@homeflare/alchemy 0.29.0 → 0.30.0

package/dist/github/index.js.map

@@ -1,10 +1,11 @@
 {
   "version": 3,
-  "sources": ["../src/github/repo-policy-guards.ts", "../src/github/repo-policy-form.ts", "../src/github/repo-policy.ts", "../src/github/repository-ruleset.ts", "../src/github/repository-ruleset-constraints.ts", "../src/github/repository-ruleset-errors.ts", "../src/github/repository-ruleset-octokit.ts", "../src/github/repository-ruleset-probe.ts", "../src/github/repository-ruleset-reconcile.ts", "../src/github/repository-ruleset-form.ts", "../src/github/repository-ruleset-guards.ts", "../src/github/repository-ruleset-narrowing-guards.ts", "../src/github/repo-baseline-data.ts", "../src/github/declare-repo-baseline.ts", "../src/github/repository-ruleset-providers.ts"],
+  "sources": ["../src/github/repo-policy-guards.ts", "../src/github/repo-policy-form.ts", "../src/github/repo-policy.ts", "../src/github/repo-auto-merge-gate.ts", "../src/github/repository-ruleset.ts", "../src/github/repository-ruleset-constraints.ts", "../src/github/repository-ruleset-errors.ts", "../src/github/repository-ruleset-octokit.ts", "../src/github/repository-ruleset-probe.ts", "../src/github/repository-ruleset-reconcile.ts", "../src/github/repository-ruleset-form.ts", "../src/github/repository-ruleset-guards.ts", "../src/github/repository-ruleset-narrowing-guards.ts", "../src/github/repo-baseline-data.ts", "../src/github/declare-repo-baseline.ts", "../src/github/repository-ruleset-providers.ts"],
   "sourcesContent": [
     "/**\n * Everything `repoPolicy` refuses, and why. Extracted from repo-policy-form.ts so the\n * shape stays readable and the reasoning stays whole.\n *\n * ⛔ FIVE DIFFERENT DOORS LEAD TO THE SAME FAILURE — auto-merge with nothing to wait for.\n *   `gh pr merge --auto` is a queue only while something is outstanding; with nothing\n *   outstanding GitHub merges the pull request on the spot. An empty `checks` is the\n *   obvious door. `enforcement: 'disabled'` or `'evaluate'` is the quiet one: the ruleset\n *   exists, the required checks are listed on it, and none of them block anything. Then\n *   three ways to end up with a ruleset that matches NO REF — which enforces on no ref\n *   while the GitHub UI still shows it as `active`: an empty `include`, a blank ref\n *   pattern, and an `exclude` that cancels every `include`. All five are refused.\n *\n * ★ THE REF DOORS WERE FOUND BY ADVERSARIAL REVIEW, NOT BY DESIGN. The first cut of this\n *   module guarded `include.length === 0` and spread `exclude` raw, so\n *   `include: ['~DEFAULT_BRANCH'], exclude: ['~DEFAULT_BRANCH']` and `include: ['   ']`\n *   both sailed through with `allowAutoMerge: true` — the exact end state the empty-array\n *   guard exists to prevent, reached by a door beside it. Checked by execution, not by\n *   reading: see the `matches no ref` tests in repo-policy-form.test.ts.\n */\n\n/** A non-empty, trimmed identifier, or an error naming the field. */\nexport function requireName(field: string, value: string): string {\n  const trimmed = value.trim();\n  if (trimmed === '') throw new Error(`repoPolicy: ${field} is required`);\n  return trimmed;\n}\n\n/**\n * Trim, de-duplicate, sort. ★ The sort is what makes a second deploy a no-op: GitHub\n * stores the contexts in the order they were sent, so an unsorted list would diff against\n * itself the first time a caller wrote the same contexts in a different order.\n */\nexport function normalizeChecks(checks: readonly string[]): string[] {\n  const seen = new Set<string>();\n  for (const raw of checks) {\n    const context = raw.trim();\n    // ⚠️ A blank context is a typo that reads as coverage: GitHub happily stores it and\n    //   no job ever reports it, so every pull request waits on a check that cannot come.\n    if (context === '') {\n      throw new Error(\n        'repoPolicy: a required check context is blank — name it exactly as the job reports it',\n      );\n    }\n    seen.add(context);\n  }\n  return [...seen].sort();\n}\n\n/**\n * Trim, de-duplicate, sort one list of ref patterns, refusing a blank one.\n *\n * ⚠️ A BLANK PATTERN IS NOT AN EMPTY LIST, AND THAT IS THE WHOLE TRAP. `['   ']` has\n *   length 1, so a guard that counts the array waves it through; GitHub then stores a ref\n *   condition that matches nothing. Same end state as `[]`, reached past the guard.\n * ★ Sorted for the same reason `normalizeChecks` is: GitHub echoes the patterns back in\n *   the order they were sent, so an unsorted list diffs against itself the first time a\n *   caller writes the same patterns in a different order.\n */\nfunction normalizeRefs(field: string, patterns: readonly string[]): string[] {\n  const seen = new Set<string>();\n  for (const raw of patterns) {\n    const pattern = raw.trim();\n    if (pattern === '') {\n      throw new Error(\n        `repoPolicy: a ${field} ref pattern is blank — a ruleset that matches no ref enforces nothing.`,\n      );\n    }\n    seen.add(pattern);\n  }\n  return [...seen].sort();\n}\n\n/**\n * ⛔ AN EMPTY `include` IS REFUSED. Alchemy defaults `conditions.include` to `['~ALL']`\n *   when it is absent, but an explicitly empty array is sent as an empty array, and a\n *   ruleset that matches no ref protects nothing while still reading as `active` in the\n *   GitHub UI — the worst possible combination, because it looks like it worked.\n */\nexport function normalizeInclude(\n  include: readonly string[] | undefined,\n  fallback: readonly string[],\n): string[] {\n  if (include === undefined) return [...fallback];\n  if (include.length === 0) {\n    throw new Error(\n      'repoPolicy: include is empty — a ruleset that matches no ref enforces nothing. Omit it for the default branch.',\n    );\n  }\n  return normalizeRefs('include', include);\n}\n\n/**\n * ⛔ AN `exclude` THAT CANCELS EVERY `include` IS REFUSED. In a GitHub ruleset the\n *   exclusions win, so `include: ['~DEFAULT_BRANCH'], exclude: ['~DEFAULT_BRANCH']` is a\n *   ruleset over nothing — and it reads as a narrowing, which is what makes it worse than\n *   the empty array: the caller believes they scoped the policy, not switched it off.\n *\n * ⚠️ EXACT CANCELLATION ONLY, DELIBERATELY. GitHub's patterns are globs, so deciding in\n *   general whether some exclude swallows some include means implementing GitHub's\n *   matcher and being wrong about it quietly. This refuses the case that is decidable —\n *   every include pattern also appears verbatim in `exclude` — and leaves\n *   `exclude: ['refs/heads/*']` against `include: ['~DEFAULT_BRANCH']` to the operator.\n *   A narrower guard that is always right beats a broad one that false-refuses.\n */\nexport function normalizeExclude(\n  exclude: readonly string[] | undefined,\n  include: readonly string[],\n): string[] {\n  const patterns = exclude === undefined ? [] : normalizeRefs('exclude', exclude);\n  if (patterns.length === 0) return patterns;\n  const excluded = new Set(patterns);\n  if (include.every((pattern) => excluded.has(pattern))) {\n    throw new Error(\n      [\n        'repoPolicy: exclude cancels every include pattern, so the ruleset matches no ref and enforces nothing.',\n        `include ${JSON.stringify(include)} is fully covered by exclude ${JSON.stringify(patterns)}.`,\n      ].join(' '),\n    );\n  }\n  return patterns;\n}\n\n/**\n * ⛔ `0` IS REFUSED, NOT TREATED AS \"NO REVIEWS\". A `pull_request` rule with zero\n *   approvals is the solo-maintainer shape — every change through a PR, no second person\n *   — and it only works with `require_extra_approval_for_unattributed_changes: false`.\n *   alchemy@2.0.0-beta.79's `Ruleset` cannot express that field, and GitHub defaults it\n *   to `true` when it is omitted (measured 2026-09-17), which blocks the very PRs the\n *   zero was meant to let through. Omitting `requiredApprovals` declares no rule at all,\n *   which is a different and honest thing.\n */\nexport function resolveApprovals(requested: number | undefined): number | undefined {\n  if (requested === undefined) return undefined;\n  if (!Number.isInteger(requested) || requested < 1) {\n    throw new Error(\n      [\n        'repoPolicy: requiredApprovals must be a whole number of 1 or more.',\n        'Omit it to declare no pull_request rule.',\n        '0 is not that: it needs require_extra_approval_for_unattributed_changes: false,',\n        'which alchemy@2.0.0-beta.79 cannot send and GitHub defaults to true.',\n      ].join(' '),\n    );\n  }\n  return requested;\n}\n\n/**\n * ⚠️ THE TEST IS \"SOMETHING OUTSTANDING\", NOT \"SOME CHECKS\". A required review holds a\n *   pull request open just as a required check does, so `requiredApprovals` with an empty\n *   `checks` is a legitimate policy. What is refused is auto-merge over a ruleset that\n *   will not hold anything back.\n */\nexport function assertAutoMergeWaits(input: {\n  readonly autoMerge: boolean;\n  readonly checkCount: number;\n  readonly approvals: number | undefined;\n  readonly enforcement: 'active' | 'disabled' | 'evaluate';\n}): void {\n  if (!input.autoMerge) return;\n  if (input.enforcement !== 'active') {\n    throw new Error(\n      [\n        `repoPolicy: autoMerge with enforcement '${input.enforcement}' merges every pull request immediately.`,\n        'A ruleset that is not active enforces none of its rules, so auto-merge has nothing to wait for.',\n        'Pass autoMerge: false while the ruleset is being evaluated.',\n      ].join(' '),\n    );\n  }\n  if (input.checkCount === 0 && input.approvals === undefined) {\n    throw new Error(\n      [\n        'repoPolicy: autoMerge with nothing required merges every pull request immediately.',\n        'Name at least one always-reporting check context, or ask for requiredApprovals,',\n        'or pass autoMerge: false for a repository that has no green run to require yet.',\n      ].join(' '),\n    );\n  }\n}\n",
     "/**\n * `repoPolicy` — one repository's house merge policy, as plain Alchemy props.\n *\n * ★ PURE ON PURPOSE, AND TYPE-ONLY IMPORTS. The exact shape a stack will deploy can be\n *   asserted in a unit test with no credentials, no network and no Effect runtime.\n *   `repo-policy.ts` is the thin half that turns these props into resources, and\n *   `repo-policy-guards.ts` holds everything this refuses and why.\n *\n * ⛔ AUTO-MERGE WITH NOTHING TO WAIT FOR MERGES IMMEDIATELY. `gh pr merge --auto` is a\n *   queue only while something is outstanding. Five different inputs produce \"nothing\n *   outstanding\" — no `checks` and no `requiredApprovals`, an `enforcement` that is not\n *   `active`, and three ways to land a ruleset that matches no ref (an empty `include`, a\n *   blank ref pattern, an `exclude` that cancels every `include`). All five are refused.\n *   See the guards module.\n *\n * ⛔ EVERY CONTEXT IN `checks` MUST ALWAYS REPORT. A required context that never reports\n *   is not \"passed\", it is \"pending\", and the pull request waits on it forever —\n *   auto-merge included. Point this at an aggregate job that runs `if: always()` and\n *   fails when any upstream job did, never at a job behind a `paths:` filter, a matrix\n *   leg, or anything a skipped workflow can silence.\n */\nimport type { RepositoryProps, RulesetProps } from 'alchemy/GitHub';\nimport {\n  assertAutoMergeWaits,\n  normalizeChecks,\n  normalizeExclude,\n  normalizeInclude,\n  requireName,\n  resolveApprovals,\n} from './repo-policy-guards.ts';\n\n/** Alchemy's own bypass-actor shape, re-exported so a caller imports one module, not two. */\nexport type RepoPolicyBypassActor = NonNullable<RulesetProps['bypassActors']>[number];\n\n/**\n * Repository fields the policy does NOT own — description, topics, visibility, …\n * ⛔ Merged UNDERNEATH the policy, so a caller can describe their repo but cannot quietly\n *   re-enable merge commits through this door. The omitted keys are the policy itself.\n * ⛔ `baseUrl` IS OMITTED TOO, and is a top-level option instead. Setting it on only one\n *   of the two resources would point the repository at a GitHub Enterprise host and its\n *   ruleset at github.com — two halves of one policy on two different instances.\n */\nexport type RepoPolicyRepositorySettings = Omit<\n  RepositoryProps,\n  | 'allowAutoMerge'\n  | 'allowMergeCommit'\n  | 'allowRebaseMerge'\n  | 'allowSquashMerge'\n  | 'baseUrl'\n  | 'deleteBranchOnMerge'\n  | 'name'\n  | 'owner'\n>;\n\nexport interface RepoPolicyOptions {\n  /** Repository owner — a user or organization login. */\n  readonly owner: string;\n  /** Repository name. */\n  readonly repository: string;\n  /**\n   * Status-check contexts a pull request must pass, named exactly as the job reports\n   * them. Trimmed, de-duplicated and sorted, so re-ordering the list is not a diff.\n   */\n  readonly checks: readonly string[];\n  /** @default true — with nothing required it is refused, not quietly downgraded. */\n  readonly autoMerge?: boolean;\n  /** @default 'main' */\n  readonly rulesetName?: string;\n  /** Ref patterns the ruleset covers. @default ['~DEFAULT_BRANCH'] */\n  readonly include?: readonly string[];\n  /**\n   * Ref patterns exempted from it. @default []\n   * ⛔ Exclusions win over inclusions, so one that cancels every `include` is refused —\n   *   it reads as a narrowing and acts as an off switch.\n   */\n  readonly exclude?: readonly string[];\n  /** Who may bypass the ruleset. @default [] — nobody, administrators included. */\n  readonly bypassActors?: readonly RepoPolicyBypassActor[];\n  /**\n   * Approving reviews a pull request needs. Omit for none — `0` is refused rather than\n   * read as \"no reviews\"; `resolveApprovals` in the guards module says why.\n   */\n  readonly requiredApprovals?: number;\n  /** @default 'active' — anything else is refused alongside `autoMerge`. */\n  readonly enforcement?: 'active' | 'disabled' | 'evaluate';\n  /** GitHub Enterprise host, applied to BOTH resources or to neither. */\n  readonly baseUrl?: string;\n  /** Everything about the repository that is not merge policy. */\n  readonly settings?: RepoPolicyRepositorySettings;\n}\n\nexport interface RepoPolicy {\n  readonly repository: RepositoryProps;\n  readonly ruleset: RulesetProps;\n}\n\nconst DEFAULT_RULESET_NAME = 'main';\n/**\n * ★ `~DEFAULT_BRANCH`, NOT `refs/heads/main`. GitHub resolves it per repository, so one\n *   policy covers a repo whose default branch is `master` or `trunk`, and renaming the\n *   default branch later does not silently leave the ruleset pointing at nothing.\n */\nconst DEFAULT_INCLUDE: readonly string[] = ['~DEFAULT_BRANCH'];\n\n/**\n * The house policy for one repository: squash-only merges, auto-merge on, head branches\n * deleted, and a ruleset over the default branch that blocks deletion and force pushes\n * and requires `checks`.\n *\n * ★ `strictRequiredStatusChecksPolicy` IS ALWAYS FALSE, AND NOT A PARAMETER. \"Require\n *   branches to be up to date\" means every merge to the default branch invalidates every\n *   other open pull request, which with auto-merge on is a re-run storm that converges\n *   only when the queue empties. The checks still have to pass; they just do not have to\n *   have passed against the very tip.\n */\nexport function repoPolicy(options: RepoPolicyOptions): RepoPolicy {\n  const owner = requireName('owner', options.owner);\n  const repository = requireName('repository', options.repository);\n  const checks = normalizeChecks(options.checks);\n  const include = normalizeInclude(options.include, DEFAULT_INCLUDE);\n  const exclude = normalizeExclude(options.exclude, include);\n  const autoMerge = options.autoMerge ?? true;\n  const enforcement = options.enforcement ?? 'active';\n  const approvals = resolveApprovals(options.requiredApprovals);\n  assertAutoMergeWaits({ approvals, autoMerge, checkCount: checks.length, enforcement });\n  const host = options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl };\n\n  return {\n    repository: {\n      ...options.settings,\n      ...host,\n      // ⛔ Squash only. The ruleset's own `allowed_merge_methods` is not reachable through\n      //   Alchemy's `pullRequest` rule, so the repository is the only place this holds.\n      allowAutoMerge: autoMerge,\n      allowMergeCommit: false,\n      allowRebaseMerge: false,\n      allowSquashMerge: true,\n      deleteBranchOnMerge: true,\n      name: repository,\n      owner,\n    },\n    ruleset: {\n      ...host,\n      bypassActors: [...(options.bypassActors ?? [])],\n      conditions: { exclude, include },\n      enforcement,\n      name: options.rulesetName ?? DEFAULT_RULESET_NAME,\n      owner,\n      repository,\n      rules: {\n        deletion: true,\n        nonFastForward: true,\n        ...(approvals === undefined\n          ? {}\n          : {\n              pullRequest: {\n                dismissStaleReviewsOnPush: true,\n                requiredApprovingReviewCount: approvals,\n              },\n            }),\n        ...(checks.length === 0\n          ? {}\n          : {\n              requiredStatusChecks: {\n                checks: checks.map((context) => ({ context })),\n                strictRequiredStatusChecksPolicy: false,\n              },\n            }),\n      },\n      target: 'branch',\n    },\n  };\n}\n",
-    "/**\n * `declareRepoPolicy` — the policy from repo-policy-form.ts, as resources.\n *\n *     const policy = yield* declareRepoPolicy('api', {\n *       owner: 'my-org',\n *       repository: 'api',\n *       checks: ['ci', 'secret scan'],\n *     });\n *\n * Provide `repoPolicyProviders()` (repository-ruleset-providers.ts) — the composed\n * `GitHub.providers()` + `RepositoryRulesetProvider()` layer; this subpath adds no GitHub\n * provider of its own beyond the ruleset bridge.\n *\n * ★ REWIRED 2026-09-23 onto `GitHub.RepositoryRuleset`, not upstream `GitHub.Ruleset` — the\n *   ADOPT-SAFE bridge documented in repository-ruleset.ts. Only `builds` calls this, and its\n *   ruleset has NEVER been created (LIVE SURVEY 2026-09-23: 0 rulesets live on `builds`), so\n *   the swap changes no live resource's identity; a cold first deploy is the only deploy this\n *   call has ever had. `homeflare/docs/repo-policy-ruleset-hazards.md`'s \"before the first\n *   deploy, check by hand\" workaround is now enforced by the resource itself (the name-probe in\n *   repository-ruleset-probe.ts) rather than left to the operator — see that doc for the\n *   history, kept rather than deleted so the hazard `builds` almost hit stays legible.\n * ⚠️ `GitHub.Repository` keeps its OWN upstream behavior unchanged — it already probed by name\n *   and converged, so only the ruleset half of this helper needed the swap.\n *\n * ⛔ BOTH RESOURCES RETAIN. `retain` is already the vendor default for each of them; it\n *   is piped anyway so that a vendor change cannot quietly turn \"drop this call from the\n *   stack\" into \"delete the repository\" or \"unprotect the default branch\".\n */\nimport { adopt } from 'alchemy/AdoptPolicy';\nimport * as GitHub from 'alchemy/GitHub';\nimport * as RemovalPolicy from 'alchemy/RemovalPolicy';\nimport * as Effect from 'effect/Effect';\nimport { type RepoPolicyOptions, repoPolicy } from './repo-policy-form.ts';\nimport { RepositoryRuleset } from './repository-ruleset.ts';\n\nexport interface DeclareRepoPolicyOptions extends RepoPolicyOptions {\n  /**\n   * `true`/`false` pipe `adopt(…)` onto both resources; omitted, the deploy's own policy\n   * decides.\n   */\n  readonly adopt?: boolean;\n}\n\n/**\n * Declares the repository and its ruleset under `<id>` and `<id>-ruleset`. Fails, before\n * declaring either, on any policy the form refuses.\n */\nexport const declareRepoPolicy = (id: string, options: DeclareRepoPolicyOptions) =>\n  Effect.gen(function* () {\n    const policy = yield* Effect.try({\n      catch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),\n      try: () => repoPolicy(options),\n    });\n    // ⚠️ `never` in the error channel, not a generic `E`: `AdoptPolicy.adopt` is typed\n    //   `Effect<A, never, R> => Effect<A, never, R>`, so a wider error type fails to\n    //   compile here rather than at the call site. Alchemy's resources declare `never`.\n    const owned = <A, R>(resource: Effect.Effect<A, never, R>) => {\n      const kept = resource.pipe(RemovalPolicy.retain());\n      return options.adopt === undefined ? kept : kept.pipe(adopt(options.adopt));\n    };\n    const repository = yield* owned(GitHub.Repository(id, policy.repository));\n    // `policy.ruleset` is a plain `RulesetProps` — every field `RepositoryRulesetProps` adds\n    // over it is optional, so it needs no translation to satisfy the bridge's props.\n    const ruleset = yield* owned(RepositoryRuleset(`${id}-ruleset`, policy.ruleset));\n    return { policy, repository, ruleset };\n  });\n",
