@homeflare/alchemy 0.36.0 → 0.37.0

package/dist/cloudflare/index.js.map

@@ -2,7 +2,7 @@
   "version": 3,
   "sources": ["../src/cloudflare/r2-bucket-lock.ts", "../src/cloudflare/lock-rules.ts", "../src/cloudflare/mesh-node.ts", "../src/cloudflare/mesh-node-api.ts", "../src/cloudflare/mesh-node-form.ts", "../src/cloudflare/mesh-node-lifecycle.ts", "../src/cloudflare/mesh-node-token.ts", "../src/cloudflare/providers.ts", "../src/cloudflare/website.ts"],
   "sourcesContent": [
-    "import { Unowned } from 'alchemy/AdoptPolicy';\nimport * as Provider from 'alchemy/Provider';\nimport { Resource, type ResourceClass } from 'alchemy/Resource';\n/**\n * `Cloudflare.R2BucketLock` — the lock rule set on one R2 bucket, declared rather than applied by\n * hand. A bucket lock is a RETENTION FLOOR: while a rule covers an object, no API call, no\n * lifecycle rule and no credential can delete it.\n *\n * 🔴 WHY THIS EXISTS AT ALL, AND WHAT IT REPLACES. a consuming stack shipped the retention floor as a\n *   documented `wrangler r2 bucket lock add …` step in the runbook, on the measured ground that\n *   `alchemy@2.0.0-beta.77` has no lock property anywhere in its R2 namespace. That measurement is\n *   still true and it was the wrong conclusion: a step a human runs once is a step an Alchemy plan\n *   can never show missing, so removing the floor by hand leaves that stack, its plan and\n *   every gate completely green. The operator's rule (2026-09-15) is to cover such a gap with a\n *   custom resource over the vendor's SDK, which is what this is.\n *\n * ★ OVER `@distilled.cloud/cloudflare/r2`, THE SAME SDK `Cloudflare.MeshNode` USES\n *   (mesh-node-api.ts), NOT THE `cloudflare` NPM SDK THIS RESOURCE USED TO CALL. Measured\n *   2026-09-23 in distilled `1.0.0-rc.12` (the version alchemy@2.0.0-beta.79 pins),\n *   `packages/cloudflare/src/services/r2.ts`: `getBucketLock` / `putBucketLock` cover the same\n *   `GET`/`PUT /accounts/{account_id}/r2/buckets/{bucket_name}/lock` route the old SDK's\n *   `r2.buckets.locks.get`/`.update` did — same `rules[]` body, the `cf-r2-jurisdiction` header\n *   spelled as the `jurisdiction` field — but typed as `NoSuchBucket | InvalidRoute |\n *   CloudflareRateLimited | CloudflareError` instead of an opaque HTTP status, so the \"bucket\n *   does not exist yet\" case below is `catchTag('NoSuchBucket', …)`, never a status check. This\n *   is also the swap that lets `client.ts` (the hand-rolled `cloudflare@4.5.0` wrapper) go away:\n *   nothing else in the kit imported it.\n *\n * ⚠️ THE RULE SET IS A REPLACE, NOT A MERGE. `PUT` takes the WHOLE list, exactly like R2's\n *   lifecycle rules — which is the trap a consuming stack records for\n *   `homeflare-git`. Declaring this resource on a bucket whose live rules nobody has read would\n *   drop them, so `read` fetches them first and `reconcile` refuses to write when they already\n *   match.\n */\nimport type { CloudflareOpContext } from '@distilled.cloud/cloudflare/r2';\nimport { Credentials } from '@distilled.cloud/cloudflare/Credentials';\nimport * as r2 from '@distilled.cloud/cloudflare/r2';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport {\n  type Jurisdiction,\n  type R2LockRule,\n  jurisdictionOf,\n  rulesEqual,\n  toBody,\n} from './lock-rules.ts';\nimport type { Providers } from './providers.ts';\n\nexport interface R2BucketLockProps {\n  readonly accountId: string;\n  readonly bucketName: string;\n  /** ⚠️ Part of the bucket's IDENTITY, not a preference — a bucket in another jurisdiction is another bucket. */\n  readonly jurisdiction?: Jurisdiction;\n  /**\n   * ⛔ REQUIRED, AND ITS EMPTY VALUE IS THE DANGEROUS ONE. `rules: []` means NO FLOOR: it is what\n   *   `delete` sends to take a lock off deliberately. An optional property would let a declaration\n   *   that simply forgot it send `[]` and silently unlock the repository, reporting success — the\n   *   same reasoning `LiteLLM.McpServer.allowedTools` is required for.\n   */\n  readonly rules: readonly R2LockRule[];\n}\n\nexport type R2BucketLockAttributes = {\n  readonly bucketName: string;\n  readonly jurisdiction: Jurisdiction;\n  readonly rules: readonly R2LockRule[];\n};\n\nexport interface R2BucketLock extends Resource<\n  'Cloudflare.R2BucketLock',\n  R2BucketLockProps,\n  R2BucketLockAttributes,\n  never,\n  Providers\n> {}\n\n// ⚠️ EXPLICIT ANNOTATION, REQUIRED BY isolatedDeclarations. This file was internal to a\n//   monorepo before it was published; a published package emits its .d.ts from a separate\n//   tsc pass, so every exported symbol must state its type rather than infer it.\nexport const R2BucketLock: ResourceClass<R2BucketLock> = Resource<R2BucketLock>(\n  'Cloudflare.R2BucketLock',\n  {\n    /**\n     * ⛔ RETAIN, AND ON THIS RESOURCE IT IS NOT THE ESTATE'S HABIT BUT THE WHOLE POINT. A lock is a\n     *   safety floor: removing the declaration must not remove the floor, because the state it\n     *   protects is the only physical backup of the estate's one Postgres. `delete` below is\n     *   implemented — a provider that cannot delete cannot be tested or corrected — and it is\n     *   reachable only by an operator running the CLI directly, past a deploy wrapper.\n     */\n    defaultRemovalPolicy: 'retain',\n  },\n);\n\n/**\n * 🔴 A 404 HERE IS \"NOTHING TO ADOPT\", AND THE FIRST PLAN PROVED IT IS THE ORDINARY CASE.\n *   Measured 2026-09-15, an alchemy plan --detailed on a bucket that does not\n *   exist yet: `404 {\"success\":false,\"errors\":[{\"code\":10006,\"message\":\"The specified bucket does\n *   not exist.\"}]}` — raised from `read`, during PLANNING, before anything is created. Alchemy\n *   calls `read` for a resource with no prior state, so on every first deploy the lock is asked\n *   about a bucket the same plan is about to create. Code 10006 is exactly distilled's\n *   `NoSuchBucket` tag (r2.ts's error matcher, `[{ code: 10006 }]`), so `catchTag` on it is the\n *   same case the status check used to cover — but by the vendor's own error identity, not by\n *   reading a number off the response. Letting it propagate would make the resource impossible to\n *   plan; swallowing every failure would also hide a 403 from a mis-scoped token, which is the\n *   failure this estate spends the most time on. So: `NoSuchBucket` → absent, everything else dies.\n *\n * ⛔ AN EMPTY LIVE RULE SET IS \"NO LOCK\", NOT \"A LOCK WITH NOTHING IN IT\", so it reads as absent\n *   and the resource CREATES. The API answers `{}` for a bucket that has never been locked and\n *   `{ rules: [] }` for one whose rules were removed; both mean the floor is gone.\n * ⚠️ `Unowned` UNTIL THIS STACK HAS WRITTEN IT. A lock someone applied by hand — which is exactly\n *   what the retired runbook step did — must not be silently rewritten by a mistyped declaration;\n *   the planner refuses until the resource is piped through `adopt(true)`, which is one line an\n *   operator reads in the diff. An adopted rule set that already MATCHES then costs no request at\n *   all, because `reconcile` below returns before writing.\n */\nexport const readLock = (\n  props: { accountId: string; bucketName: string; jurisdiction?: Jurisdiction },\n  written: boolean,\n): Effect.Effect<R2BucketLockAttributes | undefined, never, CloudflareOpContext> =>\n  Effect.gen(function* () {\n    const jurisdiction = jurisdictionOf(props);\n    const live = yield* r2\n      .getBucketLock({ accountId: props.accountId, bucketName: props.bucketName, jurisdiction })\n      .pipe(\n        Effect.catchTag('NoSuchBucket', () => Effect.succeed(undefined)),\n        Effect.orDie,\n      );\n    if (live === undefined) return undefined;\n    const rules = (live.rules ?? []) as readonly R2LockRule[];\n    if (rules.length === 0) return undefined;\n    const attributes: R2BucketLockAttributes = {\n      bucketName: props.bucketName,\n      jurisdiction,\n      rules,\n    };\n    return written ? attributes : Unowned(attributes);\n  });\n\n/**\n * ⛔ A NO-OP MAKES NO REQUEST, AND ON A LOCK THAT MATTERS MORE THAN TIDINESS. `PUT` replaces the\n *   rule set; re-sending an identical one on every deploy is a write against the only thing\n *   standing between this repository and a delete, for no change. `output` is what the last deploy\n *   persisted (or what `read` just adopted), so the comparison costs nothing either.\n * ⛔ `NoSuchBucket` IS NOT CAUGHT HERE. Unlike `read`, a `reconcile` that hits it means the bucket\n *   this declaration names is genuinely gone — that is a real failure to surface, not a case to\n *   paper over, so it dies like every other tagged error `putBucketLock` can raise.\n */\nexport const reconcileLock = (\n  news: R2BucketLockProps,\n  output: R2BucketLockAttributes | undefined,\n): Effect.Effect<R2BucketLockAttributes, never, CloudflareOpContext> =>\n  Effect.gen(function* () {\n    const jurisdiction = jurisdictionOf(news);\n    if (output !== undefined && rulesEqual(output.rules, news.rules)) return output;\n    yield* r2\n      .putBucketLock({\n        accountId: news.accountId,\n        bucketName: news.bucketName,\n        jurisdiction,\n        ...toBody(news.rules),\n      })\n      .pipe(Effect.orDie);\n    return { bucketName: news.bucketName, jurisdiction, rules: news.rules };\n  });\n\n/**\n * ⛔ DELETING THIS RESOURCE MEANS PUTTING AN EMPTY RULE SET, WHICH IS UNLOCKING THE BUCKET. It is\n *   implemented because the retirement path is real — R2 refuses to empty a bucket while any lock\n *   rule is configured, so retiring the repository has to start here — and it is behind\n *   `defaultRemovalPolicy: 'retain'` and the estate CLI's refusal of `destroy` precisely because\n *   no ordinary deploy should ever reach it.\n */\nexport const deleteLock = (\n  output: R2BucketLockAttributes,\n  accountId: string,\n): Effect.Effect<void, never, CloudflareOpContext> =>\n  Effect.gen(function* () {\n    yield* r2\n      .putBucketLock({\n        accountId,\n        bucketName: output.bucketName,\n        jurisdiction: output.jurisdiction,\n        rules: [],\n      })\n      .pipe(Effect.orDie);\n  });\n\nexport const R2BucketLockProvider = () =>\n  Provider.effect(\n    R2BucketLock,\n    Effect.gen(function* () {\n      // ★ CAPTURED AT BUILD, LIKE `MeshNodeProvider`. `Credentials` and `HttpClient.HttpClient`\n      //   are the whole of distilled's `CloudflareOpContext` (r2.ts re-exports the type); pinning\n      //   them here rather than reading ambient context inside each handler keeps this provider\n      //   correct whether or not the stack also merges `Cloudflare.providers()`.\n      const services = Context.make(Credentials, yield* Credentials).pipe(\n        Context.add(HttpClient.HttpClient, yield* HttpClient.HttpClient),\n      );\n      const run = <A, E>(effect: Effect.Effect<A, E, CloudflareOpContext>) =>\n        Effect.provideContext(effect, services);\n\n      return R2BucketLock.Provider.of({\n        /**\n         * ⛔ EMPTY, AND ALCHEMY'S OWN CONTRACT ASKS FOR EXACTLY THAT. `ProviderService.list`:\n         *   \"Resources with no native enumeration API (… sub-resources keyed entirely by a parent)\n         *   should return an empty array rather than throwing.\" There is no list-locks endpoint —\n         *   a lock is reachable only through the bucket that owns it — so enumerating would mean\n         *   listing every bucket in the account and GETting each one's lock.\n         * ⛔⛔ AND `nuke.singleton` IS WHY THAT IS NOT MERELY UNAVAILABLE BUT UNWANTED. `list`\n         *   feeds `alchemy unsafe nuke`, which lists and then deletes; `delete` here is an UNLOCK.\n         *   A working enumeration would hand one command the ability to strip the retention floor\n         *   off every bucket in the account — the precise event a floor exists to make impossible.\n         *   `singleton` is the documented word for it: always-present configuration whose delete\n         *   resets rather than removes.\n         */\n        list: () => Effect.succeed([]),\n        nuke: { singleton: true },\n        read: Effect.fn(function* ({ olds, output }) {\n          const props = olds ?? undefined;\n          if (props === undefined) return undefined;\n          return yield* run(readLock(props, output !== undefined));\n        }),\n        reconcile: Effect.fn(({ news, output }) => run(reconcileLock(news, output))),\n        delete: Effect.fn(({ olds, output }) => run(deleteLock(output, olds.accountId))),\n      });\n    }),\n  );\n",
+    "import { Unowned } from 'alchemy/AdoptPolicy';\nimport * as Provider from 'alchemy/Provider';\nimport { Resource, type ResourceClass } from 'alchemy/Resource';\n/**\n * `Cloudflare.R2BucketLock` — the lock rule set on one R2 bucket, declared rather than applied by\n * hand. A bucket lock is a RETENTION FLOOR: while a rule covers an object, no API call, no\n * lifecycle rule and no credential can delete it.\n *\n * 🔴 WHY THIS EXISTS AT ALL, AND WHAT IT REPLACES. a consuming stack shipped the retention floor as a\n *   documented `wrangler r2 bucket lock add …` step in the runbook, on the measured ground that\n *   `alchemy@2.0.0-beta.77` has no lock property anywhere in its R2 namespace. That measurement is\n *   still true and it was the wrong conclusion: a step a human runs once is a step an Alchemy plan\n *   can never show missing, so removing the floor by hand leaves that stack, its plan and\n *   every gate completely green. The operator's rule (2026-09-15) is to cover such a gap with a\n *   custom resource over the vendor's SDK, which is what this is.\n *\n * ★ OVER `@distilled.cloud/cloudflare/r2`, THE SAME SDK `Cloudflare.MeshNode` USES\n *   (mesh-node-api.ts), NOT THE `cloudflare` NPM SDK THIS RESOURCE USED TO CALL. Measured\n *   2026-09-23 in distilled `1.0.0-rc.12` (the version alchemy@2.0.0-beta.79 pins),\n *   `packages/cloudflare/src/services/r2.ts`: `getBucketLock` / `putBucketLock` cover the same\n *   `GET`/`PUT /accounts/{account_id}/r2/buckets/{bucket_name}/lock` route the old SDK's\n *   `r2.buckets.locks.get`/`.update` did — same `rules[]` body, the `cf-r2-jurisdiction` header\n *   spelled as the `jurisdiction` field — but typed as `NoSuchBucket | InvalidRoute |\n *   CloudflareRateLimited | CloudflareError` instead of an opaque HTTP status, so the \"bucket\n *   does not exist yet\" case below is `catchTag('NoSuchBucket', …)`, never a status check. This\n *   is also the swap that lets `client.ts` (the hand-rolled `cloudflare@4.5.0` wrapper) go away:\n *   nothing else in the kit imported it.\n *\n * ⚠️ THE RULE SET IS A REPLACE, NOT A MERGE. `PUT` takes the WHOLE list, exactly like R2's\n *   lifecycle rules — which is the trap a consuming stack records for\n *   `homeflare-git`. Declaring this resource on a bucket whose live rules nobody has read would\n *   drop them, so `read` fetches them first and `reconcile` refuses to write when they already\n *   match.\n */\nimport type { CloudflareOpContext } from '@distilled.cloud/cloudflare/r2';\nimport { Credentials } from '@distilled.cloud/cloudflare/Credentials';\nimport * as r2 from '@distilled.cloud/cloudflare/r2';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport {\n  type Jurisdiction,\n  type R2LockRule,\n  jurisdictionOf,\n  rulesEqual,\n  toBody,\n} from './lock-rules.ts';\nimport type { Providers } from './providers.ts';\n\nexport interface R2BucketLockProps {\n  readonly accountId: string;\n  readonly bucketName: string;\n  /** ⚠️ Part of the bucket's IDENTITY, not a preference — a bucket in another jurisdiction is another bucket. */\n  readonly jurisdiction?: Jurisdiction;\n  /**\n   * ⛔ REQUIRED, AND ITS EMPTY VALUE IS THE DANGEROUS ONE. `rules: []` means NO FLOOR: it is what\n   *   `delete` sends to take a lock off deliberately. An optional property would let a declaration\n   *   that simply forgot it send `[]` and silently unlock the repository, reporting success — the\n   *   same reasoning `LiteLLM.McpServer.allowedTools` is required for.\n   */\n  readonly rules: readonly R2LockRule[];\n}\n\nexport type R2BucketLockAttributes = {\n  readonly bucketName: string;\n  readonly jurisdiction: Jurisdiction;\n  readonly rules: readonly R2LockRule[];\n};\n\nexport interface R2BucketLock extends Resource<\n  'Cloudflare.R2BucketLock',\n  R2BucketLockProps,\n  R2BucketLockAttributes,\n  never,\n  Providers\n> {}\n\n// ⚠️ EXPLICIT ANNOTATION, REQUIRED BY isolatedDeclarations. This file was internal to a\n//   monorepo before it was published; a published package emits its .d.ts from a separate\n//   tsc pass, so every exported symbol must state its type rather than infer it.\nexport const R2BucketLock: ResourceClass<R2BucketLock> = Resource<R2BucketLock>(\n  'Cloudflare.R2BucketLock',\n  {\n    /**\n     * ⛔ RETAIN, AND ON THIS RESOURCE IT IS NOT THE ESTATE'S HABIT BUT THE WHOLE POINT. A lock is a\n     *   safety floor: removing the declaration must not remove the floor, because the state it\n     *   protects is the only physical backup of the estate's one Postgres. `delete` below is\n     *   implemented — a provider that cannot delete cannot be tested or corrected — and it is\n     *   reachable only by an operator running the CLI directly, past a deploy wrapper.\n     */\n    defaultRemovalPolicy: 'retain',\n  },\n);\n\n/**\n * 🔴 A 404 HERE IS \"NOTHING TO ADOPT\", AND THE FIRST PLAN PROVED IT IS THE ORDINARY CASE.\n *   Measured 2026-09-15, an alchemy plan --detailed on a bucket that does not\n *   exist yet: `404 {\"success\":false,\"errors\":[{\"code\":10006,\"message\":\"The specified bucket does\n *   not exist.\"}]}` — raised from `read`, during PLANNING, before anything is created. Alchemy\n *   calls `read` for a resource with no prior state, so on every first deploy the lock is asked\n *   about a bucket the same plan is about to create. Code 10006 is exactly distilled's\n *   `NoSuchBucket` tag (r2.ts's error matcher, `[{ code: 10006 }]`), so `catchTag` on it is the\n *   same case the status check used to cover — but by the vendor's own error identity, not by\n *   reading a number off the response. Letting it propagate would make the resource impossible to\n *   plan; swallowing every failure would also hide a 403 from a mis-scoped token, which is the\n *   failure this estate spends the most time on. So: `NoSuchBucket` → absent, everything else\n *   propagates with its SDK tag. Upstream `Cloudflare/R2/BucketSippy.ts` at beta.79 uses this\n *   same catch-and-propagate shape; a blanket remap would hide those typed identities (S20/S21).\n *\n * ⛔ AN EMPTY LIVE RULE SET IS \"NO LOCK\", NOT \"A LOCK WITH NOTHING IN IT\", so it reads as absent\n *   and the resource CREATES. The API answers `{}` for a bucket that has never been locked and\n *   `{ rules: [] }` for one whose rules were removed; both mean the floor is gone.\n * ⚠️ `Unowned` UNTIL THIS STACK HAS WRITTEN IT. A lock someone applied by hand — which is exactly\n *   what the retired runbook step did — must not be silently rewritten by a mistyped declaration;\n *   the planner refuses until the resource is piped through `adopt(true)`, which is one line an\n *   operator reads in the diff. An adopted rule set that already MATCHES then costs no request at\n *   all, because `reconcile` below returns before writing.\n */\nexport const readLock = (\n  props: { accountId: string; bucketName: string; jurisdiction?: Jurisdiction },\n  written: boolean,\n): Effect.Effect<\n  R2BucketLockAttributes | undefined,\n  Exclude<r2.GetBucketLockError, { _tag: 'NoSuchBucket' }>,\n  CloudflareOpContext\n> =>\n  Effect.gen(function* () {\n    const jurisdiction = jurisdictionOf(props);\n    const live = yield* r2\n      .getBucketLock({ accountId: props.accountId, bucketName: props.bucketName, jurisdiction })\n      .pipe(Effect.catchTag('NoSuchBucket', () => Effect.succeed(undefined)));\n    if (live === undefined) return undefined;\n    const rules = (live.rules ?? []) as readonly R2LockRule[];\n    if (rules.length === 0) return undefined;\n    const attributes: R2BucketLockAttributes = {\n      bucketName: props.bucketName,\n      jurisdiction,\n      rules,\n    };\n    return written ? attributes : Unowned(attributes);\n  });\n\n/**\n * ⛔ A NO-OP MAKES NO REQUEST, AND ON A LOCK THAT MATTERS MORE THAN TIDINESS. `PUT` replaces the\n *   rule set; re-sending an identical one on every deploy is a write against the only thing\n *   standing between this repository and a delete, for no change. `output` is what the last deploy\n *   persisted (or what `read` just adopted), so the comparison costs nothing either.\n * ⛔ `NoSuchBucket` IS NOT CAUGHT HERE. Unlike `read`, a `reconcile` that hits it means the bucket\n *   this declaration names is genuinely gone — that is a real failure to surface, not a case to\n *   paper over, so it propagates like every other typed SDK error `putBucketLock` can raise.\n */\nexport const reconcileLock = (\n  news: R2BucketLockProps,\n  output: R2BucketLockAttributes | undefined,\n): Effect.Effect<R2BucketLockAttributes, r2.PutBucketLockError, CloudflareOpContext> =>\n  Effect.gen(function* () {\n    const jurisdiction = jurisdictionOf(news);\n    if (output !== undefined && rulesEqual(output.rules, news.rules)) return output;\n    yield* r2.putBucketLock({\n      accountId: news.accountId,\n      bucketName: news.bucketName,\n      jurisdiction,\n      ...toBody(news.rules),\n    });\n    return { bucketName: news.bucketName, jurisdiction, rules: news.rules };\n  });\n\n/**\n * ⛔ DELETING THIS RESOURCE MEANS PUTTING AN EMPTY RULE SET, WHICH IS UNLOCKING THE BUCKET. It is\n *   implemented because the retirement path is real — R2 refuses to empty a bucket while any lock\n *   rule is configured, so retiring the repository has to start here — and it is behind\n *   `defaultRemovalPolicy: 'retain'` and the estate CLI's refusal of `destroy` precisely because\n *   no ordinary deploy should ever reach it.\n * ⛔ IDEMPOTENT (S11): a missing bucket has nothing left to unlock. Catch only `NoSuchBucket`;\n *   every other SDK error propagates, like upstream `R2/BucketSippy.ts` at beta.79.\n */\nexport const deleteLock = (\n  output: R2BucketLockAttributes,\n  accountId: string,\n): Effect.Effect<\n  void,\n  Exclude<r2.PutBucketLockError, { _tag: 'NoSuchBucket' }>,\n  CloudflareOpContext\n> =>\n  Effect.gen(function* () {\n    yield* r2\n      .putBucketLock({\n        accountId,\n        bucketName: output.bucketName,\n        jurisdiction: output.jurisdiction,\n        rules: [],\n      })\n      .pipe(Effect.catchTag('NoSuchBucket', () => Effect.void));\n  });\n\nexport const R2BucketLockProvider = () =>\n  Provider.effect(\n    R2BucketLock,\n    Effect.gen(function* () {\n      // ★ CAPTURED AT BUILD, LIKE `MeshNodeProvider`. `Credentials` and `HttpClient.HttpClient`\n      //   are the whole of distilled's `CloudflareOpContext` (r2.ts re-exports the type); pinning\n      //   them here rather than reading ambient context inside each handler keeps this provider\n      //   correct whether or not the stack also merges `Cloudflare.providers()`.\n      const services = Context.make(Credentials, yield* Credentials).pipe(\n        Context.add(HttpClient.HttpClient, yield* HttpClient.HttpClient),\n      );\n      const run = <A, E>(effect: Effect.Effect<A, E, CloudflareOpContext>) =>\n        Effect.provideContext(effect, services);\n\n      return R2BucketLock.Provider.of({\n        /**\n         * ⛔ EMPTY, AND ALCHEMY'S OWN CONTRACT ASKS FOR EXACTLY THAT. `ProviderService.list`:\n         *   \"Resources with no native enumeration API (… sub-resources keyed entirely by a parent)\n         *   should return an empty array rather than throwing.\" There is no list-locks endpoint —\n         *   a lock is reachable only through the bucket that owns it — so enumerating would mean\n         *   listing every bucket in the account and GETting each one's lock.\n         * ⛔⛔ AND `nuke.singleton` IS WHY THAT IS NOT MERELY UNAVAILABLE BUT UNWANTED. `list`\n         *   feeds `alchemy unsafe nuke`, which lists and then deletes; `delete` here is an UNLOCK.\n         *   A working enumeration would hand one command the ability to strip the retention floor\n         *   off every bucket in the account — the precise event a floor exists to make impossible.\n         *   `singleton` is the documented word for it: always-present configuration whose delete\n         *   resets rather than removes.\n         */\n        list: () => Effect.succeed([]),\n        nuke: { singleton: true },\n        read: Effect.fn(function* ({ olds, output }) {\n          const props = olds ?? undefined;\n          if (props === undefined) return undefined;\n          return yield* run(readLock(props, output !== undefined));\n        }),\n        reconcile: Effect.fn(({ news, output }) => run(reconcileLock(news, output))),\n        delete: Effect.fn(({ olds, output }) => run(deleteLock(output, olds.accountId))),\n      });\n    }),\n  );\n",
