@homeflare/alchemy 0.37.2 → 0.37.4

package/dist/proxmox/index.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
-  "sources": ["../src/proxmox/acl.ts", "../src/proxmox/constraint-guard.ts", "../src/proxmox/constraints.ts", "../src/proxmox/generated/constraints/pve-access.ts", "../src/proxmox/generated/constraints/pve-cluster-backup.ts", "../src/proxmox/generated/constraints/pve-cluster-ceph.ts", "../src/proxmox/generated/constraints/pve-cluster-firewall.ts", "../src/proxmox/generated/constraints/pve-cluster-ha.ts", "../src/proxmox/generated/constraints/pve-cluster-metrics.ts", "../src/proxmox/generated/constraints/pve-cluster-notifications.ts", "../src/proxmox/generated/constraints/pve-cluster-replication.ts", "../src/proxmox/generated/constraints/pve-cluster-sdn.ts", "../src/proxmox/generated/constraints/pve-nodes-ceph.ts", "../src/proxmox/generated/constraints/pve-nodes-disks.ts", "../src/proxmox/generated/constraints/pve-nodes-lxc.ts", "../src/proxmox/generated/constraints/pve-nodes-network.ts", "../src/proxmox/generated/constraints/pve-nodes-qemu.ts", "../src/proxmox/generated/constraints/pve-pools.ts", "../src/proxmox/generated/constraints/pve-storage.ts", "../src/proxmox/generated/constraints/pbs-config.ts", "../src/proxmox/generated/constraints/index.ts", "../src/proxmox/acl-wire.ts", "../src/proxmox/distilled-pve.ts", "../src/proxmox/lease-cache.ts", "../src/proxmox/mint.ts", "../src/proxmox/credential-errors.ts", "../src/proxmox/members.ts", "../src/proxmox/unreadable-read.ts", "../src/proxmox/alertmanager-body.ts", "../src/proxmox/api-token.ts", "../src/proxmox/values.ts", "../src/proxmox/api-token-form.ts", "../src/proxmox/distilled-guard.ts", "../src/proxmox/backup-job.ts", "../src/proxmox/resource.ts", "../src/proxmox/client.ts", "../src/proxmox/resource-guard.ts", "../src/proxmox/update-guard.ts", "../src/proxmox/ceph-daemon.ts", "../src/proxmox/ceph-daemon-form.ts", "../src/proxmox/ceph-daemon-wire.ts", "../src/proxmox/ceph-flag.ts", "../src/proxmox/ceph-fs.ts", "../src/proxmox/ceph-fs-distilled.ts", "../src/proxmox/ceph-fs-wire.ts", "../src/proxmox/ceph-osd.ts", "../src/proxmox/ceph-osd-tree.ts", "../src/proxmox/ceph-osd-write.ts", "../src/proxmox/ceph-pool.ts", "../src/proxmox/ceph-pool-form.ts", "../src/proxmox/ceph-pool-settle.ts", "../src/proxmox/ceph-pool-wire.ts", "../src/proxmox/firewall-alias.ts", "../src/proxmox/firewall-alias-form.ts", "../src/proxmox/group.ts", "../src/proxmox/group-wire.ts", "../src/proxmox/ha-resource.ts", "../src/proxmox/ha-rule.ts", "../src/proxmox/ha-rule-form.ts", "../src/proxmox/lxc.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/ownership/probe.ts", "../src/proxmox/lxc-wire.ts", "../src/proxmox/lxc-props.ts", "../src/proxmox/lxc-volume.ts", "../src/proxmox/lxc-judge.ts", "../src/proxmox/lxc-create-form.ts", "../src/proxmox/lxc-identity.ts", "../src/proxmox/lxc-adoption.ts", "../src/ownership/adopting.ts", "../src/proxmox/lxc-lifecycle.ts", "../src/proxmox/network-apply-read.ts", "../src/proxmox/metric-server.ts", "../src/proxmox/metric-server-form.ts", "../src/proxmox/metric-server-otel.ts", "../src/proxmox/network-apply.ts", "../src/proxmox/apply-endpoints.ts", "../src/proxmox/node-network.ts", "../src/proxmox/node-network-form.ts", "../src/proxmox/node-network-wire.ts", "../src/proxmox/notification-matcher.ts", "../src/proxmox/notification-matcher-form.ts", "../src/proxmox/notification-target.ts", "../src/proxmox/notification-target-endpoint.ts", "../src/proxmox/notification-target-form.ts", "../src/proxmox/pbs-datastore.ts", "../src/proxmox/pbs-datastore-form.ts", "../src/proxmox/pbs-datastore-guard.ts", "../src/proxmox/pbs-datastore-endpoint.ts", "../src/proxmox/pbs-notification-matcher.ts", "../src/proxmox/pbs-notification-target.ts", "../src/proxmox/pbs-notification-target-lifecycle.ts", "../src/proxmox/pbs-notification-target-endpoint.ts", "../src/proxmox/credential-literals.ts", "../src/proxmox/pbs-notification-target-wire.ts", "../src/secrets/write-only.ts", "../src/proxmox/pbs-notification-target-form.ts", "../src/proxmox/pbs-prune-job.ts", "../src/proxmox/pbs-prune-job-form.ts", "../src/proxmox/pbs-sync-job.ts", "../src/proxmox/pbs-sync-job-form.ts", "../src/proxmox/pbs-verify-job.ts", "../src/proxmox/pbs-verify-job-form.ts", "../src/proxmox/pool.ts", "../src/proxmox/provision-baseline.ts", "../src/proxmox/provision-bootstrap.ts", "../src/proxmox/provision-declare.ts", "../src/proxmox/role.ts", "../src/proxmox/role-wire.ts", "../src/proxmox/user.ts", "../src/proxmox/user-wire.ts", "../src/proxmox/qemu.ts", "../src/proxmox/replication-job.ts", "../src/proxmox/replication-job-form.ts", "../src/proxmox/sdn-apply.ts", "../src/proxmox/sdn-apply-read.ts", "../src/proxmox/sdn-subnet.ts", "../src/proxmox/sdn-subnet-form.ts", "../src/proxmox/sdn-vnet.ts", "../src/proxmox/sdn-zone.ts", "../src/proxmox/storage.ts", "../src/proxmox/storage-form.ts", "../src/proxmox/storage-wire.ts", "../src/proxmox/zfs-pool.ts", "../src/proxmox/zfs-pool-wire.ts", "../src/proxmox/zfs-pool-form.ts"],
+  "sources": ["../src/proxmox/acl.ts", "../src/proxmox/constraint-guard.ts", "../src/proxmox/constraints.ts", "../src/proxmox/generated/constraints/pve-access.ts", "../src/proxmox/generated/constraints/pve-cluster-backup.ts", "../src/proxmox/generated/constraints/pve-cluster-ceph.ts", "../src/proxmox/generated/constraints/pve-cluster-firewall.ts", "../src/proxmox/generated/constraints/pve-cluster-ha.ts", "../src/proxmox/generated/constraints/pve-cluster-metrics.ts", "../src/proxmox/generated/constraints/pve-cluster-notifications.ts", "../src/proxmox/generated/constraints/pve-cluster-replication.ts", "../src/proxmox/generated/constraints/pve-cluster-sdn.ts", "../src/proxmox/generated/constraints/pve-nodes-ceph.ts", "../src/proxmox/generated/constraints/pve-nodes-disks.ts", "../src/proxmox/generated/constraints/pve-nodes-lxc.ts", "../src/proxmox/generated/constraints/pve-nodes-network.ts", "../src/proxmox/generated/constraints/pve-nodes-qemu.ts", "../src/proxmox/generated/constraints/pve-pools.ts", "../src/proxmox/generated/constraints/pve-storage.ts", "../src/proxmox/generated/constraints/pbs-config.ts", "../src/proxmox/generated/constraints/index.ts", "../src/proxmox/acl-wire.ts", "../src/proxmox/distilled-pve.ts", "../src/proxmox/lease-cache.ts", "../src/proxmox/mint.ts", "../src/proxmox/credential-errors.ts", "../src/proxmox/members.ts", "../src/proxmox/unreadable-read.ts", "../src/proxmox/alertmanager-body.ts", "../src/proxmox/api-token.ts", "../src/proxmox/values.ts", "../src/proxmox/api-token-form.ts", "../src/proxmox/distilled-guard.ts", "../src/proxmox/backup-job.ts", "../src/proxmox/resource-guard.ts", "../src/proxmox/update-guard.ts", "../src/proxmox/backup-job-config.ts", "../src/proxmox/backup-job-distilled.ts", "../src/proxmox/ceph-daemon.ts", "../src/proxmox/ceph-daemon-form.ts", "../src/proxmox/ceph-daemon-wire.ts", "../src/proxmox/ceph-flag.ts", "../src/proxmox/resource.ts", "../src/proxmox/client.ts", "../src/proxmox/ceph-fs.ts", "../src/proxmox/ceph-fs-distilled.ts", "../src/proxmox/ceph-fs-wire.ts", "../src/proxmox/ceph-osd.ts", "../src/proxmox/ceph-osd-tree.ts", "../src/proxmox/ceph-osd-write.ts", "../src/proxmox/ceph-pool.ts", "../src/proxmox/ceph-pool-form.ts", "../src/proxmox/ceph-pool-settle.ts", "../src/proxmox/ceph-pool-wire.ts", "../src/proxmox/firewall-alias.ts", "../src/proxmox/firewall-alias-form.ts", "../src/proxmox/group.ts", "../src/proxmox/group-wire.ts", "../src/proxmox/ha-resource.ts", "../src/proxmox/ha-rule.ts", "../src/proxmox/ha-rule-form.ts", "../src/proxmox/lxc.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/ownership/probe.ts", "../src/proxmox/lxc-wire.ts", "../src/proxmox/lxc-props.ts", "../src/proxmox/lxc-volume.ts", "../src/proxmox/lxc-judge.ts", "../src/proxmox/lxc-create-form.ts", "../src/proxmox/lxc-identity.ts", "../src/proxmox/lxc-adoption.ts", "../src/ownership/adopting.ts", "../src/proxmox/lxc-lifecycle.ts", "../src/proxmox/network-apply-read.ts", "../src/proxmox/metric-server.ts", "../src/proxmox/metric-server-form.ts", "../src/proxmox/metric-server-otel.ts", "../src/proxmox/metric-server-config.ts", "../src/proxmox/metric-server-distilled.ts", "../src/proxmox/network-apply.ts", "../src/proxmox/apply-endpoints.ts", "../src/proxmox/node-network.ts", "../src/proxmox/node-network-form.ts", "../src/proxmox/node-network-wire.ts", "../src/proxmox/notification-matcher.ts", "../src/proxmox/notification-matcher-lifecycle.ts", "../src/proxmox/notification-matcher-form.ts", "../src/proxmox/notification-matcher-distilled.ts", "../src/proxmox/notification-sdk-input.ts", "../src/proxmox/notification-target.ts", "../src/proxmox/notification-target-lifecycle.ts", "../src/proxmox/notification-target-endpoint.ts", "../src/proxmox/notification-target-form.ts", "../src/proxmox/notification-target-spec.ts", "../src/proxmox/notification-target-distilled.ts", "../src/proxmox/pbs-datastore.ts", "../src/proxmox/pbs-datastore-lifecycle.ts", "../src/proxmox/pbs-datastore-form.ts", "../src/proxmox/pbs-datastore-wire.ts", "../src/proxmox/distilled-pbs.ts", "../src/proxmox/pbs-datastore-guard.ts", "../src/proxmox/pbs-datastore-endpoint.ts", "../src/proxmox/pbs-notification-matcher.ts", "../src/proxmox/pbs-notification-matcher-distilled.ts", "../src/proxmox/pbs-notification-input.ts", "../src/proxmox/pbs-notification-target.ts", "../src/proxmox/pbs-notification-target-lifecycle.ts", "../src/proxmox/pbs-notification-target-distilled.ts", "../src/proxmox/pbs-notification-target-wire.ts", "../src/secrets/write-only.ts", "../src/proxmox/pbs-notification-target-endpoint.ts", "../src/proxmox/credential-literals.ts", "../src/proxmox/pbs-notification-target-form.ts", "../src/proxmox/pbs-prune-job.ts", "../src/proxmox/pbs-prune-job-lifecycle.ts", "../src/proxmox/pbs-prune-job-form.ts", "../src/proxmox/pbs-prune-job-spec.ts", "../src/proxmox/pbs-prune-job-wire.ts", "../src/proxmox/pbs-sync-job.ts", "../src/proxmox/pbs-sync-job-lifecycle.ts", "../src/proxmox/pbs-sync-job-form.ts", "../src/proxmox/pbs-sync-job-wire.ts", "../src/proxmox/pbs-verify-job.ts", "../src/proxmox/pbs-verify-job-lifecycle.ts", "../src/proxmox/pbs-verify-job-form.ts", "../src/proxmox/pbs-verify-job-spec.ts", "../src/proxmox/pbs-verify-job-wire.ts", "../src/proxmox/pool.ts", "../src/proxmox/provision-baseline.ts", "../src/proxmox/provision-bootstrap.ts", "../src/proxmox/provision-declare.ts", "../src/proxmox/role.ts", "../src/proxmox/role-wire.ts", "../src/proxmox/user.ts", "../src/proxmox/user-wire.ts", "../src/proxmox/qemu.ts", "../src/proxmox/replication-job.ts", "../src/proxmox/replication-job-form.ts", "../src/proxmox/sdn-apply.ts", "../src/proxmox/sdn-apply-read.ts", "../src/proxmox/sdn-subnet.ts", "../src/proxmox/sdn-subnet-form.ts", "../src/proxmox/sdn-vnet.ts", "../src/proxmox/sdn-zone.ts", "../src/proxmox/storage.ts", "../src/proxmox/storage-form.ts", "../src/proxmox/storage-wire.ts", "../src/proxmox/zfs-pool.ts", "../src/proxmox/zfs-pool-wire.ts", "../src/proxmox/zfs-pool-form.ts"],
   "sourcesContent": [
     "/**\n * `Proxmox.Acl` — one grant: a role bound to a subject at a path. The line that makes a role real.\n *\n * ★ USERS, GROUPS, ROLES AND TOKENS ARE ALL INERT UNTIL AN ACL BINDS THEM. A role is a named list\n *   of privileges that grants nothing by itself; a user can do nothing until\n *   {path, user|group|token, role} exists. That is what makes those four families worth declaring,\n *   and why the grants that let OpenBao mint a PVE token today are only clicks somebody made once.\n *\n * ⛔ THE ONE FAMILY THAT DOES NOT FIT A GENERIC PATH+FORM SHAPE, AND THE MISFIT IS MEASURED. The\n *   cluster's own schema — `/pve-docs/api-viewer/apidoc.js`, read unauthenticated 2026-09-13 —\n *   lists exactly TWO methods on `/access/acl`: GET and PUT. There is no DELETE (it answers\n *   \"Method 'DELETE /access/acl' not implemented\") and, less famously, NO POST either — which is\n *   why `@distilled.cloud/proxmox`'s generator, reading the same schema, emits `listAccessAcl` and\n *   `putAccessAcl` and NOTHING ELSE for this path. So create and update are the SAME call, `PUT\n *   /access/acl`, and removal is that PUT with `delete=1` — there is no `destroyAccessAcl` to call.\n *\n * ⛔ A SINGLE GRANT HAS NO URL OF ITS OWN. `GET /access/acl` answers ONE FLAT LIST for the whole\n *   cluster, so identity is the tuple (path, type, ugid, roleid), matched client-side in `find`\n *   below. Two resources declaring the SAME tuple are the SAME grant — Alchemy sees two resource\n *   ids, not one collision — and deleting either takes the access away from both, the same hazard\n *   as two guests declaring one vmid.\n *\n * ⛔ AND THAT LIST IS FILTERED BY WHO IS ASKING. The schema's own words for GET: \"The returned list\n *   is restricted to objects where you have rights to modify permissions.\" A credential that can\n *   read the cluster but not modify permissions is answered `[]` — not a 403, not an error — so\n *   the mount's `read` role needs permission-modify rights on the declared path exactly as\n *   `provision` does (below, `listAcl` reads with the `provision` role for this reason). Work\n *   reported on a grant that is plainly there means that role is too narrow.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()` ONTO `@distilled.cloud/proxmox`'s typed\n *   `access.listAccessAcl`/`access.putAccessAcl` (2026-09-23, decision 43's proxmox walk-down,\n *   the sub-area's first resource — ACL was already the misfit `pveOperations` could not cover\n *   cleanly, which is exactly why it goes first). `distilled-pve.ts`'s `runPve` replaces `pve()`:\n *   same lease reuse (lease-cache.ts), same cluster-member failover (members.ts), now handing the\n *   request itself to the SDK instead of a hand-assembled `HttpClientRequest`.\n *   ⛔ ONE DEAD BRANCH REMOVED, NOT PRESERVED: the old code's generic factory POSTed on a \"live\n *     undefined\" read, which its own header called unreachable on a healthy cluster and\n *     documented as MISLEADING — PVE has no POST here, so that 501 said nothing about the real\n *     failure. `@distilled.cloud/proxmox` has no `createAccessAcl` at all (the vendor schema has\n *     no POST to generate one from), so there is nothing to call that way. `reconcile` below\n *     always PUTs instead — the only write PVE actually implements for this path — so a read that\n *     genuinely failed now surfaces its REAL cause (a typed error, or `PveClusterExhausted`)\n *     rather than a confusing 501 from a verb that was never there.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as access from '@distilled.cloud/proxmox/access';\nimport * as Effect from 'effect/Effect';\nimport { attributesOf, bind, guardWrite, identity, matches, tuple } from './acl-wire.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport {\n  UNREADABLE,\n  type Unreadable,\n  readOrUnreadable,\n  unreadableWarning,\n} from './unreadable-read.ts';\n\n/** PVE's three kinds of subject. The read answers this word; the write wants its plural. */\nexport type AclSubjectType = 'user' | 'group' | 'token';\n\nexport interface AclProps extends WithTarget {\n  /**\n   * The PVE object path the grant is ON — `/`, `/pool/lab`, `/vms/101`, `/storage/local-zfs`.\n   * ⚠️ NOT THE API PATH — the endpoint is fixed (`access/acl`). PVE's API overloads the word,\n   *   so this file does too rather than renaming a field the cluster calls `path`.\n   */\n  path: string;\n  /** Which kind of subject `ugid` names. Identity: changing it is a different grant. */\n  type: AclSubjectType;\n  /** `alice@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */\n  ugid: string;\n  /** The role bound here, e.g. `PVEAuditor`. ⚠️ It must exist — PVE refuses an unknown roleid. */\n  roleid: string;\n  /** Inherit down the path. PVE's default is ON, and this is the grant's ONLY mutable field. */\n  propagate?: boolean;\n}\n\nexport interface AclAttributes {\n  path: string;\n  type: AclSubjectType;\n  ugid: string;\n  roleid: string;\n  propagate: boolean;\n  /** Presence, so a PUT-only family can tell \"matches\" from \"does not exist yet\" — see below. */\n  bound: boolean;\n}\n\nexport interface ProxmoxAcl extends Resource<\n  'Proxmox.Acl',\n  AclProps,\n  AclAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxAcl = Resource<ProxmoxAcl>('Proxmox.Acl');\n\n/**\n * ⛔ `readRole: 'provision'`, WITHOUT WHICH EVERY GRANT READS BACK AS ABSENT — see the header's\n *   ⛔ on filtering.\n * ★ `readOrUnreadable` (unreadable-read.ts) runs first: a REFUSED mint of `provision` — the\n *   \"cries wolf\" bug — comes back `UNREADABLE` instead of the `undefined` a genuine, SUCCESSFUL\n *   read (the row simply not being in the list) produces, so `diff` below can tell them apart.\n * ⛔ NO `orElseSucceed` HERE ANY MORE — found on 2026-09-24, the SAME bug class as the credential\n *   denial: it used to fold EVERY OTHER failure (a transport error, `PveClusterExhausted`, a\n *   decode failure) into `undefined` too, which then read exactly like a genuine absence and\n *   forced the same false `update`. Only a read that actually SUCCEEDS (and the grant is not in\n *   the list it returns) may mean absent now; every other failure propagates and fails the whole\n *   plan loudly — the engine's own contract for a failed `read`/`diff` (verify.ts's `readWithState`\n *   already expects and reports it as `'failed'`).\n */\nconst readAttributes = (props: AclProps) =>\n  readOrUnreadable(runPve(props.target, 'provision', false, access.listAccessAcl({}))).pipe(\n    Effect.map((rows) => (rows === UNREADABLE ? UNREADABLE : attributesOf(rows, props))),\n  );\n\n/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */\nconst dropUnreadable = (live: AclAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n\nexport const ProxmoxAclProvider = () =>\n  Provider.effect(\n    ProxmoxAcl,\n    Effect.succeed(\n      ProxmoxAcl.Provider.of({\n        /** ⛔ EMPTY LIKE EVERY OTHER PVE RESOURCE. Adopting every grant a human ever clicked is not adoption. */\n        list: () => Effect.succeed([]),\n        read: Effect.fn(function* ({ olds }) {\n          return dropUnreadable(yield* readAttributes(olds));\n        }),\n        /**\n         * ⛔ AN IDENTITY CHANGE IS A REPLACE. Editing `roleid` (or the subject, or the path) would\n         *   PUT the NEW grant and LEAVE THE OLD ONE BOUND; replace makes Alchemy `delete` the old\n         *   props first, the only thing that removes it. Create-first (Alchemy's default) is\n         *   deliberate: delete-first could remove the very grant the provision credential mints\n         *   against.\n         */\n        diff: Effect.fn(function* ({ news, output }) {\n          if (output !== undefined && isResolved(news) && identity(news) !== identity(output)) {\n            return { action: 'replace' } as const;\n          }\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(news);\n          if (output === undefined) return undefined;\n          const live = yield* readAttributes(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and\n          //   force `update` on a grant that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning('Proxmox.Acl', identity(news));\n            return { action: 'noop' } as const;\n          }\n          return live !== undefined && matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        /**\n         * ⚠️ THE READ-BACK GUARD, FOR A FAMILY WHOSE \"ABSENT\" IS `bound: false`, NOT `undefined`.\n         *   PVE answers 200 with `{\"data\":null}` on calls that did nothing: without this, a PUT\n         *   that silently no-oped is recorded as a landed grant and the next plan reads noop over\n         *   the gap.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the\n          //   write below, so `UNREADABLE` here is a near-impossible race, not the routine case\n          //   `diff` handles — treating it as \"not yet bound\" costs at most one redundant PUT.\n          const before = dropUnreadable(yield* readAttributes(news));\n          yield* guardWrite(news);\n          if (before === undefined || !matches(before, news)) {\n            yield* runPve(news.target, 'provision', true, access.putAccessAcl(bind(news)));\n          }\n          const after = dropUnreadable(yield* readAttributes(news));\n          if (after === undefined || !after.bound) {\n            return yield* Effect.die(\n              new Error(\n                `access/acl: the write returned no error but ${identity(news)} is still not ` +\n                  'bound. Either the PUT did nothing, or the read credential cannot see the ' +\n                  'grant -- GET /access/acl is filtered to paths you may MODIFY permissions on, ' +\n                  'so a read-only role is answered [] rather than 403.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ NOT A DESTROY CALL — THERE IS NONE. `DELETE /access/acl` is not implemented; removal\n         *   is the same PUT with `delete=1` and the identity tuple, no `propagate`, because\n         *   removal is keyed on the tuple and nothing else.\n         * ⚠️ IDEMPOTENT, AND CLUSTER-WIDE: removing a grant that is already gone is a no-op, but\n         *   the tuple is shared — re-read the header's second ⛔ before assuming this only takes\n         *   away what this stack declared.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          const removal: access.PutAccessAclRequest = { ...tuple(olds), delete: '1' };\n          yield* runPve(olds.target, 'provision', true, access.putAccessAcl(removal));\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * The generated tables, looked up by endpoint, and the refusal that stops a plan.\n *\n * ★ ONE FILE BETWEEN THE PROVIDERS AND THE GENERATED DATA, so `resource.ts` gains three lines\n *   rather than an import of two generated modules and a merge, and so a family that writes its\n *   own handlers (CephPool, PbsDatastore) reaches the same check by the same name.\n *\n * ⛔ AN UNKNOWN KEY IS A DEFECT, NOT A REASON TO SKIP THE CHECK. Silently passing would put us back\n *   where this started: a declaration nothing checked, and a plan that says so in no way at all.\n *   The generator resolves every key in its source scan against the vendor schema, so a key that\n *   is absent here means the tables were not regenerated — which the message says.\n */\nimport * as Effect from 'effect/Effect';\nimport type { PveForm } from './client.ts';\nimport { type EndpointConstraints, type EndpointKey, refusal, violations } from './constraints.ts';\nimport { PROXMOX_CONSTRAINTS } from './generated/constraints/index.ts';\n\nexport { PROXMOX_CONSTRAINTS };\n\nexport const constraintsFor = (key: EndpointKey): EndpointConstraints => {\n  const table = PROXMOX_CONSTRAINTS[key];\n  if (table === undefined) {\n    throw new Error(\n      `no vendor constraint table for '${key}'. It is named in this package but not generated: ` +\n        'run `bun codegen/constraints.ts` (see codegen/README.md).',\n    );\n  }\n  return table;\n};\n\n/** Every vendor rule this form breaks. Pure — a test calls it with a literal form. */\nexport const formViolations = (\n  key: EndpointKey,\n  form: PveForm,\n  presence: boolean,\n): readonly string[] => violations(constraintsFor(key), form, { presence });\n\n/**\n * ⛔ `Effect.die`, NOT `Effect.fail`. A declaration the vendor would reject is a DEFECT in the\n *   stack file, not a recoverable condition: there is no retry and no fallback that makes a\n *   129-character comment legal. The same call that refuses a write-back with no read-back\n *   (resource.ts) dies for the same reason.\n */\nexport const guardForm = (\n  key: EndpointKey | undefined,\n  form: PveForm,\n  presence: boolean,\n): Effect.Effect<void> =>\n  Effect.suspend(() => {\n    if (key === undefined) return Effect.void;\n    const found = formViolations(key, form, presence);\n    return found.length === 0 ? Effect.void : Effect.die(new Error(refusal(key, found)));\n  });\n",
@@ -35,15 +35,17 @@
     "/**\n * How PVE spells a value on the wire, and how to get it back to something comparable.\n *\n * ⛔ EVERY FUNCTION HERE WAS FOUND IN TWO OR MORE RESOURCE FILES, AND THE COPIES HAD DRIFTED.\n *   `num` was byte-identical in three files, so merging it is free. The boolean was NOT: four\n *   files declared `const flag` and meant four different things by it, including one that ran the\n *   other way round. That is the whole reason this module exists — not to save lines, but because\n *   a name that means four things is a bug waiting for the person who assumes it means the first\n *   one they read.\n *\n * ★ THE TWO DIRECTIONS ARE NAMED APART, DELIBERATELY. `bool` reads the wire and answers a\n *   TypeScript boolean; `flag` writes a form field and answers PVE's `'1'`/`'0'`. `storage.ts`\n *   held both under one name — `flag` there was the write direction while `flag` in three other\n *   files was the read direction — which typechecks in both files and is exactly the confusion\n *   that survives review.\n *\n * ⚠️ NOTHING HERE IS RESOURCE-SPECIFIC. A coercion that only one PVE object needs belongs in that\n *   object's file, where its reasoning sits next to the field it serves. `role.ts` keeps its own\n *   `canonical` for the same reason: that one sorts a privilege SET, which is a different idea\n *   from `canonicalToken` below however similar the names read.\n */\n\n/** ⚠️ `typeof value === 'number'` and not `Number(value)`: PVE sends `null` for an unset field. */\nexport const num = (value: unknown, fallback: number) =>\n  typeof value === 'number' ? value : fallback;\n\nexport const text = (value: unknown, fallback = '') =>\n  typeof value === 'string' ? value : fallback;\n\n/**\n * A PVE boolean off the wire.\n *\n * ⛔ THE FOUR SPELLINGS THIS REPLACES, AND WHY THIS ONE IS A SUPERSET OF ALL OF THEM. Measured in\n *   the files they came from: `backup-job` accepted `1 | true | '1'` with a caller's fallback;\n *   `sdn-vnet` the same three with no fallback; `storage` accepted only `1 | true`; `user` ran the\n *   value through `Number()` and asked `!== 0`. For the values PVE actually returns on these\n *   endpoints — `0` and `1` — all four agree, so accepting the union changes no live answer.\n *\n * ⚠️ THE ONE REAL DIFFERENCE IS `2`. `user.ts` would have read any non-zero number as true; this\n *   reads only `1`. No PVE field in this package is documented to return anything but 0 or 1, and\n *   a field that did would be a flag with more than two states — which is not a boolean, and\n *   should be read with `num` and named for what it is rather than quietly coerced here.\n *\n * ⚠️ `null`, `undefined` AND `''` ALL TAKE THE FALLBACK. An absent key means PVE's documented\n *   default for that field, which is not always `false` — so the default is the CALLER's to state,\n *   and `false` is only the fallback's own default for fields that really do default off.\n *\n * ⛔ THE EMPTY STRING IS ABSENT, NOT FALSE, AND GETTING THAT WRONG WRITES THE WRONG VALUE. A\n *   metric server is a SectionConfig section and can hand back `''` for an unset flag. Read as\n *   `false`, the two fields in this package that default ON — `backup-job.enabled` and\n *   `user.enable` — would come back disabled, `matches` would report an update nobody asked for,\n *   and the deploy would then WRITE `enabled=0` onto a live job. An empty string is not a\n *   boolean; it is the absence of one.\n */\nexport const bool = (value: unknown, fallback = false) =>\n  value === undefined || value === null || value === ''\n    ? fallback\n    : value === 1 || value === true || value === '1';\n\n/**\n * A boolean on its way INTO a PVE form.\n *\n * ⚠️ `undefined` IN, `undefined` OUT — an undeclared field must not be sent at all. Sending `'0'`\n *   for a prop the caller never set would write PVE's default over whatever is live, turning an\n *   omission into an edit.\n */\nexport const flag = (value?: boolean) => (value === undefined ? undefined : value ? '1' : '0');\n\n/**\n * A comma list PVE does not promise to give back in the order it was handed.\n *\n * ⚠️ `nodes` IS A SET AND PVE DOES NOT PRESERVE ITS ORDER. The zone plugin decodes the list into a\n *   hash and re-encodes it by joining that hash's keys, so the string you get back is not the one\n *   you sent. Sorting both sides is what stops a plan reporting an update because two names came\n *   back the other way round. `peers` gets the same treatment: it is a mesh, not a queue.\n */\nexport const csv = (value: readonly string[] | string | undefined) =>\n  (typeof value === 'string' ? value.split(',') : (value ?? []))\n    .map((part) => part.trim())\n    .filter((part) => part !== '')\n    .sort()\n    .join(',');\n\n/**\n * A comma list of guest IDs, in numeric order.\n *\n * ⚠️ ORDER IS NOT MEANING IN A GUEST LIST, SO IT MUST NOT BE A DIFF. PVE stores `vmid` as the\n *   comma-separated string it was handed and gives it back the same way, so a declaration listing\n *   the same guests in another order would otherwise be an update that rewrites the job to say\n *   exactly what it already said. Both sides are sorted numerically before they meet.\n *\n * ⚠️ NUMERIC, NOT LEXICAL — this is why it is not `csv`. Sorted as text, `101` precedes `99`.\n */\nexport const guestList = (value: unknown): string => {\n  const parts =\n    typeof value === 'string'\n      ? value.split(',')\n      : Array.isArray(value)\n        ? value.map((entry: unknown) => String(entry))\n        : [];\n  return parts\n    .map((part) => Number(part.trim()))\n    .filter((id) => Number.isFinite(id))\n    .sort((left, right) => left - right)\n    .map((id) => String(id))\n    .join(',');\n};\n\n/** `yes`/`true`/`on` and their opposites are the same value as 1/0 to PVE; make them one string. */\nexport const canonicalToken = (raw: string) => {\n  const lowered = raw.trim().toLowerCase();\n  if (['1', 'yes', 'true', 'on'].includes(lowered)) return '1';\n  if (['0', 'no', 'false', 'off'].includes(lowered)) return '0';\n  return lowered;\n};\n\n/**\n * A PVE property string, flattened to one comparable form.\n *\n * ⚠️ A PROPERTY STRING AND ITS PARSED FORM ARE ONE VALUE IN TWO SHAPES, AND PVE HANDS BACK\n *   WHICHEVER IT LIKES. MEASURED: `fleecing` is WRITTEN as the property string `fleecing=enabled=0`\n *   and READ BACK as the nested object {\"enabled\":0}. Comparing raw values would report an update\n *   on every plan for a job nobody touched — the same forever-diff a create-only field causes. So\n *   both sides are flattened here, sorted, and only then compared. `prune-backups` goes through\n *   the same funnel: same kind of value, the normalisation is free, and guessing which shape it\n *   comes back in is exactly the guess that costs a permanent diff.\n *\n * ⚠️ `defaultKey` EXISTS BECAUSE `fleecing=1` IS SHORTHAND FOR `fleecing=enabled=1`. PVE's format\n *   for it is written `[enabled=]<1|0>`, so a bare token is legal on write and comes back expanded\n *   on read; unexpanded, the short and long spellings never compare equal. `prune-backups` has no\n *   default key, so a bare token there is passed through as-is rather than invented into one.\n */\nexport const propertyString = (value: unknown, defaultKey?: string): string => {\n  const pairs: [string, string][] =\n    typeof value === 'string'\n      ? value.split(',').map((part) => {\n          const [key, ...rest] = part.split('=');\n          return rest.length === 0 && defaultKey !== undefined\n            ? [defaultKey, key ?? '']\n            : [key ?? '', rest.join('=')];\n        })\n      : typeof value === 'object' && value !== null\n        ? Object.entries(value).map(([key, entry]) => [key, String(entry)])\n        : [];\n  return pairs\n    .map(([key, entry]) => [key.trim(), canonicalToken(entry)] as const)\n    .filter(([key]) => key !== '')\n    .map(([key, entry]) => `${key}=${entry}`)\n    .sort()\n    .join(',');\n};\n\n/**\n * An integer PVE may have spelled as a string.\n *\n * ⚠️ PVE MAY HAND BACK EITHER `8086` OR `\"8086\"`. These objects are SectionConfig sections, and the\n *   integer check VALIDATES the parsed string rather than converting it, so whether a number\n *   arrives as a number is a property of the version you are talking to. `'8086' === 8086` is\n *   false, and that is an update consisting of nothing, reported on every plan forever.\n */\nexport const int = (value: unknown, fallback: number) => {\n  if (typeof value === 'number') return value;\n  const parsed = Number.parseInt(text(value), 10);\n  return Number.isNaN(parsed) ? fallback : parsed;\n};\n\n/**\n * A PVE update form with its clear-list attached, and the two guaranteed not to overlap.\n *\n * ⛔ PVE DIES IF A KEY IS SET AND DELETED IN ONE CALL, AND SIX FAMILIES HERE BUILT THAT FORM BY\n *   HAND. Measured in the shipped Perl on node-b — `PVE::SectionConfig::delete_from_config`, line 1860:\n *\n *     die \"cannot set and delete property '$k' at the same time!\\n\"\n *         if defined($new_options->{$k});\n *\n *   `defined` is the test, not truth, so `strict=0` or `comment=''` in the body counts as SET. The\n *   concrete failure: a live node-affinity rule with `strict 1` and a declaration carrying\n *   `strict: false`. `matches` reports an update; the clear-list has to name `strict`, because a\n *   PUT of `strict=0` merges a falsy value the plugin still stores; and if the body also emits\n *   `strict: '0'` the PUT is refused. The update never lands, the next plan reports the same\n *   update, and every deploy 500s — forever.\n *\n * ★ SO DISJOINTNESS IS ENFORCED HERE RATHER THAN REASONED ABOUT SIX TIMES. A cleared key is\n *   dropped from the body: CLEAR WINS. That is the right way round because a clear-list entry is\n *   computed from \"this prop is absent, and absent means remove it\", which is a deliberate\n *   statement, while the body's value for the same key is the coercion of that same absence —\n *   `flag(false)` is `'0'`, and `'0'` is exactly what must not be sent.\n *\n * ⚠️ UNDEFINED VALUES ARE DROPPED TOO, so a form builder may emit `undefined` for a field it does\n *   not set without the caller filtering first. `new URLSearchParams` would otherwise stringify it\n *   to the literal text \"undefined\".\n */\nexport const withClears = (\n  fields: Record<string, string | undefined>,\n  clear: readonly string[],\n): Record<string, string> => {\n  const cleared = new Set(clear);\n  const kept: Record<string, string> = {};\n  for (const [key, value] of Object.entries(fields)) {\n    if (value !== undefined && !cleared.has(key)) kept[key] = value;\n  }\n  return cleared.size === 0 ? kept : { ...kept, delete: [...cleared].join(',') };\n};\n",
     "import type { ApiTokenAttributes, ApiTokenProps } from './api-token.ts';\n/**\n * What a write to a PVE API token actually does, and the form that does it.\n *\n * ★ SPLIT OUT OF api-token.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is the one\n *   metric-server-form.ts draws: this file answers \"what does PVE store when this form arrives\",\n *   api-token.ts answers \"what a token is and when it has changed\". Nothing here reads the\n *   cluster and nothing here decides a diff.\n *\n * ⚠️ THE `import type` BACK TO api-token.ts IS A CYCLE ON PAPER ONLY. It is type-only, so it is\n *   erased before anything runs and `ApiTokenProps` stays in the file that declares the resource.\n *\n * ⛔ THE WRITE SEMANTICS BELOW ARE READ FROM THE CLUSTER'S OWN PERL RATHER THAN INFERRED FROM THE\n *   API SCHEMA — `/usr/share/perl5/PVE/API2/User.pm`, subs `generate_token` and\n *   `update_token_info`, read over SSH on node-b on 2026-09-13. The two disagree in exactly the place\n *   that costs a forever-diff: the schema gives `expire` the default \"same as user\", and the code\n *   never implements it. api-token.ts records what that means.\n *\n * ★ MIGRATED OFF THE GENERATED `generated/pve.ts` PARAM TYPES ONTO `@distilled.cloud/proxmox`'s\n *   typed `access.PutAccessUserTokenRequest`/`access.GetAccessUserTokenResponse` (2026-09-24) —\n *   the same three fields, still form-urlencoded strings on the wire; distilled's generator\n *   reads the identical vendor schema `generated/pve.ts` came from.\n */\nimport type * as access from '@distilled.cloud/proxmox/access';\nimport { bool, int, text } from './values.ts';\n\nexport const API_TOKEN_UPDATE = 'pve:PUT /access/users/{userid}/token/{tokenid}';\n\n/**\n * `<userid>!<tokenid>` — the name the rest of PVE calls this object by.\n *\n * ★ IT IS WHAT AN ACL BINDS. `Proxmox.Acl` with `type: 'token'` wants exactly this string as its\n *   `ugid`, so reporting it as an attribute is what lets a privilege-separated token be granted\n *   anything at all without somebody retyping the join by hand.\n *\n * ⚠️ DERIVED, NOT READ. MEASURED: `GET /access/users/metrics@pve/token/exporter` answers\n *   `{\"expire\":0,\"privsep\":0}` and echoes back neither half of its own identity. So this is built\n *   from props, cannot disagree with the path the read used, and is therefore true by\n *   construction — which is why it is reported and never compared.\n */\nexport const fullTokenid = (props: ApiTokenProps) => `${props.userid}!${props.tokenid}`;\n\n/**\n * Everything a token has, in the form PVE wants. Update sends exactly this (this family never\n * creates — see api-token.ts's header).\n *\n * ⚠️ EVERY FIELD IS SENT ON EVERY WRITE, THE EMPTY COMMENT INCLUDED, BECAUSE A PUT MERGES.\n *   MEASURED in `update_token_info`: `$token->{comment} = $param->{comment} if defined(...)`\n *   followed by `delete $token->{comment} if (!length $token->{comment})`. So `comment=` is how a\n *   comment is CLEARED; omitting it leaves the old text in place while `matches` goes on asking\n *   for an update the update cannot make. user.ts writes the same reasoning out for `groups`.\n *   ⚠️ THE `delete=` PARAMETER IS NOT USED AND WOULD NOT HELP. Its whitelist in that sub is\n *     literally `my $deletable = { comment => 1 };`, and anything else answers\n *     \"unknown option '<k>'\" — so `expire` and `privsep` have no clear path at all, which is the\n *     other half of why both are required props rather than optional ones.\n */\nexport const shape = (props: ApiTokenProps): access.PutAccessUserTokenRequest => ({\n  comment: props.comment ?? '',\n  expire: String(props.expire),\n  privsep: props.privsep ? '1' : '0',\n  tokenid: props.tokenid,\n  userid: props.userid,\n});\n\n/**\n * ★ NOTHING PVE REPORTS HERE IS UNWRITABLE, WHICH IS UNUSUAL IN THIS PACKAGE. The GET returns\n *   exactly `comment`, `expire` and `privsep`; PUT accepts exactly those three.\n * ⛔ `undefined` WHEN NEITHER FLAG IS THERE, BECAUSE BOTH ARE ALWAYS THERE FOR A REAL TOKEN.\n *   `user.cfg` materialises `expire` and `privsep` for every token it stores, so an answer\n *   carrying neither is not a token — the same \"distilled unwraps a missing object's `{\"data\":\n *   null}` to `{}`\" trap group.ts's header measures, checked here the way this guard already was\n *   before the distilled migration (api-token.ts's ⛔ on the create refusal cites the same\n *   MEASURED schema). Without this guard `bool`/`int` would invent one out of their fallbacks and\n *   the read-back guard in `reconcile` could never fire.\n */\nexport const attributesOf = (\n  live: access.GetAccessUserTokenResponse,\n  props: ApiTokenProps,\n): ApiTokenAttributes | undefined => {\n  if (live.expire === undefined && live.privsep === undefined) return undefined;\n  return {\n    comment: text(live.comment),\n    expire: int(live.expire, 0),\n    fullTokenid: fullTokenid(props),\n    /** ⚠️ FALLBACK `true`, MATCHING PVE'S API DEFAULT — unreachable given the guard above, but\n     *   wrong in the safe direction if a future release stops emitting the field. */\n    privsep: bool(live.privsep, true),\n    tokenid: props.tokenid,\n    userid: props.userid,\n  };\n};\n\n/**\n * ⚠️ EXACTLY THE THREE FIELDS A PUT CAN PUT BACK, WHICH IS ALSO EXACTLY WHAT THE GET REPORTS.\n *   MEASURED (pre-migration, replaying against four live token shapes — see the old PR): all\n *   answer noop; flipping `privsep` answers update; an empty body answers absent.\n */\nexport const matches = (attributes: ApiTokenAttributes, props: ApiTokenProps) =>\n  attributes.comment === (props.comment ?? '') &&\n  attributes.expire === props.expire &&\n  attributes.privsep === props.privsep;\n",
     "/**\n * Vendor-constraint guards (constraint-guard.ts) for a distilled-backed family — the seam\n * acl.ts's own local `guardWrite` established (acl-wire.ts), generalized once a second family\n * (Group) needed the SAME create/update split `resource.ts`'s `specGuards` (resource-guard.ts)\n * gives every family still on `client.ts`. `codegen/constraints.ts` scans this package's SOURCE\n * TEXT for the endpoint-key strings a caller passes here, so a family switching to this helper\n * changes nothing about which vendor rules apply — same keys, same generated tables.\n *\n * ★ WHY `asForm` IS THE ONLY TRANSLATION NEEDED. Distilled's generated request types for every\n *   PVE form-urlencoded operation are already `Record<string, string | undefined>` — the SAME\n *   shape `PveForm`/`guardForm` want, minus the `?`. There is no JSON vs form-encoding gap to\n *   bridge here the way client.ts's `pve()` had to.\n */\nimport type * as Effect from 'effect/Effect';\nimport { guardForm } from './constraint-guard.ts';\nimport type { EndpointKey } from './constraints.ts';\n\n/**\n * Drops non-string fields — distilled's request type carries `?`, `guardForm` wants a plain\n * form. ⚠️ `body: object`, NOT `Record<string, string | undefined>`: distilled's generated\n * request types are `interface`s with no index signature, so TypeScript refuses that stricter\n * parameter type for every one of them (\"index signature ... is missing\") even though every\n * field they declare fits it. `object` accepts any of them; the cast below is where the shape\n * is actually asserted, once, rather than at every call site.\n */\nexport const asForm = (body: object): Record<string, string> =>\n  Object.fromEntries(\n    Object.entries(body as Record<string, unknown>).filter(\n      (e): e is [string, string] => typeof e[1] === 'string',\n    ),\n  );\n\n/**\n * `presence`: whether a CREATE is really about to happen (required fields are enforced) or the\n * form is only being value-checked in passing — see resource-guard.ts's own header on why this\n * is not \"this is the create form\" but \"a create is really about to happen\".\n */\nexport const guardWrite = (\n  endpoint: EndpointKey,\n  body: object,\n  presence: boolean,\n): Effect.Effect<void> => guardForm(endpoint, asForm(body), presence);\n",
-    "/**\n * `Proxmox.BackupJob` — the vzdump schedule, declared. The one object whose drift nothing else on\n * the cluster reveals.\n *\n * ★ WHY THIS ONE EARNS ITS PLACE. A hand-made vzdump job drifts silently: a schedule moved by an\n *   hour, a retention trimmed to `keep-last=1`, or `enabled 0` set during a maintenance window and\n *   never set back. All three look like a healthy cluster from every angle except a restore.\n *   Declared here, `diff` reads the LIVE job on every plan, so a hand edit surfaces as\n *   `1 to update` that day rather than on the day somebody needs last night's backup and finds a\n *   week-old one, or none.\n *\n * ⛔ PVE GENERATES `id` WHEN YOU OMIT IT, WHICH MAKES OMITTING IT THE WORST BUG THIS RESOURCE\n *   COULD CARRY. PVE's own API schema says so in one parenthesis — `id`: \"Job ID (will be\n *   autogenerated).\" — and a generated id looks like `backup-f56d8ab7-d524`. A resource that\n *   POSTed without an id would create a SECOND job beside the first on EVERY reconcile, and the\n *   read-back in `pveOperations` would still pass, because a job did appear: that check asks \"is\n *   the object there\", not \"is it the one I meant\". So `id` is a REQUIRED prop and is always sent\n *   on create. To adopt a job that already exists, declare its existing id; any other id is a new\n *   job beside it, not an adoption.\n *   ★ AN EXPLICIT id ALSO CLOSES A SECOND HOLE. `pveOperations.read` turns ANY failed GET into\n *     \"absent\" — an expired lease, a 403, a node that did not answer — and reconcile then POSTs.\n *     With an id, PVE refuses a duplicate section id and the deploy fails loudly; without one, that\n *     same swallowed error would have quietly doubled the cluster's backup jobs.\n *\n * ⚠️ `Sys.Modify` ON `/` IS THE GATE AND IT IS NOT A SMALL GRANT. PVE has no Backup.* privilege:\n *   create, update and delete of a vzdump job are all checked against `Sys.Modify` at `/` — the\n *   same privilege that covers node network configuration. A credential that can declare backup\n *   jobs can also rewrite the cluster's networking. That is PVE's granularity rather than a choice\n *   made here, and it is exactly why widening a role for this should be a decision rather than a\n *   reaction to a 403.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { bool, guestList, propertyString, text } from './values.ts';\n\n/**\n * ⚠️ THE PROPS ARE PVE'S OWN KEY NAMES, DASHES INCLUDED. `notes-template` rather than\n *   `notesTemplate` is deliberate: `createForm` is then a copy rather than a translation table,\n *   and a translation table is one more place for a key to be renamed and silently never sent. A\n *   field that is never sent reads back as whatever it already was, which is indistinguishable\n *   from \"PVE ignored me\".\n */\nexport interface BackupJobProps extends WithTarget {\n  /** ⛔ The primary key, REQUIRED. Never let PVE generate it — see the ⛔ above. */\n  id: string;\n  /** A subset of systemd calendar events, e.g. `01:00` or `mon..fri 02:30`. */\n  schedule: string;\n  /** Target storage id. That storage's own retention applies unless `prune-backups` overrides it. */\n  storage?: string;\n  mode?: 'snapshot' | 'suspend' | 'stop';\n  /** PVE's default is enabled. A disabled job is a backup that silently is not happening. */\n  enabled?: boolean;\n  /** Back up every guest. ⚠️ Pick exactly one of `all`, `vmid` and `pool` — see `shape` below. */\n  all?: boolean;\n  vmid?: readonly number[];\n  pool?: string;\n  /** Guest ids to skip. PVE reads this as \"all guests except these\", so it belongs with `all`. */\n  exclude?: readonly number[];\n  /** Retention, as a property string: `keep-daily=7,keep-weekly=4`. */\n  'prune-backups'?: string;\n  /** Supports {{cluster}}, {{guestname}}, {{node}} and {{vmid}}. Single line only. */\n  'notes-template'?: string;\n  'notification-mode'?: 'auto' | 'legacy-sendmail' | 'notification-system';\n  /** Run a missed job as soon as the scheduler is back. */\n  'repeat-missed'?: boolean;\n  /** VM-only fleecing, as a property string: `enabled=1,storage=<id>`. See `propertyString`. */\n  fleecing?: string;\n  comment?: string;\n}\n\nexport interface BackupJobAttributes {\n  id: string;\n  schedule: string;\n  storage: string;\n  mode: string;\n  enabled: boolean;\n  all: boolean;\n  /** Sorted and comma-joined, so re-ordering a declaration is not a diff. See `guestList`. */\n  vmid: string;\n  pool: string;\n  exclude: string;\n  /** Flattened and sorted — never the raw value PVE returned. See `propertyString`. */\n  'prune-backups': string;\n  'notes-template': string;\n  'notification-mode': string;\n  'repeat-missed': boolean;\n  fleecing: string;\n  comment: string;\n  /**\n   * PVE's own estimate, epoch seconds. REPORTED, NEVER COMPARED: `next-run` in `matches` would\n   * report an update every time the clock passed a scheduled run. It is here so a plan can show\n   * that a job is still due — a `next-run` of 0 is a job the scheduler will not run.\n   */\n  'next-run': number;\n}\n\nexport interface ProxmoxBackupJob extends Resource<\n  'Proxmox.BackupJob',\n  BackupJobProps,\n  BackupJobAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxBackupJob = Resource<ProxmoxBackupJob>('Proxmox.BackupJob');\n\n/**\n * The form for both create and update.\n *\n * ⛔ A FIELD THE DECLARATION LEAVES OUT IS NOT SENT, AND THAT IS LOAD BEARING. PVE's PUT can only\n *   SET a key; clearing one needs `delete=<key>`, which this resource deliberately never sends.\n *   `updateForm` is handed the props and nothing else, so a `delete` list could only be \"every\n *   field you did not declare\" — and on a job adopted out of the UI that would silently strip\n *   settings this resource does not even model, `compress`, `mailto` and `bwlimit` among them, on\n *   the first deploy. Leaving undeclared fields alone is the smaller lie, and `matches` tells the\n *   same lie consistently: it does not compare what it cannot change.\n *\n * ⚠️ THE FIVE FIELDS PVE DOCUMENTS A DEFAULT FOR ARE ALWAYS SENT AND ALWAYS COMPARED — `enabled`\n *   (1), `all` (0), `mode` (snapshot), `notification-mode` (auto), `repeat-missed` (0). That is\n *   what makes a hand-flipped `enabled 0` show up as drift rather than as silence, and it is also\n *   what stops those five looping: a field compared against a default must be sent as that\n *   default, or every plan reports an update the PUT never performs. The cost is worth reading\n *   before the first deploy against an adopted job — an omitted `all` is a declaration that this\n *   job backs up NOTHING, and PVE accepts a job that selects nothing without a word. Read that\n *   first plan; do not deploy it unseen.\n */\nconst shape = (props: BackupJobProps) => ({\n  all: props.all === true ? '1' : '0',\n  enabled: props.enabled === false ? '0' : '1',\n  mode: props.mode ?? 'snapshot',\n  'notification-mode': props['notification-mode'] ?? 'auto',\n  'repeat-missed': props['repeat-missed'] === true ? '1' : '0',\n  schedule: props.schedule,\n  ...(props.comment === undefined ? {} : { comment: props.comment }),\n  ...(props.exclude === undefined ? {} : { exclude: guestList(props.exclude) }),\n  ...(props.fleecing === undefined ? {} : { fleecing: props.fleecing }),\n  ...(props['notes-template'] === undefined ? {} : { 'notes-template': props['notes-template'] }),\n  ...(props.pool === undefined ? {} : { pool: props.pool }),\n  ...(props['prune-backups'] === undefined ? {} : { 'prune-backups': props['prune-backups'] }),\n  ...(props.storage === undefined ? {} : { storage: props.storage }),\n  ...(props.vmid === undefined ? {} : { vmid: guestList(props.vmid) }),\n});\n\nconst handlers = pveHandlers<BackupJobProps, BackupJobAttributes>({\n  /**\n   * ⛔ NO \"IS IT REALLY THERE\" GUARD, ON PURPOSE. Returning undefined for a job whose JSON is\n   *   missing some key would be a guess about which keys PVE echoes back, and a wrong guess here\n   *   does not read as absent-and-harmless: `reconcile` would POST, and POST creates ANOTHER job.\n   *   Absence is decided by the API declining to answer, which `pveOperations.read` already\n   *   handles — not by a key being missing from an answer that did arrive.\n   */\n  attributes: (live, props) => ({\n    all: bool(live['all'], false),\n    comment: text(live['comment'], ''),\n    enabled: bool(live['enabled'], true),\n    exclude: guestList(live['exclude']),\n    fleecing: propertyString(live['fleecing'], 'enabled'),\n    id: props.id,\n    mode: text(live['mode'], 'snapshot'),\n    'next-run': typeof live['next-run'] === 'number' ? live['next-run'] : 0,\n    'notes-template': text(live['notes-template'], ''),\n    'notification-mode': text(live['notification-mode'], 'auto'),\n    pool: text(live['pool'], ''),\n    'prune-backups': propertyString(live['prune-backups']),\n    'repeat-missed': bool(live['repeat-missed'], false),\n    schedule: text(live['schedule'], ''),\n    storage: text(live['storage'], ''),\n    vmid: guestList(live['vmid']),\n  }),\n  collection: () => 'cluster/backup',\n  /** ⛔ `id` IS SENT AND IS NOT OPTIONAL. Everything above depends on PVE not inventing one. */\n  createForm: (props) => ({ ...shape(props), id: props.id }),\n  /** Each line reads \"not declared, or equal\"; the five defaulted fields have no undeclared case. */\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: { create: 'pve:POST /cluster/backup', update: 'pve:PUT /cluster/backup/{id}' },\n  matches: (attributes, props) =>\n    attributes.schedule === props.schedule &&\n    attributes.enabled === (props.enabled !== false) &&\n    attributes.all === (props.all === true) &&\n    attributes.mode === (props.mode ?? 'snapshot') &&\n    attributes['notification-mode'] === (props['notification-mode'] ?? 'auto') &&\n    attributes['repeat-missed'] === (props['repeat-missed'] === true) &&\n    (props.storage === undefined || attributes.storage === props.storage) &&\n    (props.pool === undefined || attributes.pool === props.pool) &&\n    (props.comment === undefined || attributes.comment === props.comment) &&\n    (props.vmid === undefined || attributes.vmid === guestList(props.vmid)) &&\n    (props.exclude === undefined || attributes.exclude === guestList(props.exclude)) &&\n    (props['notes-template'] === undefined ||\n      attributes['notes-template'] === props['notes-template']) &&\n    (props['prune-backups'] === undefined ||\n      attributes['prune-backups'] === propertyString(props['prune-backups'])) &&\n    (props.fleecing === undefined ||\n      attributes.fleecing === propertyString(props.fleecing, 'enabled')),\n  path: (props) => `cluster/backup/${props.id}`,\n  updateForm: shape,\n});\n\n/**\n* ⛔ Empty for the same reason as every other resource here: adoption must be explicit.\n*   `GET /cluster/backup` would hand back the job somebody made by hand, and adopting it\n*   implicitly would give Alchemy the right to DELETE a cluster's only backup schedule the\n*   first time a line left a stack file.\n \n *\n* ⚠️ DELETING THE JOB DOES NOT DELETE THE BACKUPS, AND THAT CUTS BOTH WAYS. The archives\n*   stay on the storage, so this looks harmless today; it is destructive in six months,\n*   when the schedule that should have replaced them has not run since. PVE will not\n*   refuse this the way it refuses to delete a pool still holding guests — nothing depends\n*   on a backup job — so the plan line is the only warning anyone gets.\n \n */\nexport const ProxmoxBackupJobProvider = () =>\n  Provider.effect(ProxmoxBackupJob, Effect.succeed(ProxmoxBackupJob.Provider.of(handlers)));\n",
-    "/**\n * The four operations every PVE object shares, and the five handlers that wire them to Alchemy.\n *\n * ★ THE SHAPE THEY READ IS `PveSpec`, IN resource-spec.ts, WITH THE ARGUMENT FOR IT. This file was\n *   one file until 2026-09-22, when the vendor-constraint guard took it past the 250-line cap; the\n *   split is by what a reader is doing — declaring an object, or changing how every object is\n *   written — and the types are re-exported below so no importer moved.\n *\n * ⚠️ EVERY PVE ANSWER IS WRAPPED IN `{\"data\": ...}` AND A FAILED CALL CAN STILL BE HTTP 200 with\n *   `{\"data\": null}`. That is why `reconcile` below READS BACK and refuses when the object is still\n *   absent, rather than trusting a status code — see the ⛔ in that function.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport { pve } from './client.ts';\nimport { specGuards } from './resource-guard.ts';\nimport type { PveSpec, WithApiTarget } from './resource-spec.ts';\nimport { formToSend } from './update-guard.ts';\n\nexport type {\n  PveRequirements,\n  PveSpec,\n  WithApiTarget,\n  WithPbsTarget,\n  WithTarget,\n} from './resource-spec.ts';\n\nexport const pveOperations = <Props extends WithApiTarget, Attributes>(\n  spec: PveSpec<Props, Attributes>,\n) => {\n  const { guardCreate, guardUpdate } = specGuards(spec);\n\n  /** The live object, or undefined. ⚠️ A 404 and `{\"data\": null}` are ANSWERS, not failures. */\n  const read = (props: Props) =>\n    pve<Record<string, unknown>>(\n      props.target,\n      spec.readRole ?? 'read',\n      'GET',\n      spec.path(props),\n    ).pipe(\n      Effect.map((data) => (data == null ? undefined : spec.attributes(data, props))),\n      Effect.orElseSucceed(() => undefined),\n    );\n\n  return {\n    /**\n     * ★ EXPORTED SO A FAMILY THAT WRITES ITS OWN `reconcile` REACHES THE SAME CHECK BY THE SAME\n     *   NAME. CephPool, CephFs and ZfsPool all bypass the reconcile below — forked workers, a\n     *   settle loop, a destructive create — and without these two they would be checked at plan\n     *   time and not at apply time, which is exactly the gap an ADOPTED row falls through.\n     */\n    guardCreate,\n    guardUpdate,\n\n    read,\n\n    // ⚠️ `Input<Props>`, NOT `Props`. At plan time a prop can still be an unresolved Output or\n    //   Config; `isResolved` is the narrowing, so the parameter has to admit the wider type or\n    //   every caller casts — and a cast here would be a lie about what plan actually has.\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        // ⚠️ A prop can still be an unresolved Output at plan time. Alchemy's own providers guard\n        //   with isResolved and skip rather than guess; comparing a placeholder to a live value\n        //   reports an update nobody asked for.\n        if (!isResolved(news)) return undefined;\n        /**\n         * ⛔ THE VENDOR CHECK RUNS BEFORE THE `output === undefined` RETURN, AND THE ORDER IS THE\n         *   WHOLE FIX. `output === undefined` IS the resource Alchemy has no state for — the\n         *   create. Checking after it would leave exactly the case that failed on 2026-09-22\n         *   unchecked, and the refusal would arrive from the server, half a deploy in.\n         */\n        yield* guardCreate(news, output === undefined);\n        yield* guardUpdate(news);\n        if (output === undefined) return undefined;\n        const live = yield* read(news);\n        // ⚠️ `update`, NOT `create` — Alchemy's Diff admits only noop/update/replace. An object\n        //   Alchemy has state for but the cluster does not is drift, and reconcile repairs it.\n        if (live === undefined) {\n          /**\n           * ⛔ DRIFT REACHES `reconcile`'s POST, so the create form's required parameters ARE\n           *   about to go on the wire after all. Saying so here rather than leaving it to\n           *   reconcile keeps the refusal in `plan`, where an operator is reading.\n           */\n          yield* guardCreate(news, true);\n          return { action: 'update' } as const;\n        }\n        if (spec.matches(live, news)) return { action: 'noop' } as const;\n        // An object with no update path cannot be edited in place; say replace and mean it.\n        return spec.updateForm === undefined\n          ? ({ action: 'replace' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    reconcile: (news: Props) =>\n      Effect.gen(function* () {\n        const live = yield* read(news);\n        // ⚠️ CHECKED AGAIN HERE, AND NOT BECAUSE `diff` IS UNTRUSTED. `reconcile` also runs for an\n        //   ADOPTED row, whose diff answer Alchemy discards (verify/fake-engine.ts records it), and\n        //   a family that writes its own reconcile bypasses the one above entirely.\n        // ⛔ AFTER THE READ, BECAUSE THE READ IS WHAT SAYS WHICH REQUEST IS ABOUT TO BE MADE. A GET\n        //   changes nothing, so nothing has been written by the time a violation refuses the plan.\n        yield* guardCreate(news, live === undefined);\n        yield* guardUpdate(news);\n        if (live === undefined) {\n          yield* pve(\n            news.target,\n            'provision',\n            'POST',\n            spec.collection(news),\n            spec.createForm(news),\n          );\n        } else if (spec.updateForm !== undefined) {\n          /**\n           * ⛔ ADOPTING AN OBJECT THAT ALREADY MATCHES MUST NOT WRITE TO IT, AND WITHOUT THE\n           *   `matches` GUARD IT DID. Alchemy's `adopted` action is NOT a read: Apply.ts routes it\n           *   down the same branch as `update` and calls `reconcile` (Apply.ts:980 and :1045). So\n           *   the first time a declaration names an object Alchemy has no state for — which is\n           *   exactly what adopting the live estate means — reconcile runs, finds it present, and\n           *   fell through to this PUT.\n           *\n           *   For most families that was a pointless write-back of identical values. For\n           *   `Proxmox.NodeNetwork` it is worse than pointless: a PUT under `/nodes/{node}/network`\n           *   STAGES a change into `/etc/network/interfaces.new`, so merely adopting the interface\n           *   a node already has would leave that node with a pending network change waiting for an\n           *   apply — on a cluster whose Ceph traffic rides vmbr1.42. Adoption has to be free.\n           *\n           * ★ SO THE CONDITION IS THE SAME PREDICATE `diff` USES. If `matches` is true the object\n           *   already says what the declaration says, and there is nothing to write — by\n           *   definition, since every field this provider manages is a field `matches` compares.\n           *   A field deliberately left OUT of `matches` is one this resource does not manage, so\n           *   its drift is not this provider's to repair.\n           *\n           * ★ THE PREDICATE LIVES IN update-guard.ts NOW, with the ⚠️ on why an empty form is not a\n           *   write either, because CephPool and PbsDatastore write their own reconcile and need\n           *   the same one — CephPool did not have it (see that file).\n           */\n          const form = formToSend(spec.matches, live, news, spec.updateForm(news));\n          if (form !== undefined) {\n            yield* pve(news.target, 'provision', 'PUT', spec.path(news), form);\n          }\n        }\n        const after = yield* read(news);\n        if (after === undefined) {\n          /**\n           * ⛔ REFUSE RATHER THAN RETURN THE PROPS AS THOUGH THEY LANDED. PVE answers 200 with\n           *   `{\"data\": null}` on several endpoints, so \"no error\" is not evidence of a write. A\n           *   provider that returned its own inputs here would record state for an object that does\n           *   not exist, and the next plan would read `noop` over the gap.\n           */\n          return yield* Effect.die(\n            new Error(\n              `${spec.path(news)}: the write returned no error but the object is still absent. ` +\n                'PVE wraps every answer in {\"data\":...} and can report success on a call that did ' +\n                'nothing -- read back rather than trusting the status code.',\n            ),\n          );\n        }\n        return after;\n      }),\n\n    /**\n     * ⚠️ PVE REFUSES TO DELETE THINGS THAT ARE STILL IN USE — a pool holding guests, a storage with\n     *   volumes. That refusal is the cluster declining to orphan something because a line left a\n     *   file, so it is surfaced as-is rather than retried with a force flag.\n     */\n    destroy: (olds: Props) => pve(olds.target, 'provision', 'DELETE', spec.path(olds)),\n  };\n};\n\n/**\n * The five provider handlers for a spec'd PVE object, wired once.\n *\n * ⛔ THIS BLOCK WAS WRITTEN TEN TIMES BEFORE IT WAS EXTRACTED, and every copy was character for\n *   character identical apart from its comments: `list` answering empty, and four handlers whose\n *   entire body was `yield* ops.<same name>(<same argument>)`. Ten copies of a delegation is ten\n *   chances to delegate to the wrong one — `ops.read(olds)` inside `reconcile` typechecks, returns\n *   a plausible value, and turns every deploy into a no-op that reports success.\n *\n * ★ IT TAKES THE SPEC, NOT THE OPERATIONS, so a resource declares its four spec functions and\n *   stops. `pveOperations` stays exported for an object that genuinely needs a handler of its own;\n *   nothing in this package does yet, and the day one does it should be visibly different from the\n *   ten that are not.\n *\n * ⛔ IT STOPS AT THE HANDLERS AND DOES NOT RETURN THE LAYER, AND THAT IS NOT AN OVERSIGHT — it was\n *   written the other way first and reverted. Wrapping `Provider.effect(cls, …)` here means naming\n *   the resource class generically, and Alchemy's `Props<R>` and `R[\"Attributes\"]` are not the\n *   plain `Props` and `Attributes` this spec is written against: `Attributes` comes back as\n *   `Attributes & AttrOutput<Attributes[\"Attributes\"]>`. Against a free type variable TypeScript\n *   cannot prove those line up — \"could be instantiated with a different subtype\" — so the only\n *   way to compile a Layer-returning version is a cast, and a cast is a LIE ABOUT WHETHER THE\n *   HANDLERS MATCH THE RESOURCE, which is the one thing the call site exists to check. Leaving\n *   `Cls.Provider.of(...)` in each file keeps that check where the types are concrete and real.\n *   One line per resource is the price of it, and it is worth paying.\n *\n * ⚠️ `list` IS OPTIONAL IN `ProviderServiceInput` AND IS PASSED ANYWAY. An empty list is a claim —\n *   this provider adopts nothing — and it is made here for every PVE object at once, because the\n *   reasoning is identical for all of them: every PVE index endpoint answers with the whole\n *   cluster's objects, PVE's own built-ins included. `GET /pools` returns pools a human made years\n *   ago; `GET /access/roles` returns `Administrator`. Returning any of them would invite Alchemy to\n *   adopt an object it never created, and therefore one day to narrow or delete it. Adoption stays\n *   an explicit act. A resource with a reason to differ passes its own `list` and says why.\n */\nexport const pveHandlers = <Props extends WithApiTarget, Attributes extends object>(\n  spec: PveSpec<Props, Attributes>,\n) => {\n  const ops = pveOperations(spec);\n  return {\n    list: () => Effect.succeed([]),\n    read: ({ olds }: { olds: Props }) => ops.read(olds),\n    diff: ({ news, output }: { news: Input<Props>; output: Attributes | undefined }) =>\n      ops.diff(news, output),\n    reconcile: ({ news }: { news: Props }) => ops.reconcile(news),\n    delete: ({ olds }: { olds: Props }) => ops.destroy(olds),\n  };\n};\n",
-    "/**\n * One authenticated call to the Proxmox VE API.\n *\n * ★ PLAIN `fetch`, NO TLS ESCAPE HATCH, AND THAT IS A MEASURED CHOICE RATHER THAN AN OMISSION.\n *   Proxmox is usually met with `curl -k` because a fresh install serves its own self-signed\n *   certificate — I reached for `-k` myself before checking. This cluster serves a real Let's\n *   Encrypt certificate (`CN=cluster-c1.example.com`), and strict TLS answers 401, i.e. the\n *   handshake succeeds and only the credential is missing. So there is no `rejectUnauthorized`\n *   option here to be left switched on by accident in somebody else's estate.\n *\n * ⚠️ EVERY PVE ANSWER IS WRAPPED IN `{\"data\": ...}`, errors included — a failed call can still be\n *   HTTP 200 with `{\"data\": null}`. Unwrapping is not cosmetic; a caller that reads the envelope\n *   as the payload sees `undefined` and calls it \"absent\".\n */\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\nimport type { ApiTarget, PveCredential, PveRole, PveTarget } from './credentials.ts';\nimport { leased } from './lease-cache.ts';\nimport { authorization } from './mint.ts';\nimport { executeOnCluster } from './members.ts';\n\nexport class PveError extends Error {\n  constructor(\n    readonly status: number,\n    readonly method: string,\n    readonly path: string,\n    detail: string,\n  ) {\n    super(`PVE ${method} ${path} -> ${String(status)}: ${detail}`);\n    this.name = 'PveError';\n  }\n}\n\nconst clusterExhausted = (\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  attempts: ReadonlyArray<{ member: string; why: string }>,\n) =>\n  new PveError(\n    0,\n    method,\n    path,\n    `all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join('; ')}`,\n  );\n\n/**\n * A form body, where a value may be a LIST.\n *\n * ⛔ PVE AND PBS SPELL A MULTI-VALUED FIELD DIFFERENTLY, AND THE LIST FORM IS FOR PBS. PBS is Rust:\n *   its schemas use `type: array` — `delete` on every update endpoint is one — and its urlencoded\n *   decoder builds that array from REPEATED KEYS (`delete=a&delete=b`). PVE's Perl takes a comma\n *   string for the same idea, which is what `withClears` in values.ts produces, and for the one\n *   PVE field that genuinely needs repetition it wants a NUL-joined value instead (see\n *   notification-target.ts). So: PVE callers pass strings and are unaffected; a PBS caller that\n *   needs an array passes one and gets repeated keys rather than reaching for PVE's encoding.\n */\nexport type PveForm = Record<string, readonly string[] | string>;\n\n/** ⚠️ `append`, NOT `set`: a repeated key is the point, and `set` would keep only the last. */\nconst encode = (form: PveForm): string => {\n  const params = new URLSearchParams();\n  for (const [key, value] of Object.entries(form)) {\n    if (typeof value === 'string') params.append(key, value);\n    else for (const item of value) params.append(key, item);\n  }\n  return params.toString();\n};\n\nconst buildRequest = (\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  apiBase: string,\n  path: string,\n  credential: PveCredential,\n  target: ApiTarget,\n  form?: PveForm,\n) => {\n  const url = `${apiBase}/${path}`;\n  /**\n   * ⛔ THE CONTENT TYPE IS AN ARGUMENT TO `bodyText`, NOT AN ENTRY IN THE HEADER MAP, AND GETTING\n   *   THAT WRONG MADE EVERY WRITE IN THIS PACKAGE FAIL.\n   *\n   * 🔴 THE BUG, AND HOW IT HID FOR A WHOLE DAY. The header map DID set\n   *   `application/x-www-form-urlencoded` — and `bodyText(s)` with no second argument sets\n   *   `text/plain` and OVERWRITES it, because it is piped AFTER `setHeaders`. PVE and PBS accept\n   *   ONLY form encoding or JSON and reject everything else outright (measured in\n   *   proxmox-rest-server's `get_request_parameters`), so every create, update and delete this\n   *   package can perform was broken from the day the client was written.\n   *   ⛔ NOTHING CAUGHT IT BECAUSE NOTHING HAD EVER WRITTEN. Ninety-eight resources were adopted\n   *     against the live cluster and every one matched, so `reconcile` never reached a PUT. The\n   *     identical bug in <estate>/forgejo/src/client.ts surfaced the moment a write token existed\n   *     and answered `422 Unsupported Content-Type`; this one is the same line, found by looking.\n   *   ★ A PLAN THAT SAYS `noop` PROVES THE READ PATH AND NOTHING ELSE. That is the lesson worth\n   *     more than the fix.\n   *\n   * ⚠️ PVE TAKES FORM ENCODING, NOT JSON. Sending application/json is accepted and then SILENTLY\n   *   IGNORED on several endpoints, which reads as \"the API did nothing\" rather than as a wrong\n   *   content type — so the type below is load bearing in both directions.\n   */\n  return HttpClientRequest.make(method)(url).pipe(\n    HttpClientRequest.setHeaders({ Authorization: authorization(credential, target) }),\n    form === undefined\n      ? (self) => self\n      : HttpClientRequest.bodyText(encode(form), 'application/x-www-form-urlencoded'),\n  );\n};\n\nconst executeOne = (\n  target: ApiTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form: PveForm | undefined,\n  apiBase: string,\n) =>\n  Effect.gen(function* () {\n    const client = yield* HttpClient.HttpClient;\n    const request = buildRequest(method, apiBase, path, credential, target, form);\n    return yield* client\n      .execute(request)\n      .pipe(Effect.mapError((cause) => new PveError(0, method, path, String(cause))));\n  });\n\nconst readResponse = <T>(\n  response: {\n    status: number;\n    text: Effect.Effect<string, unknown>;\n    json: Effect.Effect<unknown, unknown>;\n  },\n  method: string,\n  path: string,\n) =>\n  Effect.gen(function* () {\n    /**\n     * ⛔ STATUS FIRST, THEN THE BODY, AND THE BODY IS READ EXACTLY ONCE. `text` and `json` both\n     *   consume the response stream, so asking for both is a bug waiting to happen. A failure is\n     *   read as TEXT because an error body is not reliably JSON — PVE answers HTML for some 5xx —\n     *   and a success is read as JSON by the client rather than by a hand-rolled `JSON.parse`.\n     */\n    if (response.status < 200 || response.status >= 300) {\n      // ⚠️ 401 HERE USUALLY MEANS THE LEASE EXPIRED, NOT THAT THE ROLE IS WRONG. `provision` is a\n      //   300s non-renewable lease; a long reconcile should mint again rather than widen the role.\n      const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ''));\n      return yield* Effect.fail(new PveError(response.status, method, path, detail.slice(0, 300)));\n    }\n    const body = (yield* response.json.pipe(\n      Effect.mapError((cause) => new PveError(0, method, path, String(cause))),\n    )) as { data?: T };\n    return body.data;\n  });\n\n/** A call that already holds a credential. Used when one mint serves several calls. */\nexport const pveWith = <T>(\n  target: ApiTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form?: PveForm,\n) =>\n  Effect.gen(function* () {\n    const response =\n      target.scheme === 'pve'\n        ? yield* executeOnCluster(target, method, path, (apiBase) =>\n            buildRequest(method, apiBase, path, credential, target, form),\n          ).pipe(\n            Effect.mapError((failure) =>\n              failure.tag === 'cluster'\n                ? clusterExhausted(failure.method, failure.path, failure.attempts)\n                : new PveError(0, method, path, String(failure)),\n            ),\n          )\n        : yield* executeOne(target, credential, method, path, form, target.api);\n    return yield* readResponse<T>(response, method, path);\n  });\n\n/**\n * Like `pveWith`, but returns the full JSON body — for endpoints whose answer lives beside `data`.\n *\n * ⚠️ `network-apply-read.ts` is the caller today; the local fetch there should fold into this once\n *   the envelope shape is stable across both paths.\n */\nexport const pveEnvelopeWith = (\n  target: PveTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n) =>\n  Effect.gen(function* () {\n    const response = yield* executeOnCluster(target, method, path, (apiBase) =>\n      buildRequest(method, apiBase, path, credential, target),\n    ).pipe(\n      Effect.mapError((failure) =>\n        failure.tag === 'cluster'\n          ? clusterExhausted(failure.method, failure.path, failure.attempts)\n          : new PveError(0, method, path, String(failure)),\n      ),\n    );\n    if (response.status < 200 || response.status >= 300) {\n      const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ''));\n      return yield* Effect.fail(new PveError(response.status, method, path, detail.slice(0, 300)));\n    }\n    return (yield* response.json.pipe(\n      Effect.mapError((cause) => new PveError(0, method, path, String(cause))),\n    )) as Record<string, unknown>;\n  });\n\n/**\n * Make one call on a credential for `role`, REUSING a still-valid lease rather than minting one.\n *\n * 🔴 IT USED TO MINT PER CALL, AND AT 98 RESOURCES THAT STOPPED BEING FREE. One plan plus deploy\n *   of the C1 stack left 760 token entries in `/etc/pve/user.cfg` — read, diff, reconcile and the\n *   read-back each minted their own, and `/etc/pve` is a replicated cluster filesystem every node\n *   has to agree on. src/lease-cache.ts carries the measurement and the safety argument.\n *\n * ⚠️ `pveWith` IS STILL THERE AND STILL TAKES AN EXPLICIT CREDENTIAL. network-apply.ts needs ONE\n *   identity across its apply and its task poll — PVE only skips the task-status privilege check\n *   for the task's OWNER — and it threads a lease through by hand for that. Caching makes that\n *   property easier to hold, never weaker, but the explicit path stays because that caller is\n *   reasoning about identity rather than about cost.\n *\n * ★ TASK POLL ON A DIFFERENT MEMBER THAN THE APPLY STILL HOLDS: the owner is the token id, not the\n *   node that received the PUT. Any member serves any task path; the privilege skip is keyed on\n *   whether the caller IS the task's owner.\n */\nexport const pve = <T>(\n  target: ApiTarget,\n  role: PveRole,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form?: PveForm,\n) =>\n  Effect.gen(function* () {\n    const credential = yield* leased(target, role);\n    return yield* pveWith<T>(target, credential, method, path, form);\n  });\n",
+    "/**\n * `Proxmox.BackupJob` — the vzdump schedule, declared. The one object whose drift nothing else on\n * the cluster reveals.\n *\n * ★ WHY THIS ONE EARNS ITS PLACE. A hand-made vzdump job drifts silently: a schedule moved by an\n *   hour, a retention trimmed to `keep-last=1`, or `enabled 0` set during a maintenance window and\n *   never set back. All three look like a healthy cluster from every angle except a restore.\n *   Declared here, `diff` reads the LIVE job on every plan, so a hand edit surfaces as\n *   `1 to update` that day rather than on the day somebody needs last night's backup and finds a\n *   week-old one, or none.\n *\n * ⛔ PVE GENERATES `id` WHEN YOU OMIT IT, WHICH MAKES OMITTING IT THE WORST BUG THIS RESOURCE\n *   COULD CARRY. PVE's own API schema says so in one parenthesis — `id`: \"Job ID (will be\n *   autogenerated).\" — and a generated id looks like `backup-f56d8ab7-d524`. A resource that\n *   POSTed without an id would create a SECOND job beside the first on EVERY reconcile, and the\n *   read-back could still pass, because a job did appear: that check asks \"is the object there\",\n *   not \"is it the one I meant\". So `id` is a REQUIRED prop and is always sent\n *   on create. To adopt a job that already exists, declare its existing id; any other id is a new\n *   job beside it, not an adoption.\n *   ★ FAILED READS NOW PROPAGATE THROUGH DISTILLED. Only a typed missing-job response means\n *     absent. An expired lease, a 403 or an unrelated server error stops reconciliation before\n *     any POST. The explicit id remains a second defense against accidentally duplicating jobs.\n *\n * ⚠️ `Sys.Modify` ON `/` IS THE GATE AND IT IS NOT A SMALL GRANT. PVE has no Backup.* privilege:\n *   create, update and delete of a vzdump job are all checked against `Sys.Modify` at `/` — the\n *   same privilege that covers node network configuration. A credential that can declare backup\n *   jobs can also rewrite the cluster's networking. That is PVE's granularity rather than a choice\n *   made here, and it is exactly why widening a role for this should be a decision rather than a\n *   reaction to a 403.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as cluster from '@distilled.cloud/proxmox/cluster';\nimport { runPve } from './distilled-pve.ts';\nimport { specGuards } from './resource-guard.ts';\nimport { formToSend } from './update-guard.ts';\nimport { backupJobSpec } from './backup-job-config.ts';\nimport { backupJobRequest, deleteBackupJob, readBackupJob } from './backup-job-distilled.ts';\n\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\n\n/**\n * ★ Public props retain PVE's own dashed field names. The distilled transport maps those\n *   existing forms to the SDK's generated identifiers; lifecycle tests check the actual wire.\n */\nexport interface BackupJobProps extends WithTarget {\n  /** ⛔ The primary key, REQUIRED. Never let PVE generate it — see the ⛔ above. */\n  id: string;\n  /** A subset of systemd calendar events, e.g. `01:00` or `mon..fri 02:30`. */\n  schedule: string;\n  /** Target storage id. That storage's own retention applies unless `prune-backups` overrides it. */\n  storage?: string;\n  mode?: 'snapshot' | 'suspend' | 'stop';\n  /** PVE's default is enabled. A disabled job is a backup that silently is not happening. */\n  enabled?: boolean;\n  /** Back up every guest. ⚠️ Pick exactly one of `all`, `vmid` and `pool` — see `shape` below. */\n  all?: boolean;\n  vmid?: readonly number[];\n  pool?: string;\n  /** Guest ids to skip. PVE reads this as \"all guests except these\", so it belongs with `all`. */\n  exclude?: readonly number[];\n  /** Retention, as a property string: `keep-daily=7,keep-weekly=4`. */\n  'prune-backups'?: string;\n  /** Supports {{cluster}}, {{guestname}}, {{node}} and {{vmid}}. Single line only. */\n  'notes-template'?: string;\n  'notification-mode'?: 'auto' | 'legacy-sendmail' | 'notification-system';\n  /** Run a missed job as soon as the scheduler is back. */\n  'repeat-missed'?: boolean;\n  /** VM-only fleecing, as a property string: `enabled=1,storage=<id>`. See `propertyString`. */\n  fleecing?: string;\n  comment?: string;\n}\n\nexport interface BackupJobAttributes {\n  id: string;\n  schedule: string;\n  storage: string;\n  mode: string;\n  enabled: boolean;\n  all: boolean;\n  /** Sorted and comma-joined, so re-ordering a declaration is not a diff. See `guestList`. */\n  vmid: string;\n  pool: string;\n  exclude: string;\n  /** Flattened and sorted — never the raw value PVE returned. See `propertyString`. */\n  'prune-backups': string;\n  'notes-template': string;\n  'notification-mode': string;\n  'repeat-missed': boolean;\n  fleecing: string;\n  comment: string;\n  /**\n   * PVE's own estimate, epoch seconds. REPORTED, NEVER COMPARED: `next-run` in `matches` would\n   * report an update every time the clock passed a scheduled run. It is here so a plan can show\n   * that a job is still due — a `next-run` of 0 is a job the scheduler will not run.\n   */\n  'next-run': number;\n}\n\nexport interface ProxmoxBackupJob extends Resource<\n  'Proxmox.BackupJob',\n  BackupJobProps,\n  BackupJobAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxBackupJob = Resource<ProxmoxBackupJob>('Proxmox.BackupJob');\n\n/**\n * ⛔ Adoption stays explicit: listing every backup job could grant Alchemy deletion rights over\n *   an undeclared schedule. Delete removes the schedule, not its stored archives; that still\n *   stops future backups, so the plan line is a consequential warning.\n */\nconst { guardCreate, guardUpdate } = specGuards(backupJobSpec);\n\n/** SDK lifecycle walked against pve-manager 9.2.11; failed reads never imply create. */\nexport const ProxmoxBackupJobProvider = () =>\n  Provider.effect(\n    ProxmoxBackupJob,\n    Effect.succeed(\n      ProxmoxBackupJob.Provider.of({\n        list: () => Effect.succeed([]),\n        read: ({ olds }) => readBackupJob(olds),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardCreate(news, output === undefined);\n          yield* guardUpdate(news);\n          if (output === undefined) return undefined;\n          const live = yield* readBackupJob(news);\n          if (live === undefined) {\n            yield* guardCreate(news, true);\n            return { action: 'update' } as const;\n          }\n          return { action: backupJobSpec.matches(live, news) ? 'noop' : 'update' } as const;\n        }),\n        reconcile: Effect.fn(function* ({ news }) {\n          const live = yield* readBackupJob(news);\n          yield* guardCreate(news, live === undefined);\n          yield* guardUpdate(news);\n          if (live === undefined) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              cluster.createClusterBackup(backupJobRequest(news)),\n            );\n          } else {\n            const form = formToSend(\n              backupJobSpec.matches,\n              live,\n              news,\n              backupJobSpec.updateForm(news),\n            );\n            if (form !== undefined)\n              yield* runPve(\n                news.target,\n                'provision',\n                true,\n                cluster.putClusterBackup(backupJobRequest(news, form)),\n              );\n          }\n          const after = yield* readBackupJob(news);\n          if (after === undefined)\n            return yield* Effect.fail(\n              new Error(\n                `${backupJobSpec.path(news)}: write returned success but the resource is still absent`,\n              ),\n            );\n          return after;\n        }),\n        delete: ({ olds }) => deleteBackupJob(olds),\n      }),\n    ),\n  );\n",
     "/**\n * A spec's two forms, checked against the vendor's own tables before either goes on the wire.\n *\n * ★ A FILE OF ITS OWN BECAUSE resource.ts REACHED THE 250-LINE CAP, and the seam is the same one\n *   resource-spec.ts cuts on: that file says what a PVE object DECLARES, resource.ts says how one\n *   is read and written, and this one says what makes a declaration legal. `constraint-guard.ts`\n *   is the layer below — it owns the lookup and the refusal; this owns which form to check when.\n */\nimport * as Effect from 'effect/Effect';\nimport { guardForm } from './constraint-guard.ts';\nimport type { PveSpec, WithApiTarget } from './resource-spec.ts';\n\nexport const specGuards = <Props extends WithApiTarget, Attributes>(\n  spec: PveSpec<Props, Attributes>,\n) => {\n  /** ⚠️ A function for the two families whose endpoint is a prop — see `PveSpec['endpoint']`. */\n  const endpointsOf = (props: Props) =>\n    typeof spec.endpoint === 'function' ? spec.endpoint(props) : spec.endpoint;\n\n  /**\n   * The create form against its own endpoint's table.\n   *\n   * ⛔ `presence` MEANS \"A CREATE IS REALLY ABOUT TO HAPPEN\", NOT \"THIS IS THE CREATE FORM\", AND\n   *   THE DIFFERENCE IS A WHOLE FAMILY. `Proxmox.NotificationTarget` cannot send gotify's `token`\n   *   or smtp's `password` — they are write-only secrets and props are persisted to the state\n   *   store unencrypted (notification-target.ts's third ⛔) — so PVE's `token: required` is\n   *   permanently unsatisfiable here. The documented way to run one is to create it out of band\n   *   with its secret and then DECLARE it, which is an adopt and then updates forever after.\n   *   Requiring the create form's parameters on that path would refuse a deploy that has worked\n   *   all along, which is the one failure worse than the 400 this feature removes.\n   * ⚠️ VALUE RULES STILL RUN ON EVERY PLAN, presence or not: a 129-character comment is wrong\n   *   whether it is being created or edited, and that is the case this whole feature exists for.\n   *\n   * ⛔ THE FORM IS BUILT ONLY WHEN THERE IS A TABLE TO CHECK IT AGAINST. Calling `spec.createForm`\n   *   unconditionally would run every family's form builder on every diff — work nobody asked\n   *   for, and a new way for a builder that throws on an update-only path to break a plan it\n   *   never touched.\n   */\n  const guardCreate = (props: Props, presence: boolean): Effect.Effect<void> =>\n    Effect.suspend(() => {\n      const create = endpointsOf(props)?.create;\n      return create === undefined\n        ? Effect.void\n        : guardForm(create, spec.createForm(props), presence);\n    });\n\n  /**\n   * ⛔ NEVER WITH PRESENCE. An update form is deliberately PARTIAL — `formToSend` sends the fields\n   *   that changed and nothing else — so requiring the vendor's required parameters here would\n   *   refuse every ordinary edit. Value rules (length, range, enum, pattern) apply to both forms.\n   */\n  const guardUpdate = (props: Props): Effect.Effect<void> =>\n    Effect.suspend(() => {\n      const update = endpointsOf(props)?.update;\n      if (update === undefined) return Effect.void;\n      const form = spec.updateForm?.(props);\n      return form === undefined ? Effect.void : guardForm(update, form, false);\n    });\n\n  return { guardCreate, guardUpdate };\n};\n",
     "/**\n * Whether an update has anything to write — decided ONCE for every PVE and PBS family.\n *\n * ⛔ AN ADOPTED ROW IS RECONCILED EVEN WHEN ITS DIFF SAID `noop`, SO THIS GUARD IS WHAT MAKES\n *   ADOPTION FREE. alchemy beta.79 Plan.ts sets `forceUpdateAfterAdoption` after the cold-start\n *   probe and turns a `noop` diff into an update; Apply.ts then calls `reconcile` for the\n *   `adopted` action exactly as for `update`. The plan prints `adopted` either way, so nothing on\n *   screen tells a matching object from a drifting one. docs/adopt-verify.md has the table of\n *   what each family does on that path.\n *\n * 🔴 THE FAMILY THAT DID NOT HAVE IT. `Proxmox.CephPool` wrote its own reconcile and PUT the\n *   declared set whenever the pool existed, so adopting a pool that already matched sent\n *   `setpool` and forked a worker on the live cluster (found 2026-09-21 by tracing every family).\n *   resource.ts and pbs-datastore.ts each had the guard inline; three copies of one predicate is\n *   how the fourth family forgets it, so it lives here and all three call it.\n *\n * ★ `matches` IS THE SAME PREDICATE `diff` USES, so \"the diff said noop\" and \"reconcile writes\n *   nothing\" cannot disagree. A field left OUT of `matches` is one the family does not manage, so\n *   its drift is not this write's to repair.\n *\n * ⚠️ AN EMPTY FORM IS ALSO NOT A WRITE. `updateForm` can legitimately answer `{}` — a storage\n *   declaring only `storage`, `type` and its locator has no mutable field at all — and PUTting an\n *   empty body is a pointless write at best and a 400 that reads as a broken provider at worst.\n *   (Moved here from resource.ts with the guard it explains.)\n */\nexport const formToSend = <Attributes, Props, Form extends object>(\n  matches: (attributes: Attributes, props: Props) => boolean,\n  live: Attributes,\n  props: Props,\n  form: Form,\n): Form | undefined => (matches(live, props) || Object.keys(form).length === 0 ? undefined : form);\n",
+    "/** Pure existing forms, normalization and equality, shared by plan and SDK lifecycle. */\nimport type { BackupJobAttributes, BackupJobProps } from './backup-job.ts';\nimport type { PveSpec } from './resource-spec.ts';\nimport { bool, guestList, propertyString, text } from './values.ts';\n\n/**\n * The form for both create and update.\n *\n * ⛔ A FIELD THE DECLARATION LEAVES OUT IS NOT SENT, AND THAT IS LOAD BEARING. PVE's PUT can only\n *   SET a key; clearing one needs `delete=<key>`, which this resource deliberately never sends.\n *   `updateForm` is handed the props and nothing else, so a `delete` list could only be \"every\n *   field you did not declare\" — and on a job adopted out of the UI that would silently strip\n *   settings this resource does not even model, `compress`, `mailto` and `bwlimit` among them, on\n *   the first deploy. Leaving undeclared fields alone is the smaller lie, and `matches` tells the\n *   same lie consistently: it does not compare what it cannot change.\n *\n * ⚠️ THE FIVE FIELDS PVE DOCUMENTS A DEFAULT FOR ARE ALWAYS SENT AND ALWAYS COMPARED — `enabled`\n *   (1), `all` (0), `mode` (snapshot), `notification-mode` (auto), `repeat-missed` (0). That is\n *   what makes a hand-flipped `enabled 0` show up as drift rather than as silence, and it is also\n *   what stops those five looping: a field compared against a default must be sent as that\n *   default, or every plan reports an update the PUT never performs. The cost is worth reading\n *   before the first deploy against an adopted job — an omitted `all` is a declaration that this\n *   job backs up NOTHING, and PVE accepts a job that selects nothing without a word. Read that\n *   first plan; do not deploy it unseen.\n */\nconst shape = (props: BackupJobProps) => ({\n  all: props.all === true ? '1' : '0',\n  enabled: props.enabled === false ? '0' : '1',\n  mode: props.mode ?? 'snapshot',\n  'notification-mode': props['notification-mode'] ?? 'auto',\n  'repeat-missed': props['repeat-missed'] === true ? '1' : '0',\n  schedule: props.schedule,\n  ...(props.comment === undefined ? {} : { comment: props.comment }),\n  ...(props.exclude === undefined ? {} : { exclude: guestList(props.exclude) }),\n  ...(props.fleecing === undefined ? {} : { fleecing: props.fleecing }),\n  ...(props['notes-template'] === undefined ? {} : { 'notes-template': props['notes-template'] }),\n  ...(props.pool === undefined ? {} : { pool: props.pool }),\n  ...(props['prune-backups'] === undefined ? {} : { 'prune-backups': props['prune-backups'] }),\n  ...(props.storage === undefined ? {} : { storage: props.storage }),\n  ...(props.vmid === undefined ? {} : { vmid: guestList(props.vmid) }),\n});\n\nexport const backupJobSpec = {\n  /**\n   * ⛔ NO \"IS IT REALLY THERE\" GUARD, ON PURPOSE. Returning undefined for a job whose JSON is\n   *   missing some key would be a guess about which keys PVE echoes back, and a wrong guess here\n   *   does not read as absent-and-harmless: `reconcile` would POST, and POST creates ANOTHER job.\n   *   Absence is decided by the API declining to answer, which `pveOperations.read` already\n   *   handles — not by a key being missing from an answer that did arrive.\n   */\n  attributes: (live, props) => ({\n    all: bool(live['all'], false),\n    comment: text(live['comment'], ''),\n    enabled: bool(live['enabled'], true),\n    exclude: guestList(live['exclude']),\n    fleecing: propertyString(live['fleecing'], 'enabled'),\n    id: props.id,\n    mode: text(live['mode'], 'snapshot'),\n    'next-run': typeof live['next-run'] === 'number' ? live['next-run'] : 0,\n    'notes-template': text(live['notes-template'], ''),\n    'notification-mode': text(live['notification-mode'], 'auto'),\n    pool: text(live['pool'], ''),\n    'prune-backups': propertyString(live['prune-backups']),\n    'repeat-missed': bool(live['repeat-missed'], false),\n    schedule: text(live['schedule'], ''),\n    storage: text(live['storage'], ''),\n    vmid: guestList(live['vmid']),\n  }),\n  collection: () => 'cluster/backup',\n  /** ⛔ `id` IS SENT AND IS NOT OPTIONAL. Everything above depends on PVE not inventing one. */\n  createForm: (props) => ({ ...shape(props), id: props.id }),\n  /** Each line reads \"not declared, or equal\"; the five defaulted fields have no undeclared case. */\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: { create: 'pve:POST /cluster/backup', update: 'pve:PUT /cluster/backup/{id}' },\n  matches: (attributes, props) =>\n    attributes.schedule === props.schedule &&\n    attributes.enabled === (props.enabled !== false) &&\n    attributes.all === (props.all === true) &&\n    attributes.mode === (props.mode ?? 'snapshot') &&\n    attributes['notification-mode'] === (props['notification-mode'] ?? 'auto') &&\n    attributes['repeat-missed'] === (props['repeat-missed'] === true) &&\n    (props.storage === undefined || attributes.storage === props.storage) &&\n    (props.pool === undefined || attributes.pool === props.pool) &&\n    (props.comment === undefined || attributes.comment === props.comment) &&\n    (props.vmid === undefined || attributes.vmid === guestList(props.vmid)) &&\n    (props.exclude === undefined || attributes.exclude === guestList(props.exclude)) &&\n    (props['notes-template'] === undefined ||\n      attributes['notes-template'] === props['notes-template']) &&\n    (props['prune-backups'] === undefined ||\n      attributes['prune-backups'] === propertyString(props['prune-backups'])) &&\n    (props.fleecing === undefined ||\n      attributes.fleecing === propertyString(props.fleecing, 'enabled')),\n  path: (props) => `cluster/backup/${props.id}`,\n  updateForm: shape,\n} satisfies PveSpec<BackupJobProps, BackupJobAttributes>;\n",
+    "/** Backup-job operations from distilled-proxmox, walked against pve-manager 9.2.11. */\nimport * as cluster from '@distilled.cloud/proxmox/cluster';\nimport * as Effect from 'effect/Effect';\nimport * as Schema from 'effect/Schema';\nimport { ProxmoxParseError } from '@distilled.cloud/proxmox/Errors';\nimport { backupJobSpec } from './backup-job-config.ts';\nimport type { BackupJobProps } from './backup-job.ts';\nimport { runPve } from './distilled-pve.ts';\n\n/** SDK member names differ from the vendor's hyphenated form keys; omission stays omission. */\nexport const backupJobRequest = (\n  props: BackupJobProps,\n  form = backupJobSpec.updateForm(props),\n): cluster.PutClusterBackupRequest => {\n  const {\n    'notes-template': notes_template,\n    'notification-mode': notification_mode,\n    'prune-backups': prune_backups,\n    'repeat-missed': repeat_missed,\n    ...fields\n  } = form;\n  return {\n    ...fields,\n    id: props.id,\n    notification_mode,\n    repeat_missed,\n    ...(notes_template === undefined ? {} : { notes_template }),\n    ...(prune_backups === undefined ? {} : { prune_backups }),\n  };\n};\n\n/**\n * SDK decode also renames NESTED retention keys. Restore the vendor's property-string\n * spelling before the existing canonical comparison, or keep_daily becomes perpetual drift.\n * A property string from an older server remains a property string.\n */\nexport const readBackupJob = (props: BackupJobProps) =>\n  runPve(props.target, 'read', false, cluster.getClusterBackup({ id: props.id })).pipe(\n    // Legacy PVE emits these two properties as strings; current PVE expands objects.\n    // Validate the generated response's remaining fields without narrowing that compatibility.\n    Effect.flatMap((live) =>\n      Schema.decodeUnknownEffect(Schema.toType(cluster.GetClusterBackupResponse))({\n        ...live,\n        prune_backups: undefined,\n        fleecing: undefined,\n      }).pipe(\n        Effect.mapError(\n          () =>\n            new ProxmoxParseError({\n              body: undefined,\n              cause: 'Backup job response does not match its vendor schema',\n            }),\n        ),\n        Effect.as(live),\n      ),\n    ),\n    Effect.map((live) =>\n      backupJobSpec.attributes(\n        {\n          ...live,\n          'next-run': live.next_run,\n          'notes-template': live.notes_template,\n          'notification-mode': live.notification_mode,\n          'prune-backups':\n            typeof live.prune_backups === 'object' && live.prune_backups !== null\n              ? Object.fromEntries(\n                  Object.entries(live.prune_backups).map(([key, value]) => [\n                    key.replaceAll('_', '-'),\n                    value,\n                  ]),\n                )\n              : live.prune_backups,\n          'repeat-missed': live.repeat_missed,\n        },\n        props,\n      ),\n    ),\n    Effect.catchTag('BackupJobNotFound', () => Effect.succeed(undefined)),\n    Effect.catchTag('NotFound', () => Effect.succeed(undefined)),\n  );\n\nexport const deleteBackupJob = (props: BackupJobProps) =>\n  runPve(props.target, 'provision', true, cluster.deleteClusterBackup({ id: props.id })).pipe(\n    Effect.catchTag('BackupJobNotFound', () => Effect.void),\n    Effect.catchTag('NotFound', () => Effect.void),\n  );\n",
     "/**\n * `Proxmox.CephDaemon` — a Ceph monitor, manager or metadata server on one node.\n *\n * ★ ONE RESOURCE FOR THREE KINDS, AND THE SCHEMAS WERE CHECKED BEFORE THAT WAS DECIDED. Parsed\n *   from `/usr/share/pve-docs/api-viewer/apidoc.js` on node-b, 2026-09-13: mon, mgr and mds each\n *   expose GET on the collection and POST + DELETE on the id below it, each returns\n *   name/host/state/addr/ceph_version*, and the only divergence is the create parameter\n *   (`mon-address` / none / `hotstandby`) and the read-only extras (mon: quorum, rank; mds: rank,\n *   fs_name, standby_replay). Three near-identical files would have carried the traps below three\n *   times over and let them drift — the argument resource.ts already makes for the factory itself.\n *\n * ⛔ THE ONLY GET IS THE COLLECTION'S, AND IT ANSWERS FOR THE WHOLE CLUSTER. MEASURED:\n *   `GET /nodes/node-b/ceph/mon` returns node-b, node-c AND node-d, and `GET /nodes/node-c/ceph/mon` returns the same\n *   three IN A DIFFERENT ORDER — [node-d,node-b,node-c] from node-b, [node-c,node-b,node-d] from node-c — so a row is found by\n *   `name` and NEVER by position, and the `{node}` in the path is only the node being ASKED.\n *   MEASURED too: there is no GET on the id path at all; `pvesh get /nodes/node-b/ceph/mon/node-b` answers\n *   \"No 'get' handler defined for '/nodes/node-b/ceph/mon/node-b'\", and mgr and mds answer the same.\n *   That is why `path()` below is the COLLECTION, and that in turn is why `delete` is the one\n *   handler this file writes by hand: `pveOperations.destroy` sends its DELETE to `spec.path`,\n *   which here would be the collection — a 501 reported as a failed destroy, with the daemon still\n *   running. Same shape and same rule as the override in acl.ts: do not \"restore symmetry\" by\n *   pointing it back at `ops.destroy`.\n *\n * ⛔ WHAT A DESTROY ACTUALLY DOES, BECAUSE THE PLAN LINE SAYS ONLY \"delete\". REASONED FROM PVE'S\n *   AND CEPH'S DOCUMENTED BEHAVIOUR, NOT MEASURED — nothing on this cluster was destroyed to find\n *   out, and nothing should be to check. `mon`: stops ceph-mon@id, removes it from the monmap and\n *   strips its section from ceph.conf. THREE MONS TOLERATE ONE LOSS; TWO TOLERATE NONE. Removing\n *   two in one deploy — or removing the mon on the node whose API is serving the call — loses\n *   quorum, and a cluster without mon quorum BLOCKS every RBD and CephFS I/O rather than erroring\n *   it, so on this cluster every guest on `rbd-c1` hangs.\n *   `mds`: destroying a STANDBY is a non-event; destroying the ACTIVE one fails CephFS over,\n *   and with no standby left `cephfs-c1` goes unavailable. `mgr`: no guest I/O depends on it, but\n *   the last one takes the PG autoscaler, the dashboard and PVE's own Ceph status with it.\n *   Live on 2026-09-13: mon, mgr AND mds on each of node-b, node-c, node-d.\n *\n * ★ AND THE ONLY WAY TO REACH THAT DESTROY IS TO DELETE THE DECLARATION. `matches` is deliberately\n *   total (see its ⛔), so this resource CANNOT plan a `replace` — which is the one action that\n *   would tear down a live mon off the back of an edited field rather than a removed line.\n *\n * ⚠️ THE PRIVILEGES ARE ASYMMETRIC AND THE READ SIDE IS THE CHEAP ONE. The GET checks `any` of\n *   `Sys.Audit`/`Datastore.Audit` on `/`, and PVEAuditor holds both (MEASURED:\n *   `GET /access/roles/PVEAuditor`), so the mount's `read` role can see this family — unlike\n *   `Proxmox.Storage`, which 403s under that lease. POST and DELETE both check `Sys.Modify` on\n *   `/`, and MEASURED on this cluster the provision role already held it (it is in `PROVISION_PRIVILEGES`), so the provision lane\n *   needs no widening for once. ⚠️ `Sys.Modify` on the ROOT path is broad — it also buys\n *   datacenter options and every other cluster-wide config write — so it is worth knowing that\n *   this credential already has it rather than discovering it the next time something is scoped.\n *\n * ★ MIGRATED OFF `client.ts` (2026-09-24, decision 43, 2c) — ceph-daemon-wire.ts has the rename\n *   and why no protocol gap blocks any of the three kinds. The follow-up removes the preserved\n *   catch-all read fold: only a successful index without this daemon proves absence.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { DAEMON_ENDPOINTS, createForm } from './ceph-daemon-form.ts';\nimport { createDaemon, deleteDaemon, notCreated, readDaemon } from './ceph-daemon-wire.ts';\nimport { guardWrite } from './distilled-guard.ts';\nimport { type PveRequirements, type WithTarget } from './resource.ts';\n\n/**\n * Which Ceph daemon this is. The discriminant picks the collection, the create parameters and\n * which of the read-only extras below will even be populated.\n *\n * ⚠️ `osd` IS NOT HERE AND MUST NOT BE ADDED TO THIS UNION. `/nodes/{node}/ceph/osd` takes a disk\n *   device, wipes it, and its DELETE has a `cleanup` flag — a create that destroys data on the way\n *   in is a different resource with a different set of refusals, not a fourth case in this one.\n */\nexport type CephDaemonKind = 'mon' | 'mgr' | 'mds';\n\nexport interface CephDaemonProps extends WithTarget {\n  kind: CephDaemonKind;\n  /**\n   * The node the daemon RUNS on. Identity — a daemon cannot be moved, only destroyed and rebuilt.\n   * ⚠️ It is also the node whose API is asked, and the read is only as available as that node: a\n   *   failed index now propagates its error. Before the typed-read follow-up, a down node,\n   *   missing Ceph installation or 403 was folded to \"absent\"; its daemons planned `update`\n   *   and reconcile POSTed a create for a mon that already existed. PVE refused with \"monitor\n   *   already exists\", then read-back failed again, obscuring the original node read error.\n   *   That incident is why collection failure can never prove a daemon is missing.\n   */\n  node: string;\n  /**\n   * The daemon id. PVE defaults it to the nodename, and `daemonId` in ceph-daemon-form.ts resolves\n   * that default HERE rather than leaving it to PVE, because the id is a PATH SEGMENT: create,\n   * delete and the row lookup all need the same string, and a default resolved on the far side\n   * would leave three call sites guessing. Live on this cluster every daemon's name is its node.\n   */\n  name?: string;\n  /**\n   * mon only. Overrides the autodetected monitor IP; must sit in Ceph's public network — on this\n   * cluster that is 198.51.100.0/24, carried by `vmbr1.42`.\n   * ⛔ CREATE-ONLY AND NEVER COMPARED. PVE takes a bare ip-list on write and hands back `addr` as\n   *   `198.51.100.12:6789/0` — an address, a port and a nonce. The two are not the same string and\n   *   never will be, so diffing them would report a mismatch on every plan; with no PUT on this\n   *   family that mismatch becomes a REPLACE, and a replace of a mon is the quorum loss in the\n   *   header. Left out of `matches` on purpose.\n   */\n  'mon-address'?: string;\n  /**\n   * mds only. Makes this standby replay the active MDS's journal for a faster failover.\n   * ⛔ CREATE-ONLY AND NEVER COMPARED, AND THE FIELD THAT LOOKS LIKE ITS READBACK IS NOT ONE.\n   *   `standby_replay` in the list is the daemon's CURRENT state, not its configuration: MEASURED\n   *   2026-09-13, all three mds report `standby_replay: false`, node-c included — and node-c is the ACTIVE\n   *   mds, which is not a standby at all and so can never report true however it was created.\n   *   Comparing `hotstandby` to it would plan a replace against whichever mds Ceph happens to have\n   *   elected, i.e. against a value no declaration controls.\n   * ⚠️ SET ON A mon OR mgr IT IS DROPPED RATHER THAN SENT, and `mon-address` likewise on an mds:\n   *   each POST schema lists only its own parameter, so the wrong one is a 400 rather than an\n   *   ignored hint. A field silently dropped is the lesser of the two, but it IS dropped.\n   */\n  hotstandby?: boolean;\n}\n\n/**\n * Everything the cluster says about this daemon — reported, and (bar its identity) none of it\n * compared. Read the ⛔ on `matches` for why that is the only safe split on this family.\n */\nexport interface CephDaemonAttributes {\n  kind: CephDaemonKind;\n  node: string;\n  name: string;\n  /**\n   * The host Ceph says it runs on.\n   * ⚠️ REPORTED, NOT COMPARED, AND THAT IS A DELIBERATE BLIND SPOT. A daemon found under this name\n   *   on a DIFFERENT node than `node` declares plans as `noop`, which does hide a misdeclaration.\n   *   The alternative is worse: `host` is `optional` in the schema, so an absent one would read as\n   *   a mismatch, and with no PUT a mismatch is a replace — i.e. a missing field in one API answer\n   *   would destroy a live mon. When in doubt, out of `matches`; fix a wrong node by hand.\n   */\n  host: string;\n  /**\n   * mon `running`/`stopped`/`unknown`, mgr `active`/`standby`, mds `up:active`/`up:standby`/…\n   * ⛔ CEPH ELECTS THIS AND REWRITES IT WITHOUT ANYONE DECLARING ANYTHING. MEASURED: mgr node-b is\n   *   `active` while node-c and node-d are `standby`; mds node-c is `up:active` while node-b and node-d are\n   *   `up:standby`. Restart a daemon and the roles move. It is reported so a plan can show what is\n   *   live and kept out of `matches` so that an election is never a diff.\n   * ⚠️ IT ALSO MEANS THIS RESOURCE DOES NOT MANAGE WHETHER THE DAEMON IS RUNNING. A configured but\n   *   stopped daemon is still a row in the list, so it reads as present and plans `noop`.\n   */\n  state: string;\n  /** Ceph-formatted, e.g. `198.51.100.12:6789/0`. Reported; see `mon-address` for why never compared. */\n  addr: string;\n  /** `ceph_version_short`, e.g. `20.2.2`. Reported: a straggler after an upgrade is worth seeing. */\n  version: string;\n  /**\n   * mon rank in the monmap, mds rank in the filesystem, `-1` when the daemon has neither.\n   * ⛔ CEPH ASSIGNS IT AND NOTHING DECLARES IT. MEASURED: the mons are ranked node-d=0, node-c=1, node-b=2 —\n   *   monmap order, not declaration order — and the mds ranks are 0 for the active node-c and -1 for\n   *   the two standbys. Rank moves when a daemon is added, removed or restarted.\n   */\n  rank: number;\n  /** mon only: in the current quorum. Reported. MEASURED: all three mons are in quorum. */\n  quorum: boolean;\n  /** mds only, and NOT the readback of `hotstandby` — see the ⛔ on that prop. */\n  standbyReplay: boolean;\n  /**\n   * mds only: the CephFS this daemon currently serves — `cephfs-c1` here.\n   * ⛔ PRESENT ONLY ON THE ACTIVE MDS. MEASURED: node-c carries `fs_name`, node-b and node-d have no such key\n   *   at all. So it is empty for two of three identical declarations, and comparing it would\n   *   report work on exactly the daemons that are healthy standbys.\n   */\n  fsName: string;\n  /** A `ceph-<kind>@<id>` systemd unit is enabled on the host. Reported; absent reads as false. */\n  service: boolean;\n}\n\nexport interface ProxmoxCephDaemon extends Resource<\n  'Proxmox.CephDaemon',\n  CephDaemonProps,\n  CephDaemonAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a mon carrying quorum cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxCephDaemon = Resource<ProxmoxCephDaemon>('Proxmox.CephDaemon', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * ⛔ TOTAL, AND THIS IS THE REASON THE FILE EXISTS RATHER THAN A SHORTCUT PAST WRITING IT. Every\n *   field a declaration can carry is CREATE-ONLY and unreadable — `mon-address` comes back as a\n *   different kind of string, `hotstandby` comes back as a state Ceph elects — and every field\n *   the read returns is assigned by Ceph: state, rank, quorum, fs_name, standby_replay, addr,\n *   version. Nothing is left that is both declared and readable. So the honest comparison is\n *   \"does a daemon of this kind and name exist\", which `readDaemon` has already answered by\n *   returning a value at all, and anything further would be a diff no write could ever satisfy.\n *   ⛔ AND ON THIS FAMILY THAT DIFF IS NOT MERELY NOISY. There is no PUT, so a false mismatch\n *     would have to be a REPLACE — and replace on a mon is delete-then-create against a live\n *     quorum. A forever-diff here is a forever-OUTAGE-RISK.\n *   ⚠️ THE PRICE, STATED PLAINLY: editing `hotstandby` or `mon-address` on a declared daemon\n *     plans as `noop` and never applies. Same bargain storage.ts strikes for a changed `type`.\n *     Change one by removing the declaration and re-adding it, ONE DAEMON AT A TIME, reading the\n *     ⛔ on destroy in the header first.\n */\n/**\n * ★ The factory's shape with no `updateForm`: create if absent, else read back untouched.\n * ⛔ `guardWrite` RUNS RIGHT AFTER THE READ, UNCONDITIONALLY, NOT ONLY ON THE CREATE BRANCH —\n *   found on adversarial review, 2026-09-24, matching node-network.ts's own `reconcile`.\n *   `reconcile` also runs for an ADOPTED row with no fresh `diff` first (Plan.ts forces it after\n *   the probe even when `diff` said noop), so a guard only on the create branch would let a\n *   caller that skips `diff` (a resumed apply, a verify harness) reach `createDaemon` with\n *   `mon-address` — a real vendor rule — unchecked.\n * ★ EXPORTED SO A TEST CAN CALL IT DIRECTLY, bypassing `diff` — the shape the review's own proof\n *   needed: `findProvider` gives back the wrapped service, this gives the plain function.\n */\nexport const reconcileDaemon = Effect.fn(function* ({ news }: { news: CephDaemonProps }) {\n  const live = yield* readDaemon(news);\n  yield* guardWrite(DAEMON_ENDPOINTS[news.kind], createForm(news), live === undefined);\n  if (live !== undefined) return live;\n  yield* createDaemon(news);\n  const after = yield* readDaemon(news);\n  if (after === undefined) return yield* Effect.die(notCreated(news));\n  return after;\n});\n\nexport const ProxmoxCephDaemonProvider = () =>\n  Provider.effect(\n    ProxmoxCephDaemon,\n    Effect.succeed(\n      ProxmoxCephDaemon.Provider.of({\n        /** ⛔ Empty, like every other resource here — adopting the whole cluster's daemons is not\n         *   an accident anyone should be one `destroy` away from. Adoption stays explicit. */\n        list: () => Effect.succeed([]),\n        read: ({ olds }) => readDaemon(olds),\n        // ★ Matches the pre-migration factory shape exactly (resource.ts): present is settled.\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(DAEMON_ENDPOINTS[news.kind], createForm(news), output === undefined);\n          if (output === undefined) return undefined;\n          const live = yield* readDaemon(news);\n          if (live === undefined) {\n            yield* guardWrite(DAEMON_ENDPOINTS[news.kind], createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          return { action: 'noop' } as const;\n        }),\n        reconcile: ({ news }) => reconcileDaemon({ news }),\n        /**\n         * ⛔ THE DANGEROUS ONE. Re-read the destroy ⛔ in the header before letting a plan that\n         *   removes a mon run: two gone at once is a cluster with no quorum and every guest on\n         *   `rbd-c1` blocked on I/O.\n         */\n        delete: ({ olds }) => deleteDaemon(olds),\n      }),\n    ),\n  );\n",
     "/**\n * Where a Ceph daemon lives on the API, and what a declaration of one looks like as a PVE form.\n *\n * ★ SPLIT OUT OF ceph-daemon.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is a real\n *   one rather than a convenient line number — the same seam metric-server-form.ts cuts on.\n *   This file answers \"how does a declaration address ONE daemon\" — which URL, which body, and\n *   which row of the collection's answer is it. ceph-daemon.ts answers \"what does the cluster\n *   say about that daemon, and when has it changed\". Nothing here calls the API and nothing\n *   here decides a diff; `findRow` picks a row out of an answer its caller already fetched.\n *\n * ⛔ THE TWO PATHS ARE DIFFERENT AND THAT IS THE WHOLE REASON THIS FILE HAS TWO OF THEM. MEASURED\n *   on node-b, 2026-09-13: there is no GET on the id path — `pvesh get /nodes/node-b/ceph/mon/node-b` answers\n *   \"No 'get' handler defined\" — while POST and DELETE are registered ONLY there. So the read uses\n *   `collectionPath` and the two writes use `daemonPath`, and swapping either one is a silent\n *   501: a create that never lands, or a destroy that reports failure while the daemon runs on.\n *\n * ⚠️ THE `import type` BACK TO ceph-daemon.ts IS A CYCLE ON PAPER ONLY — type-only, so it is\n *   erased before anything runs. `CephDaemonProps` stays the resource's public shape, in the file\n *   that declares the resource.\n *\n * ⛔ POST AND DELETE RETURN A UPID, NOT AN OBJECT — both are `protected` task endpoints whose\n *   schema `returns` is a bare string. REASONED, NOT MEASURED: this cluster is read-only to me, so\n *   no create was ever run. The consequence to expect is that `reconcile` reads back immediately\n *   after the POST, and if the worker has not yet written ceph.conf the read-back still says\n *   absent and reconcile dies with \"the write returned no error but the object is still absent\".\n *   That refusal is honest — nothing is recorded for an object that is not there — and a second\n *   deploy converges once the task has finished, but it is a confusing FIRST-RUN failure. Watch\n *   the task in the PVE UI before concluding the create failed.\n *\n */\nimport type { CephDaemonAttributes, CephDaemonKind, CephDaemonProps } from './ceph-daemon.ts';\nimport type { EndpointKey } from './constraints.ts';\nimport { bool, flag, num, text } from './values.ts';\n\n/**\n * The vendor endpoint each kind is created at, as the generated tables key it.\n *\n * ⛔ ONE PER KIND, NOT A `{type}` PATH. PVE registers `mds`, `mgr` and `mon` as three separate\n *   nodes with three separate parameter schemas — `hotstandby` belongs to the first and\n *   `mon-address` to the third — so a single key would enforce one kind's rules on all three.\n *   `ceph-daemon.ts` indexes this by `props.kind` for exactly that reason, on every `guardWrite`.\n * ⛔ THE STRINGS MUST STAY LITERALS. `codegen/constraints.ts` finds the endpoints to table by\n *   SCANNING THIS PACKAGE'S TEXT, so a key assembled from `props.kind` would be tabled by\n *   nothing and `constraintsFor` would throw on the first deploy that reached it.\n * ⚠️ THE PARAMETER NAMES DIFFER AND ARE THE VENDOR'S OWN — `{name}`, `{id}`, `{monid}`. The\n *   generator resolves each against the schema, so a tidied-up spelling stops the build.\n * ⚠️ NO `update` HERE: none of the three kinds has a PUT — ceph-daemon-wire.ts's own header.\n */\nexport const DAEMON_ENDPOINTS: Readonly<Record<CephDaemonKind, EndpointKey>> = {\n  mds: 'pve:POST /nodes/{node}/ceph/mds/{name}',\n  mgr: 'pve:POST /nodes/{node}/ceph/mgr/{id}',\n  mon: 'pve:POST /nodes/{node}/ceph/mon/{monid}',\n};\n\n/**\n * PVE defaults the id to the nodename for all three kinds, and that default is resolved HERE\n * rather than left to PVE, because the id is a PATH SEGMENT: create, delete and the row lookup in\n * ceph-daemon.ts all need the same string, and a default resolved on the far side would leave\n * three call sites guessing. Live on this cluster every daemon's name equals its node.\n */\nexport const daemonId = (props: CephDaemonProps) => props.name ?? props.node;\n\n/**\n * The read path. ⚠️ `{node}` HERE IS ONLY THE NODE BEING ASKED, not a filter. MEASURED:\n *   `GET /nodes/node-b/ceph/mon` returns node-b, node-c AND node-d, and `GET /nodes/node-c/ceph/mon` returns the same\n *   three IN A DIFFERENT ORDER — [node-d,node-b,node-c] from node-b against [node-c,node-b,node-d] from node-c. A caller that took\n *   row zero, or assumed the list was this node's daemons, would be wrong on both counts.\n */\nexport const collectionPath = (props: CephDaemonProps) => `nodes/${props.node}/ceph/${props.kind}`;\n\n/** The write path: POST creates here, DELETE destroys here. Never read from — see the ⛔ above. */\nexport const daemonPath = (props: CephDaemonProps) => `${collectionPath(props)}/${daemonId(props)}`;\n\n/**\n * The create body, which is EMPTY for a mgr and nearly empty for the other two.\n *\n * ⚠️ THE ID IS NOT SENT, because it is already the last segment of the path being POSTed to — the\n *   same reasoning as metric-server.ts, where a second copy of the key can only disagree with the\n *   first. PVE's schema does accept `monid`/`id`/`name` as body parameters; the path wins, so\n *   sending one would be a second source of truth for the object's identity and nothing else.\n *\n * ⚠️ AND THE BRANCHES CANNOT BE ONE SHARED BODY. `hotstandby` is an mds parameter and\n *   `mon-address` a mon one; each POST schema lists only its own, so the wrong field is a 400\n *   rather than an ignored hint. Both are create-only — the ⛔s on those props say why neither is\n *   ever compared afterwards.\n */\nexport const createForm = (props: CephDaemonProps): Record<string, string> => {\n  if (props.kind === 'mon' && props['mon-address'] !== undefined) {\n    return { 'mon-address': props['mon-address'] };\n  }\n  const hotstandby = props.kind === 'mds' ? flag(props.hotstandby) : undefined;\n  return hotstandby === undefined ? {} : { hotstandby };\n};\n\n/**\n * ⚠️ THE COLLECTION ANSWERS AN ARRAY while the factory types `attributes`' first parameter as the\n *   `Record<string, unknown>` every other PVE read is shaped like — the same mismatch acl.ts\n *   carries, handled the same way: narrow the rows, trust none of them, and match on `name`.\n * ⚠️ MATCHED ON `name` ALONE, NEVER ON POSITION — the list comes back in a different order\n *   depending on which node was asked. See the ⚠️ on `collectionPath` above.\n */\nexport const findRow = (live: unknown, props: CephDaemonProps) =>\n  (Array.isArray(live) ? live : [])\n    .filter((row): row is Record<string, unknown> => typeof row === 'object' && row !== null)\n    .find((row) => row['name'] === daemonId(props));\n\n/**\n * One live row as attributes, or `undefined` — \"no daemon of this kind carries this name\".\n *\n * ★ HERE RATHER THAN IN ceph-daemon.ts FOR THE REASON THAT FILE'S SIBLING EXISTS AT ALL: the\n *   250-line cap, and a seam that is real. It reads the row `findRow` picked out of an answer its\n *   caller already fetched, three lines above, so the lookup and the mapping now live together\n *   instead of a function call apart.\n *\n * ⚠️ `undefined` WHEN NO ROW CARRIES THIS NAME: that is how the factory learns to create.\n */\nexport const daemonAttributes = (\n  live: Record<string, unknown>,\n  props: CephDaemonProps,\n): CephDaemonAttributes | undefined => {\n  const row = findRow(live, props);\n  if (row === undefined) return undefined;\n  return {\n    addr: text(row['addr']),\n    fsName: text(row['fs_name']),\n    host: text(row['host']),\n    kind: props.kind,\n    name: daemonId(props),\n    node: props.node,\n    quorum: bool(row['quorum']),\n    rank: num(row['rank'], -1),\n    service: bool(row['service']),\n    standbyReplay: bool(row['standby_replay']),\n    state: text(row['state']),\n    version: text(row['ceph_version_short']),\n  };\n};\n",
     "/**\n * `Proxmox.CephDaemon`'s distilled wire lane: one dispatch per kind, because mon/mgr/mds are three\n * separate distilled operations with three separate request shapes (`{node,monid}` /\n * `{node,id}` / `{node,name}`) — the SAME reason `DAEMON_ENDPOINTS` (ceph-daemon-form.ts) is a\n * per-kind table rather than one templated string.\n *\n * ⛔ ABSENCE IS A SUCCESSFUL INDEX WITH NO MATCHING ROW. The original transport swap\n *   preserved `pveOperations.read`'s catch-all fold; the 2026-09-24 follow-up removes it. A failed\n *   mon/mgr/mds list proves nothing about whether a daemon exists, so its SDK error propagates.\n *\n * ⚠️ `mon_address` IS THE ONE RENAME THIS FAMILY NEEDS — distilled's generator maps the wire name\n *   `mon-address` to `mon_address` on `UpdateNodeCephMonRequest` (`T.Body(\"mon-address\")`,\n *   confirmed against its schema), the same one-key pattern node-network-form.ts's `RENAMED`\n *   table carries for three fields. `hotstandby` needs no rename.\n */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport type { CephDaemonKind, CephDaemonProps } from './ceph-daemon.ts';\nimport { daemonAttributes, daemonId, daemonPath } from './ceph-daemon-form.ts';\nimport { runPve } from './distilled-pve.ts';\n\n/**\n * The index, per kind — the same array `daemonAttributes`/`findRow` already narrow.\n *\n * ⚠️ CAST TO `unknown[]` PER BRANCH, NOT LEFT TO INFERENCE. mon/mgr/mds answer three DIFFERENT\n *   row shapes (`ListNodeCephMonResponseBodyItem` and its two siblings), and a switch returning\n *   each as-is infers their INTERSECTION rather than their union — TypeScript refuses that under\n *   `exactOptionalPropertyTypes`. `daemonAttributes` already treats the row generically (it reads\n *   by string key, the same shape acl.ts narrows), so the cast costs nothing real.\n */\nconst listRows = (props: CephDaemonProps) => {\n  const node = props.node;\n  switch (props.kind) {\n    case 'mon':\n      return runPve(props.target, 'read', false, nodes.listNodeCephMon({ node })).pipe(\n        Effect.map((rows): unknown[] => rows),\n      );\n    case 'mgr':\n      return runPve(props.target, 'read', false, nodes.listNodeCephMgr({ node })).pipe(\n        Effect.map((rows): unknown[] => rows),\n      );\n    case 'mds':\n      return runPve(props.target, 'read', false, nodes.listNodeCephMds({ node })).pipe(\n        Effect.map((rows): unknown[] => rows),\n      );\n  }\n};\n\n/** A missing row is absent; a failed index read keeps its typed SDK error. */\nexport const readDaemon = (props: CephDaemonProps) =>\n  listRows(props).pipe(\n    Effect.map((rows) => daemonAttributes(rows as unknown as Record<string, unknown>, props)),\n  );\n\n/** POST — distilled's generator misnames it \"update\" (checked against `T.Http`); it is a create. */\nexport const createDaemon = (props: CephDaemonProps) => {\n  const node = props.node;\n  const id = daemonId(props);\n  switch (props.kind) {\n    case 'mon':\n      return runPve(\n        props.target,\n        'provision',\n        true,\n        nodes.updateNodeCephMon({\n          ...(props['mon-address'] === undefined ? {} : { mon_address: props['mon-address'] }),\n          monid: id,\n          node,\n        }),\n      );\n    case 'mgr':\n      return runPve(props.target, 'provision', true, nodes.updateNodeCephMgr({ id, node }));\n    case 'mds':\n      return runPve(\n        props.target,\n        'provision',\n        true,\n        nodes.updateNodeCephMds({\n          ...(props.hotstandby === undefined ? {} : { hotstandby: props.hotstandby ? '1' : '0' }),\n          name: id,\n          node,\n        }),\n      );\n  }\n};\n\n/** ⚠️ NO FLAGS ON ANY OF THE THREE — unlike CephFs/CephOsd, nothing here is at risk of a\n *   DELETE-body PVE would ignore, because nothing here is ever sent. */\nexport const deleteDaemon = (props: CephDaemonProps) => {\n  const node = props.node;\n  const id = daemonId(props);\n  switch (props.kind) {\n    case 'mon':\n      return runPve(props.target, 'provision', true, nodes.deleteNodeCephMon({ monid: id, node }));\n    case 'mgr':\n      return runPve(props.target, 'provision', true, nodes.deleteNodeCephMgr({ id, node }));\n    case 'mds':\n      return runPve(props.target, 'provision', true, nodes.deleteNodeCephMds({ name: id, node }));\n  }\n};\n\n/** Re-exported so ceph-daemon.ts can narrow a switch exhaustively without importing the union twice. */\nexport type { CephDaemonKind };\n\n/** ★ Moved here from ceph-daemon.ts's `reconcile` for the 250-line cap — matches ceph-fs.ts's own\n *  `notCreated`/`notDestroyed` seam: the message, not the decision to die, lives with the calls. */\nexport const notCreated = (props: CephDaemonProps) =>\n  new Error(\n    `${daemonPath(props)}: no ${props.kind} named ${daemonId(props)} in GET nodes/` +\n      `${props.node}/ceph/${props.kind} after the create task finished. POST answers a UPID, ` +\n      'not a result -- watch the task in the PVE UI (ceph-daemon-form.ts).',\n  );\n",
     "/**\n * `Proxmox.CephFlag` — one cluster-wide Ceph OSD flag, declared: `noout`, `pause`, `norebalance`.\n *\n * ★ ONE RESOURCE PER FLAG, NOT ONE CARRYING ALL ELEVEN, AND THE CLUSTER'S OWN API DECIDED IT.\n *   MEASURED on C1 2026-09-13 (pve-manager 9.2.11, ceph tentacle 20.2.2) by reading\n *   `/usr/share/perl5/PVE/API2/Cluster/Ceph.pm` and the published schema in\n *   `/usr/share/pve-docs/api-viewer/apidoc.js`:\n *     · `PUT /cluster/ceph/flags` ends in `fork_worker('cephsetflags', ...)` and returns a STRING\n *       — a UPID. The bulk write is ASYNCHRONOUS, and this package has no task-polling machinery.\n *     · `PUT /cluster/ceph/flags/{flag}` calls `$rados->mon_command` inline and returns null. The\n *       per-flag write is SYNCHRONOUS.\n *   `pveOperations.reconcile` READS BACK after every write and refuses to record a value it did\n *   not see. Against the bulk endpoint that read-back races a worker which has not run yet, so it\n *   would record the OLD value as the new attributes — the one honesty mechanism in this package\n *   turned into a lie generator. Per-flag, the read-back means what it says.\n *   ★ THE SECOND REASON IS SMALLER AND STILL REAL. The bulk GET answers rows of\n *     `{name, description, value}`, and `description` is PVE's own English prose that no write\n *     accepts: compare it and you have a forever-update, report it and this provider is pretending\n *     to manage prose. `GET /cluster/ceph/flags/{flag}` answers a BARE BOOLEAN, so that trap\n *     cannot be written here at all. The brief's plural `Proxmox.CephFlags` became singular for\n *     those two reasons; the bulk endpoint is read by nothing in this package.\n *\n * ⛔ THESE ARE NOT CONFIGURATION. THEY ARE A HAND ON THE BRAKE, AND A DECLARATION CAN PULL IT OFF.\n *   `noout` is what a person sets before pulling a disk. A stack saying `value: false` reasserts\n *   that off on EVERY deploy — including a deploy somebody else runs, for an unrelated resource,\n *   twenty minutes into a maintenance window — and the plan line reads `Proxmox.CephFlag noout\n *   update`, which nobody reads as \"ceph is about to start rebalancing 128 PGs across three nodes\n *   while a disk is out of the chassis\".\n *   ★ SO `value` IS REQUIRED AND HAS NO DEFAULT, AND THAT IS THE MITIGATION. An optional `value`\n *     defaulting to false would make `CephFlag('noout', { flag: 'noout', target })` mean \"clear\n *     it\" — the dangerous direction, chosen by OMISSION. Here the dangerous sentence has to be\n *     typed out by a person. Do not add a default, and do not declare a flag merely to document\n *     that it is off: MEASURED 2026-09-13, all eleven flags on C1 read 0, so eleven\n *     `value: false` lines would plan green forever and do nothing except take the brake off\n *     whenever somebody happens to apply them.\n *\n * ⛔ `delete` DOES NOTHING, ON PURPOSE, AND THE ASYMMETRY OF THE TWO FAILURES IS THE ARGUMENT.\n *   `flags/{flag}` has exactly two methods, GET and PUT, so the factory's `destroy` would answer\n *   \"Method 'DELETE /cluster/ceph/flags/noout' not implemented\" on every teardown — whatever this\n *   handler does is INVENTED. The obvious invention, \"clear the flag\", is refused: removing a line\n *   from a stack file, or Alchemy collecting an old generation after a replace, would silently\n *   take the brake off and nothing would warn. Leaving a flag set that nothing declares any more\n *   is the opposite kind of failure — ceph reports `HEALTH_WARN ... flag(s) set` for every one of\n *   these, on `ceph -s`, in the PVE UI and in the `pve_*` metrics this estate already scrapes.\n *   A silent destructive failure loses to a loud inert one.\n *   ⚠️ THE RESIDUAL RISK, NAMED RATHER THAN DENIED: deleting a `value: true` declaration LEAVES\n *     THE FLAG SET. Retire a maintenance window by flipping the line to `value: false` and\n *     deploying BEFORE the line is removed, or a `noout` outlives the window that needed it.\n *   ⚠️ REASONED, NOT MEASURED: that health warning was not observed, because observing it means\n *     setting a flag on a live cluster and this file was researched read-only. Undeclaring stops\n *     MANAGING a flag; to clear one, declare `value: false` and deploy, where a plan says so.\n *\n * ⛔ `pause` IS TWO CEPH FLAGS AND THIS RESOURCE READS ONLY ONE OF THEM. MEASURED in\n *   `PVE::Ceph::Tools::get_real_flag_name`, whose own comment reads \"the 'pause' flag gets always\n *   set to both 'pauserd' and 'pausewr'\": PVE writes both and then decides the flag is set by\n *   looking at `pauserd` alone. A cluster where somebody ran `ceph osd unset pauserd` by hand\n *   still has `pausewr` — writes blocked, guests hung — and this resource reports `value: false`\n *   and plans `noop` straight past it. It cannot express a half-pause, so never use it to prove\n *   one is gone; `ceph osd dump | head -1` can.\n *   ⛔ `pause` AND `noup` ARE ALSO THE TWO THAT TAKE THE CLUSTER DOWN FROM A TYPO. `pause: true`\n *     stops all reads and writes, so every guest on `rbd-c1` — the cluster's only rbd pool,\n *     MEASURED 2026-09-13 — freezes on its root disk, and so does `cephfs-c1`. `noup: true`\n *     stops a rebooted OSD from ever rejoining. Neither is undone by deleting the line.\n *\n * ⚠️ PRIVILEGES, AND THE WRITE ONE IS A BIG ASK. Both GETs check `Sys.Audit` on `/`; both PUTs\n *   check `Sys.Modify` on `/`, and all four carry `allowtoken => 1`, so an API token may make the\n *   call at all. There is no `/ceph` ACL object to scope to — the check names the ROOT path\n *   literally — so granting the provision role `Sys.Modify` here also buys datacenter options,\n *   metric servers, notification targets and every other cluster-wide write, exactly as\n *   metric-server.ts warns about its own family.\n *   ⚠️ REASONED, NOT MEASURED: nothing here was exercised under a minted lease, because a mint\n *     writes an API token into the cluster and the brief for this file was reads only. Expect\n *     \"Permission check failed (/, Sys.Modify)\" on the first deploy, and widen deliberately.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { bool, flag } from './values.ts';\n\n/**\n * PVE's eleven flags, spelled as `PVE::Ceph::Tools::get_possible_osd_flags` spells them.\n *\n * ⚠️ THE ENUM IS CLOSED AND A TYPO IS A 400, WHICH IS WHY THIS IS A UNION AND NOT `string`. Both\n *   the GET and the PUT declare `additionalProperties => 0` over exactly this list.\n * ⚠️ CEPH HAS FLAGS PVE DOES NOT MODEL, and four of them are always on. MEASURED on C1:\n *   `ceph osd dump` reports `flags sortbitwise,recovery_deletes,purged_snapdirs,pglog_hardlimit`.\n *   PVE reads that same string and answers only about its own eleven, so the others can neither\n *   leak in here nor be set from here — `noautoscale` and `nosnaptrim` included.\n *   ⛔ IF SOMEBODY LATER \"IMPROVES\" THE READ BY PARSING `osd dump` DIRECTLY, those four become\n *     permanently-set flags that nothing declares: a forever-diff on a brand new cluster.\n */\nexport type CephFlagName =\n  | 'nobackfill'\n  | 'nodeep-scrub'\n  | 'nodown'\n  | 'noin'\n  | 'noout'\n  | 'norebalance'\n  | 'norecover'\n  | 'noscrub'\n  | 'notieragent'\n  | 'noup'\n  | 'pause';\n\nexport interface CephFlagProps extends WithTarget {\n  /**\n   * Which flag. PVE's primary key here, and the last segment of the path.\n   *\n   * ⚠️ EDITING IT IN PLACE ORPHANS THE OLD FLAG RATHER THAN MOVING ANYTHING. `diff` reads the NEW\n   *   path and reconcile writes it, while the old flag keeps whatever this stack last put there.\n   *   There is deliberately no replace override for it — acl.ts needs one because its `delete`\n   *   removes a real grant, and `delete` here is inert by design, so a replace would do exactly\n   *   what an update already does. Declare a second resource and set the old one to `value: false`\n   *   rather than renaming this one.\n   * ⛔ TWO RESOURCES DECLARING THE SAME FLAG ARE ONE CLUSTER OBJECT, and Alchemy sees two ids\n   *   rather than a collision — the acl.ts hazard exactly. Disagreeing, they take turns winning\n   *   and BOTH plan `update` for ever; agreeing, deleting either leaves the flag where the other\n   *   put it. One declaration per flag per cluster.\n   */\n  flag: CephFlagName;\n  /**\n   * Set the flag (`true`) or clear it (`false`).\n   *\n   * ⛔ REQUIRED, WITH NO DEFAULT — see the second ⛔ in the header, which is the whole safety\n   *   argument for this family. It is also the only field PVE accepts on this endpoint, and it is\n   *   not optional in the schema either: omitting it from the form is a 400, not an untouched\n   *   flag. (The BULK endpoint is the one where omission means \"leave it alone\"; this is not it.)\n   */\n  value: boolean;\n}\n\nexport interface CephFlagAttributes {\n  /**\n   * ⚠️ REPORTED, NEVER COMPARED. It is the path key the read was made WITH, copied back out of\n   *   props, so comparing it against props would be true by construction — the same reasoning\n   *   acl.ts gives for the four identity fields it also declines to diff.\n   */\n  flag: CephFlagName;\n  /** Whether ceph has the flag set right now. The only field `matches` looks at. */\n  value: boolean;\n}\n\nexport interface ProxmoxCephFlag extends Resource<\n  'Proxmox.CephFlag',\n  CephFlagProps,\n  CephFlagAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxCephFlag = Resource<ProxmoxCephFlag>('Proxmox.CephFlag');\n\nconst handlers = pveHandlers<CephFlagProps, CephFlagAttributes>({\n  /**\n   * ⚠️ `live` IS A BARE BOOLEAN HERE, NOT AN OBJECT, AND IT IS HANDED TO `bool` WHOLE ON PURPOSE.\n   *   `get_flag` returns perl `1` or `0` under a `type => 'boolean'` return schema, so the wire is\n   *   `{\"data\":0}` or `{\"data\":false}` depending on how the REST layer renders it. `bool` accepts\n   *   every one of those spellings, which is exactly why it is a shared coercion. The factory\n   *   types this parameter `Record<string, unknown>` because every OTHER PVE read is an object;\n   *   reaching for `live['value']` here would answer undefined on every plan and diff `false`\n   *   forever against a set flag.\n   *   ⚠️ THE SCALAR IS A MEASURED PROPERTY OF THIS PVE, NOT A PROMISE. A later version wrapping\n   *     the answer in an object would make `bool` read a SET flag as false, and `value: false`\n   *     would then plan `noop` over a live flag — silently. Re-measure\n   *     `GET /cluster/ceph/flags/noout` after a major upgrade; cheaper than a second parse path.\n   *\n   * ⛔ IT NEVER ANSWERS undefined, WHICH MAKES THE CREATE BRANCH UNREACHABLE, AND ITS ERROR WILL\n   *   MISLEAD YOU. All eleven flags always exist; there is nothing for \"absent\" to mean. So a POST\n   *   to `collection` means the READ failed — an expired 300s lease, node-b down, or ceph simply not\n   *   configured on the cluster (every one of these four handlers opens with\n   *   `check_ceph_configured()`, which dies). Read the resulting \"Method 'POST /cluster/ceph/flags'\n   *   not implemented\" as \"the read failed\" and go and look at the credential, not at ceph. Same\n   *   shape as the unreachable POST in acl.ts, same advice.\n   */\n  attributes: (live, props) => ({ flag: props.flag, value: bool(live) }),\n  collection: () => 'cluster/ceph/flags',\n  /**\n   * ⛔ UNREACHABLE — see the second ⛔ in `attributes`. It is written in the BULK endpoint's shape\n   *   (the flag name is the parameter, not `value`) rather than left empty, because that is the\n   *   only body `cluster/ceph/flags` has ever documented. Nothing sends it today.\n   */\n  createForm: (props) => ({ [props.flag]: flag(props.value) ?? '0' }),\n  endpoint: { update: 'pve:PUT /cluster/ceph/flags/{flag}' }, // ⛔ No create: see above.\n  /**\n   * ⚠️ `value` IS THE ONLY THING COMPARED, AND THE LIST OF THINGS DELIBERATELY NOT COMPARED IS THE\n   *   point of this resource. `flag` is props-derived (see `CephFlagAttributes`). `description`\n   *   and `name` exist only on the bulk GET, which this file does not read, so neither can be\n   *   compared by accident. Nothing PVE returns here is rewritten, re-ordered or re-typed by the\n   *   cluster, because all PVE returns here is one boolean.\n   *   ★ MEASURED: on C1, `GET /cluster/ceph/flags` answers value 0 for all eleven flags, so a\n   *     declaration of `value: false` reads back false and plans `noop`.\n   */\n  matches: (attributes, props) => attributes.value === props.value,\n  path: (props) => `cluster/ceph/flags/${props.flag}`,\n  /**\n   * ⚠️ ONLY `value` GOES IN THE BODY. `flag` is already bound by the path and the PUT declares\n   *   `additionalProperties => 0`, so a second copy in the form could only disagree with the URL.\n   * ⚠️ THE `?? '0'` IS UNREACHABLE, AND IS WRITTEN RATHER THAN CAST AWAY. `flag()` types its\n   *   answer `string | undefined` because it serves OPTIONAL props, and `value` here is required,\n   *   so the branch cannot be taken; a cast would claim a proof the type system has not made.\n   */\n  updateForm: (props) => ({ value: flag(props.value) ?? '0' }),\n});\n\nexport const ProxmoxCephFlagProvider = () =>\n  Provider.effect(\n    ProxmoxCephFlag,\n    Effect.succeed(\n      ProxmoxCephFlag.Provider.of({\n        /**\n         * ⚠️ NOT THE ONE-LINE `Provider.of(handlers)` EVERY OTHER FILE HERE USES, AND THE TWO\n         *   REASONS ARE BOTH acl.ts's. PVE implements no DELETE on this path, and the factory's\n         *   read-back guard is dead whenever `attributes` cannot answer undefined. Unlike acl.ts\n         *   this SPREADS the factory's handlers instead of retyping them, so `list`, `read` and\n         *   `diff` cannot drift from the shared ones — only the two that genuinely differ are\n         *   written out below.\n         */\n        ...handlers,\n        /** ⛔ Inert, deliberately. The third ⛔ in the header is the whole argument; read it. */\n        delete: () => Effect.void,\n        /**\n         * ⚠️ THE READ-BACK GUARD, RESTORED FOR A FAMILY WHOSE \"ABSENT\" DOES NOT EXIST.\n         *   `ops.reconcile` refuses when the object is still missing after a write, and a flag is\n         *   never missing, so that check can never fire here — exactly the hole acl.ts patches\n         *   with `bound`. PVE answers 200 with `{\"data\":null}` on calls that did nothing, and this\n         *   PUT's documented return IS null, so the status code carries no evidence at all.\n         * ⚠️ THE PER-FLAG PUT IS SYNCHRONOUS (`$rados->mon_command` inline, MEASURED in Ceph.pm),\n         *   which is what makes this check fair rather than a race against a worker task. If it\n         *   ever fires spuriously the honest fix is to look at the mon, not to delete the guard.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const after = yield* handlers.reconcile({ news });\n          if (after.value !== news.value) {\n            return yield* Effect.die(\n              new Error(\n                `cluster/ceph/flags/${news.flag}: the PUT returned no error but ceph still ` +\n                  `reports the flag ${after.value ? 'set' : 'clear'} rather than ` +\n                  `${news.value ? 'set' : 'clear'}. This endpoint's success is documented as a ` +\n                  'null body, so the status code proves nothing -- check `ceph osd dump | ' +\n                  'head -1` and the cluster log. `pause` in particular is two ceph flags read ' +\n                  'as one; see the header.',\n              ),\n            );\n          }\n          return after;\n        }),\n      }),\n    ),\n  );\n",