+    "/**\n * `declareRepoPolicy` — the policy from repo-policy-form.ts, as resources.\n *\n *     const policy = yield* declareRepoPolicy('api', {\n *       owner: 'my-org',\n *       repository: 'api',\n *       checks: ['ci', 'secret scan'],\n *     });\n *\n * Provide `repoPolicyProviders()` (repository-ruleset-providers.ts) — the composed\n * `GitHub.providers()` + `RepositoryRulesetProvider()` layer; this subpath adds no GitHub\n * provider of its own beyond the ruleset bridge.\n *\n * ★ REWIRED 2026-09-23 onto `GitHub.RepositoryRuleset`, not upstream `GitHub.Ruleset` — the\n *   ADOPT-SAFE bridge documented in repository-ruleset.ts. Only `builds` calls this, and its\n *   ruleset has NEVER been created (LIVE SURVEY 2026-09-23: 0 rulesets live on `builds`), so\n *   the swap changes no live resource's identity; a cold first deploy is the only deploy this\n *   call has ever had. `homeflare/docs/repo-policy-ruleset-hazards.md`'s \"before the first\n *   deploy, check by hand\" workaround is now enforced by the resource itself (the name-probe in\n *   repository-ruleset-probe.ts) rather than left to the operator — see that doc for the\n *   history, kept rather than deleted so the hazard `builds` almost hit stays legible.\n * ⚠️ `GitHub.Repository` keeps its OWN upstream behavior unchanged — it already probed by name\n *   and converged, so only the ruleset half of this helper needed the swap.\n *\n * ⛔ BOTH RESOURCES RETAIN. `retain` is already the vendor default for each of them; it\n *   is piped anyway so that a vendor change cannot quietly turn \"drop this call from the\n *   stack\" into \"delete the repository\" or \"unprotect the default branch\".\n *\n * ⛔ APPLY ORDER: `allowAutoMerge` NEVER GOES LIVE BEFORE THE RULESET IT WAITS ON — see\n *   repo-auto-merge-gate.ts's header for the mechanism (Alchemy orders by Output references in\n *   props, not declaration order), the K5 hazard it closes, and why checks/approvals being\n *   REMOVED needs no matching reverse edge. `assertAutoMergeWaits` (repo-policy-guards.ts)\n *   already guarantees `policy.repository.allowAutoMerge` is only ever `true` when the ruleset\n *   carries something outstanding (checks, approvals, or both), so that one flag is the gate.\n * ⚠️ A REPOSITORY THAT DOES NOT YET EXIST: gating on the ruleset only matters once there are open\n *   pull requests to prematurely merge, and `GitHub.Repository`'s own `reconcile` sets\n *   `allowAutoMerge` atomically in the SAME create call that makes the repo — no window where a\n *   PR could exploit it. This helper's documented use (`builds`, above) is always a repo that\n *   already converged before its ruleset's first deploy; a caller declaring both fresh in one\n *   deploy, with checks/approvals from day one, must create the bare repository first (a prior\n *   deploy, or a separate `GitHub.Repository` call) — GitHub's ruleset API 404s on a repo that\n *   does not exist yet, and this gate now makes the ruleset apply before the repository.\n */\nimport { adopt } from 'alchemy/AdoptPolicy';\nimport * as GitHub from 'alchemy/GitHub';\nimport * as RemovalPolicy from 'alchemy/RemovalPolicy';\nimport * as Effect from 'effect/Effect';\nimport { gateAutoMergeOnRuleset } from './repo-auto-merge-gate.ts';\nimport { type RepoPolicyOptions, repoPolicy } from './repo-policy-form.ts';\nimport { RepositoryRuleset } from './repository-ruleset.ts';\n\nexport interface DeclareRepoPolicyOptions extends RepoPolicyOptions {\n  /**\n   * `true`/`false` pipe `adopt(…)` onto both resources; omitted, the deploy's own policy\n   * decides.\n   */\n  readonly adopt?: boolean;\n}\n\n/**\n * Declares the repository and its ruleset under `<id>` and `<id>-ruleset`. Fails, before\n * declaring either, on any policy the form refuses.\n */\nexport const declareRepoPolicy = (id: string, options: DeclareRepoPolicyOptions) =>\n  Effect.gen(function* () {\n    const policy = yield* Effect.try({\n      catch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),\n      try: () => repoPolicy(options),\n    });\n    // ⚠️ `never` in the error channel, not a generic `E`: `AdoptPolicy.adopt` is typed\n    //   `Effect<A, never, R> => Effect<A, never, R>`, so a wider error type fails to\n    //   compile here rather than at the call site. Alchemy's resources declare `never`.\n    const owned = <A, R>(resource: Effect.Effect<A, never, R>) => {\n      const kept = resource.pipe(RemovalPolicy.retain());\n      return options.adopt === undefined ? kept : kept.pipe(adopt(options.adopt));\n    };\n    // `policy.ruleset` is a plain `RulesetProps` — every field `RepositoryRulesetProps` adds\n    // over it is optional, so it needs no translation to satisfy the bridge's props.\n\n    // Auto-merge is turning on (or staying on): declare and apply the ruleset FIRST, so its\n    // rulesetId is available to gate the repository's allowAutoMerge — see the file header.\n    if (policy.repository.allowAutoMerge) {\n      const ruleset = yield* owned(RepositoryRuleset(`${id}-ruleset`, policy.ruleset));\n      const repository = yield* owned(\n        GitHub.Repository(id, gateAutoMergeOnRuleset(policy.repository, ruleset)),\n      );\n      return { policy, repository, ruleset };\n    }\n\n    const repository = yield* owned(GitHub.Repository(id, policy.repository));\n    const ruleset = yield* owned(RepositoryRuleset(`${id}-ruleset`, policy.ruleset));\n    return { policy, repository, ruleset };\n  });\n",
+    "/**\n * `gateAutoMergeOnRuleset` — the one place `declareRepoBaseline` and `declareRepoPolicy` thread\n * a real apply-ordering edge from `GitHub.Repository`'s `allowAutoMerge` to the sibling\n * `RepositoryRuleset`, so a deploy can never turn auto-merge on before the ruleset's required\n * checks/approvals are actually live.\n *\n * ⛔ K5 (kit PR 216, 2026-09-24): both callers declare `GitHub.Repository` and `RepositoryRuleset`\n *   as two INDEPENDENT resources with no dependency edge between them. When a repo moves from\n *   `checks:[]` to `checks:['x']`, `allowAutoMerge` flips to `true` in the very same deploy that\n *   adds the required check. If the Repository apply lands before the Ruleset apply — or the\n *   Ruleset apply fails outright — the repo ends up with auto-merge on and nothing required: `gh\n *   pr merge --auto` merges a CLEAN pull request immediately (memory `gh-auto-merge-merges-now`).\n *   That fail-open state is exactly what K5 exists to prevent.\n *\n * ★ THE MECHANISM — ALCHEMY ORDERS BY OUTPUT REFERENCES IN PROPS, NOT DECLARATION ORDER.\n *   `Plan.ts` (~l.1031-1038): a resource's upstream deps are `Output.upstreamAny(resource.Props)`.\n *   `Apply.ts` (~l.760-762, ~l.909): `waitForDeps(allUpstreamFqns())` — built the same way from\n *   `Output.resolveUpstream(node.props)` — runs before `reconcile`. See the kit's own\n *   `alchemy-output-refs-order-resources` memory. `GitHub.Repository`'s upstream `RepositoryProps`\n *   has no spare field: `reconcile` (`node_modules/alchemy/src/GitHub/Repository.ts`) sends every\n *   declared prop straight to Octokit's create/update calls, so there is nothing to smuggle an\n *   unrelated Output into. `allowAutoMerge` itself is the vehicle instead: its value is still\n *   exactly `true` whenever this function is called with it already `true` — only now computed\n *   AFTER `ruleset.rulesetId` resolves via `Output.map`, instead of written as a literal. That\n *   single Output reference is enough for `Output.upstreamAny` to record the ruleset as this\n *   Repository's upstream dependency, so the engine applies the ruleset first.\n *\n * ★ WHY THIS NEEDS NO REVERSE-DIRECTION EDGE. The opposite transition — checks/approvals\n *   REMOVED, so `allowAutoMerge` turns off — cannot silently race the other way. Neither caller\n *   ever declares `rules.requiredStatusChecks: false` or omits `rules.pullRequest` on purpose;\n *   dropping `checks`/`requiredApprovals` from the options just OMITS the corresponding rule key.\n *   `requiredChecksOmissionRefusal` and `undeclaredLiveRuleRefusal` (repository-ruleset-guards.ts)\n *   both refuse — unconditionally, regardless of apply order — to drop a rule that is still LIVE\n *   by omission. So the worst reachable state, whichever resource applies first, is: Repository\n *   succeeds (auto-merge off, the correct direction anyway) and Ruleset refuses (the live rule\n *   stays required) — never fail-open. Proved by the ordering/failure tests beside this file.\n */\nimport * as Output from 'alchemy/Output';\n\n/** The one attribute this gate needs from a declared `RepositoryRuleset`. */\nexport interface AutoMergeGateSource {\n  readonly rulesetId: Output.Output<number, never>;\n}\n\n/**\n * Returns `settings` unchanged when `allowAutoMerge` is falsy — nothing to gate, and every\n * existing declaration with auto-merge off keeps its exact prior props (no diff, no replan).\n * Otherwise returns `settings` with `allowAutoMerge` recomputed as an Output.map over\n * `ruleset.rulesetId` — still resolves to `true`, now with a real dependency edge attached.\n */\nexport function gateAutoMergeOnRuleset<P extends { readonly allowAutoMerge?: boolean }>(\n  settings: P,\n  ruleset: AutoMergeGateSource,\n): P | (Omit<P, 'allowAutoMerge'> & { readonly allowAutoMerge: Output.Output<boolean, never> }) {\n  if (!settings.allowAutoMerge) return settings;\n  return { ...settings, allowAutoMerge: Output.map(ruleset.rulesetId, () => true) };\n}\n",
     "/**\n * `GitHub.RepositoryRuleset` — a bridge resource for the one thing upstream `GitHub.Ruleset`\n * cannot do: find a ruleset that already exists before creating a second one with the same\n * name.\n *\n * ⛔ THE HAZARD THIS EXISTS TO CLOSE. Read out of `alchemy@2.0.0-beta.79`'s own source\n *   (`node_modules/alchemy/src/GitHub/Ruleset.ts`, `reconcile`): `let observed = output ===\n *   undefined ? undefined : yield* getRuleset(news, output.rulesetId)`. With no prior state,\n *   `observed` stays `undefined` and `createRepoRuleset` runs UNCONDITIONALLY — there is no\n *   probe by name. GitHub permits several rulesets with one name on a repository, so nothing\n *   errors; the repo quietly ends up with two, both enforcing. `declareRepoPolicy` in this same\n *   package (repo-policy.ts) documents the same hazard and tells a caller to check `gh api\n *   repos/<owner>/<repo>/rulesets` by hand before every first deploy. This resource makes that\n *   check the engine's own job: `read`/`reconcile` list-and-filter by name+target before ever\n *   creating (see repository-ruleset-probe.ts).\n *\n * ★ WHY A NEW TYPE STRING, NOT A PATCHED `GitHub.Ruleset`. Upstream's `Ruleset` cannot be\n *   edited from here — it ships inside the `alchemy` package. `GitHub.RepositoryRuleset` is a\n *   distinct `Provider` (its own `Context.Service` keyed by this type string — see\n *   `alchemy/src/Provider.ts#Provider`), so it is declared and merged into a stack's provider\n *   layer independently of `GitHub.providers()` — the same way `postgres/database.ts` merges\n *   `PostgresDatabaseProvider()` beside it. Nothing about upstream's `GitHub.Providers`\n *   collection needs touching for the two to coexist in one stack. Props are a strict superset\n *   of upstream's `RulesetProps` (H14: the type string sits inside upstream's own `GitHub`\n *   namespace, recorded as house difference H15 below for the client choice).\n *\n * ⛔ H15: CLIENT IS OCTOKIT, NOT DISTILLED — A NAMED DIVERGENCE FROM S23. The house's default is\n *   `@distilled.cloud/*` when a vendor SDK exists there, and `@distilled.cloud/github@1.0.0-rc.12`\n *   does ship `createRepoRuleset`/`updateRepoRuleset`. But it has NO field for\n *   `require_extra_approval_for_unattributed_changes` (measured 2026-09-22: grep of its\n *   generated types), and its request bodies are plain `effect/Schema` `S.Struct`s, which strip\n *   properties a schema does not declare on encode — REASONED, not measured against distilled\n *   itself; repository-ruleset-wire.test.ts measures the Octokit side of the same question\n *   instead, because Octokit is the client this file actually uses. That flag is the entire\n *   reason this resource exists for the 0-approval, solo-maintainer shape (see\n *   repo-policy-guards.ts's `resolveApprovals` for the same story on the upstream-only path):\n *   GitHub defaults it to `true` when absent, which blocks the very pull requests a `0` was\n *   meant to allow. `octokitFor`/`GitHubCredentials` are upstream's own EXPORTED building\n *   blocks (S23's second clause: reuse Alchemy's own client construction), so the client itself\n *   is not hand-rolled — only the choice of Octokit over distilled is a recorded divergence.\n *\n * ⛔ CREDENTIALS BELONG TO THE PROVIDER'S LAYER, NOT THE RESOURCE'S DECLARATION — MEASURED\n *   2026-09-24 (homeflare-builds bump PR 6, tsc TS2345). The `Resource<Type, Props, Attributes,\n *   Binding, Providers>` 5th type parameter had `GitHubCredentials` here; that puts the\n *   credential requirement on every `yield* RepositoryRuleset(...)` CALL SITE (see\n *   `alchemy/src/Resource.ts#ResourceClass`: `Req = R[\"Providers\"] extends undefined ?\n *   Provider<R> : R[\"Providers\"]`), so a STACK BODY that merely declares the resource would\n *   itself need `GitHubCredentials` in its own effect context — which a stack body cannot\n *   produce (`Alchemy.Stack`'s own type, `alchemy/src/Stack.ts#ProviderServices`, is a closed\n *   union of tagged marker interfaces — `ProviderCollectionLike | Provider<any> |\n *   EnvironmentLike | CredentialsLike | DockerLike` — and `GitHubCredentials` matches none of\n *   them structurally). VERIFIED against upstream `Ruleset` (`node_modules/alchemy/src/GitHub/\n *   Ruleset.ts`): its 5th slot is `GitHub.Providers`, the ProviderCollection tag `GitHub.\n *   providers()` OUTPUTS — never the raw `GitHubCredentials` service upstream's OWN provider\n *   handlers pull in via `octokitFor`. `GitHubCredentials` stays confined to the PROVIDER's\n *   layer requirement (`Provider.succeed`'s inferred `ReadReq | DiffReq | ReconcileReq |\n *   DeleteReq`, below), never the declaration's. Omitting the 5th parameter here defaults it to\n *   `undefined`, so the declaration's own requirement becomes `Provider<RepositoryRuleset>` —\n *   itself a `Provider<any>`, a real `ProviderServices` member — matching the pattern a\n *   standalone (non-collection) resource actually needs. See `repoPolicyProviders()` in\n *   repository-ruleset-providers.ts for the layer composition this now requires (the provider\n *   still needs `GitHubCredentials` fed in — that half of the fix was already correct, per\n *   `docs/repository-ruleset.md`).\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport {\n  allowedMergeMethodsRefusal,\n  approvalCountRefusal,\n} from './repository-ruleset-constraints.ts';\nimport { RulesetConstraintRefused } from './repository-ruleset-errors.ts';\nimport { makeRulesetOctokit } from './repository-ruleset-octokit.ts';\nimport { type RulesetRecord, probeByName } from './repository-ruleset-probe.ts';\nimport type { RepositoryRulesetProps } from './repository-ruleset-props.ts';\nimport { reconcileRuleset } from './repository-ruleset-reconcile.ts';\n\nexport type {\n  RepositoryRulesetProps,\n  RepositoryRulesetPullRequestRule,\n  RepositoryRulesetReviewerRule,\n  RepositoryRulesetRules,\n  RepositoryRulesetStatusChecksRule,\n} from './repository-ruleset-props.ts';\n\nexport interface RepositoryRulesetAttributes {\n  readonly rulesetId: number;\n  readonly nodeId: string | undefined;\n  readonly name: string;\n  readonly createdAt: string | undefined;\n  readonly updatedAt: string | undefined;\n}\n\nexport interface RepositoryRuleset extends Resource<\n  'GitHub.RepositoryRuleset',\n  RepositoryRulesetProps,\n  RepositoryRulesetAttributes,\n  never\n  // ⛔ NO 5th (`Providers`) ARGUMENT — see the file header. Defaulting it to `undefined` makes\n  // a `yield* RepositoryRuleset(...)` call site require `Provider<RepositoryRuleset>`, not\n  // `GitHubCredentials`; the credential requirement lives on the PROVIDER below instead.\n> {}\n\nexport const RepositoryRuleset = Resource<RepositoryRuleset>('GitHub.RepositoryRuleset', {\n  defaultRemovalPolicy: 'retain',\n});\n\nexport const attrsOf = (r: RulesetRecord): RepositoryRulesetAttributes => ({\n  rulesetId: r.id,\n  nodeId: r.node_id,\n  name: r.name,\n  createdAt: r.created_at,\n  updatedAt: r.updated_at,\n});\n\n/** Plan-time-only refusals — no live data needed, so these run before any read (schema-codegen's\n * rule: check the form before the \"no previous state\" branch, never after it). */\nfunction constraintRefusal(props: RepositoryRulesetProps): RulesetConstraintRefused | undefined {\n  // `=== false` narrows `pullRequest` out of the `| false` half added for exact-adopt\n  // pass-through (see `RepositoryRulesetRules` above) — a declared absence has no fields to\n  // constrain.\n  const pr = props.rules?.pullRequest === false ? undefined : props.rules?.pullRequest;\n  const approvals = pr?.requiredApprovingReviewCount;\n  if (approvals !== undefined) {\n    const reason = approvalCountRefusal(approvals);\n    if (reason !== undefined) {\n      return new RulesetConstraintRefused({\n        field: 'rules.pullRequest.requiredApprovingReviewCount',\n        reason,\n      });\n    }\n  }\n  const methods = pr?.allowedMergeMethods;\n  if (methods !