     "/**\n * The vocabulary of an R2 lock rule, and the comparison that decides whether to write one.\n *\n * ★ ITS OWN MODULE FOR THE REASON `<estate>/litellm/src/equal.ts` IS ONE: the comparison is the\n *   riskiest function in the provider and it deserves to be readable and testable without the\n *   lifecycle around it. An equality that returned true for everything would make every reconcile\n *   a no-op and the resource would silently never write anything — which looks exactly like a\n *   converged stack.\n */\n/** Jurisdictions the API accepts, as the SDK declares them. */\nexport type Jurisdiction = 'default' | 'eu' | 'fedramp';\n\n/**\n * One lock rule. ⚠️ `prefix` OMITTED MEANS THE WHOLE BUCKET — the SDK documents an empty prefix as\n * the way to scope a rule to every object, and omitting the key is how that is spelled on the wire.\n */\nexport type R2LockRule = {\n  readonly id: string;\n  readonly enabled: boolean;\n  readonly prefix?: string;\n  readonly condition:\n    | { readonly type: 'Age'; readonly maxAgeSeconds: number }\n    | { readonly type: 'Date'; readonly date: string }\n    | { readonly type: 'Indefinite' };\n};\n\n/** ⚠️ `undefined` and `'default'` are the same jurisdiction; normalise so a diff never sees both. */\nexport const jurisdictionOf = (props: { readonly jurisdiction?: Jurisdiction }): Jurisdiction =>\n  props.jurisdiction ?? 'default';\n\n/**\n * ⛔ FIELD BY FIELD, IN ORDER, AND NOT `JSON.stringify` OF EITHER SIDE. The API returns rules in\n *   its own key order and omits `prefix` where this repo may spell it `''`; a stringify compare\n *   would report drift on every plan and PUT an identical body each deploy. Order across the list\n *   IS compared, because the rule set is a replace and the list is what gets sent.\n */\nexport function rulesEqual(a: readonly R2LockRule[], b: readonly R2LockRule[]): boolean {\n  if (a.length !== b.length) return false;\n  return a.every((left, index) => {\n    const right = b[index];\n    if (right === undefined) return false;\n    if (left.id !== right.id || left.enabled !== right.enabled) return false;\n    if ((left.prefix ?? '') !== (right.prefix ?? '')) return false;\n    const [lc, rc] = [left.condition, right.condition];\n    if (lc.type !== rc.type) return false;\n    if (lc.type === 'Age') return rc.type === 'Age' && lc.maxAgeSeconds === rc.maxAgeSeconds;\n    if (lc.type === 'Date') return rc.type === 'Date' && lc.date === rc.date;\n    return true;\n  });\n}\n\n/**\n * The body the SDK sends. Split out so the test can assert the wire shape against one function.\n *\n * ⚠️ IT TAKES THE RULES, NOT THE PROPS, so this module names nothing from the resource — the\n *   comparison and the vocabulary stay readable without the lifecycle around them.\n */\nexport const toBody = (rules: readonly R2LockRule[]): { rules: R2LockRule[] } => ({\n  rules: rules.map((rule) => ({ ...rule })),\n});\n",
     "/**\n * `Cloudflare.MeshNode` — a Cloudflare Mesh node (a `warp_connector` object), declared without\n * its token ever touching Alchemy state. Usage and the enrolment step: docs/mesh-node.md.\n *\n * 🔴 WHY THIS EXISTS ALONGSIDE `Cloudflare.Tunnel.WarpConnector`. A Mesh node that fronts a\n *   private service needs a node record in the graph, so the Gateway rules and DNS records that\n *   name it deploy together. Alchemy beta.79's WarpConnector would put the node token — the\n *   credential that lets any Linux host join the account's Mesh as that node — into plaintext\n *   state on every read, and it cannot create an HA node. See mesh-node-form.ts.\n *\n * ★ REMOVAL POLICY: `retain` BY DEFAULT — see the ★ on `MeshNode` below, and what it does to an\n *   `ha` replace in mesh-node-lifecycle.ts.\n */\nimport { Credentials } from '@distilled.cloud/cloudflare/Credentials';\nimport * as Cloudflare from 'alchemy/Cloudflare';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport { Resource, type ResourceClass } from 'alchemy/Resource';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport {\n  type MeshNodeAttributes,\n  type MeshNodeProps,\n  diffMeshNode,\n  validateMeshNode,\n} from './mesh-node-form.ts';\nimport { deleteMeshNode, readMeshNode, reconcileMeshNode } from './mesh-node-lifecycle.ts';\nimport type { Providers } from './providers.ts';\n\nexport interface MeshNode extends Resource<\n  'Cloudflare.MeshNode',\n  MeshNodeProps,\n  MeshNodeAttributes,\n  never,\n  Providers\n> {}\n\n/**\n * ★ `defaultRemovalPolicy: 'retain'`, LIKE EVERY KIT RESOURCE WHOSE DELETION BREAKS ITS CONSUMERS\n *   (the `Bao.*` families, `R2BucketLock`, the Proxmox storage families; the reasoning is written\n *   once in proxmox/resource.ts). Deleting a node cuts every enrolled replica off the Mesh, and\n *   nothing brings it back: a new node has a new id, a new token and a new Mesh IP per replica, so\n *   each host must be re-enrolled by hand and every Gateway rule or allow-list that pins the old\n *   Mesh IP breaks. So dropping the declaration, or `alchemy destroy`, leaves the node live.\n * ⚠️ IT ALSO SKIPS THE OLD NODE'S DELETE IN A REPLACE (Apply.ts, `deleteOldGenerations` and the\n *   GC's `retainOldGeneration`, beta.79). A same-name `ha` change therefore REFUSES, deleting\n *   nothing, until that deploy opts in with `.pipe(RemovalPolicy.destroy())`; a create-first\n *   replace leaves the old node live and unmanaged. Both measured in mesh-node-policy.test.ts.\n * ⛔ `delete` STAYS FULLY IMPLEMENTED. Retain is Terraform's `prevent_destroy`, not a stub: it runs\n *   the moment a declaration opts in with `.pipe(RemovalPolicy.destroy())`.\n */\nexport const MeshNode: ResourceClass<MeshNode> = Resource<MeshNode>('Cloudflare.MeshNode', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/** What every call below needs: the account, credentials and HTTP — Alchemy's own trio. */\nexport type MeshNodeServices =\n  | Cloudflare.CloudflareEnvironment\n  | Credentials\n  | HttpClient.HttpClient;\n\n/** The account id, resolved the way every `alchemy/Cloudflare` provider resolves it. */\nconst accountId = Effect.gen(function* () {\n  const resolved = yield* yield* Cloudflare.CloudflareEnvironment;\n  return resolved.accountId;\n});\n\n/**\n * ★ `Provider.effect`, CAPTURING THE THREE SERVICES AT BUILD. `Provider.succeed` (what Alchemy's\n *   own providers use) leaves each handler to find CloudflareEnvironment and Credentials in the\n *   engine's context at call time — which works for `Cloudflare.providers()` only because it\n *   `provideMerge`s them into the stack. Capturing them here keeps this provider correct whether\n *   or not the stack also merges `Cloudflare.providers()`.\n */\nexport const MeshNodeProvider = () =>\n  Provider.effect(\n    MeshNode,\n    Effect.gen(function* () {\n      const services = Context.make(\n        Cloudflare.CloudflareEnvironment,\n        yield* Cloudflare.CloudflareEnvironment,\n      ).pipe(\n        Context.add(Credentials, yield* Credentials),\n        Context.add(HttpClient.HttpClient, yield* HttpClient.HttpClient),\n      );\n      const run = <A, E>(effect: Effect.Effect<A, E, MeshNodeServices>) =>\n        Effect.provideContext(effect, services);\n\n      return MeshNode.Provider.of({\n        stables: ['id', 'accountId', 'ha'],\n        /**\n         * ⛔ EMPTY, AND `nuke.skip`. Alchemy's own `Cloudflare.Tunnel.WarpConnector` already lists\n         *   every `warp_connector` in the account for `alchemy unsafe nuke`; a second listing here\n         *   would make nuke delete each node twice. `read` does not depend on this.\n         */\n        list: () => Effect.succeed([]),\n        nuke: { skip: true },\n        /**\n         * ⛔ VALIDATE AT PLAN TIME, NOT ONLY IN `reconcile`. An `ha` replace is delete-first: the\n         *   engine deletes the old node BEFORE the new generation's reconcile runs, so a\n         *   declaration refused there would leave no node at all. launchd's job-preflight.ts\n         *   refuses at plan time for the same reason.\n         */\n        diff: ({ news, output }) =>\n          run(\n            Effect.gen(function* () {\n              const invalid = isResolved(news) ? validateMeshNode(news) : undefined;\n              if (invalid !== undefined) return yield* Effect.fail(invalid);\n              return diffMeshNode(news, output, yield* accountId);\n            }),\n          ),\n        read: ({ olds, output }) =>\n          run(Effect.flatMap(accountId, (account) => readMeshNode(account, olds, output))),\n        reconcile: ({ news, output }) =>\n          run(Effect.flatMap(accountId, (account) => reconcileMeshNode(account, news, output))),\n        delete: ({ output }) => run(deleteMeshNode(output)),\n      });\n    }),\n  );\n",
     "/**\n * The `warp_connector` calls a Cloudflare Mesh node needs, and nothing else.\n *\n * ★ A MESH NODE IS A `warp_connector` OBJECT. Cloudflare's Mesh docs create one with\n *   `POST /accounts/{account_id}/warp_connector` and fetch its enrolment token from\n *   `GET …/warp_connector/{id}/token` (developers.cloudflare.com/mesh/get-started, read\n *   2026-09-21). There is no separate \"mesh node\" endpoint.\n *\n * ★ OVER `@distilled.cloud/cloudflare`, THE SDK ALCHEMY'S OWN CLOUDFLARE PROVIDERS USE — and, as\n *   of 2026-09-23, the same one `R2BucketLock` calls too (r2-bucket-lock.ts), not the `cloudflare`\n *   npm SDK either used before that. Measured 2026-09-21: `cloudflare@4.5.0`'s\n *   `WARPConnectorCreateParams` has only `account_id` and `name`, so it cannot create an HA node.\n *   distilled `1.0.0-rc.12` (the version alchemy@2.0.0-beta.79 pins) has `ha?: boolean` on\n *   `CreateTunnelWarpConnectorRequest`, typed errors (`TunnelNotFound` code 1002 / 404,\n *   `DuplicateTunnelName` code 1013), and resolves credentials and the account exactly the way\n *   `Cloudflare.Tunnel.WarpConnector` and `Cloudflare.Gateway.Rule` do — so the node and the Gateway\n *   rules that pin its Mesh IP always land in the same account.\n *\n * ⛔ NO FUNCTION IN THIS FILE READS THE NODE TOKEN, and `observe` copies named fields only. The\n *   HA docs say the create response carries a `token` field; distilled's decoder copies only the\n *   fields in its schema (protocol.ts, `getProps(outputAst)`), and `observe` below would drop it\n *   again if it ever got through. The one token read lives in mesh-node-token.ts, on demand.\n */\nimport * as zeroTrust from '@distilled.cloud/cloudflare/zero-trust';\nimport * as Data from 'effect/Data';\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\n\n/** `inactive` (never run), `degraded`, `healthy` or `down` — Cloudflare's own four. */\nexport type MeshNodeStatus = 'inactive' | 'degraded' | 'healthy' | 'down';\n\n/** A live node as this package sees it. ⛔ There is no token field here, on purpose. */\nexport interface ObservedNode {\n  readonly id: string;\n  readonly name: string;\n  readonly status: MeshNodeStatus | undefined;\n}\n\n/** A refusal or failure, carrying the sentence an operator needs. Never a token. */\nexport class MeshNodeError extends Data.TaggedError('MeshNodeError')<{\n  readonly message: string;\n}> {}\n\ntype Raw = {\n  readonly id?: string | null;\n  readonly name?: string | null;\n  readonly status?: string | null;\n  readonly deletedAt?: string | null;\n};\n\nconst STATUSES: readonly string[] = ['inactive', 'degraded', 'healthy', 'down'];\n\n/**\n * ⚠️ A DELETED NODE IS NOT A NODE. Cloudflare keeps deleted tunnels (every response carries\n *   `deleted_at`, and the list takes `is_deleted`), so a `GET` by id can answer for one. Treating\n *   that as live would \"adopt\" a tombstone and PATCH it.\n */\nexport const observe = (raw: Raw): ObservedNode | undefined => {\n  if (typeof raw.id !== 'string' || raw.id.length === 0) return undefined;\n  if (raw.deletedAt !== undefined && raw.deletedAt !== null) return undefined;\n  const status =\n    typeof raw.status === 'string' && STATUSES.includes(raw.status)\n      ? (raw.status as MeshNodeStatus)\n      : undefined;\n  return { id: raw.id, name: raw.name ?? '', status };\n};\n\n/** The node with this id, or `undefined` when it is gone (404 / code 1002, or soft-deleted). */\nexport const getNode = (accountId: string, nodeId: string) =>\n  zeroTrust.getTunnelWarpConnector({ accountId, tunnelId: nodeId }).pipe(\n    Effect.map(observe),\n    Effect.catchTag('TunnelNotFound', () => Effect.succeed(undefined)),\n  );\n\n/**\n * The live node with exactly this name, or `undefined`.\n *\n * ★ `name` is also sent as the list filter, but the match is re-checked here: the filter's\n *   exactness is not documented, and a prefix match would adopt the wrong node.\n * ⛔ Two live matches is refused rather than resolved. Names are unique per account (the create\n *   answers code 1013 otherwise), so two means something this package does not understand.\n */\nexport const findNodeByName = (accountId: string, name: string) =>\n  zeroTrust.listTunnelWarpConnectors.items({ accountId, name, isDeleted: false }).pipe(\n    Stream.map(observe),\n    Stream.filter((node): node is ObservedNode => node !== undefined && node.name === name),\n    Stream.runCollect,\n    Effect.flatMap((chunk) => {\n      const matches = Array.from(chunk);\n      if (matches.length <= 1) return Effect.succeed(matches[0]);\n      const ids = matches.map((node) => node.id).join(', ');\n      return Effect.fail(\n        new MeshNodeError({\n          message: `Mesh node name \"${name}\" matches ${matches.length} live nodes (${ids}). Names are unique per account, so refusing to guess which one is meant.`,\n        }),\n      );\n    }),\n  );\n\n/**\n * ⛔ `ha` IS SENT ON CREATE AND NOWHERE ELSE. Cloudflare's HA page: \"High availability is set at\n *   node creation time and cannot be changed afterward.\" The PATCH body (`PatchTunnelWarpConnector\n *   Request`) has only `name` and `tunnelSecret`.\n */\nexport const createNode = (accountId: string, name: string, ha: boolean) =>\n  zeroTrust.createTunnelWarpConnector({ accountId, name, ha }).pipe(\n    Effect.flatMap((raw) => {\n      const node = observe(raw);\n      return node === undefined\n        ? Effect.fail(\n            new MeshNodeError({ message: `Creating Mesh node \"${name}\" returned no id.` }),\n          )\n        : Effect.succeed(node);\n    }),\n  );\n\n/** ★ A rename is a PATCH: same id, same token, same enrolled replicas and Mesh IP. */\nexport const renameNode = (accountId: string, nodeId: string, name: string) =>\n  zeroTrust\n    .patchTunnelWarpConnector({ accountId, tunnelId: nodeId, name })\n    .pipe(Effect.map((raw) => observe(raw) ?? { id: nodeId, name, status: undefined }));\n\n/** Idempotent: a node already gone (404 / code 1002) is a successful delete. */\nexport const deleteNode = (accountId: string, nodeId: string) =>\n  zeroTrust.deleteTunnelWarpConnector({ accountId, tunnelId: nodeId }).pipe(\n    Effect.asVoid,\n    Effect.catchTag('TunnelNotFound', () => Effect.void),\n  );\n",
@@ -12,7 +12,7 @@
     "/**\n * The HomeFlare Cloudflare provider collection, in the shape `LiteLLM.providers()` has.\n *\n * ⚠️ THIS IS NOT `alchemy/Cloudflare`'s COLLECTION AND DOES NOT REPLACE IT. A stack that declares\n *   both a `Cloudflare.R2.Bucket` and this lock merges the two:\n *   `Layer.mergeAll(Cloudflare.providers(), HomeflareCloudflare.providers())` — the shape\n *   a consuming stack names for one talking to more than one account.\n *\n * ★ ONE CREDENTIAL PATH NOW, NOT TWO. Until 2026-09-23 `R2BucketLock` ran over the `cloudflare`\n *   npm SDK with its own `CLOUDFLARE_API_TOKEN` read (`client.ts`, since deleted) while `MeshNode`\n *   ran over `@distilled.cloud/cloudflare` through `Cloudflare.CloudflareApiLive()`. Both\n *   providers now call distilled, so both resolve credentials and the account the same way\n *   `Cloudflare.providers()` does (an Alchemy profile, or `CLOUDFLARE_API_TOKEN` +\n *   `CLOUDFLARE_ACCOUNT_ID` in CI) — a lock and the Gateway rules that reference the same bucket\n *   land in the same account.\n * ⚠️ THE LAYER IS BUILT TWICE ON PURPOSE, once per provider, even when the stack also merges\n *   `Cloudflare.providers()`. `Layer.provide`, not `provideMerge`: each feeds its own provider\n *   only and adds nothing to the stack's context.\n */\nimport * as Cloudflare from 'alchemy/Cloudflare';\nimport * as Provider from 'alchemy/Provider';\nimport * as Layer from 'effect/Layer';\nimport { MeshNode, MeshNodeProvider } from './mesh-node.ts';\nimport { R2BucketLock, R2BucketLockProvider } from './r2-bucket-lock.ts';\n\nexport class Providers extends Provider.ProviderCollection<Providers>()('HomeflareCloudflare') {}\n\n// ⛔ `orDie` ON BOTH, as `Cloudflare.providers()` ends with: a stack's providers layer must not\n//   fail, and a profile that cannot resolve is a defect carrying Alchemy's own sentence.\nexport const providers = () =>\n  Layer.effect(Providers, Provider.collection([R2BucketLock, MeshNode])).pipe(\n    Layer.provide(\n      Layer.mergeAll(\n        R2BucketLockProvider().pipe(Layer.provide(Cloudflare.CloudflareApiLive()), Layer.orDie),\n        MeshNodeProvider().pipe(Layer.provide(Cloudflare.CloudflareApiLive()), Layer.orDie),\n      ),\n    ),\n  );\n",
     "/**\n * House defaults on Alchemy's Website stacks — Astro and Vite, which is what we ship.\n *\n * ★ NOT Nextjs. The blog measured Website.Nextjs planning as **create** because it\n *   hashes source; adopt is `Worker`, not Nextjs. Do not add a Nextjs helper until an\n *   app actually deploys that way.\n *\n * ⛔ `disable_nodejs_process_v2` ON ASTRO IS LOAD-BEARING. Workerd process-v2 (compat\n *   date 2025-09-15) makes every Astro page return `[object Object]`. Vite/TanStack\n *   Start does not need that flag; it needs `nodejs_compat` (Alchemy already defaults\n *   it on Vite).\n *\n * ⛔ Alchemy injects `@alchemy.run/frontend-frameworks/astro`. Do not add\n *   `@astrojs/cloudflare` — that is the wrangler path.\n *\n * ★ Alchemy's Website props are an Effect-wrapped InputProps union. We do not re-export\n *   that type — isolatedDeclarations cannot name it. Extra Alchemy fields still pass\n *   through via the rest bag; the assertion is only at the call into Alchemy.\n */\nimport * as AdoptPolicy from 'alchemy/AdoptPolicy';\nimport * as Cloudflare from 'alchemy/Cloudflare';\nimport * as RemovalPolicy from 'alchemy/RemovalPolicy';\n\nconst ASTRO_FLAGS: readonly string[] = ['nodejs_compat', 'disable_nodejs_process_v2'];\n\nexport interface AstroWebsiteProps {\n  readonly rootDir?: string;\n  readonly name?: string;\n  readonly sessionKVBindingName?: string | false;\n  readonly compatibility?: { readonly flags?: readonly string[]; readonly date?: string };\n}\n\nexport interface ViteWebsiteProps {\n  readonly rootDir?: string;\n  readonly name?: string;\n}\n\n/**\n * `Cloudflare.Website.Astro` with house flags, no auto session KV, adopt+retain.\n *\n *     const site = yield* astroWebsite('subnetcalc', { rootDir });\n */\nexport function astroWebsite(\n  name: string,\n  props: AstroWebsiteProps,\n): ReturnType<typeof Cloudflare.Website.Astro> {\n  const flags = props.compatibility?.flags ?? ASTRO_FLAGS;\n  const merged = {\n    ...props,\n    name: props.name ?? name,\n    sessionKVBindingName: props.sessionKVBindingName ?? false,\n    compatibility: { ...props.compatibility, flags: [...flags] },\n  };\n  return Cloudflare.Website.Astro(name, merged as never).pipe(\n    AdoptPolicy.adopt(true),\n    RemovalPolicy.retain(),\n  );\n}\n\n/**\n * `Cloudflare.Website.Vite` — TanStack Start, SolidStart, static Vite.\n * `nodejs_compat` is Alchemy's Vite default; we do not add process-v2 here.\n *\n *     const app = yield* viteWebsite('aimto', { rootDir: webRoot });\n */\nexport function viteWebsite(\n  name: string,\n  props?: ViteWebsiteProps,\n): ReturnType<typeof Cloudflare.Website.Vite> {\n  const merged = { ...props, name: props?.name ?? name };\n  return Cloudflare.Website.Vite(name, merged as never).pipe(\n    AdoptPolicy.adopt(true),\n    RemovalPolicy.retain(),\n  );\n}\n"