+    "/**\n * The four operations every PVE object shares, and the five handlers that wire them to Alchemy.\n *\n * ★ THE SHAPE THEY READ IS `PveSpec`, IN resource-spec.ts, WITH THE ARGUMENT FOR IT. This file was\n *   one file until 2026-09-22, when the vendor-constraint guard took it past the 250-line cap; the\n *   split is by what a reader is doing — declaring an object, or changing how every object is\n *   written — and the types are re-exported below so no importer moved.\n *\n * ⚠️ EVERY PVE ANSWER IS WRAPPED IN `{\"data\": ...}` AND A FAILED CALL CAN STILL BE HTTP 200 with\n *   `{\"data\": null}`. That is why `reconcile` below READS BACK and refuses when the object is still\n *   absent, rather than trusting a status code — see the ⛔ in that function.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport { pve } from './client.ts';\nimport { specGuards } from './resource-guard.ts';\nimport type { PveSpec, WithApiTarget } from './resource-spec.ts';\nimport { formToSend } from './update-guard.ts';\n\nexport type {\n  PveRequirements,\n  PveSpec,\n  WithApiTarget,\n  WithPbsTarget,\n  WithTarget,\n} from './resource-spec.ts';\n\nexport const pveOperations = <Props extends WithApiTarget, Attributes>(\n  spec: PveSpec<Props, Attributes>,\n) => {\n  const { guardCreate, guardUpdate } = specGuards(spec);\n\n  /** The live object, or undefined. ⚠️ A 404 and `{\"data\": null}` are ANSWERS, not failures. */\n  const read = (props: Props) =>\n    pve<Record<string, unknown>>(\n      props.target,\n      spec.readRole ?? 'read',\n      'GET',\n      spec.path(props),\n    ).pipe(\n      Effect.map((data) => (data == null ? undefined : spec.attributes(data, props))),\n      Effect.orElseSucceed(() => undefined),\n    );\n\n  return {\n    /**\n     * ★ EXPORTED SO A FAMILY THAT WRITES ITS OWN `reconcile` REACHES THE SAME CHECK BY THE SAME\n     *   NAME. CephPool, CephFs and ZfsPool all bypass the reconcile below — forked workers, a\n     *   settle loop, a destructive create — and without these two they would be checked at plan\n     *   time and not at apply time, which is exactly the gap an ADOPTED row falls through.\n     */\n    guardCreate,\n    guardUpdate,\n\n    read,\n\n    // ⚠️ `Input<Props>`, NOT `Props`. At plan time a prop can still be an unresolved Output or\n    //   Config; `isResolved` is the narrowing, so the parameter has to admit the wider type or\n    //   every caller casts — and a cast here would be a lie about what plan actually has.\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        // ⚠️ A prop can still be an unresolved Output at plan time. Alchemy's own providers guard\n        //   with isResolved and skip rather than guess; comparing a placeholder to a live value\n        //   reports an update nobody asked for.\n        if (!isResolved(news)) return undefined;\n        /**\n         * ⛔ THE VENDOR CHECK RUNS BEFORE THE `output === undefined` RETURN, AND THE ORDER IS THE\n         *   WHOLE FIX. `output === undefined` IS the resource Alchemy has no state for — the\n         *   create. Checking after it would leave exactly the case that failed on 2026-09-22\n         *   unchecked, and the refusal would arrive from the server, half a deploy in.\n         */\n        yield* guardCreate(news, output === undefined);\n        yield* guardUpdate(news);\n        if (output === undefined) return undefined;\n        const live = yield* read(news);\n        // ⚠️ `update`, NOT `create` — Alchemy's Diff admits only noop/update/replace. An object\n        //   Alchemy has state for but the cluster does not is drift, and reconcile repairs it.\n        if (live === undefined) {\n          /**\n           * ⛔ DRIFT REACHES `reconcile`'s POST, so the create form's required parameters ARE\n           *   about to go on the wire after all. Saying so here rather than leaving it to\n           *   reconcile keeps the refusal in `plan`, where an operator is reading.\n           */\n          yield* guardCreate(news, true);\n          return { action: 'update' } as const;\n        }\n        if (spec.matches(live, news)) return { action: 'noop' } as const;\n        // An object with no update path cannot be edited in place; say replace and mean it.\n        return spec.updateForm === undefined\n          ? ({ action: 'replace' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    reconcile: (news: Props) =>\n      Effect.gen(function* () {\n        const live = yield* read(news);\n        // ⚠️ CHECKED AGAIN HERE, AND NOT BECAUSE `diff` IS UNTRUSTED. `reconcile` also runs for an\n        //   ADOPTED row, whose diff answer Alchemy discards (verify/fake-engine.ts records it), and\n        //   a family that writes its own reconcile bypasses the one above entirely.\n        // ⛔ AFTER THE READ, BECAUSE THE READ IS WHAT SAYS WHICH REQUEST IS ABOUT TO BE MADE. A GET\n        //   changes nothing, so nothing has been written by the time a violation refuses the plan.\n        yield* guardCreate(news, live === undefined);\n        yield* guardUpdate(news);\n        if (live === undefined) {\n          yield* pve(\n            news.target,\n            'provision',\n            'POST',\n            spec.collection(news),\n            spec.createForm(news),\n          );\n        } else if (spec.updateForm !== undefined) {\n          /**\n           * ⛔ ADOPTING AN OBJECT THAT ALREADY MATCHES MUST NOT WRITE TO IT, AND WITHOUT THE\n           *   `matches` GUARD IT DID. Alchemy's `adopted` action is NOT a read: Apply.ts routes it\n           *   down the same branch as `update` and calls `reconcile` (Apply.ts:980 and :1045). So\n           *   the first time a declaration names an object Alchemy has no state for — which is\n           *   exactly what adopting the live estate means — reconcile runs, finds it present, and\n           *   fell through to this PUT.\n           *\n           *   For most families that was a pointless write-back of identical values. For\n           *   `Proxmox.NodeNetwork` it is worse than pointless: a PUT under `/nodes/{node}/network`\n           *   STAGES a change into `/etc/network/interfaces.new`, so merely adopting the interface\n           *   a node already has would leave that node with a pending network change waiting for an\n           *   apply — on a cluster whose Ceph traffic rides vmbr1.42. Adoption has to be free.\n           *\n           * ★ SO THE CONDITION IS THE SAME PREDICATE `diff` USES. If `matches` is true the object\n           *   already says what the declaration says, and there is nothing to write — by\n           *   definition, since every field this provider manages is a field `matches` compares.\n           *   A field deliberately left OUT of `matches` is one this resource does not manage, so\n           *   its drift is not this provider's to repair.\n           *\n           * ★ THE PREDICATE LIVES IN update-guard.ts NOW, with the ⚠️ on why an empty form is not a\n           *   write either, because CephPool and PbsDatastore write their own reconcile and need\n           *   the same one — CephPool did not have it (see that file).\n           */\n          const form = formToSend(spec.matches, live, news, spec.updateForm(news));\n          if (form !== undefined) {\n            yield* pve(news.target, 'provision', 'PUT', spec.path(news), form);\n          }\n        }\n        const after = yield* read(news);\n        if (after === undefined) {\n          /**\n           * ⛔ REFUSE RATHER THAN RETURN THE PROPS AS THOUGH THEY LANDED. PVE answers 200 with\n           *   `{\"data\": null}` on several endpoints, so \"no error\" is not evidence of a write. A\n           *   provider that returned its own inputs here would record state for an object that does\n           *   not exist, and the next plan would read `noop` over the gap.\n           */\n          return yield* Effect.die(\n            new Error(\n              `${spec.path(news)}: the write returned no error but the object is still absent. ` +\n                'PVE wraps every answer in {\"data\":...} and can report success on a call that did ' +\n                'nothing -- read back rather than trusting the status code.',\n            ),\n          );\n        }\n        return after;\n      }),\n\n    /**\n     * ⚠️ PVE REFUSES TO DELETE THINGS THAT ARE STILL IN USE — a pool holding guests, a storage with\n     *   volumes. That refusal is the cluster declining to orphan something because a line left a\n     *   file, so it is surfaced as-is rather than retried with a force flag.\n     */\n    destroy: (olds: Props) => pve(olds.target, 'provision', 'DELETE', spec.path(olds)),\n  };\n};\n\n/**\n * The five provider handlers for a spec'd PVE object, wired once.\n *\n * ⛔ THIS BLOCK WAS WRITTEN TEN TIMES BEFORE IT WAS EXTRACTED, and every copy was character for\n *   character identical apart from its comments: `list` answering empty, and four handlers whose\n *   entire body was `yield* ops.<same name>(<same argument>)`. Ten copies of a delegation is ten\n *   chances to delegate to the wrong one — `ops.read(olds)` inside `reconcile` typechecks, returns\n *   a plausible value, and turns every deploy into a no-op that reports success.\n *\n * ★ IT TAKES THE SPEC, NOT THE OPERATIONS, so a resource declares its four spec functions and\n *   stops. `pveOperations` stays exported for an object that genuinely needs a handler of its own;\n *   nothing in this package does yet, and the day one does it should be visibly different from the\n *   ten that are not.\n *\n * ⛔ IT STOPS AT THE HANDLERS AND DOES NOT RETURN THE LAYER, AND THAT IS NOT AN OVERSIGHT — it was\n *   written the other way first and reverted. Wrapping `Provider.effect(cls, …)` here means naming\n *   the resource class generically, and Alchemy's `Props<R>` and `R[\"Attributes\"]` are not the\n *   plain `Props` and `Attributes` this spec is written against: `Attributes` comes back as\n *   `Attributes & AttrOutput<Attributes[\"Attributes\"]>`. Against a free type variable TypeScript\n *   cannot prove those line up — \"could be instantiated with a different subtype\" — so the only\n *   way to compile a Layer-returning version is a cast, and a cast is a LIE ABOUT WHETHER THE\n *   HANDLERS MATCH THE RESOURCE, which is the one thing the call site exists to check. Leaving\n *   `Cls.Provider.of(...)` in each file keeps that check where the types are concrete and real.\n *   One line per resource is the price of it, and it is worth paying.\n *\n * ⚠️ `list` IS OPTIONAL IN `ProviderServiceInput` AND IS PASSED ANYWAY. An empty list is a claim —\n *   this provider adopts nothing — and it is made here for every PVE object at once, because the\n *   reasoning is identical for all of them: every PVE index endpoint answers with the whole\n *   cluster's objects, PVE's own built-ins included. `GET /pools` returns pools a human made years\n *   ago; `GET /access/roles` returns `Administrator`. Returning any of them would invite Alchemy to\n *   adopt an object it never created, and therefore one day to narrow or delete it. Adoption stays\n *   an explicit act. A resource with a reason to differ passes its own `list` and says why.\n */\nexport const pveHandlers = <Props extends WithApiTarget, Attributes extends object>(\n  spec: PveSpec<Props, Attributes>,\n) => {\n  const ops = pveOperations(spec);\n  return {\n    list: () => Effect.succeed([]),\n    read: ({ olds }: { olds: Props }) => ops.read(olds),\n    diff: ({ news, output }: { news: Input<Props>; output: Attributes | undefined }) =>\n      ops.diff(news, output),\n    reconcile: ({ news }: { news: Props }) => ops.reconcile(news),\n    delete: ({ olds }: { olds: Props }) => ops.destroy(olds),\n  };\n};\n",
+    "/**\n * One authenticated call to the Proxmox VE API.\n *\n * ★ PLAIN `fetch`, NO TLS ESCAPE HATCH, AND THAT IS A MEASURED CHOICE RATHER THAN AN OMISSION.\n *   Proxmox is usually met with `curl -k` because a fresh install serves its own self-signed\n *   certificate — I reached for `-k` myself before checking. This cluster serves a real Let's\n *   Encrypt certificate (`CN=cluster-c1.example.com`), and strict TLS answers 401, i.e. the\n *   handshake succeeds and only the credential is missing. So there is no `rejectUnauthorized`\n *   option here to be left switched on by accident in somebody else's estate.\n *\n * ⚠️ EVERY PVE ANSWER IS WRAPPED IN `{\"data\": ...}`, errors included — a failed call can still be\n *   HTTP 200 with `{\"data\": null}`. Unwrapping is not cosmetic; a caller that reads the envelope\n *   as the payload sees `undefined` and calls it \"absent\".\n */\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\nimport type { ApiTarget, PveCredential, PveRole, PveTarget } from './credentials.ts';\nimport { leased } from './lease-cache.ts';\nimport { authorization } from './mint.ts';\nimport { executeOnCluster } from './members.ts';\n\nexport class PveError extends Error {\n  constructor(\n    readonly status: number,\n    readonly method: string,\n    readonly path: string,\n    detail: string,\n  ) {\n    super(`PVE ${method} ${path} -> ${String(status)}: ${detail}`);\n    this.name = 'PveError';\n  }\n}\n\nconst clusterExhausted = (\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  attempts: ReadonlyArray<{ member: string; why: string }>,\n) =>\n  new PveError(\n    0,\n    method,\n    path,\n    `all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join('; ')}`,\n  );\n\n/**\n * A form body, where a value may be a LIST.\n *\n * ⛔ PVE AND PBS SPELL A MULTI-VALUED FIELD DIFFERENTLY, AND THE LIST FORM IS FOR PBS. PBS is Rust:\n *   its schemas use `type: array` — `delete` on every update endpoint is one — and its urlencoded\n *   decoder builds that array from REPEATED KEYS (`delete=a&delete=b`). PVE's Perl takes a comma\n *   string for the same idea, which is what `withClears` in values.ts produces, and for the one\n *   PVE field that genuinely needs repetition it wants a NUL-joined value instead (see\n *   notification-target.ts). So: PVE callers pass strings and are unaffected; a PBS caller that\n *   needs an array passes one and gets repeated keys rather than reaching for PVE's encoding.\n */\nexport type PveForm = Record<string, readonly string[] | string>;\n\n/** ⚠️ `append`, NOT `set`: a repeated key is the point, and `set` would keep only the last. */\nconst encode = (form: PveForm): string => {\n  const params = new URLSearchParams();\n  for (const [key, value] of Object.entries(form)) {\n    if (typeof value === 'string') params.append(key, value);\n    else for (const item of value) params.append(key, item);\n  }\n  return params.toString();\n};\n\nconst buildRequest = (\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  apiBase: string,\n  path: string,\n  credential: PveCredential,\n  target: ApiTarget,\n  form?: PveForm,\n) => {\n  const url = `${apiBase}/${path}`;\n  /**\n   * ⛔ THE CONTENT TYPE IS AN ARGUMENT TO `bodyText`, NOT AN ENTRY IN THE HEADER MAP, AND GETTING\n   *   THAT WRONG MADE EVERY WRITE IN THIS PACKAGE FAIL.\n   *\n   * 🔴 THE BUG, AND HOW IT HID FOR A WHOLE DAY. The header map DID set\n   *   `application/x-www-form-urlencoded` — and `bodyText(s)` with no second argument sets\n   *   `text/plain` and OVERWRITES it, because it is piped AFTER `setHeaders`. PVE and PBS accept\n   *   ONLY form encoding or JSON and reject everything else outright (measured in\n   *   proxmox-rest-server's `get_request_parameters`), so every create, update and delete this\n   *   package can perform was broken from the day the client was written.\n   *   ⛔ NOTHING CAUGHT IT BECAUSE NOTHING HAD EVER WRITTEN. Ninety-eight resources were adopted\n   *     against the live cluster and every one matched, so `reconcile` never reached a PUT. The\n   *     identical bug in <estate>/forgejo/src/client.ts surfaced the moment a write token existed\n   *     and answered `422 Unsupported Content-Type`; this one is the same line, found by looking.\n   *   ★ A PLAN THAT SAYS `noop` PROVES THE READ PATH AND NOTHING ELSE. That is the lesson worth\n   *     more than the fix.\n   *\n   * ⚠️ PVE TAKES FORM ENCODING, NOT JSON. Sending application/json is accepted and then SILENTLY\n   *   IGNORED on several endpoints, which reads as \"the API did nothing\" rather than as a wrong\n   *   content type — so the type below is load bearing in both directions.\n   */\n  return HttpClientRequest.make(method)(url).pipe(\n    HttpClientRequest.setHeaders({ Authorization: authorization(credential, target) }),\n    form === undefined\n      ? (self) => self\n      : HttpClientRequest.bodyText(encode(form), 'application/x-www-form-urlencoded'),\n  );\n};\n\nconst executeOne = (\n  target: ApiTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form: PveForm | undefined,\n  apiBase: string,\n) =>\n  Effect.gen(function* () {\n    const client = yield* HttpClient.HttpClient;\n    const request = buildRequest(method, apiBase, path, credential, target, form);\n    return yield* client\n      .execute(request)\n      .pipe(Effect.mapError((cause) => new PveError(0, method, path, String(cause))));\n  });\n\nconst readResponse = <T>(\n  response: {\n    status: number;\n    text: Effect.Effect<string, unknown>;\n    json: Effect.Effect<unknown, unknown>;\n  },\n  method: string,\n  path: string,\n) =>\n  Effect.gen(function* () {\n    /**\n     * ⛔ STATUS FIRST, THEN THE BODY, AND THE BODY IS READ EXACTLY ONCE. `text` and `json` both\n     *   consume the response stream, so asking for both is a bug waiting to happen. A failure is\n     *   read as TEXT because an error body is not reliably JSON — PVE answers HTML for some 5xx —\n     *   and a success is read as JSON by the client rather than by a hand-rolled `JSON.parse`.\n     */\n    if (response.status < 200 || response.status >= 300) {\n      // ⚠️ 401 HERE USUALLY MEANS THE LEASE EXPIRED, NOT THAT THE ROLE IS WRONG. `provision` is a\n      //   300s non-renewable lease; a long reconcile should mint again rather than widen the role.\n      const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ''));\n      return yield* Effect.fail(new PveError(response.status, method, path, detail.slice(0, 300)));\n    }\n    const body = (yield* response.json.pipe(\n      Effect.mapError((cause) => new PveError(0, method, path, String(cause))),\n    )) as { data?: T };\n    return body.data;\n  });\n\n/** A call that already holds a credential. Used when one mint serves several calls. */\nexport const pveWith = <T>(\n  target: ApiTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form?: PveForm,\n) =>\n  Effect.gen(function* () {\n    const response =\n      target.scheme === 'pve'\n        ? yield* executeOnCluster(target, method, path, (apiBase) =>\n            buildRequest(method, apiBase, path, credential, target, form),\n          ).pipe(\n            Effect.mapError((failure) =>\n              failure.tag === 'cluster'\n                ? clusterExhausted(failure.method, failure.path, failure.attempts)\n                : new PveError(0, method, path, String(failure)),\n            ),\n          )\n        : yield* executeOne(target, credential, method, path, form, target.api);\n    return yield* readResponse<T>(response, method, path);\n  });\n\n/**\n * Like `pveWith`, but returns the full JSON body — for endpoints whose answer lives beside `data`.\n *\n * ⚠️ `network-apply-read.ts` is the caller today; the local fetch there should fold into this once\n *   the envelope shape is stable across both paths.\n */\nexport const pveEnvelopeWith = (\n  target: PveTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n) =>\n  Effect.gen(function* () {\n    const response = yield* executeOnCluster(target, method, path, (apiBase) =>\n      buildRequest(method, apiBase, path, credential, target),\n    ).pipe(\n      Effect.mapError((failure) =>\n        failure.tag === 'cluster'\n          ? clusterExhausted(failure.method, failure.path, failure.attempts)\n          : new PveError(0, method, path, String(failure)),\n      ),\n    );\n    if (response.status < 200 || response.status >= 300) {\n      const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ''));\n      return yield* Effect.fail(new PveError(response.status, method, path, detail.slice(0, 300)));\n    }\n    return (yield* response.json.pipe(\n      Effect.mapError((cause) => new PveError(0, method, path, String(cause))),\n    )) as Record<string, unknown>;\n  });\n\n/**\n * Make one call on a credential for `role`, REUSING a still-valid lease rather than minting one.\n *\n * 🔴 IT USED TO MINT PER CALL, AND AT 98 RESOURCES THAT STOPPED BEING FREE. One plan plus deploy\n *   of the C1 stack left 760 token entries in `/etc/pve/user.cfg` — read, diff, reconcile and the\n *   read-back each minted their own, and `/etc/pve` is a replicated cluster filesystem every node\n *   has to agree on. src/lease-cache.ts carries the measurement and the safety argument.\n *\n * ⚠️ `pveWith` IS STILL THERE AND STILL TAKES AN EXPLICIT CREDENTIAL. network-apply.ts needs ONE\n *   identity across its apply and its task poll — PVE only skips the task-status privilege check\n *   for the task's OWNER — and it threads a lease through by hand for that. Caching makes that\n *   property easier to hold, never weaker, but the explicit path stays because that caller is\n *   reasoning about identity rather than about cost.\n *\n * ★ TASK POLL ON A DIFFERENT MEMBER THAN THE APPLY STILL HOLDS: the owner is the token id, not the\n *   node that received the PUT. Any member serves any task path; the privilege skip is keyed on\n *   whether the caller IS the task's owner.\n */\nexport const pve = <T>(\n  target: ApiTarget,\n  role: PveRole,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form?: PveForm,\n) =>\n  Effect.gen(function* () {\n    const credential = yield* leased(target, role);\n    return yield* pveWith<T>(target, credential, method, path, form);\n  });\n",
     "/**\n * `Proxmox.CephFs` — a CephFS on the cluster's own Ceph. The filesystem a `cephfs` storage mounts.\n *\n * ⛔ A REPLACE OF THIS RESOURCE DESTROYS A LIVE FILESYSTEM, AND THERE IS NO PUT TO SAVE YOU FROM\n *   IT. MEASURED from the published schema on node-b, 2026-09-13: `/nodes/{node}/ceph/fs/{name}` has\n *   exactly two methods, POST and DELETE. A CephFS cannot be edited in place, so `updateForm` is\n *   left undefined and anything the factory can see as changed becomes a REPLACE — and Alchemy's\n *   replace is create-then-delete, where the delete is `destroyfs`: the entry leaves the MDS map,\n *   every mount on every node breaks, and whether the bytes survive rests on `remove-pools` alone.\n *   ★ WHICH IS THE WHOLE REASON `matches` COMPARES NOTHING. Read its ⛔ before adding a field to\n *     it. On every other resource in this package a forever-diff is an annoying plan line; on this\n *     one it is a live filesystem destroyed on every deploy, forever, because a background daemon\n *     moved a number nobody declared.\n *\n * ⛔ THERE IS NO SINGLE-OBJECT READ, WHICH INVERTS `path` AND `collection`. MEASURED on node-b:\n *     pvesh get /nodes/node-b/ceph/fs/cephfs-c1\n *       -> No 'get' handler defined for '/nodes/node-b/ceph/fs/cephfs-c1'\n *   `GET /nodes/{node}/ceph/fs` is a directory index and is the only read there is, so `path()`\n *   below returns the INDEX and `attributes` picks this filesystem out of the array client-side —\n *   the shape acl.ts uses for the one flat `GET /access/acl`. The POST goes to the `{name}` path,\n *   so `collection()` is the LONGER of the two strings, the mirror of metric-server.ts.\n *   ⚠️ AND THAT IS WHY EVERY HANDLER BELOW IS HAND-WRITTEN rather than taken from a factory. A\n *     factory `destroy` deletes the read path, which here is the index: `DELETE /nodes/{node}/\n *     ceph/fs` is not a route, so it would fail every destroy while the filesystem stayed exactly\n *     where it was. `reconcile` is hand-written for a second, independent reason — the forked\n *     worker — set out in ceph-fs-wire.ts. acl.ts is the precedent for a family that genuinely\n *     does not fit a shared shape.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()` ONTO `@distilled.cloud/proxmox`'s typed\n *   `nodes.listNodeCephFs`/`updateNodeCephFs` for the READ and the CREATE (2026-09-24, decision\n *   43's walk-down, 2c — ceph-fs-distilled.ts). DELETE originally stayed on `client.ts`:\n *   the SDK put its flags in a body that PVE discards (ceph-fs-wire.ts's history).\n *   SDK 0.3.0 fixes the query binding; delete now uses it and catches only CephFsNotFound.\n *   The typed-read follow-up removes the catch-all fold from `readFs`: a failed index must\n *   fail read/diff/reconcile/delete, not report a missing filesystem or a successful destroy.\n *\n * ⛔ CREATING A CephFS CREATES TWO CEPH POOLS, AND A `Proxmox.CephPool` MUST NOT ALSO DECLARE THEM.\n *   `createfs` builds `<name>_data` and `<name>_metadata` itself and refuses outright if either\n *   exists (\"ceph pools '…_data' and/or '…_metadata' already exist\"). MEASURED on C1: the live\n *   `cephfs-c1` owns `cephfs-c1_data` (id 6) and `cephfs-c1_metadata` (id 7), both of which\n *   `GET /nodes/node-b/ceph/pool` lists like any other pool — and `/nodes/{node}/ceph/pool/{name}` DOES\n *   have GET, PUT and DELETE, so a pool resource would be a clean `pveHandlers` fit and would\n *   adopt them without noticing. Declaring both is double management of one object: whichever\n *   reconciles first wins, and the loser either fails its create or PUTs `size`/`pg_num` onto pools\n *   this resource believes it owns. Declare the filesystem here and leave its two pools alone.\n *\n * ⚠️ `add-storage` IS A SECOND SIDE EFFECT AND IT LANDS IN storage.cfg. Set, `createfs` also calls\n *   `PVE::API2::Storage::Config->create` with type `cephfs`, content `backup,iso,vztmpl` and\n *   `fs-name <name>`. MEASURED: /etc/pve/storage.cfg on node-b holds exactly that — `cephfs:\n *   cephfs-c1` / `content backup,vztmpl,iso` / `fs-name cephfs-c1`. So a `Proxmox.Storage`\n *   declaring `cephfs-c1` would be managing an entry this resource created. Declare ONE of them:\n *   either `add-storage` here and no storage resource, or `add-storage` off and a\n *   `Proxmox.Storage` that reads this resource's `name` attribute — which also gets the ordering\n *   right for free, because Alchemy orders by data flow.\n *\n * ⚠️ `node` IS A ROUTE, NOT IDENTITY, AND MUST NEVER BE DIFFED. A CephFS is cluster-wide; the node\n *   in the path only says which node PVE proxies the call to. MEASURED: `GET /nodes/node-b/ceph/fs`,\n *   `…/node-c/…` and `…/node-d/…` returned the byte-identical array. So changing `node` plans `noop`, and\n *   two resources naming the same `name` on different nodes are the SAME filesystem — the vmid\n *   hazard from lxc.ts, with a filesystem on the end of it instead of a container.\n *\n * ⚠️ PRIVILEGES: the read lane needs `Sys.Audit` OR `Datastore.Audit` on `/`, which an auditor\n *   role already holds — unlike storage.ts, nothing needs widening before the first plan. The\n *   write side is in ceph-fs-wire.ts beside the calls, and in docs/privileges.md with the rest.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { createFs, destroyFs, readFs } from './ceph-fs-distilled.ts';\nimport { CEPH_FS_CREATE, createForm, notCreated, notDestroyed } from './ceph-fs-wire.ts';\nimport { guardWrite } from './distilled-guard.ts';\nimport { type PveRequirements, type WithTarget } from './resource.ts';\n\nexport interface CephFsProps extends WithTarget {\n  /** ⚠️ Which node answers the call, NOT which node holds the filesystem. See the header. */\n  node: string;\n  /**\n   * The filesystem name, and the cluster-wide primary key. PVE's pattern is `^[^:/\\s]+$`.\n   * ⛔ CHANGING IT IS A REPLACE, WHICH DESTROYS THE OLD FILESYSTEM. `diff` says so explicitly\n   *   below rather than letting the factory report a create-shaped `update` and orphan the old one.\n   */\n  name: string;\n  /**\n   * Placement groups for the backing data pool; the metadata pool gets a quarter of it, or 8 when\n   * this is under 32. PVE's default is 128.\n   *\n   * ⛔ CREATE-TIME ONLY, UNREADABLE, AND OWNED BY THE AUTOSCALER FROM THE SECOND IT LANDS. It is\n   *   never compared — see the ⛔ on `matches` — and this is not caution, it is measured. C1's\n   *   `cephfs-c1` was created with the default 128 (the arithmetic proves it: `cephfs-c1_metadata`\n   *   sits at 32, which is 128/4), and `cephfs-c1_data` reads pg_num 32 TODAY. The autoscaler moved\n   *   it by a factor of four, and it is not finished: `pg_autoscale_mode` is `on` for every pool on\n   *   this cluster and `cephfs-c1_metadata` already reports `pg_num_final: 16` against its live 32.\n   */\n  pg_num?: number;\n  /**\n   * Also write a `cephfs` storage entry for this filesystem. ⚠️ Create-time only and never read\n   *   back — it is an ACTION, not a field. See the header for what it does to `Proxmox.Storage`.\n   */\n  'add-storage'?: boolean;\n  /** ⛔ DELETE-TIME ONLY, AND IT ERASES THE DATA. Read the ⛔ on `destroyFs` before setting it. */\n  'remove-pools'?: boolean;\n  /**\n   * Delete the pveceph-managed storage entries too. ⚠️ PVE refuses unless they are already\n   *   disabled (\"storage '…' is not disabled, make sure to disable and unmount the storage first\"),\n   *   so this fails the destroy rather than unmounting anything out from under a running guest.\n   */\n  'remove-storages'?: boolean;\n}\n\n/**\n * ⚠️ EVERY FIELD HERE IS REPORTED AND NONE IS COMPARED. They exist so a plan, and the state entry\n *   behind it, can say what the declaration actually points at — which pools hold the bytes.\n */\nexport interface CephFsAttributes {\n  name: string;\n  /** The first data pool. PVE keeps it for compatibility; `data_pools` is the real answer. */\n  data_pool: string;\n  /**\n   * ⚠️ SORTED, AND IT IS A SET RATHER THAN A LIST. A CephFS can hold several data pools — added\n   *   with `ceph fs add_data_pool`, which this resource has no way to express — and PVE reports\n   *   them in the MDS map's own order. Sorting is what keeps this attribute stable across reads.\n   */\n  data_pools: string;\n  metadata_pool: string;\n  /**\n   * ⚠️ AN INTEGER THAT NAMES SOMETHING WRITTEN AS A NAME, AND THEREFORE A CLASSIC FOREVER-DIFF IF\n   *   IT EVER REACHED `matches`. PVE answers `metadata_pool_id: 7` while every write in this family\n   *   spells a pool by name. It is here to be read, never to be compared. `-1` means absent: the\n   *   field is optional in the schema and older PVE omits it.\n   */\n  metadata_pool_id: number;\n}\n\nexport interface ProxmoxCephFs extends Resource<\n  'Proxmox.CephFs',\n  CephFsProps,\n  CephFsAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a filesystem holding data cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxCephFs = Resource<ProxmoxCephFs>('Proxmox.CephFs', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * ⛔ NOTHING IS COMPARED, AND THAT IS THE MOST DELIBERATE LINE IN THIS FILE. A CephFS has no\n *   readable, writable field: the index returns only the name and the pools behind it, and every\n *   prop this resource accepts is create-time or delete-time. So \"present\" IS \"settled\", and the\n *   only honest comparison is none at all.\n *   ⚠️ THE TEMPTING ADDITION IS `pg_num`, AND IT WOULD BE THE WORST BUG THIS PACKAGE HAS SHIPPED.\n *     It is not in the index at all, so it can only be read from the pool endpoint — where the\n *     autoscaler owns it. MEASURED on C1 today: created at 128, live at 32, with the metadata\n *     pool already scheduled down to 16. Compared, that is an eternal mismatch — and since there\n *     is no update path, treating this as a diff would plan a REPLACE. The plan would destroy and\n *     rebuild a live filesystem on every deploy, triggered by a daemon on its own schedule.\n *   ⚠️ `data_pools` AND `metadata_pool_id` ARE OUT FOR THE ORDINARY REASONS: a set PVE returns\n *     in its own order, and an integer id for something written as a name. `name` is out because\n *     it is the FILTER that produced these attributes, so comparing it is true by construction —\n *     an identity change is handled in `diff`, not here. `node` is out because it is a route.\n */\nexport const ProxmoxCephFsProvider = () =>\n  Provider.effect(\n    ProxmoxCephFs,\n    Effect.succeed(\n      ProxmoxCephFs.Provider.of({\n        /**\n         * ⛔ EMPTY, LIKE EVERY OTHER RESOURCE HERE. The index answers with every filesystem on the\n         *   cluster, `cephfs-c1` included — the one holding this estate's ISOs and templates.\n         *   Adopting it would put Alchemy one `destroy` away from it. Adoption stays explicit.\n         */\n        list: () => Effect.succeed([]),\n        read: Effect.fn(function* ({ olds }) {\n          return yield* readFs(olds);\n        }),\n        /**\n         * ⛔ A CHANGED `name` IS A REPLACE, AND NOTHING ELSE CAN SAY SO. Left undetected, a rename\n         *   reads the NEW name, finds nothing, and plans the drift-shaped `update` this family uses\n         *   for \"Alchemy has state, the cluster does not\" — so reconcile would build the new\n         *   filesystem and LEAVE THE OLD ONE, with its pools, its storage entry and its bytes,\n         *   owned by nobody and invisible in every later plan.\n         *   ⛔ SAYING `replace` IS HONEST, AND IT IS ALSO WHAT MAKES A TYPO EXPENSIVE. Alchemy\n         *     creates first and deletes second, so the old filesystem is destroyed AFTER the new\n         *     one exists — with `remove-pools` unset the bytes are stranded rather than erased, and\n         *     that default is the only thing between a mis-typed rename and an unrecoverable one.\n         *     ⚠️ `node` is NOT part of identity and must never join this comparison.\n         */\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(CEPH_FS_CREATE, createForm(news), output === undefined);\n          if (output !== undefined && news.name !== output.name) {\n            return { action: 'replace' } as const;\n          }\n          if (output === undefined) return undefined;\n          const live = yield* readFs(news);\n          if (live === undefined) {\n            yield* guardWrite(CEPH_FS_CREATE, createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          // ⛔ SEE THE ⛔ ABOVE `ProxmoxCephFsProvider`: NOTHING ELSE IS COMPARED. Present is settled.\n          return { action: 'noop' } as const;\n        }),\n        /**\n         * ⚠️ THE READ-BACK IS KEPT EVEN THOUGH `createFs` ALREADY WAITED OUT THE TASK. Waiting\n         *   proves the task ENDED, reading proves the filesystem EXISTS, and PVE has shipped tasks\n         *   that end OK having done nothing.\n         * ⚠️ AN EXISTING FILESYSTEM IS RETURNED UNTOUCHED. There is no update call to make, so the\n         *   only write this handler can perform is a create; `diff` has already decided that a\n         *   real change is a replace, and Alchemy calls delete for the old generation itself.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const live = yield* readFs(news);\n          if (live !== undefined) return live;\n          yield* createFs(news);\n          const after = yield* readFs(news);\n          if (after === undefined) return yield* Effect.die(notCreated(news));\n          return after;\n        }),\n        /**\n         * ⛔ THE READ-BACK IS WHAT TURNS \"the task said OK\" INTO \"it is actually gone\": `destroyfs`\n         *   refuses while a non-disabled `cephfs` storage still references the filesystem, and that\n         *   refusal must fail the destroy rather than letting Alchemy drop the state entry for a\n         *   live object. `destroyFs` now uses the SDK query binding — ceph-fs-wire.ts preserves\n         *   the measured DELETE query-binding history.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          /**\n           * ⚠️ A FILESYSTEM SOMEBODY ALREADY REMOVED BY HAND IS NOT AN ERROR. `destroyfs` dies\n           *   synchronously with \"no such cephfs\", which would fail every destroy of a stack whose\n           *   filesystem was cleaned up outside Alchemy and leave the state entry unremovable\n           *   without editing the store. The original catch-all read fold could also report\n           *   success after a 403 without deleting anything, and could defeat read-back after a\n           *   write. `readFs` now propagates those failures: only a successful index with no\n           *   matching row may short-circuit this delete or confirm the filesystem is gone.\n           */\n          if ((yield* readFs(olds)) === undefined) return;\n          yield* destroyFs(olds);\n          const after = yield* readFs(olds);\n          if (after !== undefined) return yield* Effect.die(notDestroyed(olds));\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * `Proxmox.CephFs`'s distilled transport: index, create, delete and task status.\n * SDK 0.3.0 fixes DELETE query flags and supplies the measured CephFsNotFound tag.\n *\n * ⛔ `nodes.updateNodeCephFs` IS distilled's GENERATOR MISNAMING A CREATE, NOT A SECOND ENDPOINT.\n *   Checked directly against its schema (`T.Http({ method: \"POST\", uri:\n *   \"/nodes/{node}/ceph/fs/{name}\" })`) rather than trusted from the function name — it is the\n *   SAME single write PVE registers, `createfs`. Harmless once named here for what it is.\n *\n * ★ CREATE AND DELETE SHARE THE SAME BOUNDED POLL POLICY. The raw getNodeTaskStatus\n *   operation preserves this family's tolerance of a missing Sys.Audit grant or a node\n *   mid-restart until the deadline. The former SDK Task.awaitTask propagated poll failures;\n *   SDK PR #265 removed it because polling policy belongs in the provider.\n */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport type { CephFsProps } from './ceph-fs.ts';\nimport { POLL_ATTEMPTS, POLL_SECONDS, createForm, objectPath, readRow } from './ceph-fs-wire.ts';\nimport { runPve } from './distilled-pve.ts';\n\n/**\n * The index, read via distilled — the same shape `readRow` (ceph-fs-wire.ts) already narrows.\n *\n * ⛔ ABSENCE IS A SUCCESSFUL INDEX WITH NO MATCHING FILESYSTEM. The transport swap\n *   initially preserved the generic factory's catch-all fold. The 2026-09-24 follow-up removes it:\n *   a failed list is not proof that a filesystem is missing. Task polling below retains its\n *   separate bounded wait policy; it does not decide whether a resource exists.\n */\nexport const readFs = (props: CephFsProps) =>\n  runPve(props.target, 'read', false, nodes.listNodeCephFs({ node: props.node })).pipe(\n    Effect.map((rows) => readRow(rows as unknown as Record<string, unknown>, props)),\n  );\n\n/** `updateNodeCephFs`'s own request shape — `createForm`, translated. No field is renamed. */\nconst toDistilledCreate = (props: CephFsProps): nodes.UpdateNodeCephFsRequest =>\n  ({\n    ...createForm(props),\n    name: props.name,\n    node: props.node,\n  }) as unknown as nodes.UpdateNodeCephFsRequest;\n\n/**\n * Wait for a forked task. `exitstatus` is absent while running and exactly `OK` on success.\n * ⚠️ T.Label encodes the colon-filled UPID as one path segment, as the hand client did.\n */\nconst settleTask = (props: CephFsProps, upid: string) =>\n  Effect.gen(function* () {\n    for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt += 1) {\n      const status = yield* runPve(\n        props.target,\n        'read',\n        false,\n        nodes.getNodeTaskStatus({ node: props.node, upid }),\n      ).pipe(Effect.orElseSucceed(() => undefined));\n      if (status?.status === 'stopped') {\n        if (status.exitstatus === 'OK') return;\n        return yield* Effect.die(\n          new Error(\n            `${objectPath(props)}: PVE task ${upid} finished with \"${status.exitstatus ?? 'no exit status'}\". ` +\n              'The write returned HTTP 200 because it only forked the worker -- the real error is ' +\n              `in \\`pvesh get /nodes/${props.node}/tasks/${upid}/log\\`.`,\n          ),\n        );\n      }\n      yield* Effect.sleep(POLL_SECONDS * 1000);\n    }\n    return yield* Effect.die(\n      new Error(\n        `${objectPath(props)}: PVE task ${upid} was still running after ` +\n          `${String(POLL_ATTEMPTS * POLL_SECONDS)}s, or its status could not be read. Check the ` +\n          'task log, and check that the `read` role holds Sys.Audit on ' +\n          `/nodes/${props.node} -- each call mints a new token, so the poller is never the task ` +\n          'owner and is answered 403 rather than told to wait.',\n      ),\n    );\n  });\n\n/** POST the create, then wait for the worker. ⛔ The caller still reads back; see ceph-fs.ts. */\nexport const createFs = (props: CephFsProps) =>\n  Effect.gen(function* () {\n    const upid = yield* runPve(\n      props.target,\n      'provision',\n      true,\n      nodes.updateNodeCephFs(toDistilledCreate(props)),\n    );\n    // ⛔ NO UPID MEANS NO WORKER. PVE answers 200 with `{\"data\":null}` on calls that did nothing,\n    //   and here that is indistinguishable from success by status code alone. Refusing now is the\n    //   difference between a clear failure and a state entry for a filesystem nobody built.\n    if (upid === '') {\n      return yield* Effect.die(\n        new Error(\n          `${objectPath(props)}: POST returned no task id. PVE wraps every answer in ` +\n            '{\"data\":...} and can report success on a call that did nothing.',\n        ),\n      );\n    }\n    yield* settleTask(props, upid);\n  });\n\n/**\n * DELETE the filesystem, then wait for the worker.\n *\n * ⛔ WHAT THIS TAKES AWAY DEPENDS ENTIRELY ON `remove-pools`, AND THE DEFAULT IS THE SAFE ONE. With\n *   it unset PVE removes the filesystem from the MDS map and LEAVES the two pools on disk: every\n *   mount breaks, but the bytes are still there for an operator to recover. With it set the pools\n *   go too and nothing is recoverable. Leaving it unset also means a later create of the SAME name\n *   fails with \"ceph pools '<name>_data' and/or '<name>_metadata' already exist\" -- that refusal is\n *   a BRAKE, not a bug, and it is the last thing standing between a mis-typed rename and the data.\n */\nexport const destroyFs = (props: CephFsProps) =>\n  Effect.gen(function* () {\n    const upid = yield* runPve(\n      props.target,\n      'provision',\n      true,\n      nodes.deleteNodeCephFs({\n        node: props.node,\n        name: props.name,\n        // ⛔ Query fields, never a DELETE body. Omitted/false retains PVE's safe default.\n        ...(props['remove-pools'] === true ? { remove_pools: '1' } : {}),\n        ...(props['remove-storages'] === true ? { remove_storages: '1' } : {}),\n      }),\n    ).pipe(Effect.catchTag('CephFsNotFound', () => Effect.succeed('')));\n    // ⚠️ Missing already is idempotent; every other SDK error propagates. The caller's\n    //   successful index read must still confirm absence after the DELETE or task.\n    if (upid !== '') yield* settleTask(props, upid);\n  });\n",
     "/**\n * The wire lane of `Proxmox.CephFs`: how a PVE answer becomes attributes, how a declaration becomes\n * a PVE call, and how that call becomes a fact.\n *\n * ★ SPLIT OUT OF ceph-fs.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is a real one\n *   rather than a convenient line number. ceph-fs.ts answers \"what is a CephFS, and when has it\n *   changed\"; this file answers \"what does PVE say, what does it want, and has it finished\". On\n *   this family that is where all the strangeness lives — the read is an index and not an object,\n *   the paths are inverted, the delete takes its arguments in the query string, and both writes\n *   fork a worker — so keeping it in one place is what stops the next reader assuming the ordinary\n *   shape from the other nineteen resources. ⚠️ NOTHING HERE DECIDES A DIFF.\n *\n * ⚠️ THE `import type` BACK TO ceph-fs.ts IS A CYCLE ON PAPER ONLY. It is type-only and erased\n *   before anything runs, exactly as metric-server-form.ts imports `MetricServerProps`. The props\n *   stay the resource's public shape, declared in the file that declares the resource.\n *\n * ⛔ POST AND DELETE ANSWER WITH A UPID, NOT A RESULT — THE WRITE IS ASYNCHRONOUS AND A FAILED ONE\n *   IS STILL HTTP 200. Read from the cluster's own source, /usr/share/perl5/PVE/API2/Ceph/FS.pm on\n *   node-b: `createfs` and `destroyfs` both end `return $rpcenv->fork_worker(...)`. Two different lies\n *   come out of trusting that status code. A read-back straight after the POST reports \"still\n *   absent\" about a filesystem that is being built as it says so — which is precisely the message\n *   `pveOperations.reconcile` would print, pointing at the wrong cause. And a worker that dies\n *   INSIDE — the pool create, or the add-storage step, both of which are wrapped in `eval` — is\n *   never reported to the caller at all. `settle` below is the answer to both.\n *   ⚠️ REASONED FROM THAT SOURCE, NOT MEASURED. Nothing was written to this cluster, so the race\n *     has not been observed; only the `fork_worker` that guarantees it is there.\n *\n * ⛔ A DELETE BODY IS SILENTLY DISCARDED BY PVE, SO `remove-pools` GOES IN THE QUERY STRING.\n *   MEASURED in /usr/share/perl5/PVE/APIServer/AnyEvent.pm on node-b: line 928 reads the request\n *   content into params only `if ($method eq 'PUT' || $method eq 'POST')`, and line 1653 sends\n *   every other method down a branch that parses `$request->url->query()` and nothing else. So\n *   `pve(target, role, 'DELETE', path, form)` would send a body PVE never looks at: the flags would\n *   read as unset, the pools would quietly survive a delete that asked for them, and no error would\n *   be raised anywhere. sdn-apply.ts already puts `?pending=1` in the path for the same reason.\n *\n * ⚠️ THE TASK POLL RUNS ON THE `read` ROLE THOUGH IT SITS INSIDE reconcile, FOR TWO REASONS. It is\n *   a read, and resource.ts already mints `read` for its own read-back inside reconcile. And the\n *   leases differ where it matters: `provision` is 300s and explicitly non-renewable, so a create\n *   that waits out a slow worker on that lease can expire mid-poll, while `read` is 3600s.\n *\n * ⛔ THE POLLER IS NEVER THE TASK'S OWNER, WHICH COSTS A PRIVILEGE, AND THIS ONE IS MEASURED\n *   RATHER THAN FEARED. client.ts mints a fresh credential per call and the mount vends a NEW\n *   token id each time, so the token reading the status is never the token recorded in the UPID —\n *   and PVE compares them exactly. /usr/share/perl5/PVE/API2/Tasks.pm on node-b, `$check_task_user`:\n *   `return $user eq $fulltoken || $user eq $task->{user};`, above it the comment \"token only sees\n *   token tasks, user sees user + token tasks\". Token B of the same user matches neither branch.\n *   So the fallback is the schema's other clause for `GET /nodes/{node}/tasks/{upid}/status`: \"The\n *   user needs 'Sys.Audit' permissions on '/nodes/<node>' if they are not the owner of the task.\"\n *   Grant it on the `read` role, or every create burns the full cap below and reports the wrong\n *   cause.\n *\n * ★ THE ORIGINAL DISTILLED WALK MOVED READ AND CREATE FIRST, leaving DELETE here because\n *   SDK flags were annotated as body fields. Distilled Proxmox 0.3.0 fixes their query binding\n *   and adds the measured CephFsNotFound tag. All calls now live in ceph-fs-distilled.ts;\n *   this file keeps the pure forms, attributes and read-back failure messages. The protocol\n *   history above remains load-bearing: moving a DELETE flag back into a body loses it silently.\n */\nimport type { CephFsAttributes, CephFsProps } from './ceph-fs.ts';\nimport { csv, flag, int, text } from './values.ts';\n\n/**\n * This filesystem's row of the index, as attributes.\n *\n * ⚠️ `GET /nodes/{node}/ceph/fs` ANSWERS AN ARRAY, while the factory hands `attributes` the\n *   `Record<string, unknown>` every other PVE read is shaped like. Rows are narrowed rather than\n *   trusted, the same way acl.ts narrows its one flat grant list.\n *\n * ⛔ RETURNING undefined IS WHAT MAKES \"ABSENT\" MEAN ABSENT HERE, unlike acl.ts where the object is\n *   always present-but-unbound. A filesystem missing from the index has not been created, and\n *   `reconcile` takes the create branch on exactly that signal.\n */\nexport const readRow = (\n  live: Record<string, unknown>,\n  props: CephFsProps,\n): CephFsAttributes | undefined => {\n  const row = (Array.isArray(live) ? live : [])\n    .filter(\n      (entry): entry is Record<string, unknown> => typeof entry === 'object' && entry !== null,\n    )\n    .find((entry) => entry['name'] === props.name);\n  if (row === undefined) return undefined;\n  return {\n    data_pool: text(row['data_pool']),\n    data_pools: csv(\n      Array.isArray(row['data_pools'])\n        ? row['data_pools'].map((entry: unknown) => String(entry))\n        : [],\n    ),\n    metadata_pool: text(row['metadata_pool']),\n    metadata_pool_id: int(row['metadata_pool_id'], -1),\n    name: props.name,\n  };\n};\n\n/**\n * ⚠️ SHORT POLLS, LOW CAP. Ninety seconds covers two pool creates plus the ten seconds `createfs`\n *   itself spends waiting for an MDS to go active, and is short enough that a stuck task fails the\n *   deploy rather than parking it for the afternoon.\n */\n// ★ EXPORTED so ceph-fs-distilled.ts's OWN settle polls the same cadence and cap — one number.\nexport const POLL_SECONDS = 2;\nexport const POLL_ATTEMPTS = 45;\n\n/** ⚠️ `nodes/{n}/ceph/fs/{name}` — the POST and DELETE target, and NOT where a read goes. */\nexport const objectPath = (props: CephFsProps) => `nodes/${props.node}/ceph/fs/${props.name}`;\n\n/** The vendor rules `createForm` is checked against — `guardWrite`, distilled-guard.ts. */\nexport const CEPH_FS_CREATE = 'pve:POST /nodes/{node}/ceph/fs/{name}';\n\n/** Only the declared flags. ⚠️ An omitted one is PVE's own default, not a value to send. */\nconst field = (name: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [name]: value };\n\n/**\n * ⚠️ `name` IS DELIBERATELY ABSENT FROM THE FORM. It is already the last segment of the path being\n *   POSTed to — the metric-server.ts case again — and a second copy can only ever disagree with it.\n */\nexport const createForm = (props: CephFsProps): Record<string, string> => ({\n  ...field('add-storage', flag(props['add-storage'])),\n  ...field('pg_num', props.pg_num === undefined ? undefined : String(props.pg_num)),\n});\n\n/**\n * The two read-back failures, as messages rather than as guesses.\n *\n * ⛔ WAITING PROVES THE TASK ENDED; ONLY A READ PROVES THE FILESYSTEM DID OR DID NOT. `createfs`\n *   wraps its pool creates in an `eval` and CLEANS THEM UP on error before dying, so a worker can\n *   plausibly end having built and then removed everything it made. `destroyfs` refuses outright\n *   while a non-disabled `cephfs` storage still references the filesystem. Neither outcome is\n *   visible in a status code, which is why ceph-fs.ts reads back after both and dies with these.\n */\nexport const notCreated = (props: CephFsProps) =>\n  new Error(\n    `${objectPath(props)}: the create task finished but the filesystem is not in ` +\n      `GET nodes/${props.node}/ceph/fs. Check the task log -- a PVE worker can exit having ` +\n      'rolled back the pools it had just made.',\n  );\n\nexport const notDestroyed = (props: CephFsProps) =>\n  new Error(\n    `${objectPath(props)}: the destroy task finished but the filesystem is still in ` +\n      `GET nodes/${props.node}/ceph/fs. PVE refuses to destroy a CephFS while a PVE storage entry ` +\n      'of type cephfs still references it and is not disabled.',\n  );\n",
@@ -77,38 +79,60 @@
     "/**\n * Whether a `diff` or `reconcile` that holds attributes is looking at an ADOPTION — a live object\n * that reached this stack's state by being FOUND, not by this resource's own create — so a family\n * whose adoption must never change what it takes over (`Proxmox.Lxc`) can refuse any difference\n * instead of writing it. adopt.ts and probe.ts decide WHETHER an object may be claimed; this says,\n * once it is claimed, whether the claim is an adoption.\n *\n * ★ STATE ALREADY SAYS WHICH, AT BOTH HALVES OF A DEPLOY (alchemy 2.0.0-beta.79):\n *   · PLAN, A COLD ADOPTION. The probe mints an instance id no row can hold (Plan.ts\n *     `generateInstanceId()`), and `diff` then runs with that id and the attributes the probe\n *     read. So no row holds the id.\n *   · APPLY, THE SAME ADOPTION. Apply commits an `updating` row with `adopting: true` under that id\n *     BEFORE it calls reconcile, and the flag stays until the update commits (Apply.ts). An\n *     adoption whose apply was interrupted keeps it, so the next plan's `diff` sees it too.\n *   · A RECOVERED CREATE. A `creating` row with no attributes, whose live object the recovery read\n *     found. It is this resource's own create when the row proves it (probe.ts `provenOurs`, the\n *     same proof the read asked). Otherwise the plan went on only because `--adopt` said so — an\n *     adoption like any other.\n *   · Any other row with attributes is state vouching for the object: not an adoption.\n * ⚠️ OUTSIDE A STACK — no Stack or State in context, or a store that errors (rows.ts) — no row\n *   holds anything, so every call is an adoption: the strict answer, never the permissive one. A\n *   family then refuses an ordinary update's write as if it were an adoption's. `alchemy deploy`\n *   and the Alchemist session provide both services.\n */\nimport * as Effect from 'effect/Effect';\nimport type { Owner } from './adopt.ts';\nimport { provenOurs } from './probe.ts';\nimport { recordedGeneration } from './rows.ts';\n\n/**\n * Whether `owner`'s call is an adoption (header). `settled` is the family's \"live matches these\n * props\", asked only for a recovered create, with the props of the row that recorded it.\n * ⛔ A CREATE IS NEVER ONE HERE. `output` undefined is reconcile's create path, which has its own\n *   rule for a live object it finds (adopt.ts `refuseTakeover`).\n */\nexport const adopting = <E, R>(\n  owner: Owner,\n  settled: (recorded: unknown) => Effect.Effect<boolean, E, R>,\n): Effect.Effect<boolean, never, R> =>\n  Effect.gen(function* () {\n    if (owner.output === undefined) return false;\n    const generation = yield* recordedGeneration(owner.fqn, owner.instanceId);\n    if (generation === undefined || generation.adopting === true) return true;\n    if (generation.attr !== undefined && generation.attr !== null) return false;\n    return !(yield* provenOurs(owner, settled(generation.props)));\n  });\n",
     "/**\n * The calls a `Proxmox.Lxc` makes: read one config, create, update in place, grow, delete.\n *\n * ⛔ A READ FAILURE IS A FAILURE HERE, NOT \"ABSENT\" — THE ONE PLACE THIS PACKAGE DEPARTS FROM\n *   resource.ts. `pveOperations.read` folds every error into `undefined`, which for a guest means a\n *   403 or a node that did not answer plans a CREATE over a running container. PVE answers a\n *   missing guest with HTTP 500, `Configuration file 'nodes/<node>/lxc/<vmid>.conf' does not\n *   exist` (pve-guest-common `AbstractConfig::load_config`), so only a 500 may mean absent — and\n *   even then only after the cluster says so, below. Anything else fails the plan.\n *\n * ⛔ \"ABSENT\" IS DECIDED BY THE WHOLE CLUSTER, NOT BY THE ERROR TEXT. A config lives under its\n *   node, so a guest migrated to another node — or a QEMU VM holding the same cluster-wide vmid —\n *   also reads as missing at the declared path. `GET /cluster/resources?type=vm` settles it: the\n *   vmid nowhere is absent; the vmid anywhere else FAILS the read with where it is; the vmid on\n *   the declared node fails with PVE's own error. ★ Keyed on the cluster rather than on matching\n *   the message, so a PVE that words it differently still cannot turn into a create.\n *\n * ⚠️ CREATE, RESIZE AND DELETE ARE ASYNCHRONOUS; A CONFIG PUT IS NOT. The first three answer a\n *   UPID the moment PVE forks the worker (`NodesNodeLxcPostReturn`, `…ResizePutReturn`,\n *   `…VmidDeleteReturn` are all `string`), so each waits for its task's exitstatus. `PUT …/config`\n *   answers `null` after writing (`…ConfigPutReturn`), so it needs no wait.\n * ⛔ EACH TASK IS POLLED WITH THE CREDENTIAL THAT STARTED IT — see `awaitTask`: only the owner\n *   skips `Sys.Audit`. A fresh `provision` mint per write gives the full 300s lease a create needs;\n *   a cached lease can be handed out with 60s left (lease-cache.ts).\n */\nimport * as Effect from 'effect/Effect';\nimport { PveError, pve, pveWith } from './client.ts';\nimport { guardForm } from './constraint-guard.ts';\nimport type { EndpointKey } from './constraints.ts';\nimport type { PveTarget } from './credentials.ts';\nimport { mint } from './mint.ts';\nimport { createForm } from './lxc-create-form.ts';\nimport { type LxcChange, judge } from './lxc-judge.ts';\nimport type { LxcAttributes, LxcProps } from './lxc-props.ts';\nimport { rawKeysOf, storedConfig } from './lxc-props.ts';\nimport { awaitTask } from './network-apply-read.ts';\nimport { text, withClears } from './values.ts';\n\n/** A plan-time or apply-time refusal. Nothing was written when one of these is raised. */\nexport class LxcRefusedError extends Error {\n  override readonly name = 'LxcRefusedError';\n}\n\n/** Where one guest lives. Its identity, and nothing else. */\nexport type LxcWhere = { readonly target: PveTarget; readonly node: string; readonly vmid: number };\n\nexport const guestPath = (where: LxcWhere) => `nodes/${where.node}/lxc/${String(where.vmid)}`;\n\n/**\n * The three vendor endpoints a guest is written through, as the generated tables key them.\n *\n * ⛔ DECLARED HERE RATHER THAN ON A SPEC BECAUSE `Proxmox.Lxc` HAS NO SPEC — lxc.ts writes all\n *   five handlers by hand (a guest reads failures as failures, waits on tasks and grows disks\n *   through a second endpoint), so it cannot inherit the shared guard from resource.ts. Without\n *   these three it would be the largest write surface in the package with nothing checking the\n *   body: `POST /nodes/{node}/lxc` alone carries 26 constrained parameters.\n * ⚠️ THREE, NOT TWO. `resize` is a separate PVE endpoint with its own schema — `disk` against an\n *   enum of `rootfs` and `mp0..mp255`, `size` against PVE's `+<n>` / `<n>` pattern — and it is\n *   the one lxc-volume.ts drives.\n * ⛔ `{vmid}` AND `{node}` ARE PATH SEGMENTS, NOT FORM KEYS, on the two PUTs. On the POST `vmid`\n *   IS a form key and is required, which is why `createForm` sends it.\n */\nconst LXC_ENDPOINTS = {\n  create: 'pve:POST /nodes/{node}/lxc' as EndpointKey,\n  resize: 'pve:PUT /nodes/{node}/lxc/{vmid}/resize' as EndpointKey,\n  update: 'pve:PUT /nodes/{node}/lxc/{vmid}/config' as EndpointKey,\n};\n\n/** How long each task may run, in one-second polls. ⚠️ A cap, not an estimate. */\nconst CREATE_POLLS = 180;\nconst TASK_POLLS = 60;\n\nconst isServerError = (error: unknown): error is PveError =>\n  error instanceof PveError && error.status === 500;\n\n/** One `GET /cluster/resources?type=vm` row. */\ntype GuestRow = { readonly vmid?: unknown; readonly node?: unknown; readonly type?: unknown };\n\n/** The live config, or undefined when no guest holds this vmid anywhere in the cluster. */\nexport const readLive = (where: LxcWhere) =>\n  Effect.gen(function* () {\n    const answer = yield* pve<Record<string, unknown> | null>(\n      where.target,\n      'read',\n      'GET',\n      `${guestPath(where)}/config`,\n    ).pipe(\n      Effect.map((data) => ({ data, error: undefined })),\n      Effect.catchIf(isServerError, (error) => Effect.succeed({ data: undefined, error })),\n    );\n    if (answer.data !== undefined && answer.data !== null) return answer.data;\n    const rows = yield* pve<readonly GuestRow[]>(\n      where.target,\n      'read',\n      'GET',\n      'cluster/resources?type=vm',\n    );\n    // ⚠️ `Number()`, NOT `===` ON THE RAW VALUE: a vmid that came back as `\"900\"` would otherwise\n    //   match nothing, and \"listed nowhere\" is the one answer that turns into a create.\n    const found = (rows ?? []).find((row) => Number(row.vmid) === where.vmid);\n    if (found !== undefined && found.node === where.node && found.type === 'lxc') {\n      return yield* Effect.fail(\n        answer.error ??\n          new LxcRefusedError(`CT ${String(where.vmid)} is listed but its config read empty.`),\n      );\n    }\n    if (found !== undefined) {\n      return yield* Effect.fail(\n        new LxcRefusedError(\n          `vmid ${String(where.vmid)} is a ${text(found.type, 'guest')} on ` +\n            `${text(found.node, '?')}, not a container on ${where.node}. A migration is not an ` +\n            'update and vmids are cluster-wide: declare the node it is on, or pick a free vmid.',\n        ),\n      );\n    }\n    return undefined;\n  });\n\nexport const attributesOf = (where: LxcWhere, live: Record<string, unknown>): LxcAttributes => ({\n  config: storedConfig(live),\n  node: where.node,\n  rawKeys: rawKeysOf(live),\n  vmid: where.vmid,\n});\n\n/** Run one task-starting call and wait for it on the same credential. Fails unless `OK`. */\nconst task = (\n  where: LxcWhere,\n  method: 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  what: string,\n  polls: number,\n  form?: Record<string, string>,\n) =>\n  Effect.gen(function* () {\n    const credential = yield* mint(where.target, 'provision');\n    const upid = text(yield* pveWith<string>(where.target, credential, method, path, form));\n    if (upid === '') {\n      return yield* Effect.fail(\n        new LxcRefusedError(\n          `${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`,\n        ),\n      );\n    }\n    const exit = yield* awaitTask(where.target, credential, where.node, upid, polls);\n    if (exit !== 'OK') {\n      return yield* Effect.fail(\n        new LxcRefusedError(\n          `${what}: task ${upid} ended \"${exit}\". Read \\`pvesh get /nodes/${where.node}/tasks/` +\n            `${upid}/log\\` before running the deploy again.`,\n        ),\n      );\n    }\n  });\n\n/** POST the create and wait for the template to unpack. ⛔ Refusals are the caller's to check. */\nexport const createGuest = (props: LxcProps) =>\n  Effect.gen(function* () {\n    const form = createForm(props);\n    /**\n     * ⛔ BEFORE THE POST, AND WITH PRESENCE, BECAUSE THIS IS UNCONDITIONALLY A CREATE. Reached\n     *   only when the guest is absent (lxc.ts's reconcile), so the vendor's required parameters\n     *   really are about to go on the wire — `ostemplate` and `vmid`, both of which\n     *   `createRefusals` already insists on, plus every bound the schema carries and nothing here\n     *   knew: `cores` 1..8192, `memory` ≥ 16, `hostname` as a dns-name, `tags`, `startup`.\n     */\n    yield* guardForm(LXC_ENDPOINTS.create, form, true);\n    return yield* task(\n      props,\n      'POST',\n      `nodes/${props.node}/lxc`,\n      `create CT ${String(props.vmid)}`,\n      CREATE_POLLS,\n      form,\n    );\n  });\n\n/**\n * Apply a judged change: the config PUT first, then each resize.\n * ⚠️ IN THAT ORDER BECAUSE A MOUNT POINT'S PUT CARRIES ITS LIVE `size=`, and the resize rewrites it.\n * ⛔ THE PUT CARRIES THE `digest` OF THE CONFIG IT WAS JUDGED AGAINST. PVE refuses the write if the\n *   file changed since (`assert_if_modified`), so an edit landing between reconcile's own read and\n *   its PUT fails the deploy instead of being overwritten by a change computed from the older file.\n * ⚠️ THE DIGEST IS THE DEPLOY'S READ, NOT THE PLAN'S. A hand edit between `plan` and `deploy` is\n *   seen by reconcile's fresh judge instead: a declared key edited meanwhile is written back to the\n *   declaration (even after a plan that warned of nothing), an undeclared one is left alone.\n */\nexport const updateGuest = (props: LxcProps, change: LxcChange, digest: string) =>\n  Effect.gen(function* () {\n    if (Object.keys(change.put).length > 0 || change.clear.length > 0) {\n      const form = withClears(\n        { ...change.put, ...(digest === '' ? {} : { digest }) },\n        change.clear,\n      );\n      /** ⚠️ NO PRESENCE: this form is partial by construction — it is `judge`'s answer. */\n      yield* guardForm(LXC_ENDPOINTS.update, form, false);\n      yield* pve(props.target, 'provision', 'PUT', `${guestPath(props)}/config`, form);\n    }\n    for (const grow of change.resize) {\n      const grown = { disk: grow.disk, size: grow.size };\n      // ⛔ WITH PRESENCE: `disk` and `size` are both required and both always sent, so this is a\n      //   value check over PVE's own `+<n>` size pattern and its `rootfs|mp0..mp255` enum.\n      yield* guardForm(LXC_ENDPOINTS.resize, grown, true);\n      yield* task(\n        props,\n        'PUT',\n        `${guestPath(props)}/resize`,\n        `grow ${grow.disk} of CT ${String(props.vmid)} to ${grow.size}`,\n        TASK_POLLS,\n        grown,\n      );\n    }\n  });\n\n/**\n * ⛔ NO `force`, NO `purge`, NO STOP FIRST. PVE refuses to destroy a running or protected guest,\n *   and that refusal is kept: stopping a guest so a delete can proceed is an operator's decision.\n *   Reached only under `RemovalPolicy.destroy()` — this resource retains by default.\n * ⛔ AND ONLY THE GUEST THIS STACK DECLARED. State holds a vmid, and a vmid is reusable: after a\n *   hand `pct destroy` and a new `pct create` at the same id, \"delete CT 150\" is somebody else's\n *   container and all its volumes. So the live guest is judged against the last declaration\n *   first; one that no longer matches is refused with the keys that differ, and deleting it (or\n *   declaring it again) is the operator's call.\n */\nexport const destroyGuest = (where: LxcWhere, declared: LxcProps) =>\n  Effect.gen(function* () {\n    const live = yield* readLive(where);\n    if (live === undefined) return;\n    const drift = judge(declared, live).drift;\n    if (drift.length > 0) {\n      return yield* Effect.fail(\n        new LxcRefusedError(\n          `destroy CT ${String(where.vmid)}: the guest on ${where.node} no longer matches its last ` +\n            `declaration (${drift.join(', ')}), so it may not be the guest this stack made. ` +\n            'Nothing was deleted. Delete it by hand if it should go, or declare it again.',\n        ),\n      );\n    }\n    yield* task(where, 'DELETE', guestPath(where), `destroy CT ${String(where.vmid)}`, TASK_POLLS);\n  });\n",
     "/**\n * How this package finds out what a node has STAGED, and whether the cluster survived an apply.\n *\n * ★ SPLIT OUT OF network-apply.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is a real\n *   one rather than a convenient line number: this file answers \"what is true on the cluster right\n *   now\", network-apply.ts answers \"what does the resource do about it\". Nothing here decides a\n *   diff, and the only write in either file is the apply itself.\n *\n * ⛔ THE PENDING STATE IS NOT IN `data`, WHICH IS WHY THIS FILE DOES ITS OWN FETCH. MEASURED in the\n *   cluster's own source on node-b, 2026-09-13 — not inferred from documentation:\n *     PVE/API2/Network.pm   my $tmp = PVE::INotify::read_file('interfaces', 1);\n *                           $rpcenv->set_result_attrib('changes', $changes) if $changes;\n *     PVE/HTTPServer.pm     if (my $diff = $rpcenv->get_result_attrib('changes')) {\n *                               $resp->{changes} = $diff;\n *                           }\n *   So the answer is `{\"data\":[…interfaces…],\"changes\":\"<unified diff>\"}`: `changes` is a SIBLING\n *   of `data`, set only when the diff is non-empty. `client.ts`'s `pve()` returns `body.data` and\n *   drops the envelope, so the one readable pending signal is invisible to every other resource in\n *   this package. Without the fetch below, `Proxmox.NetworkApply` could not diff honestly at all.\n *   ★ `pveEnvelopeWith` in client.ts now carries the same member failover as every other call.\n *   ⛔ WHY THIS FAMILY DID NOT MOVE TO DISTILLED WITH `Proxmox.NodeNetwork` (2026-09-24, decision\n *     43's walk-down): CONFIRMED against `@distilled.cloud/proxmox`'s own `protocol.ts` that its\n *     `transformResponse` unconditionally returns `body.data ?? {}` for every operation, before a\n *     generated call's typed output is even built — no typed call, current or future, could see\n *     `changes` without a protocol-level change upstream. `pveEnvelopeWith` stays because nothing\n *     else preserves the sibling this function needs.\n *\n * ⛔ AND THE INTERFACE ROWS CANNOT TELL YOU EITHER. MEASURED in PVE/INotify.pm `read_file`: when\n *   `/etc/network/interfaces.new` exists, THAT is the file that gets parsed, so\n *   `GET /nodes/{node}/network` answers with the STAGED config and a node about to be reconfigured\n *   looks identical to one already running it. Same trap `sdn-apply.ts` documents for `?running=1`.\n *\n * ⚠️ `active` IS NOT A PENDING SIGNAL, AND THE OBVIOUS SHORTCUT IS MEASURABLY WRONG. On node-b and node-c,\n *   with nothing staged anywhere (VERIFIED 2026-09-13: `/etc/network/interfaces.new` absent on node-b,\n *   node-c and node-d), `wlan0` already comes back with no `active` key at all. Counting interfaces that\n *   are not up as \"pending\" would report an update on two of the three nodes forever.\n *\n * ⚠️ ONE THING GENUINELY CANNOT BE SEEN FROM HERE, AND IT IS SMALL. The diff is computed as\n *   `diff -b -N -u`, so a staged file differing from the live one ONLY in whitespace produces no\n *   `changes` at all. This module reports that node as settled while `interfaces.new` still sits\n *   there waiting for the next reload anybody triggers. The file's existence is not exposed by the\n *   API in any other form, so the alternative is not a better read — it is SSH.\n */\nimport * as Effect from 'effect/Effect';\nimport { pve, pveEnvelopeWith, pveWith } from './client.ts';\nimport { type PveCredential, type PveTarget } from './credentials.ts';\nimport { leased } from './lease-cache.ts';\nimport { bool, text } from './values.ts';\n\n/** The `GET /nodes/{node}/network` envelope. ⛔ `changes` is beside `data`, never inside it. */\ntype NetworkEnvelope = { changes?: string };\n\n/** One row of `GET /cluster/status` — a `cluster` row, or one `node` row per member. */\ntype StatusRow = { type?: string; name?: string; quorate?: unknown; online?: unknown };\n\n/** One `GET /nodes/{node}/tasks/{upid}/status` answer. `status` is `running` or `stopped`. */\ntype TaskStatus = { status?: string; exitstatus?: string };\n\n/** What the cluster looked like the moment it was asked. Never persisted — see network-apply.ts. */\nexport type ClusterHealth = { quorate: boolean; offline: readonly string[] };\n\n/**\n * The unified diff between a node's applied interfaces file and its staged one, or `''`.\n *\n * ⛔ THIS STRING NEVER LEAVES THIS MODULE, AND THAT IS A SECRET RULE, NOT A STYLE ONE. Alchemy\n *   persists attributes UNENCRYPTED (credentials.ts spells out why), and `/etc/network/interfaces`\n *   is a file that can legally contain `wpa-psk` — node-b and node-c both carry a `wlan0`, MEASURED — as\n *   well as any `pre-up` command somebody wrote. A diff of that file in a state store is a secret\n *   in a state store. Only the COUNT below ever escapes.\n */\nconst stagedDiff = (target: PveTarget, node: string) =>\n  Effect.gen(function* () {\n    const path = `nodes/${node}/network`;\n    // ⚠️ THE `read` ROLE IS ENOUGH, AND DELIBERATELY SO. The schema's permission for this GET is\n    //   `\"user\": \"all\"` — no privilege check at all — so the pending read never needs the\n    //   provisioning lease, and a plan stays a plan even if the write role is missing entirely.\n    // ⛔ THROUGH THE LEASE CACHE, NOT `mint`. This read needs no particular identity — only the\n    //   apply and its task poll do, and network-apply.ts mints for those itself. Minting here left\n    //   SIX extra `hf-read@pve` tokens on node-b per C1 plan (one per node, for read and for diff),\n    //   MEASURED 2026-09-14 while the cache itself made one read mint for the whole run.\n    const credential = yield* leased(target, 'read');\n    const envelope = (yield* pveEnvelopeWith(target, credential, 'GET', path)) as NetworkEnvelope;\n    return text(envelope.changes);\n  });\n\n/**\n * Changed lines in a unified diff.\n *\n * ⚠️ A NON-EMPTY DIFF IS NEVER REPORTED AS ZERO, WHICH IS WHAT `Math.max` IS FOR. The `+++`/`---`\n *   headers have to be skipped, and a removed line whose own text starts with `---` is skipped with\n *   them; a staged change consisting of nothing else would otherwise count 0 and be reported as\n *   \"settled\", which is the exact lie this resource exists to prevent. The count is informational —\n *   the resource only ever compares it to zero — so an occasional undercount of 1 is harmless while\n *   an undercount to zero is not.\n */\nexport const pendingLines = (diff: string) => {\n  if (diff === '') return 0;\n  const changed = diff\n    .split('\\n')\n    .filter(\n      (line) =>\n        (line.startsWith('+') || line.startsWith('-')) &&\n        !line.startsWith('+++') &&\n        !line.startsWith('---'),\n    ).length;\n  return Math.max(changed, 1);\n};\n\n/** How many staged lines this node is carrying. Zero is the only settled value. */\nexport const pendingCount = (target: PveTarget, node: string) =>\n  stagedDiff(target, node).pipe(Effect.map(pendingLines));\n\n/**\n * Quorum, and every member that is not online.\n *\n * ⛔ QUORUM ALONE IS NOT THE CHECK, AND ON A THREE-NODE CLUSTER IT WOULD MISS THE ACCIDENT THIS\n *   RESOURCE IS AFRAID OF. Losing ONE of three leaves `quorate: 1` — MEASURED shape on C1:\n *   `{\"id\":\"cluster\",\"name\":\"HF-C1\",\"nodes\":3,\"quorate\":1,…}` plus one row per node with\n *   `online: 1`. So a reload that drops node-b off the network is invisible to `quorate` and visible\n *   only as `online: 0` on that row. Both are checked, and the node names come back so the failure\n *   message can say WHICH member went away.\n *\n * ⚠️ AN UNCLUSTERED NODE IS QUORATE BY DEFINITION. A standalone PVE answers with node rows and no\n *   `cluster` row; reading that absence as \"not quorate\" would make this resource undeclarable on\n *   every single-node install.\n *\n * ⚠️ THIS ONE NEEDS `Sys.Audit` ON `/` — the only privilege in this family beyond the apply itself.\n *   It is asked of the `read` role, which is auditor-shaped, rather than of `provision`.\n */\nconst clusterHealth = (target: PveTarget) =>\n  pve<StatusRow[]>(target, 'read', 'GET', 'cluster/status').pipe(\n    Effect.map((rows) => {\n      const all = rows ?? [];\n      const cluster = all.find((row) => row.type === 'cluster');\n      return {\n        offline: all\n          .filter((row) => row.type === 'node' && !bool(row.online))\n          .map((row) => text(row.name, '<unnamed>')),\n        quorate: cluster === undefined ? true : bool(cluster.quorate),\n      } satisfies ClusterHealth;\n    }),\n  );\n\n/**\n * Why the cluster is not healthy, or `undefined` when it is.\n *\n * ★ A REASON RATHER THAN A BOOLEAN, BECAUSE THE CALLER'S ONLY USE FOR IT IS A REFUSAL MESSAGE.\n *   \"The deploy stopped because the cluster was degraded\" is not actionable at three in the\n *   morning; \"quorate=true offline=[node-c]\" is. The two callers in network-apply.ts ask this before\n *   the reload and again after it, and the second answer is the one that stops the chain from\n *   reaching the next node.\n *\n * ⚠️ A MEMBER OFFLINE FOR AN UNRELATED REASON BLOCKS EVERY APPLY, AND THAT IS THE INTENDED\n *   BEHAVIOUR RATHER THAN AN OVERSIGHT. A node down for maintenance is one failure away from the\n *   pools losing min_size; reloading another node's networking while it is out is the move that\n *   completes the outage. Bring it back, or apply by hand with the cluster in front of you.\n */\nexport const degradedReason = (target: PveTarget) =>\n  clusterHealth(target).pipe(\n    Effect.map((health) =>\n      health.quorate && health.offline.length === 0\n        ? undefined\n        : `quorate=${String(health.quorate)} offline=[${health.offline.join(', ')}]`,\n    ),\n  );\n\n/**\n * ⛔ NOT AN EXITSTATUS PVE CAN RETURN, AND THAT IS THE POINT. The caller compares against `'OK'`;\n *   these two say WHY the answer is not OK without needing a second branch for \"we do not know\".\n */\nexport const UNREACHABLE =\n  'the task could not be read -- the node stopped answering, or this lease cannot see it';\nconst STILL_RUNNING = 'still running when this provider stopped waiting';\n\n/**\n * How long to wait on `ifreload`, in one-second polls.\n *\n * ⚠️ THIRTY SECONDS IS A CEILING, NOT AN EXPECTATION. A reload of a handful of interfaces finishes\n *   in a second or two; past thirty, something is wrong in a way a deploy cannot fix by waiting,\n *   and the honest move is to stop and name the task rather than park the stack on it.\n */\nconst ATTEMPTS = 30;\n\n/**\n * Wait for one `srvreload` task and answer its exitstatus.\n *\n * ⛔ THE APPLY IS ASYNCHRONOUS AND ITS 200 MEANS NOTHING. MEASURED: `reload_network_config` ends\n *   `return $rpcenv->fork_worker('srvreload', 'networking', $authuser, $worker)`, so the PUT\n *   returns a UPID the instant the worker is forked — before `ifreload -a` has run, let alone\n *   succeeded. Waiting for the task is the only way to learn the outcome.\n *\n * ⛔ AND IT MUST BE POLLED WITH THE CREDENTIAL THAT STARTED IT. The task-status schema says\n *   `\"user\": \"all\"` with the note \"needs 'Sys.Audit' on '/nodes/<node>' if they are not the owner\n *   of the task\". Every mint returns a NEW token id, so a second mint is a different identity and\n *   is not the owner — which is why this takes a `PveCredential` and the caller keeps one lease\n *   across both calls, instead of widening the provisioning role to read its own tasks.\n *\n * ⛔ THE OTHER REASON THIS FAMILY DID NOT MOVE TO DISTILLED (2026-09-24): CHECKED against\n *   `@distilled.cloud/proxmox`'s own `Task.awaitTask` (`src/task.ts`) before deciding — it\n *   propagates a poll failure as a genuine typed `GetNodeTaskStatusError` rather than collapsing\n *   it to `UNREACHABLE` the way this function does, which would turn the ⛔ two paragraphs above\n *   into a failed `reconcile` on exactly the poll a mid-reload connection drop is expected to hit.\n */\nexport const awaitTask = (\n  target: PveTarget,\n  credential: PveCredential,\n  node: string,\n  upid: string,\n  // ★ A CALLER WHOSE TASK IS SLOWER THAN A RELOAD SAYS SO: an LXC create unpacks a template.\n  attempts: number = ATTEMPTS,\n) =>\n  Effect.gen(function* () {\n    /**\n     * ⚠️ THE UPID GOES IN RAW, NOT PERCENT-ENCODED, AND THE CHOICE IS DELIBERATE. A UPID is\n     *   `UPID:<node>:<hex>:<hex>:<hex>:<type>:<id>:<user>:` — its only punctuation is `:`, `@`, `!`\n     *   and `-`, every one of which is a legal path character, so raw needs nothing from the\n     *   router. Encoding them instead RELIES on PVE unescaping each path segment, which is\n     *   plausible and was NOT measured here (measuring it means starting a task, i.e. writing). If\n     *   that assumption were wrong the poll would 404, this would report the outcome as unknown,\n     *   and a perfectly good reload would stop the deploy. Raw removes the assumption.\n     */\n    const path = `nodes/${node}/tasks/${upid}/status`;\n    for (let attempt = 0; attempt < attempts; attempt += 1) {\n      /**\n       * ⛔ A FAILED POLL IS NOT A FAILED RELOAD, AND CALLING IT ONE WOULD BE THE WORST KIND OF\n       *   WRONG. If the member serving the poll is the node being reloaded, `ifreload -a` can drop\n       *   the very connection this poll rides on — see network-apply.ts.\n       *   The reload may well have succeeded. So the call is collapsed to \"we cannot see the task\"\n       *   and the caller reports the outcome as UNKNOWN, with the UPID, rather than guessing.\n       * ⚠️ A 403 LANDS HERE TOO, AND IT READS THE SAME. If the polling identity is somehow not the\n       *   task's owner, the endpoint wants `Sys.Audit` on the node and this sees only \"no answer\" —\n       *   which is why `UNREACHABLE` names both possibilities rather than blaming the network.\n       */\n      const status = yield* pveWith<TaskStatus>(target, credential, 'GET', path).pipe(\n        Effect.orElseSucceed(() => undefined),\n      );\n      if (status === undefined) return UNREACHABLE;\n      if (status.status === 'stopped') return text(status.exitstatus, 'stopped with no exitstatus');\n      yield* Effect.sleep('1 second');\n    }\n    return STILL_RUNNING;\n  });\n",
-    "/**\n * `Proxmox.MetricServer` — where the cluster ships its metrics, declared.\n *\n * ★ THE FAILURE THIS PREVENTS IS A SILENT ONE, WHICH IS THE WHOLE ARGUMENT FOR DECLARING IT.\n *   Undeclared, the target exists only as a section of `/etc/pve/status.cfg`: rebuild a node,\n *   re-add one to the cluster, or restore a config from before it was configured, and the cluster\n *   stops shipping. Nothing fails, no task errors, no alert fires — the graphs go flat, and the\n *   first to find out is whoever went looking for a number that was not there.\n *\n * ⛔ CREATE IS `POST cluster/metrics/server/{id}` — THE OBJECT'S OWN PATH — SO `collection()`\n *   RETURNS THE SAME STRING AS `path()`, AND THAT IS NOT A TYPO. MEASURED: a POST to the\n *   collection answers \"Method 'POST /cluster/metrics/server' not implemented\", while the id path\n *   gets as far as a permission check (`/`, Sys.Modify); the published schema agrees, giving the\n *   collection a GET and nothing else. `createForm` omits `id` for the same reason — it is already\n *   the last segment of the path being POSTed to, and a second copy can only disagree with it.\n *\n * ⛔ THE `token` IS WRITE-ONLY AND MUST NEVER BECOME AN ATTRIBUTE. Alchemy persists attributes\n *   UNENCRYPTED, so one that reached state would outlive the change that set it, in the state\n *   store and in every backup of it. It is `never` in the props below — declaring one is a COMPILE\n *   ERROR rather than a leak found months later — and absent from `optional`, for the reason\n *   given there. Set it out of band; PVE never returns it on a read anyway. `otel-headers`, where an\n *   opentelemetry server's bearer token lives, gets the same treatment in metric-server-otel.ts.\n *\n * ⚠️ PRIVILEGES, AND THIS IS A BIGGER ASK THAN IT LOOKS. Read and diff are fine under an auditor\n *   lease — the single-object GET checks `Sys.Audit` on `/` — while create, update and delete all\n *   check `Sys.Modify` on `/` and answer \"Permission check failed (/, Sys.Modify)\" until the role\n *   is widened. Widen it knowingly: the ACL path is the ROOT and there is no `/metrics` object to\n *   scope to, so `Sys.Modify` also buys datacenter options, notification targets and every other\n *   cluster-wide config write. A separate role for metric writes is the narrower answer.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { UNSET, createBody, update } from './metric-server-form.ts';\nimport {\n  type MetricServerOtelAttributes,\n  type MetricServerOtelProps,\n  otelAttributes,\n  otelMatches,\n} from './metric-server-otel.ts';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { bool, int, text } from './values.ts';\n\n/**\n * PVE's status plugins. Which one a server is decides which fields it will even accept.\n *\n * ★ `opentelemetry` IS OFFERED SINCE 2026-09-14, AND THE REASON IT WAS NOT STILL HOLDS FOR ANY FIELD\n *   LEFT OUT. Its whole configuration is the `otel-*` family; declared without managing that family\n *   it would build a target whose every meaningful setting sat outside the graph, and report `noop`\n *   over it. metric-server-otel.ts manages every `otel-*` field but two, and says why for each.\n */\nexport type MetricServerType = 'graphite' | 'influxdb' | 'opentelemetry';\n\nexport interface MetricServerProps extends WithTarget, MetricServerOtelProps {\n  /** ⚠️ A `pve-configid` — a letter, then letters, digits, `-` and `_`. A rejected one fails with\n   *   \"invalid configuration ID\", which reads as a broken request rather than as a naming rule. */\n  id: string;\n  /**\n   * ⛔ CREATE-TIME ONLY. The PUT schema has no `type` parameter at all: a section's type is fixed\n   *   when it is written, so the ⛔ in `attributes` turns a changed type into a refusal rather than\n   *   a silent no-op over the wrong target.\n   */\n  type: MetricServerType;\n  /** ⚠️ REQUIRED ON EVERY WRITE, UPDATE INCLUDED — see `required`. */\n  server: string;\n  port: number;\n  /** Keep the section but stop shipping. Unset is an ENABLED target, not an absent one. */\n  disable?: boolean;\n  /**\n   * graphite and influxdb only: UDP MTU (512-65536) and socket/HTTP timeout. Unset leaves PVE's\n   * defaults, 1500 and 1. ⚠️ opentelemetry has neither; its timeout is `otel-timeout`.\n   */\n  mtu?: number;\n  timeout?: number;\n  /** graphite only: the root path metrics are published under, e.g. `proxmox.mycluster`. */\n  path?: string;\n  /**\n   * influxdb only. `udp` is PVE's default and writes line protocol; `http`/`https` use the v2 API,\n   * the only place `organization` and `bucket` mean anything. An unset `verify-certificate` means\n   * VERIFY — PVE's default, and the safe one.\n   * ⚠️ PVE's hyphenated names are kept rather than camelCased, so nothing between here and the form\n   *   body has to remember a mapping.\n   */\n  influxdbproto?: 'udp' | 'http' | 'https';\n  organization?: string;\n  bucket?: string;\n  'api-path-prefix'?: string;\n  'max-body-size'?: number;\n  'verify-certificate'?: boolean;\n  /** ⛔ `never` ON PURPOSE — see the ⛔ in the header. The compile error is the feature. */\n  token?: never;\n}\n\n/**\n * ⛔ NO `digest`, ON PURPOSE. PVE returns one with every read, but it is the digest of the WHOLE\n *   `status.cfg` rather than of this section — declaring a SECOND metric server would rewrite this\n *   one's stored attributes, and comparing it would report an update on a target nobody touched.\n *   ⛔ And no `token`, for the reason the header gives at length.\n * ⚠️ `mtu`, `timeout` and `max-body-size` report `UNSET` when the section carries none, i.e. when\n *   PVE's own default is what the target will use; `verify-certificate` reports that default\n *   directly, because \"absent\" there means the target verifies. `port` reports 0 only for a\n *   malformed section — PVE requires a port — so a plan should say so loudly. The `otel-*` half\n *   follows the same rules; see metric-server-otel.ts.\n */\nexport interface MetricServerAttributes extends MetricServerOtelAttributes {\n  id: string;\n  type: MetricServerType;\n  server: string;\n  port: number;\n  disable: boolean;\n  mtu: number;\n  timeout: number;\n  path: string;\n  influxdbproto: string;\n  organization: string;\n  bucket: string;\n  'api-path-prefix': string;\n  'max-body-size': number;\n  'verify-certificate': boolean;\n}\n\nexport interface ProxmoxMetricServer extends Resource<\n  'Proxmox.MetricServer',\n  MetricServerProps,\n  MetricServerAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxMetricServer = Resource<ProxmoxMetricServer>('Proxmox.MetricServer');\n\n/**\n * The type-specific half of `matches`.\n *\n * ⛔ ONLY FIELDS THIS TYPE ACTUALLY SENDS ARE COMPARED. `verify-certificate` is not in graphite's\n *   option set and `path` is not in influxdb's, so neither is ever sent to the wrong plugin — and\n *   diffing one anyway would report an update that the PUT it triggers cannot satisfy, forever.\n *   `mtu` and `timeout` are compared for graphite and influxdb only, because the opentelemetry\n *   plugin has neither and `optional` never sends them to it.\n */\nconst matchesType = (attributes: MetricServerAttributes, props: MetricServerProps): boolean => {\n  if (props.type === 'opentelemetry') return otelMatches(attributes, props);\n  const socket =\n    attributes.mtu === (props.mtu ?? UNSET) && attributes.timeout === (props.timeout ?? UNSET);\n  if (props.type === 'graphite') return socket && attributes.path === (props.path ?? '');\n  return (\n    socket &&\n    attributes.influxdbproto === (props.influxdbproto ?? '') &&\n    attributes.organization === (props.organization ?? '') &&\n    attributes.bucket === (props.bucket ?? '') &&\n    attributes['api-path-prefix'] === (props['api-path-prefix'] ?? '') &&\n    attributes['max-body-size'] === (props['max-body-size'] ?? UNSET) &&\n    attributes['verify-certificate'] === (props['verify-certificate'] !== false)\n  );\n};\n\nconst handlers = pveHandlers<MetricServerProps, MetricServerAttributes>({\n  attributes: (live, props) => {\n    /**\n     * ⛔ A SERVER OF ANOTHER TYPE IS ANOTHER OBJECT, AND \"ABSENT\" IS THE HONEST ANSWER. `type`\n     *   cannot be changed by a PUT, so reporting the foreign section as missing makes reconcile\n     *   POST instead and PVE refuses because the id is taken — a loud, accurate error rather than a\n     *   PUT pushing influxdb fields at a graphite section. An older PVE that omits `type` from the\n     *   read falls through and is trusted.\n     */\n    const liveType = text(live['type']);\n    if (liveType !== '' && liveType !== props.type) return undefined;\n    return {\n      ...otelAttributes(live),\n      'api-path-prefix': text(live['api-path-prefix']),\n      bucket: text(live['bucket']),\n      disable: bool(live['disable'], false),\n      id: props.id,\n      influxdbproto: text(live['influxdbproto']),\n      'max-body-size': int(live['max-body-size'], UNSET),\n      mtu: int(live['mtu'], UNSET),\n      organization: text(live['organization']),\n      path: text(live['path']),\n      port: int(live['port'], 0),\n      server: text(live['server']),\n      timeout: int(live['timeout'], UNSET),\n      type: props.type,\n      'verify-certificate': bool(live['verify-certificate'], true),\n    };\n  },\n  /** ⛔ THE SAME STRING AS `path`, DELIBERATELY — see the ⛔ in the header. */\n  collection: (props) => `cluster/metrics/server/${props.id}`,\n  /** ⚠️ `type` IS REQUIRED ON CREATE; `id` IS NOT SENT, because the id is the path. */\n  createForm: createBody,\n  /**\n   * The vendor rules both forms are checked against at plan time — resource-spec.ts.\n   * ⚠️ POST AND PUT ARE THE SAME PATH HERE, and they are still two different tables: only the\n   *   POST marks `type` required, and only the PUT accepts `delete` and `digest`.\n   */\n  endpoint: {\n    create: 'pve:POST /cluster/metrics/server/{id}',\n    update: 'pve:PUT /cluster/metrics/server/{id}',\n  },\n  /**\n   * ⛔ `id` and `type` are absent: one is the key the object was read by, the other is refused\n   *   rather than updated. Everything type-specific is `matchesType`'s, above.\n   */\n  matches: (attributes, props) =>\n    attributes.server === props.server &&\n    attributes.port === props.port &&\n    attributes.disable === (props.disable === true) &&\n    matchesType(attributes, props),\n  path: (props) => `cluster/metrics/server/${props.id}`,\n  /** The form and its clear-list, from the one table in metric-server-form.ts. */\n  updateForm: update,\n});\n\n/**\n * ⛔ THE EMPTY `list` FROM `pveHandlers` EARNS ITS KEEP HERE. `GET cluster/metrics/server` answers\n *   with every target the cluster already ships to, including the one somebody configured by hand\n *   years ago; adopting that is how a later `alchemy destroy` silences a graph nobody declared.\n * ⚠️ AND NOTHING BRAKES THIS DESTROY. A pool refuses while it holds guests, a container while it\n *   runs; a metric server just leaves `status.cfg`, the cluster stops shipping on the next\n *   interval, and no guest or task is affected. The plan diff is the only warning anyone gets —\n *   the top of this file again, this time caused by a deploy.\n */\nexport const ProxmoxMetricServerProvider = () =>\n  Provider.effect(ProxmoxMetricServer, Effect.succeed(ProxmoxMetricServer.Provider.of(handlers)));\n",
+    "/**\n * `Proxmox.MetricServer` — where the cluster ships its metrics, declared.\n *\n * ★ THE FAILURE THIS PREVENTS IS A SILENT ONE, WHICH IS THE WHOLE ARGUMENT FOR DECLARING IT.\n *   Undeclared, the target exists only as a section of `/etc/pve/status.cfg`: rebuild a node,\n *   re-add one to the cluster, or restore a config from before it was configured, and the cluster\n *   stops shipping. Nothing fails, no task errors, no alert fires — the graphs go flat, and the\n *   first to find out is whoever went looking for a number that was not there.\n *\n * ⛔ CREATE IS `POST cluster/metrics/server/{id}` — THE OBJECT'S OWN PATH — SO `collection()`\n *   RETURNS THE SAME STRING AS `path()`, AND THAT IS NOT A TYPO. MEASURED: a POST to the\n *   collection answers \"Method 'POST /cluster/metrics/server' not implemented\", while the id path\n *   gets as far as a permission check (`/`, Sys.Modify); the published schema agrees, giving the\n *   collection a GET and nothing else. `createForm` omits `id` for the same reason — it is already\n *   the last segment of the path being POSTed to, and a second copy can only disagree with it.\n *\n * ⛔ THE `token` IS WRITE-ONLY AND MUST NEVER BECOME AN ATTRIBUTE. Alchemy persists attributes\n *   UNENCRYPTED, so one that reached state would outlive the change that set it, in the state\n *   store and in every backup of it. It is `never` in the props below — declaring one is a COMPILE\n *   ERROR rather than a leak found months later — and absent from `optional`, for the reason\n *   given there. Set it out of band; PVE never returns it on a read anyway. `otel-headers`, where an\n *   opentelemetry server's bearer token lives, gets the same treatment in metric-server-otel.ts.\n *\n * ⚠️ PRIVILEGES, AND THIS IS A BIGGER ASK THAN IT LOOKS. Read and diff are fine under an auditor\n *   lease — the single-object GET checks `Sys.Audit` on `/` — while create, update and delete all\n *   check `Sys.Modify` on `/` and answer \"Permission check failed (/, Sys.Modify)\" until the role\n *   is widened. Widen it knowingly: the ACL path is the ROOT and there is no `/metrics` object to\n *   scope to, so `Sys.Modify` also buys datacenter options, notification targets and every other\n *   cluster-wide config write. A separate role for metric writes is the narrower answer.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as cluster from '@distilled.cloud/proxmox/cluster';\nimport { runPve } from './distilled-pve.ts';\nimport { specGuards } from './resource-guard.ts';\nimport { formToSend } from './update-guard.ts';\nimport { metricServerSpec } from './metric-server-config.ts';\nimport {\n  deleteMetricServer,\n  metricServerRequest,\n  readMetricServer,\n} from './metric-server-distilled.ts';\n\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport {\n  type MetricServerOtelAttributes,\n  type MetricServerOtelProps,\n} from './metric-server-otel.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\n\n/**\n * PVE's status plugins. Which one a server is decides which fields it will even accept.\n *\n * ★ `opentelemetry` IS OFFERED SINCE 2026-09-14, AND THE REASON IT WAS NOT STILL HOLDS FOR ANY FIELD\n *   LEFT OUT. Its whole configuration is the `otel-*` family; declared without managing that family\n *   it would build a target whose every meaningful setting sat outside the graph, and report `noop`\n *   over it. metric-server-otel.ts manages every `otel-*` field but two, and says why for each.\n */\nexport type MetricServerType = 'graphite' | 'influxdb' | 'opentelemetry';\n\nexport interface MetricServerProps extends WithTarget, MetricServerOtelProps {\n  /** ⚠️ A `pve-configid` — a letter, then letters, digits, `-` and `_`. A rejected one fails with\n   *   \"invalid configuration ID\", which reads as a broken request rather than as a naming rule. */\n  id: string;\n  /**\n   * ⛔ CREATE-TIME ONLY. The PUT schema has no `type` parameter at all: a section's type is fixed\n   *   when it is written, so the ⛔ in `attributes` turns a changed type into a refusal rather than\n   *   a silent no-op over the wrong target.\n   */\n  type: MetricServerType;\n  /** ⚠️ REQUIRED ON EVERY WRITE, UPDATE INCLUDED — see `required`. */\n  server: string;\n  port: number;\n  /** Keep the section but stop shipping. Unset is an ENABLED target, not an absent one. */\n  disable?: boolean;\n  /**\n   * graphite and influxdb only: UDP MTU (512-65536) and socket/HTTP timeout. Unset leaves PVE's\n   * defaults, 1500 and 1. ⚠️ opentelemetry has neither; its timeout is `otel-timeout`.\n   */\n  mtu?: number;\n  timeout?: number;\n  /** graphite only: the root path metrics are published under, e.g. `proxmox.mycluster`. */\n  path?: string;\n  /**\n   * influxdb only. `udp` is PVE's default and writes line protocol; `http`/`https` use the v2 API,\n   * the only place `organization` and `bucket` mean anything. An unset `verify-certificate` means\n   * VERIFY — PVE's default, and the safe one.\n   * ⚠️ PVE's hyphenated names are kept rather than camelCased, so nothing between here and the form\n   *   body has to remember a mapping.\n   */\n  influxdbproto?: 'udp' | 'http' | 'https';\n  organization?: string;\n  bucket?: string;\n  'api-path-prefix'?: string;\n  'max-body-size'?: number;\n  'verify-certificate'?: boolean;\n  /** ⛔ `never` ON PURPOSE — see the ⛔ in the header. The compile error is the feature. */\n  token?: never;\n}\n\n/**\n * ⛔ NO `digest`, ON PURPOSE. PVE returns one with every read, but it is the digest of the WHOLE\n *   `status.cfg` rather than of this section — declaring a SECOND metric server would rewrite this\n *   one's stored attributes, and comparing it would report an update on a target nobody touched.\n *   ⛔ And no `token`, for the reason the header gives at length.\n * ⚠️ `mtu`, `timeout` and `max-body-size` report `UNSET` when the section carries none, i.e. when\n *   PVE's own default is what the target will use; `verify-certificate` reports that default\n *   directly, because \"absent\" there means the target verifies. `port` reports 0 only for a\n *   malformed section — PVE requires a port — so a plan should say so loudly. The `otel-*` half\n *   follows the same rules; see metric-server-otel.ts.\n */\nexport interface MetricServerAttributes extends MetricServerOtelAttributes {\n  id: string;\n  type: MetricServerType;\n  server: string;\n  port: number;\n  disable: boolean;\n  mtu: number;\n  timeout: number;\n  path: string;\n  influxdbproto: string;\n  organization: string;\n  bucket: string;\n  'api-path-prefix': string;\n  'max-body-size': number;\n  'verify-certificate': boolean;\n}\n\nexport interface ProxmoxMetricServer extends Resource<\n  'Proxmox.MetricServer',\n  MetricServerProps,\n  MetricServerAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxMetricServer = Resource<ProxmoxMetricServer>('Proxmox.MetricServer');\n\n/**\n * ⛔ THE EMPTY `list` KEEPS ADOPTION EXPLICIT. `GET cluster/metrics/server` answers\n *   with every target the cluster already ships to, including the one somebody configured by hand\n *   years ago; adopting that is how a later `alchemy destroy` silences a graph nobody declared.\n * ⚠️ AND NOTHING BRAKES THIS DESTROY. A pool refuses while it holds guests, a container while it\n *   runs; a metric server just leaves `status.cfg`, the cluster stops shipping on the next\n *   interval, and no guest or task is affected. The plan diff is the only warning anyone gets —\n *   the top of this file again, this time caused by a deploy.\n */\nconst { guardCreate, guardUpdate } = specGuards(metricServerSpec);\n\n/** SDK lifecycle walked against pve-manager 9.2.11; failed reads never imply create. */\nexport const ProxmoxMetricServerProvider = () =>\n  Provider.effect(\n    ProxmoxMetricServer,\n    Effect.succeed(\n      ProxmoxMetricServer.Provider.of({\n        list: () => Effect.succeed([]),\n        read: ({ olds }) => readMetricServer(olds),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardCreate(news, output === undefined);\n          yield* guardUpdate(news);\n          if (output === undefined) return undefined;\n          const live = yield* readMetricServer(news);\n          if (live === undefined) {\n            yield* guardCreate(news, true);\n            return { action: 'update' } as const;\n          }\n          return { action: metricServerSpec.matches(live, news) ? 'noop' : 'update' } as const;\n        }),\n        reconcile: Effect.fn(function* ({ news }) {\n          const live = yield* readMetricServer(news);\n          yield* guardCreate(news, live === undefined);\n          yield* guardUpdate(news);\n          if (live === undefined) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              cluster.updateClusterMetricsServer({\n                ...metricServerRequest(news, metricServerSpec.createForm(news)),\n                type: news.type,\n              }),\n            );\n          } else {\n            const form = formToSend(\n              metricServerSpec.matches,\n              live,\n              news,\n              metricServerSpec.updateForm(news),\n            );\n            if (form !== undefined)\n              yield* runPve(\n                news.target,\n                'provision',\n                true,\n                cluster.putClusterMetricsServer(metricServerRequest(news, form)),\n              );\n          }\n          const after = yield* readMetricServer(news);\n          if (after === undefined)\n            return yield* Effect.fail(\n              new Error(\n                `${metricServerSpec.path(news)}: write returned success but the resource is still absent`,\n              ),\n            );\n          return after;\n        }),\n        delete: ({ olds }) => deleteMetricServer(olds),\n      }),\n    ),\n  );\n",
     "/**\n * A metric server's props, as the form PVE wants.\n *\n * ★ SPLIT OUT OF metric-server.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is a\n *   real one rather than a convenient line number: this file answers \"how does a declaration\n *   become a PVE form\", and metric-server.ts answers \"what is a metric server and when has it\n *   changed\". Nothing here reads the cluster and nothing here decides a diff.\n *\n * ⚠️ THE `import type` BACK TO metric-server.ts IS A CYCLE ON PAPER ONLY. It is type-only, so it\n *   is erased before anything runs — `MetricServerProps` stays the resource's public shape, in the\n *   file that declares the resource, rather than being moved somewhere odd to dodge the arrow.\n *   metric-server-otel.ts imports `UNSET` from here and this file imports nothing back from it,\n *   so no runtime cycle exists either.\n */\nimport type { MetricServerProps } from './metric-server.ts';\nimport { withClears } from './values.ts';\n\n/**\n * ⚠️ \"NOT SET\" CANNOT BE 0 HERE, WHICH IS WHY IT IS -1. `timeout` has a minimum of 0 in PVE's\n *   schema, so a deliberate `timeout 0` exists; a provider using 0 as its absent-marker reads that\n *   zero as \"unset\" and never clears it. -1 is outside every one of these fields' ranges.\n */\nexport const UNSET = -1;\n\nconst str = (value: number | undefined) => (value === undefined ? undefined : String(value));\n\n/**\n * Every managed optional, per type: the value to send, or undefined for \"clear it\".\n *\n * ⛔ ONE TABLE FEEDS BOTH HALVES OF AN UPDATE, AND THAT IS THE POINT. A PUT THAT OMITS A FIELD DOES\n *   NOT CLEAR IT — PVE merges the form into the existing section — so a managed optional needs a\n *   matching `delete=` the moment its prop goes away, or `matches` reports an update on every plan\n *   forever. Deriving the form and the delete list from one map makes \"managed but not clearable\"\n *   impossible to write here, which a separate clear-list would not.\n * ⛔ NOTHING SET OUT OF BAND MAY BE LISTED HERE, `token` FIRST AMONG THEM: a field in this map is\n *   CLEARED whenever it is undeclared, so adding the token would strip a working target's\n *   credential on the next plan — metrics stop, nothing errors, the graph goes flat. `otel-headers`\n *   is absent for the same reason: it is where an OTLP server's bearer token lives.\n * ⚠️ AND THE BRANCHES CANNOT BE ONE SHARED MAP. PVE validates a section against that plugin's own\n *   option set, so `path` on an influxdb server is a hard 400 and `delete=path` there answers \"no\n *   such option\" — neither is an ignored hint. The opentelemetry plugin has no `mtu` and no\n *   `timeout` at all (its option list is `server`, `port`, `disable` and the `otel-*` family), so\n *   that branch carries neither.\n * ⚠️ graphite's `proto` (udp or tcp) is deliberately absent: a transport chosen by hand stays put\n *   and no plan diffs it. Managing it means adding it HERE, where it is clearable by construction.\n *   `otel-resource-attributes` is absent for the reason metric-server-otel.ts gives.\n */\nexport const optional = (props: MetricServerProps): Record<string, string | undefined> => {\n  switch (props.type) {\n    case 'graphite':\n      return { mtu: str(props.mtu), path: props.path, timeout: str(props.timeout) };\n    case 'influxdb':\n      return {\n        'api-path-prefix': props['api-path-prefix'],\n        bucket: props.bucket,\n        influxdbproto: props.influxdbproto,\n        'max-body-size': str(props['max-body-size']),\n        mtu: str(props.mtu),\n        organization: props.organization,\n        timeout: str(props.timeout),\n      };\n    case 'opentelemetry':\n      return {\n        'otel-compression': props['otel-compression'],\n        'otel-max-body-size': str(props['otel-max-body-size']),\n        'otel-path': props['otel-path'],\n        'otel-protocol': props['otel-protocol'],\n        'otel-timeout': str(props['otel-timeout']),\n      };\n  }\n};\n\n/**\n * The certificate-verification flag, for the one plugin that owns it.\n *\n * ⛔ EACH FLAG GOES ONLY TO ITS OWN PLUGIN. `verify-certificate` is influxdb's, `otel-verify-ssl` is\n *   opentelemetry's, graphite has neither — and PVE refuses an option outside the section's plugin\n *   rather than ignoring it, the same way it refuses `path` on influxdb.\n */\nconst verification = (props: MetricServerProps): Record<string, string> => {\n  switch (props.type) {\n    case 'graphite':\n      return {};\n    case 'influxdb':\n      return { 'verify-certificate': props['verify-certificate'] === false ? '0' : '1' };\n    case 'opentelemetry':\n      return { 'otel-verify-ssl': props['otel-verify-ssl'] === false ? '0' : '1' };\n  }\n};\n\n/**\n * The fields sent on EVERY write, create and update alike.\n *\n * ⚠️ `server` AND `port` ARE REQUIRED BY THE PUT TOO, not only by the POST: a PUT that omits either\n *   fails parameter verification rather than leaving them alone. PVE also refuses to clear them —\n *   \"unable to delete required option\" — which is why they are here and not in `optional`.\n * ⚠️ `disable` AND THE VERIFY FLAG ARE SENT WITH THEIR DEFAULTS rather than left out. Writing the\n *   value PVE would have assumed makes the read-back match on the first plan after the create,\n *   whether or not that PVE materialises defaults into the file.\n */\nconst required = (props: MetricServerProps): Record<string, string> => ({\n  disable: props.disable === true ? '1' : '0',\n  port: String(props.port),\n  server: props.server,\n  ...verification(props),\n});\n\nexport const body = (props: MetricServerProps) => {\n  const fields = required(props);\n  for (const [option, value] of Object.entries(optional(props))) {\n    if (value !== undefined) fields[option] = value;\n  }\n  return fields;\n};\n\n/**\n * An update's form: everything `body` sends, plus a `delete=` naming each managed optional that is\n * no longer declared.\n *\n * ★ MOVED HERE FROM metric-server.ts UNCHANGED, so the test beside this file can reach the form an\n *   update really sends instead of re-deriving it and testing its own copy.\n */\nexport const update = (props: MetricServerProps) => {\n  const clear = Object.entries(optional(props))\n    .filter(([, value]) => value === undefined)\n    .map(([option]) => option);\n  return withClears(body(props), clear);\n};\n\n/**\n * The create form: `body` plus the one field only a POST takes.\n *\n * ★ EXPORTED SO THE CONSTRAINT PROOF CAN RUN THE REAL FORM. `metric-server.ts` built this inline\n *   in its spec, which meant the only way to check it against PVE's table was to retype it in a\n *   test — and a retyped form proves the test, not the provider.\n * ⚠️ `type` IS REQUIRED ON CREATE AND REFUSED ON UPDATE; `id` is the path, never the body.\n */\nexport const createBody = (props: MetricServerProps) => ({ ...body(props), type: props.type });\n",
     "/**\n * The `opentelemetry` plugin's option set: what a metric server of that type accepts, how it reads\n * back, and when it has changed.\n *\n * ★ SPLIT OUT OF metric-server.ts TO KEEP IT UNDER THE 250-LINE CAP, AND THE SEAM IS THE PLUGIN.\n *   PVE validates a section against ONE plugin's option set, so these fields mean nothing to a\n *   graphite or influxdb section and theirs mean nothing here. This file answers \"what is an OTLP\n *   metric server\"; metric-server-form.ts still builds every form, so the clear-list keeps coming\n *   from the one table that also builds the body.\n *\n * ⛔ PVE'S OTLP EXPORTER SPEAKS JSON AND NOTHING ELSE. `PVE::Status::OpenTelemetry::send` sets\n *   `Content-Type: application/json` (pve-manager PVE/Status/OpenTelemetry.pm:643) and gzips by\n *   default; there is no protobuf option. vector's opentelemetry source and VictoriaMetrics both\n *   take protobuf only — measured 2026-09-14 — so a server pointed straight at either fails every\n *   push. That is why C1's declaration points at each node's own vector bridge\n *   (the estate's per-node vector config) rather than at the estate's intake.\n *\n * ⛔ `otel-headers` IS `never`, FOR THE REASON `token` IS. It is where an OTLP bearer token goes —\n *   base64 of a JSON object of arbitrary HTTP headers — and Alchemy persists attributes UNENCRYPTED.\n *   It is also absent from `optional` in metric-server-form.ts, so an undeclared one is never\n *   cleared off a working target on the next plan.\n *\n * ⚠️ `otel-resource-attributes` IS NOT MANAGED AT ALL: not a prop, not read, not compared, not\n *   cleared. It is base64 of a JSON object whose key order nothing canonicalises, so comparing it\n *   means decoding both sides — work with no consumer yet, since nothing sets it and PVE already\n *   stamps `service.name`, `proxmox.cluster` and `proxmox.node` on every request\n *   (`_build_otlp_metrics`, lines 207-228). A hand-set one therefore survives every plan and never\n *   shows as drift. The day one matters, it goes into `optional` and here together.\n */\nimport { UNSET } from './metric-server-form.ts';\nimport { bool, int, text } from './values.ts';\n\nexport interface MetricServerOtelProps {\n  /**\n   * ⚠️ PVE'S DEFAULT IS `https`. `http` is for a receiver on the node itself, where the plaintext\n   *   never leaves the host; anything further away belongs on `https`.\n   */\n  'otel-protocol'?: 'http' | 'https';\n  /** Unset is PVE's `/v1/metrics`. */\n  'otel-path'?: string;\n  /** Unset is PVE's `gzip`, sent as `Content-Encoding: gzip`. */\n  'otel-compression'?: 'none' | 'gzip';\n  /**\n   * Per-request HTTP timeout, 1-10 seconds; unset is PVE's 5.\n   * ⚠️ pvestatd WAITS THIS LONG, PER REQUEST, AGAINST A RECEIVER THAT HANGS — the send is inline in\n   *   its update loop (`send`, line 635) — so this is also how long a broken receiver can stretch\n   *   one status cycle.\n   */\n  'otel-timeout'?: number;\n  /** Minimum 1024; unset is PVE's 10000000. pvestatd splits one flush into requests under it. */\n  'otel-max-body-size'?: number;\n  /** ⚠️ An unset `otel-verify-ssl` means VERIFY — PVE's default, and the safe one. */\n  'otel-verify-ssl'?: boolean;\n  /** ⛔ `never` ON PURPOSE — see the ⛔ in the header. The compile error is the feature. */\n  'otel-headers'?: never;\n}\n\n/**\n * ⚠️ THE SAME RULES AS THE REST OF `MetricServerAttributes`. The strings report `''` when the\n *   section carries none — PVE's default is then what the target uses — the numbers report `UNSET`\n *   for the same reason, and `otel-verify-ssl` reports its default directly, because \"absent\"\n *   there means the target verifies.\n */\nexport interface MetricServerOtelAttributes {\n  'otel-compression': string;\n  'otel-max-body-size': number;\n  'otel-path': string;\n  'otel-protocol': string;\n  'otel-timeout': number;\n  'otel-verify-ssl': boolean;\n}\n\n/** The `otel-*` half of a live section. Read for every type; compared only for this one. */\nexport const otelAttributes = (live: Record<string, unknown>): MetricServerOtelAttributes => ({\n  'otel-compression': text(live['otel-compression']),\n  'otel-max-body-size': int(live['otel-max-body-size'], UNSET),\n  'otel-path': text(live['otel-path']),\n  'otel-protocol': text(live['otel-protocol']),\n  'otel-timeout': int(live['otel-timeout'], UNSET),\n  'otel-verify-ssl': bool(live['otel-verify-ssl'], true),\n});\n\n/**\n * True when every managed `otel-*` field already says what the declaration says.\n *\n * ⛔ EVERY FIELD `optional` SENDS OR CLEARS IS COMPARED HERE, AND NOTHING ELSE IS. A field sent but\n *   not compared is drift a plan can never show; a field compared but not sent is an update the\n *   PUT it triggers can never satisfy, reported forever.\n */\nexport const otelMatches = (\n  attributes: MetricServerOtelAttributes,\n  props: MetricServerOtelProps,\n): boolean =>\n  attributes['otel-compression'] === (props['otel-compression'] ?? '') &&\n  attributes['otel-max-body-size'] === (props['otel-max-body-size'] ?? UNSET) &&\n  attributes['otel-path'] === (props['otel-path'] ?? '') &&\n  attributes['otel-protocol'] === (props['otel-protocol'] ?? '') &&\n  attributes['otel-timeout'] === (props['otel-timeout'] ?? UNSET) &&\n  attributes['otel-verify-ssl'] === (props['otel-verify-ssl'] !== false);\n",
+    "/** Pure existing forms, normalization and equality, shared by plan and SDK lifecycle. */\nimport type { MetricServerAttributes, MetricServerProps } from './metric-server.ts';\nimport type { PveSpec } from './resource-spec.ts';\nimport { UNSET, createBody, update } from './metric-server-form.ts';\nimport { otelAttributes, otelMatches } from './metric-server-otel.ts';\nimport { bool, int, text } from './values.ts';\n\n/**\n * The type-specific half of `matches`.\n *\n * ⛔ ONLY FIELDS THIS TYPE ACTUALLY SENDS ARE COMPARED. `verify-certificate` is not in graphite's\n *   option set and `path` is not in influxdb's, so neither is ever sent to the wrong plugin — and\n *   diffing one anyway would report an update that the PUT it triggers cannot satisfy, forever.\n *   `mtu` and `timeout` are compared for graphite and influxdb only, because the opentelemetry\n *   plugin has neither and `optional` never sends them to it.\n */\nconst matchesType = (attributes: MetricServerAttributes, props: MetricServerProps): boolean => {\n  if (props.type === 'opentelemetry') return otelMatches(attributes, props);\n  const socket =\n    attributes.mtu === (props.mtu ?? UNSET) && attributes.timeout === (props.timeout ?? UNSET);\n  if (props.type === 'graphite') return socket && attributes.path === (props.path ?? '');\n  return (\n    socket &&\n    attributes.influxdbproto === (props.influxdbproto ?? '') &&\n    attributes.organization === (props.organization ?? '') &&\n    attributes.bucket === (props.bucket ?? '') &&\n    attributes['api-path-prefix'] === (props['api-path-prefix'] ?? '') &&\n    attributes['max-body-size'] === (props['max-body-size'] ?? UNSET) &&\n    attributes['verify-certificate'] === (props['verify-certificate'] !== false)\n  );\n};\n\nexport const metricServerSpec = {\n  attributes: (live, props) => {\n    /**\n     * ⛔ A SERVER OF ANOTHER TYPE IS ANOTHER OBJECT, AND \"ABSENT\" IS THE HONEST ANSWER. `type`\n     *   cannot be changed by a PUT, so reporting the foreign section as missing makes reconcile\n     *   POST instead and PVE refuses because the id is taken — a loud, accurate error rather than a\n     *   PUT pushing influxdb fields at a graphite section. An older PVE that omits `type` from the\n     *   read falls through and is trusted.\n     */\n    const liveType = text(live['type']);\n    if (liveType !== '' && liveType !== props.type) return undefined;\n    return {\n      ...otelAttributes(live),\n      'api-path-prefix': text(live['api-path-prefix']),\n      bucket: text(live['bucket']),\n      disable: bool(live['disable'], false),\n      id: props.id,\n      influxdbproto: text(live['influxdbproto']),\n      'max-body-size': int(live['max-body-size'], UNSET),\n      mtu: int(live['mtu'], UNSET),\n      organization: text(live['organization']),\n      path: text(live['path']),\n      port: int(live['port'], 0),\n      server: text(live['server']),\n      timeout: int(live['timeout'], UNSET),\n      type: props.type,\n      'verify-certificate': bool(live['verify-certificate'], true),\n    };\n  },\n  /** ⛔ THE SAME STRING AS `path`, DELIBERATELY — see the ⛔ in the header. */\n  collection: (props) => `cluster/metrics/server/${props.id}`,\n  /** ⚠️ `type` IS REQUIRED ON CREATE; `id` IS NOT SENT, because the id is the path. */\n  createForm: createBody,\n  /**\n   * The vendor rules both forms are checked against at plan time — resource-spec.ts.\n   * ⚠️ POST AND PUT ARE THE SAME PATH HERE, and they are still two different tables: only the\n   *   POST marks `type` required, and only the PUT accepts `delete` and `digest`.\n   */\n  endpoint: {\n    create: 'pve:POST /cluster/metrics/server/{id}',\n    update: 'pve:PUT /cluster/metrics/server/{id}',\n  },\n  /**\n   * ⛔ `id` and `type` are absent: one is the key the object was read by, the other is refused\n   *   rather than updated. Everything type-specific is `matchesType`'s, above.\n   */\n  matches: (attributes, props) =>\n    attributes.server === props.server &&\n    attributes.port === props.port &&\n    attributes.disable === (props.disable === true) &&\n    matchesType(attributes, props),\n  path: (props) => `cluster/metrics/server/${props.id}`,\n  /** The form and its clear-list, from the one table in metric-server-form.ts. */\n  updateForm: update,\n} satisfies PveSpec<MetricServerProps, MetricServerAttributes>;\n",
+    "/** Metric-server SDK transport; pve-manager 9.2.11, no change to managed/secret fields. */\nimport * as cluster from '@distilled.cloud/proxmox/cluster';\nimport { ProxmoxParseError } from '@distilled.cloud/proxmox/Errors';\nimport * as Effect from 'effect/Effect';\nimport * as Schema from 'effect/Schema';\nimport { asForm } from './distilled-guard.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { metricServerSpec } from './metric-server-config.ts';\nimport type { MetricServerProps } from './metric-server.ts';\n\n/**\n * The vendor intentionally leaves this plugin-dependent response unstructured in its\n * schema. Decode only the object envelope, then use the existing per-plugin normalization.\n * A malformed response fails without including header credentials in a schema diagnostic.\n */\nexport const readMetricServerRow = (props: MetricServerProps) =>\n  runPve(props.target, 'read', false, cluster.getClusterMetricsServer({ id: props.id })).pipe(\n    Effect.flatMap((body) =>\n      Schema.decodeUnknownEffect(Schema.Record(Schema.String, Schema.Unknown))(body).pipe(\n        Effect.mapError(\n          () =>\n            new ProxmoxParseError({\n              body: undefined,\n              cause: 'Metric server response must be an object',\n            }),\n        ),\n      ),\n    ),\n    Effect.catchTag('MetricServerNotFound', () => Effect.succeed(undefined)),\n    Effect.catchTag('NotFound', () => Effect.succeed(undefined)),\n  );\n\nexport const readMetricServer = (props: MetricServerProps) =>\n  readMetricServerRow(props).pipe(\n    Effect.map((row) => (row === undefined ? undefined : metricServerSpec.attributes(row, props))),\n  );\n\n/** Map only the existing form's declared keys; token and otel-headers never enter this map. */\nexport const metricServerRequest = (\n  props: MetricServerProps,\n  form: Record<string, string>,\n): cluster.PutClusterMetricsServerRequest => ({\n  ...asForm({\n    api_path_prefix: form['api-path-prefix'],\n    bucket: form['bucket'],\n    delete: form['delete'],\n    disable: form['disable'],\n    influxdbproto: form['influxdbproto'],\n    max_body_size: form['max-body-size'],\n    mtu: form['mtu'],\n    organization: form['organization'],\n    otel_compression: form['otel-compression'],\n    otel_max_body_size: form['otel-max-body-size'],\n    otel_path: form['otel-path'],\n    otel_protocol: form['otel-protocol'],\n    otel_timeout: form['otel-timeout'],\n    otel_verify_ssl: form['otel-verify-ssl'],\n    path: form['path'],\n    timeout: form['timeout'],\n    verify_certificate: form['verify-certificate'],\n  } satisfies { [K in keyof cluster.PutClusterMetricsServerRequest]?: string | undefined }),\n  id: props.id,\n  port: String(props.port),\n  server: props.server,\n});\n\n/**\n * Vendor DELETE dereferences the plugin without an absent-row check (MetricServer.pm:293).\n * A typed GET miss therefore skips DELETE. A race or any other SDK error still propagates;\n * never reinterpret an arbitrary 500 from deleting an invalid section as success.\n */\nexport const deleteMetricServer = (props: MetricServerProps) =>\n  Effect.gen(function* () {\n    if ((yield* readMetricServerRow(props)) === undefined) return;\n    yield* runPve(\n      props.target,\n      'provision',\n      true,\n      cluster.deleteClusterMetricsServer({ id: props.id }),\n    );\n  });\n",
     "/**\n * `Proxmox.NetworkApply` — the call that makes a declared interfaces file real, ON ONE NODE.\n *\n * ⛔ WITHOUT IT EVERY NETWORK DECLARATION IS A GREEN PLAN THAT CHANGES NO NETWORK; WITH IT A GREEN\n *   PLAN CAN TAKE A NODE OFF THE NETWORK. Writes under `nodes/{node}/network/{iface}` edit\n *   `/etc/network/interfaces.new` and touch no interface. `PUT /nodes/{node}/network` is the apply.\n *   MEASURED in the cluster's own source on node-b, 2026-09-13 — `PVE/API2/Network.pm`:\n *       rename($new_config_file, $current_config_file) if -e $new_config_file;\n *       PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err);\n *       return $rpcenv->fork_worker('srvreload', 'networking', $authuser, $worker);\n *\n * ⛔ THIS IS THE MOST DANGEROUS RESOURCE IN THE PACKAGE, AND ON C1 THE DANGER IS NOT ABSTRACT.\n *   Ceph runs over `vmbr1.42` on node-b, node-c AND node-d (MEASURED 2026-09-13: four pools, size 3 /\n *   min_size 2, mon+mgr+mds on all three). `ifreload -a` takes that node's OSDs, mons and MDS off\n *   the cluster network for the length of the reload; two nodes at once puts every pool below\n *   min_size and blocks IO for every guest with an RBD disk. The management address the API is\n *   reached on, `vmbr0.41`, is reloaded by the same call.\n *\n * ⛔ AND UNLIKE `SdnApply` IT IS PER NODE, SO A HALF-RECONFIGURED CLUSTER IS THE DEFAULT FAILURE\n *   MODE, NOT AN EDGE CASE. `PUT /cluster/sdn` publishes the whole cluster in one call; this\n *   publishes exactly one node, so a stack holding three of these can apply node-b, fail, and leave node-c\n *   and node-d on the old layout with Ceph spanning all three. Four things here exist only for that:\n *     1. `after` SERIALISES THEM — chain node-c after node-b and node-d after node-c, so at most one node is ever\n *        mid-reload. Three declared in parallel is the outage, and nothing in Alchemy stops you.\n *     2. `reconcile` REFUSES TO START on a cluster that is already degraded.\n *     3. `reconcile` RE-CHECKS quorum and every member's `online` flag AFTER the reload and dies if\n *        the cluster came back worse — which stops the chain before it reaches the second node.\n *     4. NOTHING IS EVER APPLIED WITH NOTHING STAGED. See the first branch of `apply`.\n *\n * ⚠️ IF THE MEMBER SERVING THE POLL IS THE NODE BEING RELOADED, the reload can drop the connection\n *   carrying its own status poll — see network-apply-read.ts. Every endpoint is `proxyto =>\n *   'node'`, so any cluster member can serve any other node's paths; failover in client.ts picks\n *   whichever member is up, not necessarily one you are not applying.\n *\n * ⚠️ `DELETE /nodes/{node}/network` IS THE REVERT, AND IT IS DELIBERATELY NOT WIRED TO `delete`.\n *   MEASURED: the whole body of `revert_network_changes` is `unlink \"/etc/network/interfaces.new\"`.\n *   It discards STAGED edits and cannot undo an APPLIED one, so pointing `delete` at it would throw\n *   away whatever happened to be staged the moment somebody removed a line from a stack file — the\n *   worst possible time to do it. Revert by hand, deliberately: `pvesh delete /nodes/<node>/network`.\n *\n * ⚠️ PRIVILEGES, so widening stays a deliberate act: the `read` role needs nothing for the pending\n *   read (`GET /nodes/{node}/network` is `\"user\": \"all\"`) and `Sys.Audit` on `/` for the health\n *   gate; the `provision` role needs `Sys.Modify` on `/nodes/{node}` for the apply, and owns the\n *   task it starts so it can poll it without `Sys.Audit`. ⛔ `Sys.Modify` ON A NODE IS NOT A SMALL\n *   GRANT — it also carries that node's DNS, hosts file, time and service configuration. Granting\n *   it cluster-wide to run this resource widens the provisioning role well beyond networking.\n *\n * ⛔ STAYS ON `client.ts` (2026-09-24) — network-apply-read.ts's header has the two MEASURED reasons.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { guardNetworkApply } from './apply-endpoints.ts';\nimport { pveWith } from './client.ts';\nimport { mint } from './mint.ts';\nimport { awaitTask, degradedReason, pendingCount } from './network-apply-read.ts';\nimport type { PveRequirements } from './resource.ts';\nimport type { WithTarget } from './resource.ts';\n\nexport interface NetworkApplyProps extends WithTarget {\n  /**\n   * The node whose staged interfaces file this applies — `node-b`.\n   *\n   * ⚠️ ONE APPLY PER NODE, AND NEVER TWO FOR THE SAME NODE. Two would each publish the other's\n   *   staged half, and both would run `ifreload` on a file the other had not finished writing.\n   */\n  node: string;\n\n  /**\n   * The staged interface changes this apply publishes, and the apply that must go before it.\n   *\n   * ⚠️ IT IS NEVER READ, AND IT IS NOT DECORATION — the same contract as `SdnApply.after`. Alchemy\n   *   orders resources by DATA FLOW, so consuming an attribute is the only way to say \"after\".\n   *   Pass the interfaces this node declares AND the previous node's apply:\n   *   `after: [vmbr1.iface, n2Apply.pending]`. Leave the previous apply out and the three nodes\n   *   reload in parallel, which is the one thing this resource is built to prevent.\n   */\n  after?: readonly unknown[];\n}\n\nexport interface NetworkApplyAttributes {\n  /** The node this applies. Identity, echoed so a plan line says which member it will reload. */\n  node: string;\n\n  /**\n   * Changed lines still staged on this node.\n   *\n   * ⚠️ LINES OF A UNIFIED DIFF, NOT INTERFACES, and the number is reported rather than trusted —\n   *   `pendingLines` explains why it can undercount by one and never to zero. Zero is the only\n   *   settled value: anything above it means the running config and the staged config disagree,\n   *   whether this stack staged it or somebody edited the node in the UI and walked away.\n   *\n   * ⛔ THE DIFF ITSELF IS NEVER AN ATTRIBUTE. Alchemy writes attributes to its state store\n   *   UNENCRYPTED, and `/etc/network/interfaces` can carry a `wpa-psk` or a `pre-up` command. Only\n   *   the count leaves `network-apply-read.ts`.\n   *\n   * ⚠️ AND NOTHING OUT OF THE INTERFACE ROWS IS AN ATTRIBUTE EITHER, WHICH IS WHAT KEEPS THIS\n   *   FAMILY NOOP. `GET /nodes/{node}/network` returns eighteen fields it will not accept on write\n   *   — MEASURED by differencing the schema's GET return properties against its POST parameters:\n   *   `active`, `exists`, `families`, `method`, `method6`, `options`, `priority`, `link-type` and\n   *   ten more; `altnames` is returned and is not even in the schema. `priority` is the worst of\n   *   them: PVE ASSIGNS it from the order of the interfaces file, so the same logical layout\n   *   carries different numbers on different nodes (MEASURED: node-d's differ from node-b/node-c's by one).\n   *   Every one of those is a forever-diff waiting for whoever writes `Proxmox.NetworkInterface`.\n   *   This resource compares a single integer against zero and never looks at a row at all.\n   */\n  pending: number;\n}\n\nexport interface ProxmoxNetworkApply extends Resource<\n  'Proxmox.NetworkApply',\n  NetworkApplyProps,\n  NetworkApplyAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxNetworkApply = Resource<ProxmoxNetworkApply>('Proxmox.NetworkApply');\n\nconst read = (props: NetworkApplyProps) =>\n  pendingCount(props.target, props.node).pipe(\n    Effect.map((pending) => ({ node: props.node, pending })),\n  );\n\n/**\n * ⚠️ THE DIFF IS ABOUT THE NODE, NOT ABOUT THE PROPS — the same reasoning as `SdnApply`. This\n *   resource has no settable field (`node` is identity, `after` is an ordering edge), so comparing\n *   props to props would report `noop` forever and the apply would run exactly once, ever. What\n *   decides it is whether the node is carrying a staged change right now.\n *\n * ★ THIS IS ALSO WHY DECLARING THE LIVE CLUSTER PLANS AS `noop`. VERIFIED 2026-09-13:\n *   `/etc/network/interfaces.new` is absent on node-b, node-c and node-d, so `changes` is absent from all three\n *   answers, so `pending` is 0 on all three and every one of them plans `noop`.\n */\nconst diff = (news: Input<NetworkApplyProps>) =>\n  Effect.gen(function* () {\n    if (!isResolved(news)) return undefined;\n    const { pending } = yield* read(news);\n    return pending === 0 ? ({ action: 'noop' } as const) : ({ action: 'update' } as const);\n  });\n\n/** Stop the deploy, loudly, with the node in the message. ⚠️ A die here is the SAFE outcome. */\nconst refuse = (node: string, why: string) =>\n  Effect.die(new Error(`Proxmox.NetworkApply ${node}: ${why}`));\n\nconst apply = (props: NetworkApplyProps) =>\n  Effect.gen(function* () {\n    const node = props.node;\n    const staged = yield* pendingCount(props.target, node);\n    /**\n     * ⛔ NOTHING STAGED MEANS NOTHING TO APPLY, AND THIS BRANCH IS A SAFETY PROPERTY RATHER THAN AN\n     *   OPTIMISATION. `reconcile` also runs on CREATE — the first time this resource appears in a\n     *   stack, before `diff` has ever been consulted — and the PVE worker runs `ifreload -a`\n     *   UNCONDITIONALLY, staged file or not. Without this branch, adding `Proxmox.NetworkApply` to\n     *   a stack describing the cluster as it already is would reload networking on every node it\n     *   names, for nothing. Adoption must cost nothing; that is true here in the strongest sense.\n     */\n    if (staged === 0) return { node, pending: 0 };\n\n    const before = yield* degradedReason(props.target);\n    if (before !== undefined) {\n      return yield* refuse(\n        node,\n        `refusing to reload networking on a cluster that is already degraded (${before}). ` +\n          'Ceph spans these nodes -- fix the cluster first, then re-run the deploy.',\n      );\n    }\n\n    /**\n     * ⚠️ ONE LEASE FOR BOTH CALLS, VIA `pveWith` RATHER THAN `pve`. Each mint returns a NEW token\n     *   id, and the task-status endpoint only skips its `Sys.Audit` check for the task's OWNER —\n     *   so polling with a fresh mint is a different identity and needs a privilege this role does\n     *   not have. The `provision` lease is 300s and non-renewable, which is far longer than a\n     *   reload and is the reason no renew path is reached for.\n     */\n    // ⛔ BEFORE THE MINT AND THE RELOAD. The apply takes no body, so this is the lookup rather\n    //   than a value check: a vendor that moved this endpoint fails here, not mid-ifreload.\n    yield* guardNetworkApply;\n    const credential = yield* mint(props.target, 'provision');\n    const upid = yield* pveWith<string>(props.target, credential, 'PUT', `nodes/${node}/network`);\n    if (upid === undefined) {\n      return yield* refuse(\n        node,\n        'the apply returned no UPID. PVE wraps every answer in {\"data\":...} and can report success ' +\n          'on a call that did nothing -- the reload cannot be confirmed, so it is not claimed.',\n      );\n    }\n\n    /**\n     * ⛔ POLLING `pending` INSTEAD OF THE TASK WOULD REPORT SUCCESS BEFORE THE NETWORK WAS TOUCHED.\n     *   MEASURED in the worker above: the `rename` happens FIRST and `ifreload -a` second, so the\n     *   staged file — and therefore `changes`, and therefore `pending` — disappears while the\n     *   reload has not yet started. A provider that watched the count would call a reload that had\n     *   not run, and a reload that then FAILED, a success. The task's exitstatus is the only\n     *   honest answer.\n     */\n    const exitstatus = yield* awaitTask(props.target, credential, node, upid);\n    if (exitstatus !== 'OK') {\n      return yield* refuse(\n        node,\n        `the reload ended \"${exitstatus}\" (${upid}). Read it from ANOTHER node -- ` +\n          `\\`pvesh get /nodes/${node}/tasks/${upid}/log\\` -- and do not apply the next node until ` +\n          'this one is understood.',\n      );\n    }\n\n    const after = yield* degradedReason(props.target);\n    if (after !== undefined) {\n      return yield* refuse(\n        node,\n        `the reload reported OK but the cluster is now degraded (${after}). The next ` +\n          'node has NOT been applied. Restore this one before continuing -- Ceph runs over these ' +\n          'links and a second reload now would take pools below min_size.',\n      );\n    }\n\n    const left = yield* pendingCount(props.target, node);\n    if (left !== 0) {\n      return yield* refuse(\n        node,\n        `the reload reported OK but ${String(left)} staged line(s) remain. The running config does ` +\n          'not match the declared one, and saying otherwise is the lie this resource exists to stop.',\n      );\n    }\n    return { node, pending: left };\n  });\n\n/**\n * ⛔ HAND-WRITTEN RATHER THAN `pveHandlers`, FOR THE SAME REASON `sdn-apply.ts` IS. The factory's\n *   spec is create/update/delete over ONE object at ONE path, and an apply is not an object: there\n *   is nothing to POST, nothing to DELETE, and `matches` would compare a declaration to itself and\n *   answer `noop` forever, so the apply would run exactly once in the life of the stack. `list` is\n *   empty for the reason it is everywhere in this package — adoption stays an explicit act.\n *\n * ⛔ `delete` APPLIES NOTHING AND UNDOES NOTHING, AND THAT IS CORRECT. There is no un-apply: the\n *   config is already live on the node, and the way to remove an interface is to delete it and\n *   apply AGAIN. See the ⚠️ about `DELETE /nodes/{node}/network` at the top of this file.\n */\nconst handlers = {\n  delete: () => Effect.void,\n  diff: ({ news }: { news: Input<NetworkApplyProps> }) => diff(news),\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: NetworkApplyProps }) => read(olds),\n  reconcile: ({ news }: { news: NetworkApplyProps }) => apply(news),\n};\n\nexport const ProxmoxNetworkApplyProvider = () =>\n  Provider.effect(ProxmoxNetworkApply, Effect.succeed(ProxmoxNetworkApply.Provider.of(handlers)));\n",
