admin off` (`disabled`): nothing can manage this Caddy through its API again.\n *   · a `listen` off loopback (`:2019`, `0.0.0.0:2019`, a LAN address): the unauthenticated API is\n *     on the network. Decision 23: never expose :2019.\n *   · a `listen` on another port, socket or loopback ADDRESS than the transport's: the provider\n *     loses Caddy. Go binds exactly the literal address given (`[::1]:2019` is not reachable at\n *     `127.0.0.1:2019`), and a hostname binds its first IPv4 address (net ListenConfig.Listen,\n *     `addrs.first(isIPv4)`), so `localhost:2019` is `127.0.0.1:2019`. MEASURED 2026-09-21 on a\n *     throwaway Caddy 2.11.4: after loading `admin [::1]:<p>`, `127.0.0.1:<p>` refused the\n *     connection; after `admin localhost:<p>`, `[::1]:<p>` did.\n *   · NO `admin` address at all: Caddy falls back to DefaultAdminListen — `localhost:2019`, or\n *     `$CADDY_ADMIN` in ITS environment (admin.go replaceLocalAdminServer), which this side cannot\n *     see. A Caddy reached any other way (a socket, another port) moves there on the first load.\n *     Refused unless the transport is at that default; declaring `admin <address>` is the fix.\n *   · a Host the new config does not allow: `origins` without it, or — with no `origins` — a Host\n *     outside Caddy's loopback defaults (`localhost`, `[::1]`, `127.0.0.1` at the listen port).\n *     Every later call answers 403 (admin.go allowedOrigins / checkHost; MEASURED on a Mac host's\n *     Caddy 2.11.4 — `host not allowed`). The transport also sends `Origin: http://<Host>`, which\n *     Caddy checks against the same list (originAllowed), so one check covers both.\n *   · `enforce_origin` over a unix socket: this transport, like Caddy's CLI (cmd/commandfuncs.go\n *     AdminAPIRequest), sends no Origin there, and a unix listener has no default origins — so\n *     checkOrigin answers 403 to every call. MEASURED 2026-09-21 on a throwaway Caddy 2.11.4:\n *     `client is not allowed to access from origin ''`, and that Caddy could not be managed again.\n *   · `remote`: a second, network-facing admin listener (mTLS on :2021) — declare that deliberately,\n *     not through this resource.\n *   · `config.load`: Caddy pulls its config from elsewhere, replacing this one on a timer.\n * ★ Read in caddyserver/caddy v2.11.4: admin.go AdminConfig / allowedOrigins / originAllowed, and\n *   httpcaddyfile/options.go parseOptAdmin (an `admin { … }` block with no address still emits\n *   `listen` as the default, so a present `listen` is the norm, not a change).\n */\nimport type { CaddyAdminListener } from './admin.ts';\n\ntype AdminBlock = {\n  disabled?: boolean;\n  listen?: string;\n  origins?: string[];\n  enforce_origin?: boolean;\n  remote?: unknown;\n  config?: { load?: unknown };\n};\n\n/** Caddy's compiled-in admin port (admin.go DefaultAdminListen `localhost:2019`). */\nconst DEFAULT_ADMIN_PORT = 2019;\n\nconst LOOPBACK_HOST = /^(?:localhost|127(?:\\.\\d{1,3}){3}|\\[?::1\\]?)$/;\n\ntype Listen = { kind: 'tcp'; host: string; port: number } | { kind: 'unix'; path: string };\n\n/** Caddy network address → a listener, or a description of why it is not one we can check. */\nconst parseListen = (listen: string): Listen | string => {\n  if (listen.includes('{')) return 'a placeholder, which cannot be checked before it runs';\n  const unix = /^unix(?:gram|packet)?\\/(.+?)(?:\\|[0-7]{3,4})?$/.exec(listen);\n  if (unix !== null) return { kind: 'unix', path: unix[1] ?? '' };\n  if (/^[a-z0-9]+\\//.test(listen) && !/^tcp[46]?\\//.test(listen)) {\n    return `network ${JSON.stringify(listen.split('/')[0])}, not tcp or unix`;\n  }\n  const address = listen.replace(/^tcp[46]?\\//, '');\n  const colon = address.lastIndexOf(':');\n  const port = Number(address.slice(colon + 1));\n  if (colon === -1 || !Number.isInteger(port) || port <= 0) return 'no single port';\n  return { host: address.slice(0, colon), kind: 'tcp', port };\n};\n\nconst unbracket = (host: string): string => host.replace(/^\\[(.*)\\]$/, '$1');\n\n/**\n * Whether a transport sending `hostHeader` reaches a listener bound to `listenHost`.\n * ★ The Host stands in for the dial address: they are the same unless `hostHeader` was set for a\n *   forward, where it should name the far side's address anyway. `localhost` on the transport's\n *   side may resolve to either family (node tries both), so it reaches any loopback listener; a\n *   literal address reaches only itself.\n */\nconst reaches = (hostHeader: string, listenHost: string): boolean => {\n  const dialled = unbracket(hostHeader.slice(0, hostHeader.lastIndexOf(':')));\n  const listening = unbracket(listenHost);\n  return (\n    dialled === 'localhost' || dialled === (listening === 'localhost' ? '127.0.0.1' : listening)\n  );\n};\n\nconst sameListener = (listen: Listen, transport: CaddyAdminListener): boolean =>\n  listen.kind === 'tcp'\n    ? transport.kind === 'tcp' &&\n      listen.port === transport.port &&\n      reaches(transport.hostHeader, listen.host)\n    : transport.kind === 'unix' && listen.path === transport.path;\n\n/** Caddy's allowed Hosts for a loopback listener with no `origins` (admin.go allowedOrigins). */\nconst defaultOrigins = (port: number): string[] =>\n  ['localhost', '[::1]', '127.0.0.1'].map((host) => `${host}:${String(port)}`);\n\nconst originHost = (origin: string): string | undefined => {\n  if (!origin.includes('://')) return origin;\n  try {\n    const url = new URL(origin);\n    // ⚠️ originAllowed compares schemes when an entry has one; the transport sends `http://`.\n    return url.protocol === 'http:' ? url.host : undefined;\n  } catch {\n    return undefined;\n  }\n};\n\nconst listenProblem = (admin: AdminBlock, transport: CaddyAdminListener): string | undefined => {\n  if (admin.listen === undefined) {\n    const atDefault =\n      transport.kind === 'tcp' &&\n      transport.port === DEFAULT_ADMIN_PORT &&\n      reaches(transport.hostHeader, 'localhost');\n    return atDefault\n      ? undefined\n      : 'no `admin` address: Caddy would fall back to its default listener (localhost:2019, or ' +\n          '$CADDY_ADMIN), away from where this provider reaches it — declare `admin <address>`';\n  }\n  const listen = parseListen(admin.listen);\n  const shown = JSON.stringify(admin.listen);\n  if (typeof listen === 'string') {\n    return `admin listen ${shown} is ${listen}; declare a literal loopback address`;\n  }\n  if (listen.kind === 'tcp' && !LOOPBACK_HOST.test(listen.host)) {\n    return `admin listen ${shown} is not loopback — it would put the admin API on the network`;\n  }\n  return sameListener(listen, transport)\n    ? undefined\n    : `admin listen ${shown} moves the admin API away from where this provider reaches it`;\n};\n\n/** Refusals for the adapted config's `admin` block, given where the transport reaches Caddy. */\nexport const adminProblems = (adapted: unknown, transport: CaddyAdminListener): string[] => {\n  const admin =\n    typeof adapted === 'object' && adapted !== null\n      ? ((adapted as { admin?: AdminBlock }).admin ?? {})\n      : {};\n  const found: string[] = [];\n  if (admin.disabled === true) {\n    return ['`admin off` would disable the admin API this resource manages Caddy through'];\n  }\n  if (admin.remote !== undefined) found.push('`admin.remote` opens a network-facing admin API');\n  if (admin.config?.load !== undefined) {\n    found.push(\n      '`admin.config.load` makes Caddy pull its config from elsewhere, replacing this one',\n    );\n  }\n  const moved = listenProblem(admin, transport);\n  if (moved !== undefined) found.push(moved);\n  if (transport.kind === 'tcp') {\n    const allowed = admin.origins?.map(originHost) ?? defaultOrigins(transport.port);\n    if (!allowed.includes(transport.hostHeader)) {\n      const which =\n        admin.origins === undefined\n          ? `Caddy's default origins (no \\`origins\\` declared) ${JSON.stringify(allowed)}`\n          : `admin origins ${JSON.stringify(admin.origins)}`;\n      found.push(\n        `${which} do not allow Host ${transport.hostHeader}, which this provider sends — ` +\n          'Caddy would refuse it every call after this one',\n      );\n    }\n  } else if (admin.enforce_origin === true) {\n    found.push(\n      '`enforce_origin` over a unix socket: this transport (like the Caddy CLI) sends no Origin ' +\n        'there, so Caddy would answer 403 to every call',\n    );\n  }\n  return found;\n};\n",
+    "/**\n * Turning a distilled `@distilled.cloud/caddy` operation failure into a readable refusal — shared\n * by config-lifecycle.ts and config-reconcile.ts, so both read the same way.\n */\nimport * as Effect from 'effect/Effect';\nimport type * as Caddy from '@distilled.cloud/caddy';\nimport { isUnreachable } from './caddy-http-client.ts';\n\nexport const refuse = (endpoint: string, message: string): Error =>\n  new Error(`Caddy.Config at ${endpoint}: ${message}`);\n\nexport const short = (digest: string): string => digest.slice(0, 12);\n\n/** Every `CaddyOpError` member carries `.message` (a `Schema.TaggedError` field) — see errors.ts. */\nexport const messageOf = (error: Caddy.CaddyOpError): string =>\n  'message' in error && typeof error.message === 'string' ? error.message : String(error);\n\n/**\n * A distilled operation's typed failure, read the way this resource's own refusals read:\n * `LoadRefused` (the 200-embedded-error trap admin-calls.ts's module doc describes) says so\n * explicitly, so a grep for \"kept the previous config\" is never mistaken for an ordinary 4xx/5xx.\n */\nexport const operationFailure = (endpoint: string, op: string, error: Caddy.CaddyOpError): Error =>\n  error._tag === 'LoadRefused'\n    ? refuse(\n        endpoint,\n        `Caddy refused the Caddyfile (${error._tag}, a 200 whose body carried the error, not a ` +\n          `failure status) — ${error.message}`,\n      )\n    : refuse(endpoint, `${op} failed (${error._tag}) — ${messageOf(error)}`);\n\n/**\n * Humanizes every failure from a distilled operation EXCEPT one nothing accepted the connection\n * for — that stays the raw, still-typed `HttpClientError` so config.ts's plan-time escape hatch\n * (`Effect.catchIf(isUnreachable, …)`) can keep narrowing to it after this wrapping, the same way\n * it could inspect the un-wrapped error before this function ran.\n */\nexport const wrapOperation =\n  (endpoint: string, op: string) =>\n  <A>(\n    effect: Effect.Effect<A, Caddy.CaddyOpError, Caddy.CaddyOpContext>,\n  ): Effect.Effect<A, Error | Caddy.CaddyOpError, Caddy.CaddyOpContext> =>\n    effect.pipe(\n      Effect.mapError((error) =>\n        isUnreachable(error) ? error : operationFailure(endpoint, op, error),\n      ),\n    );\n",
     "/**\n * A tripwire for the obvious ways a secret ends up in Alchemy state through these providers.\n *\n * ⛔ WHY IT EXISTS. Alchemy persists every prop UNENCRYPTED in its state store — the same reason\n *   the OpenBao families are metadata-only (openbao/policy.ts). A LaunchdJob's `environment` and\n *   `programArguments`, and a HostFile's `content`, are props. A token declared there is a token\n *   copied into the state store, into every plan diff, and into the plist or file on disk.\n * ★ THE ALTERNATIVE, NAMED IN EVERY REFUSAL: let a secret renderer (openbao-agent, or any other)\n *   write the secret to a root-owned file, and declare only its PATH — `FOO_TOKEN_FILE=/path`,\n *   `--token-file /path`. The job reads the file at start; the state holds a path.\n *\n * ⚠️ A TRIPWIRE, NOT A SCANNER. It catches the names and shapes people actually type. A token in\n *   an innocently named variable passes; nothing here can make a secret safe to declare.\n */\nimport type { PlistDict, PlistValue } from './plist.ts';\n\nconst ALTERNATIVE =\n  'props are stored unencrypted in Alchemy state. Have a secret renderer (e.g. openbao-agent) ' +\n  'write it to a root-owned file and declare the file path instead (FOO_FILE=/path, --foo-file /path).';\n\n/** Names that end in a word meaning \"this is the secret itself\". `*_FILE`, `*_PATH` never match. */\nconst SECRET_NAME =\n  /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|API_?KEY|ACCESS_KEY|PRIVATE_KEY|SECRET_KEY|CREDENTIALS?)$/i;\n\n/** `--token=…` / `-password=…` style flags carrying their value inline. */\nconst INLINE_FLAG = /^--?[a-z0-9-]*(?:token|password|passwd|passphrase|secret|api-?key)=./i;\n\n/** A flag whose NEXT argv element is the secret: `--token abc`. */\nconst BARE_FLAG = /^--?(?:[a-z0-9]+-)*(?:token|password|passwd|passphrase|secret|api-?key)$/i;\n\nexport const PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;\n\n/** Paths of every string leaf in a plist value holding a private key. */\nconst keyLeaves = (value: PlistValue, path: string): string[] => {\n  if (typeof value === 'string') return PRIVATE_KEY.test(value) ? [path] : [];\n  if (Array.isArray(value)) {\n    return (value as readonly PlistValue[]).flatMap((item, index) =>\n      keyLeaves(item, `${path}[${String(index)}]`),\n    );\n  }\n  if (typeof value === 'object' && value !== null) {\n    return Object.entries(value).flatMap(([key, item]) => keyLeaves(item, `${path}.${key}`));\n  }\n  return [];\n};\n\n/**\n * Refusals for a job's environment, argv and extraKeys. Empty means nothing tripped.\n * ★ extraKeys too: it is a prop like the others, so it lands in state just the same.\n */\nexport const jobSecretProblems = (\n  environment: Readonly<Record<string, string>> | undefined,\n  argv: readonly string[],\n  extraKeys?: PlistDict,\n): string[] => {\n  const found: string[] = [];\n  for (const [name, value] of Object.entries(environment ?? {})) {\n    if (SECRET_NAME.test(name))\n      found.push(`environment ${name} looks like a secret: ${ALTERNATIVE}`);\n    else if (PRIVATE_KEY.test(value))\n      found.push(`environment ${name} holds a private key: ${ALTERNATIVE}`);\n  }\n  for (const [index, arg] of argv.entries()) {\n    // ⛔ Never echo the argument itself: if it IS a secret, the refusal would print it.\n    if (INLINE_FLAG.test(arg)) {\n      found.push(`programArguments[${String(index)}] passes a secret inline: ${ALTERNATIVE}`);\n    } else if (BARE_FLAG.test(arg) && index + 1 < argv.length) {\n      found.push(`programArguments[${String(index + 1)}] follows a secret flag: ${ALTERNATIVE}`);\n    } else if (PRIVATE_KEY.test(arg)) {\n      found.push(`programArguments[${String(index)}] holds a private key: ${ALTERNATIVE}`);\n    }\n  }\n  for (const path of keyLeaves(extraKeys ?? {}, 'extraKeys')) {\n    found.push(`${path} holds a private key: ${ALTERNATIVE}`);\n  }\n  return found;\n};\n\n/** Refusals for a HostFile's content. */\nexport const fileSecretProblems = (content: string): string[] =>\n  PRIVATE_KEY.test(content) ? [`content holds a private key: ${ALTERNATIVE}`] : [];\n",
     "/**\n * A tripwire for the obvious ways a secret ends up in a CaddyConfig's `caddyfile` prop.\n *\n * ⛔ WHY IT EXISTS. Alchemy stores every prop UNENCRYPTED in its state store and prints it in plan\n *   diffs (the reason launchd's secret-tripwire.ts and the metadata-only OpenBao families exist).\n *   The whole Caddyfile is one prop, so a token typed into it is a token in state.\n * ★ THE ALTERNATIVE, NAMED IN EVERY REFUSAL: a RUNTIME placeholder, which Caddy resolves in its own\n *   process and which therefore never enters the Caddyfile, the state, the adapted JSON or\n *   `autosave.json` (caddyserver/caddy v2.11.4 replacer.go):\n *   · `{env.NAME}` — the Caddy process's environment; start Caddy with `--envfile <path>` where a\n *     secret renderer (openbao-agent) writes that file. A rotated value needs a Caddy restart.\n *   · `{file./path}` — the file's contents, trailing newline trimmed, read when the placeholder is\n *     evaluated; the renderer writes the file.\n * ⚠️ `{$NAME}` IS NOT ONE OF THEM. It is substituted at ADAPT time (caddyfile/parse.go\n *   replaceEnvVars), so the value lands in the adapted JSON — readable at `GET /config/` and\n *   written to `autosave.json`. It is not refused (the prop holds only the name), but it is worse.\n *   `{$NAME:default}` is different: the default IS in the prop, and is checked as a literal.\n * ⚠️ A TRIPWIRE, NOT A SCANNER. It catches the names and shapes people actually type; a secret in\n *   an innocent-looking argument passes. Nothing here makes a secret safe to declare.\n */\nimport { PRIVATE_KEY } from '../launchd/secret-tripwire.ts';\n\nconst ALTERNATIVE =\n  'props are stored unencrypted in Alchemy state. Use a runtime placeholder instead: {env.NAME} ' +\n  '(Caddy started with --envfile <file a secret renderer writes>) or {file./path/to/secret}.';\n\n/** A subdirective whose whole name says \"my argument is the secret\". `*_file` never matches. */\nconst SECRET_WORD =\n  /^(?:token|api_token|auth_token|access_token|secret|client_secret|shared_secret|secret_key|password|passwd|passphrase|api_key|apikey|private_key|mac_key|hmac_key)$/i;\n\n/** Directives whose second argument is a DNS provider's credential: `dns cloudflare <token>`. */\nconst DNS_DIRECTIVE = /^(?:dns|acme_dns)$/;\n\nconst HEADER_DIRECTIVE = /^(?:header|header_up|header_down|request_header)$/;\nconst CREDENTIAL_HEADER =\n  /^[+-]?(?:authorization|proxy-authorization|cookie|x-api-key|api-key|x-auth-token|x-vault-token)$/i;\n\n/** Shapes that are a credential wherever they appear. The label is what the refusal says. */\nconst SHAPES: readonly (readonly [RegExp, string])[] = [\n  [/^(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{20,})$/, 'a GitHub token'],\n  [/^(?:AKIA|ASIA)[0-9A-Z]{16}$/, 'an AWS access key id'],\n  [/^xox[abposr]-[A-Za-z0-9-]{10,}$/, 'a Slack token'],\n  [/^sk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}$/, 'an API secret key'],\n  [/^eyJ[A-Za-z0-9_-]{8,}\\.eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}$/, 'a JWT'],\n  // ★ basic_auth replaces placeholders in the hash at provision time (caddyauth/basicauth.go\n  //   Provision), so `{env.ADMIN_HASH}` works and a literal hash never needs to be declared.\n  [/^\\$2[abxy]?\\$\\d{2}\\$[./A-Za-z0-9]{53}$/, 'a bcrypt password hash'],\n  [/^\\$argon2(?:id|i|d)\\$/, 'an argon2 password hash'],\n];\n\nconst PLACEHOLDER = /\\{[^{}\\s]+\\}/g;\nconst AUTH_SCHEME = /^(?:bearer|basic|token|digest)$/i;\n\n/**\n * ⛔ `{$NAME:default}` IS A LITERAL. Caddy splices the default in at ADAPT time whenever NAME is\n *   unset (caddyfile/parse.go replaceEnvVars: SplitN on `:`), so a secret typed as the default is\n *   in the prop, the state and the adapted JSON. MEASURED 2026-09-21 on a throwaway Caddy 2.11.4:\n *   `respond \"{$UNSET:literal-default}\"` adapted to the body `literal-default`. So each line is\n *   checked as Caddy sees it with every such variable unset. The RUNTIME replacer has no default\n *   syntax (replacer.go looks the whole key up), so `{env.X}` stays the safe form.\n */\nconst ENV_DEFAULT = /\\{\\$[^{}\\s:]*:([^}]*)\\}/g;\nconst withDefaults = (line: string): string => line.replace(ENV_DEFAULT, '$1');\n\n/** One line's tokens: whitespace-separated, \"double-quoted\" and `backquoted` kept whole, # comments dropped. */\nexport const tokensOf = (line: string): string[] => {\n  const tokens: string[] = [];\n  let current = '';\n  let quote: string | undefined;\n  for (let index = 0; index < line.length; index += 1) {\n    const char = line[index] ?? '';\n    if (quote !== undefined) {\n      if (char === '\\\\' && quote === '\"' && index + 1 < line.length) {\n        index += 1;\n        current += line[index] ?? '';\n      } else if (char === quote) quote = undefined;\n      else current += char;\n    } else if (char === '\"' || char === '`') {\n      quote = char;\n    } else if (/\\s/.test(char)) {\n      if (current !== '') tokens.push(current);\n      current = '';\n    } else if (char === '#' && current === '') {\n      break; // a comment starts only at the beginning of a token (caddyfile lexer)\n    } else current += char;\n  }\n  if (current !== '') tokens.push(current);\n  return tokens;\n};\n\n/**\n * True when nothing but placeholders (and an auth scheme word) is left of these tokens.\n * ⚠️ A bare `{` / `}` is a block brace, not a value: `dns cloudflare {` opens a block whose\n *   `api_token` line is checked on its own.\n */\nconst placeholderOnly = (tokens: readonly string[]): boolean =>\n  tokens\n    .flatMap((token) => token.replace(PLACEHOLDER, ' ').split(/\\s+/))\n    .filter((part) => part !== '' && part !== '{' && part !== '}' && !AUTH_SCHEME.test(part))\n    .length === 0;\n\nconst lineProblems = (tokens: readonly string[], where: string): string[] => {\n  const [first = '', second] = tokens;\n  const found: string[] = [];\n  if (SECRET_WORD.test(first) && tokens.length > 1 && !placeholderOnly(tokens.slice(1))) {\n    found.push(`${where}: \\`${first}\\` has a literal value`);\n  }\n  if (DNS_DIRECTIVE.test(first) && tokens.length > 2 && !placeholderOnly(tokens.slice(2))) {\n    found.push(`${where}: \\`${first} ${second ?? ''}\\` has a literal credential`);\n  }\n  if (HEADER_DIRECTIVE.test(first)) {\n    const at = tokens.findIndex((token, index) => index > 0 && CREDENTIAL_HEADER.test(token));\n    if (at !== -1 && tokens.length > at + 1 && !placeholderOnly(tokens.slice(at + 1))) {\n      found.push(`${where}: \\`${first} ${tokens[at] ?? ''}\\` sets a literal credential`);\n    }\n  }\n  for (const token of tokens) {\n    const shape = SHAPES.find(([pattern]) => pattern.test(token));\n    // ⛔ Never echo the token: if it IS a secret, the refusal would print it.\n    if (shape !== undefined) found.push(`${where}: holds what looks like ${shape[1]}`);\n  }\n  return found;\n};\n\n/** Refusals for a Caddyfile's text. Empty means nothing tripped. */\nexport const caddyfileSecretProblems = (caddyfile: string): string[] => {\n  const found: string[] = [];\n  if (PRIVATE_KEY.test(caddyfile)) found.push('the Caddyfile holds a PEM private key');\n  for (const [index, line] of caddyfile.split('\\n').entries()) {\n    found.push(...lineProblems(tokensOf(withDefaults(line)), `line ${String(index + 1)}`));\n  }\n  return found.map((problem) => `${problem}: ${ALTERNATIVE}`);\n};\n",