   ],
-  "mappings": ";AAAA;AACA;AACA;AAiCA;AACA;AACA;AACA;AACA;;;ACZO,IAAM,iBAAiB,CAAC,UAC7B,MAAM,gBAAgB;AAQjB,SAAS,UAAU,CAAC,GAA0B,GAAmC;AAAA,EACtF,IAAI,EAAE,WAAW,EAAE;AAAA,IAAQ,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,CAAC,MAAM,UAAU;AAAA,IAC9B,MAAM,QAAQ,EAAE;AAAA,IAChB,IAAI,UAAU;AAAA,MAAW,OAAO;AAAA,IAChC,IAAI,KAAK,OAAO,MAAM,MAAM,KAAK,YAAY,MAAM;AAAA,MAAS,OAAO;AAAA,IACnE,KAAK,KAAK,UAAU,SAAS,MAAM,UAAU;AAAA,MAAK,OAAO;AAAA,IACzD,OAAO,IAAI,MAAM,CAAC,KAAK,WAAW,MAAM,SAAS;AAAA,IACjD,IAAI,GAAG,SAAS,GAAG;AAAA,MAAM,OAAO;AAAA,IAChC,IAAI,GAAG,SAAS;AAAA,MAAO,OAAO,GAAG,SAAS,SAAS,GAAG,kBAAkB,GAAG;AAAA,IAC3E,IAAI,GAAG,SAAS;AAAA,MAAQ,OAAO,GAAG,SAAS,UAAU,GAAG,SAAS,GAAG;AAAA,IACpE,OAAO;AAAA,GACR;AAAA;AASI,IAAM,SAAS,CAAC,WAA2D;AAAA,EAChF,OAAO,MAAM,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE;AAC1C;;;ADqBO,IAAM,eAA4C,SACvD,2BACA;AAAA,EAQE,sBAAsB;AACxB,CACF;AAwBO,IAAM,WAAW,CACtB,OACA,YAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,eAAe,eAAe,KAAK;AAAA,EACzC,MAAM,OAAO,OACV,iBAAc,EAAE,WAAW,MAAM,WAAW,YAAY,MAAM,YAAY,aAAa,CAAC,EACxF,KACQ,gBAAS,gBAAgB,MAAa,eAAQ,SAAS,CAAC,GACxD,YACT;AAAA,EACF,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAS,KAAK,SAAS,CAAC;AAAA,EAC9B,IAAI,MAAM,WAAW;AAAA,IAAG;AAAA,EACxB,MAAM,aAAqC;AAAA,IACzC,YAAY,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO,UAAU,aAAa,QAAQ,UAAU;AAAA,CACjD;AAWI,IAAM,gBAAgB,CAC3B,MACA,WAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,eAAe,eAAe,IAAI;AAAA,EACxC,IAAI,WAAW,aAAa,WAAW,OAAO,OAAO,KAAK,KAAK;AAAA,IAAG,OAAO;AAAA,EACzE,OACG,iBAAc;AAAA,IACb,WAAW,KAAK;AAAA,IAChB,YAAY,KAAK;AAAA,IACjB;AAAA,OACG,OAAO,KAAK,KAAK;AAAA,EACtB,CAAC,EACA,KAAY,YAAK;AAAA,EACpB,OAAO,EAAE,YAAY,KAAK,YAAY,cAAc,OAAO,KAAK,MAAM;AAAA,CACvE;AASI,IAAM,aAAa,CACxB,QACA,cAEO,WAAI,UAAU,GAAG;AAAA,EACtB,OACG,iBAAc;AAAA,IACb;AAAA,IACA,YAAY,OAAO;AAAA,IACnB,cAAc,OAAO;AAAA,IACrB,OAAO,CAAC;AAAA,EACV,CAAC,EACA,KAAY,YAAK;AAAA,CACrB;AAEI,IAAM,uBAAuB,MACzB,gBACP,cACO,WAAI,UAAU,GAAG;AAAA,EAKtB,MAAM,WAAmB,aAAK,aAAa,OAAO,WAAW,EAAE,KACrD,YAAe,uBAAY,OAAkB,qBAAU,CACjE;AAAA,EACA,MAAM,MAAM,CAAO,YACV,sBAAe,SAAQ,QAAQ;AAAA,EAExC,OAAO,aAAa,SAAS,GAAG;AAAA,IAc9B,MAAM,MAAa,eAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,EAAE,WAAW,KAAK;AAAA,IACxB,MAAa,UAAG,UAAU,GAAG,MAAM,UAAU;AAAA,MAC3C,MAAM,QAAQ,QAAQ;AAAA,MACtB,IAAI,UAAU;AAAA,QAAW;AAAA,MACzB,OAAO,OAAO,IAAI,SAAS,OAAO,WAAW,SAAS,CAAC;AAAA,KACxD;AAAA,IACD,WAAkB,UAAG,GAAG,MAAM,aAAa,IAAI,cAAc,MAAM,MAAM,CAAC,CAAC;AAAA,IAC3E,QAAe,UAAG,GAAG,MAAM,aAAa,IAAI,WAAW,QAAQ,KAAK,SAAS,CAAC,CAAC;AAAA,EACjF,CAAC;AAAA,CACF,CACH;;AEtNF,wBAAS;AACT;AACA;AACA;AACA,qBAAS;AACT;AACA;AACA;;;ACGA;AACA;AACA;AACA;AAAA;AAaO,MAAM,sBAA2B,iBAAY,eAAe,EAEhE;AAAC;AASJ,IAAM,WAA8B,CAAC,YAAY,YAAY,WAAW,MAAM;AAOvE,IAAM,UAAU,CAAC,QAAuC;AAAA,EAC7D,IAAI,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,WAAW;AAAA,IAAG;AAAA,EACvD,IAAI,IAAI,cAAc,aAAa,IAAI,cAAc;AAAA,IAAM;AAAA,EAC3D,MAAM,SACJ,OAAO,IAAI,WAAW,YAAY,SAAS,SAAS,IAAI,MAAM,IACzD,IAAI,SACL;AAAA,EACN,OAAO,EAAE,IAAI,IAAI,IAAI,MAAM,IAAI,QAAQ,IAAI,OAAO;AAAA;AAI7C,IAAM,UAAU,CAAC,WAAmB,WAC/B,iCAAuB,EAAE,WAAW,UAAU,OAAO,CAAC,EAAE,KACzD,YAAI,OAAO,GACX,iBAAS,kBAAkB,MAAa,gBAAQ,SAAS,CAAC,CACnE;AAUK,IAAM,iBAAiB,CAAC,WAAmB,SACtC,mCAAyB,MAAM,EAAE,WAAW,MAAM,WAAW,MAAM,CAAC,EAAE,KACvE,WAAI,OAAO,GACX,cAAO,CAAC,SAA+B,SAAS,aAAa,KAAK,SAAS,IAAI,GAC/E,mBACA,gBAAQ,CAAC,UAAU;AAAA,EACxB,MAAM,UAAU,MAAM,KAAK,KAAK;AAAA,EAChC,IAAI,QAAQ,UAAU;AAAA,IAAG,OAAc,gBAAQ,QAAQ,EAAE;AAAA,EACzD,MAAM,MAAM,QAAQ,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,KAAK,IAAI;AAAA,EACpD,OAAc,aACZ,IAAI,cAAc;AAAA,IAChB,SAAS,mBAAmB,iBAAiB,QAAQ,sBAAsB;AAAA,EAC7E,CAAC,CACH;AAAA,CACD,CACH;AAOK,IAAM,aAAa,CAAC,WAAmB,MAAc,OAChD,oCAA0B,EAAE,WAAW,MAAM,GAAG,CAAC,EAAE,KACpD,gBAAQ,CAAC,QAAQ;AAAA,EACtB,MAAM,OAAO,QAAQ,GAAG;AAAA,EACxB,OAAO,SAAS,YACL,aACL,IAAI,cAAc,EAAE,SAAS,uBAAuB,wBAAwB,CAAC,CAC/E,IACO,gBAAQ,IAAI;AAAA,CACxB,CACH;AAGK,IAAM,aAAa,CAAC,WAAmB,QAAgB,SAEzD,mCAAyB,EAAE,WAAW,UAAU,QAAQ,KAAK,CAAC,EAC9D,KAAY,YAAI,CAAC,QAAQ,QAAQ,GAAG,KAAK,EAAE,IAAI,QAAQ,MAAM,QAAQ,UAAU,CAAC,CAAC;AAG/E,IAAM,aAAa,CAAC,WAAmB,WAClC,oCAA0B,EAAE,WAAW,UAAU,OAAO,CAAC,EAAE,KAC5D,gBACA,iBAAS,kBAAkB,MAAa,YAAI,CACrD;;;AClEK,IAAM,mBAAmB,CAAC,UAAoD;AAAA,EACnF,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,KAAK,EAAE,WAAW,GAAG;AAAA,IACpE,OAAO,IAAI,cAAc,EAAE,SAAS,8CAA8C,CAAC;AAAA,EACrF;AAAA,EACA,IAAI,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG;AAAA,IACpC,OAAO,IAAI,cAAc;AAAA,MACvB,SAAS,kBAAkB,MAAM;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EACA,IAAI,OAAO,MAAM,OAAO,WAAW;AAAA,IACjC,OAAO,IAAI,cAAc;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EACA;AAAA;AAwBK,IAAM,eAAe,CAC1B,MACA,QACA,cACqB;AAAA,EACrB,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC/D,MAAM,SAAS;AAAA,EACf,MAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,EAC7D,IAAI,OAAO,OAAO,OAAO,aAAa,OAAO,OAAO,OAAO,IAAI;AAAA,IAC7D,MAAM,WAAW,SAAS,aAAa,SAAS,OAAO;AAAA,IACvD,OAAO,WAAW,EAAE,QAAQ,WAAW,aAAa,KAAK,IAAI,EAAE,QAAQ,UAAU;AAAA,EACnF;AAAA,EACA,IAAI,SAAS,aAAa,SAAS,OAAO;AAAA,IAAM,OAAO,EAAE,QAAQ,SAAS;AAAA,EAC1E;AAAA;;;AC7GF,oBAAS;AACT;AAYA,IAAM,eAAe,CAAC,MAAoB,WAAmB,QAAqC;AAAA,EAChG,IAAI,KAAK;AAAA,EACT;AAAA,EACA,MAAM,KAAK;AAAA,EACX,QAAQ,KAAK;AAAA,EACb;AACF;AAYO,IAAM,eAAe,CAC1B,WACA,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,QAAQ,aAAa;AAAA,EACrC,IAAI,WAAW,WAAW;AAAA,IACxB,MAAM,OAAO,OAAO,QAAQ,SAAS,OAAO,EAAE;AAAA,IAC9C,IAAI,SAAS;AAAA,MAAW,OAAO,aAAa,MAAM,SAAS,OAAO,EAAE;AAAA,EACtE;AAAA,EACA,MAAM,OAAO,MAAM,QAAQ,QAAQ;AAAA,EACnC,MAAM,KAAK,MAAM,MAAM,QAAQ;AAAA,EAC/B,IAAI,SAAS,aAAa,OAAO;AAAA,IAAW;AAAA,EAC5C,MAAM,QAAQ,OAAO,eAAe,SAAS,IAAI;AAAA,EACjD,OAAO,UAAU,YAAY,YAAY,SAAQ,aAAa,OAAO,SAAS,EAAE,CAAC;AAAA,CAClF;AAWH,IAAM,YAAY,CAAC,MAAc,WAC/B,IAAI,cAAc;AAAA,EAChB,SACE,mBAAmB,yBAAyB,gDAC5C;AACJ,CAAC;AASH,IAAM,QACJ,iGACA;AAiBF,IAAM,mBAAmB,CAAC,MAAc,WACtC,IAAI,cAAc;AAAA,EAChB,SACE,cAAc,yBAAyB,uDACvC,6FACA,0EACA,gGACA,6FACA,4EAA4E,iBAC5E,6FACA,+DAA+D;AACnE,CAAC;AAaH,IAAM,QAAQ,CAAC,WAAmB,SAChC,eAAe,WAAW,IAAI,EAAE,KACvB,gBAAQ,CAAC,WACP,aACL,WAAW,YAIP,UAAU,MAAM,mEAAmE,IACnF,IAAI,cAAc;AAAA,EAChB,SACE,cAAc,UAAU,OAAO,uDAC/B,uFACA,kFACA,qEACA,GAAG,uEACH;AACJ,CAAC,CACP,CACF,CACF;AAEF,IAAM,cAAc,CAAC,WAAmB,SAC/B,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,eAAe,WAAW,KAAK,IAAI;AAAA,EAC3D,IAAI,aAAa;AAAA,IAAW,OAAO,OAAc,aAAK,iBAAiB,KAAK,MAAM,SAAS,EAAE,CAAC;AAAA,EAC9F,MAAM,OAAO,OAAO,WAAW,WAAW,KAAK,MAAM,KAAK,EAAE,EAAE,KACrD,iBAAS,uBAAuB,MAAM,MAAM,WAAW,KAAK,IAAI,CAAC,CAC1E;AAAA,EACA,OAAO,aAAa,MAAM,WAAW,KAAK,EAAE;AAAA,CAC7C;AAEI,IAAM,oBAAoB,CAC/B,WACA,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,iBAAiB,IAAI;AAAA,EACrC,IAAI,YAAY;AAAA,IAAW,OAAO,OAAc,aAAK,OAAO;AAAA,EAC5D,MAAM,QAAQ,WAAW,aAAa,OAAO,cAAc,YAAY,SAAS;AAAA,EAChF,MAAM,OAAO,UAAU,YAAY,YAAY,OAAO,QAAQ,WAAW,MAAM,EAAE;AAAA,EAEjF,IAAI,UAAU,aAAa,SAAS;AAAA,IAAW,OAAO,OAAO,YAAY,WAAW,IAAI;AAAA,EACxF,IAAI,MAAM,OAAO,KAAK,IAAI;AAAA,IAExB,OAAO,OAAc,aACnB,IAAI,cAAc;AAAA,MAChB,SAAS,aAAa,KAAK,wCAAwC,MAAM,gBAAgB,KAAK;AAAA,IAChG,CAAC,CACH;AAAA,EACF;AAAA,EACA,IAAI,KAAK,SAAS,KAAK;AAAA,IAAM,OAAO,aAAa,MAAM,WAAW,MAAM,EAAE;AAAA,EAC1E,MAAM,UAAU,OAAO,WAAW,WAAW,KAAK,IAAI,KAAK,IAAI,EAAE,KACxD,iBAAS,uBAAuB,MAC9B,aAAK,UAAU,KAAK,MAAM,wBAAwB,CAAC,CAC5D,CACF;AAAA,EACA,OAAO,aAAa,SAAS,WAAW,MAAM,EAAE;AAAA,CACjD;AAOI,IAAM,iBAAiB,CAAC,WAC7B,WAAW,OAAO,WAAW,OAAO,EAAE;;;AHtIjC,IAAM,WAAoC,UAAmB,uBAAuB;AAAA,EACzF,sBAAsB;AACxB,CAAC;AASD,IAAM,YAAmB,YAAI,UAAU,GAAG;AAAA,EACxC,MAAM,WAAW,OAAO,OAAkB;AAAA,EAC1C,OAAO,SAAS;AAAA,CACjB;AASM,IAAM,mBAAmB,MACrB,iBACP,UACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAmB,cACZ,kCACX,OAAkB,gCACpB,EAAE,KACQ,aAAI,cAAa,OAAO,YAAW,GACnC,aAAe,wBAAY,OAAkB,sBAAU,CACjE;AAAA,EACA,MAAM,MAAM,CAAO,YACV,uBAAe,SAAQ,QAAQ;AAAA,EAExC,OAAO,SAAS,SAAS,GAAG;AAAA,IAC1B,SAAS,CAAC,MAAM,aAAa,IAAI;AAAA,IAMjC,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,IAOnB,MAAM,GAAG,MAAM,aACb,IACS,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,UAAU,WAAW,IAAI,IAAI,iBAAiB,IAAI,IAAI;AAAA,MAC5D,IAAI,YAAY;AAAA,QAAW,OAAO,OAAc,aAAK,OAAO;AAAA,MAC5D,OAAO,aAAa,MAAM,QAAQ,OAAO,SAAS;AAAA,KACnD,CACH;AAAA,IACF,MAAM,GAAG,MAAM,aACb,IAAW,gBAAQ,WAAW,CAAC,YAAY,aAAa,SAAS,MAAM,MAAM,CAAC,CAAC;AAAA,IACjF,WAAW,GAAG,MAAM,aAClB,IAAW,gBAAQ,WAAW,CAAC,YAAY,kBAAkB,SAAS,MAAM,MAAM,CAAC,CAAC;AAAA,IACtF,QAAQ,GAAG,aAAa,IAAI,eAAe,MAAM,CAAC;AAAA,EACpD,CAAC;AAAA,CACF,CACH;;AI5FF,wBAAS;AACT;AACA;AACA;AAqBA,IAAM,eAAsB,YAAI,UAAU,GAAG;AAAA,EAC3C,KAAK,WAAW,SAAS,MAAM,2BAA2B,QAAQ,IAAI;AAAA,IACpE,OAAO,OAAc,aACnB,IAAI,cAAc;AAAA,MAChB,SACE;AAAA,IACJ,CAAC,CACH;AAAA,EACF;AAAA,EACA,MAAM,cAAc,OAAO,OAAO;AAAA,EAClC,IAAI,YAAY,SAAS,UAAU;AAAA,IACjC,OAAO,OAAc,aACnB,IAAI,cAAc;AAAA,MAChB,SACE;AAAA,IACJ,CAAC,CACH;AAAA,EACF;AAAA,EACA,IAAI,YAAY,SAAS,cAAuB,eAAM,YAAY,QAAQ,EAAE,WAAW,GAAG;AAAA,IACxF,OAAO,OAAc,aACnB,IAAI,cAAc;AAAA,MAChB,SACE;AAAA,IACJ,CAAC,CACH;AAAA,EACF;AAAA,CACD;AAED,IAAM,YAAY,CAAC,QAAqB;AAAA,EACtC,IAAI,IAAI,OAAO;AAAA,IAAW,OAAc,gBAAQ,IAAI,EAAE;AAAA,EACtD,MAAM,OAAO,IAAI;AAAA,EACjB,OAAc,gBAAQ,eAAe,IAAI,WAAW,IAAI,GAAG,CAAC,SAC1D,SAAS,YACE,aAAK,IAAI,cAAc,EAAE,SAAS,4BAA4B,SAAS,CAAC,CAAC,IACzE,gBAAQ,KAAK,EAAE,CAC5B;AAAA;AAUK,IAAM,qBAAqB,CAAC,QAC1B,YAAI,UAAU,GAAG;AAAA,EACtB,OAAO;AAAA,EACP,MAAM,SAAS,OAAO,UAAU,GAAG;AAAA,EACnC,MAAM,QAAQ,OACX,uCAA4B,EAAE,WAAW,IAAI,WAAW,UAAU,OAAO,CAAC,EAC1E,KACQ,iBAAS,kBAAkB,MACzB,aACL,IAAI,cAAc;AAAA,IAChB,SAAS,aAAa,oCAAoC,IAAI;AAAA,EAChE,CAAC,CACH,CACF,GACO,iBAAS,aAAa,MACpB,aACL,IAAI,cAAc;AAAA,IAChB,SAAS,qBAAqB,mJAAmJ,IAAI;AAAA,EACvL,CAAC,CACH,CACF,CACF;AAAA,EACF,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AAAA,IACnD,OAAO,OAAc,aACnB,IAAI,cAAc,EAAE,SAAS,aAAa,kCAAkC,CAAC,CAC/E;AAAA,EACF;AAAA,EACA,OAAgB,cAAK,KAAK;AAAA,CAC3B;;ACzGH;AACA;AACA;AAIO,MAAM,kBAA2B,6BAA8B,EAAE,qBAAqB,EAAE;AAAC;AAIzF,IAAM,YAAY,MACjB,aAAO,WAAoB,qBAAW,CAAC,cAAc,QAAQ,CAAC,CAAC,EAAE,KAC/D,cACE,eACJ,qBAAqB,EAAE,KAAW,cAAmB,8BAAkB,CAAC,GAAS,WAAK,GACtF,iBAAiB,EAAE,KAAW,cAAmB,8BAAkB,CAAC,GAAS,WAAK,CACpF,CACF,CACF;;AClBF;AACA;AACA;AAEA,IAAM,cAAiC,CAAC,iBAAiB,2BAA2B;AAmB7E,SAAS,YAAY,CAC1B,MACA,OAC6C;AAAA,EAC7C,MAAM,QAAQ,MAAM,eAAe,SAAS;AAAA,EAC5C,MAAM,SAAS;AAAA,OACV;AAAA,IACH,MAAM,MAAM,QAAQ;AAAA,IACpB,sBAAsB,MAAM,wBAAwB;AAAA,IACpD,eAAe,KAAK,MAAM,eAAe,OAAO,CAAC,GAAG,KAAK,EAAE;AAAA,EAC7D;AAAA,EACA,OAAkB,oBAAQ,MAAM,MAAM,MAAe,EAAE,KACzC,kBAAM,IAAI,GACR,qBAAO,CACvB;AAAA;AASK,SAAS,WAAW,CACzB,MACA,OAC4C;AAAA,EAC5C,MAAM,SAAS,KAAK,OAAO,MAAM,OAAO,QAAQ,KAAK;AAAA,EACrD,OAAkB,oBAAQ,KAAK,MAAM,MAAe,EAAE,KACxC,kBAAM,IAAI,GACR,qBAAO,CACvB;AAAA;",
-  "debugId": "AB671D282C098EA364756E2164756E21",
+  "mappings": ";AAAA;AACA;AACA;AAiCA;AACA;AACA;AACA;AACA;;;ACZO,IAAM,iBAAiB,CAAC,UAC7B,MAAM,gBAAgB;AAQjB,SAAS,UAAU,CAAC,GAA0B,GAAmC;AAAA,EACtF,IAAI,EAAE,WAAW,EAAE;AAAA,IAAQ,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,CAAC,MAAM,UAAU;AAAA,IAC9B,MAAM,QAAQ,EAAE;AAAA,IAChB,IAAI,UAAU;AAAA,MAAW,OAAO;AAAA,IAChC,IAAI,KAAK,OAAO,MAAM,MAAM,KAAK,YAAY,MAAM;AAAA,MAAS,OAAO;AAAA,IACnE,KAAK,KAAK,UAAU,SAAS,MAAM,UAAU;AAAA,MAAK,OAAO;AAAA,IACzD,OAAO,IAAI,MAAM,CAAC,KAAK,WAAW,MAAM,SAAS;AAAA,IACjD,IAAI,GAAG,SAAS,GAAG;AAAA,MAAM,OAAO;AAAA,IAChC,IAAI,GAAG,SAAS;AAAA,MAAO,OAAO,GAAG,SAAS,SAAS,GAAG,kBAAkB,GAAG;AAAA,IAC3E,IAAI,GAAG,SAAS;AAAA,MAAQ,OAAO,GAAG,SAAS,UAAU,GAAG,SAAS,GAAG;AAAA,IACpE,OAAO;AAAA,GACR;AAAA;AASI,IAAM,SAAS,CAAC,WAA2D;AAAA,EAChF,OAAO,MAAM,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE;AAC1C;;;ADqBO,IAAM,eAA4C,SACvD,2BACA;AAAA,EAQE,sBAAsB;AACxB,CACF;AA0BO,IAAM,WAAW,CACtB,OACA,YAMO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,eAAe,eAAe,KAAK;AAAA,EACzC,MAAM,OAAO,OACV,iBAAc,EAAE,WAAW,MAAM,WAAW,YAAY,MAAM,YAAY,aAAa,CAAC,EACxF,KAAY,gBAAS,gBAAgB,MAAa,eAAQ,SAAS,CAAC,CAAC;AAAA,EACxE,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAS,KAAK,SAAS,CAAC;AAAA,EAC9B,IAAI,MAAM,WAAW;AAAA,IAAG;AAAA,EACxB,MAAM,aAAqC;AAAA,IACzC,YAAY,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO,UAAU,aAAa,QAAQ,UAAU;AAAA,CACjD;AAWI,IAAM,gBAAgB,CAC3B,MACA,WAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,eAAe,eAAe,IAAI;AAAA,EACxC,IAAI,WAAW,aAAa,WAAW,OAAO,OAAO,KAAK,KAAK;AAAA,IAAG,OAAO;AAAA,EACzE,OAAU,iBAAc;AAAA,IACtB,WAAW,KAAK;AAAA,IAChB,YAAY,KAAK;AAAA,IACjB;AAAA,OACG,OAAO,KAAK,KAAK;AAAA,EACtB,CAAC;AAAA,EACD,OAAO,EAAE,YAAY,KAAK,YAAY,cAAc,OAAO,KAAK,MAAM;AAAA,CACvE;AAWI,IAAM,aAAa,CACxB,QACA,cAMO,WAAI,UAAU,GAAG;AAAA,EACtB,OACG,iBAAc;AAAA,IACb;AAAA,IACA,YAAY,OAAO;AAAA,IACnB,cAAc,OAAO;AAAA,IACrB,OAAO,CAAC;AAAA,EACV,CAAC,EACA,KAAY,gBAAS,gBAAgB,MAAa,WAAI,CAAC;AAAA,CAC3D;AAEI,IAAM,uBAAuB,MACzB,gBACP,cACO,WAAI,UAAU,GAAG;AAAA,EAKtB,MAAM,WAAmB,aAAK,aAAa,OAAO,WAAW,EAAE,KACrD,YAAe,uBAAY,OAAkB,qBAAU,CACjE;AAAA,EACA,MAAM,MAAM,CAAO,YACV,sBAAe,SAAQ,QAAQ;AAAA,EAExC,OAAO,aAAa,SAAS,GAAG;AAAA,IAc9B,MAAM,MAAa,eAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,EAAE,WAAW,KAAK;AAAA,IACxB,MAAa,UAAG,UAAU,GAAG,MAAM,UAAU;AAAA,MAC3C,MAAM,QAAQ,QAAQ;AAAA,MACtB,IAAI,UAAU;AAAA,QAAW;AAAA,MACzB,OAAO,OAAO,IAAI,SAAS,OAAO,WAAW,SAAS,CAAC;AAAA,KACxD;AAAA,IACD,WAAkB,UAAG,GAAG,MAAM,aAAa,IAAI,cAAc,MAAM,MAAM,CAAC,CAAC;AAAA,IAC3E,QAAe,UAAG,GAAG,MAAM,aAAa,IAAI,WAAW,QAAQ,KAAK,SAAS,CAAC,CAAC;AAAA,EACjF,CAAC;AAAA,CACF,CACH;;AE7NF,wBAAS;AACT;AACA;AACA;AACA,qBAAS;AACT;AACA;AACA;;;ACGA;AACA;AACA;AACA;AAAA;AAaO,MAAM,sBAA2B,iBAAY,eAAe,EAEhE;AAAC;AASJ,IAAM,WAA8B,CAAC,YAAY,YAAY,WAAW,MAAM;AAOvE,IAAM,UAAU,CAAC,QAAuC;AAAA,EAC7D,IAAI,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,WAAW;AAAA,IAAG;AAAA,EACvD,IAAI,IAAI,cAAc,aAAa,IAAI,cAAc;AAAA,IAAM;AAAA,EAC3D,MAAM,SACJ,OAAO,IAAI,WAAW,YAAY,SAAS,SAAS,IAAI,MAAM,IACzD,IAAI,SACL;AAAA,EACN,OAAO,EAAE,IAAI,IAAI,IAAI,MAAM,IAAI,QAAQ,IAAI,OAAO;AAAA;AAI7C,IAAM,UAAU,CAAC,WAAmB,WAC/B,iCAAuB,EAAE,WAAW,UAAU,OAAO,CAAC,EAAE,KACzD,YAAI,OAAO,GACX,iBAAS,kBAAkB,MAAa,gBAAQ,SAAS,CAAC,CACnE;AAUK,IAAM,iBAAiB,CAAC,WAAmB,SACtC,mCAAyB,MAAM,EAAE,WAAW,MAAM,WAAW,MAAM,CAAC,EAAE,KACvE,WAAI,OAAO,GACX,cAAO,CAAC,SAA+B,SAAS,aAAa,KAAK,SAAS,IAAI,GAC/E,mBACA,gBAAQ,CAAC,UAAU;AAAA,EACxB,MAAM,UAAU,MAAM,KAAK,KAAK;AAAA,EAChC,IAAI,QAAQ,UAAU;AAAA,IAAG,OAAc,gBAAQ,QAAQ,EAAE;AAAA,EACzD,MAAM,MAAM,QAAQ,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,KAAK,IAAI;AAAA,EACpD,OAAc,aACZ,IAAI,cAAc;AAAA,IAChB,SAAS,mBAAmB,iBAAiB,QAAQ,sBAAsB;AAAA,EAC7E,CAAC,CACH;AAAA,CACD,CACH;AAOK,IAAM,aAAa,CAAC,WAAmB,MAAc,OAChD,oCAA0B,EAAE,WAAW,MAAM,GAAG,CAAC,EAAE,KACpD,gBAAQ,CAAC,QAAQ;AAAA,EACtB,MAAM,OAAO,QAAQ,GAAG;AAAA,EACxB,OAAO,SAAS,YACL,aACL,IAAI,cAAc,EAAE,SAAS,uBAAuB,wBAAwB,CAAC,CAC/E,IACO,gBAAQ,IAAI;AAAA,CACxB,CACH;AAGK,IAAM,aAAa,CAAC,WAAmB,QAAgB,SAEzD,mCAAyB,EAAE,WAAW,UAAU,QAAQ,KAAK,CAAC,EAC9D,KAAY,YAAI,CAAC,QAAQ,QAAQ,GAAG,KAAK,EAAE,IAAI,QAAQ,MAAM,QAAQ,UAAU,CAAC,CAAC;AAG/E,IAAM,aAAa,CAAC,WAAmB,WAClC,oCAA0B,EAAE,WAAW,UAAU,OAAO,CAAC,EAAE,KAC5D,gBACA,iBAAS,kBAAkB,MAAa,YAAI,CACrD;;;AClEK,IAAM,mBAAmB,CAAC,UAAoD;AAAA,EACnF,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,KAAK,EAAE,WAAW,GAAG;AAAA,IACpE,OAAO,IAAI,cAAc,EAAE,SAAS,8CAA8C,CAAC;AAAA,EACrF;AAAA,EACA,IAAI,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG;AAAA,IACpC,OAAO,IAAI,cAAc;AAAA,MACvB,SAAS,kBAAkB,MAAM;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EACA,IAAI,OAAO,MAAM,OAAO,WAAW;AAAA,IACjC,OAAO,IAAI,cAAc;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EACA;AAAA;AAwBK,IAAM,eAAe,CAC1B,MACA,QACA,cACqB;AAAA,EACrB,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC/D,MAAM,SAAS;AAAA,EACf,MAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,EAC7D,IAAI,OAAO,OAAO,OAAO,aAAa,OAAO,OAAO,OAAO,IAAI;AAAA,IAC7D,MAAM,WAAW,SAAS,aAAa,SAAS,OAAO;AAAA,IACvD,OAAO,WAAW,EAAE,QAAQ,WAAW,aAAa,KAAK,IAAI,EAAE,QAAQ,UAAU;AAAA,EACnF;AAAA,EACA,IAAI,SAAS,aAAa,SAAS,OAAO;AAAA,IAAM,OAAO,EAAE,QAAQ,SAAS;AAAA,EAC1E;AAAA;;;AC7GF,oBAAS;AACT;AAYA,IAAM,eAAe,CAAC,MAAoB,WAAmB,QAAqC;AAAA,EAChG,IAAI,KAAK;AAAA,EACT;AAAA,EACA,MAAM,KAAK;AAAA,EACX,QAAQ,KAAK;AAAA,EACb;AACF;AAYO,IAAM,eAAe,CAC1B,WACA,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,QAAQ,aAAa;AAAA,EACrC,IAAI,WAAW,WAAW;AAAA,IACxB,MAAM,OAAO,OAAO,QAAQ,SAAS,OAAO,EAAE;AAAA,IAC9C,IAAI,SAAS;AAAA,MAAW,OAAO,aAAa,MAAM,SAAS,OAAO,EAAE;AAAA,EACtE;AAAA,EACA,MAAM,OAAO,MAAM,QAAQ,QAAQ;AAAA,EACnC,MAAM,KAAK,MAAM,MAAM,QAAQ;AAAA,EAC/B,IAAI,SAAS,aAAa,OAAO;AAAA,IAAW;AAAA,EAC5C,MAAM,QAAQ,OAAO,eAAe,SAAS,IAAI;AAAA,EACjD,OAAO,UAAU,YAAY,YAAY,SAAQ,aAAa,OAAO,SAAS,EAAE,CAAC;AAAA,CAClF;AAWH,IAAM,YAAY,CAAC,MAAc,WAC/B,IAAI,cAAc;AAAA,EAChB,SACE,mBAAmB,yBAAyB,gDAC5C;AACJ,CAAC;AASH,IAAM,QACJ,iGACA;AAiBF,IAAM,mBAAmB,CAAC,MAAc,WACtC,IAAI,cAAc;AAAA,EAChB,SACE,cAAc,yBAAyB,uDACvC,6FACA,0EACA,gGACA,6FACA,4EAA4E,iBAC5E,6FACA,+DAA+D;AACnE,CAAC;AAaH,IAAM,QAAQ,CAAC,WAAmB,SAChC,eAAe,WAAW,IAAI,EAAE,KACvB,gBAAQ,CAAC,WACP,aACL,WAAW,YAIP,UAAU,MAAM,mEAAmE,IACnF,IAAI,cAAc;AAAA,EAChB,SACE,cAAc,UAAU,OAAO,uDAC/B,uFACA,kFACA,qEACA,GAAG,uEACH;AACJ,CAAC,CACP,CACF,CACF;AAEF,IAAM,cAAc,CAAC,WAAmB,SAC/B,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,eAAe,WAAW,KAAK,IAAI;AAAA,EAC3D,IAAI,aAAa;AAAA,IAAW,OAAO,OAAc,aAAK,iBAAiB,KAAK,MAAM,SAAS,EAAE,CAAC;AAAA,EAC9F,MAAM,OAAO,OAAO,WAAW,WAAW,KAAK,MAAM,KAAK,EAAE,EAAE,KACrD,iBAAS,uBAAuB,MAAM,MAAM,WAAW,KAAK,IAAI,CAAC,CAC1E;AAAA,EACA,OAAO,aAAa,MAAM,WAAW,KAAK,EAAE;AAAA,CAC7C;AAEI,IAAM,oBAAoB,CAC/B,WACA,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,iBAAiB,IAAI;AAAA,EACrC,IAAI,YAAY;AAAA,IAAW,OAAO,OAAc,aAAK,OAAO;AAAA,EAC5D,MAAM,QAAQ,WAAW,aAAa,OAAO,cAAc,YAAY,SAAS;AAAA,EAChF,MAAM,OAAO,UAAU,YAAY,YAAY,OAAO,QAAQ,WAAW,MAAM,EAAE;AAAA,EAEjF,IAAI,UAAU,aAAa,SAAS;AAAA,IAAW,OAAO,OAAO,YAAY,WAAW,IAAI;AAAA,EACxF,IAAI,MAAM,OAAO,KAAK,IAAI;AAAA,IAExB,OAAO,OAAc,aACnB,IAAI,cAAc;AAAA,MAChB,SAAS,aAAa,KAAK,wCAAwC,MAAM,gBAAgB,KAAK;AAAA,IAChG,CAAC,CACH;AAAA,EACF;AAAA,EACA,IAAI,KAAK,SAAS,KAAK;AAAA,IAAM,OAAO,aAAa,MAAM,WAAW,MAAM,EAAE;AAAA,EAC1E,MAAM,UAAU,OAAO,WAAW,WAAW,KAAK,IAAI,KAAK,IAAI,EAAE,KACxD,iBAAS,uBAAuB,MAC9B,aAAK,UAAU,KAAK,MAAM,wBAAwB,CAAC,CAC5D,CACF;AAAA,EACA,OAAO,aAAa,SAAS,WAAW,MAAM,EAAE;AAAA,CACjD;AAOI,IAAM,iBAAiB,CAAC,WAC7B,WAAW,OAAO,WAAW,OAAO,EAAE;;;AHtIjC,IAAM,WAAoC,UAAmB,uBAAuB;AAAA,EACzF,sBAAsB;AACxB,CAAC;AASD,IAAM,YAAmB,YAAI,UAAU,GAAG;AAAA,EACxC,MAAM,WAAW,OAAO,OAAkB;AAAA,EAC1C,OAAO,SAAS;AAAA,CACjB;AASM,IAAM,mBAAmB,MACrB,iBACP,UACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAmB,cACZ,kCACX,OAAkB,gCACpB,EAAE,KACQ,aAAI,cAAa,OAAO,YAAW,GACnC,aAAe,wBAAY,OAAkB,sBAAU,CACjE;AAAA,EACA,MAAM,MAAM,CAAO,YACV,uBAAe,SAAQ,QAAQ;AAAA,EAExC,OAAO,SAAS,SAAS,GAAG;AAAA,IAC1B,SAAS,CAAC,MAAM,aAAa,IAAI;AAAA,IAMjC,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,IAOnB,MAAM,GAAG,MAAM,aACb,IACS,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,UAAU,WAAW,IAAI,IAAI,iBAAiB,IAAI,IAAI;AAAA,MAC5D,IAAI,YAAY;AAAA,QAAW,OAAO,OAAc,aAAK,OAAO;AAAA,MAC5D,OAAO,aAAa,MAAM,QAAQ,OAAO,SAAS;AAAA,KACnD,CACH;AAAA,IACF,MAAM,GAAG,MAAM,aACb,IAAW,gBAAQ,WAAW,CAAC,YAAY,aAAa,SAAS,MAAM,MAAM,CAAC,CAAC;AAAA,IACjF,WAAW,GAAG,MAAM,aAClB,IAAW,gBAAQ,WAAW,CAAC,YAAY,kBAAkB,SAAS,MAAM,MAAM,CAAC,CAAC;AAAA,IACtF,QAAQ,GAAG,aAAa,IAAI,eAAe,MAAM,CAAC;AAAA,EACpD,CAAC;AAAA,CACF,CACH;;AI5FF,wBAAS;AACT;AACA;AACA;AAqBA,IAAM,eAAsB,YAAI,UAAU,GAAG;AAAA,EAC3C,KAAK,WAAW,SAAS,MAAM,2BAA2B,QAAQ,IAAI;AAAA,IACpE,OAAO,OAAc,aACnB,IAAI,cAAc;AAAA,MAChB,SACE;AAAA,IACJ,CAAC,CACH;AAAA,EACF;AAAA,EACA,MAAM,cAAc,OAAO,OAAO;AAAA,EAClC,IAAI,YAAY,SAAS,UAAU;AAAA,IACjC,OAAO,OAAc,aACnB,IAAI,cAAc;AAAA,MAChB,SACE;AAAA,IACJ,CAAC,CACH;AAAA,EACF;AAAA,EACA,IAAI,YAAY,SAAS,cAAuB,eAAM,YAAY,QAAQ,EAAE,WAAW,GAAG;AAAA,IACxF,OAAO,OAAc,aACnB,IAAI,cAAc;AAAA,MAChB,SACE;AAAA,IACJ,CAAC,CACH;AAAA,EACF;AAAA,CACD;AAED,IAAM,YAAY,CAAC,QAAqB;AAAA,EACtC,IAAI,IAAI,OAAO;AAAA,IAAW,OAAc,gBAAQ,IAAI,EAAE;AAAA,EACtD,MAAM,OAAO,IAAI;AAAA,EACjB,OAAc,gBAAQ,eAAe,IAAI,WAAW,IAAI,GAAG,CAAC,SAC1D,SAAS,YACE,aAAK,IAAI,cAAc,EAAE,SAAS,4BAA4B,SAAS,CAAC,CAAC,IACzE,gBAAQ,KAAK,EAAE,CAC5B;AAAA;AAUK,IAAM,qBAAqB,CAAC,QAC1B,YAAI,UAAU,GAAG;AAAA,EACtB,OAAO;AAAA,EACP,MAAM,SAAS,OAAO,UAAU,GAAG;AAAA,EACnC,MAAM,QAAQ,OACX,uCAA4B,EAAE,WAAW,IAAI,WAAW,UAAU,OAAO,CAAC,EAC1E,KACQ,iBAAS,kBAAkB,MACzB,aACL,IAAI,cAAc;AAAA,IAChB,SAAS,aAAa,oCAAoC,IAAI;AAAA,EAChE,CAAC,CACH,CACF,GACO,iBAAS,aAAa,MACpB,aACL,IAAI,cAAc;AAAA,IAChB,SAAS,qBAAqB,mJAAmJ,IAAI;AAAA,EACvL,CAAC,CACH,CACF,CACF;AAAA,EACF,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AAAA,IACnD,OAAO,OAAc,aACnB,IAAI,cAAc,EAAE,SAAS,aAAa,kCAAkC,CAAC,CAC/E;AAAA,EACF;AAAA,EACA,OAAgB,cAAK,KAAK;AAAA,CAC3B;;ACzGH;AACA;AACA;AAIO,MAAM,kBAA2B,6BAA8B,EAAE,qBAAqB,EAAE;AAAC;AAIzF,IAAM,YAAY,MACjB,aAAO,WAAoB,qBAAW,CAAC,cAAc,QAAQ,CAAC,CAAC,EAAE,KAC/D,cACE,eACJ,qBAAqB,EAAE,KAAW,cAAmB,8BAAkB,CAAC,GAAS,WAAK,GACtF,iBAAiB,EAAE,KAAW,cAAmB,8BAAkB,CAAC,GAAS,WAAK,CACpF,CACF,CACF;;AClBF;AACA;AACA;AAEA,IAAM,cAAiC,CAAC,iBAAiB,2BAA2B;AAmB7E,SAAS,YAAY,CAC1B,MACA,OAC6C;AAAA,EAC7C,MAAM,QAAQ,MAAM,eAAe,SAAS;AAAA,EAC5C,MAAM,SAAS;AAAA,OACV;AAAA,IACH,MAAM,MAAM,QAAQ;AAAA,IACpB,sBAAsB,MAAM,wBAAwB;AAAA,IACpD,eAAe,KAAK,MAAM,eAAe,OAAO,CAAC,GAAG,KAAK,EAAE;AAAA,EAC7D;AAAA,EACA,OAAkB,oBAAQ,MAAM,MAAM,MAAe,EAAE,KACzC,kBAAM,IAAI,GACR,qBAAO,CACvB;AAAA;AASK,SAAS,WAAW,CACzB,MACA,OAC4C;AAAA,EAC5C,MAAM,SAAS,KAAK,OAAO,MAAM,OAAO,QAAQ,KAAK;AAAA,EACrD,OAAkB,oBAAQ,KAAK,MAAM,MAAe,EAAE,KACxC,kBAAM,IAAI,GACR,qBAAO,CACvB;AAAA;",
+  "debugId": "7CF2B122E4A4953564756E2164756E21",
   "names": []
 }