== undefined) {\n    const reason = allowedMergeMethodsRefusal(methods);\n    if (reason !== undefined) {\n      return new RulesetConstraintRefused({\n        field: 'rules.pullRequest.allowedMergeMethods',\n        reason,\n      });\n    }\n  }\n  // ⚠️ NO SEPARATE PLAN-TIME CHECK FOR A BLANK `acknowledge{Bypass,Rule}Narrowing.reason` HERE.\n  //   A blank reason is already indistinguishable from \"not acknowledged at all\" —\n  //   `isBypassNarrowingAcknowledged`/`isRuleNarrowingAcknowledged`\n  //   (repository-ruleset-narrowing-guards.ts) each require a non-empty, trimmed `reason` on\n  //   their OWN prop, and the matching narrowing guard reads that, not presence alone. Adding a\n  //   SECOND check here would refuse with `RulesetConstraintRefused` instead of the more\n  //   specific `BypassActorNarrowed`/`RuleNarrowed` the caller actually needs to act on — and,\n  //   unlike those two (exercised directly through `reconcileRuleset`, injected-octokit fakes\n  //   included), this function is wired only through the real `RepositoryRuleset.Provider`\n  //   (`makeRulesetOctokit` needs live `GitHubCredentials`), which this family's own test\n  //   helpers do not exercise (see `repository-ruleset-test-helpers.ts`'s stub\n  //   `constraintRefusal`) — a check that lives only here would ship untested.\n  return undefined;\n}\n\nexport const repositoryRulesetHandlers = RepositoryRuleset.Provider.of({\n  // Account-wide, cross-repo enumeration duplicates upstream `GitHub.Ruleset`'s own `list` for\n  // no benefit here — every RepositoryRuleset is declared once, by name, in a checkout's own\n  // stack (S12 already defaults this; nuke should never touch a `retain` ruleset regardless).\n  list: () => Effect.succeed([]),\n  nuke: { skip: true },\n\n  read: ({ output, olds }) =>\n    Effect.gen(function* () {\n      const octokit = makeRulesetOctokit(olds.baseUrl);\n      if (output === undefined) {\n        const match = yield* probeByName(octokit, {\n          owner: olds.owner,\n          repo: olds.repository,\n          name: olds.name,\n          target: olds.target ?? 'branch',\n        });\n        // Identical is not ours (H1): a name match with no prior state needs adopt(true).\n        return match === undefined ? undefined : Unowned(attrsOf(match));\n      }\n      const byId = yield* octokit.get({\n        owner: olds.owner,\n        repo: olds.repository,\n        rulesetId: output.rulesetId,\n      });\n      if (byId !== undefined) return attrsOf(byId);\n      const byName = yield* probeByName(octokit, {\n        owner: olds.owner,\n        repo: olds.repository,\n        name: olds.name,\n        target: olds.target ?? 'branch',\n      });\n      return byName === undefined ? undefined : attrsOf(byName);\n    }),\n\n  // Plain function, not `Effect.fn(function* …)` — there is nothing here to `yield*`, and an\n  // empty generator is its own lint hazard (oxlint's `require-yield`) for a reason: it reads as\n  // an unfinished `Effect.gen` body.\n  diff: ({ news, olds }) =>\n    Effect.succeed(\n      isResolved(news) &&\n        olds !== undefined &&\n        (news.owner !== olds.owner || news.repository !== olds.repository)\n        ? ({ action: 'replace' } as const)\n        : undefined,\n    ),\n\n  reconcile: ({ news, output }) =>\n    reconcileRuleset({\n      octokit: makeRulesetOctokit(news.baseUrl),\n      news,\n      output,\n      constraintRefusal,\n      attrsOf,\n    }),\n\n  delete: ({ olds, output }) =>\n    Effect.gen(function* () {\n      if (output?.rulesetId === undefined) return;\n      const octokit = makeRulesetOctokit(olds.baseUrl);\n      yield* octokit.delete({\n        owner: olds.owner,\n        repo: olds.repository,\n        rulesetId: output.rulesetId,\n      });\n    }),\n});\n\nexport const RepositoryRulesetProvider = () =>\n  Provider.succeed(RepositoryRuleset, repositoryRulesetHandlers);\n",
     "/**\n * Wire-form constraints for `GitHub.RepositoryRuleset`, read off GitHub's own schema rather\n * than invented (vendor-schema's rule: never infer a bound the schema does not state).\n *\n * Provenance: `github/rest-api-description` commit `4377b4f4845b` on `main`\n * (measured 2026-09-23; 12,964,430 bytes; sha256 `b8ca0376…` (prefix as given upstream by the\n * planner — this file does not extend it), `info.version` `1.1.4`).\n * That commit's `pull_request` rule gives `allowed_merge_methods` as the enum\n * `{merge, squash, rebase}` and `required_approving_review_count` as `0–10` — both match\n * what Octokit's own installed types carry (below), so the two agree.\n *\n * ⚠️ MEASURED 2026-09-23, CORRECTING THE PLAN'S OWN CITATION: `@octokit/rest@22.0.1` pulls\n *   `@octokit/openapi-types@29.0.1` in directly, but the REST method PARAMETER TYPES Octokit\n *   actually exposes — `Parameters<Octokit['rest']['repos']['createRepoRuleset']>[0]`, which\n *   `RepositoryRuleType` below is derived from — resolve through a DIFFERENT chain:\n *   `@octokit/plugin-rest-endpoint-methods@17.0.0` → `@octokit/types@16.0.0` →\n *   `@octokit/openapi-types@27.0.0` (`bun install`'s own resolution in this checkout,\n *   confirmed by reading each intermediate `package.json`). 27.0.0's `repository-rule` union\n *   has 21 members, one fewer than 29.0.1's 22 — it has no `license_compliance_scanning`.\n *   `RULE_TYPE_COVERAGE`'s `satisfies` below is written against the 27.0.0 union, because\n *   that is the one `tsc` (and so `bun run check`) actually enforces; a bump that moves\n *   `plugin-rest-endpoint-methods` onto a newer `@octokit/types` will fail this file to\n *   compile on the very day the union changes (S1 test iv), which is the point.\n *\n * ⛔ `require_extra_approval_for_unattributed_changes` appears in NEITHER schema (0 occurrences\n * in the commit above, 0 in either installed `@octokit/openapi-types`) — see\n * repository-ruleset.ts for why it is still modeled (H15) and repository-ruleset-wire.test.ts\n * for whether it survives Octokit's request builder.\n */\nimport type { Octokit } from '@octokit/rest';\n\n/** The exact vendor/toolchain versions this file's constraints were read against (S38). A\n * re-walk that finds a different version updates this comment and the header above together. */\nexport const RULESET_SCHEMA_PROVENANCE = {\n  alchemy: '2.0.0-beta.79',\n  octokitRest: '22.0.1',\n  /** The version `Octokit['rest']['repos']['createRepoRuleset']`'s own PARAMETER TYPES\n   * actually resolve through (`plugin-rest-endpoint-methods@17.0.0` → `@octokit/types@16.0.0`\n   * → this) — not the 29.0.1 `@octokit/rest@22.0.1` pulls in directly. See the file header. */\n  octokitOpenapiTypesForRestMethods: '27.0.0',\n  restApiDescriptionCommit: '4377b4f4845b',\n  restApiDescriptionSha256Prefix: 'b8ca0376',\n  restApiDescriptionInfoVersion: '1.1.4',\n} as const;\n\ntype CreateRulesetParams = NonNullable<\n  Parameters<Octokit['rest']['repos']['createRepoRuleset']>[0]\n>;\n/** The request body Octokit's OWN types accept, minus the two URL-template params — the shape\n * repository-ruleset-form.ts builds `rules`/`conditions`/`bypass_actors` against.\n * ⚠️ `Pick` with explicit keys, NOT `Omit<CreateRulesetParams, 'owner' | 'repo'>` — measured:\n *   `CreateRulesetParams` is an intersection with Octokit's own `RequestParameters`, which\n *   carries a string index signature; `Omit`'s `keyof`-based exclusion collapses through that\n *   signature and produces a type whose named properties no longer survive an object spread\n *   (every spread of the `Omit`'d type type-checked as contributing only `{}`). `Pick` with\n *   literal keys never computes `keyof` over the intersection, so it does not collapse. */\nexport type CreateRulesetBody = Pick<\n  CreateRulesetParams,\n  'name' | 'target' | 'enforcement' | 'bypass_actors' | 'conditions' | 'rules'\n>;\nexport type WireRule = NonNullable<CreateRulesetParams['rules']>[number];\nexport type WirePullRequestRule = Extract<WireRule, { type: 'pull_request' }>;\nexport type WireStatusChecksRule = Extract<WireRule, { type: 'required_status_checks' }>;\n\n/** Every rule `type` Octokit's OWN installed types know about — derived, not hand-listed, so a\n * vendor upgrade that adds a rule type fails `RULE_TYPE_COVERAGE`'s `satisfies` below at\n * compile time (S1 test iv) rather than silently reaching `reconcile` unrecognized. */\nexport type RepositoryRuleType = WireRule['type'];\n\n/** `'modeled'` rules this resource can declare and diff; `'refused'` rules it recognizes on a\n * live ruleset but will never send — a live rule of a refused type fails the plan by name\n * (`UndeclaredLiveRule`) instead of being silently dropped by the wholesale `rules` PUT. */\nexport const RULE_TYPE_COVERAGE = {\n  creation: 'modeled',\n  update: 'modeled',\n  deletion: 'modeled',\n  required_linear_history: 'modeled',\n  required_signatures: 'modeled',\n  pull_request: 'modeled',\n  required_status_checks: 'modeled',\n  non_fast_forward: 'modeled',\n  merge_queue: 'refused',\n  required_deployments: 'refused',\n  commit_message_pattern: 'refused',\n  commit_author_email_pattern: 'refused',\n  committer_email_pattern: 'refused',\n  branch_name_pattern: 'refused',\n  tag_name_pattern: 'refused',\n  workflows: 'refused',\n  code_scanning: 'refused',\n  copilot_code_review: 'refused',\n  file_path_restriction: 'refused',\n  max_file_path_length: 'refused',\n  file_extension_restriction: 'refused',\n  max_file_size: 'refused',\n} as const satisfies Record<RepositoryRuleType, 'modeled' | 'refused'>;\n\nexport const MODELED_RULE_TYPES: readonly RepositoryRuleType[] = (\n  Object.keys(RULE_TYPE_COVERAGE) as RepositoryRuleType[]\n).filter((type) => RULE_TYPE_COVERAGE[type] === 'modeled');\n\nexport const ALLOWED_MERGE_METHODS = ['merge', 'squash', 'rebase'] as const;\nexport type AllowedMergeMethod = (typeof ALLOWED_MERGE_METHODS)[number];\n\nexport const MIN_REQUIRED_APPROVALS = 0;\nexport const MAX_REQUIRED_APPROVALS = 10;\n\n/** `undefined` when the value is within the schema's `0–10` bound for\n * `required_approving_review_count`; otherwise the refusal reason. Plan-time, not wire-time —\n * schema-codegen's rule: check the form, before the \"no previous state\" early return. */\nexport function approvalCountRefusal(count: number): string | undefined {\n  if (\n    !Number.isInteger(count) ||\n    count < MIN_REQUIRED_APPROVALS ||\n    count > MAX_REQUIRED_APPROVALS\n  ) {\n    return (\n      `requiredApprovingReviewCount must be a whole number from ${String(MIN_REQUIRED_APPROVALS)} ` +\n      `to ${String(MAX_REQUIRED_APPROVALS)} (GitHub's own bound); got ${String(count)}.`\n    );\n  }\n  return undefined;\n}\n\n/** `undefined` when every entry is one of the schema's enum and the list is non-empty (\"at\n * least one option must be enabled\" — the schema's own words); otherwise the refusal reason. */\nexport function allowedMergeMethodsRefusal(methods: readonly string[]): string | undefined {\n  if (methods.length === 0) {\n    return 'allowedMergeMethods must name at least one method — GitHub refuses an empty list.';\n  }\n  const bad = methods.filter((m) => !(ALLOWED_MERGE_METHODS as readonly string[]).includes(m));\n  if (bad.length > 0) {\n    return `allowedMergeMethods has values GitHub does not accept: ${bad.join(', ')}.`;\n  }\n  return undefined;\n}\n",
     "/**\n * `GitHub.RepositoryRuleset`'s failures as typed tags (S21). None of these sniffs a status\n * code or matches a message from Octokit — every one is raised from a fact this family's own\n * code already checked (a paginated list, a live GET, a declared prop), so `catchTag` covers\n * every refusal without a driver-string coincidence hiding a different failure underneath it.\n */\nimport * as Data from 'effect/Data';\n\n/**\n * More than one ruleset shares a name (and target) on the same repository. `probeByName`\n * fails BEFORE reading either one — see repository-ruleset-probe.ts — because there is no\n * way to know which one is \"ours\" and guessing risks converging the wrong ruleset.\n */\nexport class DuplicateRuleset extends Data.TaggedError('DuplicateRuleset')<{\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly ids: readonly number[];\n}> {\n  override get message(): string {\n    return (\n      `GitHub.RepositoryRuleset: ${this.owner}/${this.repository} has ${String(this.ids.length)} ` +\n      `rulesets named \"${this.name}\" (ids ${this.ids.join(', ')}). Delete the extra one or rename ` +\n      'it by hand before this resource can adopt or manage it — nothing was read or written.'\n    );\n  }\n}\n\n/** A declared `bypassActors` entry names an actor the live ruleset does not have. Widening\n * bypass is a handoff, never a deploy — see repository-ruleset-guards.ts. */\nexport class BypassActorWidened extends Data.TaggedError('BypassActorWidened')<{\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly widened: readonly string[];\n}> {\n  override get message(): string {\n    return (\n      `GitHub.RepositoryRuleset \"${this.name}\" on ${this.owner}/${this.repository}: the ` +\n      `declaration adds a bypass actor the live ruleset does not have (${this.widened.join(', ')}). ` +\n      'Widening bypass is refused here; grant it by hand and adopt the change, or use handoff.'\n    );\n  }\n}\n\n/** A declared `bypassActors` drops an actor the live ruleset has, with no\n * `acknowledgeBypassNarrowing` on the declaration. Unlike widening, narrowing is not always\n * wrong — an exact-adopt declaration that matches live exactly narrows nothing — so this is\n * refused only when live genuinely has more than the declaration keeps, and it is escapable\n * (`BypassActorWidened` is not): see `bypassNarrowingRefusal` in\n * repository-ruleset-narrowing-guards.ts. */\nexport class BypassActorNarrowed extends Data.TaggedError('BypassActorNarrowed')<{\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly narrowed: readonly string[];\n}> {\n  override get message(): string {\n    return (\n      `GitHub.RepositoryRuleset \"${this.name}\" on ${this.owner}/${this.repository}: the ` +\n      `declaration drops a bypass actor the live ruleset has (${this.narrowed.join(', ')}), and ` +\n      'the declaration carries no `acknowledgeBypassNarrowing`. Add one with a reason once the ' +\n      'removal is deliberate, or restore the actor to match live.'\n    );\n  }\n}\n\n/** A rule type the declaration explicitly marks absent (`false`) while the live ruleset still\n * has it, with no `acknowledgeRuleNarrowing` on the declaration — see `ruleNarrowingRefusal` in\n * repository-ruleset-narrowing-guards.ts. Distinct from `UndeclaredLiveRule`: that one fires on\n * SILENCE (the declaration says nothing); this one fires on an EXPLICIT, but unacknowledged,\n * removal. */\nexport class RuleNarrowed extends Data.TaggedError('RuleNarrowed')<{\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly ruleType: string;\n}> {\n  override get message(): string {\n    return (\n      `GitHub.RepositoryRuleset \"${this.name}\" on ${this.owner}/${this.repository}: the ` +\n      `declaration drops a live \"${this.ruleType}\" rule, and carries no ` +\n      '`acknowledgeRuleNarrowing`. Add one with a reason once the removal is deliberate, or ' +\n      'declare the rule to match live.'\n    );\n  }\n}\n\n/** A live rule's `type` is neither modeled nor explicitly refused by RULE_TYPE_COVERAGE, or is\n * refused and present live anyway. The PUT replaces `rules` wholesale, so silently omitting a\n * live rule type would drop it — this fails the plan by name instead. */\nexport class UndeclaredLiveRule extends Data.TaggedError('UndeclaredLiveRule')<{\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly ruleType: string;\n}> {\n  override get message(): string {\n    return (\n      `GitHub.RepositoryRuleset \"${this.name}\" on ${this.owner}/${this.repository}: the live ` +\n      `ruleset has a \"${this.ruleType}\" rule this resource does not model. Declare it (if it is ` +\n      'now modeled) or an explicit `false` to remove it — the PUT replaces `rules` wholesale, so ' +\n      'nothing may be dropped silently.'\n    );\n  }\n}\n\n/** The declaration omits `requiredStatusChecks` while adopting or updating a live ruleset that\n * HAS one. Declare the contexts, or declare `requiredStatusChecks: false` to remove them. */\nexport class RequiredChecksOmitted extends Data.TaggedError('RequiredChecksOmitted')<{\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly liveContexts: readonly string[];\n}> {\n  override get message(): string {\n    return (\n      `GitHub.RepositoryRuleset \"${this.name}\" on ${this.owner}/${this.repository}: the live ` +\n      `ruleset requires ${this.liveContexts.join(', ')}, and the declaration says nothing about ` +\n      'requiredStatusChecks. Declare the same contexts, or `rules.requiredStatusChecks: false` to ' +\n      'remove them on purpose.'\n    );\n  }\n}\n\n/** A context being ADDED to `requiredStatusChecks` has never reported success anywhere this\n * family looks (the default branch's tip, then recent merged PR heads — K2, bounded, not full\n * history). Requiring it would leave every future pull request pending forever. */\nexport class NeverReportedContext extends Data.TaggedError('NeverReportedContext')<{\n  readonly owner: string;\n  readonly repository: string;\n  readonly context: string;\n}> {\n  override get message(): string {\n    return (\n      `GitHub.RepositoryRuleset: \"${this.context}\" has never reported success on ` +\n      `${this.owner}/${this.repository}'s default branch tip or any of its recent merged pull ` +\n      'requests. Requiring it now would leave every pull request waiting on a check that has ' +\n      'never once reported — refused before any write.'\n    );\n  }\n}\n\n/** A prop value the wire form or GitHub's own schema refuses — an approval count outside 0–10,\n * an empty `allowedMergeMethods`, or an unmodeled rule `type` in the declaration itself. */\nexport class RulesetConstraintRefused extends Data.TaggedError('RulesetConstraintRefused')<{\n  readonly field: string;\n  readonly reason: string;\n}> {\n  override get message(): string {\n    return `GitHub.RepositoryRuleset: ${this.field} — ${this.reason}`;\n  }\n}\n\n/** The independent readback GET after a write does not match what was sent, for one of the\n * fields this family refuses to leave unverified (S10: the write's own report is never proof). */\nexport class ReadbackMismatch extends Data.TaggedError('ReadbackMismatch')<{\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly field: string;\n  readonly sent: unknown;\n  readonly read: unknown;\n}> {\n  override get message(): string {\n    return (\n      `GitHub.RepositoryRuleset \"${this.name}\" on ${this.owner}/${this.repository}: after the ` +\n      `write, an independent GET of ${this.field} read back ${JSON.stringify(this.read)}, not the ` +\n      `${JSON.stringify(this.sent)} that was sent. The write did not persist as declared.`\n    );\n  }\n}\n\nexport type RepositoryRulesetError =\n  | DuplicateRuleset\n  | BypassActorWidened\n  | BypassActorNarrowed\n  | UndeclaredLiveRule\n  | RuleNarrowed\n  | RequiredChecksOmitted\n  | NeverReportedContext\n  | RulesetConstraintRefused\n  | ReadbackMismatch;\n",