     "/**\n * CaddyConfig's props, attributes and validation — the pure half of the provider.\n *\n * ⛔ `caddyfile` IS NEVER A SECRET. Alchemy stores props unencrypted, so the whole Caddyfile sits in\n *   the state store and in every plan diff. Secrets reach Caddy as runtime placeholders\n *   (`{env.NAME}`, `{file./path}`) resolved from files a secret renderer writes — see\n *   caddyfile-tripwire.ts, which refuses the obvious literals.\n */\nimport { caddyfileSecretProblems } from './caddyfile-tripwire.ts';\n\nexport interface CaddyConfigProps {\n  /**\n   * The whole Caddyfile. Applied with `POST /load` (Content-Type `text/caddyfile`); it REPLACES the\n   * running config. ⛔ Never a secret. ⚠️ `import` paths resolve against Caddy's working directory\n   * (the API adapts with no file name), so keep them absolute.\n   */\n  caddyfile: string;\n  /**\n   * The file Caddy was started with (`caddy run --config <this>`), when the same Caddyfile is also\n   * written there — `caddyWithFile()` sets it from its HostFile. Sent as\n   * `Caddy-Config-Source-File` so a load keeps Caddy's SIGUSR1 reload-from-file working.\n   */\n  sourceFile?: string;\n}\n\nexport interface CaddyConfigAttributes {\n  /**\n   * SHA-256 of the ADAPTED JSON Caddy reported after the last apply (digest.ts canonical form) —\n   * never the config itself. Drift is the live config hashing to anything else.\n   */\n  configSha256: string;\n  /** The admin endpoint the config was applied through (no credential; the API has none). */\n  endpoint: string;\n  /** The `sourceFile` prop as applied. */\n  sourceFile?: string;\n}\n\nconst absoluteNormalised = (path: string): boolean =>\n  path.startsWith('/') &&\n  !path.endsWith('/') &&\n  !path.includes('\\x00') &&\n  !path\n    .split('/')\n    .slice(1)\n    .some((part) => part === '' || part === '.' || part === '..');\n\nexport const configProblems = (props: CaddyConfigProps): string[] => {\n  const found: string[] = [];\n  /**\n   * ⛔ AN EMPTY CADDYFILE IS NOT \"NOTHING TO DO\". It adapts to a config with no apps, and loading\n   *   it stops every server Caddy runs — every site down, on a templating bug that rendered ''.\n   *   Emptying Caddy is a deliberate act for a person at the admin API, not a declaration.\n   *   Text that is not empty but serves nothing (only comments, only global options) is caught\n   *   after `/adapt`, where it shows as no apps (config-lifecycle.ts servesNothing).\n   */\n  if (props.caddyfile.trim() === '') {\n    found.push('caddyfile is empty — loading it would stop every site Caddy serves');\n  }\n  if (props.sourceFile !== undefined && !absoluteNormalised(props.sourceFile)) {\n    found.push('sourceFile must be an absolute, normalised path');\n  }\n  found.push(...caddyfileSecretProblems(props.caddyfile));\n  return found;\n};\n",
-    "/**\n * CaddyConfig's read / diff / reconcile as plain async functions over a CaddyAdmin, so the\n * lifecycle runs against a fake admin server in tests.\n *\n * The comparison is always between DIGESTS OF ADAPTED JSON (digest.ts): what `POST /adapt` makes\n * of the declared Caddyfile, what `GET /config/` reports, and what was stored after the last\n * apply. Three digests, because they answer different questions:\n *   · declared ≠ stored — the declaration changed.\n *   · live ≠ stored — DRIFT: a hand `curl` to the API, or a restart that loaded a different file\n *     (or an `autosave.json` holding someone else's change, under `--resume`).\n *   · declared = live — nothing to load, whatever the state says.\n * With NO state there is no stored digest, and the question is whose config is running: see\n * `claimable` below, which both the adoption probe and the apply ask.\n */\nimport type { Diff } from 'alchemy/Diff';\nimport { type CaddyAdmin, CaddyUnreachableError } from './admin.ts';\nimport {\n  CaddyAdminError,\n  adaptCaddyfile,\n  loadCaddyfile,\n  readRunningConfig,\n} from './admin-calls.ts';\nimport { adminProblems } from './admin-guard.ts';\nimport {\n  type CaddyConfigAttributes,\n  type CaddyConfigProps,\n  configProblems,\n} from './config-form.ts';\nimport { configDigest } from './digest.ts';\n\nconst refuse = (admin: CaddyAdmin, message: string): Error =>\n  new Error(`Caddy.Config at ${admin.endpoint}: ${message}`);\n\nconst short = (digest: string): string => digest.slice(0, 12);\n\ntype Desired = { readonly digest: string; readonly warnings: readonly string[] };\n\n/**\n * ⛔ A CONFIG WITH NO APPS SERVES NOTHING. A Caddyfile of only comments or only global options\n *   passes the empty-text check (config-form.ts) yet adapts to `{}` or `{\"admin\":…}` — MEASURED\n *   2026-09-21 on a throwaway Caddy 2.11.4 — and loading it stops every server: the same outage,\n *   from the same templating bug, that the empty check exists to prevent.\n */\nconst servesNothing = (config: unknown): boolean => {\n  const apps =\n    typeof config === 'object' && config !== null ? (config as { apps?: unknown }).apps : undefined;\n  return typeof apps !== 'object' || apps === null || Object.keys(apps).length === 0;\n};\n\n/**\n * Validate the props, adapt the Caddyfile on the running Caddy, and check its `admin` block.\n * ★ Every refusal happens HERE, before anything is loaded — and diff calls this at plan time, so a\n *   Caddyfile that does not adapt, carries a literal secret, or would strand the admin API fails the\n *   PLAN, before any resource (a HostFile holding the same text included) is applied.\n */\nexport const desiredConfig = async (\n  admin: CaddyAdmin,\n  props: CaddyConfigProps,\n): Promise<Desired> => {\n  const found = configProblems(props);\n  if (found.length > 0) throw refuse(admin, found.join('; '));\n  const adapted = await adaptCaddyfile(admin, props.caddyfile);\n  if (servesNothing(adapted.config)) {\n    throw refuse(admin, 'the Caddyfile adapts to no apps — loading it would stop every site');\n  }\n  const guard = adminProblems(adapted.config, admin.listener);\n  if (guard.length > 0) throw refuse(admin, guard.join('; '));\n  return { digest: configDigest(adapted.config), warnings: adapted.warnings };\n};\n\nconst attributesOf = (\n  admin: CaddyAdmin,\n  running: unknown,\n  sourceFile?: string,\n): CaddyConfigAttributes => ({\n  configSha256: configDigest(running),\n  endpoint: admin.endpoint,\n  ...(sourceFile === undefined ? {} : { sourceFile }),\n});\n\n/** What is running now, as attributes. `sourceFile` is carried over, never discovered. */\nexport const readLive = async (\n  admin: CaddyAdmin,\n  sourceFile?: string,\n): Promise<CaddyConfigAttributes> =>\n  attributesOf(admin, await readRunningConfig(admin), sourceFile);\n\n/**\n * ⛔ WITH NO STATE, A RUNNING CONFIG IS THIS STACK'S ONLY IF IT IS THE DECLARED ONE (decision,\n *   2026-09-21: CaddyConfig must not adopt silently — the house rule HostFile and LaunchdJob keep).\n *   Anything else was put there by a person, another tool or another stack, and loading over it\n *   replaces every site it serves. ★ A config that serves nothing (`null`, or no apps) is claimable\n *   too: there is nothing to take over, as an empty R2 lock rule set reads as no lock.\n */\nexport const claimable = (running: unknown, declaredDigest: string): boolean =>\n  servesNothing(running) || configDigest(running) === declaredDigest;\n\nexport type Probe = {\n  readonly attributes: CaddyConfigAttributes;\n  /** The live config IS the declared one: adopting it changes nothing. */\n  readonly ours: boolean;\n  /** Why the declaration could not be compared, when it could not — the Caddy is then not ours. */\n  readonly unchecked?: string;\n};\n\n/**\n * The adoption probe — `read` with no state: `undefined` when Caddy serves nothing (plan a create),\n * else the live attributes and whether they are provably ours (the provider brands the rest\n * `Unowned`, and the plan refuses them without `--adopt`).\n * ⛔ IT NEVER THROWS OVER THE DECLARATION. The engine also runs this read to recover an interrupted\n *   create, with THAT deploy's props (Plan.ts, `status: \"creating\"`) — so a Caddyfile that failed to\n *   adapt then would fail every later plan, the one carrying the fix included. What cannot be\n *   compared is \"not proven ours\", with the reason; the next diff or apply validates the Caddyfile.\n */\nexport const probeLive = async (\n  admin: CaddyAdmin,\n  caddyfile: string | undefined,\n  sourceFile?: string,\n): Promise<Probe | undefined> => {\n  const running = await readRunningConfig(admin);\n  if (servesNothing(running)) return undefined;\n  const attributes = attributesOf(admin, running, sourceFile);\n  if (caddyfile === undefined) {\n    return { attributes, ours: false, unchecked: 'the stored Caddyfile is not plain text' };\n  }\n  try {\n    const want = await desiredConfig(admin, { caddyfile });\n    return { attributes, ours: claimable(running, want.digest) };\n  } catch (cause) {\n    // ⚠️ Unreachable mid-probe is still \"no Caddy\" (config.ts plans without it), not \"not ours\".\n    if (cause instanceof CaddyUnreachableError) throw cause;\n    return {\n      attributes,\n      ours: false,\n      unchecked: cause instanceof Error ? cause.message : String(cause),\n    };\n  }\n};\n\n/**\n * ★ NEVER `replace`. Nothing in the props names a different object: a new Caddyfile is a reload of\n *   the same Caddy, and `sourceFile` is a header. (Which Caddy is the transport's business — see\n *   the ⚠️ on `endpoint` in the diff.)\n */\nexport const diffConfig = async (\n  admin: CaddyAdmin,\n  news: CaddyConfigProps,\n  output: CaddyConfigAttributes,\n): Promise<Diff> => {\n  const want = await desiredConfig(admin, news);\n  const live = await readLive(admin);\n  const converged =\n    want.digest === live.configSha256 &&\n    live.configSha256 === output.configSha256 &&\n    news.sourceFile === output.sourceFile &&\n    // ⚠️ A stack whose transport now reaches ANOTHER Caddy (a new address) must load there; the\n    //   old one keeps what it has — the same as a delete, which never unloads (see config.ts).\n    //   Planned as an update, but the state does not vouch for that Caddy: see Authority.\n    admin.endpoint === output.endpoint;\n  return converged ? { action: 'noop' } : { action: 'update' };\n};\n\nexport type Applied = {\n  readonly attributes: CaddyConfigAttributes;\n  /** The adapter's warnings (e.g. \"Caddyfile input is not formatted\") — log them, never refuse. */\n  readonly warnings: readonly string[];\n  /** Whether a `POST /load` was sent (false when Caddy already ran this config). */\n  readonly loaded: boolean;\n};\n\n/**\n * What this apply may load over — config.ts decides from the state and the adopt setting:\n *   · `takeOver` — any running config: the state was applied to THIS Caddy (an update, drift\n *     correction, or a create the engine adopted), or adoption is on (`--adopt`, or the\n *     resource's own `adopt(true)` — ownership/adopt.ts adoptEnabled).\n *   · otherwise only a claimable one — plus, as `stored`, the digest the state last recorded: a\n *     Caddy reached at a NEW endpoint that runs exactly that is the same config under another name.\n */\nexport type Authority = { readonly takeOver: boolean; readonly stored?: string };\n\n/**\n * Load the Caddyfile unless Caddy already runs it, then read it back and insist it matches.\n * ⛔ WITHOUT `takeOver`, A CONFIG THE STACK CANNOT CLAIM IS NEVER LOADED OVER. The engine's adoption\n *   probe cannot guard every create: it is skipped while `news` holds an Output — ALWAYS on\n *   caddyWithFile's first deploy (`sourceFile` is its HostFile's path) — and a Caddy that was down at\n *   plan time read as nothing. Nor does state vouch for a Caddy the transport NOW reaches at another\n *   endpoint (diff plans that as an update). Refused here, before any `/load`, like HostFile's.\n */\nexport const reconcileConfig = async (\n  admin: CaddyAdmin,\n  props: CaddyConfigProps,\n  authority: Authority,\n): Promise<Applied> => {\n  const want = await desiredConfig(admin, props);\n  const running = await readRunningConfig(admin);\n  const before = configDigest(running);\n  const known = before === authority.stored || claimable(running, want.digest);\n  if (!authority.takeOver && !known) {\n    throw refuse(\n      admin,\n      `Caddy runs config ${short(before)}, which this stack did not load, and the Caddyfile adapts ` +\n        `to ${short(want.digest)} — loading it would replace every site that config serves. ` +\n        'Deploy with --adopt (or wrap the resource in adopt(true)) to take this Caddy over, or ' +\n        'point caddyProviders() at the Caddy you meant.',\n    );\n  }\n  let warnings = want.warnings;\n  const loaded = before !== want.digest;\n  if (loaded) {\n    try {\n      warnings = await loadCaddyfile(admin, props.caddyfile, props.sourceFile);\n    } catch (cause) {\n      if (!(cause instanceof CaddyAdminError)) throw cause;\n      // ★ SAY WHAT IS RUNNING NOW. Caddy restores the previous config on a failed load (caddy.go\n      //   changeConfig); confirm it rather than promise it, because the deploy log is where the\n      //   person decides whether sites are down.\n      const after = await readLive(admin).catch(() => undefined);\n      const state =\n        after === undefined\n          ? 'and the running config could not be read back'\n          : after.configSha256 === before\n            ? 'Caddy kept the previous config (still serving)'\n            : `and the running config is now ${short(after.configSha256)}, not the previous ${short(before)}`;\n      throw refuse(admin, `Caddy refused the Caddyfile — ${cause.message}; ${state}`);\n    }\n  }\n  // ⚠️ READ BACK, never echo the declaration: a concurrent writer, or a load Caddy answered 200 but\n  //   did not apply (admin-calls.ts), shows up here as a refusal instead of as stored state that is\n  //   already wrong.\n  const attributes = await readLive(admin, props.sourceFile);\n  if (attributes.configSha256 !== want.digest) {\n    throw refuse(\n      admin,\n      `after the load Caddy runs config ${short(attributes.configSha256)}, not the ` +\n        `${short(want.digest)} this Caddyfile adapts to — another writer changed it, or it was not applied`,\n    );\n  }\n  return { attributes, loaded, warnings };\n};\n",
-    "/**\n * The real CaddyAdmin: this machine's Caddy, over loopback TCP or a unix socket.\n *\n * ★ node:http, NOT fetch. MEASURED 2026-09-21 on bun 1.4.0 and node 26.7.0: node:http sends a Host\n *   override and dials a unix socket on BOTH runtimes, while node's fetch silently drops a `Host`\n *   header (it sent the URL's host) and only Bun's fetch has a `unix` option. The published dist\n *   loads under node too (launchd's local-runner.ts makes the same call for the same reason).\n * ⛔ LOOPBACK OR A UNIX SOCKET, NOTHING ELSE. The admin API is unauthenticated plaintext; an\n *   address off this machine means it is reachable from the network, which decision 23 forbids.\n *   Reaching another host's Caddy means forwarding its socket or port to here (SSH), never\n *   exposing :2019.\n * ★ HOST AND ORIGIN, AS CADDY's OWN CLI SENDS THEM (cmd/commandfuncs.go AdminAPIRequest): over\n *   TCP, `Host` and `Origin: http://<host>`; over a socket, `Host: 127.0.0.1` and no Origin, because\n *   Caddy skips the Host check on unix listeners (admin.go allowedOrigins). MEASURED against the\n *   a Mac host's Caddy 2.11.4: any other Host gets 403 `host not allowed`, a forwarded port included —\n *   hence `hostHeader`.\n */\nimport { request as httpRequest } from 'node:http';\nimport {\n  type CaddyAdmin,\n  type CaddyAdminListener,\n  type CaddyAdminResponse,\n  CaddyUnreachableError,\n} from './admin.ts';\n\nexport type LocalCaddyAdminOptions = {\n  /**\n   * `http://<loopback>:<port>` or `unix:///absolute/path.sock`.\n   * @default 'http://127.0.0.1:2019' — Caddy's default admin listener (`localhost:2019`).\n   */\n  readonly address?: string;\n  /**\n   * The Host (and Origin) to send over TCP, when it is not the address's own: the Caddyfile\n   * narrowed `admin { origins … }`, or the port is an SSH forward of the real one (Caddy checks\n   * the Host against ITS port, not yours). Form `host:port`.\n   */\n  readonly hostHeader?: string;\n  /**\n   * Abort an exchange after this long. @default 60_000\n   * ⚠️ A `shutdown_delay` in the Caddyfile makes `/load` block that long (caddyhttp app.go Stop);\n   *   a timeout then fails the deploy while Caddy goes on to apply — the next plan converges.\n   */\n  readonly timeoutMs?: number;\n  /**\n   * Retries when the connection is REFUSED (nothing listening yet — a Caddy launchd job that was\n   * bootstrapped a moment ago). Only refusals: those never reached Caddy, so re-sending a\n   * `POST /load` cannot apply it twice. @default 2\n   */\n  readonly retries?: number;\n  /** @default 500 */\n  readonly retryDelayMs?: number;\n};\n\nexport const DEFAULT_ADMIN_ADDRESS = 'http://127.0.0.1:2019';\n\ntype Target =\n  | { readonly kind: 'tcp'; readonly host: string; readonly port: number }\n  | { readonly kind: 'unix'; readonly socketPath: string };\n\nconst UNIX = 'unix://';\nconst HOST_PORT = /^(?:[A-Za-z0-9.-]+|\\[[0-9A-Fa-f:.]+\\]):\\d{1,5}$/;\n\nconst refuse = (address: string, why: string): Error =>\n  new Error(`Caddy admin address ${JSON.stringify(address)}: ${why}`);\n\nconst isLoopback = (hostname: string): boolean =>\n  hostname === 'localhost' || hostname === '[::1]' || /^127(?:\\.\\d{1,3}){3}$/.test(hostname);\n\n/** The dial target and listener for an address, or a refusal naming what is wrong with it. */\nexport const parseAdminAddress = (\n  address: string,\n  hostHeader?: string,\n): { target: Target; listener: CaddyAdminListener } => {\n  if (hostHeader !== undefined && !HOST_PORT.test(hostHeader)) {\n    throw refuse(address, `hostHeader ${JSON.stringify(hostHeader)} must be host:port`);\n  }\n  if (address.startsWith(UNIX)) {\n    const socketPath = address.slice(UNIX.length);\n    if (!socketPath.startsWith('/')) throw refuse(address, 'the socket path must be absolute');\n    return { listener: { kind: 'unix', path: socketPath }, target: { kind: 'unix', socketPath } };\n  }\n  let url: URL;\n  try {\n    url = new URL(address);\n  } catch {\n    throw refuse(address, 'not a URL (http://127.0.0.1:2019 or unix:///path)');\n  }\n  // ⛔ Caddy's local admin endpoint is plaintext by design; its TLS one (`admin.remote`, mTLS on\n  //   :2021) is a different, network-facing API this transport deliberately does not speak.\n  if (url.protocol !== 'http:') throw refuse(address, 'only http:// (loopback) or unix://');\n  if (!isLoopback(url.hostname)) {\n    throw refuse(address, 'not loopback — the admin API is unauthenticated; forward it to here');\n  }\n  if (url.pathname !== '/' || url.search !== '' || url.username !== '') {\n    throw refuse(address, 'no path, query or credentials — the API lives at the root');\n  }\n  const port = url.port === '' ? 80 : Number(url.port);\n  // ⚠️ NOT `url.host`: WHATWG URL drops a default port (`http://127.0.0.1:80` has host\n  //   `127.0.0.1`), and Caddy compares the Host against `host:port` (admin.go allowedOrigins), so\n  //   a portless Host is a 403 on every call. The Caddy CLI always sends the port (JoinHostPort).