     "/**\n * The two applies, and the vendor endpoints they publish through.\n *\n * ★ AN ACTION ENDPOINT IS STILL WIRED, EVEN THOUGH ITS TABLE IS EMPTY, AND THE REASON IS THE\n *   GENERATOR RATHER THAN THE VALIDATOR. `PUT /nodes/{node}/network` and `PUT /cluster/sdn` take\n *   no body at all — there is nothing for a length or a range to be wrong about — but\n *   `codegen/constraints.ts` RESOLVES every key named in this package against the vendor's own\n *   schema and STOPS when one is absent. So the key buys the thing these two families most need:\n *   a PVE that moves, renames or withdraws the apply fails `bun run check` instead of failing an\n *   `ifreload -a` on three nodes at once.\n * ⚠️ AND THE LOOKUP IS NOT FREE EITHER. `constraintsFor` throws when a key has no table, so a\n *   checkout whose generated tables were never refreshed refuses the apply with the command to\n *   run rather than quietly doing nothing — the same defect `constraint-guard.ts` names.\n *\n * ⛔ NEITHER OF THESE IS A CREATE, AND NEITHER FAMILY HAS A `PveSpec`. Both write their own five\n *   handlers (an apply is not an object — see the ⛔ in each file), so they reach the shared check\n *   through `guardForm` by name, exactly as `pbs-datastore-endpoint.ts` does.\n */\nimport type * as Effect from 'effect/Effect';\nimport { guardForm } from './constraint-guard.ts';\nimport type { EndpointKey } from './constraints.ts';\n\n/** ⚠️ `{node}` is a path segment, so this really does take no form keys at all. */\nexport const NETWORK_APPLY_ENDPOINT: EndpointKey = 'pve:PUT /nodes/{node}/network';\n\n/**\n * ⛔ CLUSTER-WIDE. One PUT publishes every staged zone, vnet and subnet on every node; there is no\n *   per-object apply and no pre-apply veto. `sdn-apply.ts` is the whole argument.\n */\nexport const SDN_APPLY_ENDPOINT: EndpointKey = 'pve:PUT /cluster/sdn';\n\nexport const guardNetworkApply: Effect.Effect<void> = guardForm(NETWORK_APPLY_ENDPOINT, {}, true);\n\nexport const guardSdnApply: Effect.Effect<void> = guardForm(SDN_APPLY_ENDPOINT, {}, true);\n",
     "/**\n * `Proxmox.NodeNetwork` — one stanza of a node's `/etc/network/interfaces`, declared.\n *\n * ⛔ DECLARING THIS RESOURCE IS SAFE. APPLYING IT IS A SEPARATE, DELIBERATE ACT, AND IT IS NOT\n *   PERFORMED HERE. Every write under `/nodes/{node}/network/{iface}` lands in\n *   `/etc/network/interfaces.new` and changes no running interface. MEASURED, from PVE::INotify:\n *   `$shadowfiles = { '/etc/network/interfaces' => '/etc/network/interfaces.new' }`, and\n *   `read_file` reads the SHADOW when it exists. The apply is `PUT /nodes/{node}/network`, which\n *   renames the shadow over the real file and runs `ifreload -a`; the revert is\n *   `DELETE /nodes/{node}/network`, which simply unlinks the shadow. A sibling resource models\n *   that apply — this one never calls it, exactly as `Proxmox.SdnZone` never calls\n *   `Proxmox.SdnApply`.\n *\n * ⛔ `Proxmox.NetworkApply` STAYS ON `client.ts`, NOT MIGRATED WITH THIS FILE — network-apply-\n *   read.ts's own header has the two MEASURED reasons distilled cannot represent yet.\n *\n * ⛔ CEPH ON C1 RIDES TWO NETWORKS AND THIS API ONLY SEES ONE OF THEM. Measured from\n *   `/etc/pve/ceph.conf` on 2026-09-13:\n *\n *     public_network  = 198.51.100.0/24     -> vmbr1.42, which this resource DOES see\n *     cluster_network = 203.0.113.0/24     -> every OSD's cluster_addr: .102 / .103 / .104\n *\n *   The cluster network — OSD REPLICATION, the traffic that rebuilds a lost replica — lives on\n *   `203.0.113.10X/32` addresses carried by `tb0`, `tb1` and `dummy_c1`: the Thunderbolt mesh —\n *   TB4's own fabric ports, EXCLUDED from this family by decision 28/29/9 (SdnFabric owns them).\n *\n * ⛔ AND THOSE ADDRESSES ARE INVISIBLE HERE, WHICH IS THE TRAP. They are declared in\n *   `/etc/network/interfaces.d/sdn`, and PVE's network API does not parse that directory.\n *   MEASURED: `GET /nodes/node-b/network/tb0` answers `{\"method\":\"manual\",\"type\":\"eth\",…}` with NO\n *   address, while `ip -br -4 addr` shows `tb0  UP  203.0.113.102/32`. So this resource reports\n *   tb0 and tb1 as address-less manual ports and will plan `noop` over them — implicitly\n *   asserting they carry no address, which is FALSE.\n *\n *   The consequence, stated plainly: declaring tb0/tb1 from what this API reports and then\n *   DESTROYING or applying over them takes out OSD replication on a cluster whose pools are\n *   size 3 / min_size 2. They read as the most boring interfaces on the node and are the two most\n *   dangerous. Leave them undeclared; if they must be managed, manage the file that actually\n *   owns them, not this resource.\n *\n * ⚠️ Two ways this file limits the damage on the interfaces it CAN see: `cidr` is compared\n *   unconditionally (node-network-wire.ts's own ⛔ on `matches`), and a live interface whose\n *   `type` disagrees with the declaration is reported ABSENT rather than retyped\n *   (node-network-wire.ts's `attributesOf`).\n *\n * ★ THE REASON IT EXISTS IS THAT THE STAGED READ CANNOT TELL YOU THE NETWORK IS RIGHT — it can\n *   only tell you the FILE is. Once anything is staged, `GET /nodes/{node}/network/{iface}`\n *   answers from `interfaces.new`, so `matches` compares a declaration against a pending file and\n *   reports `noop` over a node whose running config has not moved. The apply resource is what\n *   closes that gap; this resource's `noop` means \"the file says what you said\", no more.\n *\n * ⚠️ PRIVILEGES ARE COARSER HERE THAN ANYWHERE ELSE IN THE PACKAGE: reads want `Sys.Audit` on\n *   `/nodes/{node}`, every write `Sys.Modify` on it — and there is no `/nodes/{node}/network` ACL\n *   object to scope to, so that also buys the node's services, certificates, DNS and time.\n *   Collected with every other family in docs/privileges.md.\n *\n * ★ A RECONCILE OVER A MATCHING INTERFACE IS A NO-WRITE. `reconcile` below gates the PUT on\n *   `matches` first — adopting an interface a node already has must not leave it holding a\n *   pending network change, since a PUT under `/nodes/{node}/network/{iface}` STAGES one.\n *\n * ⚠️ WHAT IS STILL TRUE: when `matches` is false the PUT rewrites the whole stanza, and that can\n *   ADD lines the file did not have — a `vlan-raw-device vmbr1` under `vmbr1.42`, where PVE had\n *   been deriving it from the name. Harmless in content, and it costs nothing until somebody\n *   applies; one more reason the apply is a separate resource.\n *\n * ⚠️ `list` IS EMPTY, AND HERE THAT MATTERS MORE THAN ANYWHERE ELSE IN THIS PACKAGE. The index\n *   returns every interface the node has, `vmbr0`, `bond0` and the Ceph vlan included. Adopting\n *   them would put Alchemy one `destroy` away from staging the removal of a node's uplink — and\n *   `delete_network` has NO in-use check at all: MEASURED, it deletes the hash entry and writes\n *   the file. Adoption stays explicit.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s\n *   typed `nodes.getNodeNetwork`/`createNodeNetwork`/`putNodeNetwork2`/`deleteNodeNetwork2`\n *   (2026-09-24, decision 43). Dual-path read and `read`'s `output`-branching wired like every\n *   other migrated family; node-network-wire.ts's `readInterfaceOrFail` has the new nuance.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport { guardWrite } from './distilled-guard.ts';\nimport {\n  NODE_NETWORK_CREATE,\n  NODE_NETWORK_UPDATE,\n  type NodeNetworkProps,\n  createForm,\n  updateForm,\n} from './node-network-form.ts';\nimport {\n  dropUnreadable,\n  matches,\n  readInterface,\n  readInterfaceOrFail,\n} from './node-network-wire.ts';\nimport type { NodeNetworkAttributes } from './node-network-wire.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { type PveRequirements } from './resource-spec.ts';\nimport { UNREADABLE, unreadableWarning } from './unreadable-read.ts';\n\nexport type { NodeNetworkAttributes, NodeNetworkType } from './node-network-wire.ts';\n// ⚠️ MOVED TO node-network-form.ts IN THIS PR'S LINE-CAP TRIM — every field on it is already\n//   documented there against `body`/`createForm`/`updateForm`, so it travels with them rather\n//   than duplicating that documentation here. Nothing about its shape changed.\nexport type { NodeNetworkProps } from './node-network-form.ts';\n\nexport interface ProxmoxNodeNetwork extends Resource<\n  'Proxmox.NodeNetwork',\n  NodeNetworkProps,\n  NodeNetworkAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a node's only uplink cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxNodeNetwork = Resource<ProxmoxNodeNetwork>('Proxmox.NodeNetwork', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * The three fields distilled's generator renamed to an underscore (`bond-primary`, `vlan-id`,\n * `vlan-raw-device`) — everything else round-trips as-is. `storage-form.ts`'s `underscored` is a\n * generic transform for a free-form bag; this family's fields are all named ahead of time, so a\n * small local map is clearer than importing a generic helper for three keys. Moved here from\n * node-network-form.ts in this PR's line-cap trim — this is the only caller.\n */\nconst RENAMED: Readonly<Record<string, string>> = {\n  'bond-primary': 'bond_primary',\n  'vlan-id': 'vlan_id',\n  'vlan-raw-device': 'vlan_raw_device',\n};\n\nconst toDistilled = (form: Record<string, string>): Record<string, string> =>\n  Object.fromEntries(Object.entries(form).map(([key, value]) => [RENAMED[key] ?? key, value]));\n\n/** The actual `createNodeNetwork` call body — `createForm`, translated once. See `toDistilled`. */\nconst toDistilledCreate = (props: NodeNetworkProps): nodes.CreateNodeNetworkRequest =>\n  ({\n    ...toDistilled(createForm(props)),\n    node: props.node,\n  }) as unknown as nodes.CreateNodeNetworkRequest;\n\n/** The actual `putNodeNetwork2` call body — `updateForm`, translated once. See `toDistilledCreate`. */\nconst toDistilledUpdate = (props: NodeNetworkProps): nodes.PutNodeNetwork2Request =>\n  ({\n    ...toDistilled(updateForm(props)),\n    iface: props.iface,\n    node: props.node,\n  }) as unknown as nodes.PutNodeNetwork2Request;\n\nexport const ProxmoxNodeNetworkProvider = () =>\n  Provider.effect(\n    ProxmoxNodeNetwork,\n    Effect.succeed(\n      ProxmoxNodeNetwork.Provider.of({\n        /**\n         * ⛔ EMPTY, AND HERE IT MATTERS MORE THAN ANYWHERE ELSE IN THIS PACKAGE. `GET\n         *   /nodes/{node}/network` returns every interface the node has. Adoption stays explicit.\n         */\n        list: () => Effect.succeed([]),\n        // ⚠️ FOLDS ONLY WHEN `output` IS `undefined`, restored by adversarial review after a\n        //   first draft dropped it — node-network-wire.ts's `readInterface` has the reasoning.\n        read: Effect.fn(function* ({ olds, output }) {\n          return dropUnreadable(\n            yield* output === undefined ? readInterface(olds) : readInterfaceOrFail(olds),\n          );\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(NODE_NETWORK_CREATE, createForm(news), output === undefined);\n          yield* guardWrite(NODE_NETWORK_UPDATE, updateForm(news), false);\n          if (output === undefined) return undefined;\n          const live = yield* readInterfaceOrFail(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused mint used to fall into `undefined` and force `update`\n          //   on an interface that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning('Proxmox.NodeNetwork', `${news.node}/${news.iface}`);\n            return { action: 'noop' } as const;\n          }\n          if (live === undefined) {\n            yield* guardWrite(NODE_NETWORK_CREATE, createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          return matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        /**\n         * ⛔ THE DESTROY IS STAGED LIKE EVERY OTHER WRITE, WHICH MAKES IT THE ONE RECOVERABLE\n         *   DESTROY IN THIS PACKAGE. It removes the stanza from `interfaces.new` and nothing\n         *   else; `DELETE /nodes/{node}/network` (a DIFFERENT, collection-level endpoint —\n         *   `Proxmox.NetworkApply`'s own revert, never called here) puts the node back by\n         *   unlinking that file. It becomes irreversible the moment somebody applies — and PVE\n         *   performs NO in-use check before removing an interface other bridges or Ceph still\n         *   stand on.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const before = dropUnreadable(yield* readInterface(news));\n          yield* guardWrite(NODE_NETWORK_CREATE, createForm(news), before === undefined);\n          yield* guardWrite(NODE_NETWORK_UPDATE, updateForm(news), false);\n          if (before === undefined) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              nodes.createNodeNetwork(toDistilledCreate(news)),\n            );\n          } else if (!matches(before, news)) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              nodes.putNodeNetwork2(toDistilledUpdate(news)),\n            );\n          }\n          const after = dropUnreadable(yield* readInterface(news));\n          if (after === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `nodes/${news.node}/network/${news.iface}: wrote with no error, but the ` +\n                  'interface is still absent -- PVE wraps every answer in {\"data\":...} and can ' +\n                  'report success on a call that did nothing, so read back rather than trust it.',\n              ),\n            );\n          }\n          return after;\n        }),\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            nodes.deleteNodeNetwork2({ iface: olds.iface, node: olds.node }),\n          );\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * `Proxmox.NodeNetwork`'s declared shape (`NodeNetworkProps`) and WRITE side, plus the wire\n * coercions the read side needs too — kept here since neither `matches` nor `updateForm` makes\n * sense without agreeing on the same normalisation. Split out of node-network.ts (2026-09-24,\n * the distilled migration; `Props` joined it in this PR's later line-cap trim) — the\n * storage.ts/storage-form.ts seam.\n */\nimport type { NodeNetworkType } from './node-network-wire.ts';\nimport { type WithTarget } from './resource-spec.ts';\nimport { flag, text, withClears } from './values.ts';\n\nexport interface NodeNetworkProps extends WithTarget {\n  /** Which node's file this stanza lives in. Interfaces are per node, never cluster-wide. */\n  node: string;\n  /** `vmbr0`, `bond0`, `vmbr1.42`. 2-20 characters, PVE's `pve-iface` format. */\n  iface: string;\n  /** ⛔ REQUIRED ON EVERY WRITE, update included, never used to retype — see node-network-wire.ts. */\n  type: NodeNetworkType;\n  /**\n   * `198.51.100.12/24`. ⛔ THE ONE FIELD WITH NO UNMANAGED MODE: leaving it out is an instruction\n   * to make the interface `manual`, not an instruction to leave its address alone. The ⛔ on\n   * `updateForm` in node-network-form.ts has the measurement and the consequence.\n   */\n  cidr?: string;\n  /** ⚠️ PVE allows exactly ONE default gateway per node and refuses a second with \"Default\n   *  gateway already exists on interface '<other>'\". On C1 it is vmbr0.41's. */\n  gateway?: string;\n  /**\n   * `auto <iface>` in the file. Absent on read means off, which is why `bool`'s fallback is used.\n   * ⚠️ UNDECLARED IS UNMANAGED ON AN UPDATE AND OFF ON A CREATE — the same asymmetry storage.ts\n   *   has, and it bites harder here: an interface created without `autostart` is one the node\n   *   will not bring up at boot. Every C1 bridge, bond and vlan carries it.\n   */\n  autostart?: boolean;\n  /** 1280-65520. Unset leaves the file without an `mtu` line and the kernel default in force. */\n  mtu?: number;\n  /** ⚠️ Round-trips only after normalisation — see `comment` in node-network-wire.ts. */\n  comments?: string;\n  /** Space-separated, a SET: `enp87s0`, or `bond0`. ⚠️ PVE refuses a port already used elsewhere. */\n  bridge_ports?: string;\n  /** `2-4094`, or `2 100-200`. Only written when `bridge_vlan_aware` is on. */\n  bridge_vids?: string;\n  /** ⛔ A `false` here is sent as `delete=`, never as `0` — node-network-form.ts's ⛔ says why. */\n  bridge_vlan_aware?: boolean;\n  /**\n   * A bond's members, space separated. ⚠️ THE PARAMETER IS `slaves`, NOT `bond_slaves`, in BOTH\n   * directions on this PVE: MEASURED, the POST/PUT schema names only `slaves` and the GET returns\n   * `\"slaves\":\"enp2s0f0np0 enp2s0f1np1\"`. `bond_slaves` appears nowhere in Network.pm here.\n   */\n  slaves?: string;\n  bond_mode?: string;\n  /** ⚠️ Only written when `bond_mode` is `balance-xor` or `802.3ad`; ignored otherwise. */\n  bond_xmit_hash_policy?: string;\n  /** active-backup only. Kept hyphenated because that is the wire name. */\n  'bond-primary'?: string;\n  /** ⚠️ DERIVED FROM A DOTTED NAME. `vmbr1.42` reports `vlan-id` 42 with no such line in the file;\n   *  declaring it there is harmless but adds a line the file did not have. */\n  'vlan-id'?: number;\n  'vlan-raw-device'?: string;\n}\n\nexport const NODE_NETWORK_CREATE = 'pve:POST /nodes/{node}/network';\nexport const NODE_NETWORK_UPDATE = 'pve:PUT /nodes/{node}/network/{iface}';\n\n/**\n * \"Not set\", for the three integers this family reports.\n *\n * ⚠️ 0 CANNOT BE THE ABSENT-MARKER AND -1 CAN. `mtu` is 1280-65520, `vlan-id` 1-4094 and PVE's\n *   `priority` starts at 1 (1 is reserved for `lo`), so -1 is outside every one of their ranges\n *   while 0 is merely outside today's. metric-server-form.ts keeps its own constant for the same\n *   reason and against different ranges; one shared UNSET would have to be right for both.\n */\nexport const UNSET = -1;\n\n/**\n * A space-separated interface list, flattened to one comparable form.\n *\n * ⚠️ `bridge_ports` AND `slaves` ARE SETS, AND PVE NORMALISES THEIR SEPARATORS BUT NOT THEIR ORDER.\n *   MEASURED in PVE::Network::Interfaces: the writer does `s/[;,\\s]+/ /g` on both before emitting\n *   them, and the reader hands the resulting string straight back — so `enp2s0f1np1 enp2s0f0np0`\n *   survives a round trip in the order it was written. Order carries no meaning for a bridge's\n *   ports or a bond's slaves, so a declaration that lists them the other way round is the SAME\n *   declaration; comparing raw strings would report an update that rewrites the file to say\n *   exactly what it already said. Both sides are sorted here and only then compared.\n *\n * ⚠️ IT IS NOT `csv` FROM values.ts. That one joins with commas, and a comma in\n *   `/etc/network/interfaces` is not a separator — PVE's own comment above the writer says the\n *   list \"must be space separated! other separators will cause problems\". Sending a comma-joined\n *   value would be accepted by `split_list` and then written back as spaces, which is a second\n *   spelling of one value and therefore a second chance to diff.\n *\n * ⚠️ `bridge_vids` GOES THROUGH THE SAME FUNNEL and its sort is LEXICAL, which is correct only\n *   because a vid list is a set: `2-4094` is one token, and `100-200 2` and `2 100-200` allow the\n *   same VLANs. Nothing here should be reused for a list whose order is meaning.\n */\nexport const ifaceList = (value: unknown) =>\n  text(value)\n    .split(/[\\s,;]+/)\n    .filter((part) => part !== '')\n    .sort()\n    .join(' ');\n\n/**\n * A comment off the wire, with the newline PVE adds taken back off.\n *\n * ⛔ `comments` NEVER ROUND-TRIPS RAW, AND THAT IS A FOREVER-DIFF IF IT IS NOT NORMALISED.\n *   MEASURED in the reader: each `#...` line is appended as `$comment . \"\\n\"`, so a declared\n *   `ceph transport` comes back as `ceph transport\\n` and the two never compare equal.\n * ⚠️ AND THE READER FOLDS `comments6` INTO `comments` (`$d->{comments} .= $comments6`), so on an\n *   interface that carries an IPv6 comment a declared `comments` CANNOT match what comes back.\n *   C1 has none; on an interface that does, leave `comments` undeclared rather than fighting it.\n */\nexport const comment = (value: unknown) => text(value).replace(/\\s+$/, '');\n\n/** Undeclared is unmanaged: neither sent nor compared. */\nexport const same = <T>(declared: T | undefined, live: T) =>\n  declared === undefined || declared === live;\n\nexport const sameList = (declared: string | undefined, live: string) =>\n  declared === undefined || ifaceList(declared) === live;\n\nexport const sameComment = (declared: string | undefined, live: string) =>\n  declared === undefined || comment(declared) === live;\n\nconst field = (name: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [name]: value };\n\n/**\n * The fields sent on EVERY write, create and update alike.\n *\n * ⚠️ UNDECLARED IS UNMANAGED — not sent, and not compared either. PVE's PUT MERGES the form into\n *   the existing stanza (`foreach my $k (keys %$param) { $ifaces->{$iface}->{$k} = $param->{$k} }`),\n *   so an omitted parameter is left exactly as it was. `cidr` is the one exception and it is not\n *   a small one — see node-network.ts's own ⛔.\n *\n * ⛔ `type` IS REQUIRED ON THE PUT, NOT ONLY ON THE POST. It carries no `optional` in either\n *   schema (CONFIRMED again in distilled's generated `PutNodeNetwork2Request`/\n *   `CreateNodeNetworkRequest`), and the merge above writes it straight into the stanza — so a PUT\n *   naming the wrong type would RETYPE A LIVE INTERFACE in the file. node-network-wire.ts's\n *   `attributesOf` refuses that case before it can reach here.\n *\n * ⛔ `bridge_vlan_aware` IS SENT ONLY WHEN TRUE, AND A FALSE ONE IS A `delete=`. MEASURED in the\n *   writer: the test is `if (defined($d->{bridge_vlan_aware}))`, not a truth test, so `0` is\n *   defined and PVE writes `bridge-vlan-aware yes` anyway. Sending `0` would therefore turn the\n *   flag ON, read back as `1`, and diff forever while lying about which way it went.\n *\n * ⚠️ `netmask` IS A WRITABLE PARAMETER AND IS DELIBERATELY NOT OFFERED. PVE raises\n *   \"netmask conflicts with cidr\" when both are sent, and the reader rewrites whatever was written\n *   into prefix form — MEASURED: node-b's vmbr1.42 reports `\"netmask\":\"24\"`, never `255.255.255.0`.\n *   A resource accepting both spellings would let a declaration diff against its own value.\n *\n * ★ HYPHENATED, THE WIRE SHAPE — `guardWrite` (node-network.ts) checks this form directly, keyed\n *   by PVE's own names (`generated/constraints/pve-nodes-network.ts`). `toDistilledCreate`/\n *   `toDistilledUpdate` below translate a COPY for the actual SDK call — storage-form.ts's\n *   `underscored` has the fuller measurement of why the wire itself does not need this rename\n *   (distilled's own `T.Body()` annotation re-hyphenates on the way out either way), reused here\n *   only for the three fields this family's schema renames: `bond-primary`, `vlan-id`,\n *   `vlan-raw-device` -> `bond_primary`, `vlan_id`, `vlan_raw_device`.\n */\nexport const body = (props: NodeNetworkProps): Record<string, string> => ({\n  ...field('autostart', flag(props.autostart)),\n  ...field('bond-primary', props['bond-primary']),\n  ...field('bond_mode', props.bond_mode),\n  ...field('bond_xmit_hash_policy', props.bond_xmit_hash_policy),\n  ...field('bridge_ports', props.bridge_ports),\n  ...field('bridge_vids', props.bridge_vids),\n  ...field('bridge_vlan_aware', props.bridge_vlan_aware === true ? '1' : undefined),\n  ...field('cidr', props.cidr),\n  ...field('comments', props.comments),\n  ...field('gateway', props.gateway),\n  ...field('mtu', props.mtu === undefined ? undefined : String(props.mtu)),\n  ...field('slaves', props.slaves),\n  ...field('vlan-id', props['vlan-id'] === undefined ? undefined : String(props['vlan-id'])),\n  ...field('vlan-raw-device', props['vlan-raw-device']),\n  type: props.type,\n});\n\n/**\n * The create form: `body` plus the name of the interface being created.\n *\n * 🔴 `iface` MUST BE IN THE BODY, NOT ONLY THE PATH — `POST /nodes/{node}/network` declares\n *   `iface` REQUIRED (`pve-iface`, 2..20) and `{node}` is its only path parameter, CONFIRMED again\n *   in distilled's generated `CreateNodeNetworkRequest`, which carries `iface` as a plain body\n *   field, never a `T.Label()`. The pre-distilled client.ts version of this file shipped without\n *   it for a time (see the git history around 2026-09-22) — every create this family had ever\n *   planned would have 400ed, caught only because every C1 interface had been adopted, never\n *   created, so nothing exercised the POST until the vendor table was wired in.\n *\n * ⚠️ NOT ADDED TO `body`, BECAUSE THE PUT MUST NOT CARRY IT. `additionalProperties => 0` on the\n *   update schema makes a second copy of the name a 400 rather than an ignored hint.\n */\nexport const createForm = (props: NodeNetworkProps): Record<string, string> => ({\n  ...body(props),\n  iface: props.iface,\n});\n\n/**\n * The update form: `body` plus the two fields that can only be cleared explicitly.\n *\n * ⛔ `delete=cidr` IS SENT WHENEVER `cidr` IS UNDECLARED, AND IT IS THE LESSER OF TWO EVILS RATHER\n *   THAN A GOOD OUTCOME. PVE recomputes the method on every write from the form alone —\n *   `$param->{method} = $param->{address} ? 'static' : 'manual'` — so a PUT WITHOUT an address\n *   makes the interface manual no matter what the caller intended. Left at that, the merge would\n *   leave the old `address` and `netmask` in the hash and the writer would emit an `address` line\n *   under `iface … inet manual`: a stanza PVE's own UI cannot produce. Clearing cidr explicitly at\n *   least produces a clean, honest manual interface — and `matches` compares `cidr`\n *   UNCONDITIONALLY, so the plan says so first.\n *\n * ⛔ ON vmbr1.42 THAT IS THE CEPH TRANSPORT. A declaration of that interface without its `cidr` is\n *   a declaration that it should have no address, applied across three nodes. The plan will read\n *   `1 to update` rather than `noop`; do not wave it through.\n *\n * ⚠️ `delete` IS A PUT-ONLY PARAMETER. The POST schema has no `delete` at all, which is why\n *   `createForm` calls `body` directly rather than going through this function.\n */\nexport const updateForm = (props: NodeNetworkProps): Record<string, string> => {\n  const clear = [\n    ...(props.cidr === undefined ? ['cidr'] : []),\n    ...(props.bridge_vlan_aware === false ? ['bridge_vlan_aware'] : []),\n  ];\n  return withClears(body(props), clear);\n};\n\n// ⚠️ `toDistilledCreate`/`toDistilledUpdate` MOVED TO node-network.ts IN THIS PR'S LINE-CAP\n//   TRIM — the only caller, and the only place `nodes.CreateNodeNetworkRequest`/\n//   `PutNodeNetwork2Request` were otherwise needed. `createForm`/`updateForm` above are unchanged.\n",
     "/**\n * `Proxmox.NodeNetwork`'s READ side: the coercions in both directions, the read itself, and\n * `matches`. Split out of node-network-form.ts (2026-09-24, the distilled migration) — the\n * storage.ts/storage-wire.ts seam; the write side stays in node-network-form.ts.\n *\n * * ⛔ THE LAST SEVEN ARE REPORTED AND NEVER COMPARED, AND EACH ONE IS A MEASURED FOREVER-DIFF.\n *   `priority` is assigned by PVE FROM FILE ORDER — `my $priority = 2; ... $d->{priority} =\n *   $priority++` — and it is not a POST or PUT parameter at all. MEASURED ACROSS C1: vmbr1.42 is\n *   priority 16 on node-b and node-c and 15 on node-d, because node-d has no `wlan0` above it. One\n *   declaration reused across three nodes would diff on exactly one of them, forever, over nothing.\n *   `method` is RECOMPUTED on every write from whether the form carried an address, `families` is\n *   recomputed the same way and never written to the file, `active` and `exists` describe the\n *   kernel rather than the config, and `bond_miimon`, `bridge_stp` and `bridge_fd` are emitted by\n *   PVE's writer with defaults (100, `off`, 0) while appearing in NEITHER write schema —\n *   `additionalProperties => 0` means sending one is a 400. Live proof of all three: node-b's bond0\n *   returns `bond_miimon \"100\"` and vmbr1 returns `bridge_stp \"off\"`, `bridge_fd \"0\"`, none of\n *   which any declaration can set.\n */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport { runPve } from './distilled-pve.ts';\nimport {\n  type NodeNetworkProps,\n  UNSET,\n  comment,\n  ifaceList,\n  same,\n  sameComment,\n  sameList,\n} from './node-network-form.ts';\nimport { UNREADABLE, type Unreadable, readOrUnreadable } from './unreadable-read.ts';\nimport { bool, int, text } from './values.ts';\n\n/**\n * PVE's interface types. `unknown` is what a NIC it does not manage reports — node-b and node-c\n * both report `wlan0` that way, and node-d has no such interface at all.\n *\n * ⚠️ THAT ASYMMETRY IS A TRAP FOR A DECLARATION SHARED ACROSS NODES. On node-d the read answers\n *   400 (\"interface does not exist\"), which this provider cannot tell from \"deleted\", so\n *   reconcile POSTs — writing a stanza for a card that is not in the machine. Declare per node\n *   what each node actually has; a physical interface is discovered, not decided.\n */\nexport type NodeNetworkType =\n  | 'OVSBond'\n  | 'OVSBridge'\n  | 'OVSIntPort'\n  | 'OVSPort'\n  | 'alias'\n  | 'bond'\n  | 'bridge'\n  | 'eth'\n  | 'fabric'\n  | 'unknown'\n  | 'vlan'\n  | 'vnet';\n\n/**\n * ⛔ THE LAST SEVEN ARE REPORTED AND NEVER COMPARED — each is a MEASURED forever-diff, and the\n *   evidence for every one of them is below, beside the code that reads them.\n */\nexport interface NodeNetworkAttributes {\n  node: string;\n  iface: string;\n  type: string;\n  cidr: string;\n  gateway: string;\n  autostart: boolean;\n  mtu: number;\n  comments: string;\n  bridge_ports: string;\n  bridge_vids: string;\n  bridge_vlan_aware: boolean;\n  slaves: string;\n  bond_mode: string;\n  bond_xmit_hash_policy: string;\n  'bond-primary': string;\n  'vlan-id': number;\n  'vlan-raw-device': string;\n  priority: number;\n  method: string;\n  families: string;\n  active: boolean;\n  exists: boolean;\n  bond_miimon: string;\n  bridge_stp: string;\n  bridge_fd: string;\n}\n\n/**\n * One live interface as attributes. `live` is cast past `GetNodeNetworkResponse`'s own TS type\n * (`{method, type}`) — MEASURED: the generated schema is a lower bound, not the full shape (PVE's\n * response varies by interface type, and the apidoc this was generated from does not enumerate\n * every field it can carry), but decoding does NOT strip the extras (Effect Schema's `S.Struct` is\n * structural, not exact) — every field PVE actually returns survives to this object at runtime,\n * confirmed against the full measured `vmbr0` response below.\n *\n * ⚠️ EVERY FIELD PVE REPORTS IS CARRIED HERE, INCLUDING THE SEVEN NO DECLARATION CAN SET. A plan\n *   that cannot show `priority`, `method` or `bond_miimon` cannot explain why it is ignoring them,\n *   and the next person to read a forever-diff would start by adding them to `matches`. They are\n *   reported precisely so that they are visibly OUT of it — see the ⛔ above the module header.\n */\nconst attributesOf = (\n  live: unknown,\n  props: NodeNetworkProps,\n): NodeNetworkAttributes | undefined => {\n  const data = live as Record<string, unknown>;\n  /**\n   * ⛔ AN INTERFACE OF ANOTHER TYPE IS ANOTHER OBJECT, AND \"ABSENT\" IS THE SAFE ANSWER — the\n   *   same call metric-server.ts makes, for a worse reason. `type` is required on the PUT and\n   *   the PUT MERGES, so a declaration naming `bridge` for what is really a vlan would write\n   *   `type bridge` into the stanza and PVE's writer would then emit bridge-ports and\n   *   bridge-stp lines for vmbr1.42. Reporting absent instead makes reconcile POST a create,\n   *   which PVE refuses with \"interface already exists\": loud, and it changes nothing.\n   */\n  const liveType = text(data['type']);\n  if (liveType !== '' && liveType !== props.type) return undefined;\n  return {\n    active: bool(data['active']),\n    autostart: bool(data['autostart']),\n    'bond-primary': text(data['bond-primary']),\n    bond_miimon: text(data['bond_miimon']),\n    bond_mode: text(data['bond_mode']),\n    bond_xmit_hash_policy: text(data['bond_xmit_hash_policy']),\n    bridge_fd: text(data['bridge_fd']),\n    bridge_ports: ifaceList(data['bridge_ports']),\n    bridge_stp: text(data['bridge_stp']),\n    bridge_vids: ifaceList(data['bridge_vids']),\n    bridge_vlan_aware: bool(data['bridge_vlan_aware']),\n    /** ⚠️ DERIVED BY THE READER from address+netmask, and always present when an address is. */\n    cidr: text(data['cidr']),\n    comments: comment(data['comments']),\n    exists: bool(data['exists']),\n    families: Array.isArray(data['families']) ? data['families'].join(',') : '',\n    gateway: text(data['gateway']),\n    iface: props.iface,\n    method: text(data['method']),\n    mtu: int(data['mtu'], UNSET),\n    node: props.node,\n    priority: int(data['priority'], UNSET),\n    slaves: ifaceList(data['slaves']),\n    type: liveType === '' ? props.type : liveType,\n    'vlan-id': int(data['vlan-id'], UNSET),\n    'vlan-raw-device': text(data['vlan-raw-device']),\n  };\n};\n\n/**\n * ★ Default `read` role — `Sys.Audit` on `/nodes/{node}` (node-network.ts's header).\n * ⛔ `{ node: props.node, iface: props.iface }`, NEVER THE WHOLE `props` — storage.ts's/user.ts's\n *   own ⛔, the kit 0.31.1 regression: `GetNodeNetworkRequest`'s schema declares only `node` and\n *   `iface` (both path labels); any OTHER key on the object passed to `nodes.getNodeNetwork` is\n *   treated by distilled's `buildRequest` as an \"unknown key\" and JSON-encoded onto this bodyless\n *   GET, which a stricter fetch client refuses outright.\n * ⛔ A MISSING INTERFACE IS A 400, NOT A 500 AND NOT A 404 — MEASURED against the live cluster\n *   (TB4 `n2`, read-role, read-only probe, 2026-09-24): `GET /nodes/n2/network/vmbr9` answers\n *   `{\"errors\":{\"iface\":\"interface does not exist\"},\"data\":null,\"message\":\"Parameter verification\n *   failed.\\n\"}` at HTTP 400 — a THIRD shape, different from every other migrated family's\n *   measured 500. `@distilled.cloud/proxmox` types this as a genuine typed error,\n *   `ParameterVerificationFailed` (`errors.ts`), carrying the per-field `errors` object rather\n *   than collapsing it to an opaque `BadRequest` — PVE's OWN 400 is never one shape (it is\n *   whatever the endpoint's parameter verification rejected), so `errors.ts`'s own header spells\n *   out why this ONE typed error is global rather than per-operation.\n * ⛔ ONLY THIS EXACT SIGNAL MEANS ABSENT, EVEN WITH THE FOLD BELOW. A different 400 reason, a\n *   permission gap, a network blip, or ANY OTHER `ParameterVerificationFailed` reason is never\n *   read as \"this interface is not there\" — `diff` calls this directly and propagates every one\n *   of them loudly.\n */\nexport const readInterfaceOrFail = (props: NodeNetworkProps) =>\n  readOrUnreadable(\n    runPve(\n      props.target,\n      'read',\n      false,\n      nodes.getNodeNetwork({ iface: props.iface, node: props.node }),\n    ).pipe(\n      Effect.catchTag('ParameterVerificationFailed', (error) =>\n        error.errors['iface'] === 'interface does not exist'\n          ? Effect.succeed(undefined)\n          : Effect.fail(error),\n      ),\n    ),\n  ).pipe(\n    Effect.map((live) => {\n      if (live === UNREADABLE) return UNREADABLE;\n      return live === undefined ? undefined : attributesOf(live, props);\n    }),\n  );\n\n/**\n * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`'s adoption/recovery branch\n *   AND `reconcile` MAY USE IT — FOUND BY ADVERSARIAL REVIEW, 2026-09-24: a first draft used\n *   `readInterfaceOrFail` (precise, non-folding) for EVERY caller, on the reasoning that a typed,\n *   parsed absence signal made folding unnecessary. That reasoning conflated two different\n *   questions: HOW PRECISELY a signal means absent (this family's is unusually precise), and\n *   WHETHER a given caller can safely treat an UNRELATED failure as \"proceed as though absent\"\n *   (storage.ts's/user.ts's own reasoning: a wrongful fold costs at most a redundant\n *   `createNodeNetwork` POST, refused loudly). Plan.ts's cold-start adoption probe and\n *   interrupted-create recovery, and Apply.ts's delete recovery, all call `read` with\n *   `output: undefined` and NO catch of their own (`Plan.ts` v2.0.0-beta.79 ~line 1308) — and\n *   Plan.ts fails the WHOLE PLAN, every other resource included, if that call throws. A malformed\n *   `iface` in ONE brand-new declaration (a DIFFERENT `ParameterVerificationFailed` than the\n *   absence one) would abort `bun run plan` for the entire stack under the precise-only design,\n *   where every other migrated family instead defers that same malformed declaration to a scoped,\n *   loud refusal at apply. This restores that same fold for those three call sites.\n */\nexport const readInterface = (props: NodeNetworkProps) =>\n  readInterfaceOrFail(props).pipe(Effect.orElseSucceed(() => undefined));\n\n/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */\nexport const dropUnreadable = (live: NodeNetworkAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n\n/**\n * ⛔ `cidr` IS THE ONLY FIELD COMPARED WHEN UNDECLARED, AND THAT ASYMMETRY IS THE POINT. Every\n *   other field here follows storage.ts: undeclared means unmanaged, so it is neither sent nor\n *   compared and a plan cannot report an update no write could satisfy. `cidr` cannot be\n *   unmanaged, because PVE derives `method` from the presence of an address IN THE FORM — an\n *   omission is an edit. Comparing it unconditionally is what makes that edit visible in `plan`\n *   instead of at `ifreload` time.\n *\n * ⚠️ NOTHING IN THE REPORTED-ONLY BLOCK IS HERE, and that is what makes the C1 declaration\n *   plan as `noop` on all three nodes at once — the module header lists them and the\n *   measurement behind each.\n */\nexport const matches = (attributes: NodeNetworkAttributes, props: NodeNetworkProps) =>\n  attributes.cidr === (props.cidr ?? '') &&\n  same(props.gateway, attributes.gateway) &&\n  same(props.autostart, attributes.autostart) &&\n  same(props.mtu, attributes.mtu) &&\n  sameComment(props.comments, attributes.comments) &&\n  sameList(props.bridge_ports, attributes.bridge_ports) &&\n  sameList(props.bridge_vids, attributes.bridge_vids) &&\n  same(props.bridge_vlan_aware, attributes.bridge_vlan_aware) &&\n  sameList(props.slaves, attributes.slaves) &&\n  same(props.bond_mode, attributes.bond_mode) &&\n  same(props.bond_xmit_hash_policy, attributes.bond_xmit_hash_policy) &&\n  same(props['bond-primary'], attributes['bond-primary']) &&\n  same(props['vlan-id'], attributes['vlan-id']) &&\n  same(props['vlan-raw-device'], attributes['vlan-raw-device']);\n",
-    "/**\n * `Proxmox.NotificationMatcher` — which notifications a PVE cluster sends to which targets.\n *\n * ★ THE HALF OF THE NOTIFICATION SYSTEM notification-target.ts LEAVES OPEN. A target is where a\n *   message CAN go; a matcher decides whether it DOES. A cluster ships one, `default-matcher`,\n *   routing everything to `mail-to-root`, and a target no matcher names receives nothing — so a\n *   declared webhook with no matcher is a delivery path that is never used, and looks finished.\n *\n * ★ ADOPTING THE BUILT-IN AS IT IS: declare what it holds and nothing more. MEASURED on PVE\n *   9.2.11 (2026-09-22, `pvesh get /cluster/notifications/matchers/default-matcher`): mode `all`,\n *   one target `mail-to-root`, no rules, the comment \"Route all notifications to mail-to-root\".\n *   ```ts\n *   ProxmoxNotificationMatcher('default-matcher', {\n *     target: cluster, name: 'default-matcher', targets: ['mail-to-root'],\n *   });\n *   ```\n *   That plans `noop` and deploys with no write (notification-matcher.test.ts). Leaving `comment`\n *   out leaves it alone; every rule field is compared — notification-matcher-form.ts says why.\n *\n * ★ WHAT THIS NEEDS, READ OFF THE CLUSTER'S OWN SCHEMA (generated/pve.ts source, 9.2.11):\n *     read      GET matchers/{name}   Mapping.Audit or Mapping.Modify on /mapping/notifications\n *     write     POST, PUT, DELETE     Mapping.Modify on /mapping/notifications\n *   The same pair as `Proxmox.NotificationTarget`, with that file's ⚠️ about granting it on `/`.\n *   ⛔ `Mapping.Use` IS NOT ENOUGH, though the COLLECTION GET accepts it: the per-object read this\n *     family makes lists only Audit and Modify (pve-manager API2/Cluster/Notifications.pm\n *     `get_matcher`, read at HEAD 2026-09-22 — corrected here; PR 95 said Use sufficed).\n *   ⛔ A MISSING READ PRIVILEGE LOOKS LIKE \"ABSENT\", not like a 403 — see the same file. For\n *     `default-matcher` that turns an adoption into a planned CREATE that PVE refuses as a\n *     duplicate: the noop below needs a read lease holding Mapping.Audit.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport {\n  type NotificationMatcherAttributes,\n  type NotificationMatcherFields,\n  matcherAttributes,\n  matcherCreateForm,\n  matcherMatches,\n  matcherUpdateForm,\n} from './notification-matcher-form.ts';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\n\nexport interface NotificationMatcherProps extends NotificationMatcherFields, WithTarget {}\n\nexport interface ProxmoxNotificationMatcher extends Resource<\n  'Proxmox.NotificationMatcher',\n  NotificationMatcherProps,\n  NotificationMatcherAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ⚠️ NO `defaultRemovalPolicy: 'retain'`, for notification-target.ts's reason: a matcher holds no\n *   data, and a plan line is the only warning a delete gets. On `default-matcher` the delete\n *   REVERTS it to the shipped rule instead — see `origin` on the attributes.\n */\nexport const ProxmoxNotificationMatcher = Resource<ProxmoxNotificationMatcher>(\n  'Proxmox.NotificationMatcher',\n);\n\nconst handlers = pveHandlers<NotificationMatcherProps, NotificationMatcherAttributes>({\n  attributes: (live, props) => matcherAttributes(live, props.name),\n  collection: () => 'cluster/notifications/matchers',\n  createForm: matcherCreateForm,\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: {\n    create: 'pve:POST /cluster/notifications/matchers',\n    update: 'pve:PUT /cluster/notifications/matchers/{name}',\n  },\n  matches: matcherMatches,\n  path: (props) => `cluster/notifications/matchers/${props.name}`,\n  updateForm: matcherUpdateForm,\n});\n\nexport const ProxmoxNotificationMatcherProvider = () =>\n  Provider.effect(\n    ProxmoxNotificationMatcher,\n    Effect.succeed(ProxmoxNotificationMatcher.Provider.of(handlers)),\n  );\n",
+    "/**\n * `Proxmox.NotificationMatcher` — which notifications a PVE cluster sends to which targets.\n *\n * ★ THE HALF OF THE NOTIFICATION SYSTEM notification-target.ts LEAVES OPEN. A target is where a\n *   message CAN go; a matcher decides whether it DOES. A cluster ships one, `default-matcher`,\n *   routing everything to `mail-to-root`, and a target no matcher names receives nothing — so a\n *   declared webhook with no matcher is a delivery path that is never used, and looks finished.\n *\n * ★ ADOPTING THE BUILT-IN AS IT IS: declare what it holds and nothing more. MEASURED on PVE\n *   9.2.11 (2026-09-22, `pvesh get /cluster/notifications/matchers/default-matcher`): mode `all`,\n *   one target `mail-to-root`, no rules, the comment \"Route all notifications to mail-to-root\".\n *   ```ts\n *   ProxmoxNotificationMatcher('default-matcher', {\n *     target: cluster, name: 'default-matcher', targets: ['mail-to-root'],\n *   });\n *   ```\n *   That plans `noop` and deploys with no write (notification-matcher.test.ts). Leaving `comment`\n *   out leaves it alone; every rule field is compared — notification-matcher-form.ts says why.\n *\n * ★ WHAT THIS NEEDS, READ OFF THE CLUSTER'S OWN SCHEMA (generated/pve.ts source, 9.2.11):\n *     read      GET matchers/{name}   Mapping.Audit or Mapping.Modify on /mapping/notifications\n *     write     POST, PUT, DELETE     Mapping.Modify on /mapping/notifications\n *   The same pair as `Proxmox.NotificationTarget`, with that file's ⚠️ about granting it on `/`.\n *   ⛔ `Mapping.Use` IS NOT ENOUGH, though the COLLECTION GET accepts it: the per-object read this\n *     family makes lists only Audit and Modify (pve-manager API2/Cluster/Notifications.pm\n *     `get_matcher`, read at HEAD 2026-09-22 — corrected here; PR 95 said Use sufficed).\n *   ⛔ THE OLD HAND CLIENT FOLDED A MISSING READ PRIVILEGE INTO \"ABSENT\", planning a duplicate\n *     create. The distilled read now catches only NotFound: a refused read fails the plan.\n *     The noop still requires a read lease holding Mapping.Audit.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type {\n  NotificationMatcherAttributes,\n  NotificationMatcherFields,\n} from './notification-matcher-form.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { matcherHandlers } from './notification-matcher-lifecycle.ts';\n\nexport interface NotificationMatcherProps extends NotificationMatcherFields, WithTarget {}\n\nexport interface ProxmoxNotificationMatcher extends Resource<\n  'Proxmox.NotificationMatcher',\n  NotificationMatcherProps,\n  NotificationMatcherAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ⚠️ NO `defaultRemovalPolicy: 'retain'`, for notification-target.ts's reason: a matcher holds no\n *   data, and a plan line is the only warning a delete gets. On `default-matcher` the delete\n *   REVERTS it to the shipped rule instead — see `origin` on the attributes.\n */\nexport const ProxmoxNotificationMatcher = Resource<ProxmoxNotificationMatcher>(\n  'Proxmox.NotificationMatcher',\n);\n\nexport const ProxmoxNotificationMatcherProvider = () =>\n  Provider.effect(\n    ProxmoxNotificationMatcher,\n    Effect.succeed(ProxmoxNotificationMatcher.Provider.of(matcherHandlers)),\n  );\n",
+    "/** A matching PVE matcher adoption writes nothing; unreadable is never treated as absent. */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport type { NotificationMatcherProps as Props } from './notification-matcher.ts';\nimport {\n  type NotificationMatcherAttributes as Attributes,\n  matcherCreateForm,\n  matcherMatches,\n  matcherUpdateForm,\n} from './notification-matcher-form.ts';\nimport { guardForm } from './constraint-guard.ts';\nimport {\n  createMatcher,\n  deleteMatcher,\n  readMatcher,\n  updateMatcher,\n} from './notification-matcher-distilled.ts';\n\nconst guard = (props: Props, create: boolean) =>\n  guardForm('pve:POST /cluster/notifications/matchers', matcherCreateForm(props), create).pipe(\n    Effect.andThen(\n      guardForm('pve:PUT /cluster/notifications/matchers/{name}', matcherUpdateForm(props), false),\n    ),\n  );\n\nexport const matcherHandlers = {\n  /** Built-ins and human-created matchers are not auto-enrolled; adoption is explicit. */\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: Props }) =>\n    Effect.gen(function* () {\n      const live = yield* readMatcher(olds);\n      yield* guard(olds, live === undefined);\n      return live;\n    }),\n  diff: ({\n    news,\n    olds,\n    output,\n  }: {\n    news: Input<Props>;\n    olds: Props;\n    output: Attributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      if (!isResolved(news)) return undefined;\n      if (olds.name !== news.name) return { action: 'replace' } as const;\n      yield* guard(news, output === undefined);\n      if (output === undefined) return undefined;\n      const live = yield* readMatcher(news);\n      if (live === undefined) {\n        yield* guard(news, true);\n        return { action: 'update' } as const;\n      }\n      return { action: matcherMatches(live, news) ? 'noop' : 'update' } as const;\n    }),\n  reconcile: ({ news }: { news: Props }) =>\n    Effect.gen(function* () {\n      const live = yield* readMatcher(news);\n      yield* guard(news, live === undefined);\n      if (live === undefined) yield* createMatcher(news);\n      else if (!matcherMatches(live, news)) yield* updateMatcher(news);\n      const after = yield* readMatcher(news);\n      if (after === undefined)\n        return yield* Effect.die(\n          new Error(`Notification matcher ${news.name}: write returned but read-back is absent.`),\n        );\n      return after;\n    }),\n  delete: ({ olds }: { olds: Props }) => deleteMatcher(olds),\n};\n",
     "/**\n * A notification matcher — the rule that routes a notification to its targets — as ONE shape\n * shared by PVE (`Proxmox.NotificationMatcher`) and PBS (`Pbs.NotificationMatcher`).\n *\n * ★ ONE FILE FOR BOTH PRODUCTS BECAUSE IT IS ONE IMPLEMENTATION. Both servers run the same Rust\n *   crate, `proxmox-notify` (matcher.rs), PVE through its Perl bindings; the schemas in\n *   generated/pve.ts and generated/pbs.ts carry the same nine fields, and the forms below are\n *   typed against BOTH, so a drift on either side fails `tsc` here rather than on a server.\n *\n * ⚠️ A MATCHER IS ITS WHOLE RULE, SO EVERY RULE FIELD IS COMPARED, DECLARED OR NOT. Most families\n *   here leave an undeclared field alone (backup-job.ts's trade). A matcher cannot: an undeclared\n *   `match-field` on a matcher that has one is a declaration claiming \"route everything\" over a\n *   server that routes one job type — and `invert-match` flips the meaning of every other line.\n *   So `match-*` default to empty, `mode` to `all`, `invert-match` and `disable` to false, all are\n *   compared, and a PUT sends all of them (an emptied list as `delete`). Only `comment` keeps the\n *   usual \"undeclared is unmanaged\" rule, because nothing routes on it.\n *   ★ THE COST IS THAT ADOPTING A MATCHER MEANS DECLARING IT AS IT IS. PBS ships `default-matcher`\n *     with `invert-match`, a `match-field` and a `match-severity` (measured on PBS 4.2, 2026-09-22),\n *     so adopting it as-is means writing those three down. A declaration that leaves them out\n *     plans an UPDATE, which is the plan telling the truth about what the deploy would do.\n */\nimport type {\n  ClusterNotificationsMatchersNamePutParams,\n  ClusterNotificationsMatchersPostParams,\n} from './generated/pve.ts';\nimport type {\n  ConfigNotificationsMatchersNamePutParams,\n  ConfigNotificationsMatchersPostParams,\n} from './generated/pbs.ts';\nimport { bool, text } from './values.ts';\n\n/** Everything a matcher declares except where it lives — the resource files add `target`. */\nexport interface NotificationMatcherFields {\n  /** The primary key, a safe id (2–32 chars on PBS). Changing it is a replace. */\n  name: string;\n  /**\n   * ⛔ THE TARGETS, BY NAME, AND REQUIRED: a matcher that notifies nobody is a routing rule for\n   *   silence. `[]` is still declarable, and clears the list.\n   * ⚠️ `targets`, NOT THE SERVER'S `target`: every resource here already spends `target` on the\n   *   HOST (resource.ts `WithTarget`), and one key cannot mean both. The wire still says `target`.\n   */\n  targets: readonly string[];\n  /**\n   * Severity rules. EACH ITEM IS ITSELF A COMMA LIST: `'warning,error'` matches either.\n   * ⛔ `['warning', 'error']` IS NOT THE SAME RULE AND UNDER `mode: 'all'` NEVER MATCHES. Items are\n   *   combined with `mode`; the severities inside one item are always OR-ed (matcher.rs\n   *   `SeverityMatcher`). A notification has one severity, so two items under AND ask for a\n   *   notification that is both — and routing nothing is the quietest failure a matcher has.\n   * Severities: `info`, `notice`, `warning`, `error`, `unknown`.\n   */\n  'match-severity'?: readonly string[];\n  /**\n   * Metadata rules, `exact:<field>=<v1>,<v2>` or `regex:<field>=<re>`. ⚠️ THE PREFIX IS REQUIRED:\n   * the schema's pattern makes it optional and the parser then refuses it. A notification WITHOUT\n   * the field never matches its rule — so `exact:job-id=…` excludes every garbage collection.\n   */\n  'match-field'?: readonly string[];\n  /** Time windows, e.g. `mon-fri 9:00-17:00`. Compared as written; the server keeps the text. */\n  'match-calendar'?: readonly string[];\n  /** How the rule items combine. The server's default, and this package's, is `all`. */\n  mode?: 'all' | 'any';\n  /** Invert the whole rule. ⚠️ IGNORED WHEN THERE ARE NO RULES — an empty matcher always matches. */\n  'invert-match'?: boolean;\n  /** A disabled matcher routes nothing. */\n  disable?: boolean;\n  /** Free text. The one field left alone when undeclared; `''` clears it. */\n  comment?: string;\n}\n\n/** ⚠️ Lists are CANONICAL and SORTED, so a re-ordered declaration is not a diff. */\nexport interface NotificationMatcherAttributes {\n  name: string;\n  /**\n   * `builtin`, `modified-builtin` or `user-created`. REPORTED, NEVER COMPARED.\n   * ⛔ ON A BUILT-IN A DELETE REVERTS RATHER THAN REMOVES, and reports success either way — Alchemy\n   *   drops the row while `default-matcher` goes on routing. Read this before destroying one.\n   * ★ MEASURED ON THE PER-OBJECT READ, which the published schema does not list: PVE 9.2.11 and\n   *   PBS 4.2 both return it from `…/matchers/default-matcher` (2026-09-22).\n   */\n  origin: string;\n  comment: string;\n  disable: boolean;\n  'invert-match': boolean;\n  mode: string;\n  targets: readonly string[];\n  'match-severity': readonly string[];\n  'match-field': readonly string[];\n  'match-calendar': readonly string[];\n}\n\nconst list = (value: unknown): readonly string[] =>\n  Array.isArray(value) ? value.map((item: unknown) => String(item)) : [];\n\n/** Trimmed items, empty ones dropped. */\nconst items = (values: readonly string[], canonical: (item: string) => string): string[] =>\n  values.map((item) => canonical(item.trim())).filter((item) => item !== '');\n\n/**\n * ⚠️ THE SERVER WRITES A RULE BACK IN ITS OWN SPELLING, SO BOTH SIDES ARE SPELLED ITS WAY FIRST.\n *   matcher.rs parses `exact:type=gc, verify` into values and `Display`s them joined by a bare\n *   comma; a severity item is split, trimmed and re-joined the same way. Without this a\n *   declaration with a space after a comma would plan an update forever.\n */\nconst severity = (item: string): string =>\n  item\n    .split(',')\n    .map((part) => part.trim())\n    .filter((part) => part !== '')\n    .sort()\n    .join(',');\n\nconst field = (item: string): string => {\n  if (!item.startsWith('exact:')) return item;\n  const at = item.indexOf('=');\n  if (at < 0) return item;\n  const values = item.slice(at + 1).split(',');\n  return `${item.slice(0, at)}=${values.map((value) => value.trim()).join(',')}`;\n};\n\nconst same = (item: string): string => item;\n\n/** A declaration's lists, canonical and sorted — the form `matches` compares. */\nexport const canonicalRules = (fields: NotificationMatcherFields) => ({\n  'match-calendar': items(fields['match-calendar'] ?? [], same).sort(),\n  'match-field': items(fields['match-field'] ?? [], field).sort(),\n  'match-severity': items(fields['match-severity'] ?? [], severity).sort(),\n  targets: items(fields.targets, same).sort(),\n});\n\nexport const matcherAttributes = (\n  live: Record<string, unknown>,\n  name: string,\n): NotificationMatcherAttributes => ({\n  comment: text(live['comment']),\n  disable: bool(live['disable']),\n  'invert-match': bool(live['invert-match']),\n  'match-calendar': items(list(live['match-calendar']), same).sort(),\n  'match-field': items(list(live['match-field']), field).sort(),\n  'match-severity': items(list(live['match-severity']), severity).sort(),\n  // ⚠️ ABSENT IS `all` — matcher.rs `mode.unwrap_or_default()`, and `All` is the default variant.\n  mode: text(live['mode'], 'all') || 'all',\n  name,\n  origin: text(live['origin']),\n  targets: items(list(live['target']), same).sort(),\n});\n\nconst equal = (a: readonly string[], b: readonly string[]): boolean =>\n  a.length === b.length && a.every((item, index) => item === b[index]);\n\nexport const matcherMatches = (\n  attributes: NotificationMatcherAttributes,\n  fields: NotificationMatcherFields,\n): boolean => {\n  const rules = canonicalRules(fields);\n  return (\n    attributes.disable === (fields.disable === true) &&\n    attributes['invert-match'] === (fields['invert-match'] === true) &&\n    attributes.mode === (fields.mode ?? 'all') &&\n    equal(attributes.targets, rules.targets) &&\n    equal(attributes['match-severity'], rules['match-severity']) &&\n    equal(attributes['match-field'], rules['match-field']) &&\n    equal(attributes['match-calendar'], rules['match-calendar']) &&\n    (fields.comment === undefined || attributes.comment === fields.comment)\n  );\n};\n\ntype Deletable = NonNullable<ConfigNotificationsMatchersNamePutParams['delete']>[number];\ntype Lists = 'match-calendar' | 'match-field' | 'match-severity' | 'target';\n\n/**\n * The fields both forms send. ⚠️ LISTS GO AS ARRAYS — REPEATED KEYS ON THE WIRE (client.ts\n * `encode`) — because every list here is `type: array` on both servers, and a comma inside a\n * severity item or an `exact:` rule means a comma-joined string could not carry them anyway.\n */\nconst always = (fields: NotificationMatcherFields) => ({\n  disable: fields.disable === true ? ('1' as const) : ('0' as const),\n  'invert-match': fields['invert-match'] === true ? ('1' as const) : ('0' as const),\n  mode: fields.mode ?? ('all' as const),\n});\n\nconst lists = (fields: NotificationMatcherFields): Partial<Record<Lists, readonly string[]>> => {\n  const rules = canonicalRules(fields);\n  const out: Partial<Record<Lists, readonly string[]>> = {};\n  if (rules['match-calendar'].length > 0) out['match-calendar'] = rules['match-calendar'];\n  if (rules['match-field'].length > 0) out['match-field'] = rules['match-field'];\n  if (rules['match-severity'].length > 0) out['match-severity'] = rules['match-severity'];\n  if (rules.targets.length > 0) out.target = rules.targets;\n  return out;\n};\n\nexport type MatcherCreateForm = ConfigNotificationsMatchersPostParams &\n  ClusterNotificationsMatchersPostParams;\nexport type MatcherUpdateForm = ConfigNotificationsMatchersNamePutParams &\n  ClusterNotificationsMatchersNamePutParams;\n\n/** ⛔ `name` is create-only: the body carries it once and the path forever after. */\nexport const matcherCreateForm = (fields: NotificationMatcherFields): MatcherCreateForm => ({\n  ...always(fields),\n  ...lists(fields),\n  ...(fields.comment === undefined || fields.comment === '' ? {} : { comment: fields.comment }),\n  name: fields.name,\n});\n\n/**\n * ⛔ AN EMPTIED LIST IS A `delete`, NOT AN EMPTY VALUE. A form cannot carry an empty array — no\n *   key is sent at all — so without the `delete` entry a declaration of `'match-field': []`\n *   would plan an update, PUT nothing for that field, and plan the same update forever.\n */\nexport const matcherUpdateForm = (fields: NotificationMatcherFields): MatcherUpdateForm => {\n  const present = lists(fields);\n  const cleared: Deletable[] = (\n    ['match-calendar', 'match-field', 'match-severity', 'target'] as const\n  ).filter((key) => present[key] === undefined);\n  if (fields.comment === '') cleared.push('comment');\n  return {\n    ...always(fields),\n    ...present,\n    ...(fields.comment === undefined || fields.comment === '' ? {} : { comment: fields.comment }),\n    ...(cleared.length === 0 ? {} : { delete: cleared }),\n  };\n};\n",
-    "/**\n * `Proxmox.NotificationTarget` — where a failed backup goes to be seen.\n *\n * ★ THE FAILURE MODE THIS REMOVES IS SILENCE. A failed vzdump, a lost HA service and a broken\n *   replication job all reach a human through one mechanism: a notification target. Out of the box\n *   a cluster has exactly one, the built-in `mail-to-root` — one mailbox, on one node, delivered by\n *   that node's local MTA. Declared, a failure becomes visible; undeclared, nothing looks wrong\n *   until somebody goes looking for a backup that was never taken. Every other resource in this\n *   package fails loudly. This is the one whose absence fails quietly.\n *\n * ⛔ THE PER-OBJECT READ GOES THROUGH `endpoints/{type}/{name}`, NEVER `targets/{name}`.\n *   `GET /cluster/notifications/targets/{name}` answers \"Method not implemented\" — MEASURED, and\n *   corroborated by the cluster's own apidoc, where that path node carries no methods at all.\n *   `/targets` is a READ-ONLY UNION VIEW implementing the collection GET and `{name}/test` and\n *   nothing else. So `type` is IDENTITY here, not a setting: it appears in both `path()` and\n *   `collection()`, and changing it is a replace rather than an update.\n *\n * ⚠️ A BUILT-IN TARGET CAN BE ADOPTED AND STILL NOT BE OWNED. The shipped entries report\n *   `origin: builtin` or `modified-builtin`, and a DELETE on one REVERTS it to shipped defaults\n *   instead of removing it: Alchemy drops the resource from state while the target is still on the\n *   cluster delivering mail. Check `origin` on `/cluster/notifications/targets` before declaring a\n *   name you did not create. ⚠️ `origin` IS DELIBERATELY NOT AN ATTRIBUTE — the schema returns it\n *   on the collection view only, never on the per-object read, so an attribute would read \"unknown\"\n *   for every object forever, and an attribute that always lies is worse than a true comment.\n *\n * ⛔ NO SECRET IS A PROP, LET ALONE AN ATTRIBUTE. smtp `password`, gotify `token` and webhook\n *   `secret` are write-only and none is declarable here. Props are persisted too, not just\n *   attributes — `delete` is handed `olds`, which can only have come from the state store — so a\n *   secret prop would sit unencrypted in the state Postgres for as long as the resource exists.\n *   ⚠️ THE COST IS REAL: `token` is REQUIRED on a gotify create, so a gotify target cannot be\n *     created from here at all. Create one out of band with its secret and then declare it — the\n *     read finds it, reconcile takes the PUT path, and PVE leaves any field the body does not\n *     mention alone. The secret half stays a human's; the rest is declared. Same for an\n *     authenticated smtp target and a signed webhook.\n *\n * ★ WHAT THIS NEEDS, READ OFF THE CLUSTER'S OWN SCHEMA:\n *     read/diff  GET endpoints/{type}/{name}  Mapping.Audit (or Mapping.Modify) on\n *                                             /mapping/notifications\n *     reconcile  POST + PUT                   Mapping.Modify on /mapping/notifications AND one of\n *                                             Sys.Audit / Sys.Modify / Sys.AccessNetwork on /\n *     delete     DELETE                       Mapping.Modify on /mapping/notifications\n *   The provision role already carried Sys.Audit on `/` (see lxc.ts), so the delta was the two\n *   Mapping privileges — notably NOT the `Sys.Modify` a backup job costs. `PROVISION_PRIVILEGES`\n *   carries both on `/`: the baseline took the trade below knowingly.\n *   ⚠️ PREFER A SECOND ROLE GRANTED AT `/mapping/notifications` OVER WIDENING THE PROVISIONING ROLE\n *     ON `/`. `/mapping` also holds the PCI and USB passthrough maps, so Mapping.Modify at the root\n *     lets a credential scoped to make containers rewire somebody's hardware.\n *   ⛔ A MISSING READ PRIVILEGE DOES NOT LOOK LIKE A 403. `pveOperations.read` ends in\n *     `orElseSucceed(() => undefined)`, so a 403 on the GET is indistinguishable from \"absent\": the\n *     plan says create, PVE answers \"already exists\", and the fault was an ACL all along. That pair\n *     is the signature — grant Mapping.Audit to the READ role before changing anything else.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { targetEndpoint } from './notification-target-endpoint.ts';\nimport { addressList, createShape, headerList, portOf, shape } from './notification-target-form.ts';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { text } from './values.ts';\n\n/** The four families PVE ships. `GET /cluster/notifications/endpoints` lists exactly these. */\nexport type NotificationTargetType = 'gotify' | 'sendmail' | 'smtp' | 'webhook';\n\n/**\n * ⚠️ PVE'S OWN KEY NAMES, DASHES INCLUDED, for the reason backup-job.ts gives: the form is then a\n *   copy rather than a translation table, and a translation table is one more place for a key to be\n *   renamed and silently never sent.\n *\n * ⚠️ A FIELD THAT DOES NOT BELONG TO `type` IS STILL SENT, and PVE refuses it by name. That 400\n *   beats this file quietly dropping a `mailto` somebody wrote on a webhook.\n */\nexport interface NotificationTargetProps extends WithTarget {\n  /** ⛔ IDENTITY: it picks the family AND the URL, so changing it is a replace. */\n  type: NotificationTargetType;\n  /**\n   * PVE's primary key, unique ACROSS ALL FOUR FAMILIES: a webhook cannot be called `mail-to-root`,\n   * because a sendmail target already is. Format `pve-configid`.\n   */\n  name: string;\n  /** Free text in the UI. */\n  comment?: string;\n  /** Configured but not delivering. Always sent and always compared — see `shape`. */\n  disable?: boolean;\n  /** sendmail, smtp: recipients. ⚠️ Order is not meaning — see `addressList`. */\n  mailto?: readonly string[];\n  /** sendmail, smtp: PVE users, whose own configured address receives the mail. */\n  'mailto-user'?: readonly string[];\n  /** smtp: the SMTP host. gotify: the server URL. PVE requires it on create for both. */\n  server?: string;\n  /** smtp only. Unset lets PVE pick from `mode`: 465 tls, 587 starttls, 25 insecure. */\n  port?: number;\n  /** smtp only. PVE's schema default is `tls`. */\n  mode?: 'insecure' | 'starttls' | 'tls';\n  /** smtp only. ⛔ The matching `password` is not declarable — see the header. */\n  username?: string;\n  /** smtp: PVE requires it on create. sendmail: optional. */\n  'from-address'?: string;\n  /** Display name on the mail. PVE's smtp schema defaults it to `Proxmox VE`. */\n  author?: string;\n  /** webhook: PVE requires it on create. */\n  url?: string;\n  /** webhook: PVE requires it on create. Lower case — PVE's enum is `post|put|get`. */\n  method?: 'get' | 'post' | 'put';\n  /**\n   * webhook: `name=<name>,value=<base64 of value>` property strings, as PVE stores them.\n   * ⚠️ MORE THAN ONE HEADER IS THE ONE THING HERE NOT PROVEN ON A WIRE — see `REPEATED_KEY`.\n   */\n  header?: readonly string[];\n  /**\n   * webhook: the request body, base64, as PVE stores it.\n   * ⚠️ THE UI SHOWS THE DECODED BODY AND THIS DOES NOT. Declaring the base64 is what keeps\n   *   `matches` symmetric with the read; decoding for display would mean encoding on write, and a\n   *   round trip PVE normalises differently is a forever-update. The cost is an unreadable diff.\n   */\n  body?: string;\n}\n\n/**\n * ⚠️ EVERY FIELD IS PRESENT FOR EVERY FAMILY, with `''` / `0` meaning \"PVE holds nothing\". A\n *   webhook reads back an empty `mailto`, which is also what a webhook declares, so the\n *   cross-family fields cost one comparison each and never a false update.\n */\nexport interface NotificationTargetAttributes {\n  name: string;\n  type: NotificationTargetType;\n  comment: string;\n  disable: boolean;\n  /** Sorted and comma-joined, so re-ordering a declaration is not a diff. See `addressList`. */\n  mailto: string;\n  'mailto-user': string;\n  server: string;\n  /** 0 means PVE holds no port and will pick one from `mode`. */\n  port: number;\n  mode: string;\n  username: string;\n  'from-address': string;\n  author: string;\n  url: string;\n  method: string;\n  /** Sorted and comma-joined for COMPARISON only; the wire form differs. See `headerList`. */\n  header: string;\n  body: string;\n}\n\nexport interface ProxmoxNotificationTarget extends Resource<\n  'Proxmox.NotificationTarget',\n  NotificationTargetProps,\n  NotificationTargetAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxNotificationTarget = Resource<ProxmoxNotificationTarget>(\n  'Proxmox.NotificationTarget',\n);\n\nconst handlers = pveHandlers<NotificationTargetProps, NotificationTargetAttributes>({\n  /**\n   * ⛔ NAMED FIELDS, NEVER A SPREAD OF `live`. gotify's `token` and smtp's `password` really are\n   *   absent from their read schemas — but webhook's read schema DECLARES `secret`, so \"PVE will\n   *   not hand it to us\" is not a defence. Listing what is kept is what keeps secret material out\n   *   of a state row, whatever a future PVE decides to start returning.\n   */\n  attributes: (live, props) => ({\n    author: text(live['author']),\n    body: text(live['body']),\n    comment: text(live['comment']),\n    disable: live['disable'] === 1 || live['disable'] === true,\n    'from-address': text(live['from-address']),\n    header: headerList(live['header']),\n    mailto: addressList(live['mailto']),\n    'mailto-user': addressList(live['mailto-user']),\n    method: text(live['method']),\n    mode: text(live['mode']),\n    name: props.name,\n    port: portOf(live['port']),\n    server: text(live['server']),\n    type: props.type,\n    url: text(live['url']),\n    username: text(live['username']),\n  }),\n  collection: (props) => `cluster/notifications/endpoints/${props.type}`,\n  /** ⛔ `name` is create-only: PVE takes it in the body once, and in the path forever after. */\n  createForm: createShape,\n  /** ⚠️ A function, because the type picks the endpoint — see `targetEndpoint`. */\n  endpoint: targetEndpoint,\n  /**\n   * Each line reads \"not declared, or equal\"; `disable` is the one field with no undeclared case.\n   *\n   * ⚠️ IF A PLAN NEVER SETTLES, SUSPECT A SCHEMA DEFAULT COMING BACK AS A VALUE. PVE defaults smtp\n   *   `mode` to `tls` and smtp `author` to `Proxmox VE`, and applies both when the mail is sent\n   *   rather than writing them into the config — so an undeclared field reads back empty and its\n   *   line is skipped. A version that STORED them would answer with a field nobody declared. The\n   *   fix is to declare the field, never to stop comparing it.\n   */\n  matches: (attributes, props) =>\n    attributes.disable === (props.disable === true) &&\n    (props.comment === undefined || attributes.comment === props.comment) &&\n    (props.server === undefined || attributes.server === props.server) &&\n    (props.port === undefined || attributes.port === props.port) &&\n    (props.mode === undefined || attributes.mode === props.mode) &&\n    (props.username === undefined || attributes.username === props.username) &&\n    (props['from-address'] === undefined || attributes['from-address'] === props['from-address']) &&\n    (props.author === undefined || attributes.author === props.author) &&\n    (props.url === undefined || attributes.url === props.url) &&\n    (props.method === undefined || attributes.method === props.method) &&\n    (props.body === undefined || attributes.body === props.body) &&\n    (props.mailto === undefined || attributes.mailto === addressList(props.mailto)) &&\n    (props['mailto-user'] === undefined ||\n      attributes['mailto-user'] === addressList(props['mailto-user'])) &&\n    (props.header === undefined || attributes.header === headerList(props.header)),\n  path: (props) => `cluster/notifications/endpoints/${props.type}/${props.name}`,\n  updateForm: shape,\n});\n\n/**\n * ⚠️ ON A BUILT-IN TARGET A DELETE REVERTS RATHER THAN REMOVES, and PVE reports success either way.\n *   It is passed through unguarded because everywhere else in this package the cluster's answer is\n *   the answer — but this is the one case where a green plan and the cluster disagree, and the\n *   object left standing is the one carrying the estate's failure mail.\n */\nexport const ProxmoxNotificationTargetProvider = () =>\n  Provider.effect(\n    ProxmoxNotificationTarget,\n    Effect.succeed(ProxmoxNotificationTarget.Provider.of(handlers)),\n  );\n",
+    "/** PVE 9.2.11 matchers through distilled; 404 is measured absence, other failures propagate. */\nimport * as cluster from '@distilled.cloud/proxmox/cluster';\nimport * as Effect from 'effect/Effect';\nimport type { NotificationMatcherProps } from './notification-matcher.ts';\nimport {\n  matcherAttributes,\n  matcherCreateForm,\n  matcherUpdateForm,\n} from './notification-matcher-form.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { notificationRequest, notificationResponse } from './notification-sdk-input.ts';\n\nexport const readMatcher = (props: NotificationMatcherProps) =>\n  runPve(\n    props.target,\n    'read',\n    false,\n    cluster.getClusterNotificationMatcher({ name: props.name }),\n  ).pipe(\n    Effect.flatMap(notificationResponse(cluster.GetClusterNotificationMatcherResponse)),\n    Effect.map((live) =>\n      matcherAttributes(\n        {\n          ...live,\n          'invert-match': live.invert_match,\n          'match-calendar': live.match_calendar,\n          'match-field': live.match_field,\n          'match-severity': live.match_severity,\n        },\n        props.name,\n      ),\n    ),\n    Effect.catchTag('NotFound', () => Effect.succeed(undefined)),\n  );\n\nexport const createMatcher = (props: NotificationMatcherProps) =>\n  Effect.gen(function* () {\n    const input = yield* notificationRequest(\n      cluster.CreateClusterNotificationMatcherRequest,\n      matcherCreateForm(props),\n    );\n    yield* runPve(props.target, 'provision', true, cluster.createClusterNotificationMatcher(input));\n  });\n\nexport const updateMatcher = (props: NotificationMatcherProps) =>\n  Effect.gen(function* () {\n    const input = yield* notificationRequest(cluster.PutClusterNotificationMatcherRequest, {\n      ...matcherUpdateForm(props),\n      name: props.name,\n    });\n    yield* runPve(props.target, 'provision', true, cluster.putClusterNotificationMatcher(input));\n  });\n\nexport const deleteMatcher = (props: NotificationMatcherProps) =>\n  runPve(\n    props.target,\n    'provision',\n    true,\n    cluster.deleteClusterNotificationMatcher({ name: props.name }),\n  ).pipe(Effect.catchTag('NotFound', () => Effect.void));\n",
+    "/** PVE 9.2.11 form names mapped to the generated SDK's TypeScript field names. */\nimport { ProxmoxParseError } from '@distilled.cloud/proxmox/Errors';\nimport * as Data from 'effect/Data';\nimport * as Effect from 'effect/Effect';\nimport * as Schema from 'effect/Schema';\n\n/** Local schema refusal names the operation, never a form value (headers may be sensitive). */\nexport class NotificationRequestInvalid extends Data.TaggedError('NotificationRequestInvalid')<{\n  readonly operation: string;\n}> {}\n\n/**\n * The provider's forms already enforce vendor constraints. This final generated-schema\n * check validates the translated Type-side fields without a cast. Unexpected family fields\n * fail explicitly instead of disappearing through the decoder's default excess-property stripping.\n */\nexport const notificationRequest = <S extends Schema.Top>(schema: S, fields: object) =>\n  Schema.decodeUnknownEffect(Schema.toType(schema), { onExcessProperty: 'error' })(\n    Object.fromEntries(\n      Object.entries(fields).map(([key, value]) => [key.replaceAll('-', '_'), value]),\n    ),\n  ).pipe(\n    Effect.mapError(() => new NotificationRequestInvalid({ operation: 'PVE notification write' })),\n  );\n\n/** Validate required response fields with the SDK schema without discarding vendor extras. */\nexport const notificationResponse =\n  <S extends Schema.Top>(schema: S) =>\n  (body: S['Type']) =>\n    Schema.decodeUnknownEffect(Schema.toType(schema))(body).pipe(\n      Effect.as(body),\n      Effect.mapError(\n        () =>\n          new ProxmoxParseError({\n            body: undefined,\n            cause: 'PVE notification response does not match its SDK schema',\n          }),\n      ),\n    );\n",
+    "/**\n * `Proxmox.NotificationTarget` — where a failed backup goes to be seen.\n *\n * ★ THE FAILURE MODE THIS REMOVES IS SILENCE. A failed vzdump, a lost HA service and a broken\n *   replication job all reach a human through one mechanism: a notification target. Out of the box\n *   a cluster has exactly one, the built-in `mail-to-root` — one mailbox, on one node, delivered by\n *   that node's local MTA. Declared, a failure becomes visible; undeclared, nothing looks wrong\n *   until somebody goes looking for a backup that was never taken. Every other resource in this\n *   package fails loudly. This is the one whose absence fails quietly.\n *\n * ⛔ THE PER-OBJECT READ GOES THROUGH `endpoints/{type}/{name}`, NEVER `targets/{name}`.\n *   `GET /cluster/notifications/targets/{name}` answers \"Method not implemented\" — MEASURED, and\n *   corroborated by the cluster's own apidoc, where that path node carries no methods at all.\n *   `/targets` is a READ-ONLY UNION VIEW implementing the collection GET and `{name}/test` and\n *   nothing else. So `type` is IDENTITY here, not a setting: it appears in both `path()` and\n *   `collection()`, and changing it is a replace rather than an update.\n *\n * ⚠️ A BUILT-IN TARGET CAN BE ADOPTED AND STILL NOT BE OWNED. The shipped entries report\n *   `origin: builtin` or `modified-builtin`, and a DELETE on one REVERTS it to shipped defaults\n *   instead of removing it: Alchemy drops the resource from state while the target is still on the\n *   cluster delivering mail. Check `origin` on `/cluster/notifications/targets` before declaring a\n *   name you did not create. ⚠️ `origin` IS DELIBERATELY NOT AN ATTRIBUTE — the schema returns it\n *   on the collection view only, never on the per-object read, so an attribute would read \"unknown\"\n *   for every object forever, and an attribute that always lies is worse than a true comment.\n *\n * ⛔ NO SECRET IS A PROP, LET ALONE AN ATTRIBUTE. smtp `password`, gotify `token` and webhook\n *   `secret` are write-only and none is declarable here. Props are persisted too, not just\n *   attributes — `delete` is handed `olds`, which can only have come from the state store — so a\n *   secret prop would sit unencrypted in the state Postgres for as long as the resource exists.\n *   ⚠️ THE COST IS REAL: `token` is REQUIRED on a gotify create, so a gotify target cannot be\n *     created from here at all. Create one out of band with its secret and then declare it — the\n *     read finds it, reconcile takes the PUT path, and PVE leaves any field the body does not\n *     mention alone. The secret half stays a human's; the rest is declared. Same for an\n *     authenticated smtp target and a signed webhook.\n *\n * ★ WHAT THIS NEEDS, READ OFF THE CLUSTER'S OWN SCHEMA:\n *     read/diff  GET endpoints/{type}/{name}  Mapping.Audit (or Mapping.Modify) on\n *                                             /mapping/notifications\n *     reconcile  POST + PUT                   Mapping.Modify on /mapping/notifications AND one of\n *                                             Sys.Audit / Sys.Modify / Sys.AccessNetwork on /\n *     delete     DELETE                       Mapping.Modify on /mapping/notifications\n *   The provision role already carried Sys.Audit on `/` (see lxc.ts), so the delta was the two\n *   Mapping privileges — notably NOT the `Sys.Modify` a backup job costs. `PROVISION_PRIVILEGES`\n *   carries both on `/`: the baseline took the trade below knowingly.\n *   ⚠️ PREFER A SECOND ROLE GRANTED AT `/mapping/notifications` OVER WIDENING THE PROVISIONING ROLE\n *     ON `/`. `/mapping` also holds the PCI and USB passthrough maps, so Mapping.Modify at the root\n *     lets a credential scoped to make containers rewire somebody's hardware.\n *   ⛔ THE OLD HAND CLIENT FOLDED 403 INTO \"ABSENT\": the plan said create, PVE refused the\n *     duplicate, and the fault was an ACL all along. Distilled now propagates that failure.\n *     Grant Mapping.Audit to the READ role before adopting; only typed NotFound means absent.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { targetHandlers } from './notification-target-lifecycle.ts';\n\n/** The four families PVE ships. `GET /cluster/notifications/endpoints` lists exactly these. */\nexport type NotificationTargetType = 'gotify' | 'sendmail' | 'smtp' | 'webhook';\n\n/**\n * ⚠️ PVE'S OWN KEY NAMES, DASHES INCLUDED, for the reason backup-job.ts gives: the form is then a\n *   copy rather than a translation table, and a translation table is one more place for a key to be\n *   renamed and silently never sent.\n *\n * ⚠️ A FIELD THAT DOES NOT BELONG TO `type` IS STILL SENT, and PVE refuses it by name. That 400\n *   beats this file quietly dropping a `mailto` somebody wrote on a webhook.\n */\nexport interface NotificationTargetProps extends WithTarget {\n  /** ⛔ IDENTITY: it picks the family AND the URL, so changing it is a replace. */\n  type: NotificationTargetType;\n  /**\n   * PVE's primary key, unique ACROSS ALL FOUR FAMILIES: a webhook cannot be called `mail-to-root`,\n   * because a sendmail target already is. Format `pve-configid`.\n   */\n  name: string;\n  /** Free text in the UI. */\n  comment?: string;\n  /** Configured but not delivering. Always sent and always compared — see `shape`. */\n  disable?: boolean;\n  /** sendmail, smtp: recipients. ⚠️ Order is not meaning — see `addressList`. */\n  mailto?: readonly string[];\n  /** sendmail, smtp: PVE users, whose own configured address receives the mail. */\n  'mailto-user'?: readonly string[];\n  /** smtp: the SMTP host. gotify: the server URL. PVE requires it on create for both. */\n  server?: string;\n  /** smtp only. Unset lets PVE pick from `mode`: 465 tls, 587 starttls, 25 insecure. */\n  port?: number;\n  /** smtp only. PVE's schema default is `tls`. */\n  mode?: 'insecure' | 'starttls' | 'tls';\n  /** smtp only. ⛔ The matching `password` is not declarable — see the header. */\n  username?: string;\n  /** smtp: PVE requires it on create. sendmail: optional. */\n  'from-address'?: string;\n  /** Display name on the mail. PVE's smtp schema defaults it to `Proxmox VE`. */\n  author?: string;\n  /** webhook: PVE requires it on create. */\n  url?: string;\n  /** webhook: PVE requires it on create. Lower case — PVE's enum is `post|put|get`. */\n  method?: 'get' | 'post' | 'put';\n  /**\n   * webhook: `name=<name>,value=<base64 of value>` property strings, as PVE stores them.\n   * ⚠️ MORE THAN ONE HEADER IS THE ONE THING HERE NOT PROVEN ON A WIRE — see `REPEATED_KEY`.\n   */\n  header?: readonly string[];\n  /**\n   * webhook: the request body, base64, as PVE stores it.\n   * ⚠️ THE UI SHOWS THE DECODED BODY AND THIS DOES NOT. Declaring the base64 is what keeps\n   *   `matches` symmetric with the read; decoding for display would mean encoding on write, and a\n   *   round trip PVE normalises differently is a forever-update. The cost is an unreadable diff.\n   */\n  body?: string;\n}\n\n/**\n * ⚠️ EVERY FIELD IS PRESENT FOR EVERY FAMILY, with `''` / `0` meaning \"PVE holds nothing\". A\n *   webhook reads back an empty `mailto`, which is also what a webhook declares, so the\n *   cross-family fields cost one comparison each and never a false update.\n */\nexport interface NotificationTargetAttributes {\n  name: string;\n  type: NotificationTargetType;\n  comment: string;\n  disable: boolean;\n  /** Sorted and comma-joined, so re-ordering a declaration is not a diff. See `addressList`. */\n  mailto: string;\n  'mailto-user': string;\n  server: string;\n  /** 0 means PVE holds no port and will pick one from `mode`. */\n  port: number;\n  mode: string;\n  username: string;\n  'from-address': string;\n  author: string;\n  url: string;\n  method: string;\n  /** Sorted and comma-joined for COMPARISON only; the wire form differs. See `headerList`. */\n  header: string;\n  body: string;\n}\n\nexport interface ProxmoxNotificationTarget extends Resource<\n  'Proxmox.NotificationTarget',\n  NotificationTargetProps,\n  NotificationTargetAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxNotificationTarget = Resource<ProxmoxNotificationTarget>(\n  'Proxmox.NotificationTarget',\n);\n\n/**\n * ⚠️ ON A BUILT-IN TARGET A DELETE REVERTS RATHER THAN REMOVES, and PVE reports success either way.\n *   It is passed through unguarded because everywhere else in this package the cluster's answer is\n *   the answer — but this is the one case where a green plan and the cluster disagree, and the\n *   object left standing is the one carrying the estate's failure mail.\n */\nexport const ProxmoxNotificationTargetProvider = () =>\n  Provider.effect(\n    ProxmoxNotificationTarget,\n    Effect.succeed(ProxmoxNotificationTarget.Provider.of(targetHandlers)),\n  );\n",
+    "/** PVE targets: observe before writes, retain secret omission and built-in delete behavior. */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport type {\n  NotificationTargetAttributes as Attributes,\n  NotificationTargetProps as Props,\n} from './notification-target.ts';\nimport { specGuards } from './resource-guard.ts';\nimport { targetSpec } from './notification-target-spec.ts';\nimport {\n  createTarget,\n  deleteTarget,\n  readTarget,\n  updateTarget,\n  validateTargetWrite,\n} from './notification-target-distilled.ts';\n\nconst { guardCreate, guardUpdate } = specGuards(targetSpec);\nconst guard = (props: Props, create: boolean) =>\n  guardCreate(props, create).pipe(Effect.andThen(guardUpdate(props)));\nexport const targetHandlers = {\n  /** Targets include built-ins and human-owned endpoints; enrollment remains explicit. */\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: Props }) =>\n    Effect.gen(function* () {\n      const live = yield* readTarget(olds);\n      yield* guard(olds, live === undefined);\n      return live;\n    }),\n  diff: ({\n    news,\n    olds,\n    output,\n  }: {\n    news: Input<Props>;\n    olds: Props;\n    output: Attributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      if (!isResolved(news)) return undefined;\n      // Names are unique across endpoint types. A same-name type change must delete first.\n      if (olds.name !== news.name || olds.type !== news.type) {\n        // ⛔ Validate before delete-first can remove the working target. An existing destination\n        // is adoption: do not demand create-only secrets that the provider cannot declare.\n        const destination = yield* readTarget(news);\n        yield* guard(news, destination === undefined);\n        yield* validateTargetWrite(news, destination === undefined);\n        return { action: 'replace', deleteFirst: olds.name === news.name } as const;\n      }\n      yield* guard(news, output === undefined);\n      if (output === undefined) return undefined;\n      const live = yield* readTarget(news);\n      if (live === undefined) {\n        yield* guard(news, true);\n        return { action: 'update' } as const;\n      }\n      return { action: targetSpec.matches(live, news) ? 'noop' : 'update' } as const;\n    }),\n  reconcile: ({ news }: { news: Props }) =>\n    Effect.gen(function* () {\n      const live = yield* readTarget(news);\n      yield* guard(news, live === undefined);\n      if (live === undefined) yield* createTarget(news);\n      else if (!targetSpec.matches(live, news)) yield* updateTarget(news);\n      const after = yield* readTarget(news);\n      if (after === undefined)\n        return yield* Effect.die(\n          new Error(`Notification target ${news.name}: write returned but read-back is absent.`),\n        );\n      return after;\n    }),\n  /** Vendor DELETE reverts built-ins; SDK NotFound makes an absent custom target idempotent. */\n  delete: ({ olds }: { olds: Props }) => deleteTarget(olds),\n};\n",
     "/**\n * `Proxmox.NotificationTarget`'s eight vendor endpoints — one create and one update per family.\n *\n * ⛔ PVE REGISTERS ONE PATH PER TYPE, NOT A `{type}` PARAMETER, AND THE FOUR SCHEMAS DIFFER IN\n *   WHAT THEY REQUIRE: gotify wants `server` and `token`, smtp `server` and `from-address`,\n *   webhook `url` and `method`, sendmail nothing but its name. One key for all four would enforce\n *   gotify's rules on a sendmail target and let three families through unchecked, which is why\n *   `PveSpec['endpoint']` admits a function of props.\n *\n * ⛔ THE STRINGS ARE LITERALS AND MUST STAY LITERALS. `codegen/constraints.ts` finds the endpoints\n *   to table by SCANNING THIS PACKAGE'S TEXT, so `` `pve:POST …/${props.type}` `` would be tabled\n *   by nothing and `constraintsFor` would throw on the first deploy that reached it.\n *\n * ⚠️ GOTIFY'S CREATE CAN NEVER SATISFY ITS OWN TABLE, AND THAT IS THE TRUTH RATHER THAN A BUG\n *   HERE. `token` is required by PVE and is a write-only secret, so it is not a prop — props are\n *   persisted to the state store unencrypted (the third ⛔ in notification-target.ts). A gotify\n *   target is created out of band and then DECLARED, which is an adopt followed by updates; the\n *   shared guard only demands the create form's required parameters when a create is really about\n *   to happen (`resource-guard.ts`), so declaring an existing gotify target still plans clean and\n *   asking to CREATE one is refused at plan time with `token: required` instead of by a 400.\n */\nimport type { NotificationTargetProps } from './notification-target.ts';\nimport type { EndpointPair } from './resource-spec.ts';\n\nconst ENDPOINTS: Readonly<Record<NotificationTargetProps['type'], EndpointPair>> = {\n  gotify: {\n    create: 'pve:POST /cluster/notifications/endpoints/gotify',\n    update: 'pve:PUT /cluster/notifications/endpoints/gotify/{name}',\n  },\n  sendmail: {\n    create: 'pve:POST /cluster/notifications/endpoints/sendmail',\n    update: 'pve:PUT /cluster/notifications/endpoints/sendmail/{name}',\n  },\n  smtp: {\n    create: 'pve:POST /cluster/notifications/endpoints/smtp',\n    update: 'pve:PUT /cluster/notifications/endpoints/smtp/{name}',\n  },\n  webhook: {\n    create: 'pve:POST /cluster/notifications/endpoints/webhook',\n    update: 'pve:PUT /cluster/notifications/endpoints/webhook/{name}',\n  },\n};\n\n/** The pair this declaration writes. ⚠️ `type` is identity here, so it never changes under a row. */\nexport const targetEndpoint = (props: NotificationTargetProps): EndpointPair =>\n  ENDPOINTS[props.type];\n",
-    "/**\n * A notification target's props, as the form PVE wants — including the one field in this package\n * that cannot be spelled as a comma list.\n *\n * ★ SPLIT OUT OF notification-target.ts TO KEEP BOTH UNDER THE 250-LINE CAP. The seam is the same\n *   one metric-server uses: this file turns a declaration into a form, and the resource file says\n *   what a target IS and when it has changed. The `import type` back is erased, so it is a cycle\n *   on paper only.\n */\nimport type { NotificationTargetProps } from './notification-target.ts';\nimport { text } from './values.ts';\n\n/**\n * ⛔ A MULTI-VALUED PARAMETER GOES ON THE WIRE DIFFERENTLY HERE THAN ANYWHERE ELSE IN THIS PACKAGE,\n *   AND THE DIFFERENCE IS MEASURED. Every other PVE endpoint spells a list `type: string, format:\n *   pve-configid-list` — comma-joined, which is what sdn-vnet.ts sends. On the notification\n *   endpoints `mailto`, `mailto-user`, `header` and `delete` are `type: array`, and PVE's own web\n *   UI submits those as REPEATED KEYS (`header=a&header=b`). `Record<string, string>` cannot repeat\n *   a key, so one value carrying a NUL goes instead: it percent-encodes to `%00`, and PVE's\n *   urlencoded decoder joins repeated keys with exactly that byte, rebuilding the same parameter.\n *   ⚠️ ONLY `header` NEEDS IT, and only past one entry. A header item is ITSELF the property string\n *     `name=<name>,value=<base64>`, so a comma cannot express even one of them. Addresses hold no\n *     commas and PVE's UI submits `mailto` as a comma-separated text field, so those go that way.\n *   ⚠️ REASONED FROM THE DECODER AND THE UI, NOT PROVEN BY A LIVE MULTI-HEADER WRITE. One header\n *     carries no separator and is unaffected either way; a longer list, if rejected, fails with a\n *     400 naming `header` rather than quietly dropping one, and the fix is one line here.\n */\nconst REPEATED_KEY = '\\0';\n\n/** ⚠️ `0` is \"PVE holds no port\". Integers have come back as strings elsewhere, so parse both. */\nexport const portOf = (value: unknown): number => {\n  const parsed = typeof value === 'number' ? value : Number.parseInt(String(value ?? ''), 10);\n  return Number.isNaN(parsed) ? 0 : parsed;\n};\n\nconst sorted = (parts: readonly string[]): string =>\n  parts\n    .map((part) => part.trim())\n    .filter((part) => part !== '')\n    .sort()\n    .join(',');\n\n/**\n * ⚠️ ORDER IS NOT MEANING IN A RECIPIENT LIST, SO IT MUST NOT BE A DIFF — backup-job.ts's reasoning\n *   about guest ids, applied to addresses. Both sides are sorted before they meet.\n *\n * ⚠️ PVE ANSWERS WITH AN ARRAY AND ACCEPTS A DELIMITED STRING, and this package has already been\n *   bitten by a list coming back flattened on one version and structured on another (`groups` in\n *   user.ts). PVE's UI calls `mailto` \"separated by spaces, commas or semicolons\", so all three are\n *   split here and both shapes funnel into one comparable value.\n */\nexport const addressList = (value: unknown): string =>\n  sorted(\n    Array.isArray(value)\n      ? value.map((item: unknown) => String(item))\n      : typeof value === 'string'\n        ? value.split(/[\\s,;]+/)\n        : [],\n  );\n\n/** ⛔ NEVER SPLIT ON A COMMA: a header item contains one. A lone string is one item, not a list. */\nexport const headerList = (value: unknown): string =>\n  sorted(Array.isArray(value) ? value.map((item: unknown) => String(item)) : [text(value)]);\n\nconst set = (key: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [key]: value };\n\n/**\n * The form for both create and update.\n *\n * ⛔ A FIELD THE DECLARATION LEAVES OUT IS NOT SENT AND NOT COMPARED — backup-job.ts's rule rather\n *   than sdn-vnet.ts's `delete` list, and here the choice is not close. That list would have to\n *   name `mailto`, so a target adopted from the UI and declared without its recipients would have\n *   them stripped on the first deploy: the one object that makes failures visible, turned back into\n *   silence. `delete` on this family is also `type: array` rather than the comma string every other\n *   endpoint takes, so sdn-vnet's encoding would not even carry.\n *   ⚠️ THE PRICE IS THAT REMOVING A LINE DOES NOT CLEAR A FIELD. Declare it as `''` to clear it,\n *     which IS sent: an empty string is a value, an absent prop is no request at all.\n *\n * ⚠️ `disable` IS ALWAYS SENT AND ALWAYS COMPARED, `0` INCLUDED. PVE documents the default as 0, so\n *   sending it explicitly is what makes \"not declared\" and \"declared false\" one state instead of a\n *   plan that asks for an update the PUT never performs. It is also the drift that matters most\n *   here: a target disabled by hand during a maintenance window and never re-enabled looks exactly\n *   like a healthy cluster.\n */\nexport const shape = (props: NotificationTargetProps): Record<string, string> => ({\n  disable: props.disable === true ? '1' : '0',\n  ...set('author', props.author),\n  ...set('body', props.body),\n  ...set('comment', props.comment),\n  ...set('from-address', props['from-address']),\n  ...set('header', props.header === undefined ? undefined : props.header.join(REPEATED_KEY)),\n  ...set('mailto', props.mailto === undefined ? undefined : addressList(props.mailto)),\n  ...set(\n    'mailto-user',\n    props['mailto-user'] === undefined ? undefined : addressList(props['mailto-user']),\n  ),\n  ...set('method', props.method),\n  ...set('mode', props.mode),\n  ...set('port', props.port === undefined ? undefined : String(props.port)),\n  ...set('server', props.server),\n  ...set('url', props.url),\n  ...set('username', props.username),\n});\n\n/**\n * The create form: `shape` plus the name PVE takes in the body exactly once.\n *\n * ★ EXPORTED SO THE CONSTRAINT PROOF CAN RUN THE REAL FORM rather than a retyped copy of it.\n * ⛔ `name` IS CREATE-ONLY: PVE takes it in the body on the POST and in the path forever after.\n */\nexport const createShape = (props: NotificationTargetProps): Record<string, string> => ({\n  ...shape(props),\n  name: props.name,\n});\n",
-    "/**\n * `Pbs.Datastore` — one section of Proxmox Backup Server's `datastore.cfg`, declared.\n *\n * ★ PBS IS A SIBLING OF PVE, NOT A PART OF IT. The estate runs both — PVE carries a storage of\n *   `type: pbs` — so declaring the datastore turns `Proxmox.Storage`'s `locator.datastore` from a\n *   string nothing checks into a reference Alchemy can order, as `Proxmox.SdnVnet` did for a bridge.\n *\n * ⛔ DIFFERENT HOST, DIFFERENT REALM, DIFFERENT AUTH HEADER. MEASURED 2026-09-13, strict TLS, no\n *   `-k` anywhere: `GET https://pbs.example.com:8007/api2/json/ping` answers 200\n *   `{\"data\":{\"pong\":true}}` against a Let's Encrypt certificate for CN=pbs.example.com;\n *   `/version` and `/config/datastore` answer 401 \"authentication failed\";\n *   `pbs.mgmt.example.com:8007` answers 401 and its certificate verifies too; and\n *   `/access/domains` lists the realms `pbs`, `pam` and an openid realm. So the\n *   prefix, the `{\"data\": …}` envelope and the strict-TLS story are PVE's exactly — and only the\n *   credential differs. There is no `pve` realm here; a PVE token cannot authenticate at all.\n *   The header differs too, which is why `pve()` exists rather than `pve()` being reused — see the\n *   ⛔ on `pbsAuthorization` in pbs-datastore-form.ts.\n *\n * ⛔ THERE IS NO OPENBAO MOUNT FOR PBS TODAY, SO NOTHING HERE CAN DEPLOY YET. `PbsTarget.mount` is\n *   a parameter for the reason `PveTarget.mount` is — the provider must be able to leave this\n *   estate — but the estate has nothing to put in it. MEASURED: under the agent's approle,\n *   `bao token capabilities` answers `deny` for `proxmox-c1/creds/{read,provision}`,\n *   `proxmox-c2/creds/read` and every `…pbs…` path tried, and `sys/mounts` is 403 — so I could\n *   not enumerate the mounts to PROVE a PBS one is absent. That it is absent is the brief's\n *   statement, not my measurement.\n *   ★ WHAT THE MOUNT MUST VEND, so `mint()` is reused unchanged: `bao read -format=json\n *     <mount>/creds/<role>` answering `{\"data\":{\"token_id\":…,\"secret\":…}}`, where `token_id` is a\n *     PBS token id `user@realm!tokenname` — `hf-read@pbs!…` and `hf-provision@pbs!…`. Same short,\n *     non-renewable lease contract as `proxmox-c1`.\n *   ⚠️ PBS HAS NO DYNAMIC-SECRETS PLUGIN OF ITS OWN — OpenBao's Proxmox support is a PVE thing — so\n *     the mount is a small custom vendor against `POST /access/users/{id}/token/{name}`. Say which\n *     mount and role you needed rather than reaching for the read-only `metrics@pbs` token on\n *     the kv shelf: widening that would delete the outer lock for every reader of the shelf.\n *\n * ⛔ A DATASTORE HOLDS THE BACKUPS, SO `retain` IS THE DEFAULT AND `delete` IS FULLY IMPLEMENTED —\n *   the ★ on removal policy in resource.ts has the whole reasoning. A stub returning `Effect.void`\n *   would report a deletion that never happened, and this is the family where that lie costs most.\n *\n * ⚠️ PRIVILEGES, READ OFF THE PUBLISHED SCHEMA RATHER THAN OFF THIS HOST:\n *     read   GET    config/datastore/{name}   Datastore.Audit    on /datastore/{name}\n *     create POST   config/datastore          Datastore.Allocate on /datastore\n *     update PUT    config/datastore/{name}   Datastore.Modify   on /datastore/{name}\n *     delete DELETE config/datastore/{name}   Datastore.Allocate on /datastore/{name}\n *   Built-in `DatastoreAdmin` at `/datastore` covers all four; `DatastoreAudit` covers the read\n *   lane alone, which is what the `read` role should hold.\n *\n * ⛔ NO SECRET IS A PROP OR AN ATTRIBUTE, AND THIS FAMILY IS CLEAN BY CONSTRUCTION: a datastore\n *   section holds no password, token or key — encryption keys belong to the backup CLIENT. Every\n *   field below is a name, a path, a schedule, a count or a policy string, all of which are safe in\n *   a state store Alchemy writes UNENCRYPTED and this estate copies to a backup guest nightly.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { pve } from './client.ts';\nimport {\n  type PbsDatastoreAttributes,\n  type PbsTarget,\n  createForm,\n  matches,\n  object,\n  readOne,\n  updateForm,\n} from './pbs-datastore-form.ts';\nimport { guardBackend, guardPath, settle } from './pbs-datastore-guard.ts';\nimport { guardDatastoreForms } from './pbs-datastore-endpoint.ts';\nimport type { PveRequirements } from './resource.ts';\nimport { formToSend } from './update-guard.ts';\n\nexport type { PbsDatastoreAttributes, PbsTarget };\n\n/**\n * ⚠️ PBS'S OWN KEY NAMES, HYPHENS INCLUDED — backup-job.ts's rule: the form is then a copy rather\n *   than a translation table, and a translation table is one more place for a key to be renamed and\n *   silently never sent.\n * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED — storage.ts's rule, not sdn-vnet.ts's, and\n *   for a retention policy the choice is not close: see the ⛔ on `updateForm`.\n */\nexport interface PbsDatastoreProps {\n  target: PbsTarget;\n  /** PBS's primary key. Create-only: there is no rename, and a new name is a new datastore. */\n  name: string;\n  /**\n   * Absolute path to the datastore directory.\n   *\n   * ⛔ CREATE-ONLY, AND THE ONE FIELD THIS FILE REFUSES TO LET DRIFT QUIETLY. PBS's update endpoint\n   *   does not accept `path`, so comparing it in `matches` could only plan an update no PUT can\n   *   apply — the forever-diff storage.ts avoids by letting its create-only `type` plan as NOOP.\n   *   Here a silent noop is the wrong trade: the operator would read a green plan while PBS kept\n   *   writing backups to the old directory. So `diff` and `reconcile` compare it themselves and DIE\n   *   with both values named. A path change is remove-and-redeclare, deliberately.\n   */\n  path: string;\n  comment?: string;\n  /** Calendar event for garbage collection, e.g. `daily` or `sat 18:15`. */\n  'gc-schedule'?: string;\n  /** Calendar event for the built-in prune job. Retention itself is the `keep-*` fields below. */\n  'prune-schedule'?: string;\n  /** ⚠️ PBS's minimum is 1 for every keep-*. A declared `0` is refused, and does not mean \"off\". */\n  'keep-last'?: number;\n  'keep-hourly'?: number;\n  'keep-daily'?: number;\n  'keep-weekly'?: number;\n  'keep-monthly'?: number;\n  'keep-yearly'?: number;\n  /**\n   * Legacy notification routing: `gc=<never|always|error>`, and the same for `verify` and `sync`.\n   * ⚠️ PBS 3.2+ picks between this and the notification system with `notification-mode`, which is\n   *   NOT declarable here: flipping a live datastore between the two silently changes who hears\n   *   about a failed verify, and silence is the failure mode that costs most (notification-target.ts).\n   */\n  notify?: string;\n  /** PBS user id legacy notifications go to. PBS's schema default is `root@pam`. */\n  'notify-user'?: string;\n  /** Verify every new backup the moment it completes. PBS's default is false. */\n  'verify-new'?: boolean;\n  /** Property string: `chunk-order=<none|inode>,sync-level=<none|file|filesystem>`, and more. */\n  tuning?: string;\n  /**\n   * Takes the datastore out of service: `type=<offline|read-only|unmount>`, optional\n   * `message=<text>`. PBS's default key is `type`, so the bare `offline` normalises to the same\n   * string here and either spelling is safe.\n   * ⛔ NEVER DECLARE `type=delete`. PBS sets that itself while destroying a datastore's contents.\n   * ⚠️ A `message` CONTAINING A COMMA BREAKS THE COMPARISON, not the write: `propertyString` splits\n   *   on commas and does not honour PBS's quoting, so the two sides never compare equal and the\n   *   plan asks for the same update forever. Keep the message comma-free.\n   */\n  'maintenance-mode'?: string;\n  /**\n   * ⛔ CREATE-ONLY, LIKE `path`, AND FOR A SHARPER REASON. MEASURED on the live 4.2 host:\n   *   `datastore create --help` offers `--backend`, `datastore update --help` does NOT, and\n   *   `backend` is absent from update's `--delete` enum. PBS will not move a datastore between\n   *   local disk and object storage, ever.\n   * ★ IT IS A PROP AT ALL BECAUSE THE ESTATE HAS ONE. `offsite` holds\n   *   `type=s3,client=cloudflare-r2,bucket=example-pbs`. Leaving it undeclared would still plan\n   *   noop — undeclared is unmanaged here — but the declaration would then describe a LOCAL\n   *   datastore, and anyone recreating from it would get exactly that: an empty directory on the\n   *   host's disk where the offsite copy used to be, behind a green plan the whole way.\n   * ⚠️ A property string. Compared canonically, so key order is never a diff.\n   */\n  backend?: string;\n  /** ⚠️ S3 request counters reset on this calendar event. Mutable; in update's `--delete` enum. */\n  'counter-reset-schedule'?: string;\n  /**\n   * ⚠️ S3 request-count thresholds that raise a notification, e.g. `s3-put=700000,s3-get=200000`.\n   *   A property string, compared canonically. Mutable.\n   */\n  'notification-thresholds'?: string;\n}\n\nexport interface PbsDatastore extends Resource<\n  'Pbs.Datastore',\n  PbsDatastoreProps,\n  PbsDatastoreAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a datastore holds the backups. See the ★ in resource.ts. */\nexport const PbsDatastore = Resource<PbsDatastore>('Pbs.Datastore', {\n  defaultRemovalPolicy: 'retain',\n});\n\nexport const PbsDatastoreProvider = () =>\n  Provider.effect(\n    PbsDatastore,\n    Effect.succeed(\n      PbsDatastore.Provider.of({\n        /**\n         * ⛔ EMPTY, AND HERE IT GUARDS THE ESTATE'S BACKUPS. `GET /config/datastore` returns every\n         *   datastore on the host, the one PVE's `type: pbs` storage writes into included. See\n         *   `pveHandlers` in resource.ts for why adoption stays an explicit act.\n         */\n        list: () => Effect.succeed([]),\n        read: ({ olds }) => readOne(olds),\n        /**\n         * ⚠️ `isResolved` IS THE NARROWING, resource.ts's reason: at plan time a prop can still be an\n         *   unresolved Output, and comparing a placeholder to a live value reports a phantom update.\n         * ⛔ `guardPath` IS A DELIBERATE DEPARTURE FROM storage.ts, which lets its create-only field\n         *   plan as noop. Dying fails `alchemy plan` with both paths named — see the ⛔ on the prop.\n         */\n        diff: ({ news, output }) =>\n          Effect.gen(function* () {\n            if (!isResolved(news)) return undefined;\n            // ⛔ BEFORE the `output === undefined` return: that branch IS the create, which is the\n            //   one this family has never checked. resource.ts carries the argument in full.\n            yield* guardDatastoreForms(news);\n            if (output === undefined) return undefined;\n            const live = yield* readOne(news);\n            // ⚠️ `update`, not `create` — Alchemy's Diff admits only noop/update/replace, and an\n            //   object Alchemy has state for but PBS does not is drift for reconcile to repair.\n            if (live === undefined) return { action: 'update' } as const;\n            yield* guardPath(live, news);\n            yield* guardBackend(live, news);\n            return matches(live, news)\n              ? ({ action: 'noop' } as const)\n              : ({ action: 'update' } as const);\n          }),\n        /**\n         * ⚠️ NOT THE FACTORY'S reconcile: it reads back ONCE, immediately — see the ⛔ on `settle`.\n         * ⛔ `guardPath` RUNS HERE TOO, AND THAT IS NOT BELT-AND-BRACES — see the ⛔ on it.\n         * ⛔ THE `matches` GUARD BEFORE THE PUT IS resource.ts's, AND IT IS WHY ADOPTION IS FREE.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ Again here: an ADOPTED row's diff answer is discarded by Alchemy and reconcile runs.\n          yield* guardDatastoreForms(news);\n          const live = yield* readOne(news);\n          let upid: string | undefined;\n          if (live === undefined) {\n            upid = yield* pve<string>(\n              news.target,\n              'provision',\n              'POST',\n              'config/datastore',\n              createForm(news),\n            );\n          } else {\n            yield* guardPath(live, news);\n            yield* guardBackend(live, news);\n            // ⚠️ An empty form is not a write, and a match is not one either — update-guard.ts.\n            const form = formToSend(matches, live, news, updateForm(news));\n            if (form !== undefined) {\n              yield* pve(news.target, 'provision', 'PUT', object(news), form);\n            }\n          }\n          const after = yield* settle(\n            readOne(news),\n            (row) => row !== undefined && matches(row, news),\n          );\n          if (after === undefined || !matches(after, news)) {\n            /**\n             * ⛔ REFUSE RATHER THAN RETURN THE PROPS AS THOUGH THEY LANDED — resource.ts's rule.\n             *   A create answers with a task id, so \"no error\" is not evidence of a datastore.\n             */\n            return yield* Effect.die(\n              new Error(\n                `${object(news)}: the write returned no error but the datastore still does not ` +\n                  `match the declaration after 120s. PBS answered with task ${upid ?? '(none)'} ` +\n                  '-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a ' +\n                  'plausible cause (see `settle`); a create over an existing chunk store is not, ' +\n                  'because PBS refuses that outright rather than timing out.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ FULLY IMPLEMENTED, NEVER A STUB, and it only ever runs on an explicit\n         *   `.pipe(RemovalPolicy.destroy())` because this family defaults to `retain`.\n         * ⛔ NO `destroy-data`. PBS's DELETE drops the section from `datastore.cfg` and leaves every\n         *   chunk and snapshot on disk; `destroy-data=1` erases the contents. It is not a prop and\n         *   not a flag here, so this provider can un-declare a datastore and can never erase one.\n         *   ⚠️ IT IS STILL A ONE-WAY DOOR FOR A DECLARATION: re-adding a datastore over an existing\n         *     chunk store needs `reuse-datastore`, which is deliberately not declarable — see the\n         *     ⚠️ on `createForm`. Re-adopt with `proxmox-backup-manager datastore create …`.\n         * ⚠️ NO `keep-job-configs` EITHER, SO THE JOBS GO TOO: PBS defaults it false and removes the\n         *   verify, sync and prune jobs referencing this datastore — objects nothing here declares.\n         *   PBS's default stands, so the blast radius is what a human clicking Remove would get.\n         * ⚠️ AND THE REFUSAL CAN ARRIVE AFTER THE RESPONSE: the delete forks a worker too, so a store\n         *   held open by a running backup can fail once the call has already returned 200.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          yield* pve<string>(olds.target, 'provision', 'DELETE', object(olds));\n          const left = yield* settle(readOne(olds), (row) => row === undefined);\n          if (left !== undefined) {\n            return yield* Effect.die(\n              new Error(\n                `${object(olds)}: the DELETE returned no error but the datastore is still in ` +\n                  'datastore.cfg after 120s. Either a backup, verify or GC task still holds it, ' +\n                  'or the provision role lacks Datastore.Allocate on /datastore/' +\n                  `${olds.name}. Read the task log with \\`proxmox-backup-manager task log <upid>\\`.`,\n              ),\n            );\n          }\n        }),\n      }),\n    ),\n  );\n",
-    "/**\n * A PBS datastore on the wire: the transport that reaches PBS, the form it wants, and the coercion\n * back to something comparable.\n *\n * ★ SPLIT OUT OF pbs-datastore.ts FOR THE 250-LINE CAP, the seam notification-target-form.ts uses:\n *   this file is everything that touches PBS's encoding, and the resource file is the declaration\n *   and the five handlers. The `import type` back is erased, so it is a cycle on paper only.\n *\n * ⛔ THIS FILE IS OVER THE 250-LINE CAP AND THE EXTRACTION IS NAMED RATHER THAN FUDGED. `PbsTarget`,\n *   `PbsRole`, `PbsError`, `pbsAuthorization`, `PveForm`, `encode`, `pbs` and `settle` — about 150\n *   lines — are a PBS CLIENT, not a datastore form, and belong in `pbs-client.ts`. Lifting them\n *   leaves this file near 200 and costs nothing but a move. It was not done here only because the\n *   family was commissioned as a two-file split; ceph-pool is the in-package precedent for three\n *   (ceph-pool.ts + ceph-pool-form.ts + ceph-pool-settle.ts, 532 lines for one family). Everything\n *   in that list is also what Pbs.SyncJob, Pbs.PruneJob and Pbs.Remote will each need unchanged,\n *   so the second PBS family forces the move anyway. ⛔ DO NOT MEET THE CAP BY CUTTING COMMENTS.\n */\nimport * as Effect from 'effect/Effect';\nimport { type PveForm, pve } from './client.ts';\nimport type { PbsTarget as ApiPbsTarget } from './credentials.ts';\nimport type { PbsDatastoreProps } from './pbs-datastore.ts';\nimport { bool, flag, int, propertyString, text } from './values.ts';\n\n/**\n * ★ PBS REUSES THE PVE CLIENT RATHER THAN OWNING ONE. An earlier draft of this file carried its\n *   own `PbsTarget`, `PbsError`, `pbsAuthorization`, form encoder and `pve()` — a near-copy of\n *   client.ts differing in one header. They are gone: `PveTarget` now carries a `scheme`, and\n *   `authorization()` spells the header `PBSAPIToken=<id>:<secret>` when it is `'pbs'`. The\n *   insight that survived is the FORM TYPE — PBS decodes a multi-valued field from repeated keys\n *   where PVE wants a comma string — and that now lives on `PveForm` in client.ts, so both\n *   products share one encoder and neither can reach for the other's convention by accident.\n *\n * 🔴 THIS ALIAS SAID `= PveTarget` AND IT WAS WRONG — Pbs.Datastore REQUIRED A PVE TARGET. When\n *   `credentials.ts` grew a real `PbsTarget` with `scheme: 'pbs'`, this line was left pointing at\n *   the PVE type, which pins `scheme: 'pve'`. So the one family that most needs the discriminant\n *   was the one family that refused the correct value: declaring a datastore against the PBS host\n *   failed to compile with `Type '\"pbs\"' is not assignable to type 'Input<\"pve\">'`, and passing a\n *   PVE target compiled fine and would have 401'd every call — which `read` folds into \"absent\",\n *   so the plan would say CREATE for a datastore holding the estate's backups.\n *   ⛔ IT SURVIVED BECAUSE NOTHING EVER DECLARED ONE. The provider was registered in\n *   alchemy.run.ts from the day it was written and `pveHandlers`' `list` answers empty, so\n *   registration exercises no call site at all. Three sibling families import `PbsTarget` from\n *   credentials.ts directly and were always correct; only the one with its own alias drifted.\n *   ★ THE LESSON, WHICH IS NOT ABOUT THIS TYPE: a provider nobody has declared an instance of is\n *   not tested by anything, including tsc.\n */\nexport type PbsTarget = ApiPbsTarget;\n\nexport interface PbsDatastoreAttributes {\n  name: string;\n  /**\n   * ⚠️ READ FROM PBS, NEVER ECHOED FROM PROPS. Echoing the declared path would make a divergent or\n   *   unreadable datastore look like agreement, and this is the field whose divergence means the\n   *   backups are going somewhere nobody declared. `''` when PBS did not say.\n   */\n  path: string;\n  comment: string;\n  'gc-schedule': string;\n  'prune-schedule': string;\n  'keep-last': number;\n  'keep-hourly': number;\n  'keep-daily': number;\n  'keep-weekly': number;\n  'keep-monthly': number;\n  'keep-yearly': number;\n  /** Normalised property strings — sorted and canonicalised, so key order is never a diff. */\n  notify: string;\n  'notify-user': string;\n  'verify-new': boolean;\n  tuning: string;\n  'maintenance-mode': string;\n  /** ⚠️ Create-only. Canonicalised property string; `''` on a plain local datastore. */\n  backend: string;\n  'counter-reset-schedule': string;\n  'notification-thresholds': string;\n}\n\n/**\n * ⚠️ `digest` IS DELIBERATELY NOT AN ATTRIBUTE, for storage.ts's reason exactly: PBS returns one on\n *   every read and it covers `datastore.cfg` as a FILE, not this section of it, so keeping it would\n *   rewrite this resource's state whenever an unrelated datastore was edited — churn that reads\n *   like drift. It is not sent on writes either, so this family never joins PBS's optimistic-locking\n *   dance and last write wins, as everywhere else in this package.\n */\nexport const attributes = (\n  live: Record<string, unknown>,\n  props: PbsDatastoreProps,\n): PbsDatastoreAttributes => ({\n  backend: propertyString(live['backend']),\n  comment: text(live['comment']),\n  'counter-reset-schedule': text(live['counter-reset-schedule']).trim(),\n  'gc-schedule': text(live['gc-schedule']).trim(),\n  'keep-daily': int(live['keep-daily'], 0),\n  'keep-hourly': int(live['keep-hourly'], 0),\n  'keep-last': int(live['keep-last'], 0),\n  'keep-monthly': int(live['keep-monthly'], 0),\n  'keep-weekly': int(live['keep-weekly'], 0),\n  'keep-yearly': int(live['keep-yearly'], 0),\n  'maintenance-mode': propertyString(live['maintenance-mode'], 'type'),\n  name: props.name,\n  'notification-thresholds': propertyString(live['notification-thresholds']),\n  notify: propertyString(live['notify']),\n  'notify-user': text(live['notify-user']),\n  path: text(live['path']),\n  'prune-schedule': text(live['prune-schedule']).trim(),\n  tuning: propertyString(live['tuning']),\n  'verify-new': bool(live['verify-new']),\n});\n\nconst same = <T>(declared: T | undefined, live: T) => declared === undefined || declared === live;\n\n/**\n * ⛔ DECLARING WHAT IS LIVE MUST PLAN noop, AND EVERY OMISSION IS DELIBERATE. Out: `name` (the\n *   address the read was made at — true by construction, never a diff); `path` (create-only, so\n *   comparing it could only plan an update no PUT can apply — pbs-datastore.ts guards it by dying\n *   instead, see the ⛔ on the prop); `digest` (not an attribute, above); and every field the\n *   declaration does not mention, because undeclared is UNMANAGED here.\n * ⚠️ A SCHEDULE THAT NEVER SETTLES MEANS PBS NORMALISED IT. Calendar events are compared as trimmed\n *   strings; if a version rewrites `sat 18:15` as `Sat 18:15` the plan asks for the same update\n *   forever. The fix is to declare the spelling PBS stores, never to stop comparing it.\n */\nexport const matches = (live: PbsDatastoreAttributes, props: PbsDatastoreProps) =>\n  same(props.comment, live.comment) &&\n  same(props['gc-schedule']?.trim(), live['gc-schedule']) &&\n  same(props['prune-schedule']?.trim(), live['prune-schedule']) &&\n  same(props['keep-last'], live['keep-last']) &&\n  same(props['keep-hourly'], live['keep-hourly']) &&\n  same(props['keep-daily'], live['keep-daily']) &&\n  same(props['keep-weekly'], live['keep-weekly']) &&\n  same(props['keep-monthly'], live['keep-monthly']) &&\n  same(props['keep-yearly'], live['keep-yearly']) &&\n  same(props['notify-user'], live['notify-user']) &&\n  same(props['counter-reset-schedule']?.trim(), live['counter-reset-schedule']) &&\n  (props['notification-thresholds'] === undefined ||\n    propertyString(props['notification-thresholds']) === live['notification-thresholds']) &&\n  same(props['verify-new'], live['verify-new']) &&\n  (props.notify === undefined || propertyString(props.notify) === live.notify) &&\n  (props.tuning === undefined || propertyString(props.tuning) === live.tuning) &&\n  (props['maintenance-mode'] === undefined ||\n    propertyString(props['maintenance-mode'], 'type') === live['maintenance-mode']);\n\nconst set = (key: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [key]: value };\n\n/** ⚠️ PBS's minimum for every keep-* is 1, so a declared `0` is refused rather than meaning \"off\". */\nconst count = (value: number | undefined) => (value === undefined ? undefined : String(value));\n\n/**\n * The mutable half, shared by create and update.\n *\n * ⚠️ AN UNDECLARED FIELD IS NOT SENT — storage.ts's rule. PBS leaves a parameter it was not given\n *   alone, so this form is safe to re-apply to a datastore that already matches, which is what the\n *   adoption path does.\n * ⛔ `name` AND `path` ARE ABSENT ON PURPOSE. Both are create-only: `name` is the address forever\n *   after, and PBS's update endpoint does not accept `path` at all, so including it here would turn\n *   every single update into a 400.\n */\nconst mutable = (props: PbsDatastoreProps): Record<string, string> => ({\n  ...set('comment', props.comment),\n  ...set('gc-schedule', props['gc-schedule']?.trim()),\n  ...set('keep-daily', count(props['keep-daily'])),\n  ...set('keep-hourly', count(props['keep-hourly'])),\n  ...set('keep-last', count(props['keep-last'])),\n  ...set('keep-monthly', count(props['keep-monthly'])),\n  ...set('keep-weekly', count(props['keep-weekly'])),\n  ...set('keep-yearly', count(props['keep-yearly'])),\n  ...set('counter-reset-schedule', props['counter-reset-schedule']),\n  ...set('maintenance-mode', props['maintenance-mode']),\n  ...set('notification-thresholds', props['notification-thresholds']),\n  ...set('notify', props.notify),\n  ...set('notify-user', props['notify-user']),\n  ...set('prune-schedule', props['prune-schedule']?.trim()),\n  ...set('tuning', props.tuning),\n  ...set('verify-new', flag(props['verify-new'])),\n});\n\n/**\n * ⚠️ `path` IS SENT ONCE, HERE, AND NEVER AGAIN — the fact the whole `path` guard hangs off.\n * ⚠️ `reuse-datastore` IS NOT SENT, AND THE REFUSAL IT CAUSES IS A FEATURE: without it PBS refuses\n *   a create against a directory that already holds a chunk store, which is the difference between\n *   building a new store and silently adopting somebody else's backups. Adopt out of band.\n * ⚠️ NEITHER IS `backing-device`. A removable datastore's UUID is a property of the hardware in the\n *   slot, not of the declaration; one that could re-point it is one that can send backups to the\n *   wrong drive.\n */\nexport const createForm = (props: PbsDatastoreProps): PveForm => ({\n  ...mutable(props),\n  name: props.name,\n  path: props.path,\n  // ⛔ CREATE ONLY, AND ABSENT FROM `mutable` ON PURPOSE. PBS has no `--backend` on update and no\n  //   `backend` in update's `--delete` enum (measured on 4.2), so sending it on a PUT is a\n  //   parameter error at best. Divergence is caught by guardBackend, which DIES — the same shape\n  //   as `path`, for a bigger consequence.\n  ...(props.backend === undefined ? {} : { backend: props.backend }),\n});\n\n/**\n * ⛔ THERE IS NO `delete` LIST HERE, AND THAT IS A CHOICE ABOUT BACKUPS RATHER THAN AN OMISSION.\n *   sdn-vnet.ts derives one from absent props, which is right for an alias and wrong for a\n *   retention policy: a declaration that simply fails to mention `keep-daily` would strip it, and a\n *   prune job whose keeps have all been stripped is one PBS version away from a prune job that\n *   keeps nothing. So undeclared is UNMANAGED, as in storage.ts and backup-job.ts.\n *   ⚠️ THE PRICE IS THAT DROPPING A LINE DOES NOT CLEAR A FIELD. Clear one out of band:\n *     `proxmox-backup-manager datastore update <name> --delete keep-daily`. It does not cost a\n *     forever-diff, because an undeclared field is not compared either.\n *   ⛔ WHEN SOMEBODY ADDS ONE, IT TAKES TWO STEPS AND SKIPPING EITHER IS A SILENT BUG. First build\n *     it with `values.withClears`, which drops a cleared key from the body — CLEAR WINS — because\n *     PBS applies its deletes BEFORE its sets, so a key both set and deleted keeps its value: the\n *     declaration would say \"unset this\", the PUT would succeed, and the next plan would ask for\n *     the very same update forever. (PVE instead DIES on that pair; the two behaviours want the\n *     same guard.) Second, split the comma-joined value `withClears` produces into a real array —\n *     PBS's `delete` is `type: array` and wants REPEATED KEYS, and a comma string arrives as one\n *     element that fails the enum check. `PveForm` and `encode` already carry arrays for exactly\n *     this. ⚠️ REASONED FROM THE PUBLISHED SCHEMA, NOT PROVEN ON A WIRE.\n */\nexport const updateForm = (props: PbsDatastoreProps): PveForm => mutable(props);\n\nexport const object = (props: PbsDatastoreProps) => `config/datastore/${props.name}`;\n\n/**\n * The live datastore, or undefined.\n *\n * ⛔ `name` IS THE PRESENCE TEST, NOT THE STATUS CODE — PBS does not answer 404 for a section that\n *   is missing from `datastore.cfg`, it answers a generic error, so there is no code to key off.\n * ⛔ A MISSING READ PRIVILEGE THEREFORE LOOKS EXACTLY LIKE ABSENCE, because the fold below cannot\n *   tell them apart. The signature is a plan that says CREATE followed by PBS answering\n *   \"datastore '<name>' already exists.\" — that pair means Datastore.Audit, not a missing\n *   datastore. It is loud and non-destructive, which is the only reason the fold is tolerable here;\n *   see the ⛔ on `readRole` in resource.ts for the PVE families where it is not.\n * ⛔ ON THE DELETE PATH THE SAME FOLD IS A LIE, AND THIS IS THE ONE HAZARD IN THIS FAMILY I COULD\n *   NOT CLOSE. `delete` settles by polling this read until it answers `undefined` — and a `read`\n *   role that lacks `Datastore.Audit` answers `undefined` from the very first poll, so EVERY delete\n *   would report success while the datastore stood. Worse, the two lanes are different leases: the\n *   DELETE goes out under `provision` and may genuinely fail, and this read cannot see that it did.\n *   ★ THE SHAPE OF THE FIX IS ALREADY IN THIS PACKAGE: `confirmAbsent` in ceph-pool-settle.ts asks\n *     a SECOND, DIFFERENT question — does the collection LIST this object? — and lets a failure\n *     PROPAGATE rather than folding it, so \"I could not ask\" fails the deploy instead of passing\n *     it. Add the same over `GET /config/datastore` before anyone relies on a reported deletion.\n *   ⚠️ UNTIL THEN THE PRECONDITION IS EXPLICIT: the `read` role MUST hold `Datastore.Audit` on the\n *     datastore, or this provider cannot tell a deletion from a refusal.\n */\nexport const readOne = (props: PbsDatastoreProps) =>\n  pve<Record<string, unknown>>(props.target, 'read', 'GET', object(props)).pipe(\n    Effect.map((live) =>\n      live === undefined || typeof live['name'] !== 'string' ? undefined : attributes(live, props),\n    ),\n    Effect.orElseSucceed(() => undefined),\n  );\n",
-    "/**\n * The two things a datastore write needs that are not form-building: refusing a moved `path`, and\n * waiting for PBS to finish.\n *\n * ★ SPLIT OUT OF pbs-datastore-form.ts FOR THE 250-LINE CAP, and the seam is real. That file turns\n *   a declaration into a form; this one is the SAFETY GUARD and the POLLING. A reader asking \"can\n *   this destroy my backups\" has one short file to read rather than a long one to search.\n */\nimport * as Effect from 'effect/Effect';\nimport { type PbsDatastoreAttributes, object } from './pbs-datastore-form.ts';\nimport type { PbsDatastoreProps } from './pbs-datastore.ts';\nimport { propertyString } from './values.ts';\n\n/**\n * ⛔ A TRAILING SLASH MUST NOT DEADLOCK EVERY PLAN, WHICH IS WHY THIS IS NOT `===`. `guardPath`\n *   DIES, so a false positive is not a spurious update — it is an `alchemy plan` that cannot run at\n *   all until somebody edits the declaration, on a family whose whole point is that the operator\n *   can see the state of their backups. `/mnt/backups/` and `/mnt/backups` are one directory, and\n *   whether PBS canonicalises the path it was handed is a property of the version you are talking\n *   to. Both sides are trimmed here so that guess cannot cost an outage of the plan itself.\n * ⚠️ THAT IS THE ONLY NORMALISATION APPLIED. A symlink, a bind mount or `/mnt/./backups` still\n *   reads as divergent, and deliberately so: this guard's job is to refuse to GUESS that two\n *   spellings are the same directory, and only the trailing slash is certain.\n */\nconst samePath = (left: string, right: string) => {\n  const trim = (value: string) => (value.length > 1 ? value.replace(/\\/+$/, '') : value);\n  return trim(left) === trim(right);\n};\n\n/**\n * ⛔ THE `path` GUARD, YIELDED FROM BOTH `diff` AND `reconcile`. Both need it: `diff` catches a\n *   changed declaration, and `reconcile` catches an ADOPTION, which Alchemy routes straight past\n *   `diff` (Apply.ts:980, :1045). `''` is skipped — an unreadable path is not a divergent one.\n */\nexport const guardPath = (live: PbsDatastoreAttributes, props: PbsDatastoreProps) =>\n  live.path === '' || samePath(live.path, props.path)\n    ? Effect.void\n    : Effect.die(\n        new Error(\n          `${object(props)}: declared path ${props.path} but PBS holds ${live.path}. \\`path\\` ` +\n            'is create-only, so this cannot be reconciled and will NOT be planned as a silent ' +\n            'noop: backups would keep landing in the old directory behind a green plan. Correct ' +\n            'the declaration, or remove the datastore and declare a new one -- the contents live, ' +\n            'because `destroy-data` is never sent.',\n        ),\n      );\n\n/**\n * ⛔ THE `backend` GUARD, AND IT MATTERS MORE THAN `path`. A wrong `path` sends backups to the\n *   wrong directory on the same machine; a wrong `backend` is the difference between a datastore\n *   on local disk and one in a Cloudflare R2 bucket. MEASURED on 4.2: `datastore create` takes\n *   `--backend`, `datastore update` does not, and `backend` is not in update's `--delete` enum —\n *   so divergence CANNOT be reconciled, and the only honest options are to refuse or to lie.\n *\n * ⚠️ AN UNDECLARED `backend` IS NOT A DIVERGENCE. Undeclared is unmanaged everywhere in this\n *   family, and this guard keeps that rule: it fires only when the declaration says something and\n *   PBS says something else. Adopting `offsite` without mentioning `backend` still plans noop.\n *\n * ⚠️ COMPARED AS A CANONICAL PROPERTY STRING, so `bucket=x,type=s3` and `type=s3,bucket=x` are the\n *   same backend and key order cannot deadlock a plan — the reason `samePath` trims a slash.\n */\nexport const guardBackend = (live: PbsDatastoreAttributes, props: PbsDatastoreProps) =>\n  props.backend === undefined || propertyString(props.backend) === live.backend\n    ? Effect.void\n    : Effect.die(\n        new Error(\n          `${object(props)}: declared backend ${props.backend} but PBS holds ` +\n            `${live.backend === '' ? '(none — a local datastore)' : live.backend}. \\`backend\\` ` +\n            'is create-only: PBS has no update for it, so this cannot be reconciled and will NOT ' +\n            'be planned as a silent noop. Correct the declaration to match what is really there, ' +\n            'or remove the datastore and declare a new one -- the contents live, because ' +\n            '`destroy-data` is never sent.',\n        ),\n      );\n\n/**\n * Wait for PBS to finish, then answer the last thing it said.\n *\n * ⛔ IT EXISTS BECAUSE A PBS CREATE IS A FORKED WORKER AND THE CONFIG SECTION IS WRITTEN LAST.\n *   `POST /config/datastore` answers with a UPID while a `create-datastore` task builds the chunk\n *   store's 65536 directories; only when that finishes does the section reach `datastore.cfg`. An\n *   immediate read-back therefore sees a datastore that is not there yet, and the factory's \"the\n *   write returned no error but the object is still absent\" would fire on a create going perfectly.\n *   The DELETE forks a worker too. ⚠️ DOCUMENTED FROM THE PUBLISHED SCHEMA, NOT MEASURED — I hold\n *   no PBS token. If a create turns out to be synchronous, the first poll simply succeeds.\n * ★ IT TAKES THE READ AS AN EFFECT RATHER THAN A FUNCTION — the one simplification over\n *   ceph-pool-settle.ts: an Effect is a description, so re-running it re-reads and no dependency\n *   has to be threaded back in to avoid a cycle.\n * ⚠️ 2s APART, 60 TRIES, ABOUT TWO MINUTES — longer than ceph-pool's minute, and REASONED rather\n *   than measured: 65536 `mkdir`s is seconds on NVMe and can be a minute on a slow or USB disk.\n *   Anything still unsettled after two minutes is a fault to surface, not a wait to lengthen, and\n *   the caller's message points at the task log, which is where the real answer is. `Effect.sleep`\n *   yields between polls; nothing here parks a call on one long wait.\n * ⚠️ POLLING THE TASK STATUS INSTEAD WOULD BE WORSE, for ceph-pool-settle.ts's reason: every call\n *   mints a FRESH token, so the token asking about the task is not the one that started it.\n */\nexport const settle = <A, E, R>(read: Effect.Effect<A, E, R>, done: (live: A) => boolean) =>\n  Effect.gen(function* () {\n    for (let attempt = 0; attempt < 60; attempt += 1) {\n      const live = yield* read;\n      if (done(live)) return live;\n      yield* Effect.sleep('2 seconds');\n    }\n    return yield* read;\n  });\n",
-    "/**\n * `Pbs.Datastore`'s two vendor endpoints, and the plan-time check over its two forms.\n *\n * ★ A FILE OF ITS OWN BECAUSE THIS FAMILY DOES NOT USE `pveHandlers`. It writes its own `diff` and\n *   `reconcile` (a create answers with a task id, so it settles rather than reading back once), so\n *   it cannot inherit the guard from resource.ts — and a copy of the two calls inside that already\n *   long file is exactly the per-resource copy-paste the shared handler exists to prevent.\n *\n * ⛔ THE FOUR FIELDS THAT MADE THIS WORTH DOING, from the PBS 4.2.6 schema: `comment` is\n *   maxLength 128 with a no-control-characters pattern, `name` is 3..32 with a safe-id pattern,\n *   and every `keep-*` has minimum 1. All four were `string`/`number` with the limits in prose.\n */\nimport * as Effect from 'effect/Effect';\nimport { guardForm } from './constraint-guard.ts';\nimport type { EndpointKey } from './constraints.ts';\nimport { createForm, updateForm } from './pbs-datastore-form.ts';\nimport type { PbsDatastoreProps } from './pbs-datastore.ts';\n\nexport const DATASTORE_ENDPOINT: { readonly create: EndpointKey; readonly update: EndpointKey } = {\n  create: 'pbs:POST /config/datastore',\n  update: 'pbs:PUT /config/datastore/{name}',\n};\n\n/** ⚠️ Presence on create only — an update form is partial by design (update-guard.ts). */\nexport const guardDatastoreForms = (props: PbsDatastoreProps): Effect.Effect<void> =>\n  Effect.gen(function* () {\n    yield* guardForm(DATASTORE_ENDPOINT.create, createForm(props), true);\n    yield* guardForm(DATASTORE_ENDPOINT.update, updateForm(props), false);\n  });\n",