package/dist/cloudflare/r2-bucket-lock.d.ts

@@ -33,6 +33,7 @@ import { Resource, type ResourceClass } from 'alchemy/Resource';
  */
 import type { CloudflareOpContext } from '@distilled.cloud/cloudflare/r2';
 import { Credentials } from '@distilled.cloud/cloudflare/Credentials';
+import * as r2 from '@distilled.cloud/cloudflare/r2';
 import * as Effect from 'effect/Effect';
 import * as HttpClient from 'effect/unstable/http/HttpClient';
 import { type Jurisdiction, type R2LockRule } from './lock-rules.ts';
@@ -69,7 +70,9 @@ export declare const R2BucketLock: ResourceClass<R2BucketLock>;
  *   same case the status check used to cover — but by the vendor's own error identity, not by
  *   reading a number off the response. Letting it propagate would make the resource impossible to
  *   plan; swallowing every failure would also hide a 403 from a mis-scoped token, which is the
- *   failure this estate spends the most time on. So: `NoSuchBucket` → absent, everything else dies.
+ *   failure this estate spends the most time on. So: `NoSuchBucket` → absent, everything else
+ *   propagates with its SDK tag. Upstream `Cloudflare/R2/BucketSippy.ts` at beta.79 uses this
+ *   same catch-and-propagate shape; a blanket remap would hide those typed identities (S20/S21).
  *
  * ⛔ AN EMPTY LIVE RULE SET IS "NO LOCK", NOT "A LOCK WITH NOTHING IN IT", so it reads as absent
  *   and the resource CREATES. The API answers `{}` for a bucket that has never been locked and
@@ -84,7 +87,9 @@ export declare const readLock: (props: {
     accountId: string;
     bucketName: string;
     jurisdiction?: Jurisdiction;
-}, written: boolean) => Effect.Effect<R2BucketLockAttributes | undefined, never, CloudflareOpContext>;
+}, written: boolean) => Effect.Effect<R2BucketLockAttributes | undefined, Exclude<r2.GetBucketLockError, {
+    _tag: 'NoSuchBucket';
+}>, CloudflareOpContext>;
 /**
  * ⛔ A NO-OP MAKES NO REQUEST, AND ON A LOCK THAT MATTERS MORE THAN TIDINESS. `PUT` replaces the
  *   rule set; re-sending an identical one on every deploy is a write against the only thing
@@ -92,16 +97,20 @@ export declare const readLock: (props: {
  *   persisted (or what `read` just adopted), so the comparison costs nothing either.
  * ⛔ `NoSuchBucket` IS NOT CAUGHT HERE. Unlike `read`, a `reconcile` that hits it means the bucket
  *   this declaration names is genuinely gone — that is a real failure to surface, not a case to
- *   paper over, so it dies like every other tagged error `putBucketLock` can raise.
+ *   paper over, so it propagates like every other typed SDK error `putBucketLock` can raise.
  */
-export declare const reconcileLock: (news: R2BucketLockProps, output: R2BucketLockAttributes | undefined) => Effect.Effect<R2BucketLockAttributes, never, CloudflareOpContext>;
+export declare const reconcileLock: (news: R2BucketLockProps, output: R2BucketLockAttributes | undefined) => Effect.Effect<R2BucketLockAttributes, r2.PutBucketLockError, CloudflareOpContext>;
 /**
  * ⛔ DELETING THIS RESOURCE MEANS PUTTING AN EMPTY RULE SET, WHICH IS UNLOCKING THE BUCKET. It is
  *   implemented because the retirement path is real — R2 refuses to empty a bucket while any lock
  *   rule is configured, so retiring the repository has to start here — and it is behind
  *   `defaultRemovalPolicy: 'retain'` and the estate CLI's refusal of `destroy` precisely because
  *   no ordinary deploy should ever reach it.
+ * ⛔ IDEMPOTENT (S11): a missing bucket has nothing left to unlock. Catch only `NoSuchBucket`;
+ *   every other SDK error propagates, like upstream `R2/BucketSippy.ts` at beta.79.
  */
-export declare const deleteLock: (output: R2BucketLockAttributes, accountId: string) => Effect.Effect<void, never, CloudflareOpContext>;
+export declare const deleteLock: (output: R2BucketLockAttributes, accountId: string) => Effect.Effect<void, Exclude<r2.PutBucketLockError, {
+    _tag: 'NoSuchBucket';
+}>, CloudflareOpContext>;
 export declare const R2BucketLockProvider: () => import("effect/Layer").Layer<Provider.Provider<R2BucketLock>, never, Credentials | HttpClient.HttpClient>;
 //# sourceMappingURL=r2-bucket-lock.d.ts.map

package/dist/cloudflare/r2-bucket-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"r2-bucket-lock.d.ts","sourceRoot":"","sources":["../../src/cloudflare/r2-bucket-lock.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAChE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAGtE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,UAAU,EAIhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+GAA+G;IAC/G,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC,CAAC;AAEF,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,yBAAyB,EACzB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,SAAS,CACV;CAAG;AAKJ,eAAO,MAAM,YAAY,EAAE,aAAa,CAAC,YAAY,CAYpD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,QAAQ,UACZ;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,YAAY,CAAA;CAAE,WACpE,OAAO,KACf,MAAM,CAAC,MAAM,CAAC,sBAAsB,GAAG,SAAS,EAAE,KAAK,EAAE,mBAAmB,CAkB3E,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,SAClB,iBAAiB,UACf,sBAAsB,GAAG,SAAS,KACzC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,EAAE,mBAAmB,CAa/D,CAAC;AAEL;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,WACb,sBAAsB,aACnB,MAAM,KAChB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAU7C,CAAC;AAEL,eAAO,MAAM,oBAAoB,iHAuC9B,CAAC"}
+{"version":3,"file":"r2-bucket-lock.d.ts","sourceRoot":"","sources":["../../src/cloudflare/r2-bucket-lock.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAChE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAErD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,UAAU,EAIhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+GAA+G;IAC/G,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC,CAAC;AAEF,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,yBAAyB,EACzB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,SAAS,CACV;CAAG;AAKJ,eAAO,MAAM,YAAY,EAAE,aAAa,CAAC,YAAY,CAYpD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,QAAQ,UACZ;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,YAAY,CAAA;CAAE,WACpE,OAAO,KACf,MAAM,CAAC,MAAM,CACd,sBAAsB,GAAG,SAAS,EAClC,OAAO,CAAC,EAAE,CAAC,kBAAkB,EAAE;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,EACxD,mBAAmB,CAgBjB,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,SAClB,iBAAiB,UACf,sBAAsB,GAAG,SAAS,KACzC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,CAW/E,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,WACb,sBAAsB,aACnB,MAAM,KAChB,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,OAAO,CAAC,EAAE,CAAC,kBAAkB,EAAE;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,EACxD,mBAAmB,CAWjB,CAAC;AAEL,eAAO,MAAM,oBAAoB,iHAuC9B,CAAC"}