\n  const host = hostHeader ?? `${url.hostname}:${String(port)}`;\n  return {\n    listener: {\n      hostHeader: host,\n      kind: 'tcp',\n      port: Number(host.slice(host.lastIndexOf(':') + 1)),\n    },\n    // ★ `hostname` keeps IPv6 brackets; node:http wants them off.\n    target: { host: url.hostname.replace(/^\\[(.*)\\]$/, '$1'), kind: 'tcp', port },\n  };\n};\n\nconst code = (cause: unknown): string | undefined =>\n  typeof cause === 'object' && cause !== null && 'code' in cause\n    ? String((cause as { code: unknown }).code)\n    : undefined;\n\n/** Nothing accepted the connection: refused TCP, or no socket file yet. The request never left. */\nconst neverConnected = (cause: unknown): boolean =>\n  code(cause) === 'ECONNREFUSED' || code(cause) === 'ENOENT';\n\nconst exchange = (\n  target: Target,\n  method: string,\n  path: string,\n  headers: Record<string, string>,\n  body: string | undefined,\n  timeoutMs: number,\n): Promise<CaddyAdminResponse> =>\n  new Promise((resolve, reject) => {\n    const bytes = body === undefined ? undefined : Buffer.from(body, 'utf8');\n    const request = httpRequest(\n      {\n        ...(target.kind === 'tcp'\n          ? { host: target.host, port: target.port }\n          : { socketPath: target.socketPath }),\n        headers: bytes === undefined ? headers : { ...headers, 'Content-Length': bytes.length },\n        method,\n        path,\n        timeout: timeoutMs,\n      },\n      (response) => {\n        const chunks: Buffer[] = [];\n        response.on('data', (chunk: Buffer) => chunks.push(chunk));\n        response.on('error', reject);\n        response.on('end', () =>\n          resolve({\n            body: Buffer.concat(chunks).toString('utf8'),\n            status: response.statusCode ?? 0,\n          }),\n        );\n      },\n    );\n    request.on('timeout', () => request.destroy(new Error(`no answer in ${String(timeoutMs)} ms`)));\n    request.on('error', reject);\n    request.end(bytes);\n  });\n\nexport const localCaddyAdmin = (options: LocalCaddyAdminOptions = {}): CaddyAdmin => {\n  const address = options.address ?? DEFAULT_ADMIN_ADDRESS;\n  const { listener, target } = parseAdminAddress(address, options.hostHeader);\n  const timeoutMs = options.timeoutMs ?? 60_000;\n  const retries = options.retries ?? 2;\n  const delay = options.retryDelayMs ?? 500;\n  const fixed: Record<string, string> =\n    listener.kind === 'tcp'\n      ? { Host: listener.hostHeader, Origin: `http://${listener.hostHeader}` }\n      : { Host: '127.0.0.1' };\n  return {\n    endpoint: address,\n    listener,\n    request: async ({ body, headers, method, path }) => {\n      for (let attempt = 0; ; attempt += 1) {\n        try {\n          // oxlint-disable-next-line no-await-in-loop -- sequential by design: retry after a wait\n          return await exchange(target, method, path, { ...headers, ...fixed }, body, timeoutMs);\n        } catch (cause) {\n          if (!neverConnected(cause) || attempt >= retries) {\n            const reason = cause instanceof Error ? cause.message : String(cause);\n            const message = `Caddy admin ${method} ${path} at ${address}: ${reason}`;\n            throw neverConnected(cause) ? new CaddyUnreachableError(message) : new Error(message);\n          }\n          // oxlint-disable-next-line no-await-in-loop -- the wait between attempts\n          await new Promise((resolve) => setTimeout(resolve, delay));\n        }\n      }\n    },\n  };\n};\n",
-    "/**\n * The Caddy provider with its admin transport, as a single layer for a host stack.\n *\n *     Layer.mergeAll(caddyProviders(), launchdProviders(), …the stack's other providers)\n *\n * ★ launchdProviders() TOO when the stack uses caddyWithFile(): the file is a launchd-subpath\n *   HostFile, written through that subpath's HostRunner.\n * ⚠️ The default is localCaddyAdmin(): `http://127.0.0.1:2019`, Caddy's default admin listener.\n *   Pass another CaddyAdmin for a unix socket, a narrowed `admin { origins }`, or an SSH forward.\n */\nimport * as Layer from 'effect/Layer';\nimport { type CaddyAdmin, caddyAdminLayer } from './admin.ts';\nimport { CaddyConfigProvider } from './config.ts';\nimport { localCaddyAdmin } from './local-admin.ts';\n\nexport const caddyProviders = (admin: CaddyAdmin = localCaddyAdmin()) =>\n  CaddyConfigProvider().pipe(Layer.provide(caddyAdminLayer(admin)));\n",
+    "/**\n * LaunchdJob's props, attributes and the pure half of the provider: domain parsing, the plist path,\n * and the props → plist mapping whose SHA-256 is the whole diff.\n *\n * ★ KEY NAMES AND MEANINGS FROM launchd.plist(5), checked against the 148 nix-darwin daemons on a\n *   macOS 27.2 host on 2026-09-21 (read-only, from /nix/store): Label, ProgramArguments, RunAtLoad,\n *   KeepAlive (boolean or {SuccessfulExit}), ThrottleInterval, StandardOutPath/StandardErrorPath,\n *   EnvironmentVariables, UserName, StartInterval and StartCalendarInterval are the keys in real\n *   use. Everything rarer goes through `extraKeys`.\n */\nimport { createHash } from 'node:crypto';\nimport { type PlistDict, type PlistValue, renderPlist } from './plist.ts';\n\n/** `system` (LaunchDaemons, root) or one user's login session, `gui/<uid>` (LaunchAgents). */\nexport type LaunchdDomain = 'system' | `gui/${number}`;\n\n/** One StartCalendarInterval entry. An omitted field is a wildcard, as in cron. */\nexport type CalendarInterval = {\n  readonly minute?: number;\n  readonly hour?: number;\n  readonly day?: number;\n  /** 0 and 7 are both Sunday. */\n  readonly weekday?: number;\n  readonly month?: number;\n};\n\n/** `true` = always restart; the object form restarts only on the named conditions. */\nexport type KeepAlive = boolean | { readonly successfulExit?: boolean; readonly crashed?: boolean };\n\nexport interface LaunchdJobProps {\n  /** Reverse-DNS label. Unique per domain; also the plist's file name. */\n  label: string;\n  domain: LaunchdDomain;\n  /** argv; the first element must be an absolute path. */\n  programArguments: readonly string[];\n  /**\n   * ⛔ NON-SECRET VALUES ONLY. Props are stored unencrypted in Alchemy state, and these also land in\n   *   the plist on disk and in `launchctl print`. Pass a secret as a FILE PATH that a secret renderer\n   *   (openbao-agent) maintains — secret-tripwire.ts refuses the obvious mistakes.\n   */\n  environment?: Readonly<Record<string, string>>;\n  runAtLoad?: boolean;\n  keepAlive?: KeepAlive;\n  /** Seconds between starts. */\n  startInterval?: number;\n  startCalendarInterval?: CalendarInterval | readonly CalendarInterval[];\n  /** Minimum seconds between (re)starts; launchd's default is 10. */\n  throttleInterval?: number;\n  standardOutPath?: string;\n  standardErrorPath?: string;\n  workingDirectory?: string;\n  /** Run as this user. ⚠️ System domain only — launchd ignores it for agents, so it is refused. */\n  userName?: string;\n  /** Run as this group. ⚠️ System domain only, like `userName`. */\n  groupName?: string;\n  /**\n   * Any other launchd.plist(5) key, verbatim (`ProcessType`, `SoftResourceLimits`, …).\n   * ⛔ A key the typed props own is refused, so one job can never say two things.\n   */\n  extraKeys?: PlistDict;\n}\n\nexport interface LaunchdJobAttributes {\n  label: string;\n  domain: LaunchdDomain;\n  /** `<domain>/<label>` — what `launchctl print` / `bootout` take. */\n  serviceTarget: string;\n  plistPath: string;\n  /** SHA-256 of the plist bytes last bootstrapped (reconcile) or found on disk (read). */\n  plistSha256: string;\n  /** Bootstrapped into the domain — not necessarily running. */\n  loaded: boolean;\n  /** launchd's own word: `running`, `not running`, … */\n  state?: string;\n  pid?: number;\n  lastExitCode?: number;\n}\n\nexport type ParsedDomain =\n  | { readonly kind: 'system' }\n  | { readonly kind: 'gui'; readonly uid: number };\n\nexport const parseDomain = (domain: string): ParsedDomain | undefined => {\n  if (domain === 'system') return { kind: 'system' };\n  const match = /^gui\\/(\\d+)$/.exec(domain);\n  return match?.[1] === undefined ? undefined : { kind: 'gui', uid: Number(match[1]) };\n};\n\nexport const serviceTarget = (label: string, domain: LaunchdDomain): string => `${domain}/${label}`;\n\n/**\n * Where launchd expects the job's plist. ★ Derived, never declared: a daemon's plist outside\n *   /Library/LaunchDaemons is not bootstrapped at boot, so a free-form path would be a job that\n *   silently stops existing after the next restart.\n */\nexport const plistPathFor = (\n  label: string,\n  domain: ParsedDomain,\n  home: string | undefined,\n): string => {\n  if (domain.kind === 'system') return `/Library/LaunchDaemons/${label}.plist`;\n  // ⛔ No `~` fallback: the provider may run as root, whose `~` is not the agent owner's home.\n  if (home === undefined || !home.startsWith('/')) {\n    throw new Error(`gui/${String(domain.uid)}: no home directory for that uid on this host`);\n  }\n  return `${home}/Library/LaunchAgents/${label}.plist`;\n};\n\n/** Plist keys the typed props own — `extraKeys` may not name them. `Program` is refused too. */\nexport const OWNED_KEYS: readonly string[] = [\n  'EnvironmentVariables',\n  'GroupName',\n  'KeepAlive',\n  'Label',\n  'Program',\n  'ProgramArguments',\n  'RunAtLoad',\n  'StandardErrorPath',\n  'StandardOutPath',\n  'StartCalendarInterval',\n  'StartInterval',\n  'ThrottleInterval',\n  'UserName',\n  'WorkingDirectory',\n];\n\nconst calendarDict = (entry: CalendarInterval): PlistDict => {\n  const dict: Record<string, PlistValue> = {};\n  if (entry.minute !== undefined) dict['Minute'] = entry.minute;\n  if (entry.hour !== undefined) dict['Hour'] = entry.hour;\n  if (entry.day !== undefined) dict['Day'] = entry.day;\n  if (entry.weekday !== undefined) dict['Weekday'] = entry.weekday;\n  if (entry.month !== undefined) dict['Month'] = entry.month;\n  return dict;\n};\n\nconst keepAliveValue = (keepAlive: KeepAlive): PlistValue => {\n  if (typeof keepAlive === 'boolean') return keepAlive;\n  const dict: Record<string, PlistValue> = {};\n  if (keepAlive.successfulExit !== undefined) dict['SuccessfulExit'] = keepAlive.successfulExit;\n  if (keepAlive.crashed !== undefined) dict['Crashed'] = keepAlive.crashed;\n  return dict;\n};\n\n/** The plist dict for a job. ⚠️ Assumes jobProblems() came back empty. */\nexport const jobPlistDict = (props: LaunchdJobProps): PlistDict => {\n  const dict: Record<string, PlistValue> = { ...props.extraKeys };\n  dict['Label'] = props.label;\n  dict['ProgramArguments'] = [...props.programArguments];\n  const env = props.environment ?? {};\n  if (Object.keys(env).length > 0) dict['EnvironmentVariables'] = { ...env };\n  if (props.runAtLoad !== undefined) dict['RunAtLoad'] = props.runAtLoad;\n  if (props.keepAlive !== undefined) dict['KeepAlive'] = keepAliveValue(props.keepAlive);\n  if (props.startInterval !== undefined) dict['StartInterval'] = props.startInterval;\n  const calendar = props.startCalendarInterval;\n  if (calendar !== undefined) {\n    dict['StartCalendarInterval'] = Array.isArray(calendar)\n      ? (calendar as readonly CalendarInterval[]).map(calendarDict)\n      : calendarDict(calendar as CalendarInterval);\n  }\n  if (props.throttleInterval !== undefined) dict['ThrottleInterval'] = props.throttleInterval;\n  if (props.standardOutPath !== undefined) dict['StandardOutPath'] = props.standardOutPath;\n  if (props.standardErrorPath !== undefined) dict['StandardErrorPath'] = props.standardErrorPath;\n  if (props.workingDirectory !== undefined) dict['WorkingDirectory'] = props.workingDirectory;\n  if (props.userName !== undefined) dict['UserName'] = props.userName;\n  if (props.groupName !== undefined) dict['GroupName'] = props.groupName;\n  return dict;\n};\n\nexport const sha256Hex = (bytes: Uint8Array | string): string =>\n  createHash('sha256').update(bytes).digest('hex');\n\n/** The rendered plist and its digest — the only thing LaunchdJob compares. */\nexport const renderJob = (\n  props: LaunchdJobProps,\n): { text: string; bytes: Uint8Array; sha256: string } => {\n  const text = renderPlist(jobPlistDict(props));\n  const bytes = new TextEncoder().encode(text);\n  return { bytes, sha256: sha256Hex(bytes), text };\n};\n",
+    "/**\n * An XML property list serializer — the subset launchd.plist(5) reads, and nothing else.\n *\n * ★ WHY NOT AN npm LIBRARY. Nothing in this workspace depends on one (checked 2026-09-21: no\n *   `plist`, `xmlbuilder` or `@xmldom/xmldom` anywhere under node_modules), and the common one pulls\n *   an XML DOM in for PARSING, which a provider that only RENDERS never does. The subset a launchd\n *   job needs is five node types, so this is ~100 lines plus exhaustive tests (plist.test.ts), which\n *   also round-trip every case through Apple's own `plutil` when the tests run on macOS.\n *\n * ⛔ THE OUTPUT MUST BE DETERMINISTIC. LaunchdJob diffs by the SHA-256 of these bytes, so two\n *   renders of one declaration must be byte-identical: dict keys are sorted, indentation is fixed,\n *   and nothing depends on insertion order. A non-deterministic render is a forever-`update`.\n * ⚠️ AND A CHANGE TO THIS FILE'S OUTPUT RESTARTS EVERY JOB. A new header, indent or escape changes\n *   every digest, so the next deploy after the kit upgrade updates — restarts — every declared\n *   job at once. Treat any byte change here as a breaking change and say so in its changeset.\n *\n * ⛔ REFUSE, NEVER COERCE. `undefined`, `null`, a fraction, NaN, a class instance or a character XML\n *   1.0 cannot carry is a thrown PlistError naming the path, not a silently dropped key. A dropped\n *   `KeepAlive` is a daemon that never restarts, and nothing downstream would say why.\n */\n\n/** Every value launchd reads. ⚠️ No `<real>`, `<date>` or `<data>`: no launchd key needs one. */\nexport type PlistValue =\n  | string\n  | number\n  | boolean\n  | readonly PlistValue[]\n  | { readonly [key: string]: PlistValue };\n\nexport type PlistDict = { readonly [key: string]: PlistValue };\n\nexport class PlistError extends Error {\n  constructor(\n    readonly path: string,\n    detail: string,\n  ) {\n    super(`plist ${path === '' ? '(root)' : path}: ${detail}`);\n    this.name = 'PlistError';\n  }\n}\n\nconst HEADER =\n  '<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n' +\n  '<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" ' +\n  '\"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\\n' +\n  '<plist version=\"1.0\">\\n';\n\n/** ⚠️ A cycle, or a runaway generator, would otherwise recurse until the stack dies. */\nconst MAX_DEPTH = 32;\n\n/**\n * ⛔ CHARACTERS XML 1.0 CANNOT CARRY AT ALL — not even escaped (XML 1.0 §2.2 `Char`). C0 controls\n *   other than tab, LF and CR; U+FFFE / U+FFFF; and an unpaired surrogate, which has no UTF-8 form.\n */\n// ★ The `u` flag makes a VALID surrogate pair one code point above U+FFFF, outside this class, so\n//   only an unpaired half matches the \\uD800-\\uDFFF range.\n// oxlint-disable-next-line no-control-regex -- matching control characters is the point\nconst FORBIDDEN = /[\\x00-\\x08\\x0B\\x0C\\x0E-\\x1F\\uD800-\\uDFFF\\uFFFE\\uFFFF]/u;\n\n/**\n * Escape text content.\n * ⚠️ CR IS A CHARACTER REFERENCE, NOT A LITERAL. An XML parser normalises a literal CR (and CRLF)\n *   to LF before the application sees it (XML 1.0 §2.11), so `a\\r\\nb` would come back as `a\\nb` and\n *   the argument launchd passes would differ from the one declared. `&#13;` survives normalisation.\n */\nexport const escapeText = (text: string, path: string): string => {\n  const bad = FORBIDDEN.exec(text);\n  if (bad !== null) {\n    const code = bad[0].codePointAt(0) ?? 0;\n    throw new PlistError(\n      path,\n      `U+${code.toString(16).toUpperCase().padStart(4, '0')} cannot appear in XML 1.0`,\n    );\n  }\n  return text\n    .replaceAll('&', '&amp;')\n    .replaceAll('<', '&lt;')\n    .replaceAll('>', '&gt;')\n    .replaceAll('\\r', '&#13;');\n};\n\nconst isPlainObject = (value: object): boolean => {\n  const proto = Object.getPrototypeOf(value) as unknown;\n  return proto === Object.prototype || proto === null;\n};\n\nconst renderValue = (value: unknown, path: string, depth: number, out: string[]): void => {\n  const pad = '\\t'.repeat(depth);\n  if (depth > MAX_DEPTH) throw new PlistError(path, `nested deeper than ${String(MAX_DEPTH)}`);\n  if (typeof value === 'string') {\n    out.push(`${pad}<string>${escapeText(value, path)}</string>`);\n    return;\n  }\n  if (typeof value === 'boolean') {\n    out.push(`${pad}<${value ? 'true' : 'false'}/>`);\n    return;\n  }\n  if (typeof value === 'number') {\n    // ⛔ launchd reads every numeric key as an integer; 1.5 would be a silently different job.\n    if (!Number.isSafeInteger(value)) {\n      throw new PlistError(path, `${String(value)} is not a safe integer (no <real> support)`);\n    }\n    out.push(`${pad}<integer>${String(value === 0 ? 0 : value)}</integer>`);\n    return;\n  }\n  if (Array.isArray(value)) {\n    if (value.length === 0) {\n      out.push(`${pad}<array/>`);\n      return;\n    }\n    out.push(`${pad}<array>`);\n    for (const [index, item] of (value as readonly unknown[]).entries()) {\n      renderValue(item, `${path}[${String(index)}]`, depth + 1, out);\n    }\n    out.push(`${pad}</array>`);\n    return;\n  }\n  if (typeof value === 'object' && value !== null && isPlainObject(value)) {\n    renderDict(value as Record<string, unknown>, path, depth, out);\n    return;\n  }\n  const kind = value === null ? 'null' : typeof value;\n  throw new PlistError(path, `${kind} has no plist form — omit the key instead`);\n};\n\nconst renderDict = (\n  dict: Record<string, unknown>,\n  path: string,\n  depth: number,\n  out: string[],\n): void => {\n  const pad = '\\t'.repeat(depth);\n  // ★ Code-unit order, not localeCompare: the same bytes on every machine and every locale.\n  const keys = Object.keys(dict).sort();\n  if (keys.length === 0) {\n    out.push(`${pad}<dict/>`);\n    return;\n  }\n  out.push(`${pad}<dict>`);\n  for (const key of keys) {\n    const child = path === '' ? key : `${path}.${key}`;\n    out.push(`${pad}\\t<key>${escapeText(key, child)}</key>`);\n    renderValue(dict[key], child, depth + 1, out);\n  }\n  out.push(`${pad}</dict>`);\n};\n\n/** Render a top-level dict as a complete XML plist document, ending in a newline. */\nexport const renderPlist = (dict: PlistDict): string => {\n  if (typeof dict !== 'object' || dict === null || Array.isArray(dict) || !isPlainObject(dict)) {\n    throw new PlistError('', 'the top level of a launchd plist must be a dict');\n  }\n  const out: string[] = [];\n  renderDict(dict as Record<string, unknown>, '', 0, out);\n  return `${HEADER}${out.join('\\n')}\\n</plist>\\n`;\n};\n",
+    "/**\n * The one form an adapted Caddy config is hashed in — so what `POST /adapt` returns for the\n * declared Caddyfile and what `GET /config/` reports after the load hash the same.\n *\n * ⛔ THE TWO ARE NOT THE SAME BYTES, AND COMPARING BYTES WOULD BE A FOREVER-`update`. Read in\n *   caddyserver/caddy v2.11.4:\n *   · `/adapt` returns the adapter's `json.Marshal(cfg)` of Go STRUCTS — keys in field order\n *     (caddyconfig/caddyfile/adapter.go Adapt; load.go handleAdapt).\n *   · `/load` decodes that JSON into a generic `any` and re-marshals it (caddy.go changeConfig):\n *     Go sorts MAP keys, so the stored config has every object's keys sorted.\n *   · `GET /config/` streams that stored value through `json.Encoder`, which appends a newline\n *     (admin.go unsyncedConfigAccess), and escapes `<`, `>` and `&` as `\\u003c`, `\\u003e`, `\\u0026`.\n *   Parsing both and re-serialising with sorted keys erases all three differences. MEASURED\n *   2026-09-21 on a throwaway Caddy 2.11.4: the digest of `GET /config/` after `POST /load` equals\n *   the digest of `/adapt` for the same Caddyfile — and a Caddy started with `--config <file>`\n *   hashes the same as `/adapt` of that file's text, so adopting it is a noop.\n * ★ NUMBERS AGREE BY CONSTRUCTION. Go decodes every JSON number in that generic `any` as float64\n *   (caddy.go indexConfigObjects says so), and JSON.parse does too — the same double on both sides\n *   serialises the same way here.\n */\nimport { sha256Hex } from '../launchd/job-form.ts';\n\ntype Json = null | boolean | number | string | readonly Json[] | { readonly [key: string]: Json };\n\nconst sorted = (value: Json): Json => {\n  if (Array.isArray(value)) return (value as readonly Json[]).map(sorted);\n  if (typeof value === 'object' && value !== null) {\n    const object = value as { readonly [key: string]: Json };\n    const out: Record<string, Json> = {};\n    for (const key of Object.keys(object).sort()) out[key] = sorted(object[key] ?? null);\n    return out;\n  }\n  return value;\n};\n\n/** Parse a config body Caddy returned. ⚠️ An empty config is the JSON `null`, not an error. */\nexport const parseConfig = (text: string): unknown => JSON.parse(text) as unknown;\n\n/** The canonical text of a parsed config: sorted keys, no whitespace. */\nexport const canonicalConfig = (config: unknown): string =>\n  JSON.stringify(sorted((config ?? null) as Json));\n\n/** SHA-256 of the canonical form — what the resource stores and compares, never the config. */\nexport const configDigest = (config: unknown): string => sha256Hex(canonicalConfig(config));\n",