@@ -15,10 +16,10 @@
     "/**\n * Everything `reconcile` refuses before it writes, and why. Extracted so\n * repository-ruleset.ts stays the wiring, and the reasoning stays whole — the same split\n * `repo-policy-guards.ts` uses for `declareRepoPolicy`.\n */\nimport * as Effect from 'effect/Effect';\nimport type { RepositoryRulesetProps } from './repository-ruleset.ts';\nimport { RULE_TYPE_COVERAGE, type RepositoryRuleType } from './repository-ruleset-constraints.ts';\nimport {\n  BypassActorWidened,\n  NeverReportedContext,\n  RequiredChecksOmitted,\n  UndeclaredLiveRule,\n} from './repository-ruleset-errors.ts';\nimport type { RulesetOctokit, RulesetRecord } from './repository-ruleset-probe.ts';\n\n/** Exported: repository-ruleset-narrowing-guards.ts reuses the identical key so a widened and a\n * narrowed actor are never computed by two independently-drifting definitions of \"the same\n * actor\". */\nexport const bypassKey = (a: { actor_type: unknown; actor_id: unknown; bypass_mode?: unknown }) =>\n  `${String(a.actor_type)}:${String(a.actor_id ?? '')}:${String(a.bypass_mode ?? 'always')}`;\n\n/**\n * ⛔ A CREATE REQUIRES `[]`; `undefined` on a create is the same thing (nothing live to widen\n *   from). On an update/adopt, `undefined` means unmanaged — the caller never sees this guard\n *   because repository-ruleset.ts sends the LIVE value back unchanged in that case, and this\n *   function is only called when `props.bypassActors` is explicitly declared.\n */\nexport function bypassWideningRefusal(input: {\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly declared: RepositoryRulesetProps['bypassActors'];\n  readonly live: RulesetRecord | undefined;\n}): BypassActorWidened | undefined {\n  // A create may declare any bypass list — nothing live to widen against.\n  if (input.live === undefined) return undefined;\n  const liveActors = (input.live.bypass_actors ?? []) as {\n    actor_type: unknown;\n    actor_id: unknown;\n    bypass_mode?: unknown;\n  }[];\n  const liveKeys = new Set(liveActors.map(bypassKey));\n  const widened = (input.declared ?? [])\n    .map((a) =>\n      bypassKey({\n        actor_type: a.actorType,\n        actor_id: a.actorId,\n        bypass_mode: a.bypassMode ?? 'always',\n      }),\n    )\n    .filter((k) => !liveKeys.has(k));\n  if (widened.length === 0) return undefined;\n  return new BypassActorWidened({\n    owner: input.owner,\n    repository: input.repository,\n    name: input.name,\n    widened,\n  });\n}\n\n/** Exported for the same reason as `bypassKey` — repository-ruleset-narrowing-guards.ts's\n * `ruleNarrowingRefusal` needs the identical live-type set `undeclaredLiveRuleRefusal` computes,\n * not a second reading of `live.rules` that could disagree with this one. */\nexport const liveRuleTypes = (live: RulesetRecord | undefined): Set<string> =>\n  new Set((live?.rules ?? []).map((r) => String(r.type)));\n\n/**\n * Refuses (a) any live rule of a REFUSED type — this resource can never represent it, and the\n * PUT replaces `rules` wholesale, so silence would drop it; and (b) ANY live rule of a MODELED\n * type the declaration is silent about — same hazard, for every rule this resource owns.\n *\n * ⚠️ `declaredTypes` MUST BE PRESENCE, NOT TRUTHINESS — this is the fix for a real bug this\n *   family's own design first shipped with. A plain `rules?.deletion` check cannot distinguish\n *   \"omitted\" from \"declared `false`\", so `undeclaredLiveRuleRefusal` originally exempted every\n *   boolean rule (`creation`/`update`/`deletion`/`requiredLinearHistory`/`requiredSignatures`/\n *   `nonFastForward`) as \"fully owned — omission IS the removal\". Concretely, that meant: a\n *   live ruleset has `deletion: true` (blocks branch deletion); a caller declares this resource\n *   with `rules: { pullRequest: {...}, requiredStatusChecks: {...} }`, simply forgetting\n *   `deletion: true` — an easy mistake, since omitting an optional boolean is not a type error.\n *   The wholesale PUT would have sent `rules` without a `deletion` entry, silently REMOVING\n *   branch-deletion protection on the very next `reconcile` — exactly the hazard this whole\n *   guard exists to prevent, reached through the one door it left open. Found by a self-review\n *   pass (no subagent available in this harness), not by a test; there is now one:\n *   repository-ruleset-write-refusals.test.ts's \"an omitted boolean rule\" case.\n *   `required_status_checks` still gets its own, better-worded `RequiredChecksOmitted` from\n *   {@link requiredChecksOmissionRefusal} and is excluded here so it is not refused twice.\n */\nexport function undeclaredLiveRuleRefusal(input: {\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly live: RulesetRecord | undefined;\n  readonly declaredTypes: ReadonlySet<string>;\n}): UndeclaredLiveRule | undefined {\n  for (const type of liveRuleTypes(input.live)) {\n    const coverage = RULE_TYPE_COVERAGE[type as RepositoryRuleType];\n    if (coverage === 'refused') {\n      return new UndeclaredLiveRule({\n        owner: input.owner,\n        repository: input.repository,\n        name: input.name,\n        ruleType: type,\n      });\n    }\n    if (\n      coverage === 'modeled' &&\n      type !== 'required_status_checks' &&\n      !input.declaredTypes.has(type)\n    ) {\n      return new UndeclaredLiveRule({\n        owner: input.owner,\n        repository: input.repository,\n        name: input.name,\n        ruleType: type,\n      });\n    }\n  }\n  return undefined;\n}\n\n/** The wire `type` for every rule key present ON THE DECLARATION OBJECT ITSELF — `Object.hasOwn`,\n * not truthiness, so `{ deletion: false }` (an explicit, deliberate removal) counts as declared\n * and a bare omission does not. Feeds `undeclaredLiveRuleRefusal`'s `declaredTypes`. */\nexport function declaredRuleTypes(rules: RepositoryRulesetProps['rules']): ReadonlySet<string> {\n  if (rules === undefined) return new Set();\n  const BOOLEAN_KEY_TO_TYPE: Record<string, string> = {\n    creation: 'creation',\n    update: 'update',\n    deletion: 'deletion',\n    requiredLinearHistory: 'required_linear_history',\n    requiredSignatures: 'required_signatures',\n    nonFastForward: 'non_fast_forward',\n  };\n  const types = new Set<string>();\n  for (const [key, type] of Object.entries(BOOLEAN_KEY_TO_TYPE)) {\n    if (Object.hasOwn(rules, key)) types.add(type);\n  }\n  if (Object.hasOwn(rules, 'pullRequest')) types.add('pull_request');\n  return types;\n}\n\n/** `requiredStatusChecks: undefined` while the live ruleset HAS one → refused, naming the live\n * contexts. `requiredStatusChecks: false` is the declared removal and never reaches here. */\nexport function requiredChecksOmissionRefusal(input: {\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly declared: RepositoryRulesetProps['rules'];\n  readonly live: RulesetRecord | undefined;\n}): RequiredChecksOmitted | undefined {\n  if (input.declared?.requiredStatusChecks !== undefined) return undefined;\n  const liveRule = (input.live?.rules ?? []).find((r) => r.type === 'required_status_checks');\n  if (liveRule === undefined) return undefined;\n  const params = liveRule.parameters as\n    | { required_status_checks?: { context: string }[] }\n    | undefined;\n  const liveContexts = (params?.required_status_checks ?? []).map((c) => c.context);\n  return new RequiredChecksOmitted({\n    owner: input.owner,\n    repository: input.repository,\n    name: input.name,\n    liveContexts,\n  });\n}\n\n/** Every context in the declared `requiredStatusChecks` that the LIVE ruleset does not already\n * require — i.e. being added by this plan, the only case a never-reported context can matter. */\nexport const newlyRequiredContexts = (\n  declared: RepositoryRulesetProps['rules'],\n  live: RulesetRecord | undefined,\n): readonly string[] => {\n  if (declared?.requiredStatusChecks === false || declared?.requiredStatusChecks === undefined)\n    return [];\n  const liveRule = (live?.rules ?? []).find((r) => r.type === 'required_status_checks');\n  const liveParams = liveRule?.parameters as\n    | { required_status_checks?: { context: string }[] }\n    | undefined;\n  const liveContexts = new Set((liveParams?.required_status_checks ?? []).map((c) => c.context));\n  return declared.requiredStatusChecks.checks\n    .map((c) => c.context)\n    .filter((c) => !liveContexts.has(c));\n};\n\n/** Fails on the first newly-required context that has never reported success anywhere this\n * family looks (the default branch's tip, then recent merged PR heads — K2) — checked once here\n * (reconcile's observe step) and again by the standalone checker. */\nexport const refuseUnreportedContexts = <R = never>(\n  octokit: RulesetOctokit<R>,\n  owner: string,\n  repo: string,\n  contexts: readonly string[],\n): Effect.Effect<void, NeverReportedContext | Error, R> =>\n  Effect.gen(function* () {\n    for (const context of contexts) {\n      const reported = yield* octokit.hasContextReportedSuccess({ owner, repo, context });\n      if (!reported) {\n        return yield* Effect.fail(new NeverReportedContext({ owner, repository: repo, context }));\n      }\n    }\n  });\n",
     "/**\n * Narrowing refusals — the counterpart to `bypassWideningRefusal`/`undeclaredLiveRuleRefusal` in\n * repository-ruleset-guards.ts, split into its own file purely to keep both under the 250-line\n * cap (same reason repository-ruleset-props.ts exists).\n *\n * ⛔ WIDENING STAYS UNCONDITIONAL; NARROWING GETS AN ESCAPE HATCH. Widening bypass (granting a\n *   NEW actor) has no legitimate reason to happen through a deploy — \"grant it by hand and adopt\n *   the change\" (repository-ruleset-errors.ts's `BypassActorWidened` message) already covers it,\n *   and this file does not touch that guard. NARROWING (removing a live bypass actor, or\n *   dropping a live rule) is different: it is exactly what an EXACT-ADOPT declaration of a repo\n *   whose live ruleset is narrower than the house baseline needs to express on its very first\n *   deploy — a caller declaring `taslabs-net/taslabs-net`'s live shape (measured live via `gh\n *   api repos/taslabs-net/taslabs-net/rulesets/12206080`, 2026-09-23: `bypass_actors:\n *   [{actor_id: 5, actor_type: \"RepositoryRole\", bypass_mode: \"always\"}]`, `rules: [deletion,\n *   non_fast_forward]`, no `pull_request` rule) is not narrowing anything by declaring exactly\n *   that shape — it is matching live exactly, and `reconcileRuleset`'s own noop check (comparing\n *   canonicalized wire forms) makes zero writes for it, same as any other exact match. What\n *   these guards refuse is a LATER declaration that removes something the CURRENT live state\n *   still has, without saying why. `acknowledgeBypassNarrowing`/`acknowledgeRuleNarrowing` are\n *   the \"why\": a reasoned, deliberate sign-off, not a rubber stamp — see their doc comments on\n *   `RepositoryRulesetProps` (repository-ruleset-props.ts).\n *\n * ⛔ THE TWO ACKNOWLEDGEMENTS ARE DELIBERATELY SEPARATE PROPS, NOT ONE SHARED FLAG (2026-09-23\n *   review finding). A single `acknowledgeNarrowing` computed once and handed to both guards let\n *   a reason written for one kind of narrowing silently also excuse the other — a declaration\n *   dropping BOTH a live rule and a live bypass actor at once needed only one acknowledgement,\n *   however narrowly worded, to pass both checks. Each guard below now reads its OWN prop.\n */\nimport { bypassKey, liveRuleTypes } from './repository-ruleset-guards.ts';\nimport { BypassActorNarrowed, RuleNarrowed } from './repository-ruleset-errors.ts';\nimport type { RepositoryRulesetProps, RepositoryRulesetRules } from './repository-ruleset-props.ts';\nimport type { RulesetRecord } from './repository-ruleset-probe.ts';\n\n/** `true` only for a non-empty, non-whitespace `reason` on `acknowledgeBypassNarrowing` — a bare\n * `{}` or a blank string is not an acknowledgement (repository-ruleset.ts's `constraintRefusal`\n * refuses the latter at plan time; this is the read `bypassNarrowingRefusal` shares). Deliberately\n * ignorant of `acknowledgeRuleNarrowing` — see the file header. */\nexport const isBypassNarrowingAcknowledged = (props: RepositoryRulesetProps): boolean =>\n  props.acknowledgeBypassNarrowing !== undefined &&\n  props.acknowledgeBypassNarrowing.reason.trim().length > 0;\n\n/** The `rules`-side counterpart to `isBypassNarrowingAcknowledged`, reading only\n * `acknowledgeRuleNarrowing` — see the file header. */\nexport const isRuleNarrowingAcknowledged = (props: RepositoryRulesetProps): boolean =>\n  props.acknowledgeRuleNarrowing !== undefined &&\n  props.acknowledgeRuleNarrowing.reason.trim().length > 0;\n\n/**\n * A live bypass actor the declaration drops, unacknowledged. `undefined` `declared` never\n * reaches here — same rule as `bypassWideningRefusal`: unmanaged means the live value is\n * preserved unchanged (repository-ruleset-reconcile.ts), so there is nothing to narrow.\n */\nexport function bypassNarrowingRefusal(input: {\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly declared: RepositoryRulesetProps['bypassActors'];\n  readonly live: RulesetRecord | undefined;\n  readonly acknowledged: boolean;\n}): BypassActorNarrowed | undefined {\n  if (input.acknowledged) return undefined;\n  if (input.live === undefined) return undefined;\n  const liveActors = (input.live.bypass_actors ?? []) as {\n    actor_type: unknown;\n    actor_id: unknown;\n    bypass_mode?: unknown;\n  }[];\n  const declaredKeys = new Set(\n    (input.declared ?? []).map((a) =>\n      bypassKey({\n        actor_type: a.actorType,\n        actor_id: a.actorId,\n        bypass_mode: a.bypassMode ?? 'always',\n      }),\n    ),\n  );\n  const narrowed = liveActors.map(bypassKey).filter((k) => !declaredKeys.has(k));\n  if (narrowed.length === 0) return undefined;\n  return new BypassActorNarrowed({\n    owner: input.owner,\n    repository: input.repository,\n    name: input.name,\n    narrowed,\n  });\n}\n\n/** The live rule `type` for the first boolean/`pullRequest` rule the declaration marks `false`\n * while live still has it — `undefined` when none does. `requiredStatusChecks: false` is\n * checked by the caller directly (its live-side read needs `required_status_checks`'s own\n * parameters shape, not just presence, elsewhere in this family — kept out of this helper so it\n * stays a plain type-to-type comparison). */\nfunction droppedBooleanOrPullRequestType(\n  rules: RepositoryRulesetRules,\n  live: ReadonlySet<string>,\n): string | undefined {\n  const declaredFalse: readonly [boolean | undefined, string][] = [\n    [rules.creation, 'creation'],\n    [rules.update, 'update'],\n    [rules.deletion, 'deletion'],\n    [rules.requiredLinearHistory, 'required_linear_history'],\n    [rules.requiredSignatures, 'required_signatures'],\n    [rules.nonFastForward, 'non_fast_forward'],\n  ];\n  for (const [declared, type] of declaredFalse) {\n    if (declared === false && live.has(type)) return type;\n  }\n  if (rules.pullRequest === false && live.has('pull_request')) return 'pull_request';\n  return undefined;\n}\n\n/**\n * A rule the declaration explicitly marks absent (a boolean rule or `pullRequest` declared\n * `false`, or `requiredStatusChecks: false`) while the LIVE ruleset still has it, unacknowledged\n * — the drop `undeclaredLiveRuleRefusal` (repository-ruleset-guards.ts) never sees, because an\n * explicit `false` IS \"declared\" there (see its own `declaredRuleTypes`).\n */\nexport function ruleNarrowingRefusal(input: {\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly declared: RepositoryRulesetProps['rules'];\n  readonly live: RulesetRecord | undefined;\n  readonly acknowledged: boolean;\n}): RuleNarrowed | undefined {\n  if (input.acknowledged) return undefined;\n  const rules = input.declared;\n  if (rules === undefined) return undefined;\n  const live = liveRuleTypes(input.live);\n  const ruleType =\n    droppedBooleanOrPullRequestType(rules, live) ??\n    (rules.requiredStatusChecks === false && live.has('required_status_checks')\n      ? 'required_status_checks'\n      : undefined);\n  if (ruleType === undefined) return undefined;\n  return new RuleNarrowed({\n    owner: input.owner,\n    repository: input.repository,\n    name: input.name,\n    ruleType,\n  });\n}\n",
     "/**\n * The house GitHub baseline, as plain data — the VALUES section of the GitHub-baseline plan\n * (2026-09-23), and nothing else. No provider import (S9's \"pure core\" pattern, the same split\n * repo-policy-form.ts uses): `declare-repo-baseline.ts` turns this into resources, and\n * `hf-repo-baseline-check.ts` reads it read-only against a live repo. Both import THIS file so\n * neither can drift from the other.\n *\n * ⚠️ IDENTICAL FOR PRIVATE AND PUBLIC, except the fields this module marks `publicOnly` —\n *   `security_and_analysis` is `null` on every private repo this estate has (LIVE SURVEY,\n *   2026-09-23), so secret scanning / push protection / private vulnerability reporting are\n *   not settable there at all, not merely off.\n */\n\nexport interface RepoBaselineInput {\n  readonly owner: string;\n  readonly repository: string;\n  readonly checks: readonly string[];\n  readonly visibility: 'public' | 'private';\n  readonly description?: string;\n}\n\n/** `GitHub.Repository` fields this baseline owns. Every merge-automation caller across the 17\n * tray checkouts uses `--squash` (measured 2026-09-23; the only non-squash mentions are\n * GitLab-era comments in cliff.toml), so squash-only is not a per-repo choice.\n *\n * ⛔ K5 (2026-09-24): `allowAutoMerge` FOLLOWS `checks.length`, NOT A HARDCODED `true`. `gh pr\n *   merge --auto` (and the ruleset's own auto-merge) is a queue only while something is\n *   outstanding — with zero required status checks there is nothing to wait for, so GitHub\n *   merges a CLEAN pull request on the spot, with no review and no green run. This is the same\n *   failure `repo-policy-guards.ts`'s `assertAutoMergeWaits` refuses on the sibling `repoPolicy`\n *   path (five doors to the same \"nothing outstanding\" state); this baseline has no `autoMerge`\n *   opt-out prop to refuse WITH, so the fix here is unconditional rather than a thrown refusal —\n *   a repo with an empty `checks` list simply never gets auto-merge turned on by this baseline. */\nexport function repoBaselineSettings(input: RepoBaselineInput) {\n  return {\n    owner: input.owner,\n    name: input.repository,\n    ...(input.description === undefined ? {} : { description: input.description }),\n    visibility: input.visibility,\n    allowSquashMerge: true,\n    allowMergeCommit: false,\n    allowRebaseMerge: false,\n    allowAutoMerge: input.checks.length > 0,\n    deleteBranchOnMerge: true,\n    hasWiki: false,\n  };\n}\n\n/** `GitHub.RepositoryRuleset` `main` — target branch, 0-approval solo-maintainer shape, the\n * named `checks` required, squash-only at the ruleset level too (H15's whole reason to exist:\n * the repository setting can be re-ticked in the UI; the ruleset is what actually enforces it). */\nexport function repoBaselineRuleset(input: RepoBaselineInput) {\n  return {\n    owner: input.owner,\n    repository: input.repository,\n    name: 'main',\n    target: 'branch' as const,\n    enforcement: 'active' as const,\n    bypassActors: [],\n    conditions: { include: ['~DEFAULT_BRANCH'], exclude: [] },\n    rules: {\n      deletion: true,\n      nonFastForward: true,\n      pullRequest: {\n        requiredApprovingReviewCount: 0,\n        dismissStaleReviewsOnPush: true,\n        requireCodeOwnerReview: false,\n        requireLastPushApproval: false,\n        requiredReviewThreadResolution: false,\n        allowedMergeMethods: ['squash' as const],\n        extraApprovalForUnattributedChanges: false as const,\n      },\n      ...(input.checks.length === 0\n        ? {}\n        : {\n            requiredStatusChecks: {\n              checks: input.checks.map((context) => ({ context })),\n              strictRequiredStatusChecksPolicy: false,\n              doNotEnforceOnCreate: false,\n            },\n          }),\n    },\n  };\n}\n\n/** Public-only settings this baseline asserts but cannot express through either resource above\n * at `alchemy@2.0.0-beta.79` — recorded for the wave-3 handoff artifact (plan section 2), not\n * declared anywhere. Both already measured ON for `kit` (LIVE SURVEY 2026-09-23); `builds` is\n * the gap. */\nexport const PUBLIC_ONLY_UNDECLARABLE = [\n  'secret_scanning: enabled',\n  'secret_scanning_push_protection: enabled',\n  'private_vulnerability_reporting: enabled',\n  \"fork-PR approval: 'first_time_contributors'\",\n] as const;\n",