-    "/**\n * `Pbs.NotificationMatcher` — which Proxmox Backup Server notifications reach which targets.\n *\n * ★ THIS IS WHERE A FAILED VERIFY, SYNC OR GARBAGE COLLECTION BECOMES A PAGE. pbs-verify-job.ts\n *   explains why verification is the only thing that notices rotten chunks; a matcher is what\n *   turns what it notices into a message. Route `match-severity: ['error']` to a webhook target\n *   (pbs-notification-target.ts, docs/pbs-notifications.md) and a failure pages someone.\n *\n * ⛔ A DATASTORE IN `legacy-sendmail` MODE BYPASSES EVERY MATCHER. PBS reads the datastore's\n *   `notification-mode` before it builds anything (src/server/notifications/mod.rs\n *   `lookup_datastore_notify_settings`, read at HEAD 2026-09-22): `legacy-sendmail` mails the\n *   `notify-user` directly and never consults a matcher. The default is `notification-system`\n *   today (pbs-api-types `NotificationMode`), but a datastore created before PBS 3.2 may say\n *   `legacy-sendmail` explicitly. `Pbs.Datastore` deliberately does not declare the mode (see\n *   `notify` in pbs-datastore.ts), so check it by hand before trusting a matcher with a datastore:\n *   `proxmox-backup-manager datastore show <name>`.\n *\n * ⚠️ THE EVENT `type` FOR A VERIFICATION JOB IS `verify`, NOT `verification`. PBS's own\n *   notifications chapter lists `verification` in its event table and `verify` in its example,\n *   and the source settles it: `send_verify_status` sets `(\"type\", \"verify\")` (same file). A\n *   `match-field: ['exact:type=verification']` rule matches nothing, silently.\n *   Types at HEAD: `gc`, `prune`, `sync`, `verify`, `tape-backup`, `tape-load`,\n *   `package-updates`, `acme`, `thresholds`, `system-mail`. GC carries `datastore` and `hostname`\n *   but NO `job-id`; prune, sync and verify carry all three; the UI's \"Test\" carries no fields.\n *\n * ★ ADOPTING THE BUILT-IN AS IT IS. MEASURED on PBS 4.2 (2026-09-22, `proxmox-backup-manager\n *   notification matcher show default-matcher`): it routes everything EXCEPT successful prune\n *   jobs to `mail-to-root` — `invert-match` over `exact:type=prune` AND severity `info`:\n *   ```ts\n *   PbsNotificationMatcher('default-matcher', {\n *     target: pbs, name: 'default-matcher', targets: ['mail-to-root'],\n *     'invert-match': true, 'match-field': ['exact:type=prune'], 'match-severity': ['info'],\n *   });\n *   ```\n *\n * ★ WHAT THIS NEEDS, READ OFF THE SERVER'S SCHEMA (generated/pbs.ts source):\n *     read      GET                 Sys.Audit  on /system/notifications\n *     write     POST, PUT, DELETE   Sys.Modify on /system/notifications\n *   ⚠️ NOT A DATASTORE PRIVILEGE. A PBS credential scoped to `/datastore/...` reads every matcher\n *     as absent — the \"absent, then already exists\" signature notification-target.ts describes.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport {\n  type NotificationMatcherAttributes,\n  type NotificationMatcherFields,\n  matcherAttributes,\n  matcherCreateForm,\n  matcherMatches,\n  matcherUpdateForm,\n} from './notification-matcher-form.ts';\nimport { type PveRequirements, type WithPbsTarget, pveHandlers } from './resource.ts';\n\nexport interface PbsNotificationMatcherProps extends NotificationMatcherFields, WithPbsTarget {}\n\nexport interface PbsNotificationMatcher extends Resource<\n  'Pbs.NotificationMatcher',\n  PbsNotificationMatcherProps,\n  NotificationMatcherAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ⚠️ No `retain`, for notification-matcher.ts's reason; a built-in REVERTS on delete. */\nexport const PbsNotificationMatcher = Resource<PbsNotificationMatcher>('Pbs.NotificationMatcher');\n\nconst handlers = pveHandlers<PbsNotificationMatcherProps, NotificationMatcherAttributes>({\n  attributes: (live, props) => matcherAttributes(live, props.name),\n  collection: () => 'config/notifications/matchers',\n  createForm: matcherCreateForm,\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: {\n    create: 'pbs:POST /config/notifications/matchers',\n    update: 'pbs:PUT /config/notifications/matchers/{name}',\n  },\n  matches: matcherMatches,\n  path: (props) => `config/notifications/matchers/${props.name}`,\n  updateForm: matcherUpdateForm,\n});\n\nexport const PbsNotificationMatcherProvider = () =>\n  Provider.effect(\n    PbsNotificationMatcher,\n    Effect.succeed(PbsNotificationMatcher.Provider.of(handlers)),\n  );\n",
-    "/**\n * `Pbs.NotificationTarget` — where a Proxmox Backup Server sends a notification: a `webhook`, or\n * mail through `sendmail` or `smtp`.\n *\n * ★ THE WEBHOOK IS THE POINT. A failed verify, sync or garbage collection reaches a human through a\n *   target a matcher names (pbs-notification-matcher.ts). Out of the box that is `mail-to-root`,\n *   one mailbox on one host; a webhook can post an Alertmanager alert instead, and then the failure\n *   pages like everything else. docs/pbs-alertmanager-body.md has the body template.\n *\n * ⛔ SECRETS ARE DECLARED BY THE NAME OF AN ENVIRONMENT VARIABLE, NEVER BY VALUE, and NO VALUE EVER\n *   REACHES STATE — not as a prop, not as an attribute. write-only.ts has the whole argument; the\n *   short form: Alchemy stores props and attributes unencrypted, so `secret`, `password` and any\n *   header holding a credential take `{ fromEnv: 'NAME' }`, read by the deploying process at call\n *   time. What the store keeps is presence (names) and digests, and the plan diffs on those.\n *   ★ THIS IS WHERE THE PBS FAMILY PARTS FROM notification-target.ts (PVE), which refuses every\n *     secret and so cannot create a signed webhook at all.\n *\n * ⛔ THE PER-OBJECT PATH CARRIES THE FAMILY: `config/notifications/endpoints/{type}/{name}`. `type`\n *   is identity, and changing it or `name` plans a REPLACE here — `diff` compares them with the\n *   recorded props. `/config/notifications/targets` is a read-only union view, as on PVE.\n *\n * ⚠️ A BUILT-IN TARGET REVERTS ON DELETE instead of disappearing (`origin: builtin`, measured on\n *   PBS 4.2 for `mail-to-root`), and PBS reports success either way — notification-target.ts has\n *   the consequence. Read `origin` before declaring a name you did not create.\n *\n * ★ WHAT THIS NEEDS (generated/pbs.ts source): Sys.Audit on /system/notifications to read,\n *   Sys.Modify there to write. A datastore-scoped credential reads every target as absent.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { handlers } from './pbs-notification-target-lifecycle.ts';\nimport type { PveRequirements, WithPbsTarget } from './resource.ts';\nimport type { FromEnv } from '../secrets/write-only.ts';\n\nexport type PbsNotificationTargetType = 'sendmail' | 'smtp' | 'webhook';\n\n/**\n * ⚠️ PBS'S OWN KEY NAMES, DASHES INCLUDED, for the reason backup-job.ts gives. A field outside its\n *   family (a `url` on a sendmail target) is refused at plan by name, not sent for a 400.\n * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED; `''` or `[]` (or `{}`) CLEARS ONE.\n */\nexport interface PbsNotificationTargetProps extends WithPbsTarget {\n  /** ⛔ IDENTITY: it picks the family and the URL. Changing it is a replace. */\n  type: PbsNotificationTargetType;\n  /** Unique across ALL families on the host: a webhook cannot be called `mail-to-root`. */\n  name: string;\n  comment?: string;\n  /** Configured but not delivering. Always sent and always compared. */\n  disable?: boolean;\n  /** sendmail, smtp: recipient addresses. Order is not meaning. */\n  mailto?: readonly string[];\n  /** sendmail, smtp: PBS users whose configured address receives the mail. */\n  'mailto-user'?: readonly string[];\n  /** smtp: required. sendmail: optional. */\n  'from-address'?: string;\n  author?: string;\n  /** smtp: the relay host. Required. */\n  server?: string;\n  /** smtp. Unset lets PBS pick from `mode`. */\n  port?: number;\n  /** smtp. PBS's default is `tls`. */\n  mode?: 'insecure' | 'starttls' | 'tls';\n  /** smtp. */\n  username?: string;\n  /** smtp: ⛔ WRITE-ONLY. The server never returns it; the plan compares its seal. */\n  password?: FromEnv;\n  /** webhook: required. Supports templating: `{{ secrets.<name> }}` keeps a token out of it. */\n  url?: string;\n  /** webhook: required. */\n  method?: 'get' | 'post' | 'put';\n  /**\n   * webhook: header name → template text, or `{ fromEnv }` for a value that is itself a secret.\n   * ⚠️ PLAIN VALUES ARE PROPS, AND PROPS ARE STORED: `Content-Type` is fine, a token is not. Put a\n   *   credential in `secret` and write `'Bearer {{ secrets.token }}'` here instead.\n   */\n  header?: Readonly<Record<string, FromEnv | string>>;\n  /**\n   * webhook: the body TEMPLATE, as text. ★ Declared DECODED — the wire is base64, and this family\n   *   encodes on write and decodes on read, so a plan shows a readable diff.\n   */\n  body?: string;\n  /** webhook: ⛔ WRITE-ONLY. Name → variable. Referenced as `{{ secrets.<name> }}`. */\n  secret?: Readonly<Record<string, FromEnv>>;\n}\n\n/** ⛔ NO VALUE OF A SECRET, PASSWORD OR HEADER — names and digests only. */\nexport interface PbsNotificationTargetAttributes {\n  name: string;\n  type: PbsNotificationTargetType;\n  /** `builtin`, `modified-builtin`, `user-created` — reported, never compared. */\n  origin: string;\n  comment: string;\n  disable: boolean;\n  mailto: string;\n  'mailto-user': string;\n  'from-address': string;\n  author: string;\n  server: string;\n  /** 0 means PBS holds no port. */\n  port: number;\n  mode: string;\n  username: string;\n  url: string;\n  method: string;\n  /** The decoded body template. */\n  body: string;\n  /** Header NAMES, sorted — presence. */\n  header: string;\n  /** scrypt digest of the live header pairs, fixed salt per target. */\n  headerDigest: string;\n  /** Secret NAMES, sorted — all PBS will say. */\n  secret: string;\n  /**\n   * Seal of the secret values and password THIS PROVIDER LAST WROTE; `''` if it never wrote them\n   * (an adoption). ⚠️ `''` makes those values presence-only until the first write that carries them.\n   */\n  sealed: string;\n}\n\nexport interface PbsNotificationTarget extends Resource<\n  'Pbs.NotificationTarget',\n  PbsNotificationTargetProps,\n  PbsNotificationTargetAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const PbsNotificationTarget = Resource<PbsNotificationTarget>('Pbs.NotificationTarget');\n\n/**\n * ⛔ `Provider.of` STAYS HERE, for resource.ts's reason: it is the one place the handlers are\n *   checked against the concrete resource types, so the lifecycle file cannot drift from them.\n */\nexport const PbsNotificationTargetProvider = () =>\n  Provider.effect(\n    PbsNotificationTarget,\n    Effect.succeed(PbsNotificationTarget.Provider.of(handlers)),\n  );\n",
-    "/**\n * The lifecycle of a `Pbs.NotificationTarget`: read, diff, reconcile, delete.\n *\n * ★ SPLIT OUT OF pbs-notification-target.ts FOR THE 250-LINE CAP. That file says what a target is\n *   and holds `Provider.of`; this one says what each operation does. The `import type` back is\n *   erased, so the cycle is on paper only.\n *\n * ⚠️ NOT `pveHandlers`, AND IT SHOULD LOOK DIFFERENT (resource.ts asks for exactly that). The\n *   factory's `diff` sees only the live object, and a secret's value is not in the live object:\n *   the seal lives in the PREVIOUS STATE, which only a hand-written `diff` and `reconcile` receive\n *   (`output`). Everything else — the read, the read-back refusal, the `matches` guard that keeps\n *   adoption free — is the factory's behaviour, written out.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport { pve } from './client.ts';\nimport { guardForm } from './constraint-guard.ts';\nimport { pbsTargetEndpoint } from './pbs-notification-target-endpoint.ts';\nimport type {\n  PbsNotificationTargetAttributes,\n  PbsNotificationTargetProps,\n} from './pbs-notification-target.ts';\nimport {\n  type Carry,\n  type Groups,\n  headerState,\n  plainMatches,\n  refusals,\n  resolveGroups,\n  sealedState,\n  targetForm,\n} from './pbs-notification-target-form.ts';\nimport { targetAttributes } from './pbs-notification-target-wire.ts';\nimport { seal } from '../secrets/write-only.ts';\n\ntype Props = PbsNotificationTargetProps;\ntype Attributes = PbsNotificationTargetAttributes;\n\nconst path = (props: Props) => `config/notifications/endpoints/${props.type}/${props.name}`;\n\n/**\n * ⚠️ A 404 and `{\"data\": null}` are answers here — and so, resource.ts's ⛔, is a 403. `pve()`\n *   returns `null` for the second, not `undefined`, so the test is `== null`.\n */\nconst readLive = (props: Props) =>\n  pve<Record<string, unknown>>(props.target, 'read', 'GET', path(props)).pipe(\n    Effect.map((data) => (data == null ? undefined : targetAttributes(data, props))),\n    Effect.orElseSucceed(() => undefined),\n  );\n\nconst refuse = (props: Props) => {\n  const reasons = refusals(props);\n  return reasons.length === 0\n    ? Effect.void\n    : Effect.die(new Error(`${path(props)}: ${reasons.join('; ')}.`));\n};\n\n/** What a write must carry, given what is stale. `undefined` means nothing to write. */\nconst toCarry = (live: Attributes, props: Props, groups: Groups, sealed: string) => {\n  const header = headerState(live, props, groups) === 'stale';\n  const sealedStale = sealedState(live, props, groups, sealed) === 'stale';\n  return plainMatches(live, props) && !header && !sealedStale\n    ? undefined\n    : ({ header, sealed: sealedStale } satisfies Carry);\n};\n\n/** ⛔ Every variable a carried group needs, or a failure naming the missing ones — never a value. */\nconst requireValues = (props: Props, groups: Groups, carry: Carry) => {\n  const missing = [\n    ...(carry.header ? groups.header.missing : []),\n    ...(carry.sealed ? groups.sealed.missing : []),\n  ];\n  return missing.length === 0\n    ? Effect.void\n    : Effect.die(\n        new Error(\n          `${path(props)}: this write must send write-only values, and ${missing.join(', ')} ` +\n            'is unset or empty in the deploying environment. Export it and deploy again.',\n        ),\n      );\n};\n\nexport const handlers = {\n  /** ⛔ EMPTY: `mail-to-root` is on every host, and adoption stays an explicit act (resource.ts). */\n  list: () => Effect.succeed([]),\n  /**\n   * ⛔ WITH NO `output` THIS IS ALCHEMY'S ADOPTION PROBE, AND THE ONLY PLAN-TIME HOOK A NEW TARGET\n   *   GETS — so the refusals run here too. Measured on beta.79 (Plan.ts, the `oldState ===\n   *   undefined` branch): a declaration with no state row is `read` with `olds: news` and never\n   *   `diff`ed, and Apply then commits its props as `creating` BEFORE `reconcile` runs. A refusal\n   *   left to `reconcile` fired after the props — a literal token included — were in the store.\n   * ⚠️ ONLY WHEN THE PROPS ARE RESOLVED: Plan skips the probe while any prop is an unresolved\n   *   Output, and then `reconcile` is the first check. docs/pbs-notifications.md says so.\n   * ★ A DEFECT (`Effect.die`), NOT A FAILURE, AND THAT IS WHAT KEEPS IT FROM WEDGING A STAGE. The\n   *   same `read`-with-no-output shape is Alchemy's RECOVERY read of an interrupted create, at plan\n   *   and before a delete (Plan.ts, Apply.ts), with the STORED props — and both wrap it in\n   *   `catchDefect`, degrading to \"nothing recovered\". A typed failure would pass that catch and\n   *   block the plan or the delete on props the user already fixed. The cold-start probe has no\n   *   catch, so there the defect fails the plan, as intended. A refused create sent no request,\n   *   so \"nothing recovered\" is also the truth.\n   */\n  read: ({ olds, output }: { olds: Props; output: Attributes | undefined }) =>\n    (output === undefined ? refuse(olds) : Effect.void).pipe(\n      Effect.andThen(readLive(olds)),\n      Effect.map((live) =>\n        live === undefined ? undefined : { ...live, sealed: output?.sealed ?? '' },\n      ),\n    ),\n  /**\n   * ⚠️ `Input<Props>` and `isResolved`, resource.ts's reason: at plan time a prop can still be an\n   *   unresolved Output, and comparing a placeholder to a live value reports a phantom update.\n   * ⛔ A NEW `type` UNDER THE SAME `name` REPLACES DELETE-FIRST: names are unique across every\n   *   family on the host (api `ensure_unique`), so creating the new one first would be refused.\n   */\n  diff: ({\n    news,\n    olds,\n    output,\n  }: {\n    news: Input<Props>;\n    olds: Props;\n    output: Attributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      if (output === undefined || !isResolved(news)) return undefined;\n      if (olds !== undefined && (olds.type !== news.type || olds.name !== news.name)) {\n        return { action: 'replace', deleteFirst: olds.name === news.name } as const;\n      }\n      yield* refuse(news);\n      const live = yield* readLive(news);\n      if (live === undefined) return { action: 'update' } as const;\n      return toCarry(live, news, resolveGroups(news), output.sealed) === undefined\n        ? ({ action: 'noop' } as const)\n        : ({ action: 'update' } as const);\n    }),\n  reconcile: ({ news, output }: { news: Props; output: Attributes | undefined }) =>\n    Effect.gen(function* () {\n      yield* refuse(news);\n      const groups = resolveGroups(news);\n      const live = yield* readLive(news);\n      let sealed = output?.sealed ?? '';\n      if (live === undefined) {\n        const carry = { header: true, sealed: true } as const;\n        yield* requireValues(news, groups, carry);\n        const collection = `config/notifications/endpoints/${news.type}`;\n        const form = targetForm(news, groups, carry, 'create');\n        /**\n         * ⛔ WITH PRESENCE, BECAUSE THIS BRANCH IS UNCONDITIONALLY THE CREATE. PBS marks `name` on\n         *   every family and `server`/`from-address` on smtp, `url`/`method` on webhook — and it\n         *   is the same `comment: maxLength 128` that failed `POST /config/verify`.\n         * ⚠️ THE FORM CARRIES SECRETS ON THIS PATH. `violations` reads values and builds only the\n         *   parameter NAME into its message (constraints.ts), so a refusal never quotes one.\n         */\n        yield* guardForm(pbsTargetEndpoint(news).create, form, true);\n        yield* pve(news.target, 'provision', 'POST', collection, form);\n        sealed = seal(groups.sealed.values);\n      } else {\n        const carry = toCarry(live, news, groups, sealed);\n        if (carry !== undefined) {\n          yield* requireValues(news, groups, carry);\n          const form = targetForm(news, groups, carry, 'update');\n          /** ⚠️ NO PRESENCE: an update form is partial by design — it carries what `toCarry` said. */\n          yield* guardForm(pbsTargetEndpoint(news).update, form, false);\n          yield* pve(news.target, 'provision', 'PUT', path(news), form);\n          if (carry.sealed) sealed = seal(groups.sealed.values);\n        }\n      }\n      const after = yield* readLive(news);\n      if (after === undefined) {\n        // ⛔ resource.ts's rule: \"no error\" is not evidence of a write. Read back, or refuse.\n        return yield* Effect.die(\n          new Error(`${path(news)}: the write returned no error but the target is still absent.`),\n        );\n      }\n      return { ...after, sealed } satisfies Attributes;\n    }),\n  delete: ({ olds }: { olds: Props }) => pve(olds.target, 'provision', 'DELETE', path(olds)),\n};\n",
-    "/**\n * `Pbs.NotificationTarget`'s six vendor endpoints — one create and one update per family.\n *\n * 🔴 THIS FAMILY WAS THE ONE THE 2026-09-22 SWEEP NEARLY MISSED, and it carries the very\n *   parameter the incident was about: `comment` is `maxLength: 128` with a no-control-characters\n *   pattern on all three PBS creates, exactly as it is on `POST /config/verify`. A 129-character\n *   comment on a notification target would have failed the same way, half a deploy in, on the\n *   family whose whole purpose is to make failures visible.\n *\n * ⛔ PBS REGISTERS ONE PATH PER TYPE, NOT A `{type}` PARAMETER, and the three schemas differ:\n *   smtp requires `server` and `from-address`, webhook `url` and `method`, sendmail nothing but\n *   its name. One key would enforce one family's rules on all three.\n * ⛔ THE STRINGS MUST STAY LITERALS. `codegen/constraints.ts` finds the endpoints to table by\n *   SCANNING THIS PACKAGE'S TEXT, so a key built from `props.type` would be tabled by nothing.\n *\n * ⚠️ NO GOTIFY KEY, BECAUSE THIS RESOURCE HAS NO GOTIFY TYPE. `PbsNotificationTargetType` is\n *   sendmail | smtp | webhook; PBS 4.2 does publish a gotify endpoint, and nothing here writes to\n *   it. ⛔ `scripts/proxmox-ownership-pbs.ts` says otherwise — it claims all four families\n *   through the shared `notificationEndpoints` helper — so `docs/api-coverage.md` credits this\n *   resource with twelve write endpoints where it really makes nine. That is an overclaim in the\n *   hand-written ownership ledger, recorded here rather than fixed in passing: correcting it\n *   regenerates a report built from a DIFFERENT (older, 9.2.4) schema manifest, which is its own\n *   change with its own diff.\n */\nimport type { PbsNotificationTargetProps } from './pbs-notification-target.ts';\nimport type { EndpointPair } from './resource-spec.ts';\n\nconst ENDPOINTS: Readonly<Record<PbsNotificationTargetProps['type'], EndpointPair>> = {\n  sendmail: {\n    create: 'pbs:POST /config/notifications/endpoints/sendmail',\n    update: 'pbs:PUT /config/notifications/endpoints/sendmail/{name}',\n  },\n  smtp: {\n    create: 'pbs:POST /config/notifications/endpoints/smtp',\n    update: 'pbs:PUT /config/notifications/endpoints/smtp/{name}',\n  },\n  webhook: {\n    create: 'pbs:POST /config/notifications/endpoints/webhook',\n    update: 'pbs:PUT /config/notifications/endpoints/webhook/{name}',\n  },\n};\n\n/** The pair this declaration writes. ⚠️ `type` is identity here — changing it is a replace. */\nexport const pbsTargetEndpoint = (props: PbsNotificationTargetProps): EndpointPair =>\n  ENDPOINTS[props.type];\n",
-    "/**\n * A credential written as a LITERAL in a plain prop — refused, because a plain prop is a value in\n * the state store.\n *\n * ⛔ THE HOLE THIS CLOSES, MEASURED 2026-09-22 (adversarial review of PR 95). write-only.ts keeps\n *   every `{ fromEnv }` value out of state, and the doc WARNED that a plain header value is a prop.\n *   A warning is not a guard: `header: { Authorization: 'Bearer <token>' }` planned, deployed, and\n *   left the token in the dumped state store — and so did `url: 'https://…?token=<token>'`. Alchemy\n *   stores props unencrypted (write-only.ts has the StateEncoding reading), so the only safe\n *   literal is one that is not a credential.\n *\n * ★ WHAT COUNTS AS A CREDENTIAL IS A NAME, NOT A VALUE. A value cannot be recognised — a token is\n *   any string — but where it sits can: an `Authorization`/`Cookie` header, a header or query\n *   parameter whose name has a word like `token`, `key`, `secret`, `password` or `signature`, and a\n *   password in the URL's userinfo. A false positive costs one edit (declare it `{ fromEnv }`, or\n *   hold it in `secret` and write `{{ secrets.<name> }}`); a false negative costs a leaked token.\n * ★ A TEMPLATE THAT READS A SECRET IS NOT A LITERAL. `Bearer {{ secrets.token }}`, and\n *   `{{ url-encode secrets.token }}` in a query, render on PBS from the root-only secret store —\n *   the prop holds the reference, not the value.\n *\n * ⚠️ WHAT THIS CANNOT SEE: a token in a URL PATH (a Slack-style `/services/T…/B…/<token>`), in the\n *   `body`, or in a `comment`. Those are plain props too; put the token in `secret` and reference\n *   it from the template. docs/pbs-notifications.md says the same to the reader.\n * ⛔ A REFUSAL NAMES THE FIELD, NEVER THE VALUE — the message lands in a terminal and a CI log.\n */\nimport type { FromEnv } from '../secrets/write-only.ts';\n\n/** `{{ secrets.x }}`, `{{secrets.x}}`, `{{ url-encode secrets.x }}` — a reference, not a value. */\nconst READS_SECRET = /\\{\\{[^}]*\\bsecrets\\./;\n\n/** A whole-name match, or one dash/underscore-separated word of the name. */\nconst CREDENTIAL_WORD =\n  /(^|[-_])(api[-_]?key|apikey|key|token|secret|password|passwd|pwd|pass|auth|signature|sig|code)($|[-_])/i;\nconst CREDENTIAL_HEADER = /^(proxy-authorization|authorization|cookie)$/i;\n\nexport const isCredentialName = (name: string): boolean =>\n  CREDENTIAL_HEADER.test(name) || CREDENTIAL_WORD.test(name);\n\nconst literal = (value: string): boolean => value !== '' && !READS_SECRET.test(value);\n\n/** Plain header values that are credentials by their header's name. `{ fromEnv }` is never one. */\nexport const literalCredentialHeaders = (\n  header: Readonly<Record<string, FromEnv | string>> | undefined,\n): string[] =>\n  Object.entries(header ?? {})\n    .filter(([name, value]) => typeof value === 'string' && isCredentialName(name))\n    .filter(([, value]) => literal(value as string))\n    .map(([name]) => name)\n    .sort();\n\n/**\n * Where a URL carries a literal credential: `userinfo` (a password before the `@`), or the names\n * of credential-shaped query (or fragment) parameters. Parsed by hand, not with `new URL`: a URL here is a\n * TEMPLATE, and `{{ … }}` in the host or the userinfo is not a URL `new URL` will accept.\n */\nexport const literalCredentialsInUrl = (url: string | undefined): string[] => {\n  if (url === undefined) return [];\n  const out: string[] = [];\n  const authority = /^[a-z][a-z0-9+.-]*:\\/\\/([^/?#]*)/i.exec(url)?.[1] ?? '';\n  const at = authority.lastIndexOf('@');\n  if (at >= 0) {\n    const userinfo = authority.slice(0, at);\n    const colon = userinfo.indexOf(':');\n    if (colon >= 0 && literal(userinfo.slice(colon + 1))) out.push('userinfo');\n  }\n  // ⚠️ THE FRAGMENT TOO: it is never sent, but it is still a prop — and so still in state.\n  const params = url.replace(/^[^?#]*/, '');\n  for (const pair of params.split(/[?&#]/)) {\n    const eq = pair.indexOf('=');\n    const name = eq < 0 ? pair : pair.slice(0, eq);\n    if (eq >= 0 && isCredentialName(name) && literal(pair.slice(eq + 1))) out.push(`?${name}`);\n  }\n  return out;\n};\n",
+    "/**\n * A notification target's props, as the form PVE wants — including the one field in this package\n * that cannot be spelled as a comma list.\n *\n * ★ SPLIT OUT OF notification-target.ts TO KEEP BOTH UNDER THE 250-LINE CAP. The seam is the same\n *   one metric-server uses: this file turns a declaration into a form, and the resource file says\n *   what a target IS and when it has changed. The `import type` back is erased, so it is a cycle\n *   on paper only.\n * ★ These shapes still feed specGuards and preserve scalar/default/omission mapping. The\n *   distilled adapter replaces list fields with typed arrays; the SDK owns their wire encoding.\n */\nimport type { NotificationTargetProps } from './notification-target.ts';\nimport { text } from './values.ts';\n\n/**\n * ⛔ A MULTI-VALUED PARAMETER GOES ON THE WIRE DIFFERENTLY HERE THAN ANYWHERE ELSE IN THIS PACKAGE,\n *   AND THE DIFFERENCE IS MEASURED. Every other PVE endpoint spells a list `type: string, format:\n *   pve-configid-list` — comma-joined, which is what sdn-vnet.ts sends. On the notification\n *   endpoints `mailto`, `mailto-user`, `header` and `delete` are `type: array`, and PVE's own web\n *   UI submits those as REPEATED KEYS (`header=a&header=b`). `Record<string, string>` cannot repeat\n *   a key, so one value carrying a NUL goes instead: it percent-encodes to `%00`, and PVE's\n *   urlencoded decoder joins repeated keys with exactly that byte, rebuilding the same parameter.\n *   ⚠️ ONLY `header` NEEDS IT, and only past one entry. A header item is ITSELF the property string\n *     `name=<name>,value=<base64>`, so a comma cannot express even one of them. Addresses hold no\n *     commas and PVE's UI submits `mailto` as a comma-separated text field, so those go that way.\n *   ⚠️ REASONED FROM THE DECODER AND THE UI, NOT PROVEN BY A LIVE MULTI-HEADER WRITE. One header\n *     carries no separator and is unaffected either way; a longer list, if rejected, fails with a\n *     400 naming `header` rather than quietly dropping one, and the fix is one line here.\n */\nconst REPEATED_KEY = '\\0';\n\n/** ⚠️ `0` is \"PVE holds no port\". Integers have come back as strings elsewhere, so parse both. */\nexport const portOf = (value: unknown): number => {\n  const parsed = typeof value === 'number' ? value : Number.parseInt(String(value ?? ''), 10);\n  return Number.isNaN(parsed) ? 0 : parsed;\n};\n\nconst sorted = (parts: readonly string[]): string =>\n  parts\n    .map((part) => part.trim())\n    .filter((part) => part !== '')\n    .sort()\n    .join(',');\n\n/**\n * ⚠️ ORDER IS NOT MEANING IN A RECIPIENT LIST, SO IT MUST NOT BE A DIFF — backup-job.ts's reasoning\n *   about guest ids, applied to addresses. Both sides are sorted before they meet.\n *\n * ⚠️ PVE ANSWERS WITH AN ARRAY AND ACCEPTS A DELIMITED STRING, and this package has already been\n *   bitten by a list coming back flattened on one version and structured on another (`groups` in\n *   user.ts). PVE's UI calls `mailto` \"separated by spaces, commas or semicolons\", so all three are\n *   split here and both shapes funnel into one comparable value.\n */\nexport const addressList = (value: unknown): string =>\n  sorted(\n    Array.isArray(value)\n      ? value.map((item: unknown) => String(item))\n      : typeof value === 'string'\n        ? value.split(/[\\s,;]+/)\n        : [],\n  );\n\n/** ⛔ NEVER SPLIT ON A COMMA: a header item contains one. A lone string is one item, not a list. */\nexport const headerList = (value: unknown): string =>\n  sorted(Array.isArray(value) ? value.map((item: unknown) => String(item)) : [text(value)]);\n\nconst set = (key: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [key]: value };\n\n/**\n * The form for both create and update.\n *\n * ⛔ A FIELD THE DECLARATION LEAVES OUT IS NOT SENT AND NOT COMPARED — backup-job.ts's rule rather\n *   than sdn-vnet.ts's `delete` list, and here the choice is not close. That list would have to\n *   name `mailto`, so a target adopted from the UI and declared without its recipients would have\n *   them stripped on the first deploy: the one object that makes failures visible, turned back into\n *   silence. `delete` on this family is also `type: array` rather than the comma string every other\n *   endpoint takes, so sdn-vnet's encoding would not even carry.\n *   ⚠️ THE PRICE IS THAT REMOVING A LINE DOES NOT CLEAR A FIELD. Declare it as `''` to clear it,\n *     which IS sent: an empty string is a value, an absent prop is no request at all.\n *\n * ⚠️ `disable` IS ALWAYS SENT AND ALWAYS COMPARED, `0` INCLUDED. PVE documents the default as 0, so\n *   sending it explicitly is what makes \"not declared\" and \"declared false\" one state instead of a\n *   plan that asks for an update the PUT never performs. It is also the drift that matters most\n *   here: a target disabled by hand during a maintenance window and never re-enabled looks exactly\n *   like a healthy cluster.\n */\nexport const shape = (props: NotificationTargetProps): Record<string, string> => ({\n  disable: props.disable === true ? '1' : '0',\n  ...set('author', props.author),\n  ...set('body', props.body),\n  ...set('comment', props.comment),\n  ...set('from-address', props['from-address']),\n  ...set('header', props.header === undefined ? undefined : props.header.join(REPEATED_KEY)),\n  ...set('mailto', props.mailto === undefined ? undefined : addressList(props.mailto)),\n  ...set(\n    'mailto-user',\n    props['mailto-user'] === undefined ? undefined : addressList(props['mailto-user']),\n  ),\n  ...set('method', props.method),\n  ...set('mode', props.mode),\n  ...set('port', props.port === undefined ? undefined : String(props.port)),\n  ...set('server', props.server),\n  ...set('url', props.url),\n  ...set('username', props.username),\n});\n\n/**\n * The create form: `shape` plus the name PVE takes in the body exactly once.\n *\n * ★ EXPORTED SO THE CONSTRAINT PROOF CAN RUN THE REAL FORM rather than a retyped copy of it.\n * ⛔ `name` IS CREATE-ONLY: PVE takes it in the body on the POST and in the path forever after.\n */\nexport const createShape = (props: NotificationTargetProps): Record<string, string> => ({\n  ...shape(props),\n  name: props.name,\n});\n",
+    "/** Pure target state and vendor guards, kept separate from the SDK lifecycle. */\nimport type {\n  NotificationTargetAttributes,\n  NotificationTargetProps,\n} from './notification-target.ts';\nimport type { PveSpec } from './resource-spec.ts';\nimport { targetEndpoint } from './notification-target-endpoint.ts';\nimport { addressList, createShape, headerList, portOf, shape } from './notification-target-form.ts';\nimport { text } from './values.ts';\n\nexport const targetSpec: PveSpec<NotificationTargetProps, NotificationTargetAttributes> = {\n  /**\n   * ⛔ NAMED FIELDS, NEVER A SPREAD OF `live`. gotify's `token` and smtp's `password` really are\n   *   absent from their read schemas — but webhook's read schema DECLARES `secret`, so \"PVE will\n   *   not hand it to us\" is not a defence. Listing what is kept is what keeps secret material out\n   *   of a state row, whatever a future PVE decides to start returning.\n   */\n  attributes: (live, props) => ({\n    author: text(live['author']),\n    body: text(live['body']),\n    comment: text(live['comment']),\n    disable: live['disable'] === 1 || live['disable'] === true,\n    'from-address': text(live['from-address']),\n    header: headerList(live['header']),\n    mailto: addressList(live['mailto']),\n    'mailto-user': addressList(live['mailto-user']),\n    method: text(live['method']),\n    mode: text(live['mode']),\n    name: props.name,\n    port: portOf(live['port']),\n    server: text(live['server']),\n    type: props.type,\n    url: text(live['url']),\n    username: text(live['username']),\n  }),\n  collection: (props) => `cluster/notifications/endpoints/${props.type}`,\n  /** ⛔ `name` is create-only: PVE takes it in the body once, and in the path forever after. */\n  createForm: createShape,\n  /** ⚠️ A function, because the type picks the endpoint — see `targetEndpoint`. */\n  endpoint: targetEndpoint,\n  /**\n   * Each line reads \"not declared, or equal\"; `disable` is the one field with no undeclared case.\n   *\n   * ⚠️ IF A PLAN NEVER SETTLES, SUSPECT A SCHEMA DEFAULT COMING BACK AS A VALUE. PVE defaults smtp\n   *   `mode` to `tls` and smtp `author` to `Proxmox VE`, and applies both when the mail is sent\n   *   rather than writing them into the config — so an undeclared field reads back empty and its\n   *   line is skipped. A version that STORED them would answer with a field nobody declared. The\n   *   fix is to declare the field, never to stop comparing it.\n   */\n  matches: (attributes, props) =>\n    attributes.disable === (props.disable === true) &&\n    (props.comment === undefined || attributes.comment === props.comment) &&\n    (props.server === undefined || attributes.server === props.server) &&\n    (props.port === undefined || attributes.port === props.port) &&\n    (props.mode === undefined || attributes.mode === props.mode) &&\n    (props.username === undefined || attributes.username === props.username) &&\n    (props['from-address'] === undefined || attributes['from-address'] === props['from-address']) &&\n    (props.author === undefined || attributes.author === props.author) &&\n    (props.url === undefined || attributes.url === props.url) &&\n    (props.method === undefined || attributes.method === props.method) &&\n    (props.body === undefined || attributes.body === props.body) &&\n    (props.mailto === undefined || attributes.mailto === addressList(props.mailto)) &&\n    (props['mailto-user'] === undefined ||\n      attributes['mailto-user'] === addressList(props['mailto-user'])) &&\n    (props.header === undefined || attributes.header === headerList(props.header)),\n  path: (props) => `cluster/notifications/endpoints/${props.type}/${props.name}`,\n  updateForm: shape,\n};\n",
+    "/** PVE 9.2.11 target operations. Named SDK calls retain each endpoint's own request schema. */\nimport * as cluster from '@distilled.cloud/proxmox/cluster';\nimport type { ProxmoxOpContext, ProxmoxOpError } from '@distilled.cloud/proxmox/Protocol';\nimport * as Effect from 'effect/Effect';\nimport { runPve } from './distilled-pve.ts';\nimport type { NotificationTargetProps as Props } from './notification-target.ts';\nimport { addressList, createShape, shape } from './notification-target-form.ts';\nimport { notificationRequest, notificationResponse } from './notification-sdk-input.ts';\nimport { targetSpec } from './notification-target-spec.ts';\n\nconst read = (\n  props: Props,\n): Effect.Effect<Record<string, unknown>, ProxmoxOpError, ProxmoxOpContext> => {\n  const request = { name: props.name };\n  switch (props.type) {\n    case 'gotify':\n      return cluster.getClusterNotificationEndpointGotify(request).pipe(\n        Effect.flatMap(notificationResponse(cluster.GetClusterNotificationEndpointGotifyResponse)),\n        Effect.map((row) => ({ ...row })),\n      );\n    case 'sendmail':\n      return cluster.getClusterNotificationEndpointSendmail(request).pipe(\n        Effect.flatMap(\n          notificationResponse(cluster.GetClusterNotificationEndpointSendmailResponse),\n        ),\n        Effect.map((row) => ({\n          ...row,\n          'from-address': row.from_address,\n          'mailto-user': row.mailto_user,\n        })),\n      );\n    case 'smtp':\n      return cluster.getClusterNotificationEndpointSmtp(request).pipe(\n        Effect.flatMap(notificationResponse(cluster.GetClusterNotificationEndpointSmtpResponse)),\n        Effect.map((row) => ({\n          ...row,\n          'from-address': row.from_address,\n          'mailto-user': row.mailto_user,\n        })),\n      );\n    case 'webhook':\n      return cluster.getClusterNotificationEndpointWebhook(request).pipe(\n        Effect.flatMap(notificationResponse(cluster.GetClusterNotificationEndpointWebhookResponse)),\n        Effect.map((row) => ({ ...row })),\n      );\n  }\n};\n\nexport const readTarget = (props: Props) =>\n  runPve(props.target, 'read', false, read(props)).pipe(\n    Effect.map((row) => targetSpec.attributes(row, props)),\n    Effect.catchTag('NotFound', () => Effect.succeed(undefined)),\n  );\n\n/** The legacy forms spell scalar lists explicitly; SDK arrays preserve each logical value. */\nconst fields = (props: Props, create: boolean) => {\n  const form: Record<string, string | string[]> = {\n    ...(create ? createShape(props) : shape(props)),\n    name: props.name,\n  };\n  const cleared: string[] = [];\n  for (const [key, values] of [\n    ['header', props.header === undefined ? undefined : [...props.header]],\n    [\n      'mailto',\n      props.mailto === undefined ? undefined : addressList(props.mailto).split(',').filter(Boolean),\n    ],\n    [\n      'mailto-user',\n      props['mailto-user'] === undefined\n        ? undefined\n        : addressList(props['mailto-user']).split(',').filter(Boolean),\n    ],\n  ] as const) {\n    if (values === undefined) continue;\n    if (values.length > 0) form[key] = values;\n    else {\n      delete form[key];\n      if (!create) cleared.push(key);\n    }\n  }\n  // Empty SDK arrays emit no keys; a PUT must explicitly clear a declared empty list.\n  if (cleared.length > 0) form.delete = cleared;\n  return form;\n};\n\n/** No request: replacement planning must reject SDK-only input errors before any DELETE. */\nexport const validateTargetWrite = (props: Props, create: boolean) => {\n  const schema = create\n    ? {\n        sendmail: cluster.CreateClusterNotificationEndpointSendmailRequest,\n        smtp: cluster.CreateClusterNotificationEndpointSmtpRequest,\n        gotify: cluster.CreateClusterNotificationEndpointGotifyRequest,\n        webhook: cluster.CreateClusterNotificationEndpointWebhookRequest,\n      }[props.type]\n    : {\n        sendmail: cluster.PutClusterNotificationEndpointSendmailRequest,\n        smtp: cluster.PutClusterNotificationEndpointSmtpRequest,\n        gotify: cluster.PutClusterNotificationEndpointGotifyRequest,\n        webhook: cluster.PutClusterNotificationEndpointWebhookRequest,\n      }[props.type];\n  return notificationRequest(schema, fields(props, create)).pipe(Effect.asVoid);\n};\n\nexport const createTarget = (props: Props) => {\n  const form = fields(props, true);\n  const operation =\n    props.type === 'sendmail'\n      ? notificationRequest(cluster.CreateClusterNotificationEndpointSendmailRequest, form).pipe(\n          Effect.flatMap(cluster.createClusterNotificationEndpointSendmail),\n        )\n      : props.type === 'smtp'\n        ? notificationRequest(cluster.CreateClusterNotificationEndpointSmtpRequest, form).pipe(\n            Effect.flatMap(cluster.createClusterNotificationEndpointSmtp),\n          )\n        : props.type === 'gotify'\n          ? notificationRequest(cluster.CreateClusterNotificationEndpointGotifyRequest, form).pipe(\n              Effect.flatMap(cluster.createClusterNotificationEndpointGotify),\n            )\n          : notificationRequest(cluster.CreateClusterNotificationEndpointWebhookRequest, form).pipe(\n              Effect.flatMap(cluster.createClusterNotificationEndpointWebhook),\n            );\n  return runPve(props.target, 'provision', true, operation);\n};\n\nexport const updateTarget = (props: Props) => {\n  const form = fields(props, false);\n  const operation =\n    props.type === 'sendmail'\n      ? notificationRequest(cluster.PutClusterNotificationEndpointSendmailRequest, form).pipe(\n          Effect.flatMap(cluster.putClusterNotificationEndpointSendmail),\n        )\n      : props.type === 'smtp'\n        ? notificationRequest(cluster.PutClusterNotificationEndpointSmtpRequest, form).pipe(\n            Effect.flatMap(cluster.putClusterNotificationEndpointSmtp),\n          )\n        : props.type === 'gotify'\n          ? notificationRequest(cluster.PutClusterNotificationEndpointGotifyRequest, form).pipe(\n              Effect.flatMap(cluster.putClusterNotificationEndpointGotify),\n            )\n          : notificationRequest(cluster.PutClusterNotificationEndpointWebhookRequest, form).pipe(\n              Effect.flatMap(cluster.putClusterNotificationEndpointWebhook),\n            );\n  return runPve(props.target, 'provision', true, operation);\n};\n\nexport const deleteTarget = (props: Props) => {\n  const request = { name: props.name };\n  const operation =\n    props.type === 'sendmail'\n      ? cluster.deleteClusterNotificationEndpointSendmail(request)\n      : props.type === 'smtp'\n        ? cluster.deleteClusterNotificationEndpointSmtp(request)\n        : props.type === 'gotify'\n          ? cluster.deleteClusterNotificationEndpointGotify(request)\n          : cluster.deleteClusterNotificationEndpointWebhook(request);\n  return runPve(props.target, 'provision', true, operation).pipe(\n    Effect.catchTag('NotFound', () => Effect.void),\n  );\n};\n",
+    "/**\n * `Pbs.Datastore` — one section of Proxmox Backup Server's `datastore.cfg`, declared.\n *\n * ★ PBS IS A SIBLING OF PVE, NOT A PART OF IT. The estate runs both — PVE carries a storage of\n *   `type: pbs` — so declaring the datastore turns `Proxmox.Storage`'s `locator.datastore` from a\n *   string nothing checks into a reference Alchemy can order, as `Proxmox.SdnVnet` did for a bridge.\n *\n * ⛔ DIFFERENT HOST, DIFFERENT REALM, DIFFERENT AUTH HEADER. MEASURED 2026-09-13, strict TLS, no\n *   `-k` anywhere: `GET https://pbs.example.com:8007/api2/json/ping` answers 200\n *   `{\"data\":{\"pong\":true}}` against a Let's Encrypt certificate for CN=pbs.example.com;\n *   `/version` and `/config/datastore` answer 401 \"authentication failed\";\n *   `pbs.mgmt.example.com:8007` answers 401 and its certificate verifies too; and\n *   `/access/domains` lists the realms `pbs`, `pam` and an openid realm. So the\n *   prefix, the `{\"data\": …}` envelope and the strict-TLS story are PVE's exactly — and only the\n *   credential differs. There is no `pve` realm here; a PVE token cannot authenticate at all.\n *   The distilled PBS SDK owns that distinct header; `distilled-pbs.ts` supplies its credentials.\n *\n * ⚠️ HISTORICAL BOOTSTRAP BLOCKER, 2026-09-13: THERE WAS NO PBS MOUNT. `PbsTarget.mount` is\n *   a parameter for the reason `PveTarget.mount` is — the provider must be able to leave this\n *   estate. A later PBS credential lane resolved the following incident. MEASURED: under the agent's approle,\n *   `bao token capabilities` answers `deny` for `proxmox-c1/creds/{read,provision}`,\n *   `proxmox-c2/creds/read` and every `…pbs…` path tried, and `sys/mounts` is 403 — so I could\n *   not enumerate the mounts to PROVE a PBS one is absent. That it is absent is the brief's\n *   statement, not my measurement.\n *   ★ WHAT THE MOUNT MUST VEND, so `mint()` is reused unchanged: `bao read -format=json\n *     <mount>/creds/<role>` answering `{\"data\":{\"token_id\":…,\"secret\":…}}`, where `token_id` is a\n *     PBS token id `user@realm!tokenname` — `hf-read@pbs!…` and `hf-provision@pbs!…`. Same short,\n *     non-renewable lease contract as `proxmox-c1`.\n *   ⚠️ PBS HAD NO DYNAMIC-SECRETS PLUGIN OF ITS OWN — OpenBao's Proxmox support is a PVE thing — so\n *     the mount is a small custom vendor against `POST /access/users/{id}/token/{name}`. Say which\n *     mount and role you needed rather than reaching for the read-only `metrics@pbs` token on\n *     the kv shelf: widening that would delete the outer lock for every reader of the shelf.\n *\n * ⛔ A DATASTORE HOLDS THE BACKUPS, SO `retain` IS THE DEFAULT AND `delete` IS FULLY IMPLEMENTED —\n *   the ★ on removal policy in resource.ts has the whole reasoning. A stub returning `Effect.void`\n *   would report a deletion that never happened, and this is the family where that lie costs most.\n *\n * ⚠️ PRIVILEGES, READ OFF THE PUBLISHED SCHEMA RATHER THAN OFF THIS HOST:\n *     read   GET    config/datastore/{name}   Datastore.Audit    on /datastore/{name}\n *     create POST   config/datastore          Datastore.Allocate on /datastore\n *     update PUT    config/datastore/{name}   Datastore.Modify   on /datastore/{name}\n *     delete DELETE config/datastore/{name}   Datastore.Allocate on /datastore/{name}\n *   Built-in `DatastoreAdmin` at `/datastore` covers all four; `DatastoreAudit` covers the read\n *   lane alone, which is what the `read` role should hold.\n *\n * ⛔ NO SECRET IS A PROP OR AN ATTRIBUTE, AND THIS FAMILY IS CLEAN BY CONSTRUCTION: a datastore\n *   section holds no password, token or key — encryption keys belong to the backup CLIENT. Every\n *   field below is a name, a path, a schedule, a count or a policy string, all of which are safe in\n *   a state store Alchemy writes UNENCRYPTED and this estate copies to a backup guest nightly.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type { PbsDatastoreAttributes, PbsTarget } from './pbs-datastore-form.ts';\nimport { handlers } from './pbs-datastore-lifecycle.ts';\nimport type { PveRequirements } from './resource.ts';\n\nexport type { PbsDatastoreAttributes, PbsTarget };\n\n/**\n * ⚠️ PBS'S OWN KEY NAMES, HYPHENS INCLUDED — backup-job.ts's rule: the form is then a copy rather\n *   than a translation table, and a translation table is one more place for a key to be renamed and\n *   silently never sent.\n * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED — storage.ts's rule, not sdn-vnet.ts's, and\n *   for a retention policy the choice is not close: see the ⛔ on `updateForm`.\n */\nexport interface PbsDatastoreProps {\n  target: PbsTarget;\n  /** PBS's primary key. Create-only: there is no rename, and a new name is a new datastore. */\n  name: string;\n  /**\n   * Absolute path to the datastore directory.\n   *\n   * ⛔ CREATE-ONLY, AND THE ONE FIELD THIS FILE REFUSES TO LET DRIFT QUIETLY. PBS's update endpoint\n   *   does not accept `path`, so comparing it in `matches` could only plan an update no PUT can\n   *   apply — the forever-diff storage.ts avoids by letting its create-only `type` plan as NOOP.\n   *   Here a silent noop is the wrong trade: the operator would read a green plan while PBS kept\n   *   writing backups to the old directory. So `diff` and `reconcile` compare it themselves and DIE\n   *   with both values named. A path change is remove-and-redeclare, deliberately.\n   */\n  path: string;\n  comment?: string;\n  /** Calendar event for garbage collection, e.g. `daily` or `sat 18:15`. */\n  'gc-schedule'?: string;\n  /** Calendar event for the built-in prune job. Retention itself is the `keep-*` fields below. */\n  'prune-schedule'?: string;\n  /** ⚠️ PBS's minimum is 1 for every keep-*. A declared `0` is refused, and does not mean \"off\". */\n  'keep-last'?: number;\n  'keep-hourly'?: number;\n  'keep-daily'?: number;\n  'keep-weekly'?: number;\n  'keep-monthly'?: number;\n  'keep-yearly'?: number;\n  /**\n   * Legacy notification routing: `gc=<never|always|error>`, and the same for `verify` and `sync`.\n   * ⚠️ PBS 3.2+ picks between this and the notification system with `notification-mode`, which is\n   *   NOT declarable here: flipping a live datastore between the two silently changes who hears\n   *   about a failed verify, and silence is the failure mode that costs most (notification-target.ts).\n   */\n  notify?: string;\n  /** PBS user id legacy notifications go to. PBS's schema default is `root@pam`. */\n  'notify-user'?: string;\n  /** Verify every new backup the moment it completes. PBS's default is false. */\n  'verify-new'?: boolean;\n  /** Property string: `chunk-order=<none|inode>,sync-level=<none|file|filesystem>`, and more. */\n  tuning?: string;\n  /**\n   * Takes the datastore out of service: `type=<offline|read-only|unmount>`, optional\n   * `message=<text>`. PBS's default key is `type`, so the bare `offline` normalises to the same\n   * string here and either spelling is safe.\n   * ⛔ NEVER DECLARE `type=delete`. PBS sets that itself while destroying a datastore's contents.\n   * ⚠️ A `message` CONTAINING A COMMA BREAKS THE COMPARISON, not the write: `propertyString` splits\n   *   on commas and does not honour PBS's quoting, so the two sides never compare equal and the\n   *   plan asks for the same update forever. Keep the message comma-free.\n   */\n  'maintenance-mode'?: string;\n  /**\n   * ⛔ CREATE-ONLY, LIKE `path`, AND FOR A SHARPER REASON. MEASURED on the live 4.2 host:\n   *   `datastore create --help` offers `--backend`, `datastore update --help` does NOT, and\n   *   `backend` is absent from update's `--delete` enum. PBS will not move a datastore between\n   *   local disk and object storage, ever.\n   * ★ IT IS A PROP AT ALL BECAUSE THE ESTATE HAS ONE. `offsite` holds\n   *   `type=s3,client=cloudflare-r2,bucket=example-pbs`. Leaving it undeclared would still plan\n   *   noop — undeclared is unmanaged here — but the declaration would then describe a LOCAL\n   *   datastore, and anyone recreating from it would get exactly that: an empty directory on the\n   *   host's disk where the offsite copy used to be, behind a green plan the whole way.\n   * ⚠️ A property string. Compared canonically, so key order is never a diff.\n   */\n  backend?: string;\n  /** ⚠️ S3 request counters reset on this calendar event. Mutable; in update's `--delete` enum. */\n  'counter-reset-schedule'?: string;\n  /**\n   * ⚠️ S3 request-count thresholds that raise a notification, e.g. `s3-put=700000,s3-get=200000`.\n   *   A property string, compared canonically. Mutable.\n   */\n  'notification-thresholds'?: string;\n}\n\nexport interface PbsDatastore extends Resource<\n  'Pbs.Datastore',\n  PbsDatastoreProps,\n  PbsDatastoreAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a datastore holds the backups. See the ★ in resource.ts. */\nexport const PbsDatastore = Resource<PbsDatastore>('Pbs.Datastore', {\n  defaultRemovalPolicy: 'retain',\n});\n\nexport const PbsDatastoreProvider = () =>\n  Provider.effect(PbsDatastore, Effect.succeed(PbsDatastore.Provider.of(handlers)));\n",
+    "/** PBS 4.2.6-1 datastore lifecycle. Reads and writes use the distilled SDK. */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport type { PbsDatastoreProps } from './pbs-datastore.ts';\nimport { type PbsDatastoreAttributes, matches, object, updateForm } from './pbs-datastore-form.ts';\nimport { createOne, deleteOne, readOne, updateOne } from './pbs-datastore-wire.ts';\nimport { guardBackend, guardPath, settle } from './pbs-datastore-guard.ts';\nimport { guardDatastoreForms } from './pbs-datastore-endpoint.ts';\nimport { formToSend } from './update-guard.ts';\n\nexport const handlers = {\n  /**\n   * ⛔ EMPTY, AND HERE IT GUARDS THE ESTATE'S BACKUPS. `GET /config/datastore` returns every\n   *   datastore on the host, the one PVE's `type: pbs` storage writes into included. See\n   *   `pveHandlers` in resource.ts for why adoption stays an explicit act.\n   */\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: PbsDatastoreProps }) => readOne(olds),\n  /**\n   * ⚠️ `isResolved` IS THE NARROWING, resource.ts's reason: at plan time a prop can still be an\n   *   unresolved Output, and comparing a placeholder to a live value reports a phantom update.\n   * ⛔ `guardPath` IS A DELIBERATE DEPARTURE FROM storage.ts, which lets its create-only field\n   *   plan as noop. Dying fails `alchemy plan` with both paths named — see the ⛔ on the prop.\n   */\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<PbsDatastoreProps>;\n    output: PbsDatastoreAttributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      if (!isResolved(news)) return undefined;\n      // ⛔ BEFORE the `output === undefined` return: that branch IS the create, which is the\n      //   one this family has never checked. resource.ts carries the argument in full.\n      yield* guardDatastoreForms(news);\n      if (output === undefined) return undefined;\n      const live = yield* readOne(news);\n      // ⚠️ `update`, not `create` — Alchemy's Diff admits only noop/update/replace, and an\n      //   object Alchemy has state for but PBS does not is drift for reconcile to repair.\n      if (live === undefined) return { action: 'update' } as const;\n      yield* guardPath(live, news);\n      yield* guardBackend(live, news);\n      return matches(live, news) ? ({ action: 'noop' } as const) : ({ action: 'update' } as const);\n    }),\n  /**\n   * ⚠️ NOT THE FACTORY'S reconcile: it reads back ONCE, immediately — see the ⛔ on `settle`.\n   * ⛔ `guardPath` RUNS HERE TOO, AND THAT IS NOT BELT-AND-BRACES — see the ⛔ on it.\n   * ⛔ THE `matches` GUARD BEFORE THE PUT IS resource.ts's, AND IT IS WHY ADOPTION IS FREE.\n   */\n  reconcile: Effect.fn(function* ({ news }: { news: PbsDatastoreProps }) {\n    // ⚠️ Again here: an ADOPTED row's diff answer is discarded by Alchemy and reconcile runs.\n    yield* guardDatastoreForms(news);\n    const live = yield* readOne(news);\n    if (live === undefined) {\n      yield* createOne(news);\n    } else {\n      yield* guardPath(live, news);\n      yield* guardBackend(live, news);\n      // ⚠️ An empty form is not a write, and a match is not one either — update-guard.ts.\n      const form = formToSend(matches, live, news, updateForm(news));\n      if (form !== undefined) {\n        yield* updateOne(news);\n      }\n    }\n    const after = yield* settle(readOne(news), (row) => row !== undefined && matches(row, news));\n    if (after === undefined || !matches(after, news)) {\n      /**\n       * ⛔ REFUSE RATHER THAN RETURN THE PROPS AS THOUGH THEY LANDED — resource.ts's rule.\n       *   The pinned PBS 4.2.6-1 schema gives create a null return, so readback is its evidence.\n       */\n      return yield* Effect.die(\n        new Error(\n          `${object(news)}: the write returned no error but the datastore still does not ` +\n            'match the declaration after 120s. Check the PBS task list ' +\n            '-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a ' +\n            'plausible cause (see `settle`); a create over an existing chunk store is not, ' +\n            'because PBS refuses that outright rather than timing out.',\n        ),\n      );\n    }\n    return after;\n  }),\n  /**\n   * ⛔ FULLY IMPLEMENTED, NEVER A STUB, and it only ever runs on an explicit\n   *   `.pipe(RemovalPolicy.destroy())` because this family defaults to `retain`.\n   * ⛔ NO `destroy-data`. PBS's DELETE drops the section from `datastore.cfg` and leaves every\n   *   chunk and snapshot on disk; `destroy-data=1` erases the contents. It is not a prop and\n   *   not a flag here, so this provider can un-declare a datastore and can never erase one.\n   *   ⚠️ IT IS STILL A ONE-WAY DOOR FOR A DECLARATION: re-adding a datastore over an existing\n   *     chunk store needs `reuse-datastore`, which is deliberately not declarable — see the\n   *     ⚠️ on `createForm`. Re-adopt with `proxmox-backup-manager datastore create …`.\n   * ⚠️ NO `keep-job-configs` EITHER, SO THE JOBS GO TOO: PBS defaults it false and removes the\n   *   verify, sync and prune jobs referencing this datastore — objects nothing here declares.\n   *   PBS's default stands, so the blast radius is what a human clicking Remove would get.\n   * ⚠️ AND THE REFUSAL CAN ARRIVE AFTER THE RESPONSE: the delete forks a worker too, so a store\n   *   held open by a running backup can fail once the call has already returned 200.\n   */\n  delete: Effect.fn(function* ({ olds }: { olds: PbsDatastoreProps }) {\n    yield* deleteOne(olds);\n    const left = yield* settle(readOne(olds), (row) => row === undefined);\n    if (left !== undefined) {\n      return yield* Effect.die(\n        new Error(\n          `${object(olds)}: the DELETE returned no error but the datastore is still in ` +\n            'datastore.cfg after 120s. Either a backup, verify or GC task still holds it, ' +\n            'or the provision role lacks Datastore.Allocate on /datastore/' +\n            `${olds.name}. Read the task log with \\`proxmox-backup-manager task log <upid>\\`.`,\n        ),\n      );\n    }\n  }),\n};\n",
+    "/**\n * A PBS datastore's pure vendor forms and coercion back to comparable state. SDK transport is\n * in pbs-datastore-wire.ts; lifecycle behavior is in pbs-datastore-lifecycle.ts.\n *\n * ★ SPLIT OUT OF pbs-datastore.ts FOR THE 250-LINE CAP, the seam notification-target-form.ts uses:\n *   this file originally held PBS encoding beside forms, while the resource held its declaration\n *   and five handlers. The `import type` back is erased, so it is a cycle on paper only.\n *\n * ⛔ HISTORICAL EXTRACTION NOTE: THIS FILE EXCEEDED THE 250-LINE CAP IN THE ORIGINAL DRAFT. `PbsTarget`,\n *   `PbsRole`, `PbsError`, `pbsAuthorization`, `PveForm`, `encode`, `pbs` and `settle` — about 150\n *   lines — are a PBS CLIENT, not a datastore form, and belong in `pbs-client.ts`. Lifting them\n *   leaves this file near 200 and costs nothing but a move. It was not done here only because the\n *   family was commissioned as a two-file split; ceph-pool is the in-package precedent for three\n *   (ceph-pool.ts + ceph-pool-form.ts + ceph-pool-settle.ts, 532 lines for one family). Everything\n *   in that list is also what Pbs.SyncJob, Pbs.PruneJob and Pbs.Remote will each need unchanged,\n *   so the second PBS family forced that move. The SDK and focused siblings now own these seams.\n *   ⛔ DO NOT MEET THE CAP BY CUTTING COMMENTS.\n */\nimport type { PbsTarget as ApiPbsTarget } from './credentials.ts';\nimport type { PbsDatastoreProps } from './pbs-datastore.ts';\nimport { bool, flag, int, propertyString, text } from './values.ts';\n\n/**\n * ★ PBS ORIGINALLY REUSED THE PVE CLIENT RATHER THAN OWNING ANOTHER. An earlier draft carried\n *   its own `PbsTarget`, `PbsError`, `pbsAuthorization`, form encoder and `pve()` — a near-copy of\n *   client.ts differing in one header. The shared target's `scheme` replaced that copy. This\n *   family now uses the distilled PBS SDK through `distilled-pbs.ts`, retaining the same leased\n *   credentials and PBS authorization scheme. The important encoding distinction survives:\n *   PBS decodes a multi-valued field from repeated keys where PVE wants a comma string. The SDK\n *   protocol owns that behavior; these pure forms describe only this datastore's scalar fields.\n *\n * 🔴 THIS ALIAS SAID `= PveTarget` AND IT WAS WRONG — Pbs.Datastore REQUIRED A PVE TARGET. When\n *   `credentials.ts` grew a real `PbsTarget` with `scheme: 'pbs'`, this line was left pointing at\n *   the PVE type, which pins `scheme: 'pve'`. So the one family that most needs the discriminant\n *   was the one family that refused the correct value: declaring a datastore against the PBS host\n *   failed to compile with `Type '\"pbs\"' is not assignable to type 'Input<\"pve\">'`, and passing a\n *   PVE target compiled fine and would have 401'd every call — which the old `read` folded into\n *   \"absent\", so the plan would say CREATE for a datastore holding the estate's backups.\n *   ⛔ IT SURVIVED BECAUSE NOTHING EVER DECLARED ONE. The provider was registered in\n *   alchemy.run.ts from the day it was written and `pveHandlers`' `list` answers empty, so\n *   registration exercises no call site at all. Three sibling families import `PbsTarget` from\n *   credentials.ts directly and were always correct; only the one with its own alias drifted.\n *   ★ THE LESSON, WHICH IS NOT ABOUT THIS TYPE: a provider nobody has declared an instance of is\n *   not tested by anything, including tsc.\n */\nexport type PbsTarget = ApiPbsTarget;\n\nexport interface PbsDatastoreAttributes {\n  name: string;\n  /**\n   * ⚠️ READ FROM PBS, NEVER ECHOED FROM PROPS. Echoing the declared path would make a divergent or\n   *   unreadable datastore look like agreement, and this is the field whose divergence means the\n   *   backups are going somewhere nobody declared. `''` when PBS did not say.\n   */\n  path: string;\n  comment: string;\n  'gc-schedule': string;\n  'prune-schedule': string;\n  'keep-last': number;\n  'keep-hourly': number;\n  'keep-daily': number;\n  'keep-weekly': number;\n  'keep-monthly': number;\n  'keep-yearly': number;\n  /** Normalised property strings — sorted and canonicalised, so key order is never a diff. */\n  notify: string;\n  'notify-user': string;\n  'verify-new': boolean;\n  tuning: string;\n  'maintenance-mode': string;\n  /** ⚠️ Create-only. Canonicalised property string; `''` on a plain local datastore. */\n  backend: string;\n  'counter-reset-schedule': string;\n  'notification-thresholds': string;\n}\n\n/**\n * ⚠️ `digest` IS DELIBERATELY NOT AN ATTRIBUTE, for storage.ts's reason exactly: PBS returns one on\n *   every read and it covers `datastore.cfg` as a FILE, not this section of it, so keeping it would\n *   rewrite this resource's state whenever an unrelated datastore was edited — churn that reads\n *   like drift. It is not sent on writes either, so this family never joins PBS's optimistic-locking\n *   dance and last write wins, as everywhere else in this package.\n */\nexport const attributes = (\n  live: Record<string, unknown>,\n  props: PbsDatastoreProps,\n): PbsDatastoreAttributes => ({\n  backend: propertyString(live['backend']),\n  comment: text(live['comment']),\n  'counter-reset-schedule': text(live['counter-reset-schedule']).trim(),\n  'gc-schedule': text(live['gc-schedule']).trim(),\n  'keep-daily': int(live['keep-daily'], 0),\n  'keep-hourly': int(live['keep-hourly'], 0),\n  'keep-last': int(live['keep-last'], 0),\n  'keep-monthly': int(live['keep-monthly'], 0),\n  'keep-weekly': int(live['keep-weekly'], 0),\n  'keep-yearly': int(live['keep-yearly'], 0),\n  'maintenance-mode': propertyString(live['maintenance-mode'], 'type'),\n  name: props.name,\n  'notification-thresholds': propertyString(live['notification-thresholds']),\n  notify: propertyString(live['notify']),\n  'notify-user': text(live['notify-user']),\n  path: text(live['path']),\n  'prune-schedule': text(live['prune-schedule']).trim(),\n  tuning: propertyString(live['tuning']),\n  'verify-new': bool(live['verify-new']),\n});\n\nconst same = <T>(declared: T | undefined, live: T) => declared === undefined || declared === live;\n\n/**\n * ⛔ DECLARING WHAT IS LIVE MUST PLAN noop, AND EVERY OMISSION IS DELIBERATE. Out: `name` (the\n *   address the read was made at — true by construction, never a diff); `path` (create-only, so\n *   comparing it could only plan an update no PUT can apply — pbs-datastore.ts guards it by dying\n *   instead, see the ⛔ on the prop); `digest` (not an attribute, above); and every field the\n *   declaration does not mention, because undeclared is UNMANAGED here.\n * ⚠️ A SCHEDULE THAT NEVER SETTLES MEANS PBS NORMALISED IT. Calendar events are compared as trimmed\n *   strings; if a version rewrites `sat 18:15` as `Sat 18:15` the plan asks for the same update\n *   forever. The fix is to declare the spelling PBS stores, never to stop comparing it.\n */\nexport const matches = (live: PbsDatastoreAttributes, props: PbsDatastoreProps) =>\n  same(props.comment, live.comment) &&\n  same(props['gc-schedule']?.trim(), live['gc-schedule']) &&\n  same(props['prune-schedule']?.trim(), live['prune-schedule']) &&\n  same(props['keep-last'], live['keep-last']) &&\n  same(props['keep-hourly'], live['keep-hourly']) &&\n  same(props['keep-daily'], live['keep-daily']) &&\n  same(props['keep-weekly'], live['keep-weekly']) &&\n  same(props['keep-monthly'], live['keep-monthly']) &&\n  same(props['keep-yearly'], live['keep-yearly']) &&\n  same(props['notify-user'], live['notify-user']) &&\n  same(props['counter-reset-schedule']?.trim(), live['counter-reset-schedule']) &&\n  (props['notification-thresholds'] === undefined ||\n    propertyString(props['notification-thresholds']) === live['notification-thresholds']) &&\n  same(props['verify-new'], live['verify-new']) &&\n  (props.notify === undefined || propertyString(props.notify) === live.notify) &&\n  (props.tuning === undefined || propertyString(props.tuning) === live.tuning) &&\n  (props['maintenance-mode'] === undefined ||\n    propertyString(props['maintenance-mode'], 'type') === live['maintenance-mode']);\n\nconst set = (key: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [key]: value };\n\n/** ⚠️ PBS's minimum for every keep-* is 1, so a declared `0` is refused rather than meaning \"off\". */\nconst count = (value: number | undefined) => (value === undefined ? undefined : String(value));\n\n/**\n * The mutable half, shared by create and update.\n *\n * ⚠️ AN UNDECLARED FIELD IS NOT SENT — storage.ts's rule. PBS leaves a parameter it was not given\n *   alone, so this form is safe to re-apply to a datastore that already matches, which is what the\n *   adoption path does.\n * ⛔ `name` AND `path` ARE ABSENT ON PURPOSE. Both are create-only: `name` is the address forever\n *   after, and PBS's update endpoint does not accept `path` at all, so including it here would turn\n *   every single update into a 400.\n */\nconst mutable = (props: PbsDatastoreProps): Record<string, string> => ({\n  ...set('comment', props.comment),\n  ...set('gc-schedule', props['gc-schedule']?.trim()),\n  ...set('keep-daily', count(props['keep-daily'])),\n  ...set('keep-hourly', count(props['keep-hourly'])),\n  ...set('keep-last', count(props['keep-last'])),\n  ...set('keep-monthly', count(props['keep-monthly'])),\n  ...set('keep-weekly', count(props['keep-weekly'])),\n  ...set('keep-yearly', count(props['keep-yearly'])),\n  ...set('counter-reset-schedule', props['counter-reset-schedule']),\n  ...set('maintenance-mode', props['maintenance-mode']),\n  ...set('notification-thresholds', props['notification-thresholds']),\n  ...set('notify', props.notify),\n  ...set('notify-user', props['notify-user']),\n  ...set('prune-schedule', props['prune-schedule']?.trim()),\n  ...set('tuning', props.tuning),\n  ...set('verify-new', flag(props['verify-new'])),\n});\n\n/**\n * ⚠️ `path` IS SENT ONCE, HERE, AND NEVER AGAIN — the fact the whole `path` guard hangs off.\n * ⚠️ `reuse-datastore` IS NOT SENT, AND THE REFUSAL IT CAUSES IS A FEATURE: without it PBS refuses\n *   a create against a directory that already holds a chunk store, which is the difference between\n *   building a new store and silently adopting somebody else's backups. Adopt out of band.\n * ⚠️ NEITHER IS `backing-device`. A removable datastore's UUID is a property of the hardware in the\n *   slot, not of the declaration; one that could re-point it is one that can send backups to the\n *   wrong drive.\n */\nexport const createForm = (props: PbsDatastoreProps): Record<string, string> => ({\n  ...mutable(props),\n  name: props.name,\n  path: props.path,\n  // ⛔ CREATE ONLY, AND ABSENT FROM `mutable` ON PURPOSE. PBS has no `--backend` on update and no\n  //   `backend` in update's `--delete` enum (measured on 4.2), so sending it on a PUT is a\n  //   parameter error at best. Divergence is caught by guardBackend, which DIES — the same shape\n  //   as `path`, for a bigger consequence.\n  ...(props.backend === undefined ? {} : { backend: props.backend }),\n});\n\n/**\n * ⛔ THERE IS NO `delete` LIST HERE, AND THAT IS A CHOICE ABOUT BACKUPS RATHER THAN AN OMISSION.\n *   sdn-vnet.ts derives one from absent props, which is right for an alias and wrong for a\n *   retention policy: a declaration that simply fails to mention `keep-daily` would strip it, and a\n *   prune job whose keeps have all been stripped is one PBS version away from a prune job that\n *   keeps nothing. So undeclared is UNMANAGED, as in storage.ts and backup-job.ts.\n *   ⚠️ THE PRICE IS THAT DROPPING A LINE DOES NOT CLEAR A FIELD. Clear one out of band:\n *     `proxmox-backup-manager datastore update <name> --delete keep-daily`. It does not cost a\n *     forever-diff, because an undeclared field is not compared either.\n *   ⛔ WHEN SOMEBODY ADDS ONE, IT TAKES TWO STEPS AND SKIPPING EITHER IS A SILENT BUG. First build\n *     it with `values.withClears`, which drops a cleared key from the body — CLEAR WINS — because\n *     PBS applies its deletes BEFORE its sets, so a key both set and deleted keeps its value: the\n *     declaration would say \"unset this\", the PUT would succeed, and the next plan would ask for\n *     the very same update forever. (PVE instead DIES on that pair; the two behaviours want the\n *     same guard.) Second, split the comma-joined value `withClears` produces into a real array —\n *     PBS's `delete` is `type: array` and wants REPEATED KEYS, and a comma string arrives as one\n *     element that fails the enum check. `PveForm` and `encode` already carry arrays for exactly\n *     this. ⚠️ REASONED FROM THE PUBLISHED SCHEMA, NOT PROVEN ON A WIRE.\n */\nexport const updateForm = (props: PbsDatastoreProps): Record<string, string> => mutable(props);\n\nexport const object = (props: PbsDatastoreProps) => `config/datastore/${props.name}`;\n",
+    "/** PBS 4.2.6-1 datastore SDK operations; no raw route-string transport. */\nimport * as config from '@distilled.cloud/proxmox-backup/config';\nimport * as Effect from 'effect/Effect';\nimport { runPbs } from './distilled-pbs.ts';\nimport { attributes, createForm, updateForm } from './pbs-datastore-form.ts';\nimport type { PbsDatastoreProps } from './pbs-datastore.ts';\n\n/** Keep the existing form's unmanaged-field decisions while using typed SDK member names. */\nconst members = (form: Record<string, string>) => ({\n  ...(form['comment'] === undefined ? {} : { comment: form['comment'] }),\n  ...(form['counter-reset-schedule'] === undefined\n    ? {}\n    : { counter_reset_schedule: form['counter-reset-schedule'] }),\n  ...(form['gc-schedule'] === undefined ? {} : { gc_schedule: form['gc-schedule'] }),\n  ...(form['keep-daily'] === undefined ? {} : { keep_daily: form['keep-daily'] }),\n  ...(form['keep-hourly'] === undefined ? {} : { keep_hourly: form['keep-hourly'] }),\n  ...(form['keep-last'] === undefined ? {} : { keep_last: form['keep-last'] }),\n  ...(form['keep-monthly'] === undefined ? {} : { keep_monthly: form['keep-monthly'] }),\n  ...(form['keep-weekly'] === undefined ? {} : { keep_weekly: form['keep-weekly'] }),\n  ...(form['keep-yearly'] === undefined ? {} : { keep_yearly: form['keep-yearly'] }),\n  ...(form['maintenance-mode'] === undefined ? {} : { maintenance_mode: form['maintenance-mode'] }),\n  ...(form['notification-thresholds'] === undefined\n    ? {}\n    : { notification_thresholds: form['notification-thresholds'] }),\n  ...(form['notify'] === undefined ? {} : { notify: form['notify'] }),\n  ...(form['notify-user'] === undefined ? {} : { notify_user: form['notify-user'] }),\n  ...(form['prune-schedule'] === undefined ? {} : { prune_schedule: form['prune-schedule'] }),\n  ...(form['tuning'] === undefined ? {} : { tuning: form['tuning'] }),\n  ...(form['verify-new'] === undefined ? {} : { verify_new: form['verify-new'] }),\n});\n\nconst createRequest = (props: PbsDatastoreProps): config.CreateConfigDatastoreRequest => ({\n  ...members(createForm(props)),\n  name: props.name,\n  path: props.path,\n  ...(props.backend === undefined ? {} : { backend: props.backend }),\n});\n\nconst updateRequest = (props: PbsDatastoreProps): config.PutConfigDatastoreRequest => ({\n  ...members(updateForm(props)),\n  name: props.name,\n});\n\nconst wire = (row: config.GetConfigDatastoreResponse): Record<string, unknown> => ({\n  ...row,\n  'counter-reset-schedule': row.counter_reset_schedule,\n  'gc-schedule': row.gc_schedule,\n  'keep-daily': row.keep_daily,\n  'keep-hourly': row.keep_hourly,\n  'keep-last': row.keep_last,\n  'keep-monthly': row.keep_monthly,\n  'keep-weekly': row.keep_weekly,\n  'keep-yearly': row.keep_yearly,\n  'maintenance-mode': row.maintenance_mode,\n  'notification-thresholds': row.notification_thresholds,\n  'notify-user': row.notify_user,\n  'prune-schedule': row.prune_schedule,\n  'verify-new': row.verify_new,\n});\n\n/**\n * ⛔ THE RAW READ FOLDED EVERY ERROR TO ABSENCE. Its `name` presence check could not distinguish\n *   a missing section from a denied read: both suggested CREATE for a datastore holding backups.\n *   The resulting \"already exists\" failure was loud, but the same fold on DELETE was worse:\n *   the first denied read confirmed removal while the datastore still stood.\n * ★ MEASURED 2026-09-24 against PBS 4.2.6-1: a missing section is plain-text HTTP400,\n *   `no such datastore '<name>'`. The distilled patch types that GET response as\n *   DatastoreNotFound. Only that tag means absent; no permission, transport or malformed-response\n *   error can settle deletion. This replaces the old recommendation to disambiguate by listing.\n * ⚠️ The read role still requires Datastore.Audit, and a missing grant now fails visibly.\n */\nexport const readOne = (props: PbsDatastoreProps) =>\n  runPbs(props.target, 'read', config.getConfigDatastore({ name: props.name })).pipe(\n    Effect.map((live) => attributes(wire(live), props)),\n    Effect.catchTag('DatastoreNotFound', () => Effect.succeed(undefined)),\n  );\n\nexport const createOne = (props: PbsDatastoreProps) =>\n  runPbs(props.target, 'provision', config.createConfigDatastore(createRequest(props)));\n\nexport const updateOne = (props: PbsDatastoreProps) =>\n  runPbs(props.target, 'provision', config.putConfigDatastore(updateRequest(props)));\n\n/** ⛔ No destroy-data or keep-job-configs flag: retain the original removal contract. */\nexport const deleteOne = (props: PbsDatastoreProps) =>\n  Effect.gen(function* () {\n    // ⛔ Missing-item tags are measured for GET only. Do not guess the DELETE error shape.\n    if ((yield* readOne(props)) === undefined) return;\n    return yield* runPbs(\n      props.target,\n      'provision',\n      config.deleteConfigDatastore({ name: props.name }),\n    );\n  });\n",
+    "/**\n * PBS 4.2.6-1 operations through the distilled SDK, with the existing OpenBao leases.\n *\n * ⛔ PBS IS A SINGLE HOST, NOT A PVE CLUSTER. Its Credentials layer supplies the\n *   `PBSAPIToken=id:secret` scheme; running a PBS operation through runPve would send PVE's\n *   different header. Nothing here invents another host or retries a possibly completed write.\n * ★ Retry.none also disables distilled's default transient-error retries within that host.\n *   MEMBER_TIMEOUT bounds the one attempt, just as it bounds each PVE member attempt.\n */\nimport { credentials } from '@distilled.cloud/proxmox-backup/Credentials';\nimport type { ProxmoxBackupOpContext } from '@distilled.cloud/proxmox-backup/Protocol';\nimport * as Retry from '@distilled.cloud/proxmox-backup/Retry';\nimport type * as Cause from 'effect/Cause';\nimport type * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport type * as HttpClient from 'effect/unstable/http/HttpClient';\nimport type { PveCredentialDenied } from './credential-errors.ts';\nimport type { PbsTarget, PveCredential, PveRole } from './credentials.ts';\nimport { leased } from './lease-cache.ts';\nimport { MEMBER_TIMEOUT } from './members.ts';\n\n/** An already-held lease, also used by offline protocol tests. Production uses the default bound. */\nexport const runPbsWith = <A, E>(\n  target: PbsTarget,\n  credential: PveCredential,\n  op: Effect.Effect<A, E, ProxmoxBackupOpContext>,\n  timeout: Duration.Input = MEMBER_TIMEOUT,\n): Effect.Effect<A, E | Cause.TimeoutError, HttpClient.HttpClient> =>\n  op.pipe(\n    Retry.none,\n    Effect.provide(\n      credentials({\n        baseUrl: target.api,\n        secret: credential.secret,\n        tokenId: credential.tokenId,\n      }),\n    ),\n    Effect.timeout(timeout),\n  );\n\n/** Preserve lease sharing and expose credential refusal and SDK error tags unchanged. */\nexport const runPbs = <A, E>(\n  target: PbsTarget,\n  role: PveRole,\n  op: Effect.Effect<A, E, ProxmoxBackupOpContext>,\n): Effect.Effect<A, E | Cause.TimeoutError | PveCredentialDenied | Error, HttpClient.HttpClient> =>\n  Effect.gen(function* () {\n    const credential = yield* leased(target, role);\n    return yield* runPbsWith(target, credential, op);\n  });\n",
+    "/**\n * The two things a datastore write needs that are not form-building: refusing a moved `path`, and\n * waiting for PBS to finish.\n *\n * ★ SPLIT OUT OF pbs-datastore-form.ts FOR THE 250-LINE CAP, and the seam is real. That file turns\n *   a declaration into a form; this one is the SAFETY GUARD and the POLLING. A reader asking \"can\n *   this destroy my backups\" has one short file to read rather than a long one to search.\n */\nimport * as Effect from 'effect/Effect';\nimport { type PbsDatastoreAttributes, object } from './pbs-datastore-form.ts';\nimport type { PbsDatastoreProps } from './pbs-datastore.ts';\nimport { propertyString } from './values.ts';\n\n/**\n * ⛔ A TRAILING SLASH MUST NOT DEADLOCK EVERY PLAN, WHICH IS WHY THIS IS NOT `===`. `guardPath`\n *   DIES, so a false positive is not a spurious update — it is an `alchemy plan` that cannot run at\n *   all until somebody edits the declaration, on a family whose whole point is that the operator\n *   can see the state of their backups. `/mnt/backups/` and `/mnt/backups` are one directory, and\n *   whether PBS canonicalises the path it was handed is a property of the version you are talking\n *   to. Both sides are trimmed here so that guess cannot cost an outage of the plan itself.\n * ⚠️ THAT IS THE ONLY NORMALISATION APPLIED. A symlink, a bind mount or `/mnt/./backups` still\n *   reads as divergent, and deliberately so: this guard's job is to refuse to GUESS that two\n *   spellings are the same directory, and only the trailing slash is certain.\n */\nconst samePath = (left: string, right: string) => {\n  const trim = (value: string) => (value.length > 1 ? value.replace(/\\/+$/, '') : value);\n  return trim(left) === trim(right);\n};\n\n/**\n * ⛔ THE `path` GUARD, YIELDED FROM BOTH `diff` AND `reconcile`. Both need it: `diff` catches a\n *   changed declaration, and `reconcile` catches an ADOPTION, which Alchemy routes straight past\n *   `diff` (Apply.ts:980, :1045). `''` is skipped — an unreadable path is not a divergent one.\n */\nexport const guardPath = (live: PbsDatastoreAttributes, props: PbsDatastoreProps) =>\n  live.path === '' || samePath(live.path, props.path)\n    ? Effect.void\n    : Effect.die(\n        new Error(\n          `${object(props)}: declared path ${props.path} but PBS holds ${live.path}. \\`path\\` ` +\n            'is create-only, so this cannot be reconciled and will NOT be planned as a silent ' +\n            'noop: backups would keep landing in the old directory behind a green plan. Correct ' +\n            'the declaration, or remove the datastore and declare a new one -- the contents live, ' +\n            'because `destroy-data` is never sent.',\n        ),\n      );\n\n/**\n * ⛔ THE `backend` GUARD, AND IT MATTERS MORE THAN `path`. A wrong `path` sends backups to the\n *   wrong directory on the same machine; a wrong `backend` is the difference between a datastore\n *   on local disk and one in a Cloudflare R2 bucket. MEASURED on 4.2: `datastore create` takes\n *   `--backend`, `datastore update` does not, and `backend` is not in update's `--delete` enum —\n *   so divergence CANNOT be reconciled, and the only honest options are to refuse or to lie.\n *\n * ⚠️ AN UNDECLARED `backend` IS NOT A DIVERGENCE. Undeclared is unmanaged everywhere in this\n *   family, and this guard keeps that rule: it fires only when the declaration says something and\n *   PBS says something else. Adopting `offsite` without mentioning `backend` still plans noop.\n *\n * ⚠️ COMPARED AS A CANONICAL PROPERTY STRING, so `bucket=x,type=s3` and `type=s3,bucket=x` are the\n *   same backend and key order cannot deadlock a plan — the reason `samePath` trims a slash.\n */\nexport const guardBackend = (live: PbsDatastoreAttributes, props: PbsDatastoreProps) =>\n  props.backend === undefined || propertyString(props.backend) === live.backend\n    ? Effect.void\n    : Effect.die(\n        new Error(\n          `${object(props)}: declared backend ${props.backend} but PBS holds ` +\n            `${live.backend === '' ? '(none — a local datastore)' : live.backend}. \\`backend\\` ` +\n            'is create-only: PBS has no update for it, so this cannot be reconciled and will NOT ' +\n            'be planned as a silent noop. Correct the declaration to match what is really there, ' +\n            'or remove the datastore and declare a new one -- the contents live, because ' +\n            '`destroy-data` is never sent.',\n        ),\n      );\n\n/**\n * Wait for PBS to finish, then answer the last thing it said.\n *\n * ⛔ THE ORIGINAL CREATE-WORKER ASSUMPTION BELOW WAS REASONED, NOT MEASURED.\n *   `POST /config/datastore` answers with a UPID while a `create-datastore` task builds the chunk\n *   store's 65536 directories; only when that finishes does the section reach `datastore.cfg`. An\n *   immediate read-back therefore sees a datastore that is not there yet, and the factory's \"the\n *   write returned no error but the object is still absent\" would fire on a create going perfectly.\n *   The DELETE forks a worker too. ⚠️ DOCUMENTED FROM THE PUBLISHED SCHEMA, NOT MEASURED — I hold\n *   no PBS token. The pinned PBS 4.2.6-1 schema actually declares a NULL create response,\n *   while DELETE declares a UPID. We preserve bounded readback for both; a synchronous create\n *   succeeds at the first poll rather than depending on the old UPID assumption.\n * ★ IT TAKES THE READ AS AN EFFECT RATHER THAN A FUNCTION — the one simplification over\n *   ceph-pool-settle.ts: an Effect is a description, so re-running it re-reads and no dependency\n *   has to be threaded back in to avoid a cycle.\n * ⚠️ 2s APART, 60 TRIES, ABOUT TWO MINUTES — longer than ceph-pool's minute, and REASONED rather\n *   than measured: 65536 `mkdir`s is seconds on NVMe and can be a minute on a slow or USB disk.\n *   Anything still unsettled after two minutes is a fault to surface, not a wait to lengthen, and\n *   the caller's message points at the task log, which is where the real answer is. `Effect.sleep`\n *   yields between polls; nothing here parks a call on one long wait.\n * ⚠️ THE ORIGINAL TRANSPORT MINTED A TOKEN PER CALL, making task-owner polling unreliable.\n *   The SDK runner now reuses leases, but create has no task id in its measured response schema.\n *   This migration therefore preserves bounded readback rather than inventing a task handle.\n */\nexport const settle = <A, E, R>(read: Effect.Effect<A, E, R>, done: (live: A) => boolean) =>\n  Effect.gen(function* () {\n    for (let attempt = 0; attempt < 60; attempt += 1) {\n      const live = yield* read;\n      if (done(live)) return live;\n      yield* Effect.sleep('2 seconds');\n    }\n    return yield* read;\n  });\n",
+    "/**\n * `Pbs.Datastore`'s two vendor endpoints, and the plan-time check over its two forms.\n *\n * ★ A FILE OF ITS OWN BECAUSE THIS FAMILY DOES NOT USE `pveHandlers`. It writes its own `diff` and\n *   `reconcile` (bounded readback handles settling after a write; create returns no task id), so\n *   it cannot inherit the guard from resource.ts — and a copy of the two calls inside that already\n *   long file is exactly the per-resource copy-paste the shared handler exists to prevent.\n *\n * ⛔ THE FOUR FIELDS THAT MADE THIS WORTH DOING, from the PBS 4.2.6 schema: `comment` is\n *   maxLength 128 with a no-control-characters pattern, `name` is 3..32 with a safe-id pattern,\n *   and every `keep-*` has minimum 1. All four were `string`/`number` with the limits in prose.\n */\nimport * as Effect from 'effect/Effect';\nimport { guardForm } from './constraint-guard.ts';\nimport type { EndpointKey } from './constraints.ts';\nimport { createForm, updateForm } from './pbs-datastore-form.ts';\nimport type { PbsDatastoreProps } from './pbs-datastore.ts';\n\nexport const DATASTORE_ENDPOINT: { readonly create: EndpointKey; readonly update: EndpointKey } = {\n  create: 'pbs:POST /config/datastore',\n  update: 'pbs:PUT /config/datastore/{name}',\n};\n\n/** ⚠️ Presence on create only — an update form is partial by design (update-guard.ts). */\nexport const guardDatastoreForms = (props: PbsDatastoreProps): Effect.Effect<void> =>\n  Effect.gen(function* () {\n    yield* guardForm(DATASTORE_ENDPOINT.create, createForm(props), true);\n    yield* guardForm(DATASTORE_ENDPOINT.update, updateForm(props), false);\n  });\n",
+    "/**\n * `Pbs.NotificationMatcher` — which Proxmox Backup Server notifications reach which targets.\n *\n * ★ THIS IS WHERE A FAILED VERIFY, SYNC OR GARBAGE COLLECTION BECOMES A PAGE. pbs-verify-job.ts\n *   explains why verification is the only thing that notices rotten chunks; a matcher is what\n *   turns what it notices into a message. Route `match-severity: ['error']` to a webhook target\n *   (pbs-notification-target.ts, docs/pbs-notifications.md) and a failure pages someone.\n *\n * ⛔ A DATASTORE IN `legacy-sendmail` MODE BYPASSES EVERY MATCHER. PBS reads the datastore's\n *   `notification-mode` before it builds anything (src/server/notifications/mod.rs\n *   `lookup_datastore_notify_settings`, read at HEAD 2026-09-22): `legacy-sendmail` mails the\n *   `notify-user` directly and never consults a matcher. The default is `notification-system`\n *   today (pbs-api-types `NotificationMode`), but a datastore created before PBS 3.2 may say\n *   `legacy-sendmail` explicitly. `Pbs.Datastore` deliberately does not declare the mode (see\n *   `notify` in pbs-datastore.ts), so check it by hand before trusting a matcher with a datastore:\n *   `proxmox-backup-manager datastore show <name>`.\n *\n * ⚠️ THE EVENT `type` FOR A VERIFICATION JOB IS `verify`, NOT `verification`. PBS's own\n *   notifications chapter lists `verification` in its event table and `verify` in its example,\n *   and the source settles it: `send_verify_status` sets `(\"type\", \"verify\")` (same file). A\n *   `match-field: ['exact:type=verification']` rule matches nothing, silently.\n *   Types at HEAD: `gc`, `prune`, `sync`, `verify`, `tape-backup`, `tape-load`,\n *   `package-updates`, `acme`, `thresholds`, `system-mail`. GC carries `datastore` and `hostname`\n *   but NO `job-id`; prune, sync and verify carry all three; the UI's \"Test\" carries no fields.\n *\n * ★ ADOPTING THE BUILT-IN AS IT IS. MEASURED on PBS 4.2 (2026-09-22, `proxmox-backup-manager\n *   notification matcher show default-matcher`): it routes everything EXCEPT successful prune\n *   jobs to `mail-to-root` — `invert-match` over `exact:type=prune` AND severity `info`:\n *   ```ts\n *   PbsNotificationMatcher('default-matcher', {\n *     target: pbs, name: 'default-matcher', targets: ['mail-to-root'],\n *     'invert-match': true, 'match-field': ['exact:type=prune'], 'match-severity': ['info'],\n *   });\n *   ```\n *\n * ★ WHAT THIS NEEDS, READ OFF THE SERVER'S SCHEMA (generated/pbs.ts source):\n *     read      GET                 Sys.Audit  on /system/notifications\n *     write     POST, PUT, DELETE   Sys.Modify on /system/notifications\n *   ⚠️ NOT A DATASTORE PRIVILEGE. A credential scoped to `/datastore/...` cannot read matchers;\n *     the old client treated that refusal as absent — notification-target.ts describes the\n *     resulting \"absent, then already exists\" signature.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport {\n  type NotificationMatcherAttributes,\n  type NotificationMatcherFields,\n  matcherCreateForm,\n  matcherMatches,\n  matcherUpdateForm,\n} from './notification-matcher-form.ts';\nimport type { PveRequirements, WithPbsTarget } from './resource.ts';\nimport { guardForm } from './constraint-guard.ts';\nimport {\n  createMatcher,\n  deleteMatcher,\n  readMatcher,\n  updateMatcher,\n} from './pbs-notification-matcher-distilled.ts';\n\nexport interface PbsNotificationMatcherProps extends NotificationMatcherFields, WithPbsTarget {}\n\nexport interface PbsNotificationMatcher extends Resource<\n  'Pbs.NotificationMatcher',\n  PbsNotificationMatcherProps,\n  NotificationMatcherAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ⚠️ No `retain`, for notification-matcher.ts's reason; a built-in REVERTS on delete. */\nexport const PbsNotificationMatcher = Resource<PbsNotificationMatcher>('Pbs.NotificationMatcher');\n\ntype Props = PbsNotificationMatcherProps;\ntype Attributes = NotificationMatcherAttributes;\n\nconst guardCreate = (props: Props, requirePresence: boolean) =>\n  guardForm('pbs:POST /config/notifications/matchers', matcherCreateForm(props), requirePresence);\nconst guardUpdate = (props: Props) =>\n  guardForm('pbs:PUT /config/notifications/matchers/{name}', matcherUpdateForm(props), false);\n\n/**\n * SDK-backed lifecycle: read before writing and compare the entire rule so adoption is free.\n * ⛔ A 401, 403, malformed response or failed credential mint must fail the plan. Only the\n *   SDK's typed NotFound means absent; the old factory turned all of these into false creates.\n */\nconst handlers = {\n  /** Built-ins belong to the host; adopting them must stay an explicit declaration. */\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: Props }) => readMatcher(olds),\n  diff: ({\n    news,\n    olds,\n    output,\n  }: {\n    news: Input<Props>;\n    olds: Props;\n    output: Attributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      if (!isResolved(news)) return undefined;\n      yield* guardCreate(news, output === undefined);\n      yield* guardUpdate(news);\n      if (output === undefined) return undefined;\n      if (olds.name !== news.name) return { action: 'replace' } as const;\n      const live = yield* readMatcher(news);\n      if (live === undefined) {\n        yield* guardCreate(news, true);\n        return { action: 'update' } as const;\n      }\n      return { action: matcherMatches(live, news) ? 'noop' : 'update' } as const;\n    }),\n  reconcile: ({ news }: { news: Props }) =>\n    Effect.gen(function* () {\n      const live = yield* readMatcher(news);\n      yield* guardCreate(news, live === undefined);\n      yield* guardUpdate(news);\n      if (live === undefined) yield* createMatcher(news, matcherCreateForm(news));\n      else if (!matcherMatches(live, news)) yield* updateMatcher(news, matcherUpdateForm(news));\n      const after = yield* readMatcher(news);\n      if (after === undefined)\n        return yield* Effect.fail(\n          new Error(\n            `config/notifications/matchers/${news.name}: the write returned no error but the matcher is still absent.`,\n          ),\n        );\n      return after;\n    }),\n  delete: ({ olds }: { olds: Props }) => deleteMatcher(olds),\n};\n\nexport const PbsNotificationMatcherProvider = () =>\n  Provider.effect(\n    PbsNotificationMatcher,\n    Effect.succeed(PbsNotificationMatcher.Provider.of(handlers)),\n  );\n",
+    "/** PBS 4.2.6-1 matcher operations through SDK 0.3.0; failed reads never become absence. */\nimport * as config from '@distilled.cloud/proxmox-backup/config';\nimport * as Effect from 'effect/Effect';\nimport { notificationInput } from './pbs-notification-input.ts';\nimport { runPbs } from './distilled-pbs.ts';\nimport {\n  type MatcherCreateForm,\n  type MatcherUpdateForm,\n  matcherAttributes,\n} from './notification-matcher-form.ts';\nimport type { PbsNotificationMatcherProps as Props } from './pbs-notification-matcher.ts';\n\nexport const readMatcher = (props: Props) =>\n  runPbs(props.target, 'read', config.getConfigNotificationMatcher({ name: props.name })).pipe(\n    Effect.map((row) =>\n      matcherAttributes(\n        {\n          ...row,\n          'invert-match': row.invert_match,\n          'match-calendar': row.match_calendar,\n          'match-field': row.match_field,\n          'match-severity': row.match_severity,\n        },\n        props.name,\n      ),\n    ),\n    Effect.catchTag('NotFound', () => Effect.succeed(undefined)),\n  );\n\n/** Validate with the SDK's request schema after spelling the shared PVE/PBS form's keys. */\nconst requestFields = (props: Props, form: MatcherCreateForm | MatcherUpdateForm) => ({\n  ...form,\n  invert_match: form['invert-match'],\n  match_calendar: form['match-calendar'],\n  match_field: form['match-field'],\n  match_severity: form['match-severity'],\n  name: props.name,\n});\n\nexport const createMatcher = (props: Props, form: MatcherCreateForm) =>\n  runPbs(\n    props.target,\n    'provision',\n    notificationInput(\n      config.CreateConfigNotificationMatcherRequest,\n      requestFields(props, form),\n    ).pipe(Effect.flatMap(config.createConfigNotificationMatcher)),\n  );\n\nexport const updateMatcher = (props: Props, form: MatcherUpdateForm) =>\n  runPbs(\n    props.target,\n    'provision',\n    notificationInput(config.PutConfigNotificationMatcherRequest, requestFields(props, form)).pipe(\n      Effect.flatMap(config.putConfigNotificationMatcher),\n    ),\n  );\n\n/** PBS reverts built-ins on deletion; it reports NotFound only for an absent user-created row. */\nexport const deleteMatcher = (props: Props) =>\n  runPbs(\n    props.target,\n    'provision',\n    config.deleteConfigNotificationMatcher({ name: props.name }),\n  ).pipe(Effect.catchTag('NotFound', () => Effect.void));\n",
+    "/** Validate translated fields with the SDK's own schema without echoing write-only values. */\nimport * as Data from 'effect/Data';\nimport * as Effect from 'effect/Effect';\nimport * as Schema from 'effect/Schema';\n\nexport class PbsNotificationInputRefusal extends Data.TaggedError('PbsNotificationInputRefusal')<{\n  readonly message: string;\n}> {}\n\n/**\n * Fields already use SDK Type-side names; toType validates without any wire transforms.\n * A schema diagnostic can reproduce the whole submitted form, including a webhook secret or\n * SMTP password. Sanitize only our pre-request validation failure. SDK operation errors below\n * this boundary retain their original typed tags and are never remapped.\n */\nexport const notificationInput = <S extends Schema.Top>(schema: S, fields: unknown) =>\n  Schema.decodeUnknownEffect(Schema.toType(schema))(fields).pipe(\n    Effect.mapError(\n      () =>\n        new PbsNotificationInputRefusal({\n          message:\n            'PBS notification fields do not match the SDK request schema; no PBS request was sent.',\n        }),\n    ),\n  );\n",
+    "/**\n * `Pbs.NotificationTarget` — where a Proxmox Backup Server sends a notification: a `webhook`, or\n * mail through `sendmail` or `smtp`.\n *\n * ★ THE WEBHOOK IS THE POINT. A failed verify, sync or garbage collection reaches a human through a\n *   target a matcher names (pbs-notification-matcher.ts). Out of the box that is `mail-to-root`,\n *   one mailbox on one host; a webhook can post an Alertmanager alert instead, and then the failure\n *   pages like everything else. docs/pbs-alertmanager-body.md has the body template.\n *\n * ⛔ SECRETS ARE DECLARED BY THE NAME OF AN ENVIRONMENT VARIABLE, NEVER BY VALUE, and NO VALUE EVER\n *   REACHES STATE — not as a prop, not as an attribute. write-only.ts has the whole argument; the\n *   short form: Alchemy stores props and attributes unencrypted, so `secret`, `password` and any\n *   header holding a credential take `{ fromEnv: 'NAME' }`, read by the deploying process at call\n *   time. What the store keeps is presence (names) and digests, and the plan diffs on those.\n *   ★ THIS IS WHERE THE PBS FAMILY PARTS FROM notification-target.ts (PVE), which refuses every\n *     secret and so cannot create a signed webhook at all.\n *\n * ⛔ THE PER-OBJECT PATH CARRIES THE FAMILY: `config/notifications/endpoints/{type}/{name}`. `type`\n *   is identity, and changing it or `name` plans a REPLACE here — `diff` compares them with the\n *   recorded props. `/config/notifications/targets` is a read-only union view, as on PVE.\n *\n * ⚠️ A BUILT-IN TARGET REVERTS ON DELETE instead of disappearing (`origin: builtin`, measured on\n *   PBS 4.2 for `mail-to-root`), and PBS reports success either way — notification-target.ts has\n *   the consequence. Read `origin` before declaring a name you did not create.\n *\n * ★ WHAT THIS NEEDS (generated/pbs.ts source): Sys.Audit on /system/notifications to read,\n *   Sys.Modify there to write. A datastore-scoped credential cannot read targets; its typed refusal now fails the plan.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { handlers } from './pbs-notification-target-lifecycle.ts';\nimport type { PveRequirements, WithPbsTarget } from './resource.ts';\nimport type { FromEnv } from '../secrets/write-only.ts';\n\nexport type PbsNotificationTargetType = 'sendmail' | 'smtp' | 'webhook';\n\n/**\n * ⚠️ PBS'S OWN KEY NAMES, DASHES INCLUDED, for the reason backup-job.ts gives. A field outside its\n *   family (a `url` on a sendmail target) is refused at plan by name, not sent for a 400.\n * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED; `''` or `[]` (or `{}`) CLEARS ONE.\n */\nexport interface PbsNotificationTargetProps extends WithPbsTarget {\n  /** ⛔ IDENTITY: it picks the family and the URL. Changing it is a replace. */\n  type: PbsNotificationTargetType;\n  /** Unique across ALL families on the host: a webhook cannot be called `mail-to-root`. */\n  name: string;\n  comment?: string;\n  /** Configured but not delivering. Always sent and always compared. */\n  disable?: boolean;\n  /** sendmail, smtp: recipient addresses. Order is not meaning. */\n  mailto?: readonly string[];\n  /** sendmail, smtp: PBS users whose configured address receives the mail. */\n  'mailto-user'?: readonly string[];\n  /** smtp: required. sendmail: optional. */\n  'from-address'?: string;\n  author?: string;\n  /** smtp: the relay host. Required. */\n  server?: string;\n  /** smtp. Unset lets PBS pick from `mode`. */\n  port?: number;\n  /** smtp. PBS's default is `tls`. */\n  mode?: 'insecure' | 'starttls' | 'tls';\n  /** smtp. */\n  username?: string;\n  /** smtp: ⛔ WRITE-ONLY. The server never returns it; the plan compares its seal. */\n  password?: FromEnv;\n  /** webhook: required. Supports templating: `{{ secrets.<name> }}` keeps a token out of it. */\n  url?: string;\n  /** webhook: required. */\n  method?: 'get' | 'post' | 'put';\n  /**\n   * webhook: header name → template text, or `{ fromEnv }` for a value that is itself a secret.\n   * ⚠️ PLAIN VALUES ARE PROPS, AND PROPS ARE STORED: `Content-Type` is fine, a token is not. Put a\n   *   credential in `secret` and write `'Bearer {{ secrets.token }}'` here instead.\n   */\n  header?: Readonly<Record<string, FromEnv | string>>;\n  /**\n   * webhook: the body TEMPLATE, as text. ★ Declared DECODED — the wire is base64, and this family\n   *   encodes on write and decodes on read, so a plan shows a readable diff.\n   */\n  body?: string;\n  /** webhook: ⛔ WRITE-ONLY. Name → variable. Referenced as `{{ secrets.<name> }}`. */\n  secret?: Readonly<Record<string, FromEnv>>;\n}\n\n/** ⛔ NO VALUE OF A SECRET, PASSWORD OR HEADER — names and digests only. */\nexport interface PbsNotificationTargetAttributes {\n  name: string;\n  type: PbsNotificationTargetType;\n  /** `builtin`, `modified-builtin`, `user-created` — reported, never compared. */\n  origin: string;\n  comment: string;\n  disable: boolean;\n  mailto: string;\n  'mailto-user': string;\n  'from-address': string;\n  author: string;\n  server: string;\n  /** 0 means PBS holds no port. */\n  port: number;\n  mode: string;\n  username: string;\n  url: string;\n  method: string;\n  /** The decoded body template. */\n  body: string;\n  /** Header NAMES, sorted — presence. */\n  header: string;\n  /** scrypt digest of the live header pairs, fixed salt per target. */\n  headerDigest: string;\n  /** Secret NAMES, sorted — all PBS will say. */\n  secret: string;\n  /**\n   * Seal of the secret values and password THIS PROVIDER LAST WROTE; `''` if it never wrote them\n   * (an adoption). ⚠️ `''` makes those values presence-only until the first write that carries them.\n   */\n  sealed: string;\n}\n\nexport interface PbsNotificationTarget extends Resource<\n  'Pbs.NotificationTarget',\n  PbsNotificationTargetProps,\n  PbsNotificationTargetAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const PbsNotificationTarget = Resource<PbsNotificationTarget>('Pbs.NotificationTarget');\n\n/**\n * ⛔ `Provider.of` STAYS HERE, for resource.ts's reason: it is the one place the handlers are\n *   checked against the concrete resource types, so the lifecycle file cannot drift from them.\n */\nexport const PbsNotificationTargetProvider = () =>\n  Provider.effect(\n    PbsNotificationTarget,\n    Effect.succeed(PbsNotificationTarget.Provider.of(handlers)),\n  );\n",
+    "/**\n * The lifecycle of a `Pbs.NotificationTarget`: read, diff, reconcile, delete.\n *\n * ★ SPLIT OUT OF pbs-notification-target.ts FOR THE 250-LINE CAP. That file says what a target is\n *   and holds `Provider.of`; this one says what each operation does. The `import type` back is\n *   erased, so the cycle is on paper only.\n *\n * ⚠️ NOT `pveHandlers`, AND IT SHOULD LOOK DIFFERENT (resource.ts asks for exactly that). The\n *   factory's `diff` sees only the live object, and a secret's value is not in the live object:\n *   the seal lives in the PREVIOUS STATE, which only a hand-written `diff` and `reconcile` receive\n *   (`output`). Everything else — the read, the read-back refusal, the `matches` guard that keeps\n *   adoption free — is the factory's behaviour, written out.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport {\n  createTarget,\n  deleteTarget,\n  readTarget as readLive,\n  updateTarget,\n  validateTargetWrite,\n} from './pbs-notification-target-distilled.ts';\nimport { guardForm } from './constraint-guard.ts';\nimport { pbsTargetEndpoint } from './pbs-notification-target-endpoint.ts';\nimport type {\n  PbsNotificationTargetAttributes,\n  PbsNotificationTargetProps,\n} from './pbs-notification-target.ts';\nimport {\n  type Carry,\n  type Groups,\n  headerState,\n  plainMatches,\n  refusals,\n  resolveGroups,\n  sealedState,\n  targetForm,\n} from './pbs-notification-target-form.ts';\nimport { seal } from '../secrets/write-only.ts';\n\ntype Props = PbsNotificationTargetProps;\ntype Attributes = PbsNotificationTargetAttributes;\n\nconst path = (props: Props) => `config/notifications/endpoints/${props.type}/${props.name}`;\n\nconst refuse = (props: Props) => {\n  const reasons = refusals(props);\n  return reasons.length === 0\n    ? Effect.void\n    : Effect.die(new Error(`${path(props)}: ${reasons.join('; ')}.`));\n};\n\n/** What a write must carry, given what is stale. `undefined` means nothing to write. */\nconst toCarry = (live: Attributes, props: Props, groups: Groups, sealed: string) => {\n  const header = headerState(live, props, groups) === 'stale';\n  const sealedStale = sealedState(live, props, groups, sealed) === 'stale';\n  return plainMatches(live, props) && !header && !sealedStale\n    ? undefined\n    : ({ header, sealed: sealedStale } satisfies Carry);\n};\n\n/** ⛔ Every variable a carried group needs, or a failure naming the missing ones — never a value. */\nconst requireValues = (props: Props, groups: Groups, carry: Carry) => {\n  const missing = [\n    ...(carry.header ? groups.header.missing : []),\n    ...(carry.sealed ? groups.sealed.missing : []),\n  ];\n  return missing.length === 0\n    ? Effect.void\n    : Effect.die(\n        new Error(\n          `${path(props)}: this write must send write-only values, and ${missing.join(', ')} ` +\n            'is unset or empty in the deploying environment. Export it and deploy again.',\n        ),\n      );\n};\n\nexport const handlers = {\n  /** ⛔ EMPTY: `mail-to-root` is on every host, and adoption stays an explicit act (resource.ts). */\n  list: () => Effect.succeed([]),\n  /**\n   * ⛔ WITH NO `output` THIS IS ALCHEMY'S ADOPTION PROBE, AND THE ONLY PLAN-TIME HOOK A NEW TARGET\n   *   GETS — so the refusals run here too. Measured on beta.79 (Plan.ts, the `oldState ===\n   *   undefined` branch): a declaration with no state row is `read` with `olds: news` and never\n   *   `diff`ed, and Apply then commits its props as `creating` BEFORE `reconcile` runs. A refusal\n   *   left to `reconcile` fired after the props — a literal token included — were in the store.\n   * ⚠️ ONLY WHEN THE PROPS ARE RESOLVED: Plan skips the probe while any prop is an unresolved\n   *   Output, and then `reconcile` is the first check. docs/pbs-notifications.md says so.\n   * ★ A DEFECT (`Effect.die`), NOT A FAILURE, AND THAT IS WHAT KEEPS IT FROM WEDGING A STAGE. The\n   *   same `read`-with-no-output shape is Alchemy's RECOVERY read of an interrupted create, at plan\n   *   and before a delete (Plan.ts, Apply.ts), with the STORED props — and both wrap it in\n   *   `catchDefect`, degrading to \"nothing recovered\". A typed failure would pass that catch and\n   *   block the plan or the delete on props the user already fixed. The cold-start probe has no\n   *   catch, so there the defect fails the plan, as intended. A refused create sent no request,\n   *   so \"nothing recovered\" is also the truth.\n   */\n  read: ({ olds, output }: { olds: Props; output: Attributes | undefined }) =>\n    (output === undefined ? refuse(olds) : Effect.void).pipe(\n      Effect.andThen(readLive(olds)),\n      Effect.map((live) =>\n        live === undefined ? undefined : { ...live, sealed: output?.sealed ?? '' },\n      ),\n    ),\n  /**\n   * ⚠️ `Input<Props>` and `isResolved`, resource.ts's reason: at plan time a prop can still be an\n   *   unresolved Output, and comparing a placeholder to a live value reports a phantom update.\n   * ⛔ A NEW `type` UNDER THE SAME `name` REPLACES DELETE-FIRST: names are unique across every\n   *   family on the host (api `ensure_unique`), so creating the new one first would be refused.\n   */\n  diff: ({\n    news,\n    olds,\n    output,\n  }: {\n    news: Input<Props>;\n    olds: Props;\n    output: Attributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      if (output === undefined || !isResolved(news)) return undefined;\n      yield* refuse(news);\n      if (olds !== undefined && (olds.type !== news.type || olds.name !== news.name)) {\n        // ⛔ Preflight the destination before delete-first can remove a working target. A rename\n        // may adopt an existing endpoint; its write-only values have no seal from this resource.\n        const destination = yield* readLive(news);\n        const groups = resolveGroups(news);\n        const carry =\n          destination === undefined\n            ? { header: true, sealed: true }\n            : toCarry(destination, news, groups, '');\n        if (carry !== undefined) {\n          yield* requireValues(news, groups, carry);\n          const mode = destination === undefined ? 'create' : 'update';\n          const form = targetForm(news, groups, carry, mode);\n          yield* guardForm(pbsTargetEndpoint(news)[mode], form, destination === undefined);\n          yield* validateTargetWrite(news, form, mode);\n        }\n        return { action: 'replace', deleteFirst: olds.name === news.name } as const;\n      }\n      const live = yield* readLive(news);\n      if (live === undefined) return { action: 'update' } as const;\n      return toCarry(live, news, resolveGroups(news), output.sealed) === undefined\n        ? ({ action: 'noop' } as const)\n        : ({ action: 'update' } as const);\n    }),\n  reconcile: ({ news, output }: { news: Props; output: Attributes | undefined }) =>\n    Effect.gen(function* () {\n      yield* refuse(news);\n      const groups = resolveGroups(news);\n      const live = yield* readLive(news);\n      let sealed = output?.sealed ?? '';\n      if (live === undefined) {\n        const carry = { header: true, sealed: true } as const;\n        yield* requireValues(news, groups, carry);\n        const form = targetForm(news, groups, carry, 'create');\n        /**\n         * ⛔ WITH PRESENCE, BECAUSE THIS BRANCH IS UNCONDITIONALLY THE CREATE. PBS marks `name` on\n         *   every family and `server`/`from-address` on smtp, `url`/`method` on webhook — and it\n         *   is the same `comment: maxLength 128` that failed `POST /config/verify`.\n         * ⚠️ THE FORM CARRIES SECRETS ON THIS PATH. `violations` reads values and builds only the\n         *   parameter NAME into its message (constraints.ts), so a refusal never quotes one.\n         */\n        yield* guardForm(pbsTargetEndpoint(news).create, form, true);\n        yield* createTarget(news, form);\n        sealed = seal(groups.sealed.values);\n      } else {\n        const carry = toCarry(live, news, groups, sealed);\n        if (carry !== undefined) {\n          yield* requireValues(news, groups, carry);\n          const form = targetForm(news, groups, carry, 'update');\n          /** ⚠️ NO PRESENCE: an update form is partial by design — it carries what `toCarry` said. */\n          yield* guardForm(pbsTargetEndpoint(news).update, form, false);\n          yield* updateTarget(news, form);\n          if (carry.sealed) sealed = seal(groups.sealed.values);\n        }\n      }\n      const after = yield* readLive(news);\n      if (after === undefined) {\n        // ⛔ resource.ts's rule: \"no error\" is not evidence of a write. Read back, or refuse.\n        return yield* Effect.die(\n          new Error(`${path(news)}: the write returned no error but the target is still absent.`),\n        );\n      }\n      return { ...after, sealed } satisfies Attributes;\n    }),\n  delete: ({ olds }: { olds: Props }) => deleteTarget(olds),\n};\n",
+    "/**\n * PBS 4.2.6-1 notification operations, generated from its vendor schema in SDK 0.3.0.\n *\n * ★ Keep targetForm's selective secret groups and deletion semantics. The SDK schemas validate\n *   the spelling adapter before their typed operations encode it; no request shape is cast.\n *   Only the SDK's NotFound is absence. An unreadable target must stop adoption, not create it.\n */\nimport * as config from '@distilled.cloud/proxmox-backup/config';\nimport type {\n  ProxmoxBackupOpContext,\n  ProxmoxBackupOpError,\n} from '@distilled.cloud/proxmox-backup/Protocol';\nimport * as Effect from 'effect/Effect';\nimport { notificationInput } from './pbs-notification-input.ts';\nimport type { PveForm } from './client.ts';\nimport { runPbs } from './distilled-pbs.ts';\nimport type { PbsNotificationTargetProps as Props } from './pbs-notification-target.ts';\nimport { targetAttributes } from './pbs-notification-target-wire.ts';\n\n/** SDK property names differ from the vendor's form keys only at these two fields. */\nconst requestFields = (props: Props, form: PveForm) => ({\n  ...form,\n  from_address: form['from-address'],\n  mailto_user: form['mailto-user'],\n  name: props.name,\n});\n\nconst read = (\n  props: Props,\n): Effect.Effect<Record<string, unknown>, ProxmoxBackupOpError, ProxmoxBackupOpContext> => {\n  switch (props.type) {\n    case 'sendmail':\n      return config.getConfigNotificationEndpointSendmail({ name: props.name }).pipe(\n        Effect.map((row) => ({\n          ...row,\n          'from-address': row.from_address,\n          'mailto-user': row.mailto_user,\n        })),\n      );\n    case 'smtp':\n      return config.getConfigNotificationEndpointSmtp({ name: props.name }).pipe(\n        Effect.map((row) => ({\n          ...row,\n          'from-address': row.from_address,\n          'mailto-user': row.mailto_user,\n        })),\n      );\n    case 'webhook':\n      return config\n        .getConfigNotificationEndpointWebhook({ name: props.name })\n        .pipe(Effect.map((row) => ({ ...row })));\n  }\n};\n\nexport const readTarget = (props: Props) =>\n  runPbs(props.target, 'read', read(props)).pipe(\n    Effect.map((row) => targetAttributes(row, props)),\n    Effect.catchTag('NotFound', () => Effect.succeed(undefined)),\n  );\n\n/** No request: run the same translated-input validation before replacement can delete anything. */\nexport const validateTargetWrite = (props: Props, form: PveForm, mode: 'create' | 'update') => {\n  const schema =\n    mode === 'create'\n      ? {\n          sendmail: config.CreateConfigNotificationEndpointSendmailRequest,\n          smtp: config.CreateConfigNotificationEndpointSmtpRequest,\n          webhook: config.CreateConfigNotificationEndpointWebhookRequest,\n        }[props.type]\n      : {\n          sendmail: config.PutConfigNotificationEndpointSendmailRequest,\n          smtp: config.PutConfigNotificationEndpointSmtpRequest,\n          webhook: config.PutConfigNotificationEndpointWebhookRequest,\n        }[props.type];\n  return notificationInput(schema, requestFields(props, form)).pipe(Effect.asVoid);\n};\n\nexport const createTarget = (props: Props, form: PveForm) => {\n  const fields = requestFields(props, form);\n  const operation =\n    props.type === 'sendmail'\n      ? notificationInput(config.CreateConfigNotificationEndpointSendmailRequest, fields).pipe(\n          Effect.flatMap(config.createConfigNotificationEndpointSendmail),\n        )\n      : props.type === 'smtp'\n        ? notificationInput(config.CreateConfigNotificationEndpointSmtpRequest, fields).pipe(\n            Effect.flatMap(config.createConfigNotificationEndpointSmtp),\n          )\n        : notificationInput(config.CreateConfigNotificationEndpointWebhookRequest, fields).pipe(\n            Effect.flatMap(config.createConfigNotificationEndpointWebhook),\n          );\n  return runPbs(props.target, 'provision', operation);\n};\n\nexport const updateTarget = (props: Props, form: PveForm) => {\n  const fields = requestFields(props, form);\n  const operation =\n    props.type === 'sendmail'\n      ? notificationInput(config.PutConfigNotificationEndpointSendmailRequest, fields).pipe(\n          Effect.flatMap(config.putConfigNotificationEndpointSendmail),\n        )\n      : props.type === 'smtp'\n        ? notificationInput(config.PutConfigNotificationEndpointSmtpRequest, fields).pipe(\n            Effect.flatMap(config.putConfigNotificationEndpointSmtp),\n          )\n        : notificationInput(config.PutConfigNotificationEndpointWebhookRequest, fields).pipe(\n            Effect.flatMap(config.putConfigNotificationEndpointWebhook),\n          );\n  return runPbs(props.target, 'provision', operation);\n};\n\n/** Built-ins still follow PBS's revert-on-delete semantics; missing objects are already deleted. */\nexport const deleteTarget = (props: Props) => {\n  const request = { name: props.name };\n  const operation =\n    props.type === 'sendmail'\n      ? config.deleteConfigNotificationEndpointSendmail(request)\n      : props.type === 'smtp'\n        ? config.deleteConfigNotificationEndpointSmtp(request)\n        : config.deleteConfigNotificationEndpointWebhook(request);\n  return runPbs(props.target, 'provision', operation).pipe(\n    Effect.catchTag('NotFound', () => Effect.void),\n  );\n};\n",
     "/**\n * How a PBS notification target looks on the wire, and what of it may be remembered.\n *\n * ★ SPLIT OUT OF pbs-notification-target.ts FOR THE 250-LINE CAP, on the seam\n *   notification-target-form.ts cut for PVE: the resource file says what a target IS and when it\n *   changed; this file turns a live answer into attributes and a value into a wire item. The\n *   `import type` back is erased, so the cycle is on paper only.\n *\n * ⛔ THE LIVE ANSWER HOLDS HEADER VALUES, AND NONE OF THEM REACHES AN ATTRIBUTE. PBS returns a\n *   webhook's headers in full — `name=Authorization,value=<base64>` — to anyone with Sys.Audit on\n *   /system/notifications (proxmox-notify api/webhook.rs `get_endpoint`, read at HEAD 2026-09-22).\n *   Copying them into attributes would copy whatever a human pasted into a header, a bearer token\n *   included, into the unencrypted state store. So attributes keep header NAMES and a fixed-salt\n *   scrypt digest of the pairs (write-only.ts), enough to notice a change and nothing to send.\n * ⚠️ SECRETS ARE SAFER ON THE SERVER, AND THE READ SHOWS IT: `get_endpoint` blanks every secret's\n *   value and returns names only, from a root-only `notifications-priv.cfg`. A credential belongs\n *   in `secret` and is referenced as `{{ secrets.<name> }}` from a header, the URL or the body.\n */\nimport { Buffer } from 'node:buffer';\nimport { addressList, portOf } from './notification-target-form.ts';\nimport type {\n  PbsNotificationTargetAttributes,\n  PbsNotificationTargetProps,\n} from './pbs-notification-target.ts';\nimport { bool, text } from './values.ts';\nimport { seal } from '../secrets/write-only.ts';\n\nexport const base64 = (value: string): string => Buffer.from(value, 'utf8').toString('base64');\n\n/** ⚠️ Node's decoder skips characters it does not know rather than throwing, so this never throws. */\nexport const unbase64 = (value: string): string => Buffer.from(value, 'base64').toString('utf8');\n\n/**\n * One `KeyAndBase64Val` property string — `name=<name>,value=<base64>` — split into its halves.\n * ⚠️ KEYED BY NAME, NOT BY POSITION: the server serialises `name` first today, and a parser that\n *   relied on that would read a reordered item as a header called `value=…`.\n * ★ A comma cannot occur inside either half: base64 has none, and `refusals` keeps names clean.\n */\nexport const keyAndValue = (item: string): { name: string; value?: string } => {\n  const parts: Record<string, string> = {};\n  for (const part of item.split(',')) {\n    const at = part.indexOf('=');\n    if (at > 0) parts[part.slice(0, at).trim()] = part.slice(at + 1).trim();\n  }\n  const value = parts['value'];\n  return value === undefined ? { name: parts['name'] ?? '' } : { name: parts['name'] ?? '', value };\n};\n\n/** The wire item for one header or secret. The value is base64 — the server decodes it to use it. */\nexport const wireItem = (name: string, value: string): string =>\n  `name=${name},value=${base64(value)}`;\n\nconst list = (value: unknown): readonly string[] =>\n  Array.isArray(value) ? value.map((item: unknown) => String(item)) : [];\n\n/** Sorted, comma-joined names — presence, the only thing the store may know about the values. */\nexport const names = (keys: readonly string[]): string =>\n  [...keys]\n    .filter((key) => key !== '')\n    .sort()\n    .join(',');\n\n/**\n * ★ A FIXED SALT PER TARGET, SO AN UNCHANGED HEADER SET DIGESTS THE SAME ON EVERY READ. A random\n *   one would rewrite the state row on every plan. The server shows these values to its auditors\n *   anyway; what the salt and scrypt buy is that the STORE does not become a second, weaker copy.\n */\nexport const headerDigest = (target: string, pairs: Readonly<Record<string, string>>): string =>\n  seal(pairs, `hf:pbs-notification-target:${target}:header`);\n\n/**\n * Live JSON to attributes. `sealed` is left empty here: it is not the server's to report, and the\n * handlers in pbs-notification-target.ts carry it forward from the previous state.\n */\nexport const targetAttributes = (\n  live: Record<string, unknown>,\n  props: PbsNotificationTargetProps,\n): PbsNotificationTargetAttributes => {\n  const headers: Record<string, string> = {};\n  for (const item of list(live['header'])) {\n    const { name, value } = keyAndValue(item);\n    if (name !== '') headers[name] = unbase64(value ?? '');\n  }\n  const secrets = list(live['secret']).map((item) => keyAndValue(item).name);\n  return {\n    author: text(live['author']),\n    // ⚠️ DECODED, unlike the PVE family's: the server stores exactly the base64 it was handed and\n    //   decodes it to render (endpoints/webhook.rs `build_request`), so decoding here is a pure\n    //   function of what was written and `matches` compares readable text rather than base64.\n    body: unbase64(text(live['body'])),\n    comment: text(live['comment']),\n    disable: bool(live['disable']),\n    'from-address': text(live['from-address']),\n    header: names(Object.keys(headers)),\n    headerDigest: headerDigest(props.name, headers),\n    mailto: addressList(live['mailto']),\n    'mailto-user': addressList(live['mailto-user']),\n    method: text(live['method']),\n    mode: text(live['mode']),\n    name: props.name,\n    // ★ ON THE PER-OBJECT READ, MEASURED on PBS 4.2 (`notification endpoint sendmail show\n    //   mail-to-root` answers `origin: builtin`). Reported, never compared.\n    origin: text(live['origin']),\n    port: portOf(live['port']),\n    secret: names(secrets),\n    sealed: '',\n    server: text(live['server']),\n    type: props.type,\n    url: text(live['url']),\n    username: text(live['username']),\n  };\n};\n",
     "/**\n * Values a declaration may SEND and must never STORE — a webhook secret, a header carrying a\n * credential, an smtp password — and the one form in which a plan may still remember them.\n *\n * ★ FAMILY-NEUTRAL ON PURPOSE, MOVED HERE FROM `proxmox/` 2026-09-22. The rule it encodes is not\n *   about Proxmox: Alchemy's state store is the same unencrypted store for every provider, so the\n *   Cloudflare MCP server entry's `auth_credentials` needs exactly this shape. A second copy under\n *   `cloudflare/` would be two seal formats for one rule; a cross-family import would make\n *   Cloudflare depend on Proxmox. Neither; it lives on its own.\n *\n * ⛔ A SECRET PROP IS A SECRET IN THE STATE STORE, WHATEVER TYPE IT HAS. Alchemy persists props as\n *   well as attributes — `delete` is handed `olds`, which can only have come from the store — and\n *   it does not encrypt either: `StateEncoding.ts` TAGS a `Redacted` value and writes the inner\n *   value beside the tag. So `Redacted` hides a secret from a log line and from nothing else.\n *   notification-target.ts (PVE) answered that by making no secret declarable at all, and paid\n *   for it: an authenticated smtp target or a signed webhook could not be created from code.\n * ★ SO THE PROP HOLDS A NAME, NOT A VALUE. `{ fromEnv: 'PBS_HOOK_TOKEN' }` names the variable the\n *   DEPLOYING process reads at call time — the shape forgejo/org-actions-secrets.ts already uses.\n *   The name is what lands in state; the value exists only in that process's memory and on the\n *   wire to the server.\n *\n * ⚠️ A PLAN STILL NEEDS TO KNOW WHETHER A VALUE CHANGED, AND IT CANNOT ASK THE SERVER. PBS returns a\n *   webhook secret's NAME and never its value, and never returns an smtp password at all. So what\n *   was last written is remembered as a SEAL: a salted scrypt digest, which lets the next plan\n *   check \"is the value in my environment the one I wrote\" without the store holding anything a\n *   reader could send to PBS.\n *   ⚠️ A DIGEST OF A GUESSABLE SECRET IS STILL GUESSABLE. The salt defeats precomputed tables and\n *     scrypt makes each guess cost memory and time; neither makes a dictionary word safe. The\n *     remedy is a secret worth the name — a random token — not a faster hash.\n */\nimport { Buffer } from 'node:buffer';\nimport { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';\n\n/** A write-only value, by the NAME of the environment variable holding it. Never the value. */\nexport interface FromEnv {\n  readonly fromEnv: string;\n}\n\n/** Where a value is looked up. Defaults to `process.env`, read at call time, never at load. */\nexport type Environment = Readonly<Record<string, string | undefined>>;\n\n/**\n * Each `name → FromEnv` resolved, or the variable names that could not be.\n *\n * ⚠️ AN EMPTY VARIABLE IS A MISSING ONE. A secret renderer that failed writes `NAME=` rather than\n *   omitting the line, and sending `''` would store an empty secret on the server — a webhook that\n *   authenticates with nothing, reported as a successful deploy.\n * ⚠️ THE VALUE IS NOT TRIMMED. A token with a trailing newline is a broken header either way, and\n *   trimming here would make the seal disagree with a value written by any other tool.\n */\nexport const resolveAll = (\n  refs: Readonly<Record<string, FromEnv>>,\n  env: Environment = process.env,\n): { readonly values: Readonly<Record<string, string>>; readonly missing: readonly string[] } => {\n  const values: Record<string, string> = {};\n  const missing: string[] = [];\n  for (const [key, ref] of Object.entries(refs)) {\n    const value = env[ref.fromEnv];\n    if (value === undefined || value === '') missing.push(ref.fromEnv);\n    else values[key] = value;\n  }\n  return { missing: [...new Set(missing)].sort(), values };\n};\n\n/**\n * ★ PARAMETERS ARE NODE'S OWN SCRYPT DEFAULTS (N 2^14, r 8, p 1) — 16 MiB and tens of\n *   milliseconds per digest. Plan runs it a handful of times per resource, which is noise, and a\n *   guesser runs it once per guess, which is the point.\n */\nconst COST = { N: 16_384, maxmem: 64 * 1024 * 1024, p: 1, r: 8 } as const;\nconst PREFIX = 'scrypt';\n\n/** Key order must not change a digest, so entries are sorted and serialised as JSON pairs. */\nconst canonical = (values: Readonly<Record<string, string>>): string =>\n  JSON.stringify(\n    Object.keys(values)\n      .sort()\n      .map((key) => [key, values[key]]),\n  );\n\nconst digest = (salt: Buffer, values: Readonly<Record<string, string>>): Buffer =>\n  scryptSync(canonical(values), salt, 32, COST);\n\n/**\n * `scrypt:<salt>:<digest>`, or `''` when there is nothing to seal.\n *\n * ★ A RANDOM SALT BY DEFAULT, FOR WHAT THIS PROVIDER WROTE. Pass a fixed one only for a value the\n *   server returns anyway (a header), where a fresh salt per read would churn the state row on\n *   every plan without protecting anything the server does not already show its auditors.\n */\nexport const seal = (values: Readonly<Record<string, string>>, salt?: string): string => {\n  if (Object.keys(values).length === 0) return '';\n  const bytes = salt === undefined ? randomBytes(16) : Buffer.from(salt, 'utf8');\n  return `${PREFIX}:${bytes.toString('base64url')}:${digest(bytes, values).toString('base64url')}`;\n};\n\n/**\n * Whether `values` are the ones `sealed` was made from.\n *\n * ⚠️ A MALFORMED OR EMPTY SEAL ANSWERS FALSE, never throws: callers decide what \"no evidence\"\n *   means, and every caller here treats it as \"cannot tell\" rather than as drift.\n */\nexport const sealMatches = (sealed: string, values: Readonly<Record<string, string>>): boolean => {\n  if (sealed === '') return Object.keys(values).length === 0;\n  const [prefix, salt, stored, extra] = sealed.split(':');\n  if (prefix !== PREFIX || salt === undefined || stored === undefined || extra !== undefined) {\n    return false;\n  }\n  const expected = Buffer.from(stored, 'base64url');\n  const actual = digest(Buffer.from(salt, 'base64url'), values);\n  return expected.length === actual.length && timingSafeEqual(expected, actual);\n};\n",
+    "/**\n * `Pbs.NotificationTarget`'s six vendor endpoints — one create and one update per family.\n *\n * 🔴 THIS FAMILY WAS THE ONE THE 2026-09-22 SWEEP NEARLY MISSED, and it carries the very\n *   parameter the incident was about: `comment` is `maxLength: 128` with a no-control-characters\n *   pattern on all three PBS creates, exactly as it is on `POST /config/verify`. A 129-character\n *   comment on a notification target would have failed the same way, half a deploy in, on the\n *   family whose whole purpose is to make failures visible.\n *\n * ⛔ PBS REGISTERS ONE PATH PER TYPE, NOT A `{type}` PARAMETER, and the three schemas differ:\n *   smtp requires `server` and `from-address`, webhook `url` and `method`, sendmail nothing but\n *   its name. One key would enforce one family's rules on all three.\n * ⛔ THE STRINGS MUST STAY LITERALS. `codegen/constraints.ts` finds the endpoints to table by\n *   SCANNING THIS PACKAGE'S TEXT, so a key built from `props.type` would be tabled by nothing.\n *\n * ⚠️ NO GOTIFY KEY, BECAUSE THIS RESOURCE HAS NO GOTIFY TYPE. `PbsNotificationTargetType` is\n *   sendmail | smtp | webhook; PBS 4.2 does publish a gotify endpoint, and nothing here writes to\n *   it. ⛔ `scripts/proxmox-ownership-pbs.ts` says otherwise — it claims all four families\n *   through the shared `notificationEndpoints` helper — so `docs/api-coverage.md` credits this\n *   resource with twelve write endpoints where it really makes nine. That is an overclaim in the\n *   hand-written ownership ledger, recorded here rather than fixed in passing: correcting it\n *   regenerates a report built from a DIFFERENT (older, 9.2.4) schema manifest, which is its own\n *   change with its own diff.\n */\nimport type { PbsNotificationTargetProps } from './pbs-notification-target.ts';\nimport type { EndpointPair } from './resource-spec.ts';\n\nconst ENDPOINTS: Readonly<Record<PbsNotificationTargetProps['type'], EndpointPair>> = {\n  sendmail: {\n    create: 'pbs:POST /config/notifications/endpoints/sendmail',\n    update: 'pbs:PUT /config/notifications/endpoints/sendmail/{name}',\n  },\n  smtp: {\n    create: 'pbs:POST /config/notifications/endpoints/smtp',\n    update: 'pbs:PUT /config/notifications/endpoints/smtp/{name}',\n  },\n  webhook: {\n    create: 'pbs:POST /config/notifications/endpoints/webhook',\n    update: 'pbs:PUT /config/notifications/endpoints/webhook/{name}',\n  },\n};\n\n/** The pair this declaration writes. ⚠️ `type` is identity here — changing it is a replace. */\nexport const pbsTargetEndpoint = (props: PbsNotificationTargetProps): EndpointPair =>\n  ENDPOINTS[props.type];\n",
+    "/**\n * A credential written as a LITERAL in a plain prop — refused, because a plain prop is a value in\n * the state store.\n *\n * ⛔ THE HOLE THIS CLOSES, MEASURED 2026-09-22 (adversarial review of PR 95). write-only.ts keeps\n *   every `{ fromEnv }` value out of state, and the doc WARNED that a plain header value is a prop.\n *   A warning is not a guard: `header: { Authorization: 'Bearer <token>' }` planned, deployed, and\n *   left the token in the dumped state store — and so did `url: 'https://…?token=<token>'`. Alchemy\n *   stores props unencrypted (write-only.ts has the StateEncoding reading), so the only safe\n *   literal is one that is not a credential.\n *\n * ★ WHAT COUNTS AS A CREDENTIAL IS A NAME, NOT A VALUE. A value cannot be recognised — a token is\n *   any string — but where it sits can: an `Authorization`/`Cookie` header, a header or query\n *   parameter whose name has a word like `token`, `key`, `secret`, `password` or `signature`, and a\n *   password in the URL's userinfo. A false positive costs one edit (declare it `{ fromEnv }`, or\n *   hold it in `secret` and write `{{ secrets.<name> }}`); a false negative costs a leaked token.\n * ★ A TEMPLATE THAT READS A SECRET IS NOT A LITERAL. `Bearer {{ secrets.token }}`, and\n *   `{{ url-encode secrets.token }}` in a query, render on PBS from the root-only secret store —\n *   the prop holds the reference, not the value.\n *\n * ⚠️ WHAT THIS CANNOT SEE: a token in a URL PATH (a Slack-style `/services/T…/B…/<token>`), in the\n *   `body`, or in a `comment`. Those are plain props too; put the token in `secret` and reference\n *   it from the template. docs/pbs-notifications.md says the same to the reader.\n * ⛔ A REFUSAL NAMES THE FIELD, NEVER THE VALUE — the message lands in a terminal and a CI log.\n */\nimport type { FromEnv } from '../secrets/write-only.ts';\n\n/** `{{ secrets.x }}`, `{{secrets.x}}`, `{{ url-encode secrets.x }}` — a reference, not a value. */\nconst READS_SECRET = /\\{\\{[^}]*\\bsecrets\\./;\n\n/** A whole-name match, or one dash/underscore-separated word of the name. */\nconst CREDENTIAL_WORD =\n  /(^|[-_])(api[-_]?key|apikey|key|token|secret|password|passwd|pwd|pass|auth|signature|sig|code)($|[-_])/i;\nconst CREDENTIAL_HEADER = /^(proxy-authorization|authorization|cookie)$/i;\n\nexport const isCredentialName = (name: string): boolean =>\n  CREDENTIAL_HEADER.test(name) || CREDENTIAL_WORD.test(name);\n\nconst literal = (value: string): boolean => value !== '' && !READS_SECRET.test(value);\n\n/** Plain header values that are credentials by their header's name. `{ fromEnv }` is never one. */\nexport const literalCredentialHeaders = (\n  header: Readonly<Record<string, FromEnv | string>> | undefined,\n): string[] =>\n  Object.entries(header ?? {})\n    .filter(([name, value]) => typeof value === 'string' && isCredentialName(name))\n    .filter(([, value]) => literal(value as string))\n    .map(([name]) => name)\n    .sort();\n\n/**\n * Where a URL carries a literal credential: `userinfo` (a password before the `@`), or the names\n * of credential-shaped query (or fragment) parameters. Parsed by hand, not with `new URL`: a URL here is a\n * TEMPLATE, and `{{ … }}` in the host or the userinfo is not a URL `new URL` will accept.\n */\nexport const literalCredentialsInUrl = (url: string | undefined): string[] => {\n  if (url === undefined) return [];\n  const out: string[] = [];\n  const authority = /^[a-z][a-z0-9+.-]*:\\/\\/([^/?#]*)/i.exec(url)?.[1] ?? '';\n  const at = authority.lastIndexOf('@');\n  if (at >= 0) {\n    const userinfo = authority.slice(0, at);\n    const colon = userinfo.indexOf(':');\n    if (colon >= 0 && literal(userinfo.slice(colon + 1))) out.push('userinfo');\n  }\n  // ⚠️ THE FRAGMENT TOO: it is never sent, but it is still a prop — and so still in state.\n  const params = url.replace(/^[^?#]*/, '');\n  for (const pair of params.split(/[?&#]/)) {\n    const eq = pair.indexOf('=');\n    const name = eq < 0 ? pair : pair.slice(0, eq);\n    if (eq >= 0 && isCredentialName(name) && literal(pair.slice(eq + 1))) out.push(`?${name}`);\n  }\n  return out;\n};\n",