+    "/**\n * CaddyConfig's diff / reconcile — the apply half of the lifecycle config-lifecycle.ts's\n * `desiredConfig`/`readLive`/`probeLive` compute the inputs for. Split out at the 250-line file\n * cap; the two files together are one lifecycle, read config-lifecycle.ts's module doc first.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Result from 'effect/Result';\nimport type * as Diff from 'alchemy/Diff';\nimport type * as Caddy from '@distilled.cloud/caddy';\nimport { CaddyAdminService } from './admin.ts';\nimport { loadCaddyfile, readRunningConfig } from './admin-calls.ts';\nimport { isUnreachable } from './caddy-http-client.ts';\nimport { messageOf, refuse, short, wrapOperation } from './config-errors.ts';\nimport type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';\nimport { claimable, desiredConfig, readLive } from './config-lifecycle.ts';\nimport { configDigest } from './digest.ts';\n\n/**\n * ★ NEVER `replace`. Nothing in the props names a different object: a new Caddyfile is a reload of\n *   the same Caddy, and `sourceFile` is a header. (Which Caddy is the transport's business — see\n *   the ⚠️ on `endpoint` in the diff.)\n */\nexport const diffConfig = (\n  news: CaddyConfigProps,\n  output: CaddyConfigAttributes,\n): Effect.Effect<Diff.Diff, Error | Caddy.CaddyOpError, CaddyAdminService | Caddy.CaddyOpContext> =>\n  Effect.gen(function* () {\n    const { endpoint } = yield* CaddyAdminService;\n    const want = yield* desiredConfig(news);\n    const live = yield* readLive();\n    const converged =\n      want.digest === live.configSha256 &&\n      live.configSha256 === output.configSha256 &&\n      news.sourceFile === output.sourceFile &&\n      // ⚠️ A stack whose transport now reaches ANOTHER Caddy (a new address) must load there; the\n      //   old one keeps what it has — the same as a delete, which never unloads (see config.ts).\n      //   Planned as an update, but the state does not vouch for that Caddy: see Authority.\n      endpoint === output.endpoint;\n    return converged ? { action: 'noop' } : { action: 'update' };\n  });\n\nexport type Applied = {\n  readonly attributes: CaddyConfigAttributes;\n  /** The adapter's warnings (e.g. \"Caddyfile input is not formatted\") — log them, never refuse. */\n  readonly warnings: readonly string[];\n  /** Whether a `POST /load` was sent (false when Caddy already ran this config). */\n  readonly loaded: boolean;\n};\n\n/**\n * What this apply may load over — config.ts decides from the state and the adopt setting:\n *   · `takeOver` — any running config: the state was applied to THIS Caddy (an update, drift\n *     correction, or a create the engine adopted), or adoption is on (`--adopt`, or the\n *     resource's own `adopt(true)` — ownership/adopt.ts adoptEnabled).\n *   · otherwise only a claimable one — plus, as `stored`, the digest the state last recorded: a\n *     Caddy reached at a NEW endpoint that runs exactly that is the same config under another name.\n */\nexport type Authority = { readonly takeOver: boolean; readonly stored?: string };\n\n/**\n * Load the Caddyfile unless Caddy already runs it, then read it back and insist it matches.\n * ⛔ WITHOUT `takeOver`, A CONFIG THE STACK CANNOT CLAIM IS NEVER LOADED OVER. The engine's adoption\n *   probe cannot guard every create: it is skipped while `news` holds an Output — ALWAYS on\n *   caddyWithFile's first deploy (`sourceFile` is its HostFile's path) — and a Caddy that was down at\n *   plan time read as nothing. Nor does state vouch for a Caddy the transport NOW reaches at another\n *   endpoint (diff plans that as an update). Refused here, before any `/load`, like HostFile's.\n */\nexport const reconcileConfig = (\n  props: CaddyConfigProps,\n  authority: Authority,\n): Effect.Effect<Applied, Error | Caddy.CaddyOpError, CaddyAdminService | Caddy.CaddyOpContext> =>\n  Effect.gen(function* () {\n    const { endpoint } = yield* CaddyAdminService;\n    const want = yield* desiredConfig(props);\n    const running = yield* readRunningConfig().pipe(wrapOperation(endpoint, 'GET /config/'));\n    const before = configDigest(running);\n    const known = before === authority.stored || claimable(running, want.digest);\n    if (!authority.takeOver && !known) {\n      return yield* Effect.fail(\n        refuse(\n          endpoint,\n          `Caddy runs config ${short(before)}, which this stack did not load, and the Caddyfile ` +\n            `adapts to ${short(want.digest)} — loading it would replace every site that config ` +\n            'serves. Deploy with --adopt (or wrap the resource in adopt(true)) to take this Caddy ' +\n            'over, or point caddyProviders() at the Caddy you meant.',\n        ),\n      );\n    }\n    let warnings = want.warnings;\n    const loaded = before !== want.digest;\n    if (loaded) {\n      const outcome = yield* Effect.result(loadCaddyfile(props.caddyfile, props.sourceFile));\n      if (Result.isFailure(outcome)) {\n        const error = outcome.failure;\n        // ⚠️ Caddy going unreachable MID-load is not a refusal — nothing to \"say what's running\n        //   now\" about, and re-sending it is unsafe (admin-calls.ts's module doc). Propagated raw,\n        //   still narrowable, matching every other unreachable path in this file.\n        if (isUnreachable(error)) return yield* Effect.fail(error);\n        // ★ SAY WHAT IS RUNNING NOW. Caddy restores the previous config on a failed load (caddy.go\n        //   changeConfig); confirm it rather than promise it, because the deploy log is where the\n        //   person decides whether sites are down.\n        const afterRead = yield* Effect.result(readLive());\n        const after = Result.isSuccess(afterRead) ? afterRead.success : undefined;\n        const state =\n          after === undefined\n            ? 'and the running config could not be read back'\n            : after.configSha256 === before\n              ? 'Caddy kept the previous config (still serving)'\n              : `and the running config is now ${short(after.configSha256)}, not the previous ${short(before)}`;\n        // ⚠️ SAY SO WHEN THE STATUS LIED, or a bare \"refused\" reads like a normal 4xx/5xx.\n        //   `LoadRefused` IS the 200-embedded-error trap (admin-calls.ts's module doc): Caddy\n        //   answered 200, and the failure was only in the body.\n        const reason =\n          error._tag === 'LoadRefused'\n            ? `${error.message} (LoadRefused: a 200 whose body carried the error, not a failure status)`\n            : messageOf(error);\n        return yield* Effect.fail(\n          refuse(endpoint, `Caddy refused the Caddyfile — ${reason}; ${state}`),\n        );\n      }\n      warnings = outcome.success;\n    }\n    // ⚠️ READ BACK, never echo the declaration: a concurrent writer, or a load Caddy answered 200 but\n    //   did not apply (admin-calls.ts), shows up here as a refusal instead of as stored state that is\n    //   already wrong.\n    const attributes = yield* readLive(props.sourceFile);\n    if (attributes.configSha256 !== want.digest) {\n      return yield* Effect.fail(\n        refuse(\n          endpoint,\n          `after the load Caddy runs config ${short(attributes.configSha256)}, not the ` +\n            `${short(want.digest)} this Caddyfile adapts to — another writer changed it, or it was ` +\n            'not applied',\n        ),\n      );\n    }\n    return { attributes, loaded, warnings };\n  });\n",
+    "/**\n * The real Caddy transport: this machine's Caddy, over loopback TCP or a unix socket — the\n * `Credentials` and `HttpClient.HttpClient` layers `@distilled.cloud/caddy`'s typed operations run\n * against (admin-calls.ts), plus the message/guard metadata `CaddyAdminService` carries.\n *\n * Address parsing (`parseAdminAddress`) is pure — admin-address.ts. The wire transport itself\n * (retries, timeouts, the unix-socket dial) is caddy-http-client.ts; this file is the seam between\n * the two and `@distilled.cloud/caddy`'s own `Credentials`.\n */\nimport * as Layer from 'effect/Layer';\nimport * as Caddy from '@distilled.cloud/caddy';\nimport type { CaddyTransport } from './admin.ts';\nimport { DEFAULT_ADMIN_ADDRESS, parseAdminAddress } from './admin-address.ts';\nimport { type LocalHttpClientOptions, makeLocalHttpClient } from './caddy-http-client.ts';\n\nexport { DEFAULT_ADMIN_ADDRESS, parseAdminAddress } from './admin-address.ts';\nexport { isUnreachable } from './caddy-http-client.ts';\n\nexport type LocalCaddyAdminOptions = LocalHttpClientOptions & {\n  /**\n   * `http://<loopback>:<port>` or `unix:///absolute/path.sock`.\n   * @default 'http://127.0.0.1:2019' — Caddy's default admin listener (`localhost:2019`).\n   */\n  readonly address?: string;\n  /**\n   * The Host (and, over TCP, Origin) to send when it is not the address's own: the Caddyfile\n   * narrowed `admin { origins … }`, or the port is an SSH forward of the real one (Caddy checks\n   * the Host against ITS port, not yours). Form `host:port`. Over a unix socket this still sets\n   * the Host header `@distilled.cloud/caddy`'s protocol always sends (Caddy skips the Host check\n   * on unix listeners regardless — admin.go allowedOrigins) — defaults to `127.0.0.1`, matching\n   * the Caddy CLI's own unix-socket calls (cmd/commandfuncs.go AdminAPIRequest).\n   */\n  readonly hostHeader?: string;\n};\n\n/**\n * A transport to this machine's Caddy — feed it to `caddyProviders()`, or build the layer by hand\n * with `CaddyConfigProvider().pipe(Layer.provideMerge(caddyAdminLayer(localCaddyAdmin())))` (never\n * plain `Layer.provide` — admin.ts's own doc on `caddyAdminLayer` says why).\n *\n * ⛔ LOOPBACK OR A UNIX SOCKET, NOTHING ELSE. The admin API is unauthenticated plaintext; an\n *   address off this machine means it is reachable from the network, which decision 23 forbids.\n *   `parseAdminAddress` refuses anything else.\n */\nexport const localCaddyAdmin = (options: LocalCaddyAdminOptions = {}): CaddyTransport => {\n  const address = options.address ?? DEFAULT_ADMIN_ADDRESS;\n  const { listener, target } = parseAdminAddress(address, options.hostHeader);\n  // `@distilled.cloud/caddy`'s protocol always builds `Host`/Origin from `apiBaseUrl` (or this\n  // override) — never from the dial target, which caddy-http-client.ts ignores the URL's host/port\n  // for anyway over a unix socket. `http://localhost` is a placeholder base for the request-URL\n  // machinery (`buildRequest` needs a syntactically valid `http://` URL to join `/config/…` onto);\n  // the hostHeader default `127.0.0.1` is what actually reaches Caddy's Host check, matching what\n  // the Caddy CLI sends over a unix socket.\n  const credentials =\n    target.kind === 'unix'\n      ? Caddy.fromApiBaseUrl({\n          apiBaseUrl: 'http://localhost',\n          hostHeader: options.hostHeader ?? '127.0.0.1',\n        })\n      : Caddy.fromApiBaseUrl({\n          apiBaseUrl: address,\n          ...(options.hostHeader === undefined ? {} : { hostHeader: options.hostHeader }),\n        });\n  return {\n    endpoint: address,\n    // ⚠️ `Caddy.Retry.Retry` DISABLED, not left at the SDK's default. MEASURED 2026-09-23: core's\n    //   `isTransientError` treats ANY `HttpClientError` with a `TransportError` reason as transient\n    //   — including an ECONNRESET well after the connection was accepted — and every generated\n    //   operation already retries under that default (`API.make({ retry: Retry.Retry })`,\n    //   services/admin.ts). Left in place, it retried a `POST /load` that had already reached the\n    //   far side (a socket that accepted, then reset) — the exact re-send admin-calls.ts's module\n    //   doc says must never happen — NINE times over, compounding with caddy-http-client.ts's own\n    //   narrower retry below it. This transport's retry (ECONNREFUSED/ENOENT only — \"nothing\n    //   accepted the connection yet\") is the one retry policy Caddy's admin API gets.\n    layer: Layer.mergeAll(\n      credentials,\n      makeLocalHttpClient(target, options),\n      Layer.succeed(Caddy.Retry.Retry, { while: () => false }),\n    ),\n    listener,\n  };\n};\n",
+    "/**\n * Parses a `localCaddyAdmin()` address into a dial target and the listener Caddy checks requests\n * against — pure, so admin-guard.ts and local-admin.ts's tests exercise it with no transport at all.\n *\n * ★ LOOPBACK OR A UNIX SOCKET, NOTHING ELSE. The admin API is unauthenticated plaintext; an address\n *   off this machine means it is reachable from the network, which decision 23 forbids. Reaching\n *   another host's Caddy means forwarding its socket or port to here (SSH), never exposing :2019.\n * ★ HOST, AS CADDY's OWN CLI SENDS IT (cmd/commandfuncs.go AdminAPIRequest): `host:port`, over TCP.\n *   MEASURED against a Mac host's Caddy 2.11.4: any other Host gets 403 `host not allowed`, a\n *   forwarded port included — hence `hostHeader`.\n */\nimport type { CaddyAdminListener } from './admin.ts';\n\nexport type Target =\n  | { readonly kind: 'tcp'; readonly host: string; readonly port: number }\n  | { readonly kind: 'unix'; readonly socketPath: string };\n\nexport const DEFAULT_ADMIN_ADDRESS = 'http://127.0.0.1:2019';\n\nconst UNIX = 'unix://';\nconst HOST_PORT = /^(?:[A-Za-z0-9.-]+|\\[[0-9A-Fa-f:.]+\\]):\\d{1,5}$/;\n\nconst refuse = (address: string, why: string): Error =>\n  new Error(`Caddy admin address ${JSON.stringify(address)}: ${why}`);\n\nconst isLoopback = (hostname: string): boolean =>\n  hostname === 'localhost' || hostname === '[::1]' || /^127(?:\\.\\d{1,3}){3}$/.test(hostname);\n\n/** The dial target and listener for an address, or a refusal naming what is wrong with it. */\nexport const parseAdminAddress = (\n  address: string,\n  hostHeader?: string,\n): { target: Target; listener: CaddyAdminListener } => {\n  if (hostHeader !== undefined && !HOST_PORT.test(hostHeader)) {\n    throw refuse(address, `hostHeader ${JSON.stringify(hostHeader)} must be host:port`);\n  }\n  if (address.startsWith(UNIX)) {\n    const socketPath = address.slice(UNIX.length);\n    if (!socketPath.startsWith('/')) throw refuse(address, 'the socket path must be absolute');\n    return { listener: { kind: 'unix', path: socketPath }, target: { kind: 'unix', socketPath } };\n  }\n  let url: URL;\n  try {\n    url = new URL(address);\n  } catch {\n    throw refuse(address, 'not a URL (http://127.0.0.1:2019 or unix:///path)');\n  }\n  // ⛔ Caddy's local admin endpoint is plaintext by design; its TLS one (`admin.remote`, mTLS on\n  //   :2021) is a different, network-facing API this transport deliberately does not speak.\n  if (url.protocol !== 'http:') throw refuse(address, 'only http:// (loopback) or unix://');\n  if (!isLoopback(url.hostname)) {\n    throw refuse(address, 'not loopback — the admin API is unauthenticated; forward it to here');\n  }\n  if (url.pathname !== '/' || url.search !== '' || url.username !== '') {\n    throw refuse(address, 'no path, query or credentials — the API lives at the root');\n  }\n  const port = url.port === '' ? 80 : Number(url.port);\n  // ⚠️ NOT `url.host`: WHATWG URL drops a default port (`http://127.0.0.1:80` has host\n  //   `127.0.0.1`), and Caddy compares the Host against `host:port` (admin.go allowedOrigins), so\n  //   a portless Host is a 403 on every call. The Caddy CLI always sends the port (JoinHostPort).\n  const host = hostHeader ?? `${url.hostname}:${String(port)}`;\n  return {\n    listener: {\n      hostHeader: host,\n      kind: 'tcp',\n      port: Number(host.slice(host.lastIndexOf(':') + 1)),\n    },\n    // ★ `hostname` keeps IPv6 brackets; node:http wants them off.\n    target: { host: url.hostname.replace(/^\\[(.*)\\]$/, '$1'), kind: 'tcp', port },\n  };\n};\n",
+    "/**\n * The Caddy provider with its admin transport, as a single layer for a host stack.\n *\n *     Layer.mergeAll(caddyProviders(), launchdProviders(), …the stack's other providers)\n *\n * ★ launchdProviders() TOO when the stack uses caddyWithFile(): the file is a launchd-subpath\n *   HostFile, written through that subpath's HostRunner.\n * ⚠️ The default is localCaddyAdmin(): `http://127.0.0.1:2019`, Caddy's default admin listener.\n *   Pass another CaddyTransport for a unix socket, a narrowed `admin { origins }`, or an SSH\n *   forward — `localCaddyAdmin({ address, hostHeader })` builds one; a consumer can provide any\n *   other `{ endpoint, listener, layer }` reaching `@distilled.cloud/caddy`'s own `Credentials`\n *   and `HttpClient.HttpClient`.\n *\n * ⚠️ `Layer.provideMerge`, NEVER PLAIN `Layer.provide`, for `caddyAdminLayer`. `CaddyConfigProvider()`'s\n *   `read`/`diff`/`reconcile` handlers each still need `CaddyAdminService` and\n *   `@distilled.cloud/caddy`'s `Credentials`/`HttpClient` — Alchemy's own `Provider.effect` types\n *   those as part of the LAYER's overall requirement (`ProviderService`'s per-handler `Req` type\n *   parameters, `alchemy/Provider.ts`), for exactly this reason. Plain `Layer.provide` SEALS a\n *   layer — it satisfies `CaddyConfigProvider()`'s requirement only for BUILDING the `Provider`\n *   value (the `admin` in its outer `Effect.gen`), then hides those services from anything that\n *   runs LATER, when the returned `read`/`diff`/`reconcile` FUNCTIONS actually execute. MEASURED\n *   2026-09-23: with plain `Layer.provide`, `caddyProviders()`'s own `reconcile` handler dies with\n *   \"Service not found: homeflare/caddy/CaddyAdmin\" the moment the ENGINE calls it. `provideMerge`\n *   feeds `caddyAdminLayer`'s output into `CaddyConfigProvider()`'s requirement AND keeps that same\n *   output live in the result, so every later handler call still runs with it in context.\n */\nimport * as Layer from 'effect/Layer';\nimport { type CaddyTransport, caddyAdminLayer } from './admin.ts';\nimport { CaddyConfigProvider } from './config.ts';\nimport { localCaddyAdmin } from './local-admin.ts';\n\nexport const caddyProviders = (transport: CaddyTransport = localCaddyAdmin()) =>\n  CaddyConfigProvider().pipe(Layer.provideMerge(caddyAdminLayer(transport)));\n",
     "/**\n * `caddyWithFile` — one Caddyfile, applied to the running Caddy AND written to the file Caddy\n * starts from, so a restart keeps it (decision 23: \"the file also lands on disk\").\n *\n * ★ REUSES launchd's HostFile, NOT A SECOND FILE WRITER. The file is an ordinary `Host.File`\n *   (atomic write, digest diff, symlink refusal, `--adopt` for a file already there); the config is\n *   a `Caddy.Config` whose `sourceFile` is that HostFile's `path` Output — which is what orders them.\n *\n * ⛔ THE ORDER IS FILE, THEN `/load`. The dependency makes Alchemy write the file first, and it is the\n *   only order that bootstraps: a new host's Caddy launchd job starts from the file, before any\n *   admin API exists to load into. Its cost, and what bounds it:\n *   · A Caddyfile that does not ADAPT never reaches disk once the config has state: CaddyConfig's\n *     diff adapts it at PLAN time and fails the plan. (On the very first deploy the file's path is\n *     still an Output, Alchemy skips the adoption probe, and the check runs at apply instead.)\n *   · A Caddyfile that adapts but that Caddy then REFUSES (a port in use, a missing cert file) is\n *     on disk when `/load` fails. Caddy keeps serving the old config, the deploy fails with Caddy's\n *     reason — and a Caddy started without `--resume` would load the refused file on its next\n *     restart. Managed Caddies run with `--resume` (decision, 2026-09-21; docs/caddy.md): they\n *     restart from `autosave.json`, the last config Caddy ACCEPTED, and the file is only the\n *     first-boot fallback.\n *   · The skipped probe is also why the ADOPTION check of a first deploy happens at apply: a Caddy\n *     running a config this stack did not load is refused before `/load` unless the deploy runs\n *     with `--adopt` (config-lifecycle.ts reconcileConfig) — after this file is written.\n * ⛔ SECRETS ARE REFUSED HERE, AT DECLARATION, before the HostFile exists: its `content` is a prop\n *   too, and would carry a literal into state even if the CaddyConfig then refused it.\n * ★ BOTH RETAIN. Removing this from a stack must not delete the file a restart needs.\n */\nimport * as Effect from 'effect/Effect';\nimport * as RemovalPolicy from 'alchemy/RemovalPolicy';\nimport { HostFile } from '../launchd/host-file.ts';\nimport { CaddyConfig } from './config.ts';\nimport { configProblems } from './config-form.ts';\n\nexport interface CaddyWithFileProps {\n  /** The whole Caddyfile. ⛔ Never a secret — use `{env.NAME}` / `{file./path}` placeholders. */\n  readonly caddyfile: string;\n  /** Absolute path Caddy is started with: `caddy run --config <path> --adapter caddyfile`. */\n  readonly path: string;\n  /** @default 0o644 */\n  readonly mode?: number;\n  readonly owner?: string | number;\n  readonly group?: string | number;\n}\n\n/**\n * Declare the file (`<id>-file`) and the config (`<id>`). Provide `launchdProviders()` for the\n * file and `caddyProviders()` for the config.\n *\n *     const { config, file } = yield* caddyWithFile('caddy', { caddyfile, path: '/usr/local/etc/Caddyfile' });\n */\nexport const caddyWithFile = (id: string, props: CaddyWithFileProps) =>\n  Effect.gen(function* () {\n    const found = configProblems({ caddyfile: props.caddyfile, sourceFile: props.path });\n    if (found.length > 0) {\n      return yield* Effect.fail(new Error(`caddyWithFile ${id}: ${found.join('; ')}`));\n    }\n    const file = yield* HostFile(`${id}-file`, {\n      content: props.caddyfile,\n      mode: props.mode ?? 0o644,\n      path: props.path,\n      ...(props.owner === undefined ? {} : { owner: props.owner }),\n      ...(props.group === undefined ? {} : { group: props.group }),\n    }).pipe(RemovalPolicy.retain());\n    const config = yield* CaddyConfig(id, { caddyfile: props.caddyfile, sourceFile: file.path });\n    return { config, file };\n  });\n",