-    "/**\n * `declareRepoBaseline` — the house GitHub baseline (repo-baseline-data.ts), as resources.\n *\n *     const baseline = yield* declareRepoBaseline('api', {\n *       owner: 'taslabs-net',\n *       repository: 'api',\n *       checks: ['ci', 'secret scan'],\n *       visibility: 'private',\n *     });\n *\n * Provide `repoPolicyProviders()` (repository-ruleset-providers.ts) — this subpath ships no\n * provider of its own beyond the ruleset bridge, the same as `declareRepoPolicy`. Both resources\n * are `retain` and `adopt(true)` ALWAYS, unlike `declareRepoPolicy`'s optional `adopt` — a\n * baseline this widely shared is meant for a checkout adopting the estate's existing repository\n * and ruleset by name, never for creating one out from under a caller who forgot the flag (H1: a\n * name match is not ours until adopted).\n *\n * ⛔ NO IMPORT FROM `@homeflare/config`, either direction — see `renderRepoShape`'s own header\n *   in `packages/config/src/repo-shape/render.ts`. A caller spreads `renderRepoShape(shape)\n *   .policy` into these options itself; `checks` only needs to be `readonly string[]`.\n */\nimport { adopt } from 'alchemy/AdoptPolicy';\nimport * as GitHub from 'alchemy/GitHub';\nimport * as RemovalPolicy from 'alchemy/RemovalPolicy';\nimport * as Effect from 'effect/Effect';\nimport {\n  type RepoBaselineInput,\n  repoBaselineRuleset,\n  repoBaselineSettings,\n} from './repo-baseline-data.ts';\nimport { RepositoryRuleset } from './repository-ruleset.ts';\n\nexport interface DeclareRepoBaselineOptions extends RepoBaselineInput {}\n\nexport const declareRepoBaseline = (id: string, options: DeclareRepoBaselineOptions) =>\n  Effect.gen(function* () {\n    const owned = <A, R>(resource: Effect.Effect<A, never, R>) =>\n      resource.pipe(RemovalPolicy.retain(), adopt(true));\n    const repository = yield* owned(GitHub.Repository(id, repoBaselineSettings(options)));\n    const ruleset = yield* owned(RepositoryRuleset(`${id}-ruleset`, repoBaselineRuleset(options)));\n    return { repository, ruleset };\n  });\n",
+    "/**\n * `declareRepoBaseline` — the house GitHub baseline (repo-baseline-data.ts), as resources.\n *\n *     const baseline = yield* declareRepoBaseline('api', {\n *       owner: 'taslabs-net',\n *       repository: 'api',\n *       checks: ['ci', 'secret scan'],\n *       visibility: 'private',\n *     });\n *\n * Provide `repoPolicyProviders()` (repository-ruleset-providers.ts) — this subpath ships no\n * provider of its own beyond the ruleset bridge, the same as `declareRepoPolicy`. Both resources\n * are `retain` and `adopt(true)` ALWAYS, unlike `declareRepoPolicy`'s optional `adopt` — a\n * baseline this widely shared is meant for a checkout adopting the estate's existing repository\n * and ruleset by name, never for creating one out from under a caller who forgot the flag (H1: a\n * name match is not ours until adopted).\n *\n * ⛔ NO IMPORT FROM `@homeflare/config`, either direction — see `renderRepoShape`'s own header\n *   in `packages/config/src/repo-shape/render.ts`. A caller spreads `renderRepoShape(shape)\n *   .policy` into these options itself; `checks` only needs to be `readonly string[]`.\n *\n * ⛔ APPLY ORDER: `allowAutoMerge` NEVER GOES LIVE BEFORE THE RULESET IT WAITS ON. When `checks`\n *   is non-empty, the ruleset is declared and applied FIRST, and the repository's `allowAutoMerge`\n *   is threaded through `gateAutoMergeOnRuleset` (repo-auto-merge-gate.ts) so Alchemy's own\n *   Output-in-props ordering — not declaration order — makes the engine wait for it. See that\n *   file's header for the full mechanism, the K5 hazard it closes, and why the reverse direction\n *   (checks removed) needs no matching edge.\n * ⚠️ A REPOSITORY THAT DOES NOT YET EXIST: `adopt(true)` above does NOT refuse to create — with\n *   nothing live to adopt, Alchemy creates from scratch regardless (`AdoptPolicy`'s own contract:\n *   `undefined` observed state means create, adopt policy or not). The paragraph above says this\n *   baseline is \"never for creating one out from under a caller who forgot the flag\", but nothing\n *   enforces that; it is the caller's discipline, not this function's. If it IS ever called for a\n *   repo+ruleset that do not exist yet with `checks` non-empty from day one, the forced\n *   ruleset-first order above now makes the ruleset's create fail — GitHub's own ruleset API\n *   404s on a repository that does not exist — instead of racing. That failure is explicit and\n *   tested (declare-repo-baseline-apply-order.test.ts's \"created together\" case), not a silent\n *   fail-open, but it is still a real usability regression for that one scenario: create the bare\n *   repository first (a prior deploy, or a separate `GitHub.Repository` call).\n */\nimport { adopt } from 'alchemy/AdoptPolicy';\nimport * as GitHub from 'alchemy/GitHub';\nimport * as RemovalPolicy from 'alchemy/RemovalPolicy';\nimport * as Effect from 'effect/Effect';\nimport {\n  type RepoBaselineInput,\n  repoBaselineRuleset,\n  repoBaselineSettings,\n} from './repo-baseline-data.ts';\nimport { gateAutoMergeOnRuleset } from './repo-auto-merge-gate.ts';\nimport { RepositoryRuleset } from './repository-ruleset.ts';\n\nexport interface DeclareRepoBaselineOptions extends RepoBaselineInput {}\n\nexport const declareRepoBaseline = (id: string, options: DeclareRepoBaselineOptions) =>\n  Effect.gen(function* () {\n    const owned = <A, R>(resource: Effect.Effect<A, never, R>) =>\n      resource.pipe(RemovalPolicy.retain(), adopt(true));\n    const settings = repoBaselineSettings(options);\n\n    // Auto-merge is turning on (or staying on): declare and apply the ruleset FIRST, so its\n    // rulesetId is available to gate the repository's allowAutoMerge — see the file header.\n    if (settings.allowAutoMerge) {\n      const ruleset = yield* owned(\n        RepositoryRuleset(`${id}-ruleset`, repoBaselineRuleset(options)),\n      );\n      const repository = yield* owned(\n        GitHub.Repository(id, gateAutoMergeOnRuleset(settings, ruleset)),\n      );\n      return { repository, ruleset };\n    }\n\n    const repository = yield* owned(GitHub.Repository(id, settings));\n    const ruleset = yield* owned(RepositoryRuleset(`${id}-ruleset`, repoBaselineRuleset(options)));\n    return { repository, ruleset };\n  });\n",
     "/**\n * `repoPolicyProviders` — the documented stack wiring for `RepositoryRuleset` (directly, or\n * through `declareRepoPolicy` / `declareRepoBaseline`): `GitHub.providers()` and\n * `RepositoryRulesetProvider()`, composed so the whole thing typechecks and needs nothing\n * further from the stack.\n *\n *     providers: repoPolicyProviders()\n *\n * ⛔ WHY THIS EXISTS — MEASURED 2026-09-24 (homeflare-builds bump PR 6, tsc). Writing the two\n *   providers side by side, `Layer.mergeAll(GitHub.providers(), RepositoryRulesetProvider())`,\n *   type-errors: `RepositoryRulesetProvider()`'s handlers call `octokitFor`, which needs\n *   `GitHubCredentials` — a requirement of the PROVIDER's layer, correctly inferred by\n *   `Provider.succeed` from `repositoryRulesetHandlers` in repository-ruleset.ts. Merging two\n *   layers does not thread one's output into the other's requirement; `RepositoryRulesetProvider()`\n *   still needs `GitHubCredentials` fed in. `GitHub.providers()` is the only thing here that\n *   resolves credentials (env, stored PAT, `gh` CLI, or OAuth — see `alchemy/src/GitHub/\n *   Providers.ts`), and — because it chains `Layer.provideMerge(Credentials.fromAuthProvider(…))`\n *   internally rather than `Layer.provide` — its own OUTPUT includes `GitHubCredentials`\n *   alongside `GitHub.Providers`. `Layer.provideMerge(github)` on `RepositoryRulesetProvider()`\n *   both supplies that requirement AND keeps `github`'s own output merged in for any\n *   `GitHub.Repository`/`GitHub.Ruleset` the caller also declares. `github` is built once and\n *   referenced twice below — Effect's layer memoization (by reference) builds it once, not\n *   twice, not twice against the auth provider either.\n *\n * ★ THIS IS ONLY HALF OF 2026-09-24's FIX. The other half — `RepositoryRuleset`'s own `Resource<>`\n *   declaration no longer naming `GitHubCredentials` in its 5th (`Providers`) slot — lives in\n *   repository-ruleset.ts's file header; that half is what let a stack BODY calling\n *   `declareRepoPolicy`/`declareRepoBaseline` typecheck at all. Composing the providers\n *   correctly, as this function does, does not by itself fix a body that still requires\n *   `GitHubCredentials` directly.\n *\n * ⚠️ DON'T ALSO MERGE A SEPARATE `GitHub.providers()` CALL IN. `github` here is one Layer\n *   object referenced twice, which Effect's layer memoization (by reference, ADVERSARIAL\n *   REVIEW 2026-09-24: confirmed against `effect@4.0.0-rc.115`'s own `MemoMap`) builds once. A\n *   stack that ALSO writes its own `GitHub.providers()` alongside this function's result is a\n *   second, distinct Layer object — a genuine second credential resolution, not shared with\n *   this one. Get every GitHub resource's providers from this one call.\n */\nimport * as GitHub from 'alchemy/GitHub';\nimport * as Layer from 'effect/Layer';\nimport { RepositoryRulesetProvider } from './repository-ruleset.ts';\n\nexport const repoPolicyProviders = (options?: GitHub.ProvidersOptions) => {\n  const github = GitHub.providers(options);\n  return Layer.mergeAll(github, RepositoryRulesetProvider().pipe(Layer.provideMerge(github)));\n};\n"
   ],
-  "mappings": ";AAsBO,SAAS,WAAW,CAAC,OAAe,OAAuB;AAAA,EAChE,MAAM,UAAU,MAAM,KAAK;AAAA,EAC3B,IAAI,YAAY;AAAA,IAAI,MAAM,IAAI,MAAM,eAAe,mBAAmB;AAAA,EACtE,OAAO;AAAA;AAQF,SAAS,eAAe,CAAC,QAAqC;AAAA,EACnE,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,OAAO,QAAQ;AAAA,IACxB,MAAM,UAAU,IAAI,KAAK;AAAA,IAGzB,IAAI,YAAY,IAAI;AAAA,MAClB,MAAM,IAAI,MACR,uFACF;AAAA,IACF;AAAA,IACA,KAAK,IAAI,OAAO;AAAA,EAClB;AAAA,EACA,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK;AAAA;AAaxB,SAAS,aAAa,CAAC,OAAe,UAAuC;AAAA,EAC3E,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,OAAO,UAAU;AAAA,IAC1B,MAAM,UAAU,IAAI,KAAK;AAAA,IACzB,IAAI,YAAY,IAAI;AAAA,MAClB,MAAM,IAAI,MACR,iBAAiB,8EACnB;AAAA,IACF;AAAA,IACA,KAAK,IAAI,OAAO;AAAA,EAClB;AAAA,EACA,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK;AAAA;AASjB,SAAS,gBAAgB,CAC9B,SACA,UACU;AAAA,EACV,IAAI,YAAY;AAAA,IAAW,OAAO,CAAC,GAAG,QAAQ;AAAA,EAC9C,IAAI,QAAQ,WAAW,GAAG;AAAA,IACxB,MAAM,IAAI,MACR,gHACF;AAAA,EACF;AAAA,EACA,OAAO,cAAc,WAAW,OAAO;AAAA;AAgBlC,SAAS,gBAAgB,CAC9B,SACA,SACU;AAAA,EACV,MAAM,WAAW,YAAY,YAAY,CAAC,IAAI,cAAc,WAAW,OAAO;AAAA,EAC9E,IAAI,SAAS,WAAW;AAAA,IAAG,OAAO;AAAA,EAClC,MAAM,WAAW,IAAI,IAAI,QAAQ;AAAA,EACjC,IAAI,QAAQ,MAAM,CAAC,YAAY,SAAS,IAAI,OAAO,CAAC,GAAG;AAAA,IACrD,MAAM,IAAI,MACR;AAAA,MACE;AAAA,MACA,WAAW,KAAK,UAAU,OAAO,iCAAiC,KAAK,UAAU,QAAQ;AAAA,IAC3F,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAYF,SAAS,gBAAgB,CAAC,WAAmD;AAAA,EAClF,IAAI,cAAc;AAAA,IAAW;AAAA,EAC7B,IAAI,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,GAAG;AAAA,IACjD,MAAM,IAAI,MACR;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AASF,SAAS,oBAAoB,CAAC,OAK5B;AAAA,EACP,IAAI,CAAC,MAAM;AAAA,IAAW;AAAA,EACtB,IAAI,MAAM,gBAAgB,UAAU;AAAA,IAClC,MAAM,IAAI,MACR;AAAA,MACE,2CAA2C,MAAM;AAAA,MACjD;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA,EACA,IAAI,MAAM,eAAe,KAAK,MAAM,cAAc,WAAW;AAAA,IAC3D,MAAM,IAAI,MACR;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA;;;ACjFF,IAAM,uBAAuB;AAM7B,IAAM,kBAAqC,CAAC,iBAAiB;AAatD,SAAS,UAAU,CAAC,SAAwC;AAAA,EACjE,MAAM,QAAQ,YAAY,SAAS,QAAQ,KAAK;AAAA,EAChD,MAAM,aAAa,YAAY,cAAc,QAAQ,UAAU;AAAA,EAC/D,MAAM,SAAS,gBAAgB,QAAQ,MAAM;AAAA,EAC7C,MAAM,UAAU,iBAAiB,QAAQ,SAAS,eAAe;AAAA,EACjE,MAAM,UAAU,iBAAiB,QAAQ,SAAS,OAAO;AAAA,EACzD,MAAM,YAAY,QAAQ,aAAa;AAAA,EACvC,MAAM,cAAc,QAAQ,eAAe;AAAA,EAC3C,MAAM,YAAY,iBAAiB,QAAQ,iBAAiB;AAAA,EAC5D,qBAAqB,EAAE,WAAW,WAAW,YAAY,OAAO,QAAQ,YAAY,CAAC;AAAA,EACrF,MAAM,OAAO,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EAE7E,OAAO;AAAA,IACL,YAAY;AAAA,SACP,QAAQ;AAAA,SACR;AAAA,MAGH,gBAAgB;AAAA,MAChB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,qBAAqB;AAAA,MACrB,MAAM;AAAA,MACN;AAAA,IACF;AAAA,IACA,SAAS;AAAA,SACJ;AAAA,MACH,cAAc,CAAC,GAAI,QAAQ,gBAAgB,CAAC,CAAE;AAAA,MAC9C,YAAY,EAAE,SAAS,QAAQ;AAAA,MAC/B;AAAA,MACA,MAAM,QAAQ,eAAe;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,OAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,WACZ,cAAc,YACd,CAAC,IACD;AAAA,UACE,aAAa;AAAA,YACX,2BAA2B;AAAA,YAC3B,8BAA8B;AAAA,UAChC;AAAA,QACF;AAAA,WACA,OAAO,WAAW,IAClB,CAAC,IACD;AAAA,UACE,sBAAsB;AAAA,YACpB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE;AAAA,YAC7C,kCAAkC;AAAA,UACpC;AAAA,QACF;AAAA,MACN;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAAA;;AC/IF;AACA;AACA;AACA;;;ACiCA;AACA;AACA;AACA;AACA;;;ACIO,IAAM,qBAAqB;AAAA,EAChC,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,yBAAyB;AAAA,EACzB,qBAAqB;AAAA,EACrB,cAAc;AAAA,EACd,wBAAwB;AAAA,EACxB,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,sBAAsB;AAAA,EACtB,wBAAwB;AAAA,EACxB,6BAA6B;AAAA,EAC7B,yBAAyB;AAAA,EACzB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,uBAAuB;AAAA,EACvB,sBAAsB;AAAA,EACtB,4BAA4B;AAAA,EAC5B,eAAe;AACjB;AAEO,IAAM,qBACX,OAAO,KAAK,kBAAkB,EAC9B,OAAO,CAAC,SAAS,mBAAmB,UAAU,SAAS;AAElD,IAAM,wBAAwB,CAAC,SAAS,UAAU,QAAQ;AAG1D,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAK/B,SAAS,oBAAoB,CAAC,OAAmC;AAAA,EACtE,IACE,CAAC,OAAO,UAAU,KAAK,KACvB,QAAQ,0BACR,QAAQ,wBACR;AAAA,IACA,OACE,4DAA4D,OAAO,sBAAsB,OACzF,MAAM,OAAO,sBAAsB,+BAA+B,OAAO,KAAK;AAAA,EAElF;AAAA,EACA;AAAA;AAKK,SAAS,0BAA0B,CAAC,SAAgD;AAAA,EACzF,IAAI,QAAQ,WAAW,GAAG;AAAA,IACxB,OAAO;AAAA,EACT;AAAA,EACA,MAAM,MAAM,QAAQ,OAAO,CAAC,MAAM,CAAE,sBAA4C,SAAS,CAAC,CAAC;AAAA,EAC3F,IAAI,IAAI,SAAS,GAAG;AAAA,IAClB,OAAO,0DAA0D,IAAI,KAAK,IAAI;AAAA,EAChF;AAAA,EACA;AAAA;;;AChIF;AAAA;AAOO,MAAM,yBAA8B,iBAAY,kBAAkB,EAKtE;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,SAAS,KAAK,kBAAkB,OAAO,KAAK,IAAI,MAAM,OACxF,mBAAmB,KAAK,cAAc,KAAK,IAAI,KAAK,IAAI,wCACxD;AAAA;AAGN;AAAA;AAIO,MAAM,2BAAgC,iBAAY,oBAAoB,EAK1E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,qBACjE,mEAAmE,KAAK,QAAQ,KAAK,IAAI,SACzF;AAAA;AAGN;AAAA;AAQO,MAAM,4BAAiC,iBAAY,qBAAqB,EAK5E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,qBACjE,0DAA0D,KAAK,SAAS,KAAK,IAAI,aACjF,6FACA;AAAA;AAGN;AAAA;AAOO,MAAM,qBAA0B,iBAAY,cAAc,EAK9D;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,qBACjE,6BAA6B,KAAK,oCAClC,0FACA;AAAA;AAGN;AAAA;AAKO,MAAM,2BAAgC,iBAAY,oBAAoB,EAK1E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,0BACjE,kBAAkB,KAAK,uEACvB,+FACA;AAAA;AAGN;AAAA;AAIO,MAAM,8BAAmC,iBAAY,uBAAuB,EAKhF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,0BACjE,oBAAoB,KAAK,aAAa,KAAK,IAAI,+CAC/C,gGACA;AAAA;AAGN;AAAA;AAKO,MAAM,6BAAkC,iBAAY,sBAAsB,EAI9E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,8BAA8B,KAAK,4CACnC,GAAG,KAAK,SAAS,KAAK,sEACtB,2FACA;AAAA;AAGN;AAAA;AAIO,MAAM,iCAAsC,iBAAY,0BAA0B,EAGtF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,6BAA6B,KAAK,WAAW,KAAK;AAAA;AAE7D;AAAA;AAIO,MAAM,yBAA8B,iBAAY,kBAAkB,EAOtE;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,2BACjE,gCAAgC,KAAK,mBAAmB,KAAK,UAAU,KAAK,IAAI,gBAChF,GAAG,KAAK,UAAU,KAAK,IAAI;AAAA;AAGjC;;;AC/IA;AACA;AAMA,IAAM,UAAU,CAAC,MAAuB,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC;AAEpF,IAAM,aAAa,CACjB,YAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO,OAAO;AAAA,EAC5B,OAAO,YAAY,YAAY,MAAM,QAAQ,IAAI,MAAM,QAAQ,EAAE,QAAQ,CAAC;AAAA,CAC3E,EAAE,KAAY,gBAAS,OAAO,CAAC;AAElC,IAAM,QAAQ,CAAC,MAAyB,GAAuC,WAAW;AAInF,IAAM,yBAAyB;AAYtC,IAAM,6BAA6B;AAO5B,IAAM,wBAAwB,CACnC,SACA,OACA,MACA,KACA,YAEO,WAAI,UAAU,GAAG;AAAA,EACtB,OAAO,WAAW,YAAY,OAAc,WAAI;AAAA,IACvC,kBAAW;AAAA,MAChB,KAAK,MAAM,QAAQ,KAAK,OAAO,WAAW,EAAE,OAAO,MAAM,KAAK,YAAY,QAAQ,CAAC;AAAA,MACnF,OAAO;AAAA,IACT,CAAC;AAAA,IACM,kBAAW;AAAA,MAChB,KAAK,MAAM,QAAQ,KAAK,MAAM,yBAAyB,EAAE,OAAO,MAAM,IAAI,CAAC;AAAA,MAC3E,OAAO;AAAA,IACT,CAAC;AAAA,EACH,CAAC;AAAA,EACD,MAAM,gBAAgB,UAAU,KAAK,WAAW,KAC9C,CAAC,QAAQ,IAAI,SAAS,WAAW,IAAI,eAAe,SACtD;AAAA,EACA,MAAM,iBAAiB,SAAS,KAAK,KACnC,CAAC,WAAW,OAAO,YAAY,WAAW,OAAO,UAAU,SAC7D;AAAA,EACA,OAAO,iBAAiB;AAAA,CACzB;AAOI,IAAM,uBAAuB,CAClC,SACA,OACA,MACA,SAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAc,kBAAW;AAAA,IACtC,KAAK,MACH,QAAQ,KAAK,MAAM,KAAK;AAAA,MACtB;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,MAAM;AAAA,MACN,WAAW;AAAA,MACX,UAAU;AAAA,IACZ,CAAC;AAAA,IACH,OAAO;AAAA,EACT,CAAC;AAAA,EACD,OAAO,OAAO,KACX,OAAO,CAAC,OAAO,GAAG,cAAc,IAAI,EACpC,MAAM,GAAG,sBAAsB,EAC/B,IAAI,CAAC,OAAO,GAAG,KAAK,GAAG;AAAA,CAC3B;AAMI,IAAM,yBAAyB,CACpC,SACA,OACA,MACA,YAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAc,kBAAW;AAAA,IAC1C,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,EAAE,OAAO,KAAK,CAAC;AAAA,IACjD,OAAO;AAAA,EACT,CAAC;AAAA,EACD,MAAM,MAAM,WAAW,KAAK;AAAA,EAC5B,IAAI,OAAO,sBAAsB,SAAS,OAAO,MAAM,KAAK,OAAO;AAAA,IAAG,OAAO;AAAA,EAE7E,MAAM,QAAQ,OAAO,qBAAqB,SAAS,OAAO,MAAM,GAAG;AAAA,EACnE,WAAW,OAAO,OAAO;AAAA,IACvB,IAAI,OAAO,sBAAsB,SAAS,OAAO,MAAM,KAAK,OAAO;AAAA,MAAG,OAAO;AAAA,EAC/E;AAAA,EACA,OAAO;AAAA,CACR;AAEI,IAAM,qBAAqB,CAAC,aAAqD;AAAA,EACtF,MAAM,GAAG,OAAO,WACP,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,MAAM,WAAW,OAAc,kBAAW;AAAA,MACxC,KAAK,MACH,QAAQ,SAAS,QAAQ,KAAK,MAAM,iBAAiB;AAAA,QACnD;AAAA,QACA;AAAA,QACA,kBAAkB;AAAA,QAClB,UAAU;AAAA,MACZ,CAAC;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAEH,KAAK,GAAG,OAAO,MAAM,gBACZ,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,OAAO,OAAc,kBAAW;AAAA,MAC9B,KAAK,MAAM,QAAQ,KAAK,MAAM,eAAe,EAAE,OAAO,MAAM,YAAY,UAAU,CAAC;AAAA,MACnF,OAAO,CAAC,MAAM;AAAA,IAChB,CAAC,EAAE,KACM,WAAI,GAAG,WAAW,IAAqB,GACvC,eAAQ,OAAO,MAAa,eAAQ,SAAS,CAAC,GAC9C,gBAAS,OAAO,CACzB;AAAA,GACD;AAAA