package/dist/litellm/index.js.map

@@ -3,12 +3,12 @@
   "sources": ["../src/litellm/pass-through-endpoint.ts", "../src/litellm/operations.ts", "../src/litellm/pass-through-errors.ts", "../src/litellm/pass-through-form.ts", "../src/litellm/providers.ts"],
   "sourcesContent": [
     "/**\n * `LiteLLM.PassThroughEndpoint` — one row in LiteLLM's `general_settings.pass_through_endpoints`.\n *\n * ★ ADOPT-FRIENDLY BY id, NOT BY PATH. `output?.id` is used as the object's live id once the\n *   engine has one — from our own prior create (the deterministic physical name) or from an\n *   adopted foreign row — and `read` computes a FRESH physical name only for a resource the\n *   engine has never resolved before. This is S7/S9's \"output is a cache of stable identifiers,\n *   not proof the object exists\" and S13's \"an adopted object keeps its live name as an explicit\n *   prop\", applied to an id LiteLLM lets a client choose (`_types.py:2192` at v1.100.0: create\n *   takes a caller-supplied `id`, else `uuid4()`).\n *\n * ⛔ A PATH HELD BY AN `is_from_config` ROW IS REFUSED, NOT ADOPTED. A DB row on the same path\n *   overrides it at runtime (`pass_through_endpoints.py` merges DB after config, at the tag) — so\n *   creating one would silently take over a route the operator declared in `config.yaml`, the\n *   exact \"DB row silently overrides the file\" the task names. `is_from_config` rows are also\n *   never updated or deleted by this provider, for the same reason.\n * ⛔ A DB ROW WITH NO `id` (path-only, `_types.py`'s \"backwards compatibility\" case) CANNOT BE\n *   ADDRESSED by the id-keyed update/delete calls this provider uses, so it is refused rather than\n *   silently adopted into an id-based lifecycle it cannot actually manage — see docs/litellm.md.\n * ⛔ NO CREDENTIAL IS A PROP (S25). `LITELLM_PROXY_URL`/`LITELLM_PROXY_API_KEY` are read at call\n *   time by `@distilled.cloud/litellm`'s own `CredentialsFromEnv` (providers.ts) — the same two\n *   variable names the retired hand-rolled `credentials.ts` read.\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport { createPhysicalName } from 'alchemy/PhysicalName';\nimport * as Provider from 'alchemy/Provider';\nimport type { Stack } from 'alchemy/Stack';\nimport type { Stage } from 'alchemy/Stage';\nimport type * as misc from '@distilled.cloud/litellm/misc';\nimport * as Effect from 'effect/Effect';\nimport * as Predicate from 'effect/Predicate';\nimport {\n  type LitellmRequirements,\n  createPassThroughEndpoint,\n  deletePassThroughEndpoint,\n  listPassThroughEndpoints,\n  updatePassThroughEndpoint,\n} from './operations.ts';\nimport {\n  LitellmConfigPathConflictError,\n  LitellmLiteralSecretHeaderError,\n  LitellmUnaddressableRowError,\n} from './pass-through-errors.ts';\nimport {\n  type PassThroughEndpointAttributes,\n  type PassThroughEndpointProps,\n  createBody,\n  literalSecretHeaders,\n  matches,\n  needsReplace,\n  updateBody,\n} from './pass-through-form.ts';\n\nexport type { PassThroughEndpointAttributes, PassThroughEndpointProps };\nexport {\n  LitellmConfigPathConflictError,\n  LitellmLiteralSecretHeaderError,\n  LitellmUnaddressableRowError,\n  type PassThroughEndpointError,\n} from './pass-through-errors.ts';\n\nexport interface LiteLLMPassThroughEndpoint extends Resource<\n  'LiteLLM.PassThroughEndpoint',\n  PassThroughEndpointProps,\n  PassThroughEndpointAttributes,\n  never,\n  LitellmRequirements | Stack | Stage\n> {}\n\nexport const LiteLLMPassThroughEndpoint = Resource<LiteLLMPassThroughEndpoint>(\n  'LiteLLM.PassThroughEndpoint',\n);\n\nexport const isLiteLLMPassThroughEndpoint = (value: unknown): value is LiteLLMPassThroughEndpoint =>\n  Predicate.hasProperty(value, 'Type') && value.Type === 'LiteLLM.PassThroughEndpoint';\n\nconst toAttributes = (\n  row: misc.PassThroughGenericEndpoint,\n  fallbackId: string,\n): PassThroughEndpointAttributes => ({\n  ...row,\n  id: row.id ?? fallbackId,\n});\n\nconst physicalIdOf = (logicalId: string, instanceId: string) =>\n  createPhysicalName({ id: logicalId, instanceId, lowercase: true, maxLength: 64 });\n\n/**\n * Find this resource's live row (by id) and, when absent, the row that already holds its `path`\n * (a config-file row to refuse, or a DB row LiteLLM did not give an id — also refused, see the\n * file header — or a genuine foreign DB row to hand back `Unowned`).\n */\nconst locate = (\n  rows: readonly misc.PassThroughGenericEndpoint[],\n  objectId: string,\n  path: string,\n): {\n  readonly mine: misc.PassThroughGenericEndpoint | undefined;\n  readonly conflict: misc.PassThroughGenericEndpoint | undefined;\n} => {\n  const mine = rows.find((row) => row.id === objectId);\n  const conflict = mine === undefined ? rows.find((row) => row.path === path) : undefined;\n  return { conflict, mine };\n};\n\n/** The typed refusal for a `path` conflict that cannot ever be adopted (config row, or no id). */\nconst conflictRefusal = (conflict: misc.PassThroughGenericEndpoint, path: string) =>\n  conflict.is_from_config === true\n    ? new LitellmConfigPathConflictError({ path })\n    : new LitellmUnaddressableRowError({ path });\n\n/** `read`'s answer for a path conflict: `Unowned` when it is a real, addressable DB row — a typed refusal otherwise. */\nconst readConflict = (conflict: misc.PassThroughGenericEndpoint, path: string) =>\n  conflict.is_from_config !== true && conflict.id !== undefined && conflict.id !== null\n    ? Effect.succeed(Unowned(toAttributes(conflict, conflict.id)))\n    : Effect.fail(conflictRefusal(conflict, path));\n\nconst refuseLiteralSecrets = (headers: Readonly<Record<string, unknown>> | undefined) => {\n  const bad = literalSecretHeaders(headers);\n  return bad.length === 0\n    ? Effect.void\n    : Effect.fail(new LitellmLiteralSecretHeaderError({ headers: bad }));\n};\n\n/** ⛔ TEST-ONLY EXPORT. Not on index.ts's barrel — a lifecycle test calls these directly against the fake. */\nexport const passThroughHandlers = {\n  read: ({\n    id,\n    instanceId,\n    olds,\n    output,\n  }: {\n    id: string;\n    instanceId: string;\n    olds: PassThroughEndpointProps;\n    output: PassThroughEndpointAttributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      const objectId = output?.id ?? (yield* physicalIdOf(id, instanceId));\n      const rows = yield* listPassThroughEndpoints();\n      const { conflict, mine } = locate(rows, objectId, olds.path);\n      if (mine !== undefined) return toAttributes(mine, objectId);\n      if (conflict === undefined) return undefined;\n      return yield* readConflict(conflict, olds.path);\n    }),\n\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<PassThroughEndpointProps>;\n    output: PassThroughEndpointAttributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      if (!isResolved(news)) return undefined;\n      yield* refuseLiteralSecrets(news.headers);\n      if (output === undefined) return undefined;\n      // ⛔ deleteFirst: TRUE — a create-first replace mints a new instanceId/id before the old row\n      //   on `path` is gone, so the new generation's `reconcile` would refuse it as a foreign\n      //   conflict (Apply.ts). Same fix this kit's other unique-identity providers use.\n      if (needsReplace(output, news)) return { action: 'replace', deleteFirst: true } as const;\n      return matches(output, news)\n        ? ({ action: 'noop' } as const)\n        : ({ action: 'update' } as const);\n    }),\n\n  reconcile: ({\n    id,\n    instanceId,\n    news,\n    output,\n  }: {\n    id: string;\n    instanceId: string;\n    news: PassThroughEndpointProps;\n    output: PassThroughEndpointAttributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      yield* refuseLiteralSecrets(news.headers);\n      const objectId = output?.id ?? (yield* physicalIdOf(id, instanceId));\n      const rows = yield* listPassThroughEndpoints();\n      const { conflict, mine } = locate(rows, objectId, news.path);\n\n      if (mine === undefined) {\n        // ⚠️ A CONFLICT HERE — reconcile, not read — means ownership shifted between plan and\n        //   apply (a config row or a foreign DB row landed on this path after `read` cleared it).\n        //   `read` gates a genuine adopt by returning `Unowned`; reconcile itself never adopts,\n        //   so ANY conflict here fails rather than risking a second row on one path.\n        if (conflict !== undefined) return yield* Effect.fail(conflictRefusal(conflict, news.path));\n        yield* createPassThroughEndpoint(createBody(news, objectId));\n      } else if (mine.is_from_config === true) {\n        // ⛔ NEVER UPDATE OR DELETE AN `is_from_config` ROW, even one this resource's own\n        //   deterministic id happens to match (a config.yaml author could in principle choose the\n        //   same id `createPhysicalName` would). Refuse rather than silently editing the file's row.\n        return yield* Effect.fail(new LitellmConfigPathConflictError({ path: news.path }));\n      } else if (needsReplace(toAttributes(mine, objectId), news)) {\n        yield* deletePassThroughEndpoint(objectId);\n        yield* createPassThroughEndpoint(createBody(news, objectId));\n      } else if (!matches(toAttributes(mine, objectId), news)) {\n        const body = updateBody(news);\n        if (Object.keys(body).length > 0) yield* updatePassThroughEndpoint(objectId, body);\n      }\n\n      const after = (yield* listPassThroughEndpoints()).find((row) => row.id === objectId);\n      if (after === undefined) {\n        return yield* Effect.die(\n          new Error(\n            `LiteLLM.PassThroughEndpoint ${news.path}: the write returned no error but id ` +\n              `${objectId} is still absent from GET /config/pass_through_endpoint — read back ` +\n              'rather than trusting the call that just returned.',\n          ),\n        );\n      }\n      return toAttributes(after, objectId);\n    }),\n\n  delete: ({\n    id,\n    instanceId,\n    olds,\n    output,\n  }: {\n    id: string;\n    instanceId: string;\n    olds: PassThroughEndpointProps;\n    output: PassThroughEndpointAttributes;\n  }) =>\n    Effect.gen(function* () {\n      const objectId = output.id ?? (yield* physicalIdOf(id, instanceId));\n      const rows = yield* listPassThroughEndpoints();\n      const live = rows.find((row) => row.id === objectId);\n      // ⛔ NEVER DELETE AN `is_from_config` ROW, and a DB row this resource never created (a path\n      //   match with a different id) is not this resource's to remove either.\n      if (live === undefined || live.is_from_config === true || live.path !== olds.path) return;\n      yield* deletePassThroughEndpoint(objectId);\n    }),\n\n  list: () => Effect.succeed([]),\n};\n\nexport const LiteLLMPassThroughEndpointProvider = () =>\n  Provider.effect(\n    LiteLLMPassThroughEndpoint,\n    Effect.succeed(LiteLLMPassThroughEndpoint.Provider.of(passThroughHandlers)),\n  );\n",
-    "/**\n * The four LiteLLM `/config/pass_through_endpoint*` calls this package writes to and reads from —\n * now through `@distilled.cloud/litellm`'s typed operations (S23), not a hand-rolled `HttpClient`\n * client. `client.ts` is retired; nothing else in this package imported it.\n *\n * ⛔ STILL WRAPPED IN A PER-BASE-URL SEMAPHORE, UNCHANGED FROM `client.ts`. LiteLLM stores every\n *   pass-through endpoint in ONE `general_settings.pass_through_endpoints` list\n *   (`pass_through_endpoints.py` at tag v1.100.0, mirrored in the SDK's own `misc.ts` docstrings),\n *   so create/update/delete are each a read-modify-write of the WHOLE list through\n *   `update_config_general_settings`. Two of this package's own calls racing each other — two\n *   endpoints created in the same deploy — would each read the list, add their own row and write\n *   it back, and the second write would silently drop the first row. The SDK has no opinion on\n *   this: it is a quirk of how THIS vendor stores the resource, not a distilled protocol concern,\n *   so it stays here, one layer above the typed calls. One permit per proxy serialises this\n *   package's own writes; it cannot serialise against the LiteLLM UI or a second deploy process,\n *   which is why `pass-through-endpoint.ts`'s `reconcile` reads back after writing rather than\n *   trusting the call that just returned (docs/litellm.md).\n * ⛔ NO STATUS SNIFFING (S21). Every failure the SDK's own typed operations declare — `BadRequest`\n *   (400), `NotFound` (404 on update only), `UnprocessableEntity` (422) plus the shared\n *   `Unauthorized`/`TooManyRequests`/`InternalServerError`/`BadGateway`/`ServiceUnavailable`/\n *   `GatewayTimeout` every operation carries — is a distilled patch's doing\n *   (`@distilled.cloud/litellm`'s own `patches/misc/*.json`, applied at generation time), never a\n *   status check here or in `pass-through-endpoint.ts`. Deleting an id LiteLLM does not have\n *   answers `BadRequest` (measured against the tag's `pass_through_endpoint_delete` — the id is\n *   looked up in the list and a miss raises `HTTPException(400)`, not 404) — but so does a\n *   genuinely-live row when the caller isn't PROXY_ADMIN, or the DB is disconnected. Telling those\n *   apart by re-listing, not by the `BadRequest`'s message text, is `pass-through-endpoint.ts`'s\n *   `deletePassThroughEndpoint`'s own job (S21 — a status-and-a-real-read decision, never body\n *   text) — this file only forwards the typed error.\n */\nimport * as misc from '@distilled.cloud/litellm/misc';\nimport { Credentials } from '@distilled.cloud/litellm/Credentials';\nimport type { LitellmOpContext } from '@distilled.cloud/litellm/Protocol';\nimport type { ConfigError } from '@distilled.cloud/litellm/Errors';\nimport * as Effect from 'effect/Effect';\nimport * as Semaphore from 'effect/Semaphore';\n\nexport type { LitellmOpContext } from '@distilled.cloud/litellm/Protocol';\nexport type LitellmRequirements = LitellmOpContext;\nexport type {\n  PassThroughEndpointResponse,\n  PassThroughGenericEndpoint,\n  PassThroughGuardrailSettings,\n} from '@distilled.cloud/litellm/misc';\n\nconst semaphores = new Map<string, Semaphore.Semaphore>();\n\n/** One semaphore per base URL, created on first use. Never `Hash.structure` (S18) — a plain Map key. */\nconst semaphoreFor = (baseUrl: string): Effect.Effect<Semaphore.Semaphore> =>\n  Effect.sync(() => {\n    const existing = semaphores.get(baseUrl);\n    if (existing !== undefined) return existing;\n    const created = Semaphore.makeUnsafe(1);\n    semaphores.set(baseUrl, created);\n    return created;\n  });\n\n/**\n * Serialises a write against this call's own base URL — see the file header.\n *\n * Resolving `Credentials` can itself fail typed (`ConfigError` — S20/S24, credentials.ts), so\n * the return type carries that alongside the wrapped operation's own error `E`; every call\n * site's declared error type already includes `ConfigError` as a member of the SDK's shared\n * `LitellmOpError` (protocol.ts), so this widening is a no-op for callers.\n */\nconst mutate = <A, E>(\n  io: Effect.Effect<A, E, LitellmOpContext>,\n): Effect.Effect<A, E | ConfigError, LitellmOpContext> =>\n  Effect.gen(function* () {\n    const resolve = yield* Credentials;\n    const creds = yield* resolve;\n    const semaphore = yield* semaphoreFor(creds.apiBaseUrl);\n    return yield* semaphore.withPermits(1)(io);\n  });\n\n/** GET /config/pass_through_endpoint — every row, config-file and DB alike. Not under the semaphore: reads don't race the field. */\nexport const listPassThroughEndpoints = (): Effect.Effect<\n  readonly misc.PassThroughGenericEndpoint[],\n  misc.GetPassThroughEndpointsConfigPassThroughEndpointGetError,\n  LitellmOpContext\n> =>\n  misc\n    .getPassThroughEndpointsConfigPassThroughEndpointGet({})\n    .pipe(Effect.map((response) => response.endpoints));\n\n/** POST /config/pass_through_endpoint. `body` carries `id` — see pass-through-form.ts. */\nexport const createPassThroughEndpoint = (\n  body: misc.PassThroughGenericEndpoint,\n): Effect.Effect<\n  void,\n  misc.CreatePassThroughEndpointsConfigPassThroughEndpointPostError,\n  LitellmOpContext\n> => mutate(misc.createPassThroughEndpointsConfigPassThroughEndpointPost(body).pipe(Effect.asVoid));\n\n/**\n * POST /config/pass_through_endpoint/{endpoint_id}. Merges with `exclude_none` — see\n * pass-through-form.ts. `body` is `pass-through-form.ts`'s own `UpdateBody`, not a blanket\n * `Partial<>` — `path`/`target` are the two fields the SDK's request type still requires\n * non-optionally on an update.\n */\nexport const updatePassThroughEndpoint = (\n  endpointId: string,\n  body: Partial<Omit<misc.PassThroughGenericEndpoint, 'path' | 'target'>> &\n    Pick<misc.PassThroughGenericEndpoint, 'path' | 'target'>,\n): Effect.Effect<\n  void,\n  misc.UpdatePassThroughEndpointsConfigPassThroughEndpointEndpointIdPostError,\n  LitellmOpContext\n> =>\n  mutate(\n    misc\n      .updatePassThroughEndpointsConfigPassThroughEndpointEndpointIdPost({\n        ...body,\n        endpoint_id: endpointId,\n      })\n      .pipe(Effect.asVoid),\n  );\n\n/**\n * DELETE /config/pass_through_endpoint?endpoint_id=… — idempotent BY THIS FUNCTION, not by the\n * vendor. ⚠️ Measured at v1.100.0: deleting an id the list does not have raises `HTTPException(400)`\n * from `pass_through_endpoint_delete`, which the SDK decodes as a typed `BadRequest` — but the SAME\n * route also raises the SAME `BadRequest` for `not_allowed_access` (a non-PROXY_ADMIN caller) or a\n * disconnected DB, on a row that never got deleted. A `BadRequest` alone cannot tell the two apart,\n * so THIS FUNCTION DOESN'T GUESS FROM THE TAG ALONE: on `BadRequest` it re-lists (a GET — no\n * PROXY_ADMIN required) and only treats the delete as already-done if `endpointId` is genuinely\n * absent; otherwise the delete failed and this re-fails with the ORIGINAL error, not a message\n * match (S21 — a status-and-a-real-read decision, never body text).\n */\nexport const deletePassThroughEndpoint = (\n  endpointId: string,\n): Effect.Effect<\n  void,\n  misc.DeletePassThroughEndpointsConfigPassThroughEndpointDeleteError,\n  LitellmOpContext\n> =>\n  mutate(\n    misc\n      .deletePassThroughEndpointsConfigPassThroughEndpointDelete({ endpoint_id: endpointId })\n      .pipe(\n        Effect.asVoid,\n        Effect.catchTag('BadRequest', (original) =>\n          Effect.gen(function* () {\n            const rows = yield* listPassThroughEndpoints();\n            if (rows.some((row) => row.id === endpointId)) return yield* Effect.fail(original);\n          }),\n        ),\n      ),\n  );\n",
+    "/**\n * The four LiteLLM `/config/pass_through_endpoint*` calls this package writes to and reads from —\n * now through `@distilled.cloud/litellm`'s typed operations (S23), not a hand-rolled `HttpClient`\n * client. `client.ts` is retired; nothing else in this package imported it.\n *\n * ⛔ STILL WRAPPED IN A PER-BASE-URL SEMAPHORE, UNCHANGED FROM `client.ts`. LiteLLM stores every\n *   pass-through endpoint in ONE `general_settings.pass_through_endpoints` list\n *   (`pass_through_endpoints.py` at tag v1.100.0, mirrored in the SDK's own `misc.ts` docstrings),\n *   so create/update/delete are each a read-modify-write of the WHOLE list through\n *   `update_config_general_settings`. Two of this package's own calls racing each other — two\n *   endpoints created in the same deploy — would each read the list, add their own row and write\n *   it back, and the second write would silently drop the first row. The SDK has no opinion on\n *   this: it is a quirk of how THIS vendor stores the resource, not a distilled protocol concern,\n *   so it stays here, one layer above the typed calls. One permit per proxy serialises this\n *   package's own writes; it cannot serialise against the LiteLLM UI or a second deploy process,\n *   which is why `pass-through-endpoint.ts`'s `reconcile` reads back after writing rather than\n *   trusting the call that just returned (docs/litellm.md).\n * ⛔ NO STATUS SNIFFING (S21). Every failure the SDK's own typed operations declare — `BadRequest`\n *   (400), `NotFound` (404 on update only), `UnprocessableEntity` (422) plus the shared\n *   `Unauthorized`/`TooManyRequests`/`InternalServerError`/`BadGateway`/`ServiceUnavailable`/\n *   `GatewayTimeout` every operation carries — is a distilled patch's doing\n *   (`@distilled.cloud/litellm`'s own `patches/misc/*.json`, applied at generation time), never a\n *   status check here or in `pass-through-endpoint.ts`. Deleting an id LiteLLM does not have\n *   answers `BadRequest` (measured against the tag's `pass_through_endpoint_delete` — the id is\n *   looked up in the list and a miss raises `HTTPException(400)`, not 404) — but so does a\n *   genuinely-live row when the caller isn't PROXY_ADMIN, or the DB is disconnected. Telling those\n *   apart by re-listing, not by the `BadRequest`'s message text, is `pass-through-endpoint.ts`'s\n *   `deletePassThroughEndpoint`'s own job (S21 — a status-and-a-real-read decision, never body\n *   text) — this file only forwards the typed error.\n */\nimport * as misc from '@distilled.cloud/litellm/misc';\nimport { Credentials } from '@distilled.cloud/litellm/Credentials';\nimport type { LitellmOpContext } from '@distilled.cloud/litellm/Protocol';\nimport type { ConfigError } from '@distilled.cloud/litellm/Errors';\nimport * as Effect from 'effect/Effect';\nimport * as Semaphore from 'effect/Semaphore';\n\nexport type { LitellmOpContext } from '@distilled.cloud/litellm/Protocol';\nexport type LitellmRequirements = LitellmOpContext;\nexport type {\n  PassThroughEndpointResponse,\n  PassThroughGenericEndpoint,\n  PassThroughGuardrailSettings,\n} from '@distilled.cloud/litellm/misc';\n\nconst semaphores = new Map<string, Semaphore.Semaphore>();\n\n/** One semaphore per base URL, created on first use. Never `Hash.structure` (S18) — a plain Map key. */\nconst semaphoreFor = (baseUrl: string): Effect.Effect<Semaphore.Semaphore> =>\n  Effect.sync(() => {\n    const existing = semaphores.get(baseUrl);\n    if (existing !== undefined) return existing;\n    const created = Semaphore.makeUnsafe(1);\n    semaphores.set(baseUrl, created);\n    return created;\n  });\n\n/**\n * Serialises a write against this call's own base URL — see the file header.\n *\n * ⚠️ `Credentials` itself ends in `Effect.orDie` on a missing/misspelled env var (Q6, decision\n *   49 \"upstream wins\", 2026-09-24, matching distilled's own convention — 73 of 80 packages'\n *   `credentials.ts` do the same at `homeflare/base`), so resolving it here can no longer fail\n *   typed. The `| ConfigError` this function still adds to its return type stays only because\n *   `@distilled.cloud/litellm`'s own `LitellmOpError` (protocol.ts) unconditionally declares\n *   `ConfigError` as a member of every generated operation's error union regardless of\n *   `Credentials`'s own type — so `E` (the wrapped operation's error) already contains it, and\n *   this widening is a genuine no-op for callers, not dead type-state left over from the revert.\n */\nconst mutate = <A, E>(\n  io: Effect.Effect<A, E, LitellmOpContext>,\n): Effect.Effect<A, E | ConfigError, LitellmOpContext> =>\n  Effect.gen(function* () {\n    const resolve = yield* Credentials;\n    const creds = yield* resolve;\n    const semaphore = yield* semaphoreFor(creds.apiBaseUrl);\n    return yield* semaphore.withPermits(1)(io);\n  });\n\n/** GET /config/pass_through_endpoint — every row, config-file and DB alike. Not under the semaphore: reads don't race the field. */\nexport const listPassThroughEndpoints = (): Effect.Effect<\n  readonly misc.PassThroughGenericEndpoint[],\n  misc.GetPassThroughEndpointsConfigPassThroughEndpointGetError,\n  LitellmOpContext\n> =>\n  misc\n    .getPassThroughEndpointsConfigPassThroughEndpointGet({})\n    .pipe(Effect.map((response) => response.endpoints));\n\n/** POST /config/pass_through_endpoint. `body` carries `id` — see pass-through-form.ts. */\nexport const createPassThroughEndpoint = (\n  body: misc.PassThroughGenericEndpoint,\n): Effect.Effect<\n  void,\n  misc.CreatePassThroughEndpointsConfigPassThroughEndpointPostError,\n  LitellmOpContext\n> => mutate(misc.createPassThroughEndpointsConfigPassThroughEndpointPost(body).pipe(Effect.asVoid));\n\n/**\n * POST /config/pass_through_endpoint/{endpoint_id}. Merges with `exclude_none` — see\n * pass-through-form.ts. `body` is `pass-through-form.ts`'s own `UpdateBody`, not a blanket\n * `Partial<>` — `path`/`target` are the two fields the SDK's request type still requires\n * non-optionally on an update.\n */\nexport const updatePassThroughEndpoint = (\n  endpointId: string,\n  body: Partial<Omit<misc.PassThroughGenericEndpoint, 'path' | 'target'>> &\n    Pick<misc.PassThroughGenericEndpoint, 'path' | 'target'>,\n): Effect.Effect<\n  void,\n  misc.UpdatePassThroughEndpointsConfigPassThroughEndpointEndpointIdPostError,\n  LitellmOpContext\n> =>\n  mutate(\n    misc\n      .updatePassThroughEndpointsConfigPassThroughEndpointEndpointIdPost({\n        ...body,\n        endpoint_id: endpointId,\n      })\n      .pipe(Effect.asVoid),\n  );\n\n/**\n * DELETE /config/pass_through_endpoint?endpoint_id=… — idempotent BY THIS FUNCTION, not by the\n * vendor. ⚠️ Measured at v1.100.0: deleting an id the list does not have raises `HTTPException(400)`\n * from `pass_through_endpoint_delete`, which the SDK decodes as a typed `BadRequest` — but the SAME\n * route also raises the SAME `BadRequest` for `not_allowed_access` (a non-PROXY_ADMIN caller) or a\n * disconnected DB, on a row that never got deleted. A `BadRequest` alone cannot tell the two apart,\n * so THIS FUNCTION DOESN'T GUESS FROM THE TAG ALONE: on `BadRequest` it re-lists (a GET — no\n * PROXY_ADMIN required) and only treats the delete as already-done if `endpointId` is genuinely\n * absent; otherwise the delete failed and this re-fails with the ORIGINAL error, not a message\n * match (S21 — a status-and-a-real-read decision, never body text).\n */\nexport const deletePassThroughEndpoint = (\n  endpointId: string,\n): Effect.Effect<\n  void,\n  misc.DeletePassThroughEndpointsConfigPassThroughEndpointDeleteError,\n  LitellmOpContext\n> =>\n  mutate(\n    misc\n      .deletePassThroughEndpointsConfigPassThroughEndpointDelete({ endpoint_id: endpointId })\n      .pipe(\n        Effect.asVoid,\n        Effect.catchTag('BadRequest', (original) =>\n          Effect.gen(function* () {\n            const rows = yield* listPassThroughEndpoints();\n            if (rows.some((row) => row.id === endpointId)) return yield* Effect.fail(original);\n          }),\n        ),\n      ),\n  );\n",