     "/**\n * `Host.File` — one text file on the host, declared: content, mode, owner, group.\n *\n * - create / update — atomic write (temp file in the same directory, mode and owner set, rename),\n *   skipped when the file already matches; then read back and compared.\n * - read — lstat plus the SHA-256 of the bytes.\n * - diff — declared SHA-256 against the stored and on-disk digest, plus mode and owner.\n * - replace — only when `path` changes; create-before-delete.\n * - delete — removes the file.\n *\n * ⛔ NEVER A SECRET — see host-file-form.ts. Secret files stay rendered by openbao-agent.\n * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`: a file already at the path reads as `Unowned`, and where\n *   the plan never asked, reconcile refuses it unless adoption is on (docs/ownership.md).\n * ★ IT LIVES IN THE launchd SUBPATH because the two travel together: a Mac host stack declares a\n *   daemon's config file and the daemon that reads it, through the same HostRunner.\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { adoptsAtApply } from '../ownership/adopt.ts';\nimport { noteUnfinished } from '../ownership/resume.ts';\nimport { oneFile } from './file-identity.ts';\nimport { lift, resolvedString } from './host-effect.ts';\nimport type { HostFileAttributes, HostFileProps } from './host-file-form.ts';\nimport { deleteFile, diffFile, readFileAttributes, reconcileFile } from './host-file-lifecycle.ts';\nimport { HostRunnerService } from './runner.ts';\n\nexport type { HostFileAttributes, HostFileProps } from './host-file-form.ts';\n\nexport interface HostFile extends Resource<'Host.File', HostFileProps, HostFileAttributes> {}\n\nexport const HostFile = Resource<HostFile>('Host.File');\n\nexport const HostFileProvider = () =>\n  Provider.effect(\n    HostFile,\n    Effect.gen(function* () {\n      const runner = yield* HostRunnerService;\n      return HostFile.Provider.of({\n        list: () => Effect.succeed([]),\n\n        read: ({ olds, output }) =>\n          lift(async () => {\n            const found = await readFileAttributes(runner, olds.path);\n            if (found === undefined) return undefined;\n            return output === undefined ? Unowned(found) : found;\n          }),\n\n        diff: ({ instanceId, news, output }) => {\n          // ★ An unfinished generation of our own: `--adopt` may resume it (ownership/resume.ts).\n          if (output === undefined) return noteUnfinished(instanceId);\n          if (isResolved(news)) return lift(() => diffFile(runner, news, output));\n          // ⛔ A new path is a replace even while `content` is unresolved (an Output templated in):\n          //   the engine's default would be an update, which writes the new path and never\n          //   removes the old one. reconcileFile also defends, for a path that is an Output.\n          //   ⛔ Unless the new path is the old FILE under another spelling (file-identity.ts):\n          //   a replace's Phase 2 would delete it. The update then records the new spelling.\n          const path = resolvedString(news, 'path');\n          if (path === undefined || path === output.path) return Effect.succeed(undefined);\n          return lift(async () =>\n            (await oneFile(runner, path, output.path)) === true\n              ? undefined\n              : { action: 'replace' as const },\n          );\n        },\n\n        // ★ `--adopt` reaches the apply too: the probe never ran for a create with an Output prop.\n        //   ⛔ A create or an unfinished generation — never a fresh replace's, never offered it.\n        reconcile: ({ fqn, instanceId, news, output }) =>\n          Effect.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) =>\n            lift(() => reconcileFile(runner, news, output, adopt)),\n          ),\n\n        delete: ({ output }) => lift(() => deleteFile(runner, output)),\n      });\n    }),\n  );\n",
     "/**\n * Whether two paths name ONE file — the question a move must answer before it deletes its old\n * path, and a plan before it answers `replace`.\n *\n * 🔴 MEASURED 2026-09-22 (release/binary-alias.test.ts, localRunner over a real temp directory,\n *   through Alchemy's own Plan and Apply): a Release.Binary whose directory was respelled to\n *   another path for the SAME file — through a symlinked parent (`/tmp` → `/private/tmp`, `/etc`\n *   → `/private/etc`), or by case alone on case-insensitive APFS, macOS's default — planned a\n *   `replace`. The new generation took the file already there as its own (same bytes, same mode:\n *   file-converge.ts's resume rule), then Phase 2 deleted the old generation's path, which was that\n *   same file. The deploy SUCCEEDED and the binary was gone. The `update` route lost it in one step:\n *   convergeFile's move removed the old path after \"writing\" the new one. Host.File shares both.\n * ★ IDENTITY, NOT SPELLING. Case-folding the strings would be wrong on a case-sensitive volume and\n *   blind to a symlinked parent; device and inode from lstat are what the kernel itself compares.\n * ⚠️ A HARD LINK also shares an inode. At the old path of a move it is therefore kept, not removed:\n *   one stray link left behind, rather than the risk of deleting the file just verified.\n */\nimport type { FileStat, HostRunner } from './runner.ts';\n\n/**\n * `true` when both entries exist and are one file; `false` when either is absent or they differ;\n * `undefined` when the runner reported no identity, so nobody can tell (fakes, custom runners).\n */\nexport const sameEntry = (\n  a: FileStat | undefined,\n  b: FileStat | undefined,\n): boolean | undefined => {\n  if (a === undefined || b === undefined) return false;\n  if (a.dev === undefined || a.ino === undefined || b.dev === undefined || b.ino === undefined) {\n    return undefined;\n  }\n  return a.dev === b.dev && a.ino === b.ino;\n};\n\n/** Whether `a` and `b` are one file on this host right now. Equal strings always are. */\nexport const oneFile = async (\n  runner: HostRunner,\n  a: string,\n  b: string,\n): Promise<boolean | undefined> => {\n  if (a === b) return true;\n  const [left, right] = await Promise.all([runner.stat(a), runner.stat(b)]);\n  return sameEntry(left, right);\n};\n\n/**\n * The last step of a move: `remove` the old path unless it is the file just verified at `path`.\n * ⚠️ A runner that reports no identity cannot be asked beforehand, so `path` is checked after: a\n *   file lost to a respelling then fails the deploy instead of reporting success.\n */\nexport const leaveOldPath = async (\n  runner: HostRunner,\n  oldPath: string,\n  path: string,\n  remove: () => Promise<void>,\n  refuse: (path: string, message: string) => Error,\n): Promise<void> => {\n  const same = await oneFile(runner, oldPath, path);\n  if (same === true) return;\n  await remove();\n  if (same === undefined && (await runner.stat(path)) === undefined) {\n    throw refuse(\n      path,\n      `removing the old path ${oldPath} removed this file too: they are one file under two ` +\n        'spellings (a symlinked parent, or case on a case-insensitive volume). Deploy again to ' +\n        'reinstall it, and keep one spelling.',\n    );\n  }\n};\n",
@@ -29,7 +33,7 @@
     "/**\n * HostFile's props, attributes and validation — the pure half of the provider.\n *\n * ⛔ `content` IS NEVER A SECRET. Alchemy stores props unencrypted, so the content of every HostFile\n *   sits in the state store and in every plan diff. A secret file stays RENDERED BY A SECRET\n *   RENDERER (openbao-agent templates, on this estate) that fetches it at run time; the stack\n *   declares only non-secret config, and at most the PATH the renderer writes to.\n *   secret-tripwire.ts refuses the obvious case (a PEM private key); nothing can catch all of them.\n */\nimport { fileSecretProblems } from './secret-tripwire.ts';\n\nexport interface HostFileProps {\n  /** Absolute path. The parent directory must already exist. */\n  path: string;\n  /** UTF-8 text. ⛔ Never a secret — see the file header. */\n  content: string;\n  /** Permission bits. @default 0o644 */\n  mode?: number;\n  /** User name or numeric uid. Omitted: whoever the runner writes as (a rewrite keeps no owner). */\n  owner?: string | number;\n  /** Group name or numeric gid. Omitted: the directory's default group. */\n  group?: string | number;\n}\n\nexport interface HostFileAttributes {\n  path: string;\n  /** SHA-256 of the bytes on disk. */\n  sha256: string;\n  mode: number;\n  uid: number;\n  gid: number;\n  size: number;\n}\n\nexport const DEFAULT_MODE = 0o644;\n\n/** A user or group as declared: a non-negative id, or a name the host could have. */\nexport const identityProblems = (name: string, value: string | number | undefined): string[] => {\n  if (value === undefined) return [];\n  if (typeof value === 'number') {\n    return Number.isSafeInteger(value) && value >= 0\n      ? []\n      : [`${name} must be a non-negative integer id`];\n  }\n  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(value) || /^\\d+$/.test(value)\n    ? []\n    : [`${name} ${JSON.stringify(value)} is not a valid user or group name`];\n};\n\n/**\n * An absolute, normalised path, or the reasons it is not. ★ Shared with sudo-allowlist.ts, so a\n *   path the sudo runner may touch as root obeys exactly the rule a declared file does.\n */\nexport const pathProblems = (path: string): string[] => {\n  const found: string[] = [];\n  if (!path.startsWith('/')) found.push('path must be absolute');\n  // ★ One spelling per file: `a/./b`, `a//b` and `a/../b` would each be a second resource for the\n  //   same inode, and `..` is how a derived path walks out of the directory it was meant for.\n  if (\n    path.endsWith('/') ||\n    path\n      .split('/')\n      .slice(1)\n      .some((part) => part === '' || part === '.' || part === '..')\n  ) {\n    found.push('path must be normalised (no trailing slash, no empty, \".\" or \"..\" segments)');\n  }\n  if (path.includes('\\x00')) found.push('path contains NUL');\n  return found;\n};\n\nexport const fileProblems = (props: HostFileProps): string[] => {\n  const found = pathProblems(props.path);\n  const mode = props.mode ?? DEFAULT_MODE;\n  if (!Number.isSafeInteger(mode) || mode < 0 || mode > 0o7777) found.push('mode must be 0–0o7777');\n  found.push(...identityProblems('owner', props.owner));\n  found.push(...identityProblems('group', props.group));\n  found.push(...fileSecretProblems(props.content));\n  return found;\n};\n",
     "/**\n * HostFile's read / diff / reconcile / delete as plain async functions over a HostRunner, so the\n * lifecycle runs against fake-runner.ts in tests.\n *\n * ★ THE CONVERGENCE ITSELF IS file-converge.ts, shared with every resource that owns one whole file\n *   (Release.Binary is the second). What stays here is what makes a HOST FILE: text content, its\n *   validation (never a secret — host-file-form.ts), and the refusal wording `Host.File <path>: …`.\n * ⛔ SYMLINKS AND DIRECTORIES ARE REFUSED, NOT REPLACED — see file-converge.ts for why.\n */\nimport type { Diff } from 'alchemy/Diff';\nimport {\n  type FileTarget,\n  convergeFile,\n  diffTarget,\n  removeWholeFile,\n  resolveIds,\n} from './file-converge.ts';\nimport {\n  DEFAULT_MODE,\n  type HostFileAttributes,\n  type HostFileProps,\n  fileProblems,\n} from './host-file-form.ts';\nimport { sha256Hex } from './job-form.ts';\nimport type { HostRunner } from './runner.ts';\n\nexport { readFileAttributes } from './file-converge.ts';\n\ntype Desired = FileTarget & { readonly bytes: Uint8Array };\n\nconst refuse = (path: string, message: string): Error => new Error(`Host.File ${path}: ${message}`);\n\n/** Validate, then resolve owner/group names to ids through the runner. */\nexport const desiredFile = async (runner: HostRunner, props: HostFileProps): Promise<Desired> => {\n  const found = fileProblems(props);\n  if (found.length > 0) throw refuse(props.path, found.join('; '));\n  const bytes = new TextEncoder().encode(props.content);\n  return {\n    bytes,\n    mode: props.mode ?? DEFAULT_MODE,\n    path: props.path,\n    sha256: sha256Hex(bytes),\n    ...(await resolveIds(runner, props, props.path, refuse)),\n  };\n};\n\n/** Declared digest, mode and owner against state and the live file — see diffTarget. */\nexport const diffFile = async (\n  runner: HostRunner,\n  news: HostFileProps,\n  output: HostFileAttributes,\n): Promise<Diff> => diffTarget(runner, await desiredFile(runner, news), output);\n\n/**\n * Write the declared text, unless the file already matches. `adopt` is adoptsAtApply's answer;\n * what it may and may not take over is convergeFile's ⛔.\n */\nexport const reconcileFile = async (\n  runner: HostRunner,\n  props: HostFileProps,\n  output?: HostFileAttributes,\n  adopt = false,\n): Promise<HostFileAttributes> => {\n  const want = await desiredFile(runner, props);\n  const spec = { bytesFor: async () => want.bytes, owner: props.owner, refuse, want };\n  return convergeFile(runner, spec, output, adopt);\n};\n\n/** Remove the file. Idempotent. ⛔ Refuses a path that has since become a symlink or directory. */\nexport const deleteFile = (runner: HostRunner, output: HostFileAttributes): Promise<void> =>\n  removeWholeFile(runner, output, refuse);\n"
   ],
-  "mappings": ";AAoBA,IAAM,uBAAuB,CAAC,kBAAkB,cAAc;AA6B9D,IAAM,WAAW,IAAI,IAAI,CAAC,aAAa,aAAa,OAAO,OAAO,CAAC;AAQnE,IAAM,SAAS,CAAC,aAA6B;AAAA,EAC3C,MAAM,UAAU,SAAS,QAAQ,gBAAgB,EAAE;AAAA,EACnD,IAAI,QAAQ,WAAW,OAAO;AAAA,IAAG,OAAO;AAAA,EAGxC,IAAI,QAAQ,WAAW,GAAG;AAAA,IAAG,OAAO,QAAQ,MAAM,GAAG,QAAQ,QAAQ,GAAG,IAAI,CAAC;AAAA,EAE7E,MAAM,QAAQ,QAAQ,QAAQ,GAAG;AAAA,EACjC,OAAO,UAAU,KAAK,UAAU,QAAQ,MAAM,GAAG,KAAK;AAAA;AAGjD,IAAM,mBAAmB,CAAC,aAA+B;AAAA,EAC9D,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OAAO,OAAO,SAAS,KAAK,CAAC;AAAA,EAEnC,IAAI,SAAS,KAAK,MAAM;AAAA,IAAI,MAAM,KAAK,mBAAmB;AAAA,EACrD,SAAI,SAAS,UAAU,CAAC,SAAS,IAAI,IAAI,GAAG;AAAA,IAC/C,MAAM,KACJ,mDAAmD,gDACrD;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAoBF,IAAM,oBAAoB,CAAC,UAA0C;AAAA,EAC1E,MAAM,WAAW,iBAAiB,MAAM,QAAQ;AAAA,EAChD,IAAI,SAAS,SAAS;AAAA,IAAG,MAAM,IAAI,MAAM,sBAAsB,SAAS,KAAK,IAAI,GAAG;AAAA,EAEpF,MAAM,SAAS,MAAM,UAAU;AAAA,EAC/B,MAAM,MAAM,MAAM,OAAO;AAAA,EACzB,MAAM,UAAU,MAAM,eAAe;AAAA,EAErC,MAAM,QAAQ;AAAA,IACZ,GAAI,MAAM,QAAQ,CAAC;AAAA,IACnB,gBAAgB,MAAM;AAAA,IACtB,GAAG,aAAa;AAAA,IAGhB,GAAG;AAAA,IACH,GAAG,QAAQ,IAAI,CAAC,WAAW,GAAG,SAAS,SAAS,QAAQ;AAAA,IACxD,GAAG;AAAA,IACH;AAAA,EACF;AAAA,EAEA,OAAO,MAAM,IAAI,CAAC,SAAS,GAAG,SAAS,MAAM,EAAE,KAAK;AAAA,CAAI;AAAA;;ACvG1D;AACA;AAAA;AA8CO,MAAM,8BAA8B,MAAM;AAAA,EAC7B,OAAO;AAC3B;AAAA;AAGO,MAAM,0BAAkC,gBAAuC,EACpF,4BACF,EAAE;AAAC;AAGI,IAAM,kBAAkB,CAAC,UACxB,cAAQ,mBAAmB,KAAK;;AC/DxC;;;ACqBO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EADX,WAAW,CACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,SAAS,KAAK,WAAW,SAAS,QAAQ;AAAA,IAHhD;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,SACJ;AAAA,IACA,0DACA;AAAA,IACA;AAAA;AAGF,IAAM,YAAY;AASlB,IAAM,YAAY;AAQX,IAAM,aAAa,CAAC,MAAc,SAAyB;AAAA,EAChE,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,EAC/B,IAAI,QAAQ,MAAM;AAAA,IAChB,MAAM,OAAO,IAAI,GAAG,YAAY,CAAC,KAAK;AAAA,IACtC,MAAM,IAAI,WACR,MACA,KAAK,KAAK,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,4BACtD;AAAA,EACF;AAAA,EACA,OAAO,KACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,MAAM,OAAO;AAAA;AAG7B,IAAM,gBAAgB,CAAC,UAA2B;AAAA,EAChD,MAAM,QAAQ,OAAO,eAAe,KAAK;AAAA,EACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAGjD,IAAM,cAAc,CAAC,OAAgB,MAAc,OAAe,QAAwB;AAAA,EACxF,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAC7B,IAAI,QAAQ;AAAA,IAAW,MAAM,IAAI,WAAW,MAAM,sBAAsB,OAAO,SAAS,GAAG;AAAA,EAC3F,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,IAAI,KAAK,GAAG,cAAc,WAAW,OAAO,IAAI,YAAY;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,IAAI,KAAK,GAAG,OAAO,QAAQ,SAAS,WAAW;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAE7B,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAAA,MAChC,MAAM,IAAI,WAAW,MAAM,GAAG,OAAO,KAAK,6CAA6C;AAAA,IACzF;AAAA,IACA,IAAI,KAAK,GAAG,eAAe,OAAO,UAAU,IAAI,IAAI,KAAK,aAAa;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,IAAI,KAAK,GAAG,aAAa;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB,YAAY,OAAO,SAAU,MAA6B,QAAQ,GAAG;AAAA,MACnE,YAAY,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG,GAAG;AAAA,IAC/D;AAAA,IACA,IAAI,KAAK,GAAG,aAAa;AAAA,IACzB;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,cAAc,KAAK,GAAG;AAAA,IACvE,WAAW,OAAkC,MAAM,OAAO,GAAG;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAM,OAAO,UAAU,OAAO,SAAS,OAAO;AAAA,EAC9C,MAAM,IAAI,WAAW,MAAM,GAAG,+CAA+C;AAAA;AAG/E,IAAM,aAAa,CACjB,MACA,MACA,OACA,QACS;AAAA,EACT,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAE7B,MAAM,OAAO,OAAO,KAAK,IAAI,EAAE,KAAK;AAAA,EACpC,IAAI,KAAK,WAAW,GAAG;AAAA,IACrB,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB;AAAA,EACF;AAAA,EACA,IAAI,KAAK,GAAG,WAAW;AAAA,EACvB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,QAAQ;AAAA,IAC7C,IAAI,KAAK,GAAG,YAAa,WAAW,KAAK,KAAK,SAAS;AAAA,IACvD,YAAY,KAAK,MAAM,OAAO,QAAQ,GAAG,GAAG;AAAA,EAC9C;AAAA,EACA,IAAI,KAAK,GAAG,YAAY;AAAA;AAInB,IAAM,cAAc,CAAC,SAA4B;AAAA,EACtD,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,KAAK,CAAC,cAAc,IAAI,GAAG;AAAA,IAC5F,MAAM,IAAI,WAAW,IAAI,iDAAiD;AAAA,EAC5E;AAAA,EACA,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAiC,IAAI,GAAG,GAAG;AAAA,EACtD,OAAO,GAAG,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;;;ADxE3B,IAAM,cAAc,CAAC,WAA6C;AAAA,EACvE,IAAI,WAAW;AAAA,IAAU,OAAO,EAAE,MAAM,SAAS;AAAA,EACjD,MAAM,QAAQ,eAAe,KAAK,MAAM;AAAA,EACxC,OAAO,QAAQ,OAAO,YAAY,YAAY,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,EAAE,EAAE;AAAA;AAG9E,IAAM,gBAAgB,CAAC,OAAe,WAAkC,GAAG,UAAU;AAOrF,IAAM,eAAe,CAC1B,OACA,QACA,SACW;AAAA,EACX,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,0BAA0B;AAAA,EAE/D,IAAI,SAAS,aAAa,CAAC,KAAK,WAAW,GAAG,GAAG;AAAA,IAC/C,MAAM,IAAI,MAAM,OAAO,OAAO,OAAO,GAAG,gDAAgD;AAAA,EAC1F;AAAA,EACA,OAAO,GAAG,6BAA6B;AAAA;AAIlC,IAAM,aAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAAe,CAAC,UAAuC;AAAA,EAC3D,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,MAAM,WAAW;AAAA,IAAW,KAAK,YAAY,MAAM;AAAA,EACvD,IAAI,MAAM,SAAS;AAAA,IAAW,KAAK,UAAU,MAAM;AAAA,EACnD,IAAI,MAAM,QAAQ;AAAA,IAAW,KAAK,SAAS,MAAM;AAAA,EACjD,IAAI,MAAM,YAAY;AAAA,IAAW,KAAK,aAAa,MAAM;AAAA,EACzD,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,MAAM;AAAA,EACrD,OAAO;AAAA;AAGT,IAAM,iBAAiB,CAAC,cAAqC;AAAA,EAC3D,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO;AAAA,EAC3C,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,UAAU,mBAAmB;AAAA,IAAW,KAAK,oBAAoB,UAAU;AAAA,EAC/E,IAAI,UAAU,YAAY;AAAA,IAAW,KAAK,aAAa,UAAU;AAAA,EACjE,OAAO;AAAA;AAIF,IAAM,eAAe,CAAC,UAAsC;AAAA,EACjE,MAAM,OAAmC,KAAK,MAAM,UAAU;AAAA,EAC9D,KAAK,WAAW,MAAM;AAAA,EACtB,KAAK,sBAAsB,CAAC,GAAG,MAAM,gBAAgB;AAAA,EACrD,MAAM,MAAM,MAAM,eAAe,CAAC;AAAA,EAClC,IAAI,OAAO,KAAK,GAAG,EAAE,SAAS;AAAA,IAAG,KAAK,0BAA0B,KAAK,IAAI;AAAA,EACzE,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