,EAEH,QAAQ,CAAC,UACA,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,QAAQ,SAAS,OAAc,kBAAW;AAAA,MACxC,KAAK,MACH,QAAQ,KAAK,MAAM,kBAAkB;AAAA,QACnC,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,WACT,MAAM;AAAA,MACX,CAAC;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAEH,QAAQ,CAAC,UACA,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,QAAQ,SAAS,OAAc,kBAAW;AAAA,MACxC,KAAK,MACH,QAAQ,KAAK,MAAM,kBAAkB;AAAA,QACnC,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,QACZ,YAAY,MAAM;AAAA,WACf,MAAM;AAAA,MACX,CAAC;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAEH,QAAQ,GAAG,OAAO,MAAM,gBACf,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,OAAc,kBAAW;AAAA,MACvB,KAAK,MAAM,QAAQ,KAAK,MAAM,kBAAkB,EAAE,OAAO,MAAM,YAAY,UAAU,CAAC;AAAA,MACtF,OAAO,CAAC,MAAM;AAAA,IAChB,CAAC,EAAE,KACM,eACA,eAAQ,OAAO,MAAa,WAAI,GAChC,gBAAS,OAAO,CACzB;AAAA,GACD;AAAA,EAEH,2BAA2B,GAAG,OAAO,MAAM,cAClC,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,OAAO,OAAO,uBAAuB,SAAS,OAAO,MAAM,OAAO;AAAA,GACnE;AACL;;;ACzNA;AA4EO,IAAM,cAAc,CACzB,SACA,UAOO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAM,OAAO,QAAQ,KAAK,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,KAAK,CAAC;AAAA,EACxE,MAAM,UAAU,KAAI,OAClB,CAAC,MAAM,EAAE,SAAS,MAAM,SAAS,EAAE,UAAU,cAAc,MAAM,MACnE;AAAA,EACA,OAAO,SAAS,QAAQ;AAAA,EACxB,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS,GAAG;AAAA,IACnB,OAAO,OAAc,aACnB,IAAI,iBAAiB;AAAA,MACnB,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,MAAM,MAAM;AAAA,MACZ,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9B,CAAC,CACH;AAAA,EACF;AAAA,EACA,OAAO,OAAO,QAAQ,IAAI,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,MAAM,WAAW,KAAK,GAAG,CAAC;AAAA,CACvF;;;AC/GH;;;ACiBA,IAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,oBAAoB,CAAC,MAAkD;AAAA,EAC9E,OAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,MACV,iCAAiC,KAAK,gCAAgC;AAAA,MACtE,+BAA+B,KAAK,6BAA6B;AAAA,MACjE,2BAA2B,KAAK,0BAA0B;AAAA,MAC1D,4BAA4B,KAAK,2BAA2B;AAAA,MAC5D,mCAAmC,KAAK,kCAAkC;AAAA,SACtE,KAAK,wBAAwB,YAC7B,CAAC,IACD,EAAE,uBAAuB,CAAC,GAAG,KAAK,mBAAmB,EAAE;AAAA,MAG3D,qBAAqB,KAAK,qBAAqB,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,QAC7D,eAAe,CAAC,GAAG,EAAE,YAAY;AAAA,QACjC,mBAAmB,EAAE;AAAA,QACrB,UAAU,EAAE,IAAI,EAAE,SAAS,SAAS,MAAM,EAAE,SAAS,UAAU;AAAA,MACjE,EAAE;AAAA,SAIE,KAAK,wCAAwC,YAC7C,CAAC,IACD;AAAA,QACE,iDACE,KAAK;AAAA,MACT;AAAA,IACN;AAAA,EAGF;AAAA;AAGF,SAAS,qBAAqB,CAAC,MAAmD;AAAA,EAChF,OAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,MACV,wBAAwB,KAAK,OAAO,IAAI,CAAC,OAAO;AAAA,QAC9C,SAAS,EAAE;AAAA,WACP,EAAE,kBAAkB,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,cAAc;AAAA,MAC7E,EAAE;AAAA,MACF,sCAAsC,KAAK,oCAAoC;AAAA,MAC/E,0BAA0B,KAAK,wBAAwB;AAAA,IACzD;AAAA,EACF;AAAA;AAGK,SAAS,cAAc,CAAC,OAAuD;AAAA,EACpF,MAAM,OAAmB,CAAC;AAAA,EAC1B,WAAW,QAAQ,kBAAkB;AAAA,IACnC,QAAQ;AAAA,WACD;AAAA,QACH,IAAI,OAAO;AAAA,UAAU,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AAAA,QACnD;AAAA,WACG;AAAA,QACH,IAAI,OAAO,QAAQ;AAAA,UACjB,KAAK,KAAK,EAAE,MAAM,UAAU,YAAY,EAAE,+BAA+B,MAAM,EAAE,CAAC;AAAA,QACpF;AAAA,QACA;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAU,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AAAA,QACnD;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAuB,KAAK,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAAA,QAC/E;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAoB,KAAK,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAAA,QACxE;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAgB,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAAA,QACjE;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAa,KAAK,KAAK,qBAAqB,MAAM,WAAW,CAAC;AAAA,QACzE;AAAA,WACG;AAAA,QACH,IAAI,OAAO,sBAAsB;AAAA,UAC/B,KAAK,KAAK,sBAAsB,MAAM,oBAAoB,CAAC;AAAA,QAC7D;AAAA,QACA;AAAA;AAAA,EAEN;AAAA,EACA,OAAO;AAAA;AAKF,SAAS,kBAAkB,CAAC,OAAkD;AAAA,EACnF,OAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM,UAAU;AAAA,IACxB,aAAa,MAAM,eAAe;AAAA,IAClC,gBAAgB,MAAM,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,MACpD,YAAY,EAAE;AAAA,SAIV,EAAE,YAAY,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ;AAAA,MACzD,aAAa,EAAE,cAAc;AAAA,IAC/B,EAAE;AAAA,IACF,YAAY;AAAA,MACV,UAAU;AAAA,QACR,SAAS,CAAC,GAAI,MAAM,YAAY,WAAW,CAAC,MAAM,CAAE,EAAE,KAAK;AAAA,QAC3D,SAAS,CAAC,GAAI,MAAM,YAAY,WAAW,CAAC,CAAE,EAAE,KAAK;AAAA,MACvD;AAAA,IACF;AAAA,IACA,OAAO,eAAe,MAAM,KAAK;AAAA,EACnC;AAAA;AAGF,IAAM,aAAa,CAAI,UACrB,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,KAAK,UAAU,CAAC,EAAE,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC;AAe9E,SAAS,YAAY,CAAC,OAAyB;AAAA,EAC7C,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO,MAAM,IAAI,YAAY;AAAA,EACvD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,MAAM,MAA+B,CAAC;AAAA,IACtC,WAAW,KAAK,OAAO,KAAK,KAAK,EAAE,KAAK,GAAG;AAAA,MACzC,MAAM,IAAK,MAAkC;AAAA,MAC7C,IAAI,MAAM,QAAQ,MAAM;AAAA,QAAW,IAAI,KAAK,aAAa,CAAC;AAAA,IAC5D;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,gBAAgB,CAAC,MAAwD;AAAA,EAChF,MAAM,WAAW,aAAa,IAAI;AAAA,EAClC,MAAM,SAAS,SAAS;AAAA,EACxB,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,OAAO,KAAK,OAAO;AAAA,EACzB,IAAI,MAAM,QAAQ,KAAK,qBAAqB,GAAG;AAAA,IAC7C,KAAK,wBAAwB,CAAC,GAAI,KAAK,qBAAkC,EAAE,KAAK;AAAA,EAClF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,sBAAsB,GAAG;AAAA,IAC9C,KAAK,yBAAyB,WAC5B,KAAK,sBACP;AAAA,EACF;AAAA,EACA,OAAO,KAAK,UAAU,YAAY,KAAK;AAAA;AAalC,SAAS,uBAAuB,CAAC,OAAyB;AAAA,EAC/D,MAAM,IAAK,SAAS,CAAC;AAAA,EAQrB,OAAO,aAAa;AAAA,IAClB,MAAM,EAAE;AAAA,IACR,QAAQ,EAAE,UAAU;AAAA,IACpB,aAAa,EAAE;AAAA,IACf,eAAe,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAAA,IAC/C,YAAY,EAAE;AAAA,IACd,OAAO,YAAY,EAAE,SAAS,CAAC,GAAG,IAAI,gBAAgB,CAAC;AAAA,EACzD,CAAC;AAAA;;;ACjNH;AAcO,IAAM,YAAY,CAAC,MACxB,GAAG,OAAO,EAAE,UAAU,KAAK,OAAO,EAAE,YAAY,EAAE,KAAK,OAAO,EAAE,eAAe,QAAQ;AAQlF,SAAS,qBAAqB,CAAC,OAMH;AAAA,EAEjC,IAAI,MAAM,SAAS;AAAA,IAAW;AAAA,EAC9B,MAAM,aAAc,MAAM,KAAK,iBAAiB,CAAC;AAAA,EAKjD,MAAM,WAAW,IAAI,IAAI,WAAW,IAAI,SAAS,CAAC;AAAA,EAClD,MAAM,WAAW,MAAM,YAAY,CAAC,GACjC,IAAI,CAAC,MACJ,UAAU;AAAA,IACR,YAAY,EAAE;AAAA,IACd,UAAU,EAAE;AAAA,IACZ,aAAa,EAAE,cAAc;AAAA,EAC/B,CAAC,CACH,EACC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;AAAA,EACjC,IAAI,QAAQ,WAAW;AAAA,IAAG;AAAA,EAC1B,OAAO,IAAI,mBAAmB;AAAA,IAC5B,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;AAMI,IAAM,gBAAgB,CAAC,SAC5B,IAAI,KAAK,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,OAAO,EAAE,IAAI,CAAC,CAAC;AAuBjD,SAAS,yBAAyB,CAAC,OAMP;AAAA,EACjC,WAAW,QAAQ,cAAc,MAAM,IAAI,GAAG;AAAA,IAC5C,MAAM,WAAW,mBAAmB;AAAA,IACpC,IAAI,aAAa,WAAW;AAAA,MAC1B,OAAO,IAAI,mBAAmB;AAAA,QAC5B,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,MAAM,MAAM;AAAA,QACZ,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,IACA,IACE,aAAa,aACb,SAAS,4BACT,CAAC,MAAM,cAAc,IAAI,IAAI,GAC7B;AAAA,MACA,OAAO,IAAI,mBAAmB;AAAA,QAC5B,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,MAAM,MAAM;AAAA,QACZ,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA;AAAA;AAMK,SAAS,iBAAiB,CAAC,OAA6D;AAAA,EAC7F,IAAI,UAAU;AAAA,IAAW,OAAO,IAAI;AAAA,EACpC,MAAM,sBAA8C;AAAA,IAClD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,uBAAuB;AAAA,IACvB,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,EAClB;AAAA,EACA,MAAM,QAAQ,IAAI;AAAA,EAClB,YAAY,KAAK,SAAS,OAAO,QAAQ,mBAAmB,GAAG;AAAA,IAC7D,IAAI,OAAO,OAAO,OAAO,GAAG;AAAA,MAAG,MAAM,IAAI,IAAI;AAAA,EAC/C;AAAA,EACA,IAAI,OAAO,OAAO,OAAO,aAAa;AAAA,IAAG,MAAM,IAAI,cAAc;AAAA,EACjE,OAAO;AAAA;AAKF,SAAS,6BAA6B,CAAC,OAMR;AAAA,EACpC,IAAI,MAAM,UAAU,yBAAyB;AAAA,IAAW;AAAA,EACxD,MAAM,YAAY,MAAM,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,wBAAwB;AAAA,EAC1F,IAAI,aAAa;AAAA,IAAW;AAAA,EAC5B,MAAM,SAAS,SAAS;AAAA,EAGxB,MAAM,gBAAgB,QAAQ,0BAA0B,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO;AAAA,EAChF,OAAO,IAAI,sBAAsB;AAAA,IAC/B,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;AAKI,IAAM,wBAAwB,CACnC,UACA,SACsB;AAAA,EACtB,IAAI,UAAU,yBAAyB,SAAS,UAAU,yBAAyB;AAAA,IACjF,OAAO,CAAC;AAAA,EACV,MAAM,YAAY,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,wBAAwB;AAAA,EACpF,MAAM,aAAa,UAAU;AAAA,EAG7B,MAAM,eAAe,IAAI,KAAK,YAAY,0BAA0B,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;AAAA,EAC7F,OAAO,SAAS,qBAAqB,OAClC,IAAI,CAAC,MAAM,EAAE,OAAO,EACpB,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;AAAA;AAMhC,IAAM,2BAA2B,CACtC,SACA,OACA,MACA,aAEO,YAAI,UAAU,GAAG;AAAA,EACtB,WAAW,WAAW,UAAU;AAAA,IAC9B,MAAM,WAAW,OAAO,QAAQ,0BAA0B,EAAE,OAAO,MAAM,QAAQ,CAAC;AAAA,IAClF,IAAI,CAAC,UAAU;AAAA,MACb,OAAO,OAAc,aAAK,IAAI,qBAAqB,EAAE,OAAO,YAAY,MAAM,QAAQ,CAAC,CAAC;AAAA,IAC1F;AAAA,EACF;AAAA,CACD;;;ACnKI,IAAM,gCAAgC,CAAC,UAC5C,MAAM,+BAA+B,aACrC,MAAM,2BAA2B,OAAO,KAAK,EAAE,SAAS;AAInD,IAAM,8BAA8B,CAAC,UAC1C,MAAM,6BAA6B,aACnC,MAAM,yBAAyB,OAAO,KAAK,EAAE,SAAS;AAOjD,SAAS,sBAAsB,CAAC,OAOH;AAAA,EAClC,IAAI,MAAM;AAAA,IAAc;AAAA,EACxB,IAAI,MAAM,SAAS;AAAA,IAAW;AAAA,EAC9B,MAAM,aAAc,MAAM,KAAK,iBAAiB,CAAC;AAAA,EAKjD,MAAM,eAAe,IAAI,KACtB,MAAM,YAAY,CAAC,GAAG,IAAI,CAAC,MAC1B,UAAU;AAAA,IACR,YAAY,EAAE;AAAA,IACd,UAAU,EAAE;AAAA,IACZ,aAAa,EAAE,cAAc;AAAA,EAC/B,CAAC,CACH,CACF;AAAA,EACA,MAAM,WAAW,WAAW,IAAI,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;AAAA,EAC7E,IAAI,SAAS,WAAW;AAAA,IAAG;AAAA,EAC3B,OAAO,IAAI,oBAAoB;AAAA,IAC7B,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;AAQH,SAAS,+BAA+B,CACtC,OACA,MACoB;AAAA,EACpB,MAAM,gBAA0D;AAAA,IAC9D,CAAC,MAAM,UAAU,UAAU;AAAA,IAC3B,CAAC,MAAM,QAAQ,QAAQ;AAAA,IACvB,CAAC,MAAM,UAAU,UAAU;AAAA,IAC3B,CAAC,MAAM,uBAAuB,yBAAyB;AAAA,IACvD,CAAC,MAAM,oBAAoB,qBAAqB;AAAA,IAChD,CAAC,MAAM,gBAAgB,kBAAkB;AAAA,EAC3C;AAAA,EACA,YAAY,UAAU,SAAS,eAAe;AAAA,IAC5C,IAAI,aAAa,SAAS,KAAK,IAAI,IAAI;AAAA,MAAG,OAAO;AAAA,EACnD;AAAA,EACA,IAAI,MAAM,gBAAgB,SAAS,KAAK,IAAI,cAAc;AAAA,IAAG,OAAO;AAAA,EACpE;AAAA;AASK,SAAS,oBAAoB,CAAC,OAOR;AAAA,EAC3B,IAAI,MAAM;AAAA,IAAc;AAAA,EACxB,MAAM,QAAQ,MAAM;AAAA,EACpB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,OAAO,cAAc,MAAM,IAAI;AAAA,EACrC,MAAM,WACJ,gCAAgC,OAAO,IAAI,MAC1C,MAAM,yBAAyB,SAAS,KAAK,IAAI,wBAAwB,IACtE,2BACA;AAAA,EACN,IAAI,aAAa;AAAA,IAAW;AAAA,EAC5B,OAAO,IAAI,aAAa;AAAA,IACtB,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;;;AHzGH,IAAM,2BAA2B,CAC/B,SAC4B;AAAA,EAC5B,MAAM,SAAU,MAAM,cAAc,CAAC;AAAA,EACrC,OAAO;AAAA,IACL,iCAAiC,OAAO;AAAA,IACxC,uBAAuB,MAAM,QAAQ,OAAO,qBAAqB,IAC7D,CAAC,GAAI,OAAO,qBAAkC,EAAE,KAAK,IACrD;AAAA,IACJ,iDACE,OAAO;AAAA,EACX;AAAA;AAMF,SAAS,eAAe,CACtB,OACA,YACA,MACA,WACA,aAC8B;AAAA,EAC9B,MAAM,SAAS,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;AAAA,EAC9D,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,MAAM,UAAU,YAAY,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;AAAA,EAC9E,MAAM,OAAO,yBAAyB,MAAM;AAAA,EAC5C,MAAM,OAAO,yBAAyB,MAAM;AAAA,EAC5C,WAAW,SAAS,OAAO,KAAK,IAAI,GAA4B;AAAA,IAC9D,IAAI,KAAK,WAAW;AAAA,MAAW;AAAA,IAC/B,IAAI,KAAK,UAAU,KAAK,MAAM,MAAM,KAAK,UAAU,KAAK,MAAM,GAAG;AAAA,MAC/D,OAAO,IAAI,iBAAiB;AAAA,QAC1B;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,iCAAiC;AAAA,QACxC,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA;AAAA;AAUK,IAAM,mBAAmB,CAAY,UASnC,YAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,MAAM,QAAQ,mBAAmB,SAAS,YAAY;AAAA,EAC9D,MAAM,UAAU,kBAAkB,IAAI;AAAA,EACtC,IAAI,YAAY;AAAA,IAAW,OAAO,OAAc,aAAK,OAAO;AAAA,EAE5D,MAAM,QAAQ,KAAK;AAAA,EACnB,MAAM,OAAO,KAAK;AAAA,EAClB,MAAM,SAAS,KAAK,UAAU;AAAA,EAE9B,IAAI,WACF,WAAW,YACP,YACA,OAAO,QAAQ,IAAI,EAAE,OAAO,MAAM,WAAW,OAAO,UAAU,CAAC;AAAA,EACrE,IAAI,aAAa,WAAW;AAAA,IAC1B,WAAW,OAAO,YAAY,SAAS,EAAE,OAAO,MAAM,MAAM,KAAK,MAAM,OAAO,CAAC;AAAA,EACjF;AAAA,EAKA,MAAM,qBAAqB,8BAA8B,IAAI;AAAA,EAC7D,MAAM,mBAAmB,4BAA4B,IAAI;AAAA,EAEzD,MAAM,gBACJ,KAAK,iBAAiB,YAClB,YACA,sBAAsB;AAAA,IACpB;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,EACR,CAAC;AAAA,EACP,IAAI,kBAAkB;AAAA,IAAW,OAAO,OAAc,aAAK,aAAa;AAAA,EAExE,MAAM,sBACJ,KAAK,iBAAiB,YAClB,YACA,uBAAuB;AAAA,IACrB;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,IACN,cAAc;AAAA,EAChB,CAAC;AAAA,EACP,IAAI,wBAAwB;AAAA,IAAW,OAAO,OAAc,aAAK,mBAAmB;AAAA,EAEpF,MAAM,cAAc,0BAA0B;AAAA,IAC5C;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,MAAM;AAAA,IACN,eAAe,kBAAkB,KAAK,KAAK;AAAA,EAC7C,CAAC;AAAA,EACD,IAAI,gBAAgB;AAAA,IAAW,OAAO,OAAc,aAAK,WAAW;AAAA,EAEpE,MAAM,oBAAoB,qBAAqB;AAAA,IAC7C;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,IACN,cAAc;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,sBAAsB;AAAA,IAAW,OAAO,OAAc,aAAK,iBAAiB;AAAA,EAEhF,MAAM,gBAAgB,8BAA8B;AAAA,IAClD;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,EACR,CAAC;AAAA,EACD,IAAI,kBAAkB;AAAA,IAAW,OAAO,OAAc,aAAK,aAAa;AAAA,EAExE,MAAM,cAAc,sBAAsB,KAAK,OAAO,QAAQ;AAAA,EAC9D,OAAO,yBAAyB,SAAS,OAAO,MAAM,WAAW;AAAA,EAEjE,MAAM,UAAU,mBAAmB,IAAI;AAAA,EAIvC,MAAM,OACJ,KAAK,iBAAiB,aAAa,aAAa,YAC3C,KAAK,SAAS,eAAe,SAAS,iBAAiB,CAAC,EAAE,IAC3D;AAAA,EAEN,IAAI;AAAA,EACJ,IAAI,QAAQ;AAAA,EACZ,IAAI,aAAa,WAAW;AAAA,IAC1B,SAAS,OAAO,QAAQ,OAAO,EAAE,OAAO,MAAM,KAAK,CAAC;AAAA,IACpD,QAAQ;AAAA,EACV,EAAO;AAAA,IACL,MAAM,OACJ,KAAK,UAAU,wBAAwB,IAAI,CAAC,MAC5C,KAAK,UAAU,wBAAwB,QAAQ,CAAC;AAAA,IAClD,IAAI,MAAM;AAAA,MACR,SAAS;AAAA,IACX,EAAO;AAAA,MACL,SAAS,OAAO,QAAQ,OAAO,EAAE,OAAO,MAAM,WAAW,SAAS,IAAI,KAAK,CAAC;AAAA,MAC5E,QAAQ;AAAA;AAAA;AAAA,EAIZ,IAAI,OAAO;AAAA,IACT,MAAM,cAAc,OAAO,QAAQ,IAAI,EAAE,OAAO,MAAM,WAAW,OAAO,GAAG,CAAC;AAAA,IAC5E,IAAI,gBAAgB,WAAW;AAAA,MAC7B,MAAM,YAAa,KAAK,SAAS,CAAC;AAAA,MAClC,MAAM,WAAW,gBAAgB,OAAO,MAAM,KAAK,MAAM,WAAW,WAAW;AAAA,MAC/E,IAAI,aAAa;AAAA,QAAW,OAAO,OAAc,aAAK,QAAQ;AAAA,IAChE;AAAA,EACF;AAAA,EAEA,OAAO,QAAQ,MAAM;AAAA,CACtB;;;ALzGI,IAAM,oBAAoB,SAA4B,4BAA4B;AAAA,EACvF,sBAAsB;AACxB,CAAC;AAEM,IAAM,UAAU,CAAC,OAAmD;AAAA,EACzE,WAAW,EAAE;AAAA,EACb,QAAQ,EAAE;AAAA,EACV,MAAM,EAAE;AAAA,EACR,WAAW,EAAE;AAAA,EACb,WAAW,EAAE;AACf;AAIA,SAAS,iBAAiB,CAAC,OAAqE;AAAA,EAI9F,MAAM,KAAK,MAAM,OAAO,gBAAgB,QAAQ,YAAY,MAAM,OAAO;AAAA,EACzE,MAAM,YAAY,IAAI;AAAA,EACtB,IAAI,cAAc,WAAW;AAAA,IAC3B,MAAM,SAAS,qBAAqB,SAAS;AAAA,IAC7C,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,IAAI,yBAAyB;AAAA,QAClC,OAAO;AAAA,QACP;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,YAAY,WAAW;AAAA,IACzB,MAAM,SAAS,2BAA2B,OAAO;AAAA,IACjD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,IAAI,yBAAyB;AAAA,QAClC,OAAO;AAAA,QACP;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAaA;AAAA;AAGK,IAAM,4BAA4B,kBAAkB,SAAS,GAAG;AAAA,EAIrE,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,EAEnB,MAAM,GAAG,QAAQ,WACR,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,mBAAmB,KAAK,OAAO;AAAA,IAC/C,IAAI,WAAW,WAAW;AAAA,MACxB,MAAM,QAAQ,OAAO,YAAY,SAAS;AAAA,QACxC,OAAO,KAAK;AAAA,QACZ,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK,UAAU;AAAA,MACzB,CAAC;AAAA,MAED,OAAO,UAAU,YAAY,YAAY,QAAQ,QAAQ,KAAK,CAAC;AAAA,IACjE;AAAA,IACA,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,MAC9B,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,IACD,IAAI,SAAS;AAAA,MAAW,OAAO,QAAQ,IAAI;AAAA,IAC3C,MAAM,SAAS,OAAO,YAAY,SAAS;AAAA,MACzC,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK,UAAU;AAAA,IACzB,CAAC;AAAA,IACD,OAAO,WAAW,YAAY,YAAY,QAAQ,MAAM;AAAA,GACzD;AAAA,EAKH,MAAM,GAAG,MAAM,WACN,gBACL,WAAW,IAAI,KACb,SAAS,cACR,KAAK,UAAU,KAAK,SAAS,KAAK,eAAe,KAAK,cACpD,EAAE,QAAQ,UAAU,IACrB,SACN;AAAA,EAEF,WAAW,GAAG,MAAM,aAClB,iBAAiB;AAAA,IACf,SAAS,mBAAmB,KAAK,OAAO;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EAEH,QAAQ,GAAG,MAAM,aACR,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,QAAQ,cAAc;AAAA,MAAW;AAAA,IACrC,MAAM,UAAU,mBAAmB,KAAK,OAAO;AAAA,IAC/C,OAAO,QAAQ,OAAO;AAAA,MACpB,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,GACF;AACL,CAAC;AAEM,IAAM,4BAA4B,MAC9B,iBAAQ,mBAAmB,yBAAyB;;;ADrLxD,IAAM,oBAAoB,CAAC,IAAY,YACrC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAc,YAAI;AAAA,IAC/B,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,IAC3E,KAAK,MAAM,WAAW,OAAO;AAAA,EAC/B,CAAC;AAAA,EAID,MAAM,QAAQ,CAAO,aAAyC;AAAA,IAC5D,MAAM,OAAO,SAAS,KAAmB,qBAAO,CAAC;AAAA,IACjD,OAAO,QAAQ,UAAU,YAAY,OAAO,KAAK,KAAK,MAAM,QAAQ,KAAK,CAAC;AAAA;AAAA,EAE5E,MAAM,aAAa,OAAO,MAAa,kBAAW,IAAI,OAAO,UAAU,CAAC;AAAA,EAGxE,MAAM,UAAU,OAAO,MAAM,kBAAkB,GAAG,cAAc,OAAO,OAAO,CAAC;AAAA,EAC/E,OAAO,EAAE,QAAQ,YAAY,QAAQ;AAAA,CACtC;;AUhCI,SAAS,oBAAoB,CAAC,OAA0B;AAAA,EAC7D,OAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,OACR,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,IAC5E,YAAY,MAAM;AAAA,IAClB,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,gBAAgB,MAAM,OAAO,SAAS;AAAA,IACtC,qBAAqB;AAAA,IACrB,SAAS;AAAA,EACX;AAAA;AAMK,SAAS,mBAAmB,CAAC,OAA0B;AAAA,EAC5D,OAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,cAAc,CAAC;AAAA,IACf,YAAY,EAAE,SAAS,CAAC,iBAAiB,GAAG,SAAS,CAAC,EAAE;AAAA,IACxD,OAAO;AAAA,MACL,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,aAAa;AAAA,QACX,8BAA8B;AAAA,QAC9B,2BAA2B;AAAA,QAC3B,wBAAwB;AAAA,QACxB,yBAAyB;AAAA,QACzB,gCAAgC;AAAA,QAChC,qBAAqB,CAAC,QAAiB;AAAA,QACvC,qCAAqC;AAAA,MACvC;AAAA,SACI,MAAM,OAAO,WAAW,IACxB,CAAC,IACD;AAAA,QACE,sBAAsB;AAAA,UACpB,QAAQ,MAAM,OAAO,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE;AAAA,UACnD,kCAAkC;AAAA,UAClC,sBAAsB;AAAA,QACxB;AAAA,MACF;AAAA,IACN;AAAA,EACF;AAAA;AAOK,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;ACzEA,kBAAS;AACT;AACA;AACA;AAUO,IAAM,sBAAsB,CAAC,IAAY,YACvC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,CAAO,aACnB,SAAS,KAAmB,sBAAO,GAAG,OAAM,IAAI,CAAC;AAAA,EACnD,MAAM,aAAa,OAAO,MAAa,mBAAW,IAAI,qBAAqB,OAAO,CAAC,CAAC;AAAA,EACpF,MAAM,UAAU,OAAO,MAAM,kBAAkB,GAAG,cAAc,oBAAoB,OAAO,CAAC,CAAC;AAAA,EAC7F,OAAO,EAAE,YAAY,QAAQ;AAAA,CAC9B;;ACHH;AACA;AAGO,IAAM,sBAAsB,CAAC,YAAsC;AAAA,EACxE,MAAM,SAAgB,kBAAU,OAAO;AAAA,EACvC,OAAa,eAAS,QAAQ,0BAA0B,EAAE,KAAW,mBAAa,MAAM,CAAC,CAAC;AAAA;",
-  "debugId": "4642631C8C22EC1064756E2164756E21",