     "/**\n * When a PBS notification target has changed, and the forms that change it.\n *\n * ★ THREE QUESTIONS, NOT ONE, because the three kinds of field can be checked three ways:\n *     plain   every field the server returns in full — compared by value, like any family here\n *     header  names from the read, values by digest (pbs-notification-target-wire.ts)\n *     sealed  secret values and the smtp password: the server returns names at best, so values\n *             are checked against the seal of what this provider last wrote (write-only.ts)\n *   Each answers `match`, `stale` or `unknown`; only `stale` writes. `unknown` is \"the plan cannot\n *   see it\" — a variable missing from the plan's environment, or a secret this provider never\n *   wrote (an adoption) — and it is PRESENCE-ONLY by design: a plan never invents drift it\n *   cannot see, and adoption stays free.\n *\n * ⛔ A WRITE SENDS ONLY THE GROUPS THAT ARE STALE. Omitting `header` or `secret` from a PUT keeps\n *   what the server holds (api/webhook.rs `update_endpoint`), so a changed comment is written\n *   without reading a single secret — and a deploy environment without the secrets can still\n *   repair the rest. A group that IS stale needs every value it holds; a missing one fails the\n *   deploy by variable name before anything is sent.\n */\nimport type { PveForm } from './client.ts';\nimport { literalCredentialHeaders, literalCredentialsInUrl } from './credential-literals.ts';\nimport { addressList } from './notification-target-form.ts';\nimport type {\n  PbsNotificationTargetAttributes,\n  PbsNotificationTargetProps,\n} from './pbs-notification-target.ts';\nimport { base64, headerDigest, names, wireItem } from './pbs-notification-target-wire.ts';\nimport { type Environment, type FromEnv, resolveAll, sealMatches } from '../secrets/write-only.ts';\n\ntype Props = PbsNotificationTargetProps;\ntype Field = keyof Props;\n\n/** Which family each optional field belongs to. A field outside its family is refused at plan. */\nconst OWNED: Readonly<Partial<Record<Field, readonly Props['type'][]>>> = {\n  author: ['sendmail', 'smtp'],\n  body: ['webhook'],\n  'from-address': ['sendmail', 'smtp'],\n  header: ['webhook'],\n  mailto: ['sendmail', 'smtp'],\n  'mailto-user': ['sendmail', 'smtp'],\n  method: ['webhook'],\n  mode: ['smtp'],\n  password: ['smtp'],\n  port: ['smtp'],\n  secret: ['webhook'],\n  server: ['smtp'],\n  url: ['webhook'],\n  username: ['smtp'],\n};\n\nconst REQUIRED: Readonly<Record<Props['type'], readonly Field[]>> = {\n  sendmail: [],\n  smtp: ['server', 'from-address'],\n  webhook: ['url', 'method'],\n};\n\n/** A header or secret name lands inside a property string, where `,` and `=` are syntax. */\nconst CLEAN_NAME = /^[^,=\\s]+$/;\n\n/** How a refused literal credential should be declared instead. */\nconst WRITE_ONLY =\n  \"declare it { fromEnv: 'NAME' }, or keep it in 'secret' and write {{ secrets.<name> }}\";\n\n/**\n * Why this declaration cannot be written, or nothing. Checked at PLAN, so a webhook without a\n * URL fails `alchemy plan` naming the field rather than a deploy failing on a 400.\n * ⚠️ \"AT PLAN\" MEANS `diff` FOR A TARGET WITH STATE AND THE ADOPTION PROBE (`read`) FOR ONE\n *   WITHOUT — pbs-notification-target-lifecycle.ts has why both are needed.\n */\nexport const refusals = (props: Props): string[] => {\n  const out: string[] = [];\n  for (const [field, types] of Object.entries(OWNED) as [Field, readonly Props['type'][]][]) {\n    if (props[field] !== undefined && !types.includes(props.type)) {\n      out.push(`'${field}' belongs to ${types.join('/')} targets, not ${props.type}`);\n    }\n  }\n  for (const field of REQUIRED[props.type]) {\n    if (props[field] === undefined || props[field] === '')\n      out.push(`${props.type} needs '${field}'`);\n  }\n  for (const key of [...Object.keys(props.header ?? {}), ...Object.keys(props.secret ?? {})]) {\n    if (!CLEAN_NAME.test(key)) out.push(`'${key}' cannot be a header or secret name`);\n  }\n  // ⛔ credential-literals.ts: a literal credential in a plain prop is a credential in state.\n  for (const name of literalCredentialHeaders(props.header)) {\n    out.push(`header '${name}' holds a literal credential; ${WRITE_ONLY}`);\n  }\n  for (const where of literalCredentialsInUrl(props.url)) {\n    out.push(`'url' ${where} holds a literal credential; ${WRITE_ONLY}`);\n  }\n  return out;\n};\n\nconst isFromEnv = (value: string | FromEnv): value is FromEnv => typeof value !== 'string';\n\n/** Each group's values, resolved from `env`, plus the variables that were missing. */\nexport const resolveGroups = (props: Props, env: Environment = process.env) => {\n  const headerRefs: Record<string, FromEnv> = {};\n  const headers: Record<string, string> = {};\n  for (const [name, value] of Object.entries(props.header ?? {})) {\n    if (isFromEnv(value)) headerRefs[name] = value;\n    else headers[name] = value;\n  }\n  const header = resolveAll(headerRefs, env);\n  const sealedRefs: Record<string, FromEnv> = {};\n  for (const [name, ref] of Object.entries(props.secret ?? {})) sealedRefs[`secret:${name}`] = ref;\n  if (props.password !== undefined) sealedRefs['password'] = props.password;\n  const sealed = resolveAll(sealedRefs, env);\n  return {\n    header: { missing: header.missing, values: { ...headers, ...header.values } },\n    sealed,\n  };\n};\n\nexport type Groups = ReturnType<typeof resolveGroups>;\nexport type GroupState = 'match' | 'stale' | 'unknown';\n\nconst same = (declared: string | undefined, live: string): boolean =>\n  declared === undefined || declared === live;\n\n/** Every field the server returns in full. `disable` is the one with no undeclared case. */\nexport const plainMatches = (live: PbsNotificationTargetAttributes, props: Props): boolean =>\n  live.disable === (props.disable === true) &&\n  same(props.comment, live.comment) &&\n  same(props.author, live.author) &&\n  same(props['from-address'], live['from-address']) &&\n  same(props.server, live.server) &&\n  (props.port === undefined || props.port === live.port) &&\n  same(props.mode, live.mode) &&\n  same(props.username, live.username) &&\n  same(props.url, live.url) &&\n  same(props.method, live.method) &&\n  same(props.body, live.body) &&\n  (props.mailto === undefined || addressList(props.mailto) === live.mailto) &&\n  (props['mailto-user'] === undefined || addressList(props['mailto-user']) === live['mailto-user']);\n\nexport const headerState = (\n  live: PbsNotificationTargetAttributes,\n  props: Props,\n  groups: Groups,\n): GroupState => {\n  if (props.header === undefined) return 'match';\n  if (names(Object.keys(props.header)) !== live.header) return 'stale';\n  if (groups.header.missing.length > 0) return 'unknown';\n  return headerDigest(props.name, groups.header.values) === live.headerDigest ? 'match' : 'stale';\n};\n\nexport const sealedState = (\n  live: PbsNotificationTargetAttributes,\n  props: Props,\n  groups: Groups,\n  sealed: string,\n): GroupState => {\n  if (props.secret === undefined && props.password === undefined) return 'match';\n  if (props.secret !== undefined && names(Object.keys(props.secret)) !== live.secret)\n    return 'stale';\n  if (groups.sealed.missing.length > 0 || sealed === '') return 'unknown';\n  return sealMatches(sealed, groups.sealed.values) ? 'match' : 'stale';\n};\n\n/** Which write-only groups a write carries. A create carries every declared one. */\nexport interface Carry {\n  readonly header: boolean;\n  readonly sealed: boolean;\n}\n\nconst secretItems = (props: Props, groups: Groups): string[] =>\n  Object.keys(props.secret ?? {}).map((name) =>\n    wireItem(name, groups.sealed.values[`secret:${name}`] ?? ''),\n  );\n\nconst headerItems = (props: Props, groups: Groups): string[] =>\n  Object.keys(props.header ?? {}).map((name) => wireItem(name, groups.header.values[name] ?? ''));\n\n/** `''`/`[]` means \"clear\": dropped on a create, turned into a `delete` entry on an update. */\nconst plainPairs = (props: Props): [string, string | readonly string[]][] => [\n  ['author', props.author ?? ''],\n  ['body', props.body === undefined ? '' : base64(props.body)],\n  ['comment', props.comment ?? ''],\n  ['from-address', props['from-address'] ?? ''],\n  ['method', props.method ?? ''],\n  ['mode', props.mode ?? ''],\n  ['port', props.port === undefined ? '' : String(props.port)],\n  ['server', props.server ?? ''],\n  ['url', props.url ?? ''],\n  ['username', props.username ?? ''],\n  ['mailto', props.mailto === undefined ? [] : addressList(props.mailto).split(',')],\n  [\n    'mailto-user',\n    props['mailto-user'] === undefined ? [] : addressList(props['mailto-user']).split(','),\n  ],\n];\n\nconst declared = (props: Props, key: string): boolean =>\n  (props as unknown as Record<string, unknown>)[key] !== undefined;\n\nconst empty = (value: string | readonly string[]): boolean =>\n  typeof value === 'string' ? value === '' : value.filter((item) => item !== '').length === 0;\n\n/**\n * The body of a create or an update — keys are the server's own, checked against generated/pbs.ts\n * by pbs-notification-target.test.ts. ⛔ `disable` IS ALWAYS SENT, `0` included — the PVE family's\n * reason: it is always compared, and \"undeclared\" and \"false\" must be one state, not a plan that\n * asks for an update the PUT never performs.\n */\nexport const targetForm = (\n  props: Props,\n  groups: Groups,\n  carry: Carry,\n  mode: 'create' | 'update',\n): PveForm => {\n  const form: Record<string, string | readonly string[]> = {\n    disable: props.disable === true ? '1' : '0',\n  };\n  const cleared: string[] = [];\n  const put = (key: string, value: string | readonly string[]) => {\n    if (!empty(value)) form[key] = value;\n    else if (mode === 'update') cleared.push(key);\n  };\n  for (const [key, value] of plainPairs(props)) if (declared(props, key)) put(key, value);\n  if (carry.header && props.header !== undefined) put('header', headerItems(props, groups));\n  if (carry.sealed && props.secret !== undefined) put('secret', secretItems(props, groups));\n  if (carry.sealed && props.password !== undefined) {\n    form['password'] = groups.sealed.values['password'] ?? '';\n  }\n  if (mode === 'create') form['name'] = props.name;\n  if (cleared.length > 0) form['delete'] = cleared;\n  return form;\n};\n",
-    "/**\n * `Pbs.PruneJob` — a Proxmox Backup Server retention schedule, declared. PBS is a SIBLING of PVE,\n * so this family reuses `pveHandlers` wholesale rather than growing a second factory.\n *\n * ⛔ THIS IS THE ONE RESOURCE IN THIS PACKAGE THAT DESTROYS DATA ON AN ORDINARY *UPDATE*. CephPool,\n *   ZfsPool and Storage can destroy data too — which is exactly why they default to `retain` and\n *   make a caller opt in with `destroy()`, and that guard covers DELETE and nothing else. Here the\n *   destruction rides a plain `1 to update` that no removal policy has any opinion about. A wrong\n *   `keep-*` does not fail: it succeeds. The PUT returns 200, and the NEXT SCHEDULED RUN — minutes\n *   or days later, with nobody watching — removes every snapshot that fell outside the new window.\n *   There is no undo, PBS does not ask, and nothing about the deploy looks unusual.\n *   ★ CONCRETELY, SO NOBODY HAS TO IMAGINE IT: a live job with `keep-daily 30`, a declaration\n *     saying `keep-daily: 7`. `matches` reports an update, the PUT lands, and twenty-three days of\n *     daily backups are gone at the next run. The plan showed one word. READ THE `keep-*` HALF OF\n *     EVERY PLAN TWICE; it is the only warning there is.\n *   ⚠️ THE ONE THING THAT CANNOT HAPPEN IS A SILENT ZERO. MEASURED from the published schema: every\n *     `keep-*` carries `minimum: 1`, so a literal `keep-daily=0` is a 400 rather than a wipe. And\n *     an UNDECLARED window is not sent as zero either — it is not sent at all, because undeclared\n *     means unmanaged here exactly as it does in storage.ts. A window this stack never named is one\n *     it never narrows. `0` in the attributes below therefore means ABSENT, never a real setting.\n *\n * ⛔ `max-depth` UNSET IS THE WIDEST SCOPE, NOT THE NARROWEST, AND IT IS THE ONE FIELD WHERE\n *   \"UNMANAGED\" IS NOT THE SAFE ANSWER. MEASURED, quoting the published schema's own description:\n *   \"0 == no recursion, empty == automatic full recursion\". So a job that names an `ns` but leaves\n *   `max-depth` alone prunes every namespace BENEATH that one too, with these windows. Declare it.\n *   `-1` in the attributes means \"absent from prune.cfg\", the sentinel storage.ts uses for\n *   `maxfiles`, because `0` here is a real and very different setting.\n *\n * ⛔ THE CREDENTIAL DOES NOT EXIST YET, SO NOTHING BELOW HAS EVER MADE A CALL. PBS is a different\n *   host and a different auth realm from PVE. MEASURED 2026-09-13: pbs.example.com:8007 answers\n *   HTTP 401 under STRICT TLS behind a real Let's Encrypt certificate (CN=pbs.example.com, issuer\n *   YR1, valid 2026-09-02 to 2026-12-01) — so there is no `-k` to reach for and `client.ts` needs\n *   no TLS escape hatch, exactly as on PVE. What it does need is a header it cannot build today.\n *   PBS's documented form is `Authorization: PBSAPIToken=TOKENID:TOKENSECRET` (measured from the\n *   published PBS documentation, 2026-09-13) while `authorization()` in credentials.ts builds\n *   `PVEAPIToken=<tokenid>=<secret>`: BOTH the scheme and the separator differ. A wrong separator\n *   answers 401 \"authentication failure\", which reads as a bad credential rather than as a\n *   malformed header — the same trap credentials.ts already records for PVE's colon form.\n *   ⛔ AND THERE IS NO MOUNT TO MINT FROM. `mint()` runs `bao read <mount>/creds/<role>`; no\n *     OpenBao mount vends PBS tokens — `proxmox-c1` and `proxmox-c2` vend PVE ones. The\n *     `kv/infra/proxmox` shelf holds a READ-ONLY `Audit` token for PBS, and a read-only token\n *     cannot create a prune job. I could not confirm that shelf's contents: this machine's\n *     agent approle answers 403 on `sys/mounts` AND on `kv/metadata/infra/proxmox`\n *     (MEASURED). What is needed is a dynamic PBS mount vending a `provision` role with\n *     `Datastore.Modify` — say that, rather than reaching for the stored auditor token.\n *\n * ★ WHAT A `PbsTarget` NEEDS, AND WHY IT IS ALMOST `PveTarget`. Structurally `PveTarget` already\n *   fits a PBS host: a credential mount name and an `/api2/json` base are the whole of it, and PBS\n *   shares the `{\"data\": …}` envelope, the four-operation shape and the read-back discipline —\n *   which is exactly why this file declares a spec and stops. The single thing `PveTarget` cannot\n *   carry is WHICH AUTHORIZATION SCHEME the host at the other end speaks, so `PbsTarget` below adds\n *   that and nothing else rather than bending the PVE type in silence.\n *\n * ⚠️ WHICH VERSION THIS IS AUTHORED AGAINST, BECAUSE PRUNE JOBS MOVED. The paths and every field\n *   below are MEASURED from the PBS API as published at pbs.proxmox.com/docs/api-viewer, fetched\n *   2026-09-13 — current PBS 4.x. Before PBS 2.2 there was no `/config/prune` at all: retention\n *   lived on the datastore section itself, as `keep-*` plus `prune-schedule` under\n *   `/config/datastore/{name}`. Against anything older every path here 404s, `pveOperations.read`\n *   folds that into \"absent\", and the plan says create forever. Check `GET /api2/json/version`\n *   before the first plan.\n *\n * ★ THE READ LANE NEEDS NOTHING EXTRA, UNLIKE THREE PVE FAMILIES — so there is no `readRole:\n *   'provision'` below and there should not be one. MEASURED: `GET /config/prune/{id}` requires\n *   \"Datastore.Audit or Datastore.Verify on job's datastore\", i.e. the AUDIT privilege is enough\n *   for the ITEM read. That is precisely what `Proxmox.Storage` and the two SDN families could not\n *   say, and it is why the ⛔ on `readRole` in resource.ts does not claim a fourth family here.\n *   ⚠️ THE WRITE PRIVILEGES ARE NOT ONE PRIVILEGE, AND DELETE IS THE ODD ONE OUT. MEASURED: POST\n *     and PUT require `Datastore.Modify` on the job's datastore; DELETE requires `Datastore.Verify`.\n *     A credential that can create and edit a prune job cannot necessarily remove one, and the\n *     symptom is a destroy that 403s long after the creates worked.\n *\n * ⚠️ RUNTIME STATUS IS NOT HERE AND WAS NOT FORGOTTEN. `last-run-endtime` and friends come from\n *   `/admin/prune`, not from this endpoint: MEASURED, `GET /config/prune/{id}` returns exactly\n *   comment, disable, id, the six keep-*, max-depth, ns, schedule and store — no digest, no status.\n *   Reporting a last-run time would make a plan's output change when nothing changed, and a plan\n *   whose output moves on its own is one people stop reading. `/admin/prune/{id}/run` triggers a\n *   prune by hand and is deliberately not modelled: running one is an act, not a declaration.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type { PbsTarget } from './credentials.ts';\nimport { createBody, keepAttributes, keepsMatch, updateBody } from './pbs-prune-job-form.ts';\nimport { type PveRequirements, type WithPbsTarget, pveHandlers } from './resource.ts';\nimport { bool, int, text } from './values.ts';\n\n/**\n * ⚠️ THE PROPS ARE PBS'S OWN KEY NAMES, HYPHENS INCLUDED, for backup-job.ts's reason: the form\n *   builder is then a copy rather than a translation table, and a translation table is one more\n *   place for a key to be renamed and silently never sent. Here a field that is never sent is a\n *   retention window that never applies.\n */\nexport interface PruneJobProps extends WithPbsTarget {\n  /** ⛔ A PBS host, not a PVE one. See `PbsTarget` and the credential ⛔ in the header. */\n  target: PbsTarget;\n  /**\n   * ⛔ The primary key, REQUIRED, and PBS does not generate one. Measured: 3–32 chars matching\n   * `^[A-Za-z0-9_][A-Za-z0-9._\\-]*$`. To adopt a job that exists, declare its existing id — any\n   * other id is a SECOND prune job on the same datastore, and two prune jobs do not negotiate.\n   */\n  id: string;\n  /** ⚠️ The datastore this prunes. Changing it re-points the job rather than adding one: the old\n   * store stops being pruned and the new one starts, with these windows, at the next run. */\n  store: string;\n  /**\n   * A systemd calendar event, e.g. `daily` or `sat 02:30`. ⛔ REQUIRED — measured, it is the one\n   * non-optional field of `POST /config/prune` besides `id` and `store`, and it is NOT in the PUT\n   * `delete` enum, so there is no way to un-schedule a job short of disabling or removing it.\n   * ⚠️ THIS COMPARES STRINGS, NOT MEANINGS. A calendar event has many equivalent spellings and PBS\n   *   stores the one it was handed; declare the spelling the server echoes back.\n   */\n  schedule: string;\n  /** Namespace to prune, `''` or unset for the root one. ⚠️ Scope, so read it with `max-depth`. */\n  ns?: string;\n  /** ⛔ UNSET MEANS FULL RECURSION, NOT NONE — see the ⛔ in the header. 0–7. Declare it. */\n  'max-depth'?: number;\n  /** ⚠️ Undeclared is UNMANAGED, so a job somebody disabled by hand stays disabled. That is the\n   * deliberate direction for a destructive job: never switch one on that nobody asked for. */\n  disable?: boolean;\n  comment?: string;\n  /** ⚠️ Every window below is `minimum: 1` (measured) and undeclared means unmanaged. */\n  'keep-last'?: number;\n  'keep-hourly'?: number;\n  'keep-daily'?: number;\n  'keep-weekly'?: number;\n  'keep-monthly'?: number;\n  'keep-yearly'?: number;\n}\n\nexport interface PruneJobAttributes {\n  id: string;\n  store: string;\n  schedule: string;\n  ns: string;\n  /** ⚠️ `-1` is ABSENT — and absent means full recursion. `0` is the real \"no recursion\" setting. */\n  'max-depth': number;\n  disable: boolean;\n  comment: string;\n  /** ⚠️ `0` is ABSENT in all six. PBS's own minimum is 1, so zero can never be a live value. */\n  'keep-last': number;\n  'keep-hourly': number;\n  'keep-daily': number;\n  'keep-weekly': number;\n  'keep-monthly': number;\n  'keep-yearly': number;\n}\n\nexport interface PbsPruneJob extends Resource<\n  'Pbs.PruneJob',\n  PruneJobProps,\n  PruneJobAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ★ NO `defaultRemovalPolicy: 'retain'`, UNLIKE Storage AND ZfsPool, AND THE REASON IS THE REVERSE\n *   OF THEIRS. Destroying this resource destroys a POLICY, and a policy is a line of TypeScript.\n *   The archives it would have trimmed are not touched by the DELETE — see the ⚠️ on the provider.\n */\nexport const PbsPruneJob = Resource<PbsPruneJob>('Pbs.PruneJob');\n\n/** \"Not declared, or equal\" — the single shape every unmanaged field is compared with. */\nconst same = <T>(declared: T | undefined, live: T) => declared === undefined || declared === live;\n\nconst handlers = pveHandlers<PruneJobProps, PruneJobAttributes>({\n  /**\n   * ⚠️ EVERY OPTIONAL FIELD FALLS BACK TO ITS ABSENT SENTINEL RATHER THAN TO PBS'S DEFAULT, because\n   *   for this family the two are different questions. `keep-daily` absent does not mean \"keep zero\n   *   dailies\", it means \"this window is not part of the policy\", and `matches` must not compare a\n   *   window the declaration never mentioned against an invented value.\n   * ⛔ NO \"IS IT REALLY THERE\" GUARD, for backup-job.ts's reason: returning undefined for a job\n   *   whose JSON is missing a key would be a guess about which keys PBS echoes, and a wrong guess\n   *   sends reconcile down the POST branch — which creates ANOTHER prune job rather than failing.\n   */\n  attributes: (live, props) => ({\n    comment: text(live['comment'], ''),\n    disable: bool(live['disable'], false),\n    id: props.id,\n    ...keepAttributes(live),\n    'max-depth': int(live['max-depth'], -1),\n    ns: text(live['ns'], ''),\n    schedule: text(live['schedule'], ''),\n    store: text(live['store'], props.store),\n  }),\n  collection: () => 'config/prune',\n  createForm: createBody,\n  /**\n   * ⚠️ THE UNDECLARED HALF IS NOT COMPARED, AND THAT IS THE WHOLE SAFETY MODEL. `same` reads \"not\n   *   declared, or equal\", so a field set by hand on an adopted job survives adoption untouched and\n   *   never appears as drift. `keepsMatch` applies the identical rule to the six windows, from the\n   *   file that also writes and reads them — see the ★ at the top of pbs-prune-job-form.ts.\n   * ⚠️ `store` AND `schedule` HAVE NO UNDECLARED CASE because both are required props, so both are\n   *   compared unconditionally. A changed `store` is an update, not a replace: PBS accepts `store`\n   *   on PUT, so the job is re-pointed in place.\n   */\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: { create: 'pbs:POST /config/prune', update: 'pbs:PUT /config/prune/{id}' },\n  matches: (attributes, props) =>\n    attributes.schedule === props.schedule &&\n    attributes.store === props.store &&\n    same(props.ns, attributes.ns) &&\n    same(props['max-depth'], attributes['max-depth']) &&\n    same(props.disable, attributes.disable) &&\n    same(props.comment, attributes.comment) &&\n    keepsMatch(attributes, props),\n  path: (props) => `config/prune/${props.id}`,\n  updateForm: updateBody,\n});\n\n/**\n * ⛔ `list` IS EMPTY like every other family here, and the stakes are the usual ones read backwards.\n *   `GET /config/prune` hands back every prune job on the server, the ones an operator tuned by\n *   hand included. Adopting those would give Alchemy the right to REWRITE their retention the first\n *   time a declaration disagreed — and rewriting retention is deleting backups. Adoption stays an\n *   explicit act: name the id you mean.\n *\n * ⚠️ THE DELETE IS THE SAFE DIRECTION, AND IT IS STILL NOT FREE. Removing a prune job deletes\n *   NOTHING: the archives that survived the last run stay exactly where they are. What goes away is\n *   the only thing trimming that datastore, so the failure mode is a datastore that fills up weeks\n *   later — an outage with no obvious cause and no backup written during it. Nothing on the server\n *   depends on a prune job, so PBS will not refuse this the way PVE refuses to delete a pool still\n *   holding guests; the plan line is the only warning anyone gets.\n *   ⚠️ DELETE ALSO NEEDS A DIFFERENT PRIVILEGE FROM THE WRITES — `Datastore.Verify`, not\n *     `Datastore.Modify`. See the ⚠️ in the header before assuming a working create means a working\n *     destroy.\n */\nexport const PbsPruneJobProvider = () =>\n  Provider.effect(PbsPruneJob, Effect.succeed(PbsPruneJob.Provider.of(handlers)));\n",
+    "/**\n * `Pbs.PruneJob` — a Proxmox Backup Server retention schedule, declared. PBS is a SIBLING of PVE,\n * and this family uses its own distilled SDK's typed config operations (PBS 4.2.6-1).\n *\n * ⛔ THIS IS THE ONE RESOURCE IN THIS PACKAGE THAT DESTROYS DATA ON AN ORDINARY *UPDATE*. CephPool,\n *   ZfsPool and Storage can destroy data too — which is exactly why they default to `retain` and\n *   make a caller opt in with `destroy()`, and that guard covers DELETE and nothing else. Here the\n *   destruction rides a plain `1 to update` that no removal policy has any opinion about. A wrong\n *   `keep-*` does not fail: it succeeds. The PUT returns 200, and the NEXT SCHEDULED RUN — minutes\n *   or days later, with nobody watching — removes every snapshot that fell outside the new window.\n *   There is no undo, PBS does not ask, and nothing about the deploy looks unusual.\n *   ★ CONCRETELY, SO NOBODY HAS TO IMAGINE IT: a live job with `keep-daily 30`, a declaration\n *     saying `keep-daily: 7`. `matches` reports an update, the PUT lands, and twenty-three days of\n *     daily backups are gone at the next run. The plan showed one word. READ THE `keep-*` HALF OF\n *     EVERY PLAN TWICE; it is the only warning there is.\n *   ⚠️ THE ONE THING THAT CANNOT HAPPEN IS A SILENT ZERO. MEASURED from the published schema: every\n *     `keep-*` carries `minimum: 1`, so a literal `keep-daily=0` is a 400 rather than a wipe. And\n *     an UNDECLARED window is not sent as zero either — it is not sent at all, because undeclared\n *     means unmanaged here exactly as it does in storage.ts. A window this stack never named is one\n *     it never narrows. `0` in the attributes below therefore means ABSENT, never a real setting.\n *\n * ⛔ `max-depth` UNSET IS THE WIDEST SCOPE, NOT THE NARROWEST, AND IT IS THE ONE FIELD WHERE\n *   \"UNMANAGED\" IS NOT THE SAFE ANSWER. MEASURED, quoting the published schema's own description:\n *   \"0 == no recursion, empty == automatic full recursion\". So a job that names an `ns` but leaves\n *   `max-depth` alone prunes every namespace BENEATH that one too, with these windows. Declare it.\n *   `-1` in the attributes means \"absent from prune.cfg\", the sentinel storage.ts uses for\n *   `maxfiles`, because `0` here is a real and very different setting.\n *\n * ⚠️ HISTORICAL BOOTSTRAP BLOCKER, 2026-09-13: PBS was a different\n *   host and auth realm from PVE. The later PBS credential lane and SDK resolved this blocker.\n *   MEASURED 2026-09-13: pbs.example.com:8007 answers\n *   HTTP 401 under STRICT TLS behind a real Let's Encrypt certificate (CN=pbs.example.com, issuer\n *   YR1, valid 2026-09-02 to 2026-12-01) — so there is no `-k` to reach for and `client.ts` needs\n *   no TLS escape hatch, exactly as on PVE. What it does need is a header it cannot build today.\n *   PBS's documented form is `Authorization: PBSAPIToken=TOKENID:TOKENSECRET` (measured from the\n *   published PBS documentation, 2026-09-13) while `authorization()` in credentials.ts builds\n *   `PVEAPIToken=<tokenid>=<secret>`: BOTH the scheme and the separator differ. A wrong separator\n *   answers 401 \"authentication failure\", which reads as a bad credential rather than as a\n *   malformed header — the same trap credentials.ts already records for PVE's colon form.\n *   ⛔ AND THERE IS NO MOUNT TO MINT FROM. `mint()` runs `bao read <mount>/creds/<role>`; no\n *     OpenBao mount vends PBS tokens — `proxmox-c1` and `proxmox-c2` vend PVE ones. The\n *     `kv/infra/proxmox` shelf holds a READ-ONLY `Audit` token for PBS, and a read-only token\n *     cannot create a prune job. I could not confirm that shelf's contents: this machine's\n *     agent approle answers 403 on `sys/mounts` AND on `kv/metadata/infra/proxmox`\n *     (MEASURED). What is needed is a dynamic PBS mount vending a `provision` role with\n *     `Datastore.Modify` — say that, rather than reaching for the stored auditor token.\n *\n * ★ WHAT A `PbsTarget` NEEDS, AND WHY IT IS ALMOST `PveTarget`. Structurally `PveTarget` already\n *   fits a PBS host: a credential mount name and an `/api2/json` base are the whole of it, and PBS\n *   shares the `{\"data\": …}` envelope, the four-operation shape and the read-back discipline —\n *   which is why the pure spec survives the SDK transport migration. The single thing `PveTarget` cannot\n *   carry is WHICH AUTHORIZATION SCHEME the host at the other end speaks, so `PbsTarget` below adds\n *   that and nothing else rather than bending the PVE type in silence.\n *\n * ⚠️ WHICH VERSION THIS IS AUTHORED AGAINST, BECAUSE PRUNE JOBS MOVED. The paths and every field\n *   below are MEASURED from the PBS API as published at pbs.proxmox.com/docs/api-viewer, fetched\n *   2026-09-13 — current PBS 4.x. Before PBS 2.2 there was no `/config/prune` at all: retention\n *   lived on the datastore section itself, as `keep-*` plus `prune-schedule` under\n *   `/config/datastore/{name}`. The old `pveOperations.read` folded those 404s into \"absent\",\n *   producing a create forever. The SDK path now propagates an unknown route's 404; only the\n *   vendor's typed missing-prune response means absent. Check the PBS version before planning.\n *\n * ★ THE READ LANE NEEDS NOTHING EXTRA, UNLIKE THREE PVE FAMILIES — so there is no `readRole:\n *   'provision'` below and there should not be one. MEASURED: `GET /config/prune/{id}` requires\n *   \"Datastore.Audit or Datastore.Verify on job's datastore\", i.e. the AUDIT privilege is enough\n *   for the ITEM read. That is precisely what `Proxmox.Storage` and the two SDN families could not\n *   say, and it is why the ⛔ on `readRole` in resource.ts does not claim a fourth family here.\n *   ⚠️ THE WRITE PRIVILEGES ARE NOT ONE PRIVILEGE, AND DELETE IS THE ODD ONE OUT. MEASURED: POST\n *     and PUT require `Datastore.Modify` on the job's datastore; DELETE requires `Datastore.Verify`.\n *     A credential that can create and edit a prune job cannot necessarily remove one, and the\n *     symptom is a destroy that 403s long after the creates worked.\n *\n * ⚠️ RUNTIME STATUS IS NOT HERE AND WAS NOT FORGOTTEN. `last-run-endtime` and friends come from\n *   `/admin/prune`, not from this endpoint: MEASURED, `GET /config/prune/{id}` returns exactly\n *   comment, disable, id, the six keep-*, max-depth, ns, schedule and store — no digest, no status.\n *   Reporting a last-run time would make a plan's output change when nothing changed, and a plan\n *   whose output moves on its own is one people stop reading. `/admin/prune/{id}/run` triggers a\n *   prune by hand and is deliberately not modelled: running one is an act, not a declaration.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { handlers } from './pbs-prune-job-lifecycle.ts';\nimport type { PbsTarget } from './credentials.ts';\nimport type { PveRequirements, WithPbsTarget } from './resource-spec.ts';\n\n/**\n * ⚠️ THE PROPS ARE PBS'S OWN KEY NAMES, HYPHENS INCLUDED, for backup-job.ts's reason: the form\n *   builder is then a copy rather than a translation table, and a translation table is one more\n *   place for a key to be renamed and silently never sent. Here a field that is never sent is a\n *   retention window that never applies.\n */\nexport interface PruneJobProps extends WithPbsTarget {\n  /** ⛔ A PBS host, not a PVE one. See `PbsTarget` and the credential ⛔ in the header. */\n  target: PbsTarget;\n  /**\n   * ⛔ The primary key, REQUIRED, and PBS does not generate one. Measured: 3–32 chars matching\n   * `^[A-Za-z0-9_][A-Za-z0-9._\\-]*$`. To adopt a job that exists, declare its existing id — any\n   * other id is a SECOND prune job on the same datastore, and two prune jobs do not negotiate.\n   */\n  id: string;\n  /** ⚠️ The datastore this prunes. Changing it re-points the job rather than adding one: the old\n   * store stops being pruned and the new one starts, with these windows, at the next run. */\n  store: string;\n  /**\n   * A systemd calendar event, e.g. `daily` or `sat 02:30`. ⛔ REQUIRED — measured, it is the one\n   * non-optional field of `POST /config/prune` besides `id` and `store`, and it is NOT in the PUT\n   * `delete` enum, so there is no way to un-schedule a job short of disabling or removing it.\n   * ⚠️ THIS COMPARES STRINGS, NOT MEANINGS. A calendar event has many equivalent spellings and PBS\n   *   stores the one it was handed; declare the spelling the server echoes back.\n   */\n  schedule: string;\n  /** Namespace to prune, `''` or unset for the root one. ⚠️ Scope, so read it with `max-depth`. */\n  ns?: string;\n  /** ⛔ UNSET MEANS FULL RECURSION, NOT NONE — see the ⛔ in the header. 0–7. Declare it. */\n  'max-depth'?: number;\n  /** ⚠️ Undeclared is UNMANAGED, so a job somebody disabled by hand stays disabled. That is the\n   * deliberate direction for a destructive job: never switch one on that nobody asked for. */\n  disable?: boolean;\n  comment?: string;\n  /** ⚠️ Every window below is `minimum: 1` (measured) and undeclared means unmanaged. */\n  'keep-last'?: number;\n  'keep-hourly'?: number;\n  'keep-daily'?: number;\n  'keep-weekly'?: number;\n  'keep-monthly'?: number;\n  'keep-yearly'?: number;\n}\n\nexport interface PruneJobAttributes {\n  id: string;\n  store: string;\n  schedule: string;\n  ns: string;\n  /** ⚠️ `-1` is ABSENT — and absent means full recursion. `0` is the real \"no recursion\" setting. */\n  'max-depth': number;\n  disable: boolean;\n  comment: string;\n  /** ⚠️ `0` is ABSENT in all six. PBS's own minimum is 1, so zero can never be a live value. */\n  'keep-last': number;\n  'keep-hourly': number;\n  'keep-daily': number;\n  'keep-weekly': number;\n  'keep-monthly': number;\n  'keep-yearly': number;\n}\n\nexport interface PbsPruneJob extends Resource<\n  'Pbs.PruneJob',\n  PruneJobProps,\n  PruneJobAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ★ NO `defaultRemovalPolicy: 'retain'`, UNLIKE Storage AND ZfsPool, AND THE REASON IS THE REVERSE\n *   OF THEIRS. Destroying this resource destroys a POLICY, and a policy is a line of TypeScript.\n *   The archives it would have trimmed are not touched by the DELETE — see the ⚠️ on the provider.\n */\nexport const PbsPruneJob = Resource<PbsPruneJob>('Pbs.PruneJob');\n\n/**\n * ⛔ `list` IS EMPTY like every other family here, and the stakes are the usual ones read backwards.\n *   `GET /config/prune` hands back every prune job on the server, the ones an operator tuned by\n *   hand included. Adopting those would give Alchemy the right to REWRITE their retention the first\n *   time a declaration disagreed — and rewriting retention is deleting backups. Adoption stays an\n *   explicit act: name the id you mean.\n *\n * ⚠️ THE DELETE IS THE SAFE DIRECTION, AND IT IS STILL NOT FREE. Removing a prune job deletes\n *   NOTHING: the archives that survived the last run stay exactly where they are. What goes away is\n *   the only thing trimming that datastore, so the failure mode is a datastore that fills up weeks\n *   later — an outage with no obvious cause and no backup written during it. Nothing on the server\n *   depends on a prune job, so PBS will not refuse this the way PVE refuses to delete a pool still\n *   holding guests; the plan line is the only warning anyone gets.\n *   ⚠️ DELETE ALSO NEEDS A DIFFERENT PRIVILEGE FROM THE WRITES — `Datastore.Verify`, not\n *     `Datastore.Modify`. See the ⚠️ in the header before assuming a working create means a working\n *     destroy.\n */\nexport const PbsPruneJobProvider = () =>\n  Provider.effect(PbsPruneJob, Effect.succeed(PbsPruneJob.Provider.of(handlers)));\n",
+    "/** PBS 4.2.6-1 prune lifecycle; the SDK owns serialization and typed API errors. */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport { specGuards } from './resource-guard.ts';\nimport type { PruneJobAttributes, PruneJobProps } from './pbs-prune-job.ts';\nimport { spec } from './pbs-prune-job-spec.ts';\nimport { createOne, deleteOne, readOne, updateOne } from './pbs-prune-job-wire.ts';\n\nconst { guardCreate, guardUpdate } = specGuards(spec);\n\nexport const handlers = {\n  // ⛔ Explicit adoption only: a listed job may be somebody else's only backup policy.\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: PruneJobProps }) => readOne(olds),\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<PruneJobProps>;\n    output: PruneJobAttributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      if (!isResolved(news)) return undefined;\n      yield* guardCreate(news, output === undefined);\n      yield* guardUpdate(news);\n      if (output === undefined) return undefined;\n      const live = yield* readOne(news);\n      if (live === undefined) {\n        yield* guardCreate(news, true);\n        return { action: 'update' } as const;\n      }\n      return { action: spec.matches(live, news) ? 'noop' : 'update' } as const;\n    }),\n  reconcile: ({ news }: { news: PruneJobProps }) =>\n    Effect.gen(function* () {\n      const live = yield* readOne(news);\n      yield* guardCreate(news, live === undefined);\n      yield* guardUpdate(news);\n      if (live === undefined) yield* createOne(news);\n      else if (!spec.matches(live, news)) yield* updateOne(news);\n      // ⛔ A successful write is not evidence of a job; read it back through the SDK.\n      const after = yield* readOne(news);\n      if (after === undefined) {\n        return yield* Effect.fail(\n          new Error(`${spec.path(news)}: write succeeded but job is absent.`),\n        );\n      }\n      return after;\n    }),\n  delete: ({ olds }: { olds: PruneJobProps }) => deleteOne(olds),\n};\n",
     "/**\n * A prune job's wire half — and, deliberately, EVERY LINE THAT CAN DELETE A BACKUP.\n *\n * ★ SPLIT OUT OF pbs-prune-job.ts ON THE SEAM replication-job-form.ts USES: that file answers\n *   \"what is a prune job and when has it changed\", this one answers \"how does a declaration become\n *   a PBS write\". The one deliberate departure from that seam is `keepsMatch`, which is diff logic\n *   and lives here anyway — see the ★ below, which is the reason the cut falls where it does.\n *\n * ★ THE SIX RETENTION WINDOWS ARE TOUCHED IN THREE PLACES AND ALL THREE ARE IN THIS FILE: sent by\n *   `keepForm`, read back by `keepAttributes`, compared by `keepsMatch`. The three must stay in\n *   step — a window written but not compared is a diff that never settles, and one compared but not\n *   written is an update reported on every plan forever — and this is the half of the resource\n *   where being wrong costs backups rather than a confusing plan. Keeping all three on one screen\n *   is what makes that review possible in one sitting instead of a grep across two files.\n *\n * ⚠️ THE `import type` BACK TO pbs-prune-job.ts IS A CYCLE ON PAPER ONLY. It is type-only, erased\n *   before anything runs, so `PruneJobProps` stays the resource's public shape in the file that\n *   declares the resource rather than being moved somewhere odd to dodge the arrow.\n *\n * ⚠️ FORM ENCODING IS THE ONE TRANSPORT ASSUMPTION THIS FAMILY RESTS ON, AND IT IS REASONED RATHER\n *   THAN MEASURED. `pveWith` sends `application/x-www-form-urlencoded`; PBS's REST server accepts\n *   that alongside JSON and parses each value through the parameter schema, which is how its own\n *   ExtJS GUI talks to it. I could not prove it: there is no credential for this host (see the ⛔ in\n *   pbs-prune-job.ts) and the only unauthenticated endpoint that would have distinguished a 400\n *   \"bad parameters\" from a 401 is the login form, which is not a thing to poke on a live box. If\n *   PBS turns out to want JSON here, every key and value below is still right and only the\n *   transport is wrong — VERIFY THIS FIRST, before anything else in these two files.\n */\nimport type { PruneJobAttributes, PruneJobProps } from './pbs-prune-job.ts';\nimport { flag, int } from './values.ts';\n\n/**\n * The six retention windows, in PBS's own spelling.\n *\n * ⚠️ ONE LIST, READ THREE TIMES — by `keepForm` on the way to the wire, by `keepsMatch` on the way\n *   back, and by `keepsSomething` in the guard. Two hand-kept copies of six key names is how a\n *   seventh window gets added to one of them and silently never sent, which for this family means\n *   never applied and never noticed until a restore.\n */\nexport const KEEP_KEYS = [\n  'keep-last',\n  'keep-hourly',\n  'keep-daily',\n  'keep-weekly',\n  'keep-monthly',\n  'keep-yearly',\n] as const;\n\nexport type KeepKey = (typeof KEEP_KEYS)[number];\n\n/** ⚠️ Undeclared windows are simply absent — see `requireKeeps` for why zero is never sent. */\nconst keepForm = (props: PruneJobProps): Record<string, string> => {\n  const form: Record<string, string> = {};\n  for (const key of KEEP_KEYS) {\n    const value = props[key];\n    if (value !== undefined) form[key] = String(value);\n  }\n  return form;\n};\n\n/**\n * The six windows off the wire, where `0` MEANS ABSENT.\n *\n * ⛔ ZERO IS A SENTINEL HERE AND CAN NEVER BE A LIVE VALUE, which is the only reason it is safe to\n *   use one. MEASURED from the published PBS schema: every `keep-*` carries `minimum: 1`, so PBS\n *   cannot store a zero and cannot be sent one — `keep-daily=0` is a 400, not a wipe. A field that\n *   comes back missing is a window that is not part of this job's policy, and `keepsMatch` must be\n *   able to tell that apart from \"the declaration asked for zero\", which it cannot express either.\n */\nexport const keepAttributes = (\n  live: Record<string, unknown>,\n): Pick<PruneJobAttributes, KeepKey> => ({\n  'keep-daily': int(live['keep-daily'], 0),\n  'keep-hourly': int(live['keep-hourly'], 0),\n  'keep-last': int(live['keep-last'], 0),\n  'keep-monthly': int(live['keep-monthly'], 0),\n  'keep-weekly': int(live['keep-weekly'], 0),\n  'keep-yearly': int(live['keep-yearly'], 0),\n});\n\n/**\n * ⚠️ AN UNDECLARED WINDOW IS NOT COMPARED, AND THAT IS THE SAFETY MODEL RATHER THAN AN OVERSIGHT.\n *   A `keep-weekly` an operator set by hand on an adopted job is not drift this stack repairs —\n *   repairing it would mean narrowing retention nobody asked to narrow. The cost is stated rather\n *   than hidden: deleting a `keep-daily` line from a declaration plans as a NOOP and changes\n *   nothing on the server. See the ⛔ on `updateBody` for why clearing is a hand operation.\n */\nexport const keepsMatch = (attributes: Pick<PruneJobAttributes, KeepKey>, props: PruneJobProps) =>\n  KEEP_KEYS.every((key) => props[key] === undefined || props[key] === attributes[key]);\n\n/**\n * ⛔ A PRUNE JOB WITH NO `keep-*` KEEPS NOTHING, AND THIS REFUSES TO BUILD ONE.\n *\n *   MEASURED from the published PBS API: all six windows are `optional: 1` on POST and on PUT. So\n *   on the wire \"I forgot the retention\" and \"I want no retention\" are the SAME REQUEST, and the\n *   second one is not a configuration — it is a scheduled deletion of every backup in scope. This\n *   is the one mistake this family must not be able to make.\n *\n * ⚠️ PBS PROBABLY REFUSES IT TOO, AND THAT IS NOT GOOD ENOUGH TO LEAN ON. Its GUI warns about a\n *   keep-less prune job, which suggests the API guards it as well, but I could not reach a PBS to\n *   prove it and \"probably refused upstream\" is not a thing to bet a restore on. The guard is\n *   local, it is cheap, and it costs nothing at all on a declaration that is already correct.\n *\n * ⛔ IT THROWS RATHER THAN RETURNING AN EMPTY FORM. `reconcile` calls these builders inside\n *   `Effect.gen`, so the throw lands as a defect and stops the deploy carrying this sentence. A\n *   builder that quietly answered `{}` instead would be a PUT of nothing — reported as success —\n *   over the retention the declaration existed to set.\n *\n * ⚠️ IT FIRES AT DEPLOY, NOT AT PLAN, because `diff` never calls a form builder: a keep-less\n *   declaration plans as a clean create and then dies on apply. Loud and safe, but not early. The\n *   stronger guard is a props type where one window is mandatory — a `Base & ({'keep-last': number}\n *   | …)` union — and it is NOT here because I could not satisfy myself that Alchemy's\n *   `Input<Props>` narrowing distributes over that union, and an unverified type trick in the file\n *   that decides what gets deleted is worse than an honest runtime throw.\n */\nconst keepsSomething = (props: PruneJobProps) => KEEP_KEYS.some((key) => props[key] !== undefined);\n\nconst requireKeeps = (props: PruneJobProps) => {\n  if (keepsSomething(props)) return;\n  throw new Error(\n    `Pbs.PruneJob ${props.id}: declares no keep-* window, which tells PBS to keep NOTHING on ` +\n      `datastore '${props.store}'. Every keep-* is optional on the wire, so an omission and a ` +\n      'deliberate \"retain nothing\" are indistinguishable; declare at least one window (keep-last, ' +\n      'keep-hourly, keep-daily, keep-weekly, keep-monthly or keep-yearly) or delete the job.',\n  );\n};\n\n/** ⚠️ An undeclared field emits NO KEY AT ALL, not an empty one — see the ⚠️ on `shape`. */\nconst field = (name: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [name]: value };\n\n/** ⚠️ `undefined` in, `undefined` out, so `field` can drop it — never the text \"undefined\". */\nconst integer = (value: number | undefined) => (value === undefined ? undefined : String(value));\n\n/**\n * The mutable half, shared by create and update.\n *\n * ⚠️ `store` AND `schedule` ARE ALWAYS SENT because they are always declared and always compared —\n *   a field compared against a value but NOT SENT as that value is an update reported on every\n *   plan that the PUT never performs (backup-job.ts and replication-job-form.ts both record that\n *   trade). PBS makes both required on POST and optional on PUT, so sending them on both calls is\n *   legal and keeps one shape for the two.\n *\n * ⚠️ EVERYTHING ELSE IS SENT ONLY WHEN DECLARED, AND UNDECLARED MEANS UNMANAGED — the rule\n *   storage.ts sets, not backup-job.ts's \"always send the documented default\". The difference is\n *   what the drift costs: an undetected `enabled 0` on a vzdump job means backups quietly are not\n *   happening, while an unasked-for change here means backups quietly ARE being deleted. Writing a\n *   default this stack never declared is the worse error for a destructive job, so it is not done.\n *   ⛔ `max-depth` IS THE EXCEPTION THAT PROVES IT AND IT RUNS THE OTHER WAY — see the ⛔ in\n *     pbs-prune-job.ts. Its unset value is FULL RECURSION, so leaving it unmanaged is the WIDE\n *     choice rather than the narrow one. Declare it.\n */\nconst shape = (props: PruneJobProps): Record<string, string> => ({\n  ...keepForm(props),\n  ...field('comment', props.comment),\n  ...field('disable', flag(props.disable)),\n  ...field('max-depth', integer(props['max-depth'])),\n  ...field('ns', props.ns),\n  schedule: props.schedule,\n  store: props.store,\n});\n\n/**\n * ⛔ `id` IS SENT AND IS NOT OPTIONAL, for backup-job.ts's reason sharpened by this API's shape.\n *   MEASURED: `id` is a REQUIRED parameter of `POST /config/prune` — PBS does not generate one —\n *   so an omitted id is a 400 rather than a duplicate job. That is the good case; the bad one is\n *   the id being WRONG. `pveOperations.read` folds every failed GET into \"absent\", so a 403 or an\n *   expired lease reads as \"no such job\", the plan says create, and a second prune job appears\n *   beside the first with this declaration's retention applied to the same datastore. Two prune\n *   jobs on one store do not negotiate: each deletes what its own windows do not keep.\n */\nexport const createBody = (props: PruneJobProps): Record<string, string> => {\n  requireKeeps(props);\n  return { ...shape(props), id: props.id };\n};\n\n/**\n * ⛔ THERE IS NO `delete` LIST HERE AND `withClears()` IS DELIBERATELY NOT IMPORTED. Two\n *   independent reasons, either of which alone would be enough.\n *\n *   FIRST, THE WIRE SHAPE IS NOT PVE'S. MEASURED from the published PBS schema, `PUT\n *   /config/prune/{id}` declares `delete` as `{\"type\":\"array\",\"items\":{\"type\":\"string\",\"enum\":[\n *   \"comment\",\"disable\",\"ns\",\"max-depth\",\"keep-last\",\"keep-hourly\",\"keep-daily\",\"keep-weekly\",\n *   \"keep-monthly\",\"keep-yearly\"]}}` — an ARRAY of enum members. PVE's `delete` is a comma-joined\n *   string, which is exactly what `withClears()` builds, and a form-encoded array is built by\n *   REPEATING the key. `delete=comment,disable` is therefore ONE item that is in no enum: a 400,\n *   not a clear.\n *   ⚠️ AND THE CORRECT SHAPE IS NOT EXPRESSIBLE TODAY. `pveWith` takes `Record<string, string>` and\n *     runs it through `new URLSearchParams`, which cannot repeat a key from a plain object. A PBS\n *     clear list needs a client that can, and that is a change to client.ts rather than to this\n *     file — so a clear list could not be shipped here even if it were wanted.\n *\n *   SECOND, AND THIS ONE WOULD STAND ANYWAY: CLEARING A `keep-*` IS THE MOST DESTRUCTIVE THING\n *   THIS API CAN DO. Removing `keep-last` from a job that had it does not restore a default — PBS\n *   has no default retention — it NARROWS what survives the next run. So an undeclared field is\n *   unmanaged, and a window this stack never mentioned is one it never widens and never removes.\n *   Dropping a `keep-daily` line from a declaration therefore does NOTHING on purpose; clear it by\n *   hand, having first looked at what it is holding.\n *\n * ★ THE DISJOINTNESS `withClears()` EXISTS TO ENFORCE IS THEREFORE VACUOUS HERE: with no clear list\n *   there is no key that can be set and deleted in one call, which is the failure it guards. If a\n *   later change does add one it must go through `withClears()` AND teach the client to repeat the\n *   key — half of that is a 400, and the other half is PVE's spelling sent to a PBS host.\n */\nexport const updateBody = (props: PruneJobProps): Record<string, string> => {\n  requireKeeps(props);\n  return shape(props);\n};\n",
-    "/**\n * `Pbs.SyncJob` — one section of Proxmox Backup Server's `sync.cfg`, declared: a remote datastore's\n * snapshots pulled into a local one on a schedule.\n *\n * ★ IT USES THE SHARED PVE CLIENT, AND THE TYPES STOP THE TWO HOSTS BEING SWAPPED. An earlier\n *   draft imported a `./pbs-client.ts` that never existed, arguing that reusing the PVE machinery\n *   would COMPILE and that this was the danger — a PBS host accepted wherever a PVE one belongs,\n *   every call 401ing, `read` folding that into \"absent\". The argument was right and the fix is\n *   the discriminant rather than a second client: `scheme` is REQUIRED on a target, so a PBS host\n *   is not assignable to a PVE resource or the reverse, and the mistake is a compile error. See\n *   the ⛔ on `scheme` in credentials.ts.\n *\n * ⛔ THE CREDENTIAL IS A PBS TOKEN AND IT DOES NOT EXIST YET; NO MOUNT NAME IS INVENTED IN THIS\n *   FILE. PBS wants `user@realm!tokenname` plus a UUID secret, issued by PBS — a PVE token is not\n *   one, whatever it is spelled like. MEASURED from this machine on 2026-09-13: the agent's\n *   approle cannot enumerate mounts (`bao secrets list` -> 403) and\n *   `bao token capabilities kv/infra/proxmox/pbs` -> `deny`, so I could not confirm from here what\n *   does or does not exist. What credentials.ts records is that every PBS token on the kv shelf is\n *   READ-ONLY (`Audit`, as `metrics@pve`) and STATIC — too narrow to create a sync job, and\n *   exactly the kind of credential this provider exists to avoid writing with.\n *   ★ SO THE MOUNT IS A `PbsTarget.mount` THE STACK SUPPLIES, and somebody has to build it first:\n *     a dynamic PBS mount with `read` and `provision` roles mirroring `proxmox-c1`. Until it\n *     exists this family can be declared and cannot be deployed. `permission denied` means the\n *     grant is missing — say which mount and role you needed; do not fall back to the shelf token.\n *\n * ⚠️ WHAT IS MEASURED AND WHAT IS NOT. MEASURED on 2026-09-13 from this machine, read-only and\n *   under STRICT TLS (no `-k`; curl reports `ssl_verify_result` 0):\n *   `GET https://pbs.example.com:8007/api2/json/ping` -> HTTP 200 `{\"data\":{\"pong\":true}}`. So\n *   the host is real, its certificate validates, and PBS WRAPS ITS ANSWER IN THE SAME `{\"data\": …}`\n *   ENVELOPE AS PVE — which is what lets the PVE-shaped client body be reused at all.\n *   ⛔ EVERYTHING ELSE BELOW IS DOCUMENTED, FROM PBS'S PUBLISHED API SCHEMA, AND NOT MEASURED — the\n *     field list, the parameter spellings, which of them a PUT accepts, the privileges. Without a\n *     credential every other endpoint answers 401, and PBS answers 401 BEFORE it routes:\n *     `/api2/json/config/nosuchthing` -> 401, not 404 (measured). So the 401 from\n *     `/api2/json/config/sync` is not even evidence that the endpoint exists. THE FIRST PLAN\n *     AGAINST A LIVE PBS IS THE MEASUREMENT. Read it; do not deploy it unseen.\n *   ⚠️ AN ERROR BODY IS NOT WRAPPED: the 401 body is the bare text `authentication failed`, not\n *     JSON. `pve()` checks `response.ok` before it parses, so a `pbs()` copied from it is safe —\n *     provided the check stays in that order.\n *\n * ⚠️ `Proxmox.BackupJob` AND `Pbs.SyncJob` ARE NOT THE SAME FAMILY AND THE NAMES NEARLY COLLIDE.\n *   The first is a PVE vzdump schedule; this is a Proxmox Backup SERVER sync job, on a different\n *   host. The `Pbs.` prefix is what keeps them apart in a plan, so it is not shortened.\n *\n * ★ THE SEAM, SINCE IT IS NOT THE USUAL ONE. This file answers \"what a sync job is and what it\n *   costs to declare one\": the props, the attributes, the resource. pbs-sync-job-form.ts answers\n *   \"how it meets PBS\": the coercions, the create and update bodies, and — the part that normally\n *   lives here — `matches`. `matches` went with the wire because it is DOWNSTREAM of the wire:\n *   ha-rule.ts's rule is that only a field a write can actually set may be compared, so every line\n *   of that predicate is an argument about what the PUT accepts. Splitting it from the forms would\n *   have put the claim and its evidence in different files. `Provider.of(handlers)` stays HERE, for\n *   resource.ts's ⛔: it is the one place the handlers are checked against the concrete resource\n *   types, and a cast there would be a lie about whether they match.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { handlers } from './pbs-sync-job-form.ts';\nimport type { PveRequirements } from './resource.ts';\nimport type { WithPbsTarget } from './resource.ts';\n\n/**\n * ⚠️ THE PROPS ARE PBS'S OWN PARAMETER NAMES, DASHES INCLUDED, for backup-job.ts's reason: the form\n *   builder is then a copy rather than a translation table, and a translation table is one more\n *   place for a key to be renamed and silently never sent.\n */\nexport interface SyncJobProps extends WithPbsTarget {\n  /**\n   * ⛔ PBS'S SECTION ID AND THIS RESOURCE'S KEY, REQUIRED. Unlike a PVE vzdump job PBS does not\n   *   autogenerate one — `POST /config/sync` takes `id` — so the backup-job.ts failure of creating\n   *   a second job beside the first on every reconcile cannot happen here. It is still required\n   *   rather than derived: to adopt a job that exists, declare the id it already has.\n   * ⚠️ A PROXMOX SAFE ID — letters, digits, `_`, `.`, `-`, 3 to 32 characters — so there is nothing\n   *   in it for `path` below to encode.\n   */\n  id: string;\n  /** The LOCAL datastore the snapshots land in. Required by PBS at create. */\n  store: string;\n  /** Local namespace, e.g. `tenant/db`. Unset means the root namespace, which PBS spells `''`. */\n  ns?: string;\n  /**\n   * ⛔ A REMOTE BY NAME ONLY. THIS RESOURCE NEVER MODELS THE CREDENTIAL BEHIND IT, and a\n   *   `Pbs.Remote` family is OUT OF SCOPE for this package rather than merely unwritten:\n   *   `POST /config/remote` requires `password`, and Alchemy persists props and attributes to its\n   *   state store UNENCRYPTED (StateEncoding.ts tags Redacted values rather than encrypting them),\n   *   which here is the `alchemy` Postgres that a nightly job dumps to a backup guest. A remote's\n   *   password in a prop is that password in four places, for months. The only Remote resource that\n   *   could exist would refuse `password` the way storage.ts refuses it — as a `never` — and could\n   *   therefore never CREATE a remote, which is a resource that cannot do what its name promises.\n   *   Create remotes out of band (`proxmox-backup-manager remote create`) and name one here.\n   *   ⚠️ The fingerprint is not the problem: a certificate fingerprint is public. The password is.\n   * ⚠️ UNSET MEANS A LOCAL SYNC — datastore to datastore on this same PBS — which is a real and\n   *   supported mode, not an omission. See `matches`: an unset `remote` is NOT compared, so leaving\n   *   it out does not claim a job with a remote is local; it claims nothing at all.\n   */\n  remote?: string;\n  /** The datastore on that remote. Required by PBS at create. */\n  'remote-store': string;\n  /** Namespace on the remote. Unset means its root namespace. */\n  'remote-ns'?: string;\n  /**\n   * A PBS calendar event — `daily`, `hourly`, `mon..fri 02:30`. Unset means the job runs ONLY when\n   * somebody starts it by hand, which is a sync that is not happening; declare one.\n   * ⚠️ THIS COMPARES STRINGS, NOT MEANINGS. A calendar event has many equivalent spellings and PBS\n   *   stores the one it was handed, so declare the spelling the server echoes back.\n   */\n  schedule?: string;\n  /** Single line only — PBS's comment schema rejects a newline. */\n  comment?: string;\n  /**\n   * ⛔ THIS DELETES SNAPSHOTS. NOT \"prunes\", NOT \"tidies\" — DELETES, on a schedule, driven by\n   *   ANOTHER SERVER'S STATE. On a PULL job (the default), every backup group in the local `store`\n   *   and `ns` that is no longer on the remote is REMOVED LOCALLY the next time the job runs. The\n   *   remote decides; this side obeys. Somebody pruning hard on the remote, a remote datastore\n   *   restored from an older copy, a remote namespace renamed, or a remote that has simply lost\n   *   data — each of those becomes deletion HERE, and the local copy is usually the copy that was\n   *   supposed to survive the remote.\n   *   ⛔ AND ON A PUSH JOB IT DELETES ON THE REMOTE INSTEAD — same flag, opposite victim. Read\n   *     `sync-direction` before reading this one.\n   * ⚠️ IT IS COMPARED AND SENT EVEN WHEN UNDECLARED, unlike every other optional field here, and\n   *   that is deliberate: undeclared means `false`, so adopting a job somebody had switched this on\n   *   for plans as an UPDATE that switches it off — a real edit, and NOT a free one. It is the\n   *   direction that does not delete, but a job that was BOUNDING a datastore now grows it, and a\n   *   full PBS datastore fails every backup on it. The plan says only \"update\"; read the live job.\n   */\n  'remove-vanished'?: boolean;\n  /**\n   * The PBS Authid that owns the synced groups, e.g. `sync@pbs` or `sync@pbs!job1`. Unset leaves\n   * the config without one, which PBS reads as `root@pam` AT RUNTIME — so unset and `root@pam` are\n   * not the same value in the config even though they behave alike. Owning a group is what lets an\n   * Authid prune or delete it, so changing this is a permissions change, not a label.\n   * ⚠️ AN AUTHID IS AN IDENTIFIER, NEVER A SECRET — it may name an API token (`user@realm!name`),\n   *   and the token's VALUE is the secret. This resource stores the name and never the value.\n   */\n  owner?: string;\n  /**\n   * Incoming rate limit in BYTES PER SECOND. Unset means unlimited.\n   * ⚠️ DECLARED IN BYTES, STORED AS A HUMAN STRING. PBS types this as a `HumanByte`, so a written\n   *   `10485760` comes back as something like `10.00 MiB`; `bytes()` in the form file parses both\n   *   ends back to a byte count so the two can be compared at all. REASONED from the type, NOT\n   *   measured — I had no credential to round-trip one.\n   * ⛔ DECLARE A VALUE PBS CAN PRINT EXACTLY — a whole multiple of a binary unit. A rate that\n   *   rounds in the printed form (10485761) reads back as the rounded value, never equals what was\n   *   declared, and becomes an update reported on every plan forever. This is the single most\n   *   likely forever-diff in this file; it is the first thing to check on the first plan.\n   * ⚠️ `burst-in`, `rate-out` AND `burst-out` ARE NOT MODELLED. PBS's rate limit is four fields\n   *   flattened into the job; this resource manages one and leaves the others alone, which is safe\n   *   because PBS's update assigns only the parameters it was sent.\n   */\n  'rate-in'?: number;\n  /**\n   * How many namespace levels below `remote-ns` to sync, 0 (no recursion) upwards. Unset means PBS\n   * recurses as deep as it is allowed — which is MORE data, not less, so it is not a safe default\n   * to leave implicit on a job whose target namespace has children.\n   */\n  'max-depth'?: number;\n  /** Sync only the last N snapshots of each group. Unset means all of them. */\n  'transfer-last'?: number;\n  /**\n   * ⛔ NOT DECLARABLE, AND A COMPILE ERROR RATHER THAN A PROP THAT HALF WORKS — the storage.ts\n   *   `password` idiom, for two independent reasons, either of which alone would be enough.\n   *   1. THE WIRE FORM IS AN ARRAY. PBS takes `group-filter` as a repeated parameter\n   *      (`group-filter=type:ct&group-filter=regex:^web`), and `pve()`'s form is\n   *      `Record<string, string>` — one value per key — so a list cannot be expressed at all.\n   *   2. NARROWING A FILTER MAY BE A DELETE. Whether `remove-vanished` skips the groups a filter\n   *      excludes is NOT something I could measure without a credential. If it does not, then\n   *      editing this field on a job with `remove-vanished` set removes every local group the new\n   *      filter excludes. A field that MIGHT delete snapshots when changed does not get a\n   *      half-working prop.\n   *   ★ IT IS STILL REPORTED in the attributes, so a plan shows the filters a hand-made job carries\n   *     and this resource never strips them: undeclared is unmanaged, and PBS's update assigns only\n   *     what it was sent. To make it declarable, fix both halves — a form type that can repeat a\n   *     key, and a MEASURED answer to (2) — in that order.\n   */\n  'group-filter'?: never;\n  /**\n   * `pull` (default) or `push`. ⛔ IT DECIDES WHICH SIDE `remove-vanished` DELETES FROM. Push also\n   * needs a newer PBS: on a server that predates it the parameter is unknown and the create is\n   * refused, which is the honest failure.\n   * ⚠️ CREATE-ONLY HERE, SO A CHANGED DIRECTION PLANS AS NOOP — see `matches`. That is the\n   *   deliberately safe half of an unmeasured question: if PBS does accept it on PUT, the cost of\n   *   this choice is a noop; if PBS refuses it, comparing it would be an update the PUT can never\n   *   perform, on every plan, forever. Retire the declaration and add another, as user.ts says for\n   *   `userid`.\n   */\n  'sync-direction'?: 'pull' | 'push';\n  /**\n   * ⚠️ SYNC ONLY SNAPSHOTS THAT HAVE PASSED VERIFICATION. Present on 4.2 (`sync-job update\n   *   --verified-only <boolean>`, and in its `--delete` enum), and the estate sets it: the parked\n   *   `sync-all-to-dc` job carries `verified-only: true`, so without this prop that job cannot be\n   *   declared as it actually is.\n   * ⛔ IT PAIRS WITH A VERIFICATION JOB THAT ACTUALLY RUNS. With PBS's defaults a snapshot is\n   *   verified once and never again — see `rechecks` in pbs-verify-job-form.ts — so `verified-only`\n   *   on a datastore whose verify job is parked means \"sync only what was checked once, long ago\".\n   */\n  'verified-only'?: boolean;\n}\n\nexport interface SyncJobAttributes {\n  /** From the props — it is the path this object was read by. */\n  id: string;\n  store: string;\n  /** `''` is the root namespace, which is also how PBS spells it. */\n  ns: string;\n  /** `''` means a LOCAL sync — datastore to datastore on this PBS. */\n  remote: string;\n  'remote-store': string;\n  'remote-ns': string;\n  /** `''` means the job runs only when somebody starts it. */\n  schedule: string;\n  comment: string;\n  'remove-vanished': boolean;\n  /** ⚠️ Absent on the wire means `false`, PBS's own default. */\n  'verified-only': boolean;\n  /** `''` means no owner in the config, i.e. `root@pam` at runtime. An identifier, never a secret. */\n  owner: string;\n  /** Bytes per second, or `UNSET` (-1). See `bytes()`. */\n  'rate-in': number;\n  /** `UNSET` (-1) means unset, which means full recursion. `0` is a real value meaning none. */\n  'max-depth': number;\n  /** `UNSET` (-1) means all snapshots. */\n  'transfer-last': number;\n  /**\n   * ⚠️ REPORTED, NEVER SENT, NEVER COMPARED — the live filter list joined for display only. See the\n   *   ⛔ on the prop for why it is not declarable.\n   */\n  'group-filter': string;\n  /** `pull` or `push`. Reported, never compared — create-only here. */\n  'sync-direction': string;\n}\n\nexport interface PbsSyncJob extends Resource<\n  'Pbs.SyncJob',\n  SyncJobProps,\n  SyncJobAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ⚠️ NO `defaultRemovalPolicy: 'retain'`, and the reasoning is replication-job.ts's. Deleting this\n *   object removes a SCHEDULE, not data: every snapshot already synced stays in the local\n *   datastore, and PBS's own pruning is a different job. What is lost is freshness — which is\n *   destructive in six months rather than today, and is exactly why the plan line deserves reading.\n */\nexport const PbsSyncJob = Resource<PbsSyncJob>('Pbs.SyncJob');\n\n/**\n * ⛔ THE EMPTY `list` FROM THE FACTORY STANDS. `GET /config/sync` hands back every sync job an\n *   operator ever made in the UI, and adopting one is how a later `alchemy destroy` silently stops\n *   a second copy being refreshed. Adoption is an explicit act — declare the `id` you mean.\n * ⚠️ DELETING THE JOB DOES NOT DELETE SNAPSHOTS, AND `remove-vanished` DOES. Those two sentences\n *   are the whole risk model of this family and they point opposite ways: the DELETE plan line is\n *   safe today and expensive in six months, while a single `remove-vanished: true` is a standing\n *   instruction to delete local snapshots whenever another server loses them.\n */\nexport const PbsSyncJobProvider = () =>\n  Provider.effect(PbsSyncJob, Effect.succeed(PbsSyncJob.Provider.of(handlers)));\n",
-    "import type { SyncJobAttributes, SyncJobProps } from './pbs-sync-job.ts';\n/**\n * A sync job on the wire: how a PBS answer becomes comparable values, how a declaration becomes a\n * create or an update, and — because that question is downstream of this one — when it has changed.\n *\n * ★ SPLIT OUT OF pbs-sync-job.ts FOR THE 250-LINE CAP; the ★ SEAM there says why `matches` came\n *   with the wire instead of staying with the props. The `import type` back is a cycle on paper\n *   only — erased before anything runs, so the runtime arrow points one way, resource to wire.\n *\n * ★ IT USES THE SHARED PVE CLIENT, NOT A PBS ONE. An earlier draft of this file was written\n *   against a `./pbs-client.ts` that never existed, and spelled out what it would have to export.\n *   That module is not needed: PBS speaks the same `/api2/json` paths and the same `{\"data\": …}`\n *   envelope, its OpenBao mount vends the same `{token_id, secret}`, and the only difference is\n *   the authorization header — so `PveTarget` carries a `scheme` and `authorization()` spells\n *   `PBSAPIToken=<id>:<secret>` for `'pbs'`. `pveHandlers` and `pveOperations` work unchanged.\n *   The one PBS-specific thing that survived is the FORM TYPE: PBS decodes a multi-valued field\n *   from repeated keys, and `PveForm` in client.ts admits a list for exactly that reason.\n\n */\nimport { pveHandlers } from './resource.ts';\nimport { bool, int, text } from './values.ts';\n\n/**\n * The marker for \"PBS has no value for this number\".\n *\n * ⚠️ `-1` RATHER THAN `0`, AND metric-server.ts's `UNSET = -1` IS THE PRECEDENT. `max-depth` has a\n *   legal value of 0 — sync this namespace and no child of it — which is a completely different\n *   instruction from the absent field, where PBS recurses as deep as it is allowed. Using 0 as the\n *   marker would make \"no recursion\" and \"full recursion\" the same attribute. `rate-in` and\n *   `transfer-last` take the same marker for uniformity rather than because 0 is legal for them:\n *   depending on a schema minimum I could not measure is exactly the kind of guess that becomes a\n *   forever-diff.\n */\nexport const UNSET = -1;\n\n/** ⚠️ BINARY AND DECIMAL BOTH, because PBS's HumanByte can print either and parses both. */\nconst UNITS: Record<string, number> = {\n  '': 1,\n  B: 1,\n  GB: 1e9,\n  GiB: 1073741824,\n  KB: 1e3,\n  KiB: 1024,\n  MB: 1e6,\n  MiB: 1048576,\n  TB: 1e12,\n  TiB: 1099511627776,\n};\n\n/**\n * A PBS rate limit off the wire, as a plain byte count.\n *\n * ⛔ THE VALUE GOES OUT AS A NUMBER AND COMES BACK AS PROSE. PBS types `rate-in` as a `HumanByte`,\n *   which parses `10485760` on the way in and prints something like `10.00 MiB` on the way out, so\n *   the two sides of a comparison are never the same string. Flattening both to bytes is what makes\n *   the field comparable at all. REASONED from the type's parse/print asymmetry, NOT measured —\n *   there was no credential to round-trip one with.\n * ⚠️ IT ROUNDS, AND A RATE THAT DOES NOT DIVIDE EVENLY WILL NEVER SETTLE. `10.00 MiB` carries two\n *   decimals, so a declared 10485761 reads back as 10485760, `matches` reports an update, the PUT\n *   writes the same rounded value, and the next plan reports it again — forever. Declare a whole\n *   multiple of a binary unit. This is the likeliest forever-diff in the family and the first thing\n *   to check on the first plan against a live PBS.\n * ⚠️ AN UNPARSEABLE ANSWER READS AS `UNSET`, which for a DECLARED rate means \"not equal\" and so an\n *   update rather than a silent noop. Wrong-but-loud is the right way round here.\n */\nexport const bytes = (value: unknown): number => {\n  if (typeof value === 'number') return value;\n  const raw = text(value).trim();\n  const match = /^([0-9]+(?:\\.[0-9]+)?)\\s*([A-Za-z]*)$/.exec(raw);\n  if (match === null) return UNSET;\n  const unit = UNITS[match[2] ?? ''];\n  return unit === undefined ? UNSET : Math.round(Number(match[1] ?? '0') * unit);\n};\n\n/**\n * The live group filters, joined for a human.\n *\n * ⚠️ DISPLAY ONLY — NEVER SENT, NEVER COMPARED. The ⛔ on the `group-filter` prop says why the field\n *   is not declarable; this exists so that a plan against an adopted job SHOWS the filters this\n *   resource is deliberately leaving alone, rather than making them invisible.\n * ⚠️ THE SEPARATOR IS ` | `, NOT A COMMA: a `regex:` filter may contain either, so no join here is\n *   unambiguous — and a comma is the one that would invite somebody to parse this back.\n */\nexport const filters = (value: unknown): string =>\n  Array.isArray(value) ? value.map((entry: unknown) => String(entry)).join(' | ') : text(value);\n\n/**\n * The half of a declaration that create and update both send.\n *\n * ⛔ `remove-vanished` IS ALWAYS SENT, AT ITS DEFAULT INCLUDED, and that is the one field here that\n *   breaks the \"undeclared is unmanaged\" rule on purpose. It is always COMPARED (see `matches`), and\n *   backup-job.ts records why the two must agree: a field compared against a default but not sent as\n *   that default is an update reported on every plan that the PUT never performs. `0` is the\n *   direction that does not delete; the prop says why that is still not a free edit.\n * ⚠️ THE TERNARY IS NOT A REFUSAL TO REUSE values.ts's `flag()`; IT IS WHAT `flag()` IS DOCUMENTED\n *   NOT TO DO. That coercion answers `undefined` for an undeclared boolean precisely so an omitted\n *   field is never sent — it is the tool for \"send it only if declared\", and this is the one field\n *   that must be sent ALWAYS. Calling it here types as `string | undefined` and tsc rejects the\n *   form (MEASURED: TS2322, \"Type 'undefined' is not assignable to type 'string'\"), which is the\n *   type system saying the same thing. replication-job-form.ts writes its always-sent `disable` the\n *   same way, for the same reason.\n * ⚠️ `1`/`0` RATHER THAN `true`/`false`: PBS's boolean schema accepts both spellings (DOCUMENTED),\n *   and one spelling shared with the PVE families is one fewer thing to keep in step.\n * ⚠️ EVERY OTHER FIELD IS SPREAD IN ONLY WHEN DECLARED. An undeclared key is not sent, so PBS leaves\n *   it exactly as it is — which is what makes adopting a hand-made job non-destructive.\n */\nconst shape = (props: SyncJobProps) => ({\n  'remote-store': props['remote-store'],\n  'remove-vanished': props['remove-vanished'] === true ? '1' : '0',\n  store: props.store,\n  ...(props.comment === undefined ? {} : { comment: props.comment }),\n  ...(props['max-depth'] === undefined ? {} : { 'max-depth': String(props['max-depth']) }),\n  ...(props.ns === undefined ? {} : { ns: props.ns }),\n  ...(props.owner === undefined ? {} : { owner: props.owner }),\n  ...(props['rate-in'] === undefined ? {} : { 'rate-in': String(props['rate-in']) }),\n  ...(props.remote === undefined ? {} : { remote: props.remote }),\n  ...(props['remote-ns'] === undefined ? {} : { 'remote-ns': props['remote-ns'] }),\n  ...(props.schedule === undefined ? {} : { schedule: props.schedule }),\n  ...(props['verified-only'] === undefined\n    ? {}\n    : { 'verified-only': props['verified-only'] ? '1' : '0' }),\n  ...(props['transfer-last'] === undefined\n    ? {}\n    : { 'transfer-last': String(props['transfer-last']) }),\n});\n\n/**\n * ⛔ `id` IS SENT AND IS NOT OPTIONAL. PBS's create takes it rather than inventing one, so this\n *   family avoids backup-job.ts's worst failure by construction — but only while the id is here.\n *   A POST without one would be refused rather than silently duplicating the job, which is the\n *   better failure, and it is still not a reason to leave it out.\n * ⛔ `sync-direction` IS THE ONE FIELD SENT ONLY ON CREATE. It decides which side `remove-vanished`\n *   deletes from, it is not compared (see `matches`), and on a PBS old enough to have no push\n *   support it is an unknown parameter — so sending it on every update would turn every deploy\n *   against such a server into a 400 over a field nobody was changing.\n */\nexport const createBody = (props: SyncJobProps): Record<string, string> => ({\n  ...shape(props),\n  id: props.id,\n  ...(props['sync-direction'] === undefined ? {} : { 'sync-direction': props['sync-direction'] }),\n});\n\n/**\n * ⚠️ THE UPDATE IS THE SHARED HALF AND NOTHING ELSE — no `id` (it is the path), no\n *   `sync-direction`, no `delete` list. The factory only PUTs when `matches` is false and the form\n *   is non-empty, and this form is never empty because `remove-vanished` and the two store names\n *   are always present. That is fine here: reconcile reaches this line only when something really\n *   does differ, and re-sending the two store names it just compared is a write of what is already\n *   there rather than a change.\n */\nexport const updateBody = (props: SyncJobProps): Record<string, string> => shape(props);\n\nexport const handlers = pveHandlers<SyncJobProps, SyncJobAttributes>({\n  /**\n   * ⛔ NO \"IS IT REALLY THERE\" GUARD, for backup-job.ts's reason: absence is the API declining to\n   *   answer, which the factory's `read` already handles, not a key missing from an answer that did\n   *   arrive. Every fallback below is PBS's documented default rather than one picked for\n   *   convenience, so the answer does not depend on whether a release echoes a key it never wrote.\n   * ⛔ EXCEPT `store` AND `remote-store`, WHICH FALL BACK TO `''` RATHER THAN TO THE DECLARED VALUE.\n   *   They are the only required fields `matches` COMPARES, and a props-shaped fallback would make a\n   *   malformed answer compare EQUAL — drift that hides itself, where `''` can only be loud. `id`\n   *   keeps its props fallback: it is the path the object was read by, and is never compared.\n   * ⚠️ `digest` IS DELIBERATELY NOT AN ATTRIBUTE. PBS returns one for `sync.cfg` as a FILE, so\n   *   keeping it would rewrite this resource's state whenever an unrelated sync job was edited —\n   *   churn that reads like drift. ha-resource.ts hit exactly that on PVE.\n   * ⚠️ NEITHER IS THE RUN STATUS. `last-run-state`, `last-run-upid`, `last-run-endtime` and\n   *   `next-run` come from the LIST endpoint, not from `GET /config/sync/{id}` which this reads.\n   *   A plan whose output changes every time the job runs is a plan people stop reading.\n   */\n  attributes: (live, props) => ({\n    comment: text(live['comment'], ''),\n    'group-filter': filters(live['group-filter']),\n    id: props.id,\n    'max-depth': int(live['max-depth'], UNSET),\n    ns: text(live['ns'], ''),\n    owner: text(live['owner'], ''),\n    'rate-in': bytes(live['rate-in']),\n    remote: text(live['remote'], ''),\n    'remote-ns': text(live['remote-ns'], ''),\n    'remote-store': text(live['remote-store'], ''),\n    // ⚠️ PBS answers with a JSON `true`/`false` where PVE answers `1`/`0`; `bool` takes both, and\n    //   takes the string `'false'` correctly too if some release spells it that way.\n    'remove-vanished': bool(live['remove-vanished'], false),\n    schedule: text(live['schedule'], ''),\n    // ⚠️ ABSENT MEANS FALSE, the PBS-side default — so an undeclared prop and a job that never had\n    //   the field compare equal, and adopting one does not plan an edit.\n    'verified-only': bool(live['verified-only'], false),\n    store: text(live['store'], ''),\n    'sync-direction': text(live['sync-direction'], 'pull'),\n    'transfer-last': int(live['transfer-last'], UNSET),\n  }),\n  collection: () => 'config/sync',\n  createForm: createBody,\n  /**\n   * ⛔ ONLY FIELDS A WRITE CAN ACTUALLY SET ARE COMPARED, and on PBS that list is REASONED rather\n   *   than measured: the published update schema for `PUT /config/sync/{id}` takes every property\n   *   of the job except its `id`. If a release turns out to refuse one of these, the comparison\n   *   becomes an update the PUT cannot perform — reported on every plan, forever. That is what the\n   *   first plan against a live PBS is for.\n   * ⚠️ `remove-vanished` IS COMPARED UNCONDITIONALLY — undeclared means false. Every other optional\n   *   field reads \"not declared, or equal\": undeclared is UNMANAGED, so a schedule, comment, owner,\n   *   namespace or limit somebody set by hand survives adoption untouched. The destructive one does\n   *   not get that courtesy, and the price is that adopting a job with it switched on is a real\n   *   edit, announced only as \"update\" — toward not deleting, and toward a datastore that grows.\n   * ⚠️ `store` AND `remote-store` ARE COMPARED UNCONDITIONALLY because PBS requires them at create,\n   *   so there is no undeclared case to protect. `remote` is NOT: an absent `remote` on an existing\n   *   job would otherwise plan an update clearing it, and `remote=` is not a value PBS's id schema\n   *   accepts — a failing PUT on every deploy, over a field the declaration never mentioned.\n   * ⚠️ `id`, `group-filter` AND `sync-direction` ARE OUT. The first is the path, a change to which\n   *   is a different object; the other two are argued on their props in pbs-sync-job.ts.\n   */\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: { create: 'pbs:POST /config/sync', update: 'pbs:PUT /config/sync/{id}' },\n  matches: (attributes, props) =>\n    attributes['remove-vanished'] === (props['remove-vanished'] === true) &&\n    attributes.store === props.store &&\n    attributes['remote-store'] === props['remote-store'] &&\n    (props.remote === undefined || attributes.remote === props.remote) &&\n    (props.ns === undefined || attributes.ns === props.ns) &&\n    (props['remote-ns'] === undefined || attributes['remote-ns'] === props['remote-ns']) &&\n    (props.schedule === undefined || attributes.schedule === props.schedule) &&\n    (props.comment === undefined || attributes.comment === props.comment) &&\n    (props.owner === undefined || attributes.owner === props.owner) &&\n    // ⚠️ NOT COMPARED UNCONDITIONALLY, unlike `remove-vanished`. Turning `verified-only` ON is the\n    //   safe direction (sync less), so undeclared stays UNMANAGED like every other optional field;\n    //   `remove-vanished` gets the unconditional treatment because its unsafe direction deletes.\n    (props['verified-only'] === undefined ||\n      attributes['verified-only'] === props['verified-only']) &&\n    (props['rate-in'] === undefined || attributes['rate-in'] === props['rate-in']) &&\n    (props['max-depth'] === undefined || attributes['max-depth'] === props['max-depth']) &&\n    (props['transfer-last'] === undefined ||\n      attributes['transfer-last'] === props['transfer-last']),\n  /** ⚠️ A Proxmox safe id has no `/` or `:` in it, so there is nothing here to encode. */\n  path: (props) => `config/sync/${props.id}`,\n  updateForm: updateBody,\n});\n",
-    "/**\n * `Pbs.VerifyJob` — one section of PBS's `verification.cfg`, declared.\n *\n * ★ THIS IS THE FAMILY THAT ANSWERS \"ARE THE BACKUPS ACTUALLY GOOD\", AND NOTHING ELSE IN THIS\n *   PACKAGE DOES. A datastore reports free space, a prune job reports that it ran, and every\n *   snapshot in the store can still be unreadable: PBS learns a chunk has rotted only when\n *   something reads it back and checks its digest, and verification is the only thing that does\n *   that on a schedule. An undeclared verify job is the reason nobody notices for months — and a\n *   green `Proxmox.BackupJob` makes it worse rather than better, because a vzdump job that says\n *   \"OK\" every night is exactly the evidence people stop at.\n *\n * ⛔ THIS FILE CANNOT AUTHENTICATE UNTIL TWO THINGS OUTSIDE IT CHANGE, AND IT IS SHIPPED SAYING SO\n *   RATHER THAN SHIPPED LOOKING FINISHED. Both are recorded on `PbsTarget` below:\n *     1. `credentials.ts` has no PBS mint. MEASURED 2026-09-13 from this Mac: the agent's\n *        approle is refused `sys/mounts`, `kv/infra/proxmox` and `proxmox-pbs/creds/read` alike —\n *        403 permission denied on all three — so there is no mount to name and none is invented.\n *     2. `client.ts`'s `authorization()` builds a PVE header, and PBS will not accept it. See the\n *        ⛔ on `PbsTarget`.\n *   Until both land, every call 401s, `pveOperations.read` folds that into \"absent\", and the plan\n *   reports `create` for a job that is plainly there. The deploy then FAILS at the POST rather\n *   than clobbering anything — an unauthenticated POST 401s, and an authenticated one is refused\n *   because PBS will not take a duplicate section id — so the cost is a LYING PLAN and a broken\n *   run, not a lost job. That is still reason enough not to wire it into a stack yet: a plan\n *   nobody can trust is its own outage.\n *\n * ⚠️ THE SHAPES BELOW ARE READ FROM PUBLISHED SOURCE, NOT MEASURED ON THIS ESTATE. Everything is\n *   taken from `pbs-api-types/src/jobs.rs`, `src/api2/config/verify.rs`, `src/server/verify_job.rs`\n *   and `src/backup/verify.rs` at HEAD of the Proxmox git mirrors on 2026-09-13. What WAS measured\n *   here: `pbs.example.com:8007` and `pbs.mgmt.example.com:8007` both answer HTTP 401 under\n *   STRICT TLS (curl `ssl_verify_result=0`), so no `-k` is needed and `client.ts`'s plain `fetch`\n *   reaches PBS unchanged. The running host's own schema was NOT read — no credential — so a PBS\n *   older than HEAD may differ.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type { PbsTarget } from './credentials.ts';\nimport { rechecks, shape } from './pbs-verify-job-form.ts';\nimport { type PveRequirements, pveHandlers } from './resource.ts';\nimport { bool, int, text } from './values.ts';\n\nexport interface PbsVerifyJobProps {\n  /** ⛔ A PBS host, never a PVE cluster. See `PbsTarget`. */\n  target: PbsTarget;\n  /**\n   * ⛔ The primary key, REQUIRED, and never left to PBS. 3–32 chars of\n   * `[A-Za-z0-9_][A-Za-z0-9._-]*`. PBS refuses a duplicate section id outright, which is the loud\n   * failure `Proxmox.BackupJob` had to engineer for itself — but only because the id is sent.\n   */\n  id: string;\n  /** Datastore name, 3–32 safe-id chars. ⚠️ MUTABLE — see the ⚠️ on `matches`. */\n  store: string;\n  /**\n   * ⛔ THE KEY IS REQUIRED AND THE VALUE MAY BE `null`. PBS makes the field optional; this family\n   * refuses to let you OMIT it, which is not the same thing. A verification job with no schedule\n   * never runs on its own and PBS reports it as perfectly healthy — and an absent schedule is also\n   * the only way to turn one off, because there is NO `disable` field on a verification job.\n   * ⛔ THAT LAST CLAIM IS NOW MEASURED, not read from source. `proxmox-backup-manager verify-job\n   *   update --help` on the live 4.2 host lists `--delete\n   *   ignore-verified|comment|schedule|outdated-after|ns|max-depth|read-threads|verify-threads`\n   *   and no `--disable` anywhere. So `schedule` is deletable — \"parked\" is a state PBS supports —\n   *   and `disable` genuinely does not exist. pbs-verify-job-form.ts said this was read off the\n   *   source and NOT verified against a running host; it is now verified, on this one.\n   * ★ SO `null` MEANS \"DELIBERATELY PARKED\" AND OMITTING IT IS STILL AN ERROR. The original\n   *   required-string kept you from declaring verification that never happens, which is right, but\n   *   it also made a genuinely parked job UNDECLARABLE — and the estate has one: `v-datacenter` is\n   *   parked because syno1 is powered off, comment and runbook and all. A resource that cannot\n   *   describe what is really there pushes the operator back to the CLI, which is the failure this\n   *   package exists to end. Writing `schedule: null` costs a word and says the quiet part out\n   *   loud; leaving the key out still will not compile.\n   * ⚠️ ADOPTING A SCHEDULELESS JOB WITH A SCHEDULE DECLARED GIVES IT ONE ON THE FIRST DEPLOY, which\n   *   is the intended direction and is still a write nobody asked for in words. `matches` compares\n   *   `schedule`, the live value reads `''`, so the first reconcile PUTs the declared one and\n   *   verification starts running that night. Read the first plan against an adopted job.\n   * ⚠️ A systemd calendar event. Spelled `daily`, `sat 02:00`, `mon..fri 23:00`. A step expression\n   *   is legal too and is not written out here: those two characters would close this comment.\n   */\n  schedule: string | null;\n  /**\n   * The namespace to verify, e.g. `tier1/prod`. Omitted means the datastore root.\n   * ⛔ NEVER SENT AS THE EMPTY STRING. MEASURED in the update handler: `if !ns.is_root()` — a root\n   *   namespace on a PUT is accepted by the schema, reaches the handler and is then SILENTLY\n   *   DISCARDED. A job cannot be moved back to the root namespace by this resource at all; that\n   *   needs `--delete ns` by hand. So an undeclared `ns` is neither sent nor compared.\n   */\n  ns?: string;\n  /**\n   * How many namespace levels below `ns` to descend. `0` is that level only; PBS's maximum is 7.\n   * ⚠️ PBS's own default is FULL recursion (7), not 0. Undeclared means undeclared here: not sent,\n   *   not compared, because \"unset\" and \"7\" are stored differently and only one is reachable.\n   */\n  'max-depth'?: number;\n  /**\n   * ⛔ THE HALF OF THE PAIR THAT DECIDES WHETHER THIS JOB EVER RE-CHECKS ANYTHING. Defaults to\n   *   TRUE. Read `rechecks` and the ⛔ in pbs-verify-job-form.ts before setting either of these.\n   */\n  'ignore-verified'?: boolean;\n  /** Days after which a past verification is stale. ⛔ See the pair's ⛔ in the form file. */\n  'outdated-after'?: number;\n  /** ⚠️ PBS TRIMS IT AND STORES AN EMPTY ONE AS ABSENT, so `'  '` reads back as `''`. */\n  comment?: string;\n}\n\nexport interface PbsVerifyJobAttributes {\n  id: string;\n  store: string;\n  schedule: string;\n  ns: string;\n  /** ⚠️ `-1` means \"no max-depth in the section\". `0` is a real setting meaning no recursion. */\n  'max-depth': number;\n  'ignore-verified': boolean;\n  /** ⚠️ `-1` means \"unset\", which is NOT `0`. See the ⛔ in the form file. */\n  'outdated-after': number;\n  comment: string;\n  /**\n   * ★ WHAT THIS JOB ACTUALLY RE-CHECKS, IN ENGLISH, COMPUTED FROM THE LIVE PAIR. REPORTED, NEVER\n   *   COMPARED — it is derived from two fields `matches` already compares, so diffing it would\n   *   double-count them. It exists because the failure this family guards against is a job that\n   *   looks healthy in every column and verifies each snapshot exactly once, ever; that job reads\n   *   `never` here. A plan line is the only place anyone will see it.\n   */\n  rechecks: string;\n}\n\nexport interface PbsVerifyJob extends Resource<\n  'Pbs.VerifyJob',\n  PbsVerifyJobProps,\n  PbsVerifyJobAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ⚠️ NO `defaultRemovalPolicy: 'retain'`, DELIBERATELY, AND IT IS THE CLOSER CALL THAN IT LOOKS.\n *   The section holds no data — deleting it destroys nothing, the way `Proxmox.BackupJob`'s delete\n *   destroys no archives. What it destroys is the CHECKING, silently and permanently, and PBS will\n *   not refuse it the way it refuses to remove a datastore in use. `retain` would hide that behind\n *   a state-row drop instead of showing it as a plan line, and the plan line is the only warning\n *   anyone gets. Pipe `RemovalPolicy.retain()` per declaration where the job must outlive the code.\n */\nexport const PbsVerifyJob = Resource<PbsVerifyJob>('Pbs.VerifyJob');\n\n/**\n * ⚠️ EVERY FIELD IS READ THROUGH `values.ts` THOUGH PBS RETURNS REAL JSON TYPES. Unlike PVE's\n *   SectionConfig round-trip, `GET /config/verify/{id}` serialises a Rust struct, so\n *   `ignore-verified` arrives as a JSON boolean and `max-depth` as a JSON number. `bool` and `int`\n *   accept both spellings, and using them costs nothing while covering the version that does not.\n * ⚠️ `digest` IS NOT AN ATTRIBUTE AND CANNOT BECOME ONE BY ACCIDENT. PBS puts it on the rpcenv, and\n *   the JSON formatter adds rpcenv attributes as SIBLINGS of `data` — `{\"data\":{…},\"digest\":\"…\"}` —\n *   so `client.ts`, which returns `body.data`, never sees it. That is lucky rather than designed:\n *   the digest covers verification.cfg as a FILE, so keeping it would churn this resource's state\n *   whenever an unrelated verify job was edited.\n */\nconst handlers = pveHandlers<PbsVerifyJobProps, PbsVerifyJobAttributes>({\n  attributes: (live, props) => {\n    const ignoreVerified = bool(live['ignore-verified'], true);\n    const outdatedAfter = int(live['outdated-after'], -1);\n    return {\n      comment: text(live['comment'], ''),\n      id: props.id,\n      'ignore-verified': ignoreVerified,\n      'max-depth': int(live['max-depth'], -1),\n      ns: text(live['ns'], ''),\n      'outdated-after': outdatedAfter,\n      rechecks: rechecks(ignoreVerified, outdatedAfter),\n      schedule: text(live['schedule'], ''),\n      store: text(live['store'], props.store),\n    };\n  },\n  /**\n   * 🔴 THIS WAS `config/verification` AND PBS ANSWERS 404 FOR IT. MEASURED on the live 4.2 server:\n   *   `GET /api2/json/config/verification` -> 404 \"Path not found\"; `GET /api2/json/config/verify`\n   *   -> 200 with both jobs. The struct is `VerificationJobConfig` and the CLI subcommand is\n   *   `verify-job`, so the long spelling reads right and is simply not the route.\n   *   ⛔ THE FAILURE MODE IS THE ONE THIS PACKAGE KEEPS FINDING: `read` folds every failure into\n   *   `undefined`, so a 404 from a WRONG PATH is indistinguishable from an object that is not\n   *   there. The first plan against the live estate said `create` for two verification jobs that\n   *   have existed for weeks — and a create would then have POSTed to a 404 as well, so it fails\n   *   loudly rather than duplicating anything. Nothing caught it earlier because no verification\n   *   job had ever been declared; registering the provider exercises no path at all.\n   */\n  collection: () => 'config/verify',\n  /** ⛔ `id` IS SENT. PBS refuses a duplicate id, and that refusal is this family's safety net. */\n  createForm: (props) => ({ ...shape(props), id: props.id }),\n  /**\n   * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED — the `Proxmox.BackupJob` trade, for the\n   *   same reason and with one extra: this form carries NO `delete` list, so there is nothing it\n   *   could clear even if it wanted to. See the ⛔ on `withClears` in pbs-verify-job-form.ts.\n   * ⚠️ `store` IS COMPARED AND IS MUTABLE, which is unusual and worth reading twice. PBS's update\n   *   handler assigns it and re-checks privileges on both the old and the new path, so changing\n   *   `store` MOVES the job — and the datastore it left is then verified by nothing. That is a\n   *   one-word edit with the same effect as deleting the job, and it plans as a quiet `update`.\n   * ⚠️ `rechecks` IS ABSENT HERE ON PURPOSE. It is a rendering of the two fields on the lines\n   *   above; comparing it too would report the same drift twice.\n   */\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: { create: 'pbs:POST /config/verify', update: 'pbs:PUT /config/verify/{id}' },\n  matches: (attributes, props) =>\n    attributes.store === props.store &&\n    // ⚠️ `null` IS COMPARED AGAINST `''`, NOT SKIPPED. A parked job is a declaration like any\n    //   other, so declaring `null` against a job that HAS a schedule must plan an update — the\n    //   form then omits `schedule`, which is a set-only form, so see the ⛔ on clearing below.\n    attributes.schedule === (props.schedule ?? '') &&\n    attributes['ignore-verified'] === (props['ignore-verified'] !== false) &&\n    (props['outdated-after'] === undefined ||\n      attributes['outdated-after'] === props['outdated-after']) &&\n    (props['max-depth'] === undefined || attributes['max-depth'] === props['max-depth']) &&\n    (props.ns === undefined || attributes.ns === props.ns) &&\n    (props.comment === undefined || attributes.comment === props.comment),\n  path: (props) => `config/verify/${props.id}`,\n  updateForm: shape,\n});\n\n/**\n * ⛔ `list` IS EMPTY, INHERITED FROM `pveHandlers`, AND THE REASON IS SHARPER HERE THAN ELSEWHERE.\n *   `GET /config/verify` returns every verification job the caller can see, including the\n *   ones the PBS installer and a human made. Adopting those would put Alchemy one dropped line\n *   away from DELETING a datastore's only verification schedule — and deleting it destroys nothing\n *   visible, so the loss is discovered the day a restore fails and there is no verification history\n *   to say when the rot started. Adoption stays explicit: declare the existing id.\n *\n * ⚠️ NO `digest` IS SENT ON UPDATE OR DELETE, SO THIS IS LAST-WRITER-WINS. PBS accepts an optional\n *   `digest` on both and would refuse a write made against a stale read. Sending one would need a\n *   read-then-write window this provider does not have — `pveOperations` reads and writes in two\n *   separate calls with two separate mints — so a concurrent edit from the PBS UI is overwritten\n *   rather than refused. Same behaviour as every PVE family here; stated because PBS offers better.\n */\nexport const PbsVerifyJobProvider = () =>\n  Provider.effect(PbsVerifyJob, Effect.succeed(PbsVerifyJob.Provider.of(handlers)));\n",
+    "/** PBS 4.2.6-1 values and vendor form guards; SDK transport is in pbs-prune-job-wire.ts. */\nimport type { PruneJobAttributes, PruneJobProps } from './pbs-prune-job.ts';\nimport type { PveSpec } from './resource-spec.ts';\nimport { createBody, keepAttributes, keepsMatch, updateBody } from './pbs-prune-job-form.ts';\nimport { bool, int, text } from './values.ts';\n\n/** \"Not declared, or equal\" — the single shape every unmanaged field is compared with. */\nconst same = <T>(declared: T | undefined, live: T) => declared === undefined || declared === live;\n\nexport const spec: PveSpec<PruneJobProps, PruneJobAttributes> = {\n  /**\n   * ⚠️ EVERY OPTIONAL FIELD FALLS BACK TO ITS ABSENT SENTINEL RATHER THAN TO PBS'S DEFAULT, because\n   *   for this family the two are different questions. `keep-daily` absent does not mean \"keep zero\n   *   dailies\", it means \"this window is not part of the policy\", and `matches` must not compare a\n   *   window the declaration never mentioned against an invented value.\n   * ⛔ NO \"IS IT REALLY THERE\" GUARD, for backup-job.ts's reason: returning undefined for a job\n   *   whose JSON is missing a key would be a guess about which keys PBS echoes, and a wrong guess\n   *   sends reconcile down the POST branch — which creates ANOTHER prune job rather than failing.\n   */\n  attributes: (live, props) => ({\n    comment: text(live['comment'], ''),\n    disable: bool(live['disable'], false),\n    id: props.id,\n    ...keepAttributes(live),\n    'max-depth': int(live['max-depth'], -1),\n    ns: text(live['ns'], ''),\n    schedule: text(live['schedule'], ''),\n    store: text(live['store'], props.store),\n  }),\n  collection: () => 'config/prune',\n  createForm: createBody,\n  /**\n   * ⚠️ THE UNDECLARED HALF IS NOT COMPARED, AND THAT IS THE WHOLE SAFETY MODEL. `same` reads \"not\n   *   declared, or equal\", so a field set by hand on an adopted job survives adoption untouched and\n   *   never appears as drift. `keepsMatch` applies the identical rule to the six windows, from the\n   *   file that also writes and reads them — see the ★ at the top of pbs-prune-job-form.ts.\n   * ⚠️ `store` AND `schedule` HAVE NO UNDECLARED CASE because both are required props, so both are\n   *   compared unconditionally. A changed `store` is an update, not a replace: PBS accepts `store`\n   *   on PUT, so the job is re-pointed in place.\n   */\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: { create: 'pbs:POST /config/prune', update: 'pbs:PUT /config/prune/{id}' },\n  matches: (attributes, props) =>\n    attributes.schedule === props.schedule &&\n    attributes.store === props.store &&\n    same(props.ns, attributes.ns) &&\n    same(props['max-depth'], attributes['max-depth']) &&\n    same(props.disable, attributes.disable) &&\n    same(props.comment, attributes.comment) &&\n    keepsMatch(attributes, props),\n  path: (props) => `config/prune/${props.id}`,\n  updateForm: updateBody,\n};\n",
+    "/** PBS 4.2.6-1 operations through @distilled.cloud/proxmox-backup. */\nimport * as config from '@distilled.cloud/proxmox-backup/config';\nimport * as Effect from 'effect/Effect';\nimport { runPbs } from './distilled-pbs.ts';\nimport type { PruneJobProps } from './pbs-prune-job.ts';\nimport { createBody, updateBody } from './pbs-prune-job-form.ts';\nimport { spec } from './pbs-prune-job-spec.ts';\n\n/** SDK member names differ from the vendor form names; omission stays unmanaged. */\nconst members = (form: Record<string, string>) => ({\n  ...(form['comment'] === undefined ? {} : { comment: form['comment'] }),\n  ...(form['disable'] === undefined ? {} : { disable: form['disable'] }),\n  ...(form['keep-daily'] === undefined ? {} : { keep_daily: form['keep-daily'] }),\n  ...(form['keep-hourly'] === undefined ? {} : { keep_hourly: form['keep-hourly'] }),\n  ...(form['keep-last'] === undefined ? {} : { keep_last: form['keep-last'] }),\n  ...(form['keep-monthly'] === undefined ? {} : { keep_monthly: form['keep-monthly'] }),\n  ...(form['keep-weekly'] === undefined ? {} : { keep_weekly: form['keep-weekly'] }),\n  ...(form['keep-yearly'] === undefined ? {} : { keep_yearly: form['keep-yearly'] }),\n  ...(form['max-depth'] === undefined ? {} : { max_depth: form['max-depth'] }),\n  ...(form['ns'] === undefined ? {} : { ns: form['ns'] }),\n  ...(form['schedule'] === undefined ? {} : { schedule: form['schedule'] }),\n  ...(form['store'] === undefined ? {} : { store: form['store'] }),\n});\n\nconst createRequest = (props: PruneJobProps): config.CreateConfigPruneRequest => ({\n  ...members(createBody(props)),\n  id: props.id,\n  store: props.store,\n  schedule: props.schedule,\n});\n\nconst updateRequest = (props: PruneJobProps): config.PutConfigPruneRequest => ({\n  ...members(updateBody(props)),\n  id: props.id,\n});\n\n/** Preserve the state attribute shape while the SDK decodes its typed field names. */\nconst wire = (row: config.GetConfigPruneResponse): Record<string, unknown> => ({\n  ...row,\n  'keep-daily': row.keep_daily,\n  'keep-hourly': row.keep_hourly,\n  'keep-last': row.keep_last,\n  'keep-monthly': row.keep_monthly,\n  'keep-weekly': row.keep_weekly,\n  'keep-yearly': row.keep_yearly,\n  'max-depth': row.max_depth,\n});\n\n/** ⛔ Only the SDK PruneJobNotFound is absence; permission, transport and malformed replies propagate. */\nexport const readOne = (props: PruneJobProps) =>\n  runPbs(props.target, 'read', config.getConfigPrune({ id: props.id })).pipe(\n    Effect.map((row) => spec.attributes(wire(row), props)),\n    Effect.catchTag('PruneJobNotFound', () => Effect.succeed(undefined)),\n  );\n\nexport const createOne = (props: PruneJobProps) =>\n  runPbs(props.target, 'provision', config.createConfigPrune(createRequest(props)));\n\nexport const updateOne = (props: PruneJobProps) =>\n  runPbs(props.target, 'provision', config.putConfigPrune(updateRequest(props)));\n\n/** Deleting the schedule never deletes backups; already missing is a successful deletion. */\nexport const deleteOne = (props: PruneJobProps) =>\n  Effect.gen(function* () {\n    // ⛔ Missing-item tags are measured for GET only. Do not guess the DELETE error shape.\n    if ((yield* readOne(props)) === undefined) return;\n    return yield* runPbs(props.target, 'provision', config.deleteConfigPrune({ id: props.id }));\n  });\n",
+    "/**\n * `Pbs.SyncJob` — one section of Proxmox Backup Server's `sync.cfg`, declared: a remote datastore's\n * snapshots pulled into a local one on a schedule.\n *\n * ★ IT USES THE SHARED PVE CLIENT, AND THE TYPES STOP THE TWO HOSTS BEING SWAPPED. An earlier\n *   draft imported a `./pbs-client.ts` that never existed, arguing that reusing the PVE machinery\n *   would COMPILE and that this was the danger — a PBS host accepted wherever a PVE one belongs,\n *   every call 401ing, `read` folding that into \"absent\". The argument was right and the fix is\n *   the discriminant rather than a second client: `scheme` is REQUIRED on a target, so a PBS host\n *   is not assignable to a PVE resource or the reverse, and the mistake is a compile error. See\n *   the ⛔ on `scheme` in credentials.ts.\n *\n * ⛔ THE CREDENTIAL IS A PBS TOKEN AND IT DOES NOT EXIST YET; NO MOUNT NAME IS INVENTED IN THIS\n *   FILE. PBS wants `user@realm!tokenname` plus a UUID secret, issued by PBS — a PVE token is not\n *   one, whatever it is spelled like. MEASURED from this machine on 2026-09-13: the agent's\n *   approle cannot enumerate mounts (`bao secrets list` -> 403) and\n *   `bao token capabilities kv/infra/proxmox/pbs` -> `deny`, so I could not confirm from here what\n *   does or does not exist. What credentials.ts records is that every PBS token on the kv shelf is\n *   READ-ONLY (`Audit`, as `metrics@pve`) and STATIC — too narrow to create a sync job, and\n *   exactly the kind of credential this provider exists to avoid writing with.\n *   ★ SO THE MOUNT IS A `PbsTarget.mount` THE STACK SUPPLIES, and somebody has to build it first:\n *     a dynamic PBS mount with `read` and `provision` roles mirroring `proxmox-c1`. Until it\n *     exists this family can be declared and cannot be deployed. `permission denied` means the\n *     grant is missing — say which mount and role you needed; do not fall back to the shelf token.\n *\n * ⚠️ WHAT IS MEASURED AND WHAT IS NOT. MEASURED on 2026-09-13 from this machine, read-only and\n *   under STRICT TLS (no `-k`; curl reports `ssl_verify_result` 0):\n *   `GET https://pbs.example.com:8007/api2/json/ping` -> HTTP 200 `{\"data\":{\"pong\":true}}`. So\n *   the host is real, its certificate validates, and PBS WRAPS ITS ANSWER IN THE SAME `{\"data\": …}`\n *   ENVELOPE AS PVE — which is what lets the PVE-shaped client body be reused at all.\n *   ⛔ EVERYTHING ELSE BELOW IS DOCUMENTED, FROM PBS'S PUBLISHED API SCHEMA, AND NOT MEASURED — the\n *     field list, the parameter spellings, which of them a PUT accepts, the privileges. Without a\n *     credential every other endpoint answers 401, and PBS answers 401 BEFORE it routes:\n *     `/api2/json/config/nosuchthing` -> 401, not 404 (measured). So the 401 from\n *     `/api2/json/config/sync` is not even evidence that the endpoint exists. THE FIRST PLAN\n *     AGAINST A LIVE PBS IS THE MEASUREMENT. Read it; do not deploy it unseen.\n *   ⚠️ AN ERROR BODY IS NOT WRAPPED: the 401 body is the bare text `authentication failed`, not\n *     JSON. The original `pve()` checked status before decoding success data. The distilled PBS\n *     protocol preserves this distinction and classifies error text through SDK patches.\n *\n * ⚠️ `Proxmox.BackupJob` AND `Pbs.SyncJob` ARE NOT THE SAME FAMILY AND THE NAMES NEARLY COLLIDE.\n *   The first is a PVE vzdump schedule; this is a Proxmox Backup SERVER sync job, on a different\n *   host. The `Pbs.` prefix is what keeps them apart in a plan, so it is not shortened.\n *\n * ★ THE SEAM, SINCE IT IS NOT THE USUAL ONE. This file answers \"what a sync job is and what it\n *   costs to declare one\": the props, the attributes, the resource. pbs-sync-job-form.ts answers\n *   \"how it meets PBS\": the coercions, the create and update bodies, and — the part that normally\n *   lives here — `matches`. `matches` went with the wire because it is DOWNSTREAM of the wire:\n *   ha-rule.ts's rule is that only a field a write can actually set may be compared, so every line\n *   of that predicate is an argument about what the PUT accepts. Splitting it from the forms would\n *   have put the claim and its evidence in different files. `Provider.of(handlers)` stays HERE, for\n *   resource.ts's ⛔: it is the one place the handlers are checked against the concrete resource\n *   types, and a cast there would be a lie about whether they match.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { handlers } from './pbs-sync-job-lifecycle.ts';\nimport type { SyncJobAttributes } from './pbs-sync-job-attributes.ts';\nexport type { SyncJobAttributes } from './pbs-sync-job-attributes.ts';\nimport type { PveRequirements } from './resource.ts';\nimport type { WithPbsTarget } from './resource.ts';\n\n/**\n * ⚠️ THE PROPS ARE PBS'S OWN PARAMETER NAMES, DASHES INCLUDED, for backup-job.ts's reason: the form\n *   builder is then a copy rather than a translation table, and a translation table is one more\n *   place for a key to be renamed and silently never sent.\n */\nexport interface SyncJobProps extends WithPbsTarget {\n  /**\n   * ⛔ PBS'S SECTION ID AND THIS RESOURCE'S KEY, REQUIRED. Unlike a PVE vzdump job PBS does not\n   *   autogenerate one — `POST /config/sync` takes `id` — so the backup-job.ts failure of creating\n   *   a second job beside the first on every reconcile cannot happen here. It is still required\n   *   rather than derived: to adopt a job that exists, declare the id it already has.\n   * ⚠️ A PROXMOX SAFE ID — letters, digits, `_`, `.`, `-`, 3 to 32 characters — so there is nothing\n   *   in it for `path` below to encode.\n   */\n  id: string;\n  /** The LOCAL datastore the snapshots land in. Required by PBS at create. */\n  store: string;\n  /** Local namespace, e.g. `tenant/db`. Unset means the root namespace, which PBS spells `''`. */\n  ns?: string;\n  /**\n   * ⛔ A REMOTE BY NAME ONLY. THIS RESOURCE NEVER MODELS THE CREDENTIAL BEHIND IT, and a\n   *   `Pbs.Remote` family is OUT OF SCOPE for this package rather than merely unwritten:\n   *   `POST /config/remote` requires `password`, and Alchemy persists props and attributes to its\n   *   state store UNENCRYPTED (StateEncoding.ts tags Redacted values rather than encrypting them),\n   *   which here is the `alchemy` Postgres that a nightly job dumps to a backup guest. A remote's\n   *   password in a prop is that password in four places, for months. The only Remote resource that\n   *   could exist would refuse `password` the way storage.ts refuses it — as a `never` — and could\n   *   therefore never CREATE a remote, which is a resource that cannot do what its name promises.\n   *   Create remotes out of band (`proxmox-backup-manager remote create`) and name one here.\n   *   ⚠️ The fingerprint is not the problem: a certificate fingerprint is public. The password is.\n   * ⚠️ UNSET MEANS A LOCAL SYNC — datastore to datastore on this same PBS — which is a real and\n   *   supported mode, not an omission. See `matches`: an unset `remote` is NOT compared, so leaving\n   *   it out does not claim a job with a remote is local; it claims nothing at all.\n   */\n  remote?: string;\n  /** The datastore on that remote. Required by PBS at create. */\n  'remote-store': string;\n  /** Namespace on the remote. Unset means its root namespace. */\n  'remote-ns'?: string;\n  /**\n   * A PBS calendar event — `daily`, `hourly`, `mon..fri 02:30`. Unset means the job runs ONLY when\n   * somebody starts it by hand, which is a sync that is not happening; declare one.\n   * ⚠️ THIS COMPARES STRINGS, NOT MEANINGS. A calendar event has many equivalent spellings and PBS\n   *   stores the one it was handed, so declare the spelling the server echoes back.\n   */\n  schedule?: string;\n  /** Single line only — PBS's comment schema rejects a newline. */\n  comment?: string;\n  /**\n   * ⛔ THIS DELETES SNAPSHOTS. NOT \"prunes\", NOT \"tidies\" — DELETES, on a schedule, driven by\n   *   ANOTHER SERVER'S STATE. On a PULL job (the default), every backup group in the local `store`\n   *   and `ns` that is no longer on the remote is REMOVED LOCALLY the next time the job runs. The\n   *   remote decides; this side obeys. Somebody pruning hard on the remote, a remote datastore\n   *   restored from an older copy, a remote namespace renamed, or a remote that has simply lost\n   *   data — each of those becomes deletion HERE, and the local copy is usually the copy that was\n   *   supposed to survive the remote.\n   *   ⛔ AND ON A PUSH JOB IT DELETES ON THE REMOTE INSTEAD — same flag, opposite victim. Read\n   *     `sync-direction` before reading this one.\n   * ⚠️ IT IS COMPARED AND SENT EVEN WHEN UNDECLARED, unlike every other optional field here, and\n   *   that is deliberate: undeclared means `false`, so adopting a job somebody had switched this on\n   *   for plans as an UPDATE that switches it off — a real edit, and NOT a free one. It is the\n   *   direction that does not delete, but a job that was BOUNDING a datastore now grows it, and a\n   *   full PBS datastore fails every backup on it. The plan says only \"update\"; read the live job.\n   */\n  'remove-vanished'?: boolean;\n  /**\n   * The PBS Authid that owns the synced groups, e.g. `sync@pbs` or `sync@pbs!job1`. Unset leaves\n   * the config without one, which PBS reads as `root@pam` AT RUNTIME — so unset and `root@pam` are\n   * not the same value in the config even though they behave alike. Owning a group is what lets an\n   * Authid prune or delete it, so changing this is a permissions change, not a label.\n   * ⚠️ AN AUTHID IS AN IDENTIFIER, NEVER A SECRET — it may name an API token (`user@realm!name`),\n   *   and the token's VALUE is the secret. This resource stores the name and never the value.\n   */\n  owner?: string;\n  /**\n   * Incoming rate limit in BYTES PER SECOND. Unset means unlimited.\n   * ⚠️ DECLARED IN BYTES, STORED AS A HUMAN STRING. PBS types this as a `HumanByte`, so a written\n   *   `10485760` comes back as something like `10.00 MiB`; `bytes()` in the form file parses both\n   *   ends back to a byte count so the two can be compared at all. REASONED from the type, NOT\n   *   measured — I had no credential to round-trip one.\n   * ⛔ DECLARE A VALUE PBS CAN PRINT EXACTLY — a whole multiple of a binary unit. A rate that\n   *   rounds in the printed form (10485761) reads back as the rounded value, never equals what was\n   *   declared, and becomes an update reported on every plan forever. This is the single most\n   *   likely forever-diff in this file; it is the first thing to check on the first plan.\n   * ⚠️ `burst-in`, `rate-out` AND `burst-out` ARE NOT MODELLED. PBS's rate limit is four fields\n   *   flattened into the job; this resource manages one and leaves the others alone, which is safe\n   *   because PBS's update assigns only the parameters it was sent.\n   */\n  'rate-in'?: number;\n  /**\n   * How many namespace levels below `remote-ns` to sync, 0 (no recursion) upwards. Unset means PBS\n   * recurses as deep as it is allowed — which is MORE data, not less, so it is not a safe default\n   * to leave implicit on a job whose target namespace has children.\n   */\n  'max-depth'?: number;\n  /** Sync only the last N snapshots of each group. Unset means all of them. */\n  'transfer-last'?: number;\n  /**\n   * ⛔ NOT DECLARABLE, AND A COMPILE ERROR RATHER THAN A PROP THAT HALF WORKS — the storage.ts\n   *   `password` idiom. Two barriers originally applied; the second remains unresolved.\n   *   1. THE WIRE FORM IS AN ARRAY. PBS takes `group-filter` as a repeated parameter\n   *      (`group-filter=type:ct&group-filter=regex:^web`). The old single-value form could not\n   *      express it; the distilled PBS protocol now supports repeated keys.\n   *   2. NARROWING A FILTER MAY BE A DELETE. Whether `remove-vanished` skips the groups a filter\n   *      excludes is NOT something I could measure without a credential. If it does not, then\n   *      editing this field on a job with `remove-vanished` set removes every local group the new\n   *      filter excludes. A field that MIGHT delete snapshots when changed does not get a\n   *      half-working prop.\n   *   ★ IT IS STILL REPORTED in the attributes, so a plan shows the filters a hand-made job carries\n   *     and this resource never strips them: undeclared is unmanaged, and PBS's update assigns only\n   *     what it was sent. Making it declarable still needs a MEASURED answer to (2), even though\n   *     the SDK now supplies the necessary repeated-key transport.\n   */\n  'group-filter'?: never;\n  /**\n   * `pull` (default) or `push`. ⛔ IT DECIDES WHICH SIDE `remove-vanished` DELETES FROM. Push also\n   * needs a newer PBS: on a server that predates it the parameter is unknown and the create is\n   * refused, which is the honest failure.\n   * ⚠️ CREATE-ONLY HERE, SO A CHANGED DIRECTION PLANS AS NOOP — see `matches`. That is the\n   *   deliberately safe half of an unmeasured question: if PBS does accept it on PUT, the cost of\n   *   this choice is a noop; if PBS refuses it, comparing it would be an update the PUT can never\n   *   perform, on every plan, forever. Retire the declaration and add another, as user.ts says for\n   *   `userid`.\n   */\n  'sync-direction'?: 'pull' | 'push';\n  /**\n   * ⚠️ SYNC ONLY SNAPSHOTS THAT HAVE PASSED VERIFICATION. Present on 4.2 (`sync-job update\n   *   --verified-only <boolean>`, and in its `--delete` enum), and the estate sets it: the parked\n   *   `sync-all-to-dc` job carries `verified-only: true`, so without this prop that job cannot be\n   *   declared as it actually is.\n   * ⛔ IT PAIRS WITH A VERIFICATION JOB THAT ACTUALLY RUNS. With PBS's defaults a snapshot is\n   *   verified once and never again — see `rechecks` in pbs-verify-job-form.ts — so `verified-only`\n   *   on a datastore whose verify job is parked means \"sync only what was checked once, long ago\".\n   */\n  'verified-only'?: boolean;\n}\n\nexport interface PbsSyncJob extends Resource<\n  'Pbs.SyncJob',\n  SyncJobProps,\n  SyncJobAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ⚠️ NO `defaultRemovalPolicy: 'retain'`, and the reasoning is replication-job.ts's. Deleting this\n *   object removes a SCHEDULE, not data: every snapshot already synced stays in the local\n *   datastore, and PBS's own pruning is a different job. What is lost is freshness — which is\n *   destructive in six months rather than today, and is exactly why the plan line deserves reading.\n */\nexport const PbsSyncJob = Resource<PbsSyncJob>('Pbs.SyncJob');\n\n/**\n * ⛔ THE EMPTY `list` FROM THE FACTORY STANDS. `GET /config/sync` hands back every sync job an\n *   operator ever made in the UI, and adopting one is how a later `alchemy destroy` silently stops\n *   a second copy being refreshed. Adoption is an explicit act — declare the `id` you mean.\n * ⚠️ DELETING THE JOB DOES NOT DELETE SNAPSHOTS, AND `remove-vanished` DOES. Those two sentences\n *   are the whole risk model of this family and they point opposite ways: the DELETE plan line is\n *   safe today and expensive in six months, while a single `remove-vanished: true` is a standing\n *   instruction to delete local snapshots whenever another server loses them.\n */\nexport const PbsSyncJobProvider = () =>\n  Provider.effect(PbsSyncJob, Effect.succeed(PbsSyncJob.Provider.of(handlers)));\n",
+    "/** PBS 4.2.6-1 sync lifecycle; the SDK owns serialization and typed API errors. */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport { specGuards } from './resource-guard.ts';\nimport type { SyncJobAttributes, SyncJobProps } from './pbs-sync-job.ts';\nimport { spec } from './pbs-sync-job-form.ts';\nimport { createOne, deleteOne, readOne, updateOne } from './pbs-sync-job-wire.ts';\n\nconst { guardCreate, guardUpdate } = specGuards(spec);\n\nexport const handlers = {\n  // ⛔ Explicit adoption only: a listed job may be somebody else's only backup policy.\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: SyncJobProps }) => readOne(olds),\n  diff: ({ news, output }: { news: Input<SyncJobProps>; output: SyncJobAttributes | undefined }) =>\n    Effect.gen(function* () {\n      if (!isResolved(news)) return undefined;\n      yield* guardCreate(news, output === undefined);\n      yield* guardUpdate(news);\n      if (output === undefined) return undefined;\n      const live = yield* readOne(news);\n      if (live === undefined) {\n        yield* guardCreate(news, true);\n        return { action: 'update' } as const;\n      }\n      return { action: spec.matches(live, news) ? 'noop' : 'update' } as const;\n    }),\n  reconcile: ({ news }: { news: SyncJobProps }) =>\n    Effect.gen(function* () {\n      const live = yield* readOne(news);\n      yield* guardCreate(news, live === undefined);\n      yield* guardUpdate(news);\n      if (live === undefined) yield* createOne(news);\n      else if (!spec.matches(live, news)) yield* updateOne(news);\n      // ⛔ A successful write is not evidence of a job; read it back through the SDK.\n      const after = yield* readOne(news);\n      if (after === undefined) {\n        return yield* Effect.fail(\n          new Error(`${spec.path(news)}: write succeeded but job is absent.`),\n        );\n      }\n      return after;\n    }),\n  delete: ({ olds }: { olds: SyncJobProps }) => deleteOne(olds),\n};\n",
+    "import type { SyncJobAttributes, SyncJobProps } from './pbs-sync-job.ts';\n/**\n * A sync job on the wire: how a PBS answer becomes comparable values, how a declaration becomes a\n * create or an update, and — because that question is downstream of this one — when it has changed.\n *\n * ★ SPLIT OUT OF pbs-sync-job.ts FOR THE 250-LINE CAP; the ★ SEAM there says why `matches` came\n *   with the wire instead of staying with the props. The `import type` back is a cycle on paper\n *   only — erased before anything runs, so the runtime arrow points one way, resource to wire.\n *\n * ★ HISTORICALLY IT USED THE SHARED PVE CLIENT, NOT A PBS ONE. An earlier draft of this file was written\n *   against a `./pbs-client.ts` that never existed, and spelled out what it would have to export.\n *   That module is not needed: PBS speaks the same `/api2/json` paths and the same `{\"data\": …}`\n *   envelope, its OpenBao mount vends the same `{token_id, secret}`, and the only difference is\n *   the authorization header — so `PveTarget` carries a `scheme` and `authorization()` spells\n *   `PBSAPIToken=<id>:<secret>` for `'pbs'`. The SDK now owns that header; the pure spec below\n *   preserves the existing field and retention semantics.\n *   The one PBS-specific thing that survived is the FORM TYPE: PBS decodes a multi-valued field\n *   from repeated keys, and the distilled PBS protocol must preserve that encoding.\n\n */\nimport type { PveSpec } from './resource-spec.ts';\nimport { bool, int, text } from './values.ts';\n\n/**\n * The marker for \"PBS has no value for this number\".\n *\n * ⚠️ `-1` RATHER THAN `0`, AND metric-server.ts's `UNSET = -1` IS THE PRECEDENT. `max-depth` has a\n *   legal value of 0 — sync this namespace and no child of it — which is a completely different\n *   instruction from the absent field, where PBS recurses as deep as it is allowed. Using 0 as the\n *   marker would make \"no recursion\" and \"full recursion\" the same attribute. `rate-in` and\n *   `transfer-last` take the same marker for uniformity rather than because 0 is legal for them:\n *   depending on a schema minimum I could not measure is exactly the kind of guess that becomes a\n *   forever-diff.\n */\nexport const UNSET = -1;\n\n/** ⚠️ BINARY AND DECIMAL BOTH, because PBS's HumanByte can print either and parses both. */\nconst UNITS: Record<string, number> = {\n  '': 1,\n  B: 1,\n  GB: 1e9,\n  GiB: 1073741824,\n  KB: 1e3,\n  KiB: 1024,\n  MB: 1e6,\n  MiB: 1048576,\n  TB: 1e12,\n  TiB: 1099511627776,\n};\n\n/**\n * A PBS rate limit off the wire, as a plain byte count.\n *\n * ⛔ THE VALUE GOES OUT AS A NUMBER AND COMES BACK AS PROSE. PBS types `rate-in` as a `HumanByte`,\n *   which parses `10485760` on the way in and prints something like `10.00 MiB` on the way out, so\n *   the two sides of a comparison are never the same string. Flattening both to bytes is what makes\n *   the field comparable at all. REASONED from the type's parse/print asymmetry, NOT measured —\n *   there was no credential to round-trip one with.\n * ⚠️ IT ROUNDS, AND A RATE THAT DOES NOT DIVIDE EVENLY WILL NEVER SETTLE. `10.00 MiB` carries two\n *   decimals, so a declared 10485761 reads back as 10485760, `matches` reports an update, the PUT\n *   writes the same rounded value, and the next plan reports it again — forever. Declare a whole\n *   multiple of a binary unit. This is the likeliest forever-diff in the family and the first thing\n *   to check on the first plan against a live PBS.\n * ⚠️ AN UNPARSEABLE ANSWER READS AS `UNSET`, which for a DECLARED rate means \"not equal\" and so an\n *   update rather than a silent noop. Wrong-but-loud is the right way round here.\n */\nexport const bytes = (value: unknown): number => {\n  if (typeof value === 'number') return value;\n  const raw = text(value).trim();\n  const match = /^([0-9]+(?:\\.[0-9]+)?)\\s*([A-Za-z]*)$/.exec(raw);\n  if (match === null) return UNSET;\n  const unit = UNITS[match[2] ?? ''];\n  return unit === undefined ? UNSET : Math.round(Number(match[1] ?? '0') * unit);\n};\n\n/**\n * The live group filters, joined for a human.\n *\n * ⚠️ DISPLAY ONLY — NEVER SENT, NEVER COMPARED. The ⛔ on the `group-filter` prop says why the field\n *   is not declarable; this exists so that a plan against an adopted job SHOWS the filters this\n *   resource is deliberately leaving alone, rather than making them invisible.\n * ⚠️ THE SEPARATOR IS ` | `, NOT A COMMA: a `regex:` filter may contain either, so no join here is\n *   unambiguous — and a comma is the one that would invite somebody to parse this back.\n */\nexport const filters = (value: unknown): string =>\n  Array.isArray(value) ? value.map((entry: unknown) => String(entry)).join(' | ') : text(value);\n\n/**\n * The half of a declaration that create and update both send.\n *\n * ⛔ `remove-vanished` IS ALWAYS SENT, AT ITS DEFAULT INCLUDED, and that is the one field here that\n *   breaks the \"undeclared is unmanaged\" rule on purpose. It is always COMPARED (see `matches`), and\n *   backup-job.ts records why the two must agree: a field compared against a default but not sent as\n *   that default is an update reported on every plan that the PUT never performs. `0` is the\n *   direction that does not delete; the prop says why that is still not a free edit.\n * ⚠️ THE TERNARY IS NOT A REFUSAL TO REUSE values.ts's `flag()`; IT IS WHAT `flag()` IS DOCUMENTED\n *   NOT TO DO. That coercion answers `undefined` for an undeclared boolean precisely so an omitted\n *   field is never sent — it is the tool for \"send it only if declared\", and this is the one field\n *   that must be sent ALWAYS. Calling it here types as `string | undefined` and tsc rejects the\n *   form (MEASURED: TS2322, \"Type 'undefined' is not assignable to type 'string'\"), which is the\n *   type system saying the same thing. replication-job-form.ts writes its always-sent `disable` the\n *   same way, for the same reason.\n * ⚠️ `1`/`0` RATHER THAN `true`/`false`: PBS's boolean schema accepts both spellings (DOCUMENTED),\n *   and one spelling shared with the PVE families is one fewer thing to keep in step.\n * ⚠️ EVERY OTHER FIELD IS SPREAD IN ONLY WHEN DECLARED. An undeclared key is not sent, so PBS leaves\n *   it exactly as it is — which is what makes adopting a hand-made job non-destructive.\n */\nconst shape = (props: SyncJobProps) => ({\n  'remote-store': props['remote-store'],\n  'remove-vanished': props['remove-vanished'] === true ? '1' : '0',\n  store: props.store,\n  ...(props.comment === undefined ? {} : { comment: props.comment }),\n  ...(props['max-depth'] === undefined ? {} : { 'max-depth': String(props['max-depth']) }),\n  ...(props.ns === undefined ? {} : { ns: props.ns }),\n  ...(props.owner === undefined ? {} : { owner: props.owner }),\n  ...(props['rate-in'] === undefined ? {} : { 'rate-in': String(props['rate-in']) }),\n  ...(props.remote === undefined ? {} : { remote: props.remote }),\n  ...(props['remote-ns'] === undefined ? {} : { 'remote-ns': props['remote-ns'] }),\n  ...(props.schedule === undefined ? {} : { schedule: props.schedule }),\n  ...(props['verified-only'] === undefined\n    ? {}\n    : { 'verified-only': props['verified-only'] ? '1' : '0' }),\n  ...(props['transfer-last'] === undefined\n    ? {}\n    : { 'transfer-last': String(props['transfer-last']) }),\n});\n\n/**\n * ⛔ `id` IS SENT AND IS NOT OPTIONAL. PBS's create takes it rather than inventing one, so this\n *   family avoids backup-job.ts's worst failure by construction — but only while the id is here.\n *   A POST without one would be refused rather than silently duplicating the job, which is the\n *   better failure, and it is still not a reason to leave it out.\n * ⛔ `sync-direction` IS THE ONE FIELD SENT ONLY ON CREATE. It decides which side `remove-vanished`\n *   deletes from, it is not compared (see `matches`), and on a PBS old enough to have no push\n *   support it is an unknown parameter — so sending it on every update would turn every deploy\n *   against such a server into a 400 over a field nobody was changing.\n */\nexport const createBody = (props: SyncJobProps): Record<string, string> => ({\n  ...shape(props),\n  id: props.id,\n  ...(props['sync-direction'] === undefined ? {} : { 'sync-direction': props['sync-direction'] }),\n});\n\n/**\n * ⚠️ THE UPDATE IS THE SHARED HALF AND NOTHING ELSE — no `id` (it is the path), no\n *   `sync-direction`, no `delete` list. The factory only PUTs when `matches` is false and the form\n *   is non-empty, and this form is never empty because `remove-vanished` and the two store names\n *   are always present. That is fine here: reconcile reaches this line only when something really\n *   does differ, and re-sending the two store names it just compared is a write of what is already\n *   there rather than a change.\n */\nexport const updateBody = (props: SyncJobProps): Record<string, string> => shape(props);\n\nexport const spec: PveSpec<SyncJobProps, SyncJobAttributes> = {\n  /**\n   * ⛔ NO \"IS IT REALLY THERE\" GUARD, for backup-job.ts's reason: absence is the API declining to\n   *   answer, which the factory's `read` already handles, not a key missing from an answer that did\n   *   arrive. Every fallback below is PBS's documented default rather than one picked for\n   *   convenience, so the answer does not depend on whether a release echoes a key it never wrote.\n   * ⛔ EXCEPT `store` AND `remote-store`, WHICH FALL BACK TO `''` RATHER THAN TO THE DECLARED VALUE.\n   *   They are the only required fields `matches` COMPARES, and a props-shaped fallback would make a\n   *   malformed answer compare EQUAL — drift that hides itself, where `''` can only be loud. `id`\n   *   keeps its props fallback: it is the path the object was read by, and is never compared.\n   * ⚠️ `digest` IS DELIBERATELY NOT AN ATTRIBUTE. PBS returns one for `sync.cfg` as a FILE, so\n   *   keeping it would rewrite this resource's state whenever an unrelated sync job was edited —\n   *   churn that reads like drift. ha-resource.ts hit exactly that on PVE.\n   * ⚠️ NEITHER IS THE RUN STATUS. `last-run-state`, `last-run-upid`, `last-run-endtime` and\n   *   `next-run` come from the LIST endpoint, not from `GET /config/sync/{id}` which this reads.\n   *   A plan whose output changes every time the job runs is a plan people stop reading.\n   */\n  attributes: (live, props) => ({\n    comment: text(live['comment'], ''),\n    'group-filter': filters(live['group-filter']),\n    id: props.id,\n    'max-depth': int(live['max-depth'], UNSET),\n    ns: text(live['ns'], ''),\n    owner: text(live['owner'], ''),\n    'rate-in': bytes(live['rate-in']),\n    remote: text(live['remote'], ''),\n    'remote-ns': text(live['remote-ns'], ''),\n    'remote-store': text(live['remote-store'], ''),\n    // ⚠️ PBS answers with a JSON `true`/`false` where PVE answers `1`/`0`; `bool` takes both, and\n    //   takes the string `'false'` correctly too if some release spells it that way.\n    'remove-vanished': bool(live['remove-vanished'], false),\n    schedule: text(live['schedule'], ''),\n    // ⚠️ ABSENT MEANS FALSE, the PBS-side default — so an undeclared prop and a job that never had\n    //   the field compare equal, and adopting one does not plan an edit.\n    'verified-only': bool(live['verified-only'], false),\n    store: text(live['store'], ''),\n    'sync-direction': text(live['sync-direction'], 'pull'),\n    'transfer-last': int(live['transfer-last'], UNSET),\n  }),\n  collection: () => 'config/sync',\n  createForm: createBody,\n  /**\n   * ⛔ ONLY FIELDS A WRITE CAN ACTUALLY SET ARE COMPARED, and on PBS that list is REASONED rather\n   *   than measured: the published update schema for `PUT /config/sync/{id}` takes every property\n   *   of the job except its `id`. If a release turns out to refuse one of these, the comparison\n   *   becomes an update the PUT cannot perform — reported on every plan, forever. That is what the\n   *   first plan against a live PBS is for.\n   * ⚠️ `remove-vanished` IS COMPARED UNCONDITIONALLY — undeclared means false. Every other optional\n   *   field reads \"not declared, or equal\": undeclared is UNMANAGED, so a schedule, comment, owner,\n   *   namespace or limit somebody set by hand survives adoption untouched. The destructive one does\n   *   not get that courtesy, and the price is that adopting a job with it switched on is a real\n   *   edit, announced only as \"update\" — toward not deleting, and toward a datastore that grows.\n   * ⚠️ `store` AND `remote-store` ARE COMPARED UNCONDITIONALLY because PBS requires them at create,\n   *   so there is no undeclared case to protect. `remote` is NOT: an absent `remote` on an existing\n   *   job would otherwise plan an update clearing it, and `remote=` is not a value PBS's id schema\n   *   accepts — a failing PUT on every deploy, over a field the declaration never mentioned.\n   * ⚠️ `id`, `group-filter` AND `sync-direction` ARE OUT. The first is the path, a change to which\n   *   is a different object; the other two are argued on their props in pbs-sync-job.ts.\n   */\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: { create: 'pbs:POST /config/sync', update: 'pbs:PUT /config/sync/{id}' },\n  matches: (attributes, props) =>\n    attributes['remove-vanished'] === (props['remove-vanished'] === true) &&\n    attributes.store === props.store &&\n    attributes['remote-store'] === props['remote-store'] &&\n    (props.remote === undefined || attributes.remote === props.remote) &&\n    (props.ns === undefined || attributes.ns === props.ns) &&\n    (props['remote-ns'] === undefined || attributes['remote-ns'] === props['remote-ns']) &&\n    (props.schedule === undefined || attributes.schedule === props.schedule) &&\n    (props.comment === undefined || attributes.comment === props.comment) &&\n    (props.owner === undefined || attributes.owner === props.owner) &&\n    // ⚠️ NOT COMPARED UNCONDITIONALLY, unlike `remove-vanished`. Turning `verified-only` ON is the\n    //   safe direction (sync less), so undeclared stays UNMANAGED like every other optional field;\n    //   `remove-vanished` gets the unconditional treatment because its unsafe direction deletes.\n    (props['verified-only'] === undefined ||\n      attributes['verified-only'] === props['verified-only']) &&\n    (props['rate-in'] === undefined || attributes['rate-in'] === props['rate-in']) &&\n    (props['max-depth'] === undefined || attributes['max-depth'] === props['max-depth']) &&\n    (props['transfer-last'] === undefined ||\n      attributes['transfer-last'] === props['transfer-last']),\n  /** ⚠️ A Proxmox safe id has no `/` or `:` in it, so there is nothing here to encode. */\n  path: (props) => `config/sync/${props.id}`,\n  updateForm: updateBody,\n};\n",
+    "/** PBS 4.2.6-1 operations through @distilled.cloud/proxmox-backup. */\nimport * as config from '@distilled.cloud/proxmox-backup/config';\nimport * as Effect from 'effect/Effect';\nimport { runPbs } from './distilled-pbs.ts';\nimport type { SyncJobProps } from './pbs-sync-job.ts';\nimport { createBody, spec, updateBody } from './pbs-sync-job-form.ts';\n\n/** SDK member names differ from the vendor form names; omission stays unmanaged. */\nconst members = (form: Record<string, string>) => ({\n  ...(form['remote-store'] === undefined ? {} : { remote_store: form['remote-store'] }),\n  ...(form['remove-vanished'] === undefined ? {} : { remove_vanished: form['remove-vanished'] }),\n  ...(form['store'] === undefined ? {} : { store: form['store'] }),\n  ...(form['comment'] === undefined ? {} : { comment: form['comment'] }),\n  ...(form['max-depth'] === undefined ? {} : { max_depth: form['max-depth'] }),\n  ...(form['ns'] === undefined ? {} : { ns: form['ns'] }),\n  ...(form['owner'] === undefined ? {} : { owner: form['owner'] }),\n  ...(form['rate-in'] === undefined ? {} : { rate_in: form['rate-in'] }),\n  ...(form['remote'] === undefined ? {} : { remote: form['remote'] }),\n  ...(form['remote-ns'] === undefined ? {} : { remote_ns: form['remote-ns'] }),\n  ...(form['schedule'] === undefined ? {} : { schedule: form['schedule'] }),\n  ...(form['verified-only'] === undefined ? {} : { verified_only: form['verified-only'] }),\n  ...(form['transfer-last'] === undefined ? {} : { transfer_last: form['transfer-last'] }),\n  ...(form['sync-direction'] === undefined ? {} : { sync_direction: form['sync-direction'] }),\n});\n\nconst createRequest = (props: SyncJobProps): config.SyncConfigRequest => ({\n  ...members(createBody(props)),\n  id: props.id,\n  store: props.store,\n  remote_store: props['remote-store'],\n});\n\nconst updateRequest = (props: SyncJobProps): config.PutConfigSyncRequest => ({\n  ...members(updateBody(props)),\n  id: props.id,\n});\n\n/** Preserve the state attribute shape while the SDK decodes its typed field names. */\nconst wire = (row: config.GetConfigSyncResponse): Record<string, unknown> => ({\n  ...row,\n  'remote-store': row.remote_store,\n  'remove-vanished': row.remove_vanished,\n  'max-depth': row.max_depth,\n  'rate-in': row.rate_in,\n  'remote-ns': row.remote_ns,\n  'verified-only': row.verified_only,\n  'transfer-last': row.transfer_last,\n  'sync-direction': row.sync_direction,\n  'group-filter': row.group_filter,\n});\n\n/** ⛔ Only the SDK SyncJobNotFound is absence; permission, transport and malformed replies propagate. */\nexport const readOne = (props: SyncJobProps) =>\n  runPbs(props.target, 'read', config.getConfigSync({ id: props.id })).pipe(\n    Effect.map((row) => spec.attributes(wire(row), props)),\n    Effect.catchTag('SyncJobNotFound', () => Effect.succeed(undefined)),\n  );\n\nexport const createOne = (props: SyncJobProps) =>\n  runPbs(props.target, 'provision', config.syncConfig(createRequest(props)));\n\nexport const updateOne = (props: SyncJobProps) =>\n  runPbs(props.target, 'provision', config.putConfigSync(updateRequest(props)));\n\n/** Deleting the schedule never deletes backups; already missing is a successful deletion. */\nexport const deleteOne = (props: SyncJobProps) =>\n  Effect.gen(function* () {\n    // ⛔ Missing-item tags are measured for GET only. Do not guess the DELETE error shape.\n    if ((yield* readOne(props)) === undefined) return;\n    return yield* runPbs(props.target, 'provision', config.deleteConfigSync({ id: props.id }));\n  });\n",