     "/**\n * The typed refusals `LiteLLM.PassThroughEndpoint` raises on top of `@distilled.cloud/litellm`'s\n * own SDK errors — split out of pass-through-endpoint.ts to keep that file under the house's\n * 250-line cap once this migration added the four named SDK error-union re-exports.\n */\nimport type * as misc from '@distilled.cloud/litellm/misc';\nimport * as Data from 'effect/Data';\n\nexport class LitellmConfigPathConflictError extends Data.TaggedError(\n  'LitellmConfigPathConflictError',\n)<{\n  readonly path: string;\n}> {}\nexport class LitellmUnaddressableRowError extends Data.TaggedError('LitellmUnaddressableRowError')<{\n  readonly path: string;\n}> {}\nexport class LitellmLiteralSecretHeaderError extends Data.TaggedError(\n  'LitellmLiteralSecretHeaderError',\n)<{\n  readonly headers: readonly string[];\n}> {}\n\n/**\n * ⛔ THE FOUR SDK ERROR UNIONS, NAMED, NOT `LitellmOpError` ALONE. `catchTag`'s tag-literal\n *   inference needs a concrete union to resolve `\"BadRequest\"`/`\"NotFound\"` against (the same\n *   reason `netbox/resource.ts` leaves `NotFound` folding to each resource file, not its shared\n *   engine) — `operations.ts` already returns each call's own precise per-operation error type, so\n *   this is just their union, not a re-widening.\n */\nexport type PassThroughEndpointError =\n  | misc.GetPassThroughEndpointsConfigPassThroughEndpointGetError\n  | misc.CreatePassThroughEndpointsConfigPassThroughEndpointPostError\n  | misc.UpdatePassThroughEndpointsConfigPassThroughEndpointEndpointIdPostError\n  | misc.DeletePassThroughEndpointsConfigPassThroughEndpointDeleteError\n  | LitellmConfigPathConflictError\n  | LitellmUnaddressableRowError\n  | LitellmLiteralSecretHeaderError;\n",
     "/**\n * The wire body for a `LiteLLM.PassThroughEndpoint`, the comparison that decides whether it needs\n * writing, and the refusals that stop a plan before it writes anything unsafe.\n *\n * ★ EXTRACTED SO IT CAN BE TESTED WITHOUT A SERVER — the same reason netbox keeps `prefix-form.ts`\n *   beside `prefix.ts` (S32/testing-and-docs.md).\n *\n * ⛔ PROPS ARE `@distilled.cloud/litellm`'s OWN GENERATED TYPE, MINUS THE TWO FIELDS THIS RESOURCE\n *   OWNS ITSELF: `id` (a deterministic physical name — pass-through-endpoint.ts) and\n *   `is_from_config` (response-only; the vendor sets it, a declaration never does). Deriving\n *   `Props` with `Omit<>` rather than hand-typing it means a vendor schema change the SDK's own\n *   next regeneration picks up is felt here as a compiler error, not silently ignored — the same\n *   reason this used to derive from the kit's own hand-generated `./generated/pass-through.ts`\n *   (retired by this migration: the SDK's type is the same shape, generated from the same LiteLLM\n *   1.100.0 OpenAPI document, and keeping a second copy would only drift).\n */\nimport { deepEqual } from 'alchemy/Diff';\nimport type * as Generated from '@distilled.cloud/litellm/misc';\n\nexport type PassThroughEndpointProps = Omit<\n  Generated.PassThroughGenericEndpoint,\n  'id' | 'is_from_config'\n>;\n\n/** What `read` returns: the props plus the two vendor-owned fields, `id` now guaranteed present. */\nexport type PassThroughEndpointAttributes = Omit<Generated.PassThroughGenericEndpoint, 'id'> & {\n  readonly id: string;\n};\n\n/** ⚠️ NetBox `settled()`'s pattern: only fields the SCHEMA gives a vendor default for, copied from it (not assumed). */\nexport const settled = (props: PassThroughEndpointProps) => ({\n  auth: props.auth ?? true,\n  cost_per_request: props.cost_per_request ?? 0,\n  default_query_params: props.default_query_params ?? {},\n  headers: props.headers ?? {},\n  include_subpath: props.include_subpath ?? false,\n});\n\n/** The three fields whose absence the vendor's `exclude_none` update can never write (see client.ts). */\nexport const NULLABLE_FIELDS = ['timeout', 'methods', 'guardrails'] as const;\n\nconst isUnset = (value: unknown): boolean => value === undefined || value === null;\n\n/**\n * ⚠️ BUILT AS A WIDER RECORD AND PRUNED, NOT AS THE GENERATED TYPE DIRECTLY.\n *   `exactOptionalPropertyTypes` is on (packages/config/tsconfig.base.json), so writing\n *   `timeout: undefined` into a `{ timeout?: number | null }` is a type error rather than an\n *   absent key — the same reason `codegen/openapi.ts`'s `prune` exists, and the same fix.\n */\nconst prune = (value: Record<string, unknown>): Record<string, unknown> =>\n  Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined));\n\n/**\n * Full body for CREATE. `id` is the deterministic physical name (pass-through-endpoint.ts), sent\n * so a failed create is recoverable by `read` rather than orphaning a second row on retry.\n */\nexport const createBody = (\n  props: PassThroughEndpointProps,\n  id: string,\n): Generated.PassThroughGenericEndpoint =>\n  prune({\n    ...settled(props),\n    guardrails: isUnset(props.guardrails) ? undefined : props.guardrails,\n    id,\n    methods: isUnset(props.methods) ? undefined : props.methods,\n    path: props.path,\n    target: props.target,\n    timeout: isUnset(props.timeout) ? undefined : props.timeout,\n  }) as unknown as Generated.PassThroughGenericEndpoint;\n\n/**\n * Partial body for UPDATE (`POST /{id}`). ⛔ ONLY FIELDS THIS DECLARATION ACTUALLY SETS — the\n * vendor merges the parsed body with `model_dump(exclude_none=True)` (measured at v1.100.0), so an\n * `undefined` OR an explicit `null` here would be dropped by the server anyway; sending neither is\n * the same outcome with no request made when nothing changed (`Object.keys(body).length === 0`\n * checked by the caller in pass-through-endpoint.ts).\n *\n * ⛔ `path`/`target` ARE NOT `Partial` HERE, UNLIKE EVERY OTHER FIELD. The SDK's own update\n *   request type requires both non-optionally (the vendor's PATCH route still wants the full\n *   route/target pair on every call, unlike the other fields' `exclude_none` merge) — typing them\n *   as always-present here is what lets `operations.ts`'s `updatePassThroughEndpoint` pass this\n *   straight to the SDK without an unsafe cast.\n */\nexport type UpdateBody = Partial<Omit<Generated.PassThroughGenericEndpoint, 'path' | 'target'>> &\n  Pick<Generated.PassThroughGenericEndpoint, 'path' | 'target'>;\n\nexport const updateBody = (props: PassThroughEndpointProps): UpdateBody =>\n  prune({\n    ...settled(props),\n    guardrails: isUnset(props.guardrails) ? undefined : props.guardrails,\n    methods: isUnset(props.methods) ? undefined : props.methods,\n    path: props.path,\n    target: props.target,\n    timeout: isUnset(props.timeout) ? undefined : props.timeout,\n  }) as UpdateBody;\n\n/**\n * Whether ANY of the three nullable fields went from set (in `live`) to unset (in `props`) — the\n * one case `updateBody` cannot express, because the vendor's `exclude_none` merge silently keeps\n * the old value instead of clearing it. Detected here so `pass-through-endpoint.ts` can plan a\n * `replace` (delete-then-create) instead of an update that would look like it worked.\n */\nexport const needsReplace = (\n  live: PassThroughEndpointAttributes,\n  props: PassThroughEndpointProps,\n): boolean => NULLABLE_FIELDS.some((field) => !isUnset(live[field]) && isUnset(props[field]));\n\n/** Whether the live object already says what the declaration says — the `diff` \"noop\" test. */\nexport const matches = (\n  live: PassThroughEndpointAttributes,\n  props: PassThroughEndpointProps,\n): boolean => {\n  const fixed = settled(props);\n  return (\n    live.target === props.target &&\n    live.auth === fixed.auth &&\n    live.cost_per_request === fixed.cost_per_request &&\n    live.include_subpath === fixed.include_subpath &&\n    deepEqual(live.headers, fixed.headers) &&\n    deepEqual(live.default_query_params, fixed.default_query_params) &&\n    (isUnset(props.timeout) ? isUnset(live.timeout) : live.timeout === props.timeout) &&\n    (isUnset(props.methods) ? isUnset(live.methods) : deepEqual(live.methods, props.methods)) &&\n    (isUnset(props.guardrails)\n      ? isUnset(live.guardrails)\n      : deepEqual(live.guardrails, props.guardrails))\n  );\n};\n\n/**\n * A literal secret in a forwarded header (S25, house rule — not a vendor one; see\n * pass-through-endpoint.ts). Case-insensitive on the header name; the reference form is LiteLLM's\n * own, `os.environ/NAME` (`set_env_variables_in_header`, pass_through_endpoints.py:117-160 at the\n * tag) — a missing variable on the proxy host leaves that literal string in the header, which\n * nothing in the API can detect, so this is enforced here rather than trusted to the vendor.\n */\nconst SECRET_HEADER_NAMES = new Set(['authorization', 'x-api-key', 'cf-aig-authorization']);\n\nexport const literalSecretHeaders = (\n  headers: Readonly<Record<string, unknown>> | undefined,\n): readonly string[] =>\n  Object.entries(headers ?? {})\n    .filter(\n      ([name, value]) =>\n        SECRET_HEADER_NAMES.has(name.toLowerCase()) && !String(value).includes('os.environ/'),\n    )\n    .map(([name]) => name);\n",
     "/**\n * The LiteLLM provider, with its credential source, as one layer for a stack.\n *\n *     Layer.mergeAll(litellmProviders(), …the stack's other providers)\n *\n * ★ THE DEFAULT READS `LITELLM_PROXY_URL`/`LITELLM_PROXY_API_KEY` AT CALL TIME, through\n *   `@distilled.cloud/litellm`'s own `CredentialsFromEnv` — the same two variable names the\n *   retired hand-rolled `credentials.ts` read — never at layer build. Pass another\n *   `Layer.Layer<Credentials>` (see the SDK's own `credentials({ apiKey, baseUrl })` in a test) to\n *   source them another way.\n * ⚠️ `HttpClient` is NOT provided here. It is ambient in every Alchemy runtime the same way it is\n *   for `netboxProviders`-style families in this kit; a stack that already deploys anything over\n *   HTTP already has one.\n */\nimport { type Credentials, CredentialsFromEnv } from '@distilled.cloud/litellm/Credentials';\nimport * as Layer from 'effect/Layer';\nimport { LiteLLMPassThroughEndpointProvider } from './pass-through-endpoint.ts';\n\nexport const litellmProviders = (creds: Layer.Layer<Credentials> = CredentialsFromEnv) =>\n  LiteLLMPassThroughEndpointProvider().pipe(Layer.provide(creds));\n"
   ],
-  "mappings": ";AAuBA;AACA;AACA;AAEA;AACA;AAIA;AACA;;;ACHA;AACA;AAGA;AACA;AAUA,IAAM,aAAa,IAAI;AAGvB,IAAM,eAAe,CAAC,YACb,YAAK,MAAM;AAAA,EAChB,MAAM,WAAW,WAAW,IAAI,OAAO;AAAA,EACvC,IAAI,aAAa;AAAA,IAAW,OAAO;AAAA,EACnC,MAAM,UAAoB,qBAAW,CAAC;AAAA,EACtC,WAAW,IAAI,SAAS,OAAO;AAAA,EAC/B,OAAO;AAAA,CACR;AAUH,IAAM,SAAS,CACb,OAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,OAAO;AAAA,EACvB,MAAM,QAAQ,OAAO;AAAA,EACrB,MAAM,YAAY,OAAO,aAAa,MAAM,UAAU;AAAA,EACtD,OAAO,OAAO,UAAU,YAAY,CAAC,EAAE,EAAE;AAAA,CAC1C;AAGI,IAAM,2BAA2B,MAMnC,yDAAoD,CAAC,CAAC,EACtD,KAAY,WAAI,CAAC,aAAa,SAAS,SAAS,CAAC;AAG/C,IAAM,4BAA4B,CACvC,SAKG,OAAY,6DAAwD,IAAI,EAAE,KAAY,aAAM,CAAC;AAQ3F,IAAM,4BAA4B,CACvC,YACA,SAOA,OAEK,uEAAkE;AAAA,KAC9D;AAAA,EACH,aAAa;AACf,CAAC,EACA,KAAY,aAAM,CACvB;AAaK,IAAM,4BAA4B,CACvC,eAMA,OAEK,+DAA0D,EAAE,aAAa,WAAW,CAAC,EACrF,KACQ,eACA,gBAAS,cAAc,CAAC,aACtB,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,yBAAyB;AAAA,EAC7C,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,UAAU;AAAA,IAAG,OAAO,OAAc,YAAK,QAAQ;AAAA,CAClF,CACH,CACF,CACJ;;;AC9IF;AAAA;AAEO,MAAM,uCAA4C,iBACvD,gCACF,EAEG;AAAC;AAAA;AACG,MAAM,qCAA0C,iBAAY,8BAA8B,EAE9F;AAAC;AAAA;AACG,MAAM,wCAA6C,iBACxD,iCACF,EAEG;AAAC;;;ACJJ;AAcO,IAAM,UAAU,CAAC,WAAqC;AAAA,EAC3D,MAAM,MAAM,QAAQ;AAAA,EACpB,kBAAkB,MAAM,oBAAoB;AAAA,EAC5C,sBAAsB,MAAM,wBAAwB,CAAC;AAAA,EACrD,SAAS,MAAM,WAAW,CAAC;AAAA,EAC3B,iBAAiB,MAAM,mBAAmB;AAC5C;AAGO,IAAM,kBAAkB,CAAC,WAAW,WAAW,YAAY;AAElE,IAAM,UAAU,CAAC,UAA4B,UAAU,aAAa,UAAU;AAQ9E,IAAM,QAAQ,CAAC,UACb,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,IAAI,OAAO,MAAM,SAAS,CAAC;AAMtE,IAAM,aAAa,CACxB,OACA,OAEA,MAAM;AAAA,KACD,QAAQ,KAAK;AAAA,EAChB,YAAY,QAAQ,MAAM,UAAU,IAAI,YAAY,MAAM;AAAA,EAC1D;AAAA,EACA,SAAS,QAAQ,MAAM,OAAO,IAAI,YAAY,MAAM;AAAA,EACpD,MAAM,MAAM;AAAA,EACZ,QAAQ,MAAM;AAAA,EACd,SAAS,QAAQ,MAAM,OAAO,IAAI,YAAY,MAAM;AACtD,CAAC;AAkBI,IAAM,aAAa,CAAC,UACzB,MAAM;AAAA,KACD,QAAQ,KAAK;AAAA,EAChB,YAAY,QAAQ,MAAM,UAAU,IAAI,YAAY,MAAM;AAAA,EAC1D,SAAS,QAAQ,MAAM,OAAO,IAAI,YAAY,MAAM;AAAA,EACpD,MAAM,MAAM;AAAA,EACZ,QAAQ,MAAM;AAAA,EACd,SAAS,QAAQ,MAAM,OAAO,IAAI,YAAY,MAAM;AACtD,CAAC;AAQI,IAAM,eAAe,CAC1B,MACA,UACY,gBAAgB,KAAK,CAAC,UAAU,CAAC,QAAQ,KAAK,MAAM,KAAK,QAAQ,MAAM,MAAM,CAAC;AAGrF,IAAM,UAAU,CACrB,MACA,UACY;AAAA,EACZ,MAAM,QAAQ,QAAQ,KAAK;AAAA,EAC3B,OACE,KAAK,WAAW,MAAM,UACtB,KAAK,SAAS,MAAM,QACpB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,oBAAoB,MAAM,mBAC/B,UAAU,KAAK,SAAS,MAAM,OAAO,KACrC,UAAU,KAAK,sBAAsB,MAAM,oBAAoB,MAC9D,QAAQ,MAAM,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,KAAK,YAAY,MAAM,aACxE,QAAQ,MAAM,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,UAAU,KAAK,SAAS,MAAM,OAAO,OACtF,QAAQ,MAAM,UAAU,IACrB,QAAQ,KAAK,UAAU,IACvB,UAAU,KAAK,YAAY,MAAM,UAAU;AAAA;AAWnD,IAAM,sBAAsB,IAAI,IAAI,CAAC,iBAAiB,aAAa,sBAAsB,CAAC;AAEnF,IAAM,uBAAuB,CAClC,YAEA,OAAO,QAAQ,WAAW,CAAC,CAAC,EACzB,OACC,EAAE,MAAM,WACN,oBAAoB,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE,SAAS,aAAa,CACxF,EACC,IAAI,EAAE,UAAU,IAAI;;;AHzElB,IAAM,6BAA6B,SACxC,6BACF;AAEO,IAAM,+BAA+B,CAAC,UACjC,sBAAY,OAAO,MAAM,KAAK,MAAM,SAAS;AAEzD,IAAM,eAAe,CACnB,KACA,gBACmC;AAAA,KAChC;AAAA,EACH,IAAI,IAAI,MAAM;AAChB;AAEA,IAAM,eAAe,CAAC,WAAmB,eACvC,mBAAmB,EAAE,IAAI,WAAW,YAAY,WAAW,MAAM,WAAW,GAAG,CAAC;AAOlF,IAAM,SAAS,CACb,MACA,UACA,SAIG;AAAA,EACH,MAAM,OAAO,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,QAAQ;AAAA,EACnD,MAAM,WAAW,SAAS,YAAY,KAAK,KAAK,CAAC,QAAQ,IAAI,SAAS,IAAI,IAAI;AAAA,EAC9E,OAAO,EAAE,UAAU,KAAK;AAAA;AAI1B,IAAM,kBAAkB,CAAC,UAA2C,SAClE,SAAS,mBAAmB,OACxB,IAAI,+BAA+B,EAAE,KAAK,CAAC,IAC3C,IAAI,6BAA6B,EAAE,KAAK,CAAC;AAG/C,IAAM,eAAe,CAAC,UAA2C,SAC/D,SAAS,mBAAmB,QAAQ,SAAS,OAAO,aAAa,SAAS,OAAO,OACtE,gBAAQ,QAAQ,aAAa,UAAU,SAAS,EAAE,CAAC,CAAC,IACpD,aAAK,gBAAgB,UAAU,IAAI,CAAC;AAEjD,IAAM,uBAAuB,CAAC,YAA2D;AAAA,EACvF,MAAM,MAAM,qBAAqB,OAAO;AAAA,EACxC,OAAO,IAAI,WAAW,IACX,eACA,aAAK,IAAI,gCAAgC,EAAE,SAAS,IAAI,CAAC,CAAC;AAAA;AAIhE,IAAM,sBAAsB;AAAA,EACjC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAOO,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,WAAW,QAAQ,OAAO,OAAO,aAAa,IAAI,UAAU;AAAA,IAClE,MAAM,OAAO,OAAO,yBAAyB;AAAA,IAC7C,QAAQ,UAAU,SAAS,OAAO,MAAM,UAAU,KAAK,IAAI;AAAA,IAC3D,IAAI,SAAS;AAAA,MAAW,OAAO,aAAa,MAAM,QAAQ;AAAA,IAC1D,IAAI,aAAa;AAAA,MAAW;AAAA,IAC5B,OAAO,OAAO,aAAa,UAAU,KAAK,IAAI;AAAA,GAC/C;AAAA,EAEH,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAKO,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,WAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,qBAAqB,KAAK,OAAO;AAAA,IACxC,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,IAAI,aAAa,QAAQ,IAAI;AAAA,MAAG,OAAO,EAAE,QAAQ,WAAW,aAAa,KAAK;AAAA,IAC9E,OAAO,QAAQ,QAAQ,IAAI,IACtB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAEH,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAOO,YAAI,UAAU,GAAG;AAAA,IACtB,OAAO,qBAAqB,KAAK,OAAO;AAAA,IACxC,MAAM,WAAW,QAAQ,OAAO,OAAO,aAAa,IAAI,UAAU;AAAA,IAClE,MAAM,OAAO,OAAO,yBAAyB;AAAA,IAC7C,QAAQ,UAAU,SAAS,OAAO,MAAM,UAAU,KAAK,IAAI;AAAA,IAE3D,IAAI,SAAS,WAAW;AAAA,MAKtB,IAAI,aAAa;AAAA,QAAW,OAAO,OAAc,aAAK,gBAAgB,UAAU,KAAK,IAAI,CAAC;AAAA,MAC1F,OAAO,0BAA0B,WAAW,MAAM,QAAQ,CAAC;AAAA,IAC7D,EAAO,SAAI,KAAK,mBAAmB,MAAM;AAAA,MAIvC,OAAO,OAAc,aAAK,IAAI,+BAA+B,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC;AAAA,IACnF,EAAO,SAAI,aAAa,aAAa,MAAM,QAAQ,GAAG,IAAI,GAAG;AAAA,MAC3D,OAAO,0BAA0B,QAAQ;AAAA,MACzC,OAAO,0BAA0B,WAAW,MAAM,QAAQ,CAAC;AAAA,IAC7D,EAAO,SAAI,CAAC,QAAQ,aAAa,MAAM,QAAQ,GAAG,IAAI,GAAG;AAAA,MACvD,MAAM,OAAO,WAAW,IAAI;AAAA,MAC5B,IAAI,OAAO,KAAK,IAAI,EAAE,SAAS;AAAA,QAAG,OAAO,0BAA0B,UAAU,IAAI;AAAA,IACnF;AAAA,IAEA,MAAM,SAAS,OAAO,yBAAyB,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,QAAQ;AAAA,IACnF,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,YACnB,IAAI,MACF,+BAA+B,KAAK,8CAClC,GAAG,iFACH,mDACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO,aAAa,OAAO,QAAQ;AAAA,GACpC;AAAA,EAEH,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAOO,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,WAAW,OAAO,OAAO,OAAO,aAAa,IAAI,UAAU;AAAA,IACjE,MAAM,OAAO,OAAO,yBAAyB;AAAA,IAC7C,MAAM,OAAO,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,QAAQ;AAAA,IAGnD,IAAI,SAAS,aAAa,KAAK,mBAAmB,QAAQ,KAAK,SAAS,KAAK;AAAA,MAAM;AAAA,IACnF,OAAO,0BAA0B,QAAQ;AAAA,GAC1C;AAAA,EAEH,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAC/B;AAEO,IAAM,qCAAqC,MACvC,gBACP,4BACO,gBAAQ,2BAA2B,SAAS,GAAG,mBAAmB,CAAC,CAC5E;;AIzOF;AACA;AAGO,IAAM,mBAAmB,CAAC,QAAkC,uBACjE,mCAAmC,EAAE,KAAW,cAAQ,KAAK,CAAC;",
+  "mappings": ";AAuBA;AACA;AACA;AAEA;AACA;AAIA;AACA;;;ACHA;AACA;AAGA;AACA;AAUA,IAAM,aAAa,IAAI;AAGvB,IAAM,eAAe,CAAC,YACb,YAAK,MAAM;AAAA,EAChB,MAAM,WAAW,WAAW,IAAI,OAAO;AAAA,EACvC,IAAI,aAAa;AAAA,IAAW,OAAO;AAAA,EACnC,MAAM,UAAoB,qBAAW,CAAC;AAAA,EACtC,WAAW,IAAI,SAAS,OAAO;AAAA,EAC/B,OAAO;AAAA,CACR;AAcH,IAAM,SAAS,CACb,OAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,OAAO;AAAA,EACvB,MAAM,QAAQ,OAAO;AAAA,EACrB,MAAM,YAAY,OAAO,aAAa,MAAM,UAAU;AAAA,EACtD,OAAO,OAAO,UAAU,YAAY,CAAC,EAAE,EAAE;AAAA,CAC1C;AAGI,IAAM,2BAA2B,MAMnC,yDAAoD,CAAC,CAAC,EACtD,KAAY,WAAI,CAAC,aAAa,SAAS,SAAS,CAAC;AAG/C,IAAM,4BAA4B,CACvC,SAKG,OAAY,6DAAwD,IAAI,EAAE,KAAY,aAAM,CAAC;AAQ3F,IAAM,4BAA4B,CACvC,YACA,SAOA,OAEK,uEAAkE;AAAA,KAC9D;AAAA,EACH,aAAa;AACf,CAAC,EACA,KAAY,aAAM,CACvB;AAaK,IAAM,4BAA4B,CACvC,eAMA,OAEK,+DAA0D,EAAE,aAAa,WAAW,CAAC,EACrF,KACQ,eACA,gBAAS,cAAc,CAAC,aACtB,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,yBAAyB;AAAA,EAC7C,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,UAAU;AAAA,IAAG,OAAO,OAAc,YAAK,QAAQ;AAAA,CAClF,CACH,CACF,CACJ;;;AClJF;AAAA;AAEO,MAAM,uCAA4C,iBACvD,gCACF,EAEG;AAAC;AAAA;AACG,MAAM,qCAA0C,iBAAY,8BAA8B,EAE9F;AAAC;AAAA;AACG,MAAM,wCAA6C,iBACxD,iCACF,EAEG;AAAC;;;ACJJ;AAcO,IAAM,UAAU,CAAC,WAAqC;AAAA,EAC3D,MAAM,MAAM,QAAQ;AAAA,EACpB,kBAAkB,MAAM,oBAAoB;AAAA,EAC5C,sBAAsB,MAAM,wBAAwB,CAAC;AAAA,EACrD,SAAS,MAAM,WAAW,CAAC;AAAA,EAC3B,iBAAiB,MAAM,mBAAmB;AAC5C;AAGO,IAAM,kBAAkB,CAAC,WAAW,WAAW,YAAY;AAElE,IAAM,UAAU,CAAC,UAA4B,UAAU,aAAa,UAAU;AAQ9E,IAAM,QAAQ,CAAC,UACb,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,IAAI,OAAO,MAAM,SAAS,CAAC;AAMtE,IAAM,aAAa,CACxB,OACA,OAEA,MAAM;AAAA,KACD,QAAQ,KAAK;AAAA,EAChB,YAAY,QAAQ,MAAM,UAAU,IAAI,YAAY,MAAM;AAAA,EAC1D;AAAA,EACA,SAAS,QAAQ,MAAM,OAAO,IAAI,YAAY,MAAM;AAAA,EACpD,MAAM,MAAM;AAAA,EACZ,QAAQ,MAAM;AAAA,EACd,SAAS,QAAQ,MAAM,OAAO,IAAI,YAAY,MAAM;AACtD,CAAC;AAkBI,IAAM,aAAa,CAAC,UACzB,MAAM;AAAA,KACD,QAAQ,KAAK;AAAA,EAChB,YAAY,QAAQ,MAAM,UAAU,IAAI,YAAY,MAAM;AAAA,EAC1D,SAAS,QAAQ,MAAM,OAAO,IAAI,YAAY,MAAM;AAAA,EACpD,MAAM,MAAM;AAAA,EACZ,QAAQ,MAAM;AAAA,EACd,SAAS,QAAQ,MAAM,OAAO,IAAI,YAAY,MAAM;AACtD,CAAC;AAQI,IAAM,eAAe,CAC1B,MACA,UACY,gBAAgB,KAAK,CAAC,UAAU,CAAC,QAAQ,KAAK,MAAM,KAAK,QAAQ,MAAM,MAAM,CAAC;AAGrF,IAAM,UAAU,CACrB,MACA,UACY;AAAA,EACZ,MAAM,QAAQ,QAAQ,KAAK;AAAA,EAC3B,OACE,KAAK,WAAW,MAAM,UACtB,KAAK,SAAS,MAAM,QACpB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,oBAAoB,MAAM,mBAC/B,UAAU,KAAK,SAAS,MAAM,OAAO,KACrC,UAAU,KAAK,sBAAsB,MAAM,oBAAoB,MAC9D,QAAQ,MAAM,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,KAAK,YAAY,MAAM,aACxE,QAAQ,MAAM,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,UAAU,KAAK,SAAS,MAAM,OAAO,OACtF,QAAQ,MAAM,UAAU,IACrB,QAAQ,KAAK,UAAU,IACvB,UAAU,KAAK,YAAY,MAAM,UAAU;AAAA;AAWnD,IAAM,sBAAsB,IAAI,IAAI,CAAC,iBAAiB,aAAa,sBAAsB,CAAC;AAEnF,IAAM,uBAAuB,CAClC,YAEA,OAAO,QAAQ,WAAW,CAAC,CAAC,EACzB,OACC,EAAE,MAAM,WACN,oBAAoB,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE,SAAS,aAAa,CACxF,EACC,IAAI,EAAE,UAAU,IAAI;;;AHzElB,IAAM,6BAA6B,SACxC,6BACF;AAEO,IAAM,+BAA+B,CAAC,UACjC,sBAAY,OAAO,MAAM,KAAK,MAAM,SAAS;AAEzD,IAAM,eAAe,CACnB,KACA,gBACmC;AAAA,KAChC;AAAA,EACH,IAAI,IAAI,MAAM;AAChB;AAEA,IAAM,eAAe,CAAC,WAAmB,eACvC,mBAAmB,EAAE,IAAI,WAAW,YAAY,WAAW,MAAM,WAAW,GAAG,CAAC;AAOlF,IAAM,SAAS,CACb,MACA,UACA,SAIG;AAAA,EACH,MAAM,OAAO,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,QAAQ;AAAA,EACnD,MAAM,WAAW,SAAS,YAAY,KAAK,KAAK,CAAC,QAAQ,IAAI,SAAS,IAAI,IAAI;AAAA,EAC9E,OAAO,EAAE,UAAU,KAAK;AAAA;AAI1B,IAAM,kBAAkB,CAAC,UAA2C,SAClE,SAAS,mBAAmB,OACxB,IAAI,+BAA+B,EAAE,KAAK,CAAC,IAC3C,IAAI,6BAA6B,EAAE,KAAK,CAAC;AAG/C,IAAM,eAAe,CAAC,UAA2C,SAC/D,SAAS,mBAAmB,QAAQ,SAAS,OAAO,aAAa,SAAS,OAAO,OACtE,gBAAQ,QAAQ,aAAa,UAAU,SAAS,EAAE,CAAC,CAAC,IACpD,aAAK,gBAAgB,UAAU,IAAI,CAAC;AAEjD,IAAM,uBAAuB,CAAC,YAA2D;AAAA,EACvF,MAAM,MAAM,qBAAqB,OAAO;AAAA,EACxC,OAAO,IAAI,WAAW,IACX,eACA,aAAK,IAAI,gCAAgC,EAAE,SAAS,IAAI,CAAC,CAAC;AAAA;AAIhE,IAAM,sBAAsB;AAAA,EACjC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAOO,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,WAAW,QAAQ,OAAO,OAAO,aAAa,IAAI,UAAU;AAAA,IAClE,MAAM,OAAO,OAAO,yBAAyB;AAAA,IAC7C,QAAQ,UAAU,SAAS,OAAO,MAAM,UAAU,KAAK,IAAI;AAAA,IAC3D,IAAI,SAAS;AAAA,MAAW,OAAO,aAAa,MAAM,QAAQ;AAAA,IAC1D,IAAI,aAAa;AAAA,MAAW;AAAA,IAC5B,OAAO,OAAO,aAAa,UAAU,KAAK,IAAI;AAAA,GAC/C;AAAA,EAEH,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAKO,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,WAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,qBAAqB,KAAK,OAAO;AAAA,IACxC,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,IAAI,aAAa,QAAQ,IAAI;AAAA,MAAG,OAAO,EAAE,QAAQ,WAAW,aAAa,KAAK;AAAA,IAC9E,OAAO,QAAQ,QAAQ,IAAI,IACtB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAEH,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAOO,YAAI,UAAU,GAAG;AAAA,IACtB,OAAO,qBAAqB,KAAK,OAAO;AAAA,IACxC,MAAM,WAAW,QAAQ,OAAO,OAAO,aAAa,IAAI,UAAU;AAAA,IAClE,MAAM,OAAO,OAAO,yBAAyB;AAAA,IAC7C,QAAQ,UAAU,SAAS,OAAO,MAAM,UAAU,KAAK,IAAI;AAAA,IAE3D,IAAI,SAAS,WAAW;AAAA,MAKtB,IAAI,aAAa;AAAA,QAAW,OAAO,OAAc,aAAK,gBAAgB,UAAU,KAAK,IAAI,CAAC;AAAA,MAC1F,OAAO,0BAA0B,WAAW,MAAM,QAAQ,CAAC;AAAA,IAC7D,EAAO,SAAI,KAAK,mBAAmB,MAAM;AAAA,MAIvC,OAAO,OAAc,aAAK,IAAI,+BAA+B,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC;AAAA,IACnF,EAAO,SAAI,aAAa,aAAa,MAAM,QAAQ,GAAG,IAAI,GAAG;AAAA,MAC3D,OAAO,0BAA0B,QAAQ;AAAA,MACzC,OAAO,0BAA0B,WAAW,MAAM,QAAQ,CAAC;AAAA,IAC7D,EAAO,SAAI,CAAC,QAAQ,aAAa,MAAM,QAAQ,GAAG,IAAI,GAAG;AAAA,MACvD,MAAM,OAAO,WAAW,IAAI;AAAA,MAC5B,IAAI,OAAO,KAAK,IAAI,EAAE,SAAS;AAAA,QAAG,OAAO,0BAA0B,UAAU,IAAI;AAAA,IACnF;AAAA,IAEA,MAAM,SAAS,OAAO,yBAAyB,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,QAAQ;AAAA,IACnF,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,YACnB,IAAI,MACF,+BAA+B,KAAK,8CAClC,GAAG,iFACH,mDACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO,aAAa,OAAO,QAAQ;AAAA,GACpC;AAAA,EAEH,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAOO,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,WAAW,OAAO,OAAO,OAAO,aAAa,IAAI,UAAU;AAAA,IACjE,MAAM,OAAO,OAAO,yBAAyB;AAAA,IAC7C,MAAM,OAAO,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,QAAQ;AAAA,IAGnD,IAAI,SAAS,aAAa,KAAK,mBAAmB,QAAQ,KAAK,SAAS,KAAK;AAAA,MAAM;AAAA,IACnF,OAAO,0BAA0B,QAAQ;AAAA,GAC1C;AAAA,EAEH,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAC/B;AAEO,IAAM,qCAAqC,MACvC,gBACP,4BACO,gBAAQ,2BAA2B,SAAS,GAAG,mBAAmB,CAAC,CAC5E;;AIzOF;AACA;AAGO,IAAM,mBAAmB,CAAC,QAAkC,uBACjE,mCAAmC,EAAE,KAAW,cAAQ,KAAK,CAAC;",
   "debugId": "F883BA858F0CF3AD64756E2164756E21",
   "names": []
 }