+  "mappings": ";AAsBO,SAAS,WAAW,CAAC,OAAe,OAAuB;AAAA,EAChE,MAAM,UAAU,MAAM,KAAK;AAAA,EAC3B,IAAI,YAAY;AAAA,IAAI,MAAM,IAAI,MAAM,eAAe,mBAAmB;AAAA,EACtE,OAAO;AAAA;AAQF,SAAS,eAAe,CAAC,QAAqC;AAAA,EACnE,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,OAAO,QAAQ;AAAA,IACxB,MAAM,UAAU,IAAI,KAAK;AAAA,IAGzB,IAAI,YAAY,IAAI;AAAA,MAClB,MAAM,IAAI,MACR,uFACF;AAAA,IACF;AAAA,IACA,KAAK,IAAI,OAAO;AAAA,EAClB;AAAA,EACA,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK;AAAA;AAaxB,SAAS,aAAa,CAAC,OAAe,UAAuC;AAAA,EAC3E,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,OAAO,UAAU;AAAA,IAC1B,MAAM,UAAU,IAAI,KAAK;AAAA,IACzB,IAAI,YAAY,IAAI;AAAA,MAClB,MAAM,IAAI,MACR,iBAAiB,8EACnB;AAAA,IACF;AAAA,IACA,KAAK,IAAI,OAAO;AAAA,EAClB;AAAA,EACA,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK;AAAA;AASjB,SAAS,gBAAgB,CAC9B,SACA,UACU;AAAA,EACV,IAAI,YAAY;AAAA,IAAW,OAAO,CAAC,GAAG,QAAQ;AAAA,EAC9C,IAAI,QAAQ,WAAW,GAAG;AAAA,IACxB,MAAM,IAAI,MACR,gHACF;AAAA,EACF;AAAA,EACA,OAAO,cAAc,WAAW,OAAO;AAAA;AAgBlC,SAAS,gBAAgB,CAC9B,SACA,SACU;AAAA,EACV,MAAM,WAAW,YAAY,YAAY,CAAC,IAAI,cAAc,WAAW,OAAO;AAAA,EAC9E,IAAI,SAAS,WAAW;AAAA,IAAG,OAAO;AAAA,EAClC,MAAM,WAAW,IAAI,IAAI,QAAQ;AAAA,EACjC,IAAI,QAAQ,MAAM,CAAC,YAAY,SAAS,IAAI,OAAO,CAAC,GAAG;AAAA,IACrD,MAAM,IAAI,MACR;AAAA,MACE;AAAA,MACA,WAAW,KAAK,UAAU,OAAO,iCAAiC,KAAK,UAAU,QAAQ;AAAA,IAC3F,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAYF,SAAS,gBAAgB,CAAC,WAAmD;AAAA,EAClF,IAAI,cAAc;AAAA,IAAW;AAAA,EAC7B,IAAI,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,GAAG;AAAA,IACjD,MAAM,IAAI,MACR;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AASF,SAAS,oBAAoB,CAAC,OAK5B;AAAA,EACP,IAAI,CAAC,MAAM;AAAA,IAAW;AAAA,EACtB,IAAI,MAAM,gBAAgB,UAAU;AAAA,IAClC,MAAM,IAAI,MACR;AAAA,MACE,2CAA2C,MAAM;AAAA,MACjD;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA,EACA,IAAI,MAAM,eAAe,KAAK,MAAM,cAAc,WAAW;AAAA,IAC3D,MAAM,IAAI,MACR;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA;;;ACjFF,IAAM,uBAAuB;AAM7B,IAAM,kBAAqC,CAAC,iBAAiB;AAatD,SAAS,UAAU,CAAC,SAAwC;AAAA,EACjE,MAAM,QAAQ,YAAY,SAAS,QAAQ,KAAK;AAAA,EAChD,MAAM,aAAa,YAAY,cAAc,QAAQ,UAAU;AAAA,EAC/D,MAAM,SAAS,gBAAgB,QAAQ,MAAM;AAAA,EAC7C,MAAM,UAAU,iBAAiB,QAAQ,SAAS,eAAe;AAAA,EACjE,MAAM,UAAU,iBAAiB,QAAQ,SAAS,OAAO;AAAA,EACzD,MAAM,YAAY,QAAQ,aAAa;AAAA,EACvC,MAAM,cAAc,QAAQ,eAAe;AAAA,EAC3C,MAAM,YAAY,iBAAiB,QAAQ,iBAAiB;AAAA,EAC5D,qBAAqB,EAAE,WAAW,WAAW,YAAY,OAAO,QAAQ,YAAY,CAAC;AAAA,EACrF,MAAM,OAAO,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EAE7E,OAAO;AAAA,IACL,YAAY;AAAA,SACP,QAAQ;AAAA,SACR;AAAA,MAGH,gBAAgB;AAAA,MAChB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,qBAAqB;AAAA,MACrB,MAAM;AAAA,MACN;AAAA,IACF;AAAA,IACA,SAAS;AAAA,SACJ;AAAA,MACH,cAAc,CAAC,GAAI,QAAQ,gBAAgB,CAAC,CAAE;AAAA,MAC9C,YAAY,EAAE,SAAS,QAAQ;AAAA,MAC/B;AAAA,MACA,MAAM,QAAQ,eAAe;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,OAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,WACZ,cAAc,YACd,CAAC,IACD;AAAA,UACE,aAAa;AAAA,YACX,2BAA2B;AAAA,YAC3B,8BAA8B;AAAA,UAChC;AAAA,QACF;AAAA,WACA,OAAO,WAAW,IAClB,CAAC,IACD;AAAA,UACE,sBAAsB;AAAA,YACpB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE;AAAA,YAC7C,kCAAkC;AAAA,UACpC;AAAA,QACF;AAAA,MACN;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAAA;;AChIF;AACA;AACA;AACA;;;ACTA;AAaO,SAAS,sBAAuE,CACrF,UACA,SAC8F;AAAA,EAC9F,IAAI,CAAC,SAAS;AAAA,IAAgB,OAAO;AAAA,EACrC,OAAO,KAAK,UAAU,gBAAuB,WAAI,QAAQ,WAAW,MAAM,IAAI,EAAE;AAAA;;;ACSlF;AACA;AACA;AACA;AACA;;;ACIO,IAAM,qBAAqB;AAAA,EAChC,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,yBAAyB;AAAA,EACzB,qBAAqB;AAAA,EACrB,cAAc;AAAA,EACd,wBAAwB;AAAA,EACxB,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,sBAAsB;AAAA,EACtB,wBAAwB;AAAA,EACxB,6BAA6B;AAAA,EAC7B,yBAAyB;AAAA,EACzB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,uBAAuB;AAAA,EACvB,sBAAsB;AAAA,EACtB,4BAA4B;AAAA,EAC5B,eAAe;AACjB;AAEO,IAAM,qBACX,OAAO,KAAK,kBAAkB,EAC9B,OAAO,CAAC,SAAS,mBAAmB,UAAU,SAAS;AAElD,IAAM,wBAAwB,CAAC,SAAS,UAAU,QAAQ;AAG1D,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAK/B,SAAS,oBAAoB,CAAC,OAAmC;AAAA,EACtE,IACE,CAAC,OAAO,UAAU,KAAK,KACvB,QAAQ,0BACR,QAAQ,wBACR;AAAA,IACA,OACE,4DAA4D,OAAO,sBAAsB,OACzF,MAAM,OAAO,sBAAsB,+BAA+B,OAAO,KAAK;AAAA,EAElF;AAAA,EACA;AAAA;AAKK,SAAS,0BAA0B,CAAC,SAAgD;AAAA,EACzF,IAAI,QAAQ,WAAW,GAAG;AAAA,IACxB,OAAO;AAAA,EACT;AAAA,EACA,MAAM,MAAM,QAAQ,OAAO,CAAC,MAAM,CAAE,sBAA4C,SAAS,CAAC,CAAC;AAAA,EAC3F,IAAI,IAAI,SAAS,GAAG;AAAA,IAClB,OAAO,0DAA0D,IAAI,KAAK,IAAI;AAAA,EAChF;AAAA,EACA;AAAA;;;AChIF;AAAA;AAOO,MAAM,yBAA8B,iBAAY,kBAAkB,EAKtE;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,SAAS,KAAK,kBAAkB,OAAO,KAAK,IAAI,MAAM,OACxF,mBAAmB,KAAK,cAAc,KAAK,IAAI,KAAK,IAAI,wCACxD;AAAA;AAGN;AAAA;AAIO,MAAM,2BAAgC,iBAAY,oBAAoB,EAK1E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,qBACjE,mEAAmE,KAAK,QAAQ,KAAK,IAAI,SACzF;AAAA;AAGN;AAAA;AAQO,MAAM,4BAAiC,iBAAY,qBAAqB,EAK5E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,qBACjE,0DAA0D,KAAK,SAAS,KAAK,IAAI,aACjF,6FACA;AAAA;AAGN;AAAA;AAOO,MAAM,qBAA0B,iBAAY,cAAc,EAK9D;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,qBACjE,6BAA6B,KAAK,oCAClC,0FACA;AAAA;AAGN;AAAA;AAKO,MAAM,2BAAgC,iBAAY,oBAAoB,EAK1E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,0BACjE,kBAAkB,KAAK,uEACvB,+FACA;AAAA;AAGN;AAAA;AAIO,MAAM,8BAAmC,iBAAY,uBAAuB,EAKhF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,0BACjE,oBAAoB,KAAK,aAAa,KAAK,IAAI,+CAC/C,gGACA;AAAA;AAGN;AAAA;AAKO,MAAM,6BAAkC,iBAAY,sBAAsB,EAI9E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,8BAA8B,KAAK,4CACnC,GAAG,KAAK,SAAS,KAAK,sEACtB,2FACA;AAAA;AAGN;AAAA;AAIO,MAAM,iCAAsC,iBAAY,0BAA0B,EAGtF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,6BAA6B,KAAK,WAAW,KAAK;AAAA;AAE7D;AAAA;AAIO,MAAM,yBAA8B,iBAAY,kBAAkB,EAOtE;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,2BACjE,gCAAgC,KAAK,mBAAmB,KAAK,UAAU,KAAK,IAAI,gBAChF,GAAG,KAAK,UAAU,KAAK,IAAI;AAAA;AAGjC;;;AC/IA;AACA;AAMA,IAAM,UAAU,CAAC,MAAuB,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC;AAEpF,IAAM,aAAa,CACjB,YAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO,OAAO;AAAA,EAC5B,OAAO,YAAY,YAAY,MAAM,QAAQ,IAAI,MAAM,QAAQ,EAAE,QAAQ,CAAC;AAAA,CAC3E,EAAE,KAAY,gBAAS,OAAO,CAAC;AAElC,IAAM,QAAQ,CAAC,MAAyB,GAAuC,WAAW;AAInF,IAAM,yBAAyB;AAYtC,IAAM,6BAA6B;AAO5B,IAAM,wBAAwB,CACnC,SACA,OACA,MACA,KACA,YAEO,WAAI,UAAU,GAAG;AAAA,EACtB,OAAO,WAAW,YAAY,OAAc,WAAI;AAAA,IACvC,kBAAW;AAAA,MAChB,KAAK,MAAM,QAAQ,KAAK,OAAO,WAAW,EAAE,OAAO,MAAM,KAAK,YAAY,QAAQ,CAAC;AAAA,MACnF,OAAO;AAAA,IACT,CAAC;AAAA,IACM,kBAAW;AAAA,MAChB,KAAK,MAAM,QAAQ,KAAK,MAAM,yBAAyB,EAAE,OAAO,MAAM,IAAI,CAAC;AAAA,MAC3E,OAAO;AAAA,IACT,CAAC;AAAA,EACH,CAAC;AAAA,EACD,MAAM,gBAAgB,UAAU,KAAK,WAAW,KAC9C,CAAC,QAAQ,IAAI,SAAS,WAAW,IAAI,eAAe,SACtD;AAAA,EACA,MAAM,iBAAiB,SAAS,KAAK,KACnC,CAAC,WAAW,OAAO,YAAY,WAAW,OAAO,UAAU,SAC7D;AAAA,EACA,OAAO,iBAAiB;AAAA,CACzB;AAOI,IAAM,uBAAuB,CAClC,SACA,OACA,MACA,SAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAc,kBAAW;AAAA,IACtC,KAAK,MACH,QAAQ,KAAK,MAAM,KAAK;AAAA,MACtB;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,MAAM;AAAA,MACN,WAAW;AAAA,MACX,UAAU;AAAA,IACZ,CAAC;AAAA,IACH,OAAO;AAAA,EACT,CAAC;AAAA,EACD,OAAO,OAAO,KACX,OAAO,CAAC,OAAO,GAAG,cAAc,IAAI,EACpC,MAAM,GAAG,sBAAsB,EAC/B,IAAI,CAAC,OAAO,GAAG,KAAK,GAAG;AAAA,CAC3B;AAMI,IAAM,yBAAyB,CACpC,SACA,OACA,MACA,YAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAc,kBAAW;AAAA,IAC1C,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,EAAE,OAAO,KAAK,CAAC;AAAA,IACjD,OAAO;AAAA,EACT,CAAC;AAAA,EACD,MAAM,MAAM,WAAW,KAAK;AAAA,EAC5B,IAAI,OAAO,sBAAsB,SAAS,OAAO,MAAM,KAAK,OAAO;AAAA,IAAG,OAAO;AAAA,EAE7E,MAAM,QAAQ,OAAO,qBAAqB,SAAS,OAAO,MAAM,GAAG;AAAA,EACnE,WAAW,OAAO,OAAO;AAAA,IACvB,IAAI,OAAO,sBAAsB,SAAS,OAAO,MAAM,KAAK,OAAO;AAAA,MAAG,OAAO;AAAA,EAC/E;AAAA,EACA,OAAO;AAAA,CACR;AAEI,IAAM,qBAAqB,CAAC,aAAqD;AAAA,EACtF,MAAM,GAAG,OAAO,WACP,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,MAAM,WAAW,OAAc,kBAAW;AAAA,MACxC,KAAK,MACH,QAAQ,SAAS,QAAQ,KAAK,MAAM,iBAAiB;AAAA,QACnD;AAAA,QACA;AAAA,QACA,kBAAkB;AAAA,QAClB,UAAU;AAAA,MACZ,CAAC;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAEH,KAAK,GAAG,OAAO,MAAM,gBACZ,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,OAAO,OAAc,kBAAW;AAAA,MAC9B,KAAK,MAAM,QAAQ,KAAK,MAAM,eAAe,EAAE,OAAO,MAAM,YAAY,UAAU,CAAC;AAAA,MACnF,OAAO,CAAC,MAAM;AAAA,IAChB,CAAC,EAAE,KACM,WAAI,GAAG,WAAW,IAAqB,GACvC,eAAQ,OAAO,MAAa,eAAQ,SAAS,CAAC,GAC9C,gBAAS,OAAO,CACzB;AAAA,GACD;AAAA,EAEH,QAAQ,CAAC,UACA,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,QAAQ,SAAS,OAAc,kBAAW;AAAA,MACxC,KAAK,MACH,QAAQ,KAAK,MAAM,kBAAkB;AAAA,QACnC,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,WACT,MAAM;AAAA,MACX,CAAC;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAEH,QAAQ,CAAC,UACA,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,QAAQ,SAAS,OAAc,kBAAW;AAAA,MACxC,KAAK,MACH,QAAQ,KAAK,MAAM,kBAAkB;AAAA,QACnC,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,QACZ,YAAY,MAAM;AAAA,WACf,MAAM;AAAA,MACX,CAAC;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAEH,QAAQ,GAAG,OAAO,MAAM,gBACf,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,OAAc,kBAAW;AAAA,MACvB,KAAK,MAAM,QAAQ,KAAK,MAAM,kBAAkB,EAAE,OAAO,MAAM,YAAY,UAAU,CAAC;AAAA,MACtF,OAAO,CAAC,MAAM;AAAA,IAChB,CAAC,EAAE,KACM,eACA,eAAQ,OAAO,MAAa,WAAI,GAChC,gBAAS,OAAO,CACzB;AAAA,GACD;AAAA,EAEH,2BAA2B,GAAG,OAAO,MAAM,cAClC,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,OAAO,OAAO,uBAAuB,SAAS,OAAO,MAAM,OAAO;AAAA,GACnE;AACL;;;ACzNA;AA4EO,IAAM,cAAc,CACzB,SACA,UAOO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAM,OAAO,QAAQ,KAAK,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,KAAK,CAAC;AAAA,EACxE,MAAM,UAAU,KAAI,OAClB,CAAC,MAAM,EAAE,SAAS,MAAM,SAAS,EAAE,UAAU,cAAc,MAAM,MACnE;AAAA,EACA,OAAO,SAAS,QAAQ;AAAA,EACxB,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS,GAAG;AAAA,IACnB,OAAO,OAAc,aACnB,IAAI,iBAAiB;AAAA,MACnB,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,MAAM,MAAM;AAAA,MACZ,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9B,CAAC,CACH;AAAA,EACF;AAAA,EACA,OAAO,OAAO,QAAQ,IAAI,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,MAAM,WAAW,KAAK,GAAG,CAAC;AAAA,CACvF;;;AC/GH;;;ACiBA,IAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,oBAAoB,CAAC,MAAkD;AAAA,EAC9E,OAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,MACV,iCAAiC,KAAK,gCAAgC;AAAA,MACtE,+BAA+B,KAAK,6BAA6B;AAAA,MACjE,2BAA2B,KAAK,0BAA0B;AAAA,MAC1D,4BAA4B,KAAK,2BAA2B;AAAA,MAC5D,mCAAmC,KAAK,kCAAkC;AAAA,SACtE,KAAK,wBAAwB,YAC7B,CAAC,IACD,EAAE,uBAAuB,CAAC,GAAG,KAAK,mBAAmB,EAAE;AAAA,MAG3D,qBAAqB,KAAK,qBAAqB,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,QAC7D,eAAe,CAAC,GAAG,EAAE,YAAY;AAAA,QACjC,mBAAmB,EAAE;AAAA,QACrB,UAAU,EAAE,IAAI,EAAE,SAAS,SAAS,MAAM,EAAE,SAAS,UAAU;AAAA,MACjE,EAAE;AAAA,SAIE,KAAK,wCAAwC,YAC7C,CAAC,IACD;AAAA,QACE,iDACE,KAAK;AAAA,MACT;AAAA,IACN;AAAA,EAGF;AAAA;AAGF,SAAS,qBAAqB,CAAC,MAAmD;AAAA,EAChF,OAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,MACV,wBAAwB,KAAK,OAAO,IAAI,CAAC,OAAO;AAAA,QAC9C,SAAS,EAAE;AAAA,WACP,EAAE,kBAAkB,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,cAAc;AAAA,MAC7E,EAAE;AAAA,MACF,sCAAsC,KAAK,oCAAoC;AAAA,MAC/E,0BAA0B,KAAK,wBAAwB;AAAA,IACzD;AAAA,EACF;AAAA;AAGK,SAAS,cAAc,CAAC,OAAuD;AAAA,EACpF,MAAM,OAAmB,CAAC;AAAA,EAC1B,WAAW,QAAQ,kBAAkB;AAAA,IACnC,QAAQ;AAAA,WACD;AAAA,QACH,IAAI,OAAO;AAAA,UAAU,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AAAA,QACnD;AAAA,WACG;AAAA,QACH,IAAI,OAAO,QAAQ;AAAA,UACjB,KAAK,KAAK,EAAE,MAAM,UAAU,YAAY,EAAE,+BAA+B,MAAM,EAAE,CAAC;AAAA,QACpF;AAAA,QACA;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAU,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AAAA,QACnD;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAuB,KAAK,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAAA,QAC/E;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAoB,KAAK,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAAA,QACxE;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAgB,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAAA,QACjE;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAa,KAAK,KAAK,qBAAqB,MAAM,WAAW,CAAC;AAAA,QACzE;AAAA,WACG;AAAA,QACH,IAAI,OAAO,sBAAsB;AAAA,UAC/B,KAAK,KAAK,sBAAsB,MAAM,oBAAoB,CAAC;AAAA,QAC7D;AAAA,QACA;AAAA;AAAA,EAEN;AAAA,EACA,OAAO;AAAA;AAKF,SAAS,kBAAkB,CAAC,OAAkD;AAAA,EACnF,OAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM,UAAU;AAAA,IACxB,aAAa,MAAM,eAAe;AAAA,IAClC,gBAAgB,MAAM,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,MACpD,YAAY,EAAE;AAAA,SAIV,EAAE,YAAY,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ;AAAA,MACzD,aAAa,EAAE,cAAc;AAAA,IAC/B,EAAE;AAAA,IACF,YAAY;AAAA,MACV,UAAU;AAAA,QACR,SAAS,CAAC,GAAI,MAAM,YAAY,WAAW,CAAC,MAAM,CAAE,EAAE,KAAK;AAAA,QAC3D,SAAS,CAAC,GAAI,MAAM,YAAY,WAAW,CAAC,CAAE,EAAE,KAAK;AAAA,MACvD;AAAA,IACF;AAAA,IACA,OAAO,eAAe,MAAM,KAAK;AAAA,EACnC;AAAA;AAGF,IAAM,aAAa,CAAI,UACrB,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,KAAK,UAAU,CAAC,EAAE,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC;AAe9E,SAAS,YAAY,CAAC,OAAyB;AAAA,EAC7C,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO,MAAM,IAAI,YAAY;AAAA,EACvD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,MAAM,MAA+B,CAAC;AAAA,IACtC,WAAW,KAAK,OAAO,KAAK,KAAK,EAAE,KAAK,GAAG;AAAA,MACzC,MAAM,IAAK,MAAkC;AAAA,MAC7C,IAAI,MAAM,QAAQ,MAAM;AAAA,QAAW,IAAI,KAAK,aAAa,CAAC;AAAA,IAC5D;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,gBAAgB,CAAC,MAAwD;AAAA,EAChF,MAAM,WAAW,aAAa,IAAI;AAAA,EAClC,MAAM,SAAS,SAAS;AAAA,EACxB,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,OAAO,KAAK,OAAO;AAAA,EACzB,IAAI,MAAM,QAAQ,KAAK,qBAAqB,GAAG;AAAA,IAC7C,KAAK,wBAAwB,CAAC,GAAI,KAAK,qBAAkC,EAAE,KAAK;AAAA,EAClF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,sBAAsB,GAAG;AAAA,IAC9C,KAAK,yBAAyB,WAC5B,KAAK,sBACP;AAAA,EACF;AAAA,EACA,OAAO,KAAK,UAAU,YAAY,KAAK;AAAA;AAalC,SAAS,uBAAuB,CAAC,OAAyB;AAAA,EAC/D,MAAM,IAAK,SAAS,CAAC;AAAA,EAQrB,OAAO,aAAa;AAAA,IAClB,MAAM,EAAE;AAAA,IACR,QAAQ,EAAE,UAAU;AAAA,IACpB,aAAa,EAAE;AAAA,IACf,eAAe,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAAA,IAC/C,YAAY,EAAE;AAAA,IACd,OAAO,YAAY,EAAE,SAAS,CAAC,GAAG,IAAI,gBAAgB,CAAC;AAAA,EACzD,CAAC;AAAA;;;ACjNH;AAcO,IAAM,YAAY,CAAC,MACxB,GAAG,OAAO,EAAE,UAAU,KAAK,OAAO,EAAE,YAAY,EAAE,KAAK,OAAO,EAAE,eAAe,QAAQ;AAQlF,SAAS,qBAAqB,CAAC,OAMH;AAAA,EAEjC,IAAI,MAAM,SAAS;AAAA,IAAW;AAAA,EAC9B,MAAM,aAAc,MAAM,KAAK,iBAAiB,CAAC;AAAA,EAKjD,MAAM,WAAW,IAAI,IAAI,WAAW,IAAI,SAAS,CAAC;AAAA,EAClD,MAAM,WAAW,MAAM,YAAY,CAAC,GACjC,IAAI,CAAC,MACJ,UAAU;AAAA,IACR,YAAY,EAAE;AAAA,IACd,UAAU,EAAE;AAAA,IACZ,aAAa,EAAE,cAAc;AAAA,EAC/B,CAAC,CACH,EACC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;AAAA,EACjC,IAAI,QAAQ,WAAW;AAAA,IAAG;AAAA,EAC1B,OAAO,IAAI,mBAAmB;AAAA,IAC5B,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;AAMI,IAAM,gBAAgB,CAAC,SAC5B,IAAI,KAAK,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,OAAO,EAAE,IAAI,CAAC,CAAC;AAuBjD,SAAS,yBAAyB,CAAC,OAMP;AAAA,EACjC,WAAW,QAAQ,cAAc,MAAM,IAAI,GAAG;AAAA,IAC5C,MAAM,WAAW,mBAAmB;AAAA,IACpC,IAAI,aAAa,WAAW;AAAA,MAC1B,OAAO,IAAI,mBAAmB;AAAA,QAC5B,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,MAAM,MAAM;AAAA,QACZ,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,IACA,IACE,aAAa,aACb,SAAS,4BACT,CAAC,MAAM,cAAc,IAAI,IAAI,GAC7B;AAAA,MACA,OAAO,IAAI,mBAAmB;AAAA,QAC5B,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,MAAM,MAAM;AAAA,QACZ,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA;AAAA;AAMK,SAAS,iBAAiB,CAAC,OAA6D;AAAA,EAC7F,IAAI,UAAU;AAAA,IAAW,OAAO,IAAI;AAAA,EACpC,MAAM,sBAA8C;AAAA,IAClD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,uBAAuB;AAAA,IACvB,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,EAClB;AAAA,EACA,MAAM,QAAQ,IAAI;AAAA,EAClB,YAAY,KAAK,SAAS,OAAO,QAAQ,mBAAmB,GAAG;AAAA,IAC7D,IAAI,OAAO,OAAO,OAAO,GAAG;AAAA,MAAG,MAAM,IAAI,IAAI;AAAA,EAC/C;AAAA,EACA,IAAI,OAAO,OAAO,OAAO,aAAa;AAAA,IAAG,MAAM,IAAI,cAAc;AAAA,EACjE,OAAO;AAAA;AAKF,SAAS,6BAA6B,CAAC,OAMR;AAAA,EACpC,IAAI,MAAM,UAAU,yBAAyB;AAAA,IAAW;AAAA,EACxD,MAAM,YAAY,MAAM,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,wBAAwB;AAAA,EAC1F,IAAI,aAAa;AAAA,IAAW;AAAA,EAC5B,MAAM,SAAS,SAAS;AAAA,EAGxB,MAAM,gBAAgB,QAAQ,0BAA0B,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO;AAAA,EAChF,OAAO,IAAI,sBAAsB;AAAA,IAC/B,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;AAKI,IAAM,wBAAwB,CACnC,UACA,SACsB;AAAA,EACtB,IAAI,UAAU,yBAAyB,SAAS,UAAU,yBAAyB;AAAA,IACjF,OAAO,CAAC;AAAA,EACV,MAAM,YAAY,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,wBAAwB;AAAA,EACpF,MAAM,aAAa,UAAU;AAAA,EAG7B,MAAM,eAAe,IAAI,KAAK,YAAY,0BAA0B,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;AAAA,EAC7F,OAAO,SAAS,qBAAqB,OAClC,IAAI,CAAC,MAAM,EAAE,OAAO,EACpB,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;AAAA;AAMhC,IAAM,2BAA2B,CACtC,SACA,OACA,MACA,aAEO,YAAI,UAAU,GAAG;AAAA,EACtB,WAAW,WAAW,UAAU;AAAA,IAC9B,MAAM,WAAW,OAAO,QAAQ,0BAA0B,EAAE,OAAO,MAAM,QAAQ,CAAC;AAAA,IAClF,IAAI,CAAC,UAAU;AAAA,MACb,OAAO,OAAc,aAAK,IAAI,qBAAqB,EAAE,OAAO,YAAY,MAAM,QAAQ,CAAC,CAAC;AAAA,IAC1F;AAAA,EACF;AAAA,CACD;;;ACnKI,IAAM,gCAAgC,CAAC,UAC5C,MAAM,+BAA+B,aACrC,MAAM,2BAA2B,OAAO,KAAK,EAAE,SAAS;AAInD,IAAM,8BAA8B,CAAC,UAC1C,MAAM,6BAA6B,aACnC,MAAM,yBAAyB,OAAO,KAAK,EAAE,SAAS;AAOjD,SAAS,sBAAsB,CAAC,OAOH;AAAA,EAClC,IAAI,MAAM;AAAA,IAAc;AAAA,EACxB,IAAI,MAAM,SAAS;AAAA,IAAW;AAAA,EAC9B,MAAM,aAAc,MAAM,KAAK,iBAAiB,CAAC;AAAA,EAKjD,MAAM,eAAe,IAAI,KACtB,MAAM,YAAY,CAAC,GAAG,IAAI,CAAC,MAC1B,UAAU;AAAA,IACR,YAAY,EAAE;AAAA,IACd,UAAU,EAAE;AAAA,IACZ,aAAa,EAAE,cAAc;AAAA,EAC/B,CAAC,CACH,CACF;AAAA,EACA,MAAM,WAAW,WAAW,IAAI,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;AAAA,EAC7E,IAAI,SAAS,WAAW;AAAA,IAAG;AAAA,EAC3B,OAAO,IAAI,oBAAoB;AAAA,IAC7B,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;AAQH,SAAS,+BAA+B,CACtC,OACA,MACoB;AAAA,EACpB,MAAM,gBAA0D;AAAA,IAC9D,CAAC,MAAM,UAAU,UAAU;AAAA,IAC3B,CAAC,MAAM,QAAQ,QAAQ;AAAA,IACvB,CAAC,MAAM,UAAU,UAAU;AAAA,IAC3B,CAAC,MAAM,uBAAuB,yBAAyB;AAAA,IACvD,CAAC,MAAM,oBAAoB,qBAAqB;AAAA,IAChD,CAAC,MAAM,gBAAgB,kBAAkB;AAAA,EAC3C;AAAA,EACA,YAAY,UAAU,SAAS,eAAe;AAAA,IAC5C,IAAI,aAAa,SAAS,KAAK,IAAI,IAAI;AAAA,MAAG,OAAO;AAAA,EACnD;AAAA,EACA,IAAI,MAAM,gBAAgB,SAAS,KAAK,IAAI,cAAc;AAAA,IAAG,OAAO;AAAA,EACpE;AAAA;AASK,SAAS,oBAAoB,CAAC,OAOR;AAAA,EAC3B,IAAI,MAAM;AAAA,IAAc;AAAA,EACxB,MAAM,QAAQ,MAAM;AAAA,EACpB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,OAAO,cAAc,MAAM,IAAI;AAAA,EACrC,MAAM,WACJ,gCAAgC,OAAO,IAAI,MAC1C,MAAM,yBAAyB,SAAS,KAAK,IAAI,wBAAwB,IACtE,2BACA;AAAA,EACN,IAAI,aAAa;AAAA,IAAW;AAAA,EAC5B,OAAO,IAAI,aAAa;AAAA,IACtB,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;;;AHzGH,IAAM,2BAA2B,CAC/B,SAC4B;AAAA,EAC5B,MAAM,SAAU,MAAM,cAAc,CAAC;AAAA,EACrC,OAAO;AAAA,IACL,iCAAiC,OAAO;AAAA,IACxC,uBAAuB,MAAM,QAAQ,OAAO,qBAAqB,IAC7D,CAAC,GAAI,OAAO,qBAAkC,EAAE,KAAK,IACrD;AAAA,IACJ,iDACE,OAAO;AAAA,EACX;AAAA;AAMF,SAAS,eAAe,CACtB,OACA,YACA,MACA,WACA,aAC8B;AAAA,EAC9B,MAAM,SAAS,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;AAAA,EAC9D,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,MAAM,UAAU,YAAY,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;AAAA,EAC9E,MAAM,OAAO,yBAAyB,MAAM;AAAA,EAC5C,MAAM,OAAO,yBAAyB,MAAM;AAAA,EAC5C,WAAW,SAAS,OAAO,KAAK,IAAI,GAA4B;AAAA,IAC9D,IAAI,KAAK,WAAW;AAAA,MAAW;AAAA,IAC/B,IAAI,KAAK,UAAU,KAAK,MAAM,MAAM,KAAK,UAAU,KAAK,MAAM,GAAG;AAAA,MAC/D,OAAO,IAAI,iBAAiB;AAAA,QAC1B;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,iCAAiC;AAAA,QACxC,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA;AAAA;AAUK,IAAM,mBAAmB,CAAY,UASnC,YAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,MAAM,QAAQ,mBAAmB,SAAS,YAAY;AAAA,EAC9D,MAAM,UAAU,kBAAkB,IAAI;AAAA,EACtC,IAAI,YAAY;AAAA,IAAW,OAAO,OAAc,aAAK,OAAO;AAAA,EAE5D,MAAM,QAAQ,KAAK;AAAA,EACnB,MAAM,OAAO,KAAK;AAAA,EAClB,MAAM,SAAS,KAAK,UAAU;AAAA,EAE9B,IAAI,WACF,WAAW,YACP,YACA,OAAO,QAAQ,IAAI,EAAE,OAAO,MAAM,WAAW,OAAO,UAAU,CAAC;AAAA,EACrE,IAAI,aAAa,WAAW;AAAA,IAC1B,WAAW,OAAO,YAAY,SAAS,EAAE,OAAO,MAAM,MAAM,KAAK,MAAM,OAAO,CAAC;AAAA,EACjF;AAAA,EAKA,MAAM,qBAAqB,8BAA8B,IAAI;AAAA,EAC7D,MAAM,mBAAmB,4BAA4B,IAAI;AAAA,EAEzD,MAAM,gBACJ,KAAK,iBAAiB,YAClB,YACA,sBAAsB;AAAA,IACpB;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,EACR,CAAC;AAAA,EACP,IAAI,kBAAkB;AAAA,IAAW,OAAO,OAAc,aAAK,aAAa;AAAA,EAExE,MAAM,sBACJ,KAAK,iBAAiB,YAClB,YACA,uBAAuB;AAAA,IACrB;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,IACN,cAAc;AAAA,EAChB,CAAC;AAAA,EACP,IAAI,wBAAwB;AAAA,IAAW,OAAO,OAAc,aAAK,mBAAmB;AAAA,EAEpF,MAAM,cAAc,0BAA0B;AAAA,IAC5C;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,MAAM;AAAA,IACN,eAAe,kBAAkB,KAAK,KAAK;AAAA,EAC7C,CAAC;AAAA,EACD,IAAI,gBAAgB;AAAA,IAAW,OAAO,OAAc,aAAK,WAAW;AAAA,EAEpE,MAAM,oBAAoB,qBAAqB;AAAA,IAC7C;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,IACN,cAAc;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,sBAAsB;AAAA,IAAW,OAAO,OAAc,aAAK,iBAAiB;AAAA,EAEhF,MAAM,gBAAgB,8BAA8B;AAAA,IAClD;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,EACR,CAAC;AAAA,EACD,IAAI,kBAAkB;AAAA,IAAW,OAAO,OAAc,aAAK,aAAa;AAAA,EAExE,MAAM,cAAc,sBAAsB,KAAK,OAAO,QAAQ;AAAA,EAC9D,OAAO,yBAAyB,SAAS,OAAO,MAAM,WAAW;AAAA,EAEjE,MAAM,UAAU,mBAAmB,IAAI;AAAA,EAIvC,MAAM,OACJ,KAAK,iBAAiB,aAAa,aAAa,YAC3C,KAAK,SAAS,eAAe,SAAS,iBAAiB,CAAC,EAAE,IAC3D;AAAA,EAEN,IAAI;AAAA,EACJ,IAAI,QAAQ;AAAA,EACZ,IAAI,aAAa,WAAW;AAAA,IAC1B,SAAS,OAAO,QAAQ,OAAO,EAAE,OAAO,MAAM,KAAK,CAAC;AAAA,IACpD,QAAQ;AAAA,EACV,EAAO;AAAA,IACL,MAAM,OACJ,KAAK,UAAU,wBAAwB,IAAI,CAAC,MAC5C,KAAK,UAAU,wBAAwB,QAAQ,CAAC;AAAA,IAClD,IAAI,MAAM;AAAA,MACR,SAAS;AAAA,IACX,EAAO;AAAA,MACL,SAAS,OAAO,QAAQ,OAAO,EAAE,OAAO,MAAM,WAAW,SAAS,IAAI,KAAK,CAAC;AAAA,MAC5E,QAAQ;AAAA;AAAA;AAAA,EAIZ,IAAI,OAAO;AAAA,IACT,MAAM,cAAc,OAAO,QAAQ,IAAI,EAAE,OAAO,MAAM,WAAW,OAAO,GAAG,CAAC;AAAA,IAC5E,IAAI,gBAAgB,WAAW;AAAA,MAC7B,MAAM,YAAa,KAAK,SAAS,CAAC;AAAA,MAClC,MAAM