+    "/**\n * `Pbs.VerifyJob` — one section of PBS's `verification.cfg`, declared.\n *\n * ★ THIS IS THE FAMILY THAT ANSWERS \"ARE THE BACKUPS ACTUALLY GOOD\", AND NOTHING ELSE IN THIS\n *   PACKAGE DOES. A datastore reports free space, a prune job reports that it ran, and every\n *   snapshot in the store can still be unreadable: PBS learns a chunk has rotted only when\n *   something reads it back and checks its digest, and verification is the only thing that does\n *   that on a schedule. An undeclared verify job is the reason nobody notices for months — and a\n *   green `Proxmox.BackupJob` makes it worse rather than better, because a vzdump job that says\n *   \"OK\" every night is exactly the evidence people stop at.\n *\n * ⚠️ HISTORICAL BOOTSTRAP BLOCKER, 2026-09-13: TWO THINGS OUTSIDE THIS FILE WERE MISSING\n *   before PBS could authenticate. Both are now resolved by the PBS lane and SDK:\n *     1. `credentials.ts` has no PBS mint. MEASURED 2026-09-13 from this Mac: the agent's\n *        approle is refused `sys/mounts`, `kv/infra/proxmox` and `proxmox-pbs/creds/read` alike —\n *        403 permission denied on all three — so there is no mount to name and none is invented.\n *     2. `client.ts`'s `authorization()` builds a PVE header, and PBS will not accept it. See the\n *        ⛔ on `PbsTarget`.\n *   Before both landed, every call 401'd, `pveOperations.read` folded that into \"absent\", and the plan\n *   reported `create` for a job that was plainly there. The deploy then FAILED at the POST rather\n *   than clobbering anything — an unauthenticated POST 401s, and an authenticated one is refused\n *   because PBS will not take a duplicate section id — so the cost is a LYING PLAN and a broken\n *   run, not a lost job. That is still reason enough not to wire it into a stack yet: a plan\n *   nobody can trust is its own outage.\n *\n * ⚠️ THE ORIGINAL SHAPES WERE READ FROM PUBLISHED SOURCE, NOT MEASURED ON THIS ESTATE. Everything is\n *   originally taken from `pbs-api-types/src/jobs.rs`, `src/api2/config/verify.rs`, `src/server/verify_job.rs`\n *   and `src/backup/verify.rs` at HEAD of the Proxmox git mirrors on 2026-09-13. What WAS measured\n *   here: `pbs.example.com:8007` and `pbs.mgmt.example.com:8007` both answer HTTP 401 under\n *   STRICT TLS (curl `ssl_verify_result=0`), so no `-k` is needed and `client.ts`'s plain `fetch`\n *   reaches PBS unchanged. The running host's own schema was NOT read — no credential — so a PBS\n *   older than HEAD may differ.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { handlers } from './pbs-verify-job-lifecycle.ts';\nimport type { PbsTarget } from './credentials.ts';\nimport type { PveRequirements } from './resource-spec.ts';\n\nexport interface PbsVerifyJobProps {\n  /** ⛔ A PBS host, never a PVE cluster. See `PbsTarget`. */\n  target: PbsTarget;\n  /**\n   * ⛔ The primary key, REQUIRED, and never left to PBS. 3–32 chars of\n   * `[A-Za-z0-9_][A-Za-z0-9._-]*`. PBS refuses a duplicate section id outright, which is the loud\n   * failure `Proxmox.BackupJob` had to engineer for itself — but only because the id is sent.\n   */\n  id: string;\n  /** Datastore name, 3–32 safe-id chars. ⚠️ MUTABLE — see the ⚠️ on `matches`. */\n  store: string;\n  /**\n   * ⛔ THE KEY IS REQUIRED AND THE VALUE MAY BE `null`. PBS makes the field optional; this family\n   * refuses to let you OMIT it, which is not the same thing. A verification job with no schedule\n   * never runs on its own and PBS reports it as perfectly healthy — and an absent schedule is also\n   * the only way to turn one off, because there is NO `disable` field on a verification job.\n   * ⛔ THAT LAST CLAIM IS NOW MEASURED, not read from source. `proxmox-backup-manager verify-job\n   *   update --help` on the live 4.2 host lists `--delete\n   *   ignore-verified|comment|schedule|outdated-after|ns|max-depth|read-threads|verify-threads`\n   *   and no `--disable` anywhere. So `schedule` is deletable — \"parked\" is a state PBS supports —\n   *   and `disable` genuinely does not exist. pbs-verify-job-form.ts said this was read off the\n   *   source and NOT verified against a running host; it is now verified, on this one.\n   * ★ SO `null` MEANS \"DELIBERATELY PARKED\" AND OMITTING IT IS STILL AN ERROR. The original\n   *   required-string kept you from declaring verification that never happens, which is right, but\n   *   it also made a genuinely parked job UNDECLARABLE — and the estate has one: `v-datacenter` is\n   *   parked because syno1 is powered off, comment and runbook and all. A resource that cannot\n   *   describe what is really there pushes the operator back to the CLI, which is the failure this\n   *   package exists to end. Writing `schedule: null` costs a word and says the quiet part out\n   *   loud; leaving the key out still will not compile.\n   * ⚠️ ADOPTING A SCHEDULELESS JOB WITH A SCHEDULE DECLARED GIVES IT ONE ON THE FIRST DEPLOY, which\n   *   is the intended direction and is still a write nobody asked for in words. `matches` compares\n   *   `schedule`, the live value reads `''`, so the first reconcile PUTs the declared one and\n   *   verification starts running that night. Read the first plan against an adopted job.\n   * ⚠️ A systemd calendar event. Spelled `daily`, `sat 02:00`, `mon..fri 23:00`. A step expression\n   *   is legal too and is not written out here: those two characters would close this comment.\n   */\n  schedule: string | null;\n  /**\n   * The namespace to verify, e.g. `tier1/prod`. Omitted means the datastore root.\n   * ⛔ NEVER SENT AS THE EMPTY STRING. MEASURED in the update handler: `if !ns.is_root()` — a root\n   *   namespace on a PUT is accepted by the schema, reaches the handler and is then SILENTLY\n   *   DISCARDED. A job cannot be moved back to the root namespace by this resource at all; that\n   *   needs `--delete ns` by hand. So an undeclared `ns` is neither sent nor compared.\n   */\n  ns?: string;\n  /**\n   * How many namespace levels below `ns` to descend. `0` is that level only; PBS's maximum is 7.\n   * ⚠️ PBS's own default is FULL recursion (7), not 0. Undeclared means undeclared here: not sent,\n   *   not compared, because \"unset\" and \"7\" are stored differently and only one is reachable.\n   */\n  'max-depth'?: number;\n  /**\n   * ⛔ THE HALF OF THE PAIR THAT DECIDES WHETHER THIS JOB EVER RE-CHECKS ANYTHING. Defaults to\n   *   TRUE. Read `rechecks` and the ⛔ in pbs-verify-job-form.ts before setting either of these.\n   */\n  'ignore-verified'?: boolean;\n  /** Days after which a past verification is stale. ⛔ See the pair's ⛔ in the form file. */\n  'outdated-after'?: number;\n  /** ⚠️ PBS TRIMS IT AND STORES AN EMPTY ONE AS ABSENT, so `'  '` reads back as `''`. */\n  comment?: string;\n}\n\nexport interface PbsVerifyJobAttributes {\n  id: string;\n  store: string;\n  schedule: string;\n  ns: string;\n  /** ⚠️ `-1` means \"no max-depth in the section\". `0` is a real setting meaning no recursion. */\n  'max-depth': number;\n  'ignore-verified': boolean;\n  /** ⚠️ `-1` means \"unset\", which is NOT `0`. See the ⛔ in the form file. */\n  'outdated-after': number;\n  comment: string;\n  /**\n   * ★ WHAT THIS JOB ACTUALLY RE-CHECKS, IN ENGLISH, COMPUTED FROM THE LIVE PAIR. REPORTED, NEVER\n   *   COMPARED — it is derived from two fields `matches` already compares, so diffing it would\n   *   double-count them. It exists because the failure this family guards against is a job that\n   *   looks healthy in every column and verifies each snapshot exactly once, ever; that job reads\n   *   `never` here. A plan line is the only place anyone will see it.\n   */\n  rechecks: string;\n}\n\nexport interface PbsVerifyJob extends Resource<\n  'Pbs.VerifyJob',\n  PbsVerifyJobProps,\n  PbsVerifyJobAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ⚠️ NO `defaultRemovalPolicy: 'retain'`, DELIBERATELY, AND IT IS THE CLOSER CALL THAN IT LOOKS.\n *   The section holds no data — deleting it destroys nothing, the way `Proxmox.BackupJob`'s delete\n *   destroys no archives. What it destroys is the CHECKING, silently and permanently, and PBS will\n *   not refuse it the way it refuses to remove a datastore in use. `retain` would hide that behind\n *   a state-row drop instead of showing it as a plan line, and the plan line is the only warning\n *   anyone gets. Pipe `RemovalPolicy.retain()` per declaration where the job must outlive the code.\n */\nexport const PbsVerifyJob = Resource<PbsVerifyJob>('Pbs.VerifyJob');\n\n/**\n * ⛔ `list` STAYS EXPLICITLY EMPTY, AND THE REASON IS SHARPER HERE THAN ELSEWHERE.\n *   `GET /config/verify` returns every verification job the caller can see, including the\n *   ones the PBS installer and a human made. Adopting those would put Alchemy one dropped line\n *   away from DELETING a datastore's only verification schedule — and deleting it destroys nothing\n *   visible, so the loss is discovered the day a restore fails and there is no verification history\n *   to say when the rot started. Adoption stays explicit: declare the existing id.\n *\n * ⚠️ NO `digest` IS SENT ON UPDATE OR DELETE, SO THIS IS LAST-WRITER-WINS. PBS accepts an optional\n *   `digest` on both and would refuse a write made against a stale read. This migration preserves\n *   the existing forms, which omit it; the SDK runner reuses leased credentials but does not add\n *   an optimistic-lock check. A concurrent edit from the PBS UI may therefore be overwritten\n *   rather than refused. PBS offers that stronger guarantee as a separate provider change.\n */\nexport const PbsVerifyJobProvider = () =>\n  Provider.effect(PbsVerifyJob, Effect.succeed(PbsVerifyJob.Provider.of(handlers)));\n",
+    "/** PBS 4.2.6-1 verify lifecycle; the SDK owns serialization and typed API errors. */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport { specGuards } from './resource-guard.ts';\nimport type { PbsVerifyJobAttributes, PbsVerifyJobProps } from './pbs-verify-job.ts';\nimport { spec } from './pbs-verify-job-spec.ts';\nimport { createOne, deleteOne, readOne, updateOne } from './pbs-verify-job-wire.ts';\n\nconst { guardCreate, guardUpdate } = specGuards(spec);\n\nexport const handlers = {\n  // ⛔ Explicit adoption only: a listed job may be somebody else's only backup policy.\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: PbsVerifyJobProps }) => readOne(olds),\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<PbsVerifyJobProps>;\n    output: PbsVerifyJobAttributes | undefined;\n  }) =>\n    Effect.gen(function* () {\n      if (!isResolved(news)) return undefined;\n      yield* guardCreate(news, output === undefined);\n      yield* guardUpdate(news);\n      if (output === undefined) return undefined;\n      const live = yield* readOne(news);\n      if (live === undefined) {\n        yield* guardCreate(news, true);\n        return { action: 'update' } as const;\n      }\n      return { action: spec.matches(live, news) ? 'noop' : 'update' } as const;\n    }),\n  reconcile: ({ news }: { news: PbsVerifyJobProps }) =>\n    Effect.gen(function* () {\n      const live = yield* readOne(news);\n      yield* guardCreate(news, live === undefined);\n      yield* guardUpdate(news);\n      if (live === undefined) yield* createOne(news);\n      else if (!spec.matches(live, news)) yield* updateOne(news);\n      // ⛔ A successful write is not evidence of a job; read it back through the SDK.\n      const after = yield* readOne(news);\n      if (after === undefined) {\n        return yield* Effect.fail(\n          new Error(`${spec.path(news)}: write succeeded but job is absent.`),\n        );\n      }\n      return after;\n    }),\n  delete: ({ olds }: { olds: PbsVerifyJobProps }) => deleteOne(olds),\n};\n",
     "/**\n * A verification job's props as the form PBS wants, and the one derived string worth reporting.\n *\n * ★ SPLIT OUT OF pbs-verify-job.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, on the seam\n *   replication-job-form.ts and ha-rule-form.ts already cut: this file answers \"how does a\n *   declaration become a PBS write, and what do the two filter fields actually mean\", and\n *   pbs-verify-job.ts answers \"what is a verification job and when has it changed\". Nothing here\n *   reads the host and nothing here decides a diff.\n *\n * ⚠️ THE `import type` BACK TO pbs-verify-job.ts IS A CYCLE ON PAPER ONLY — type-only, erased\n *   before anything runs, and `PbsVerifyJobProps` stays public in the file declaring the resource.\n *\n * ⛔ THERE IS NO `disable` FIELD ON A PBS VERIFICATION JOB, AND SHIPPING A PROP FOR ONE WOULD HAVE\n *   BEEN THE WORST BUG IN THIS FAMILY. Prune jobs have `disable` and sync jobs have `disable`;\n *   `VerificationJobConfig` does not, in the struct, in the API schema, or in the update handler's\n *   `DeletableProperty` enum — read at HEAD of pbs-api-types and src/api2/config/verify.rs on\n *   2026-09-13. A `disable` prop would therefore be a prop that either does nothing or 400s the\n *   whole call (the create schema has `additional_properties: false`, so an unknown key is\n *   rejected with \"schema does not allow additional properties\"). Either way it would be a\n *   declaration saying \"verification is paused\" that PBS never agreed to. The real off switch is\n *   an absent `schedule`.\n *   ★ NOW VERIFIED AGAINST THE RUNNING HOST, which this comment previously said it was not.\n *     `proxmox-backup-manager verify-job update --help` on the live 4.2 server offers\n *     `--comment --delete --digest --ignore-verified --max-depth --ns --outdated-after\n *     --read-threads --schedule --store --verify-threads` — no `--disable` — and its `--delete`\n *     enum contains `schedule`. Both halves of the claim hold on this estate's actual version.\n *   ⚠️ `read-threads` AND `verify-threads` EXIST ON 4.2 AND ARE NOT PROPS HERE. Nothing on this\n *     estate sets either, and a prop nobody uses is an abstraction with no user — the same reason\n *     `PveSpec.immutable` was backed out. Add them when something needs them.\n *\n * ⛔ `withClears` FROM values.ts IS DELIBERATELY NOT USED HERE, AND USING IT WOULD BREAK EVERY\n *   UPDATE. PVE's `delete` is ONE comma-separated string; PBS's is an ARRAY of an enum. MEASURED in\n *   proxmox-schema's `do_parse_parameter_strings`: for an `Schema::Array` property each occurrence\n *   of the key pushes ONE element, so a form body must REPEAT the key — `delete=ns&delete=comment`.\n *   `withClears` emits `delete: 'ns,comment'`, which PBS parses as a single element `\"ns,comment\"`,\n *   which is not a `DeletableProperty` variant, so the call fails with a parameter error. It fails\n *   loudly rather than quietly, which is the only good news in it.\n *   ★ AND IT COULD NOT BE FIXED IN THIS FILE ANYWAY. `client.ts` types a form as\n *     `Record<string, string>` and builds it with `new URLSearchParams(form)`; neither a plain\n *     object nor that constructor overload can express a repeated key. Clearing a PBS field needs\n *     a client that takes entry pairs. Until one exists, this form SETS and never CLEARS — so an\n *     undeclared field is left alone and, in pbs-verify-job.ts, is not compared either.\n */\nimport type { PbsVerifyJobProps } from './pbs-verify-job.ts';\n\n/**\n * What the live pair actually causes, rendered for a plan line.\n *\n * ⛔ THE DEFAULTS MEAN \"VERIFY EACH SNAPSHOT EXACTLY ONCE, EVER\", AND THAT IS THE FAILURE THIS\n *   WHOLE FAMILY EXISTS TO MAKE VISIBLE. Read from src/backup/verify.rs `verify_filter` and\n *   src/server/verify_job.rs at HEAD on 2026-09-13, the filter is:\n *\n *     ignore_verified = ignore_verified.unwrap_or(true)      // absent means TRUE\n *     if !ignore_verified                       -> verify\n *     manifest has no verify state              -> verify\n *     outdated_after is None                    -> SKIP, forever\n *     days_since_last_verify > outdated_after   -> verify\n *\n *   So a job created with neither field set — the shape the PBS web UI produces when nobody\n *   touches those two boxes — checks every snapshot once on the run after it is written and then\n *   never looks at it again. Bit rot that appears a month later is never found. The job stays\n *   green the entire time, because a job that verified nothing verified nothing badly.\n *\n * ⚠️ A FAILED PAST VERIFICATION IS SKIPPED TOO. `verify_filter` looks only at whether a verify\n *   state EXISTS, never at whether it says Ok or Failed, so a snapshot that failed once is not\n *   re-checked by a defaulted job either. Pair that with a prune job and the failure ages out\n *   without anyone confirming it.\n *\n * ⛔ `outdated-after: 0` DOES NOT MEAN \"NEVER\", THOUGH PBS'S OWN STRUCT DOC SAYS IT DOES. That\n *   comment — \"Reverify snapshots after X days, never if 0\" — contradicts the code beside it: the\n *   test is `days_since_last_verify > max_age`, so `0` re-verifies everything checked more than a\n *   day ago, i.e. very nearly every run. The schema text calls `0` deprecated and the minimum is\n *   `0`, so it is accepted. \"Never\" is the ABSENT value, not the zero — and this resource cannot\n *   get a job back to absent (see the ⛔ on `withClears` above), so a declaration that sets\n *   `outdated-after` has made a one-way choice. Undo it by hand:\n *   `proxmox-backup-manager verify-job update <id> --delete outdated-after`.\n *\n * ⚠️ THE COMPARISON IS INTEGER DAYS SINCE THE LAST RUN'S START, `(now - upid.starttime) / 86400`,\n *   and it is strictly greater-than. `outdated-after: 30` therefore re-checks on day 31.\n */\nexport const rechecks = (ignoreVerified: boolean, outdatedAfter: number): string => {\n  if (!ignoreVerified) return 'every snapshot on every run';\n  // ⚠️ `-1` is this package's spelling of \"the key is absent\", set in `attributes`. It is not a\n  //   value PBS accepts: the schema's minimum is 0.\n  if (outdatedAfter < 0) return 'never: each snapshot is checked once and then skipped forever';\n  return `once the last check is more than ${String(outdatedAfter)} day(s) old`;\n};\n\n/**\n * The form for create and update alike.\n *\n * ⛔ `schedule: null` OMITS THE KEY, AND ON AN UPDATE THAT DOES NOT CLEAR AN EXISTING ONE. This\n *   form SETS and never CLEARS — the ⛔ on `withClears` above is why — so declaring `null` against\n *   a job that already has a schedule plans an update that changes nothing, every time. Park a job\n *   by hand once and the declaration then describes it truthfully:\n *   `proxmox-backup-manager verify-job update <id> --delete schedule`. The honest failure is a\n *   plan that keeps asking; the dishonest one would be a form that quietly reported success.\n *\n * ⚠️ `store` AND `ignore-verified` ARE ALWAYS SENT BECAUSE THEY ARE ALWAYS COMPARED.\n *   A field compared against a default but not sent as that default is an update reported on every\n *   plan that the write never performs — backup-job.ts and replication-job-form.ts both record the\n *   same trade. `ignore-verified` is the only one of the three with a PBS-side default, and it is\n *   TRUE, so an undeclared prop is sent as `1` rather than left out.\n *\n * ⚠️ THE BOOLEAN IS SPELLED INLINE RATHER THAN THROUGH `flag()` FROM values.ts, AND THAT IS A TYPE\n *   FACT RATHER THAN A STYLE ONE. `flag` answers `'1' | '0' | undefined` so that an undeclared\n *   field is dropped; here the field must never be dropped, and the `undefined` in its return type\n *   is not assignable to a `Record<string, string>` form body.\n *\n * ⚠️ PBS ACCEPTS BOTH `application/x-www-form-urlencoded` AND `application/json` AND NOTHING ELSE —\n *   any other content type is rejected outright with \"unsupported content type\", measured in\n *   proxmox-rest-server's `get_request_parameters`. `client.ts` sends the form encoding whenever a\n *   body is present, so it is already speaking one of the two. Numbers are stringified here for\n *   that reason; PBS parses them back through the integer schema.\n *\n * ⛔ `ns` IS DROPPED WHEN IT IS EMPTY, NOT SENT AS `''`. The empty string IS a legal namespace\n *   value — `BACKUP_NS_RE` is wrapped in `(?:…)?`, so it passes the schema and reaches the update\n *   handler — and the handler then throws it away at `if !ns.is_root()`. Sending it would look like\n *   a write that moves the job to the root namespace and would silently be nothing at all.\n */\nexport const shape = (props: PbsVerifyJobProps): Record<string, string> => ({\n  'ignore-verified': props['ignore-verified'] === false ? '0' : '1',\n  store: props.store,\n  ...(props.schedule === null ? {} : { schedule: props.schedule }),\n  ...(props.comment === undefined ? {} : { comment: props.comment }),\n  ...(props['max-depth'] === undefined ? {} : { 'max-depth': String(props['max-depth']) }),\n  ...(props.ns === undefined || props.ns === '' ? {} : { ns: props.ns }),\n  ...(props['outdated-after'] === undefined\n    ? {}\n    : { 'outdated-after': String(props['outdated-after']) }),\n});\n",
-    "/**\n * `Proxmox.Pool` — a PVE resource pool. Guests grouped for permissions and quota.\n *\n * ★ PROVEN END TO END AGAINST THE LIVE CLUSTER, 2026-09-13. create -> verified with `pvesh get\n *   /pools` on the node rather than by believing Alchemy; second plan -> `no changes / noop`; then\n *   the comment was edited ON THE CLUSTER and plan said `1 to update`, and a deploy repaired it.\n *   That drift case is the one that matters: `diff` reads the LIVE pool, so a provider trusting\n *   its own state would have reported noop straight past a hand-edit in the UI.\n *\n * ⚠️ IT 403'd UNTIL THE ROLE WAS WIDENED, AND THE HISTORY IS WORTH KEEPING. `hf-provision@pve`\n *   held the provision role on `/` with no `Pool.Allocate`, so reconcile answered\n *   \"Permission check failed (/pool/lab, Pool.Allocate)\". The credential could not widen itself\n *   — `PUT /access/roles` is 403 for it too — so the role was extended over SSH with\n *   `pveum role modify <role> --privs \"<existing>,Pool.Allocate,Pool.Audit\"`, preserving every\n *   existing privilege. `PROVISION_PRIVILEGES` (provision-baseline.ts) carries both now. Each new resource in this package should state the privileges its\n *   reconcile needs, so widening stays a deliberate act rather than a reaction to a 403.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type {\n  PoolsPoolidGetReturn,\n  PoolsPoolidPutParams,\n  PoolsPostParams,\n} from './generated/pve.ts';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\n\nexport interface PoolProps extends WithTarget {\n  /** PVE's primary key for a pool. Changing it is a replace, not an update. */\n  poolid: string;\n  /** Free text shown in the UI — the only mutable field a pool has. */\n  comment?: string;\n}\n\nexport interface PoolAttributes {\n  poolid: string;\n  comment: string;\n  /** Guests currently in the pool, so a plan can say what a delete would refuse to orphan. */\n  members: number;\n}\n\nexport interface ProxmoxPool extends Resource<\n  'Proxmox.Pool',\n  PoolProps,\n  PoolAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxPool = Resource<ProxmoxPool>('Proxmox.Pool');\n\n/** Form bodies this family sends — exported for the drift test in pool.test.ts. */\nexport const poolCreateForm = (props: PoolProps): PoolsPostParams => ({\n  comment: props.comment ?? '',\n  poolid: props.poolid,\n});\n\n/** PUT body — only `comment`; path carries `poolid`. Matches deprecated `/pools/{poolid}`. */\nexport const poolUpdateForm = (props: PoolProps): Pick<PoolsPoolidPutParams, 'comment'> => ({\n  comment: props.comment ?? '',\n});\n\nconst handlers = pveHandlers<PoolProps, PoolAttributes>({\n  attributes: (live, props) => {\n    const row = live as PoolsPoolidGetReturn;\n    return {\n      comment: typeof row.comment === 'string' ? row.comment : '',\n      members: Array.isArray(row.members) ? row.members.length : 0,\n      poolid: props.poolid,\n    };\n  },\n  collection: () => 'pools',\n  createForm: poolCreateForm,\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: { create: 'pve:POST /pools', update: 'pve:PUT /pools/{poolid}' },\n  matches: (attributes, props) => attributes.comment === (props.comment ?? ''),\n  path: (props) => `pools/${props.poolid}`,\n  updateForm: poolUpdateForm,\n});\n\nexport const ProxmoxPoolProvider = () =>\n  Provider.effect(ProxmoxPool, Effect.succeed(ProxmoxPool.Provider.of(handlers)));\n",
+    "/** PBS 4.2.6-1 values and vendor form guards; SDK transport is in pbs-verify-job-wire.ts. */\nimport type { PbsVerifyJobAttributes, PbsVerifyJobProps } from './pbs-verify-job.ts';\nimport type { PveSpec } from './resource-spec.ts';\nimport { rechecks, shape } from './pbs-verify-job-form.ts';\nimport { bool, int, text } from './values.ts';\n\n/**\n * ⚠️ EVERY FIELD IS READ THROUGH `values.ts` THOUGH PBS RETURNS REAL JSON TYPES. Unlike PVE's\n *   SectionConfig round-trip, `GET /config/verify/{id}` serialises a Rust struct, so\n *   `ignore-verified` arrives as a JSON boolean and `max-depth` as a JSON number. `bool` and `int`\n *   accept both spellings, and using them costs nothing while covering the version that does not.\n * ⚠️ `digest` IS NOT AN ATTRIBUTE AND CANNOT BECOME ONE BY ACCIDENT. PBS puts it on the rpcenv, and\n *   the JSON formatter adds rpcenv attributes as SIBLINGS of `data` — `{\"data\":{…},\"digest\":\"…\"}` —\n *   so both the old client and the SDK expose only the resource data. Attributes deliberately\n *   exclude it: the digest covers verification.cfg as a FILE, so keeping it would churn state\n *   whenever an unrelated verify job was edited.\n */\nexport const spec: PveSpec<PbsVerifyJobProps, PbsVerifyJobAttributes> = {\n  attributes: (live, props) => {\n    const ignoreVerified = bool(live['ignore-verified'], true);\n    const outdatedAfter = int(live['outdated-after'], -1);\n    return {\n      comment: text(live['comment'], ''),\n      id: props.id,\n      'ignore-verified': ignoreVerified,\n      'max-depth': int(live['max-depth'], -1),\n      ns: text(live['ns'], ''),\n      'outdated-after': outdatedAfter,\n      rechecks: rechecks(ignoreVerified, outdatedAfter),\n      schedule: text(live['schedule'], ''),\n      store: text(live['store'], props.store),\n    };\n  },\n  /**\n   * 🔴 THIS WAS `config/verification` AND PBS ANSWERS 404 FOR IT. MEASURED on the live 4.2 server:\n   *   `GET /api2/json/config/verification` -> 404 \"Path not found\"; `GET /api2/json/config/verify`\n   *   -> 200 with both jobs. The struct is `VerificationJobConfig` and the CLI subcommand is\n   *   `verify-job`, so the long spelling reads right and is simply not the route.\n   *   ⛔ THE OLD FAILURE MODE: `read` folded every failure into `undefined`, so a 404 from a\n   *   WRONG PATH was indistinguishable from an object that was not\n   *   there. The first plan against the live estate said `create` for two verification jobs that\n   *   have existed for weeks — and a create would then have POSTed to a 404 as well, so it fails\n   *   loudly rather than duplicating anything. Nothing caught it earlier because no verification\n   *   job had ever been declared; registering the provider exercises no path at all.\n   */\n  collection: () => 'config/verify',\n  /** ⛔ `id` IS SENT. PBS refuses a duplicate id, and that refusal is this family's safety net. */\n  createForm: (props) => ({ ...shape(props), id: props.id }),\n  /**\n   * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED — the `Proxmox.BackupJob` trade, for the\n   *   same reason and with one extra: this form carries NO `delete` list, so there is nothing it\n   *   could clear even if it wanted to. See the ⛔ on `withClears` in pbs-verify-job-form.ts.\n   * ⚠️ `store` IS COMPARED AND IS MUTABLE, which is unusual and worth reading twice. PBS's update\n   *   handler assigns it and re-checks privileges on both the old and the new path, so changing\n   *   `store` MOVES the job — and the datastore it left is then verified by nothing. That is a\n   *   one-word edit with the same effect as deleting the job, and it plans as a quiet `update`.\n   * ⚠️ `rechecks` IS ABSENT HERE ON PURPOSE. It is a rendering of the two fields on the lines\n   *   above; comparing it too would report the same drift twice.\n   */\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: { create: 'pbs:POST /config/verify', update: 'pbs:PUT /config/verify/{id}' },\n  matches: (attributes, props) =>\n    attributes.store === props.store &&\n    // ⚠️ `null` IS COMPARED AGAINST `''`, NOT SKIPPED. A parked job is a declaration like any\n    //   other, so declaring `null` against a job that HAS a schedule must plan an update — the\n    //   form then omits `schedule`, which is a set-only form, so see the ⛔ on clearing below.\n    attributes.schedule === (props.schedule ?? '') &&\n    attributes['ignore-verified'] === (props['ignore-verified'] !== false) &&\n    (props['outdated-after'] === undefined ||\n      attributes['outdated-after'] === props['outdated-after']) &&\n    (props['max-depth'] === undefined || attributes['max-depth'] === props['max-depth']) &&\n    (props.ns === undefined || attributes.ns === props.ns) &&\n    (props.comment === undefined || attributes.comment === props.comment),\n  path: (props) => `config/verify/${props.id}`,\n  updateForm: shape,\n};\n",
+    "/** PBS 4.2.6-1 operations through @distilled.cloud/proxmox-backup. */\nimport * as config from '@distilled.cloud/proxmox-backup/config';\nimport * as Effect from 'effect/Effect';\nimport { runPbs } from './distilled-pbs.ts';\nimport type { PbsVerifyJobProps } from './pbs-verify-job.ts';\nimport { shape } from './pbs-verify-job-form.ts';\nimport { spec } from './pbs-verify-job-spec.ts';\n\n/** SDK member names differ from the vendor form names; omission stays unmanaged. */\nconst members = (form: Record<string, string>) => ({\n  ...(form['ignore-verified'] === undefined ? {} : { ignore_verified: form['ignore-verified'] }),\n  ...(form['store'] === undefined ? {} : { store: form['store'] }),\n  ...(form['schedule'] === undefined ? {} : { schedule: form['schedule'] }),\n  ...(form['comment'] === undefined ? {} : { comment: form['comment'] }),\n  ...(form['max-depth'] === undefined ? {} : { max_depth: form['max-depth'] }),\n  ...(form['ns'] === undefined ? {} : { ns: form['ns'] }),\n  ...(form['outdated-after'] === undefined ? {} : { outdated_after: form['outdated-after'] }),\n});\n\nconst createRequest = (props: PbsVerifyJobProps): config.VerifyConfigRequest => ({\n  ...members({ ...shape(props), id: props.id }),\n  id: props.id,\n  store: props.store,\n});\n\nconst updateRequest = (props: PbsVerifyJobProps): config.PutConfigVerifyRequest => ({\n  ...members(shape(props)),\n  id: props.id,\n});\n\n/** Preserve the state attribute shape while the SDK decodes its typed field names. */\nconst wire = (row: config.GetConfigVerifyResponse): Record<string, unknown> => ({\n  ...row,\n  'ignore-verified': row.ignore_verified,\n  'max-depth': row.max_depth,\n  'outdated-after': row.outdated_after,\n});\n\n/** ⛔ Only the SDK VerifyJobNotFound is absence; permission, transport and malformed replies propagate. */\nexport const readOne = (props: PbsVerifyJobProps) =>\n  runPbs(props.target, 'read', config.getConfigVerify({ id: props.id })).pipe(\n    Effect.map((row) => spec.attributes(wire(row), props)),\n    Effect.catchTag('VerifyJobNotFound', () => Effect.succeed(undefined)),\n  );\n\nexport const createOne = (props: PbsVerifyJobProps) =>\n  runPbs(props.target, 'provision', config.verifyConfig(createRequest(props)));\n\nexport const updateOne = (props: PbsVerifyJobProps) =>\n  runPbs(props.target, 'provision', config.putConfigVerify(updateRequest(props)));\n\n/** Deleting the schedule never deletes backups; already missing is a successful deletion. */\nexport const deleteOne = (props: PbsVerifyJobProps) =>\n  Effect.gen(function* () {\n    // ⛔ Missing-item tags are measured for GET only. Do not guess the DELETE error shape.\n    if ((yield* readOne(props)) === undefined) return;\n    return yield* runPbs(props.target, 'provision', config.deleteConfigVerify({ id: props.id }));\n  });\n",
+    "/**\n * `Proxmox.Pool` — a PVE resource pool. Guests grouped for permissions and quota.\n *\n * ★ PROVEN END TO END AGAINST THE LIVE CLUSTER, 2026-09-13. create -> verified with `pvesh get\n *   /pools` on the node rather than by believing Alchemy; second plan -> `no changes / noop`; then\n *   the comment was edited ON THE CLUSTER and plan said `1 to update`, and a deploy repaired it.\n *   That drift case is the one that matters: `diff` reads the LIVE pool, so a provider trusting\n *   its own state would have reported noop straight past a hand-edit in the UI.\n *\n * ⚠️ IT 403'd UNTIL THE ROLE WAS WIDENED, AND THE HISTORY IS WORTH KEEPING. `hf-provision@pve`\n *   held the provision role on `/` with no `Pool.Allocate`, so reconcile answered\n *   \"Permission check failed (/pool/lab, Pool.Allocate)\". The credential could not widen itself\n *   — `PUT /access/roles` is 403 for it too — so the role was extended over SSH with\n *   `pveum role modify <role> --privs \"<existing>,Pool.Allocate,Pool.Audit\"`, preserving every\n *   existing privilege. `PROVISION_PRIVILEGES` (provision-baseline.ts) carries both now. Each new resource in this package should state the privileges its\n *   reconcile needs, so widening stays a deliberate act rather than a reaction to a 403.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as pools from '@distilled.cloud/proxmox/pools';\nimport { ProxmoxParseError } from '@distilled.cloud/proxmox/Errors';\nimport * as Schema from 'effect/Schema';\nimport * as Effect from 'effect/Effect';\nimport type { PoolsPoolidPutParams, PoolsPostParams } from './generated/pve.ts';\nimport type { PveRequirements, PveSpec, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { specGuards } from './resource-guard.ts';\nimport { formToSend } from './update-guard.ts';\n\nexport interface PoolProps extends WithTarget {\n  /** PVE's primary key for a pool. Changing it is a replace, not an update. */\n  poolid: string;\n  /** Free text shown in the UI — the only mutable field a pool has. */\n  comment?: string;\n}\n\nexport interface PoolAttributes {\n  poolid: string;\n  comment: string;\n  /** Guests currently in the pool, so a plan can say what a delete would refuse to orphan. */\n  members: number;\n}\n\nexport interface ProxmoxPool extends Resource<\n  'Proxmox.Pool',\n  PoolProps,\n  PoolAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxPool = Resource<ProxmoxPool>('Proxmox.Pool');\n\n/** Form bodies this family sends — exported for the drift test in pool.test.ts. */\nexport const poolCreateForm = (props: PoolProps): PoolsPostParams => ({\n  comment: props.comment ?? '',\n  poolid: props.poolid,\n});\n\n/** PUT body — only `comment`; path carries `poolid`. Matches deprecated `/pools/{poolid}`. */\nexport const poolUpdateForm = (props: PoolProps): Pick<PoolsPoolidPutParams, 'comment'> => ({\n  comment: props.comment ?? '',\n});\n\nconst spec = {\n  attributes: (live, props) => {\n    const row = live;\n    return {\n      comment: typeof row.comment === 'string' ? row.comment : '',\n      members: Array.isArray(row.members) ? row.members.length : 0,\n      poolid: props.poolid,\n    };\n  },\n  collection: () => 'pools',\n  createForm: poolCreateForm,\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: { create: 'pve:POST /pools', update: 'pve:PUT /pools/{poolid}' },\n  matches: (attributes, props) => attributes.comment === (props.comment ?? ''),\n  path: (props) => `pools/${props.poolid}`,\n  updateForm: poolUpdateForm,\n} satisfies PveSpec<PoolProps, PoolAttributes>;\n\nconst { guardCreate, guardUpdate } = specGuards(spec);\n\n/** Pool absence is PVE's typed 500, not a catch-all; pve-manager 9.2.11. */\nexport const readPool = (props: PoolProps) =>\n  runPve(props.target, 'read', false, pools.getPool({ poolid: props.poolid })).pipe(\n    Effect.flatMap((live) =>\n      Schema.decodeUnknownEffect(Schema.toType(pools.GetPoolResponse))(live).pipe(\n        Effect.mapError(\n          () =>\n            new ProxmoxParseError({\n              body: undefined,\n              cause: 'Pool response does not match its vendor schema',\n            }),\n        ),\n        Effect.as(live),\n      ),\n    ),\n    Effect.map((live) => spec.attributes({ ...live }, props)),\n    Effect.catchTag('PoolNotFound', () => Effect.succeed(undefined)),\n    Effect.catchTag('NotFound', () => Effect.succeed(undefined)),\n  );\n\nexport const deletePool = (props: PoolProps) =>\n  runPve(props.target, 'provision', true, pools.deletePool({ poolid: props.poolid })).pipe(\n    Effect.catchTag('PoolNotFound', () => Effect.void),\n    Effect.catchTag('NotFound', () => Effect.void),\n  );\n\nexport const ProxmoxPoolProvider = () =>\n  Provider.effect(\n    ProxmoxPool,\n    Effect.succeed(\n      ProxmoxPool.Provider.of({\n        /** Pools are adopted explicitly; an index must not silently claim every existing pool. */\n        list: () => Effect.succeed([]),\n        read: ({ olds }) => readPool(olds),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardCreate(news, output === undefined);\n          yield* guardUpdate(news);\n          if (output === undefined) return undefined;\n          const live = yield* readPool(news);\n          if (live === undefined) {\n            yield* guardCreate(news, true);\n            return { action: 'update' } as const;\n          }\n          return { action: spec.matches(live, news) ? 'noop' : 'update' } as const;\n        }),\n        reconcile: Effect.fn(function* ({ news }) {\n          const live = yield* readPool(news);\n          yield* guardCreate(news, live === undefined);\n          yield* guardUpdate(news);\n          if (live === undefined) {\n            yield* runPve(news.target, 'provision', true, pools.createPool(poolCreateForm(news)));\n          } else {\n            const form = formToSend(spec.matches, live, news, poolUpdateForm(news));\n            if (form !== undefined)\n              yield* runPve(\n                news.target,\n                'provision',\n                true,\n                pools.putPool({\n                  ...form,\n                  poolid: news.poolid,\n                }),\n              );\n          }\n          const after = yield* readPool(news);\n          if (after === undefined)\n            return yield* Effect.fail(\n              new Error(\n                `pools/${news.poolid}: write returned success but the pool is still absent`,\n              ),\n            );\n          return after;\n        }),\n        /** A nonempty-pool refusal still propagates; there is no force-delete fallback. */\n        delete: ({ olds }) => deletePool(olds),\n      }),\n    ),\n  );\n",
     "/**\n * The provisioning baseline: the access every PVE cluster and node needs before a stack built on\n * this package can manage it — one role, the users OpenBao mints tokens for, the group that fences\n * the mint, and the grants that bind them. ONE description, read by both halves:\n *   · provision-declare.ts turns it into `Proxmox.Role`/`Group`/`User`/`Acl` resources, so a stack\n *     adopts the baseline and keeps it (drift is a plan, not a 403 weeks later);\n *   · provision-bootstrap.ts turns it into the one-time root commands for a NEW cluster or node.\n * The two cannot drift apart because neither holds a name or a privilege of its own.\n *\n * ⛔ THE PROVISION LANE CANNOT CREATE ITSELF. Every write here runs as a token OpenBao mints for the\n *   provision user, and minting needs that user to exist, in the mint group, bound to this role.\n *   So a new cluster is bootstrapped ONCE by root@pam with the generated commands, and the stack\n *   then adopts what they made (docs/provision-baseline.md).\n *\n * ★ ONE PRIVILEGE LIST FOR EVERY FAMILY, NOT A ROLE PER RESOURCE. The list is what the families'\n *   reconciles need, unioned — the set a hand-kept provision role reached one 403 at a time, each\n *   step recorded where it was hit (pool.ts, sdn-vnet.ts, ha-rule.ts). It includes what the lane needs\n *   to manage THIS baseline (`Sys.Modify` for the role, `Realm.AllocateUser`/`User.Modify` for the\n *   users, `Group.Allocate`, `Permissions.Modify` for the grants), so declaring it can never narrow\n *   the lane out of its own repair (role.ts: \"A ROLE CAN LOCK ITS OWN PROVIDER OUT\").\n * ⚠️ NOT EVERY FAMILY: root@pam-only writes (device passthrough, bind mounts — lxc-judge.ts) and\n *   privileges a family names as still missing (`VM.Replicate`, replication-job.ts) are outside it.\n */\n\n/** The provision role's privileges, sorted — the exact set, never an addition to a live one. */\nexport const PROVISION_PRIVILEGES: readonly string[] = Object.freeze([\n  'Datastore.Allocate',\n  'Datastore.AllocateSpace',\n  'Datastore.Audit',\n  'Group.Allocate',\n  'Mapping.Audit',\n  'Mapping.Modify',\n  'Permissions.Modify',\n  'Pool.Allocate',\n  'Pool.Audit',\n  'Realm.AllocateUser',\n  'SDN.Allocate',\n  'SDN.Audit',\n  'SDN.Use',\n  'Sys.Audit',\n  'Sys.Console',\n  'Sys.Modify',\n  'User.Modify',\n  'VM.Allocate',\n  'VM.Audit',\n  'VM.Backup',\n  'VM.Config.CPU',\n  'VM.Config.Disk',\n  'VM.Config.HWType',\n  'VM.Config.Memory',\n  'VM.Config.Network',\n  'VM.Config.Options',\n  'VM.PowerMgmt',\n]);\n\n/** The names a baseline uses. Every field has a generic default (`PROVISION_DEFAULTS`). */\nexport interface CoreProvisionNames {\n  /** The role holding `PROVISION_PRIVILEGES` on `/`. */\n  readonly role?: string | undefined;\n  /** The user OpenBao's `provision` role mints tokens for, realm-qualified. */\n  readonly provisionUser?: string | undefined;\n  /** The group whose members OpenBao may mint for — the fence around the mint. */\n  readonly mintGroup?: string | undefined;\n  /** The user OpenBao's `read` role mints for, or `null` for a baseline with no read lane. */\n  readonly readUser?: string | null | undefined;\n  /** The role the read user holds on `/`. ⛔ It must already exist: a built-in, or one you declare. */\n  readonly readRole?: string | undefined;\n  /** The comment on the group and both users — how a person on the node learns what they are. */\n  readonly comment?: string | undefined;\n}\n\n/** Every core name, resolved: what `PROVISION_DEFAULTS` holds and what a baseline is built from. */\nexport type ResolvedProvisionNames = {\n  readonly [K in keyof CoreProvisionNames]-?: Exclude<CoreProvisionNames[K], undefined>;\n};\n\n/**\n * `CoreProvisionNames` plus a comment per object, each defaulting to `comment`.\n *\n * ⛔ WHY PER OBJECT: AN EXISTING CLUSTER IS THE NORMAL CASE, NOT THE EXCEPTION. One `comment` for\n *   three objects can only describe a cluster this baseline made. On one that already has a mint\n *   group and a read user — with their own live comments, which a stack elsewhere may already\n *   declare — a single comment makes `provisionBootstrap` rewrite objects nobody asked it to\n *   touch, and the next deploy of that stack writes them back. Measured on an estate cluster\n *   2026-09-22, where `hf-mint` had NO comment and `hf-read@pve` named its own mount.\n * ★ Overriding one does not change the others: `comment` stays the default for every object that\n *   has no override, so the generic case is still one string.\n * ⚠️ Each is checked like `comment` is, and a `null` `readUser` drops `readComment` with its lane.\n */\nexport interface ProvisionNames extends CoreProvisionNames {\n  /** The mint group's comment. Defaults to `comment`. */\n  readonly groupComment?: string | undefined;\n  /** The provision user's comment. Defaults to `comment`. */\n  readonly provisionComment?: string | undefined;\n  /** The read user's comment. Defaults to `comment`. Ignored when `readUser` is `null`. */\n  readonly readComment?: string | undefined;\n}\n\n/** The resolved comment for each object a baseline holds. */\nexport type ProvisionComments = {\n  readonly [K in 'group' | ProvisionLane]: string;\n};\n\n/** Which credential lane a user or a grant belongs to — the OpenBao role that mints for it. */\nexport type ProvisionLane = 'provision' | 'read';\n\n/** ★ Generic, kit-prefixed names: nothing here is any one estate's. */\nexport const PROVISION_DEFAULTS: ResolvedProvisionNames = Object.freeze({\n  comment:\n    'provision baseline from @homeflare/alchemy - OpenBao mints short-lived tokens for members',\n  mintGroup: 'hf-mint',\n  provisionUser: 'hf-provision@pve',\n  readRole: 'PVEAuditor',\n  readUser: 'hf-read@pve',\n  role: 'HfProvisioner',\n});\n\n/** A baseline, resolved: exactly what the declaration holds and the bootstrap makes. */\nexport interface ProvisionBaseline {\n  readonly role: { readonly roleid: string; readonly privs: readonly string[] };\n  readonly group: { readonly groupid: string; readonly comment: string };\n  readonly users: readonly {\n    readonly lane: ProvisionLane;\n    readonly userid: string;\n    readonly comment: string;\n    readonly groups: readonly string[];\n  }[];\n  /** Each binds one user to one role on `/`, with propagate — the only shape the lanes need. */\n  readonly grants: readonly {\n    readonly lane: ProvisionLane;\n    readonly userid: string;\n    readonly roleid: string;\n  }[];\n}\n\n/**\n * ⛔ NAMES ARE CHECKED HERE, ONCE, FOR BOTH HALVES — and conservatively. The bootstrap pastes them\n *   into a root shell, so a name that would need quoting is refused rather than quoted: PVE's own\n *   ids (`pve-roleid`, `pve-groupid`, `pve-userid`) are narrower than what a shell tolerates.\n */\nconst ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\nconst USERID = /^[A-Za-z0-9][A-Za-z0-9._-]*@[A-Za-z][A-Za-z0-9._-]*$/;\nconst COMMENT = /^[A-Za-z0-9 ._,:()@/+-]*$/;\n\nconst problems = (\n  names: ResolvedProvisionNames,\n  comments: ProvisionComments,\n  given: ProvisionNames,\n): string[] => {\n  const found: string[] = [];\n  if (!ID.test(names.role)) found.push(`role \\`${names.role}\\` is not a PVE role id`);\n  if (!ID.test(names.mintGroup)) found.push(`mintGroup \\`${names.mintGroup}\\` is not a group id`);\n  if (!ID.test(names.readRole)) found.push(`readRole \\`${names.readRole}\\` is not a PVE role id`);\n  for (const [field, userid] of [\n    ['provisionUser', names.provisionUser],\n    ['readUser', names.readUser],\n  ] as const) {\n    if (userid !== null && !USERID.test(userid)) {\n      found.push(`${field} \\`${userid}\\` is not a realm-qualified user id (name@realm)`);\n    }\n  }\n  if (names.readUser === names.provisionUser) found.push('readUser and provisionUser are one user');\n  // ⛔ EVERY comment THE BASELINE WILL HOLD, not just the shared one: each is pasted into `sh` and\n  //    into a Perl `q{}`. ⚠️ `readComment` only when there is a read lane — a `null` `readUser`\n  //    drops the user, so nothing would ever be pasted.\n  // ★ NAMED BY WHERE THE VALUE CAME FROM, and said once. A bad shared `comment` is one problem\n  //   called `comment`, not three called after overrides the caller never passed.\n  const source = (override: string | undefined, field: string) =>\n    override === undefined ? 'comment' : field;\n  const checked: (readonly [string, string])[] = [\n    [source(given.groupComment, 'groupComment'), comments.group],\n    [source(given.provisionComment, 'provisionComment'), comments.provision],\n  ];\n  if (names.readUser !== null) {\n    checked.push([source(given.readComment, 'readComment'), comments.read]);\n  }\n  const said = new Set<string>();\n  for (const [field, comment] of checked) {\n    if (COMMENT.test(comment) || said.has(field)) continue;\n    said.add(field);\n    found.push(`${field} holds a character the bootstrap will not quote`);\n  }\n  return found;\n};\n\n/** Resolve `names` over the defaults and check them. Throws with every problem at once. */\nexport const provisionBaseline = (names: ProvisionNames = {}): ProvisionBaseline => {\n  // ⚠️ The per-object comments are taken out first: they are not core names, so they must not land\n  //    in `resolved`, which `PROVISION_DEFAULTS` types and a caller may build a literal of.\n  const { groupComment, provisionComment, readComment, ...core } = names;\n  // ⚠️ An explicit `undefined` means \"the default\", not \"blank\": spread alone would keep it.\n  const given = Object.entries(core).filter(([, value]) => value !== undefined);\n  const resolved: ResolvedProvisionNames = {\n    ...PROVISION_DEFAULTS,\n    ...Object.fromEntries(given),\n  };\n  // ★ `?? resolved.comment`, so an override changes ONE object and the generic case stays one\n  //   string. ⚠️ `??` and not `||`: an empty comment is a real value — a live object with none.\n  const comments: ProvisionComments = {\n    group: groupComment ?? resolved.comment,\n    provision: provisionComment ?? resolved.comment,\n    read: readComment ?? resolved.comment,\n  };\n  const found = problems(resolved, comments, names);\n  if (found.length > 0) throw new Error(`provision baseline: ${found.join('; ')}`);\n  const lanes: [ProvisionLane, string, string][] = [\n    ['provision', resolved.provisionUser, resolved.role],\n  ];\n  if (resolved.readUser !== null) lanes.push(['read', resolved.readUser, resolved.readRole]);\n  return {\n    grants: lanes.map(([lane, userid, roleid]) => ({ lane, roleid, userid })),\n    group: { comment: comments.group, groupid: resolved.mintGroup },\n    role: { privs: PROVISION_PRIVILEGES, roleid: resolved.role },\n    users: lanes.map(([lane, userid]) => ({\n      comment: comments[lane],\n      groups: [resolved.mintGroup],\n      lane,\n      userid,\n    })),\n  };\n};\n",
     "/**\n * `provisionBootstrap` — the provisioning baseline (provision-baseline.ts) as the one-time root\n * commands for a NEW cluster or node: a POSIX `sh` script, printed, never run from here.\n *\n *     bun -e \"import { provisionBootstrap } from '@homeflare/alchemy/proxmox';\n *             process.stdout.write(provisionBootstrap())\" | ssh root@<node> sh\n *\n * ⛔ WHY IT EXISTS: THE PROVISION LANE CANNOT CREATE ITSELF. Every resource in this package runs as a\n *   token OpenBao mints for the provision user, and a cluster without that user, its group and its\n *   grant has nothing to mint for — the plan that would create them cannot authenticate. So root\n *   makes them once, and the stack adopts and keeps them (provision-declare.ts). This is the only\n *   hand step, and it is generated from the same baseline the stack declares.\n * ⛔ NEVER A TOKEN, NEVER A PASSWORD. The users are created with neither: OpenBao mints short-lived\n *   tokens for them later, and an `@pve` user with no password cannot log in to the UI. Nothing\n *   secret is in the script, so it can be read, reviewed and pasted.\n * ★ CHECK, THEN CHANGE — IDEMPOTENT BY CONSTRUCTION. Each object is read first (`pvesh get … json`,\n *   parsed with Perl's core JSON::PP, which every PVE node has), compared with the baseline, and\n *   written only when it differs, naming what it does. A second run prints `ok` for everything and\n *   writes nothing. It also CONVERGES: a role with other privileges is set to exactly the baseline,\n *   as the stack's `Proxmox.Role` would set it (role.ts: a declaration replaces the set).\n * ★ ONE NODE PER CLUSTER. Users, groups, roles and ACLs live in `/etc/pve/user.cfg`, which pmxcfs\n *   shares across the cluster: a node joining a cluster that has the baseline needs nothing, and a\n *   run there is all `ok`. A new standalone node or a new cluster is where it creates.\n * ⚠️ NAMES ARE NOT QUOTED INTO SAFETY, THEY ARE REFUSED INTO IT: provision-baseline.ts admits only\n *   characters that need no quoting in `sh` or in a Perl `q{}`.\n */\nimport {\n  type ProvisionBaseline,\n  type ProvisionNames,\n  provisionBaseline,\n} from './provision-baseline.ts';\n\nconst HEADER = `#!/bin/sh\n# Provisioning baseline bootstrap, generated by @homeflare/alchemy (provisionBootstrap).\n# Run ONCE, as root, on one node of a NEW cluster (or a new standalone node). Every step reads\n# first and writes only what differs; a second run changes nothing. No token, no password.\nset -eu\n[ \"$(id -u)\" -eq 0 ] || { echo 'bootstrap: run this as root' >&2; exit 1; }\ncommand -v pvesh >/dev/null 2>&1 || { echo 'bootstrap: no pvesh; run this on a PVE node' >&2; exit 1; }\nperl -MJSON::PP -e 1 || { echo 'bootstrap: perl cannot load JSON::PP' >&2; exit 1; }\n\n# get <api-path> <perl>: print <perl> evaluated over the object at <api-path> (as $d).\n# Fails, silently, when the object does not exist: the empty input is not JSON.\nget() {\n  pvesh get \"$1\" --output-format json 2>/dev/null | perl -MJSON::PP -0777 -ne \"\\\\$d = decode_json(\\\\$_); $2\" 2>/dev/null\n}\n`;\n\n/** A Perl string literal with no interpolation — `@pve` in a double-quoted one is an array. */\nconst perlText = (text: string) => `q{${text}}`;\n\n/** The user fields `Proxmox.User` compares, as one line both sides can produce. */\nconst USER_STATE =\n  'my $g = $d->{groups} // []; $g = [split /,/, $g] unless ref $g; ' +\n  'print join(\";\", \"groups=\" . join(\",\", sort @$g), \"enable=\" . (($d->{enable} // 1) ? 1 : 0), ' +\n  '\"expire=\" . ($d->{expire} // 0), \"email=\" . ($d->{email} // \"\"), ' +\n  '\"firstname=\" . ($d->{firstname} // \"\"), \"lastname=\" . ($d->{lastname} // \"\"), ' +\n  '\"comment=\" . ($d->{comment} // \"\"))';\n\nconst roleStep = ({ role }: ProvisionBaseline): string => {\n  const privs = [...role.privs].sort().join(',');\n  return `\n# Role ${role.roleid}: exactly the provision privileges, on no path yet.\nwant='${privs}'\nif have=$(get /access/roles/${role.roleid} 'print join(\",\", sort grep { /\\\\./ } keys %$d)'); then\n  if [ \"$have\" = \"$want\" ]; then echo 'role ${role.roleid}: ok'\n  else echo 'role ${role.roleid}: setting the baseline privileges'; pveum role modify ${role.roleid} --privs \"$want\"; fi\nelse\n  echo 'role ${role.roleid}: adding'; pveum role add ${role.roleid} --privs \"$want\"\nfi\n`;\n};\n\nconst groupStep = ({ group }: ProvisionBaseline): string => `\n# Group ${group.groupid}: OpenBao may mint only for its members.\nif have=$(get /access/groups/${group.groupid} 'print $d->{comment} // \"\"'); then\n  if [ \"$have\" = '${group.comment}' ]; then echo 'group ${group.groupid}: ok'\n  else echo 'group ${group.groupid}: setting the comment'; pveum group modify ${group.groupid} --comment '${group.comment}'; fi\nelse\n  echo 'group ${group.groupid}: adding'; pveum group add ${group.groupid} --comment '${group.comment}'\nfi\n`;\n\nconst userStep = (user: ProvisionBaseline['users'][number]): string => {\n  const groups = [...user.groups].sort().join(',');\n  const want = `groups=${groups};enable=1;expire=0;email=;firstname=;lastname=;comment=${user.comment}`;\n  const fields = `--groups ${groups} --comment '${user.comment}'`;\n  return `\n# User ${user.userid} (the ${user.lane} lane): in ${groups}, enabled, no password.\nif have=$(get /access/users/${user.userid} '${USER_STATE}'); then\n  if [ \"$have\" = '${want}' ]; then echo 'user ${user.userid}: ok'\n  else echo 'user ${user.userid}: setting groups, comment and account fields'\n    pveum user modify ${user.userid} ${fields} --enable 1 --expire 0 --email '' --firstname '' --lastname ''; fi\nelse\n  echo 'user ${user.userid}: adding'; pveum user add ${user.userid} ${fields}\nfi\n`;\n};\n\nconst grantStep = (grant: ProvisionBaseline['grants'][number]): string => {\n  const match =\n    `print scalar grep { $_->{path} eq \"/\" && $_->{type} eq \"user\" && ` +\n    `$_->{ugid} eq ${perlText(grant.userid)} && $_->{roleid} eq ${perlText(grant.roleid)} && ` +\n    `($_->{propagate} // 1) } @$d`;\n  return `\n# Grant: ${grant.userid} holds ${grant.roleid} on /, propagated (the ${grant.lane} lane).\nif [ \"$(get /access/acl '${match}')\" = 1 ]; then echo 'grant ${grant.userid} ${grant.roleid} /: ok'\nelse echo 'grant ${grant.userid} ${grant.roleid} /: adding'; pveum acl modify / --users ${grant.userid} --roles ${grant.roleid} --propagate 1; fi\n`;\n};\n\n/** A role the baseline binds but does not own — the read lane's — must already exist. */\nconst requireRole = (roleid: string): string => `\nget /access/roles/${roleid} 'print 1' >/dev/null || { echo 'bootstrap: role ${roleid} does not exist; create it, or name another readRole' >&2; exit 1; }\n`;\n\n/**\n * The script for `names` (defaults: `PROVISION_DEFAULTS`). Pure: it reads nothing and runs nothing.\n * Throws, like `provisionBaseline`, on a name the baseline refuses.\n */\nexport const provisionBootstrap = (names: ProvisionNames = {}): string => {\n  const baseline = provisionBaseline(names);\n  const borrowed = baseline.grants\n    .map((grant) => grant.roleid)\n    .filter((roleid) => roleid !== baseline.role.roleid);\n  return [\n    HEADER,\n    ...[...new Set(borrowed)].map(requireRole),\n    roleStep(baseline),\n    groupStep(baseline),\n    ...baseline.users.map(userStep),\n    ...baseline.grants.map(grantStep),\n    `\\necho 'provision baseline: done. Next: point the OpenBao proxmox mount at these users, then deploy the stack that declares this baseline with --adopt.'\\n`,\n  ].join('');\n};\n",
     "/**\n * `declareProvisionBaseline` — the provisioning baseline (provision-baseline.ts) as resources, so a\n * stack adopts what the bootstrap made and keeps it: the role, the mint group, one user per lane\n * (its group membership included) and the grant binding each user to its role on `/`.\n *\n *     const lane = yield* declareProvisionBaseline('pve', target);\n *     // names are generic by default; a site passes its own:\n *     const lane = yield* declareProvisionBaseline('pve', target, { role: 'Provisioner' });\n *\n * Provide `ProxmoxRoleProvider()`, `ProxmoxGroupProvider()`, `ProxmoxUserProvider()` and\n * `ProxmoxAclProvider()` with `FetchHttpClient.layer`.\n *\n * ⛔ EVERY RESOURCE HERE RETAINS. This is the branch the whole package sits on (user.ts): dropping\n *   the call from a stack must drop state, never the role, the users or their grants — deleting the\n *   provision user revokes every lease at once, the plan that would recreate it included.\n * ⛔ ADOPTION IS THE OPERATOR'S TO STATE, AS EVERYWHERE IN THE KIT (docs/ownership.md). The first\n *   deploy after the bootstrap finds all of this live with no state: run it with `--adopt`, or pass\n *   `{ adopt: true }`, which pipes `adopt(true)` onto each resource. `{ adopt: false }` pins them\n *   refused under a deploy-wide `--adopt`. Left out, the deploy's own policy decides.\n *   ⚠️ TODAY THE FOUR FAMILIES STILL READ A LIVE OBJECT WITH NO STATE AS OURS (the `pveHandlers`\n *     limit in ownership.md), so the flag is not yet what stops a claim. It is stated here so that\n *     when they follow the rule, a stack built on this helper already says what it means.\n * ★ THE BOOTSTRAP MAKES EXACTLY THIS, so a clean adoption writes nothing: the same privileges, the\n *   same comment, the same single group per user (provision-bootstrap.ts reads the same baseline).\n * ★ PLAIN NAMES, NOT ONE RESOURCE'S OUTPUT IN ANOTHER'S PROPS. An Output would order the creates,\n *   but Alchemy skips the adoption probe while any prop is one (Plan.ts), so the first deploy after\n *   the bootstrap would plan `create` for objects that are all there. Order never matters here:\n *   nothing in this package can run before the bootstrap, and after it everything exists.\n */\nimport { adopt } from 'alchemy/AdoptPolicy';\nimport * as RemovalPolicy from 'alchemy/RemovalPolicy';\nimport * as Effect from 'effect/Effect';\nimport { ProxmoxAcl } from './acl.ts';\nimport type { PveTarget } from './credentials.ts';\nimport { ProxmoxGroup } from './group.ts';\nimport { type ProvisionNames, provisionBaseline } from './provision-baseline.ts';\nimport { ProxmoxRole } from './role.ts';\nimport { ProxmoxUser } from './user.ts';\n\nexport interface DeclareProvisionOptions {\n  /** `true`/`false` pipe `adopt(…)` onto every resource; omitted, the deploy's policy decides. */\n  readonly adopt?: boolean;\n}\n\n/**\n * The baseline for one cluster. `id` prefixes every logical id (`<id>-role`, `<id>-mint-group`,\n * `<id>-provision-user`, `<id>-provision-grant`, and the `read` pair), so one stack can declare a\n * baseline per cluster. `users` and `grants` come back in `baseline.users` / `baseline.grants`\n * order: provision, then read. Fails, before declaring anything, on a name the baseline refuses.\n */\nexport const declareProvisionBaseline = (\n  id: string,\n  target: PveTarget,\n  names: ProvisionNames = {},\n  options: DeclareProvisionOptions = {},\n) =>\n  Effect.gen(function* () {\n    const baseline = yield* Effect.try({\n      catch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),\n      try: () => provisionBaseline(names),\n    });\n    const owned = <A, R>(resource: Effect.Effect<A, never, R>) => {\n      const kept = resource.pipe(RemovalPolicy.retain());\n      return options.adopt === undefined ? kept : kept.pipe(adopt(options.adopt));\n    };\n    const role = yield* owned(\n      ProxmoxRole(`${id}-role`, {\n        privs: [...baseline.role.privs],\n        roleid: baseline.role.roleid,\n        target,\n      }),\n    );\n    const group = yield* owned(ProxmoxGroup(`${id}-mint-group`, { ...baseline.group, target }));\n    // ★ `Effect.all` over mapped declarations (sequential), as cloudflare-permission-groups.ts does:\n    //   oxlint's unicorn/no-array-for-each cannot tell `Effect.forEach` from `Array#forEach`.\n    const users = yield* Effect.all(\n      baseline.users.map((user) =>\n        owned(\n          ProxmoxUser(`${id}-${user.lane}-user`, {\n            comment: user.comment,\n            groups: [...user.groups],\n            target,\n            userid: user.userid,\n          }),\n        ),\n      ),\n    );\n    const grants = yield* Effect.all(\n      baseline.grants.map((grant) =>\n        owned(\n          ProxmoxAcl(`${id}-${grant.lane}-grant`, {\n            path: '/',\n            propagate: true,\n            roleid: grant.roleid,\n            target,\n            type: 'user',\n            ugid: grant.userid,\n          }),\n        ),\n      ),\n    );\n    return { baseline, grants, group, role, users };\n  });\n",
@@ -132,7 +156,7 @@
     "/**\n * `Proxmox.ZfsPool`'s READ side: the live-to-attributes shape, the read itself, and `matches`.\n * Split out of zfs-pool.ts (2026-09-24, the distilled migration) — the storage.ts/storage-wire.ts\n * seam; the write side is zfs-pool-form.ts.\n */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport { runPve } from './distilled-pve.ts';\nimport type { ZfsPoolProps } from './zfs-pool.ts';\nimport { UNREADABLE, type Unreadable, readOrUnreadable } from './unreadable-read.ts';\nimport { text } from './values.ts';\n\n/**\n * ⚠️ EVERYTHING HERE IS REPORTED, NOTHING HERE IS COMPARED — see the ⛔ on `matches` below. These\n *   exist so a plan and the state store can say what the pool actually is, on a family where the\n *   declaration and the live object share no comparable field at all.\n */\nexport interface ZfsPoolAttributes {\n  /** ★ The value a `Proxmox.Storage` should read to order itself after this pool. */\n  name: string;\n  node: string;\n  /** `ONLINE` | `DEGRADED` | `FAULTED` | … Health, not configuration. */\n  state: string;\n  /** ZFS's own error summary, e.g. `No known data errors`. */\n  errors: string;\n  /**\n   * The leaf devices ZFS reports, in vdev order, comma-joined.\n   *\n   * ⚠️ THIS IS WHAT ZFS RESOLVED, NOT WHAT WAS DECLARED, and the two normally differ: PVE rewrites\n   *   a `/dev/sdb` into a by-id link before creating, and ZFS reports partition paths (`…-part3`)\n   *   for a pool built on partitions — MEASURED, that is exactly what node-b's `rpool` reports.\n   *   Never compare it with `props.devices`.\n   */\n  devices: string;\n}\n\n/**\n * The device paths at the bottom of PVE's vdev tree, in the order ZFS reports them.\n *\n * ⚠️ \"NO CHILDREN\" IS THE LEAF TEST, AND IT IS NOT A GUESS — MEASURED in the node's `preparetree`,\n *   which sets `leaf` to 0 when there are children and 1 otherwise. Reading the flag would work\n *   equally well; recursing on `children` needs no second field to be present and is what makes\n *   nested sections (mirrors inside a raid10, `spares`, `cache`) flatten correctly.\n */\nexport const leafDevices = (children: unknown): string[] =>\n  Array.isArray(children)\n    ? children.flatMap((entry: unknown) => {\n        const vdev = entry as { children?: unknown; name?: unknown };\n        const nested = leafDevices(vdev.children);\n        return nested.length > 0 ? nested : [text(vdev.name)].filter((name) => name !== '');\n      })\n    : [];\n\n/**\n * ⚠️ `scan`, `status` AND `action` ARE DELIBERATELY NOT ATTRIBUTES. All three are advisory strings\n *   ZFS rewrites on its own — `scan` on every scrub, the other two as feature flags and faults come\n *   and go — so keeping them would rewrite this resource's state row for reasons no declaration\n *   caused. Same reasoning as `digest` in storage.ts.\n */\nconst attributesOf = (\n  live: nodes.GetNodeDiskZfsResponse,\n  props: ZfsPoolProps,\n): ZfsPoolAttributes => ({\n  devices: leafDevices(live.children).join(','),\n  errors: text(live.errors, 'unknown'),\n  name: props.name,\n  node: props.node,\n  state: text(live.state, 'unknown'),\n});\n\n/**\n * ★ Default `read` role — `Sys.Audit` on `/` is all this GET checks (zfs-pool.ts's header).\n * ⛔ `{ node: props.node, name: props.name }`, NEVER THE WHOLE `props` — storage.ts's/user.ts's own\n *   ⛔, the kit 0.31.1 regression: `GetNodeDiskZfsRequest`'s schema declares only `node` and `name`\n *   (both path labels); any OTHER key on the object passed to `nodes.getNodeDiskZfs` is treated by\n *   distilled's `buildRequest` as an \"unknown key\" and JSON-encoded onto this bodyless GET, which a\n *   stricter fetch client refuses outright.\n * ⛔ A MISSING POOL IS A 500, NOT A 404 — MEASURED against the live cluster (TB4 n2, 2026-09-24,\n *   read-role, read-only probe): `GET /nodes/n2/disks/zfs/hf-measure-nonexistent-pool` answers\n *   `{\"message\":\"command '/sbin/zpool status -P hf-measure-nonexistent-pool' failed: exit code\n *   1\\n\",\"data\":null}` at HTTP 500 — PVE shells out to `zpool status` and reports its exit code\n *   as a generic command failure, not a typed \"not found\". The same shape as user.ts's/group.ts's/\n *   storage.ts's own measured 500s. `readPool` below (used by `createPool`'s settle-poll and by\n *   `reconcile`/`read`) still folds it, exactly as `readUser`/`readGroup`/`readStorage` do — the\n *   whole reason `createPool` can tell \"not built yet\" from \"forbidden\" only by giving up after\n *   `SETTLE_ATTEMPTS` (zfs-pool-form.ts's own ⚠️ on that); `readPoolOrFail` (used by `diff`) does\n *   not fold it, so a genuine transient failure there propagates and fails the plan loudly instead.\n */\nexport const readPoolOrFail = (props: ZfsPoolProps) =>\n  readOrUnreadable(\n    runPve(\n      props.target,\n      'read',\n      false,\n      nodes.getNodeDiskZfs({ name: props.name, node: props.node }),\n    ),\n  ).pipe(\n    Effect.map((live) => {\n      if (live === UNREADABLE) return UNREADABLE;\n      // ⚠️ A detail answer with no `name` is not a pool — same shape check zfs-pool-spec.ts made,\n      //   kept as a defensive fallback now that the 500 above is the measured absence signal.\n      return text(live.name) === '' ? undefined : attributesOf(live, props);\n    }),\n  );\n\n/**\n * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `createPool`'s settle-poll AND\n *   `read`/`reconcile` MAY USE IT — user.ts's `readUser` has the full reasoning. Safe here because\n *   a wrongful fold during create costs at most a redundant `createNodeDiskZfs` POST, which PVE\n *   refuses loudly (\"pool already exists\") rather than silently corrupting anything — zfs-pool.ts's\n *   own header, measured.\n * ⛔ `zfs-pool.ts`'s `diff` does **NOT** use this — the same bug class as the credential denial fix:\n *   folding a TRANSIENT failure into \"absent\" at PLAN TIME would force a false `update` with\n *   nothing compared. `diff` calls `readPoolOrFail` directly, so a genuine failure there propagates\n *   and fails the whole plan loudly instead.\n */\nexport const readPool = (props: ZfsPoolProps) =>\n  readPoolOrFail(props).pipe(Effect.orElseSucceed(() => undefined));\n\n/** `read`/`reconcile`/`createPool` return `Attributes | undefined`; only `diff` sees `UNREADABLE`. */\nexport const dropUnreadable = (live: ZfsPoolAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n\n/**\n * ⛔ THERE IS NO `matches` FUNCTION HERE — UNLIKE EVERY OTHER MIGRATED FAMILY, AND DELIBERATELY.\n *   Every create parameter on this family is write-only (this file's own `attributesOf`), so\n *   there is nothing a declaration and a live pool can ever be compared on — a `matches` that\n *   invented one would plan a replace (`zpool destroy`, since this family has no PUT) over a\n *   difference it could never verify. `zfs-pool.ts`'s `diff` returns `noop` unconditionally once a\n *   pool is found, rather than calling a function that would only ever return `true` — found by\n *   adversarial review that an earlier draft exported one here anyway, unused by anything.\n */\n",
     "/**\n * The create lane for `Proxmox.ZfsPool`: the form PVE wants, and the wait for the worker it forks.\n * Split out of zfs-pool.ts (2026-09-24, the distilled migration) — same seam as before, now naming\n * the write side the way storage.ts/storage-form.ts does.\n *\n * ⚠️ `createPool` TAKES THE READ AS A PARAMETER, GENERIC IN ITS ERROR AND REQUIREMENT CHANNELS,\n *   rather than importing the read module and coupling to its exact effect shape here. This file\n *   answers \"how does a declaration become a pool on disks\"; zfs-pool-wire.ts answers \"what is a\n *   zpool, and when has it changed\" — the caller (zfs-pool.ts) is what ties the two together, so\n *   this file cannot accidentally read the cluster differently from `diff`.\n */\nimport * as Effect from 'effect/Effect';\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport { asForm } from './distilled-guard.ts';\nimport { guardForm } from './constraint-guard.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { text } from './values.ts';\nimport type { ZfsPoolAttributes, ZfsPoolProps } from './zfs-pool.ts';\nimport type { NodesNodeDisksZfsPostParams } from './generated/pve.ts';\n\nexport const ZFS_POOL_CREATE = 'pve:POST /nodes/{node}/disks/zfs';\n\n/**\n * PVE's layouts, generated (2026-09-23) from `NodesNodeDisksZfsPostParams['raidlevel']`\n * (`generated/pve.ts`, manifest `pve-apidoc` pve-manager 9.2.11 sha256 9def8f13…) rather than\n * hand-typed, per decision 9. ⚠️ Each has a minimum disk count PVE enforces, and `raid10` needs an\n * even one. ⛔ THERE IS NO `stripe` IN THIS ENUM. n1's `speed` pool is one (decision 14 accepts it\n * as-is): `ZfsPoolProps` (zfs-pool.ts) is why a stripe pool is declarable at all — as an\n * ADOPT-ONLY declaration with no `raidlevel`, never as a full one.\n */\nexport type ZfsRaidLevel = NonNullable<NodesNodeDisksZfsPostParams['raidlevel']>;\n\n/** Generated the same way, from `NodesNodeDisksZfsPostParams['compression']`. */\nexport type ZfsCompression = NonNullable<NodesNodeDisksZfsPostParams['compression']>;\n\n/**\n * ★ CHECKED AGAINST THE VENDOR TABLE ONLY FOR A FULL DECLARATION — decision 9's adopt-only mode.\n *   `guardCreate` (distilled-guard.ts's `guardWrite`) runs on the FIRST plan of ANY declaration and\n *   checks the create form's REQUIRED fields whenever this resolves to the real endpoint key — and\n *   PVE marks both `devices` and `raidlevel` required (codegen/constraints's `pve-nodes-disks`\n *   row). An adopt-only declaration deliberately omits both, so checking it would refuse a MATCHING\n *   adoption at plan time, before `read` ever ran. Returning `undefined` (no key) makes the guard a\n *   no-op for an adopt-only declaration, while a FULL one (`devices` and `raidlevel` both present)\n *   is checked exactly as before — zfs-pool.ts's `diff` passes this as the `guardWrite` endpoint.\n * ⚠️ THE RUNTIME BACKSTOP IS `createPool` BELOW, NOT THIS FUNCTION. Skipping the plan-time guard\n *   for an adopt-only declaration does not skip the check that the pool is actually there —\n *   `createPool` refuses before any POST when the read comes back absent and either field is\n *   undefined, which is what a genuinely absent adopt-only declaration hits at apply time.\n */\nexport const zfsPoolCreateEndpoint = (props: ZfsPoolProps) =>\n  props.devices === undefined || props.raidlevel === undefined ? undefined : ZFS_POOL_CREATE;\n\n/**\n * The wire form, PVE's own field names — what `guardWrite` (zfs-pool.ts) checks.\n *\n * ⚠️ `devices` IS JOINED IN DECLARED ORDER AND NOT PUT THROUGH `csv()` FROM values.ts. `csv` sorts,\n *   and PVE walks this list two at a time to pair `raid10` mirrors — MEASURED in the node's own\n *   `PVE::API2::Disks::ZFS` — so sorting it builds a different pool from the one declared. The list\n *   is never compared against anything, so it needs no normalisation, only faithful order.\n * ⚠️ AN OMITTED OPTIONAL IS NOT SENT. PVE's own defaults (ashift 12, compression on) are then\n *   applied by the node. Sending a guessed default would be indistinguishable here — the values\n *   are unreadable afterwards either way — but it would put a number in the request that no\n *   declaration asked for, and this is the one call that writes to physical disks.\n * ⚠️ `node` IS NOT IN THE FORM: it is the `nodes/{node}` path label, and a second copy could only\n *   disagree with it.\n * ⚠️ EVERY KEY IS OMITTED WHEN ABSENT, `devices` AND `raidlevel` INCLUDED — not just the optional\n *   ones. An adopt-only declaration (both undefined, decision 9) must produce a form `createPool`'s\n *   own guard can inspect for their absence, and one this function itself does not throw building.\n */\nexport const createForm = (props: ZfsPoolProps): Record<string, string> => ({\n  ...(props.devices === undefined ? {} : { devices: props.devices.join(',') }),\n  name: props.name,\n  ...(props.raidlevel === undefined ? {} : { raidlevel: props.raidlevel }),\n  ...(props.ashift === undefined ? {} : { ashift: String(props.ashift) }),\n  ...(props.compression === undefined ? {} : { compression: props.compression }),\n  ...(props['draid-config'] === undefined ? {} : { 'draid-config': props['draid-config'] }),\n});\n\n/**\n * The actual `createNodeDiskZfs` call body — `createForm` plus the `node` label, `draid-config`\n * renamed to distilled's `draid_config` (`T.Body(\"draid-config\")` on the generated schema; the\n * ONE hyphenated field this family's create form carries — storage-form.ts's `underscored` has\n * the fuller measurement, not repeated here for one field).\n *\n * ⚠️ `as unknown as` — `devices`/`raidlevel` are REQUIRED in distilled's generated\n *   `CreateNodeDiskZfsRequest`, so an adopt-only form (both omitted) cannot satisfy it structurally\n *   even though it is a valid PVE request for `guardWrite`'s purposes. `createPool` below refuses\n *   before ever reaching this cast when either is genuinely missing, so the cast never carries a\n *   request distilled's OWN required fields would reject in practice.\n */\nconst toDistilledCreate = (props: ZfsPoolProps): nodes.CreateNodeDiskZfsRequest => {\n  const form = createForm(props);\n  return {\n    ...form,\n    draid_config: form['draid-config'],\n    node: props.node,\n  } as unknown as nodes.CreateNodeDiskZfsRequest;\n};\n\n/** 30 reads, 2s apart. A create that has not landed in a minute has gone wrong, not gone slow. */\nconst SETTLE_ATTEMPTS = 30;\n\n/**\n * Create the pool if it is absent, and otherwise leave it completely alone.\n *\n * ⛔ THE POST ONLY FORKS A WORKER. MEASURED in `/usr/share/perl5/PVE/API2/Disks/ZFS.pm` on node-b:\n *   the create handler ends in `$rpcenv->fork_worker('zfscreate', ...)` and its HTTP answer is a\n *   UPID returned the instant the worker is forked — before `zpool create` has run, let alone\n *   finished. A read-back taken immediately would report a successful create as the failure \"the\n *   write returned no error but the object is still absent\". THAT is why this function polls.\n *\n * ⚠️ THERE IS NO UPDATE BRANCH BECAUSE PVE HAS NO PUT HERE. An existing pool is returned exactly as\n *   read, unwritten: the only write this resource ever makes is the create of a pool that is not\n *   there. Do not add a \"repair\" write; there is no field it could set.\n *\n * ⛔ AND IF THE READ IS WRONG, THE POST IS STILL SAFE — measured, not hoped for. `readPool` folds a\n *   403 or an unreachable node into \"absent\", so a too-narrow lease would send this down the create\n *   path over a live pool. PVE's handler calls `get_pool_data()` before it forks anything and dies\n *   with \"pool '<name>' already exists on node '<node>'\", and `assert_disk_unused` refuses every\n *   device that pool is holding. A create aimed at a pool that is really there fails loudly rather\n *   than wiping it.\n *\n * ⚠️ SHORT POLLS WITH A HARD CAP, NOT ONE LONG WAIT, NOT `@distilled.cloud/proxmox`'s `awaitTask`.\n *   `readPool` cannot tell \"not yet\" from \"forbidden\" — both fold to `undefined` — so the loop\n *   gives up with the UPID rather than retrying forever, and the UPID is the only thing that leads\n *   to the worker's real error. Distilled's own task-status poller exists (`Task.ts`) and would\n *   remove this ambiguity, but swapping to it changes this resource's OBSERVABLE behaviour (what a\n *   caller sees on a slow create) beyond a transport swap — left as a follow-up, not folded into a\n *   migration PR silently.\n *\n * ⛔ THE SAME AMBIGUITY MAKES A RE-RUN AFTER THE GIVE-UP DIE GENUINELY UNSAFE, NOT MERELY SLOW TO\n *   CONFIRM — FOUND BY ADVERSARIAL REVIEW, 2026-09-24, of THIS migration, though the shape is\n *   unchanged from before it (`git blame` shows the same settle-poll pre-dates this PR). \"If the\n *   read is wrong, the POST is still safe\" above is true for the FIRST call into this function —\n *   PVE's own `get_pool_data()` refuses a create over a pool it can already see. It is NOT true\n *   for a SECOND deploy attempt started while the FIRST worker is still mid-`zpool create`: that\n *   worker has not yet made the pool visible to a read, so `existing = yield* read(props)` at the\n *   top of THIS call can also fold to `undefined` — not because the pool is gone, but because the\n *   first attempt has not finished — and this function would POST a SECOND `zpool create` at the\n *   SAME devices while the first is still writing them. There is no lock or marker anywhere in\n *   this package that would stop it. The give-up message below says so explicitly and names the\n *   task log to check FIRST; that message, and an operator reading it, are the only safeguard.\n *\n * ⛔ THE ADOPT-ONLY GUARD, RIGHT AFTER THE READ AND BEFORE ANYTHING ELSE. Decision 9 (2026-09-23):\n *   omitting `devices` and `raidlevel` declares a pool this resource may only ADOPT, for a pool\n *   PVE's own schema cannot fully describe — n1's `speed` is a stripe, and `raidlevel`'s enum has\n *   no stripe (zfs-pool.ts). `zfsPoolCreateEndpoint` above already keeps the vendor constraint\n *   guard from refusing such a declaration at PLAN time; this is the matching refusal at APPLY\n *   time, for the one case that guard cannot see — the pool genuinely is not there.\n */\nexport const createPool = <E, R>(\n  props: ZfsPoolProps,\n  read: (props: ZfsPoolProps) => Effect.Effect<ZfsPoolAttributes | undefined, E, R>,\n) =>\n  Effect.gen(function* () {\n    const existing = yield* read(props);\n    if (existing !== undefined) return existing;\n\n    if (props.devices === undefined || props.raidlevel === undefined) {\n      return yield* Effect.die(\n        new Error(\n          `${props.node}/${props.name}: this is an adopt-only declaration (no \\`devices\\` or ` +\n            '`raidlevel`) and the pool is not there to adopt. An adopt-only Proxmox.ZfsPool never ' +\n            'creates -- declare both fields for a pool this resource should build, or point this ' +\n            'declaration at a pool that already exists on this node.',\n        ),\n      );\n    }\n\n    /**\n     * ⛔ FOUND BY ADVERSARIAL REVIEW, 2026-09-24 — `diff` NEVER RUNS FOR A GENUINELY FIRST-EVER\n     *   DECLARATION. Upstream `Plan.ts` routes a brand-new resource (`oldState === undefined`)\n     *   straight to `action: 'create'` without ever calling `provider.diff` — so `zfs-pool.ts`'s\n     *   own `guardForm` call (which checks THIS SAME form) never runs for that plan, and this was\n     *   THE ONLY WRITE PATH IN THE FAMILY WITH NO VENDOR CHECK AT ALL, before or after this\n     *   migration. `ceph-pool.ts`'s own hand-written `reconcile` already re-runs its create guard\n     *   for exactly this reason (an ADOPTED row's `diff` answer is discarded by Plan.ts too); this\n     *   is the same fix for this family. A malformed `ashift` or `draid-config` is now refused\n     *   here, before the POST, rather than reaching the wire and refused only by PVE itself.\n     */\n    yield* guardForm(zfsPoolCreateEndpoint(props), asForm(createForm(props)), true);\n\n    const upid = yield* runPve(\n      props.target,\n      'provision',\n      true,\n      nodes.createNodeDiskZfs(toDistilledCreate(props)),\n    );\n\n    const settle = (attempts: number): Effect.Effect<ZfsPoolAttributes | undefined, E, R> =>\n      Effect.gen(function* () {\n        const live = yield* read(props);\n        if (live !== undefined || attempts <= 0) return live;\n        yield* Effect.sleep('2 seconds');\n        return yield* settle(attempts - 1);\n      });\n\n    const after = yield* settle(SETTLE_ATTEMPTS);\n    if (after === undefined) {\n      return yield* Effect.die(\n        new Error(\n          `nodes/${props.node}/disks/zfs/${props.name}: POST returned ${text(upid, '(no UPID)')} ` +\n            'but the pool has not appeared. That POST only forks a `zfscreate` worker, so the task ' +\n            `holds the real error -- read it with \\`pvesh get /nodes/${props.node}/tasks/<upid>/log\\`. ` +\n            'NOTHING WAS RETRIED AND NOTHING WAS CLEANED UP: if the worker reached `zpool create`, ' +\n            'the declared devices have already been written to. DO NOT RE-RUN THIS DEPLOY BEFORE ' +\n            'READING THAT LOG: `read` cannot tell \"the worker is still running\" from \"the pool is ' +\n            'genuinely gone\", so a re-run this soon can POST a SECOND `zpool create` at the SAME ' +\n            'devices while the first one is still mid-write -- confirm the task finished (one way ' +\n            'or the other) before trying again.',\n        ),\n      );\n    }\n    return after;\n  });\n\n/**\n * ⛔ `DELETE /nodes/{node}/disks/zfs/{name}` RUNS `zpool destroy` AND THE DATASETS GO WITH IT. Per\n *   S14 (alchemy-provider-standard), it is implemented rather than stubbed — a `delete` that\n *   silently does nothing lies to whoever reads the plan — and what keeps an ordinary removed\n *   declaration from reaching it is the resource's `defaultRemovalPolicy: 'retain'` (zfs-pool.ts):\n *   an orphaned pool is forgotten, not destroyed, unless a caller opts in with\n *   `.pipe(RemovalPolicy.destroy())`. See the corrected header in zfs-pool.ts.\n *\n * ⚠️ `cleanup-config`/`cleanup-disks` ARE NOT SENT. The first would additionally remove the PVE\n *   storage entry pointing at this pool, which is a different object with its own resource\n *   (`Proxmox.Storage`); one resource reaching over to delete another's is how a stack ends up with\n *   state describing something that is gone. Neither is offered as a prop, for the same reason.\n */\nexport const destroyPool = (props: ZfsPoolProps) =>\n  runPve(\n    props.target,\n    'provision',\n    true,\n    nodes.deleteNodeDiskZfs({ name: props.name, node: props.node }),\n  );\n"
   ],
-  "mappings": ";AA4CA;AACA;AACA;AACA;AACA;;;ACpCA;;;AC4EA,IAAM,WAAW,CAAC,UAA0B,CAAC,GAAG,KAAK,EAAE;AAQvD,IAAM,aAAa,CAAC,MAAc,OAAe,SAAoC;AAAA,EACnF,MAAM,MAAgB,CAAC;AAAA,EACvB,IAAI,KAAK,cAAc,aAAa,SAAS,KAAK,IAAI,KAAK,WAAW;AAAA,IACpE,IAAI,KAAK,GAAG,iBAAiB,KAAK,sBAAsB;AAAA,EAC1D;AAAA,EACA,IAAI,KAAK,cAAc,aAAa,SAAS,KAAK,IAAI,KAAK,WAAW;AAAA,IACpE,IAAI,KAAK,GAAG,kBAAkB,KAAK,sBAAsB;AAAA,EAC3D;AAAA,EACA,IAAI,KAAK,SAAS,aAAa,CAAC,KAAK,KAAK,SAAS,KAAK,GAAG;AAAA,IACzD,IAAI,KAAK,GAAG,wBAAwB,KAAK,KAAK,KAAK,IAAI,GAAG;AAAA,EAC5D;AAAA,EAGA,IAAI,KAAK,YAAY,aAAa,CAAC,IAAI,OAAO,KAAK,SAAS,KAAK,YAAY,EAAE,KAAK,KAAK,GAAG;AAAA,IAC1F,IAAI,KAAK,GAAG,oBAAoB,KAAK,iBAAiB,KAAK,SAAS;AAAA,EACtE;AAAA,EAIA,MAAM,UAAU,OAAO,KAAK;AAAA,EAC5B,MAAM,UAAU,KAAK,YAAY,aAAa,KAAK,YAAY;AAAA,EAC/D,IAAI,WAAW,UAAU,MAAM,OAAO,SAAS,OAAO,GAAG;AAAA,IACvD,IAAI,KAAK,YAAY,aAAa,UAAU,KAAK,SAAS;AAAA,MACxD,IAAI,KAAK,GAAG,kBAAkB,KAAK,SAAS;AAAA,IAC9C;AAAA,IACA,IAAI,KAAK,YAAY,aAAa,UAAU,KAAK,SAAS;AAAA,MACxD,IAAI,KAAK,GAAG,iBAAiB,KAAK,SAAS;AAAA,IAC7C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,aAAa,CACxB,OACA,MACA,UAA4B,CAAC,MACP;AAAA,EACtB,MAAM,MAAgB,CAAC;AAAA,EACvB,YAAY,MAAM,SAAS,OAAO,QAAQ,KAAK,GAAG;AAAA,IAChD,MAAM,QAAQ,KAAK;AAAA,IACnB,IAAI,UAAU,WAAW;AAAA,MACvB,IAAI,QAAQ,aAAa,QAAQ,KAAK,aAAa;AAAA,QAAM,IAAI,KAAK,GAAG,gBAAgB;AAAA,MACrF;AAAA,IACF;AAAA,IAEA,WAAW,QAAQ,OAAO,UAAU,WAAW,CAAC,KAAK,IAAI,OAAO;AAAA,MAC9D,IAAI,KAAK,GAAG,WAAW,MAAM,MAAM,IAAI,CAAC;AAAA,IAC1C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,UAAU,CAAC,UAAuB,UAC7C,GAAG;AAAA,MAAkD,MAAM,KAAK;AAAA,KAAQ;AAAA,IACxE,uEACA;;;ACzIK,IAAM,yBAAwE;AAAA,EACnF,2BAA2B;AAAA,IACzB,SAAW,EAAC,QAAS,eAAc,UAAW,MAAK,MAAO,SAAQ;AAAA,EACpE;AAAA,EACA,0BAA0B;AAAA,IACxB,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,QAAU,EAAC,QAAS,cAAa,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,0BAA0B;AAAA,IACxB,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,aAAY,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC9D,QAAU,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACvC,WAAa,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,MAAQ,EAAC,SAAU,+BAA8B,eAAgB,yBAAwB,MAAO,SAAQ;AAAA,IACxG,UAAY,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC7C,UAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,QAAS,cAAa,WAAY,IAAG,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjF;AAAA,EACA,uBAAuB;AAAA,IACrB,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,MAAQ,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACxC,OAAS,EAAC,QAAS,mBAAkB,UAAW,MAAK,MAAO,SAAQ;AAAA,IACpE,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,OAAS,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,EACtD;AAAA,EACA,oCAAoC,CAAC;AAAA,EACrC,kCAAkC;AAAA,IAChC,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EACpD;AAAA,EACA,kCAAkC;AAAA,IAChC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,aAAY,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC9D,QAAU,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACvC,WAAa,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,MAAQ,EAAC,SAAU,+BAA8B,eAAgB,yBAAwB,MAAO,SAAQ;AAAA,IACxG,UAAY,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,EAC/C;AAAA,EACA,kDAAkD;AAAA,IAChD,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,SAAU,gBAAe,SAAU,GAAE,MAAO,UAAS;AAAA,EAClE;AACF;;;AC3CO,IAAM,iCAAgF;AAAA,EAC3F,4BAA4B;AAAA,IAC1B,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,SAAU,KAAI,MAAO,CAAC,KAAI,KAAI,QAAO,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC/E,KAAO,EAAC,SAAU,+BAA8B,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IAC/F,SAAW,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACpD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,IAAM,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACjE,UAAY,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACzD,kBAAoB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACnF,QAAU,EAAC,QAAS,0BAAyB,MAAO,SAAQ;AAAA,IAC5D,MAAQ,EAAC,SAAU,YAAW,MAAO,CAAC,YAAW,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClF,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,kBAAkB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACnD,qBAAqB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IAC9G,6BAA6B,EAAC,MAAO,CAAC,UAAS,QAAO,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,aAAe,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IAC7D,iBAAiB,EAAC,SAAU,cAAa,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjF,UAAY,EAAC,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1E,WAAa,EAAC,SAAU,2BAA0B,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IACrG,UAAY,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACxD,SAAW,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACrD,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EACnD;AAAA,EACA,gCAAgC;AAAA,IAC9B,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,SAAU,KAAI,MAAO,CAAC,KAAI,KAAI,QAAO,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC/E,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACpD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACjE,UAAY,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACzD,kBAAoB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACnF,QAAU,EAAC,QAAS,0BAAyB,MAAO,SAAQ;AAAA,IAC5D,MAAQ,EAAC,SAAU,YAAW,MAAO,CAAC,YAAW,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClF,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,kBAAkB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACnD,qBAAqB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IAC9G,6BAA6B,EAAC,MAAO,CAAC,UAAS,QAAO,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,aAAe,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IAC7D,iBAAiB,EAAC,SAAU,cAAa,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjF,UAAY,EAAC,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1E,WAAa,EAAC,SAAU,2BAA0B,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IACrG,UAAY,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACxD,SAAW,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACrD,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EACnD;AACF;;;ACnDO,IAAM,+BAA8E;AAAA,EACzF,sCAAsC;AAAA,IACpC,OAAS,EAAC,UAAW,MAAK,MAAO,UAAS;AAAA,EAC5C;AACF;;;ACJO,IAAM,mCAAkF;AAAA,EAC7F,sCAAsC;AAAA,IACpC,MAAQ,EAAC,QAAS,YAAW,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5D,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,oCAAmC,eAAgB,8BAA6B,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjK;AAAA,EACA,4CAA4C;AAAA,IAC1C,MAAQ,EAAC,QAAS,YAAW,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5D,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,oCAAmC,eAAgB,8BAA6B,MAAO,SAAQ;AAAA,EACnJ;AACF;;;ACZO,IAAM,6BAA4E;AAAA,EACvF,kCAAkC;AAAA,IAChC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACjD,cAAgB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3D,aAAe,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1D,KAAO,EAAC,QAAS,4BAA2B,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3E,OAAS,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,WAAU,WAAU,YAAW,SAAS,GAAE,MAAO,SAAQ;AAAA,IACzG,MAAQ,EAAC,MAAO,CAAC,MAAK,IAAI,GAAE,MAAO,SAAQ;AAAA,EAC7C;AAAA,EACA,8BAA8B;AAAA,IAC5B,UAAY,EAAC,MAAO,CAAC,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IAC3D,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,WAAa,EAAC,QAAS,2BAA0B,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChF,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,uCAAuC;AAAA,IACrC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,OAAS,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACjD,cAAgB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3D,aAAe,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1D,OAAS,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,WAAU,WAAU,YAAW,SAAS,GAAE,MAAO,SAAQ;AAAA,EAC3G;AAAA,EACA,oCAAoC;AAAA,IAClC,UAAY,EAAC,MAAO,CAAC,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IAC3D,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,WAAa,EAAC,QAAS,2BAA0B,MAAO,SAAQ;AAAA,EAClE;AACF;;;AChCO,IAAM,kCAAiF;AAAA,EAC5F,yCAAyC;AAAA,IACvC,eAAiB,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC/E,iBAAiB,EAAC,SAAU,YAAW,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,KAAO,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,KAAI,MAAO,UAAS;AAAA,IACvE,oBAAoB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC5E,gBAAgB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACjD,sBAAsB,EAAC,SAAU,YAAW,SAAU,MAAK,MAAO,UAAS;AAAA,IAC3E,iBAAiB,EAAC,SAAU,SAAQ,MAAO,CAAC,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC3E,4BAA4B,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC7D,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,UAAW,MAAK,MAAO,UAAS;AAAA,IACrE,OAAS,EAAC,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,WAAU,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7D,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,MAAQ,EAAC,MAAO,CAAC,YAAW,YAAW,eAAe,GAAE,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjH;AAAA,EACA,wCAAwC;AAAA,IACtC,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,eAAiB,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC/E,iBAAiB,EAAC,SAAU,YAAW,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,KAAO,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,KAAI,MAAO,UAAS;AAAA,IACvE,oBAAoB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC5E,gBAAgB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACjD,sBAAsB,EAAC,SAAU,YAAW,SAAU,MAAK,MAAO,UAAS;AAAA,IAC3E,iBAAiB,EAAC,SAAU,SAAQ,MAAO,CAAC,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC3E,4BAA4B,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC7D,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,UAAW,MAAK,MAAO,UAAS;AAAA,IACrE,OAAS,EAAC,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,WAAU,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7D,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,EACxD;AACF;;;ACpCO,IAAM,wCAAuF;AAAA,EAClG,oDAAoD;AAAA,IAClD,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC1C,OAAS,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC3C;AAAA,EACA,sDAAsD;AAAA,IACpD,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,IAChE,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,kDAAkD;AAAA,IAChD,gBAAgB,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,IAChE,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC5C;AAAA,EACA,qDAAqD;AAAA,IACnD,QAAU,EAAC,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IACtE,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,KAAO,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EACzC;AAAA,EACA,4CAA4C;AAAA,IAC1C,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,EAC/D;AAAA,EACA,0DAA0D;AAAA,IACxD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,EAC3C;AAAA,EACA,4DAA4D;AAAA,IAC1D,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,EAClE;AAAA,EACA,wDAAwD;AAAA,IACtD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,IAChE,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,EAC/E;AAAA,EACA,2DAA2D;AAAA,IACzD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,EACxD;AAAA,EACA,kDAAkD;AAAA,IAChD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,EAC/D;AACF;;;ACzDO,IAAM,sCAAqF;AAAA,EAChG,iCAAiC;AAAA,IAC/B,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,IAAM,EAAC,QAAS,0BAAyB,SAAU,kCAAiC,eAAgB,4BAA2B,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9J,MAAQ,EAAC,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpC,YAAc,EAAC,MAAO,CAAC,SAAQ,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtD,UAAY,EAAC,SAAU,QAAO,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3F,QAAU,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,YAAW,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9D,MAAQ,EAAC,MAAO,CAAC,OAAO,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC3D;AAAA,EACA,qCAAqC;AAAA,IACnC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,MAAQ,EAAC,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpC,YAAc,EAAC,MAAO,CAAC,SAAQ,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtD,UAAY,EAAC,SAAU,QAAO,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3F,QAAU,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,EAChD;AACF;;;ACpBO,IAAM,8BAA6E;AAAA,EACxF,+BAA+B;AAAA,IAC7B,OAAS,EAAC,WAAY,KAAI,eAAgB,qCAAoC,MAAO,SAAQ;AAAA,IAC7F,KAAO,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,MAAQ,EAAC,MAAO,CAAC,MAAM,GAAE,MAAO,SAAQ;AAAA,IACxC,MAAQ,EAAC,WAAY,GAAE,WAAY,GAAE,SAAU,yCAAwC,eAAgB,mCAAkC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACxK,MAAQ,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC1C;AAAA,EACA,8CAA8C;AAAA,IAC5C,mBAAmB,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,IACjD,cAAc,EAAC,MAAO,MAAK,QAAS,sBAAqB,MAAO,QAAO;AAAA,IACvE,eAAiB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACrD,SAAW,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,QAAS,qBAAoB,UAAW,MAAK,MAAO,SAAQ;AAAA,IACvE,MAAQ,EAAC,MAAO,CAAC,QAAQ,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC5D;AAAA,EACA,+BAA+B;AAAA,IAC7B,MAAQ,EAAC,MAAO,CAAC,SAAS,GAAE,MAAO,SAAQ;AAAA,IAC3C,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,WAAa,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACtD,qBAAqB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC3C,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,OAAS,EAAC,QAAS,WAAU,MAAO,SAAQ;AAAA,IAC5C,aAAa,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC5D,yBAAyB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,2CAA0C,eAAgB,qCAAoC,MAAO,QAAO;AAAA,IACzL,KAAO,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACpC,MAAQ,EAAC,MAAO,CAAC,QAAO,UAAS,QAAO,UAAS,QAAO,OAAO,GAAE,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IACxH,iBAAiB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IAChF,aAAa,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7D,cAAc,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5E,MAAQ,EAAC,WAAY,GAAE,WAAY,GAAE,SAAU,yCAAwC,eAAgB,mCAAkC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC1K;AAAA,EACA,wBAAwB,CAAC;AAAA,EACzB,qCAAqC;AAAA,IACnC,OAAS,EAAC,WAAY,KAAI,eAAgB,qCAAoC,MAAO,SAAQ;AAAA,IAC7F,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,KAAO,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,EACzD;AAAA,EACA,sDAAsD;AAAA,IACpD,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,mBAAmB,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,IACjD,cAAc,EAAC,MAAO,MAAK,QAAS,sBAAqB,MAAO,QAAO;AAAA,IACvE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,eAAiB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACrD,SAAW,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,EAC3C;AAAA,EACA,qCAAqC;AAAA,IACnC,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,MAAQ,EAAC,MAAO,CAAC,SAAS,GAAE,MAAO,SAAQ;AAAA,IAC3C,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,WAAa,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACtD,qBAAqB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC3C,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,OAAS,EAAC,QAAS,WAAU,MAAO,SAAQ;AAAA,IAC5C,aAAa,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC5D,yBAAyB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,2CAA0C,eAAgB,qCAAoC,MAAO,QAAO;AAAA,IACzL,KAAO,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACpC,iBAAiB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IAChF,aAAa,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7D,cAAc,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,EAC9E;AACF;;;ACnEO,IAAM,6BAA4E;AAAA,EACvF,yCAAyC;AAAA,IACvC,QAAU,EAAC,SAAU,OAAM,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,EACzE;AAAA,EACA,0CAA0C,CAAC;AAAA,EAC3C,wCAAwC,CAAC;AAAA,EACzC,2CAA2C;AAAA,IACzC,eAAe,EAAC,QAAS,WAAU,MAAO,SAAQ;AAAA,EACpD;AAAA,EACA,mCAAmC;AAAA,IACjC,aAAe,EAAC,SAAU,GAAE,MAAO,SAAQ;AAAA,IAC3C,KAAO,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACvC,mBAAmB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAChD,cAAgB,EAAC,SAAU,KAAI,MAAO,SAAQ;AAAA,EAChD;AAAA,EACA,oCAAoC;AAAA,IAClC,aAAe,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,UAAS,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,UAAY,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,MAAQ,EAAC,eAAgB,oBAAmB,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3E,mBAAqB,EAAC,SAAU,QAAO,MAAO,CAAC,MAAK,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IACjF,QAAU,EAAC,SAAU,OAAM,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACvE,YAAc,EAAC,SAAU,OAAM,MAAO,UAAS;AAAA,IAC/C,MAAQ,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IAC/D,aAAe,EAAC,SAAU,qCAAoC,eAAgB,+BAA8B,MAAO,SAAQ;AAAA,EAC7H;AAAA,EACA,0CAA0C;AAAA,IACxC,aAAe,EAAC,MAAO,CAAC,OAAM,UAAS,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,UAAY,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,mBAAqB,EAAC,MAAO,CAAC,MAAK,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,YAAc,EAAC,SAAU,OAAM,MAAO,UAAS;AAAA,IAC/C,MAAQ,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACjD,aAAe,EAAC,SAAU,qCAAoC,eAAgB,+BAA8B,MAAO,SAAQ;AAAA,EAC7H;AACF;;;AClCO,IAAM,8BAA6E;AAAA,EACxF,oCAAoC;AAAA,IAClC,QAAU,EAAC,SAAU,MAAK,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,aAAe,EAAC,SAAU,MAAK,MAAO,CAAC,MAAK,OAAM,QAAO,OAAM,QAAO,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IACnG,SAAW,EAAC,QAAS,eAAc,UAAW,MAAK,MAAO,SAAQ;AAAA,IAClE,MAAQ,EAAC,QAAS,kBAAiB,UAAW,MAAK,MAAO,SAAQ;AAAA,IAClE,WAAa,EAAC,MAAO,CAAC,UAAS,UAAS,UAAS,SAAQ,UAAS,UAAS,SAAQ,UAAS,QAAQ,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EACvI;AACF;;;ACRO,IAAM,4BAA2E;AAAA,EACtF,8BAA8B;AAAA,IAC5B,MAAQ,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,QAAO,SAAQ,SAAQ,WAAU,SAAS,GAAE,MAAO,SAAQ;AAAA,IACtG,SAAW,EAAC,SAAU,mDAAkD,SAAU,GAAE,MAAO,SAAQ;AAAA,IACnG,OAAS,EAAC,SAAU,OAAM,MAAO,CAAC,SAAQ,WAAU,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC1E,OAAS,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,UAAY,EAAC,SAAU,KAAI,SAAU,MAAK,SAAU,GAAE,MAAO,SAAQ;AAAA,IACrE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,YAAc,EAAC,SAAU,cAAa,eAAgB,wCAAuC,MAAO,SAAQ;AAAA,IAC5G,KAAO,EAAC,eAAgB,6FAA4F,MAAO,SAAQ;AAAA,IACnI,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,UAAY,EAAC,QAAS,YAAW,WAAY,KAAI,MAAO,SAAQ;AAAA,IAChE,MAAQ,EAAC,MAAO,CAAC,UAAS,UAAS,aAAY,QAAO,UAAS,WAAU,WAAU,YAAW,YAAW,iBAAiB,GAAE,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,SAAU,OAAM,SAAU,IAAG,MAAO,UAAS;AAAA,IACxD,YAAc,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACnE,YAAc,EAAC,WAAY,KAAI,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9D,QAAU,EAAC,MAAO,CAAC,UAAS,UAAS,UAAS,UAAS,UAAS,YAAW,aAAY,UAAS,UAAS,SAAQ,WAAW,GAAE,MAAO,SAAQ;AAAA,IAC7I,UAAY,EAAC,WAAY,GAAE,MAAO,SAAQ;AAAA,IAC1C,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,cAAgB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACzD,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,SAAU,SAAQ,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvE,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IAC9D,MAAQ,EAAC,QAAS,YAAW,SAAU,WAAU,SAAU,KAAI,UAAW,MAAK,MAAO,UAAS;AAAA,EACjG;AAAA,EACA,2CAA2C;AAAA,IACzC,MAAQ,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,QAAO,SAAQ,SAAQ,WAAU,SAAS,GAAE,MAAO,SAAQ;AAAA,IACtG,OAAS,EAAC,SAAU,OAAM,MAAO,CAAC,SAAQ,WAAU,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC1E,OAAS,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,UAAY,EAAC,SAAU,KAAI,SAAU,MAAK,SAAU,GAAE,MAAO,SAAQ;AAAA,IACrE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,YAAc,EAAC,SAAU,cAAa,eAAgB,wCAAuC,MAAO,SAAQ;AAAA,IAC5G,KAAO,EAAC,eAAgB,6FAA4F,MAAO,SAAQ;AAAA,IACnI,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,UAAY,EAAC,QAAS,YAAW,WAAY,KAAI,MAAO,SAAQ;AAAA,IAChE,MAAQ,EAAC,MAAO,CAAC,UAAS,UAAS,aAAY,QAAO,UAAS,WAAU,WAAU,YAAW,YAAW,iBAAiB,GAAE,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,SAAU,OAAM,SAAU,IAAG,MAAO,UAAS;AAAA,IACxD,YAAc,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACnE,QAAU,EAAC,MAAO,CAAC,UAAS,UAAS,UAAS,UAAS,UAAS,YAAW,aAAY,UAAS,UAAS,SAAQ,WAAW,GAAE,MAAO,SAAQ;AAAA,IAC7I,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,cAAgB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACzD,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,EAChE;AAAA,EACA,2CAA2C;AAAA,IACzC,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,MAAQ,EAAC,MAAO,CAAC,UAAS,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,OAAO,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC58D,MAAQ,EAAC,SAAU,mCAAkC,eAAgB,6BAA4B,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClI;AACF;;;AC3DO,IAAM,gCAA+E;AAAA,EAC1F,kCAAkC;AAAA,IAChC,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,gBAAgB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACrD,WAAa,EAAC,MAAO,CAAC,cAAa,iBAAgB,eAAc,aAAY,WAAU,eAAc,eAAc,eAAc,oBAAmB,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IACvL,uBAAyB,EAAC,MAAO,CAAC,UAAS,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,cAAgB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC1D,aAAe,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACpE,MAAQ,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC1C,OAAS,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC3C,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,aAAY,WAAY,IAAG,WAAY,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3F,KAAO,EAAC,SAAU,OAAM,SAAU,MAAK,MAAO,UAAS;AAAA,IACvD,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,YAAc,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACnD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,QAAU,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACpD,MAAQ,EAAC,MAAO,CAAC,UAAS,QAAO,OAAM,SAAQ,QAAO,UAAS,aAAY,WAAU,WAAU,cAAa,QAAO,SAAS,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7J,WAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,mBAAmB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,EAC1D;AAAA,EACA,iCAAiC,CAAC;AAAA,EAClC,yCAAyC;AAAA,IACvC,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,gBAAgB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACrD,WAAa,EAAC,MAAO,CAAC,cAAa,iBAAgB,eAAc,aAAY,WAAU,eAAc,eAAc,eAAc,oBAAmB,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IACvL,uBAAyB,EAAC,MAAO,CAAC,UAAS,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,cAAgB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC1D,aAAe,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACpE,MAAQ,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC1C,OAAS,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC3C,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,KAAO,EAAC,SAAU,OAAM,SAAU,MAAK,MAAO,UAAS;AAAA,IACvD,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,YAAc,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACnD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,QAAU,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACpD,MAAQ,EAAC,MAAO,CAAC,UAAS,QAAO,OAAM,SAAQ,QAAO,UAAS,aAAY,WAAU,WAAU,cAAa,QAAO,SAAS,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7J,WAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,mBAAmB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,EAC1D;AACF;;;ACtDO,IAAM,6BAA4E;AAAA,EACvF,+BAA+B;AAAA,IAC7B,UAAY,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAClD,WAAW,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACvD,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpD,SAAW,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3C,SAAW,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACxC,MAAQ,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtE,MAAQ,EAAC,QAAS,eAAc,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,SAAU,oCAAmC,eAAgB,8BAA6B,MAAO,SAAQ;AAAA,IACjJ,SAAW,EAAC,SAAU,mDAAkD,SAAU,GAAE,MAAO,UAAS;AAAA,IACpG,OAAS,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,YAAY,GAAE,MAAO,SAAQ;AAAA,IACzE,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,KAAO,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAClD,UAAY,EAAC,SAAU,KAAI,SAAU,KAAI,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,cAAc,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,SAAU,oBAAmB,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IACxF,WAAa,EAAC,MAAO,CAAC,OAAM,KAAI,MAAM,GAAE,MAAO,SAAQ;AAAA,IACvD,0BAA0B,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACpE,aAAa,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACzD,eAAe,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,MAAO,CAAC,MAAK,SAAQ,MAAK,SAAQ,SAAQ,MAAK,MAAK,MAAK,SAAQ,SAAQ,SAAQ,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,SAAQ,MAAK,MAAK,IAAI,GAAE,MAAO,SAAQ;AAAA,IACvL,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAQ,UAAS,WAAU,YAAW,YAAW,mBAAkB,cAAa,WAAW,GAAE,MAAO,SAAQ;AAAA,IACtI,kBAAoB,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,SAAQ;AAAA,IAChE,eAAiB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5D,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,YAAc,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACtD,QAAU,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,OAAM,OAAM,QAAO,QAAO,UAAS,QAAO,QAAO,SAAQ,SAAQ,OAAM,OAAM,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpJ,eAAe,EAAC,SAAU,0CAAyC,eAAgB,oCAAmC,MAAO,SAAQ;AAAA,IACrI,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,aAAY,mBAAkB,sBAAqB,WAAU,QAAQ,GAAE,MAAO,SAAQ;AAAA,IAC/H,aAAa,EAAC,SAAU,6BAA4B,eAAgB,uBAAsB,MAAO,SAAQ;AAAA,IACzG,QAAU,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,SAAW,EAAC,QAAS,kBAAiB,WAAY,KAAI,MAAO,SAAQ;AAAA,IACrE,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAClD,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IACjD,WAAa,EAAC,SAAU,OAAM,SAAU,sEAAqE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,IAC3M,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACrD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,SAAW,EAAC,SAAU,qBAAoB,SAAU,uEAAsE,eAAgB,iEAAgE,MAAO,SAAQ;AAAA,IACzN,MAAQ,EAAC,QAAS,YAAW,SAAU,WAAU,SAAU,KAAI,UAAW,MAAK,MAAO,UAAS;AAAA,IAC/F,gBAAkB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC5D,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,EACzD;AAAA,EACA,4CAA4C;AAAA,IAC1C,UAAY,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAClD,WAAW,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACvD,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpD,SAAW,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACxC,MAAQ,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtE,MAAQ,EAAC,QAAS,eAAc,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,SAAU,oCAAmC,eAAgB,8BAA6B,MAAO,SAAQ;AAAA,IACjJ,OAAS,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,YAAY,GAAE,MAAO,SAAQ;AAAA,IACzE,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,KAAO,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAClD,UAAY,EAAC,SAAU,KAAI,SAAU,KAAI,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,cAAc,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,SAAU,oBAAmB,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IACxF,WAAa,EAAC,MAAO,CAAC,OAAM,KAAI,MAAM,GAAE,MAAO,SAAQ;AAAA,IACvD,aAAa,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACzD,eAAe,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,MAAO,CAAC,MAAK,SAAQ,MAAK,SAAQ,SAAQ,MAAK,MAAK,MAAK,SAAQ,SAAQ,SAAQ,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,SAAQ,MAAK,MAAK,IAAI,GAAE,MAAO,SAAQ;AAAA,IACvL,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAQ,UAAS,WAAU,YAAW,YAAW,mBAAkB,cAAa,WAAW,GAAE,MAAO,SAAQ;AAAA,IACtI,kBAAoB,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,SAAQ;AAAA,IAChE,eAAiB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5D,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,YAAc,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACtD,QAAU,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,OAAM,OAAM,QAAO,QAAO,UAAS,QAAO,QAAO,SAAQ,SAAQ,OAAM,OAAM,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpJ,eAAe,EAAC,SAAU,0CAAyC,eAAgB,oCAAmC,MAAO,SAAQ;AAAA,IACrI,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,aAAY,mBAAkB,sBAAqB,WAAU,QAAQ,GAAE,MAAO,SAAQ;AAAA,IAC/H,aAAa,EAAC,SAAU,6BAA4B,eAAgB,uBAAsB,MAAO,SAAQ;AAAA,IACzG,QAAU,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,SAAW,EAAC,QAAS,kBAAiB,WAAY,KAAI,MAAO,SAAQ;AAAA,IACrE,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAClD,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IACjD,WAAa,EAAC,SAAU,OAAM,SAAU,sEAAqE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,IAC3M,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,SAAW,EAAC,SAAU,qBAAoB,SAAU,uEAAsE,eAAgB,iEAAgE,MAAO,SAAQ;AAAA,IACzN,gBAAkB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC5D,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,EACzD;AACF;;;ACtGO,IAAM,wBAAuE;AAAA,EAClF,mBAAmB;AAAA,IACjB,QAAU,EAAC,QAAS,cAAa,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,2BAA2B;AAAA,IACzB,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,KAAO,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EAClD;AACF;;;ACRO,IAAM,0BAAyE;AAAA,EACpF,qBAAqB;AAAA,IACnB,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjD,WAAa,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IAClE,SAAW,EAAC,QAAS,4BAA2B,MAAO,SAAQ;AAAA,IAC/D,gBAAgB,EAAC,QAAS,yBAAwB,MAAO,SAAQ;AAAA,IACjE,QAAU,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1C,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,aAAe,EAAC,SAAU,6CAA4C,eAAgB,uCAAsC,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,MAAO,CAAC,OAAM,SAAQ,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IACjE,WAAW,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACnD,yBAAyB,EAAC,SAAU,4EAA2E,SAAU,IAAG,MAAO,UAAS;AAAA,IAC5I,SAAW,EAAC,QAAS,+BAA8B,MAAO,SAAQ;AAAA,IAClE,YAAc,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IAC1D,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC5C,MAAQ,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACpD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,QAAU,EAAC,QAAS,0BAAyB,MAAO,SAAQ;AAAA,IAC5D,eAAiB,EAAC,SAAU,YAAW,MAAO,CAAC,OAAM,YAAW,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IAChG,iBAAiB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAC1D,uBAAuB,EAAC,SAAU,MAAK,MAAO,CAAC,KAAI,KAAI,KAAI,KAAI,MAAK,IAAI,GAAE,MAAO,UAAS;AAAA,IAC1F,QAAU,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IACxD,YAAc,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,OAAM,OAAM,KAAI,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClG,SAAW,EAAC,QAAS,kBAAiB,UAAW,MAAK,MAAO,SAAQ;AAAA,IACrE,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,UAAY,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IAC1D,MAAQ,EAAC,MAAO,CAAC,SAAQ,UAAS,QAAO,OAAM,QAAO,SAAQ,eAAc,OAAM,WAAU,OAAM,OAAM,OAAM,OAAM,SAAS,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9J,QAAU,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IACxD,iBAAiB,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,EAC/D;AAAA,EACA,8BAA8B;AAAA,IAC5B,WAAa,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IAClE,SAAW,EAAC,QAAS,4BAA2B,MAAO,SAAQ;AAAA,IAC/D,gBAAgB,EAAC,QAAS,yBAAwB,MAAO,SAAQ;AAAA,IACjE,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1C,aAAe,EAAC,SAAU,6CAA4C,eAAgB,uCAAsC,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,MAAO,CAAC,OAAM,SAAQ,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IACjE,WAAW,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACnD,yBAAyB,EAAC,SAAU,4EAA2E,SAAU,IAAG,MAAO,UAAS;AAAA,IAC5I,SAAW,EAAC,QAAS,+BAA8B,MAAO,SAAQ;AAAA,IAClE,YAAc,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IAC1D,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC5C,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,eAAiB,EAAC,SAAU,YAAW,MAAO,CAAC,OAAM,YAAW,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IAChG,iBAAiB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAC1D,uBAAuB,EAAC,SAAU,MAAK,MAAO,CAAC,KAAI,KAAI,KAAI,KAAI,MAAK,IAAI,GAAE,MAAO,UAAS;AAAA,IAC1F,QAAU,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IACxD,YAAc,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,OAAM,OAAM,KAAI,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClG,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,iBAAiB,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,EAC/D;AACF;;;ACzDO,IAAM,yBAAwE;AAAA,EACnF,8BAA8B;AAAA,IAC5B,kBAAkB,EAAC,SAAU,iDAAgD,eAAgB,mDAAkD,MAAO,SAAQ;AAAA,IAC9J,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,qBAAqB,EAAC,SAAU,uBAAsB,MAAO,CAAC,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IACtH,eAAe,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,qEAAoE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,IACzN,MAAQ,EAAC,WAAY,MAAK,WAAY,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EACzE;AAAA,EACA,qDAAqD;AAAA,IACnD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IAC9I,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,EACjF;AAAA,EACA,iDAAiD;AAAA,IAC/C,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,gBAAgB,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IAC9I,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IAC/E,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,QAAU,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC5C;AAAA,EACA,oDAAoD;AAAA,IAClD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IACvF,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IAC/E,KAAO,EAAC,SAAU,mmHAAsmH,eAAgB,qmHAAwmH,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjxO;AAAA,EACA,2CAA2C;AAAA,IACzC,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IAC/E,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,EAC5K;AAAA,EACA,0BAA0B;AAAA,IACxB,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,IAAM,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3K,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,UAAY,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAChL;AAAA,EACA,yBAAyB;AAAA,IACvB,yBAAyB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,IAClL,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,aAAa,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IAC1D,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,IAAM,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3K,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,2KAA0K,eAAgB,+JAA8J,MAAO,SAAQ;AAAA,IACxZ,WAAW,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACxD,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC/J,aAAa,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IACrP,gBAAgB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACrL,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC1E,iBAAiB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC9C,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AAAA,EACA,2BAA2B;AAAA,IACzB,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,IAAM,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3K,aAAa,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACpE,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,kBAAkB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC/C,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AAAA,EACA,oCAAoC;AAAA,IAClC,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,eAAc,iBAAgB,kBAAiB,aAAY,eAAc,cAAa,eAAc,gBAAe,eAAc,cAAa,eAAc,UAAS,qBAAoB,UAAS,oBAAmB,2BAA0B,wBAAwB,GAAE,MAAO,QAAO;AAAA,IAChU,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,qBAAqB,EAAC,SAAU,uBAAsB,MAAO,CAAC,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IACtH,eAAe,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,qEAAoE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,EAC3N;AAAA,EACA,2DAA2D;AAAA,IACzD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,UAAS,WAAU,WAAU,gBAAe,UAAS,aAAa,GAAE,MAAO,QAAO;AAAA,IACjH,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,EAChJ;AAAA,EACA,uDAAuD;AAAA,IACrD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,UAAS,WAAU,WAAU,UAAS,eAAc,YAAW,QAAO,UAAU,GAAE,MAAO,QAAO;AAAA,IAC/H,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IAC9I,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,EACvD;AAAA,EACA,0DAA0D;AAAA,IACxD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,WAAU,UAAS,QAAO,QAAQ,GAAE,MAAO,QAAO;AAAA,IAC3F,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,QAAU,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IACvE,KAAO,EAAC,SAAU,mmHAAsmH,eAAgB,qmHAAwmH,MAAO,SAAQ;AAAA,EACjwO;AAAA,EACA,iDAAiD;AAAA,IAC/C,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,WAAU,gBAAe,kBAAiB,eAAc,kBAAiB,QAAO,QAAQ,GAAE,MAAO,QAAO;AAAA,IACjJ,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,EAC5K;AAAA,EACA,8BAA8B;AAAA,IAC5B,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,WAAU,MAAK,aAAY,aAAY,eAAc,cAAa,eAAc,gBAAe,aAAa,GAAE,MAAO,QAAO;AAAA,IACrK,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,EAChK;AAAA,EACA,6BAA6B;AAAA,IAC3B,yBAAyB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,IAClL,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,aAAa,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IAC1D,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,UAAS,SAAQ,WAAU,YAAW,mBAAkB,gBAAe,WAAU,YAAW,YAAW,aAAY,MAAK,aAAY,aAAY,iBAAgB,kBAAiB,iBAAgB,gBAAe,mBAAkB,kBAAiB,kBAAiB,yBAAwB,gBAAgB,GAAE,MAAO,QAAO;AAAA,IAC3V,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,2KAA0K,eAAgB,+JAA8J,MAAO,SAAQ;AAAA,IACxZ,WAAW,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACxD,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC/J,aAAa,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IACrP,gBAAgB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IACrK,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9J,kBAAkB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC1E,iBAAiB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC9C,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AAAA,EACA,+BAA+B;AAAA,IAC7B,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,mBAAkB,WAAU,YAAW,kBAAiB,MAAK,aAAY,gBAAe,gBAAgB,GAAE,MAAO,QAAO;AAAA,IACvJ,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,aAAa,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACpE,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,kBAAkB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC/C,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9J,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AACF;;;AC9KO,IAAM,sBAAqE;AAAA,KAC7E;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AACL;;;AnB3BO,IAAM,iBAAiB,CAAC,QAA0C;AAAA,EACvE,MAAM,QAAQ,oBAAoB;AAAA,EAClC,IAAI,UAAU,WAAW;AAAA,IACvB,MAAM,IAAI,MACR,mCAAmC,0DACjC,2DACJ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,iBAAiB,CAC5B,KACA,MACA,aACsB,WAAW,eAAe,GAAG,GAAG,MAAM,EAAE,SAAS,CAAC;AAQnE,IAAM,YAAY,CACvB,KACA,MACA,aAEO,eAAQ,MAAM;AAAA,EACnB,IAAI,QAAQ;AAAA,IAAW,OAAc;AAAA,EACrC,MAAM,QAAQ,eAAe,KAAK,MAAM,QAAQ;AAAA,EAChD,OAAO,MAAM,WAAW,IAAW,cAAc,WAAI,IAAI,MAAM,QAAQ,KAAK,KAAK,CAAC,CAAC;AAAA,CACpF;;;AoBzCI,IAAM,YAAY,CAAC,QAAgB,IAAI,IAAI,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG;AAGrF,IAAM,gBAAgB,EAAE,OAAO,UAAU,OAAO,UAAU,MAAM,QAAQ;AAGxE,IAAM,WAAW;AAGV,IAAM,QAAQ,CAAC,WAAiD;AAAA,EACrE,MAAM,UAAU,MAAM,IAAI;AAAA,EAC1B,OAAO,MAAM;AAAA,GACZ,cAAc,MAAM,QAAQ,MAAM;AACrC;AAGO,IAAM,OAAO,CAAC,WAAiD;AAAA,KACjE,MAAM,KAAK;AAAA,EACd,WAAW,MAAM,cAAc,QAAQ,MAAM;AAC/C;AAGA,IAAM,SAAS,CAAC,SACd,OAAO,YAAY,OAAO,QAAQ,IAAI,EAAE,OAAO,CAAC,MAA6B,EAAE,OAAO,SAAS,CAAC;AAQ3F,IAAM,aAAa,CAAC,UAAoB,UAAU,UAAU,OAAO,KAAK,KAAK,CAAC,GAAG,IAAI;AAGrF,IAAM,WAAW,CAAC,UACvB,CAAC,UAAU,MAAM,IAAI,GAAG,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,EAAE,KAAK,GAAG;AAExE,IAAM,OAAO,CAAC,MAAuD,UACnE,KAAK,KACH,CAAC,QACC,IAAI,SAAS,UAAU,MAAM,IAAI,KACjC,IAAI,SAAS,MAAM,QACnB,IAAI,SAAS,MAAM,QACnB,IAAI,WAAW,MAAM,MACzB;AAMF,IAAM,aAAa,CAAC,QAA8C;AAAA,EAChE,MAAM,QAAQ,IAAI;AAAA,EAClB,OAAO,UAAU,aAAa,UAAU,KAAK,UAAU,QAAQ,UAAU;AAAA;AAGpE,IAAM,eAAe,CAC1B,MACA,UACkB;AAAA,EAClB,MAAM,MAAM,KAAK,MAAM,KAAK;AAAA,EAC5B,OAAO;AAAA,IACL,OAAO,QAAQ;AAAA,IACf,MAAM,UAAU,MAAM,IAAI;AAAA,IAC1B,WAAW,QAAQ,aAAa,WAAW,GAAG;AAAA,IAC9C,QAAQ,MAAM;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,EACd;AAAA;AAGK,IAAM,UAAU,CAAC,YAA2B,UACjD,WAAW,SAAS,WAAW,eAAe,MAAM,cAAc;;;AC5BpE;AACA;AAEA,wBAAS;AAET;;;ACdA;AACA;AACA;AACA;;;ACvCA;AACA;AACA;AACA;AACA;AACA;;;ACVA;AAAA;AAiBO,MAAM,4BAAiC,iBAAY,qBAAqB,EAI5E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,mBAAmB,KAAK,eAAe,KAAK,gBAAgB,KAAK,6BACjE;AAAA;AAGN;;;ADbA,IAAM,cAAc,CAAC,KAAqB,SACxC,IAAI,OAAO,WAAW,IAAI,SAAS,WAAW;AA0BzC,IAAM,OAAO,CAAC,QAAmB,MAAe,MAAsB,QAAQ,QAC5E,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,GAAG,OAAO,eAAe;AAAA,EAGtC,MAAM,SAAS,CAAC,SAAgB,WAC9B,IAAI,MAAM,mBAAmB,WAAW,YAAW,IAAI,gBAAgB,YAAW,QAAQ;AAAA,EAC5F,MAAM,UACJ,YAAY,KAAK,YAAY,KAAK,YAAY,KAAK,MAAM,KAAK;AAAA,EAChE,MAAM,SAAS,QAAQ,WAAW,SAAS,IAAI,QAAQ,MAAM,UAAU,MAAM,IAAI;AAAA,EACjF,MAAM,OAAO,WAAW,YAAY,QAAQ,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAClE,MAAM,UAAkC,EAAE,mBAAmB,OAAO;AAAA,EACpE,MAAM,YAAY,YAAY,KAAK,WAAW;AAAA,EAC9C,IAAI,cAAc;AAAA,IAAI,QAAQ,uBAAuB;AAAA,EACrD,MAAM,QAAQ,YAAY,KAAK,OAAO;AAAA,EACtC,IAAI,UAAU;AAAA,IAAI,QAAQ,mBAAmB;AAAA,EAC7C,IAAI,WAAW,aAAa,EAAE,SAAS,aAAa;AAAA,IAClD,OAAO,OAAc,aAAK,OAAO,GAAG,oDAAoD,CAAC;AAAA,EAC3F;AAAA,EAEA,MAAM,SAAS,OAAkB;AAAA,EAGjC,MAAM,WAAW,OAAe;AAAA,EAChC,MAAM,WAAkB,iBACtB,OAAc,sBAA8B,2BAAW,GACvD,OAAO,CAAC,EACV;AAAA,EACA,MAAM,UAA4B,sBAAI,GAAG,WAAW,MAAM,EAAE,KACxC,6BAAW,OAAO,CACtC;AAAA,EACA,MAAM,WAAW,OAAO,QAAQ,OAAO,EAAE,KAChC,gBAAQ,CAAC,aACP,YAAI,SAAS,MAAM,CAAC,WAAU,EAAE,QAAQ,SAAS,QAAQ,YAAK,EAAE,CACzE,GAEO,gBAAQ,YAAY,GACpB,uBAAuB,8BAAsB,CAAC,GAAG,UAAU,eAAe,CAAC,CACpF;AAAA,EAKA,MAAM,OAAoD,KAAK,UAAU,MAAM,OAAO;AAAA,EACtF,QAAQ,QAAQ,SAAS,QACvB,WAAW,YACP,WACO,uBAAe,UAA0B,6BAAa,IAAI,GACrE,KAEO,iBAAS,CAAC,UAAU,OAAO,GAAG,MAAM,OAAO,CAAC,CACrD;AAAA,EAEA,IAAI;AAAA,EAOJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,IAAI;AAAA,IACxB,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,EAEX,IAAI,SAAS,OAAO,UAAU,KAAK;AAAA,IACjC,MAAM,SAAS,QAAQ;AAAA,IACvB,MAAM,gBAAgB,MAAM,QAAQ,MAAM;AAAA,IAC1C,MAAM,SAAS,gBAAgB,OAAO,IAAI,MAAM,EAAE,KAAK,IAAI,IAAI;AAAA,IAY/D,IAAI,WAAW,OAAO,eAAe;AAAA,MACnC,OAAO,OAAc,aAAK,IAAI,oBAAoB,EAAE,QAAQ,OAAO,OAAO,OAAO,KAAK,CAAC,CAAC;AAAA,IAC1F;AAAA,IACA,OAAO,OAAc,aAAK,OAAO,QAAQ,UAAU,mBAAmB,CAAC;AAAA,EACzE;AAAA,EACA,MAAM,UAAU,QAAQ,MAAM;AAAA,EAC9B,MAAM,SAAS,QAAQ,MAAM;AAAA,EAC7B,IAAI,OAAO,YAAY,YAAY,OAAO,WAAW,UAAU;AAAA,IAE7D,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,eAAe,iEACvB,kCAAkC,OAAO,gDACzC,kFACJ,CACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,QAAQ;AAAA,EACtB,MAAM,eAAe,OAAO,UAAU,WAAW,QAAQ;AAAA,EACzD,OAAO,EAAE,cAAc,QAAQ,QAAQ;AAAA,CACxC;AAQI,IAAM,gBAAgB,CAAC,YAA2B,WACvD,OAAO,WAAW,QACd,eAAe,WAAW,WAAW,WAAW,WAChD,eAAe,WAAW,WAAW,WAAW;;;AD9FtD,IAAM,wBAAwB;AAmB9B,IAAM,QAAQ,CAAC,QAAmB,UAA6B;AAAA,EAC7D,OAAO,OAAO;AAAA,EACd;AAAA,EACA,QAAQ,OAAO;AACjB;AAWO,IAAM,aAAa,CAAC,SACpB,eAAU,IAAI,KAAK,KAAK,MAAM,eAAe,wBACrC,iBAAQ,KAAK,MAAM,eAAe,qBAAqB,IACvD;AAcR,IAAM,aAAa,CAAO,YACzB,eAAS,SAAS,EAAE,UAAU,IAAI,mBAAmB,UAAU,WAAW,CAAC;AAEnF,IAAM,eAAe,CAAC,QACpB,IAAI,WAAW,QACX,EAAE,KAAK,iCAAiC,OAAO,IAAI,OAAO,QAAQ,MAAM,IACxE,EAAE,SAAS,CAAC,GAAG,OAAO,IAAI,OAAO,QAAQ,MAAM;AAErD,IAAM,SAAgB,gBAAQ,WAAW,CAAC,QAAQ,KAAK,aAAa,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAS7E,IAAM,SAAS,CAAC,QAAmB,SAAwB,UAAI,QAAQ,MAAM,QAAQ,IAAI,CAAC;;;AG3HjG;AAEA;AACA;AACA;AACA;AAKO,IAAM,eAAe;AAGrB,IAAM,aAAa,CAAC,WAAmB,WAAW,UAAU,OAAO,YAAY;AAgB/E,IAAM,iBAAiC;AAG9C,IAAM,kBAAkB,IAAI;AAKrB,IAAM,iBAAiB,CAAC,QAAmB,WAAmB;AAAA,EACnE,gBAAgB,IAAI,OAAO,OAAO,MAAM;AAAA;AAInC,IAAM,iBAAiB,CAAC,WAAyC;AAAA,EACtE,MAAM,YAAY,gBAAgB,IAAI,OAAO,KAAK;AAAA,EAClD,IAAI,cAAc,aAAa,CAAC,OAAO,QAAQ,SAAS,SAAS;AAAA,IAAG,OAAO,OAAO;AAAA,EAClF,OAAO,CAAC,WAAW,GAAG,OAAO,QAAQ,OAAO,CAAC,WAAW,WAAW,SAAS,CAAC;AAAA;AAG/E,IAAM,YAAY,CAAC,UAAuC;AAAA,EACxD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,IAAI,UAAU,SAAS,OAAO,MAAM,SAAS;AAAA,MAAU,OAAO,MAAM;AAAA,IACpE,IAAI,WAAW;AAAA,MAAO,OAAO,UAAW,MAA6B,KAAK;AAAA,EAC5E;AAAA,EACA;AAAA;AAGF,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,IAAI,SAAS,gBAAgB,SAAS,eAAe,SAAS,2BAA2B;AAAA,IACvF,OAAO;AAAA,EACT;AAAA,EACA,OAAO,iBAAiB,SAAS,qBAAqB,KAAK,MAAM,OAAO;AAAA;AAkB1E,IAAM,iBAAiB,IAAI,IAAI,CAAC,qBAAqB,gBAAgB,aAAa,WAAW,CAAC;AAE9F,IAAM,oBAAoB,CAAC,SACzB,mFAAmF,KAAK,IAAI;AAE9F,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,OAAO,SAAS,cAAc,eAAe,IAAI,IAAI,KAAK,kBAAkB,IAAI;AAAA;AAW3E,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAU,qBAAe,KAAK;AAAA,IAAG,OAAO;AAAA,EACxC,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,MAAM,MAAM,MAAM,OAAO;AAAA,EACzB,OAAO,QAAQ,oBAAoB,QAAQ,qBAAqB,QAAQ;AAAA;AASnE,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,QAAQ,WAAW;AAAA,EACnB,IAAI,OAAO,SAAS,qBAAqB,OAAO,SAAS;AAAA,IAAe,OAAO;AAAA,EAC/E,IAAI,OAAO,SAAS,kBAAkB;AAAA,IACpC,IAAI,eAAe,OAAO,KAAK;AAAA,MAAG,OAAO;AAAA,IACzC,OAAO,eAAe,OAAO,KAAK;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,oBAAoB,CAAC,UAA2B;AAAA,EAC3D,IAAU,qBAAe,KAAK;AAAA,IAAG,OAAO,mBAAmB,OAAO,cAAc;AAAA,EAChF,IAAoB,kCAAkB,KAAK;AAAA,IAAG,OAAO,MAAM;AAAA,EAC3D,OAAO,OAAO,KAAK;AAAA;AAwBd,IAAM,mBAAmB,CAC9B,QACA,QACA,MACA,OACA,WAA0B,mBAWnB,YAAI,UAAU,GAAG;AAAA,EActB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,UAAU,WAAW;AAAA,EAC3B,MAAM,WAA4B,CAAC;AAAA,EACnC,WAAW,UAAU,eAAe,MAAM,GAAG;AAAA,IAC3C,MAAM,UAAU,OAAO,OACpB,QAAQ,MAAM,WAAW,MAAM,CAAC,CAAC,EACjC,KAAY,gBAAQ,QAAO,GAAU,cAAM;AAAA,IAC9C,IAAW,iBAAU,OAAO,GAAG;AAAA,MAC7B,eAAe,QAAQ,MAAM;AAAA,MAC7B,OAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,MAAM,kBAAkB,QAAQ,OAAO;AAAA,IAC7C,SAAS,KAAK,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,MAAM,WAAW,UACb,mBAAmB,QAAQ,OAAO,IAClC,mBAAmB,QAAQ,OAAO;AAAA,IACtC,IAAI,CAAC,UAAU;AAAA,MACb,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,IAC/E;AAAA,EACF;AAAA,EACA,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,CAC9E;;;AJpII,MAAM,4BAA4B,MAAM;AAAA,EACxB;AAAA,EAArB,WAAW,CAAU,UAAoC;AAAA,IACvD,MAAM,uBAAuB,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG;AAAA,IADpE;AAAA,IAEnB,KAAK,OAAO;AAAA;AAEhB;AAeO,IAAM,aAAa,CACxB,QACA,YACA,SACA,IACA,WAA0B,mBAEnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAA4B,CAAC;AAAA,EACnC,WAAW,UAAU,eAAe,MAAM,GAAG;AAAA,IAC3C,MAAM,YAAY,wBAAwB;AAAA,MACxC,SAAS,WAAW,MAAM;AAAA,MAC1B,QAAQ,WAAW;AAAA,MACnB,SAAS,WAAW;AAAA,IACtB,CAAC;AAAA,IACD,MAAM,UAAU,OAAO,GAAG,KACX,mBACN,gBAAQ,SAAS,GACjB,gBAAQ,QAAO,GACf,cACT;AAAA,IACA,IAAW,kBAAU,OAAO,GAAG;AAAA,MAC7B,eAAe,QAAQ,MAAM;AAAA,MAC7B,OAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,WAAW,UACb,mBAAmB,QAAQ,OAAO,IAClC,mBAAmB,QAAQ,OAAO;AAAA,IACtC,IAAI,CAAC;AAAA,MAAU,OAAO,OAAc,aAAK,QAAQ,OAAO;AAAA,IACxD,SAAS,KAAK,EAAE,QAAQ,KAAK,kBAAkB,QAAQ,OAAO,EAAE,CAAC;AAAA,EACnE;AAAA,EACA,OAAO,OAAc,aAAK,IAAI,oBAAoB,QAAQ,CAAC;AAAA,CAC5D;AAiBI,IAAM,SAAS,CACpB,QACA,MACA,SACA,OAMO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,WAAW,QAAQ,YAAY,SAAS,EAAE;AAAA,CACzD;;;AKpIH;AAIO,IAAM,aAAa,OAAO,gBAAgB;AAc1C,IAAM,mBAAmB,CAC9B,WAEA,OAAO,KAAY,iBAAS,uBAAuB,MAAa,gBAAQ,UAAU,CAAC,CAAC;AAQ/E,IAAM,oBAAoB,CAAC,MAAc,cACvC,mBACL,GAAG,QAAQ,8EACT,2FACA,qDACJ;;;A3BsCK,IAAM,aAAa,SAAqB,aAAa;AAgB5D,IAAM,iBAAiB,CAAC,UACtB,iBAAiB,OAAO,MAAM,QAAQ,aAAa,OAAc,qBAAc,CAAC,CAAC,CAAC,CAAC,EAAE,KAC5E,YAAI,CAAC,SAAU,SAAS,aAAa,aAAa,aAAa,MAAM,KAAK,CAAE,CACrF;AAGF,IAAM,iBAAiB,CAAC,SACtB,SAAS,aAAa,YAAY;AAE7B,IAAM,qBAAqB,MACvB,gBACP,YACO,gBACL,WAAW,SAAS,GAAG;AAAA,EAErB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,WAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,GAClD;AAAA,EAQD,MAAa,WAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,WAAW,aAAa,WAAW,IAAI,KAAK,SAAS,IAAI,MAAM,SAAS,MAAM,GAAG;AAAA,MACnF,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,IAAI,CAAC,WAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,WAAW,IAAI;AAAA,IACtB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IAGvC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,eAAe,SAAS,IAAI,CAAC;AAAA,MACtD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,OAAO,SAAS,aAAa,QAAQ,MAAM,IAAI,IAC1C,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAOD,WAAkB,WAAG,UAAU,GAAG,QAAQ;AAAA,IAIxC,MAAM,SAAS,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,IACzD,OAAO,WAAW,IAAI;AAAA,IACtB,IAAI,WAAW,aAAa,CAAC,QAAQ,QAAQ,IAAI,GAAG;AAAA,MAClD,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,oBAAa,KAAK,IAAI,CAAC,CAAC;AAAA,IAC/E;AAAA,IACA,MAAM,QAAQ,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,IACxD,IAAI,UAAU,aAAa,CAAC,MAAM,OAAO;AAAA,MACvC,OAAO,OAAc,YACnB,IAAI,MACF,+CAA+C,SAAS,IAAI,oBAC1D,8EACA,kFACA,qDACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EASD,QAAe,WAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,MAAM,UAAsC,KAAK,MAAM,IAAI,GAAG,QAAQ,IAAI;AAAA,IAC1E,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,oBAAa,OAAO,CAAC;AAAA,GAC3E;AACH,CAAC,CACH,CACF;;A4BzJF,IAAM,UAAU,CAAC,OAAe,UAA0B;AAAA,EACxD,IAAI,SAAS,KAAK,KAAK,KAAK,UAAU,IAAI;AAAA,IACxC,MAAM,IAAI,MACR,0BAA0B,sDAC5B;AAAA,EACF;AAAA,EACA,OAAO,KAAK,UAAU,KAAK;AAAA;AAQ7B,IAAM,cAAc,CAAC,UAA0B;AAAA,EAC7C,MAAM,OAAO,QAAQ,gBAAgB,KAAK;AAAA,EAC1C,IAAI,WAAW;AAAA,EACf,IAAI;AAAA,IACF,WAAW,IAAI,IAAI,KAAK,EAAE;AAAA,IAC1B,MAAM;AAAA,EAGR,IAAI,aAAa,YAAY,aAAa,SAAS;AAAA,IACjD,MAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAAA,EACA,OAAO;AAAA;AAIT,IAAM,eAAqE;AAAA,EACzE,CAAC,YAAY,MAAM;AAAA,EACnB,CAAC,UAAU,QAAQ;AAAA,EACnB,CAAC,aAAa,WAAW;AAAA,EACzB,CAAC,YAAY,UAAU;AACzB;AAeO,IAAM,wBAAwB,CAAC,UAAmC,CAAC,MAAc;AAAA,EACtF,MAAM,YAAY,QAAQ,aAAa,QAAQ,aAAa,iBAAiB;AAAA,EAC7E,MAAM,SAAS,QAAQ,UAAU,QAAQ,UAAU,KAAK;AAAA,EACxD,MAAM,SAAS,aAAa,IAC1B,EAAE,OAAO,WACP,sBAAsB,WAAW,0BAA0B,kBAC/D;AAAA,EACA,MAAM,OACJ,QAAQ,iBAAiB,YACrB,KACA;AAAA,sBAA0B,YAAY,QAAQ,YAAY;AAAA,EAChE,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA,sBAAsB;AAAA,IACtB,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AAAA,CAAI;AAAA;;AC3Eb,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AC7BO,IAAM,MAAM,CAAC,OAAgB,aAClC,OAAO,UAAU,WAAW,QAAQ;AAE/B,IAAM,OAAO,CAAC,OAAgB,WAAW,OAC9C,OAAO,UAAU,WAAW,QAAQ;AA2B/B,IAAM,OAAO,CAAC,OAAgB,WAAW,UAC9C,UAAU,aAAa,UAAU,QAAQ,UAAU,KAC/C,WACA,UAAU,KAAK,UAAU,QAAQ,UAAU;AAS1C,IAAM,OAAO,CAAC,UAAqB,UAAU,YAAY,YAAY,QAAQ,MAAM;AAUnF,IAAM,MAAM,CAAC,WACjB,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,IAAK,SAAS,CAAC,GACxD,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAYN,IAAM,YAAY,CAAC,UAA2B;AAAA,EACnD,MAAM,QACJ,OAAO,UAAU,WACb,MAAM,MAAM,GAAG,IACf,MAAM,QAAQ,KAAK,IACjB,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IAC3C,CAAC;AAAA,EACT,OAAO,MACJ,IAAI,CAAC,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,EACjC,OAAO,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,EAClC,KAAK,CAAC,MAAM,UAAU,OAAO,KAAK,EAClC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,EACtB,KAAK,GAAG;AAAA;AAIN,IAAM,iBAAiB,CAAC,QAAgB;AAAA,EAC7C,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAAA,EACvC,IAAI,CAAC,KAAK,OAAO,QAAQ,IAAI,EAAE,SAAS,OAAO;AAAA,IAAG,OAAO;AAAA,EACzD,IAAI,CAAC,KAAK,MAAM,SAAS,KAAK,EAAE,SAAS,OAAO;AAAA,IAAG,OAAO;AAAA,EAC1D,OAAO;AAAA;AAmBF,IAAM,iBAAiB,CAAC,OAAgB,eAAgC;AAAA,EAC7E,MAAM,QACJ,OAAO,UAAU,WACb,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS;AAAA,IAC7B,OAAO,QAAQ,QAAQ,KAAK,MAAM,GAAG;AAAA,IACrC,OAAO,KAAK,WAAW,KAAK,eAAe,YACvC,CAAC,YAAY,OAAO,EAAE,IACtB,CAAC,OAAO,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,GAC/B,IACD,OAAO,UAAU,YAAY,UAAU,OACrC,OAAO,QAAQ,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC,IAChE,CAAC;AAAA,EACT,OAAO,MACJ,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,KAAK,GAAG,eAAe,KAAK,CAAC,CAAU,EAClE,OAAO,EAAE,SAAS,QAAQ,EAAE,EAC5B,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,EACvC,KAAK,EACL,KAAK,GAAG;AAAA;AAWN,IAAM,MAAM,CAAC,OAAgB,aAAqB;AAAA,EACvD,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,SAAS,OAAO,SAAS,KAAK,KAAK,GAAG,EAAE;AAAA,EAC9C,OAAO,OAAO,MAAM,MAAM,IAAI,WAAW;AAAA;AA6BpC,IAAM,aAAa,CACxB,QACA,UAC2B;AAAA,EAC3B,MAAM,UAAU,IAAI,IAAI,KAAK;AAAA,EAC7B,MAAM,OAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;AAAA,IACjD,IAAI,UAAU,aAAa,CAAC,QAAQ,IAAI,GAAG;AAAA,MAAG,KAAK,OAAO;AAAA,EAC5D;AAAA,EACA,OAAO,QAAQ,SAAS,IAAI,OAAO,KAAK,MAAM,QAAQ,CAAC,GAAG,OAAO,EAAE,KAAK,GAAG,EAAE;AAAA;;;AC/KxE,IAAM,mBAAmB;AAczB,IAAM,cAAc,CAAC,UAAyB,GAAG,MAAM,UAAU,MAAM;AAgBvE,IAAM,QAAQ,CAAC,WAA4D;AAAA,EAChF,SAAS,MAAM,WAAW;AAAA,EAC1B,QAAQ,OAAO,MAAM,MAAM;AAAA,EAC3B,SAAS,MAAM,UAAU,MAAM;AAAA,EAC/B,SAAS,MAAM;AAAA,EACf,QAAQ,MAAM;AAChB;AAaO,IAAM,gBAAe,CAC1B,MACA,UACmC;AAAA,EACnC,IAAI,KAAK,WAAW,aAAa,KAAK,YAAY;AAAA,IAAW;AAAA,EAC7D,OAAO;AAAA,IACL,SAAS,KAAK,KAAK,OAAO;AAAA,IAC1B,QAAQ,IAAI,KAAK,QAAQ,CAAC;AAAA,IAC1B,aAAa,YAAY,KAAK;AAAA,IAG9B,SAAS,KAAK,KAAK,SAAS,IAAI;AAAA,IAChC,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,EAChB;AAAA;AAQK,IAAM,WAAU,CAAC,YAAgC,UACtD,WAAW,aAAa,MAAM,WAAW,OACzC,WAAW,WAAW,MAAM,UAC5B,WAAW,YAAY,MAAM;;;AC3ExB,IAAM,UAAS,CAAC,SACrB,OAAO,YACL,OAAO,QAAQ,IAA+B,EAAE,OAC9C,CAAC,MAA6B,OAAO,EAAE,OAAO,QAChD,CACF;AAOK,IAAM,cAAa,CACxB,UACA,MACA,aACwB,UAAU,UAAU,QAAO,IAAI,GAAG,QAAQ;;;AHkG7D,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAYD,IAAM,YAAY,CAAC,UAAyB;AAAA,EAC1C,MAAM,QAAQ,EAAE,SAAS,MAAM,SAAS,QAAQ,MAAM,OAAO;AAAA,EAC7D,OAAO,iBACL,OAAO,MAAM,QAAQ,aAAa,OAAc,2BAAmB,KAAK,CAAC,CAC3E,EAAE,KAAY,YAAI,CAAC,SAAU,SAAS,aAAa,aAAa,cAAa,MAAM,KAAK,CAAE,CAAC;AAAA;AAI7F,IAAM,kBAAiB,CAAC,SACtB,SAAS,aAAa,YAAY;AAQ7B,IAAM,0BAA0B,MAC5B,iBACP,iBACO,gBACL,gBAAgB,SAAS,GAAG;AAAA,EAM1B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,WAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,GAC7C;AAAA,EACD,MAAa,WAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,kBAAkB,MAAM,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,UAAU,IAAI;AAAA,IAGlC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,oBAAoB,GAAG,KAAK,UAAU,KAAK,SAAS;AAAA,MAC7E,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IAKA,OAAO,SAAS,aAAa,SAAQ,MAAM,IAAI,IAC1C,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,WAAG,UAAU,GAAG,QAAQ;AAAA,IAMxC,MAAM,SAAS,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACpD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,UAAU,KAAK,4DACrB,kFACA,6EACA,kFACA,oFACA,uBACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO,YAAW,kBAAkB,MAAM,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MAC1B,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,2BAAmB,MAAM,IAAI,CAAC,CAAC;AAAA,IACtF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACnD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,UAAU,KAAK,2DACrB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAe,WAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,8BAAsB,EAAE,SAAS,KAAK,SAAS,QAAQ,KAAK,OAAO,CAAC,CAC7E;AAAA,GACD;AACH,CAAC,CACH,CACF;;AIzNF,qBAAS;AACT;AACA;;;ACrBA,uBAAS;AAET;;;ACAA;AACA;AACA;AAMO,MAAM,iBAAiB,MAAM;AAAA,EAEvB;AAAA,EACA;AAAA,EACA;AAAA,EAHX,WAAW,CACA,QACA,QACA,MACT,QACA;AAAA,IACA,MAAM,OAAO,UAAU,WAAW,OAAO,MAAM,MAAM,QAAQ;AAAA,IALpD;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,mBAAmB,CACvB,QACA,MACA,aAEA,IAAI,SACF,GACA,QACA,MACA,uBAAuB,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,GAChF;AAgBF,IAAM,SAAS,CAAC,SAA0B;AAAA,EACxC,MAAM,SAAS,IAAI;AAAA,EACnB,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,OAAO,UAAU;AAAA,MAAU,OAAO,OAAO,KAAK,KAAK;AAAA,IAClD;AAAA,iBAAW,QAAQ;AAAA,QAAO,OAAO,OAAO,KAAK,IAAI;AAAA,EACxD;AAAA,EACA,OAAO,OAAO,SAAS;AAAA;AAGzB,IAAM,eAAe,CACnB,QACA,SACA,MACA,YACA,QACA,SACG;AAAA,EACH,MAAM,MAAM,GAAG,WAAW;AAAA,EAsB1B,OAAyB,wBAAK,MAAM,EAAE,GAAG,EAAE,KACvB,8BAAW,EAAE,eAAe,cAAc,YAAY,MAAM,EAAE,CAAC,GACjF,SAAS,YACL,CAAC,SAAS,OACQ,4BAAS,OAAO,IAAI,GAAG,mCAAmC,CAClF;AAAA;AAGF,IAAM,aAAa,CACjB,QACA,YACA,QACA,MACA,MACA,YAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,UAAU,aAAa,QAAQ,SAAS,MAAM,YAAY,QAAQ,IAAI;AAAA,EAC5E,OAAO,OAAO,OACX,QAAQ,OAAO,EACf,KAAY,iBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,CACjF;AAEH,IAAM,eAAe,CACnB,UAKA,QACA,SAEO,YAAI,UAAU,GAAG;AAAA,EAOtB,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AAAA,IAGnD,MAAM,SAAS,OAAO,SAAS,KAAK,KAAY,sBAAc,MAAM,EAAE,CAAC;AAAA,IACvE,OAAO,OAAc,aAAK,IAAI,SAAS,