,eAAe,MAAM,SAAS;AAAA,EACrF,IAAI,MAAM,kBAAkB;AAAA,IAAW,KAAK,mBAAmB,MAAM;AAAA,EACrE,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,KAAK,2BAA2B,MAAM,QAAQ,QAAQ,IACjD,SAAyC,IAAI,YAAY,IAC1D,aAAa,QAA4B;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,oBAAoB;AAAA,IAAW,KAAK,qBAAqB,MAAM;AAAA,EACzE,IAAI,MAAM,sBAAsB;AAAA,IAAW,KAAK,uBAAuB,MAAM;AAAA,EAC7E,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,aAAa;AAAA,IAAW,KAAK,cAAc,MAAM;AAAA,EAC3D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,OAAO;AAAA;AAGF,IAAM,YAAY,CAAC,UACxB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAG1C,IAAM,YAAY,CACvB,UACwD;AAAA,EACxD,MAAM,OAAO,YAAY,aAAa,KAAK,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC3C,OAAO,EAAE,OAAO,QAAQ,UAAU,KAAK,GAAG,KAAK;AAAA;;;AE1JjD,IAAM,SAAS,CAAC,UAAsB;AAAA,EACpC,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAQ,MAA0B,IAAI,MAAM;AAAA,EACtE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,MAAM,SAAS;AAAA,IACf,MAAM,MAA4B,CAAC;AAAA,IACnC,WAAW,OAAO,OAAO,KAAK,MAAM,EAAE,KAAK;AAAA,MAAG,IAAI,OAAO,OAAO,OAAO,QAAQ,IAAI;AAAA,IACnF,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,cAAc,CAAC,SAA0B,KAAK,MAAM,IAAI;AAG9D,IAAM,kBAAkB,CAAC,WAC9B,KAAK,UAAU,OAAQ,UAAU,IAAa,CAAC;AAG1C,IAAM,eAAe,CAAC,WAA4B,UAAU,gBAAgB,MAAM,CAAC;;;ACjBnF,MAAM,wBAAwB,MAAM;AAAA,EAE9B;AAAA,EACA;AAAA,EACA;AAAA,EAHX,WAAW,CACA,QACA,QACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,UAAU,UAAU,OAAO,MAAM,MAAM,QAAQ;AAAA,IALrD;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,YAAY;AAElB,IAAM,aAAa;AAInB,IAAM,WAAW,CAAC,YAChB,GAAG,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,CAAC,MAAM,QAAQ,WAAW;AAGrF,IAAM,UAAU,CAAC,SAAqC;AAAA,EACpD,MAAM,KAAK,KAAK,YAAY,UAAU;AAAA,EACtC,IAAI,OAAO;AAAA,IAAI;AAAA,EACf,IAAI;AAAA,IACF,MAAM,SAAS,KAAK,MAAM,KAAK,MAAM,EAAE,CAAC;AAAA,IACxC,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAAA,IACzD,MAAM;AAAA,IACN;AAAA;AAAA;AAIJ,IAAM,aAAa,CAAC,SAA2B;AAAA,EAC7C,IAAI,KAAK,KAAK,MAAM;AAAA,IAAI,OAAO,CAAC;AAAA,EAChC,IAAI;AAAA,IACF,MAAM,SAAS,KAAK,MAAM,IAAI;AAAA,IAC9B,OAAO,MAAM,QAAQ,MAAM,IAAK,OAAqB,IAAI,QAAQ,IAAI,CAAC;AAAA,IACtE,MAAM;AAAA,IACN,OAAO,CAAC;AAAA;AAAA;AAIZ,IAAM,OAAO,CAAC,UAA8B,QAAgB,SAAwB;AAAA,EAClF,MAAM,SAAS,QAAQ,SAAS,IAAI,MAAM,SAAS,KAAK,KAAK,EAAE,MAAM,GAAG,GAAG,KAAK;AAAA,EAEhF,MAAM,QAAQ,SAAS,WAAW,MAAM,GAAG,iCAAiC;AAAA,EAC5E,MAAM,IAAI,gBAAgB,SAAS,QAAQ,QAAQ,MAAM,KAAK;AAAA;AAMzD,IAAM,iBAAiB,OAAO,OAAmB,cAAwC;AAAA,EAC9F,MAAM,WAAW,MAAM,MAAM,QAAQ;AAAA,IACnC,MAAM;AAAA,IACN,SAAS,EAAE,gBAAgB,UAAU;AAAA,IACrC,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AAAA,EAGD,IAAI,SAAS,WAAW;AAAA,IAAK,KAAK,UAAU,QAAQ,QAAQ;AAAA,EAC5D,MAAM,SAAS,KAAK,MAAM,SAAS,IAAI;AAAA,EACvC,OAAO,EAAE,QAAQ,OAAO,UAAU,MAAM,WAAW,OAAO,YAAY,CAAC,GAAG,IAAI,QAAQ,EAAE;AAAA;AAInF,IAAM,oBAAoB,OAAO,UAAwC;AAAA,EAC9E,MAAM,WAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,OAAO,MAAM,WAAW,CAAC;AAAA,EACxE,IAAI,SAAS,WAAW;AAAA,IAAK,KAAK,UAAU,OAAO,UAAU;AAAA,EAC7D,OAAO,YAAY,SAAS,IAAI;AAAA;AAW3B,IAAM,gBAAgB,OAC3B,OACA,WACA,eAC+B;AAAA,EAC/B,MAAM,WAAW,MAAM,MAAM,QAAQ;AAAA,IACnC,MAAM;AAAA,IACN,SAAS;AAAA,MACP,gBAAgB;AAAA,SACZ,eAAe,YACf,CAAC,IACD,EAAE,+BAA+B,aAAa,4BAA4B,WAAW;AAAA,IAC3F;AAAA,IACA,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AAAA,EACD,MAAM,UAAU,QAAQ,SAAS,IAAI;AAAA,EACrC,IAAI,SAAS,WAAW,OAAO,YAAY;AAAA,IAAW,KAAK,UAAU,QAAQ,OAAO;AAAA,EACpF,OAAO,WAAW,SAAS,IAAI;AAAA;;ACtGjC;AACA,oBAAS;AACT;AACA;AACA;;;ACnBA;AAEO,IAAM,OAAO,CAAI,SACf,kBAAW;AAAA,EAChB,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,EAC3E,KAAK;AACP,CAAC;AAQI,IAAM,iBAAiB,CAAC,MAAe,QAAoC;AAAA,EAChF,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,QAAS,KAAiC;AAAA,EAChD,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA;;;ACjB7C;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,WAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,YAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,gBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,cAAM,QAAQ,GAAU,oBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,iBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,eAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,eAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,YAAW,sBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,YAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,sBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,sBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,YACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAaK,IAAM,sBAAsB,CAAC,KAAa,eACxC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,cAAM;AAAA,CACtE;;;AFxFI,IAAM,eAAe,CAAC,QACpB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,sBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,sBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AIzE9B,IAAM,qBAAqB;AAE3B,IAAM,gBAAgB;AAKtB,IAAM,cAAc,CAAC,WAAoC;AAAA,EACvD,IAAI,OAAO,SAAS,GAAG;AAAA,IAAG,OAAO;AAAA,EACjC,MAAM,OAAO,iDAAiD,KAAK,MAAM;AAAA,EACzE,IAAI,SAAS;AAAA,IAAM,OAAO,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,GAAG;AAAA,EAC9D,IAAI,eAAe,KAAK,MAAM,KAAK,CAAC,cAAc,KAAK,MAAM,GAAG;AAAA,IAC9D,OAAO,WAAW,KAAK,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA,EACvD;AAAA,EACA,MAAM,UAAU,OAAO,QAAQ,eAAe,EAAE;AAAA,EAChD,MAAM,QAAQ,QAAQ,YAAY,GAAG;AAAA,EACrC,MAAM,OAAO,OAAO,QAAQ,MAAM,QAAQ,CAAC,CAAC;AAAA,EAC5C,IAAI,UAAU,MAAM,CAAC,OAAO,UAAU,IAAI,KAAK,QAAQ;AAAA,IAAG,OAAO;AAAA,EACjE,OAAO,EAAE,MAAM,QAAQ,MAAM,GAAG,KAAK,GAAG,MAAM,OAAO,KAAK;AAAA;AAG5D,IAAM,YAAY,CAAC,SAAyB,KAAK,QAAQ,cAAc,IAAI;AAS3E,IAAM,UAAU,CAAC,YAAoB,eAAgC;AAAA,EACnE,MAAM,UAAU,UAAU,WAAW,MAAM,GAAG,WAAW,YAAY,GAAG,CAAC,CAAC;AAAA,EAC1E,MAAM,YAAY,UAAU,UAAU;AAAA,EACtC,OACE,YAAY,eAAe,aAAa,cAAc,cAAc,cAAc;AAAA;AAItF,IAAM,eAAe,CAAC,QAAgB,cACpC,OAAO,SAAS,QACZ,UAAU,SAAS,SACnB,OAAO,SAAS,UAAU,QAC1B,QAAQ,UAAU,YAAY,OAAO,IAAI,IACzC,UAAU,SAAS,UAAU,OAAO,SAAS,UAAU;AAG7D,IAAM,iBAAiB,CAAC,SACtB,CAAC,aAAa,SAAS,WAAW,EAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,OAAO,IAAI,GAAG;AAE7E,IAAM,aAAa,CAAC,WAAuC;AAAA,EACzD,IAAI,CAAC,OAAO,SAAS,KAAK;AAAA,IAAG,OAAO;AAAA,EACpC,IAAI;AAAA,IACF,MAAM,MAAM,IAAI,IAAI,MAAM;AAAA,IAE1B,OAAO,IAAI,aAAa,UAAU,IAAI,OAAO;AAAA,IAC7C,MAAM;AAAA,IACN;AAAA;AAAA;AAIJ,IAAM,gBAAgB,CAAC,OAAmB,cAAsD;AAAA,EAC9F,IAAI,MAAM,WAAW,WAAW;AAAA,IAC9B,MAAM,YACJ,UAAU,SAAS,SACnB,UAAU,SAAS,sBACnB,QAAQ,UAAU,YAAY,WAAW;AAAA,IAC3C,OAAO,YACH,YACA,2FACE;AAAA,EACR;AAAA,EACA,MAAM,SAAS,YAAY,MAAM,MAAM;AAAA,EACvC,MAAM,QAAQ,KAAK,UAAU,MAAM,MAAM;AAAA,EACzC,IAAI,OAAO,WAAW,UAAU;AAAA,IAC9B,OAAO,gBAAgB,YAAY;AAAA,EACrC;AAAA,EACA,IAAI,OAAO,SAAS,SAAS,CAAC,cAAc,KAAK,OAAO,IAAI,GAAG;AAAA,IAC7D,OAAO,gBAAgB;AAAA,EACzB;AAAA,EACA,OAAO,aAAa,QAAQ,SAAS,IACjC,YACA,gBAAgB;AAAA;AAIf,IAAM,gBAAgB,CAAC,SAAkB,cAA4C;AAAA,EAC1F,MAAM,QACJ,OAAO,YAAY,YAAY,YAAY,OACrC,QAAmC,SAAS,CAAC,IAC/C,CAAC;AAAA,EACP,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,MAAM,aAAa,MAAM;AAAA,IAC3B,OAAO,CAAC,6EAA6E;AAAA,EACvF;AAAA,EACA,IAAI,MAAM,WAAW;AAAA,IAAW,MAAM,KAAK,iDAAiD;AAAA,EAC5F,IAAI,MAAM,QAAQ,SAAS,WAAW;AAAA,IACpC,MAAM,KACJ,oFACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,cAAc,OAAO,SAAS;AAAA,EAC5C,IAAI,UAAU;AAAA,IAAW,MAAM,KAAK,KAAK;AAAA,EACzC,IAAI,UAAU,SAAS,OAAO;AAAA,IAC5B,MAAM,UAAU,MAAM,SAAS,IAAI,UAAU,KAAK,eAAe,UAAU,IAAI;AAAA,IAC/E,IAAI,CAAC,QAAQ,SAAS,UAAU,UAAU,GAAG;AAAA,MAC3C,MAAM,QACJ,MAAM,YAAY,YACd,qDAAqD,KAAK,UAAU,OAAO,MAC3E,iBAAiB,KAAK,UAAU,MAAM,OAAO;AAAA,MACnD,MAAM,KACJ,GAAG,2BAA2B,UAAU,6CACtC,iDACJ;AAAA,IACF;AAAA,EACF,EAAO,SAAI,MAAM,mBAAmB,MAAM;AAAA,IACxC,MAAM,KACJ,8FACE,gDACJ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACxJT,IAAM,cACJ,gGACA;AAGF,IAAM,cACJ;AAGF,IAAM,cAAc;AAGpB,IAAM,YAAY;AAEX,IAAM,cAAc;AAG3B,IAAM,YAAY,CAAC,OAAmB,SAA2B;AAAA,EAC/D,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1E,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAQ,MAAgC,QAAQ,CAAC,MAAM,UACrD,UAAU,MAAM,GAAG,QAAQ,OAAO,KAAK,IAAI,CAC7C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,OAAO,OAAO,QAAQ,KAAK,EAAE,QAAQ,EAAE,KAAK,UAAU,UAAU,MAAM,GAAG,QAAQ,KAAK,CAAC;AAAA,EACzF;AAAA,EACA,OAAO,CAAC;AAAA;AAOH,IAAM,oBAAoB,CAC/B,aACA,MACA,cACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,MAAM,UAAU,OAAO,QAAQ,eAAe,CAAC,CAAC,GAAG;AAAA,IAC7D,IAAI,YAAY,KAAK,IAAI;AAAA,MACvB,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,IACjE,SAAI,YAAY,KAAK,KAAK;AAAA,MAC7B,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,EACxE;AAAA,EACA,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAEzC,IAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MACzB,MAAM,KAAK,oBAAoB,OAAO,KAAK,8BAA8B,aAAa;AAAA,IACxF,EAAO,SAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAAA,MACzD,MAAM,KAAK,oBAAoB,OAAO,QAAQ,CAAC,6BAA6B,aAAa;AAAA,IAC3F,EAAO,SAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MAChC,MAAM,KAAK,oBAAoB,OAAO,KAAK,2BAA2B,aAAa;AAAA,IACrF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,UAAU,aAAa,CAAC,GAAG,WAAW,GAAG;AAAA,IAC1D,MAAM,KAAK,GAAG,6BAA6B,aAAa;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,qBAAqB,CAAC,YACjC,YAAY,KAAK,OAAO,IAAI,CAAC,gCAAgC,aAAa,IAAI,CAAC;;;AC1DjF,IAAM,eACJ,kGACA;AAGF,IAAM,cACJ;AAGF,IAAM,gBAAgB;AAEtB,IAAM,mBAAmB;AACzB,IAAM,oBACJ;AAGF,IAAM,SAAiD;AAAA,EACrD,CAAC,iEAAiE,gBAAgB;AAAA,EAClF,CAAC,+BAA+B,sBAAsB;AAAA,EACtD,CAAC,mCAAmC,eAAe;AAAA,EACnD,CAAC,0CAA0C,mBAAmB;AAAA,EAC9D,CAAC,mEAAmE,OAAO;AAAA,EAG3E,CAAC,0CAA0C,wBAAwB;AAAA,EACnE,CAAC,yBAAyB,yBAAyB;AACrD;AAEA,IAAM,cAAc;AACpB,IAAM,cAAc;AAUpB,IAAM,cAAc;AACpB,IAAM,eAAe,CAAC,SAAyB,KAAK,QAAQ,aAAa,IAAI;AAGtE,IAAM,WAAW,CAAC,SAA2B;AAAA,EAClD,MAAM,SAAmB,CAAC;AAAA,EAC1B,IAAI,UAAU;AAAA,EACd,IAAI;AAAA,EACJ,SAAS,QAAQ,EAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AAAA,IACnD,MAAM,OAAO,KAAK,UAAU;AAAA,IAC5B,IAAI,UAAU,WAAW;AAAA,MACvB,IAAI,SAAS,QAAQ,UAAU,OAAO,QAAQ,IAAI,KAAK,QAAQ;AAAA,QAC7D,SAAS;AAAA,QACT,WAAW,KAAK,UAAU;AAAA,MAC5B,EAAO,SAAI,SAAS;AAAA,QAAO,QAAQ;AAAA,MAC9B;AAAA,mBAAW;AAAA,IAClB,EAAO,SAAI,SAAS,OAAO,SAAS,KAAK;AAAA,MACvC,QAAQ;AAAA,IACV,EAAO,SAAI,KAAK,KAAK,IAAI,GAAG;AAAA,MAC1B,IAAI,YAAY;AAAA,QAAI,OAAO,KAAK,OAAO;AAAA,MACvC,UAAU;AAAA,IACZ,EAAO,SAAI,SAAS,OAAO,YAAY,IAAI;AAAA,MACzC;AAAA,IACF,EAAO;AAAA,iBAAW;AAAA,EACpB;AAAA,EACA,IAAI,YAAY;AAAA,IAAI,OAAO,KAAK,OAAO;AAAA,EACvC,OAAO;AAAA;AAQT,IAAM,kBAAkB,CAAC,WACvB,OACG,QAAQ,CAAC,UAAU,MAAM,QAAQ,aAAa,GAAG,EAAE,MAAM,KAAK,CAAC,EAC/D,OAAO,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,EACvF,WAAW;AAEhB,IAAM,eAAe,CAAC,QAA2B,UAA4B;AAAA,EAC3E,OAAO,QAAQ,IAAI,UAAU;AAAA,EAC7B,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,YAAY,KAAK,KAAK,KAAK,OAAO,SAAS,KAAK,CAAC,gBAAgB,OAAO,MAAM,CAAC,CAAC,GAAG;AAAA,IACrF,MAAM,KAAK,GAAG,YAAY,6BAA6B;AAAA,EACzD;AAAA,EACA,IAAI,cAAc,KAAK,KAAK,KAAK,OAAO,SAAS,KAAK,CAAC,gBAAgB,OAAO,MAAM,CAAC,CAAC,GAAG;AAAA,IACvF,MAAM,KAAK,GAAG,YAAY,SAAS,UAAU,+BAA+B;AAAA,EAC9E;AAAA,EACA,IAAI,iBAAiB,KAAK,KAAK,GAAG;AAAA,IAChC,MAAM,KAAK,OAAO,UAAU,CAAC,OAAO,UAAU,QAAQ,KAAK,kBAAkB,KAAK,KAAK,CAAC;AAAA,IACxF,IAAI,OAAO,MAAM,OAAO,SAAS,KAAK,KAAK,CAAC,gBAAgB,OAAO,MAAM,KAAK,CAAC,CAAC,GAAG;AAAA,MACjF,MAAM,KAAK,GAAG,YAAY,SAAS,OAAO,OAAO,gCAAgC;AAAA,IACnF;AAAA,EACF;AAAA,EACA,WAAW,SAAS,QAAQ;AAAA,IAC1B,MAAM,QAAQ,OAAO,KAAK,EAAE,aAAa,QAAQ,KAAK,KAAK,CAAC;AAAA,IAE5D,IAAI,UAAU;AAAA,MAAW,MAAM,KAAK,GAAG,gCAAgC,MAAM,IAAI;AAAA,EACnF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,0BAA0B,CAAC,cAAgC;AAAA,EACtE,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,YAAY,KAAK,SAAS;AAAA,IAAG,MAAM,KAAK,uCAAuC;AAAA,EACnF,YAAY,OAAO,SAAS,UAAU,MAAM;AAAA,CAAI,EAAE,QAAQ,GAAG;AAAA,IAC3D,MAAM,KAAK,GAAG,aAAa,SAAS,aAAa,IAAI,CAAC,GAAG,QAAQ,OAAO,QAAQ,CAAC,GAAG,CAAC;AAAA,EACvF;AAAA,EACA,OAAO,MAAM,IAAI,CAAC,YAAY,GAAG,YAAY,cAAa;AAAA;;;AC9F5D,IAAM,qBAAqB,CAAC,SAC1B,KAAK,WAAW,GAAG,KACnB,CAAC,KAAK,SAAS,GAAG,KAClB,CAAC,KAAK,SAAS,MAAM,KACrB,CAAC,KACE,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI;AAEzD,IAAM,iBAAiB,CAAC,UAAsC;AAAA,EACnE,MAAM,QAAkB,CAAC;AAAA,EAQzB,IAAI,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,IACjC,MAAM,KAAK,oEAAoE;AAAA,EACjF;AAAA,EACA,IAAI,MAAM,eAAe,aAAa,CAAC,mBAAmB,MAAM,UAAU,GAAG;AAAA,IAC3E,MAAM,KAAK,iDAAiD;AAAA,EAC9D;AAAA,EACA,MAAM,KAAK,GAAG,wBAAwB,MAAM,SAAS,CAAC;AAAA,EACtD,OAAO;AAAA;;;AChCT,IAAM,SAAS,CAAC,OAAmB,YACjC,IAAI,MAAM,mBAAmB,MAAM,aAAa,SAAS;AAE3D,IAAM,QAAQ,CAAC,WAA2B,OAAO,MAAM,GAAG,EAAE;AAU5D,IAAM,gBAAgB,CAAC,WAA6B;AAAA,EAClD,MAAM,OACJ,OAAO,WAAW,YAAY,WAAW,OAAQ,OAA8B,OAAO;AAAA,EACxF,OAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,OAAO,KAAK,IAAI,EAAE,WAAW;AAAA;AAS5E,IAAM,gBAAgB,OAC3B,OACA,UACqB;AAAA,EACrB,MAAM,QAAQ,eAAe,KAAK;AAAA,EAClC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,OAAO,OAAO,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1D,MAAM,UAAU,MAAM,eAAe,OAAO,MAAM,SAAS;AAAA,EAC3D,IAAI,cAAc,QAAQ,MAAM,GAAG;AAAA,IACjC,MAAM,OAAO,OAAO,oEAAoE;AAAA,EAC1F;AAAA,EACA,MAAM,QAAQ,cAAc,QAAQ,QAAQ,MAAM,QAAQ;AAAA,EAC1D,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,OAAO,OAAO,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1D,OAAO,EAAE,QAAQ,aAAa,QAAQ,MAAM,GAAG,UAAU,QAAQ,SAAS;AAAA;AAG5E,IAAM,eAAe,CACnB,OACA,SACA,gBAC2B;AAAA,EAC3B,cAAc,aAAa,OAAO;AAAA,EAClC,UAAU,MAAM;AAAA,KACZ,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AACnD;AAGO,IAAM,WAAW,OACtB,OACA,eAEA,aAAa,OAAO,MAAM,kBAAkB,KAAK,GAAG,UAAU;AASzD,IAAM,YAAY,CAAC,SAAkB,mBAC1C,cAAc,OAAO,KAAK,aAAa,OAAO,MAAM;AAmB/C,IAAM,YAAY,OACvB,OACA,WACA,eAC+B;AAAA,EAC/B,MAAM,UAAU,MAAM,kBAAkB,KAAK;AAAA,EAC7C,IAAI,cAAc,OAAO;AAAA,IAAG;AAAA,EAC5B,MAAM,aAAa,aAAa,OAAO,SAAS,UAAU;AAAA,EAC1D,IAAI,cAAc,WAAW;AAAA,IAC3B,OAAO,EAAE,YAAY,MAAM,OAAO,WAAW,yCAAyC;AAAA,EACxF;AAAA,EACA,IAAI;AAAA,IACF,MAAM,OAAO,MAAM,cAAc,OAAO,EAAE,UAAU,CAAC;AAAA,IACrD,OAAO,EAAE,YAAY,MAAM,UAAU,SAAS,KAAK,MAAM,EAAE;AAAA,IAC3D,OAAO,OAAO;AAAA,IAEd,IAAI,iBAAiB;AAAA,MAAuB,MAAM;AAAA,IAClD,OAAO;AAAA,MACL;AAAA,MACA,MAAM;AAAA,MACN,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAClE;AAAA;AAAA;AASG,IAAM,aAAa,OACxB,OACA,MACA,WACkB;AAAA,EAClB,MAAM,OAAO,MAAM,cAAc,OAAO,IAAI;AAAA,EAC5C,MAAM,OAAO,MAAM,SAAS,KAAK;AAAA,EACjC,MAAM,YACJ,KAAK,WAAW,KAAK,gBACrB,KAAK,iBAAiB,OAAO,gBAC7B,KAAK,eAAe,OAAO,cAI3B,MAAM,aAAa,OAAO;AAAA,EAC5B,OAAO,YAAY,EAAE,QAAQ,OAAO,IAAI,EAAE,QAAQ,SAAS;AAAA;AA6BtD,IAAM,kBAAkB,OAC7B,OACA,OACA,cACqB;AAAA,EACrB,MAAM,OAAO,MAAM,cAAc,OAAO,KAAK;AAAA,EAC7C,MAAM,UAAU,MAAM,kBAAkB,KAAK;AAAA,EAC7C,MAAM,SAAS,aAAa,OAAO;AAAA,EACnC,MAAM,QAAQ,WAAW,UAAU,UAAU,UAAU,SAAS,KAAK,MAAM;AAAA,EAC3E,IAAI,CAAC,UAAU,YAAY,CAAC,OAAO;AAAA,IACjC,MAAM,OACJ,OACA,qBAAqB,MAAM,MAAM,gEAC/B,MAAM,MAAM,KAAK,MAAM,iEACvB,2FACA,gDACJ;AAAA,EACF;AAAA,EACA,IAAI,WAAW,KAAK;AAAA,EACpB,MAAM,SAAS,WAAW,KAAK;AAAA,EAC/B,IAAI,QAAQ;AAAA,IACV,IAAI;AAAA,MACF,WAAW,MAAM,cAAc,OAAO,MAAM,WAAW,MAAM,UAAU;AAAA,MACvE,OAAO,OAAO;AAAA,MACd,IAAI,EAAE,iBAAiB;AAAA,QAAkB,MAAM;AAAA,MAI/C,MAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA,MACzD,MAAM,QACJ,UAAU,YACN,kDACA,MAAM,iBAAiB,SACrB,mDACA,iCAAiC,MAAM,MAAM,YAAY,uBAAuB,MAAM,MAAM;AAAA,MACpG,MAAM,OAAO,OAAO,iCAAiC,MAAM,YAAY,OAAO;AAAA;AAAA,EAElF;AAAA,EAIA,MAAM,aAAa,MAAM,SAAS,OAAO,MAAM,UAAU;AAAA,EACzD,IAAI,WAAW,iBAAiB,KAAK,QAAQ;AAAA,IAC3C,MAAM,OACJ,OACA,oCAAoC,MAAM,WAAW,YAAY,gBAC/D,GAAG,MAAM,KAAK,MAAM,+EACxB;AAAA,EACF;AAAA,EACA,OAAO,EAAE,YAAY,QAAQ,SAAS;AAAA;;;AVlMjC,IAAM,cAAc,SAAsB,gBAAgB;AAAA,EAC/D,sBAAsB;AACxB,CAAC;AAED,IAAM,cAAc,CAAC,UACnB,iBAAiB;AAQnB,IAAM,mBACJ,CAAI,OAA6B,aACjC,CAAC,UACQ,WACE,mBACL,6BAA6B,MAAM,aAAa,MAAM,qCACpD,0DACJ,GACA,QACF;AAEG,IAAM,sBAAsB,MACxB,gBACP,aACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EAErB,MAAM,QAAQ,CAAC,WAA+B,eACrC,gBACL,KAAK,MAAM,UAAU,OAAO,WAAW,UAAU,CAAC,GAClD,CAAC,UAAU;AAAA,IACT,IAAI,UAAU;AAAA,MAAW,OAAc,gBAAQ,SAAS;AAAA,IACxD,IAAI,MAAM;AAAA,MAAM,OAAc,gBAAQ,MAAM,UAAU;AAAA,IACtD,MAAM,UAAU,SAAQ,MAAM,UAAU;AAAA,IACxC,OAAO,MAAM,cAAc,YAChB,gBAAQ,OAAO,IACf,WACE,mBACL,mBAAmB,MAAM,wDACvB,gCAAgC,MAAM,0CAC1C,GACA,OACF;AAAA,GAER;AAAA,EACF,OAAO,YAAY,SAAS,GAAG;AAAA,IAE7B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAQ7B,MAAM,GAAG,MAAM,cACZ,WAAW,YACR,MAAM,eAAe,MAAM,WAAW,GAAG,eAAe,MAAM,YAAY,CAAC,IAC3E,KAAK,MAAM,SAAS,OAAO,eAAe,MAAM,YAAY,CAAC,CAAC,GAChE,KAEO,gBAAQ,aAAa,iBAAiB,OAAO,SAAS,CAAC,CAChE;AAAA,IAEF,MAAM,GAAG,MAAM,aAAa;AAAA,MAC1B,IAAI,WAAW;AAAA,QAAW,OAAc,gBAAQ,SAAS;AAAA,MACzD,MAAM,SAAS,iBAAiB,OAAO,EAAE,QAAQ,SAAkB,CAAC;AAAA,MACpE,IAAI,WAAW,IAAI,GAAG;AAAA,QACpB,OAAO,KAAK,MAAM,WAAW,OAAO,MAAM,MAAM,CAAC,EAAE,KAC1C,gBAAQ,aAAa,MAAM,CACpC;AAAA,MACF;AAAA,MAOA,MAAM,YAAY,eAAe,MAAM,WAAW;AAAA,MAClD,IAAI,cAAc;AAAA,QAAW,OAAc,gBAAQ,SAAS;AAAA,MAC5D,OAAO,KAAK,YAAY;AAAA,QACtB,MAAM,WAAW,OAAO,EAAE,UAAU,GAAG,MAAM;AAAA,QAC7C,OAAO,EAAE,QAAQ,SAAkB;AAAA,OACpC,EAAE,KAAY,gBAAQ,aAAa,MAAM,CAAC;AAAA;AAAA,IAG7C,WAAW,GAAG,KAAK,MAAM,aAChB,YAAI,UAAU,GAAG;AAAA,MAKtB,MAAM,YAAY,WAAW,aAAa,OAAO,aAAa,MAAM;AAAA,MACpE,MAAM,WAAW,cAAc,OAAO,aAAa,GAAG;AAAA,MACtD,MAAM,SAAS,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,aAAa;AAAA,MACzE,MAAM,UAAU,OAAO,KAAK,MAC1B,gBAAgB,OAAO,MAAM,EAAE,aAAa,OAAO,CAAC,CACtD;AAAA,MACA,WAAW,WAAW,QAAQ,UAAU;AAAA,QACtC,OAAc,mBAAW,mBAAmB,MAAM,aAAa,SAAS;AAAA,MAC1E;AAAA,MACA,OAAO,QAAQ;AAAA,KAChB;AAAA,IAEH,QAAQ,MAAa;AAAA,EACvB,CAAC;AAAA,CACF,CACH;;AWxIF,oBAAS;AAoCF,IAAM,wBAAwB;AAMrC,IAAM,OAAO;AACb,IAAM,YAAY;AAElB,IAAM,UAAS,CAAC,SAAiB,QAC/B,IAAI,MAAM,uBAAuB,KAAK,UAAU,OAAO,MAAM,KAAK;AAEpE,IAAM,aAAa,CAAC,aAClB,aAAa,eAAe,aAAa,WAAW,wBAAwB,KAAK,QAAQ;AAGpF,IAAM,oBAAoB,CAC/B,SACA,eACqD;AAAA,EACrD,IAAI,eAAe,aAAa,CAAC,UAAU,KAAK,UAAU,GAAG;AAAA,IAC3D,MAAM,QAAO,SAAS,cAAc,KAAK,UAAU,UAAU,qBAAqB;AAAA,EACpF;AAAA,EACA,IAAI,QAAQ,WAAW,IAAI,GAAG;AAAA,IAC5B,MAAM,aAAa,QAAQ,MAAM,KAAK,MAAM;AAAA,IAC5C,IAAI,CAAC,WAAW,WAAW,GAAG;AAAA,MAAG,MAAM,QAAO,SAAS,kCAAkC;AAAA,IACzF,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,WAAW,GAAG,QAAQ,EAAE,MAAM,QAAQ,WAAW,EAAE;AAAA,EAC9F;AAAA,EACA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,MAAM,IAAI,IAAI,OAAO;AAAA,IACrB,MAAM;AAAA,IACN,MAAM,QAAO,SAAS,mDAAmD;AAAA;AAAA,EAI3E,IAAI,IAAI,aAAa;AAAA,IAAS,MAAM,QAAO,SAAS,oCAAoC;AAAA,EACxF,IAAI,CAAC,WAAW,IAAI,QAAQ,GAAG;AAAA,IAC7B,MAAM,QAAO,SAAS,qEAAqE;AAAA,EAC7F;AAAA,EACA,IAAI,IAAI,aAAa,OAAO,IAAI,WAAW,MAAM,IAAI,aAAa,IAAI;AAAA,IACpE,MAAM,QAAO,SAAS,2DAA2D;AAAA,EACnF;AAAA,EACA,MAAM,OAAO,IAAI,SAAS,KAAK,KAAK,OAAO,IAAI,IAAI;AAAA,EAInD,MAAM,OAAO,cAAc,GAAG,IAAI,YAAY,OAAO,IAAI;AAAA,EACzD,OAAO;AAAA,IACL,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,OAAO,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC;AAAA,IACpD;AAAA,IAEA,QAAQ,EAAE,MAAM,IAAI,SAAS,QAAQ,cAAc,IAAI,GAAG,MAAM,OAAO,KAAK;AAAA,EAC9E;AAAA;AAGF,IAAM,OAAO,CAAC,UACZ,OAAO,UAAU,YAAY,UAAU,SAAQ,UAAU,SACrD,OAAQ,MAA4B,IAAI,IACxC;AAGN,IAAM,iBAAiB,CAAC,UACtB,KAAK,KAAK,MAAM,kBAAkB,KAAK,KAAK,MAAM;AAEpD,IAAM,WAAW,CACf,QACA,QACA,MACA,SACA,MACA,cAEA,IAAI,QAAQ,CAAC,SAAS,WAAW;AAAA,EAC/B,MAAM,QAAQ,SAAS,YAAY,YAAY,OAAO,KAAK,MAAM,MAAM;AAAA,EACvE,MAAM,UAAU,YACd;AAAA,OACM,OAAO,SAAS,QAChB,EAAE,MAAM,OAAO,MAAM,MAAM,OAAO,KAAK,IACvC,EAAE,YAAY,OAAO,WAAW;AAAA,IACpC,SAAS,UAAU,YAAY,UAAU,KAAK,SAAS,kBAAkB,MAAM,OAAO;AAAA,IACtF;AAAA,IACA;AAAA,IACA,SAAS;AAAA,EACX,GACA,CAAC,aAAa;AAAA,IACZ,MAAM,SAAmB,CAAC;AAAA,IAC1B,SAAS,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AAAA,IACzD,SAAS,GAAG,SAAS,MAAM;AAAA,IAC3B,SAAS,GAAG,OAAO,MACjB,QAAQ;AAAA,MACN,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AAAA,MAC3C,QAAQ,SAAS,cAAc;AAAA,IACjC,CAAC,CACH;AAAA,GAEJ;AAAA,EACA,QAAQ,GAAG,WAAW,MAAM,QAAQ,QAAQ,IAAI,MAAM,gBAAgB,OAAO,SAAS,MAAM,CAAC,CAAC;AAAA,EAC9F,QAAQ,GAAG,SAAS,MAAM;AAAA,EAC1B,QAAQ,IAAI,KAAK;AAAA,CAClB;AAEI,IAAM,kBAAkB,CAAC,UAAkC,CAAC,MAAkB;AAAA,EACnF,MAAM,UAAU,QAAQ,WAAW;AAAA,EACnC,QAAQ,UAAU,WAAW,kBAAkB,SAAS,QAAQ,UAAU;AAAA,EAC1E,MAAM,YAAY,QAAQ,aAAa;AAAA,EACvC,MAAM,UAAU,QAAQ,WAAW;AAAA,EACnC,MAAM,QAAQ,QAAQ,gBAAgB;AAAA,EACtC,MAAM,QACJ,SAAS,SAAS,QACd,EAAE,MAAM,SAAS,YAAY,QAAQ,UAAU,SAAS,aAAa,IACrE,EAAE,MAAM,YAAY;AAAA,EAC1B,OAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA,SAAS,SAAS,MAAM,SAAS,QAAQ,WAAW;AAAA,MAClD,SAAS,UAAU,IAAK,WAAW,GAAG;AAAA,QACpC,IAAI;AAAA,UAEF,OAAO,MAAM,SAAS,QAAQ,QAAQ,MAAM,KAAK,YAAY,MAAM,GAAG,MAAM,SAAS;AAAA,UACrF,OAAO,OAAO;AAAA,UACd,IAAI,CAAC,eAAe,KAAK,KAAK,WAAW,SAAS;AAAA,YAChD,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,YACpE,MAAM,UAAU,eAAe,UAAU,WAAW,YAAY;AAAA,YAChE,MAAM,eAAe,KAAK,IAAI,IAAI,sBAAsB,OAAO,IAAI,IAAI,MAAM,OAAO;AAAA,UACtF;AAAA,UAEA,MAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,KAAK,CAAC;AAAA;AAAA,MAE7D;AAAA;AAAA,EAEJ;AAAA;;ACjLF;AAKO,IAAM,iBAAiB,CAAC,QAAoB,gBAAgB,MACjE,oBAAoB,EAAE,KAAW,eAAQ,gBAAgB,KAAK,CAAC,CAAC;;ACWlE;AACA;;;ACZA,qBAAS;AACT,oBAAS;AACT,uBAAS;AACT;AACA;;;ACGO,IAAM,YAAY,CACvB,GACA,MACwB;AAAA,EACxB,IAAI,MAAM,aAAa,MAAM;AAAA,IAAW,OAAO;AAAA,EAC/C,IAAI,EAAE,QAAQ,aAAa,EAAE,QAAQ,aAAa,EAAE,QAAQ,aAAa,EAAE,QAAQ,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAIjC,IAAM,UAAU,OACrB,QACA,GACA,MACiC;AAAA,EACjC,IAAI,MAAM;AAAA,IAAG,OAAO;AAAA,EACpB,OAAO,MAAM,SAAS,MAAM,QAAQ,IAAI,CAAC,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,EACxE,OAAO,UAAU,MAAM,KAAK;AAAA;AAQvB,IAAM,eAAe,OAC1B,QACA,SACA,MACA,QACA,YACkB;AAAA,EAClB,MAAM,OAAO,MAAM,QAAQ,QAAQ,SAAS,IAAI;AAAA,EAChD,IAAI,SAAS;AAAA,IAAM;AAAA,EACnB,MAAM,OAAO;AAAA,EACb,IAAI,SAAS,aAAc,MAAM,OAAO,KAAK,IAAI,MAAO,WAAW;AAAA,IACjE,MAAM,QACJ,MACA,yBAAyB,gEACvB,2FACA,sCACJ;AAAA,EACF;AAAA;;;ACrDF;AACA;AAAA;AA6FO,MAAM,0BAAkC,iBAAuC,EACpF,8BACF,EAAE;AAAC;AAGI,IAAM,kBAAkB,CAAC,WACxB,eAAQ,mBAAmB,MAAM;AAGlC,IAAM,eAAe,CAAC,WAC3