package/dist/litellm/operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/litellm/operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,IAAI,MAAM,+BAA+B,CAAC;AAEtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACnD,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AAgCvC,oIAAoI;AACpI,eAAO,MAAM,wBAAwB,QAAO,MAAM,CAAC,MAAM,CACvD,SAAS,IAAI,CAAC,0BAA0B,EAAE,EAC1C,IAAI,CAAC,wDAAwD,EAC7D,gBAAgB,CAIqC,CAAC;AAExD,0FAA0F;AAC1F,eAAO,MAAM,yBAAyB,SAC9B,IAAI,CAAC,0BAA0B,KACpC,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,IAAI,CAAC,4DAA4D,EACjE,gBAAgB,CACiF,CAAC;AAEpG;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eACxB,MAAM,QACZ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,GACrE,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,MAAM,GAAG,QAAQ,CAAC,KACzD,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,IAAI,CAAC,sEAAsE,EAC3E,gBAAgB,CASf,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,eACxB,MAAM,KACjB,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,IAAI,CAAC,8DAA8D,EACnE,gBAAgB,CAcf,CAAC"}
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/litellm/operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,IAAI,MAAM,+BAA+B,CAAC;AAEtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACnD,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AAoCvC,oIAAoI;AACpI,eAAO,MAAM,wBAAwB,QAAO,MAAM,CAAC,MAAM,CACvD,SAAS,IAAI,CAAC,0BAA0B,EAAE,EAC1C,IAAI,CAAC,wDAAwD,EAC7D,gBAAgB,CAIqC,CAAC;AAExD,0FAA0F;AAC1F,eAAO,MAAM,yBAAyB,SAC9B,IAAI,CAAC,0BAA0B,KACpC,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,IAAI,CAAC,4DAA4D,EACjE,gBAAgB,CACiF,CAAC;AAEpG;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eACxB,MAAM,QACZ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,GACrE,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,MAAM,GAAG,QAAQ,CAAC,KACzD,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,IAAI,CAAC,sEAAsE,EAC3E,gBAAgB,CASf,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,eACxB,MAAM,KACjB,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,IAAI,CAAC,8DAA8D,EACnE,gBAAgB,CAcf,CAAC"}