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,EAC7F;AAAA,EACA,MAAM,OAAQ,OAAO,SAAS,KAAK,KAC1B,iBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CACzE;AAAA,EACA,OAAO,KAAK;AAAA,CACb;AAGI,IAAM,UAAU,CACrB,QACA,YACA,QACA,MACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WACJ,OAAO,WAAW,QACd,OAAO,iBAAiB,QAAQ,QAAQ,MAAM,CAAC,YAC7C,aAAa,QAAQ,SAAS,MAAM,YAAY,QAAQ,IAAI,CAC9D,EAAE,KACO,iBAAS,CAAC,YACf,QAAQ,QAAQ,YACZ,iBAAiB,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,IAC/D,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,OAAO,CAAC,CACnD,CACF,IACA,OAAO,WAAW,QAAQ,YAAY,QAAQ,MAAM,MAAM,OAAO,GAAG;AAAA,EAC1E,OAAO,OAAO,aAAgB,UAAU,QAAQ,IAAI;AAAA,CACrD;AAQI,IAAM,kBAAkB,CAC7B,QACA,YACA,QACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,iBAAiB,QAAQ,QAAQ,MAAM,CAAC,YAC9D,aAAa,QAAQ,SAAS,MAAM,YAAY,MAAM,CACxD,EAAE,KACO,iBAAS,CAAC,YACf,QAAQ,QAAQ,YACZ,iBAAiB,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,IAC/D,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,OAAO,CAAC,CACnD,CACF;AAAA,EACA,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AAAA,IACnD,MAAM,SAAS,OAAO,SAAS,KAAK,KAAY,sBAAc,MAAM,EAAE,CAAC;AAAA,IACvE,OAAO,OAAc,aAAK,IAAI,SAAS,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,EAC7F;AAAA,EACA,OAAQ,OAAO,SAAS,KAAK,KACpB,iBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CACzE;AAAA,CACD;AAoBI,IAAM,MAAM,CACjB,QACA,MACA,QACA,MACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,QAAW,QAAQ,YAAY,QAAQ,MAAM,IAAI;AAAA,CAChE;;;AClOH;AAIO,IAAM,aAAa,CACxB,SACG;AAAA,EAEH,MAAM,cAAc,CAAC,UACnB,OAAO,KAAK,aAAa,aAAa,KAAK,SAAS,KAAK,IAAI,KAAK;AAAA,EAqBpE,MAAM,cAAc,CAAC,OAAc,aAC1B,iBAAQ,MAAM;AAAA,IACnB,MAAM,SAAS,YAAY,KAAK,GAAG;AAAA,IACnC,OAAO,WAAW,YACP,gBACP,UAAU,QAAQ,KAAK,WAAW,KAAK,GAAG,QAAQ;AAAA,GACvD;AAAA,EAOH,MAAM,cAAc,CAAC,UACZ,iBAAQ,MAAM;AAAA,IACnB,MAAM,SAAS,YAAY,KAAK,GAAG;AAAA,IACnC,IAAI,WAAW;AAAA,MAAW,OAAc;AAAA,IACxC,MAAM,OAAO,KAAK,aAAa,KAAK;AAAA,IACpC,OAAO,SAAS,YAAmB,gBAAO,UAAU,QAAQ,MAAM,KAAK;AAAA,GACxE;AAAA,EAEH,OAAO,EAAE,aAAa,YAAY;AAAA;;;AClC7B,IAAM,aAAa,CACxB,UACA,MACA,OACA,SACsB,SAAQ,MAAM,KAAK,KAAK,OAAO,KAAK,IAAI,EAAE,WAAW,IAAI,YAAY;;;AHFtF,IAAM,gBAAgB,CAC3B,SACG;AAAA,EACH,QAAQ,aAAa,gBAAgB,WAAW,IAAI;AAAA,EAGpD,MAAM,OAAO,CAAC,UACZ,IACE,MAAM,QACN,KAAK,YAAY,QACjB,OACA,KAAK,KAAK,KAAK,CACjB,EAAE,KACO,aAAI,CAAC,SAAU,QAAQ,OAAO,YAAY,KAAK,WAAW,MAAM,KAAK,CAAE,GACvE,uBAAc,MAAG;AAAA,IAAG;AAAA,GAAS,CACtC;AAAA,EAEF,OAAO;AAAA,IAOL;AAAA,IACA;AAAA,IAEA;AAAA,IAKA,MAAM,CAAC,MAAoB,WAClB,aAAI,UAAU,GAAG;AAAA,MAItB,IAAI,CAAC,YAAW,IAAI;AAAA,QAAG;AAAA,MAOvB,OAAO,YAAY,MAAM,WAAW,SAAS;AAAA,MAC7C,OAAO,YAAY,IAAI;AAAA,MACvB,IAAI,WAAW;AAAA,QAAW;AAAA,MAC1B,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAG7B,IAAI,SAAS,WAAW;AAAA,QAMtB,OAAO,YAAY,MAAM,IAAI;AAAA,QAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,MAC5B;AAAA,MACA,IAAI,KAAK,QAAQ,MAAM,IAAI;AAAA,QAAG,OAAO,EAAE,QAAQ,OAAO;AAAA,MAEtD,OAAO,KAAK,eAAe,YACtB,EAAE,QAAQ,UAAU,IACpB,EAAE,QAAQ,SAAS;AAAA,KACzB;AAAA,IAEH,WAAW,CAAC,SACH,aAAI,UAAU,GAAG;AAAA,MACtB,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAM7B,OAAO,YAAY,MAAM,SAAS,SAAS;AAAA,MAC3C,OAAO,YAAY,IAAI;AAAA,MACvB,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,IACL,KAAK,QACL,aACA,QACA,KAAK,WAAW,IAAI,GACpB,KAAK,WAAW,IAAI,CACtB;AAAA,MACF,EAAO,SAAI,KAAK,eAAe,WAAW;AAAA,QAyBxC,MAAM,OAAO,WAAW,KAAK,SAAS,MAAM,MAAM,KAAK,WAAW,IAAI,CAAC;AAAA,QACvE,IAAI,SAAS,WAAW;AAAA,UACtB,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,KAAK,KAAK,IAAI,GAAG,IAAI;AAAA,QACnE;AAAA,MACF;AAAA,MACA,MAAM,QAAQ,OAAO,KAAK,IAAI;AAAA,MAC9B,IAAI,UAAU,WAAW;AAAA,QAOvB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,KAAK,KAAK,IAAI,oEACf,sFACA,4DACJ,CACF;AAAA,MACF;AAAA,MACA,OAAO;AAAA,KACR;AAAA,IAOH,SAAS,CAAC,SAAgB,IAAI,KAAK,QAAQ,aAAa,UAAU,KAAK,KAAK,IAAI,CAAC;AAAA,EACnF;AAAA;AAoCK,IAAM,cAAc,CACzB,SACG;AAAA,EACH,MAAM,MAAM,cAAc,IAAI;AAAA,EAC9B,OAAO;AAAA,IACL,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,GAAG,WAA4B,IAAI,KAAK,IAAI;AAAA,IAClD,MAAM,GAAG,MAAM,aACb,IAAI,KAAK,MAAM,MAAM;AAAA,IACvB,WAAW,GAAG,WAA4B,IAAI,UAAU,IAAI;AAAA,IAC5D,QAAQ,GAAG,WAA4B,IAAI,QAAQ,IAAI;AAAA,EACzD;AAAA;;;AD5GK,IAAM,mBAAmB,UAA2B,mBAAmB;AAsB9E,IAAM,SAAQ,CAAC,WAA2B;AAAA,EACxC,KAAK,MAAM,QAAQ,OAAO,MAAM;AAAA,EAChC,SAAS,MAAM,YAAY,QAAQ,MAAM;AAAA,EACzC,MAAM,MAAM,QAAQ;AAAA,EACpB,qBAAqB,MAAM,wBAAwB;AAAA,EACnD,iBAAiB,MAAM,qBAAqB,OAAO,MAAM;AAAA,EACzD,UAAU,MAAM;AAAA,KACZ,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,UAAU,MAAM,OAAO,EAAE;AAAA,KACvE,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC/D,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB,MAAM,kBAAkB;AAAA,KACzF,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,KACnD,MAAM,qBAAqB,YAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,iBAAiB;AAAA,KACtF,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,UAAU,MAAM,IAAI,EAAE;AACpE;AAEA,IAAM,WAAW,YAAiD;AAAA,EAQhE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,KAAK,KAAK,KAAK,QAAQ,KAAK;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,IAAI;AAAA,IACnC,SAAS,UAAU,KAAK,UAAU;AAAA,IAClC,UAAU,eAAe,KAAK,aAAa,SAAS;AAAA,IACpD,IAAI,MAAM;AAAA,IACV,MAAM,KAAK,KAAK,SAAS,UAAU;AAAA,IACnC,YAAY,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;AAAA,IACtE,kBAAkB,KAAK,KAAK,mBAAmB,EAAE;AAAA,IACjD,qBAAqB,KAAK,KAAK,sBAAsB,MAAM;AAAA,IAC3D,MAAM,KAAK,KAAK,SAAS,EAAE;AAAA,IAC3B,iBAAiB,eAAe,KAAK,gBAAgB;AAAA,IACrD,iBAAiB,KAAK,KAAK,kBAAkB,KAAK;AAAA,IAClD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IACnC,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,MAAM,UAAU,KAAK,OAAO;AAAA,EAC9B;AAAA,EACA,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA,EAGxD,UAAU,EAAE,QAAQ,4BAA4B,QAAQ,+BAA+B;AAAA,EACvF,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,YAC9B,WAAW,aAAa,MAAM,YAAY,UAC1C,WAAW,SAAS,MAAM,QAAQ,SAClC,WAAW,UAAU,MAAM,QAAQ,eACnC,WAAW,0BAA0B,MAAM,wBAAwB,WACnE,WAAW,sBAAsB,MAAM,qBAAqB,UAC3D,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,SAAS,aAAa,WAAW,SAAS,UAAU,MAAM,IAAI,OACpE,MAAM,YAAY,aAAa,WAAW,YAAY,UAAU,MAAM,OAAO,OAC7E,MAAM,sBAAsB,aAC3B,WAAW,sBAAsB,MAAM,uBACxC,MAAM,qBAAqB,aAC1B,WAAW,qBAAqB,eAAe,MAAM,gBAAgB,OACtE,MAAM,aAAa,aAClB,WAAW,aAAa,eAAe,MAAM,UAAU,SAAS;AAAA,EACpE,MAAM,CAAC,UAAU,kBAAkB,MAAM;AAAA,EACzC,YAAY;AACd,CAAC;AAgBM,IAAM,2BAA2B,MAC7B,iBAAO,kBAAyB,iBAAQ,iBAAiB,SAAS,GAAG,QAAQ,CAAC,CAAC;;AKlK1F,qBAAS;AACT,uBAAS;AACT;AACA;;;ACPO,IAAM,mBAAkE;AAAA,EAC7E,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACP;AAQO,IAAM,WAAW,CAAC,UAA2B,MAAM,QAAQ,MAAM;AAQjE,IAAM,iBAAiB,CAAC,UAA2B,SAAS,MAAM,aAAa,MAAM;AAGrF,IAAM,aAAa,CAAC,UAA2B,GAAG,eAAe,KAAK,KAAK,SAAS,KAAK;AAezF,IAAM,aAAa,CAAC,UAAmD;AAAA,EAC5E,IAAI,MAAM,SAAS,SAAS,MAAM,mBAAmB,WAAW;AAAA,IAC9D,OAAO,EAAE,eAAe,MAAM,eAAe;AAAA,EAC/C;AAAA,EACA,MAAM,aAAa,MAAM,SAAS,QAAQ,KAAK,MAAM,UAAU,IAAI;AAAA,EACnE,OAAO,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AAAA;AAU/C,IAAM,UAAU,CAAC,MAAe,WACpC,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAC5B,OAAO,CAAC,QAAwC,OAAO,QAAQ,YAAY,QAAQ,IAAI,EACvF,KAAK,CAAC,QAAQ,IAAI,YAAY,SAAS,KAAK,CAAC;AAY3C,IAAM,mBAAmB,CAC9B,MACA,UACqC;AAAA,EACrC,MAAM,MAAM,QAAQ,MAAM,KAAK;AAAA,EAC/B,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,OAAO;AAAA,IACL,MAAM,KAAK,IAAI,OAAO;AAAA,IACtB,QAAQ,KAAK,IAAI,UAAU;AAAA,IAC3B,MAAM,KAAK,IAAI,OAAO;AAAA,IACtB,MAAM,MAAM;AAAA,IACZ,MAAM,SAAS,KAAK;AAAA,IACpB,MAAM,MAAM;AAAA,IACZ,QAAQ,KAAK,IAAI,SAAS;AAAA,IAC1B,MAAM,IAAI,IAAI,SAAS,EAAE;AAAA,IACzB,SAAS,KAAK,IAAI,UAAU;AAAA,IAC5B,eAAe,KAAK,IAAI,iBAAiB;AAAA,IACzC,OAAO,KAAK,IAAI,QAAQ;AAAA,IACxB,SAAS,KAAK,IAAI,qBAAqB;AAAA,EACzC;AAAA;;;ACxHF;AACA;AAcA,IAAM,WAAW,CAAC,UAA2B;AAAA,EAC3C,MAAM,OAAO,MAAM;AAAA,EACnB,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAgB,EAAE,KAAK,CAAC,CAAC,EAAE,KACnE,aAAI,CAAC,SAAoB,IAAI,CACtC;AAAA,SACG;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAgB,EAAE,KAAK,CAAC,CAAC,EAAE,KACnE,aAAI,CAAC,SAAoB,IAAI,CACtC;AAAA,SACG;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAgB,EAAE,KAAK,CAAC,CAAC,EAAE,KACnE,aAAI,CAAC,SAAoB,IAAI,CACtC;AAAA;AAAA;AAKC,IAAM,aAAa,CAAC,UACzB,SAAS,KAAK,EAAE,KACP,aAAI,CAAC,SAAS,iBAAiB,MAA4C,KAAK,CAAC,CAC1F;AAGK,IAAM,eAAe,CAAC,UAA2B;AAAA,EACtD,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,KAAK,SAAS,KAAK;AAAA,EACzB,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,OACL,MAAM,QACN,aACA,MACM,wBAAkB;AAAA,WAClB,MAAM,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,eAAe;AAAA,QAClF,OAAO;AAAA,QACP;AAAA,MACF,CAAC,CACH;AAAA,SACG;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,IAAI,KAAK,CAAC,CAAC;AAAA,SACjF;AAAA,MACH,OAAO,OACL,MAAM,QACN,aACA,MACM,wBAAkB;AAAA,WAClB,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,MAAM,aAAa,MAAM,IAAI;AAAA,QACrF,MAAM;AAAA,QACN;AAAA,MACF,CAAC,CACH;AAAA;AAAA;AAMC,IAAM,eAAe,CAAC,UAA2B;AAAA,EACtD,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,KAAK,SAAS,KAAK;AAAA,EACzB,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;AAAA,SACxF;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,IAAI,KAAK,CAAC,CAAC;AAAA,SACjF;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC;AAAA;AAAA;AASzF,IAAM,aAAa,CAAC,UACzB,IAAI,MACF,GAAG,WAAW,KAAK,SAAS,MAAM,cAAc,SAAS,KAAK,oBAC5D,GAAG,MAAM,aAAa,MAAM,+DAC5B,qEACJ;;;AFkEK,IAAM,oBAAoB,UAA4B,sBAAsB;AAAA,EACjF,sBAAsB;AACxB,CAAC;AA6BM,IAAM,kBAAyB,YAAG,UAAU,GAAG,QAAmC;AAAA,EACvF,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,EACnC,OAAO,YAAW,iBAAiB,KAAK,OAAO,WAAW,IAAI,GAAG,SAAS,SAAS;AAAA,EACnF,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,OAAO,aAAa,IAAI;AAAA,EACxB,MAAM,QAAQ,OAAO,WAAW,IAAI;AAAA,EACpC,IAAI,UAAU;AAAA,IAAW,OAAO,OAAc,aAAI,WAAW,IAAI,CAAC;AAAA,EAClE,OAAO;AAAA,CACR;AAEM,IAAM,4BAA4B,MAC9B,iBACP,mBACO,iBACL,kBAAkB,SAAS,GAAG;AAAA,EAG5B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,WAAW,IAAI;AAAA,EAEnC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,iBAAiB,KAAK,OAAO,WAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrF,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,IACnC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,iBAAiB,KAAK,OAAO,WAAW,IAAI,GAAG,IAAI;AAAA,MACrE,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,OAAO;AAAA,GACzB;AAAA,EACD,WAAW,GAAG,WAAW,gBAAgB,EAAE,KAAK,CAAC;AAAA,EAMjD,QAAQ,GAAG,WAAW,aAAa,IAAI;AACzC,CAAC,CACH,CACF;;AG9KF,qBAAS;AACT;AACA;AA2EO,IAAM,kBAAkB,UAA0B,kBAAkB;AAE3E,IAAM,YAAW,YAA+C;AAAA,EAsB9D,YAAY,CAAC,MAAM,WAAW,EAAE,MAAM,MAAM,MAAM,OAAO,KAAK,IAAI,EAAE;AAAA,EACpE,YAAY,MAAM;AAAA,EAMlB,YAAY,CAAC,WAAW,GAAG,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,IAAI;AAAA,EACjE,UAAU,EAAE,QAAQ,qCAAqC;AAAA,EAUzD,SAAS,CAAC,YAAY,UAAU,WAAW,UAAU,MAAM;AAAA,EAC3D,MAAM,CAAC,UAAU,sBAAsB,MAAM;AAAA,EAQ7C,YAAY,CAAC,WAAW,EAAE,OAAO,KAAK,MAAM,KAAK,KAAK,IAAI;AAC5D,CAAC;AAEM,IAAM,0BAA0B,MAC5B,iBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,KASvB;AAAA,EAEH,QAAQ,MAAa;AAAA,EAWrB,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,QAAQ,OAAO,UAAS,UAAU,EAAE,KAAK,CAAC;AAAA,IAChD,IAAI,MAAM,UAAU,KAAK,OAAO;AAAA,MAC9B,OAAO,OAAc,aACnB,IAAI,MACF,sBAAsB,KAAK,oDACzB,oBAAoB,MAAM,QAAQ,QAAQ,yBAC1C,GAAG,KAAK,QAAQ,QAAQ,yDACxB,4EACA,gFACA,yBACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AACH,CAAC,CACH,CACF;;ACxLF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACtDA;AACA;;;ACwDO,IAAM,UAAU,CACrB,MACA,UACiC;AAAA,EACjC,MAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GACxC,OACC,CAAC,UAA4C,OAAO,UAAU,YAAY,UAAU,IACtF,EACC,KAAK,CAAC,UAAU,MAAM,YAAY,MAAM,IAAI;AAAA,EAC/C,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,OAAO;AAAA,IACL,WAAW,KAAK,IAAI,YAAY;AAAA,IAChC,YAAY,IACV,MAAM,QAAQ,IAAI,aAAa,IAC3B,IAAI,cAAc,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IACvD,CAAC,CACP;AAAA,IACA,eAAe,KAAK,IAAI,gBAAgB;AAAA,IACxC,kBAAkB,IAAI,IAAI,qBAAqB,EAAE;AAAA,IACjD,MAAM,MAAM;AAAA,EACd;AAAA;AASK,IAAM,eAAe;AACrB,IAAM,gBAAgB;AAGtB,IAAM,aAAa,CAAC,UAAuB,SAAS,MAAM,gBAAgB,MAAM;AAGhF,IAAM,iBAAiB;AAG9B,IAAM,QAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAMtC,IAAM,cAAa,CAAC,WAAgD;AAAA,KACtE,MAAM,eAAe,KAAK,MAAM,cAAc,CAAC;AAAA,KAC/C,MAAM,UAAU,MAAM,WAAW,YAAY,YAAY,OAAO,MAAM,MAAM,CAAC;AAClF;AAWO,IAAM,cAAa,CAAC,UACzB,IAAI,MACF,GAAG,WAAW,KAAK,8DACjB,aAAa,MAAM,sEACnB,yCACJ;AAEK,IAAM,eAAe,CAAC,UAC3B,IAAI,MACF,GAAG,WAAW,KAAK,iEACjB,aAAa,MAAM,6EACnB,yDACJ;;;ADnHK,IAAM,SAAS,CAAC,UACrB,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAe,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACvE,aAAI,CAAC,SAAS,QAAQ,MAA4C,KAAK,CAAC,CACjF;AAGF,IAAM,oBAAoB,CAAC,WACxB;AAAA,KACI,YAAW,KAAK;AAAA,EACnB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AACd;AAMF,IAAM,aAAa,CAAC,OAAoB,SAC/B,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,eAAe,WAAW,GAAG;AAAA,IAC3D,MAAM,SAAS,OAAO,OACpB,MAAM,QACN,QACA,OACM,yBAAkB,EAAE,MAAM,MAAM,MAAM,KAAK,CAAC,CACpD,EAAE,KAAY,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CAAC;AAAA,IAC5C,IAAI,QAAQ,WAAW,WAAW;AAAA,MAChC,IAAI,OAAO,eAAe;AAAA,QAAM;AAAA,MAChC,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,eAAe,uBAAuB,OAAO,cAAc,wBAC5E,wFACA,yBAAyB,MAAM,cAAc,aACjD,CACF;AAAA,IACF;AAAA,IACA,OAAc,eAAM,eAAe,IAAI;AAAA,EACzC;AAAA,EACA,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,eAAe,kCAChC,GAAG,OAAO,gBAAgB,YAAY,oDACtC,iEACA,UAAU,MAAM,0EAChB,qDACJ,CACF;AAAA,CACD;AAGI,IAAM,WAAW,CAAC,UAChB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,aACA,MACM,wBAAiB,kBAAkB,KAAK,CAAC,CACjD;AAAA,EAIA,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,4DACjB,iEACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,WAAW,OAAO,IAAI;AAAA,CAC9B;AAYI,IAAM,YAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,aACA,MACM,wBAAiB;AAAA,IACrB,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,OAER,MAAM,oBAAoB,OAAO,EAAE,cAAc,IAAI,IAAI,CAAC;AAAA,OAC1D,MAAM,uBAAuB,OAAO,EAAE,iBAAiB,IAAI,IAAI,CAAC;AAAA,EACtE,CAAC,CACH,EAAE,KAAY,kBAAS,kBAAkB,MAAa,iBAAQ,EAAE,CAAC,CAAC;AAAA,EAGlE,IAAI,SAAS;AAAA,IAAI,OAAO,WAAW,OAAO,IAAI;AAAA,CAC/C;;;ADgBI,IAAM,gBAAgB,UAAwB,kBAAkB;AAAA,EACrE,sBAAsB;AACxB,CAAC;AAkBM,IAAM,wBAAwB,MAC1B,iBACP,eACO,iBACL,cAAc,SAAS,GAAG;AAAA,EAMxB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,OAAO,IAAI;AAAA,GAC1B;AAAA,EAaD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,gBAAgB,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACxE,IAAI,WAAW,aAAa,KAAK,SAAS,OAAO,MAAM;AAAA,MACrD,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,OAAO,IAAI;AAAA,IAC/B,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,gBAAgB,YAAW,IAAI,GAAG,IAAI;AAAA,MACxD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAEA,OAAO,EAAE,QAAQ,OAAO;AAAA,GACzB;AAAA,EASD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,OAAO,IAAI;AAAA,IAC/B,IAAI,SAAS;AAAA,MAAW,OAAO;AAAA,IAC/B,OAAO,SAAS,IAAI;AAAA,IACpB,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,IAChC,IAAI,UAAU;AAAA,MAAW,OAAO,OAAc,aAAI,YAAW,IAAI,CAAC;AAAA,IAClE,OAAO;AAAA,GACR;AAAA,EAQD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IAUrC,KAAK,OAAO,OAAO,IAAI,OAAO;AAAA,MAAW;AAAA,IACzC,OAAO,UAAU,IAAI;AAAA,IACrB,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,IAChC,IAAI,UAAU;AAAA,MAAW,OAAO,OAAc,aAAI,aAAa,IAAI,CAAC;AAAA,GACrE;AACH,CAAC,CACH,CACF;;AG1MF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACYA;AACA;AAQA,IAAM,WAAW,CAAC,UACf,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC,GAAG,OACxD,CAAC,UAA8B,OAAO,UAAU,YAAY,UAAU,IACxE;AAeK,IAAM,YAAY,CAAC,SAAiC;AAAA,EACzD,MAAM,OAAO,KAAK;AAAA,EAClB,MAAM,QAAmB,OAAO,SAAS,YAAY,SAAS,OAAQ,OAAqB,CAAC;AAAA,EAC5F,MAAM,OAAO,CAAC,SAAiC;AAAA,IAC7C,GAAI,KAAK,YAAY,QAAQ,CAAC,IAAI,IAAI,CAAC;AAAA,IACvC,GAAG,SAAS,IAAI,EAAE,QAAQ,IAAI;AAAA,EAChC;AAAA,EACA,OAAO,KAAK,KAAK;AAAA;AAoBZ,IAAM,UAAU,CAAC,MAAiB,UACvC,UAAU,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,OAAO,OAAO,GAAG,MAAM,KAAK;AAkD/D,IAAM,gBAAgB,CAAC,MAAiB,WAA4C;AAAA,EACzF,cAAc,KAAK,KAAK,qBAAqB;AAAA,EAC7C,cAAc,IAAI,KAAK,iBAAiB,CAAC;AAAA,EACzC,cAAc,KAAK,KAAK,eAAe;AAAA,EACvC,MAAM,KAAK,KAAK,OAAO;AAAA,EACvB,IAAI,KAAK,KAAK,KAAK;AAAA,EACnB,MAAM,KAAK,KAAK,SAAS,OAAO,OAAO,MAAM,KAAK,GAAG;AAAA,EACrD,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK;AAAA,EAClC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,EACvB,UAAU,IAAI,KAAK,aAAa,CAAC;AAAA,EACjC,QAAQ,KAAK,KAAK,SAAS;AAAA,EAC3B,aAAa,IAAI,KAAK,gBAAgB,CAAC;AACzC;AAmBO,IAAM,UAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAe,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACvE,aAAI,CAAC,MAAM;AAAA,EAChB,MAAM,OAAO,QAAQ,GAA2B,MAAM,KAAK;AAAA,EAC3D,OAAO,SAAS,YAAY,YAAY,cAAc,MAAM,KAAK;AAAA,CAClE,CACH;;;AC5LF;AACA;AAmBO,IAAM,sBAAmC;AAEhD,IAAM,WAAW,CAAC,UAAwB,OAAO,OAAO,MAAM,KAAK,QAAQ,MAAM;AAM1E,IAAM,gBAAgB,CAAC,OAAqB,SAAyC;AAAA,EAC1F;AAAA,KACI,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,sBAAsB,MAAM,aAAa;AACzF;AAEO,IAAM,YAAmB,YAAG,UAAU,CAAC,MAAoB;AAAA,EAChE,IAAI,KAAK,QAAQ,WAAW;AAAA,IAC1B,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,SAAS,IAAI,oEACd,kFACA,oFACA,qFACA,cACJ,CACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,cAAc,MAAM,KAAK,GAAG;AAAA,EAGzC,OAAO,UAAU,qBAAqB,MAAM,IAAI;AAAA,EAChD,OAAO,OACL,KAAK,QACL,aACA,MACM,yBAAkB;AAAA,IACtB,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,OACP,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,oBAAoB,KAAK,aAAa;AAAA,EACrF,CAAC,CACH;AAAA,EACA,MAAM,UAAU,OAAO,QAAQ,IAAI;AAAA,EACnC,IAAI,YAAY,WAAW;AAAA,IACzB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,SAAS,IAAI,2CAA2C,OAAO,KAAK,KAAK,UAC1E,sFACA,wFACA,uDACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAkCM,IAAM,aAAa,CAAC,SACzB,OACE,KAAK,QACL,aACA,MACM,yBAAkB;AAAA,EACtB,MAAM,KAAK;AAAA,EACX,OAAO,OAAO,KAAK,KAAK;AAAA,KACpB,KAAK,YAAY,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC;AAClD,CAAC,CACH;;;AFTK,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAuBD,IAAM,UAAU,CAAC,MAAyB,WACvC,MAAM,SAAS,aAAa,MAAM,SAAS,KAAK,UAChD,MAAM,iBAAiB,aAAa,MAAM,iBAAiB,KAAK;AAEnE,IAAM,YAAW,CAAC,UAChB,OAAO,OAAO,MAAM,KAAK,qBAAqB,MAAM;AAetD,IAAM,YAAW;AAAA,EAOf,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAE7B,MAAa,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC3D,OAAO,OAAO,QAAQ,IAAI;AAAA,GAC3B;AAAA,EAUD,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,KAIC;AAAA,IACD,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IAC/C,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAQlD,IAAI,OAAO,UAAU,KAAK;AAAA,MAAO,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC3D,OAAO,QAAQ,MAAM,IAAI,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAClF;AAAA,EAOD,WAAkB,YAAG,UAAU,GAAG,QAAgC;AAAA,IAChE,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MAUtB,OAAO,OAAO,UAAU,IAAI;AAAA,IAC9B;AAAA,IACA,IAAI,CAAC,QAAQ,MAAM,IAAI,GAAG;AAAA,MACxB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,UAAS,IAAI,8CAA8C,KAAK,UACjE,gBAAgB,KAAK,8DACrB,wFACA,6DACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC7D,OAAO,WAAW,IAAI;AAAA,GACvB;AACH;AAEO,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,SAAQ,CAAC,CAAC;;AG/MtF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACkGO,IAAM,SAAS,CAAC,UAAyB,SAAS,MAAM,kBAAkB,MAAM;AAShF,IAAM,QAAQ;AAGd,IAAM,eAAe,CAAC,UAC3B,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;AAQvE,IAAM,OAAO,CAAI,UAAyB,MAAS,SAAS,UACjE,aAAa,aAAa,UAAU,aAAa;AAc5C,IAAM,OAAO,CAAC,UAA+B,UAAU,IAAI,YAAY;AAG9E,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAG7C,IAAM,UAAU,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAmCvF,IAAM,aAAa,CAAC,WAAkD;AAAA,KACxE,OAAM,cAAc,MAAM,UAAU;AAAA,KACpC,OAAM,YAAY,QAAQ,MAAM,QAAQ,CAAC;AAAA,KACzC,OAAM,qBAAqB,MAAM,iBAAiB;AAAA,KAClD,OAAM,cAAc,QAAQ,MAAM,UAAU,CAAC;AAAA,KAC7C,OAAM,QAAQ,QAAQ,MAAM,IAAI,CAAC;AAAA,KACjC,OAAM,eAAe,QAAQ,MAAM,WAAW,CAAC;AAAA,KAC/C,OAAM,qBAAqB,QAAQ,MAAM,iBAAiB,CAAC;AAChE;AAYO,IAAM,aAAa,CAAC,WAAkD;AAAA,KACxE,WAAW,KAAK;AAAA,KAChB,OAAM,eAAe,MAAM,WAAW;AAAA,KACtC,OAAM,UAAU,QAAQ,MAAM,MAAM,CAAC;AAAA,EACxC,cAAc;AAAA,EACd,MAAM,MAAM;AACd;;;AChPA;AACA;AA6BO,IAAM,gBAAgB,CAAC,OAAsB,cAClD,OAAO,MAAM,QAAQ,QAAQ,OAAa,wBAAiB,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACzE,iBAAQ,CAAC,SACd,KAAK,KAAK,CAAC,QAAQ,IAAI,cAAc,MAAM,IAAI,IACpC,aACL,IAAI,MACF,GAAG,8EACD,oFACA,oFACA,6CACJ,CACF,IACO,aACb,CACF;AAYK,IAAM,SAAS,CACpB,OACA,MACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,IAAI,WAAW,GAAG;AAAA,IAChD,MAAM,OAAO,OAAO,KAAK,KAAK;AAAA,IAC9B,IAAI,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACvB,OAAc,eAAM,WAAW;AAAA,EACjC;AAAA,EACA,OAAO,OAAO,KAAK,KAAK;AAAA,CACzB;;;AC3DH;AACA;AAwBA,IAAM,gBAAe,CAAC,MAAe,UAAyD;AAAA,EAC5F,MAAM,MAAM;AAAA,EACZ,IAAI,OAAO,IAAI,YAAY;AAAA,IAAU;AAAA,EACrC,OAAO;AAAA,IACL,cAAc,aAAa,IAAI,mBAAmB;AAAA,IAClD,YAAY,KAAK,IAAI,aAAa;AAAA,IAClC,IAAI,IAAI,IAAI,OAAO,KAAK;AAAA,IACxB,UAAU,IAAI,IAAI,aAAa,KAAK;AAAA,IACpC,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,IACZ,UAAU,KAAK,IAAI,WAAW;AAAA,IAC9B,YAAY,KAAK,IAAI,aAAa;AAAA,IAClC,cAAc,KAAK,IAAI,eAAe;AAAA,IACtC,mBAAmB,KAAK,IAAI,oBAAoB;AAAA,IAChD,QAAQ,IAAI,IAAI,WAAW,KAAK;AAAA,IAChC,YAAY,IAAI,IAAI,eAAe,KAAK;AAAA,IACxC,MAAM,IAAI,IAAI,SAAS,KAAK;AAAA,IAC5B,aAAa,IAAI,IAAI,gBAAgB,KAAK;AAAA,IAC1C,mBAAmB,IAAI,IAAI,sBAAsB,KAAK;AAAA,EACxD;AAAA;AAWK,IAAM,iBAAiB,CAAC,UAC7B,OACE,MAAM,QACN,QACA,OACM,6BAAsB,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,IAAI,CAAC,CAClF,EAAE,KACO,aAAI,CAAC,SAAS,cAAa,MAAM,KAAK,CAAC,GACvC,kBAAS,oBAAoB,MAAa,iBAAQ,SAAS,CAAC,CACrE;AAGK,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AAGzB,IAAM,qBAAoB,CAAC,WAC/B;AAAA,KACI,WAAW,KAAK;AAAA,EACnB,MAAM,MAAM;AACd;AAGK,IAAM,oBAAoB,CAAC,WAC/B;AAAA,KACI,WAAW,KAAK;AAAA,EACnB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AACd;;;AHpBK,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAaD,IAAM,WAAU,CAAC,YAAgC,UAC/C,KAAK,MAAM,MAAM,WAAW,MAAM,WAAW,YAAY,KACzD,KAAK,MAAM,UAAU,WAAW,UAAU,WAAW,YAAY,KACjE,KAAK,MAAM,mBAAmB,WAAW,iBAAiB,KAC1D,KAAK,KAAK,MAAM,UAAU,GAAG,WAAW,YAAY,WAAW,UAAU,KACzE,KAAK,MAAM,YAAY,WAAW,YAAY,WAAW,eAAe,EAAE,KAC1E,KAAK,KAAK,MAAM,WAAW,GAAG,WAAW,WAAW;AAE/C,IAAM,0BAA0B,MAC5B,iBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,EAE1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,eAAe,IAAI;AAAA,EAMvC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAC1E,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,KAAK;AAAA,IAC3D,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IACvC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,IAAI;AAAA,MAC1D,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAMD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IACvC,IAAI;AAAA,IACJ,IAAI,SAAS,WAAW;AAAA,MAItB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,IAAI;AAAA,MAC1D,OAAO,cAAc,MAAM,OAAO,IAAI,CAAC;AAAA,MACvC,OAAO,OAAO,OACZ,KAAK,QACL,aACA,MACM,0BAAmB,mBAAkB,IAAI,CAAC,CAClD;AAAA,IACF,EAAO;AAAA,MAQL,MAAM,OAAO,WAAW,UAAS,MAAM,MAAM,WAAW,IAAI,CAAC;AAAA,MAC7D,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,KAAK;AAAA,QAC3D,OAAO,OAAO,OACZ,KAAK,QACL,aACA,MACM,uBAAgB,kBAAkB,IAAI,CAAC,CAC/C;AAAA,MACF;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,OACnB,MACA,gBACA,CAAC,QAAQ,QAAQ,aAAa,SAAQ,KAAK,IAAI,CACjD;AAAA,IACA,IAAI,UAAU,aAAa,CAAC,SAAQ,OAAO,IAAI,GAAG;AAAA,MAChD,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,IAAI,sEACZ,qDAAqD,QAAQ,sBAC7D,8EACA,UACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAYD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACM,0BAAmB,EAAE,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK,CAAC,CAC/D;AAAA,IACA,MAAM,OAAO,OAAO,OAAO,MAAM,gBAAgB,CAAC,QAAQ,QAAQ,SAAS;AAAA,IAC3E,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,IAAI,uEACZ,iFACA,mCACJ,CACF;AAAA,IACF;AAAA,GACD;AACH,CAAC,CACH,CACF;;AI3HF,qBAAS;AACT,uBAAS;AACT;AACA;;;AChEO,IAAM,OAAO,CAAC,SAAiB,KAAK,KAAK,EAAE,YAAY;AAyBvD,IAAM,OAAO,CAAC,UAAmB;AAAA,EACtC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK;AAAA,EAC7B,MAAM,OAAO,IAAI,SAAS,GAAG,IAAI,SAAS;AAAA,EAC1C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,GAAG,CAAC,KAAK,MAAM,IAAI;AAAA;AAwBpD,IAAM,UAAU,CAAC,UAAmB;AAAA,EACzC,MAAM,UAAU,KAAK,KAAK,EAAE,KAAK;AAAA,EACjC,OAAO,YAAY,MAAM,KAAK;AAAA;AAqBzB,IAAM,OAAO,CAAC,UAAsD;AAAA,EACzE,MAAM,OAAO,QAAQ,MAAM,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,MAAO,SAAS,KAAK,CAAC,IAAI,EAAE,SAAS,KAAK,EAAG;AAAA;;;ADkCtE,IAAM,uBAAuB,UAA+B,uBAAuB;AAE1F,IAAM,YAAW,YAAyD;AAAA,EAQxE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,UAAU,KAAK,KAAK,OAAO;AAAA,IACjC,OAAO,YAAY,KACf,YACA;AAAA,MACE,MAAM;AAAA,MACN,SAAS,QAAQ,KAAK,UAAU;AAAA,MAChC,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,MAEnC,MAAM,KAAK,KAAK,SAAS,MAAM,IAAI;AAAA,IACrC;AAAA;AAAA,EAEN,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,KAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAO3D,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,YAAY,UACpB,WAAW,SAAS,KAAK,MAAM,IAAI,KAAK,WAAW,YAAY,QAAQ,MAAM,OAAO;AAAA,EAKtF,MAAM,CAAC,UAAU,4BAA4B,MAAM;AAAA,EACnD,YAAY;AACd,CAAC;AASM,IAAM,+BAA+B,MACjC,iBACP,sBACO,iBACL,qBAAqB,SAAS,GAAG;AAAA,KAC5B;AAAA,EACH,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAI3C,IAAI,WAAW,aAAa,YAAW,IAAI,KAAK,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI,GAAG;AAAA,MACrF,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,OAAO,OAAO,UAAS,KAAK,EAAE,MAAM,OAAO,CAAC;AAAA,GAC7C;AACH,CAAC,CACH,CACF;;AE/IF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACpEA;AACA;AAMO,IAAM,eAAe;AACrB,IAAM,eAAe;AAWrB,IAAM,gBAAgB,CAAC,aAAgC;AAAA,EAC5D,MAAM,QAAQ,YAAW;AAAA,EACzB,OAAO,UAAU,MAAM,KAAK;AAAA;AAI9B,IAAM,aAAa,CAAC,SAAsC;AAAA,EACxD,MAAM,SAAS,IAAI,KAAK,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC;AAAA,EACrD,OAAO,WAAW,KAAK,CAAC,IAAI,OAAO,MAAM,GAAG;AAAA;AAGvC,IAAM,cAAa,CAAC,WAAwD;AAAA,EACjF,SAAS,cAAc,MAAM,OAAO;AAAA,EACpC,SAAS,MAAM;AACjB;AAGO,IAAM,aAAa,CAAC,WAAqD;AAAA,EAC9E,SAAS,cAAc,MAAM,OAAO;AAAA,EACpC,SAAS,MAAM;AACjB;AAEA,IAAM,gBAAe,CAAC,MAAqC,WAAwC;AAAA,EAKjG,SAAS,KAAK,KAAK,OAAO;AAAA,EAE1B,SAAS,MAAM;AAAA,EACf,SAAS,WAAW,KAAK,OAAO;AAClC;AAMO,IAAM,WAAU,CAAC,YAA6B,UACnD,WAAW,YAAY,cAAc,MAAM,OAAO;AAuB7C,IAAM,kBAAkB,CAAC,UAC9B,iBACE,OAAO,MAAM,QAAQ,QAAQ,OAAc,uBAAe,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CACvF,EAAE,KACO,aAAI,CAAC,SACV,SAAS,aACL,aACA,KAAK,YAAY,YACf,YACA,cAAa,MAAM,KAAK,CAChC,CACF;AAUK,IAAM,YAAY,CAAC,UACxB,gBAAgB,KAAK,EAAE,KAAY,kBAAS,iBAAiB,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAGxF,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;;;ADW7B,IAAM,eAAe,WAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAEM,IAAM,uBAAuB,MACzB,kBACP,cACO,iBACL,aAAa,SAAS,GAAG;AAAA,EAKvB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAY7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,UAAU,IAAI,IAAI,gBAAgB,IAAI,CACtE;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACtE,OAAO,YAAW,cAAc,WAAW,IAAI,GAAG,KAAK;AAAA,IACvD,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,gBAAgB,IAAI;AAAA,IAGxC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,iBAAiB,KAAK,OAAO;AAAA,MACtD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MAEtB,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,IAAI;AAAA,MACtD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAOxC,MAAM,SAAS,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACpD,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACtE,OAAO,YAAW,cAAc,WAAW,IAAI,GAAG,KAAK;AAAA,IACvD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACO,0BAAkB,YAAW,IAAI,CAAC,CAC3C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,uBAAe,WAAW,IAAI,CAAC,CAAC;AAAA,IACvF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACnD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,iBAAiB,KAAK,2DACpB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,0BAAkB,EAAE,SAAS,KAAK,QAAQ,CAAC,CACpD;AAAA,GACD;AACH,CAAC,CACH,CACF;;AE5KF,qBAAS;AACT;AACA;AAmDO,IAAM,oBAAoB,WAA4B,oBAAoB;AAGjF,IAAM,OAAO,CAAC,QAAgB,IAAI,MAAM,GAAG,EAAE,MAAM;AAOnD,IAAM,SAAQ,CAAC,WAA4B;AAAA,EACzC,SAAS,MAAM,WAAW;AAAA,EAC1B,cAAc,OAAO,MAAM,gBAAgB,CAAC;AAAA,EAC5C,aAAa,OAAO,MAAM,eAAe,CAAC;AAAA,EAC1C,OAAO,MAAM,SAAS;AACxB;AAEA,IAAM,YAAW,YAAmD;AAAA,EAClE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAAA,IACjE,cAAc,IAAI,KAAK,iBAAiB,CAAC;AAAA,IACzC,aAAa,IAAI,KAAK,gBAAgB,CAAC;AAAA,IACvC,KAAK,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,MAAM;AAAA,IAC3D,OAAO,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC3D,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,KAAK,MAAM,GAAG;AAAA,EACxE;AAAA,EAMA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,KAAK,MAAM,IAAI;AAAA,EAS1D,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,YAAY,UACpB,WAAW,WAAW,MAAM,SAAS,cACrC,WAAW,aAAa,MAAM,WAAW,OACzC,WAAW,iBAAiB,MAAM,eAAe,MACjD,WAAW,kBAAkB,MAAM,gBAAgB;AAAA,EAMrD,MAAM,CAAC,UAAU,wBAAwB,MAAM;AAAA,EAC/C,YAAY;AACd,CAAC;AAiBM,IAAM,4BAA4B,MAC9B,kBAAO,mBAA0B,iBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;;ACpG5F,qBAAS;AACT;AACA;;;ACzCO,IAAM,WAAW,CAAC,UAAkD;AAAA,EACzE,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,SAAS,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,IAAK,SAAS,CAAC,GAAI;AAAA,IAChF,OAAO,MAAM,YAAY,MAAM,KAAK,EAAE,MAAM,GAAG;AAAA,IAC/C,IAAI,SAAS,aAAa,SAAS;AAAA,MAAI;AAAA,IACvC,MAAM,OAAO,OAAO,SAAS,YAAY,KAAK,EAAE;AAAA,IAChD,OAAO,IAAI,MAAM,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI;AAAA,EAChD;AAAA,EACA,OAAO,CAAC,GAAG,OAAO,KAAK,CAAC,EACrB,KAAK,EACL,IAAI,CAAC,SAAS;AAAA,IACb,MAAM,OAAO,OAAO,IAAI,IAAI,KAAK;AAAA,IACjC,OAAO,SAAS,IAAI,OAAO,GAAG,QAAQ,OAAO,IAAI;AAAA,GAClD,EACA,KAAK,GAAG;AAAA;AAYN,IAAM,WAAW,CAAC,UACvB,OAAO,UAAU,YAAY,UAAU,OACnC,OAAO,QAAQ,KAAK,EACjB,IAAI,EAAE,QAAQ,aAAa,GAAG,WAAW,OAAO,OAAO,GAAG,EAC1D,KAAK,EACL,KAAK,IAAI,IACZ;AAqBC,IAAM,cAAc,CAAC,QAC1B,IAAI,QAAQ,yBAAyB,CAAC,YAAY;AAAA,EAChD,IAAI;AAAA,IACF,OAAO,mBAAmB,OAAO;AAAA,IACjC,MAAM;AAAA,IACN,OAAO;AAAA;AAAA,CAEV;AAuBI,IAAM,WAAW,CAAC,WAA4D;AAAA,EACnF,SAAS,MAAM,YAAY,aAAa,MAAM,YAAY,KAAK,YAAY,MAAM;AAAA,EACjF,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,KACpC,MAAM,SAAS,kBAAkB,EAAE,QAAQ,MAAM,WAAW,OAAO,MAAM,UAAU,IAAI,CAAC;AAC9F;AA8BA,IAAM,WAAW,CAAC,WAAgD;AAAA,EAChE,UAAU,MAAM;AAAA,EAChB,WAAW,IAAI,MAAM,SAAS;AAAA,EAC9B,MAAM,MAAM;AAAA,KACR,MAAM,SAAS,kBAAkB,EAAE,OAAO,SAAS,MAAM,KAAK,EAAE,IAAI,CAAC;AAC3E;AAEO,IAAM,QAAO,CAAC,UAAuB;AAAA,EAC1C,MAAM,SAAS,SAAS,KAAK;AAAA,EAC7B,YAAY,QAAQ,UAAU,OAAO,QAAQ,SAAS,KAAK,CAAC,GAAG;AAAA,IAC7D,IAAI,UAAU;AAAA,MAAW,OAAO,UAAU;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAiBF,IAAM,YAAY,CAAC,UACxB,OAAO,QAAQ,SAAS,KAAK,CAAC,EAC3B,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,YAAY,MAAM;;;ADtBtB,IAAM,gBAAgB,WAAwB,gBAAgB;AAErE,IAAM,YAAW,YAA2C;AAAA,EAC1D,YAAY,CAAC,MAAM,UAAU;AAAA,IAO3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,UAAU,KAAK,KAAK,WAAW;AAAA,MAC/B,SAAS,KAAK,KAAK,UAAU;AAAA,MAO7B,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,MACpC,QAAQ,SAAS,KAAK,SAAS;AAAA,MAC/B,OAAO,SAAS,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW,SAAS;AAAA,MAC7E,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,MAC3B,WAAW,IAAI,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,SAAS;AAAA,MACpF,MAAM,KAAK,KAAK,SAAS,MAAM,IAAI;AAAA,MACnC,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,MAClC,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAGlB,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAa3D,UAAU,EAAE,QAAQ,8BAA8B,QAAQ,mCAAmC;AAAA,EAC7F,SAAS,CAAC,YAAY,UACpB,WAAW,cAAc,IAAI,MAAM,SAAS,KAC5C,WAAW,aAAa,MAAM,YAC9B,WAAW,YAAY,YAAY,MAAM,WAAW,EAAE,KACtD,WAAW,aAAa,MAAM,YAAY,UACzC,MAAM,SAAS,mBACb,WAAW,UAAU,SAAS,MAAM,KAAK,KACxC,WAAW,YAAY,MAAM,WAAW;AAAA,EAE9C,MAAM,CAAC,UAAU,oBAAoB,MAAM;AAAA,EAO3C,YAAY,CAAC,UAAU;AAAA,IACrB,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7B,MAAM,SAAS,MAAK,KAAK;AAAA,IACzB,OAAO,WAAW,QAAQ,KAAK;AAAA;AAEnC,CAAC;AASM,IAAM,wBAAwB,MAC1B,kBAAO,eAAsB,iBAAQ,cAAc,SAAS,GAAG,SAAQ,CAAC,CAAC;;AErNpF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACvBA;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,YAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,iBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,gBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,cAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,cAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,aAAW,uBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,aAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,uBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,aACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAaK,IAAM,sBAAsB,CAAC,KAAa,eACxC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,eAAM;AAAA,CACtE;;;AFxFI,IAAM,eAAe,CAAC,QACpB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,uBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,uBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AIjG9B,oBAAS;AACT;AAcO,IAAM,aAAa,CACxB,KACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,iBAAiB,IAAI,KAAK,IAAI,UAAU;AAAA,EAChE,IAAI,aAAa;AAAA,IAAU,OAAO;AAAA,EAClC,IAAI,aAAa,WAAW;AAAA,IAC1B,OAAc,oBACZ,GAAG,IAAI,mFACL,iFACJ;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,WAAW,CAAC,WACT,YACE,oBACL,GAAG,IAAI,+EACL,IAAI,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM,kCAChE,GACA,KACF;AAAA,EACF,OAAO,OAAO,SAAQ,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,CAChF;AAOI,IAAM,YAAY,CACvB,KACA,OACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,UAAU,aAAa,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EAC5D,QAAQ,OAAO,WAAW,KAAK,QAAO,KAAK,QAAQ,SAAQ,KAAK;AAAA,CACjE;;;AC3DI,IAAM,QAAQ,CAAC,OAAe,eACnC,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,IAAI,CAAC,SAA2B;AAAA,EAC/B,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,IAAI,OAAO;AAAA,IAAI,OAAO,CAAC,cAAc,MAAM,eAAe,YAAY,KAAK,IAAI;AAAA,EAC/E,OAAO,CAAC,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,CAC5D;AAOL,IAAM,WAAuE;AAAA,EAC3E,KAAK,EAAE,cAAc,IAAI;AAAA,EACzB,UAAU,EAAE,cAAc,KAAK,MAAM,KAAK,QAAQ,KAAK,OAAO,KAAK,SAAS,IAAI;AAAA,EAChF,KAAK,EAAE,UAAU,KAAK,gBAAgB,KAAK,WAAW,KAAK,MAAM,OAAO;AAAA,EACxE,QAAQ,EAAE,QAAQ,KAAK,WAAW,KAAK,OAAO,KAAK,WAAW,KAAK,IAAI,KAAK,QAAQ,IAAI;AAC1F;AAGA,IAAM,QAAQ,IAAI,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,OAAO,IAAI,IAAI,CAAC,SAAS,cAAc,CAAC;AAG9C,IAAM,iBAAiB,CAAC,KAAa,UAAkB;AAAA,EACrD,IAAI,MAAM,IAAI,GAAG;AAAA,IAAG,OAAO,eAAe,KAAK;AAAA,EAC/C,IAAI,KAAK,IAAI,GAAG;AAAA,IACd,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG;AAAA,EAClF,IAAI,QAAQ;AAAA,IAAU,OAAO,MAAM,YAAY;AAAA,EAC/C,OAAO;AAAA;AAIF,IAAM,YAAY,CACvB,OACA,QACA,eACwB;AAAA,EACxB,MAAM,WAAW,SAAS,WAAW,CAAC;AAAA,EACtC,MAAM,MAAM,IAAI;AAAA,EAChB,YAAY,KAAK,QAAQ,MAAM,OAAO,UAAU,GAAG;AAAA,IACjD,MAAM,YAAY,eAAe,KAAK,GAAG;AAAA,IACzC,IAAI,SAAS,SAAS;AAAA,MAAW,IAAI,IAAI,KAAK,SAAS;AAAA,EACzD;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,UAAU,CAAC,MAA2B,UACjD,KAAK,SAAS,MAAM,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,WAAW,MAAM,IAAI,GAAG,MAAM,KAAK;AAGjF,IAAM,aAAa,CAAC,UACzB,CAAC,GAAG,KAAG,EACJ,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,EACvC,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,WAAW,CAAC,OAA0B,OAA0B,CAAC,MAC5E,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,MAAI,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,MAAI,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EACxF,IAAI,CAAC,QAAQ,GAAG,OAAO,MAAI,IAAI,GAAG,KAAK,IAAI,EAC3C,KAAK,GAAG;AAMN,IAAM,UAAU,CAAC,UAAkB,SAAiB;AAAA,EACzD,MAAM,OAAO,UAAU,UAAU,KAAK;AAAA,EACtC,MAAM,OAAO,UAAU,MAAM,KAAK;AAAA,EAClC,IAAI,CAAC,KAAK,IAAI,QAAQ;AAAA,IAAG,KAAK,OAAO,QAAQ;AAAA,EAC7C,OAAO,EAAE,MAAM,KAAK;AAAA;AAQf,IAAM,WAAW,CAAC,UAAkB,SAA6B;AAAA,EACtE,MAAM,OAAO,IAAI,IAAI,MAAM,QAAQ,CAAC;AAAA,EACpC,MAAM,MAAM,SAAS,YAAY,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,IAAI,QAAQ;AAAA,EAC9E,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,QAAQ;AAAA,IAAW,KAAK,IAAI,UAAU,GAAG;AAAA,EACpE,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC;AAAA;AAIzB,IAAM,SAAS,CAAC,UACrB,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,SAAS,EAAE,OAAO,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,EAC5D,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,EAC9B,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,cAAc,CAAC,UAC1B,MACG,MAAM,SAAS,EACf,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,GAAG;AAMN,IAAM,kBAAkB,CAAC,UAAkB,MAAM,QAAQ,QAAQ,EAAE;AAGnE,IAAM,eAA8E;AAAA,EACzF,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,OAAO;AAAA,EACP,UAAU;AAAA,EACV,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,SAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AACP;AAGO,IAAM,YAAiC,IAAI,IAAI;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,kBAAoD;AAAA,EAC/D,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,KAAK;AACP;AAGO,IAAM,aAAa,CAAC,KAAa,UAA0B;AAAA,EAChE,MAAM,QAAO,aAAa;AAAA,EAC1B,IAAI,UAAS;AAAA,IAAU,OAAO,OAAO,OAAO,KAAK,CAAC;AAAA,EAClD,IAAI,UAAS;AAAA,IAAQ,OAAO,eAAe,KAAK;AAAA,EAChD,IAAI,QAAQ;AAAA,IAAe,OAAO,gBAAgB,KAAK;AAAA,EACvD,IAAI,QAAQ;AAAA,IAAY,OAAO,WAAW,UAAU,OAAO,UAAU,CAAC;AAAA,EACtE,IAAI,QAAQ,gBAAgB,QAAQ;AAAA,IAAgB,OAAO,YAAY,KAAK;AAAA,EAC5E,IAAI,QAAQ;AAAA,IAAW,OAAO,eAAe,OAAO,OAAO;AAAA,EAC3D,IAAI,QAAQ;AAAA,IAAQ,OAAO,OAAO,KAAK;AAAA,EACvC,OAAO;AAAA;;;ACrFF,IAAM,WAAgC,IAAI,IAAI;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,UAAU;AAAA,EACrB,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AACP;AAKO,IAAM,aAAa,CAAC,QAA8D;AAAA,EACvF,MAAM,QAAQ,6BAA6B,KAAK,GAAG;AAAA,EACnD,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,MAAM,SAAS,MAAM;AAAA,EACrB,MAAM,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC7B,OAAO,QAAQ,QAAQ,UAAU,CAAC,QAAQ,KAAK,IAAI;AAAA;AAI9C,IAAM,aAAkC,IAAI,IAAI;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,gBAAgB,CAAC,OAAiB,QAC5C,MAA6C;AAGzC,IAAM,eAAe,CAAC,UAC3B,OAAO,KAAK,KAAK,EACd,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,GAAG,KAAK,cAAc,OAAO,GAAG,MAAM,SAAS,EAC/E,KAAK;AAGH,IAAM,YAAY,CAAC,UACxB,UAAU,OAAO,MAAM,UAAU,QAAQ,MAAM,OAAO,KAAK;AAStD,IAAM,eAAe,CAAC,QAC3B,aAAa,SAAS,aACtB,QAAQ,kBACR,QAAQ,YACR,WAAW,GAAG,MAAM;AAUf,IAAM,eAAe,CAAC,SAA0D;AAAA,EACrF,MAAM,MAA8B,CAAC;AAAA,EACrC,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,CAAC,aAAa,GAAG,KAAK,SAAS,IAAI,GAAG;AAAA,MAAG;AAAA,IAC7C,IAAI,UAAU,QAAQ,UAAU,aAAa,OAAO,UAAU;AAAA,MAAU;AAAA,IACxE,IAAI,OAAO,UAAU,KAAK;AAAA,EAC5B;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,YAAY,CAAC,SAA4C;AAAA,EACpE,MAAM,MAAM,KAAK;AAAA,EACjB,IAAI,CAAC,MAAM,QAAQ,GAAG;AAAA,IAAG,OAAO,CAAC;AAAA,EACjC,OAAO,IACJ,IAAI,CAAC,SAAmB,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,EAAE,IAAI,EAAG,EACnE,OAAO,CAAC,QAAQ,QAAQ,EAAE;AAAA;;;AC9L/B,IAAM,WAAW;AAEjB,IAAM,QAA0C;AAAA,EAC9C,GAAG,QAAQ;AAAA,EACX,GAAG;AAAA,EACH,GAAG,QAAQ;AAAA,EACX,GAAG,QAAQ;AACb;AAGO,IAAM,YAAY,CAAC,UAAqC;AAAA,EAC7D,MAAM,QAAQ,6BAA6B,KAAK,MAAK,KAAK,CAAC;AAAA,EAC3D,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,OAAO,KAAK,MAAM,OAAO,MAAM,EAAE,KAAK,MAAM,OAAO,YAAY,IAAK,MAAM,MAAM,OAAO,EAAG;AAAA;AAkBrF,IAAM,cAAc,CAAC,UAAyB;AAAA,EACnD,OAAO,SAAS,MAAM,OAAM,QAAQ;AAAA,EACpC,MAAM,OAAO,QAAQ,OAAO,WAAW,MAAM,KAAK;AAAA,EAClD,MAAM,UAAU,UAAU,OAAM,UAAU,QAAQ;AAAA,EAClD,QAAQ,OAAO,QAAQ;AAAA,EACvB,MAAM,WAAW,QAAQ,IAAI,MAAM;AAAA,EACnC,QAAQ,OAAO,MAAM;AAAA,EACrB,MAAM,QAAQ,SAAS,KAAK,IAAI;AAAA,EAChC,IAAI,UAAU,MAAM;AAAA,IAClB,MAAM,MAAM,GAAG,MAAM,MAAM;AAAA,IAC3B,OAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,MAAM,UAAU,GAAG;AAAA,MACnB,UAAU;AAAA,MACV,QAAQ,MAAM,MAAM;AAAA,MACpB,SAAS;AAAA,IACX;AAAA,EACF;AAAA,EACA,MAAM,OAAO,aAAa,YAAY,YAAY,UAAU,QAAQ;AAAA,EACpE,IAAI,KAAK,WAAW,GAAG,GAAG;AAAA,IACxB,MAAM,QAAO,KAAK,WAAW,OAAO,IAAI,WAAW;AAAA,IACnD,OAAO,EAAE,aAAM,SAAS,MAAM,UAAU,QAAQ,MAAM,SAAS,GAAG;AAAA,EACpE;AAAA,EACA,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE;AAAA,IAC3C,SAAS,OAAO,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC;AAAA,EAC7C;AAAA;AAaK,IAAM,aAAa,CAAC,WAAmB,OAAO,SAAS,UAAU,OAAO,SAAS;AAOxF,IAAM,UAAU,CAAC,MAAc,aAAqB;AAAA,EAClD,MAAM,QAAQ,CAAC,GAAG,KAAK,UAAU,KAAK,SAAS;AAAA,EAC/C,YAAY,KAAK,UAAU,SAAS;AAAA,IAAS,MAAM,KAAK,GAAG,OAAO,OAAO;AAAA,EACzE,IAAI,KAAK,aAAa;AAAA,IAAW,MAAM,KAAK,QAAQ,KAAK,UAAU;AAAA,EACnE,OAAO,MAAM,KAAK,GAAG;AAAA;AAGhB,IAAM,cAAc,CAAC,KAAa,UAAkB,SAAgC;AAAA,EACzF,MAAM,OAAO,YAAY,QAAQ;AAAA,EACjC,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,IAAI,WAAW,IAAI,KAAK,WAAW,IAAI,GAAG;AAAA,IACxC,MAAM,QACJ,KAAK,SAAS,KAAK,QAAQ,KAAK,WAAW,KAAK,UAAU,QAAQ,KAAK,SAAS,KAAK,OAAO;AAAA,IAC9F,OAAO,QAAO,CAAC,IAAI,EAAE,UAAU,KAAK;AAAA,EACtC;AAAA,EACA,IAAI,KAAK,WAAW,KAAK,QAAQ;AAAA,IAC/B,OAAO;AAAA,MACL,QACE,GAAG,yBAAyB,KAAK,uBAAuB,KAAK,0BAC7D;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI,KAAK,SAAS,YAAY,KAAK,YAAY,KAAK,SAAS;AAAA,IAC3D,OAAO;AAAA,MACL,QACE,GAAG,wBAAwB,KAAK,2BAA2B,KAAK,+BAChE;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI;AAAA,EACJ,IAAI,KAAK,SAAS,aAAa,KAAK,SAAS,aAAa,KAAK,SAAS,KAAK,MAAM;AAAA,IACjF,IAAI,KAAK,OAAO,KAAK,MAAM;AAAA,MACzB,OAAO;AAAA,QACL,QACE,GAAG,iBAAiB,KAAK,YAAY,kCACrC,GAAG,KAAK,YAAY,uEACpB;AAAA,MACJ;AAAA,IACF;AAAA,IACA,SAAS,KAAK;AAAA,EAChB;AAAA,EACA,MAAM,MAAM,QAAQ,KAAK,SAAS,KAAK,OAAO,IAAI,YAAY,QAAQ,MAAM,IAAI;AAAA,EAChF,OAAO;AAAA,OACD,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,OAC/B,WAAW,YAAY,CAAC,IAAI,EAAE,OAAO;AAAA,EAC3C;AAAA;;;ACnGF,IAAM,QAAO,CAAC,UACZ,UAAU,aAAa,UAAU,OAAO,YAAY,UAAU,KAAK;AAG9D,IAAM,WAAW,CAAC,MAAc,KAAa,OAAe,QACjE,GAAG,QAAQ,kFACX,aAAa,OAAO,IAAI,KAAK,UAAU,KAAK,YAAY,QAAQ,KAAK,QAAQ,gBAC7E;AAGF,IAAM,cAAc,CAAC,UACnB,IAAI,IACF,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,QAAQ,UAAU,QAAQ,eAAe,KAAK,CAAC,CAAC,CAC3F;AASK,IAAM,mBAAmB,CAC9B,MACA,MACA,iBACY;AAAA,EACZ,IAAI,CAAC;AAAA,IAAc,OAAO;AAAA,EAC1B,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,IAAI,SAAS;AAAA,IAAW,OAAO,EAAE,KAAK,SAAS,KAAM,KAAK,SAAS,KAAK,KAAK,IAAI,SAAS;AAAA,EAC1F,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,MAAM,OAAO,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACrD,OAAO,CAAC,GAAG,IAAI,EAAE,KACf,CAAC,QAAQ,QAAQ,cAAc,KAAK,IAAI,GAAG,KAAK,SAAS,KAAK,IAAI,GAAG,KAAK,GAC5E;AAAA;AAGK,IAAM,aAAa,CAAC,iBACzB,eAAe,kCAAkC;AAE5C,IAAM,QAAQ,CAAC,OAAiB,SAA6C;AAAA,EAClF,MAAM,MAA8B,CAAC;AAAA,EACrC,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,SAA2C,CAAC;AAAA,EAClD,MAAM,SAAmB,CAAC;AAAA,EAC1B,MAAM,QAAQ,IAAI;AAAA,EAClB,MAAM,eAAe,KAAK,KAAK,iBAAiB,KAAK;AAAA,EAErD,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,OAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IAChD,MAAM,OAAO,MAAK,KAAK,IAAI;AAAA,IAC3B,MAAM,UAAU,WAAW,GAAG;AAAA,IAE9B,IAAI,QAAQ,gBAAgB;AAAA,MAC1B,IAAI,eAAe,IAAI,MAAM,eAAe,QAAQ,GAAG,GAAG;AAAA,QACxD,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KACL,sBAAsB,QAAQ,iBAAiB,6CAC7C,uFACJ;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,IAEA,IAAI,QAAQ,YAAY,UAAU,OAAO,MAAM;AAAA,MAC7C,IAAI,SAAS,IAAI;AAAA,QACf,IAAI,SAAS;AAAA,UAAW;AAAA,QACxB,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KACL,GAAG,4EACL;AAAA,MACF,EAAO,SAAI,SAAS,WAAW;AAAA,QAC7B,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,WAAW,YAAY,IAAI,CAAC,GAAG;AAAA,UACjC,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,+BAA+B,CAAC;AAAA,QAC9E,EAAO;AAAA,cAAI,OAAO;AAAA,MACpB,EAAO;AAAA,QACL,MAAM,UAAU,YAAY,KAAK,MAAM,IAAI;AAAA,QAC3C,IAAI,QAAQ,WAAW;AAAA,UAAW,OAAO,KAAK,QAAQ,MAAM;AAAA,QAC5D,IAAI,QAAQ,aAAa,MAAM;AAAA,UAC7B,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,+BAA+B,CAAC;AAAA,QAC9E;AAAA,QACA,IAAI,QAAQ,QAAQ;AAAA,UAAW,IAAI,OAAO,QAAQ;AAAA,QAClD,IAAI,QAAQ,WAAW;AAAA,UAAW,OAAO,KAAK,EAAE,MAAM,KAAK,MAAM,QAAQ,OAAO,CAAC;AAAA,QACjF,IAAI,OAAO,KAAK,OAAO,EAAE,SAAS;AAAA,UAAG,MAAM,IAAI,GAAG;AAAA;AAAA,MAEpD;AAAA,IACF;AAAA,IAEA,IAAI,UAAU,OAAO,OAAO;AAAA,MAC1B,MAAM,QAAO,SAAS,KAAK,SAAS,YAAY,SAAS,aAAa,QAAQ,MAAM,IAAI;AAAA,MACxF,IAAI,CAAC,OAAM;AAAA,QACT,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,qBAAqB,CAAC;AAAA,MACpE;AAAA,MACA;AAAA,IACF;AAAA,IAEA,IAAI,UAAU,OAAO,OAAO;AAAA,MAC1B,IAAI,SAAS,IAAI;AAAA,QACf,IAAI,SAAS,WAAW;AAAA,UACtB,MAAM,IAAI,GAAG;AAAA,UACb,MAAM,KAAK,GAAG;AAAA,QAChB;AAAA,MACF,EAAO,SAAI,SAAS,WAAW;AAAA,QAC7B,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,OAAO;AAAA,MACb,EAAO;AAAA,QACL,MAAM,OAAO,QAAQ,MAAM,IAAI;AAAA,QAC/B,IAAI,CAAC,QAAQ,KAAK,MAAM,KAAK,IAAI,GAAG;AAAA,UAClC,MAAM,IAAI,GAAG;AAAA,UACb,IAAI,OAAO,SAAS,MAAM,IAAI;AAAA,QAChC;AAAA;AAAA,MAEF;AAAA,IACF;AAAA,IAEA,IAAI,CAAC,aAAa,GAAG,GAAG;AAAA,MACtB,MAAM,IAAI,GAAG;AAAA,MACb,OAAO,KAAK,GAAG,8CAA8C;AAAA,MAC7D;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,SAAS,KAAK,KAAK,WAAW,KAAK,IAAI;AAAA,IACtD,MAAM,UAAU,QAAQ,gBAAgB;AAAA,IACxC,MAAM,MAAM,YAAY,YAAY,KAAK,WAAW,KAAK,OAAO;AAAA,IAChE,IAAI,WAAW;AAAA,MAAK;AAAA,IACpB,MAAM,IAAI,GAAG;AAAA,IAEb,MAAM,OAAO,QAAQ,aAAa,SAAS;AAAA,IAC3C,IAAI,QAAQ,cAAc,iBAAiB,QAAQ,IAAI,QAAQ,WAAW,YAAY,GAAG;AAAA,MACvF,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,WAAW,YAAY,CAAC,CAAC;AAAA,IACvE,EAAO,SAAI,SAAS,MAAM,UAAU,IAAI,GAAG,GAAG;AAAA,MAC5C,MAAM,KAAK,GAAG;AAAA,IAChB,EAAO,SAAI,SAAS,IAAI;AAAA,MACtB,OAAO,KAAK,GAAG,2DAA2D;AAAA,IAC5E,EAAO;AAAA,UAAI,OAAO;AAAA,EACpB;AAAA,EACA,OAAO,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,QAAQ,OAAO;AAAA;AAIhE,IAAM,UAAU,CAAC,MAAc,SAC7B,WAAW,UAAU,MAAM,OAAO,MAAM,CAAC,MAAM,WAAW,UAAU,MAAM,OAAO,MAAM,CAAC;;;ACtK1F,IAAM,iBAAiB,CAAC,KAAa,UACnC,GAAG,QAAQ,kFACX,gGACA;AAGK,IAAM,iBAAiB,CAAC,UAA8B;AAAA,EAC3D,MAAM,SAAmB,CAAC;AAAA,EAC1B,IAAI,MAAM,eAAe,aAAa,MAAM,eAAe,IAAI;AAAA,IAC7D,OAAO,KACL,MAAM,OAAO,MAAM,IAAI,uBAAuB,MAAM,sCAClD,kFACJ;AAAA,EACF;AAAA,EACA,MAAM,eAAe,MAAM,iBAAiB,YAAY,OAAO,KAAK,MAAM,YAAY;AAAA,EACtF,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,QAAQ,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IACjD,MAAM,SAAS,WAAW,GAAG,IAAI;AAAA,IAGjC,IAAI,CAAC,aAAa,GAAG;AAAA,MAAG,OAAO,KAAK,GAAG,8CAA8C;AAAA,IACrF,IAAI,UAAU;AAAA,MAAI;AAAA,IAClB,IAAI,WAAW;AAAA,MAAO,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,qBAAqB,CAAC;AAAA,IACzF,MAAM,SAAS,WAAW,QAAQ,QAAQ,WAAW,YAAY,KAAK,IAAI;AAAA,IAC1E,IAAI,WAAW,aAAa,WAAW,MAAM,GAAG;AAAA,MAC9C,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,+BAA+B,CAAC;AAAA,IAC/E;AAAA,IACA,IAAI,QAAQ,SAAS;AAAA,MAAU,OAAO,KAAK,eAAe,KAAK,KAAK,CAAC;AAAA,IACrE,IAAI,QAAQ,cAAc,iBAAiB,IAAI,OAAO,YAAY,GAAG;AAAA,MACnE,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,WAAW,YAAY,CAAC,CAAC;AAAA,IACxE;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,cAAa,CAAC,UAA4C;AAAA,EACrE,MAAM,OAA+B,EAAE,MAAM,OAAO,MAAM,IAAI,EAAE;AAAA,EAChE,IAAI,MAAM,eAAe;AAAA,IAAW,KAAK,gBAAgB,MAAM;AAAA,EAC/D,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,UAAU,MAAM,KAAK;AAAA,EACpE,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,QAAQ,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IACjD,IAAI,UAAU;AAAA,MAAI;AAAA,IAClB,KAAK,OAAO,QAAQ,aAAa,WAAW,KAAK,KAAK,IAAI;AAAA,EAC5D;AAAA,EACA,OAAO;AAAA;;;ACnET,IAAM,QAAQ,CAAC,MAAe,QAAyB;AAAA,EACrD,MAAM,QAAkB,KAAiC;AAAA,EACzD,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,QAAQ;AAAA;AAcnE,IAAM,mBAAmB,CAC9B,MACA,MACA,WACa;AAAA,EACb,MAAM,MAAM,QAAQ,QAAQ,KAAK;AAAA,EACjC,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EAC/B,MAAM,WAAW,MAAM,MAAM,YAAY;AAAA,EACzC,MAAM,UAAoB,CAAC;AAAA,EAC3B,IAAI,SAAS,aAAa,SAAS,KAAK;AAAA,IACtC,QAAQ,KACN,SAAS,OAAO,GAAG,QAAQ,OAAO,IAAI,iDACpC,2DACJ;AAAA,EACF;AAAA,EACA,IAAI,aAAa,aAAa,KAAK,eAAe,aAAa,aAAa,KAAK,YAAY;AAAA,IAC3F,QAAQ,KAAK,2EAA2E;AAAA,EAC1F;AAAA,EACA,OAAO;AAAA;;;ACtBT;;;ACKA;AAWO,IAAM,WAAW,CACtB,OACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW,OAAO;AAAA,EACvC,MAAM,aAAa,OAAO,mBAAmB,MAAM,KAAK,MAAM,UAAU;AAAA,EACxE,IAAI,eAAe,aAAa,WAAW,aAAa;AAAA,IAAM,OAAO;AAAA,EACrE,IAAI,WAAW,SAAS,aAAa,WAAW,SAAS;AAAA,IAAM,OAAO;AAAA,EACtE,OAAO,EAAE,OAAO,WAAW,OAAO,SAAQ,WAAW,KAAK,CAAC;AAAA,CAC5D;;;ACpBH;;;ACkBA;AA2BA,IAAM,aAAa,CAAC,QAAmB,SAC9B,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,SAAS;AAAA,EAQtB,MAAM,aAAa,OAAO,OAAO,QAAQ,MAAM;AAAA,EAC/C,MAAM,WAAY,OAAO,gBAAgB,QAAQ,YAAY,OAAO,IAAI;AAAA,EACxE,OAAO,KAAK,SAAS,OAAO;AAAA,CAC7B;AAYI,IAAM,eAAe,CAAC,SAAiB;AAAA,EAC5C,IAAI,SAAS;AAAA,IAAI,OAAO;AAAA,EACxB,MAAM,UAAU,KACb,MAAM;AAAA,CAAI,EACV,OACC,CAAC,UACE,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,MAC5C,CAAC,KAAK,WAAW,KAAK,KACtB,CAAC,KAAK,WAAW,KAAK,CAC1B,EAAE;AAAA,EACJ,OAAO,KAAK,IAAI,SAAS,CAAC;AAAA;AAIrB,IAAM,eAAe,CAAC,QAAmB,SAC9C,WAAW,QAAQ,IAAI,EAAE,KAAY,aAAI,YAAY,CAAC;AAmBxD,IAAM,gBAAgB,CAAC,WACrB,IAAiB,QAAQ,QAAQ,OAAO,gBAAgB,EAAE,KACjD,aAAI,CAAC,SAAS;AAAA,EACnB,MAAM,MAAM,QAAQ,CAAC;AAAA,EACrB,MAAM,UAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,SAAS,SAAS;AAAA,EACxD,OAAO;AAAA,IACL,SAAS,IACN,OAAO,CAAC,QAAQ,IAAI,SAAS,UAAU,CAAC,KAAK,IAAI,MAAM,CAAC,EACxD,IAAI,CAAC,QAAQ,KAAK,IAAI,MAAM,WAAW,CAAC;AAAA,IAC3C,SAAS,YAAY,YAAY,OAAO,KAAK,QAAQ,OAAO;AAAA,EAC9D;AAAA,CACD,CACH;AAgBK,IAAM,iBAAiB,CAAC,WAC7B,cAAc,MAAM,EAAE,KACb,aAAI,CAAC,WACV,OAAO,WAAW,OAAO,QAAQ,WAAW,IACxC,YACA,WAAW,OAAO,OAAO,OAAO,cAAc,OAAO,QAAQ,KAAK,IAAI,IAC5E,CACF;AAMK,IAAM,cACX;AACF,IAAM,gBAAgB;AAStB,IAAM,WAAW;AAsBV,IAAM,YAAY,CACvB,QACA,YACA,MACA,MAEA,WAAmB,aAEZ,aAAI,UAAU,GAAG;AAAA,EAUtB,MAAM,OAAO,SAAS,cAAc;AAAA,EACpC,SAAS,UAAU,EAAG,UAAU,UAAU,WAAW,GAAG;AAAA,IAWtD,MAAM,SAAS,OAAO,QAAoB,QAAQ,YAAY,OAAO,IAAI,EAAE,KAClE,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CACtC;AAAA,IACA,IAAI,WAAW;AAAA,MAAW,OAAO;AAAA,IACjC,IAAI,OAAO,WAAW;AAAA,MAAW,OAAO,KAAK,OAAO,YAAY,4BAA4B;AAAA,IAC5F,OAAc,eAAM,UAAU;AAAA,EAChC;AAAA,EACA,OAAO;AAAA,CACR;;;AD1MI,MAAM,wBAAwB,MAAM;AAAA,EACvB,OAAO;AAC3B;AAKO,IAAM,YAAY,CAAC,UAAoB,SAAS,MAAM,YAAY,OAAO,MAAM,IAAI;AAgB1F,IAAM,gBAAgB;AAAA,EACpB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAGA,IAAM,eAAe;AACrB,IAAM,aAAa;AAEnB,IAAM,gBAAgB,CAAC,UACrB,iBAAiB,YAAY,MAAM,WAAW;AAMzC,IAAM,WAAW,CAAC,UAChB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO,IACpB,MAAM,QACN,QACA,OACA,GAAG,UAAU,KAAK,UACpB,EAAE,KACO,aAAI,CAAC,UAAU,EAAE,MAAM,OAAO,UAAU,EAAE,GAC1C,iBAAQ,eAAe,CAAC,UAAiB,iBAAQ,EAAE,MAAM,WAAW,MAAM,CAAC,CAAC,CACrF;AAAA,EACA,IAAI,OAAO,SAAS,aAAa,OAAO,SAAS;AAAA,IAAM,OAAO,OAAO;AAAA,EACrE,MAAM,OAAO,OAAO,IAClB,MAAM,QACN,QACA,OACA,2BACF;AAAA,EAGA,MAAM,SAAS,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,OAAO,IAAI,IAAI,MAAM,MAAM,IAAI;AAAA,EACxE,IAAI,UAAU,aAAa,MAAM,SAAS,MAAM,QAAQ,MAAM,SAAS,OAAO;AAAA,IAC5E,OAAO,OAAc,cACnB,OAAO,SACL,IAAI,gBAAgB,MAAM,OAAO,MAAM,IAAI,wCAAwC,CACvF;AAAA,EACF;AAAA,EACA,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,cACnB,IAAI,gBACF,QAAQ,OAAO,MAAM,IAAI,UAAU,KAAK,MAAM,MAAM,OAAO,UACzD,GAAG,KAAK,MAAM,MAAM,GAAG,yBAAyB,MAAM,iCACtD,oFACJ,CACF;AAAA,EACF;AAAA,EACA;AAAA,CACD;AAEI,IAAM,gBAAe,CAAC,OAAiB,UAAkD;AAAA,EAC9F,QAAQ,aAAa,IAAI;AAAA,EACzB,MAAM,MAAM;AAAA,EACZ,SAAS,UAAU,IAAI;AAAA,EACvB,MAAM,MAAM;AACd;AAGA,IAAM,OAAO,CACX,OACA,QACA,MACA,MACA,OACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,KAAK,OAAO,QAAgB,MAAM,QAAQ,YAAY,QAAQ,MAAM,IAAI,CAAC;AAAA,EACtF,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAc,cACnB,IAAI,gBACF,GAAG,qFACL,CACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAO,UAAU,MAAM,QAAQ,YAAY,MAAM,MAAM,MAAM,KAAK;AAAA,EAC/E,IAAI,SAAS,MAAM;AAAA,IACjB,OAAO,OAAc,cACnB,IAAI,gBACF,GAAG,cAAc,eAAe,kCAAkC,MAAM,gBACtE,GAAG,6CACP,CACF;AAAA,EACF;AAAA,CACD;AAGI,IAAM,cAAc,CAAC,UACnB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,YAAW,KAAK;AAAA,EAQ7B,OAAO,UAAU,cAAc,QAAQ,MAAM,IAAI;AAAA,EACjD,OAAO,OAAO,KACZ,OACA,QACA,SAAS,MAAM,YACf,aAAa,OAAO,MAAM,IAAI,KAC9B,cACA,IACF;AAAA,CACD;AAYI,IAAM,cAAc,CAAC,OAAiB,QAAmB,WACvD,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,KAAK,OAAO,GAAG,EAAE,SAAS,KAAK,OAAO,MAAM,SAAS,GAAG;AAAA,IACjE,MAAM,OAAO,WACX,KAAK,OAAO,QAAS,WAAW,KAAK,CAAC,IAAI,EAAE,OAAO,EAAG,GACtD,OAAO,KACT;AAAA,IAEA,OAAO,UAAU,cAAc,QAAQ,MAAM,KAAK;AAAA,IAClD,OAAO,IAAI,MAAM,QAAQ,aAAa,OAAO,GAAG,UAAU,KAAK,YAAY,IAAI;AAAA,EACjF;AAAA,EACA,WAAW,QAAQ,OAAO,QAAQ;AAAA,IAChC,MAAM,QAAQ,EAAE,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK;AAAA,IAGjD,OAAO,UAAU,cAAc,QAAQ,OAAO,IAAI;AAAA,IAClD,OAAO,KACL,OACA,OACA,GAAG,UAAU,KAAK,YAClB,QAAQ,KAAK,cAAc,OAAO,MAAM,IAAI,QAAQ,KAAK,QACzD,YACA,KACF;AAAA,EACF;AAAA,CACD;AAYI,IAAM,eAAe,CAAC,OAAiB,aACrC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,SAAS,KAAK;AAAA,EAClC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,MAAM,UAAU,IAAI,EAAE;AAAA,EACpC,IAAI,MAAM,SAAS,GAAG;AAAA,IACpB,OAAO,OAAc,cACnB,IAAI,gBACF,cAAc,OAAO,MAAM,IAAI,mBAAmB,MAAM,qCACtD,gBAAgB,MAAM,KAAK,IAAI,qDAC/B,8EACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,KAAK,OAAO,UAAU,UAAU,KAAK,GAAG,cAAc,OAAO,MAAM,IAAI,KAAK,UAAU;AAAA,CAC9F;;;AFpNI,IAAM,kBAAkB,CAAC,OAAiB,UAC/C,MAAM,OAAO,MAAM,IAAI,QAAQ,MAAM,kCAAkC,MAAM,KAAK,IAAI,WACtF,gGACA,+FACA;AAMK,IAAM,qBAAqB,CAChC,OACA,OACA,MACA,WAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,MAAM,WAAW;AAAA,IAAG;AAAA,EAC/B,MAAM,WAAU,CAAC,aACR,cAAK,MAAM,MAAM,UAAsB,IAAI,EAAE,MAAM,WAAW,CAAC;AAAA,EACxE,IAAI,EAAE,OAAO,SAAS,OAAO,QAAO;AAAA,IAAI;AAAA,EACxC,OAAO,OAAc,cAAK,IAAI,gBAAgB,gBAAgB,OAAO,OAAO,KAAK,CAAC,CAAC;AAAA,CACpF;;;AZeI,IAAM,aAAa,WAAqB,eAAe,EAAE,sBAAsB,SAAS,CAAC;AAKhG,IAAM,UAAU,CAAC,YACR,cAAK,IAAI,gBAAgB,QAAQ,KAAK;AAAA,CAAI,CAAC,CAAC;AAQrD,IAAM,OAAO,CAAC,OAAiB,MAAuB,SAC7C,aAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,WAAW;AAAA,EACnB,MAAM,YAAW,iBAAiB,MAAM,MAAM,MAAM;AAAA,EACpD,IAAI,UAAS,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,SAAQ;AAAA,EACvD,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,IAAI,CAAC,aAAW,IAAI;AAAA,IAAG;AAAA,EACvB,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,EAKjC,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,WAAW,eAAe,IAAI;AAAA,IACpC,IAAI,SAAS,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,QAAQ;AAAA,IACvD,OAAc,oBACZ,eAAe,KAAK,QAAQ,OAAO,KAAK,IAAI,6CAC1C,6EACJ;AAAA,IACA,OAAO,EAAE,QAAQ,SAAS;AAAA,EAC5B;AAAA,EACA,MAAM,SAAS,MAAM,MAAM,IAAI;AAAA,EAC/B,OAAO,mBAAmB,OAAO,MAAM,MAAM,MAAM;AAAA,EACnD,IAAI,OAAO,OAAO,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,OAAO,MAAM;AAAA,EACjE,MAAM,QAAQ,KAAK,SAAS,OAAO;AAAA,EACnC,IAAI,OAAO,MAAM,WAAW,KAAK,CAAC;AAAA,IAAO,OAAO,EAAE,QAAQ,OAAO;AAAA,EACjE,MAAM,OACJ,OAAO,MAAM,WAAW,IACpB,mBAAmB,KAAK,iBAAiB,OAAO,qCAChD,qBACA,+CAA+C,OAAO,MAAM,KAAK,IAAI,YACrE;AAAA,EACN,OAAc,oBAAW,eAAe,KAAK,QAAQ,OAAO,KAAK,IAAI,MAAM,MAAM;AAAA,EACjF,OAAO,EAAE,QAAQ,SAAS;AAAA,CAC3B;AAoBH,IAAM,YAAY,CAAC,OAAiB,SAC3B,aAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,WAAW;AAAA,EACnB,MAAM,YAAW,iBAAiB,MAAM,MAAM,MAAM;AAAA,EACpD,IAAI,UAAS,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,SAAQ;AAAA,EACvD,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,EACjC,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,WAAW,eAAe,IAAI;AAAA,IACpC,IAAI,SAAS,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,QAAQ;AAAA,IACvD,OAAO,YAAY,IAAI;AAAA,EACzB,EAAO;AAAA,IACL,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,eAAe,OAAO,kBAAkB,OAAO,KAAK,IAAI,QAAQ,KAAK,MAAM;AAAA,IACpF;AAAA,IACA,MAAM,SAAS,MAAM,MAAM,IAAI;AAAA,IAC/B,IAAI,WAAW,aAAa,OAAO,MAAM,SAAS,GAAG;AAAA,MACnD,OAAO,OAAO,QAAQ;AAAA,QACpB,MAAM,OAAO,KAAK,IAAI,uBAAuB,KAAK,yBAChD,GAAG,OAAO,MAAM,KAAK,IAAI,gEACzB;AAAA,MACJ,CAAC;AAAA,IACH;AAAA,IACA,OAAO,mBAAmB,OAAO,MAAM,MAAM,MAAM;AAAA,IACnD,IAAI,OAAO,OAAO,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,OAAO,MAAM;AAAA,IACjE,IAAI,OAAO,MAAM,SAAS;AAAA,MAAG,OAAO,YAAY,MAAM,QAAQ,KAAK,KAAK,SAAS,CAAC;AAAA;AAAA,EAEpF,MAAM,QAAQ,OAAO,SAAS,IAAI;AAAA,EAClC,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAO,QAAQ;AAAA,MACpB,MAAM,OAAO,KAAK,IAAI;AAAA,IACxB,CAAC;AAAA,EACH;AAAA,EACA,MAAM,OAAO,MAAM,MAAM,KAAK,EAAE;AAAA,EAChC,IAAI,KAAK,SAAS,GAAG;AAAA,IACnB,OAAO,OAAO,QAAQ;AAAA,MACpB,MAAM,OAAO,KAAK,IAAI,uBAAuB,KAAK,KAAK,IAAI,6BACzD,yFACA;AAAA,IACJ,CAAC;AAAA,EACH;AAAA,EACA,OAAO,cAAa,MAAM,KAAK;AAAA,CAChC;AAEH,IAAM,UAAU,CAAC,MAAgB,YAAiD;AAAA,EAChF,MAAM,QAAQ,QAAQ,KAAK;AAAA,EAC3B,QAAQ,KAAK;AAAA,EACb,MAAM,QAAQ,QAAQ,KAAK;AAC7B;AAeA,IAAM,OAAO,CAAC,OAAiB,SACtB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,QAAQ,MAAM,MAAM,MAAM;AAAA,EACxC,MAAM,OAAO,OAAO,SAAS,KAAK;AAAA,EAClC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,WAAiB,cAAK,MAAM,MAAM,MAAM,IAAI,EAAE,MAAM,WAAW,CAAC;AAAA,EACtE,OAAO,OAAO,UAAU,OAAO,cAAa,OAAO,IAAI,GAAG,QAAO;AAAA,CAClE;AAUH,IAAM,YAAW;AAAA,EACf,QAAQ,GAAG,MAAM,aACf,aAAa,QAAQ,MAAM,MAAM,GAAG,IAAI;AAAA,EAC1C,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,KAAK,EAAE,KAAK,YAAY,OAAO,GAAG,MAAM,IAAI;AAAA,EAC9C,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,KAAK,EAAE,KAAK,YAAY,OAAO,GAAG,IAAI;AAAA,EACxC,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,UAAU,EAAE,KAAK,YAAY,OAAO,GAAG,IAAI;AAC/C;AAEO,IAAM,qBAAqB,MACvB,kBACP,YACO,iBAAQ,WAAW,SAAS,GAAG,SAAQ,CAAC,EAAE,KAAY,aAAI,cAAc,CAAC,CAClF;;AgBrNF,qBAAS;AACT;AACA;;;ACVO,IAAM,SAAQ;AAErB,IAAM,MAAM,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAuBnF,IAAM,YAAW,CAAC,UAAiE;AAAA,EACxF,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,EAAE,KAAK,IAAI,MAAM,GAAG,GAAG,MAAM,MAAM,MAAM,SAAS,IAAI,MAAM,OAAO,EAAE;AAAA,SACzE;AAAA,MACH,OAAO;AAAA,QACL,mBAAmB,MAAM;AAAA,QACzB,QAAQ,MAAM;AAAA,QACd,eAAe,MAAM;AAAA,QACrB,iBAAiB,IAAI,MAAM,gBAAgB;AAAA,QAC3C,KAAK,IAAI,MAAM,GAAG;AAAA,QAClB,cAAc,MAAM;AAAA,QACpB,SAAS,IAAI,MAAM,OAAO;AAAA,MAC5B;AAAA,SACG;AAAA,MACH,OAAO;AAAA,QACL,oBAAoB,MAAM;AAAA,QAC1B,sBAAsB,IAAI,MAAM,qBAAqB;AAAA,QACrD,aAAa,MAAM;AAAA,QACnB,iBAAiB,MAAM;AAAA,QACvB,gBAAgB,IAAI,MAAM,eAAe;AAAA,MAC3C;AAAA;AAAA;AAWN,IAAM,eAAe,CAAC,UAAqD;AAAA,EACzE,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,CAAC;AAAA,SACL;AAAA,MACH,OAAO,EAAE,sBAAsB,MAAM,0BAA0B,QAAQ,MAAM,IAAI;AAAA,SAC9E;AAAA,MACH,OAAO,EAAE,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,IAAI;AAAA;AAAA;AAcjF,IAAM,YAAW,CAAC,WAAsD;AAAA,EACtE,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EACxC,MAAM,OAAO,MAAM,IAAI;AAAA,EACvB,QAAQ,MAAM;AAAA,KACX,aAAa,KAAK;AACvB;AAEO,IAAM,QAAO,CAAC,UAA6B;AAAA,EAChD,MAAM,SAAS,UAAS,KAAK;AAAA,EAC7B,YAAY,QAAQ,UAAU,OAAO,QAAQ,UAAS,KAAK,CAAC,GAAG;AAAA,IAC7D,IAAI,UAAU;AAAA,MAAW,OAAO,UAAU;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,SAAS,CAAC,UAA6B;AAAA,EAClD,MAAM,QAAQ,OAAO,QAAQ,UAAS,KAAK,CAAC,EACzC,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,YAAY,MAAM;AAAA,EAC3B,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;AAW/B,IAAM,cAAa,CAAC,WAA8B,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,KAAK;;;AChErF,IAAM,iBAAiB,CAAC,UAA+D;AAAA,EAC5F,oBAAoB,KAAK,KAAK,mBAAmB;AAAA,EACjD,sBAAsB,IAAI,KAAK,uBAAuB,MAAK;AAAA,EAC3D,aAAa,KAAK,KAAK,YAAY;AAAA,EACnC,iBAAiB,KAAK,KAAK,gBAAgB;AAAA,EAC3C,gBAAgB,IAAI,KAAK,iBAAiB,MAAK;AAAA,EAC/C,mBAAmB,KAAK,KAAK,oBAAoB,IAAI;AACvD;AASO,IAAM,cAAc,CACzB,YACA,UAEA,WAAW,yBAAyB,MAAM,uBAAuB,OACjE,WAAW,2BAA2B,MAAM,yBAAyB,WACrE,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,sBAAsB,MAAM,oBAAoB,OAC3D,WAAW,qBAAqB,MAAM,mBAAmB,WACzD,WAAW,wBAAwB,MAAM,uBAAuB;;;AF+B3D,IAAM,sBAAsB,WAA8B,sBAAsB;AAWvF,IAAM,cAAc,CAAC,YAAoC,UAAsC;AAAA,EAC7F,IAAI,MAAM,SAAS;AAAA,IAAiB,OAAO,YAAY,YAAY,KAAK;AAAA,EACxE,MAAM,SACJ,WAAW,SAAS,MAAM,OAAO,WAAU,WAAW,aAAa,MAAM,WAAW;AAAA,EACtF,IAAI,MAAM,SAAS;AAAA,IAAY,OAAO,UAAU,WAAW,UAAU,MAAM,QAAQ;AAAA,EACnF,OACE,UACA,WAAW,mBAAmB,MAAM,iBAAiB,OACrD,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,YAAY,MAAM,UAAU,OACvC,WAAW,wBAAwB,MAAM,sBAAsB,OAC/D,WAAW,sBAAsB,MAAM,oBAAoB,WAC3D,WAAW,2BAA2B,MAAM,0BAA0B;AAAA;AAI1E,IAAM,YAAW,YAAuD;AAAA,EACtE,YAAY,CAAC,MAAM,UAAU;AAAA,IAQ3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,SACF,eAAe,IAAI;AAAA,MACtB,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,MAC/C,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,MACpC,IAAI,MAAM;AAAA,MACV,eAAe,KAAK,KAAK,gBAAgB;AAAA,MACzC,iBAAiB,IAAI,KAAK,kBAAkB,MAAK;AAAA,MACjD,KAAK,IAAI,KAAK,QAAQ,MAAK;AAAA,MAC3B,cAAc,KAAK,KAAK,eAAe;AAAA,MACvC,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,MAAM,IAAI,KAAK,SAAS,CAAC;AAAA,MACzB,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,SAAS,IAAI,KAAK,YAAY,MAAK;AAAA,MACnC,MAAM,MAAM;AAAA,MACZ,sBAAsB,KAAK,KAAK,uBAAuB,IAAI;AAAA,IAC7D;AAAA;AAAA,EAGF,YAAY,CAAC,UAAU,0BAA0B,MAAM;AAAA,EAEvD,YAAY;AAAA,EAMZ,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EAKA,SAAS,CAAC,YAAY,UACpB,WAAW,WAAW,MAAM,UAC5B,WAAW,SAAS,MAAM,QAC1B,WAAW,aAAa,MAAM,YAAY,SAC1C,YAAY,YAAY,KAAK;AAAA,EAC/B,MAAM,CAAC,UAAU,0BAA0B,MAAM;AAAA,EAEjD,YAAY;AACd,CAAC;AAWM,IAAM,8BAA8B,MAChC,kBAAO,qBAA4B,iBAAQ,oBAAoB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AG7KhG,qBAAS;AACT,uBAAS;AAET;AACA;;;AC9BO,IAAM,yBAAsC;AAM5C,IAAM,qBAAkC;AAExC,IAAM,oBAAyC,UAAU,wBAAwB,CAAC,GAAG,IAAI;AAEzF,IAAM,gBAAqC,UAAU,oBAAoB,CAAC,GAAG,IAAI;;;ADsFjF,IAAM,sBAAsB,WAA8B,sBAAsB;AAEvF,IAAM,QAAO,CAAC,UACZ,aAAa,MAAM,QAAQ,MAAM,IAAI,EAAE,KAC9B,aAAI,CAAC,aAAa,EAAE,MAAM,MAAM,MAAM,QAAQ,EAAE,CACzD;AAYF,IAAM,QAAO,CAAC,SACL,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,CAAC,aAAW,IAAI;AAAA,IAAG;AAAA,EACvB,QAAQ,YAAY,OAAO,MAAK,IAAI;AAAA,EACpC,OAAO,YAAY,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,CAC5E;AAGH,IAAM,SAAS,CAAC,MAAc,QACrB,aAAI,IAAI,MAAM,wBAAwB,SAAS,KAAK,CAAC;AAE9D,IAAM,QAAQ,CAAC,UACN,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,SAAS,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,EASrD,IAAI,WAAW;AAAA,IAAG,OAAO,EAAE,MAAM,SAAS,EAAE;AAAA,EAE5C,MAAM,SAAS,OAAO,eAAe,MAAM,MAAM;AAAA,EACjD,IAAI,WAAW,WAAW;AAAA,IACxB,OAAO,OAAO,OACZ,MACA,wEAAwE,cACtE,0EACJ;AAAA,EACF;AAAA,EAWA,OAAO;AAAA,EACP,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,OAAO,QAAgB,MAAM,QAAQ,YAAY,OAAO,SAAS,cAAc;AAAA,EAC5F,IAAI,SAAS,WAAW;AAAA,IACtB,OAAO,OAAO,OACZ,MACA,+FACE,qFACJ;AAAA,EACF;AAAA,EAUA,MAAM,aAAa,OAAO,UAAU,MAAM,QAAQ,YAAY,MAAM,IAAI;AAAA,EACxE,IAAI,eAAe,MAAM;AAAA,IACvB,OAAO,OAAO,OACZ,MACA,qBAAqB,gBAAgB,yCACnC,sBAAsB,cAAc,wDACpC,yBACJ;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,OAAO,eAAe,MAAM,MAAM;AAAA,EAChD,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAO,OACZ,MACA,2DAA2D,sBACzD,2FACA,gEACJ;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,EACnD,IAAI,SAAS,GAAG;AAAA,IACd,OAAO,OAAO,OACZ,MACA,8BAA8B,OAAO,IAAI,sDACvC,2FACJ;AAAA,EACF;AAAA,EACA,OAAO,EAAE,MAAM,SAAS,KAAK;AAAA,CAC9B;AAaH,IAAM,YAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM,GAAG,WAA+C,MAAK,IAAI;AAAA,EACjE,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAwC,MAAK,IAAI;AAAA,EAC1D,WAAW,GAAG,WAAwC,MAAM,IAAI;AAClE;AAEO,IAAM,8BAA8B,MAChC,kBAAO,qBAA4B,iBAAQ,oBAAoB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AE9KhG,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AClBO,IAAM,sBAAsB;AAC5B,IAAM,sBAAsB;AAU5B,IAAM,SAAQ;AAuBd,IAAM,YAAY,CAAC,UACxB,KAAK,KAAK,EACP,MAAM,SAAS,EACf,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAYN,IAAM,WAAU,CAAC,UAAmB,KAAK,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAGlE,IAAM,QAAO,CAAI,UAAyB,SAC/C,aAAa,aAAa,aAAa;AAElC,IAAM,WAAW,CAAC,UAA8B,SACrD,aAAa,aAAa,UAAU,QAAQ,MAAM;AAE7C,IAAM,cAAc,CAAC,UAA8B,SACxD,aAAa,aAAa,SAAQ,QAAQ,MAAM;AAElD,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAkCtC,IAAM,QAAO,CAAC,WAAqD;AAAA,KACrE,OAAM,aAAa,KAAK,MAAM,SAAS,CAAC;AAAA,KACxC,OAAM,gBAAgB,MAAM,eAAe;AAAA,KAC3C,OAAM,aAAa,MAAM,SAAS;AAAA,KAClC,OAAM,yBAAyB,MAAM,qBAAqB;AAAA,KAC1D,OAAM,gBAAgB,MAAM,YAAY;AAAA,KACxC,OAAM,eAAe,MAAM,WAAW;AAAA,KACtC,OAAM,qBAAqB,MAAM,sBAAsB,OAAO,MAAM,SAAS;AAAA,KAC7E,OAAM,QAAQ,MAAM,IAAI;AAAA,KACxB,OAAM,YAAY,MAAM,QAAQ;AAAA,KAChC,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,OAAO,MAAM,QAAQ,YAAY,YAAY,OAAO,MAAM,GAAG,CAAC;AAAA,KACpE,OAAM,UAAU,MAAM,MAAM;AAAA,KAC5B,OAAM,WAAW,MAAM,eAAe,YAAY,YAAY,OAAO,MAAM,UAAU,CAAC;AAAA,KACtF,OAAM,mBAAmB,MAAM,kBAAkB;AAAA,EACpD,MAAM,MAAM;AACd;AAgBO,IAAM,cAAa,CAAC,WAAqD;AAAA,KAC3E,MAAK,KAAK;AAAA,EACb,OAAO,MAAM;AACf;AAqBO,IAAM,cAAa,CAAC,UAAoD;AAAA,EAC7E,MAAM,QAAQ;AAAA,IACZ,GAAI,MAAM,SAAS,YAAY,CAAC,MAAM,IAAI,CAAC;AAAA,IAC3C,GAAI,MAAM,sBAAsB,QAAQ,CAAC,mBAAmB,IAAI,CAAC;AAAA,EACnE;AAAA,EACA,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;;;AC1MtC;AACA;AAkFA,IAAM,gBAAe,CACnB,MACA,UACsC;AAAA,EACtC,MAAM,OAAO;AAAA,EASb,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,EAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,IAAM;AAAA,EAChD,OAAO;AAAA,IACL,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,aAAa,KAAK,KAAK,cAAc;AAAA,IACrC,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,uBAAuB,KAAK,KAAK,wBAAwB;AAAA,IACzD,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,cAAc,UAAU,KAAK,eAAe;AAAA,IAC5C,YAAY,KAAK,KAAK,aAAa;AAAA,IACnC,aAAa,UAAU,KAAK,cAAc;AAAA,IAC1C,mBAAmB,KAAK,KAAK,oBAAoB;AAAA,IAEjD,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,UAAU,SAAQ,KAAK,WAAW;AAAA,IAClC,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,UAAU,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,YAAY,KAAK,GAAG,IAAI;AAAA,IACzE,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,OAAO,MAAM;AAAA,IACb,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,KAAK,IAAI,KAAK,QAAQ,MAAK;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,UAAU,IAAI,KAAK,aAAa,MAAK;AAAA,IACrC,QAAQ,UAAU,KAAK,SAAS;AAAA,IAChC,MAAM,aAAa,KAAK,MAAM,OAAO;AAAA,IACrC,WAAW,IAAI,KAAK,YAAY,MAAK;AAAA,IACrC,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,EACjD;AAAA;AAwBK,IAAM,sBAAsB,CAAC,UAClC,iBACE,OACE,MAAM,QACN,QACA,OACM,sBAAe,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,KAAK,CAAC,CAC/D,EAAE,KACO,kBAAS,+BAA+B,CAAC,UAC9C,MAAM,OAAO,aAAa,6BACf,iBAAQ,SAAS,IACjB,cAAK,KAAK,CACvB,CACF,CACF,EAAE,KACO,aAAI,CAAC,SAAS;AAAA,EACnB,IAAI,SAAS;AAAA,IAAY,OAAO;AAAA,EAChC,OAAO,SAAS,YAAY,YAAY,cAAa,MAAM,KAAK;AAAA,CACjE,CACH;AAmBK,IAAM,gBAAgB,CAAC,UAC5B,oBAAoB,KAAK,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAGhE,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;AAc7B,IAAM,WAAU,CAAC,YAAmC,UACzD,WAAW,UAAU,MAAM,QAAQ,OACnC,MAAK,MAAM,SAAS,WAAW,OAAO,KACtC,MAAK,MAAM,WAAW,WAAW,SAAS,KAC1C,MAAK,MAAM,KAAK,WAAW,GAAG,KAC9B,YAAY,MAAM,UAAU,WAAW,QAAQ,KAC/C,SAAS,MAAM,cAAc,WAAW,YAAY,KACpD,SAAS,MAAM,aAAa,WAAW,WAAW,KAClD,MAAK,MAAM,mBAAmB,WAAW,iBAAiB,KAC1D,SAAS,MAAM,QAAQ,WAAW,MAAM,KACxC,MAAK,MAAM,WAAW,WAAW,SAAS,KAC1C,MAAK,MAAM,uBAAuB,WAAW,qBAAqB,KAClE,MAAK,MAAM,iBAAiB,WAAW,eAAe,KACtD,MAAK,MAAM,YAAY,WAAW,UAAU,KAC5C,MAAK,MAAM,oBAAoB,WAAW,kBAAkB;;;AF5HvD,IAAM,qBAAqB,WAA6B,uBAAuB;AAAA,EACpF,sBAAsB;AACxB,CAAC;AASD,IAAM,UAA4C;AAAA,EAChD,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,mBAAmB;AACrB;AAEA,IAAM,cAAc,CAAC,SACnB,OAAO,YAAY,OAAO,QAAQ,IAAI,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,CAAC,CAAC;AAG7F,IAAM,qBAAoB,CAAC,WACxB;AAAA,KACI,YAAY,YAAW,KAAK,CAAC;AAAA,EAChC,MAAM,MAAM;AACd;AAGF,IAAM,qBAAoB,CAAC,WACxB;AAAA,KACI,YAAY,YAAW,KAAK,CAAC;AAAA,EAChC,OAAO,MAAM;AAAA,EACb,MAAM,MAAM;AACd;AAEK,IAAM,6BAA6B,MAC/B,kBACP,oBACO,iBACL,mBAAmB,SAAS,GAAG;AAAA,EAK7B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAG7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,cAAc,IAAI,IAAI,oBAAoB,IAAI,CAC9E;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAC7E,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,KAAK;AAAA,IAC9D,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,oBAAoB,IAAI;AAAA,IAG5C,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,uBAAuB,GAAG,KAAK,QAAQ,KAAK,OAAO;AAAA,MAC5E,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,IAAI;AAAA,MAC7D,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAUD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,SAAS,gBAAe,OAAO,cAAc,IAAI,CAAC;AAAA,IACxD,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAC7E,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,KAAK;AAAA,IAC9D,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACM,yBAAkB,mBAAkB,IAAI,CAAC,CACjD;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OACL,KAAK,QACL,aACA,MACM,uBAAgB,mBAAkB,IAAI,CAAC,CAC/C;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,cAAc,IAAI,CAAC;AAAA,IACvD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,SAAS,KAAK,gBAAgB,KAAK,yCACjC,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACM,0BAAmB,EAAE,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,CAAC,CACjE;AAAA,GACD;AACH,CAAC,CACH,CACF;;AG9MF,qBAAS;AACT;AACA;;;AC0DA,IAAM,OAAO,CAAC,UACZ,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC;AAGvE,IAAM,QAAQ,CAAC,QAA2B,cACxC,OAAO,IAAI,CAAC,SAAS,UAAU,KAAK,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,SAAS,EAAE;AAQ3E,IAAM,WAAW,CAAC,SAChB,KACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAEb,IAAM,SAAQ,CAAC,SAAyB;AAAA,EACtC,IAAI,CAAC,KAAK,WAAW,QAAQ;AAAA,IAAG,OAAO;AAAA,EACvC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,IAAI,KAAK;AAAA,IAAG,OAAO;AAAA,EACnB,MAAM,SAAS,KAAK,MAAM,KAAK,CAAC,EAAE,MAAM,GAAG;AAAA,EAC3C,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,KAAK,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,KAAK,GAAG;AAAA;AAG7E,IAAM,QAAO,CAAC,SAAyB;AAGhC,IAAM,iBAAiB,CAAC,YAAuC;AAAA,EACpE,kBAAkB,MAAM,OAAO,qBAAqB,CAAC,GAAG,KAAI,EAAE,KAAK;AAAA,EACnE,eAAe,MAAM,OAAO,kBAAkB,CAAC,GAAG,MAAK,EAAE,KAAK;AAAA,EAC9D,kBAAkB,MAAM,OAAO,qBAAqB,CAAC,GAAG,QAAQ,EAAE,KAAK;AAAA,EACvE,SAAS,MAAM,OAAO,SAAS,KAAI,EAAE,KAAK;AAC5C;AAEO,IAAM,oBAAoB,CAC/B,MACA,UACmC;AAAA,EACnC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,gBAAgB,KAAK,KAAK,eAAe;AAAA,EACzC,kBAAkB,MAAM,KAAK,KAAK,iBAAiB,GAAG,KAAI,EAAE,KAAK;AAAA,EACjE,eAAe,MAAM,KAAK,KAAK,cAAc,GAAG,MAAK,EAAE,KAAK;AAAA,EAC5D,kBAAkB,MAAM,KAAK,KAAK,iBAAiB,GAAG,QAAQ,EAAE,KAAK;AAAA,EAErE,MAAM,KAAK,KAAK,SAAS,KAAK,KAAK;AAAA,EACnC;AAAA,EACA,QAAQ,KAAK,KAAK,SAAS;AAAA,EAC3B,SAAS,MAAM,KAAK,KAAK,SAAS,GAAG,KAAI,EAAE,KAAK;AAClD;AAEA,IAAM,QAAQ,CAAC,GAAsB,MACnC,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,UAAU,SAAS,EAAE,MAAM;AAE9D,IAAM,iBAAiB,CAC5B,YACA,WACY;AAAA,EACZ,MAAM,QAAQ,eAAe,MAAM;AAAA,EACnC,OACE,WAAW,aAAa,OAAO,YAAY,SAC3C,WAAW,qBAAqB,OAAO,oBAAoB,SAC3D,WAAW,UAAU,OAAO,QAAQ,UACpC,MAAM,WAAW,SAAS,MAAM,OAAO,KACvC,MAAM,WAAW,mBAAmB,MAAM,iBAAiB,KAC3D,MAAM,WAAW,gBAAgB,MAAM,cAAc,KACrD,MAAM,WAAW,mBAAmB,MAAM,iBAAiB,MAC1D,OAAO,YAAY,aAAa,WAAW,YAAY,OAAO;AAAA;AAYnE,IAAM,SAAS,CAAC,YAAuC;AAAA,EACrD,SAAS,OAAO,YAAY,OAAQ,MAAiB;AAAA,EACrD,gBAAgB,OAAO,oBAAoB,OAAQ,MAAiB;AAAA,EACpE,MAAM,OAAO,QAAS;AACxB;AAEA,IAAM,QAAQ,CAAC,WAAiF;AAAA,EAC9F,MAAM,QAAQ,eAAe,MAAM;AAAA,EACnC,MAAM,MAAiD,CAAC;AAAA,EACxD,IAAI,MAAM,kBAAkB,SAAS;AAAA,IAAG,IAAI,oBAAoB,MAAM;AAAA,EACtE,IAAI,MAAM,eAAe,SAAS;AAAA,IAAG,IAAI,iBAAiB,MAAM;AAAA,EAChE,IAAI,MAAM,kBAAkB,SAAS;AAAA,IAAG,IAAI,oBAAoB,MAAM;AAAA,EACtE,IAAI,MAAM,QAAQ,SAAS;AAAA,IAAG,IAAI,SAAS,MAAM;AAAA,EACjD,OAAO;AAAA;AASF,IAAM,oBAAoB,CAAC,YAA0D;AAAA,KACvF,OAAO,MAAM;AAAA,KACb,MAAM,MAAM;AAAA,KACX,OAAO,YAAY,aAAa,OAAO,YAAY,KAAK,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;AAAA,EAC3F,MAAM,OAAO;AACf;AAOO,IAAM,oBAAoB,CAAC,WAAyD;AAAA,EACzF,MAAM,UAAU,MAAM,MAAM;AAAA,EAC5B,MAAM,UACJ,CAAC,kBAAkB,eAAe,kBAAkB,QAAQ,EAC5D,OAAO,CAAC,QAAQ,QAAQ,SAAS,SAAS;AAAA,EAC5C,IAAI,OAAO,YAAY;AAAA,IAAI,QAAQ,KAAK,SAAS;AAAA,EACjD,OAAO;AAAA,OACF,OAAO,MAAM;AAAA,OACb;AAAA,OACC,OAAO,YAAY,aAAa,OAAO,YAAY,KAAK,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;AAAA,OACvF,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ,QAAQ;AAAA,EACpD;AAAA;;;ADjKK,IAAM,6BAA6B,WACxC,6BACF;AAEA,IAAM,aAAW,YAAqE;AAAA,EACpF,YAAY,CAAC,MAAM,UAAU,kBAAkB,MAAM,MAAM,IAAI;AAAA,EAC/D,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAEZ,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS;AAAA,EACT,MAAM,CAAC,UAAU,kCAAkC,MAAM;AAAA,EACzD,YAAY;AACd,CAAC;AAEM,IAAM,qCAAqC,MACvC,kBACP,4BACO,iBAAQ,2BAA2B,SAAS,GAAG,UAAQ,CAAC,CACjE;;AE5BF,qBAAS;AACT;AACA;;;AC9BA,IAAM,YAA6E;AAAA,EACjF,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACF;AAGO,IAAM,iBAAiB,CAAC,UAC7B,UAAU,MAAM;;;AClBlB,IAAM,eAAe;AAGd,IAAM,SAAS,CAAC,UAA2B;AAAA,EAChD,MAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,OAAO,SAAS,EAAE,GAAG,EAAE;AAAA,EAC1F,OAAO,OAAO,MAAM,MAAM,IAAI,IAAI;AAAA;AAGpC,IAAM,SAAS,CAAC,UACd,MACG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAWN,IAAM,cAAc,CAAC,UAC1B,OACE,MAAM,QAAQ,KAAK,IACf,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IACzC,OAAO,UAAU,WACf,MAAM,MAAM,SAAS,IACrB,CAAC,CACT;AAGK,IAAM,aAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AAE1F,IAAM,MAAM,CAAC,KAAa,UACxB,UAAU,YAAY,CAAC,IAAI,GAAG,MAAM,MAAM;AAoBrC,IAAM,SAAQ,CAAC,WAA4D;AAAA,EAChF,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,KACrC,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,QAAQ,MAAM,IAAI;AAAA,KACtB,IAAI,WAAW,MAAM,OAAO;AAAA,KAC5B,IAAI,gBAAgB,MAAM,eAAe;AAAA,KACzC,IAAI,UAAU,MAAM,WAAW,YAAY,YAAY,MAAM,OAAO,KAAK,YAAY,CAAC;AAAA,KACtF,IAAI,UAAU,MAAM,WAAW,YAAY,YAAY,YAAY,MAAM,MAAM,CAAC;AAAA,KAChF,IACD,eACA,MAAM,mBAAmB,YAAY,YAAY,YAAY,MAAM,cAAc,CACnF;AAAA,KACG,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,QAAQ,MAAM,IAAI;AAAA,KACtB,IAAI,QAAQ,MAAM,SAAS,YAAY,YAAY,OAAO,MAAM,IAAI,CAAC;AAAA,KACrE,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,OAAO,MAAM,GAAG;AAAA,KACpB,IAAI,YAAY,MAAM,QAAQ;AACnC;AAQO,IAAM,cAAc,CAAC,WAA4D;AAAA,KACnF,OAAM,KAAK;AAAA,EACd,MAAM,MAAM;AACd;;;AFsCO,IAAM,4BAA4B,WACvC,4BACF;AAEA,IAAM,aAAW,YAAmE;AAAA,EAOlF,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,SAAS,KAAK,eAAe,KAAK,KAAK,eAAe;AAAA,IACtD,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,QAAQ,WAAW,KAAK,SAAS;AAAA,IACjC,QAAQ,YAAY,KAAK,SAAS;AAAA,IAClC,eAAe,YAAY,KAAK,cAAc;AAAA,IAC9C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,MAAM,MAAM;AAAA,IACZ,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,KAAK,KAAK,KAAK,MAAM;AAAA,IACrB,UAAU,KAAK,KAAK,WAAW;AAAA,EACjC;AAAA,EACA,YAAY,CAAC,UAAU,mCAAmC,MAAM;AAAA,EAEhE,YAAY;AAAA,EAEZ,UAAU;AAAA,EAUV,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,YAAY,UACzC,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,aAAa,aAAa,WAAW,aAAa,MAAM,cAC9D,MAAM,oBAAoB,aAAa,WAAW,oBAAoB,MAAM,qBAC5E,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,QAAQ,aAAa,WAAW,QAAQ,MAAM,SACpD,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,WAAW,aAAa,WAAW,WAAW,YAAY,MAAM,MAAM,OAC5E,MAAM,mBAAmB,aACxB,WAAW,mBAAmB,YAAY,MAAM,cAAc,OAC/D,MAAM,WAAW,aAAa,WAAW,WAAW,WAAW,MAAM,MAAM;AAAA,EAC9E,MAAM,CAAC,UAAU,mCAAmC,MAAM,QAAQ,MAAM;AAAA,EACxE,YAAY;AACd,CAAC;AAQM,IAAM,oCAAoC,MACtC,kBACP,2BACO,iBAAQ,0BAA0B,SAAS,GAAG,UAAQ,CAAC,CAChE;;AG9KF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACrCA;AAmEO,IAAM,aAAa,CACxB,MACA,WAC4B;AAAA,EAC5B,SAAS,eAAe,KAAK,UAAU;AAAA,EACvC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,0BAA0B,KAAK,KAAK,yBAAyB,EAAE,KAAK;AAAA,EACpE,eAAe,KAAK,KAAK,cAAc,EAAE,KAAK;AAAA,EAC9C,cAAc,IAAI,KAAK,eAAe,CAAC;AAAA,EACvC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,EACrC,gBAAgB,IAAI,KAAK,iBAAiB,CAAC;AAAA,EAC3C,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,oBAAoB,eAAe,KAAK,qBAAqB,MAAM;AAAA,EACnE,MAAM,MAAM;AAAA,EACZ,2BAA2B,eAAe,KAAK,0BAA0B;AAAA,EACzE,QAAQ,eAAe,KAAK,SAAS;AAAA,EACrC,eAAe,KAAK,KAAK,cAAc;AAAA,EACvC,MAAM,KAAK,KAAK,OAAO;AAAA,EACvB,kBAAkB,KAAK,KAAK,iBAAiB,EAAE,KAAK;AAAA,EACpD,QAAQ,eAAe,KAAK,SAAS;AAAA,EACrC,cAAc,KAAK,KAAK,aAAa;AACvC;AAEA,IAAM,QAAO,CAAI,UAAyB,SAAY,aAAa,aAAa,aAAa;AAYtF,IAAM,WAAU,CAAC,MAA8B,UACpD,MAAK,MAAM,SAAS,KAAK,OAAO,KAChC,MAAK,MAAM,gBAAgB,KAAK,GAAG,KAAK,cAAc,KACtD,MAAK,MAAM,mBAAmB,KAAK,GAAG,KAAK,iBAAiB,KAC5D,MAAK,MAAM,cAAc,KAAK,YAAY,KAC1C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,eAAe,KAAK,aAAa,KAC5C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,iBAAiB,KAAK,eAAe,KAChD,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,2BAA2B,KAAK,GAAG,KAAK,yBAAyB,MAC3E,MAAM,+BAA+B,aACpC,eAAe,MAAM,0BAA0B,MAAM,KAAK,+BAC5D,MAAK,MAAM,eAAe,KAAK,aAAa,MAC3C,MAAM,WAAW,aAAa,eAAe,MAAM,MAAM,MAAM,KAAK,YACpE,MAAM,WAAW,aAAa,eAAe,MAAM,MAAM,MAAM,KAAK,YACpE,MAAM,wBAAwB,aAC7B,eAAe,MAAM,qBAAqB,MAAM,MAAM,KAAK;AAE/D,IAAM,OAAM,CAAC,KAAa,UACxB,UAAU,YAAY,CAAC,IAAI,GAAG,MAAM,MAAM;AAG5C,IAAM,QAAQ,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAY5F,IAAM,UAAU,CAAC,WAAsD;AAAA,KAClE,KAAI,WAAW,MAAM,OAAO;AAAA,KAC5B,KAAI,eAAe,MAAM,gBAAgB,KAAK,CAAC;AAAA,KAC/C,KAAI,cAAc,MAAM,MAAM,aAAa,CAAC;AAAA,KAC5C,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,aAAa,MAAM,MAAM,YAAY,CAAC;AAAA,KAC1C,KAAI,gBAAgB,MAAM,MAAM,eAAe,CAAC;AAAA,KAChD,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,0BAA0B,MAAM,yBAAyB;AAAA,KAC7D,KAAI,oBAAoB,MAAM,mBAAmB;AAAA,KACjD,KAAI,2BAA2B,MAAM,0BAA0B;AAAA,KAC/D,KAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,KAAI,eAAe,MAAM,cAAc;AAAA,KACvC,KAAI,kBAAkB,MAAM,mBAAmB,KAAK,CAAC;AAAA,KACrD,KAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,KAAI,cAAc,KAAK,MAAM,aAAa,CAAC;AAChD;AAWO,IAAM,cAAa,CAAC,WAAuC;AAAA,KAC7D,QAAQ,KAAK;AAAA,EAChB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,KAKR,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAClE;AAqBO,IAAM,cAAa,CAAC,UAAsC,QAAQ,KAAK;AAEvE,IAAM,UAAS,CAAC,UAA6B,oBAAoB,MAAM;AAwBvE,IAAM,UAAU,CAAC,UACtB,IAA6B,MAAM,QAAQ,QAAQ,OAAO,QAAO,KAAK,CAAC,EAAE,KAChE,aAAI,CAAC,SACV,SAAS,aAAa,OAAO,KAAK,YAAY,WAAW,YAAY,WAAW,MAAM,KAAK,CAC7F,GACO,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CACtC;;;AC/OF;AAgBA,IAAM,WAAW,CAAC,MAAc,UAAkB;AAAA,EAChD,MAAM,OAAO,CAAC,UAAmB,MAAM,SAAS,IAAI,MAAM,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAChF,OAAO,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA;AAQ3B,IAAM,YAAY,CAAC,MAA8B,UACtD,KAAK,SAAS,MAAM,SAAS,KAAK,MAAM,MAAM,IAAI,IACvC,gBACA,aACL,IAAI,MACF,GAAG,QAAO,KAAK,oBAAoB,MAAM,sBAAsB,KAAK,oBAClE,sFACA,wFACA,0FACA,uCACJ,CACF;AAgBC,IAAM,eAAe,CAAC,MAA8B,UACzD,MAAM,YAAY,aAAa,eAAe,MAAM,OAAO,MAAM,KAAK,UAC3D,gBACA,aACL,IAAI,MACF,GAAG,QAAO,KAAK,uBAAuB,MAAM,2BAC1C,GAAG,KAAK,YAAY,KAAK,+BAA+B,KAAK,0BAC7D,yFACA,yFACA,iFACA,+BACJ,CACF;AAuBC,IAAM,UAAS,CAAU,OAA8B,SACrD,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,IAAI,WAAW,GAAG;AAAA,IAChD,MAAM,OAAO,OAAO;AAAA,IACpB,IAAI,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACvB,OAAc,eAAM,WAAW;AAAA,EACjC;AAAA,EACA,OAAO,OAAO;AAAA,CACf;;;AC5FH;AAMO,IAAM,qBAAqF;AAAA,EAChG,QAAQ;AAAA,EACR,QAAQ;AACV;AAGO,IAAM,sBAAsB,CAAC,UAC3B,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,UAAU,mBAAmB,QAAQ,YAAW,KAAK,GAAG,IAAI;AAAA,EACnE,OAAO,UAAU,mBAAmB,QAAQ,YAAW,KAAK,GAAG,KAAK;AAAA,CACrE;;;AHoII,IAAM,eAAe,WAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAEM,IAAM,uBAAuB,MACzB,kBACP,cACO,iBACL,aAAa,SAAS,GAAG;AAAA,EAMvB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,QAAQ,IAAI;AAAA,EAOhC,MAAM,GAAG,MAAM,aACN,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAGvB,OAAO,oBAAoB,IAAI;AAAA,IAC/B,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAGhC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAClD,OAAO,UAAU,MAAM,IAAI;AAAA,IAC3B,OAAO,aAAa,MAAM,IAAI;AAAA,IAC9B,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAMH,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAExC,OAAO,oBAAoB,IAAI;AAAA,IAC/B,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI;AAAA,IACJ,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAO,IACZ,KAAK,QACL,aACA,QACA,oBACA,YAAW,IAAI,CACjB;AAAA,IACF,EAAO;AAAA,MACL,OAAO,UAAU,MAAM,IAAI;AAAA,MAC3B,OAAO,aAAa,MAAM,IAAI;AAAA,MAE9B,MAAM,OAAO,WAAW,UAAS,MAAM,MAAM,YAAW,IAAI,CAAC;AAAA,MAC7D,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,QAAO,IAAI,GAAG,IAAI;AAAA,MAChE;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,QACnB,QAAQ,IAAI,GACZ,CAAC,QAAQ,QAAQ,aAAa,SAAQ,KAAK,IAAI,CACjD;AAAA,IACA,IAAI,UAAU,aAAa,CAAC,SAAQ,OAAO,IAAI,GAAG;AAAA,MAKhD,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,QAAO,IAAI,qEACZ,4DAA4D,QAAQ,cACpE,gFACA,mFACA,2DACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAgBD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,IAAY,KAAK,QAAQ,aAAa,UAAU,QAAO,IAAI,CAAC;AAAA,IACnE,MAAM,OAAO,OAAO,QAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,QAAQ,SAAS;AAAA,IACpE,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,QAAO,IAAI,mEACZ,kFACA,kEACA,GAAG,KAAK,0EACZ,CACF;AAAA,IACF;AAAA,GACD;AACH,CAAC,CACH,CACF;;AI7OF,qBAAS;AACT;AACA;AAsBO,IAAM,yBAAyB,WAAiC,yBAAyB;AAEhG,IAAM,aAAW,YAAwE;AAAA,EACvF,YAAY,CAAC,MAAM,UAAU,kBAAkB,MAAM,MAAM,IAAI;AAAA,EAC/D,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAEZ,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS;AAAA,EACT,MAAM,CAAC,UAAU,iCAAiC,MAAM;AAAA,EACxD,YAAY;AACd,CAAC;AAEM,IAAM,iCAAiC,MACnC,kBACP,wBACO,iBAAQ,uBAAuB,SAAS,GAAG,UAAQ,CAAC,CAC7D;;ACzDF,qBAAS;AACT;AACA;;;ACjBA,uBAAS;AAET;;;ACYA,IAAM,aAAgF;AAAA,EACpF,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACF;AAGO,IAAM,oBAAoB,CAAC,UAChC,WAAU,MAAM;;;AChBlB,IAAM,eAAe;AAGrB,IAAM,kBACJ;AACF,IAAM,oBAAoB;AAEnB,IAAM,mBAAmB,CAAC,SAC/B,kBAAkB,KAAK,IAAI,KAAK,gBAAgB,KAAK,IAAI;AAE3D,IAAM,WAAU,CAAC,UAA2B,UAAU,MAAM,CAAC,aAAa,KAAK,KAAK;AAG7E,IAAM,2BAA2B,CACtC,WAEA,OAAO,QAAQ,UAAU,CAAC,CAAC,EACxB,OAAO,EAAE,MAAM,WAAW,OAAO,UAAU,YAAY,iBAAiB,IAAI,CAAC,EAC7E,OAAO,IAAI,WAAW,SAAQ,KAAe,CAAC,EAC9C,IAAI,EAAE,UAAU,IAAI,EACpB,KAAK;AAOH,IAAM,0BAA0B,CAAC,QAAsC;AAAA,EAC5E,IAAI,QAAQ;AAAA,IAAW,OAAO,CAAC;AAAA,EAC/B,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,YAAY,oCAAoC,KAAK,GAAG,IAAI,MAAM;AAAA,EACxE,MAAM,KAAK,UAAU,YAAY,GAAG;AAAA,EACpC,IAAI,MAAM,GAAG;AAAA,IACX,MAAM,WAAW,UAAU,MAAM,GAAG,EAAE;AAAA,IACtC,MAAM,QAAQ,SAAS,QAAQ,GAAG;AAAA,IAClC,IAAI,SAAS,KAAK,SAAQ,SAAS,MAAM,QAAQ,CAAC,CAAC;AAAA,MAAG,IAAI,KAAK,UAAU;AAAA,EAC3E;AAAA,EAEA,MAAM,SAAS,IAAI,QAAQ,WAAW,EAAE;AAAA,EACxC,WAAW,QAAQ,OAAO,MAAM,OAAO,GAAG;AAAA,IACxC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC3B,MAAM,OAAO,KAAK,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE;AAAA,IAC7C,IAAI,MAAM,KAAK,iBAAiB,IAAI,KAAK,SAAQ,KAAK,MAAM,KAAK,CAAC,CAAC;AAAA,MAAG,IAAI,KAAK,IAAI,MAAM;AAAA,EAC3F;AAAA,EACA,OAAO;AAAA;;;ACtDT,mBAAS;;;ACYT;AACA;AAmBO,IAAM,aAAa,CACxB,MACA,MAAmB,QAAQ,QACoE;AAAA,EAC/F,MAAM,SAAiC,CAAC;AAAA,EACxC,MAAM,UAAoB,CAAC;AAAA,EAC3B,YAAY,KAAK,QAAQ,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC7C,MAAM,QAAQ,IAAI,IAAI;AAAA,IACtB,IAAI,UAAU,aAAa,UAAU;AAAA,MAAI,QAAQ,KAAK,IAAI,OAAO;AAAA,IAC5D;AAAA,aAAO,OAAO;AAAA,EACrB;AAAA,EACA,OAAO,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG,OAAO;AAAA;AAQzD,IAAM,OAAO,EAAE,GAAG,OAAQ,QAAQ,KAAK,OAAO,MAAM,GAAG,GAAG,GAAG,EAAE;AAC/D,IAAM,SAAS;AAGf,IAAM,YAAY,CAAC,WACjB,KAAK,UACH,OAAO,KAAK,MAAM,EACf,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CACpC;AAEF,IAAM,SAAS,CAAC,MAAc,WAC5B,WAAW,UAAU,MAAM,GAAG,MAAM,IAAI,IAAI;AASvC,IAAM,OAAO,CAAC,QAA0C,SAA0B;AAAA,EACvF,IAAI,OAAO,KAAK,MAAM,EAAE,WAAW;AAAA,IAAG,OAAO;AAAA,EAC7C,MAAM,QAAQ,SAAS,YAAY,YAAY,EAAE,IAAI,OAAO,KAAK,MAAM,MAAM;AAAA,EAC7E,OAAO,GAAG,UAAU,MAAM,SAAS,WAAW,KAAK,OAAO,OAAO,MAAM,EAAE,SAAS,WAAW;AAAA;AASxF,IAAM,cAAc,CAAC,QAAgB,WAAsD;AAAA,EAChG,IAAI,WAAW;AAAA,IAAI,OAAO,OAAO,KAAK,MAAM,EAAE,WAAW;AAAA,EACzD,OAAO,QAAQ,MAAM,QAAQ,SAAS,OAAO,MAAM,GAAG;AAAA,EACtD,IAAI,WAAW,UAAU,SAAS,aAAa,WAAW,aAAa,UAAU,WAAW;AAAA,IAC1F,OAAO;AAAA,EACT;AAAA,EACA,MAAM,WAAW,OAAO,KAAK,QAAQ,WAAW;AAAA,EAChD,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,WAAW,GAAG,MAAM;AAAA,EAC5D,OAAO,SAAS,WAAW,OAAO,UAAU,gBAAgB,UAAU,MAAM;AAAA;;;ADnFvE,IAAM,SAAS,CAAC,UAA0B,QAAO,KAAK,OAAO,MAAM,EAAE,SAAS,QAAQ;AAGtF,IAAM,WAAW,CAAC,UAA0B,QAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,MAAM;AAQxF,IAAM,cAAc,CAAC,SAAmD;AAAA,EAC7E,MAAM,QAAgC,CAAC;AAAA,EACvC,WAAW,QAAQ,KAAK,MAAM,GAAG,GAAG;AAAA,IAClC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC3B,IAAI,KAAK;AAAA,MAAG,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,EACxE;AAAA,EACA,MAAM,QAAQ,MAAM;AAAA,EACpB,OAAO,UAAU,YAAY,EAAE,MAAM,MAAM,WAAW,GAAG,IAAI,EAAE,MAAM,MAAM,WAAW,IAAI,MAAM;AAAA;AAI3F,IAAM,WAAW,CAAC,MAAc,UACrC,QAAQ,cAAc,OAAO,KAAK;AAEpC,IAAM,QAAO,CAAC,UACZ,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC;AAGhE,IAAM,QAAQ,CAAC,SACpB,CAAC,GAAG,IAAI,EACL,OAAO,CAAC,QAAQ,QAAQ,EAAE,EAC1B,KAAK,EACL,KAAK,GAAG;AAON,IAAM,eAAe,CAAC,QAAgB,WAC3C,KAAK,QAAO,8BAA8B,eAAe;AAMpD,IAAM,mBAAmB,CAC9B,MACA,UACoC;AAAA,EACpC,MAAM,UAAkC,CAAC;AAAA,EACzC,WAAW,QAAQ,MAAK,KAAK,SAAS,GAAG;AAAA,IACvC,QAAQ,MAAM,UAAU,YAAY,IAAI;AAAA,IACxC,IAAI,SAAS;AAAA,MAAI,QAAQ,QAAQ,SAAS,SAAS,EAAE;AAAA,EACvD;AAAA,EACA,MAAM,UAAU,MAAK,KAAK,SAAS,EAAE,IAAI,CAAC,SAAS,YAAY,IAAI,EAAE,IAAI;AAAA,EACzE,OAAO;AAAA,IACL,QAAQ,KAAK,KAAK,SAAS;AAAA,IAI3B,MAAM,SAAS,KAAK,KAAK,OAAO,CAAC;AAAA,IACjC,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,QAAQ,MAAM,OAAO,KAAK,OAAO,CAAC;AAAA,IAClC,cAAc,aAAa,MAAM,MAAM,OAAO;AAAA,IAC9C,QAAQ,YAAY,KAAK,SAAS;AAAA,IAClC,eAAe,YAAY,KAAK,cAAc;AAAA,IAC9C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,MAAM,MAAM;AAAA,IAGZ,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,QAAQ,MAAM,OAAO;AAAA,IACrB,QAAQ;AAAA,IACR,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,KAAK,KAAK,KAAK,MAAM;AAAA,IACrB,UAAU,KAAK,KAAK,WAAW;AAAA,EACjC;AAAA;;;AE7EF,IAAM,QAAoE;AAAA,EACxE,QAAQ,CAAC,YAAY,MAAM;AAAA,EAC3B,MAAM,CAAC,SAAS;AAAA,EAChB,gBAAgB,CAAC,YAAY,MAAM;AAAA,EACnC,QAAQ,CAAC,SAAS;AAAA,EAClB,QAAQ,CAAC,YAAY,MAAM;AAAA,EAC3B,eAAe,CAAC,YAAY,MAAM;AAAA,EAClC,QAAQ,CAAC,SAAS;AAAA,EAClB,MAAM,CAAC,MAAM;AAAA,EACb,UAAU,CAAC,MAAM;AAAA,EACjB,MAAM,CAAC,MAAM;AAAA,EACb,QAAQ,CAAC,SAAS;AAAA,EAClB,QAAQ,CAAC,MAAM;AAAA,EACf,KAAK,CAAC,SAAS;AAAA,EACf,UAAU,CAAC,MAAM;AACnB;AAEA,IAAM,WAA8D;AAAA,EAClE,UAAU,CAAC;AAAA,EACX,MAAM,CAAC,UAAU,cAAc;AAAA,EAC/B,SAAS,CAAC,OAAO,QAAQ;AAC3B;AAGA,IAAM,aAAa;AAGnB,IAAM,aACJ;AAQK,IAAM,WAAW,CAAC,UAA2B;AAAA,EAClD,MAAM,MAAgB,CAAC;AAAA,EACvB,YAAY,QAAO,UAAU,OAAO,QAAQ,KAAK,GAA0C;AAAA,IACzF,IAAI,MAAM,YAAW,aAAa,CAAC,MAAM,SAAS,MAAM,IAAI,GAAG;AAAA,MAC7D,IAAI,KAAK,IAAI,sBAAqB,MAAM,KAAK,GAAG,kBAAkB,MAAM,MAAM;AAAA,IAChF;AAAA,EACF;AAAA,EACA,WAAW,UAAS,SAAS,MAAM,OAAO;AAAA,IACxC,IAAI,MAAM,YAAW,aAAa,MAAM,YAAW;AAAA,MACjD,IAAI,KAAK,GAAG,MAAM,eAAe,SAAQ;AAAA,EAC7C;AAAA,EACA,WAAW,OAAO,CAAC,GAAG,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,GAAG,GAAG,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG;AAAA,IAC1F,IAAI,CAAC,WAAW,KAAK,GAAG;AAAA,MAAG,IAAI,KAAK,IAAI,wCAAwC;AAAA,EAClF;AAAA,EAEA,WAAW,QAAQ,yBAAyB,MAAM,MAAM,GAAG;AAAA,IACzD,IAAI,KAAK,WAAW,qCAAqC,YAAY;AAAA,EACvE;AAAA,EACA,WAAW,SAAS,wBAAwB,MAAM,GAAG,GAAG;AAAA,IACtD,IAAI,KAAK,SAAS,qCAAqC,YAAY;AAAA,EACrE;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,YAAY,CAAC,UAA8C,OAAO,UAAU;AAG3E,IAAM,gBAAgB,CAAC,OAAc,MAAmB,QAAQ,QAAQ;AAAA,EAC7E,MAAM,aAAsC,CAAC;AAAA,EAC7C,MAAM,UAAkC,CAAC;AAAA,EACzC,YAAY,MAAM,UAAU,OAAO,QAAQ,MAAM,UAAU,CAAC,CAAC,GAAG;AAAA,IAC9D,IAAI,UAAU,KAAK;AAAA,MAAG,WAAW,QAAQ;AAAA,IACpC;AAAA,cAAQ,QAAQ;AAAA,EACvB;AAAA,EACA,MAAM,SAAS,WAAW,YAAY,GAAG;AAAA,EACzC,MAAM,aAAsC,CAAC;AAAA,EAC7C,YAAY,MAAM,QAAQ,OAAO,QAAQ,MAAM,UAAU,CAAC,CAAC;AAAA,IAAG,WAAW,UAAU,UAAU;AAAA,EAC7F,IAAI,MAAM,aAAa;AAAA,IAAW,WAAW,cAAc,MAAM;AAAA,EACjE,MAAM,SAAS,WAAW,YAAY,GAAG;AAAA,EACzC,OAAO;AAAA,IACL,QAAQ,EAAE,SAAS,OAAO,SAAS,QAAQ,KAAK,YAAY,OAAO,OAAO,EAAE;AAAA,IAC5E;AAAA,EACF;AAAA;AAMF,IAAM,QAAO,CAAC,UAA8B,SAC1C,aAAa,aAAa,aAAa;AAGlC,IAAM,eAAe,CAAC,MAAuC,UAClE,KAAK,aAAa,MAAM,YAAY,SACpC,MAAK,MAAM,SAAS,KAAK,OAAO,KAChC,MAAK,MAAM,QAAQ,KAAK,MAAM,KAC9B,MAAK,MAAM,iBAAiB,KAAK,eAAe,KAChD,MAAK,MAAM,QAAQ,KAAK,MAAM,MAC7B,MAAM,SAAS,aAAa,MAAM,SAAS,KAAK,SACjD,MAAK,MAAM,MAAM,KAAK,IAAI,KAC1B,MAAK,MAAM,UAAU,KAAK,QAAQ,KAClC,MAAK,MAAM,KAAK,KAAK,GAAG,KACxB,MAAK,MAAM,QAAQ,KAAK,MAAM,KAC9B,MAAK,MAAM,MAAM,KAAK,IAAI,MACzB,MAAM,WAAW,aAAa,YAAY,MAAM,MAAM,MAAM,KAAK,YACjE,MAAM,mBAAmB,aAAa,YAAY,MAAM,cAAc,MAAM,KAAK;AAE7E,IAAM,cAAc,CACzB,MACA,OACA,WACe;AAAA,EACf,IAAI,MAAM,WAAW;AAAA,IAAW,OAAO;AAAA,EACvC,IAAI,MAAM,OAAO,KAAK,MAAM,MAAM,CAAC,MAAM,KAAK;AAAA,IAAQ,OAAO;AAAA,EAC7D,IAAI,OAAO,OAAO,QAAQ,SAAS;AAAA,IAAG,OAAO;AAAA,EAC7C,OAAO,aAAa,MAAM,MAAM,OAAO,OAAO,MAAM,MAAM,KAAK,eAAe,UAAU;AAAA;AAGnF,IAAM,cAAc,CACzB,MACA,OACA,QACA,WACe;AAAA,EACf,IAAI,MAAM,WAAW,aAAa,MAAM,aAAa;AAAA,IAAW,OAAO;AAAA,EACvE,IAAI,MAAM,WAAW,aAAa,MAAM,OAAO,KAAK,MAAM,MAAM,CAAC,MAAM,KAAK;AAAA,IAC1E,OAAO;AAAA,EACT,IAAI,OAAO,OAAO,QAAQ,SAAS,KAAK,WAAW;AAAA,IAAI,OAAO;AAAA,EAC9D,OAAO,YAAY,QAAQ,OAAO,OAAO,MAAM,IAAI,UAAU;AAAA;AAS/D,IAAM,cAAc,CAAC,OAAc,WACjC,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,SACnC,SAAS,MAAM,OAAO,OAAO,OAAO,UAAU,WAAW,EAAE,CAC7D;AAEF,IAAM,cAAc,CAAC,OAAc,WACjC,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,SAAS,MAAM,OAAO,OAAO,OAAO,SAAS,EAAE,CAAC;AAGhG,IAAM,aAAa,CAAC,UAAyD;AAAA,EAC3E,CAAC,UAAU,MAAM,UAAU,EAAE;AAAA,EAC7B,CAAC,QAAQ,MAAM,SAAS,YAAY,KAAK,OAAO,MAAM,IAAI,CAAC;AAAA,EAC3D,CAAC,WAAW,MAAM,WAAW,EAAE;AAAA,EAC/B,CAAC,gBAAgB,MAAM,mBAAmB,EAAE;AAAA,EAC5C,CAAC,UAAU,MAAM,UAAU,EAAE;AAAA,EAC7B,CAAC,QAAQ,MAAM,QAAQ,EAAE;AAAA,EACzB,CAAC,QAAQ,MAAM,SAAS,YAAY,KAAK,OAAO,MAAM,IAAI,CAAC;AAAA,EAC3D,CAAC,UAAU,MAAM,UAAU,EAAE;AAAA,EAC7B,CAAC,OAAO,MAAM,OAAO,EAAE;AAAA,EACvB,CAAC,YAAY,MAAM,YAAY,EAAE;AAAA,EACjC,CAAC,UAAU,MAAM,WAAW,YAAY,CAAC,IAAI,YAAY,MAAM,MAAM,EAAE,MAAM,GAAG,CAAC;AAAA,EACjF;AAAA,IACE;AAAA,IACA,MAAM,mBAAmB,YAAY,CAAC,IAAI,YAAY,MAAM,cAAc,EAAE,MAAM,GAAG;AAAA,EACvF;AACF;AAEA,IAAM,WAAW,CAAC,OAAc,QAC7B,MAA6C,SAAS;AAEzD,IAAM,QAAQ,CAAC,UACb,OAAO,UAAU,WAAW,UAAU,KAAK,MAAM,OAAO,CAAC,SAAS,SAAS,EAAE,EAAE,WAAW;AAQrF,IAAM,aAAa,CACxB,OACA,QACA,OACA,SACY;AAAA,EACZ,MAAM,OAAmD;AAAA,IACvD,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EAC1C;AAAA,EACA,MAAM,UAAoB,CAAC;AAAA,EAC3B,MAAM,MAAM,CAAC,KAAa,UAAsC;AAAA,IAC9D,IAAI,CAAC,MAAM,KAAK;AAAA,MAAG,KAAK,OAAO;AAAA,IAC1B,SAAI,SAAS;AAAA,MAAU,QAAQ,KAAK,GAAG;AAAA;AAAA,EAE9C,YAAY,KAAK,UAAU,WAAW,KAAK;AAAA,IAAG,IAAI,SAAS,OAAO,GAAG;AAAA,MAAG,IAAI,KAAK,KAAK;AAAA,EACtF,IAAI,MAAM,UAAU,MAAM,WAAW;AAAA,IAAW,IAAI,UAAU,YAAY,OAAO,MAAM,CAAC;AAAA,EACxF,IAAI,MAAM,UAAU,MAAM,WAAW;AAAA,IAAW,IAAI,UAAU,YAAY,OAAO,MAAM,CAAC;AAAA,EACxF,IAAI,MAAM,UAAU,MAAM,aAAa,WAAW;AAAA,IAChD,KAAK,cAAc,OAAO,OAAO,OAAO,eAAe;AAAA,EACzD;AAAA,EACA,IAAI,SAAS;AAAA,IAAU,KAAK,UAAU,MAAM;AAAA,EAC5C,IAAI,QAAQ,SAAS;AAAA,IAAG,KAAK,YAAY;AAAA,EACzC,OAAO;AAAA;;;AL5LT,IAAM,OAAO,CAAC,UAAiB,kCAAkC,MAAM,QAAQ,MAAM;AAMrF,IAAM,YAAW,CAAC,UAChB,IAA6B,MAAM,QAAQ,QAAQ,OAAO,KAAK,KAAK,CAAC,EAAE,KAC9D,aAAI,CAAC,SAAU,QAAQ,OAAO,YAAY,iBAAiB,MAAM,KAAK,CAAE,GACxE,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CACtC;AAEF,IAAM,UAAS,CAAC,UAAiB;AAAA,EAC/B,MAAM,UAAU,SAAS,KAAK;AAAA,EAC9B,OAAO,QAAQ,WAAW,IACf,gBACA,aAAI,IAAI,MAAM,GAAG,KAAK,KAAK,MAAM,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA;AAIpE,IAAM,UAAU,CAAC,MAAkB,OAAc,QAAgB,WAAmB;AAAA,EAClF,MAAM,SAAS,YAAY,MAAM,OAAO,MAAM,MAAM;AAAA,EACpD,MAAM,cAAc,YAAY,MAAM,OAAO,QAAQ,MAAM,MAAM;AAAA,EACjE,OAAO,aAAa,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,cAC5C,YACC,EAAE,QAAQ,QAAQ,YAAY;AAAA;AAIrC,IAAM,gBAAgB,CAAC,OAAc,QAAgB,UAAiB;AAAA,EACpE,MAAM,UAAU;AAAA,IACd,GAAI,MAAM,SAAS,OAAO,OAAO,UAAU,CAAC;AAAA,IAC5C,GAAI,MAAM,SAAS,OAAO,OAAO,UAAU,CAAC;AAAA,EAC9C;AAAA,EACA,OAAO,QAAQ,WAAW,IACf,gBACA,aACL,IAAI,MACF,GAAG,KAAK,KAAK,kDAAkD,QAAQ,KAAK,IAAI,OAC9E,6EACJ,CACF;AAAA;AAGC,IAAM,aAAW;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAiB7B,MAAM,GAAG,MAAM,cACZ,WAAW,YAAY,QAAO,IAAI,IAAW,eAAM,KAC3C,iBAAQ,UAAS,IAAI,CAAC,GACtB,aAAI,CAAC,SACV,SAAS,YAAY,YAAY,KAAK,MAAM,QAAQ,QAAQ,UAAU,GAAG,CAC3E,CACF;AAAA,EAOF,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAMO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,WAAW,aAAa,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAC/C,IAAI,SAAS,cAAc,KAAK,SAAS,KAAK,QAAQ,KAAK,SAAS,KAAK,OAAO;AAAA,MAC9E,OAAO,EAAE,QAAQ,WAAW,aAAa,KAAK,SAAS,KAAK,KAAK;AAAA,IACnE;AAAA,IACA,OAAO,QAAO,IAAI;AAAA,IAClB,MAAM,OAAO,OAAO,UAAS,IAAI;AAAA,IACjC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAClD,OAAO,QAAQ,MAAM,MAAM,cAAc,IAAI,GAAG,OAAO,MAAM,MAAM,YAC9D,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACH,WAAW,GAAG,MAAM,aACX,aAAI,UAAU,GAAG;AAAA,IACtB,OAAO,QAAO,IAAI;AAAA,IAClB,MAAM,SAAS,cAAc,IAAI;AAAA,IACjC,MAAM,OAAO,OAAO,UAAS,IAAI;AAAA,IACjC,IAAI,SAAS,QAAQ,UAAU;AAAA,IAC/B,IAAI,SAAS,WAAW;AAAA,MACtB,MAAM,QAAQ,EAAE,QAAQ,MAAM,QAAQ,KAAK;AAAA,MAC3C,OAAO,cAAc,MAAM,QAAQ,KAAK;AAAA,MACxC,MAAM,aAAa,kCAAkC,KAAK;AAAA,MAC1D,MAAM,OAAO,WAAW,MAAM,QAAQ,OAAO,QAAQ;AAAA,MAQrD,OAAO,UAAU,kBAAkB,IAAI,EAAE,QAAQ,MAAM,IAAI;AAAA,MAC3D,OAAO,IAAI,KAAK,QAAQ,aAAa,QAAQ,YAAY,IAAI;AAAA,MAC7D,SAAS,KAAK,OAAO,OAAO,MAAM;AAAA,IACpC,EAAO;AAAA,MACL,MAAM,QAAQ,QAAQ,MAAM,MAAM,QAAQ,MAAM;AAAA,MAChD,IAAI,UAAU,WAAW;AAAA,QACvB,OAAO,cAAc,MAAM,QAAQ,KAAK;AAAA,QACxC,MAAM,OAAO,WAAW,MAAM,QAAQ,OAAO,QAAQ;AAAA,QAErD,OAAO,UAAU,kBAAkB,IAAI,EAAE,QAAQ,MAAM,KAAK;AAAA,QAC5D,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,KAAK,IAAI,GAAG,IAAI;AAAA,QAC5D,IAAI,MAAM;AAAA,UAAQ,SAAS,KAAK,OAAO,OAAO,MAAM;AAAA,MACtD;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,UAAS,IAAI;AAAA,IAClC,IAAI,UAAU,WAAW;AAAA,MAEvB,OAAO,OAAc,aACnB,IAAI,MAAM,GAAG,KAAK,IAAI,gEAAgE,CACxF;AAAA,IACF;AAAA,IACA,OAAO,KAAK,OAAO,OAAO;AAAA,GAC3B;AAAA,EACH,QAAQ,GAAG,WAA4B,IAAI,KAAK,QAAQ,aAAa,UAAU,KAAK,IAAI,CAAC;AAC3F;;;ADlDO,IAAM,wBAAwB,WAAgC,wBAAwB;AAMtF,IAAM,gCAAgC,MAClC,kBACP,uBACO,iBAAQ,sBAAsB,SAAS,GAAG,UAAQ,CAAC,CAC5D;;AO5DF,qBAAS;AACT;AACA;;;ACzCO,IAAM,YAAY;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKA,IAAM,WAAW,CAAC,UAAiD;AAAA,EACjE,MAAM,OAA+B,CAAC;AAAA,EACtC,WAAW,OAAO,WAAW;AAAA,IAC3B,MAAM,QAAQ,MAAM;AAAA,IACpB,IAAI,UAAU;AAAA,MAAW,KAAK,OAAO,OAAO,KAAK;AAAA,EACnD;AAAA,EACA,OAAO;AAAA;AAYF,IAAM,iBAAiB,CAC5B,UACuC;AAAA,EACvC,cAAc,IAAI,KAAK,eAAe,CAAC;AAAA,EACvC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,EACrC,gBAAgB,IAAI,KAAK,iBAAiB,CAAC;AAAA,EAC3C,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAC3C;AASO,IAAM,aAAa,CAAC,aAA+C,UACxE,UAAU,MAAM,CAAC,QAAQ,MAAM,SAAS,aAAa,MAAM,SAAS,YAAW,IAAI;AA2BrF,IAAM,iBAAiB,CAAC,UAAyB,UAAU,KAAK,CAAC,QAAQ,MAAM,SAAS,SAAS;AAEjG,IAAM,eAAe,CAAC,UAAyB;AAAA,EAC7C,IAAI,eAAe,KAAK;AAAA,IAAG;AAAA,EAC3B,MAAM,IAAI,MACR,gBAAgB,MAAM,uEACpB,cAAc,MAAM,wEACpB,gGACA,uFACJ;AAAA;AAIF,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAG7C,IAAM,UAAU,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAoB9F,IAAM,SAAQ,CAAC,WAAkD;AAAA,KAC5D,SAAS,KAAK;AAAA,KACd,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,KAAK,MAAM,OAAO,CAAC;AAAA,KACpC,OAAM,aAAa,QAAQ,MAAM,YAAY,CAAC;AAAA,KAC9C,OAAM,MAAM,MAAM,EAAE;AAAA,EACvB,UAAU,MAAM;AAAA,EAChB,OAAO,MAAM;AACf;AAWO,IAAM,cAAa,CAAC,UAAiD;AAAA,EAC1E,aAAa,KAAK;AAAA,EAClB,OAAO,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA;AA+BlC,IAAM,cAAa,CAAC,UAAiD;AAAA,EAC1E,aAAa,KAAK;AAAA,EAClB,OAAO,OAAM,KAAK;AAAA;;;AD9Cb,IAAM,cAAc,WAAsB,cAAc;AAG/D,IAAM,QAAO,CAAI,WAAyB,SAAY,cAAa,aAAa,cAAa;AAE7F,IAAM,aAAW,YAA+C;AAAA,EAU9D,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,IACpC,IAAI,MAAM;AAAA,OACP,eAAe,IAAI;AAAA,IACtB,aAAa,IAAI,KAAK,cAAc,EAAE;AAAA,IACtC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,IACvB,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IACnC,OAAO,KAAK,KAAK,UAAU,MAAM,KAAK;AAAA,EACxC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAWZ,UAAU,EAAE,QAAQ,0BAA0B,QAAQ,6BAA6B;AAAA,EACnF,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,YAC9B,YAAW,UAAU,MAAM,SAC3B,MAAK,MAAM,IAAI,YAAW,EAAE,KAC5B,MAAK,MAAM,cAAc,YAAW,YAAY,KAChD,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,WAAW,aAAY,KAAK;AAAA,EAC9B,MAAM,CAAC,UAAU,gBAAgB,MAAM;AAAA,EACvC,YAAY;AACd,CAAC;AAmBM,IAAM,sBAAsB,MACxB,kBAAO,aAAoB,iBAAQ,YAAY,SAAS,GAAG,UAAQ,CAAC,CAAC;;AE9KhF,qBAAS;AACT;AACA;;;ACvBO,IAAM,SAAQ;AAGrB,IAAM,SAAgC;AAAA,EACpC,IAAI;AAAA,EACJ,GAAG;AAAA,EACH,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AACP;AAkBO,IAAM,QAAQ,CAAC,UAA2B;AAAA,EAC/C,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK;AAAA,EAC7B,MAAM,QAAQ,wCAAwC,KAAK,GAAG;AAAA,EAC9D,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,MAAM,OAAO,OAAM,MAAM,MAAM;AAAA,EAC/B,OAAO,SAAS,YAAY,SAAQ,KAAK,MAAM,OAAO,MAAM,MAAM,GAAG,IAAI,IAAI;AAAA;AAYxE,IAAM,UAAU,CAAC,UACtB,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,KAAK,KAAK;AAsB9F,IAAM,SAAQ,CAAC,WAAyB;AAAA,EACtC,gBAAgB,MAAM;AAAA,EACtB,mBAAmB,MAAM,uBAAuB,OAAO,MAAM;AAAA,EAC7D,OAAO,MAAM;AAAA,KACT,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AAAA,KAClF,MAAM,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,KAC7C,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,KACtD,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW,OAAO,MAAM,UAAU,EAAE;AAAA,KAC5E,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,KACzD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,aAAa;AAAA,KAC1E,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC/D,MAAM,qBAAqB,YAC3B,CAAC,IACD,EAAE,iBAAiB,MAAM,mBAAmB,MAAM,IAAI;AAAA,KACtD,MAAM,qBAAqB,YAC3B,CAAC,IACD,EAAE,iBAAiB,OAAO,MAAM,gBAAgB,EAAE;AACxD;AAYO,IAAM,cAAa,CAAC,WAAiD;AAAA,KACvE,OAAM,KAAK;AAAA,EACd,IAAI,MAAM;AAAA,KACN,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB,MAAM,kBAAkB;AAC/F;AAUO,IAAM,cAAa,CAAC,UAAgD,OAAM,KAAK;AAE/E,IAAM,aAAW,YAA6C;AAAA,EAiBnE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,gBAAgB,QAAQ,KAAK,eAAe;AAAA,IAC5C,IAAI,MAAM;AAAA,IACV,aAAa,IAAI,KAAK,cAAc,MAAK;AAAA,IACzC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,IACvB,OAAO,KAAK,KAAK,UAAU,EAAE;AAAA,IAC7B,WAAW,MAAM,KAAK,UAAU;AAAA,IAChC,QAAQ,KAAK,KAAK,WAAW,EAAE;AAAA,IAC/B,aAAa,KAAK,KAAK,cAAc,EAAE;AAAA,IACvC,gBAAgB,KAAK,KAAK,iBAAiB,EAAE;AAAA,IAG7C,mBAAmB,KAAK,KAAK,oBAAoB,KAAK;AAAA,IACtD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IAGnC,iBAAiB,KAAK,KAAK,kBAAkB,KAAK;AAAA,IAClD,OAAO,KAAK,KAAK,UAAU,EAAE;AAAA,IAC7B,kBAAkB,KAAK,KAAK,mBAAmB,MAAM;AAAA,IACrD,iBAAiB,IAAI,KAAK,kBAAkB,MAAK;AAAA,EACnD;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAoBZ,UAAU,EAAE,QAAQ,yBAAyB,QAAQ,4BAA4B;AAAA,EACjF,SAAS,CAAC,aAAY,UACpB,YAAW,wBAAwB,MAAM,uBAAuB,SAChE,YAAW,UAAU,MAAM,SAC3B,YAAW,oBAAoB,MAAM,oBACpC,MAAM,WAAW,aAAa,YAAW,WAAW,MAAM,YAC1D,MAAM,OAAO,aAAa,YAAW,OAAO,MAAM,QAClD,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,aAAa,aAAa,YAAW,aAAa,MAAM,cAC9D,MAAM,YAAY,aAAa,YAAW,YAAY,MAAM,aAC5D,MAAM,UAAU,aAAa,YAAW,UAAU,MAAM,WAIxD,MAAM,qBAAqB,aAC1B,YAAW,qBAAqB,MAAM,sBACvC,MAAM,eAAe,aAAa,YAAW,eAAe,MAAM,gBAClE,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,qBAAqB,aAC1B,YAAW,qBAAqB,MAAM;AAAA,EAE1C,MAAM,CAAC,UAAU,eAAe,MAAM;AAAA,EACtC,YAAY;AACd,CAAC;;;ADUM,IAAM,aAAa,WAAqB,aAAa;AAWrD,IAAM,qBAAqB,MACvB,kBAAO,YAAmB,iBAAQ,WAAW,SAAS,GAAG,UAAQ,CAAC,CAAC;;AEhO9E,qBAAS;AACT;AACA;;;AC6CO,IAAM,WAAW,CAAC,gBAAyB,kBAAkC;AAAA,EAClF,IAAI,CAAC;AAAA,IAAgB,OAAO;AAAA,EAG5B,IAAI,gBAAgB;AAAA,IAAG,OAAO;AAAA,EAC9B,OAAO,oCAAoC,OAAO,aAAa;AAAA;AAmC1D,IAAM,SAAQ,CAAC,WAAsD;AAAA,EAC1E,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM;AAAA,EAC9D,OAAO,MAAM;AAAA,KACT,MAAM,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC1D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AAAA,KAClF,MAAM,OAAO,aAAa,MAAM,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,KAChE,MAAM,sBAAsB,YAC5B,CAAC,IACD,EAAE,kBAAkB,OAAO,MAAM,iBAAiB,EAAE;AAC1D;;;ADUO,IAAM,eAAe,WAAuB,eAAe;AAalE,IAAM,aAAW,YAAuD;AAAA,EACtE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,iBAAiB,KAAK,KAAK,oBAAoB,IAAI;AAAA,IACzD,MAAM,gBAAgB,IAAI,KAAK,mBAAmB,EAAE;AAAA,IACpD,OAAO;AAAA,MACL,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,MACjC,IAAI,MAAM;AAAA,MACV,mBAAmB;AAAA,MACnB,aAAa,IAAI,KAAK,cAAc,EAAE;AAAA,MACtC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,MACvB,kBAAkB;AAAA,MAClB,UAAU,SAAS,gBAAgB,aAAa;AAAA,MAChD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,MACnC,OAAO,KAAK,KAAK,UAAU,MAAM,KAAK;AAAA,IACxC;AAAA;AAAA,EAcF,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA,EAaxD,UAAU,EAAE,QAAQ,2BAA2B,QAAQ,8BAA8B;AAAA,EACrF,SAAS,CAAC,aAAY,UACpB,YAAW,UAAU,MAAM,SAI3B,YAAW,cAAc,MAAM,YAAY,OAC3C,YAAW,wBAAwB,MAAM,uBAAuB,WAC/D,MAAM,sBAAsB,aAC3B,YAAW,sBAAsB,MAAM,uBACxC,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,OAAO,aAAa,YAAW,OAAO,MAAM,QAClD,MAAM,YAAY,aAAa,YAAW,YAAY,MAAM;AAAA,EAC/D,MAAM,CAAC,UAAU,iBAAiB,MAAM;AAAA,EACxC,YAAY;AACd,CAAC;AAgBM,IAAM,uBAAuB,MACzB,kBAAO,cAAqB,iBAAQ,aAAa,SAAS,GAAG,UAAQ,CAAC,CAAC;;AEnNlF,qBAAS;AACT;AACA;AA8BO,IAAM,cAAc,WAAsB,cAAc;AAGxD,IAAM,iBAAiB,CAAC,WAAuC;AAAA,EACpE,SAAS,MAAM,WAAW;AAAA,EAC1B,QAAQ,MAAM;AAChB;AAGO,IAAM,iBAAiB,CAAC,WAA6D;AAAA,EAC1F,SAAS,MAAM,WAAW;AAC5B;AAEA,IAAM,aAAW,YAAuC;AAAA,EACtD,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,OAAO;AAAA,MACL,SAAS,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU;AAAA,MACzD,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,QAAQ,SAAS;AAAA,MAC3D,QAAQ,MAAM;AAAA,IAChB;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAEZ,UAAU,EAAE,QAAQ,mBAAmB,QAAQ,0BAA0B;AAAA,EACzE,SAAS,CAAC,aAAY,UAAU,YAAW,aAAa,MAAM,WAAW;AAAA,EACzE,MAAM,CAAC,UAAU,SAAS,MAAM;AAAA,EAChC,YAAY;AACd,CAAC;AAEM,IAAM,sBAAsB,MACxB,kBAAO,aAAoB,iBAAQ,YAAY,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACxDzE,IAAM,uBAA0C,OAAO,OAAO;AAAA,EACnE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAsDM,IAAM,qBAA6C,OAAO,OAAO;AAAA,EACtE,SACE;AAAA,EACF,WAAW;AAAA,EACX,eAAe;AAAA,EACf,UAAU;AAAA,EACV,UAAU;AAAA,EACV,MAAM;AACR,CAAC;AAyBD,IAAM,KAAK;AACX,IAAM,SAAS;AACf,IAAM,UAAU;AAEhB,IAAM,YAAW,CACf,QACA,UACA,UACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,GAAG,KAAK,OAAM,IAAI;AAAA,IAAG,MAAM,KAAK,UAAU,OAAM,6BAA6B;AAAA,EAClF,IAAI,CAAC,GAAG,KAAK,OAAM,SAAS;AAAA,IAAG,MAAM,KAAK,eAAe,OAAM,+BAA+B;AAAA,EAC9F,IAAI,CAAC,GAAG,KAAK,OAAM,QAAQ;AAAA,IAAG,MAAM,KAAK,cAAc,OAAM,iCAAiC;AAAA,EAC9F,YAAY,QAAO,WAAW;AAAA,IAC5B,CAAC,iBAAiB,OAAM,aAAa;AAAA,IACrC,CAAC,YAAY,OAAM,QAAQ;AAAA,EAC7B,GAAY;AAAA,IACV,IAAI,WAAW,QAAQ,CAAC,OAAO,KAAK,MAAM,GAAG;AAAA,MAC3C,MAAM,KAAK,GAAG,YAAW,wDAAwD;AAAA,IACnF;AAAA,EACF;AAAA,EACA,IAAI,OAAM,aAAa,OAAM;AAAA,IAAe,MAAM,KAAK,yCAAyC;AAAA,EAMhG,MAAM,SAAS,CAAC,UAA8B,WAC5C,aAAa,YAAY,YAAY;AAAA,EACvC,MAAM,UAAyC;AAAA,IAC7C,CAAC,OAAO,MAAM,cAAc,cAAc,GAAG,SAAS,KAAK;AAAA,IAC3D,CAAC,OAAO,MAAM,kBAAkB,kBAAkB,GAAG,SAAS,SAAS;AAAA,EACzE;AAAA,EACA,IAAI,OAAM,aAAa,MAAM;AAAA,IAC3B,QAAQ,KAAK,CAAC,OAAO,MAAM,aAAa,aAAa,GAAG,SAAS,IAAI,CAAC;AAAA,EACxE;AAAA,EACA,MAAM,OAAO,IAAI;AAAA,EACjB,YAAY,QAAO,aAAY,SAAS;AAAA,IACtC,IAAI,QAAQ,KAAK,QAAO,KAAK,KAAK,IAAI,MAAK;AAAA,MAAG;AAAA,IAC9C,KAAK,IAAI,MAAK;AAAA,IACd,MAAM,KAAK,GAAG,uDAAsD;AAAA,EACtE;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,oBAAoB,CAAC,SAAwB,CAAC,MAAyB;AAAA,EAGlF,QAAQ,cAAc,kBAAkB,gBAAgB,SAAS;AAAA,EAEjE,MAAM,QAAQ,OAAO,QAAQ,IAAI,EAAE,OAAO,IAAI,WAAW,UAAU,SAAS;AAAA,EAC5E,MAAM,WAAmC;AAAA,OACpC;AAAA,OACA,OAAO,YAAY,KAAK;AAAA,EAC7B;AAAA,EAGA,MAAM,WAA8B;AAAA,IAClC,OAAO,gBAAgB,SAAS;AAAA,IAChC,WAAW,oBAAoB,SAAS;AAAA,IACxC,MAAM,eAAe,SAAS;AAAA,EAChC;AAAA,EACA,MAAM,QAAQ,UAAS,UAAU,UAAU,MAAK;AAAA,EAChD,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,IAAI,MAAM,uBAAuB,MAAM,KAAK,IAAI,GAAG;AAAA,EAC/E,MAAM,QAA2C;AAAA,IAC/C,CAAC,aAAa,SAAS,eAAe,SAAS,IAAI;AAAA,EACrD;AAAA,EACA,IAAI,SAAS,aAAa;AAAA,IAAM,MAAM,KAAK,CAAC,QAAQ,SAAS,UAAU,SAAS,QAAQ,CAAC;AAAA,EACzF,OAAO;AAAA,IACL,QAAQ,MAAM,IAAI,EAAE,MAAM,QAAQ,aAAa,EAAE,MAAM,QAAQ,OAAO,EAAE;AAAA,IACxE,OAAO,EAAE,SAAS,SAAS,OAAO,SAAS,SAAS,UAAU;AAAA,IAC9D,MAAM,EAAE,OAAO,sBAAsB,QAAQ,SAAS,KAAK;AAAA,IAC3D,OAAO,MAAM,IAAI,EAAE,MAAM,aAAa;AAAA,MACpC,SAAS,SAAS;AAAA,MAClB,QAAQ,CAAC,SAAS,SAAS;AAAA,MAC3B;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AAAA;;AC3LF,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBf,IAAM,WAAW,CAAC,UAAiB,KAAK;AAGxC,IAAM,aACJ,qEACA,iGACA,sEACA,mFACA;AAEF,IAAM,WAAW,GAAG,WAAsC;AAAA,EACxD,MAAM,QAAQ,CAAC,GAAG,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG;AAAA,EAC7C,OAAO;AAAA,SACA,KAAK;AAAA,QACN;AAAA,8BACsB,KAAK;AAAA,8CACW,KAAK;AAAA,oBAC/B,KAAK,+DAA+D,KAAK;AAAA;AAAA,eAE9E,KAAK,mCAAmC,KAAK;AAAA;AAAA;AAAA;AAK5D,IAAM,YAAY,GAAG,YAAuC;AAAA,UAClD,MAAM;AAAA,+BACe,MAAM;AAAA,oBACjB,MAAM,gCAAgC,MAAM;AAAA,qBAC3C,MAAM,qDAAqD,MAAM,sBAAsB,MAAM;AAAA;AAAA,gBAElG,MAAM,qCAAqC,MAAM,sBAAsB,MAAM;AAAA;AAAA;AAI7F,IAAM,WAAW,CAAC,SAAqD;AAAA,EACrE,MAAM,SAAS,CAAC,GAAG,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG;AAAA,EAC/C,MAAM,OAAO,UAAU,gEAAgE,KAAK;AAAA,EAC5F,MAAM,SAAS,YAAY,qBAAqB,KAAK;AAAA,EACrD,OAAO;AAAA,SACA,KAAK,eAAe,KAAK,kBAAkB;AAAA,8BACtB,KAAK,WAAW;AAAA,oBAC1B,4BAA4B,KAAK;AAAA,oBACjC,KAAK;AAAA,wBACD,KAAK,UAAU;AAAA;AAAA,eAExB,KAAK,mCAAmC,KAAK,UAAU;AAAA;AAAA;AAAA;AAKtE,IAAM,YAAY,CAAC,UAAuD;AAAA,EACxE,MAAM,QACJ,sEACA,iBAAiB,SAAS,MAAM,MAAM,wBAAwB,SAAS,MAAM,MAAM,UACnF;AAAA,EACF,OAAO;AAAA,WACE,MAAM,gBAAgB,MAAM,gCAAgC,MAAM;AAAA,2BAClD,oCAAoC,MAAM,UAAU,MAAM;AAAA,mBAClE,MAAM,UAAU,MAAM,iDAAiD,MAAM,kBAAkB,MAAM;AAAA;AAAA;AAKxH,IAAM,cAAc,CAAC,WAA2B;AAAA,oBAC5B,0DAA0D;AAAA;AAOvE,IAAM,qBAAqB,CAAC,SAAwB,CAAC,MAAc;AAAA,EACxE,MAAM,WAAW,kBAAkB,MAAK;AAAA,EACxC,MAAM,WAAW,SAAS,OACvB,IAAI,CAAC,UAAU,MAAM,MAAM,EAC3B,OAAO,CAAC,WAAW,WAAW,SAAS,KAAK,MAAM;AAAA,EACrD,OAAO;AAAA,IACL;AAAA,IACA,GAAG,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,WAAW;AAAA,IACzC,SAAS,QAAQ;AAAA,IACjB,UAAU,QAAQ;AAAA,IAClB,GAAG,SAAS,MAAM,IAAI,QAAQ;AAAA,IAC9B,GAAG,SAAS,OAAO,IAAI,SAAS;AAAA,IAChC;AAAA;AAAA;AAAA,EACF,EAAE,KAAK,EAAE;AAAA;;ACxGX;AACA;AACA;;;ACkBA,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AC7CO,IAAM,cAAc;AACpB,IAAM,cAAc;AAUpB,IAAM,aAAY,CAAC,UACxB,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK;AAEjF,IAAM,cAAa,CAAC,WAAsD;AAAA,EAC/E,OAAO,WAAU,MAAM,KAAK,EAAE,KAAK,GAAG;AAAA,EACtC,QAAQ,MAAM;AAChB;AAMO,IAAM,cAAa,CAAC,WAAmD;AAAA,EAC5E,OAAO,WAAU,MAAM,KAAK,EAAE,KAAK,GAAG;AAAA,EACtC,QAAQ,MAAM;AAChB;AAEO,IAAM,QAAO,CAAC,MAAyD,WAC5E,KAAK,KAAK,CAAC,QAAQ,IAAI,WAAW,MAAM;AAEnC,IAAM,gBAAe,CAC1B,KACA,WACoB;AAAA,EACpB,OAAO,WAAU,IAAI,UAAU,YAAY,CAAC,IAAI,IAAI,MAAM,MAAM,GAAG,CAAC;AAAA,EACpE,QAAQ,MAAM;AAChB;AAEO,IAAM,WAAU,CAAC,aAA4B,UAClD,WAAU,YAAW,KAAK,EAAE,KAAK,GAAG,MAAM,WAAU,MAAM,KAAK,EAAE,KAAK,GAAG;;;AD2DpE,IAAM,cAAc,WAAsB,cAAc;AAW/D,IAAM,WAAW,CAAC,UAChB,iBAAiB,OAAO,MAAM,QAAQ,QAAQ,OAAc,wBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,KACzE,aAAI,CAAC,SAAS;AAAA,EACnB,IAAI,SAAS;AAAA,IAAY,OAAO;AAAA,EAChC,MAAM,MAAM,MAAK,MAAM,MAAM,MAAM;AAAA,EACnC,OAAO,QAAQ,YAAY,YAAY,cAAa,KAAK,KAAK;AAAA,CAC/D,CACH;AAGF,IAAM,kBAAiB,CAAC,SACtB,SAAS,aAAa,YAAY;AAE7B,IAAM,sBAAsB,MACxB,kBACP,aACO,iBACL,YAAY,SAAS,GAAG;AAAA,EAKtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,GAC5C;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IAGjC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,gBAAgB,KAAK,MAAM;AAAA,MACpD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,IAAI;AAAA,MACrD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAKxC,MAAM,SAAS,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IACnD,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,YAAW,IAAI,CAAC,CAC1C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,sBAAc,YAAW,IAAI,CAAC,CAAC;AAAA,IACtF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IAClD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,gBAAgB,KAAK,yDACnB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,EAAE,QAAQ,KAAK,OAAO,CAAC,CACjD;AAAA,GACD;AACH,CAAC,CACH,CACF;;;AE5JF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACrDA;AACA;AAMO,IAAM,cAAc;AACpB,IAAM,cAAc;AAU3B,IAAM,OAAM,CAAC,UAAmB;AAAA,EAC9B,MAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,CAAC;AAAA,EACpE,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA;AAQ5C,IAAM,WAAW,CAAC,UAA6B;AAAA,EAC7C,MAAM,MAAiB,MAAM,QAAQ,KAAK,IACtC,QACA,OAAO,UAAU,WACf,MAAM,MAAM,GAAG,IACf,CAAC;AAAA,EACP,MAAM,SAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,UAAU,EAAE;AAAA,EACnF,OAAO,CAAC,GAAG,IAAI,IAAI,MAAK,CAAC,EAAE,KAAK;AAAA;AASlC,IAAM,aAAa,CAAC,UAClB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,OAAO,KAAK,KAAK,EAAE,KAAK,IACxB,CAAC;AAGP,IAAM,SAAQ,CAAC,WAAsB;AAAA,EACnC,SAAS,MAAM,WAAW;AAAA,EAC1B,OAAO,MAAM,SAAS;AAAA,EACtB,QAAQ,MAAM,WAAW,QAAQ,MAAM;AAAA,EACvC,QAAQ,OAAO,MAAM,UAAU,CAAC;AAAA,EAChC,WAAW,MAAM,aAAa;AAAA,EAQ9B,QAAQ,SAAS,MAAM,MAAM,EAAE,KAAK,GAAG;AAAA,EACvC,UAAU,MAAM,YAAY;AAC9B;AAEO,IAAM,cAAa,CAAC,WAAsD;AAAA,KAC5E,OAAM,KAAK;AAAA,EACd,QAAQ,MAAM;AAChB;AAEO,IAAM,cAAa,CAAC,WAAmD;AAAA,KACzE,OAAM,KAAK;AAAA,EACd,QAAQ,MAAM;AAChB;AAEA,IAAM,gBAAe,CAAC,MAAoC,WAAsC;AAAA,EAC9F,SAAS,KAAK,KAAK,OAAO;AAAA,EAC1B,OAAO,KAAK,KAAK,KAAK;AAAA,EAMtB,QAAQ,KAAK,KAAK,QAAQ,IAAI;AAAA,EAC9B,QAAQ,KAAI,KAAK,MAAM;AAAA,EACvB,WAAW,KAAK,KAAK,SAAS;AAAA,EAC9B,QAAQ,SAAS,KAAK,MAAM;AAAA,EAC5B,UAAU,KAAK,KAAK,QAAQ;AAAA,EAC5B,QAAQ,WAAW,KAAK,MAAM;AAAA,EAE9B,QAAQ,MAAM;AAChB;AAMO,IAAM,WAAU,CAAC,aAA4B,UAClD,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,WAAW,MAAM,SAAS,OACrC,YAAW,YAAY,MAAM,WAAW,UACxC,YAAW,YAAY,MAAM,UAAU,MACvC,YAAW,eAAe,MAAM,aAAa,OAC7C,YAAW,cAAc,MAAM,YAAY,OAC3C,YAAW,OAAO,KAAK,GAAG,MAAM,SAAS,MAAM,MAAM,EAAE,KAAK,GAAG;AAe1D,IAAM,iBAAiB,CAAC,UAC7B,iBACE,OAAO,MAAM,QAAQ,QAAQ,OAAc,sBAAc,EAAE,QAAQ,MAAM,OAAO,CAAC,CAAC,CACpF,EAAE,KAAY,aAAI,CAAC,SAAU,SAAS,aAAa,aAAa,cAAa,MAAM,KAAK,CAAE,CAAC;AAUtF,IAAM,WAAW,CAAC,UACvB,eAAe,KAAK,EAAE,KAAY,kBAAS,gBAAgB,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAGtF,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;;;ADrB7B,IAAM,cAAc,WAAsB,cAAc;AAExD,IAAM,sBAAsB,MACxB,kBACP,aACO,iBACL,YAAY,SAAS,GAAG;AAAA,EAMtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAY7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,SAAS,IAAI,IAAI,eAAe,IAAI,CACpE;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IAGvC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,gBAAgB,KAAK,MAAM;AAAA,MACpD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,IAAI;AAAA,MACrD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAKxC,MAAM,SAAS,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IACnD,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,YAAW,IAAI,CAAC,CAC1C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,sBAAc,YAAW,IAAI,CAAC,CAAC;AAAA,IACtF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IAClD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,gBAAgB,KAAK,4DACnB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,EAAE,QAAQ,KAAK,OAAO,CAAC,CACjD;AAAA,GACD;AACH,CAAC,CACH,CACF;;;AH3KK,IAAM,2BAA2B,CACtC,IACA,QACA,SAAwB,CAAC,GACzB,UAAmC,CAAC,MAE7B,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAc,aAAI;AAAA,IACjC,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,IAC3E,KAAK,MAAM,kBAAkB,MAAK;AAAA,EACpC,CAAC;AAAA,EACD,MAAM,QAAQ,CAAO,aAAyC;AAAA,IAC5D,MAAM,OAAO,SAAS,KAAmB,qBAAO,CAAC;AAAA,IACjD,OAAO,QAAQ,UAAU,YAAY,OAAO,KAAK,KAAK,MAAM,QAAQ,KAAK,CAAC;AAAA;AAAA,EAE5E,MAAM,OAAO,OAAO,MAClB,YAAY,GAAG,WAAW;AAAA,IACxB,OAAO,CAAC,GAAG,SAAS,KAAK,KAAK;AAAA,IAC9B,QAAQ,SAAS,KAAK;AAAA,IACtB;AAAA,EACF,CAAC,CACH;AAAA,EACA,MAAM,QAAQ,OAAO,MAAM,aAAa,GAAG,iBAAiB,KAAK,SAAS,OAAO,OAAO,CAAC,CAAC;AAAA,EAG1F,MAAM,QAAQ,OAAc,aAC1B,SAAS,MAAM,IAAI,CAAC,SAClB,MACE,YAAY,GAAG,MAAM,KAAK,aAAa;AAAA,IACrC,SAAS,KAAK;AAAA,IACd,QAAQ,CAAC,GAAG,KAAK,MAAM;AAAA,IACvB;AAAA,IACA,QAAQ,KAAK;AAAA,EACf,CAAC,CACH,CACF,CACF;AAAA,EACA,MAAM,SAAS,OAAc,aAC3B,SAAS,OAAO,IAAI,CAAC,UACnB,MACE,WAAW,GAAG,MAAM,MAAM,cAAc;AAAA,IACtC,MAAM;AAAA,IACN,WAAW;AAAA,IACX,QAAQ,MAAM;AAAA,IACd;AAAA,IACA,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,EACd,CAAC,CACH,CACF,CACF;AAAA,EACA,OAAO,EAAE,UAAU,QAAQ,OAAO,MAAM,MAAM;AAAA,CAC/C;;AKtFH,qBAAS;AACT;AACA;AAoCO,IAAM,YAAY,WAAoB,YAAY;AAGlD,IAAM,cAAa,CAAC,WAAoB,KAAK,OAAM,KAAK,GAAG,MAAM,OAAO,MAAM,IAAI,EAAE;AAE3F,IAAM,SAAQ,CAAC,WAAoB;AAAA,EACjC,OAAO,OAAO,MAAM,SAAS,CAAC;AAAA,EAC9B,QAAQ,OAAO,MAAM,UAAU,GAAG;AAAA,EAClC,MAAM,MAAM,QAAQ,KAAK,OAAO,MAAM,IAAI;AAAA,EAC1C,QAAQ,MAAM,WAAW,OAAO,MAAM;AAAA,EACtC,SAAS,OAAO,MAAM,WAAW,CAAC;AAAA,KAC9B,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AACzD;AAEA,IAAM,aAAW,YAAmC;AAAA,EAClD,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,IAC3B,QAAQ,IAAI,KAAK,WAAW,GAAG;AAAA,IAC/B,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,IACxD,MAAM,MAAM;AAAA,IACZ,QAAQ,KAAK,cAAc,KAAK,KAAK,cAAc;AAAA,IACnD,SAAS,IAAI,KAAK,YAAY,CAAC;AAAA,IAC/B,MAAM,MAAM;AAAA,EACd;AAAA,EACA,YAAY,CAAC,UAAU,SAAS,MAAM;AAAA,EACtC;AAAA,EAEA,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,aAAY,UACpB,YAAW,UAAU,MAAM,QAAQ,KAAK,OAAO,MAAM,IAAI,QACzD,YAAW,YAAY,MAAM,UAAU,QACvC,YAAW,WAAW,MAAM,SAAS,MACrC,YAAW,aAAa,MAAM,WAAW,MACzC,YAAW,YAAY,MAAM,WAAW;AAAA,EAC1C,MAAM,CAAC,UAAU,SAAS,MAAM,aAAa,OAAO,MAAM,IAAI;AAAA,EAC9D,YAAY;AACd,CAAC;AAEM,IAAM,oBAAoB,MACtB,kBAAO,WAAkB,iBAAQ,UAAU,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACX5E,qBAAS;AACT;AACA;;;AC/DO,IAAM,mBAAmB;AASzB,IAAM,QAAQ,CAAC,UACpB,GAAG,OAAO,MAAM,KAAK,KAAK,OAAO,MAAM,MAAM;AAe/C,IAAM,UAAQ,CAAC,WAAgC;AAAA,EAC7C,SAAS,MAAM,WAAW;AAAA,EAC1B,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EACxC,UAAU,MAAM,YAAY;AAAA,KACxB,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,OAAO,MAAM,IAAI,EAAE;AACjE;AAUO,IAAM,cAAa,CAAC,WAAgC;AAAA,KACtD,QAAM,KAAK;AAAA,EACd,IAAI,MAAM,KAAK;AAAA,EACf,QAAQ,MAAM;AAAA,EACd,MAAM;AACR;AAgBO,IAAM,cAAa,CAAC,WAAgC;AAAA,KACtD,QAAM,KAAK;AAAA,EACd,QAAQ;AACV;;;AD4EO,IAAM,wBAAwB,WAAgC,wBAAwB;AAY7F,IAAM,SAAS,CAAC,UAA2B;AAAA,EACzC,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,SAAS,OAAO,WAAW,KAAK,KAAK,CAAC;AAAA,EAC5C,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA;AAG5C,IAAM,aAAW,YAA2D;AAAA,EAY1E,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,IACpC,OAAO,IAAI,KAAK,UAAU,MAAM,KAAK;AAAA,IACrC,IAAI,KAAK,KAAK,OAAO,MAAM,KAAK,CAAC;AAAA,IACjC,QAAQ,IAAI,KAAK,WAAW,MAAM,MAAM;AAAA,IACxC,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,YAAY,KAAK,KAAK,eAAe,EAAE;AAAA,IACvC,UAAU,KAAK,KAAK,aAAa,gBAAgB;AAAA,IACjD,QAAQ,KAAK,KAAK,WAAW,EAAE;AAAA,IAC/B,YAAY,KAAK,KAAK,WAAW,MAAM,UAAU;AAAA,IACjD,MAAM,KAAK,KAAK,SAAS,OAAO;AAAA,EAClC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAmBZ,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,aAAY,UACpB,YAAW,eAAe,MAC1B,YAAW,cAAc,MAAM,YAAY,qBAC3C,YAAW,aAAa,MAAM,YAAY,SAC1C,YAAW,aAAa,MAAM,WAAW,QACxC,MAAM,SAAS,aAAa,YAAW,SAAS,MAAM;AAAA,EACzD,MAAM,CAAC,UAAU,uBAAuB,MAAM,KAAK;AAAA,EACnD,YAAY;AACd,CAAC;AAUM,IAAM,gCAAgC,MAClC,kBACP,uBACO,iBAAQ,sBAAsB,SAAS,GAAG,UAAQ,CAAC,CAC5D;;AE7NF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACHA;AAkBA,IAAM,SAAS;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA2BO,IAAM,kBAAkB,CAAC,UAC9B,iBAAiB,YAAY,MAAM,WAAW;AAGhD,IAAM,gBAAgB,CAAC,WACd,aACL,OAAO,IAAI,CAAC,eACV,IAAkB,QAAQ,QAAQ,OAAO,GAAG,sBAAsB,EAAE,KAC3D,aAAI,CAAC,UAAU,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,SAAS,EAAE,MAAM,GAQ1E,iBAAQ,iBAAiB,MAAa,iBAAQ,CAAC,CAAC,CACzD,CACF,GACA,EAAE,aAAa,YAAY,CAC7B,EAAE,KAAY,aAAI,CAAC,WAAW,OAAO,OAAO,CAAC,OAAO,WAAU,QAAQ,QAAO,CAAC,CAAC,CAAC;AAU3E,IAAM,eAAe,CAC1B,QACA,YAC4B;AAAA,EAC5B,IAAI,WAAW,aAAa,YAAY;AAAA,IAAW,OAAO;AAAA,EAC1D,IAAI,WAAW,aAAa,YAAY;AAAA,IAAW,OAAO;AAAA,EAC1D,OAAO,WAAW,UAAU,IAAI;AAAA;AAiBlC,IAAM,gBAAgB,CAAC,WACd,aACL,CAAC,WAAW,SAAS,EAAE,IAAI,CAAC,SAC1B,IAAa,QAAQ,QAAQ,OAAO,2BAA2B,QAAQ,EAAE,KAChE,aAAI,UAAS,GACb,iBAAQ,iBAAiB,MAAa,iBAAQ,SAAS,CAAC,CACjE,CACF,GACA,EAAE,aAAa,YAAY,CAC7B,EAAE,KACO,iBAAQ,EAAE,QAAQ,aAAa;AAAA,EACpC,MAAM,UAAU,aAAa,QAAQ,OAAO;AAAA,EAC5C,OAAO,YAAY,iBACR,aACL,IAAI,MACF,uFACE,6DACJ,CACF,IACO,iBAAQ,OAAO;AAAA,CAC3B,CACH;AAGK,IAAM,aAAY,CAAC,UAA2B,KAAK,UAAU,SAAS,KAAK,CAAC;AAEnF,IAAM,WAAW,CAAC,UAA4B;AAAA,EAC5C,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAO,MACJ,IAAI,QAAQ,EACZ,KAAK,CAAC,MAAM,UAAU,KAAK,UAAU,IAAI,EAAE,cAAc,KAAK,UAAU,KAAK,CAAC,CAAC;AAAA,EACpF;AAAA,EACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,MAAM,UAAU,OAAO,QAAQ,KAAgC,EAC5D,OAAO,EAAE,SAAS,QAAQ,QAAQ,EAClC,KAAK,EAAE,QAAQ,WAAW,KAAK,cAAc,KAAK,CAAC;AAAA,IACtD,OAAO,OAAO,YAAY,QAAQ,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,SAAS,KAAK,CAAC,CAAC,CAAC;AAAA,EACjF;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,kBAAkB,CAAC,WACvB,aAAI,CAAC,cAAc,MAAM,GAAG,cAAc,MAAM,CAAC,GAAG,EAAE,aAAa,YAAY,CAAC,EAAE,KAChF,aAAI,EAAE,QAAQ,YAAY,SAAS,MAAM,CAClD;;;ADjHK,IAAM,kBAAkB,WAA0B,kBAAkB;AAE3E,IAAM,QAAO,CAAC,UACZ,gBAAgB,MAAM,MAAM,EAAE,KAAY,aAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC;AAEpE,IAAM,0BAA0B,MAC5B,kBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,EAE1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAE7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,MAAK,IAAI;AAAA,GACxB;AAAA,EAQD,MAAa,YAAG,UAAU,GAAG,QAAwC;AAAA,IACnE,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,QAAQ,YAAY,OAAO,MAAK,IAAI;AAAA,IACpC,OAAO,YAAY,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAC5E;AAAA,EAED,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAiBxC,MAAM,SAAS,OAAO,MAAK,IAAI;AAAA,IAC/B,IAAI,OAAO,YAAY;AAAA,MAAG,OAAO;AAAA,IAIjC,OAAO;AAAA,IACP,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,aAAa;AAAA,IAOzD,MAAM,QAAQ,OAAO,MAAK,IAAI;AAAA,IAC9B,IAAI,MAAM,YAAY,GAAG;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,0CAA0C,OAAO,MAAM,OAAO,qBAC5D,mFACA,yEACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EASD,QAAQ,MAAa;AACvB,CAAC,CACH,CACF;;AE/FF,qBAAS;AACT;AACA;;;ACjCO,IAAM,WAAW,CAAC,UACvB,GAAG,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK,GAAG;AAG9C,IAAM,cAAc,CAAC,UAAqB,iBAAiB,MAAM,qBAAqB,MAAM;AAoBrF,IAAM,aAAa,CAAC,WACxB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAC9B,IAAI,CAAC,UAAmB,eAAe,KAAK,CAAC,EAC7C,OAAO,CAAC,UAAU,UAAU,EAAE,EAC9B,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,iBAAiB,CAAC,UAC7B,UAAU,YAAY,KAAK,WAAW,CAAC,YAAY,KAAK,CAAC,CAAC;AAO5D,IAAM,QAAQ,CAAC,UACb,UAAU,aAAa,UAAU,KAAK,YAAY;AA0B7C,IAAM,YAAW,CAAC,WAA+D;AAAA,EACtF,mBAAmB,MAAM,MAAM,aAAa;AAAA,EAC5C,cAAc,MAAM,cAAc,YAAY,YAAY,YAAY,MAAM,SAAS;AAAA,EACrF,eAAe,MAAM,MAAM,aAAa;AAAA,EACxC,SAAS,MAAM,MAAM,OAAO;AAC9B;AAUO,IAAM,QAAO,CAAC,WAAmD;AAAA,EACtE,MAAM,MAAM,SAAS,OAAO,MAAM;AAAA,EAClC,MAAM,MAAM;AAAA,KACT,OAAO,YACR,OAAO,QAAQ,UAAS,KAAK,CAAC,EAAE,OAC9B,CAAC,UAAqC,MAAM,OAAO,SACrD,CACF;AACF;AAOO,IAAM,eAAa,CAAC,WAAmD;AAAA,KACzE,MAAK,KAAK;AAAA,EACb,QAAQ,MAAM;AAAA,EACd,MAAM;AACR;AAkBO,IAAM,cAAa,CAAC,UAAkD;AAAA,EAC3E,MAAM,QAAQ,OAAO,QAAQ,UAAS,KAAK,CAAC,EACzC,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,SAAS,GAAG;AAAA,EACrB,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;;;ADY/B,IAAM,mBAAmB,WAA2B,mBAAmB;AAE9E,IAAM,aAAW,YAAiD;AAAA,EAChE,YAAY,CAAC,MAAM,UAAU;AAAA,IAS3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,eAAe,KAAK,KAAK,kBAAkB;AAAA,MAC3C,WAAW,WAAW,KAAK,aAAa;AAAA,MACxC,eAAe,KAAK,KAAK,gBAAgB;AAAA,MACzC,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,MAAM,IAAI,KAAK,SAAS,CAAC;AAAA,MACzB,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,QAAQ;AAAA,MACR,UAAU,SAAS,KAAK;AAAA,MACxB,MAAM,MAAM;AAAA,MACZ,MAAM,KAAK,KAAK,OAAO;AAAA,IACzB;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAClD;AAAA,EAEA,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EAeA,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,UAAU,MAAM,SAAS,SACpC,YAAW,mBAAmB,MAAM,iBAAiB,OACrD,YAAW,mBAAmB,MAAM,iBAAiB,OACrD,YAAW,cAAc,eAAe,MAAM,SAAS;AAAA,EAOzD,MAAM,CAAC,UAAU,qBAAqB,MAAM,gBAAgB,SAAS,KAAK;AAAA,EAC1E;AACF,CAAC;AAYM,IAAM,2BAA2B,MAC7B,kBAAO,kBAAyB,iBAAQ,iBAAiB,SAAS,GAAG,UAAQ,CAAC,CAAC;;AEvM1F,qBAAS;AACT;AACA;AA6DO,IAAM,iBAAiB,WAAyB,iBAAiB;AAQxE,IAAM,QAAQ,CAAC,UAAoB,OAAO,UAAU,WAAW,QAAQ;AAUvE,IAAM,UAAQ,CAAC,UAAgD;AAAA,EAC7D,MAAM,QAAQ,MAAM,SAAS;AAAA,EAC7B,OAAO;AAAA,IAIL,iBAAiB,MAAM,iBAAiB,OAAO,MAAM;AAAA,IACrD,WAAW,MAAM,cAAc,OAAO,MAAM;AAAA,IAC5C,MAAM,MAAM;AAAA,OAIR,UAAU,KAAK,CAAC,IAAI,EAAE,MAAM;AAAA,OAC5B,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,EAC9D;AAAA;AAoBF,IAAM,cAAa,CAAC,UAAgD;AAAA,EAClE,MAAM,SAAQ;AAAA,IACZ,IAAK,MAAM,SAAS,QAAQ,KAAK,CAAC,OAAO,IAAI,CAAC;AAAA,IAC9C,GAAI,MAAM,QAAQ,YAAY,CAAC,KAAK,IAAI,CAAC;AAAA,EAC3C;AAAA,EACA,OAAO,WAAW,QAAM,KAAK,GAAG,MAAK;AAAA;AAGvC,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EACV,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,OAAO,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC3D,QAAQ,MAAM;AAAA,IACd,cAAc,KAAK,KAAK,gBAAgB;AAAA,IACxC,KAAK,MAAM,KAAK,MAAM;AAAA,IACtB,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,MAAM,MAAM;AAAA,IAOZ,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,EAC1D;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,QAAM,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAS5D,UAAU,EAAE,QAAQ,+BAA+B,QAAQ,oCAAoC;AAAA,EAC/F,SAAS,CAAC,aAAY,UACpB,YAAW,SAAS,MAAM,QAC1B,YAAW,WAAW,MAAM,SAAS,OACrC,YAAW,QAAQ,MAAM,OACzB,YAAW,eAAe,MAAM,cAAc,SAC9C,YAAW,kBAAkB,MAAM,iBAAiB;AAAA,EAOtD,MAAM,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAC5C;AACF,CAAC;AAgBM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACrLtF,qBAAS;AACT;AACA;AAwEO,IAAM,iBAAiB,WAAyB,iBAAiB;AAQxE,IAAM,WAAW,CAAC,MAAc,eAC7B,SAAS,KAAK,QAAQ,WAAW,cAAa,aAAa,cAAa,KAAK,QAAQ;AASxF,IAAM,QAAO,CAAC,WAAiD;AAAA,KACzD,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,KACzD,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,KAChD,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,KACnD,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,KACxD,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,KAAK,EAAE;AAAA,KAC3D,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,KAAK,EAAE;AAAA,KAC3D,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,KACxD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AACxF;AAkBA,IAAM,YAAoD;AAAA,EACxD,MAAM,CAAC,OAAO,WAAW,OAAO,OAAO;AAAA,EACvC,MAAM,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EAC/C,QAAQ,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EACjD,MAAM,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EAC/C,OAAO,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAClD;AAEA,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EACV,YAAY,CAAC,MAAM,UAAU;AAAA,IAQ3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,KAAK,KAAK,KAAK,MAAM;AAAA,MACrB,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,MAAM,KAAK,KAAK,OAAO,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO;AAAA,MAC3D,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,MACvB,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AAAA,MAC9B,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AAAA,MAC9B,QAAQ;AAAA,MACR,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,MACvB,MAAM,MAAM;AAAA,MACZ,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,MACrC,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK;AAAA,EAO7E,UAAU,EAAE,QAAQ,+BAA+B,QAAQ,oCAAoC;AAAA,EAC/F,SAAS,CAAC,aAAY,UACpB,YAAW,SAAS,MAAM,OAAO,MACjC,YAAW,UAAU,IAAI,MAAM,KAAK,KACpC,SAAS,YAAW,MAAM,MAAM,IAAI,KACpC,YAAW,SAAS,MAAM,OAAO,OACjC,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,UAAU,IAAI,MAAM,KAAK,KACpC,YAAW,kBAAkB,MAAM,gBAAgB,MACnD,YAAW,SAAS,MAAM,OAAO,MACjC,YAAW,YAAY,MAAM,UAAU;AAAA,EACzC,MAAM,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAC5C,YAAY,CAAC,UAAU;AAAA,IACrB,MAAM,SAAS,MAAK,KAAK;AAAA,IACzB,MAAM,QAAQ,UAAU,MAAM,MAAM,OAAO,CAAC,WAAW,OAAO,YAAY,SAAS;AAAA,IACnF,OAAO,WAAW,QAAQ,KAAK;AAAA;AAEnC,CAAC;AAgBM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;AChLtF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AClEO,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;AAsB9B,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAQ7C,IAAM,cAAc,CAAC,aAClB,KAAK,QAAQ;AAgChB,IAAM,cAAc,CAAC,SACnB,OAAO,YAAY,OAAO,QAAQ,IAAI,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,WAAW,KAAK,GAAG,GAAG,KAAK,CAAC,CAAC;AAqBlG,IAAM,WAAU,CAAC,WAAyB;AAAA,KACrC,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,KAAK,MAAM,OAAO,CAAC;AAAA,KACpC,OAAM,SAAS,MAAM,KAAK;AAAA,KAC1B,OAAM,iBAAiB,MAAM,aAAa;AAAA,KAC1C,OAAM,iBAAiB,MAAM,gBAAgB;AAAA,KAC7C,OAAM,UAAU,KAAK,MAAM,MAAM,CAAC;AACvC;AASO,IAAM,eAAa,CAAC,WAAiD;AAAA,KACvE,YAAY,MAAM,OAAO;AAAA,KACzB,SAAQ,KAAK;AAAA,EAChB,SAAS,MAAM;AAAA,EACf,MAAM,MAAM;AACd;AAQO,IAAM,cAAa,CAAC,WAAiD;AAAA,KACvE,SAAQ,KAAK;AAAA,EAChB,SAAS,MAAM;AACjB;AASO,IAAM,qBAAoB,CAAC,UAChC,YAAY,aAAW,KAAK,CAAC;AAGxB,IAAM,qBAAoB,CAAC,UAChC,YAAY,YAAW,KAAK,CAAC;;;ACzI/B;AACA;AAmBA,IAAM,OAAM,CAAC,OAAgB,WAAW,OAAQ,OAAO,UAAU,WAAW,QAAQ;AASpF,IAAM,SAAS,CAAC,UACd,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAEN,IAAM,YAAW,CAAC,WAA8B,SACrD,cAAa,aAAa,OAAO,SAAQ,MAAM,OAAO,IAAI;AAErD,IAAM,QAAO,CAAI,WAAyB,SAC/C,cAAa,aAAa,cAAa;AASzC,IAAM,gBAAe,CAAC,MAAe,UAA2C;AAAA,EAC9E,MAAM,OAAO;AAAA,EACb,OAAO;AAAA,IACL,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,OAAO,KAAI,KAAK,QAAQ;AAAA,IACxB,eAAe,KAAI,KAAK,gBAAgB;AAAA,IACxC,iBAAiB,KAAI,KAAK,gBAAgB;AAAA,IAC1C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,SAAS,MAAM;AAAA,IACf,MAAM,KAAI,KAAK,SAAS,MAAM,IAAI;AAAA,EACpC;AAAA;AAqBK,IAAM,oBAAoB,CAAC,UAChC,iBACE,OAAO,MAAM,QAAQ,aAAa,OAAe,mBAAW,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CACzF,EAAE,KAAY,aAAI,CAAC,SAAU,SAAS,aAAa,aAAa,cAAa,MAAM,KAAK,CAAE,CAAC;AAUtF,IAAM,cAAc,CAAC,UAC1B,kBAAkB,KAAK,EAAE,KAChB,kBAAS,mBAAmB,MAAa,iBAAQ,SAAS,CAAC,CACpE;AAGK,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;AAM7B,IAAM,WAAU,CAAC,aAA+B,UACrD,UAAS,MAAM,SAAS,YAAW,OAAO,KAC1C,UAAS,MAAM,OAAO,YAAW,KAAK,KACtC,UAAS,MAAM,kBAAkB,YAAW,gBAAgB,KAC5D,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,MAAK,MAAM,QAAQ,YAAW,MAAM,KACpC,MAAK,MAAM,eAAe,YAAW,aAAa,KAClD,MAAK,MAAM,SAAS,YAAW,OAAO;;;AFejC,IAAM,iBAAiB,WAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAEM,IAAM,yBAAyB,MAC3B,kBACP,gBACO,iBACL,eAAe,SAAS,GAAG;AAAA,EAOzB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAQ7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,YAAY,IAAI,IAAI,kBAAkB,IAAI,CAC1E;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,gBAAgB,aAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACxE,OAAO,YAAW,gBAAgB,YAAW,IAAI,GAAG,KAAK;AAAA,IACzD,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,kBAAkB,IAAI;AAAA,IAG1C,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,mBAAmB,KAAK,OAAO;AAAA,MACxD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,gBAAgB,aAAW,IAAI,GAAG,IAAI;AAAA,MACxD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAIxC,MAAM,SAAS,gBAAe,OAAO,YAAY,IAAI,CAAC;AAAA,IACtD,OAAO,YAAW,gBAAgB,aAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACxE,OAAO,YAAW,gBAAgB,YAAW,IAAI,GAAG,KAAK;AAAA,IACzD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACQ,uBAAc,mBAAkB,IAAI,CAAC,CAC/C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OACL,KAAK,QACL,aACA,MACQ,oBAAW,mBAAkB,IAAI,CAAC,CAC5C;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,YAAY,IAAI,CAAC;AAAA,IACrD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,WAAW,KAAK,mEACd,gFACA,0EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAMD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACQ,uBAAc,EAAE,SAAS,KAAK,QAAQ,CAAC,CACjD;AAAA,GACD;AACH,CAAC,CACH,CACF;;AGpKF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACvEA;AACA;AAsCO,IAAM,cAAc,CAAC,aAC1B,MAAM,QAAQ,QAAQ,IAClB,SAAS,QAAQ,CAAC,UAAmB;AAAA,EACnC,MAAM,OAAO;AAAA,EACb,MAAM,SAAS,YAAY,KAAK,QAAQ;AAAA,EACxC,OAAO,OAAO,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,SAAS,EAAE;AAAA,CACnF,IACD,CAAC;AAQP,IAAM,iBAAe,CACnB,MACA,WACuB;AAAA,EACvB,SAAS,YAAY,KAAK,QAAQ,EAAE,KAAK,GAAG;AAAA,EAC5C,QAAQ,KAAK,KAAK,QAAQ,SAAS;AAAA,EACnC,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,EACZ,OAAO,KAAK,KAAK,OAAO,SAAS;AACnC;AAoBO,IAAM,iBAAiB,CAAC,UAC7B,iBACE,OACE,MAAM,QACN,QACA,OACM,uBAAe,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK,CAAC,CAC7D,CACF,EAAE,KACO,aAAI,CAAC,SAAS;AAAA,EACnB,IAAI,SAAS;AAAA,IAAY,OAAO;AAAA,EAGhC,OAAO,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,eAAa,MAAM,KAAK;AAAA,CACrE,CACH;AAaK,IAAM,WAAW,CAAC,UACvB,eAAe,KAAK,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAG3D,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;;;AC9GpC;AACA;AAQO,IAAM,kBAAkB;AA6BxB,IAAM,wBAAwB,CAAC,UACpC,MAAM,YAAY,aAAa,MAAM,cAAc,YAAY,YAAY;AAmBtE,IAAM,eAAa,CAAC,WAAiD;AAAA,KACtE,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ,KAAK,GAAG,EAAE;AAAA,EAC1E,MAAM,MAAM;AAAA,KACR,MAAM,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,KAClE,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,MAAM,MAAM,EAAE;AAAA,KACjE,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,KACxE,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,gBAAgB;AACzF;AAcA,IAAM,qBAAoB,CAAC,UAAwD;AAAA,EACjF,MAAM,OAAO,aAAW,KAAK;AAAA,EAC7B,OAAO;AAAA,OACF;AAAA,IACH,cAAc,KAAK;AAAA,IACnB,MAAM,MAAM;AAAA,EACd;AAAA;AAIF,IAAM,kBAAkB;AAkDjB,IAAM,aAAa,CACxB,OACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,MAAK,KAAK;AAAA,EAClC,IAAI,aAAa;AAAA,IAAW,OAAO;AAAA,EAEnC,IAAI,MAAM,YAAY,aAAa,MAAM,cAAc,WAAW;AAAA,IAChE,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,MAAM,QAAQ,MAAM,gEACrB,0FACA,yFACA,yDACJ,CACF;AAAA,EACF;AAAA,EAaA,OAAO,UAAU,sBAAsB,KAAK,GAAG,QAAO,aAAW,KAAK,CAAC,GAAG,IAAI;AAAA,EAE9E,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,aACA,MACM,0BAAkB,mBAAkB,KAAK,CAAC,CAClD;AAAA,EAEA,MAAM,UAAS,CAAC,aACP,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,MAAK,KAAK;AAAA,IAC9B,IAAI,SAAS,aAAa,YAAY;AAAA,MAAG,OAAO;AAAA,IAChD,OAAc,eAAM,WAAW;AAAA,IAC/B,OAAO,OAAO,QAAO,WAAW,CAAC;AAAA,GAClC;AAAA,EAEH,MAAM,QAAQ,OAAO,QAAO,eAAe;AAAA,EAC3C,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,aACnB,IAAI,MACF,SAAS,MAAM,kBAAkB,MAAM,uBAAuB,KAAK,MAAM,WAAW,OAClF,2FACA,2DAA2D,MAAM,8BACjE,2FACA,yFACA,0FACA,yFACA,0FACA,oCACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAeI,IAAM,cAAc,CAAC,UAC1B,OACE,MAAM,QACN,aACA,MACM,0BAAkB,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK,CAAC,CAChE;;;AFvEK,IAAM,iBAAiB,WAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAEM,IAAM,yBAAyB,MAC3B,kBACP,gBACO,iBACL,eAAe,SAAS,GAAG;AAAA,EAGzB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAM7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,SAAS,IAAI,IAAI,eAAe,IAAI,CACpE;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAMvB,OAAO,UACL,sBAAsB,IAAI,GAC1B,QAAO,aAAW,IAAI,CAAC,GACvB,WAAW,SACb;AAAA,IACA,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IACvC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,mBAAmB,GAAG,KAAK,QAAQ,KAAK,MAAM;AAAA,MACvE,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IAOA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,UAAU,sBAAsB,IAAI,GAAG,QAAO,aAAW,IAAI,CAAC,GAAG,IAAI;AAAA,MAC5E,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAIA,OAAO,EAAE,QAAQ,OAAO;AAAA,GACzB;AAAA,EAUD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,OAAO,OAAO,WAAW,MAAM,CAAC,UAC9B,SAAS,KAAK,EAAE,KAAY,aAAI,eAAc,CAAC,CACjD;AAAA,GACD;AAAA,EACD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,YAAY,IAAI;AAAA,GACxB;AACH,CAAC,CACH,CACF;",
-  "debugId": "7C16E956F2A3150864756E2164756E21",