B,OAAO,cAAc,OAAO,aAAa,MAAM;;;ACnFjD,IAAM,YAAY,CAAC,UACjB,OAAO,UAAU,WAAW,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;AAGrE,IAAM,aAAa,OACxB,QACA,UACA,MACA,YAC4C;AAAA,EAC5C,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI,SAAS,UAAU,WAAW;AAAA,IAChC,MAAM,UAAU,SAAS,KAAK,MAAM,MAAM,OAAO,WAAW,OAAO,SAAS,KAAK,CAAC,IAAI;AAAA,IACtF,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,WAAW,OAAO,SAAS,KAAK,gBAAgB;AAAA,EAC5F;AAAA,EACA,IAAI,SAAS,UAAU,WAAW;AAAA,IAChC,MAAM,UAAU,SAAS,KAAK,KAAM,MAAM,OAAO,YAAY,OAAO,SAAS,KAAK,CAAC;AAAA,IACnF,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,YAAY,OAAO,SAAS,KAAK,gBAAgB;AAAA,EAC7F;AAAA,EACA,OAAO,KAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,MAAQ,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,EAAG;AAAA;AAIjF,IAAM,qBAAqB,OAChC,QACA,SAC4C;AAAA,EAC5C,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,KAAK,SAAS,SAAS,MAAM,OAAO,SAAS,IAAI,IAAI;AAAA,EACnE,OAAO;AAAA,IACL,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,IACX;AAAA,IACA,QAAQ,UAAU,YAAY,KAAK,UAAU,KAAK;AAAA,IAClD,MAAM,KAAK;AAAA,IACX,KAAK,KAAK;AAAA,EACZ;AAAA;AAGK,IAAM,iBAAiB,CAAC,UAAoC;AAAA,EACjE,MAAM,KAAK;AAAA,KACP,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AAAA,KAC9C,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AACpD;AAEO,IAAM,cAAc,CAAC,MAA0B,SACpD,KAAK,WAAW,KAAK,UACrB,KAAK,SAAS,KAAK,SAClB,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK,SAC5C,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK;AAOxC,IAAM,aAAa,OACxB,QACA,MACA,WACkB;AAAA,EAClB,MAAM,SAAS,OAAO,SAA8B;AAAA,IAClD,MAAM,OAAO,aAAa,KAAK,MAAM,eAAe,IAAI,CAAC;AAAA,IACzD,OAAO;AAAA;AAAA,EAMT,IAAI,KAAK,SAAS,OAAO,MAAM;AAAA,IAC7B,MAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK,MAAM,OAAO,IAAI;AAAA,IACzD,OAAO,OAAO,EAAE,QAAQ,SAAS,OAAO,WAAW,UAAU,CAAC;AAAA,EAChE;AAAA,EACA,IAAI,KAAK,WAAW,OAAO;AAAA,IAAQ,OAAO,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA,EACrE,MAAM,OAAO,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,EACvD,OAAO,SAAS,aAAa,YAAY,MAAM,IAAI,IAC/C,EAAE,QAAQ,OAAO,IACjB,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA;AAsB1B,IAAM,eAAe,OAC1B,QACA,MACA,QACA,QAAQ,UACwB;AAAA,EAChC,QAAQ,MAAM,oBAAW;AAAA,EACzB,MAAM,OAAO,KAAK;AAAA,EAElB,IAAI,KAAK,QAAQ,aAAa,KAAK,QAAQ,OAAO,aAAa,KAAK,CAAC,aAAa,MAAM,GAAG;AAAA,IACzF,MAAM,QACJ,MACA,SAAS,OAAO,KAAK,KAAK,sEACxB,2FACA,mCACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS,aAAa,KAAK,SAAS,QAAQ;AAAA,IAC9C,MAAM,QACJ,MACA,QAAQ,KAAK,gEACf;AAAA,EACF;AAAA,EACA,MAAM,SAAS,SAAS,YAAY,YAAY,MAAM,mBAAmB,QAAQ,IAAI;AAAA,EAKrF,MAAM,QAAQ,WAAW,aAAa,OAAO,SAAS;AAAA,EACtD,MAAM,QAAQ,QAAQ,YAAY;AAAA,EASlC,MAAM,WAAW,SAAS,WAAW;AAAA,EACrC,IAAI,UAAU,aAAa,WAAW,aAAa,CAAC,YAAY,QAAQ,IAAI,KAAK,CAAC,UAAU;AAAA,IAC1F,MAAM,QACJ,MACA,6FACE,sBACJ;AAAA,EACF;AAAA,EACA,IAAI,WAAW,aAAa,CAAC,YAAY,QAAQ,IAAI,GAAG;AAAA,IACtD,MAAM,QAAQ,MAAM,KAAK,SAAS,MAAM;AAAA,IAGxC,IAAI,UAAU,KAAK,MAAM,KAAK,QAAQ;AAAA,MACpC,MAAM,QAAO,MAAM,qCAAqC,KAAK,8BAA8B;AAAA,IAC7F;AAAA,IACA,MAAM,OAAO,gBAAgB,MAAM,OAAO,eAAe,IAAI,CAAC;AAAA,EAChE;AAAA,EAOA,MAAM,WAAW,YAAY;AAAA,IAC3B,IAAI,WAAW;AAAA,MAAW,MAAM,OAAO,WAAW,IAAI,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA;AAAA,EAE/E,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,IAAI,EAAE,MAAM,OAAO,UAAmB;AAAA,IACnF,MAAM,SAAS;AAAA,IACf,MAAM,QAAO,MAAM,kDAAkD,OAAO,KAAK,GAAG;AAAA,GACrF;AAAA,EACD,IAAI,UAAU,aAAa,CAAC,YAAY,OAAO,IAAI,GAAG;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,MAAM,QAAO,MAAM,wEAAwE;AAAA,EAC7F;AAAA,EAGA,IAAI;AAAA,IACF,MAAM,aACJ,QACA,OAAO,MACP,MACA,MAAM,gBAAgB,QAAQ,QAAQ,OAAM,GAC5C,OACF;AAAA,EACF,OAAO;AAAA;AAIF,IAAM,kBAAkB,OAC7B,QACA,QACA,YACkB;AAAA,EAClB,MAAM,OAAO,MAAM,OAAO,KAAK,OAAO,IAAI;AAAA,EAC1C,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAAQ,MAAM,QAAO,OAAO,MAAM,YAAY,KAAK,uBAAuB;AAAA,EAC5F,MAAM,OAAO,WAAW,OAAO,IAAI;AAAA;;;ACrM9B,IAAM,eAAe;AAGrB,IAAM,mBAAmB,CAAC,MAAc,UAAiD;AAAA,EAC9F,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAOpE,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,KAAK,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,uBAAuB;AAAA,EAG7D,IACE,KAAK,SAAS,GAAG,KACjB,KACG,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAC9D;AAAA,IACA,MAAM,KAAK,6EAA6E;AAAA,EAC1F;AAAA,EACA,IAAI,KAAK,SAAS,MAAM;AAAA,IAAG,MAAM,KAAK,mBAAmB;AAAA,EACzD,OAAO;AAAA;AAGF,IAAM,eAAe,CAAC,UAAmC;AAAA,EAC9D,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,OAAO;AAAA;;;AChDT,IAAM,UAAS,CAAC,MAAc,YAA2B,IAAI,MAAM,aAAa,SAAS,SAAS;AAG3F,IAAM,cAAc,OAAO,QAAoB,UAA2C;AAAA,EAC/F,MAAM,QAAQ,aAAa,KAAK;AAAA,EAChC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,QAAO,MAAM,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,EAC/D,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,MAAM,OAAO;AAAA,EACpD,OAAO;AAAA,IACL;AAAA,IACA,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM;AAAA,IACZ,QAAQ,UAAU,KAAK;AAAA,OACnB,MAAM,WAAW,QAAQ,OAAO,MAAM,MAAM,OAAM;AAAA,EACxD;AAAA;AAIK,IAAM,WAAW,OACtB,QACA,MACA,WACkB,WAAW,QAAQ,MAAM,YAAY,QAAQ,IAAI,GAAG,MAAM;AAMvE,IAAM,gBAAgB,OAC3B,QACA,OACA,QACA,QAAQ,UACwB;AAAA,EAChC,MAAM,OAAO,MAAM,YAAY,QAAQ,KAAK;AAAA,EAC5C,MAAM,OAAO,EAAE,UAAU,YAAY,KAAK,OAAO,OAAO,MAAM,OAAO,iBAAQ,KAAK;AAAA,EAClF,OAAO,aAAa,QAAQ,MAAM,QAAQ,KAAK;AAAA;AAI1C,IAAM,aAAa,CAAC,QAAoB,WAC7C,gBAAgB,QAAQ,QAAQ,OAAM;;;ALrCjC,IAAM,WAAW,UAAmB,WAAW;AAE/C,IAAM,mBAAmB,MACrB,iBACP,UACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,SAAS,SAAS,GAAG;AAAA,IAC1B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAE7B,MAAM,GAAG,MAAM,aACb,KAAK,YAAY;AAAA,MACf,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,MACxD,IAAI,UAAU;AAAA,QAAW;AAAA,MACzB,OAAO,WAAW,YAAY,SAAQ,KAAK,IAAI;AAAA,KAChD;AAAA,IAEH,MAAM,GAAG,YAAY,MAAM,aAAa;AAAA,MAEtC,IAAI,WAAW;AAAA,QAAW,OAAO,eAAe,UAAU;AAAA,MAC1D,IAAI,YAAW,IAAI;AAAA,QAAG,OAAO,KAAK,MAAM,SAAS,QAAQ,MAAM,MAAM,CAAC;AAAA,MAMtE,MAAM,OAAO,eAAe,MAAM,MAAM;AAAA,MACxC,IAAI,SAAS,aAAa,SAAS,OAAO;AAAA,QAAM,OAAc,gBAAQ,SAAS;AAAA,MAC/E,OAAO,KAAK,YACT,MAAM,QAAQ,QAAQ,MAAM,OAAO,IAAI,MAAO,OAC3C,YACA,EAAE,QAAQ,UAAmB,CACnC;AAAA;AAAA,IAKF,WAAW,GAAG,KAAK,YAAY,MAAM,aAC5B,gBAAQ,cAAc,EAAE,KAAK,YAAY,OAAO,CAAC,GAAG,CAAC,UAC1D,KAAK,MAAM,cAAc,QAAQ,MAAM,QAAQ,KAAK,CAAC,CACvD;AAAA,IAEF,QAAQ,GAAG,aAAa,KAAK,MAAM,WAAW,QAAQ,MAAM,CAAC;AAAA,EAC/D,CAAC;AAAA,CACF,CACH;;;AD5BK,IAAM,gBAAgB,CAAC,IAAY,UACjC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,eAAe,EAAE,WAAW,MAAM,WAAW,YAAY,MAAM,KAAK,CAAC;AAAA,EACnF,IAAI,MAAM,SAAS,GAAG;AAAA,IACpB,OAAO,OAAc,aAAK,IAAI,MAAM,iBAAiB,OAAO,MAAM,KAAK,IAAI,GAAG,CAAC;AAAA,EACjF;AAAA,EACA,MAAM,OAAO,OAAO,SAAS,GAAG,WAAW;AAAA,IACzC,SAAS,MAAM;AAAA,IACf,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM;AAAA,OACR,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,OACtD,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,EAC5D,CAAC,EAAE,KAAmB,qBAAO,CAAC;AAAA,EAC9B,MAAM,SAAS,OAAO,YAAY,IAAI,EAAE,WAAW,MAAM,WAAW,YAAY,KAAK,KAAK,CAAC;AAAA,EAC3F,OAAO,EAAE,QAAQ,KAAK;AAAA,CACvB;",
-  "debugId": "A91D75C3B7D7145864756E2164756E21",
+  "mappings": ";AAoBA,IAAM,uBAAuB,CAAC,kBAAkB,cAAc;AA6B9D,IAAM,WAAW,IAAI,IAAI,CAAC,aAAa,aAAa,OAAO,OAAO,CAAC;AAQnE,IAAM,SAAS,CAAC,aAA6B;AAAA,EAC3C,MAAM,UAAU,SAAS,QAAQ,gBAAgB,EAAE;AAAA,EACnD,IAAI,QAAQ,WAAW,OAAO;AAAA,IAAG,OAAO;AAAA,EAGxC,IAAI,QAAQ,WAAW,GAAG;AAAA,IAAG,OAAO,QAAQ,MAAM,GAAG,QAAQ,QAAQ,GAAG,IAAI,CAAC;AAAA,EAE7E,MAAM,QAAQ,QAAQ,QAAQ,GAAG;AAAA,EACjC,OAAO,UAAU,KAAK,UAAU,QAAQ,MAAM,GAAG,KAAK;AAAA;AAGjD,IAAM,mBAAmB,CAAC,aAA+B;AAAA,EAC9D,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OAAO,OAAO,SAAS,KAAK,CAAC;AAAA,EAEnC,IAAI,SAAS,KAAK,MAAM;AAAA,IAAI,MAAM,KAAK,mBAAmB;AAAA,EACrD,SAAI,SAAS,UAAU,CAAC,SAAS,IAAI,IAAI,GAAG;AAAA,IAC/C,MAAM,KACJ,mDAAmD,gDACrD;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAoBF,IAAM,oBAAoB,CAAC,UAA0C;AAAA,EAC1E,MAAM,WAAW,iBAAiB,MAAM,QAAQ;AAAA,EAChD,IAAI,SAAS,SAAS;AAAA,IAAG,MAAM,IAAI,MAAM,sBAAsB,SAAS,KAAK,IAAI,GAAG;AAAA,EAEpF,MAAM,SAAS,MAAM,UAAU;AAAA,EAC/B,MAAM,MAAM,MAAM,OAAO;AAAA,EACzB,MAAM,UAAU,MAAM,eAAe;AAAA,EAErC,MAAM,QAAQ;AAAA,IACZ,GAAI,MAAM,QAAQ,CAAC;AAAA,IACnB,gBAAgB,MAAM;AAAA,IACtB,GAAG,aAAa;AAAA,IAGhB,GAAG;AAAA,IACH,GAAG,QAAQ,IAAI,CAAC,WAAW,GAAG,SAAS,SAAS,QAAQ;AAAA,IACxD,GAAG;AAAA,IACH;AAAA,EACF;AAAA,EAEA,OAAO,MAAM,IAAI,CAAC,SAAS,GAAG,SAAS,MAAM,EAAE,KAAK;AAAA,CAAI;AAAA;;AClG1D;AACA;AAAA;AA6BO,MAAM,0BAAkC,gBAAwC,EACrF,4BACF,EAAE;AAAC;AAQI,IAAM,kBAAkB,CAC7B,cAEM,eACE,cAAQ,mBAAmB;AAAA,EAC/B,UAAU,UAAU;AAAA,EACpB,UAAU,UAAU;AACtB,CAAC,GACD,UAAU,KACZ;;ACpDF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AAgBA,IAAM,kBAAkB,IAAI,IAAI,CAAC,gBAAgB,QAAQ,CAAC;AAE1D,IAAM,SAAS,CAAC,UACd,OAAO,UAAU,YAAY,UAAU,SAAQ,UAAU,SACrD,OAAQ,MAA4B,IAAI,IACxC;AAOC,IAAM,gBAAgB,CAAC,UAC5B,iBAAiC,mCACjC,MAAM,OAAO,SAAS,oBACtB,gBAAgB,IAAI,OAAO,MAAM,OAAO,KAAK,KAAK,EAAE;AAEtD,IAAM,mBAAmB,CAAC,UAA8C,UACtE,IAAoB,gCAAgB;AAAA,EAClC,QAAQ,IAAoB,+BAAe,EAAE,mBAAS,MAAM,CAAC;AAC/D,CAAC;AAGH,IAAM,iBAAiB,CAAC,YAA8D;AAAA,EACpF,MAAM,OAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;AAAA,IAClD,IAAI,UAAU;AAAA,MAAW,KAAK,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI;AAAA,EACjF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,kBAAkB,CACtB,aACA,aAEO,gBAAgE,CAAC,WAAW;AAAA,EACjF,MAAM,WAAU,CAAC,UAAuB;AAAA,IACtC,OAAc,YAAK,iBAAiB,UAAS,KAAK,CAAC,CAAC;AAAA;AAAA,EAEtD,YAAY,GAAG,SAAS,QAAO;AAAA,EAC/B,MAAM,aAAa,CAAC,aAAyC;AAAA,IAC3D,YAAY,IAAI,SAAS,QAAO;AAAA,IAChC,OAAc,eAAQ,QAAQ,CAAC;AAAA;AAAA,EAEjC,YAAY,GAAG,YAAY,UAAU;AAAA,EACrC,OAAc,YAAK,MAAM;AAAA,IACvB,YAAY,IAAI,SAAS,QAAO;AAAA,IAChC,YAAY,IAAI,YAAY,UAAU;AAAA,GACvC;AAAA,CACF;AAEH,IAAM,gBAAgB,CACpB,aACA,aAEO,gBAAgD,CAAC,WAAW;AAAA,EACjE,MAAM,WAAU,CAAC,UAAuB;AAAA,IACtC,OAAc,YAAK,iBAAiB,UAAS,KAAK,CAAC,CAAC;AAAA;AAAA,EAEtD,YAAY,KAAK,SAAS,QAAO;AAAA,EACjC,MAAM,WAAW,MAAY;AAAA,IAC3B,YAAY,IAAI,SAAS,QAAO;AAAA,IAChC,OAAc,WAAI;AAAA;AAAA,EAEpB,YAAY,KAAK,UAAU,QAAQ;AAAA,EACnC,OAAc,YAAK,MAAM;AAAA,IACvB,YAAY,IAAI,SAAS,QAAO;AAAA,IAChC,YAAY,IAAI,UAAU,QAAQ;AAAA,GACnC;AAAA,CACF;AAQH,IAAM,WAAW,CACf,aACA,aAEO,eAAQ,MAAM;AAAA,EACnB,MAAM,OAAO,SAAQ;AAAA,EACrB,IAAI,KAAK,SAAS,SAAS;AAAA,IACzB,YAAY,IAAI;AAAA,IAChB,OAAO,cAAc,aAAa,QAAO;AAAA,EAC3C;AAAA,EACA,IAAI,KAAK,SAAS,cAAc;AAAA,IAI9B,YAAY,UAAU,kBAAkB,KAAK,aAAa;AAAA,IAC1D,YAAY,IAAI,KAAK,IAAI;AAAA,IACzB,OAAO,cAAc,aAAa,QAAO;AAAA,EAC3C;AAAA,EACA,OAAc,YACZ,IAAoB,gCAAgB;AAAA,IAClC,QAAQ,IAAoB,4BAAY;AAAA,MACtC;AAAA,MACA,aAAa,oDAAoD,KAAK;AAAA,IACxE,CAAC;AAAA,EACH,CAAC,CACH;AAAA,CACD;AAEH,IAAM,gBAAgB,CAAC,WACrB,IAAI,SAAS,SAAS,MAAM,MAAM,GAAgC;AAAA,EAChE,SAAS,eAAe,OAAO,OAAO;AAAA,EACtC,QAAQ,OAAO,cAAc;AAC/B,CAAC;AAEH,IAAM,eAAe,CACnB,QACA,UACA,KACA,QACA,cAEO,eAAQ,MAAM;AAAA,EACnB,MAAM,cAAmB,aAAQ;AAAA,IAC/B,SAAS,SAAQ;AAAA,IACjB,QAAQ,SAAQ;AAAA,IAChB,MAAM,GAAG,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,SAAS;AAAA,OACL,OAAO,SAAS,SAChB,EAAE,YAAY,OAAO,WAAW,IAChC,EAAE,MAAM,OAAO,MAAM,MAAM,OAAO,KAAK;AAAA,EAC7C,CAAC;AAAA,EAID,YAAY,GAAG,WAAW,MAAM;AAAA,IAC9B,YAAY,QAAQ,IAAI,MAAM,gBAAgB,OAAO,SAAS,MAAM,CAAC;AAAA,GACtE;AAAA,EACD,OAAc,iBACZ,gBAAgB,aAAa,QAAO,GACpC,SAAS,aAAa,QAAO,EAAE,KAAY,eAAe,YAAK,CAAC,CAClE,EAAE,KACO,eAAQ,MAAa,YAAK,MAAM,YAAY,QAAQ,CAAC,CAAC,GACtD,WAAI,CAAC,WAA8B,2BAAQ,UAAS,cAAc,MAAM,CAAC,CAAC,CACnF;AAAA,CACD;AAWH,IAAM,uBAAuB,CAC3B,SACA,SACA,iBAEO,WAAI,UAAU,GAAG;AAAA,EACtB,IAAI,eAAe;AAAA,EACnB,UAAS;AAAA,IACP,MAAM,UAAU,OAAc,cAAO,OAAO;AAAA,IAC5C,IAAW,iBAAU,OAAO;AAAA,MAAG,OAAO,QAAQ;AAAA,IAC9C,IAAI,gBAAgB,KAAK,CAAC,cAAc,QAAQ,OAAO,GAAG;AAAA,MACxD,OAAO,OAAc,YAAK,QAAQ,OAAO;AAAA,IAC3C;AAAA,IACA,gBAAgB;AAAA,IAChB,OAAc,aAAe,gBAAO,YAAY,CAAC;AAAA,EACnD;AAAA,CACD;AAGI,IAAM,sBAAsB,CACjC,QACA,UAAkC,CAAC,MACI;AAAA,EACvC,MAAM,YAAY,QAAQ,aAAa;AAAA,EACvC,MAAM,UAAU,QAAQ,WAAW;AAAA,EACnC,MAAM,eAAe,QAAQ,gBAAgB;AAAA,EAC7C,OAAa,eACA,uBACA,gBAAK,CAAC,UAAS,KAAK,WAAW;AAAA,IACxC,MAAM,UAAU,aAAa,QAAQ,UAAS,KAAK,QAAQ,SAAS;AAAA,IACpE,OAAO,WAAW,IAAI,UAAU,qBAAqB,SAAS,SAAS,YAAY;AAAA,GACpF,CACH;AAAA;;AC1MF;AACA,oBAAS;AACT;AACA;AACA;;;ACpBA;AAEO,IAAM,OAAO,CAAI,SACf,mBAAW;AAAA,EAChB,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,EAC3E,KAAK;AACP,CAAC;AAQI,IAAM,iBAAiB,CAAC,MAAe,QAAoC;AAAA,EAChF,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,QAAS,KAAiC;AAAA,EAChD,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA;;;ACjB7C;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,WAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,YAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,gBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,cAAM,QAAQ,GAAU,oBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,gBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,cAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,cAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,YAAW,sBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,YAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,sBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,sBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,YACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAaK,IAAM,sBAAsB,CAAC,KAAa,eACxC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,cAAM;AAAA,CACtE;;;AFxFI,IAAM,eAAe,CAAC,QACpB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,sBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,sBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AI/G9B;AACA;;;ACWA;AACA;AAEA,IAAM,YAAY;AAIlB,IAAM,WAAW,CAAC,YAChB,GAAG,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,CAAC,MAAM,QAAQ,WAAW;AAK9E,IAAM,iBAAiB,CAC5B,cAEO,YACC,eAAS,MAAM,YAAY,EAAE,QAAQ,WAAW,aAAa,UAAU,CAAC,GAC9E,CAAC,cAAc;AAAA,EACb,QAAQ,SAAS,UAAU;AAAA,EAC3B,WAAW,SAAS,YAAY,CAAC,GAAG,IAAI,QAAQ;AAClD,EACF;AAGK,IAAM,oBAAoB,MAIrB,YAAU,eAAS,MAAM,UAAU,EAAE,MAAM,GAAG,CAAC,GAAG,CAAC,aAAa,SAAS,SAAS,IAAI;AAa3F,IAAM,gBAAgB,CAC3B,WACA,eAEO,YACC,eAAS,MAAM,WAAW;AAAA,EAC9B,QAAQ;AAAA,EACR,aAAa;AAAA,KACT,eAAe,YAAY,CAAC,IAAI,EAAE,eAAe,aAAa,WAAW;AAC/E,CAAC,GACD,CAAC,cAAc,SAAS,YAAY,CAAC,GAAG,IAAI,QAAQ,CACtD;;;AC3BF,IAAM,qBAAqB;AAE3B,IAAM,gBAAgB;AAKtB,IAAM,cAAc,CAAC,WAAoC;AAAA,EACvD,IAAI,OAAO,SAAS,GAAG;AAAA,IAAG,OAAO;AAAA,EACjC,MAAM,OAAO,iDAAiD,KAAK,MAAM;AAAA,EACzE,IAAI,SAAS;AAAA,IAAM,OAAO,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,GAAG;AAAA,EAC9D,IAAI,eAAe,KAAK,MAAM,KAAK,CAAC,cAAc,KAAK,MAAM,GAAG;AAAA,IAC9D,OAAO,WAAW,KAAK,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA,EACvD;AAAA,EACA,MAAM,UAAU,OAAO,QAAQ,eAAe,EAAE;AAAA,EAChD,MAAM,QAAQ,QAAQ,YAAY,GAAG;AAAA,EACrC,MAAM,OAAO,OAAO,QAAQ,MAAM,QAAQ,CAAC,CAAC;AAAA,EAC5C,IAAI,UAAU,MAAM,CAAC,OAAO,UAAU,IAAI,KAAK,QAAQ;AAAA,IAAG,OAAO;AAAA,EACjE,OAAO,EAAE,MAAM,QAAQ,MAAM,GAAG,KAAK,GAAG,MAAM,OAAO,KAAK;AAAA;AAG5D,IAAM,YAAY,CAAC,SAAyB,KAAK,QAAQ,cAAc,IAAI;AAS3E,IAAM,UAAU,CAAC,YAAoB,eAAgC;AAAA,EACnE,MAAM,UAAU,UAAU,WAAW,MAAM,GAAG,WAAW,YAAY,GAAG,CAAC,CAAC;AAAA,EAC1E,MAAM,YAAY,UAAU,UAAU;AAAA,EACtC,OACE,YAAY,eAAe,aAAa,cAAc,cAAc,cAAc;AAAA;AAItF,IAAM,eAAe,CAAC,QAAgB,cACpC,OAAO,SAAS,QACZ,UAAU,SAAS,SACnB,OAAO,SAAS,UAAU,QAC1B,QAAQ,UAAU,YAAY,OAAO,IAAI,IACzC,UAAU,SAAS,UAAU,OAAO,SAAS,UAAU;AAG7D,IAAM,iBAAiB,CAAC,SACtB,CAAC,aAAa,SAAS,WAAW,EAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,OAAO,IAAI,GAAG;AAE7E,IAAM,aAAa,CAAC,WAAuC;AAAA,EACzD,IAAI,CAAC,OAAO,SAAS,KAAK;AAAA,IAAG,OAAO;AAAA,EACpC,IAAI;AAAA,IACF,MAAM,MAAM,IAAI,IAAI,MAAM;AAAA,IAE1B,OAAO,IAAI,aAAa,UAAU,IAAI,OAAO;AAAA,IAC7C,MAAM;AAAA,IACN;AAAA;AAAA;AAIJ,IAAM,gBAAgB,CAAC,OAAmB,cAAsD;AAAA,EAC9F,IAAI,MAAM,WAAW,WAAW;AAAA,IAC9B,MAAM,YACJ,UAAU,SAAS,SACnB,UAAU,SAAS,sBACnB,QAAQ,UAAU,YAAY,WAAW;AAAA,IAC3C,OAAO,YACH,YACA,2FACE;AAAA,EACR;AAAA,EACA,MAAM,SAAS,YAAY,MAAM,MAAM;AAAA,EACvC,MAAM,QAAQ,KAAK,UAAU,MAAM,MAAM;AAAA,EACzC,IAAI,OAAO,WAAW,UAAU;AAAA,IAC9B,OAAO,gBAAgB,YAAY;AAAA,EACrC;AAAA,EACA,IAAI,OAAO,SAAS,SAAS,CAAC,cAAc,KAAK,OAAO,IAAI,GAAG;AAAA,IAC7D,OAAO,gBAAgB;AAAA,EACzB;AAAA,EACA,OAAO,aAAa,QAAQ,SAAS,IACjC,YACA,gBAAgB;AAAA;AAIf,IAAM,gBAAgB,CAAC,SAAkB,cAA4C;AAAA,EAC1F,MAAM,QACJ,OAAO,YAAY,YAAY,YAAY,OACrC,QAAmC,SAAS,CAAC,IAC/C,CAAC;AAAA,EACP,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,MAAM,aAAa,MAAM;AAAA,IAC3B,OAAO,CAAC,6EAA6E;AAAA,EACvF;AAAA,EACA,IAAI,MAAM,WAAW;AAAA,IAAW,MAAM,KAAK,iDAAiD;AAAA,EAC5F,IAAI,MAAM,QAAQ,SAAS,WAAW;AAAA,IACpC,MAAM,KACJ,oFACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,cAAc,OAAO,SAAS;AAAA,EAC5C,IAAI,UAAU;AAAA,IAAW,MAAM,KAAK,KAAK;AAAA,EACzC,IAAI,UAAU,SAAS,OAAO;AAAA,IAC5B,MAAM,UAAU,MAAM,SAAS,IAAI,UAAU,KAAK,eAAe,UAAU,IAAI;AAAA,IAC/E,IAAI,CAAC,QAAQ,SAAS,UAAU,UAAU,GAAG;AAAA,MAC3C,MAAM,QACJ,MAAM,YAAY,YACd,qDAAqD,KAAK,UAAU,OAAO,MAC3E,iBAAiB,KAAK,UAAU,MAAM,OAAO;AAAA,MACnD,MAAM,KACJ,GAAG,2BAA2B,UAAU,6CACtC,iDACJ;AAAA,IACF;AAAA,EACF,EAAO,SAAI,MAAM,mBAAmB,MAAM;AAAA,IACxC,MAAM,KACJ,8FACE,gDACJ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACpKT;AAIO,IAAM,SAAS,CAAC,UAAkB,YACvC,IAAI,MAAM,mBAAmB,aAAa,SAAS;AAE9C,IAAM,QAAQ,CAAC,WAA2B,OAAO,MAAM,GAAG,EAAE;AAG5D,IAAM,YAAY,CAAC,WACxB,aAAa,UAAS,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU,OAAO,KAAK;AAOjF,IAAM,mBAAmB,CAAC,UAAkB,IAAY,UAC7D,MAAM,SAAS,gBACX,OACE,UACA,gCAAgC,MAAM,qDACpC,qBAAqB,MAAM,SAC/B,IACA,OAAO,UAAU,GAAG,cAAc,MAAM,WAAW,UAAU,KAAK,GAAG;AAQpE,IAAM,gBACX,CAAC,UAAkB,OACnB,CACE,WAEA,OAAO,KACE,iBAAS,CAAC,UACf,cAAc,KAAK,IAAI,QAAQ,iBAAiB,UAAU,IAAI,KAAK,CACrE,CACF;;;AC9BJ,IAAM,cACJ,gGACA;AAGF,IAAM,cACJ;AAGF,IAAM,cAAc;AAGpB,IAAM,YAAY;AAEX,IAAM,cAAc;AAG3B,IAAM,YAAY,CAAC,OAAmB,SAA2B;AAAA,EAC/D,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1E,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAQ,MAAgC,QAAQ,CAAC,MAAM,UACrD,UAAU,MAAM,GAAG,QAAQ,OAAO,KAAK,IAAI,CAC7C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,OAAO,OAAO,QAAQ,KAAK,EAAE,QAAQ,EAAE,KAAK,UAAU,UAAU,MAAM,GAAG,QAAQ,KAAK,CAAC;AAAA,EACzF;AAAA,EACA,OAAO,CAAC;AAAA;AAOH,IAAM,oBAAoB,CAC/B,aACA,MACA,cACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,MAAM,UAAU,OAAO,QAAQ,eAAe,CAAC,CAAC,GAAG;AAAA,IAC7D,IAAI,YAAY,KAAK,IAAI;AAAA,MACvB,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,IACjE,SAAI,YAAY,KAAK,KAAK;AAAA,MAC7B,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,EACxE;AAAA,EACA,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAEzC,IAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MACzB,MAAM,KAAK,oBAAoB,OAAO,KAAK,8BAA8B,aAAa;AAAA,IACxF,EAAO,SAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAAA,MACzD,MAAM,KAAK,oBAAoB,OAAO,QAAQ,CAAC,6BAA6B,aAAa;AAAA,IAC3F,EAAO,SAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MAChC,MAAM,KAAK,oBAAoB,OAAO,KAAK,2BAA2B,aAAa;AAAA,IACrF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,UAAU,aAAa,CAAC,GAAG,WAAW,GAAG;AAAA,IAC1D,MAAM,KAAK,GAAG,6BAA6B,aAAa;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,qBAAqB,CAAC,YACjC,YAAY,KAAK,OAAO,IAAI,CAAC,gCAAgC,aAAa,IAAI,CAAC;;;AC1DjF,IAAM,eACJ,kGACA;AAGF,IAAM,cACJ;AAGF,IAAM,gBAAgB;AAEtB,IAAM,mBAAmB;AACzB,IAAM,oBACJ;AAGF,IAAM,SAAiD;AAAA,EACrD,CAAC,iEAAiE,gBAAgB;AAAA,EAClF,CAAC,+BAA+B,sBAAsB;AAAA,EACtD,CAAC,mCAAmC,eAAe;AAAA,EACnD,CAAC,0CAA0C,mBAAmB;AAAA,EAC9D,CAAC,mEAAmE,OAAO;AAAA,EAG3E,CAAC,0CAA0C,wBAAwB;AAAA,EACnE,CAAC,yBAAyB,yBAAyB;AACrD;AAEA,IAAM,cAAc;AACpB,IAAM,cAAc;AAUpB,IAAM,cAAc;AACpB,IAAM,eAAe,CAAC,SAAyB,KAAK,QAAQ,aAAa,IAAI;AAGtE,IAAM,WAAW,CAAC,SAA2B;AAAA,EAClD,MAAM,SAAmB,CAAC;AAAA,EAC1B,IAAI,UAAU;AAAA,EACd,IAAI;AAAA,EACJ,SAAS,QAAQ,EAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AAAA,IACnD,MAAM,OAAO,KAAK,UAAU;AAAA,IAC5B,IAAI,UAAU,WAAW;AAAA,MACvB,IAAI,SAAS,QAAQ,UAAU,OAAO,QAAQ,IAAI,KAAK,QAAQ;AAAA,QAC7D,SAAS;AAAA,QACT,WAAW,KAAK,UAAU;AAAA,MAC5B,EAAO,SAAI,SAAS;AAAA,QAAO,QAAQ;AAAA,MAC9B;AAAA,mBAAW;AAAA,IAClB,EAAO,SAAI,SAAS,OAAO,SAAS,KAAK;AAAA,MACvC,QAAQ;AAAA,IACV,EAAO,SAAI,KAAK,KAAK,IAAI,GAAG;AAAA,MAC1B,IAAI,YAAY;AAAA,QAAI,OAAO,KAAK,OAAO;AAAA,MACvC,UAAU;AAAA,IACZ,EAAO,SAAI,SAAS,OAAO,YAAY,IAAI;AAAA,MACzC;AAAA,IACF,EAAO;AAAA,iBAAW;AAAA,EACpB;AAAA,EACA,IAAI,YAAY;AAAA,IAAI,OAAO,KAAK,OAAO;AAAA,EACvC,OAAO;AAAA;AAQT,IAAM,kBAAkB,CAAC,WACvB,OACG,QAAQ,CAAC,UAAU,MAAM,QAAQ,aAAa,GAAG,EAAE,MAAM,KAAK,CAAC,EAC/D,OAAO,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,EACvF,WAAW;AAEhB,IAAM,eAAe,CAAC,QAA2B,UAA4B;AAAA,EAC3E,OAAO,QAAQ,IAAI,UAAU;AAAA,EAC7B,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,YAAY,KAAK,KAAK,KAAK,OAAO,SAAS,KAAK,CAAC,gBAAgB,OAAO,MAAM,CAAC,CAAC,GAAG;AAAA,IACrF,MAAM,KAAK,GAAG,YAAY,6BAA6B;AAAA,EACzD;AAAA,EACA,IAAI,cAAc,KAAK,KAAK,KAAK,OAAO,SAAS,KAAK,CAAC,gBAAgB,OAAO,MAAM,CAAC,CAAC,GAAG;AAAA,IACvF,MAAM,KAAK,GAAG,YAAY,SAAS,UAAU,+BAA+B;AAAA,EAC9E;AAAA,EACA,IAAI,iBAAiB,KAAK,KAAK,GAAG;AAAA,IAChC,MAAM,KAAK,OAAO,UAAU,CAAC,OAAO,UAAU,QAAQ,KAAK,kBAAkB,KAAK,KAAK,CAAC;AAAA,IACxF,IAAI,OAAO,MAAM,OAAO,SAAS,KAAK,KAAK,CAAC,gBAAgB,OAAO,MAAM,KAAK,CAAC,CAAC,GAAG;AAAA,MACjF,MAAM,KAAK,GAAG,YAAY,SAAS,OAAO,OAAO,gCAAgC;AAAA,IACnF;AAAA,EACF;AAAA,EACA,WAAW,SAAS,QAAQ;AAAA,IAC1B,MAAM,QAAQ,OAAO,KAAK,EAAE,aAAa,QAAQ,KAAK,KAAK,CAAC;AAAA,IAE5D,IAAI,UAAU;AAAA,MAAW,MAAM,KAAK,GAAG,gCAAgC,MAAM,IAAI;AAAA,EACnF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,0BAA0B,CAAC,cAAgC;AAAA,EACtE,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,YAAY,KAAK,SAAS;AAAA,IAAG,MAAM,KAAK,uCAAuC;AAAA,EACnF,YAAY,OAAO,SAAS,UAAU,MAAM;AAAA,CAAI,EAAE,QAAQ,GAAG;AAAA,IAC3D,MAAM,KAAK,GAAG,aAAa,SAAS,aAAa,IAAI,CAAC,GAAG,QAAQ,OAAO,QAAQ,CAAC,GAAG,CAAC;AAAA,EACvF;AAAA,EACA,OAAO,MAAM,IAAI,CAAC,YAAY,GAAG,YAAY,cAAa;AAAA;;;AC9F5D,IAAM,qBAAqB,CAAC,SAC1B,KAAK,WAAW,GAAG,KACnB,CAAC,KAAK,SAAS,GAAG,KAClB,CAAC,KAAK,SAAS,MAAM,KACrB,CAAC,KACE,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI;AAEzD,IAAM,iBAAiB,CAAC,UAAsC;AAAA,EACnE,MAAM,QAAkB,CAAC;AAAA,EAQzB,IAAI,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,IACjC,MAAM,KAAK,oEAAoE;AAAA,EACjF;AAAA,EACA,IAAI,MAAM,eAAe,aAAa,CAAC,mBAAmB,MAAM,UAAU,GAAG;AAAA,IAC3E,MAAM,KAAK,iDAAiD;AAAA,EAC9D;AAAA,EACA,MAAM,KAAK,GAAG,wBAAwB,MAAM,SAAS,CAAC;AAAA,EACtD,OAAO;AAAA;;;ACpDT;;;ACqBO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EADX,WAAW,CACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,SAAS,KAAK,WAAW,SAAS,QAAQ;AAAA,IAHhD;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,SACJ;AAAA,IACA,0DACA;AAAA,IACA;AAAA;AAGF,IAAM,YAAY;AASlB,IAAM,YAAY;AAQX,IAAM,aAAa,CAAC,MAAc,SAAyB;AAAA,EAChE,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,EAC/B,IAAI,QAAQ,MAAM;AAAA,IAChB,MAAM,OAAO,IAAI,GAAG,YAAY,CAAC,KAAK;AAAA,IACtC,MAAM,IAAI,WACR,MACA,KAAK,KAAK,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,4BACtD;AAAA,EACF;AAAA,EACA,OAAO,KACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,MAAM,OAAO;AAAA;AAG7B,IAAM,iBAAgB,CAAC,UAA2B;AAAA,EAChD,MAAM,QAAQ,OAAO,eAAe,KAAK;AAAA,EACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAGjD,IAAM,cAAc,CAAC,OAAgB,MAAc,OAAe,QAAwB;AAAA,EACxF,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAC7B,IAAI,QAAQ;AAAA,IAAW,MAAM,IAAI,WAAW,MAAM,sBAAsB,OAAO,SAAS,GAAG;AAAA,EAC3F,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,IAAI,KAAK,GAAG,cAAc,WAAW,OAAO,IAAI,YAAY;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,IAAI,KAAK,GAAG,OAAO,QAAQ,SAAS,WAAW;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAE7B,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAAA,MAChC,MAAM,IAAI,WAAW,MAAM,GAAG,OAAO,KAAK,6CAA6C;AAAA,IACzF;AAAA,IACA,IAAI,KAAK,GAAG,eAAe,OAAO,UAAU,IAAI,IAAI,KAAK,aAAa;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,IAAI,KAAK,GAAG,aAAa;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB,YAAY,OAAO,SAAU,MAA6B,QAAQ,GAAG;AAAA,MACnE,YAAY,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG,GAAG;AAAA,IAC/D;AAAA,IACA,IAAI,KAAK,GAAG,aAAa;AAAA,IACzB;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,eAAc,KAAK,GAAG;AAAA,IACvE,WAAW,OAAkC,MAAM,OAAO,GAAG;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAM,OAAO,UAAU,OAAO,SAAS,OAAO;AAAA,EAC9C,MAAM,IAAI,WAAW,MAAM,GAAG,+CAA+C;AAAA;AAG/E,IAAM,aAAa,CACjB,MACA,MACA,OACA,QACS;AAAA,EACT,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAE7B,MAAM,OAAO,OAAO,KAAK,IAAI,EAAE,KAAK;AAAA,EACpC,IAAI,KAAK,WAAW,GAAG;AAAA,IACrB,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB;AAAA,EACF;AAAA,EACA,IAAI,KAAK,GAAG,WAAW;AAAA,EACvB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,QAAQ;AAAA,IAC7C,IAAI,KAAK,GAAG,YAAa,WAAW,KAAK,KAAK,SAAS;AAAA,IACvD,YAAY,KAAK,MAAM,OAAO,QAAQ,GAAG,GAAG;AAAA,EAC9C;AAAA,EACA,IAAI,KAAK,GAAG,YAAY;AAAA;AAInB,IAAM,cAAc,CAAC,SAA4B;AAAA,EACtD,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,KAAK,CAAC,eAAc,IAAI,GAAG;AAAA,IAC5F,MAAM,IAAI,WAAW,IAAI,iDAAiD;AAAA,EAC5E;AAAA,EACA,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAiC,IAAI,GAAG,GAAG;AAAA,EACtD,OAAO,GAAG,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;;;ADxE3B,IAAM,cAAc,CAAC,WAA6C;AAAA,EACvE,IAAI,WAAW;AAAA,IAAU,OAAO,EAAE,MAAM,SAAS;AAAA,EACjD,MAAM,QAAQ,eAAe,KAAK,MAAM;AAAA,EACxC,OAAO,QAAQ,OAAO,YAAY,YAAY,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,EAAE,EAAE;AAAA;AAG9E,IAAM,gBAAgB,CAAC,OAAe,WAAkC,GAAG,UAAU;AAOrF,IAAM,eAAe,CAC1B,OACA,QACA,SACW;AAAA,EACX,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,0BAA0B;AAAA,EAE/D,IAAI,SAAS,aAAa,CAAC,KAAK,WAAW,GAAG,GAAG;AAAA,IAC/C,MAAM,IAAI,MAAM,OAAO,OAAO,OAAO,GAAG,gDAAgD;AAAA,EAC1F;AAAA,EACA,OAAO,GAAG,6BAA6B;AAAA;AAIlC,IAAM,aAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAAe,CAAC,UAAuC;AAAA,EAC3D,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,MAAM,WAAW;AAAA,IAAW,KAAK,YAAY,MAAM;AAAA,EACvD,IAAI,MAAM,SAAS;AAAA,IAAW,KAAK,UAAU,MAAM;AAAA,EACnD,IAAI,MAAM,QAAQ;AAAA,IAAW,KAAK,SAAS,MAAM;AAAA,EACjD,IAAI,MAAM,YAAY;AAAA,IAAW,KAAK,aAAa,MAAM;AAAA,EACzD,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,MAAM;AAAA,EACrD,OAAO;AAAA;AAGT,IAAM,iBAAiB,CAAC,cAAqC;AAAA,EAC3D,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO;AAAA,EAC3C,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,UAAU,mBAAmB;AAAA,IAAW,KAAK,oBAAoB,UAAU;AAAA,EAC/E,IAAI,UAAU,YAAY;AAAA,IAAW,KAAK,aAAa,UAAU;AAAA,EACjE,OAAO;AAAA;AAIF,IAAM,eAAe,CAAC,UAAsC;AAAA,EACjE,MAAM,OAAmC,KAAK,MAAM,UAAU;AAAA,EAC9D,KAAK,WAAW,MAAM;AAAA,EACtB,KAAK,sBAAsB,CAAC,GAAG,MAAM,gBAAgB;AAAA,EACrD,MAAM,MAAM,MAAM,eAAe,CAAC;AAAA,EAClC,IAAI,OAAO,KAAK,GAAG,EAAE,SAAS;AAAA,IAAG,KAAK,0BAA0B,KAAK,IAAI;AAAA,EACzE,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,eAAe,MAAM,SAAS;AAAA,EACrF,IAAI,MAAM,kBAAkB;AAAA,IAAW,KAAK,mBAAmB,MAAM;AAAA,EACrE,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,KAAK,2BAA2B,MAAM,QAAQ,QAAQ,IACjD,SAAyC,IAAI,YAAY,IAC1D,aAAa,QAA4B;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,oBAAoB;AAAA,IAAW,KAAK,qBAAqB,MAAM;AAAA,EACzE,IAAI,MAAM,sBAAsB;AAAA,IAAW,KAAK,uBAAuB,MAAM;AAAA,EAC7E,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,aAAa;AAAA,IAAW,KAAK,cAAc,MAAM;AAAA,EAC3D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,OAAO;AAAA;AAGF,IAAM,YAAY,CAAC,UACxB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAG1C,IAAM,YAAY,CACvB,UACwD;AAAA,EACxD,MAAM,OAAO,YAAY,aAAa,KAAK,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC3C,OAAO,EAAE,OAAO,QAAQ,UAAU,KAAK,GAAG,KAAK;AAAA;;;AE1JjD,IAAM,SAAS,CAAC,UAAsB;AAAA,EACpC,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAQ,MAA0B,IAAI,MAAM;AAAA,EACtE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,MAAM,SAAS;AAAA,IACf,MAAM,MAA4B,CAAC;AAAA,IACnC,WAAW,OAAO,OAAO,KAAK,MAAM,EAAE,KAAK;AAAA,MAAG,IAAI,OAAO,OAAO,OAAO,QAAQ,IAAI;AAAA,IACnF,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;AAOF,IAAM,kBAAkB,CAAC,WAC9B,KAAK,UAAU,OAAQ,UAAU,IAAa,CAAC;AAG1C,IAAM,eAAe,CAAC,WAA4B,UAAU,gBAAgB,MAAM,CAAC;;;ATVnF,IAAM,gBAAgB,CAAC,WAA6B;AAAA,EACzD,MAAM,OACJ,OAAO,WAAW,YAAY,WAAW,OAAQ,OAA8B,OAAO;AAAA,EACxF,OAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,OAAO,KAAK,IAAI,EAAE,WAAW;AAAA;AAS5E,IAAM,gBAAgB,CAC3B,UAEO,YAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,UAAU,aAAa,OAAO;AAAA,EACtC,MAAM,QAAQ,eAAe,KAAK;AAAA,EAClC,IAAI,MAAM,SAAS;AAAA,IAAG,OAAO,OAAc,aAAK,OAAO,UAAU,MAAM,KAAK,IAAI,CAAC,CAAC;AAAA,EAClF,MAAM,UAAU,OAAO,eAAe,MAAM,SAAS,EAAE,KACrD,cAAc,UAAU,aAAa,CACvC;AAAA,EACA,IAAI,cAAc,QAAQ,MAAM,GAAG;AAAA,IACjC,OAAO,OAAc,aACnB,OAAO,UAAU,oEAAoE,CACvF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,cAAc,QAAQ,QAAQ,QAAQ;AAAA,EACpD,IAAI,MAAM,SAAS;AAAA,IAAG,OAAO,OAAc,aAAK,OAAO,UAAU,MAAM,KAAK,IAAI,CAAC,CAAC;AAAA,EAClF,OAAO,EAAE,QAAQ,aAAa,QAAQ,MAAM,GAAG,UAAU,QAAQ,SAAS;AAAA,CAC3E;AAEI,IAAM,eAAe,CAC1B,UACA,SACA,gBAC2B;AAAA,EAC3B,cAAc,aAAa,OAAO;AAAA,EAClC;AAAA,KACI,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AACnD;AAGO,IAAM,WAAW,CACtB,eAMO,YAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,aAAa,OAAO;AAAA,EAC5B,MAAM,UAAU,OAAO,kBAAkB,EAAE,KAAK,cAAc,UAAU,cAAc,CAAC;AAAA,EACvF,OAAO,aAAa,UAAU,SAAS,UAAU;AAAA,CAClD;AASI,IAAM,YAAY,CAAC,SAAkB,mBAC1C,cAAc,OAAO,KAAK,aAAa,OAAO,MAAM;AAmB/C,IAAM,YAAY,CACvB,WACA,eAEO,YAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,aAAa,OAAO;AAAA,EAI5B,MAAM,UAAU,OAAO,kBAAkB;AAAA,EACzC,IAAI,cAAc,OAAO;AAAA,IAAG;AAAA,EAC5B,MAAM,aAAa,aAAa,UAAU,SAAS,UAAU;AAAA,EAC7D,IAAI,cAAc,WAAW;AAAA,IAC3B,OAAO,EAAE,YAAY,MAAM,OAAO,WAAW,yCAAyC;AAAA,EACxF;AAAA,EAOA,MAAM,UAAU,OAAc,eAAO,cAAc,EAAE,UAAU,CAAC,CAAC;AAAA,EACjE,IAAW,kBAAU,OAAO,GAAG;AAAA,IAC7B,OAAO,EAAE,YAAY,MAAM,UAAU,SAAS,QAAQ,QAAQ,MAAM,EAAE;AAAA,EACxE;AAAA,EACA,IAAI,cAAc,QAAQ,OAAO;AAAA,IAAG,OAAO,OAAc,aAAK,QAAQ,OAAO;AAAA,EAC7E,MAAM,QAAQ,QAAQ;AAAA,EACtB,OAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EAClE;AAAA,CACD;;;AU/IH;AACA;AAgBO,IAAM,aAAa,CACxB,MACA,WAEO,aAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,aAAa,OAAO;AAAA,EAC5B,MAAM,OAAO,OAAO,cAAc,IAAI;AAAA,EACtC,MAAM,OAAO,OAAO,SAAS;AAAA,EAC7B,MAAM,YACJ,KAAK,WAAW,KAAK,gBACrB,KAAK,iBAAiB,OAAO,gBAC7B,KAAK,eAAe,OAAO,cAI3B,aAAa,OAAO;AAAA,EACtB,OAAO,YAAY,EAAE,QAAQ,OAAO,IAAI,EAAE,QAAQ,SAAS;AAAA,CAC5D;AA4BI,IAAM,kBAAkB,CAC7B,OACA,cAEO,aAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,aAAa,OAAO;AAAA,EAC5B,MAAM,OAAO,OAAO,cAAc,KAAK;AAAA,EACvC,MAAM,UAAU,OAAO,kBAAkB,EAAE,KAAK,cAAc,UAAU,cAAc,CAAC;AAAA,EACvF,MAAM,SAAS,aAAa,OAAO;AAAA,EACnC,MAAM,QAAQ,WAAW,UAAU,UAAU,UAAU,SAAS,KAAK,MAAM;AAAA,EAC3E,IAAI,CAAC,UAAU,YAAY,CAAC,OAAO;AAAA,IACjC,OAAO,OAAc,cACnB,OACE,UACA,qBAAqB,MAAM,MAAM,yDAC/B,aAAa,MAAM,KAAK,MAAM,yDAC9B,0FACA,yDACJ,CACF;AAAA,EACF;AAAA,EACA,IAAI,WAAW,KAAK;AAAA,EACpB,MAAM,SAAS,WAAW,KAAK;AAAA,EAC/B,IAAI,QAAQ;AAAA,IACV,MAAM,UAAU,OAAc,gBAAO,cAAc,MAAM,WAAW,MAAM,UAAU,CAAC;AAAA,IACrF,IAAW,kBAAU,OAAO,GAAG;AAAA,MAC7B,MAAM,QAAQ,QAAQ;AAAA,MAItB,IAAI,cAAc,KAAK;AAAA,QAAG,OAAO,OAAc,cAAK,KAAK;AAAA,MAIzD,MAAM,YAAY,OAAc,gBAAO,SAAS,CAAC;AAAA,MACjD,MAAM,QAAe,kBAAU,SAAS,IAAI,UAAU,UAAU;AAAA,MAChE,MAAM,QACJ,UAAU,YACN,kDACA,MAAM,iBAAiB,SACrB,mDACA,iCAAiC,MAAM,MAAM,YAAY,uBAAuB,MAAM,MAAM;AAAA,MAIpG,MAAM,SACJ,MAAM,SAAS,gBACX,GAAG,MAAM,oFACT,UAAU,KAAK;AAAA,MACrB,OAAO,OAAc,cACnB,OAAO,UAAU,iCAAiC,WAAW,OAAO,CACtE;AAAA,IACF;AAAA,IACA,WAAW,QAAQ;AAAA,EACrB;AAAA,EAIA,MAAM,aAAa,OAAO,SAAS,MAAM,UAAU;AAAA,EACnD,IAAI,WAAW,iBAAiB,KAAK,QAAQ;AAAA,IAC3C,OAAO,OAAc,cACnB,OACE,UACA,oCAAoC,MAAM,WAAW,YAAY,gBAC/D,GAAG,MAAM,KAAK,MAAM,uEACpB,aACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,EAAE,YAAY,QAAQ,SAAS;AAAA,CACvC;;;AhB3FI,IAAM,cAAc,SAAsB,gBAAgB;AAAA,EAC/D,sBAAsB;AACxB,CAAC;AAQD,IAAM,mBACJ,CAAI,OAA6B,aACjC,CAAC,UACQ,YACE,oBACL,6BAA6B,MAAM,cACjC,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,+BACzD,0DACJ,GACA,QACF;AAEG,IAAM,sBAAsB,MACxB,gBACP,aACO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EAErB,MAAM,QAAQ,CAAC,WAA+B,eACrC,iBAAQ,UAAU,WAAW,UAAU,GAAG,CAAC,UAAU;AAAA,IAC1D,IAAI,UAAU;AAAA,MAAW,OAAc,iBAAQ,SAAS;AAAA,IACxD,IAAI,MAAM;AAAA,MAAM,OAAc,iBAAQ,MAAM,UAAU;AAAA,IACtD,MAAM,UAAU,SAAQ,MAAM,UAAU;AAAA,IACxC,OAAO,MAAM,cAAc,YAChB,iBAAQ,OAAO,IACf,YACE,oBACL,mBAAmB,MAAM,wDACvB,gCAAgC,MAAM,0CAC1C,GACA,OACF;AAAA,GACL;AAAA,EACH,OAAO,YAAY,SAAS,GAAG;AAAA,IAE7B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,IAQ7B,MAAM,GAAG,MAAM,aACN,aAAI,UAAU,GAAG;AAAA,MACtB,OAAO,WAAW,YACd,OAAO,MAAM,eAAe,MAAM,WAAW,GAAG,eAAe,MAAM,YAAY,CAAC,IAClF,OAAO,SAAS,eAAe,MAAM,YAAY,CAAC;AAAA,KACvD,EAAE,KAEM,iBAAQ,eAAe,iBAAiB,OAAO,SAAS,CAAC,CAClE;AAAA,IAEF,MAAM,GAAG,MAAM,aAAa;AAAA,MAC1B,IAAI,WAAW;AAAA,QAAW,OAAc,iBAAQ,SAAS;AAAA,MACzD,MAAM,SAAS,iBAAiB,OAAO,EAAE,QAAQ,SAAkB,CAAC;AAAA,MACpE,IAAI,WAAW,IAAI,GAAG;AAAA,QACpB,OAAO,WAAW,MAAM,MAAM,EAAE,KAAY,iBAAQ,eAAe,MAAM,CAAC;AAAA,MAC5E;AAAA,MAOA,MAAM,YAAY,eAAe,MAAM,WAAW;AAAA,MAClD,IAAI,cAAc;AAAA,QAAW,OAAc,iBAAQ,SAAS;AAAA,MAC5D,OAAc,YAAG,WAAW,EAAE,UAAU,GAAG,MAAM,GAAG,EAAE,QAAQ,SAAkB,CAAC,EAAE,KAC1E,iBAAQ,eAAe,MAAM,CACtC;AAAA;AAAA,IAGF,WAAW,GAAG,KAAK,MAAM,aAChB,aAAI,UAAU,GAAG;AAAA,MAKtB,MAAM,YAAY,WAAW,aAAa,OAAO,aAAa,MAAM;AAAA,MACpE,MAAM,WAAW,cAAc,OAAO,aAAa,GAAG;AAAA,MACtD,MAAM,SAAS,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,aAAa;AAAA,MACzE,MAAM,UAAU,OAAO,gBAAgB,MAAM,EAAE,aAAa,OAAO,CAAC;AAAA,MACpE,WAAW,WAAW,QAAQ,UAAU;AAAA,QACtC,OAAc,oBAAW,mBAAmB,MAAM,aAAa,SAAS;AAAA,MAC1E;AAAA,MACA,OAAO,QAAQ;AAAA,KAChB;AAAA,IAEH,QAAQ,MAAa;AAAA,EACvB,CAAC;AAAA,CACF,CACH;;AiB1IF;AACA;;;ACOO,IAAM,wBAAwB;AAErC,IAAM,OAAO;AACb,IAAM,YAAY;AAElB,IAAM,UAAS,CAAC,SAAiB,QAC/B,IAAI,MAAM,uBAAuB,KAAK,UAAU,OAAO,MAAM,KAAK;AAEpE,IAAM,aAAa,CAAC,aAClB,aAAa,eAAe,aAAa,WAAW,wBAAwB,KAAK,QAAQ;AAGpF,IAAM,oBAAoB,CAC/B,SACA,eACqD;AAAA,EACrD,IAAI,eAAe,aAAa,CAAC,UAAU,KAAK,UAAU,GAAG;AAAA,IAC3D,MAAM,QAAO,SAAS,cAAc,KAAK,UAAU,UAAU,qBAAqB;AAAA,EACpF;AAAA,EACA,IAAI,QAAQ,WAAW,IAAI,GAAG;AAAA,IAC5B,MAAM,aAAa,QAAQ,MAAM,KAAK,MAAM;AAAA,IAC5C,IAAI,CAAC,WAAW,WAAW,GAAG;AAAA,MAAG,MAAM,QAAO,SAAS,kCAAkC;AAAA,IACzF,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,WAAW,GAAG,QAAQ,EAAE,MAAM,QAAQ,WAAW,EAAE;AAAA,EAC9F;AAAA,EACA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,MAAM,IAAI,IAAI,OAAO;AAAA,IACrB,MAAM;AAAA,IACN,MAAM,QAAO,SAAS,mDAAmD;AAAA;AAAA,EAI3E,IAAI,IAAI,aAAa;AAAA,IAAS,MAAM,QAAO,SAAS,oCAAoC;AAAA,EACxF,IAAI,CAAC,WAAW,IAAI,QAAQ,GAAG;AAAA,IAC7B,MAAM,QAAO,SAAS,qEAAqE;AAAA,EAC7F;AAAA,EACA,IAAI,IAAI,aAAa,OAAO,IAAI,WAAW,MAAM,IAAI,aAAa,IAAI;AAAA,IACpE,MAAM,QAAO,SAAS,2DAA2D;AAAA,EACnF;AAAA,EACA,MAAM,OAAO,IAAI,SAAS,KAAK,KAAK,OAAO,IAAI,IAAI;AAAA,EAInD,MAAM,OAAO,cAAc,GAAG,IAAI,YAAY,OAAO,IAAI;AAAA,EACzD,OAAO;AAAA,IACL,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,OAAO,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC;AAAA,IACpD;AAAA,IAEA,QAAQ,EAAE,MAAM,IAAI,SAAS,QAAQ,cAAc,IAAI,GAAG,MAAM,OAAO,KAAK;AAAA,EAC9E;AAAA;;;ADzBK,IAAM,kBAAkB,CAAC,UAAkC,CAAC,MAAsB;AAAA,EACvF,MAAM,UAAU,QAAQ,WAAW;AAAA,EACnC,QAAQ,UAAU,WAAW,kBAAkB,SAAS,QAAQ,UAAU;AAAA,EAO1E,MAAM,cACJ,OAAO,SAAS,SACN,sBAAe;AAAA,IACnB,YAAY;AAAA,IACZ,YAAY,QAAQ,cAAc;AAAA,EACpC,CAAC,IACK,sBAAe;AAAA,IACnB,YAAY;AAAA,OACR,QAAQ,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,WAAW;AAAA,EAC/E,CAAC;AAAA,EACP,OAAO;AAAA,IACL,UAAU;AAAA,IAUV,OAAa,gBACX,aACA,oBAAoB,QAAQ,OAAO,GAC7B,eAAc,aAAM,OAAO,EAAE,OAAO,MAAM,MAAM,CAAC,CACzD;AAAA,IACA;AAAA,EACF;AAAA;;AEtDF;AAKO,IAAM,iBAAiB,CAAC,YAA4B,gBAAgB,MACzE,oBAAoB,EAAE,KAAW,oBAAa,gBAAgB,SAAS,CAAC,CAAC;;ACL3E;AACA;;;ACZA,qBAAS;AACT,oBAAS;AACT,uBAAS;AACT;AACA;;;ACGO,IAAM,YAAY,CACvB,GACA,MACwB;AAAA,EACxB,IAAI,MAAM,aAAa,MAAM;AAAA,IAAW,OAAO;AAAA,EAC/C,IAAI,EAAE,QAAQ,aAAa,EAAE,QAAQ,aAAa,EAAE,QAAQ,aAAa,EAAE,QAAQ,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAIjC,IAAM,UAAU,OACrB,QACA,GACA,MACiC;AAAA,EACjC,IAAI,MAAM;AAAA,IAAG,OAAO;AAAA,EACpB,OAAO,MAAM,SAAS,MAAM,QAAQ,IAAI,CAAC,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,EACxE,OAAO,UAAU,MAAM,KAAK;AAAA;AAQvB,IAAM,eAAe,OAC1B,QACA,SACA,MACA,QACA,YACkB;AAAA,EAClB,MAAM,OAAO,MAAM,QAAQ,QAAQ,SAAS,IAAI;AAAA,EAChD,IAAI,SAAS;AAAA,IAAM;AAAA,EACnB,MAAM,OAAO;AAAA,EACb,IAAI,SAAS,aAAc,MAAM,OAAO,KAAK,IAAI,MAAO,WAAW;AAAA,IACjE,MAAM,QACJ,MACA,yBAAyB,gEACvB,2FACA,sCACJ;AAAA,EACF;AAAA;;;ACrDF;AACA;AAAA;AA6FO,MAAM,0BAAkC,iBAAuC,EACpF,8BACF,EAAE;AAAC;AAGI,IAAM,kBAAkB,CAAC,WACxB,eAAQ,mBAAmB,MAAM;AAGlC,IAAM,eAAe,CAAC,WAC3B,OAAO,cAAc,OAAO,aAAa,MAAM;;;ACnFjD,IAAM,YAAY,CAAC,UACjB,OAAO,UAAU,WAAW,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;AAGrE,IAAM,aAAa,OACxB,QACA,UACA,MACA,YAC4C;AAAA,EAC5C,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI,SAAS,UAAU,WAAW;AAAA,IAChC,MAAM,UAAU,SAAS,KAAK,MAAM,MAAM,OAAO,WAAW,OAAO,SAAS,KAAK,CAAC,IAAI;AAAA,IACtF,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,WAAW,OAAO,SAAS,KAAK,gBAAgB;AAAA,EAC5F;AAAA,EACA,IAAI,SAAS,UAAU,WAAW;AAAA,IAChC,MAAM,UAAU,SAAS,KAAK,KAAM,MAAM,OAAO,YAAY,OAAO,SAAS,KAAK,CAAC;AAAA,IACnF,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,YAAY,OAAO,SAAS,KAAK,gBAAgB;AAAA,EAC7F;AAAA,EACA,OAAO,KAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,MAAQ,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,EAAG;AAAA;AAIjF,IAAM,qBAAqB,OAChC,QACA,SAC4C;AAAA,EAC5C,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,KAAK,SAAS,SAAS,MAAM,OAAO,SAAS,IAAI,IAAI;AAAA,EACnE,OAAO;AAAA,IACL,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,IACX;AAAA,IACA,QAAQ,UAAU,YAAY,KAAK,UAAU,KAAK;AAAA,IAClD,MAAM,KAAK;AAAA,IACX,KAAK,KAAK;AAAA,EACZ;AAAA;AAGK,IAAM,iBAAiB,CAAC,UAAoC;AAAA,EACjE,MAAM,KAAK;AAAA,KACP,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AAAA,KAC9C,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AACpD;AAEO,IAAM,cAAc,CAAC,MAA0B,SACpD,KAAK,WAAW,KAAK,UACrB,KAAK,SAAS,KAAK,SAClB,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK,SAC5C,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK;AAOxC,IAAM,aAAa,OACxB,QACA,MACA,WACkB;AAAA,EAClB,MAAM,SAAS,OAAO,SAA8B;AAAA,IAClD,MAAM,OAAO,aAAa,KAAK,MAAM,eAAe,IAAI,CAAC;AAAA,IACzD,OAAO;AAAA;AAAA,EAMT,IAAI,KAAK,SAAS,OAAO,MAAM;AAAA,IAC7B,MAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK,MAAM,OAAO,IAAI;AAAA,IACzD,OAAO,OAAO,EAAE,QAAQ,SAAS,OAAO,WAAW,UAAU,CAAC;AAAA,EAChE;AAAA,EACA,IAAI,KAAK,WAAW,OAAO;AAAA,IAAQ,OAAO,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA,EACrE,MAAM,OAAO,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,EACvD,OAAO,SAAS,aAAa,YAAY,MAAM,IAAI,IAC/C,EAAE,QAAQ,OAAO,IACjB,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA;AAsB1B,IAAM,eAAe,OAC1B,QACA,MACA,QACA,QAAQ,UACwB;AAAA,EAChC,QAAQ,MAAM,oBAAW;AAAA,EACzB,MAAM,OAAO,KAAK;AAAA,EAElB,IAAI,KAAK,QAAQ,aAAa,KAAK,QAAQ,OAAO,aAAa,KAAK,CAAC,aAAa,MAAM,GAAG;AAAA,IACzF,MAAM,QACJ,MACA,SAAS,OAAO,KAAK,KAAK,sEACxB,2FACA,mCACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS,aAAa,KAAK,SAAS,QAAQ;AAAA,IAC9C,MAAM,QACJ,MACA,QAAQ,KAAK,gEACf;AAAA,EACF;AAAA,EACA,MAAM,SAAS,SAAS,YAAY,YAAY,MAAM,mBAAmB,QAAQ,IAAI;AAAA,EAKrF,MAAM,QAAQ,WAAW,aAAa,OAAO,SAAS;AAAA,EACtD,MAAM,QAAQ,QAAQ,YAAY;AAAA,EASlC,MAAM,WAAW,SAAS,WAAW;AAAA,EACrC,IAAI,UAAU,aAAa,WAAW,aAAa,CAAC,YAAY,QAAQ,IAAI,KAAK,CAAC,UAAU;AAAA,IAC1F,MAAM,QACJ,MACA,6FACE,sBACJ;AAAA,EACF;AAAA,EACA,IAAI,WAAW,aAAa,CAAC,YAAY,QAAQ,IAAI,GAAG;AAAA,IACtD,MAAM,QAAQ,MAAM,KAAK,SAAS,MAAM;AAAA,IAGxC,IAAI,UAAU,KAAK,MAAM,KAAK,QAAQ;AAAA,MACpC,MAAM,QAAO,MAAM,qCAAqC,KAAK,8BAA8B;AAAA,IAC7F;AAAA,IACA,MAAM,OAAO,gBAAgB,MAAM,OAAO,eAAe,IAAI,CAAC;AAAA,EAChE;AAAA,EAOA,MAAM,WAAW,YAAY;AAAA,IAC3B,IAAI,WAAW;AAAA,MAAW,MAAM,OAAO,WAAW,IAAI,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA;AAAA,EAE/E,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,IAAI,EAAE,MAAM,OAAO,UAAmB;AAAA,IACnF,MAAM,SAAS;AAAA,IACf,MAAM,QAAO,MAAM,kDAAkD,OAAO,KAAK,GAAG;AAAA,GACrF;AAAA,EACD,IAAI,UAAU,aAAa,CAAC,YAAY,OAAO,IAAI,GAAG;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,MAAM,QAAO,MAAM,wEAAwE;AAAA,EAC7F;AAAA,EAGA,IAAI;AAAA,IACF,MAAM,aACJ,QACA,OAAO,MACP,MACA,MAAM,gBAAgB,QAAQ,QAAQ,OAAM,GAC5C,OACF;AAAA,EACF,OAAO;AAAA;AAIF,IAAM,kBAAkB,OAC7B,QACA,QACA,YACkB;AAAA,EAClB,MAAM,OAAO,MAAM,OAAO,KAAK,OAAO,IAAI;AAAA,EAC1C,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAAQ,MAAM,QAAO,OAAO,MAAM,YAAY,KAAK,uBAAuB;AAAA,EAC5F,MAAM,OAAO,WAAW,OAAO,IAAI;AAAA;;;ACrM9B,IAAM,eAAe;AAGrB,IAAM,mBAAmB,CAAC,MAAc,UAAiD;AAAA,EAC9F,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAOpE,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,KAAK,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,uBAAuB;AAAA,EAG7D,IACE,KAAK,SAAS,GAAG,KACjB,KACG,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAC9D;AAAA,IACA,MAAM,KAAK,6EAA6E;AAAA,EAC1F;AAAA,EACA,IAAI,KAAK,SAAS,MAAM;AAAA,IAAG,MAAM,KAAK,mBAAmB;AAAA,EACzD,OAAO;AAAA;AAGF,IAAM,eAAe,CAAC,UAAmC;AAAA,EAC9D,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,OAAO;AAAA;;;AChDT,IAAM,UAAS,CAAC,MAAc,YAA2B,IAAI,MAAM,aAAa,SAAS,SAAS;AAG3F,IAAM,cAAc,OAAO,QAAoB,UAA2C;AAAA,EAC/F,MAAM,QAAQ,aAAa,KAAK;AAAA,EAChC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,QAAO,MAAM,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,EAC/D,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,MAAM,OAAO;AAAA,EACpD,OAAO;AAAA,IACL;AAAA,IACA,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM;AAAA,IACZ,QAAQ,UAAU,KAAK;AAAA,OACnB,MAAM,WAAW,QAAQ,OAAO,MAAM,MAAM,OAAM;AAAA,EACxD;AAAA;AAIK,IAAM,WAAW,OACtB,QACA,MACA,WACkB,WAAW,QAAQ,MAAM,YAAY,QAAQ,IAAI,GAAG,MAAM;AAMvE,IAAM,gBAAgB,OAC3B,QACA,OACA,QACA,QAAQ,UACwB;AAAA,EAChC,MAAM,OAAO,MAAM,YAAY,QAAQ,KAAK;AAAA,EAC5C,MAAM,OAAO,EAAE,UAAU,YAAY,KAAK,OAAO,OAAO,MAAM,OAAO,iBAAQ,KAAK;AAAA,EAClF,OAAO,aAAa,QAAQ,MAAM,QAAQ,KAAK;AAAA;AAI1C,IAAM,aAAa,CAAC,QAAoB,WAC7C,gBAAgB,QAAQ,QAAQ,OAAM;;;ALrCjC,IAAM,WAAW,UAAmB,WAAW;AAE/C,IAAM,mBAAmB,MACrB,iBACP,UACO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,SAAS,SAAS,GAAG;AAAA,IAC1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,IAE7B,MAAM,GAAG,MAAM,aACb,KAAK,YAAY;AAAA,MACf,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,MACxD,IAAI,UAAU;AAAA,QAAW;AAAA,MACzB,OAAO,WAAW,YAAY,SAAQ,KAAK,IAAI;AAAA,KAChD;AAAA,IAEH,MAAM,GAAG,YAAY,MAAM,aAAa;AAAA,MAEtC,IAAI,WAAW;AAAA,QAAW,OAAO,eAAe,UAAU;AAAA,MAC1D,IAAI,YAAW,IAAI;AAAA,QAAG,OAAO,KAAK,MAAM,SAAS,QAAQ,MAAM,MAAM,CAAC;AAAA,MAMtE,MAAM,OAAO,eAAe,MAAM,MAAM;AAAA,MACxC,IAAI,SAAS,aAAa,SAAS,OAAO;AAAA,QAAM,OAAc,iBAAQ,SAAS;AAAA,MAC/E,OAAO,KAAK,YACT,MAAM,QAAQ,QAAQ,MAAM,OAAO,IAAI,MAAO,OAC3C,YACA,EAAE,QAAQ,UAAmB,CACnC;AAAA;AAAA,IAKF,WAAW,GAAG,KAAK,YAAY,MAAM,aAC5B,iBAAQ,cAAc,EAAE,KAAK,YAAY,OAAO,CAAC,GAAG,CAAC,UAC1D,KAAK,MAAM,cAAc,QAAQ,MAAM,QAAQ,KAAK,CAAC,CACvD;AAAA,IAEF,QAAQ,GAAG,aAAa,KAAK,MAAM,WAAW,QAAQ,MAAM,CAAC;AAAA,EAC/D,CAAC;AAAA,CACF,CACH;;;AD5BK,IAAM,gBAAgB,CAAC,IAAY,UACjC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,eAAe,EAAE,WAAW,MAAM,WAAW,YAAY,MAAM,KAAK,CAAC;AAAA,EACnF,IAAI,MAAM,SAAS,GAAG;AAAA,IACpB,OAAO,OAAc,cAAK,IAAI,MAAM,iBAAiB,OAAO,MAAM,KAAK,IAAI,GAAG,CAAC;AAAA,EACjF;AAAA,EACA,MAAM,OAAO,OAAO,SAAS,GAAG,WAAW;AAAA,IACzC,SAAS,MAAM;AAAA,IACf,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM;AAAA,OACR,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,OACtD,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,EAC5D,CAAC,EAAE,KAAmB,qBAAO,CAAC;AAAA,EAC9B,MAAM,SAAS,OAAO,YAAY,IAAI,EAAE,WAAW,MAAM,WAAW,YAAY,KAAK,KAAK,CAAC;AAAA,EAC3F,OAAO,EAAE,QAAQ,KAAK;AAAA,CACvB;",
+  "debugId": "643BF5F5D21610F364756E2164756E21",
   "names": []
 }