,WAAW,gBAAgB,OAAO,MAAM,KAAK,MAAM,WAAW,WAAW;AAAA,MAC/E,IAAI,aAAa;AAAA,QAAW,OAAO,OAAc,aAAK,QAAQ;AAAA,IAChE;AAAA,EACF;AAAA,EAEA,OAAO,QAAQ,MAAM;AAAA,CACtB;;;ALzGI,IAAM,oBAAoB,SAA4B,4BAA4B;AAAA,EACvF,sBAAsB;AACxB,CAAC;AAEM,IAAM,UAAU,CAAC,OAAmD;AAAA,EACzE,WAAW,EAAE;AAAA,EACb,QAAQ,EAAE;AAAA,EACV,MAAM,EAAE;AAAA,EACR,WAAW,EAAE;AAAA,EACb,WAAW,EAAE;AACf;AAIA,SAAS,iBAAiB,CAAC,OAAqE;AAAA,EAI9F,MAAM,KAAK,MAAM,OAAO,gBAAgB,QAAQ,YAAY,MAAM,OAAO;AAAA,EACzE,MAAM,YAAY,IAAI;AAAA,EACtB,IAAI,cAAc,WAAW;AAAA,IAC3B,MAAM,SAAS,qBAAqB,SAAS;AAAA,IAC7C,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,IAAI,yBAAyB;AAAA,QAClC,OAAO;AAAA,QACP;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,YAAY,WAAW;AAAA,IACzB,MAAM,SAAS,2BAA2B,OAAO;AAAA,IACjD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,IAAI,yBAAyB;AAAA,QAClC,OAAO;AAAA,QACP;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAaA;AAAA;AAGK,IAAM,4BAA4B,kBAAkB,SAAS,GAAG;AAAA,EAIrE,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,EAEnB,MAAM,GAAG,QAAQ,WACR,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,mBAAmB,KAAK,OAAO;AAAA,IAC/C,IAAI,WAAW,WAAW;AAAA,MACxB,MAAM,QAAQ,OAAO,YAAY,SAAS;AAAA,QACxC,OAAO,KAAK;AAAA,QACZ,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK,UAAU;AAAA,MACzB,CAAC;AAAA,MAED,OAAO,UAAU,YAAY,YAAY,QAAQ,QAAQ,KAAK,CAAC;AAAA,IACjE;AAAA,IACA,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,MAC9B,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,IACD,IAAI,SAAS;AAAA,MAAW,OAAO,QAAQ,IAAI;AAAA,IAC3C,MAAM,SAAS,OAAO,YAAY,SAAS;AAAA,MACzC,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK,UAAU;AAAA,IACzB,CAAC;AAAA,IACD,OAAO,WAAW,YAAY,YAAY,QAAQ,MAAM;AAAA,GACzD;AAAA,EAKH,MAAM,GAAG,MAAM,WACN,gBACL,WAAW,IAAI,KACb,SAAS,cACR,KAAK,UAAU,KAAK,SAAS,KAAK,eAAe,KAAK,cACpD,EAAE,QAAQ,UAAU,IACrB,SACN;AAAA,EAEF,WAAW,GAAG,MAAM,aAClB,iBAAiB;AAAA,IACf,SAAS,mBAAmB,KAAK,OAAO;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EAEH,QAAQ,GAAG,MAAM,aACR,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,QAAQ,cAAc;AAAA,MAAW;AAAA,IACrC,MAAM,UAAU,mBAAmB,KAAK,OAAO;AAAA,IAC/C,OAAO,QAAQ,OAAO;AAAA,MACpB,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,GACF;AACL,CAAC;AAEM,IAAM,4BAA4B,MAC9B,iBAAQ,mBAAmB,yBAAyB;;;AFrKxD,IAAM,oBAAoB,CAAC,IAAY,YACrC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAc,YAAI;AAAA,IAC/B,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,IAC3E,KAAK,MAAM,WAAW,OAAO;AAAA,EAC/B,CAAC;AAAA,EAID,MAAM,QAAQ,CAAO,aAAyC;AAAA,IAC5D,MAAM,OAAO,SAAS,KAAmB,qBAAO,CAAC;AAAA,IACjD,OAAO,QAAQ,UAAU,YAAY,OAAO,KAAK,KAAK,MAAM,QAAQ,KAAK,CAAC;AAAA;AAAA,EAO5E,IAAI,OAAO,WAAW,gBAAgB;AAAA,IACpC,MAAM,WAAU,OAAO,MAAM,kBAAkB,GAAG,cAAc,OAAO,OAAO,CAAC;AAAA,IAC/E,MAAM,cAAa,OAAO,MACjB,kBAAW,IAAI,uBAAuB,OAAO,YAAY,QAAO,CAAC,CAC1E;AAAA,IACA,OAAO,EAAE,QAAQ,yBAAY,kBAAQ;AAAA,EACvC;AAAA,EAEA,MAAM,aAAa,OAAO,MAAa,kBAAW,IAAI,OAAO,UAAU,CAAC;AAAA,EACxE,MAAM,UAAU,OAAO,MAAM,kBAAkB,GAAG,cAAc,OAAO,OAAO,CAAC;AAAA,EAC/E,OAAO,EAAE,QAAQ,YAAY,QAAQ;AAAA,CACtC;;AW3DI,SAAS,oBAAoB,CAAC,OAA0B;AAAA,EAC7D,OAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,OACR,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,IAC5E,YAAY,MAAM;AAAA,IAClB,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,gBAAgB,MAAM,OAAO,SAAS;AAAA,IACtC,qBAAqB;AAAA,IACrB,SAAS;AAAA,EACX;AAAA;AAMK,SAAS,mBAAmB,CAAC,OAA0B;AAAA,EAC5D,OAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,cAAc,CAAC;AAAA,IACf,YAAY,EAAE,SAAS,CAAC,iBAAiB,GAAG,SAAS,CAAC,EAAE;AAAA,IACxD,OAAO;AAAA,MACL,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,aAAa;AAAA,QACX,8BAA8B;AAAA,QAC9B,2BAA2B;AAAA,QAC3B,wBAAwB;AAAA,QACxB,yBAAyB;AAAA,QACzB,gCAAgC;AAAA,QAChC,qBAAqB,CAAC,QAAiB;AAAA,QACvC,qCAAqC;AAAA,MACvC;AAAA,SACI,MAAM,OAAO,WAAW,IACxB,CAAC,IACD;AAAA,QACE,sBAAsB;AAAA,UACpB,QAAQ,MAAM,OAAO,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE;AAAA,UACnD,kCAAkC;AAAA,UAClC,sBAAsB;AAAA,QACxB;AAAA,MACF;AAAA,IACN;AAAA,EACF;AAAA;AAOK,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;ACvDA,kBAAS;AACT;AACA;AACA;AAWO,IAAM,sBAAsB,CAAC,IAAY,YACvC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,CAAO,aACnB,SAAS,KAAmB,sBAAO,GAAG,OAAM,IAAI,CAAC;AAAA,EACnD,MAAM,WAAW,qBAAqB,OAAO;AAAA,EAI7C,IAAI,SAAS,gBAAgB;AAAA,IAC3B,MAAM,WAAU,OAAO,MACrB,kBAAkB,GAAG,cAAc,oBAAoB,OAAO,CAAC,CACjE;AAAA,IACA,MAAM,cAAa,OAAO,MACjB,mBAAW,IAAI,uBAAuB,UAAU,QAAO,CAAC,CACjE;AAAA,IACA,OAAO,EAAE,yBAAY,kBAAQ;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,OAAO,MAAa,mBAAW,IAAI,QAAQ,CAAC;AAAA,EAC/D,MAAM,UAAU,OAAO,MAAM,kBAAkB,GAAG,cAAc,oBAAoB,OAAO,CAAC,CAAC;AAAA,EAC7F,OAAO,EAAE,YAAY,QAAQ;AAAA,CAC9B;;ACpCH;AACA;AAGO,IAAM,sBAAsB,CAAC,YAAsC;AAAA,EACxE,MAAM,SAAgB,kBAAU,OAAO;AAAA,EACvC,OAAa,eAAS,QAAQ,0BAA0B,EAAE,KAAW,mBAAa,MAAM,CAAC,CAAC;AAAA;",
+  "debugId": "D21B99F55F9E8E6C64756E2164756E21",
   "names": []
 }

package/dist/github/repo-apply-order-fake-providers.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Fully in-memory `Provider.succeed(...)` fakes for `GitHub.Repository` and `RepositoryRuleset`
+ * — no octokit, no `GitHubCredentials`, no network. Unlike `repository-ruleset-fake-octokit.ts`
+ * (a fake HTTP client fed into the REAL provider's `reconcile`), these fakes replace the provider
+ * entirely, because what `declare-repo-baseline-apply-order.test.ts` and
+ * `repo-policy-apply-order.test.ts` measure is the ENGINE's own scheduling — which resource's
+ * `reconcile` runs first, and whether one's failure reaches the other — not GitHub's wire
+ * protocol. `Provider.succeed`'s runtime lookup (`tryFindProviderRegistrationByType`,
+ * `node_modules/alchemy/src/Provider.ts`) checks the INDIVIDUAL `Provider<R>` tag before falling
+ * back to a `GitHub.Providers` collection, so registering these two standalone providers is
+ * enough regardless of `GitHub.Repository`'s own declared `Providers` slot — the same shortcut
+ * `RepositoryRulesetProvider()` already relies on.
+ *
+ * ⚠️ NO LIVE NETWORK, EVER. Nothing here imports `octokit`/`GitHubCredentials`, so a test built
+ *   on this file cannot make a real GitHub call even by accident — required by this PR's own
+ *   "no live GitHub writes" rule.
+ *
+ * ⚠️ THE FAKE RULESET REFUSES A REPO THAT DOESN'T EXIST YET, ON PURPOSE — mirroring GitHub's own
+ *   `POST /repos/{owner}/{repo}/rulesets`, which 404s on a repo that hasn't been created. A first
+ *   ADVERSARIAL REVIEW pass (2026-09-24) on this PR found that the ordering fix forces the
+ *   ruleset to apply before the repository whenever auto-merge turns on — safe for an UPDATE
+ *   (the repo already exists), but a real hazard for a repo+ruleset created together for the
+ *   FIRST time with checks set from day one, and the original version of this fake modeled no
+ *   such constraint, so its own tests could not have caught that regression. It now can — see
+ *   `declare-repo-baseline-apply-order.test.ts`'s "a repo and ruleset created together" test.
+ */
+import * as GitHub from 'alchemy/GitHub';
+import * as Provider from 'alchemy/Provider';
+import * as Layer from 'effect/Layer';
+import { RepositoryRuleset } from './repository-ruleset.ts';
+/** One resource type's name, in the order its fake `reconcile` was actually invoked. */
+export type CallLog = ('repository' | 'ruleset')[];
+export interface World {
+    readonly calls: CallLog;
+    /** `owner/name` of every repository the fake repository provider has reconciled at least
+     * once — what the fake ruleset provider checks before allowing a create. */
+    readonly liveRepositories: Set<string>;
+    /** Set before `deploy` to make the ruleset's `reconcile` fail instead of succeeding, even
+     * against a repository already in `liveRepositories`. */
+    rulesetShouldFail: boolean;
+    /** `news.allowAutoMerge` as the repository's fake `reconcile` last observed it — `undefined`
+     * until (unless) the repository's `reconcile` actually runs. */
+    repositoryAllowAutoMerge: boolean | undefined;
+}
+export declare const makeWorld: () => World;
+/** Both fakes, merged — everything `declareRepoBaseline`/`declareRepoPolicy` need. */
+export declare const fakeGithubProviders: (world: World) => Layer.Layer<Provider.Provider<GitHub.Repository> | Provider.Provider<RepositoryRuleset>, never, never>;
+//# sourceMappingURL=repo-apply-order-fake-providers.d.ts.map

package/dist/github/repo-apply-order-fake-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-apply-order-fake-providers.d.ts","sourceRoot":"","sources":["../../src/github/repo-apply-order-fake-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAA+B,MAAM,yBAAyB,CAAC;AAEzF,wFAAwF;AACxF,MAAM,MAAM,OAAO,GAAG,CAAC,YAAY,GAAG,SAAS,CAAC,EAAE,CAAC;AAEnD,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;gFAC4E;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC;6DACyD;IACzD,iBAAiB,EAAE,OAAO,CAAC;IAC3B;oEACgE;IAChE,wBAAwB,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/C;AAED,eAAO,MAAM,SAAS,QAAO,KAK3B,CAAC;AA+DH,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,UAAW,KAAK,2GAC2B,CAAC"}

package/dist/github/repo-apply-order-fake-stack.d.ts

@@ -0,0 +1,13 @@
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+export type Planned = Readonly<Record<string, string>>;
+export type StackBody = Effect.Effect<unknown, unknown, unknown>;
+export type DeployOptions = {
+    readonly adopt?: boolean;
+};
+export interface FakeStack {
+    /** Plan, then apply, `body`. Resolves to the plan; rejects with the apply's failure. */
+    readonly deploy: (body: StackBody, options?: DeployOptions) => Promise<Planned>;
+}
+export declare const fakeStack: <ROut, E, RIn>(providers: Layer.Layer<ROut, E, RIn>, name?: string) => FakeStack;
+//# sourceMappingURL=repo-apply-order-fake-stack.d.ts.map

package/dist/github/repo-apply-order-fake-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-apply-order-fake-stack.d.ts","sourceRoot":"","sources":["../../src/github/repo-apply-order-fake-stack.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACvD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjF;AAiBD,eAAO,MAAM,SAAS,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,aACzB,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,oBAEnC,SA6BF,CAAC"}

package/dist/github/repo-auto-merge-gate.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `gateAutoMergeOnRuleset` — the one place `declareRepoBaseline` and `declareRepoPolicy` thread
+ * a real apply-ordering edge from `GitHub.Repository`'s `allowAutoMerge` to the sibling
+ * `RepositoryRuleset`, so a deploy can never turn auto-merge on before the ruleset's required
+ * checks/approvals are actually live.
+ *
+ * ⛔ K5 (kit PR 216, 2026-09-24): both callers declare `GitHub.Repository` and `RepositoryRuleset`
+ *   as two INDEPENDENT resources with no dependency edge between them. When a repo moves from
+ *   `checks:[]` to `checks:['x']`, `allowAutoMerge` flips to `true` in the very same deploy that
+ *   adds the required check. If the Repository apply lands before the Ruleset apply — or the
+ *   Ruleset apply fails outright — the repo ends up with auto-merge on and nothing required: `gh
+ *   pr merge --auto` merges a CLEAN pull request immediately (memory `gh-auto-merge-merges-now`).
+ *   That fail-open state is exactly what K5 exists to prevent.
+ *
+ * ★ THE MECHANISM — ALCHEMY ORDERS BY OUTPUT REFERENCES IN PROPS, NOT DECLARATION ORDER.
+ *   `Plan.ts` (~l.1031-1038): a resource's upstream deps are `Output.upstreamAny(resource.Props)`.
+ *   `Apply.ts` (~l.760-762, ~l.909): `waitForDeps(allUpstreamFqns())` — built the same way from
+ *   `Output.resolveUpstream(node.props)` — runs before `reconcile`. See the kit's own
+ *   `alchemy-output-refs-order-resources` memory. `GitHub.Repository`'s upstream `RepositoryProps`
+ *   has no spare field: `reconcile` (`node_modules/alchemy/src/GitHub/Repository.ts`) sends every
+ *   declared prop straight to Octokit's create/update calls, so there is nothing to smuggle an
+ *   unrelated Output into. `allowAutoMerge` itself is the vehicle instead: its value is still
+ *   exactly `true` whenever this function is called with it already `true` — only now computed
+ *   AFTER `ruleset.rulesetId` resolves via `Output.map`, instead of written as a literal. That
+ *   single Output reference is enough for `Output.upstreamAny` to record the ruleset as this
+ *   Repository's upstream dependency, so the engine applies the ruleset first.
+ *
+ * ★ WHY THIS NEEDS NO REVERSE-DIRECTION EDGE. The opposite transition — checks/approvals
+ *   REMOVED, so `allowAutoMerge` turns off — cannot silently race the other way. Neither caller
+ *   ever declares `rules.requiredStatusChecks: false` or omits `rules.pullRequest` on purpose;
+ *   dropping `checks`/`requiredApprovals` from the options just OMITS the corresponding rule key.
+ *   `requiredChecksOmissionRefusal` and `undeclaredLiveRuleRefusal` (repository-ruleset-guards.ts)
+ *   both refuse — unconditionally, regardless of apply order — to drop a rule that is still LIVE
+ *   by omission. So the worst reachable state, whichever resource applies first, is: Repository
+ *   succeeds (auto-merge off, the correct direction anyway) and Ruleset refuses (the live rule
+ *   stays required) — never fail-open. Proved by the ordering/failure tests beside this file.
+ */
+import * as Output from 'alchemy/Output';
+/** The one attribute this gate needs from a declared `RepositoryRuleset`. */
+export interface AutoMergeGateSource {
+    readonly rulesetId: Output.Output<number, never>;
+}
+/**
+ * Returns `settings` unchanged when `allowAutoMerge` is falsy — nothing to gate, and every
+ * existing declaration with auto-merge off keeps its exact prior props (no diff, no replan).
+ * Otherwise returns `settings` with `allowAutoMerge` recomputed as an Output.map over
+ * `ruleset.rulesetId` — still resolves to `true`, now with a real dependency edge attached.
+ */
+export declare function gateAutoMergeOnRuleset<P extends {
+    readonly allowAutoMerge?: boolean;
+}>(settings: P, ruleset: AutoMergeGateSource): P | (Omit<P, 'allowAutoMerge'> & {
+    readonly allowAutoMerge: Output.Output<boolean, never>;
+});
+//# sourceMappingURL=repo-auto-merge-gate.d.ts.map

package/dist/github/repo-auto-merge-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-auto-merge-gate.d.ts","sourceRoot":"","sources":["../../src/github/repo-auto-merge-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,EACpF,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,mBAAmB,GAC3B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,gBAAgB,CAAC,GAAG;IAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;CAAE,CAAC,CAG9F"}

package/dist/github/repo-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-policy.d.ts","sourceRoot":"","sources":["../../src/github/repo-policy.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,OAAQ,MAAM,WAAW,wBAAwB;;;;2EAkB3E,CAAC"}
+{"version":3,"file":"repo-policy.d.ts","sourceRoot":"","sources":["../../src/github/repo-policy.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,OAAQ,MAAM,WAAW,wBAAwB;;;;2EA6B3E,CAAC"}

package/dist/google-workspace/credentials.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Google Workspace credentials for the house — a lazy reference, never the key.
+ *
+ * ⛔ THE DISTILLED SDK'S OWN `Credentials` SERVICE TAKES ONE THING: an already-minted OAuth2
+ *   bearer access token (`@distilled.cloud/google-workspace/Credentials` — read at
+ *   `node_modules/@distilled.cloud/google-workspace/src/credentials.ts`, 2026-09-24: "API-compatible
+ *   port of the distilled gcp credentials module … no ADC, no service-account signing, no refresh
+ *   flow"). It has no service-account JSON shape and no domain-wide-delegation JWT exchange built
+ *   in — minting the token is entirely outside the SDK's surface.
+ *
+ * ★ SO THE HOUSE PATTERN IS H8'S, UNCHANGED: a short-lived credential is minted from OpenBao and
+ *   exported into the DEPLOY PROCESS's environment only, by a Bun wrapper the operator runs — the
+ *   same shape the kit's Proxmox subpath already uses for its own OpenBao-sourced token. This
+ *   family adds nothing that signs a JWT or talks to Google's token endpoint; that stays Tim's
+ *   wrapper script, documented in the README, because building it here would be a second,
+ *   hand-rolled auth flow next to the one the SDK already exposes (S23).
+ *
+ * ⛔ NEVER THE KEY. `GoogleWorkspaceKeyRef` below is a REFERENCE to where a service-account key
+ *   lives — an OpenBao path, a delegated admin subject and the scopes the wrapper requests — not
+ *   the key itself. Nothing in this family reads, parses or holds private key material; `describeKeyRef`
+ *   is pure string formatting for docs and the census handoff header, and it is tested (below) to
+ *   never accept or echo anything shaped like a key.
+ *
+ * Re-exported so a consumer imports one module for both the distilled service and the house
+ * reference type: `import { CredentialsFromEnv, fromAccessToken, type GoogleWorkspaceKeyRef } from
+ * '@homeflare/alchemy/google-workspace'`.
+ */
+export { type Config as GoogleWorkspaceConfig, Credentials, CredentialsFromEnv, fromAccessToken, } from '@distilled.cloud/google-workspace/Credentials';
+/** Env var the SDK's `CredentialsFromEnv` reads — the wrapper mints into THIS var, nothing else. */
+export declare const GOOGLE_ACCESS_TOKEN_ENV = "GOOGLE_ACCESS_TOKEN";
+/** Optional — only meaningful if a resource ever needs to scope a call to a GCP project. */
+export declare const GOOGLE_PROJECT_ID_ENV = "GOOGLE_PROJECT_ID";
+/**
+ * Where the service-account key that a wrapper exchanges for `GOOGLE_ACCESS_TOKEN` lives —
+ * documentation and typing only. A stack file may keep one of these next to its declarations so
+ * the OpenBao path, delegated admin and scopes are reviewable in the same diff as the resources
+ * they authorize — nothing here reads OpenBao or Google, and no field may hold a key, a token or
+ * a private key fragment.
+ */
+export interface GoogleWorkspaceKeyRef {
+    /** OpenBao KV path, e.g. `kv/google-workspace/service-accounts/directory-admin`. */
+    readonly openBaoPath: string;
+    /** The Workspace admin the service account impersonates via domain-wide delegation. */
+    readonly delegatedAdmin: string;
+    /** OAuth scopes the wrapper requests — keep this the least the declared resources need. */
+    readonly scopes: readonly string[];
+}
+/**
+ * A one-line, key-free description for docs and the census handoff header. Throws rather than
+ * formatting a ref whose fields look like they hold key material — a `GoogleWorkspaceKeyRef` is
+ * a pointer, and this is the one place that assumption is checked instead of assumed.
+ */
+export declare const describeKeyRef: (ref: GoogleWorkspaceKeyRef) => string;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/google-workspace/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/google-workspace/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,KAAK,MAAM,IAAI,qBAAqB,EACpC,WAAW,EACX,kBAAkB,EAClB,eAAe,GAChB,MAAM,+CAA+C,CAAC;AAEvD,oGAAoG;AACpG,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,4FAA4F;AAC5F,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAKD;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAS,qBAAqB,KAAG,MAW3D,CAAC"}