package/dist/proxmox/ceph-daemon-form.d.ts

@@ -29,23 +29,22 @@
  *
  */
 import type { CephDaemonAttributes, CephDaemonKind, CephDaemonProps } from './ceph-daemon.ts';
-import type { EndpointPair } from './resource-spec.ts';
+import type { EndpointKey } from './constraints.ts';
 /**
  * The vendor endpoint each kind is created at, as the generated tables key it.
  *
  * ⛔ ONE PER KIND, NOT A `{type}` PATH. PVE registers `mds`, `mgr` and `mon` as three separate
  *   nodes with three separate parameter schemas — `hotstandby` belongs to the first and
  *   `mon-address` to the third — so a single key would enforce one kind's rules on all three.
- *   That is why `PveSpec['endpoint']` admits a function of props at all.
+ *   `ceph-daemon.ts` indexes this by `props.kind` for exactly that reason, on every `guardWrite`.
  * ⛔ THE STRINGS MUST STAY LITERALS. `codegen/constraints.ts` finds the endpoints to table by
  *   SCANNING THIS PACKAGE'S TEXT, so a key assembled from `props.kind` would be tabled by
  *   nothing and `constraintsFor` would throw on the first deploy that reached it.
  * ⚠️ THE PARAMETER NAMES DIFFER AND ARE THE VENDOR'S OWN — `{name}`, `{id}`, `{monid}`. The
  *   generator resolves each against the schema, so a tidied-up spelling stops the build.
- * ⚠️ NO `update` ON ANY OF THEM: none of the three has a PUT, which is why the spec declares no
- *   `updateForm` either.
+ * ⚠️ NO `update` HERE: none of the three kinds has a PUT — ceph-daemon-wire.ts's own header.
  */
-export declare const DAEMON_ENDPOINTS: Readonly<Record<CephDaemonKind, EndpointPair>>;
+export declare const DAEMON_ENDPOINTS: Readonly<Record<CephDaemonKind, EndpointKey>>;
 /**
  * PVE defaults the id to the nodename for all three kinds, and that default is resolved HERE
  * rather than left to PVE, because the id is a PATH SEGMENT: create, delete and the row lookup in

package/dist/proxmox/ceph-daemon-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-daemon-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-daemon-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC,CAI3E,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,UAAW,eAAe,WAA6B,CAAC;AAE7E;;;;;GAKG;AACH,eAAO,MAAM,cAAc,UAAW,eAAe,WAA6C,CAAC;AAEnG,kGAAkG;AAClG,eAAO,MAAM,UAAU,UAAW,eAAe,WAAkD,CAAC;AAEpG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,UAAW,eAAe,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMxE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,SAAU,OAAO,SAAS,eAAe,wCAGV,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,SACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,eAAe,KACrB,oBAAoB,GAAG,SAiBzB,CAAC"}
+{"version":3,"file":"ceph-daemon-form.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-daemon-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAI1E,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,UAAW,eAAe,WAA6B,CAAC;AAE7E;;;;;GAKG;AACH,eAAO,MAAM,cAAc,UAAW,eAAe,WAA6C,CAAC;AAEnG,kGAAkG;AAClG,eAAO,MAAM,UAAU,UAAW,eAAe,WAAkD,CAAC;AAEpG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,UAAW,eAAe,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMxE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,SAAU,OAAO,SAAS,eAAe,wCAGV,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,SACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,eAAe,KACrB,oBAAoB,GAAG,SAiBzB,CAAC"}

package/dist/proxmox/ceph-daemon-wire.d.ts

@@ -0,0 +1,33 @@
+/**
+ * `Proxmox.CephDaemon`'s distilled wire lane: one dispatch per kind, because mon/mgr/mds are three
+ * separate distilled operations with three separate request shapes (`{node,monid}` /
+ * `{node,id}` / `{node,name}`) — the SAME reason `DAEMON_ENDPOINTS` (ceph-daemon-form.ts) is a
+ * per-kind table rather than one templated string.
+ *
+ * ⛔ ONE READ FUNCTION, NOT THE readXOrFail/foldingX PAIR — the same deliberate, measured
+ *   departure ceph-pool-wire.ts and ceph-fs-distilled.ts explain in full: this family's
+ *   pre-migration `pveOperations.read` (resource.ts) already folded every failure unconditionally,
+ *   with no `output`-branching, so `readDaemon` below reproduces that exact single-fold shape
+ *   rather than gaining the newer dual-path pattern along the way.
+ *
+ * ⚠️ `mon_address` IS THE ONE RENAME THIS FAMILY NEEDS — distilled's generator maps the wire name
+ *   `mon-address` to `mon_address` on `UpdateNodeCephMonRequest` (`T.Body("mon-address")`,
+ *   confirmed against its schema), the same one-key pattern node-network-form.ts's `RENAMED`
+ *   table carries for three fields. `hotstandby` needs no rename.
+ */
+import * as nodes from '@distilled.cloud/proxmox/nodes';
+import * as Effect from 'effect/Effect';
+import type { CephDaemonKind, CephDaemonProps } from './ceph-daemon.ts';
+/** ⛔ FOLDS EVERY FAILURE TO `undefined` — see this file's own header for why. */
+export declare const readDaemon: (props: CephDaemonProps) => Effect.Effect<import("./ceph-daemon.ts").CephDaemonAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** POST — distilled's generator misnames it "update" (checked against `T.Http`); it is a create. */
+export declare const createDaemon: (props: CephDaemonProps) => Effect.Effect<string, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ⚠️ NO FLAGS ON ANY OF THE THREE — unlike CephFs/CephOsd, nothing here is at risk of a
+ *   DELETE-body PVE would ignore, because nothing here is ever sent. */
+export declare const deleteDaemon: (props: CephDaemonProps) => Effect.Effect<string, Error | import("./distilled-pve.ts").PveClusterExhausted | import("./credential-errors.ts").PveCredentialDenied | import("effect/Cause").TimeoutError | nodes.ProxmoxOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** Re-exported so ceph-daemon.ts can narrow a switch exhaustively without importing the union twice. */
+export type { CephDaemonKind };
+/** ★ Moved here from ceph-daemon.ts's `reconcile` for the 250-line cap — matches ceph-fs.ts's own
+ *  `notCreated`/`notDestroyed` seam: the message, not the decision to die, lives with the calls. */
+export declare const notCreated: (props: CephDaemonProps) => Error;
+//# sourceMappingURL=ceph-daemon-wire.d.ts.map

package/dist/proxmox/ceph-daemon-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-daemon-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-daemon-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AA+BxE,iFAAiF;AACjF,eAAO,MAAM,UAAU,UAAW,eAAe,4IAI9C,CAAC;AAEJ,oGAAoG;AACpG,eAAO,MAAM,YAAY,UAAW,eAAe,8PA6BlD,CAAC;AAEF;wEACwE;AACxE,eAAO,MAAM,YAAY,UAAW,eAAe,8PAWlD,CAAC;AAEF,wGAAwG;AACxG,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;oGACoG;AACpG,eAAO,MAAM,UAAU,UAAW,eAAe,UAK9C,CAAC"}

package/dist/proxmox/ceph-daemon.d.ts

@@ -45,9 +45,14 @@
  *   needs no widening for once. ⚠️ `Sys.Modify` on the ROOT path is broad — it also buys
  *   datacenter options and every other cluster-wide config write — so it is worth knowing that
  *   this credential already has it rather than discovering it the next time something is scoped.
+ *
+ * ★ MIGRATED OFF `client.ts` (2026-09-24, decision 43, 2c) — ceph-daemon-wire.ts has the rename
+ *   and why no protocol gap blocks any of the three kinds; `readDaemon` there keeps this family's
+ *   pre-migration single-fold shape (ceph-pool-wire.ts explains why that is not left unfixed).
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
 import { type PveRequirements, type WithTarget } from './resource.ts';
 /**
  * Which Ceph daemon this is. The discriminant picks the collection, the create parameters and
@@ -158,5 +163,35 @@ export interface ProxmoxCephDaemon extends Resource<'Proxmox.CephDaemon', CephDa
 }
 /** ★ `retain` by default — a mon carrying quorum cannot be rebuilt. See the ★ in resource.ts. */
 export declare const ProxmoxCephDaemon: import("alchemy").ResourceClass<ProxmoxCephDaemon>;
+/**
+ * ⛔ TOTAL, AND THIS IS THE REASON THE FILE EXISTS RATHER THAN A SHORTCUT PAST WRITING IT. Every
+ *   field a declaration can carry is CREATE-ONLY and unreadable — `mon-address` comes back as a
+ *   different kind of string, `hotstandby` comes back as a state Ceph elects — and every field
+ *   the read returns is assigned by Ceph: state, rank, quorum, fs_name, standby_replay, addr,
+ *   version. Nothing is left that is both declared and readable. So the honest comparison is
+ *   "does a daemon of this kind and name exist", which `readDaemon` has already answered by
+ *   returning a value at all, and anything further would be a diff no write could ever satisfy.
+ *   ⛔ AND ON THIS FAMILY THAT DIFF IS NOT MERELY NOISY. There is no PUT, so a false mismatch
+ *     would have to be a REPLACE — and replace on a mon is delete-then-create against a live
+ *     quorum. A forever-diff here is a forever-OUTAGE-RISK.
+ *   ⚠️ THE PRICE, STATED PLAINLY: editing `hotstandby` or `mon-address` on a declared daemon
+ *     plans as `noop` and never applies. Same bargain storage.ts strikes for a changed `type`.
+ *     Change one by removing the declaration and re-adding it, ONE DAEMON AT A TIME, reading the
+ *     ⛔ on destroy in the header first.
+ */
+/**
+ * ★ The factory's shape with no `updateForm`: create if absent, else read back untouched.
+ * ⛔ `guardWrite` RUNS RIGHT AFTER THE READ, UNCONDITIONALLY, NOT ONLY ON THE CREATE BRANCH —
+ *   found on adversarial review, 2026-09-24, matching node-network.ts's own `reconcile`.
+ *   `reconcile` also runs for an ADOPTED row with no fresh `diff` first (Plan.ts forces it after
+ *   the probe even when `diff` said noop), so a guard only on the create branch would let a
+ *   caller that skips `diff` (a resumed apply, a verify harness) reach `createDaemon` with
+ *   `mon-address` — a real vendor rule — unchecked.
+ * ★ EXPORTED SO A TEST CAN CALL IT DIRECTLY, bypassing `diff` — the shape the review's own proof
+ *   needed: `findProvider` gives back the wrapped service, this gives the plain function.
+ */
+export declare const reconcileDaemon: (args_0: {
+    news: CephDaemonProps;
+}) => Effect.Effect<CephDaemonAttributes, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 export declare const ProxmoxCephDaemonProvider: () => import("effect/Layer").Layer<Provider.Provider<ProxmoxCephDaemon>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=ceph-daemon.d.ts.map

package/dist/proxmox/ceph-daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-daemon.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAU7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEnD,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,IAAI,EAAE,cAAc,CAAC;IACrB;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;IAChB,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AA+BH,eAAO,MAAM,yBAAyB,uIAoBnC,CAAC"}
+{"version":3,"file":"ceph-daemon.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEnD,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,IAAI,EAAE,cAAc,CAAC;IACrB;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;IAChB,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe;UAA0C,eAAe;8NAQnF,CAAC;AAEH,eAAO,MAAM,yBAAyB,uIA8BnC,CAAC"}

package/dist/proxmox/ceph-fs-distilled.d.ts

@@ -0,0 +1,14 @@
+import * as Effect from 'effect/Effect';
+import type { CephFsProps } from './ceph-fs.ts';
+/**
+ * The index, read via distilled — the same shape `readRow` (ceph-fs-wire.ts) already narrows.
+ *
+ * ⛔ FOLDS EVERY FAILURE TO `undefined`, matching the pre-migration `pveOperations.read` this
+ *   family used (`resource.ts`, `Effect.orElseSucceed`) — the same single-fold shape
+ *   ceph-pool-wire.ts's `readPoolStatus` preserves and explains: this migration's own rule is
+ *   behaviour surviving byte-for-byte, not the newer dual-path pattern gaining a new family.
+ */
+export declare const readFs: (props: CephFsProps) => Effect.Effect<import("./ceph-fs.ts").CephFsAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** POST the create, then wait for the worker. ⛔ The caller still reads back; see ceph-fs.ts. */
+export declare const createFs: (props: CephFsProps) => Effect.Effect<undefined, Error | import("effect/unstable/http/HttpClientError").HttpClientError | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=ceph-fs-distilled.d.ts.map

package/dist/proxmox/ceph-fs-distilled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceph-fs-distilled.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-fs-distilled.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIhD;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,UAAW,WAAW,oIAItC,CAAC;AA2CJ,gGAAgG;AAChG,eAAO,MAAM,QAAQ,UAAW,WAAW,kNAoBvC,CAAC"}

package/dist/proxmox/ceph-fs-wire.d.ts

@@ -48,6 +48,17 @@
  *   user needs 'Sys.Audit' permissions on '/nodes/<node>' if they are not the owner of the task."
  *   Grant it on the `read` role, or every create burns the full cap below and reports the wrong
  *   cause.
+ *
+ * ★ AS OF 2026-09-24 (decision 43's walk-down, 2c) THIS FILE IS `client.ts`'s HALF ONLY. The read
+ *   (`readRow`) moved to `ceph-fs-distilled.ts`, and so did the create — `nodes.updateNodeCephFs`
+ *   (distilled's own misnamed POST, confirmed against its `T.Http` annotation) plus a SEPARATE
+ *   distilled `settle`, using the raw `getNodeTaskStatus` operation in its own tolerant poll loop
+ *   rather than `Task.awaitTask`, which does not tolerate a poll failure the way this family needs
+ *   (network-apply-read.ts's own header has the fuller reasoning). `destroyFs` stays HERE,
+ *   unmigrated: distilled types `remove_pools`/`remove_storages` as `T.Body` on a DELETE, and the
+ *   ⛔ two paragraphs up is the MEASURED reason PVE would silently ignore both flags if sent that
+ *   way — a real protocol gap, not a judgement call. `settle` below is still shared where it can
+ *   be: `createForm`/`objectPath`/`destroyPath` are pure and reused by the distilled file too.
  */
 import * as Effect from 'effect/Effect';
 import type { CephFsAttributes, CephFsProps } from './ceph-fs.ts';
@@ -63,24 +74,22 @@ import type { CephFsAttributes, CephFsProps } from './ceph-fs.ts';
  *   `reconcile` takes the create branch on exactly that signal.
  */
 export declare const readRow: (live: Record<string, unknown>, props: CephFsProps) => CephFsAttributes | undefined;
+/**
+ * ⚠️ SHORT POLLS, LOW CAP. Ninety seconds covers two pool creates plus the ten seconds `createfs`
+ *   itself spends waiting for an MDS to go active, and is short enough that a stuck task fails the
+ *   deploy rather than parking it for the afternoon.
+ */
+export declare const POLL_SECONDS = 2;
+export declare const POLL_ATTEMPTS = 45;
 /** ⚠️ `nodes/{n}/ceph/fs/{name}` — the POST and DELETE target, and NOT where a read goes. */
 export declare const objectPath: (props: CephFsProps) => string;
+/** The vendor rules `createForm` is checked against — `guardWrite`, distilled-guard.ts. */
+export declare const CEPH_FS_CREATE = "pve:POST /nodes/{node}/ceph/fs/{name}";
 /**
  * ⚠️ `name` IS DELIBERATELY ABSENT FROM THE FORM. It is already the last segment of the path being
  *   POSTed to — the metric-server.ts case again — and a second copy can only ever disagree with it.
  */
 export declare const createForm: (props: CephFsProps) => Record<string, string>;
-/**
- * POST the create, then wait for the worker. ⛔ The caller still reads back; see ceph-fs.ts.
- *
- * ⚠️ A CREATE NEEDS A RUNNING *AND* A STANDBY MDS, and refuses BEFORE it forks -- "no running
- *   Metadata Server (MDS) found!" / "no standby Metadata Server (MDS) found!" are synchronous, so
- *   they surface as a failed POST rather than as a silent worker. C1 has three (MEASURED: node-c
- *   `up:active` for cephfs-c1, node-b and node-d `up:standby`), so this is a note for a smaller cluster.
- * ⚠️ BOTH WRITES CHECK `Sys.Modify` ON `/` -- the root, with the breadth metric-server.ts warns
- *   about: granting it buys datacenter options and every other cluster-wide config write too.
- */
-export declare const createFs: (props: CephFsProps) => Effect.Effect<undefined, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * DELETE the filesystem, then wait for the worker.
  *