+  "mappings": ";AA4CA;AACA;AACA;AACA;AACA;;;ACpCA;;;AC4EA,IAAM,WAAW,CAAC,UAA0B,CAAC,GAAG,KAAK,EAAE;AAQvD,IAAM,aAAa,CAAC,MAAc,OAAe,SAAoC;AAAA,EACnF,MAAM,MAAgB,CAAC;AAAA,EACvB,IAAI,KAAK,cAAc,aAAa,SAAS,KAAK,IAAI,KAAK,WAAW;AAAA,IACpE,IAAI,KAAK,GAAG,iBAAiB,KAAK,sBAAsB;AAAA,EAC1D;AAAA,EACA,IAAI,KAAK,cAAc,aAAa,SAAS,KAAK,IAAI,KAAK,WAAW;AAAA,IACpE,IAAI,KAAK,GAAG,kBAAkB,KAAK,sBAAsB;AAAA,EAC3D;AAAA,EACA,IAAI,KAAK,SAAS,aAAa,CAAC,KAAK,KAAK,SAAS,KAAK,GAAG;AAAA,IACzD,IAAI,KAAK,GAAG,wBAAwB,KAAK,KAAK,KAAK,IAAI,GAAG;AAAA,EAC5D;AAAA,EAGA,IAAI,KAAK,YAAY,aAAa,CAAC,IAAI,OAAO,KAAK,SAAS,KAAK,YAAY,EAAE,KAAK,KAAK,GAAG;AAAA,IAC1F,IAAI,KAAK,GAAG,oBAAoB,KAAK,iBAAiB,KAAK,SAAS;AAAA,EACtE;AAAA,EAIA,MAAM,UAAU,OAAO,KAAK;AAAA,EAC5B,MAAM,UAAU,KAAK,YAAY,aAAa,KAAK,YAAY;AAAA,EAC/D,IAAI,WAAW,UAAU,MAAM,OAAO,SAAS,OAAO,GAAG;AAAA,IACvD,IAAI,KAAK,YAAY,aAAa,UAAU,KAAK,SAAS;AAAA,MACxD,IAAI,KAAK,GAAG,kBAAkB,KAAK,SAAS;AAAA,IAC9C;AAAA,IACA,IAAI,KAAK,YAAY,aAAa,UAAU,KAAK,SAAS;AAAA,MACxD,IAAI,KAAK,GAAG,iBAAiB,KAAK,SAAS;AAAA,IAC7C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,aAAa,CACxB,OACA,MACA,UAA4B,CAAC,MACP;AAAA,EACtB,MAAM,MAAgB,CAAC;AAAA,EACvB,YAAY,MAAM,SAAS,OAAO,QAAQ,KAAK,GAAG;AAAA,IAChD,MAAM,QAAQ,KAAK;AAAA,IACnB,IAAI,UAAU,WAAW;AAAA,MACvB,IAAI,QAAQ,aAAa,QAAQ,KAAK,aAAa;AAAA,QAAM,IAAI,KAAK,GAAG,gBAAgB;AAAA,MACrF;AAAA,IACF;AAAA,IAEA,WAAW,QAAQ,OAAO,UAAU,WAAW,CAAC,KAAK,IAAI,OAAO;AAAA,MAC9D,IAAI,KAAK,GAAG,WAAW,MAAM,MAAM,IAAI,CAAC;AAAA,IAC1C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,UAAU,CAAC,UAAuB,UAC7C,GAAG;AAAA,MAAkD,MAAM,KAAK;AAAA,KAAQ;AAAA,IACxE,uEACA;;;ACzIK,IAAM,yBAAwE;AAAA,EACnF,2BAA2B;AAAA,IACzB,SAAW,EAAC,QAAS,eAAc,UAAW,MAAK,MAAO,SAAQ;AAAA,EACpE;AAAA,EACA,0BAA0B;AAAA,IACxB,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,QAAU,EAAC,QAAS,cAAa,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,0BAA0B;AAAA,IACxB,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,aAAY,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC9D,QAAU,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACvC,WAAa,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,MAAQ,EAAC,SAAU,+BAA8B,eAAgB,yBAAwB,MAAO,SAAQ;AAAA,IACxG,UAAY,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC7C,UAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,QAAS,cAAa,WAAY,IAAG,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjF;AAAA,EACA,uBAAuB;AAAA,IACrB,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,MAAQ,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACxC,OAAS,EAAC,QAAS,mBAAkB,UAAW,MAAK,MAAO,SAAQ;AAAA,IACpE,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,OAAS,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,EACtD;AAAA,EACA,oCAAoC,CAAC;AAAA,EACrC,kCAAkC;AAAA,IAChC,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EACpD;AAAA,EACA,kCAAkC;AAAA,IAChC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,aAAY,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC9D,QAAU,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACvC,WAAa,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,MAAQ,EAAC,SAAU,+BAA8B,eAAgB,yBAAwB,MAAO,SAAQ;AAAA,IACxG,UAAY,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,EAC/C;AAAA,EACA,kDAAkD;AAAA,IAChD,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,SAAU,gBAAe,SAAU,GAAE,MAAO,UAAS;AAAA,EAClE;AACF;;;AC3CO,IAAM,iCAAgF;AAAA,EAC3F,4BAA4B;AAAA,IAC1B,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,SAAU,KAAI,MAAO,CAAC,KAAI,KAAI,QAAO,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC/E,KAAO,EAAC,SAAU,+BAA8B,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IAC/F,SAAW,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACpD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,IAAM,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACjE,UAAY,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACzD,kBAAoB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACnF,QAAU,EAAC,QAAS,0BAAyB,MAAO,SAAQ;AAAA,IAC5D,MAAQ,EAAC,SAAU,YAAW,MAAO,CAAC,YAAW,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClF,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,kBAAkB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACnD,qBAAqB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IAC9G,6BAA6B,EAAC,MAAO,CAAC,UAAS,QAAO,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,aAAe,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IAC7D,iBAAiB,EAAC,SAAU,cAAa,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjF,UAAY,EAAC,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1E,WAAa,EAAC,SAAU,2BAA0B,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IACrG,UAAY,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACxD,SAAW,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACrD,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EACnD;AAAA,EACA,gCAAgC;AAAA,IAC9B,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,SAAU,KAAI,MAAO,CAAC,KAAI,KAAI,QAAO,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC/E,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACpD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACjE,UAAY,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACzD,kBAAoB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACnF,QAAU,EAAC,QAAS,0BAAyB,MAAO,SAAQ;AAAA,IAC5D,MAAQ,EAAC,SAAU,YAAW,MAAO,CAAC,YAAW,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClF,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,kBAAkB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACnD,qBAAqB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IAC9G,6BAA6B,EAAC,MAAO,CAAC,UAAS,QAAO,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,aAAe,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IAC7D,iBAAiB,EAAC,SAAU,cAAa,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjF,UAAY,EAAC,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1E,WAAa,EAAC,SAAU,2BAA0B,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IACrG,UAAY,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACxD,SAAW,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACrD,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EACnD;AACF;;;ACnDO,IAAM,+BAA8E;AAAA,EACzF,sCAAsC;AAAA,IACpC,OAAS,EAAC,UAAW,MAAK,MAAO,UAAS;AAAA,EAC5C;AACF;;;ACJO,IAAM,mCAAkF;AAAA,EAC7F,sCAAsC;AAAA,IACpC,MAAQ,EAAC,QAAS,YAAW,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5D,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,oCAAmC,eAAgB,8BAA6B,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjK;AAAA,EACA,4CAA4C;AAAA,IAC1C,MAAQ,EAAC,QAAS,YAAW,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5D,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,oCAAmC,eAAgB,8BAA6B,MAAO,SAAQ;AAAA,EACnJ;AACF;;;ACZO,IAAM,6BAA4E;AAAA,EACvF,kCAAkC;AAAA,IAChC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACjD,cAAgB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3D,aAAe,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1D,KAAO,EAAC,QAAS,4BAA2B,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3E,OAAS,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,WAAU,WAAU,YAAW,SAAS,GAAE,MAAO,SAAQ;AAAA,IACzG,MAAQ,EAAC,MAAO,CAAC,MAAK,IAAI,GAAE,MAAO,SAAQ;AAAA,EAC7C;AAAA,EACA,8BAA8B;AAAA,IAC5B,UAAY,EAAC,MAAO,CAAC,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IAC3D,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,WAAa,EAAC,QAAS,2BAA0B,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChF,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,uCAAuC;AAAA,IACrC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,OAAS,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACjD,cAAgB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3D,aAAe,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1D,OAAS,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,WAAU,WAAU,YAAW,SAAS,GAAE,MAAO,SAAQ;AAAA,EAC3G;AAAA,EACA,oCAAoC;AAAA,IAClC,UAAY,EAAC,MAAO,CAAC,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IAC3D,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,WAAa,EAAC,QAAS,2BAA0B,MAAO,SAAQ;AAAA,EAClE;AACF;;;AChCO,IAAM,kCAAiF;AAAA,EAC5F,yCAAyC;AAAA,IACvC,eAAiB,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC/E,iBAAiB,EAAC,SAAU,YAAW,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,KAAO,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,KAAI,MAAO,UAAS;AAAA,IACvE,oBAAoB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC5E,gBAAgB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACjD,sBAAsB,EAAC,SAAU,YAAW,SAAU,MAAK,MAAO,UAAS;AAAA,IAC3E,iBAAiB,EAAC,SAAU,SAAQ,MAAO,CAAC,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC3E,4BAA4B,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC7D,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,UAAW,MAAK,MAAO,UAAS;AAAA,IACrE,OAAS,EAAC,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,WAAU,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7D,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,MAAQ,EAAC,MAAO,CAAC,YAAW,YAAW,eAAe,GAAE,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjH;AAAA,EACA,wCAAwC;AAAA,IACtC,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,eAAiB,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC/E,iBAAiB,EAAC,SAAU,YAAW,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,KAAO,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,KAAI,MAAO,UAAS;AAAA,IACvE,oBAAoB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC5E,gBAAgB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACjD,sBAAsB,EAAC,SAAU,YAAW,SAAU,MAAK,MAAO,UAAS;AAAA,IAC3E,iBAAiB,EAAC,SAAU,SAAQ,MAAO,CAAC,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC3E,4BAA4B,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC7D,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,UAAW,MAAK,MAAO,UAAS;AAAA,IACrE,OAAS,EAAC,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,WAAU,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7D,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,EACxD;AACF;;;ACpCO,IAAM,wCAAuF;AAAA,EAClG,oDAAoD;AAAA,IAClD,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC1C,OAAS,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC3C;AAAA,EACA,sDAAsD;AAAA,IACpD,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,IAChE,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,kDAAkD;AAAA,IAChD,gBAAgB,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,IAChE,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC5C;AAAA,EACA,qDAAqD;AAAA,IACnD,QAAU,EAAC,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IACtE,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,KAAO,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EACzC;AAAA,EACA,4CAA4C;AAAA,IAC1C,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,EAC/D;AAAA,EACA,0DAA0D;AAAA,IACxD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,EAC3C;AAAA,EACA,4DAA4D;AAAA,IAC1D,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,EAClE;AAAA,EACA,wDAAwD;AAAA,IACtD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,IAChE,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,EAC/E;AAAA,EACA,2DAA2D;AAAA,IACzD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,EACxD;AAAA,EACA,kDAAkD;AAAA,IAChD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,EAC/D;AACF;;;ACzDO,IAAM,sCAAqF;AAAA,EAChG,iCAAiC;AAAA,IAC/B,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,IAAM,EAAC,QAAS,0BAAyB,SAAU,kCAAiC,eAAgB,4BAA2B,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9J,MAAQ,EAAC,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpC,YAAc,EAAC,MAAO,CAAC,SAAQ,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtD,UAAY,EAAC,SAAU,QAAO,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3F,QAAU,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,YAAW,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9D,MAAQ,EAAC,MAAO,CAAC,OAAO,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC3D;AAAA,EACA,qCAAqC;AAAA,IACnC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,MAAQ,EAAC,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpC,YAAc,EAAC,MAAO,CAAC,SAAQ,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtD,UAAY,EAAC,SAAU,QAAO,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3F,QAAU,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,EAChD;AACF;;;ACpBO,IAAM,8BAA6E;AAAA,EACxF,+BAA+B;AAAA,IAC7B,OAAS,EAAC,WAAY,KAAI,eAAgB,qCAAoC,MAAO,SAAQ;AAAA,IAC7F,KAAO,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,MAAQ,EAAC,MAAO,CAAC,MAAM,GAAE,MAAO,SAAQ;AAAA,IACxC,MAAQ,EAAC,WAAY,GAAE,WAAY,GAAE,SAAU,yCAAwC,eAAgB,mCAAkC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACxK,MAAQ,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC1C;AAAA,EACA,8CAA8C;AAAA,IAC5C,mBAAmB,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,IACjD,cAAc,EAAC,MAAO,MAAK,QAAS,sBAAqB,MAAO,QAAO;AAAA,IACvE,eAAiB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACrD,SAAW,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,QAAS,qBAAoB,UAAW,MAAK,MAAO,SAAQ;AAAA,IACvE,MAAQ,EAAC,MAAO,CAAC,QAAQ,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC5D;AAAA,EACA,+BAA+B;AAAA,IAC7B,MAAQ,EAAC,MAAO,CAAC,SAAS,GAAE,MAAO,SAAQ;AAAA,IAC3C,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,WAAa,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACtD,qBAAqB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC3C,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,OAAS,EAAC,QAAS,WAAU,MAAO,SAAQ;AAAA,IAC5C,aAAa,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC5D,yBAAyB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,2CAA0C,eAAgB,qCAAoC,MAAO,QAAO;AAAA,IACzL,KAAO,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACpC,MAAQ,EAAC,MAAO,CAAC,QAAO,UAAS,QAAO,UAAS,QAAO,OAAO,GAAE,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IACxH,iBAAiB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IAChF,aAAa,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7D,cAAc,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5E,MAAQ,EAAC,WAAY,GAAE,WAAY,GAAE,SAAU,yCAAwC,eAAgB,mCAAkC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC1K;AAAA,EACA,wBAAwB,CAAC;AAAA,EACzB,qCAAqC;AAAA,IACnC,OAAS,EAAC,WAAY,KAAI,eAAgB,qCAAoC,MAAO,SAAQ;AAAA,IAC7F,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,KAAO,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,EACzD;AAAA,EACA,sDAAsD;AAAA,IACpD,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,mBAAmB,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,IACjD,cAAc,EAAC,MAAO,MAAK,QAAS,sBAAqB,MAAO,QAAO;AAAA,IACvE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,eAAiB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACrD,SAAW,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,EAC3C;AAAA,EACA,qCAAqC;AAAA,IACnC,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,MAAQ,EAAC,MAAO,CAAC,SAAS,GAAE,MAAO,SAAQ;AAAA,IAC3C,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,WAAa,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACtD,qBAAqB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC3C,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,OAAS,EAAC,QAAS,WAAU,MAAO,SAAQ;AAAA,IAC5C,aAAa,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC5D,yBAAyB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,2CAA0C,eAAgB,qCAAoC,MAAO,QAAO;AAAA,IACzL,KAAO,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACpC,iBAAiB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IAChF,aAAa,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7D,cAAc,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,EAC9E;AACF;;;ACnEO,IAAM,6BAA4E;AAAA,EACvF,yCAAyC;AAAA,IACvC,QAAU,EAAC,SAAU,OAAM,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,EACzE;AAAA,EACA,0CAA0C,CAAC;AAAA,EAC3C,wCAAwC,CAAC;AAAA,EACzC,2CAA2C;AAAA,IACzC,eAAe,EAAC,QAAS,WAAU,MAAO,SAAQ;AAAA,EACpD;AAAA,EACA,mCAAmC;AAAA,IACjC,aAAe,EAAC,SAAU,GAAE,MAAO,SAAQ;AAAA,IAC3C,KAAO,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACvC,mBAAmB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAChD,cAAgB,EAAC,SAAU,KAAI,MAAO,SAAQ;AAAA,EAChD;AAAA,EACA,oCAAoC;AAAA,IAClC,aAAe,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,UAAS,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,UAAY,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,MAAQ,EAAC,eAAgB,oBAAmB,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3E,mBAAqB,EAAC,SAAU,QAAO,MAAO,CAAC,MAAK,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IACjF,QAAU,EAAC,SAAU,OAAM,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACvE,YAAc,EAAC,SAAU,OAAM,MAAO,UAAS;AAAA,IAC/C,MAAQ,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IAC/D,aAAe,EAAC,SAAU,qCAAoC,eAAgB,+BAA8B,MAAO,SAAQ;AAAA,EAC7H;AAAA,EACA,0CAA0C;AAAA,IACxC,aAAe,EAAC,MAAO,CAAC,OAAM,UAAS,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,UAAY,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,mBAAqB,EAAC,MAAO,CAAC,MAAK,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,YAAc,EAAC,SAAU,OAAM,MAAO,UAAS;AAAA,IAC/C,MAAQ,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACjD,aAAe,EAAC,SAAU,qCAAoC,eAAgB,+BAA8B,MAAO,SAAQ;AAAA,EAC7H;AACF;;;AClCO,IAAM,8BAA6E;AAAA,EACxF,oCAAoC;AAAA,IAClC,QAAU,EAAC,SAAU,MAAK,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,aAAe,EAAC,SAAU,MAAK,MAAO,CAAC,MAAK,OAAM,QAAO,OAAM,QAAO,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IACnG,SAAW,EAAC,QAAS,eAAc,UAAW,MAAK,MAAO,SAAQ;AAAA,IAClE,MAAQ,EAAC,QAAS,kBAAiB,UAAW,MAAK,MAAO,SAAQ;AAAA,IAClE,WAAa,EAAC,MAAO,CAAC,UAAS,UAAS,UAAS,SAAQ,UAAS,UAAS,SAAQ,UAAS,QAAQ,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EACvI;AACF;;;ACRO,IAAM,4BAA2E;AAAA,EACtF,8BAA8B;AAAA,IAC5B,MAAQ,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,QAAO,SAAQ,SAAQ,WAAU,SAAS,GAAE,MAAO,SAAQ;AAAA,IACtG,SAAW,EAAC,SAAU,mDAAkD,SAAU,GAAE,MAAO,SAAQ;AAAA,IACnG,OAAS,EAAC,SAAU,OAAM,MAAO,CAAC,SAAQ,WAAU,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC1E,OAAS,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,UAAY,EAAC,SAAU,KAAI,SAAU,MAAK,SAAU,GAAE,MAAO,SAAQ;AAAA,IACrE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,YAAc,EAAC,SAAU,cAAa,eAAgB,wCAAuC,MAAO,SAAQ;AAAA,IAC5G,KAAO,EAAC,eAAgB,6FAA4F,MAAO,SAAQ;AAAA,IACnI,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,UAAY,EAAC,QAAS,YAAW,WAAY,KAAI,MAAO,SAAQ;AAAA,IAChE,MAAQ,EAAC,MAAO,CAAC,UAAS,UAAS,aAAY,QAAO,UAAS,WAAU,WAAU,YAAW,YAAW,iBAAiB,GAAE,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,SAAU,OAAM,SAAU,IAAG,MAAO,UAAS;AAAA,IACxD,YAAc,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACnE,YAAc,EAAC,WAAY,KAAI,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9D,QAAU,EAAC,MAAO,CAAC,UAAS,UAAS,UAAS,UAAS,UAAS,YAAW,aAAY,UAAS,UAAS,SAAQ,WAAW,GAAE,MAAO,SAAQ;AAAA,IAC7I,UAAY,EAAC,WAAY,GAAE,MAAO,SAAQ;AAAA,IAC1C,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,cAAgB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACzD,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,SAAU,SAAQ,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvE,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IAC9D,MAAQ,EAAC,QAAS,YAAW,SAAU,WAAU,SAAU,KAAI,UAAW,MAAK,MAAO,UAAS;AAAA,EACjG;AAAA,EACA,2CAA2C;AAAA,IACzC,MAAQ,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,QAAO,SAAQ,SAAQ,WAAU,SAAS,GAAE,MAAO,SAAQ;AAAA,IACtG,OAAS,EAAC,SAAU,OAAM,MAAO,CAAC,SAAQ,WAAU,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC1E,OAAS,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,UAAY,EAAC,SAAU,KAAI,SAAU,MAAK,SAAU,GAAE,MAAO,SAAQ;AAAA,IACrE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,YAAc,EAAC,SAAU,cAAa,eAAgB,wCAAuC,MAAO,SAAQ;AAAA,IAC5G,KAAO,EAAC,eAAgB,6FAA4F,MAAO,SAAQ;AAAA,IACnI,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,UAAY,EAAC,QAAS,YAAW,WAAY,KAAI,MAAO,SAAQ;AAAA,IAChE,MAAQ,EAAC,MAAO,CAAC,UAAS,UAAS,aAAY,QAAO,UAAS,WAAU,WAAU,YAAW,YAAW,iBAAiB,GAAE,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,SAAU,OAAM,SAAU,IAAG,MAAO,UAAS;AAAA,IACxD,YAAc,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACnE,QAAU,EAAC,MAAO,CAAC,UAAS,UAAS,UAAS,UAAS,UAAS,YAAW,aAAY,UAAS,UAAS,SAAQ,WAAW,GAAE,MAAO,SAAQ;AAAA,IAC7I,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,cAAgB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACzD,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,EAChE;AAAA,EACA,2CAA2C;AAAA,IACzC,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,MAAQ,EAAC,MAAO,CAAC,UAAS,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,OAAO,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC58D,MAAQ,EAAC,SAAU,mCAAkC,eAAgB,6BAA4B,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClI;AACF;;;AC3DO,IAAM,gCAA+E;AAAA,EAC1F,kCAAkC;AAAA,IAChC,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,gBAAgB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACrD,WAAa,EAAC,MAAO,CAAC,cAAa,iBAAgB,eAAc,aAAY,WAAU,eAAc,eAAc,eAAc,oBAAmB,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IACvL,uBAAyB,EAAC,MAAO,CAAC,UAAS,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,cAAgB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC1D,aAAe,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACpE,MAAQ,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC1C,OAAS,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC3C,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,aAAY,WAAY,IAAG,WAAY,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3F,KAAO,EAAC,SAAU,OAAM,SAAU,MAAK,MAAO,UAAS;AAAA,IACvD,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,YAAc,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACnD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,QAAU,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACpD,MAAQ,EAAC,MAAO,CAAC,UAAS,QAAO,OAAM,SAAQ,QAAO,UAAS,aAAY,WAAU,WAAU,cAAa,QAAO,SAAS,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7J,WAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,mBAAmB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,EAC1D;AAAA,EACA,iCAAiC,CAAC;AAAA,EAClC,yCAAyC;AAAA,IACvC,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,gBAAgB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACrD,WAAa,EAAC,MAAO,CAAC,cAAa,iBAAgB,eAAc,aAAY,WAAU,eAAc,eAAc,eAAc,oBAAmB,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IACvL,uBAAyB,EAAC,MAAO,CAAC,UAAS,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,cAAgB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC1D,aAAe,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACpE,MAAQ,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC1C,OAAS,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC3C,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,KAAO,EAAC,SAAU,OAAM,SAAU,MAAK,MAAO,UAAS;AAAA,IACvD,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,YAAc,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACnD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,QAAU,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACpD,MAAQ,EAAC,MAAO,CAAC,UAAS,QAAO,OAAM,SAAQ,QAAO,UAAS,aAAY,WAAU,WAAU,cAAa,QAAO,SAAS,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7J,WAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,mBAAmB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,EAC1D;AACF;;;ACtDO,IAAM,6BAA4E;AAAA,EACvF,+BAA+B;AAAA,IAC7B,UAAY,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAClD,WAAW,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACvD,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpD,SAAW,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3C,SAAW,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACxC,MAAQ,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtE,MAAQ,EAAC,QAAS,eAAc,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,SAAU,oCAAmC,eAAgB,8BAA6B,MAAO,SAAQ;AAAA,IACjJ,SAAW,EAAC,SAAU,mDAAkD,SAAU,GAAE,MAAO,UAAS;AAAA,IACpG,OAAS,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,YAAY,GAAE,MAAO,SAAQ;AAAA,IACzE,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,KAAO,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAClD,UAAY,EAAC,SAAU,KAAI,SAAU,KAAI,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,cAAc,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,SAAU,oBAAmB,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IACxF,WAAa,EAAC,MAAO,CAAC,OAAM,KAAI,MAAM,GAAE,MAAO,SAAQ;AAAA,IACvD,0BAA0B,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACpE,aAAa,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACzD,eAAe,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,MAAO,CAAC,MAAK,SAAQ,MAAK,SAAQ,SAAQ,MAAK,MAAK,MAAK,SAAQ,SAAQ,SAAQ,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,SAAQ,MAAK,MAAK,IAAI,GAAE,MAAO,SAAQ;AAAA,IACvL,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAQ,UAAS,WAAU,YAAW,YAAW,mBAAkB,cAAa,WAAW,GAAE,MAAO,SAAQ;AAAA,IACtI,kBAAoB,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,SAAQ;AAAA,IAChE,eAAiB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5D,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,YAAc,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACtD,QAAU,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,OAAM,OAAM,QAAO,QAAO,UAAS,QAAO,QAAO,SAAQ,SAAQ,OAAM,OAAM,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpJ,eAAe,EAAC,SAAU,0CAAyC,eAAgB,oCAAmC,MAAO,SAAQ;AAAA,IACrI,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,aAAY,mBAAkB,sBAAqB,WAAU,QAAQ,GAAE,MAAO,SAAQ;AAAA,IAC/H,aAAa,EAAC,SAAU,6BAA4B,eAAgB,uBAAsB,MAAO,SAAQ;AAAA,IACzG,QAAU,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,SAAW,EAAC,QAAS,kBAAiB,WAAY,KAAI,MAAO,SAAQ;AAAA,IACrE,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAClD,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IACjD,WAAa,EAAC,SAAU,OAAM,SAAU,sEAAqE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,IAC3M,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACrD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,SAAW,EAAC,SAAU,qBAAoB,SAAU,uEAAsE,eAAgB,iEAAgE,MAAO,SAAQ;AAAA,IACzN,MAAQ,EAAC,QAAS,YAAW,SAAU,WAAU,SAAU,KAAI,UAAW,MAAK,MAAO,UAAS;AAAA,IAC/F,gBAAkB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC5D,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,EACzD;AAAA,EACA,4CAA4C;AAAA,IAC1C,UAAY,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAClD,WAAW,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACvD,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpD,SAAW,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACxC,MAAQ,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtE,MAAQ,EAAC,QAAS,eAAc,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,SAAU,oCAAmC,eAAgB,8BAA6B,MAAO,SAAQ;AAAA,IACjJ,OAAS,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,YAAY,GAAE,MAAO,SAAQ;AAAA,IACzE,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,KAAO,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAClD,UAAY,EAAC,SAAU,KAAI,SAAU,KAAI,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,cAAc,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,SAAU,oBAAmB,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IACxF,WAAa,EAAC,MAAO,CAAC,OAAM,KAAI,MAAM,GAAE,MAAO,SAAQ;AAAA,IACvD,aAAa,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACzD,eAAe,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,MAAO,CAAC,MAAK,SAAQ,MAAK,SAAQ,SAAQ,MAAK,MAAK,MAAK,SAAQ,SAAQ,SAAQ,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,SAAQ,MAAK,MAAK,IAAI,GAAE,MAAO,SAAQ;AAAA,IACvL,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAQ,UAAS,WAAU,YAAW,YAAW,mBAAkB,cAAa,WAAW,GAAE,MAAO,SAAQ;AAAA,IACtI,kBAAoB,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,SAAQ;AAAA,IAChE,eAAiB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5D,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,YAAc,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACtD,QAAU,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,OAAM,OAAM,QAAO,QAAO,UAAS,QAAO,QAAO,SAAQ,SAAQ,OAAM,OAAM,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpJ,eAAe,EAAC,SAAU,0CAAyC,eAAgB,oCAAmC,MAAO,SAAQ;AAAA,IACrI,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,aAAY,mBAAkB,sBAAqB,WAAU,QAAQ,GAAE,MAAO,SAAQ;AAAA,IAC/H,aAAa,EAAC,SAAU,6BAA4B,eAAgB,uBAAsB,MAAO,SAAQ;AAAA,IACzG,QAAU,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,SAAW,EAAC,QAAS,kBAAiB,WAAY,KAAI,MAAO,SAAQ;AAAA,IACrE,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAClD,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IACjD,WAAa,EAAC,SAAU,OAAM,SAAU,sEAAqE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,IAC3M,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,SAAW,EAAC,SAAU,qBAAoB,SAAU,uEAAsE,eAAgB,iEAAgE,MAAO,SAAQ;AAAA,IACzN,gBAAkB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC5D,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,EACzD;AACF;;;ACtGO,IAAM,wBAAuE;AAAA,EAClF,mBAAmB;AAAA,IACjB,QAAU,EAAC,QAAS,cAAa,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,2BAA2B;AAAA,IACzB,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,KAAO,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EAClD;AACF;;;ACRO,IAAM,0BAAyE;AAAA,EACpF,qBAAqB;AAAA,IACnB,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjD,WAAa,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IAClE,SAAW,EAAC,QAAS,4BAA2B,MAAO,SAAQ;AAAA,IAC/D,gBAAgB,EAAC,QAAS,yBAAwB,MAAO,SAAQ;AAAA,IACjE,QAAU,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1C,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,aAAe,EAAC,SAAU,6CAA4C,eAAgB,uCAAsC,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,MAAO,CAAC,OAAM,SAAQ,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IACjE,WAAW,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACnD,yBAAyB,EAAC,SAAU,4EAA2E,SAAU,IAAG,MAAO,UAAS;AAAA,IAC5I,SAAW,EAAC,QAAS,+BAA8B,MAAO,SAAQ;AAAA,IAClE,YAAc,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IAC1D,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC5C,MAAQ,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACpD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,QAAU,EAAC,QAAS,0BAAyB,MAAO,SAAQ;AAAA,IAC5D,eAAiB,EAAC,SAAU,YAAW,MAAO,CAAC,OAAM,YAAW,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IAChG,iBAAiB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAC1D,uBAAuB,EAAC,SAAU,MAAK,MAAO,CAAC,KAAI,KAAI,KAAI,KAAI,MAAK,IAAI,GAAE,MAAO,UAAS;AAAA,IAC1F,QAAU,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IACxD,YAAc,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,OAAM,OAAM,KAAI,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClG,SAAW,EAAC,QAAS,kBAAiB,UAAW,MAAK,MAAO,SAAQ;AAAA,IACrE,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,UAAY,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IAC1D,MAAQ,EAAC,MAAO,CAAC,SAAQ,UAAS,QAAO,OAAM,QAAO,SAAQ,eAAc,OAAM,WAAU,OAAM,OAAM,OAAM,OAAM,SAAS,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9J,QAAU,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IACxD,iBAAiB,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,EAC/D;AAAA,EACA,8BAA8B;AAAA,IAC5B,WAAa,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IAClE,SAAW,EAAC,QAAS,4BAA2B,MAAO,SAAQ;AAAA,IAC/D,gBAAgB,EAAC,QAAS,yBAAwB,MAAO,SAAQ;AAAA,IACjE,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1C,aAAe,EAAC,SAAU,6CAA4C,eAAgB,uCAAsC,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,MAAO,CAAC,OAAM,SAAQ,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IACjE,WAAW,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACnD,yBAAyB,EAAC,SAAU,4EAA2E,SAAU,IAAG,MAAO,UAAS;AAAA,IAC5I,SAAW,EAAC,QAAS,+BAA8B,MAAO,SAAQ;AAAA,IAClE,YAAc,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IAC1D,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC5C,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,eAAiB,EAAC,SAAU,YAAW,MAAO,CAAC,OAAM,YAAW,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IAChG,iBAAiB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAC1D,uBAAuB,EAAC,SAAU,MAAK,MAAO,CAAC,KAAI,KAAI,KAAI,KAAI,MAAK,IAAI,GAAE,MAAO,UAAS;AAAA,IAC1F,QAAU,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IACxD,YAAc,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,OAAM,OAAM,KAAI,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClG,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,iBAAiB,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,EAC/D;AACF;;;ACzDO,IAAM,yBAAwE;AAAA,EACnF,8BAA8B;AAAA,IAC5B,kBAAkB,EAAC,SAAU,iDAAgD,eAAgB,mDAAkD,MAAO,SAAQ;AAAA,IAC9J,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,qBAAqB,EAAC,SAAU,uBAAsB,MAAO,CAAC,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IACtH,eAAe,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,qEAAoE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,IACzN,MAAQ,EAAC,WAAY,MAAK,WAAY,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EACzE;AAAA,EACA,qDAAqD;AAAA,IACnD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IAC9I,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,EACjF;AAAA,EACA,iDAAiD;AAAA,IAC/C,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,gBAAgB,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IAC9I,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IAC/E,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,QAAU,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC5C;AAAA,EACA,oDAAoD;AAAA,IAClD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IACvF,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IAC/E,KAAO,EAAC,SAAU,mmHAAsmH,eAAgB,qmHAAwmH,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjxO;AAAA,EACA,2CAA2C;AAAA,IACzC,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IAC/E,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,EAC5K;AAAA,EACA,0BAA0B;AAAA,IACxB,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,IAAM,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3K,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,UAAY,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAChL;AAAA,EACA,yBAAyB;AAAA,IACvB,yBAAyB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,IAClL,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,aAAa,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IAC1D,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,IAAM,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3K,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,2KAA0K,eAAgB,+JAA8J,MAAO,SAAQ;AAAA,IACxZ,WAAW,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACxD,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC/J,aAAa,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IACrP,gBAAgB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACrL,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC1E,iBAAiB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC9C,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AAAA,EACA,2BAA2B;AAAA,IACzB,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,IAAM,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3K,aAAa,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACpE,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,kBAAkB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC/C,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AAAA,EACA,oCAAoC;AAAA,IAClC,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,eAAc,iBAAgB,kBAAiB,aAAY,eAAc,cAAa,eAAc,gBAAe,eAAc,cAAa,eAAc,UAAS,qBAAoB,UAAS,oBAAmB,2BAA0B,wBAAwB,GAAE,MAAO,QAAO;AAAA,IAChU,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,qBAAqB,EAAC,SAAU,uBAAsB,MAAO,CAAC,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IACtH,eAAe,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,qEAAoE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,EAC3N;AAAA,EACA,2DAA2D;AAAA,IACzD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,UAAS,WAAU,WAAU,gBAAe,UAAS,aAAa,GAAE,MAAO,QAAO;AAAA,IACjH,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,EAChJ;AAAA,EACA,uDAAuD;AAAA,IACrD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,UAAS,WAAU,WAAU,UAAS,eAAc,YAAW,QAAO,UAAU,GAAE,MAAO,QAAO;AAAA,IAC/H,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IAC9I,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,EACvD;AAAA,EACA,0DAA0D;AAAA,IACxD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,WAAU,UAAS,QAAO,QAAQ,GAAE,MAAO,QAAO;AAAA,IAC3F,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,QAAU,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IACvE,KAAO,EAAC,SAAU,mmHAAsmH,eAAgB,qmHAAwmH,MAAO,SAAQ;AAAA,EACjwO;AAAA,EACA,iDAAiD;AAAA,IAC/C,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,WAAU,gBAAe,kBAAiB,eAAc,kBAAiB,QAAO,QAAQ,GAAE,MAAO,QAAO;AAAA,IACjJ,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,EAC5K;AAAA,EACA,8BAA8B;AAAA,IAC5B,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,WAAU,MAAK,aAAY,aAAY,eAAc,cAAa,eAAc,gBAAe,aAAa,GAAE,MAAO,QAAO;AAAA,IACrK,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,EAChK;AAAA,EACA,6BAA6B;AAAA,IAC3B,yBAAyB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,IAClL,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,aAAa,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IAC1D,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,UAAS,SAAQ,WAAU,YAAW,mBAAkB,gBAAe,WAAU,YAAW,YAAW,aAAY,MAAK,aAAY,aAAY,iBAAgB,kBAAiB,iBAAgB,gBAAe,mBAAkB,kBAAiB,kBAAiB,yBAAwB,gBAAgB,GAAE,MAAO,QAAO;AAAA,IAC3V,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,2KAA0K,eAAgB,+JAA8J,MAAO,SAAQ;AAAA,IACxZ,WAAW,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACxD,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC/J,aAAa,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IACrP,gBAAgB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IACrK,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9J,kBAAkB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC1E,iBAAiB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC9C,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AAAA,EACA,+BAA+B;AAAA,IAC7B,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,mBAAkB,WAAU,YAAW,kBAAiB,MAAK,aAAY,gBAAe,gBAAgB,GAAE,MAAO,QAAO;AAAA,IACvJ,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,aAAa,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACpE,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,kBAAkB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC/C,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9J,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AACF;;;AC9KO,IAAM,sBAAqE;AAAA,KAC7E;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AACL;;;AnB3BO,IAAM,iBAAiB,CAAC,QAA0C;AAAA,EACvE,MAAM,QAAQ,oBAAoB;AAAA,EAClC,IAAI,UAAU,WAAW;AAAA,IACvB,MAAM,IAAI,MACR,mCAAmC,0DACjC,2DACJ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,iBAAiB,CAC5B,KACA,MACA,aACsB,WAAW,eAAe,GAAG,GAAG,MAAM,EAAE,SAAS,CAAC;AAQnE,IAAM,YAAY,CACvB,KACA,MACA,aAEO,eAAQ,MAAM;AAAA,EACnB,IAAI,QAAQ;AAAA,IAAW,OAAc;AAAA,EACrC,MAAM,QAAQ,eAAe,KAAK,MAAM,QAAQ;AAAA,EAChD,OAAO,MAAM,WAAW,IAAW,cAAc,WAAI,IAAI,MAAM,QAAQ,KAAK,KAAK,CAAC,CAAC;AAAA,CACpF;;;AoBzCI,IAAM,YAAY,CAAC,QAAgB,IAAI,IAAI,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG;AAGrF,IAAM,gBAAgB,EAAE,OAAO,UAAU,OAAO,UAAU,MAAM,QAAQ;AAGxE,IAAM,WAAW;AAGV,IAAM,QAAQ,CAAC,WAAiD;AAAA,EACrE,MAAM,UAAU,MAAM,IAAI;AAAA,EAC1B,OAAO,MAAM;AAAA,GACZ,cAAc,MAAM,QAAQ,MAAM;AACrC;AAGO,IAAM,OAAO,CAAC,WAAiD;AAAA,KACjE,MAAM,KAAK;AAAA,EACd,WAAW,MAAM,cAAc,QAAQ,MAAM;AAC/C;AAGA,IAAM,SAAS,CAAC,SACd,OAAO,YAAY,OAAO,QAAQ,IAAI,EAAE,OAAO,CAAC,MAA6B,EAAE,OAAO,SAAS,CAAC;AAQ3F,IAAM,aAAa,CAAC,UAAoB,UAAU,UAAU,OAAO,KAAK,KAAK,CAAC,GAAG,IAAI;AAGrF,IAAM,WAAW,CAAC,UACvB,CAAC,UAAU,MAAM,IAAI,GAAG,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,EAAE,KAAK,GAAG;AAExE,IAAM,OAAO,CAAC,MAAuD,UACnE,KAAK,KACH,CAAC,QACC,IAAI,SAAS,UAAU,MAAM,IAAI,KACjC,IAAI,SAAS,MAAM,QACnB,IAAI,SAAS,MAAM,QACnB,IAAI,WAAW,MAAM,MACzB;AAMF,IAAM,aAAa,CAAC,QAA8C;AAAA,EAChE,MAAM,QAAQ,IAAI;AAAA,EAClB,OAAO,UAAU,aAAa,UAAU,KAAK,UAAU,QAAQ,UAAU;AAAA;AAGpE,IAAM,eAAe,CAC1B,MACA,UACkB;AAAA,EAClB,MAAM,MAAM,KAAK,MAAM,KAAK;AAAA,EAC5B,OAAO;AAAA,IACL,OAAO,QAAQ;AAAA,IACf,MAAM,UAAU,MAAM,IAAI;AAAA,IAC1B,WAAW,QAAQ,aAAa,WAAW,GAAG;AAAA,IAC9C,QAAQ,MAAM;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,EACd;AAAA;AAGK,IAAM,UAAU,CAAC,YAA2B,UACjD,WAAW,SAAS,WAAW,eAAe,MAAM,cAAc;;;AC5BpE;AACA;AAEA,wBAAS;AAET;;;ACdA;AACA;AACA;AACA;;;ACvCA;AACA;AACA;AACA;AACA;AACA;;;ACVA;AAAA;AAiBO,MAAM,4BAAiC,iBAAY,qBAAqB,EAI5E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,mBAAmB,KAAK,eAAe,KAAK,gBAAgB,KAAK,6BACjE;AAAA;AAGN;;;ADbA,IAAM,cAAc,CAAC,KAAqB,SACxC,IAAI,OAAO,WAAW,IAAI,SAAS,WAAW;AA0BzC,IAAM,OAAO,CAAC,QAAmB,MAAe,MAAsB,QAAQ,QAC5E,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,GAAG,OAAO,eAAe;AAAA,EAGtC,MAAM,SAAS,CAAC,SAAgB,WAC9B,IAAI,MAAM,mBAAmB,WAAW,YAAW,IAAI,gBAAgB,YAAW,QAAQ;AAAA,EAC5F,MAAM,UACJ,YAAY,KAAK,YAAY,KAAK,YAAY,KAAK,MAAM,KAAK;AAAA,EAChE,MAAM,SAAS,QAAQ,WAAW,SAAS,IAAI,QAAQ,MAAM,UAAU,MAAM,IAAI;AAAA,EACjF,MAAM,OAAO,WAAW,YAAY,QAAQ,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAClE,MAAM,UAAkC,EAAE,mBAAmB,OAAO;AAAA,EACpE,MAAM,YAAY,YAAY,KAAK,WAAW;AAAA,EAC9C,IAAI,cAAc;AAAA,IAAI,QAAQ,uBAAuB;AAAA,EACrD,MAAM,QAAQ,YAAY,KAAK,OAAO;AAAA,EACtC,IAAI,UAAU;AAAA,IAAI,QAAQ,mBAAmB;AAAA,EAC7C,IAAI,WAAW,aAAa,EAAE,SAAS,aAAa;AAAA,IAClD,OAAO,OAAc,aAAK,OAAO,GAAG,oDAAoD,CAAC;AAAA,EAC3F;AAAA,EAEA,MAAM,SAAS,OAAkB;AAAA,EAGjC,MAAM,WAAW,OAAe;AAAA,EAChC,MAAM,WAAkB,iBACtB,OAAc,sBAA8B,2BAAW,GACvD,OAAO,CAAC,EACV;AAAA,EACA,MAAM,UAA4B,sBAAI,GAAG,WAAW,MAAM,EAAE,KACxC,6BAAW,OAAO,CACtC;AAAA,EACA,MAAM,WAAW,OAAO,QAAQ,OAAO,EAAE,KAChC,gBAAQ,CAAC,aACP,YAAI,SAAS,MAAM,CAAC,WAAU,EAAE,QAAQ,SAAS,QAAQ,YAAK,EAAE,CACzE,GAEO,gBAAQ,YAAY,GACpB,uBAAuB,8BAAsB,CAAC,GAAG,UAAU,eAAe,CAAC,CACpF;AAAA,EAKA,MAAM,OAAoD,KAAK,UAAU,MAAM,OAAO;AAAA,EACtF,QAAQ,QAAQ,SAAS,QACvB,WAAW,YACP,WACO,uBAAe,UAA0B,6BAAa,IAAI,GACrE,KAEO,iBAAS,CAAC,UAAU,OAAO,GAAG,MAAM,OAAO,CAAC,CACrD;AAAA,EAEA,IAAI;AAAA,EAOJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,IAAI;AAAA,IACxB,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,EAEX,IAAI,SAAS,OAAO,UAAU,KAAK;AAAA,IACjC,MAAM,SAAS,QAAQ;AAAA,IACvB,MAAM,gBAAgB,MAAM,QAAQ,MAAM;AAAA,IAC1C,MAAM,SAAS,gBAAgB,OAAO,IAAI,MAAM,EAAE,KAAK,IAAI,IAAI;AAAA,IAY/D,IAAI,WAAW,OAAO,eAAe;AAAA,MACnC,OAAO,OAAc,aAAK,IAAI,oBAAoB,EAAE,QAAQ,OAAO,OAAO,OAAO,KAAK,CAAC,CAAC;AAAA,IAC1F;AAAA,IACA,OAAO,OAAc,aAAK,OAAO,QAAQ,UAAU,mBAAmB,CAAC;AAAA,EACzE;AAAA,EACA,MAAM,UAAU,QAAQ,MAAM;AAAA,EAC9B,MAAM,SAAS,QAAQ,MAAM;AAAA,EAC7B,IAAI,OAAO,YAAY,YAAY,OAAO,WAAW,UAAU;AAAA,IAE7D,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,eAAe,iEACvB,kCAAkC,OAAO,gDACzC,kFACJ,CACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,QAAQ;AAAA,EACtB,MAAM,eAAe,OAAO,UAAU,WAAW,QAAQ;AAAA,EACzD,OAAO,EAAE,cAAc,QAAQ,QAAQ;AAAA,CACxC;AAQI,IAAM,gBAAgB,CAAC,YAA2B,WACvD,OAAO,WAAW,QACd,eAAe,WAAW,WAAW,WAAW,WAChD,eAAe,WAAW,WAAW,WAAW;;;AD9FtD,IAAM,wBAAwB;AAmB9B,IAAM,QAAQ,CAAC,QAAmB,UAA6B;AAAA,EAC7D,OAAO,OAAO;AAAA,EACd;AAAA,EACA,QAAQ,OAAO;AACjB;AAWO,IAAM,aAAa,CAAC,SACpB,eAAU,IAAI,KAAK,KAAK,MAAM,eAAe,wBACrC,iBAAQ,KAAK,MAAM,eAAe,qBAAqB,IACvD;AAcR,IAAM,aAAa,CAAO,YACzB,eAAS,SAAS,EAAE,UAAU,IAAI,mBAAmB,UAAU,WAAW,CAAC;AAEnF,IAAM,eAAe,CAAC,QACpB,IAAI,WAAW,QACX,EAAE,KAAK,iCAAiC,OAAO,IAAI,OAAO,QAAQ,MAAM,IACxE,EAAE,SAAS,CAAC,GAAG,OAAO,IAAI,OAAO,QAAQ,MAAM;AAErD,IAAM,SAAgB,gBAAQ,WAAW,CAAC,QAAQ,KAAK,aAAa,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAS7E,IAAM,SAAS,CAAC,QAAmB,SAAwB,UAAI,QAAQ,MAAM,QAAQ,IAAI,CAAC;;;AG3HjG;AAEA;AACA;AACA;AACA;AAKO,IAAM,eAAe;AAGrB,IAAM,aAAa,CAAC,WAAmB,WAAW,UAAU,OAAO,YAAY;AAgB/E,IAAM,iBAAiC;AAG9C,IAAM,kBAAkB,IAAI;AAKrB,IAAM,iBAAiB,CAAC,QAAmB,WAAmB;AAAA,EACnE,gBAAgB,IAAI,OAAO,OAAO,MAAM;AAAA;AAInC,IAAM,iBAAiB,CAAC,WAAyC;AAAA,EACtE,MAAM,YAAY,gBAAgB,IAAI,OAAO,KAAK;AAAA,EAClD,IAAI,cAAc,aAAa,CAAC,OAAO,QAAQ,SAAS,SAAS;AAAA,IAAG,OAAO,OAAO;AAAA,EAClF,OAAO,CAAC,WAAW,GAAG,OAAO,QAAQ,OAAO,CAAC,WAAW,WAAW,SAAS,CAAC;AAAA;AAG/E,IAAM,YAAY,CAAC,UAAuC;AAAA,EACxD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,IAAI,UAAU,SAAS,OAAO,MAAM,SAAS;AAAA,MAAU,OAAO,MAAM;AAAA,IACpE,IAAI,WAAW;AAAA,MAAO,OAAO,UAAW,MAA6B,KAAK;AAAA,EAC5E;AAAA,EACA;AAAA;AAGF,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,IAAI,SAAS,gBAAgB,SAAS,eAAe,SAAS,2BAA2B;AAAA,IACvF,OAAO;AAAA,EACT;AAAA,EACA,OAAO,iBAAiB,SAAS,qBAAqB,KAAK,MAAM,OAAO;AAAA;AAkB1E,IAAM,iBAAiB,IAAI,IAAI,CAAC,qBAAqB,gBAAgB,aAAa,WAAW,CAAC;AAE9F,IAAM,oBAAoB,CAAC,SACzB,mFAAmF,KAAK,IAAI;AAE9F,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,OAAO,SAAS,cAAc,eAAe,IAAI,IAAI,KAAK,kBAAkB,IAAI;AAAA;AAW3E,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAU,qBAAe,KAAK;AAAA,IAAG,OAAO;AAAA,EACxC,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,MAAM,MAAM,MAAM,OAAO;AAAA,EACzB,OAAO,QAAQ,oBAAoB,QAAQ,qBAAqB,QAAQ;AAAA;AASnE,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,QAAQ,WAAW;AAAA,EACnB,IAAI,OAAO,SAAS,qBAAqB,OAAO,SAAS;AAAA,IAAe,OAAO;AAAA,EAC/E,IAAI,OAAO,SAAS,kBAAkB;AAAA,IACpC,IAAI,eAAe,OAAO,KAAK;AAAA,MAAG,OAAO;AAAA,IACzC,OAAO,eAAe,OAAO,KAAK;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,oBAAoB,CAAC,UAA2B;AAAA,EAC3D,IAAU,qBAAe,KAAK;AAAA,IAAG,OAAO,mBAAmB,OAAO,cAAc;AAAA,EAChF,IAAoB,kCAAkB,KAAK;AAAA,IAAG,OAAO,MAAM;AAAA,EAC3D,OAAO,OAAO,KAAK;AAAA;AAwBd,IAAM,mBAAmB,CAC9B,QACA,QACA,MACA,OACA,WAA0B,mBAWnB,YAAI,UAAU,GAAG;AAAA,EActB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,UAAU,WAAW;AAAA,EAC3B,MAAM,WAA4B,CAAC;AAAA,EACnC,WAAW,UAAU,eAAe,MAAM,GAAG;AAAA,IAC3C,MAAM,UAAU,OAAO,OACpB,QAAQ,MAAM,WAAW,MAAM,CAAC,CAAC,EACjC,KAAY,gBAAQ,QAAO,GAAU,cAAM;AAAA,IAC9C,IAAW,iBAAU,OAAO,GAAG;AAAA,MAC7B,eAAe,QAAQ,MAAM;AAAA,MAC7B,OAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,MAAM,kBAAkB,QAAQ,OAAO;AAAA,IAC7C,SAAS,KAAK,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,MAAM,WAAW,UACb,mBAAmB,QAAQ,OAAO,IAClC,mBAAmB,QAAQ,OAAO;AAAA,IACtC,IAAI,CAAC,UAAU;AAAA,MACb,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,IAC/E;AAAA,EACF;AAAA,EACA,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,CAC9E;;;AJpII,MAAM,4BAA4B,MAAM;AAAA,EACxB;AAAA,EAArB,WAAW,CAAU,UAAoC;AAAA,IACvD,MAAM,uBAAuB,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG;AAAA,IADpE;AAAA,IAEnB,KAAK,OAAO;AAAA;AAEhB;AAeO,IAAM,aAAa,CACxB,QACA,YACA,SACA,IACA,WAA0B,mBAEnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAA4B,CAAC;AAAA,EACnC,WAAW,UAAU,eAAe,MAAM,GAAG;AAAA,IAC3C,MAAM,YAAY,wBAAwB;AAAA,MACxC,SAAS,WAAW,MAAM;AAAA,MAC1B,QAAQ,WAAW;AAAA,MACnB,SAAS,WAAW;AAAA,IACtB,CAAC;AAAA,IACD,MAAM,UAAU,OAAO,GAAG,KACX,mBACN,gBAAQ,SAAS,GACjB,gBAAQ,QAAO,GACf,cACT;AAAA,IACA,IAAW,kBAAU,OAAO,GAAG;AAAA,MAC7B,eAAe,QAAQ,MAAM;AAAA,MAC7B,OAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,WAAW,UACb,mBAAmB,QAAQ,OAAO,IAClC,mBAAmB,QAAQ,OAAO;AAAA,IACtC,IAAI,CAAC;AAAA,MAAU,OAAO,OAAc,aAAK,QAAQ,OAAO;AAAA,IACxD,SAAS,KAAK,EAAE,QAAQ,KAAK,kBAAkB,QAAQ,OAAO,EAAE,CAAC;AAAA,EACnE;AAAA,EACA,OAAO,OAAc,aAAK,IAAI,oBAAoB,QAAQ,CAAC;AAAA,CAC5D;AAiBI,IAAM,SAAS,CACpB,QACA,MACA,SACA,OAMO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,WAAW,QAAQ,YAAY,SAAS,EAAE;AAAA,CACzD;;;AKpIH;AAIO,IAAM,aAAa,OAAO,gBAAgB;AAc1C,IAAM,mBAAmB,CAC9B,WAEA,OAAO,KAAY,iBAAS,uBAAuB,MAAa,gBAAQ,UAAU,CAAC,CAAC;AAQ/E,IAAM,oBAAoB,CAAC,MAAc,cACvC,mBACL,GAAG,QAAQ,8EACT,2FACA,qDACJ;;;A3BsCK,IAAM,aAAa,SAAqB,aAAa;AAgB5D,IAAM,iBAAiB,CAAC,UACtB,iBAAiB,OAAO,MAAM,QAAQ,aAAa,OAAc,qBAAc,CAAC,CAAC,CAAC,CAAC,EAAE,KAC5E,YAAI,CAAC,SAAU,SAAS,aAAa,aAAa,aAAa,MAAM,KAAK,CAAE,CACrF;AAGF,IAAM,iBAAiB,CAAC,SACtB,SAAS,aAAa,YAAY;AAE7B,IAAM,qBAAqB,MACvB,gBACP,YACO,gBACL,WAAW,SAAS,GAAG;AAAA,EAErB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,WAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,GAClD;AAAA,EAQD,MAAa,WAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,WAAW,aAAa,WAAW,IAAI,KAAK,SAAS,IAAI,MAAM,SAAS,MAAM,GAAG;AAAA,MACnF,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,IAAI,CAAC,WAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,WAAW,IAAI;AAAA,IACtB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IAGvC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,eAAe,SAAS,IAAI,CAAC;AAAA,MACtD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,OAAO,SAAS,aAAa,QAAQ,MAAM,IAAI,IAC1C,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAOD,WAAkB,WAAG,UAAU,GAAG,QAAQ;AAAA,IAIxC,MAAM,SAAS,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,IACzD,OAAO,WAAW,IAAI;AAAA,IACtB,IAAI,WAAW,aAAa,CAAC,QAAQ,QAAQ,IAAI,GAAG;AAAA,MAClD,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,oBAAa,KAAK,IAAI,CAAC,CAAC;AAAA,IAC/E;AAAA,IACA,MAAM,QAAQ,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,IACxD,IAAI,UAAU,aAAa,CAAC,MAAM,OAAO;AAAA,MACvC,OAAO,OAAc,YACnB,IAAI,MACF,+CAA+C,SAAS,IAAI,oBAC1D,8EACA,kFACA,qDACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EASD,QAAe,WAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,MAAM,UAAsC,KAAK,MAAM,IAAI,GAAG,QAAQ,IAAI;AAAA,IAC1E,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,oBAAa,OAAO,CAAC;AAAA,GAC3E;AACH,CAAC,CACH,CACF;;A4BzJF,IAAM,UAAU,CAAC,OAAe,UAA0B;AAAA,EACxD,IAAI,SAAS,KAAK,KAAK,KAAK,UAAU,IAAI;AAAA,IACxC,MAAM,IAAI,MACR,0BAA0B,sDAC5B;AAAA,EACF;AAAA,EACA,OAAO,KAAK,UAAU,KAAK;AAAA;AAQ7B,IAAM,cAAc,CAAC,UAA0B;AAAA,EAC7C,MAAM,OAAO,QAAQ,gBAAgB,KAAK;AAAA,EAC1C,IAAI,WAAW;AAAA,EACf,IAAI;AAAA,IACF,WAAW,IAAI,IAAI,KAAK,EAAE;AAAA,IAC1B,MAAM;AAAA,EAGR,IAAI,aAAa,YAAY,aAAa,SAAS;AAAA,IACjD,MAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAAA,EACA,OAAO;AAAA;AAIT,IAAM,eAAqE;AAAA,EACzE,CAAC,YAAY,MAAM;AAAA,EACnB,CAAC,UAAU,QAAQ;AAAA,EACnB,CAAC,aAAa,WAAW;AAAA,EACzB,CAAC,YAAY,UAAU;AACzB;AAeO,IAAM,wBAAwB,CAAC,UAAmC,CAAC,MAAc;AAAA,EACtF,MAAM,YAAY,QAAQ,aAAa,QAAQ,aAAa,iBAAiB;AAAA,EAC7E,MAAM,SAAS,QAAQ,UAAU,QAAQ,UAAU,KAAK;AAAA,EACxD,MAAM,SAAS,aAAa,IAC1B,EAAE,OAAO,WACP,sBAAsB,WAAW,0BAA0B,kBAC/D;AAAA,EACA,MAAM,OACJ,QAAQ,iBAAiB,YACrB,KACA;AAAA,sBAA0B,YAAY,QAAQ,YAAY;AAAA,EAChE,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA,sBAAsB;AAAA,IACtB,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AAAA,CAAI;AAAA;;AC3Eb,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AC7BO,IAAM,MAAM,CAAC,OAAgB,aAClC,OAAO,UAAU,WAAW,QAAQ;AAE/B,IAAM,OAAO,CAAC,OAAgB,WAAW,OAC9C,OAAO,UAAU,WAAW,QAAQ;AA2B/B,IAAM,OAAO,CAAC,OAAgB,WAAW,UAC9C,UAAU,aAAa,UAAU,QAAQ,UAAU,KAC/C,WACA,UAAU,KAAK,UAAU,QAAQ,UAAU;AAS1C,IAAM,OAAO,CAAC,UAAqB,UAAU,YAAY,YAAY,QAAQ,MAAM;AAUnF,IAAM,MAAM,CAAC,WACjB,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,IAAK,SAAS,CAAC,GACxD,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAYN,IAAM,YAAY,CAAC,UAA2B;AAAA,EACnD,MAAM,QACJ,OAAO,UAAU,WACb,MAAM,MAAM,GAAG,IACf,MAAM,QAAQ,KAAK,IACjB,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IAC3C,CAAC;AAAA,EACT,OAAO,MACJ,IAAI,CAAC,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,EACjC,OAAO,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,EAClC,KAAK,CAAC,MAAM,UAAU,OAAO,KAAK,EAClC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,EACtB,KAAK,GAAG;AAAA;AAIN,IAAM,iBAAiB,CAAC,QAAgB;AAAA,EAC7C,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAAA,EACvC,IAAI,CAAC,KAAK,OAAO,QAAQ,IAAI,EAAE,SAAS,OAAO;AAAA,IAAG,OAAO;AAAA,EACzD,IAAI,CAAC,KAAK,MAAM,SAAS,KAAK,EAAE,SAAS,OAAO;AAAA,IAAG,OAAO;AAAA,EAC1D,OAAO;AAAA;AAmBF,IAAM,iBAAiB,CAAC,OAAgB,eAAgC;AAAA,EAC7E,MAAM,QACJ,OAAO,UAAU,WACb,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS;AAAA,IAC7B,OAAO,QAAQ,QAAQ,KAAK,MAAM,GAAG;AAAA,IACrC,OAAO,KAAK,WAAW,KAAK,eAAe,YACvC,CAAC,YAAY,OAAO,EAAE,IACtB,CAAC,OAAO,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,GAC/B,IACD,OAAO,UAAU,YAAY,UAAU,OACrC,OAAO,QAAQ,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC,IAChE,CAAC;AAAA,EACT,OAAO,MACJ,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,KAAK,GAAG,eAAe,KAAK,CAAC,CAAU,EAClE,OAAO,EAAE,SAAS,QAAQ,EAAE,EAC5B,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,EACvC,KAAK,EACL,KAAK,GAAG;AAAA;AAWN,IAAM,MAAM,CAAC,OAAgB,aAAqB;AAAA,EACvD,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,SAAS,OAAO,SAAS,KAAK,KAAK,GAAG,EAAE;AAAA,EAC9C,OAAO,OAAO,MAAM,MAAM,IAAI,WAAW;AAAA;AA6BpC,IAAM,aAAa,CACxB,QACA,UAC2B;AAAA,EAC3B,MAAM,UAAU,IAAI,IAAI,KAAK;AAAA,EAC7B,MAAM,OAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;AAAA,IACjD,IAAI,UAAU,aAAa,CAAC,QAAQ,IAAI,GAAG;AAAA,MAAG,KAAK,OAAO;AAAA,EAC5D;AAAA,EACA,OAAO,QAAQ,SAAS,IAAI,OAAO,KAAK,MAAM,QAAQ,CAAC,GAAG,OAAO,EAAE,KAAK,GAAG,EAAE;AAAA;;;AC/KxE,IAAM,mBAAmB;AAczB,IAAM,cAAc,CAAC,UAAyB,GAAG,MAAM,UAAU,MAAM;AAgBvE,IAAM,QAAQ,CAAC,WAA4D;AAAA,EAChF,SAAS,MAAM,WAAW;AAAA,EAC1B,QAAQ,OAAO,MAAM,MAAM;AAAA,EAC3B,SAAS,MAAM,UAAU,MAAM;AAAA,EAC/B,SAAS,MAAM;AAAA,EACf,QAAQ,MAAM;AAChB;AAaO,IAAM,gBAAe,CAC1B,MACA,UACmC;AAAA,EACnC,IAAI,KAAK,WAAW,aAAa,KAAK,YAAY;AAAA,IAAW;AAAA,EAC7D,OAAO;AAAA,IACL,SAAS,KAAK,KAAK,OAAO;AAAA,IAC1B,QAAQ,IAAI,KAAK,QAAQ,CAAC;AAAA,IAC1B,aAAa,YAAY,KAAK;AAAA,IAG9B,SAAS,KAAK,KAAK,SAAS,IAAI;AAAA,IAChC,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,EAChB;AAAA;AAQK,IAAM,WAAU,CAAC,YAAgC,UACtD,WAAW,aAAa,MAAM,WAAW,OACzC,WAAW,WAAW,MAAM,UAC5B,WAAW,YAAY,MAAM;;;AC3ExB,IAAM,UAAS,CAAC,SACrB,OAAO,YACL,OAAO,QAAQ,IAA+B,EAAE,OAC9C,CAAC,MAA6B,OAAO,EAAE,OAAO,QAChD,CACF;AAOK,IAAM,cAAa,CACxB,UACA,MACA,aACwB,UAAU,UAAU,QAAO,IAAI,GAAG,QAAQ;;;AHkG7D,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAYD,IAAM,YAAY,CAAC,UAAyB;AAAA,EAC1C,MAAM,QAAQ,EAAE,SAAS,MAAM,SAAS,QAAQ,MAAM,OAAO;AAAA,EAC7D,OAAO,iBACL,OAAO,MAAM,QAAQ,aAAa,OAAc,2BAAmB,KAAK,CAAC,CAC3E,EAAE,KAAY,YAAI,CAAC,SAAU,SAAS,aAAa,aAAa,cAAa,MAAM,KAAK,CAAE,CAAC;AAAA;AAI7F,IAAM,kBAAiB,CAAC,SACtB,SAAS,aAAa,YAAY;AAQ7B,IAAM,0BAA0B,MAC5B,iBACP,iBACO,gBACL,gBAAgB,SAAS,GAAG;AAAA,EAM1B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,WAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,GAC7C;AAAA,EACD,MAAa,WAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,kBAAkB,MAAM,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,UAAU,IAAI;AAAA,IAGlC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,oBAAoB,GAAG,KAAK,UAAU,KAAK,SAAS;AAAA,MAC7E,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IAKA,OAAO,SAAS,aAAa,SAAQ,MAAM,IAAI,IAC1C,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,WAAG,UAAU,GAAG,QAAQ;AAAA,IAMxC,MAAM,SAAS,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACpD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,UAAU,KAAK,4DACrB,kFACA,6EACA,kFACA,oFACA,uBACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO,YAAW,kBAAkB,MAAM,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MAC1B,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,2BAAmB,MAAM,IAAI,CAAC,CAAC;AAAA,IACtF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACnD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,UAAU,KAAK,2DACrB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAe,WAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,8BAAsB,EAAE,SAAS,KAAK,SAAS,QAAQ,KAAK,OAAO,CAAC,CAC7E;AAAA,GACD;AACH,CAAC,CACH,CACF;;AI1NF,qBAAS;AACT,uBAAS;AACT;;;ACxBA;AAIO,IAAM,aAAa,CACxB,SACG;AAAA,EAEH,MAAM,cAAc,CAAC,UACnB,OAAO,KAAK,aAAa,aAAa,KAAK,SAAS,KAAK,IAAI,KAAK;AAAA,EAqBpE,MAAM,cAAc,CAAC,OAAc,aAC1B,gBAAQ,MAAM;AAAA,IACnB,MAAM,SAAS,YAAY,KAAK,GAAG;AAAA,IACnC,OAAO,WAAW,YACP,eACP,UAAU,QAAQ,KAAK,WAAW,KAAK,GAAG,QAAQ;AAAA,GACvD;AAAA,EAOH,MAAM,cAAc,CAAC,UACZ,gBAAQ,MAAM;AAAA,IACnB,MAAM,SAAS,YAAY,KAAK,GAAG;AAAA,IACnC,IAAI,WAAW;AAAA,MAAW,OAAc;AAAA,IACxC,MAAM,OAAO,KAAK,aAAa,KAAK;AAAA,IACpC,OAAO,SAAS,YAAmB,eAAO,UAAU,QAAQ,MAAM,KAAK;AAAA,GACxE;AAAA,EAEH,OAAO,EAAE,aAAa,YAAY;AAAA;;;AClC7B,IAAM,aAAa,CACxB,UACA,MACA,OACA,SACsB,SAAQ,MAAM,KAAK,KAAK,OAAO,KAAK,IAAI,EAAE,WAAW,IAAI,YAAY;;;ACL7F,IAAM,SAAQ,CAAC,WAA2B;AAAA,EACxC,KAAK,MAAM,QAAQ,OAAO,MAAM;AAAA,EAChC,SAAS,MAAM,YAAY,QAAQ,MAAM;AAAA,EACzC,MAAM,MAAM,QAAQ;AAAA,EACpB,qBAAqB,MAAM,wBAAwB;AAAA,EACnD,iBAAiB,MAAM,qBAAqB,OAAO,MAAM;AAAA,EACzD,UAAU,MAAM;AAAA,KACZ,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,UAAU,MAAM,OAAO,EAAE;AAAA,KACvE,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC/D,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB,MAAM,kBAAkB;AAAA,KACzF,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,KACnD,MAAM,qBAAqB,YAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,iBAAiB;AAAA,KACtF,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,UAAU,MAAM,IAAI,EAAE;AACpE;AAEO,IAAM,gBAAgB;AAAA,EAQ3B,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,KAAK,KAAK,KAAK,QAAQ,KAAK;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,IAAI;AAAA,IACnC,SAAS,UAAU,KAAK,UAAU;AAAA,IAClC,UAAU,eAAe,KAAK,aAAa,SAAS;AAAA,IACpD,IAAI,MAAM;AAAA,IACV,MAAM,KAAK,KAAK,SAAS,UAAU;AAAA,IACnC,YAAY,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;AAAA,IACtE,kBAAkB,KAAK,KAAK,mBAAmB,EAAE;AAAA,IACjD,qBAAqB,KAAK,KAAK,sBAAsB,MAAM;AAAA,IAC3D,MAAM,KAAK,KAAK,SAAS,EAAE;AAAA,IAC3B,iBAAiB,eAAe,KAAK,gBAAgB;AAAA,IACrD,iBAAiB,KAAK,KAAK,kBAAkB,KAAK;AAAA,IAClD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IACnC,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,MAAM,UAAU,KAAK,OAAO;AAAA,EAC9B;AAAA,EACA,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA,EAGxD,UAAU,EAAE,QAAQ,4BAA4B,QAAQ,+BAA+B;AAAA,EACvF,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,YAC9B,WAAW,aAAa,MAAM,YAAY,UAC1C,WAAW,SAAS,MAAM,QAAQ,SAClC,WAAW,UAAU,MAAM,QAAQ,eACnC,WAAW,0BAA0B,MAAM,wBAAwB,WACnE,WAAW,sBAAsB,MAAM,qBAAqB,UAC3D,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,SAAS,aAAa,WAAW,SAAS,UAAU,MAAM,IAAI,OACpE,MAAM,YAAY,aAAa,WAAW,YAAY,UAAU,MAAM,OAAO,OAC7E,MAAM,sBAAsB,aAC3B,WAAW,sBAAsB,MAAM,uBACxC,MAAM,qBAAqB,aAC1B,WAAW,qBAAqB,eAAe,MAAM,gBAAgB,OACtE,MAAM,aAAa,aAClB,WAAW,aAAa,eAAe,MAAM,UAAU,SAAS;AAAA,EACpE,MAAM,CAAC,UAAU,kBAAkB,MAAM;AAAA,EACzC,YAAY;AACd;;;AC7FA;AACA;AACA;AACA;AAMO,IAAM,mBAAmB,CAC9B,OACA,OAAO,cAAc,WAAW,KAAK,MACD;AAAA,EACpC;AAAA,IACE,kBAAkB;AAAA,IAClB,qBAAqB;AAAA,IACrB,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,OACd;AAAA,MACD;AAAA,EACJ,OAAO;AAAA,OACF;AAAA,IACH,IAAI,MAAM;AAAA,IACV;AAAA,IACA;AAAA,OACI,mBAAmB,YAAY,CAAC,IAAI,EAAE,eAAe;AAAA,OACrD,kBAAkB,YAAY,CAAC,IAAI,EAAE,cAAc;AAAA,EACzD;AAAA;AAQK,IAAM,gBAAgB,CAAC,UAC5B,OAAO,MAAM,QAAQ,QAAQ,OAAe,yBAAiB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAGvE,iBAAQ,CAAC,SACP,2BAA2B,cAAe,gCAAwB,CAAC,EAAE;AAAA,KACvE;AAAA,EACH,eAAe;AAAA,EACf,UAAU;AACZ,CAAC,EAAE,KACM,kBACL,MACE,IAAI,kBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC,CACL,GACO,YAAG,IAAI,CAChB,CACF,GACO,aAAI,CAAC,SACV,cAAc,WACZ;AAAA,KACK;AAAA,EACH,YAAY,KAAK;AAAA,EACjB,kBAAkB,KAAK;AAAA,EACvB,qBAAqB,KAAK;AAAA,EAC1B,iBACE,OAAO,KAAK,kBAAkB,YAAY,KAAK,kBAAkB,OAC7D,OAAO,YACL,OAAO,QAAQ,KAAK,aAAa,EAAE,IAAI,EAAE,KAAK,WAAW;AAAA,IACvD,IAAI,WAAW,KAAK,GAAG;AAAA,IACvB;AAAA,EACF,CAAC,CACH,IACA,KAAK;AAAA,EACX,iBAAiB,KAAK;AACxB,GACA,KACF,CACF,GACO,kBAAS,qBAAqB,MAAa,iBAAQ,SAAS,CAAC,GAC7D,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAEK,IAAM,kBAAkB,CAAC,UAC9B,OAAO,MAAM,QAAQ,aAAa,MAAc,4BAAoB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC9E,kBAAS,qBAAqB,MAAa,aAAI,GAC/C,kBAAS,YAAY,MAAa,aAAI,CAC/C;;;AJ9CF;AACA;AAqEO,IAAM,mBAAmB,UAA2B,mBAAmB;AAO9E,MAAQ,aAAa,gBAAgB,WAAW,aAAa;AAGtD,IAAM,2BAA2B,MAC7B,iBACP,kBACO,iBACL,iBAAiB,SAAS,GAAG;AAAA,EAC3B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,cAAc,IAAI;AAAA,EACtC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,YAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,cAAc,IAAI;AAAA,IACtC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,cAAc,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GACxE;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,cAAc,IAAI;AAAA,IACtC,OAAO,YAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,YAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OACL,KAAK,QACL,aACA,MACQ,6BAAoB,iBAAiB,IAAI,CAAC,CACpD;AAAA,IACF,EAAO;AAAA,MACL,MAAM,OAAO,WACX,cAAc,SACd,MACA,MACA,cAAc,WAAW,IAAI,CAC/B;AAAA,MACA,IAAI,SAAS;AAAA,QACX,OAAO,OACL,KAAK,QACL,aACA,MACQ,0BAAiB,iBAAiB,MAAM,IAAI,CAAC,CACvD;AAAA;AAAA,IAEJ,MAAM,QAAQ,OAAO,cAAc,IAAI;AAAA,IACvC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MACF,GAAG,cAAc,KAAK,IAAI,4DAC5B,CACF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAAW,gBAAgB,IAAI;AAC5C,CAAC,CACH,CACF;;AK5HF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACPO,IAAM,mBAAkE;AAAA,EAC7E,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACP;AAQO,IAAM,WAAW,CAAC,UAA2B,MAAM,QAAQ,MAAM;AAQjE,IAAM,iBAAiB,CAAC,UAA2B,SAAS,MAAM,aAAa,MAAM;AAGrF,IAAM,aAAa,CAAC,UAA2B,GAAG,eAAe,KAAK,KAAK,SAAS,KAAK;AAezF,IAAM,aAAa,CAAC,UAAmD;AAAA,EAC5E,IAAI,MAAM,SAAS,SAAS,MAAM,mBAAmB,WAAW;AAAA,IAC9D,OAAO,EAAE,eAAe,MAAM,eAAe;AAAA,EAC/C;AAAA,EACA,MAAM,aAAa,MAAM,SAAS,QAAQ,KAAK,MAAM,UAAU,IAAI;AAAA,EACnE,OAAO,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AAAA;AAU/C,IAAM,UAAU,CAAC,MAAe,WACpC,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAC5B,OAAO,CAAC,QAAwC,OAAO,QAAQ,YAAY,QAAQ,IAAI,EACvF,KAAK,CAAC,QAAQ,IAAI,YAAY,SAAS,KAAK,CAAC;AAY3C,IAAM,mBAAmB,CAC9B,MACA,UACqC;AAAA,EACrC,MAAM,MAAM,QAAQ,MAAM,KAAK;AAAA,EAC/B,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,OAAO;AAAA,IACL,MAAM,KAAK,IAAI,OAAO;AAAA,IACtB,QAAQ,KAAK,IAAI,UAAU;AAAA,IAC3B,MAAM,KAAK,IAAI,OAAO;AAAA,IACtB,MAAM,MAAM;AAAA,IACZ,MAAM,SAAS,KAAK;AAAA,IACpB,MAAM,MAAM;AAAA,IACZ,QAAQ,KAAK,IAAI,SAAS;AAAA,IAC1B,MAAM,IAAI,IAAI,SAAS,EAAE;AAAA,IACzB,SAAS,KAAK,IAAI,UAAU;AAAA,IAC5B,eAAe,KAAK,IAAI,iBAAiB;AAAA,IACzC,OAAO,KAAK,IAAI,QAAQ;AAAA,IACxB,SAAS,KAAK,IAAI,qBAAqB;AAAA,EACzC;AAAA;;;ACxHF;AACA;AAcA,IAAM,WAAW,CAAC,UAA2B;AAAA,EAC3C,MAAM,OAAO,MAAM;AAAA,EACnB,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAgB,EAAE,KAAK,CAAC,CAAC,EAAE,KACnE,aAAI,CAAC,SAAoB,IAAI,CACtC;AAAA,SACG;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAgB,EAAE,KAAK,CAAC,CAAC,EAAE,KACnE,aAAI,CAAC,SAAoB,IAAI,CACtC;AAAA,SACG;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAgB,EAAE,KAAK,CAAC,CAAC,EAAE,KACnE,aAAI,CAAC,SAAoB,IAAI,CACtC;AAAA;AAAA;AAKC,IAAM,aAAa,CAAC,UACzB,SAAS,KAAK,EAAE,KACP,aAAI,CAAC,SAAS,iBAAiB,MAA4C,KAAK,CAAC,CAC1F;AAGK,IAAM,eAAe,CAAC,UAA2B;AAAA,EACtD,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,KAAK,SAAS,KAAK;AAAA,EACzB,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,OACL,MAAM,QACN,aACA,MACM,wBAAkB;AAAA,WAClB,MAAM,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,eAAe;AAAA,QAClF,OAAO;AAAA,QACP;AAAA,MACF,CAAC,CACH;AAAA,SACG;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,IAAI,KAAK,CAAC,CAAC;AAAA,SACjF;AAAA,MACH,OAAO,OACL,MAAM,QACN,aACA,MACM,wBAAkB;AAAA,WAClB,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,MAAM,aAAa,MAAM,IAAI;AAAA,QACrF,MAAM;AAAA,QACN;AAAA,MACF,CAAC,CACH;AAAA;AAAA;AAMC,IAAM,eAAe,CAAC,UAA2B;AAAA,EACtD,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,KAAK,SAAS,KAAK;AAAA,EACzB,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;AAAA,SACxF;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,IAAI,KAAK,CAAC,CAAC;AAAA,SACjF;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC;AAAA;AAAA;AASzF,IAAM,aAAa,CAAC,UACzB,IAAI,MACF,GAAG,WAAW,KAAK,SAAS,MAAM,cAAc,SAAS,KAAK,oBAC5D,GAAG,MAAM,aAAa,MAAM,+DAC5B,qEACJ;;;AFkEK,IAAM,oBAAoB,UAA4B,sBAAsB;AAAA,EACjF,sBAAsB;AACxB,CAAC;AA6BM,IAAM,kBAAyB,YAAG,UAAU,GAAG,QAAmC;AAAA,EACvF,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,EACnC,OAAO,YAAW,iBAAiB,KAAK,OAAO,WAAW,IAAI,GAAG,SAAS,SAAS;AAAA,EACnF,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,OAAO,aAAa,IAAI;AAAA,EACxB,MAAM,QAAQ,OAAO,WAAW,IAAI;AAAA,EACpC,IAAI,UAAU;AAAA,IAAW,OAAO,OAAc,aAAI,WAAW,IAAI,CAAC;AAAA,EAClE,OAAO;AAAA,CACR;AAEM,IAAM,4BAA4B,MAC9B,iBACP,mBACO,iBACL,kBAAkB,SAAS,GAAG;AAAA,EAG5B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,WAAW,IAAI;AAAA,EAEnC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,iBAAiB,KAAK,OAAO,WAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrF,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,IACnC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,iBAAiB,KAAK,OAAO,WAAW,IAAI,GAAG,IAAI;AAAA,MACrE,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,OAAO;AAAA,GACzB;AAAA,EACD,WAAW,GAAG,WAAW,gBAAgB,EAAE,KAAK,CAAC;AAAA,EAMjD,QAAQ,GAAG,WAAW,aAAa,IAAI;AACzC,CAAC,CACH,CACF;;AG9KF,qBAAS;AACT;AACA;;;AChEA,uBAAS;AAET;;;ACAA;AACA;AACA;AAMO,MAAM,iBAAiB,MAAM;AAAA,EAEvB;AAAA,EACA;AAAA,EACA;AAAA,EAHX,WAAW,CACA,QACA,QACA,MACT,QACA;AAAA,IACA,MAAM,OAAO,UAAU,WAAW,OAAO,MAAM,MAAM,QAAQ;AAAA,IALpD;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,mBAAmB,CACvB,QACA,MACA,aAEA,IAAI,SACF,GACA,QACA,MACA,uBAAuB,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,GAChF;AAgBF,IAAM,SAAS,CAAC,SAA0B;AAAA,EACxC,MAAM,SAAS,IAAI;AAAA,EACnB,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,OAAO,UAAU;AAAA,MAAU,OAAO,OAAO,KAAK,KAAK;AAAA,IAClD;AAAA,iBAAW,QAAQ;AAAA,QAAO,OAAO,OAAO,KAAK,IAAI;AAAA,EACxD;AAAA,EACA,OAAO,OAAO,SAAS;AAAA;AAGzB,IAAM,eAAe,CACnB,QACA,SACA,MACA,YACA,QACA,SACG;AAAA,EACH,MAAM,MAAM,GAAG,WAAW;AAAA,EAsB1B,OAAyB,wBAAK,MAAM,EAAE,GAAG,EAAE,KACvB,8BAAW,EAAE,eAAe,cAAc,YAAY,MAAM,EAAE,CAAC,GACjF,SAAS,YACL,CAAC,SAAS,OACQ,4BAAS,OAAO,IAAI,GAAG,mCAAmC,CAClF;AAAA;AAGF,IAAM,aAAa,CACjB,QACA,YACA,QACA,MACA,MACA,YAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,UAAU,aAAa,QAAQ,SAAS,MAAM,YAAY,QAAQ,IAAI;AAAA,EAC5E,OAAO,OAAO,OACX,QAAQ,OAAO,EACf,KAAY,kBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,CACjF;AAEH,IAAM,eAAe,CACnB,UAKA,QACA,SAEO,aAAI,UAAU,GAAG;AAAA,EAOtB,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AAAA,IAGnD,MAAM,SAAS,OAAO,SAAS,KAAK,KAAY,uBAAc,MAAM,EAAE,CAAC;AAAA,IACvE,OAAO,OAAc,cAAK,IAAI,SAAS,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,EAC7F;AAAA,EACA,MAAM,OAAQ,OAAO,SAAS,KAAK,KAC1B,kBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CACzE;AAAA,EACA,OAAO,KAAK;AAAA,CACb;AAGI,IAAM,UAAU,CACrB,QACA,YACA,QACA,MACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WACJ,OAAO,WAAW,QACd,OAAO,iBAAiB,QAAQ,QAAQ,MAAM,CAAC,YAC7C,aAAa,QAAQ,SAAS,MAAM,YAAY,QAAQ,IAAI,CAC9D,EAAE,KACO,kBAAS,CAAC,YACf,QAAQ,QAAQ,YACZ,iBAAiB,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,IAC/D,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,OAAO,CAAC,CACnD,CACF,IACA,OAAO,WAAW,QAAQ,YAAY,QAAQ,MAAM,MAAM,OAAO,GAAG;AAAA,EAC1E,OAAO,OAAO,aAAgB,UAAU,QAAQ,IAAI;AAAA,CACrD;AAQI,IAAM,kBAAkB,CAC7B,QACA,YACA,QACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,iBAAiB,QAAQ,QAAQ,MAAM,CAAC,YAC9D,aAAa,QAAQ,SAAS,MAAM,YAAY,MAAM,CACxD,EAAE,KACO,kBAAS,CAAC,YACf,QAAQ,QAAQ,YACZ,iBAAiB,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,IAC/D,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,OAAO,CAAC,CACnD,CACF;AAAA,EACA,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AAAA,IACnD,MAAM,SAAS,OAAO,SAAS,KAAK,KAAY,uBAAc,MAAM,EAAE,CAAC;AAAA,IACvE,OAAO,OAAc,cAAK,IAAI,SAAS,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,EAC7F;AAAA,EACA,OAAQ,OAAO,SAAS,KAAK,KACpB,kBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CACzE;AAAA,CACD;AAoBI,IAAM,MAAM,CACjB,QACA,MACA,QACA,MACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,QAAW,QAAQ,YAAY,QAAQ,MAAM,IAAI;AAAA,CAChE;;;AD9MI,IAAM,gBAAgB,CAC3B,SACG;AAAA,EACH,QAAQ,2BAAa,8BAAgB,WAAW,IAAI;AAAA,EAGpD,MAAM,OAAO,CAAC,UACZ,IACE,MAAM,QACN,KAAK,YAAY,QACjB,OACA,KAAK,KAAK,KAAK,CACjB,EAAE,KACO,aAAI,CAAC,SAAU,QAAQ,OAAO,YAAY,KAAK,WAAW,MAAM,KAAK,CAAE,GACvE,uBAAc,MAAG;AAAA,IAAG;AAAA,GAAS,CACtC;AAAA,EAEF,OAAO;AAAA,IAOL;AAAA,IACA;AAAA,IAEA;AAAA,IAKA,MAAM,CAAC,MAAoB,WAClB,aAAI,UAAU,GAAG;AAAA,MAItB,IAAI,CAAC,YAAW,IAAI;AAAA,QAAG;AAAA,MAOvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,MAC7C,OAAO,aAAY,IAAI;AAAA,MACvB,IAAI,WAAW;AAAA,QAAW;AAAA,MAC1B,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAG7B,IAAI,SAAS,WAAW;AAAA,QAMtB,OAAO,aAAY,MAAM,IAAI;AAAA,QAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,MAC5B;AAAA,MACA,IAAI,KAAK,QAAQ,MAAM,IAAI;AAAA,QAAG,OAAO,EAAE,QAAQ,OAAO;AAAA,MAEtD,OAAO,KAAK,eAAe,YACtB,EAAE,QAAQ,UAAU,IACpB,EAAE,QAAQ,SAAS;AAAA,KACzB;AAAA,IAEH,WAAW,CAAC,SACH,aAAI,UAAU,GAAG;AAAA,MACtB,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAM7B,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,MAC3C,OAAO,aAAY,IAAI;AAAA,MACvB,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,IACL,KAAK,QACL,aACA,QACA,KAAK,WAAW,IAAI,GACpB,KAAK,WAAW,IAAI,CACtB;AAAA,MACF,EAAO,SAAI,KAAK,eAAe,WAAW;AAAA,QAyBxC,MAAM,OAAO,WAAW,KAAK,SAAS,MAAM,MAAM,KAAK,WAAW,IAAI,CAAC;AAAA,QACvE,IAAI,SAAS,WAAW;AAAA,UACtB,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,KAAK,KAAK,IAAI,GAAG,IAAI;AAAA,QACnE;AAAA,MACF;AAAA,MACA,MAAM,QAAQ,OAAO,KAAK,IAAI;AAAA,MAC9B,IAAI,UAAU,WAAW;AAAA,QAOvB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,KAAK,KAAK,IAAI,oEACf,sFACA,4DACJ,CACF;AAAA,MACF;AAAA,MACA,OAAO;AAAA,KACR;AAAA,IAOH,SAAS,CAAC,SAAgB,IAAI,KAAK,QAAQ,aAAa,UAAU,KAAK,KAAK,IAAI,CAAC;AAAA,EACnF;AAAA;AAoCK,IAAM,cAAc,CACzB,SACG;AAAA,EACH,MAAM,MAAM,cAAc,IAAI;AAAA,EAC9B,OAAO;AAAA,IACL,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,GAAG,WAA4B,IAAI,KAAK,IAAI;AAAA,IAClD,MAAM,GAAG,MAAM,aACb,IAAI,KAAK,MAAM,MAAM;AAAA,IACvB,WAAW,GAAG,WAA4B,IAAI,UAAU,IAAI;AAAA,IAC5D,QAAQ,GAAG,WAA4B,IAAI,QAAQ,IAAI;AAAA,EACzD;AAAA;;;AD/DK,IAAM,kBAAkB,UAA0B,kBAAkB;AAE3E,IAAM,WAAW,YAA+C;AAAA,EAsB9D,YAAY,CAAC,MAAM,WAAW,EAAE,MAAM,MAAM,MAAM,OAAO,KAAK,IAAI,EAAE;AAAA,EACpE,YAAY,MAAM;AAAA,EAMlB,YAAY,CAAC,WAAW,GAAG,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,IAAI;AAAA,EACjE,UAAU,EAAE,QAAQ,qCAAqC;AAAA,EAUzD,SAAS,CAAC,YAAY,UAAU,WAAW,UAAU,MAAM;AAAA,EAC3D,MAAM,CAAC,UAAU,sBAAsB,MAAM;AAAA,EAQ7C,YAAY,CAAC,WAAW,EAAE,OAAO,KAAK,MAAM,KAAK,KAAK,IAAI;AAC5D,CAAC;AAEM,IAAM,0BAA0B,MAC5B,iBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,KASvB;AAAA,EAEH,QAAQ,MAAa;AAAA,EAWrB,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,QAAQ,OAAO,SAAS,UAAU,EAAE,KAAK,CAAC;AAAA,IAChD,IAAI,MAAM,UAAU,KAAK,OAAO;AAAA,MAC9B,OAAO,OAAc,aACnB,IAAI,MACF,sBAAsB,KAAK,oDACzB,oBAAoB,MAAM,QAAQ,QAAQ,yBAC1C,GAAG,KAAK,QAAQ,QAAQ,yDACxB,4EACA,gFACA,yBACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AACH,CAAC,CACH,CACF;;AGxLF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACtDA;AACA;;;ACwDO,IAAM,UAAU,CACrB,MACA,UACiC;AAAA,EACjC,MAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GACxC,OACC,CAAC,UAA4C,OAAO,UAAU,YAAY,UAAU,IACtF,EACC,KAAK,CAAC,UAAU,MAAM,YAAY,MAAM,IAAI;AAAA,EAC/C,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,OAAO;AAAA,IACL,WAAW,KAAK,IAAI,YAAY;AAAA,IAChC,YAAY,IACV,MAAM,QAAQ,IAAI,aAAa,IAC3B,IAAI,cAAc,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IACvD,CAAC,CACP;AAAA,IACA,eAAe,KAAK,IAAI,gBAAgB;AAAA,IACxC,kBAAkB,IAAI,IAAI,qBAAqB,EAAE;AAAA,IACjD,MAAM,MAAM;AAAA,EACd;AAAA;AASK,IAAM,eAAe;AACrB,IAAM,gBAAgB;AAGtB,IAAM,aAAa,CAAC,UAAuB,SAAS,MAAM,gBAAgB,MAAM;AAGhF,IAAM,iBAAiB;AAG9B,IAAM,QAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAMtC,IAAM,cAAa,CAAC,WAAgD;AAAA,KACtE,MAAM,eAAe,KAAK,MAAM,cAAc,CAAC;AAAA,KAC/C,MAAM,UAAU,MAAM,WAAW,YAAY,YAAY,OAAO,MAAM,MAAM,CAAC;AAClF;AAWO,IAAM,cAAa,CAAC,UACzB,IAAI,MACF,GAAG,WAAW,KAAK,8DACjB,aAAa,MAAM,sEACnB,yCACJ;AAEK,IAAM,eAAe,CAAC,UAC3B,IAAI,MACF,GAAG,WAAW,KAAK,iEACjB,aAAa,MAAM,6EACnB,yDACJ;;;ADnHK,IAAM,SAAS,CAAC,UACrB,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAe,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACvE,aAAI,CAAC,SAAS,QAAQ,MAA4C,KAAK,CAAC,CACjF;AAGF,IAAM,oBAAoB,CAAC,WACxB;AAAA,KACI,YAAW,KAAK;AAAA,EACnB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AACd;AAMF,IAAM,aAAa,CAAC,OAAoB,SAC/B,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,eAAe,WAAW,GAAG;AAAA,IAC3D,MAAM,SAAS,OAAO,OACpB,MAAM,QACN,QACA,OACM,yBAAkB,EAAE,MAAM,MAAM,MAAM,KAAK,CAAC,CACpD,EAAE,KAAY,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CAAC;AAAA,IAC5C,IAAI,QAAQ,WAAW,WAAW;AAAA,MAChC,IAAI,OAAO,eAAe;AAAA,QAAM;AAAA,MAChC,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,eAAe,uBAAuB,OAAO,cAAc,wBAC5E,wFACA,yBAAyB,MAAM,cAAc,aACjD,CACF;AAAA,IACF;AAAA,IACA,OAAc,eAAM,eAAe,IAAI;AAAA,EACzC;AAAA,EACA,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,eAAe,kCAChC,GAAG,OAAO,gBAAgB,YAAY,oDACtC,iEACA,UAAU,MAAM,0EAChB,qDACJ,CACF;AAAA,CACD;AAGI,IAAM,WAAW,CAAC,UAChB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,aACA,MACM,wBAAiB,kBAAkB,KAAK,CAAC,CACjD;AAAA,EAIA,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,4DACjB,iEACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,WAAW,OAAO,IAAI;AAAA,CAC9B;AAYI,IAAM,YAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,aACA,MACM,wBAAiB;AAAA,IACrB,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,OAER,MAAM,oBAAoB,OAAO,EAAE,cAAc,IAAI,IAAI,CAAC;AAAA,OAC1D,MAAM,uBAAuB,OAAO,EAAE,iBAAiB,IAAI,IAAI,CAAC;AAAA,EACtE,CAAC,CACH,EAAE,KAAY,kBAAS,kBAAkB,MAAa,iBAAQ,EAAE,CAAC,CAAC;AAAA,EAGlE,IAAI,SAAS;AAAA,IAAI,OAAO,WAAW,OAAO,IAAI;AAAA,CAC/C;;;ADgBI,IAAM,gBAAgB,UAAwB,kBAAkB;AAAA,EACrE,sBAAsB;AACxB,CAAC;AAkBM,IAAM,wBAAwB,MAC1B,iBACP,eACO,iBACL,cAAc,SAAS,GAAG;AAAA,EAMxB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,OAAO,IAAI;AAAA,GAC1B;AAAA,EAaD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,gBAAgB,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACxE,IAAI,WAAW,aAAa,KAAK,SAAS,OAAO,MAAM;AAAA,MACrD,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,OAAO,IAAI;AAAA,IAC/B,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,gBAAgB,YAAW,IAAI,GAAG,IAAI;AAAA,MACxD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAEA,OAAO,EAAE,QAAQ,OAAO;AAAA,GACzB;AAAA,EASD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,OAAO,IAAI;AAAA,IAC/B,IAAI,SAAS;AAAA,MAAW,OAAO;AAAA,IAC/B,OAAO,SAAS,IAAI;AAAA,IACpB,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,IAChC,IAAI,UAAU;AAAA,MAAW,OAAO,OAAc,aAAI,YAAW,IAAI,CAAC;AAAA,IAClE,OAAO;AAAA,GACR;AAAA,EAQD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IAUrC,KAAK,OAAO,OAAO,IAAI,OAAO;AAAA,MAAW;AAAA,IACzC,OAAO,UAAU,IAAI;AAAA,IACrB,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,IAChC,IAAI,UAAU;AAAA,MAAW,OAAO,OAAc,aAAI,aAAa,IAAI,CAAC;AAAA,GACrE;AACH,CAAC,CACH,CACF;;AG1MF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACYA;AACA;AAQA,IAAM,WAAW,CAAC,UACf,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC,GAAG,OACxD,CAAC,UAA8B,OAAO,UAAU,YAAY,UAAU,IACxE;AAeK,IAAM,YAAY,CAAC,SAAiC;AAAA,EACzD,MAAM,OAAO,KAAK;AAAA,EAClB,MAAM,QAAmB,OAAO,SAAS,YAAY,SAAS,OAAQ,OAAqB,CAAC;AAAA,EAC5F,MAAM,OAAO,CAAC,SAAiC;AAAA,IAC7C,GAAI,KAAK,YAAY,QAAQ,CAAC,IAAI,IAAI,CAAC;AAAA,IACvC,GAAG,SAAS,IAAI,EAAE,QAAQ,IAAI;AAAA,EAChC;AAAA,EACA,OAAO,KAAK,KAAK;AAAA;AAoBZ,IAAM,UAAU,CAAC,MAAiB,UACvC,UAAU,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,OAAO,OAAO,GAAG,MAAM,KAAK;AAkD/D,IAAM,gBAAgB,CAAC,MAAiB,WAA4C;AAAA,EACzF,cAAc,KAAK,KAAK,qBAAqB;AAAA,EAC7C,cAAc,IAAI,KAAK,iBAAiB,CAAC;AAAA,EACzC,cAAc,KAAK,KAAK,eAAe;AAAA,EACvC,MAAM,KAAK,KAAK,OAAO;AAAA,EACvB,IAAI,KAAK,KAAK,KAAK;AAAA,EACnB,MAAM,KAAK,KAAK,SAAS,OAAO,OAAO,MAAM,KAAK,GAAG;AAAA,EACrD,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK;AAAA,EAClC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,EACvB,UAAU,IAAI,KAAK,aAAa,CAAC;AAAA,EACjC,QAAQ,KAAK,KAAK,SAAS;AAAA,EAC3B,aAAa,IAAI,KAAK,gBAAgB,CAAC;AACzC;AAmBO,IAAM,UAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAe,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACvE,aAAI,CAAC,MAAM;AAAA,EAChB,MAAM,OAAO,QAAQ,GAA2B,MAAM,KAAK;AAAA,EAC3D,OAAO,SAAS,YAAY,YAAY,cAAc,MAAM,KAAK;AAAA,CAClE,CACH;;;AC5LF;AACA;AAmBO,IAAM,sBAAmC;AAEhD,IAAM,WAAW,CAAC,UAAwB,OAAO,OAAO,MAAM,KAAK,QAAQ,MAAM;AAM1E,IAAM,gBAAgB,CAAC,OAAqB,SAAyC;AAAA,EAC1F;AAAA,KACI,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,sBAAsB,MAAM,aAAa;AACzF;AAEO,IAAM,YAAmB,YAAG,UAAU,CAAC,MAAoB;AAAA,EAChE,IAAI,KAAK,QAAQ,WAAW;AAAA,IAC1B,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,SAAS,IAAI,oEACd,kFACA,oFACA,qFACA,cACJ,CACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,cAAc,MAAM,KAAK,GAAG;AAAA,EAGzC,OAAO,UAAU,qBAAqB,MAAM,IAAI;AAAA,EAChD,OAAO,OACL,KAAK,QACL,aACA,MACM,yBAAkB;AAAA,IACtB,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,OACP,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,oBAAoB,KAAK,aAAa;AAAA,EACrF,CAAC,CACH;AAAA,EACA,MAAM,UAAU,OAAO,QAAQ,IAAI;AAAA,EACnC,IAAI,YAAY,WAAW;AAAA,IACzB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,SAAS,IAAI,2CAA2C,OAAO,KAAK,KAAK,UAC1E,sFACA,wFACA,uDACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAkCM,IAAM,aAAa,CAAC,SACzB,OACE,KAAK,QACL,aACA,MACM,yBAAkB;AAAA,EACtB,MAAM,KAAK;AAAA,EACX,OAAO,OAAO,KAAK,KAAK;AAAA,KACpB,KAAK,YAAY,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC;AAClD,CAAC,CACH;;;AFTK,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAuBD,IAAM,UAAU,CAAC,MAAyB,WACvC,MAAM,SAAS,aAAa,MAAM,SAAS,KAAK,UAChD,MAAM,iBAAiB,aAAa,MAAM,iBAAiB,KAAK;AAEnE,IAAM,YAAW,CAAC,UAChB,OAAO,OAAO,MAAM,KAAK,qBAAqB,MAAM;AAetD,IAAM,YAAW;AAAA,EAOf,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAE7B,MAAa,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC3D,OAAO,OAAO,QAAQ,IAAI;AAAA,GAC3B;AAAA,EAUD,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,KAIC;AAAA,IACD,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IAC/C,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAQlD,IAAI,OAAO,UAAU,KAAK;AAAA,MAAO,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC3D,OAAO,QAAQ,MAAM,IAAI,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAClF;AAAA,EAOD,WAAkB,YAAG,UAAU,GAAG,QAAgC;AAAA,IAChE,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MAUtB,OAAO,OAAO,UAAU,IAAI;AAAA,IAC9B;AAAA,IACA,IAAI,CAAC,QAAQ,MAAM,IAAI,GAAG;AAAA,MACxB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,UAAS,IAAI,8CAA8C,KAAK,UACjE,gBAAgB,KAAK,8DACrB,wFACA,6DACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC7D,OAAO,WAAW,IAAI;AAAA,GACvB;AACH;AAEO,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,SAAQ,CAAC,CAAC;;AG/MtF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACkGO,IAAM,SAAS,CAAC,UAAyB,SAAS,MAAM,kBAAkB,MAAM;AAShF,IAAM,QAAQ;AAGd,IAAM,eAAe,CAAC,UAC3B,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;AAQvE,IAAM,OAAO,CAAI,UAAyB,MAAS,SAAS,UACjE,aAAa,aAAa,UAAU,aAAa;AAc5C,IAAM,OAAO,CAAC,UAA+B,UAAU,IAAI,YAAY;AAG9E,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAG7C,IAAM,UAAU,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAmCvF,IAAM,aAAa,CAAC,WAAkD;AAAA,KACxE,OAAM,cAAc,MAAM,UAAU;AAAA,KACpC,OAAM,YAAY,QAAQ,MAAM,QAAQ,CAAC;AAAA,KACzC,OAAM,qBAAqB,MAAM,iBAAiB;AAAA,KAClD,OAAM,cAAc,QAAQ,MAAM,UAAU,CAAC;AAAA,KAC7C,OAAM,QAAQ,QAAQ,MAAM,IAAI,CAAC;AAAA,KACjC,OAAM,eAAe,QAAQ,MAAM,WAAW,CAAC;AAAA,KAC/C,OAAM,qBAAqB,QAAQ,MAAM,iBAAiB,CAAC;AAChE;AAYO,IAAM,aAAa,CAAC,WAAkD;AAAA,KACxE,WAAW,KAAK;AAAA,KAChB,OAAM,eAAe,MAAM,WAAW;AAAA,KACtC,OAAM,UAAU,QAAQ,MAAM,MAAM,CAAC;AAAA,EACxC,cAAc;AAAA,EACd,MAAM,MAAM;AACd;;;AChPA;AACA;AA6BO,IAAM,gBAAgB,CAAC,OAAsB,cAClD,OAAO,MAAM,QAAQ,QAAQ,OAAa,wBAAiB,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACzE,iBAAQ,CAAC,SACd,KAAK,KAAK,CAAC,QAAQ,IAAI,cAAc,MAAM,IAAI,IACpC,aACL,IAAI,MACF,GAAG,8EACD,oFACA,oFACA,6CACJ,CACF,IACO,aACb,CACF;AAYK,IAAM,SAAS,CACpB,OACA,MACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,IAAI,WAAW,GAAG;AAAA,IAChD,MAAM,OAAO,OAAO,KAAK,KAAK;AAAA,IAC9B,IAAI,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACvB,OAAc,eAAM,WAAW;AAAA,EACjC;AAAA,EACA,OAAO,OAAO,KAAK,KAAK;AAAA,CACzB;;;AC3DH;AACA;AAwBA,IAAM,gBAAe,CAAC,MAAe,UAAyD;AAAA,EAC5F,MAAM,MAAM;AAAA,EACZ,IAAI,OAAO,IAAI,YAAY;AAAA,IAAU;AAAA,EACrC,OAAO;AAAA,IACL,cAAc,aAAa,IAAI,mBAAmB;AAAA,IAClD,YAAY,KAAK,IAAI,aAAa;AAAA,IAClC,IAAI,IAAI,IAAI,OAAO,KAAK;AAAA,IACxB,UAAU,IAAI,IAAI,aAAa,KAAK;AAAA,IACpC,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,IACZ,UAAU,KAAK,IAAI,WAAW;AAAA,IAC9B,YAAY,KAAK,IAAI,aAAa;AAAA,IAClC,cAAc,KAAK,IAAI,eAAe;AAAA,IACtC,mBAAmB,KAAK,IAAI,oBAAoB;AAAA,IAChD,QAAQ,IAAI,IAAI,WAAW,KAAK;AAAA,IAChC,YAAY,IAAI,IAAI,eAAe,KAAK;AAAA,IACxC,MAAM,IAAI,IAAI,SAAS,KAAK;AAAA,IAC5B,aAAa,IAAI,IAAI,gBAAgB,KAAK;AAAA,IAC1C,mBAAmB,IAAI,IAAI,sBAAsB,KAAK;AAAA,EACxD;AAAA;AAWK,IAAM,iBAAiB,CAAC,UAC7B,OACE,MAAM,QACN,QACA,OACM,6BAAsB,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,IAAI,CAAC,CAClF,EAAE,KACO,aAAI,CAAC,SAAS,cAAa,MAAM,KAAK,CAAC,GACvC,kBAAS,oBAAoB,MAAa,iBAAQ,SAAS,CAAC,CACrE;AAGK,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AAGzB,IAAM,qBAAoB,CAAC,WAC/B;AAAA,KACI,WAAW,KAAK;AAAA,EACnB,MAAM,MAAM;AACd;AAGK,IAAM,oBAAoB,CAAC,WAC/B;AAAA,KACI,WAAW,KAAK;AAAA,EACnB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AACd;;;AHpBK,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAaD,IAAM,WAAU,CAAC,YAAgC,UAC/C,KAAK,MAAM,MAAM,WAAW,MAAM,WAAW,YAAY,KACzD,KAAK,MAAM,UAAU,WAAW,UAAU,WAAW,YAAY,KACjE,KAAK,MAAM,mBAAmB,WAAW,iBAAiB,KAC1D,KAAK,KAAK,MAAM,UAAU,GAAG,WAAW,YAAY,WAAW,UAAU,KACzE,KAAK,MAAM,YAAY,WAAW,YAAY,WAAW,eAAe,EAAE,KAC1E,KAAK,KAAK,MAAM,WAAW,GAAG,WAAW,WAAW;AAE/C,IAAM,0BAA0B,MAC5B,iBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,EAE1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,eAAe,IAAI;AAAA,EAMvC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAC1E,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,KAAK;AAAA,IAC3D,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IACvC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,IAAI;AAAA,MAC1D,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAMD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IACvC,IAAI;AAAA,IACJ,IAAI,SAAS,WAAW;AAAA,MAItB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,IAAI;AAAA,MAC1D,OAAO,cAAc,MAAM,OAAO,IAAI,CAAC;AAAA,MACvC,OAAO,OAAO,OACZ,KAAK,QACL,aACA,MACM,0BAAmB,mBAAkB,IAAI,CAAC,CAClD;AAAA,IACF,EAAO;AAAA,MAQL,MAAM,OAAO,WAAW,UAAS,MAAM,MAAM,WAAW,IAAI,CAAC;AAAA,MAC7D,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,KAAK;AAAA,QAC3D,OAAO,OAAO,OACZ,KAAK,QACL,aACA,MACM,uBAAgB,kBAAkB,IAAI,CAAC,CAC/C;AAAA,MACF;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,OACnB,MACA,gBACA,CAAC,QAAQ,QAAQ,aAAa,SAAQ,KAAK,IAAI,CACjD;AAAA,IACA,IAAI,UAAU,aAAa,CAAC,SAAQ,OAAO,IAAI,GAAG;AAAA,MAChD,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,IAAI,sEACZ,qDAAqD,QAAQ,sBAC7D,8EACA,UACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAYD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACM,0BAAmB,EAAE,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK,CAAC,CAC/D;AAAA,IACA,MAAM,OAAO,OAAO,OAAO,MAAM,gBAAgB,CAAC,QAAQ,QAAQ,SAAS;AAAA,IAC3E,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,IAAI,uEACZ,iFACA,mCACJ,CACF;AAAA,IACF;AAAA,GACD;AACH,CAAC,CACH,CACF;;AI3HF,qBAAS;AACT,uBAAS;AACT;AACA;;;AChEO,IAAM,OAAO,CAAC,SAAiB,KAAK,KAAK,EAAE,YAAY;AAyBvD,IAAM,OAAO,CAAC,UAAmB;AAAA,EACtC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK;AAAA,EAC7B,MAAM,OAAO,IAAI,SAAS,GAAG,IAAI,SAAS;AAAA,EAC1C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,GAAG,CAAC,KAAK,MAAM,IAAI;AAAA;AAwBpD,IAAM,UAAU,CAAC,UAAmB;AAAA,EACzC,MAAM,UAAU,KAAK,KAAK,EAAE,KAAK;AAAA,EACjC,OAAO,YAAY,MAAM,KAAK;AAAA;AAqBzB,IAAM,OAAO,CAAC,UAAsD;AAAA,EACzE,MAAM,OAAO,QAAQ,MAAM,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,MAAO,SAAS,KAAK,CAAC,IAAI,EAAE,SAAS,KAAK,EAAG;AAAA;;;ADkCtE,IAAM,uBAAuB,UAA+B,uBAAuB;AAE1F,IAAM,YAAW,YAAyD;AAAA,EAQxE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,UAAU,KAAK,KAAK,OAAO;AAAA,IACjC,OAAO,YAAY,KACf,YACA;AAAA,MACE,MAAM;AAAA,MACN,SAAS,QAAQ,KAAK,UAAU;AAAA,MAChC,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,MAEnC,MAAM,KAAK,KAAK,SAAS,MAAM,IAAI;AAAA,IACrC;AAAA;AAAA,EAEN,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,KAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAO3D,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,YAAY,UACpB,WAAW,SAAS,KAAK,MAAM,IAAI,KAAK,WAAW,YAAY,QAAQ,MAAM,OAAO;AAAA,EAKtF,MAAM,CAAC,UAAU,4BAA4B,MAAM;AAAA,EACnD,YAAY;AACd,CAAC;AASM,IAAM,+BAA+B,MACjC,iBACP,sBACO,iBACL,qBAAqB,SAAS,GAAG;AAAA,KAC5B;AAAA,EACH,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAI3C,IAAI,WAAW,aAAa,YAAW,IAAI,KAAK,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI,GAAG;AAAA,MACrF,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,OAAO,OAAO,UAAS,KAAK,EAAE,MAAM,OAAO,CAAC;AAAA,GAC7C;AACH,CAAC,CACH,CACF;;AE/IF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACpEA;AACA;AAMO,IAAM,eAAe;AACrB,IAAM,eAAe;AAWrB,IAAM,gBAAgB,CAAC,aAAgC;AAAA,EAC5D,MAAM,QAAQ,YAAW;AAAA,EACzB,OAAO,UAAU,MAAM,KAAK;AAAA;AAI9B,IAAM,aAAa,CAAC,SAAsC;AAAA,EACxD,MAAM,SAAS,IAAI,KAAK,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC;AAAA,EACrD,OAAO,WAAW,KAAK,CAAC,IAAI,OAAO,MAAM,GAAG;AAAA;AAGvC,IAAM,cAAa,CAAC,WAAwD;AAAA,EACjF,SAAS,cAAc,MAAM,OAAO;AAAA,EACpC,SAAS,MAAM;AACjB;AAGO,IAAM,aAAa,CAAC,WAAqD;AAAA,EAC9E,SAAS,cAAc,MAAM,OAAO;AAAA,EACpC,SAAS,MAAM;AACjB;AAEA,IAAM,gBAAe,CAAC,MAAqC,WAAwC;AAAA,EAKjG,SAAS,KAAK,KAAK,OAAO;AAAA,EAE1B,SAAS,MAAM;AAAA,EACf,SAAS,WAAW,KAAK,OAAO;AAClC;AAMO,IAAM,WAAU,CAAC,YAA6B,UACnD,WAAW,YAAY,cAAc,MAAM,OAAO;AAuB7C,IAAM,kBAAkB,CAAC,UAC9B,iBACE,OAAO,MAAM,QAAQ,QAAQ,OAAc,uBAAe,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CACvF,EAAE,KACO,aAAI,CAAC,SACV,SAAS,aACL,aACA,KAAK,YAAY,YACf,YACA,cAAa,MAAM,KAAK,CAChC,CACF;AAUK,IAAM,YAAY,CAAC,UACxB,gBAAgB,KAAK,EAAE,KAAY,kBAAS,iBAAiB,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAGxF,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;;;ADW7B,IAAM,eAAe,WAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAEM,IAAM,uBAAuB,MACzB,kBACP,cACO,iBACL,aAAa,SAAS,GAAG;AAAA,EAKvB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAY7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,UAAU,IAAI,IAAI,gBAAgB,IAAI,CACtE;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACtE,OAAO,YAAW,cAAc,WAAW,IAAI,GAAG,KAAK;AAAA,IACvD,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,gBAAgB,IAAI;AAAA,IAGxC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,iBAAiB,KAAK,OAAO;AAAA,MACtD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MAEtB,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,IAAI;AAAA,MACtD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAOxC,MAAM,SAAS,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACpD,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACtE,OAAO,YAAW,cAAc,WAAW,IAAI,GAAG,KAAK;AAAA,IACvD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACO,0BAAkB,YAAW,IAAI,CAAC,CAC3C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,uBAAe,WAAW,IAAI,CAAC,CAAC;AAAA,IACvF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACnD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,iBAAiB,KAAK,2DACpB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,0BAAkB,EAAE,SAAS,KAAK,QAAQ,CAAC,CACpD;AAAA,GACD;AACH,CAAC,CACH,CACF;;AE5KF,qBAAS;AACT;AACA;AAmDO,IAAM,oBAAoB,WAA4B,oBAAoB;AAGjF,IAAM,OAAO,CAAC,QAAgB,IAAI,MAAM,GAAG,EAAE,MAAM;AAOnD,IAAM,SAAQ,CAAC,WAA4B;AAAA,EACzC,SAAS,MAAM,WAAW;AAAA,EAC1B,cAAc,OAAO,MAAM,gBAAgB,CAAC;AAAA,EAC5C,aAAa,OAAO,MAAM,eAAe,CAAC;AAAA,EAC1C,OAAO,MAAM,SAAS;AACxB;AAEA,IAAM,YAAW,YAAmD;AAAA,EAClE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAAA,IACjE,cAAc,IAAI,KAAK,iBAAiB,CAAC;AAAA,IACzC,aAAa,IAAI,KAAK,gBAAgB,CAAC;AAAA,IACvC,KAAK,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,MAAM;AAAA,IAC3D,OAAO,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC3D,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,KAAK,MAAM,GAAG;AAAA,EACxE;AAAA,EAMA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,KAAK,MAAM,IAAI;AAAA,EAS1D,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,YAAY,UACpB,WAAW,WAAW,MAAM,SAAS,cACrC,WAAW,aAAa,MAAM,WAAW,OACzC,WAAW,iBAAiB,MAAM,eAAe,MACjD,WAAW,kBAAkB,MAAM,gBAAgB;AAAA,EAMrD,MAAM,CAAC,UAAU,wBAAwB,MAAM;AAAA,EAC/C,YAAY;AACd,CAAC;AAiBM,IAAM,4BAA4B,MAC9B,kBAAO,mBAA0B,iBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;;ACpG5F,qBAAS;AACT;AACA;;;ACzCO,IAAM,WAAW,CAAC,UAAkD;AAAA,EACzE,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,SAAS,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,IAAK,SAAS,CAAC,GAAI;AAAA,IAChF,OAAO,MAAM,YAAY,MAAM,KAAK,EAAE,MAAM,GAAG;AAAA,IAC/C,IAAI,SAAS,aAAa,SAAS;AAAA,MAAI;AAAA,IACvC,MAAM,OAAO,OAAO,SAAS,YAAY,KAAK,EAAE;AAAA,IAChD,OAAO,IAAI,MAAM,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI;AAAA,EAChD;AAAA,EACA,OAAO,CAAC,GAAG,OAAO,KAAK,CAAC,EACrB,KAAK,EACL,IAAI,CAAC,SAAS;AAAA,IACb,MAAM,OAAO,OAAO,IAAI,IAAI,KAAK;AAAA,IACjC,OAAO,SAAS,IAAI,OAAO,GAAG,QAAQ,OAAO,IAAI;AAAA,GAClD,EACA,KAAK,GAAG;AAAA;AAYN,IAAM,WAAW,CAAC,UACvB,OAAO,UAAU,YAAY,UAAU,OACnC,OAAO,QAAQ,KAAK,EACjB,IAAI,EAAE,QAAQ,aAAa,GAAG,WAAW,OAAO,OAAO,GAAG,EAC1D,KAAK,EACL,KAAK,IAAI,IACZ;AAqBC,IAAM,cAAc,CAAC,QAC1B,IAAI,QAAQ,yBAAyB,CAAC,YAAY;AAAA,EAChD,IAAI;AAAA,IACF,OAAO,mBAAmB,OAAO;AAAA,IACjC,MAAM;AAAA,IACN,OAAO;AAAA;AAAA,CAEV;AAuBI,IAAM,WAAW,CAAC,WAA4D;AAAA,EACnF,SAAS,MAAM,YAAY,aAAa,MAAM,YAAY,KAAK,YAAY,MAAM;AAAA,EACjF,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,KACpC,MAAM,SAAS,kBAAkB,EAAE,QAAQ,MAAM,WAAW,OAAO,MAAM,UAAU,IAAI,CAAC;AAC9F;AA8BA,IAAM,WAAW,CAAC,WAAgD;AAAA,EAChE,UAAU,MAAM;AAAA,EAChB,WAAW,IAAI,MAAM,SAAS;AAAA,EAC9B,MAAM,MAAM;AAAA,KACR,MAAM,SAAS,kBAAkB,EAAE,OAAO,SAAS,MAAM,KAAK,EAAE,IAAI,CAAC;AAC3E;AAEO,IAAM,QAAO,CAAC,UAAuB;AAAA,EAC1C,MAAM,SAAS,SAAS,KAAK;AAAA,EAC7B,YAAY,QAAQ,UAAU,OAAO,QAAQ,SAAS,KAAK,CAAC,GAAG;AAAA,IAC7D,IAAI,UAAU;AAAA,MAAW,OAAO,UAAU;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAiBF,IAAM,YAAY,CAAC,UACxB,OAAO,QAAQ,SAAS,KAAK,CAAC,EAC3B,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,YAAY,MAAM;;;ADtBtB,IAAM,gBAAgB,WAAwB,gBAAgB;AAErE,IAAM,YAAW,YAA2C;AAAA,EAC1D,YAAY,CAAC,MAAM,UAAU;AAAA,IAO3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,UAAU,KAAK,KAAK,WAAW;AAAA,MAC/B,SAAS,KAAK,KAAK,UAAU;AAAA,MAO7B,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,MACpC,QAAQ,SAAS,KAAK,SAAS;AAAA,MAC/B,OAAO,SAAS,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW,SAAS;AAAA,MAC7E,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,MAC3B,WAAW,IAAI,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,SAAS;AAAA,MACpF,MAAM,KAAK,KAAK,SAAS,MAAM,IAAI;AAAA,MACnC,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,MAClC,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAGlB,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAa3D,UAAU,EAAE,QAAQ,8BAA8B,QAAQ,mCAAmC;AAAA,EAC7F,SAAS,CAAC,YAAY,UACpB,WAAW,cAAc,IAAI,MAAM,SAAS,KAC5C,WAAW,aAAa,MAAM,YAC9B,WAAW,YAAY,YAAY,MAAM,WAAW,EAAE,KACtD,WAAW,aAAa,MAAM,YAAY,UACzC,MAAM,SAAS,mBACb,WAAW,UAAU,SAAS,MAAM,KAAK,KACxC,WAAW,YAAY,MAAM,WAAW;AAAA,EAE9C,MAAM,CAAC,UAAU,oBAAoB,MAAM;AAAA,EAO3C,YAAY,CAAC,UAAU;AAAA,IACrB,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7B,MAAM,SAAS,MAAK,KAAK;AAAA,IACzB,OAAO,WAAW,QAAQ,KAAK;AAAA;AAEnC,CAAC;AASM,IAAM,wBAAwB,MAC1B,kBAAO,eAAsB,iBAAQ,cAAc,SAAS,GAAG,SAAQ,CAAC,CAAC;;AErNpF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACvBA;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,YAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,iBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,gBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,cAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,cAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,aAAW,uBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,aAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,uBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,aACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAaK,IAAM,sBAAsB,CAAC,KAAa,eACxC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,eAAM;AAAA,CACtE;;;AFxFI,IAAM,eAAe,CAAC,QACpB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,uBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,uBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AIjG9B,oBAAS;AACT;AAcO,IAAM,aAAa,CACxB,KACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,iBAAiB,IAAI,KAAK,IAAI,UAAU;AAAA,EAChE,IAAI,aAAa;AAAA,IAAU,OAAO;AAAA,EAClC,IAAI,aAAa,WAAW;AAAA,IAC1B,OAAc,oBACZ,GAAG,IAAI,mFACL,iFACJ;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,WAAW,CAAC,WACT,YACE,oBACL,GAAG,IAAI,+EACL,IAAI,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM,kCAChE,GACA,KACF;AAAA,EACF,OAAO,OAAO,SAAQ,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,CAChF;AAOI,IAAM,YAAY,CACvB,KACA,OACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,UAAU,aAAa,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EAC5D,QAAQ,OAAO,WAAW,KAAK,QAAO,KAAK,QAAQ,SAAQ,KAAK;AAAA,CACjE;;;AC3DI,IAAM,QAAQ,CAAC,OAAe,eACnC,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,IAAI,CAAC,SAA2B;AAAA,EAC/B,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,IAAI,OAAO;AAAA,IAAI,OAAO,CAAC,cAAc,MAAM,eAAe,YAAY,KAAK,IAAI;AAAA,EAC/E,OAAO,CAAC,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,CAC5D;AAOL,IAAM,WAAuE;AAAA,EAC3E,KAAK,EAAE,cAAc,IAAI;AAAA,EACzB,UAAU,EAAE,cAAc,KAAK,MAAM,KAAK,QAAQ,KAAK,OAAO,KAAK,SAAS,IAAI;AAAA,EAChF,KAAK,EAAE,UAAU,KAAK,gBAAgB,KAAK,WAAW,KAAK,MAAM,OAAO;AAAA,EACxE,QAAQ,EAAE,QAAQ,KAAK,WAAW,KAAK,OAAO,KAAK,WAAW,KAAK,IAAI,KAAK,QAAQ,IAAI;AAC1F;AAGA,IAAM,QAAQ,IAAI,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,OAAO,IAAI,IAAI,CAAC,SAAS,cAAc,CAAC;AAG9C,IAAM,iBAAiB,CAAC,KAAa,UAAkB;AAAA,EACrD,IAAI,MAAM,IAAI,GAAG;AAAA,IAAG,OAAO,eAAe,KAAK;AAAA,EAC/C,IAAI,KAAK,IAAI,GAAG;AAAA,IACd,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG;AAAA,EAClF,IAAI,QAAQ;AAAA,IAAU,OAAO,MAAM,YAAY;AAAA,EAC/C,OAAO;AAAA;AAIF,IAAM,YAAY,CACvB,OACA,QACA,eACwB;AAAA,EACxB,MAAM,WAAW,SAAS,WAAW,CAAC;AAAA,EACtC,MAAM,MAAM,IAAI;AAAA,EAChB,YAAY,KAAK,QAAQ,MAAM,OAAO,UAAU,GAAG;AAAA,IACjD,MAAM,YAAY,eAAe,KAAK,GAAG;AAAA,IACzC,IAAI,SAAS,SAAS;AAAA,MAAW,IAAI,IAAI,KAAK,SAAS;AAAA,EACzD;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,UAAU,CAAC,MAA2B,UACjD,KAAK,SAAS,MAAM,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,WAAW,MAAM,IAAI,GAAG,MAAM,KAAK;AAGjF,IAAM,aAAa,CAAC,UACzB,CAAC,GAAG,KAAG,EACJ,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,EACvC,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,WAAW,CAAC,OAA0B,OAA0B,CAAC,MAC5E,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,MAAI,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,MAAI,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EACxF,IAAI,CAAC,QAAQ,GAAG,OAAO,MAAI,IAAI,GAAG,KAAK,IAAI,EAC3C,KAAK,GAAG;AAMN,IAAM,UAAU,CAAC,UAAkB,SAAiB;AAAA,EACzD,MAAM,OAAO,UAAU,UAAU,KAAK;AAAA,EACtC,MAAM,OAAO,UAAU,MAAM,KAAK;AAAA,EAClC,IAAI,CAAC,KAAK,IAAI,QAAQ;AAAA,IAAG,KAAK,OAAO,QAAQ;AAAA,EAC7C,OAAO,EAAE,MAAM,KAAK;AAAA;AAQf,IAAM,WAAW,CAAC,UAAkB,SAA6B;AAAA,EACtE,MAAM,OAAO,IAAI,IAAI,MAAM,QAAQ,CAAC;AAAA,EACpC,MAAM,MAAM,SAAS,YAAY,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,IAAI,QAAQ;AAAA,EAC9E,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,QAAQ;AAAA,IAAW,KAAK,IAAI,UAAU,GAAG;AAAA,EACpE,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC;AAAA;AAIzB,IAAM,SAAS,CAAC,UACrB,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,SAAS,EAAE,OAAO,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,EAC5D,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,EAC9B,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,cAAc,CAAC,UAC1B,MACG,MAAM,SAAS,EACf,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,GAAG;AAMN,IAAM,kBAAkB,CAAC,UAAkB,MAAM,QAAQ,QAAQ,EAAE;AAGnE,IAAM,eAA8E;AAAA,EACzF,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,OAAO;AAAA,EACP,UAAU;AAAA,EACV,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,SAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AACP;AAGO,IAAM,YAAiC,IAAI,IAAI;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,kBAAoD;AAAA,EAC/D,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,KAAK;AACP;AAGO,IAAM,aAAa,CAAC,KAAa,UAA0B;AAAA,EAChE,MAAM,QAAO,aAAa;AAAA,EAC1B,IAAI,UAAS;AAAA,IAAU,OAAO,OAAO,OAAO,KAAK,CAAC;AAAA,EAClD,IAAI,UAAS;AAAA,IAAQ,OAAO,eAAe,KAAK;AAAA,EAChD,IAAI,QAAQ;AAAA,IAAe,OAAO,gBAAgB,KAAK;AAAA,EACvD,IAAI,QAAQ;AAAA,IAAY,OAAO,WAAW,UAAU,OAAO,UAAU,CAAC;AAAA,EACtE,IAAI,QAAQ,gBAAgB,QAAQ;AAAA,IAAgB,OAAO,YAAY,KAAK;AAAA,EAC5E,IAAI,QAAQ;AAAA,IAAW,OAAO,eAAe,OAAO,OAAO;AAAA,EAC3D,IAAI,QAAQ;AAAA,IAAQ,OAAO,OAAO,KAAK;AAAA,EACvC,OAAO;AAAA;;;ACrFF,IAAM,WAAgC,IAAI,IAAI;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,UAAU;AAAA,EACrB,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AACP;AAKO,IAAM,aAAa,CAAC,QAA8D;AAAA,EACvF,MAAM,QAAQ,6BAA6B,KAAK,GAAG;AAAA,EACnD,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,MAAM,SAAS,MAAM;AAAA,EACrB,MAAM,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC7B,OAAO,QAAQ,QAAQ,UAAU,CAAC,QAAQ,KAAK,IAAI;AAAA;AAI9C,IAAM,aAAkC,IAAI,IAAI;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,gBAAgB,CAAC,OAAiB,QAC5C,MAA6C;AAGzC,IAAM,eAAe,CAAC,UAC3B,OAAO,KAAK,KAAK,EACd,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,GAAG,KAAK,cAAc,OAAO,GAAG,MAAM,SAAS,EAC/E,KAAK;AAGH,IAAM,YAAY,CAAC,UACxB,UAAU,OAAO,MAAM,UAAU,QAAQ,MAAM,OAAO,KAAK;AAStD,IAAM,eAAe,CAAC,QAC3B,aAAa,SAAS,aACtB,QAAQ,kBACR,QAAQ,YACR,WAAW,GAAG,MAAM;AAUf,IAAM,eAAe,CAAC,SAA0D;AAAA,EACrF,MAAM,MAA8B,CAAC;AAAA,EACrC,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,CAAC,aAAa,GAAG,KAAK,SAAS,IAAI,GAAG;AAAA,MAAG;AAAA,IAC7C,IAAI,UAAU,QAAQ,UAAU,aAAa,OAAO,UAAU;AAAA,MAAU;AAAA,IACxE,IAAI,OAAO,UAAU,KAAK;AAAA,EAC5B;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,YAAY,CAAC,SAA4C;AAAA,EACpE,MAAM,MAAM,KAAK;AAAA,EACjB,IAAI,CAAC,MAAM,QAAQ,GAAG;AAAA,IAAG,OAAO,CAAC;AAAA,EACjC,OAAO,IACJ,IAAI,CAAC,SAAmB,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,EAAE,IAAI,EAAG,EACnE,OAAO,CAAC,QAAQ,QAAQ,EAAE;AAAA;;;AC9L/B,IAAM,WAAW;AAEjB,IAAM,QAA0C;AAAA,EAC9C,GAAG,QAAQ;AAAA,EACX,GAAG;AAAA,EACH,GAAG,QAAQ;AAAA,EACX,GAAG,QAAQ;AACb;AAGO,IAAM,YAAY,CAAC,UAAqC;AAAA,EAC7D,MAAM,QAAQ,6BAA6B,KAAK,MAAK,KAAK,CAAC;AAAA,EAC3D,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,OAAO,KAAK,MAAM,OAAO,MAAM,EAAE,KAAK,MAAM,OAAO,YAAY,IAAK,MAAM,MAAM,OAAO,EAAG;AAAA;AAkBrF,IAAM,cAAc,CAAC,UAAyB;AAAA,EACnD,OAAO,SAAS,MAAM,OAAM,QAAQ;AAAA,EACpC,MAAM,OAAO,QAAQ,OAAO,WAAW,MAAM,KAAK;AAAA,EAClD,MAAM,UAAU,UAAU,OAAM,UAAU,QAAQ;AAAA,EAClD,QAAQ,OAAO,QAAQ;AAAA,EACvB,MAAM,WAAW,QAAQ,IAAI,MAAM;AAAA,EACnC,QAAQ,OAAO,MAAM;AAAA,EACrB,MAAM,QAAQ,SAAS,KAAK,IAAI;AAAA,EAChC,IAAI,UAAU,MAAM;AAAA,IAClB,MAAM,MAAM,GAAG,MAAM,MAAM;AAAA,IAC3B,OAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,MAAM,UAAU,GAAG;AAAA,MACnB,UAAU;AAAA,MACV,QAAQ,MAAM,MAAM;AAAA,MACpB,SAAS;AAAA,IACX;AAAA,EACF;AAAA,EACA,MAAM,OAAO,aAAa,YAAY,YAAY,UAAU,QAAQ;AAAA,EACpE,IAAI,KAAK,WAAW,GAAG,GAAG;AAAA,IACxB,MAAM,QAAO,KAAK,WAAW,OAAO,IAAI,WAAW;AAAA,IACnD,OAAO,EAAE,aAAM,SAAS,MAAM,UAAU,QAAQ,MAAM,SAAS,GAAG;AAAA,EACpE;AAAA,EACA,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE;AAAA,IAC3C,SAAS,OAAO,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC;AAAA,EAC7C;AAAA;AAaK,IAAM,aAAa,CAAC,WAAmB,OAAO,SAAS,UAAU,OAAO,SAAS;AAOxF,IAAM,UAAU,CAAC,MAAc,aAAqB;AAAA,EAClD,MAAM,QAAQ,CAAC,GAAG,KAAK,UAAU,KAAK,SAAS;AAAA,EAC/C,YAAY,KAAK,UAAU,SAAS;AAAA,IAAS,MAAM,KAAK,GAAG,OAAO,OAAO;AAAA,EACzE,IAAI,KAAK,aAAa;AAAA,IAAW,MAAM,KAAK,QAAQ,KAAK,UAAU;AAAA,EACnE,OAAO,MAAM,KAAK,GAAG;AAAA;AAGhB,IAAM,cAAc,CAAC,KAAa,UAAkB,SAAgC;AAAA,EACzF,MAAM,OAAO,YAAY,QAAQ;AAAA,EACjC,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,IAAI,WAAW,IAAI,KAAK,WAAW,IAAI,GAAG;AAAA,IACxC,MAAM,QACJ,KAAK,SAAS,KAAK,QAAQ,KAAK,WAAW,KAAK,UAAU,QAAQ,KAAK,SAAS,KAAK,OAAO;AAAA,IAC9F,OAAO,QAAO,CAAC,IAAI,EAAE,UAAU,KAAK;AAAA,EACtC;AAAA,EACA,IAAI,KAAK,WAAW,KAAK,QAAQ;AAAA,IAC/B,OAAO;AAAA,MACL,QACE,GAAG,yBAAyB,KAAK,uBAAuB,KAAK,0BAC7D;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI,KAAK,SAAS,YAAY,KAAK,YAAY,KAAK,SAAS;AAAA,IAC3D,OAAO;AAAA,MACL,QACE,GAAG,wBAAwB,KAAK,2BAA2B,KAAK,+BAChE;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI;AAAA,EACJ,IAAI,KAAK,SAAS,aAAa,KAAK,SAAS,aAAa,KAAK,SAAS,KAAK,MAAM;AAAA,IACjF,IAAI,KAAK,OAAO,KAAK,MAAM;AAAA,MACzB,OAAO;AAAA,QACL,QACE,GAAG,iBAAiB,KAAK,YAAY,kCACrC,GAAG,KAAK,YAAY,uEACpB;AAAA,MACJ;AAAA,IACF;AAAA,IACA,SAAS,KAAK;AAAA,EAChB;AAAA,EACA,MAAM,MAAM,QAAQ,KAAK,SAAS,KAAK,OAAO,IAAI,YAAY,QAAQ,MAAM,IAAI;AAAA,EAChF,OAAO;AAAA,OACD,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,OAC/B,WAAW,YAAY,CAAC,IAAI,EAAE,OAAO;AAAA,EAC3C;AAAA;;;ACnGF,IAAM,QAAO,CAAC,UACZ,UAAU,aAAa,UAAU,OAAO,YAAY,UAAU,KAAK;AAG9D,IAAM,WAAW,CAAC,MAAc,KAAa,OAAe,QACjE,GAAG,QAAQ,kFACX,aAAa,OAAO,IAAI,KAAK,UAAU,KAAK,YAAY,QAAQ,KAAK,QAAQ,gBAC7E;AAGF,IAAM,cAAc,CAAC,UACnB,IAAI,IACF,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,QAAQ,UAAU,QAAQ,eAAe,KAAK,CAAC,CAAC,CAC3F;AASK,IAAM,mBAAmB,CAC9B,MACA,MACA,iBACY;AAAA,EACZ,IAAI,CAAC;AAAA,IAAc,OAAO;AAAA,EAC1B,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,IAAI,SAAS;AAAA,IAAW,OAAO,EAAE,KAAK,SAAS,KAAM,KAAK,SAAS,KAAK,KAAK,IAAI,SAAS;AAAA,EAC1F,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,MAAM,OAAO,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACrD,OAAO,CAAC,GAAG,IAAI,EAAE,KACf,CAAC,QAAQ,QAAQ,cAAc,KAAK,IAAI,GAAG,KAAK,SAAS,KAAK,IAAI,GAAG,KAAK,GAC5E;AAAA;AAGK,IAAM,aAAa,CAAC,iBACzB,eAAe,kCAAkC;AAE5C,IAAM,QAAQ,CAAC,OAAiB,SAA6C;AAAA,EAClF,MAAM,MAA8B,CAAC;AAAA,EACrC,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,SAA2C,CAAC;AAAA,EAClD,MAAM,SAAmB,CAAC;AAAA,EAC1B,MAAM,QAAQ,IAAI;AAAA,EAClB,MAAM,eAAe,KAAK,KAAK,iBAAiB,KAAK;AAAA,EAErD,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,OAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IAChD,MAAM,OAAO,MAAK,KAAK,IAAI;AAAA,IAC3B,MAAM,UAAU,WAAW,GAAG;AAAA,IAE9B,IAAI,QAAQ,gBAAgB;AAAA,MAC1B,IAAI,eAAe,IAAI,MAAM,eAAe,QAAQ,GAAG,GAAG;AAAA,QACxD,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KACL,sBAAsB,QAAQ,iBAAiB,6CAC7C,uFACJ;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,IAEA,IAAI,QAAQ,YAAY,UAAU,OAAO,MAAM;AAAA,MAC7C,IAAI,SAAS,IAAI;AAAA,QACf,IAAI,SAAS;AAAA,UAAW;AAAA,QACxB,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KACL,GAAG,4EACL;AAAA,MACF,EAAO,SAAI,SAAS,WAAW;AAAA,QAC7B,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,WAAW,YAAY,IAAI,CAAC,GAAG;AAAA,UACjC,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,+BAA+B,CAAC;AAAA,QAC9E,EAAO;AAAA,cAAI,OAAO;AAAA,MACpB,EAAO;AAAA,QACL,MAAM,UAAU,YAAY,KAAK,MAAM,IAAI;AAAA,QAC3C,IAAI,QAAQ,WAAW;AAAA,UAAW,OAAO,KAAK,QAAQ,MAAM;AAAA,QAC5D,IAAI,QAAQ,aAAa,MAAM;AAAA,UAC7B,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,+BAA+B,CAAC;AAAA,QAC9E;AAAA,QACA,IAAI,QAAQ,QAAQ;AAAA,UAAW,IAAI,OAAO,QAAQ;AAAA,QAClD,IAAI,QAAQ,WAAW;AAAA,UAAW,OAAO,KAAK,EAAE,MAAM,KAAK,MAAM,QAAQ,OAAO,CAAC;AAAA,QACjF,IAAI,OAAO,KAAK,OAAO,EAAE,SAAS;AAAA,UAAG,MAAM,IAAI,GAAG;AAAA;AAAA,MAEpD;AAAA,IACF;AAAA,IAEA,IAAI,UAAU,OAAO,OAAO;AAAA,MAC1B,MAAM,QAAO,SAAS,KAAK,SAAS,YAAY,SAAS,aAAa,QAAQ,MAAM,IAAI;AAAA,MACxF,IAAI,CAAC,OAAM;AAAA,QACT,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,qBAAqB,CAAC;AAAA,MACpE;AAAA,MACA;AAAA,IACF;AAAA,IAEA,IAAI,UAAU,OAAO,OAAO;AAAA,MAC1B,IAAI,SAAS,IAAI;AAAA,QACf,IAAI,SAAS,WAAW;AAAA,UACtB,MAAM,IAAI,GAAG;AAAA,UACb,MAAM,KAAK,GAAG;AAAA,QAChB;AAAA,MACF,EAAO,SAAI,SAAS,WAAW;AAAA,QAC7B,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,OAAO;AAAA,MACb,EAAO;AAAA,QACL,MAAM,OAAO,QAAQ,MAAM,IAAI;AAAA,QAC/B,IAAI,CAAC,QAAQ,KAAK,MAAM,KAAK,IAAI,GAAG;AAAA,UAClC,MAAM,IAAI,GAAG;AAAA,UACb,IAAI,OAAO,SAAS,MAAM,IAAI;AAAA,QAChC;AAAA;AAAA,MAEF;AAAA,IACF;AAAA,IAEA,IAAI,CAAC,aAAa,GAAG,GAAG;AAAA,MACtB,MAAM,IAAI,GAAG;AAAA,MACb,OAAO,KAAK,GAAG,8CAA8C;AAAA,MAC7D;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,SAAS,KAAK,KAAK,WAAW,KAAK,IAAI;AAAA,IACtD,MAAM,UAAU,QAAQ,gBAAgB;AAAA,IACxC,MAAM,MAAM,YAAY,YAAY,KAAK,WAAW,KAAK,OAAO;AAAA,IAChE,IAAI,WAAW;AAAA,MAAK;AAAA,IACpB,MAAM,IAAI,GAAG;AAAA,IAEb,MAAM,OAAO,QAAQ,aAAa,SAAS;AAAA,IAC3C,IAAI,QAAQ,cAAc,iBAAiB,QAAQ,IAAI,QAAQ,WAAW,YAAY,GAAG;AAAA,MACvF,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,WAAW,YAAY,CAAC,CAAC;AAAA,IACvE,EAAO,SAAI,SAAS,MAAM,UAAU,IAAI,GAAG,GAAG;AAAA,MAC5C,MAAM,KAAK,GAAG;AAAA,IAChB,EAAO,SAAI,SAAS,IAAI;AAAA,MACtB,OAAO,KAAK,GAAG,2DAA2D;AAAA,IAC5E,EAAO;AAAA,UAAI,OAAO;AAAA,EACpB;AAAA,EACA,OAAO,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,QAAQ,OAAO;AAAA;AAIhE,IAAM,UAAU,CAAC,MAAc,SAC7B,WAAW,UAAU,MAAM,OAAO,MAAM,CAAC,MAAM,WAAW,UAAU,MAAM,OAAO,MAAM,CAAC;;;ACtK1F,IAAM,iBAAiB,CAAC,KAAa,UACnC,GAAG,QAAQ,kFACX,gGACA;AAGK,IAAM,iBAAiB,CAAC,UAA8B;AAAA,EAC3D,MAAM,SAAmB,CAAC;AAAA,EAC1B,IAAI,MAAM,eAAe,aAAa,MAAM,eAAe,IAAI;AAAA,IAC7D,OAAO,KACL,MAAM,OAAO,MAAM,IAAI,uBAAuB,MAAM,sCAClD,kFACJ;AAAA,EACF;AAAA,EACA,MAAM,eAAe,MAAM,iBAAiB,YAAY,OAAO,KAAK,MAAM,YAAY;AAAA,EACtF,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,QAAQ,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IACjD,MAAM,SAAS,WAAW,GAAG,IAAI;AAAA,IAGjC,IAAI,CAAC,aAAa,GAAG;AAAA,MAAG,OAAO,KAAK,GAAG,8CAA8C;AAAA,IACrF,IAAI,UAAU;AAAA,MAAI;AAAA,IAClB,IAAI,WAAW;AAAA,MAAO,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,qBAAqB,CAAC;AAAA,IACzF,MAAM,SAAS,WAAW,QAAQ,QAAQ,WAAW,YAAY,KAAK,IAAI;AAAA,IAC1E,IAAI,WAAW,aAAa,WAAW,MAAM,GAAG;AAAA,MAC9C,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,+BAA+B,CAAC;AAAA,IAC/E;AAAA,IACA,IAAI,QAAQ,SAAS;AAAA,MAAU,OAAO,KAAK,eAAe,KAAK,KAAK,CAAC;AAAA,IACrE,IAAI,QAAQ,cAAc,iBAAiB,IAAI,OAAO,YAAY,GAAG;AAAA,MACnE,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,WAAW,YAAY,CAAC,CAAC;AAAA,IACxE;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,cAAa,CAAC,UAA4C;AAAA,EACrE,MAAM,OAA+B,EAAE,MAAM,OAAO,MAAM,IAAI,EAAE;AAAA,EAChE,IAAI,MAAM,eAAe;AAAA,IAAW,KAAK,gBAAgB,MAAM;AAAA,EAC/D,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,UAAU,MAAM,KAAK;AAAA,EACpE,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,QAAQ,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IACjD,IAAI,UAAU;AAAA,MAAI;AAAA,IAClB,KAAK,OAAO,QAAQ,aAAa,WAAW,KAAK,KAAK,IAAI;AAAA,EAC5D;AAAA,EACA,OAAO;AAAA;;;ACnET,IAAM,QAAQ,CAAC,MAAe,QAAyB;AAAA,EACrD,MAAM,QAAkB,KAAiC;AAAA,EACzD,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,QAAQ;AAAA;AAcnE,IAAM,mBAAmB,CAC9B,MACA,MACA,WACa;AAAA,EACb,MAAM,MAAM,QAAQ,QAAQ,KAAK;AAAA,EACjC,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EAC/B,MAAM,WAAW,MAAM,MAAM,YAAY;AAAA,EACzC,MAAM,UAAoB,CAAC;AAAA,EAC3B,IAAI,SAAS,aAAa,SAAS,KAAK;AAAA,IACtC,QAAQ,KACN,SAAS,OAAO,GAAG,QAAQ,OAAO,IAAI,iDACpC,2DACJ;AAAA,EACF;AAAA,EACA,IAAI,aAAa,aAAa,KAAK,eAAe,aAAa,aAAa,KAAK,YAAY;AAAA,IAC3F,QAAQ,KAAK,2EAA2E;AAAA,EAC1F;AAAA,EACA,OAAO;AAAA;;;ACtBT;;;ACKA;AAWO,IAAM,WAAW,CACtB,OACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW,OAAO;AAAA,EACvC,MAAM,aAAa,OAAO,mBAAmB,MAAM,KAAK,MAAM,UAAU;AAAA,EACxE,IAAI,eAAe,aAAa,WAAW,aAAa;AAAA,IAAM,OAAO;AAAA,EACrE,IAAI,WAAW,SAAS,aAAa,WAAW,SAAS;AAAA,IAAM,OAAO;AAAA,EACtE,OAAO,EAAE,OAAO,WAAW,OAAO,SAAQ,WAAW,KAAK,CAAC;AAAA,CAC5D;;;ACpBH;;;ACkBA;AA2BA,IAAM,aAAa,CAAC,QAAmB,SAC9B,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,SAAS;AAAA,EAQtB,MAAM,aAAa,OAAO,OAAO,QAAQ,MAAM;AAAA,EAC/C,MAAM,WAAY,OAAO,gBAAgB,QAAQ,YAAY,OAAO,IAAI;AAAA,EACxE,OAAO,KAAK,SAAS,OAAO;AAAA,CAC7B;AAYI,IAAM,eAAe,CAAC,SAAiB;AAAA,EAC5C,IAAI,SAAS;AAAA,IAAI,OAAO;AAAA,EACxB,MAAM,UAAU,KACb,MAAM;AAAA,CAAI,EACV,OACC,CAAC,UACE,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,MAC5C,CAAC,KAAK,WAAW,KAAK,KACtB,CAAC,KAAK,WAAW,KAAK,CAC1B,EAAE;AAAA,EACJ,OAAO,KAAK,IAAI,SAAS,CAAC;AAAA;AAIrB,IAAM,eAAe,CAAC,QAAmB,SAC9C,WAAW,QAAQ,IAAI,EAAE,KAAY,aAAI,YAAY,CAAC;AAmBxD,IAAM,gBAAgB,CAAC,WACrB,IAAiB,QAAQ,QAAQ,OAAO,gBAAgB,EAAE,KACjD,aAAI,CAAC,SAAS;AAAA,EACnB,MAAM,MAAM,QAAQ,CAAC;AAAA,EACrB,MAAM,WAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,SAAS,SAAS;AAAA,EACxD,OAAO;AAAA,IACL,SAAS,IACN,OAAO,CAAC,QAAQ,IAAI,SAAS,UAAU,CAAC,KAAK,IAAI,MAAM,CAAC,EACxD,IAAI,CAAC,QAAQ,KAAK,IAAI,MAAM,WAAW,CAAC;AAAA,IAC3C,SAAS,aAAY,YAAY,OAAO,KAAK,SAAQ,OAAO;AAAA,EAC9D;AAAA,CACD,CACH;AAgBK,IAAM,iBAAiB,CAAC,WAC7B,cAAc,MAAM,EAAE,KACb,aAAI,CAAC,WACV,OAAO,WAAW,OAAO,QAAQ,WAAW,IACxC,YACA,WAAW,OAAO,OAAO,OAAO,cAAc,OAAO,QAAQ,KAAK,IAAI,IAC5E,CACF;AAMK,IAAM,cACX;AACF,IAAM,gBAAgB;AAStB,IAAM,WAAW;AAsBV,IAAM,YAAY,CACvB,QACA,YACA,MACA,MAEA,WAAmB,aAEZ,aAAI,UAAU,GAAG;AAAA,EAUtB,MAAM,OAAO,SAAS,cAAc;AAAA,EACpC,SAAS,UAAU,EAAG,UAAU,UAAU,WAAW,GAAG;AAAA,IAWtD,MAAM,SAAS,OAAO,QAAoB,QAAQ,YAAY,OAAO,IAAI,EAAE,KAClE,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CACtC;AAAA,IACA,IAAI,WAAW;AAAA,MAAW,OAAO;AAAA,IACjC,IAAI,OAAO,WAAW;AAAA,MAAW,OAAO,KAAK,OAAO,YAAY,4BAA4B;AAAA,IAC5F,OAAc,eAAM,UAAU;AAAA,EAChC;AAAA,EACA,OAAO;AAAA,CACR;;;AD1MI,MAAM,wBAAwB,MAAM;AAAA,EACvB,OAAO;AAC3B;AAKO,IAAM,YAAY,CAAC,UAAoB,SAAS,MAAM,YAAY,OAAO,MAAM,IAAI;AAgB1F,IAAM,gBAAgB;AAAA,EACpB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAGA,IAAM,eAAe;AACrB,IAAM,aAAa;AAEnB,IAAM,gBAAgB,CAAC,UACrB,iBAAiB,YAAY,MAAM,WAAW;AAMzC,IAAM,WAAW,CAAC,UAChB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO,IACpB,MAAM,QACN,QACA,OACA,GAAG,UAAU,KAAK,UACpB,EAAE,KACO,aAAI,CAAC,UAAU,EAAE,MAAM,OAAO,UAAU,EAAE,GAC1C,iBAAQ,eAAe,CAAC,UAAiB,iBAAQ,EAAE,MAAM,WAAW,MAAM,CAAC,CAAC,CACrF;AAAA,EACA,IAAI,OAAO,SAAS,aAAa,OAAO,SAAS;AAAA,IAAM,OAAO,OAAO;AAAA,EACrE,MAAM,OAAO,OAAO,IAClB,MAAM,QACN,QACA,OACA,2BACF;AAAA,EAGA,MAAM,SAAS,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,OAAO,IAAI,IAAI,MAAM,MAAM,IAAI;AAAA,EACxE,IAAI,UAAU,aAAa,MAAM,SAAS,MAAM,QAAQ,MAAM,SAAS,OAAO;AAAA,IAC5E,OAAO,OAAc,cACnB,OAAO,SACL,IAAI,gBAAgB,MAAM,OAAO,MAAM,IAAI,wCAAwC,CACvF;AAAA,EACF;AAAA,EACA,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,cACnB,IAAI,gBACF,QAAQ,OAAO,MAAM,IAAI,UAAU,KAAK,MAAM,MAAM,OAAO,UACzD,GAAG,KAAK,MAAM,MAAM,GAAG,yBAAyB,MAAM,iCACtD,oFACJ,CACF;AAAA,EACF;AAAA,EACA;AAAA,CACD;AAEI,IAAM,gBAAe,CAAC,OAAiB,UAAkD;AAAA,EAC9F,QAAQ,aAAa,IAAI;AAAA,EACzB,MAAM,MAAM;AAAA,EACZ,SAAS,UAAU,IAAI;AAAA,EACvB,MAAM,MAAM;AACd;AAGA,IAAM,OAAO,CACX,OACA,QACA,MACA,MACA,OACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,KAAK,OAAO,QAAgB,MAAM,QAAQ,YAAY,QAAQ,MAAM,IAAI,CAAC;AAAA,EACtF,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAc,cACnB,IAAI,gBACF,GAAG,qFACL,CACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAO,UAAU,MAAM,QAAQ,YAAY,MAAM,MAAM,MAAM,KAAK;AAAA,EAC/E,IAAI,SAAS,MAAM;AAAA,IACjB,OAAO,OAAc,cACnB,IAAI,gBACF,GAAG,cAAc,eAAe,kCAAkC,MAAM,gBACtE,GAAG,6CACP,CACF;AAAA,EACF;AAAA,CACD;AAGI,IAAM,cAAc,CAAC,UACnB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,YAAW,KAAK;AAAA,EAQ7B,OAAO,UAAU,cAAc,QAAQ,MAAM,IAAI;AAAA,EACjD,OAAO,OAAO,KACZ,OACA,QACA,SAAS,MAAM,YACf,aAAa,OAAO,MAAM,IAAI,KAC9B,cACA,IACF;AAAA,CACD;AAYI,IAAM,cAAc,CAAC,OAAiB,QAAmB,WACvD,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,KAAK,OAAO,GAAG,EAAE,SAAS,KAAK,OAAO,MAAM,SAAS,GAAG;AAAA,IACjE,MAAM,OAAO,WACX,KAAK,OAAO,QAAS,WAAW,KAAK,CAAC,IAAI,EAAE,OAAO,EAAG,GACtD,OAAO,KACT;AAAA,IAEA,OAAO,UAAU,cAAc,QAAQ,MAAM,KAAK;AAAA,IAClD,OAAO,IAAI,MAAM,QAAQ,aAAa,OAAO,GAAG,UAAU,KAAK,YAAY,IAAI;AAAA,EACjF;AAAA,EACA,WAAW,QAAQ,OAAO,QAAQ;AAAA,IAChC,MAAM,QAAQ,EAAE,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK;AAAA,IAGjD,OAAO,UAAU,cAAc,QAAQ,OAAO,IAAI;AAAA,IAClD,OAAO,KACL,OACA,OACA,GAAG,UAAU,KAAK,YAClB,QAAQ,KAAK,cAAc,OAAO,MAAM,IAAI,QAAQ,KAAK,QACzD,YACA,KACF;AAAA,EACF;AAAA,CACD;AAYI,IAAM,eAAe,CAAC,OAAiB,aACrC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,SAAS,KAAK;AAAA,EAClC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,MAAM,UAAU,IAAI,EAAE;AAAA,EACpC,IAAI,MAAM,SAAS,GAAG;AAAA,IACpB,OAAO,OAAc,cACnB,IAAI,gBACF,cAAc,OAAO,MAAM,IAAI,mBAAmB,MAAM,qCACtD,gBAAgB,MAAM,KAAK,IAAI,qDAC/B,8EACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,KAAK,OAAO,UAAU,UAAU,KAAK,GAAG,cAAc,OAAO,MAAM,IAAI,KAAK,UAAU;AAAA,CAC9F;;;AFpNI,IAAM,kBAAkB,CAAC,OAAiB,UAC/C,MAAM,OAAO,MAAM,IAAI,QAAQ,MAAM,kCAAkC,MAAM,KAAK,IAAI,WACtF,gGACA,+FACA;AAMK,IAAM,qBAAqB,CAChC,OACA,OACA,MACA,WAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,MAAM,WAAW;AAAA,IAAG;AAAA,EAC/B,MAAM,WAAU,CAAC,aACR,cAAK,MAAM,MAAM,UAAsB,IAAI,EAAE,MAAM,WAAW,CAAC;AAAA,EACxE,IAAI,EAAE,OAAO,SAAS,OAAO,QAAO;AAAA,IAAI;AAAA,EACxC,OAAO,OAAc,cAAK,IAAI,gBAAgB,gBAAgB,OAAO,OAAO,KAAK,CAAC,CAAC;AAAA,CACpF;;;AZeI,IAAM,aAAa,WAAqB,eAAe,EAAE,sBAAsB,SAAS,CAAC;AAKhG,IAAM,UAAU,CAAC,YACR,cAAK,IAAI,gBAAgB,QAAQ,KAAK;AAAA,CAAI,CAAC,CAAC;AAQrD,IAAM,OAAO,CAAC,OAAiB,MAAuB,SAC7C,aAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,WAAW;AAAA,EACnB,MAAM,YAAW,iBAAiB,MAAM,MAAM,MAAM;AAAA,EACpD,IAAI,UAAS,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,SAAQ;AAAA,EACvD,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,IAAI,CAAC,aAAW,IAAI;AAAA,IAAG;AAAA,EACvB,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,EAKjC,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,WAAW,eAAe,IAAI;AAAA,IACpC,IAAI,SAAS,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,QAAQ;AAAA,IACvD,OAAc,oBACZ,eAAe,KAAK,QAAQ,OAAO,KAAK,IAAI,6CAC1C,6EACJ;AAAA,IACA,OAAO,EAAE,QAAQ,SAAS;AAAA,EAC5B;AAAA,EACA,MAAM,SAAS,MAAM,MAAM,IAAI;AAAA,EAC/B,OAAO,mBAAmB,OAAO,MAAM,MAAM,MAAM;AAAA,EACnD,IAAI,OAAO,OAAO,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,OAAO,MAAM;AAAA,EACjE,MAAM,QAAQ,KAAK,SAAS,OAAO;AAAA,EACnC,IAAI,OAAO,MAAM,WAAW,KAAK,CAAC;AAAA,IAAO,OAAO,EAAE,QAAQ,OAAO;AAAA,EACjE,MAAM,OACJ,OAAO,MAAM,WAAW,IACpB,mBAAmB,KAAK,iBAAiB,OAAO,qCAChD,qBACA,+CAA+C,OAAO,MAAM,KAAK,IAAI,YACrE;AAAA,EACN,OAAc,oBAAW,eAAe,KAAK,QAAQ,OAAO,KAAK,IAAI,MAAM,MAAM;AAAA,EACjF,OAAO,EAAE,QAAQ,SAAS;AAAA,CAC3B;AAoBH,IAAM,YAAY,CAAC,OAAiB,SAC3B,aAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,WAAW;AAAA,EACnB,MAAM,YAAW,iBAAiB,MAAM,MAAM,MAAM;AAAA,EACpD,IAAI,UAAS,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,SAAQ;AAAA,EACvD,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,EACjC,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,WAAW,eAAe,IAAI;AAAA,IACpC,IAAI,SAAS,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,QAAQ;AAAA,IACvD,OAAO,YAAY,IAAI;AAAA,EACzB,EAAO;AAAA,IACL,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,eAAe,OAAO,kBAAkB,OAAO,KAAK,IAAI,QAAQ,KAAK,MAAM;AAAA,IACpF;AAAA,IACA,MAAM,SAAS,MAAM,MAAM,IAAI;AAAA,IAC/B,IAAI,WAAW,aAAa,OAAO,MAAM,SAAS,GAAG;AAAA,MACnD,OAAO,OAAO,QAAQ;AAAA,QACpB,MAAM,OAAO,KAAK,IAAI,uBAAuB,KAAK,yBAChD,GAAG,OAAO,MAAM,KAAK,IAAI,gEACzB;AAAA,MACJ,CAAC;AAAA,IACH;AAAA,IACA,OAAO,mBAAmB,OAAO,MAAM,MAAM,MAAM;AAAA,IACnD,IAAI,OAAO,OAAO,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,OAAO,MAAM;AAAA,IACjE,IAAI,OAAO,MAAM,SAAS;AAAA,MAAG,OAAO,YAAY,MAAM,QAAQ,KAAK,KAAK,SAAS,CAAC;AAAA;AAAA,EAEpF,MAAM,QAAQ,OAAO,SAAS,IAAI;AAAA,EAClC,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAO,QAAQ;AAAA,MACpB,MAAM,OAAO,KAAK,IAAI;AAAA,IACxB,CAAC;AAAA,EACH;AAAA,EACA,MAAM,OAAO,MAAM,MAAM,KAAK,EAAE;AAAA,EAChC,IAAI,KAAK,SAAS,GAAG;AAAA,IACnB,OAAO,OAAO,QAAQ;AAAA,MACpB,MAAM,OAAO,KAAK,IAAI,uBAAuB,KAAK,KAAK,IAAI,6BACzD,yFACA;AAAA,IACJ,CAAC;AAAA,EACH;AAAA,EACA,OAAO,cAAa,MAAM,KAAK;AAAA,CAChC;AAEH,IAAM,UAAU,CAAC,MAAgB,YAAiD;AAAA,EAChF,MAAM,QAAQ,QAAQ,KAAK;AAAA,EAC3B,QAAQ,KAAK;AAAA,EACb,MAAM,QAAQ,QAAQ,KAAK;AAC7B;AAeA,IAAM,OAAO,CAAC,OAAiB,SACtB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,QAAQ,MAAM,MAAM,MAAM;AAAA,EACxC,MAAM,OAAO,OAAO,SAAS,KAAK;AAAA,EAClC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,WAAiB,cAAK,MAAM,MAAM,MAAM,IAAI,EAAE,MAAM,WAAW,CAAC;AAAA,EACtE,OAAO,OAAO,UAAU,OAAO,cAAa,OAAO,IAAI,GAAG,QAAO;AAAA,CAClE;AAUH,IAAM,YAAW;AAAA,EACf,QAAQ,GAAG,MAAM,aACf,aAAa,QAAQ,MAAM,MAAM,GAAG,IAAI;AAAA,EAC1C,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,KAAK,EAAE,KAAK,YAAY,OAAO,GAAG,MAAM,IAAI;AAAA,EAC9C,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,KAAK,EAAE,KAAK,YAAY,OAAO,GAAG,IAAI;AAAA,EACxC,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,UAAU,EAAE,KAAK,YAAY,OAAO,GAAG,IAAI;AAC/C;AAEO,IAAM,qBAAqB,MACvB,kBACP,YACO,iBAAQ,WAAW,SAAS,GAAG,SAAQ,CAAC,EAAE,KAAY,aAAI,cAAc,CAAC,CAClF;;AgBrNF,qBAAS;AACT,uBAAS;AACT;;;ACVO,IAAM,SAAQ;AAErB,IAAM,MAAM,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAuBnF,IAAM,YAAW,CAAC,UAAiE;AAAA,EACxF,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,EAAE,KAAK,IAAI,MAAM,GAAG,GAAG,MAAM,MAAM,MAAM,SAAS,IAAI,MAAM,OAAO,EAAE;AAAA,SACzE;AAAA,MACH,OAAO;AAAA,QACL,mBAAmB,MAAM;AAAA,QACzB,QAAQ,MAAM;AAAA,QACd,eAAe,MAAM;AAAA,QACrB,iBAAiB,IAAI,MAAM,gBAAgB;AAAA,QAC3C,KAAK,IAAI,MAAM,GAAG;AAAA,QAClB,cAAc,MAAM;AAAA,QACpB,SAAS,IAAI,MAAM,OAAO;AAAA,MAC5B;AAAA,SACG;AAAA,MACH,OAAO;AAAA,QACL,oBAAoB,MAAM;AAAA,QAC1B,sBAAsB,IAAI,MAAM,qBAAqB;AAAA,QACrD,aAAa,MAAM;AAAA,QACnB,iBAAiB,MAAM;AAAA,QACvB,gBAAgB,IAAI,MAAM,eAAe;AAAA,MAC3C;AAAA;AAAA;AAWN,IAAM,eAAe,CAAC,UAAqD;AAAA,EACzE,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,CAAC;AAAA,SACL;AAAA,MACH,OAAO,EAAE,sBAAsB,MAAM,0BAA0B,QAAQ,MAAM,IAAI;AAAA,SAC9E;AAAA,MACH,OAAO,EAAE,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,IAAI;AAAA;AAAA;AAcjF,IAAM,YAAW,CAAC,WAAsD;AAAA,EACtE,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EACxC,MAAM,OAAO,MAAM,IAAI;AAAA,EACvB,QAAQ,MAAM;AAAA,KACX,aAAa,KAAK;AACvB;AAEO,IAAM,QAAO,CAAC,UAA6B;AAAA,EAChD,MAAM,SAAS,UAAS,KAAK;AAAA,EAC7B,YAAY,QAAQ,UAAU,OAAO,QAAQ,UAAS,KAAK,CAAC,GAAG;AAAA,IAC7D,IAAI,UAAU;AAAA,MAAW,OAAO,UAAU;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,SAAS,CAAC,UAA6B;AAAA,EAClD,MAAM,QAAQ,OAAO,QAAQ,UAAS,KAAK,CAAC,EACzC,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,YAAY,MAAM;AAAA,EAC3B,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;AAW/B,IAAM,cAAa,CAAC,WAA8B,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,KAAK;;;AChErF,IAAM,iBAAiB,CAAC,UAA+D;AAAA,EAC5F,oBAAoB,KAAK,KAAK,mBAAmB;AAAA,EACjD,sBAAsB,IAAI,KAAK,uBAAuB,MAAK;AAAA,EAC3D,aAAa,KAAK,KAAK,YAAY;AAAA,EACnC,iBAAiB,KAAK,KAAK,gBAAgB;AAAA,EAC3C,gBAAgB,IAAI,KAAK,iBAAiB,MAAK;AAAA,EAC/C,mBAAmB,KAAK,KAAK,oBAAoB,IAAI;AACvD;AASO,IAAM,cAAc,CACzB,YACA,UAEA,WAAW,yBAAyB,MAAM,uBAAuB,OACjE,WAAW,2BAA2B,MAAM,yBAAyB,WACrE,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,sBAAsB,MAAM,oBAAoB,OAC3D,WAAW,qBAAqB,MAAM,mBAAmB,WACzD,WAAW,wBAAwB,MAAM,uBAAuB;;;AClFlE,IAAM,cAAc,CAAC,YAAoC,UAAsC;AAAA,EAC7F,IAAI,MAAM,SAAS;AAAA,IAAiB,OAAO,YAAY,YAAY,KAAK;AAAA,EACxE,MAAM,SACJ,WAAW,SAAS,MAAM,OAAO,WAAU,WAAW,aAAa,MAAM,WAAW;AAAA,EACtF,IAAI,MAAM,SAAS;AAAA,IAAY,OAAO,UAAU,WAAW,UAAU,MAAM,QAAQ;AAAA,EACnF,OACE,UACA,WAAW,mBAAmB,MAAM,iBAAiB,OACrD,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,YAAY,MAAM,UAAU,OACvC,WAAW,wBAAwB,MAAM,sBAAsB,OAC/D,WAAW,sBAAsB,MAAM,oBAAoB,WAC3D,WAAW,2BAA2B,MAAM,0BAA0B;AAAA;AAInE,IAAM,mBAAmB;AAAA,EAC9B,YAAY,CAAC,MAAM,UAAU;AAAA,IAQ3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,SACF,eAAe,IAAI;AAAA,MACtB,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,MAC/C,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,MACpC,IAAI,MAAM;AAAA,MACV,eAAe,KAAK,KAAK,gBAAgB;AAAA,MACzC,iBAAiB,IAAI,KAAK,kBAAkB,MAAK;AAAA,MACjD,KAAK,IAAI,KAAK,QAAQ,MAAK;AAAA,MAC3B,cAAc,KAAK,KAAK,eAAe;AAAA,MACvC,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,MAAM,IAAI,KAAK,SAAS,CAAC;AAAA,MACzB,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,SAAS,IAAI,KAAK,YAAY,MAAK;AAAA,MACnC,MAAM,MAAM;AAAA,MACZ,sBAAsB,KAAK,KAAK,uBAAuB,IAAI;AAAA,IAC7D;AAAA;AAAA,EAGF,YAAY,CAAC,UAAU,0BAA0B,MAAM;AAAA,EAEvD,YAAY;AAAA,EAMZ,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EAKA,SAAS,CAAC,YAAY,UACpB,WAAW,WAAW,MAAM,UAC5B,WAAW,SAAS,MAAM,QAC1B,WAAW,aAAa,MAAM,YAAY,SAC1C,YAAY,YAAY,KAAK;AAAA,EAC/B,MAAM,CAAC,UAAU,0BAA0B,MAAM;AAAA,EAEjD,YAAY;AACd;;;ACrFA;AACA,8BAAS;AACT;AACA;AAWO,IAAM,sBAAsB,CAAC,UAClC,OAAO,MAAM,QAAQ,QAAQ,OAAe,iCAAwB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC9E,iBAAQ,CAAC,UACP,4BAA2B,eAAc,gBAAe,eAAO,CAAC,EAAE,KAAI,EAAE,KACtE,kBACL,MACE,IAAI,mBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC,CACL,CACF,CACF,GACO,kBAAS,wBAAwB,MAAa,iBAAQ,SAAS,CAAC,GAChE,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAEK,IAAM,mBAAmB,CAAC,UAC/B,oBAAoB,KAAK,EAAE,KAClB,aAAI,CAAC,QAAS,QAAQ,YAAY,YAAY,iBAAiB,WAAW,KAAK,KAAK,CAAE,CAC/F;AAGK,IAAM,sBAAsB,CACjC,OACA,UAC4C;AAAA,KACzC,QAAO;AAAA,IACR,iBAAiB,KAAK;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,eAAe,KAAK;AAAA,IACpB,eAAe,KAAK;AAAA,IACpB,KAAK,KAAK;AAAA,IACV,cAAc,KAAK;AAAA,IACnB,kBAAkB,KAAK;AAAA,IACvB,oBAAoB,KAAK;AAAA,IACzB,WAAW,KAAK;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,cAAc,KAAK;AAAA,IACnB,iBAAiB,KAAK;AAAA,IACtB,MAAM,KAAK;AAAA,IACX,SAAS,KAAK;AAAA,IACd,oBAAoB,KAAK;AAAA,EAC3B,CAAwF;AAAA,EACxF,IAAI,MAAM;AAAA,EACV,MAAM,OAAO,MAAM,IAAI;AAAA,EACvB,QAAQ,MAAM;AAChB;AAOO,IAAM,qBAAqB,CAAC,UAC1B,aAAI,UAAU,GAAG;AAAA,EACtB,KAAK,OAAO,oBAAoB,KAAK,OAAO;AAAA,IAAW;AAAA,EACvD,OAAO,OACL,MAAM,QACN,aACA,MACQ,oCAA2B,EAAE,IAAI,MAAM,GAAG,CAAC,CACrD;AAAA,CACD;;;AJrCH;AACA;AA6FO,IAAM,sBAAsB,WAA8B,sBAAsB;AAWvF,MAAQ,2BAAa,8BAAgB,WAAW,gBAAgB;AAGzD,IAAM,8BAA8B,MAChC,kBACP,qBACO,iBACL,oBAAoB,SAAS,GAAG;AAAA,EAC9B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,iBAAiB,IAAI;AAAA,EACzC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,iBAAiB,IAAI;AAAA,IACzC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,iBAAiB,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC3E;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,iBAAiB,IAAI;AAAA,IACzC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OACL,KAAK,QACL,aACA,MACQ,oCAA2B;AAAA,WAC9B,oBAAoB,MAAM,iBAAiB,WAAW,IAAI,CAAC;AAAA,QAC9D,MAAM,KAAK;AAAA,MACb,CAAC,CACH;AAAA,IACF,EAAO;AAAA,MACL,MAAM,OAAO,WACX,iBAAiB,SACjB,MACA,MACA,iBAAiB,WAAW,IAAI,CAClC;AAAA,MACA,IAAI,SAAS;AAAA,QACX,OAAO,OACL,KAAK,QACL,aACA,MACQ,iCAAwB,oBAAoB,MAAM,IAAI,CAAC,CACjE;AAAA;AAAA,IAEJ,MAAM,QAAQ,OAAO,iBAAiB,IAAI;AAAA,IAC1C,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MACF,GAAG,iBAAiB,KAAK,IAAI,4DAC/B,CACF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAAW,mBAAmB,IAAI;AAC/C,CAAC,CACH,CACF;;AKlKF,qBAAS;AACT,uBAAS;AAET;AACA;;;AC9BO,IAAM,yBAAsC;AAM5C,IAAM,qBAAkC;AAExC,IAAM,oBAAyC,UAAU,wBAAwB,CAAC,GAAG,IAAI;AAEzF,IAAM,gBAAqC,UAAU,oBAAoB,CAAC,GAAG,IAAI;;;ADsFjF,IAAM,sBAAsB,WAA8B,sBAAsB;AAEvF,IAAM,QAAO,CAAC,UACZ,aAAa,MAAM,QAAQ,MAAM,IAAI,EAAE,KAC9B,aAAI,CAAC,aAAa,EAAE,MAAM,MAAM,MAAM,QAAQ,EAAE,CACzD;AAYF,IAAM,QAAO,CAAC,SACL,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,CAAC,aAAW,IAAI;AAAA,IAAG;AAAA,EACvB,QAAQ,YAAY,OAAO,MAAK,IAAI;AAAA,EACpC,OAAO,YAAY,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,CAC5E;AAGH,IAAM,SAAS,CAAC,MAAc,QACrB,aAAI,IAAI,MAAM,wBAAwB,SAAS,KAAK,CAAC;AAE9D,IAAM,QAAQ,CAAC,UACN,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,SAAS,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,EASrD,IAAI,WAAW;AAAA,IAAG,OAAO,EAAE,MAAM,SAAS,EAAE;AAAA,EAE5C,MAAM,SAAS,OAAO,eAAe,MAAM,MAAM;AAAA,EACjD,IAAI,WAAW,WAAW;AAAA,IACxB,OAAO,OAAO,OACZ,MACA,wEAAwE,cACtE,0EACJ;AAAA,EACF;AAAA,EAWA,OAAO;AAAA,EACP,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,OAAO,QAAgB,MAAM,QAAQ,YAAY,OAAO,SAAS,cAAc;AAAA,EAC5F,IAAI,SAAS,WAAW;AAAA,IACtB,OAAO,OAAO,OACZ,MACA,+FACE,qFACJ;AAAA,EACF;AAAA,EAUA,MAAM,aAAa,OAAO,UAAU,MAAM,QAAQ,YAAY,MAAM,IAAI;AAAA,EACxE,IAAI,eAAe,MAAM;AAAA,IACvB,OAAO,OAAO,OACZ,MACA,qBAAqB,gBAAgB,yCACnC,sBAAsB,cAAc,wDACpC,yBACJ;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,OAAO,eAAe,MAAM,MAAM;AAAA,EAChD,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAO,OACZ,MACA,2DAA2D,sBACzD,2FACA,gEACJ;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,EACnD,IAAI,SAAS,GAAG;AAAA,IACd,OAAO,OAAO,OACZ,MACA,8BAA8B,OAAO,IAAI,sDACvC,2FACJ;AAAA,EACF;AAAA,EACA,OAAO,EAAE,MAAM,SAAS,KAAK;AAAA,CAC9B;AAaH,IAAM,YAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM,GAAG,WAA+C,MAAK,IAAI;AAAA,EACjE,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAwC,MAAK,IAAI;AAAA,EAC1D,WAAW,GAAG,WAAwC,MAAM,IAAI;AAClE;AAEO,IAAM,8BAA8B,MAChC,kBAAO,qBAA4B,iBAAQ,oBAAoB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AE9KhG,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AClBO,IAAM,sBAAsB;AAC5B,IAAM,sBAAsB;AAU5B,IAAM,SAAQ;AAuBd,IAAM,YAAY,CAAC,UACxB,KAAK,KAAK,EACP,MAAM,SAAS,EACf,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAYN,IAAM,WAAU,CAAC,UAAmB,KAAK,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAGlE,IAAM,QAAO,CAAI,UAAyB,SAC/C,aAAa,aAAa,aAAa;AAElC,IAAM,WAAW,CAAC,UAA8B,SACrD,aAAa,aAAa,UAAU,QAAQ,MAAM;AAE7C,IAAM,cAAc,CAAC,UAA8B,SACxD,aAAa,aAAa,SAAQ,QAAQ,MAAM;AAElD,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAkCtC,IAAM,QAAO,CAAC,WAAqD;AAAA,KACrE,OAAM,aAAa,KAAK,MAAM,SAAS,CAAC;AAAA,KACxC,OAAM,gBAAgB,MAAM,eAAe;AAAA,KAC3C,OAAM,aAAa,MAAM,SAAS;AAAA,KAClC,OAAM,yBAAyB,MAAM,qBAAqB;AAAA,KAC1D,OAAM,gBAAgB,MAAM,YAAY;AAAA,KACxC,OAAM,eAAe,MAAM,WAAW;AAAA,KACtC,OAAM,qBAAqB,MAAM,sBAAsB,OAAO,MAAM,SAAS;AAAA,KAC7E,OAAM,QAAQ,MAAM,IAAI;AAAA,KACxB,OAAM,YAAY,MAAM,QAAQ;AAAA,KAChC,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,OAAO,MAAM,QAAQ,YAAY,YAAY,OAAO,MAAM,GAAG,CAAC;AAAA,KACpE,OAAM,UAAU,MAAM,MAAM;AAAA,KAC5B,OAAM,WAAW,MAAM,eAAe,YAAY,YAAY,OAAO,MAAM,UAAU,CAAC;AAAA,KACtF,OAAM,mBAAmB,MAAM,kBAAkB;AAAA,EACpD,MAAM,MAAM;AACd;AAgBO,IAAM,cAAa,CAAC,WAAqD;AAAA,KAC3E,MAAK,KAAK;AAAA,EACb,OAAO,MAAM;AACf;AAqBO,IAAM,cAAa,CAAC,UAAoD;AAAA,EAC7E,MAAM,QAAQ;AAAA,IACZ,GAAI,MAAM,SAAS,YAAY,CAAC,MAAM,IAAI,CAAC;AAAA,IAC3C,GAAI,MAAM,sBAAsB,QAAQ,CAAC,mBAAmB,IAAI,CAAC;AAAA,EACnE;AAAA,EACA,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;;;AC1MtC;AACA;AAkFA,IAAM,gBAAe,CACnB,MACA,UACsC;AAAA,EACtC,MAAM,OAAO;AAAA,EASb,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,EAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,IAAM;AAAA,EAChD,OAAO;AAAA,IACL,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,aAAa,KAAK,KAAK,cAAc;AAAA,IACrC,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,uBAAuB,KAAK,KAAK,wBAAwB;AAAA,IACzD,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,cAAc,UAAU,KAAK,eAAe;AAAA,IAC5C,YAAY,KAAK,KAAK,aAAa;AAAA,IACnC,aAAa,UAAU,KAAK,cAAc;AAAA,IAC1C,mBAAmB,KAAK,KAAK,oBAAoB;AAAA,IAEjD,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,UAAU,SAAQ,KAAK,WAAW;AAAA,IAClC,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,UAAU,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,YAAY,KAAK,GAAG,IAAI;AAAA,IACzE,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,OAAO,MAAM;AAAA,IACb,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,KAAK,IAAI,KAAK,QAAQ,MAAK;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,UAAU,IAAI,KAAK,aAAa,MAAK;AAAA,IACrC,QAAQ,UAAU,KAAK,SAAS;AAAA,IAChC,MAAM,aAAa,KAAK,MAAM,OAAO;AAAA,IACrC,WAAW,IAAI,KAAK,YAAY,MAAK;AAAA,IACrC,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,EACjD;AAAA;AAwBK,IAAM,sBAAsB,CAAC,UAClC,iBACE,OACE,MAAM,QACN,QACA,OACM,sBAAe,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,KAAK,CAAC,CAC/D,EAAE,KACO,kBAAS,+BAA+B,CAAC,UAC9C,MAAM,OAAO,aAAa,6BACf,iBAAQ,SAAS,IACjB,cAAK,KAAK,CACvB,CACF,CACF,EAAE,KACO,aAAI,CAAC,SAAS;AAAA,EACnB,IAAI,SAAS;AAAA,IAAY,OAAO;AAAA,EAChC,OAAO,SAAS,YAAY,YAAY,cAAa,MAAM,KAAK;AAAA,CACjE,CACH;AAmBK,IAAM,gBAAgB,CAAC,UAC5B,oBAAoB,KAAK,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAGhE,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;AAc7B,IAAM,WAAU,CAAC,YAAmC,UACzD,WAAW,UAAU,MAAM,QAAQ,OACnC,MAAK,MAAM,SAAS,WAAW,OAAO,KACtC,MAAK,MAAM,WAAW,WAAW,SAAS,KAC1C,MAAK,MAAM,KAAK,WAAW,GAAG,KAC9B,YAAY,MAAM,UAAU,WAAW,QAAQ,KAC/C,SAAS,MAAM,cAAc,WAAW,YAAY,KACpD,SAAS,MAAM,aAAa,WAAW,WAAW,KAClD,MAAK,MAAM,mBAAmB,WAAW,iBAAiB,KAC1D,SAAS,MAAM,QAAQ,WAAW,MAAM,KACxC,MAAK,MAAM,WAAW,WAAW,SAAS,KAC1C,MAAK,MAAM,uBAAuB,WAAW,qBAAqB,KAClE,MAAK,MAAM,iBAAiB,WAAW,eAAe,KACtD,MAAK,MAAM,YAAY,WAAW,UAAU,KAC5C,MAAK,MAAM,oBAAoB,WAAW,kBAAkB;;;AF5HvD,IAAM,qBAAqB,WAA6B,uBAAuB;AAAA,EACpF,sBAAsB;AACxB,CAAC;AASD,IAAM,UAA4C;AAAA,EAChD,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,mBAAmB;AACrB;AAEA,IAAM,cAAc,CAAC,SACnB,OAAO,YAAY,OAAO,QAAQ,IAAI,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,CAAC,CAAC;AAG7F,IAAM,qBAAoB,CAAC,WACxB;AAAA,KACI,YAAY,YAAW,KAAK,CAAC;AAAA,EAChC,MAAM,MAAM;AACd;AAGF,IAAM,qBAAoB,CAAC,WACxB;AAAA,KACI,YAAY,YAAW,KAAK,CAAC;AAAA,EAChC,OAAO,MAAM;AAAA,EACb,MAAM,MAAM;AACd;AAEK,IAAM,6BAA6B,MAC/B,kBACP,oBACO,iBACL,mBAAmB,SAAS,GAAG;AAAA,EAK7B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAG7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,cAAc,IAAI,IAAI,oBAAoB,IAAI,CAC9E;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAC7E,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,KAAK;AAAA,IAC9D,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,oBAAoB,IAAI;AAAA,IAG5C,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,uBAAuB,GAAG,KAAK,QAAQ,KAAK,OAAO;AAAA,MAC5E,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,IAAI;AAAA,MAC7D,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAUD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,SAAS,gBAAe,OAAO,cAAc,IAAI,CAAC;AAAA,IACxD,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAC7E,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,KAAK;AAAA,IAC9D,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACM,yBAAkB,mBAAkB,IAAI,CAAC,CACjD;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OACL,KAAK,QACL,aACA,MACM,uBAAgB,mBAAkB,IAAI,CAAC,CAC/C;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,cAAc,IAAI,CAAC;AAAA,IACvD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,SAAS,KAAK,gBAAgB,KAAK,yCACjC,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACM,0BAAmB,EAAE,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,CAAC,CACjE;AAAA,GACD;AACH,CAAC,CACH,CACF;;AG9MF,qBAAS;AACT;AACA;;;AC/BA,uBAAS;AAET;;;ACuFA,IAAM,OAAO,CAAC,UACZ,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC;AAGvE,IAAM,QAAQ,CAAC,QAA2B,cACxC,OAAO,IAAI,CAAC,SAAS,UAAU,KAAK,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,SAAS,EAAE;AAQ3E,IAAM,WAAW,CAAC,SAChB,KACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAEb,IAAM,SAAQ,CAAC,SAAyB;AAAA,EACtC,IAAI,CAAC,KAAK,WAAW,QAAQ;AAAA,IAAG,OAAO;AAAA,EACvC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,IAAI,KAAK;AAAA,IAAG,OAAO;AAAA,EACnB,MAAM,SAAS,KAAK,MAAM,KAAK,CAAC,EAAE,MAAM,GAAG;AAAA,EAC3C,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,KAAK,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,KAAK,GAAG;AAAA;AAG7E,IAAM,QAAO,CAAC,SAAyB;AAGhC,IAAM,iBAAiB,CAAC,YAAuC;AAAA,EACpE,kBAAkB,MAAM,OAAO,qBAAqB,CAAC,GAAG,KAAI,EAAE,KAAK;AAAA,EACnE,eAAe,MAAM,OAAO,kBAAkB,CAAC,GAAG,MAAK,EAAE,KAAK;AAAA,EAC9D,kBAAkB,MAAM,OAAO,qBAAqB,CAAC,GAAG,QAAQ,EAAE,KAAK;AAAA,EACvE,SAAS,MAAM,OAAO,SAAS,KAAI,EAAE,KAAK;AAC5C;AAEO,IAAM,oBAAoB,CAC/B,MACA,UACmC;AAAA,EACnC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,gBAAgB,KAAK,KAAK,eAAe;AAAA,EACzC,kBAAkB,MAAM,KAAK,KAAK,iBAAiB,GAAG,KAAI,EAAE,KAAK;AAAA,EACjE,eAAe,MAAM,KAAK,KAAK,cAAc,GAAG,MAAK,EAAE,KAAK;AAAA,EAC5D,kBAAkB,MAAM,KAAK,KAAK,iBAAiB,GAAG,QAAQ,EAAE,KAAK;AAAA,EAErE,MAAM,KAAK,KAAK,SAAS,KAAK,KAAK;AAAA,EACnC;AAAA,EACA,QAAQ,KAAK,KAAK,SAAS;AAAA,EAC3B,SAAS,MAAM,KAAK,KAAK,SAAS,GAAG,KAAI,EAAE,KAAK;AAClD;AAEA,IAAM,QAAQ,CAAC,GAAsB,MACnC,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,UAAU,SAAS,EAAE,MAAM;AAE9D,IAAM,iBAAiB,CAC5B,YACA,WACY;AAAA,EACZ,MAAM,QAAQ,eAAe,MAAM;AAAA,EACnC,OACE,WAAW,aAAa,OAAO,YAAY,SAC3C,WAAW,qBAAqB,OAAO,oBAAoB,SAC3D,WAAW,UAAU,OAAO,QAAQ,UACpC,MAAM,WAAW,SAAS,MAAM,OAAO,KACvC,MAAM,WAAW,mBAAmB,MAAM,iBAAiB,KAC3D,MAAM,WAAW,gBAAgB,MAAM,cAAc,KACrD,MAAM,WAAW,mBAAmB,MAAM,iBAAiB,MAC1D,OAAO,YAAY,aAAa,WAAW,YAAY,OAAO;AAAA;AAYnE,IAAM,SAAS,CAAC,YAAuC;AAAA,EACrD,SAAS,OAAO,YAAY,OAAQ,MAAiB;AAAA,EACrD,gBAAgB,OAAO,oBAAoB,OAAQ,MAAiB;AAAA,EACpE,MAAM,OAAO,QAAS;AACxB;AAEA,IAAM,QAAQ,CAAC,WAAiF;AAAA,EAC9F,MAAM,QAAQ,eAAe,MAAM;AAAA,EACnC,MAAM,MAAiD,CAAC;AAAA,EACxD,IAAI,MAAM,kBAAkB,SAAS;AAAA,IAAG,IAAI,oBAAoB,MAAM;AAAA,EACtE,IAAI,MAAM,eAAe,SAAS;AAAA,IAAG,IAAI,iBAAiB,MAAM;AAAA,EAChE,IAAI,MAAM,kBAAkB,SAAS;AAAA,IAAG,IAAI,oBAAoB,MAAM;AAAA,EACtE,IAAI,MAAM,QAAQ,SAAS;AAAA,IAAG,IAAI,SAAS,MAAM;AAAA,EACjD,OAAO;AAAA;AASF,IAAM,oBAAoB,CAAC,YAA0D;AAAA,KACvF,OAAO,MAAM;AAAA,KACb,MAAM,MAAM;AAAA,KACX,OAAO,YAAY,aAAa,OAAO,YAAY,KAAK,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;AAAA,EAC3F,MAAM,OAAO;AACf;AAOO,IAAM,oBAAoB,CAAC,WAAyD;AAAA,EACzF,MAAM,UAAU,MAAM,MAAM;AAAA,EAC5B,MAAM,UACJ,CAAC,kBAAkB,eAAe,kBAAkB,QAAQ,EAC5D,OAAO,CAAC,QAAQ,QAAQ,SAAS,SAAS;AAAA,EAC5C,IAAI,OAAO,YAAY;AAAA,IAAI,QAAQ,KAAK,SAAS;AAAA,EACjD,OAAO;AAAA,OACF,OAAO,MAAM;AAAA,OACb;AAAA,OACC,OAAO,YAAY,aAAa,OAAO,YAAY,KAAK,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;AAAA,OACvF,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ,QAAQ;AAAA,EACpD;AAAA;;;AC1NF;AACA;;;ACDA,8BAAS;AACT;AACA;AACA;AAAA;AAGO,MAAM,mCAAwC,kBAAY,4BAA4B,EAE1F;AAAC;AAOG,IAAM,sBAAsB,CAAuB,QAAW,WAC5D,4BAA2B,eAAO,MAAM,GAAG,EAAE,kBAAkB,QAAQ,CAAC,EAC7E,OAAO,YACL,OAAO,QAAQ,MAAM,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,WAAW,KAAK,GAAG,GAAG,KAAK,CAAC,CAChF,CACF,EAAE,KACO,kBAAS,MAAM,IAAI,2BAA2B,EAAE,WAAW,yBAAyB,CAAC,CAAC,CAC/F;AAGK,IAAM,uBACX,CAAuB,WACvB,CAAC,UACQ,4BAA2B,eAAO,MAAM,CAAC,EAAE,KAAI,EAAE,KAC/C,YAAG,KAAI,GACP,kBACL,MACE,IAAI,mBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC,CACL,CACF;;;AD1BG,IAAM,cAAc,CAAC,UAC1B,OACE,MAAM,QACN,QACA,OACQ,uCAA8B,EAAE,MAAM,MAAM,KAAK,CAAC,CAC5D,EAAE,KACO,iBAAQ,qBAA6B,8CAAqC,CAAC,GAC3E,aAAI,CAAC,SACV,kBACE;AAAA,KACK;AAAA,EACH,gBAAgB,KAAK;AAAA,EACrB,kBAAkB,KAAK;AAAA,EACvB,eAAe,KAAK;AAAA,EACpB,kBAAkB,KAAK;AACzB,GACA,MAAM,IACR,CACF,GACO,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAEK,IAAM,gBAAgB,CAAC,UACrB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO,oBACX,kDACR,kBAAkB,KAAK,CACzB;AAAA,EACA,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAc,0CAAiC,KAAK,CAAC;AAAA,CAC/F;AAEI,IAAM,gBAAgB,CAAC,UACrB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO,oBAA4B,+CAAsC;AAAA,OAClF,kBAAkB,KAAK;AAAA,IAC1B,MAAM,MAAM;AAAA,EACd,CAAC;AAAA,EACD,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAc,uCAA8B,KAAK,CAAC;AAAA,CAC5F;AAEI,IAAM,gBAAgB,CAAC,UAC5B,OACE,MAAM,QACN,aACA,MACQ,0CAAiC,EAAE,MAAM,MAAM,KAAK,CAAC,CAC/D,EAAE,KAAY,kBAAS,YAAY,MAAa,aAAI,CAAC;;;AFxCvD,IAAM,QAAQ,CAAC,OAAc,WAC3B,UAAU,4CAA4C,kBAAkB,KAAK,GAAG,MAAM,EAAE,KAC/E,iBACL,UAAU,kDAAkD,kBAAkB,KAAK,GAAG,KAAK,CAC7F,CACF;AAEK,IAAM,kBAAkB;AAAA,EAE7B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WACA,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,YAAY,IAAI;AAAA,IACpC,OAAO,MAAM,MAAM,SAAS,SAAS;AAAA,IACrC,OAAO;AAAA,GACR;AAAA,EACH,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAMO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,IAAI,KAAK,SAAS,KAAK;AAAA,MAAM,OAAO,EAAE,QAAQ,UAAU;AAAA,IACxD,OAAO,MAAM,MAAM,WAAW,SAAS;AAAA,IACvC,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,YAAY,IAAI;AAAA,IACpC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,MAAM,MAAM,IAAI;AAAA,MACvB,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,eAAe,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GACjE;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,YAAY,IAAI;AAAA,IACpC,OAAO,MAAM,MAAM,SAAS,SAAS;AAAA,IACrC,IAAI,SAAS;AAAA,MAAW,OAAO,cAAc,IAAI;AAAA,IAC5C,SAAI,CAAC,eAAe,MAAM,IAAI;AAAA,MAAG,OAAO,cAAc,IAAI;AAAA,IAC/D,MAAM,QAAQ,OAAO,YAAY,IAAI;AAAA,IACrC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,aACnB,IAAI,MAAM,wBAAwB,KAAK,+CAA+C,CACxF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAA4B,cAAc,IAAI;AAC3D;;;ADfO,IAAM,6BAA6B,WACxC,6BACF;AAEO,IAAM,qCAAqC,MACvC,kBACP,4BACO,iBAAQ,2BAA2B,SAAS,GAAG,eAAe,CAAC,CACxE;;AKZF,qBAAS;AACT;AACA;;;ACpDA,uBAAS;AAET;;;ACqBA,IAAM,YAA6E;AAAA,EACjF,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACF;AAGO,IAAM,iBAAiB,CAAC,UAC7B,UAAU,MAAM;;;AChBlB,IAAM,eAAe;AAGd,IAAM,SAAS,CAAC,UAA2B;AAAA,EAChD,MAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,OAAO,SAAS,EAAE,GAAG,EAAE;AAAA,EAC1F,OAAO,OAAO,MAAM,MAAM,IAAI,IAAI;AAAA;AAGpC,IAAM,SAAS,CAAC,UACd,MACG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAWN,IAAM,cAAc,CAAC,UAC1B,OACE,MAAM,QAAQ,KAAK,IACf,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IACzC,OAAO,UAAU,WACf,MAAM,MAAM,SAAS,IACrB,CAAC,CACT;AAGK,IAAM,aAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AAE1F,IAAM,MAAM,CAAC,KAAa,UACxB,UAAU,YAAY,CAAC,IAAI,GAAG,MAAM,MAAM;AAoBrC,IAAM,SAAQ,CAAC,WAA4D;AAAA,EAChF,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,KACrC,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,QAAQ,MAAM,IAAI;AAAA,KACtB,IAAI,WAAW,MAAM,OAAO;AAAA,KAC5B,IAAI,gBAAgB,MAAM,eAAe;AAAA,KACzC,IAAI,UAAU,MAAM,WAAW,YAAY,YAAY,MAAM,OAAO,KAAK,YAAY,CAAC;AAAA,KACtF,IAAI,UAAU,MAAM,WAAW,YAAY,YAAY,YAAY,MAAM,MAAM,CAAC;AAAA,KAChF,IACD,eACA,MAAM,mBAAmB,YAAY,YAAY,YAAY,MAAM,cAAc,CACnF;AAAA,KACG,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,QAAQ,MAAM,IAAI;AAAA,KACtB,IAAI,QAAQ,MAAM,SAAS,YAAY,YAAY,OAAO,MAAM,IAAI,CAAC;AAAA,KACrE,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,OAAO,MAAM,GAAG;AAAA,KACpB,IAAI,YAAY,MAAM,QAAQ;AACnC;AAQO,IAAM,cAAc,CAAC,WAA4D;AAAA,KACnF,OAAM,KAAK;AAAA,EACd,MAAM,MAAM;AACd;;;AC1GO,IAAM,aAA6E;AAAA,EAOxF,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,SAAS,KAAK,eAAe,KAAK,KAAK,eAAe;AAAA,IACtD,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,QAAQ,WAAW,KAAK,SAAS;AAAA,IACjC,QAAQ,YAAY,KAAK,SAAS;AAAA,IAClC,eAAe,YAAY,KAAK,cAAc;AAAA,IAC9C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,MAAM,MAAM;AAAA,IACZ,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,KAAK,KAAK,KAAK,MAAM;AAAA,IACrB,UAAU,KAAK,KAAK,WAAW;AAAA,EACjC;AAAA,EACA,YAAY,CAAC,UAAU,mCAAmC,MAAM;AAAA,EAEhE,YAAY;AAAA,EAEZ,UAAU;AAAA,EAUV,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,YAAY,UACzC,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,aAAa,aAAa,WAAW,aAAa,MAAM,cAC9D,MAAM,oBAAoB,aAAa,WAAW,oBAAoB,MAAM,qBAC5E,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,QAAQ,aAAa,WAAW,QAAQ,MAAM,SACpD,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,WAAW,aAAa,WAAW,WAAW,YAAY,MAAM,MAAM,OAC5E,MAAM,mBAAmB,aACxB,WAAW,mBAAmB,YAAY,MAAM,cAAc,OAC/D,MAAM,WAAW,aAAa,WAAW,WAAW,WAAW,MAAM,MAAM;AAAA,EAC9E,MAAM,CAAC,UAAU,mCAAmC,MAAM,QAAQ,MAAM;AAAA,EACxE,YAAY;AACd;;;AClEA;AAEA;AAOA,IAAM,QAAO,CACX,UAC6E;AAAA,EAC7E,MAAM,UAAU,EAAE,MAAM,MAAM,KAAK;AAAA,EACnC,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAe,8CAAqC,OAAO,EAAE,KACpD,iBAAQ,qBAA6B,qDAA4C,CAAC,GAClF,aAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAClC;AAAA,SACG;AAAA,MACH,OAAe,gDAAuC,OAAO,EAAE,KACtD,iBACL,qBAA6B,uDAA8C,CAC7E,GACO,aAAI,CAAC,SAAS;AAAA,WAChB;AAAA,QACH,gBAAgB,IAAI;AAAA,QACpB,eAAe,IAAI;AAAA,MACrB,EAAE,CACJ;AAAA,SACG;AAAA,MACH,OAAe,4CAAmC,OAAO,EAAE,KAClD,iBAAQ,qBAA6B,mDAA0C,CAAC,GAChF,aAAI,CAAC,SAAS;AAAA,WAChB;AAAA,QACH,gBAAgB,IAAI;AAAA,QACpB,eAAe,IAAI;AAAA,MACrB,EAAE,CACJ;AAAA,SACG;AAAA,MACH,OAAe,+CAAsC,OAAO,EAAE,KACrD,iBAAQ,qBAA6B,sDAA6C,CAAC,GACnF,aAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAClC;AAAA;AAAA;AAIC,IAAM,aAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,QAAQ,OAAO,MAAK,KAAK,CAAC,EAAE,KACxC,aAAI,CAAC,QAAQ,WAAW,WAAW,KAAK,KAAK,CAAC,GAC9C,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAGF,IAAM,SAAS,CAAC,OAAc,WAAoB;AAAA,EAChD,MAAM,OAA0C;AAAA,OAC1C,SAAS,YAAY,KAAK,IAAI,OAAM,KAAK;AAAA,IAC7C,MAAM,MAAM;AAAA,EACd;AAAA,EACA,MAAM,UAAoB,CAAC;AAAA,EAC3B,YAAY,KAAK,WAAW;AAAA,IAC1B,CAAC,UAAU,MAAM,WAAW,YAAY,YAAY,CAAC,GAAG,MAAM,MAAM,CAAC;AAAA,IACrE;AAAA,MACE;AAAA,MACA,MAAM,WAAW,YAAY,YAAY,YAAY,MAAM,MAAM,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAAA,IAC9F;AAAA,IACA;AAAA,MACE;AAAA,MACA,MAAM,mBAAmB,YACrB,YACA,YAAY,MAAM,cAAc,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAAA,IACjE;AAAA,EACF,GAAY;AAAA,IACV,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,IAAI,OAAO,SAAS;AAAA,MAAG,KAAK,OAAO;AAAA,IAC9B;AAAA,MACH,OAAO,KAAK;AAAA,MACZ,IAAI,CAAC;AAAA,QAAQ,QAAQ,KAAK,GAAG;AAAA;AAAA,EAEjC;AAAA,EAEA,IAAI,QAAQ,SAAS;AAAA,IAAG,KAAK,SAAS;AAAA,EACtC,OAAO;AAAA;AAIF,IAAM,sBAAsB,CAAC,OAAc,WAAoB;AAAA,EACpE,MAAM,SAAS,SACX;AAAA,IACE,UAAkB;AAAA,IAClB,MAAc;AAAA,IACd,QAAgB;AAAA,IAChB,SAAiB;AAAA,EACnB,EAAE,MAAM,QACR;AAAA,IACE,UAAkB;AAAA,IAClB,MAAc;AAAA,IACd,QAAgB;AAAA,IAChB,SAAiB;AAAA,EACnB,EAAE,MAAM;AAAA,EACZ,OAAO,oBAAoB,QAAQ,OAAO,OAAO,MAAM,CAAC,EAAE,KAAY,eAAM;AAAA;AAGvE,IAAM,eAAe,CAAC,UAAiB;AAAA,EAC5C,MAAM,OAAO,OAAO,OAAO,IAAI;AAAA,EAC/B,MAAM,YACJ,MAAM,SAAS,aACX,oBAA4B,2DAAkD,IAAI,EAAE,KAC3E,iBAAgB,kDAAyC,CAClE,IACA,MAAM,SAAS,SACb,oBAA4B,uDAA8C,IAAI,EAAE,KACvE,iBAAgB,8CAAqC,CAC9D,IACA,MAAM,SAAS,WACb,oBAA4B,yDAAgD,IAAI,EAAE,KACzE,iBAAgB,gDAAuC,CAChE,IACA,oBAA4B,0DAAiD,IAAI,EAAE,KAC1E,iBAAgB,iDAAwC,CACjE;AAAA,EACV,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAM,SAAS;AAAA;AAGnD,IAAM,eAAe,CAAC,UAAiB;AAAA,EAC5C,MAAM,OAAO,OAAO,OAAO,KAAK;AAAA,EAChC,MAAM,YACJ,MAAM,SAAS,aACX,oBAA4B,wDAA+C,IAAI,EAAE,KACxE,iBAAgB,+CAAsC,CAC/D,IACA,MAAM,SAAS,SACb,oBAA4B,oDAA2C,IAAI,EAAE,KACpE,iBAAgB,2CAAkC,CAC3D,IACA,MAAM,SAAS,WACb,oBAA4B,sDAA6C,IAAI,EAAE,KACtE,iBAAgB,6CAAoC,CAC7D,IACA,oBAA4B,uDAA8C,IAAI,EAAE,KACvE,iBAAgB,8CAAqC,CAC9D;AAAA,EACV,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAM,SAAS;AAAA;AAGnD,IAAM,eAAe,CAAC,UAAiB;AAAA,EAC5C,MAAM,UAAU,EAAE,MAAM,MAAM,KAAK;AAAA,EACnC,MAAM,YACJ,MAAM,SAAS,aACH,mDAA0C,OAAO,IACzD,MAAM,SAAS,SACL,+CAAsC,OAAO,IACrD,MAAM,SAAS,WACL,iDAAwC,OAAO,IAC/C,kDAAyC,OAAO;AAAA,EAClE,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAM,SAAS,EAAE,KACjD,kBAAS,YAAY,MAAa,aAAI,CAC/C;AAAA;;;AJ5IF,MAAQ,2BAAa,8BAAgB,WAAW,UAAU;AAC1D,IAAM,SAAQ,CAAC,OAAc,WAC3B,aAAY,OAAO,MAAM,EAAE,KAAY,iBAAQ,aAAY,KAAK,CAAC,CAAC;AAC7D,IAAM,iBAAiB;AAAA,EAE5B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WACA,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,IACnC,OAAO,OAAM,MAAM,SAAS,SAAS;AAAA,IACrC,OAAO;AAAA,GACR;AAAA,EACH,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAMO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAEvB,IAAI,KAAK,SAAS,KAAK,QAAQ,KAAK,SAAS,KAAK,MAAM;AAAA,MAGtD,MAAM,cAAc,OAAO,WAAW,IAAI;AAAA,MAC1C,OAAO,OAAM,MAAM,gBAAgB,SAAS;AAAA,MAC5C,OAAO,oBAAoB,MAAM,gBAAgB,SAAS;AAAA,MAC1D,OAAO,EAAE,QAAQ,WAAW,aAAa,KAAK,SAAS,KAAK,KAAK;AAAA,IACnE;AAAA,IACA,OAAO,OAAM,MAAM,WAAW,SAAS;AAAA,IACvC,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,IACnC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAM,MAAM,IAAI;AAAA,MACvB,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,WAAW,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GACrE;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,IACnC,OAAO,OAAM,MAAM,SAAS,SAAS;AAAA,IACrC,IAAI,SAAS;AAAA,MAAW,OAAO,aAAa,IAAI;AAAA,IAC3C,SAAI,CAAC,WAAW,QAAQ,MAAM,IAAI;AAAA,MAAG,OAAO,aAAa,IAAI;AAAA,IAClE,MAAM,QAAQ,OAAO,WAAW,IAAI;AAAA,IACpC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,aACnB,IAAI,MAAM,uBAAuB,KAAK,+CAA+C,CACvF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EAEH,QAAQ,GAAG,WAA4B,aAAa,IAAI;AAC1D;;;AD2EO,IAAM,4BAA4B,WACvC,4BACF;AAQO,IAAM,oCAAoC,MACtC,kBACP,2BACO,iBAAQ,0BAA0B,SAAS,GAAG,cAAc,CAAC,CACtE;;AMjHF,qBAAS;AACT;AACA;;;ACnDA,uBAAS;AAET;;;ACgFO,IAAM,aAAa,CACxB,MACA,WAC4B;AAAA,EAC5B,SAAS,eAAe,KAAK,UAAU;AAAA,EACvC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,0BAA0B,KAAK,KAAK,yBAAyB,EAAE,KAAK;AAAA,EACpE,eAAe,KAAK,KAAK,cAAc,EAAE,KAAK;AAAA,EAC9C,cAAc,IAAI,KAAK,eAAe,CAAC;AAAA,EACvC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,EACrC,gBAAgB,IAAI,KAAK,iBAAiB,CAAC;AAAA,EAC3C,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,oBAAoB,eAAe,KAAK,qBAAqB,MAAM;AAAA,EACnE,MAAM,MAAM;AAAA,EACZ,2BAA2B,eAAe,KAAK,0BAA0B;AAAA,EACzE,QAAQ,eAAe,KAAK,SAAS;AAAA,EACrC,eAAe,KAAK,KAAK,cAAc;AAAA,EACvC,MAAM,KAAK,KAAK,OAAO;AAAA,EACvB,kBAAkB,KAAK,KAAK,iBAAiB,EAAE,KAAK;AAAA,EACpD,QAAQ,eAAe,KAAK,SAAS;AAAA,EACrC,cAAc,KAAK,KAAK,aAAa;AACvC;AAEA,IAAM,QAAO,CAAI,UAAyB,SAAY,aAAa,aAAa,aAAa;AAYtF,IAAM,WAAU,CAAC,MAA8B,UACpD,MAAK,MAAM,SAAS,KAAK,OAAO,KAChC,MAAK,MAAM,gBAAgB,KAAK,GAAG,KAAK,cAAc,KACtD,MAAK,MAAM,mBAAmB,KAAK,GAAG,KAAK,iBAAiB,KAC5D,MAAK,MAAM,cAAc,KAAK,YAAY,KAC1C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,eAAe,KAAK,aAAa,KAC5C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,iBAAiB,KAAK,eAAe,KAChD,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,2BAA2B,KAAK,GAAG,KAAK,yBAAyB,MAC3E,MAAM,+BAA+B,aACpC,eAAe,MAAM,0BAA0B,MAAM,KAAK,+BAC5D,MAAK,MAAM,eAAe,KAAK,aAAa,MAC3C,MAAM,WAAW,aAAa,eAAe,MAAM,MAAM,MAAM,KAAK,YACpE,MAAM,WAAW,aAAa,eAAe,MAAM,MAAM,MAAM,KAAK,YACpE,MAAM,wBAAwB,aAC7B,eAAe,MAAM,qBAAqB,MAAM,MAAM,KAAK;AAE/D,IAAM,OAAM,CAAC,KAAa,UACxB,UAAU,YAAY,CAAC,IAAI,GAAG,MAAM,MAAM;AAG5C,IAAM,QAAQ,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAY5F,IAAM,UAAU,CAAC,WAAsD;AAAA,KAClE,KAAI,WAAW,MAAM,OAAO;AAAA,KAC5B,KAAI,eAAe,MAAM,gBAAgB,KAAK,CAAC;AAAA,KAC/C,KAAI,cAAc,MAAM,MAAM,aAAa,CAAC;AAAA,KAC5C,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,aAAa,MAAM,MAAM,YAAY,CAAC;AAAA,KAC1C,KAAI,gBAAgB,MAAM,MAAM,eAAe,CAAC;AAAA,KAChD,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,0BAA0B,MAAM,yBAAyB;AAAA,KAC7D,KAAI,oBAAoB,MAAM,mBAAmB;AAAA,KACjD,KAAI,2BAA2B,MAAM,0BAA0B;AAAA,KAC/D,KAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,KAAI,eAAe,MAAM,cAAc;AAAA,KACvC,KAAI,kBAAkB,MAAM,mBAAmB,KAAK,CAAC;AAAA,KACrD,KAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,KAAI,cAAc,KAAK,MAAM,aAAa,CAAC;AAChD;AAWO,IAAM,cAAa,CAAC,WAAsD;AAAA,KAC5E,QAAQ,KAAK;AAAA,EAChB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,KAKR,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAClE;AAqBO,IAAM,cAAa,CAAC,UAAqD,QAAQ,KAAK;AAEtF,IAAM,UAAS,CAAC,UAA6B,oBAAoB,MAAM;;;ACvN9E;AACA;;;ACOA;AAEA;AAGA;AAQO,IAAM,aAAa,CACxB,QACA,YACA,IACA,WAA0B,mBAE1B,GAAG,KACK,YACC,iBACL,YAAY;AAAA,EACV,SAAS,OAAO;AAAA,EAChB,QAAQ,WAAW;AAAA,EACnB,SAAS,WAAW;AACtB,CAAC,CACH,GACO,iBAAQ,QAAO,CACxB;AAGK,IAAM,SAAS,CACpB,QACA,MACA,OAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,WAAW,QAAQ,YAAY,EAAE;AAAA,CAChD;;;ADzCH,IAAM,UAAU,CAAC,UAAkC;AAAA,KAC7C,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,8BAA8B,YACnC,CAAC,IACD,EAAE,wBAAwB,KAAK,0BAA0B;AAAA,KACzD,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,kBAAkB,YAAY,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc;AAAA,KACzE,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,oBAAoB,YAAY,CAAC,IAAI,EAAE,cAAc,KAAK,gBAAgB;AAAA,KAC/E,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,wBAAwB,YAAY,CAAC,IAAI,EAAE,kBAAkB,KAAK,oBAAoB;AAAA,KAC3F,KAAK,+BAA+B,YACpC,CAAC,IACD,EAAE,yBAAyB,KAAK,2BAA2B;AAAA,KAC3D,KAAK,cAAc,YAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU;AAAA,KAC7D,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,sBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB;AAAA,KACrF,KAAK,cAAc,YAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU;AAAA,KAC7D,KAAK,kBAAkB,YAAY,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc;AAC/E;AAEA,IAAM,gBAAgB,CAAC,WAAmE;AAAA,KACrF,QAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,KACR,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAClE;AAEA,IAAM,gBAAgB,CAAC,WAAgE;AAAA,KAClF,QAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,MAAM,MAAM;AACd;AAEA,IAAM,OAAO,CAAC,SAAqE;AAAA,KAC9E;AAAA,EACH,0BAA0B,IAAI;AAAA,EAC9B,eAAe,IAAI;AAAA,EACnB,cAAc,IAAI;AAAA,EAClB,eAAe,IAAI;AAAA,EACnB,aAAa,IAAI;AAAA,EACjB,gBAAgB,IAAI;AAAA,EACpB,eAAe,IAAI;AAAA,EACnB,eAAe,IAAI;AAAA,EACnB,oBAAoB,IAAI;AAAA,EACxB,2BAA2B,IAAI;AAAA,EAC/B,eAAe,IAAI;AAAA,EACnB,kBAAkB,IAAI;AAAA,EACtB,cAAc,IAAI;AACpB;AAaO,IAAM,UAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAe,0BAAmB,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACrE,aAAI,CAAC,SAAS,WAAW,KAAK,IAAI,GAAG,KAAK,CAAC,GAC3C,kBAAS,qBAAqB,MAAa,iBAAQ,SAAS,CAAC,CACtE;AAEK,IAAM,YAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,6BAAsB,cAAc,KAAK,CAAC,CAAC;AAE/E,IAAM,YAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,0BAAmB,cAAc,KAAK,CAAC,CAAC;AAG5E,IAAM,YAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EAEtB,KAAK,OAAO,QAAQ,KAAK,OAAO;AAAA,IAAW;AAAA,EAC3C,OAAO,OAAO,OACZ,MAAM,QACN,aACO,6BAAsB,EAAE,MAAM,MAAM,KAAK,CAAC,CACnD;AAAA,CACD;;;AErFH;AAgBA,IAAM,WAAW,CAAC,MAAc,UAAkB;AAAA,EAChD,MAAM,OAAO,CAAC,UAAmB,MAAM,SAAS,IAAI,MAAM,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAChF,OAAO,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA;AAQ3B,IAAM,YAAY,CAAC,MAA8B,UACtD,KAAK,SAAS,MAAM,SAAS,KAAK,MAAM,MAAM,IAAI,IACvC,gBACA,aACL,IAAI,MACF,GAAG,QAAO,KAAK,oBAAoB,MAAM,sBAAsB,KAAK,oBAClE,sFACA,wFACA,0FACA,uCACJ,CACF;AAgBC,IAAM,eAAe,CAAC,MAA8B,UACzD,MAAM,YAAY,aAAa,eAAe,MAAM,OAAO,MAAM,KAAK,UAC3D,gBACA,aACL,IAAI,MACF,GAAG,QAAO,KAAK,uBAAuB,MAAM,2BAC1C,GAAG,KAAK,YAAY,KAAK,+BAA+B,KAAK,0BAC7D,yFACA,yFACA,iFACA,+BACJ,CACF;AA0BC,IAAM,UAAS,CAAU,OAA8B,SACrD,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,IAAI,WAAW,GAAG;AAAA,IAChD,MAAM,OAAO,OAAO;AAAA,IACpB,IAAI,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACvB,OAAc,eAAM,WAAW;AAAA,EACjC;AAAA,EACA,OAAO,OAAO;AAAA,CACf;;;AC/FH;AAMO,IAAM,qBAAqF;AAAA,EAChG,QAAQ;AAAA,EACR,QAAQ;AACV;AAGO,IAAM,sBAAsB,CAAC,UAC3B,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,UAAU,mBAAmB,QAAQ,YAAW,KAAK,GAAG,IAAI;AAAA,EACnE,OAAO,UAAU,mBAAmB,QAAQ,YAAW,KAAK,GAAG,KAAK;AAAA,CACrE;;;ALjBI,IAAM,YAAW;AAAA,EAMtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAwC,QAAQ,IAAI;AAAA,EAO7D,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAKO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAGvB,OAAO,oBAAoB,IAAI;AAAA,IAC/B,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAGhC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAClD,OAAO,UAAU,MAAM,IAAI;AAAA,IAC3B,OAAO,aAAa,MAAM,IAAI;AAAA,IAC9B,OAAO,SAAQ,MAAM,IAAI,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAClF;AAAA,EAMH,WAAkB,YAAG,UAAU,GAAG,QAAqC;AAAA,IAErE,OAAO,oBAAoB,IAAI;AAAA,IAC/B,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,UAAU,IAAI;AAAA,IACvB,EAAO;AAAA,MACL,OAAO,UAAU,MAAM,IAAI;AAAA,MAC3B,OAAO,aAAa,MAAM,IAAI;AAAA,MAE9B,MAAM,OAAO,WAAW,UAAS,MAAM,MAAM,YAAW,IAAI,CAAC;AAAA,MAC7D,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,UAAU,IAAI;AAAA,MACvB;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,QAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,QAAQ,aAAa,SAAQ,KAAK,IAAI,CAAC;AAAA,IAC3F,IAAI,UAAU,aAAa,CAAC,SAAQ,OAAO,IAAI,GAAG;AAAA,MAKhD,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,QAAO,IAAI,qEACZ,+DACA,gFACA,mFACA,2DACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAgBD,QAAe,YAAG,UAAU,GAAG,QAAqC;AAAA,IAClE,OAAO,UAAU,IAAI;AAAA,IACrB,MAAM,OAAO,OAAO,QAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,QAAQ,SAAS;AAAA,IACpE,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,QAAO,IAAI,mEACZ,kFACA,kEACA,GAAG,KAAK,0EACZ,CACF;AAAA,IACF;AAAA,GACD;AACH;;;ADkCO,IAAM,eAAe,WAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAEM,IAAM,uBAAuB,MACzB,kBAAO,cAAqB,iBAAQ,aAAa,SAAS,GAAG,SAAQ,CAAC,CAAC;;AO9GlF,qBAAS;AACT;AACA,uBAAS;AAET;;;AC7CA;AACA;;;ACDA;AACA;AACA;AAAA;AAEO,MAAM,oCAAyC,kBAAY,6BAA6B,EAE5F;AAAC;AAQG,IAAM,oBAAoB,CAAuB,QAAW,YAC1D,4BAA2B,eAAO,MAAM,CAAC,EAAE,OAAM,EAAE,KACjD,kBACL,MACE,IAAI,4BAA4B;AAAA,EAC9B,SACE;AACJ,CAAC,CACL,CACF;;;ADZK,IAAM,eAAc,CAAC,UAC1B,OAAO,MAAM,QAAQ,QAAe,qCAA6B,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KAC/E,aAAI,CAAC,QACV,kBACE;AAAA,KACK;AAAA,EACH,gBAAgB,IAAI;AAAA,EACpB,kBAAkB,IAAI;AAAA,EACtB,eAAe,IAAI;AAAA,EACnB,kBAAkB,IAAI;AACxB,GACA,MAAM,IACR,CACF,GACO,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAGF,IAAM,gBAAgB,CAAC,OAAc,UAAiD;AAAA,KACjF;AAAA,EACH,cAAc,KAAK;AAAA,EACnB,gBAAgB,KAAK;AAAA,EACrB,aAAa,KAAK;AAAA,EAClB,gBAAgB,KAAK;AAAA,EACrB,MAAM,MAAM;AACd;AAEO,IAAM,iBAAgB,CAAC,OAAc,SAC1C,OACE,MAAM,QACN,aACA,kBACS,gDACP,cAAc,OAAO,IAAI,CAC3B,EAAE,KAAY,iBAAe,uCAA+B,CAAC,CAC/D;AAEK,IAAM,iBAAgB,CAAC,OAAc,SAC1C,OACE,MAAM,QACN,aACA,kBAAyB,6CAAqC,cAAc,OAAO,IAAI,CAAC,EAAE,KACjF,iBAAe,oCAA4B,CACpD,CACF;AAGK,IAAM,iBAAgB,CAAC,UAC5B,OACE,MAAM,QACN,aACO,wCAAgC,EAAE,MAAM,MAAM,KAAK,CAAC,CAC7D,EAAE,KAAY,kBAAS,YAAY,MAAa,aAAI,CAAC;;;ADUhD,IAAM,yBAAyB,WAAiC,yBAAyB;AAKhG,IAAM,eAAc,CAAC,OAAc,oBACjC,UAAU,2CAA2C,kBAAkB,KAAK,GAAG,eAAe;AAChG,IAAM,eAAc,CAAC,UACnB,UAAU,iDAAiD,kBAAkB,KAAK,GAAG,KAAK;AAO5F,IAAM,YAAW;AAAA,EAEf,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAA4B,aAAY,IAAI;AAAA,EACrD,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAMO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,IAAI,KAAK,SAAS,KAAK;AAAA,MAAM,OAAO,EAAE,QAAQ,UAAU;AAAA,IACxD,MAAM,OAAO,OAAO,aAAY,IAAI;AAAA,IACpC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,eAAe,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GACjE;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,aAAY,IAAI;AAAA,IACpC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS;AAAA,MAAW,OAAO,eAAc,MAAM,kBAAkB,IAAI,CAAC;AAAA,IACrE,SAAI,CAAC,eAAe,MAAM,IAAI;AAAA,MAAG,OAAO,eAAc,MAAM,kBAAkB,IAAI,CAAC;AAAA,IACxF,MAAM,QAAQ,OAAO,aAAY,IAAI;AAAA,IACrC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MACF,iCAAiC,KAAK,oEACxC,CACF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAA4B,eAAc,IAAI;AAC3D;AAEO,IAAM,iCAAiC,MACnC,kBACP,wBACO,iBAAQ,uBAAuB,SAAS,GAAG,SAAQ,CAAC,CAC7D;;AG9GF,qBAAS;AACT;AACA;;;ACjBA,uBAAS;AAET;;;ACRA;AAKA;;;ACMA,mBAAS;;;ACYT;AACA;AAmBO,IAAM,aAAa,CACxB,MACA,MAAmB,QAAQ,QACoE;AAAA,EAC/F,MAAM,SAAiC,CAAC;AAAA,EACxC,MAAM,UAAoB,CAAC;AAAA,EAC3B,YAAY,KAAK,QAAQ,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC7C,MAAM,QAAQ,IAAI,IAAI;AAAA,IACtB,IAAI,UAAU,aAAa,UAAU;AAAA,MAAI,QAAQ,KAAK,IAAI,OAAO;AAAA,IAC5D;AAAA,aAAO,OAAO;AAAA,EACrB;AAAA,EACA,OAAO,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG,OAAO;AAAA;AAQzD,IAAM,OAAO,EAAE,GAAG,OAAQ,QAAQ,KAAK,OAAO,MAAM,GAAG,GAAG,GAAG,EAAE;AAC/D,IAAM,SAAS;AAGf,IAAM,YAAY,CAAC,WACjB,KAAK,UACH,OAAO,KAAK,MAAM,EACf,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CACpC;AAEF,IAAM,SAAS,CAAC,MAAc,WAC5B,WAAW,UAAU,MAAM,GAAG,MAAM,IAAI,IAAI;AASvC,IAAM,OAAO,CAAC,QAA0C,SAA0B;AAAA,EACvF,IAAI,OAAO,KAAK,MAAM,EAAE,WAAW;AAAA,IAAG,OAAO;AAAA,EAC7C,MAAM,QAAQ,SAAS,YAAY,YAAY,EAAE,IAAI,OAAO,KAAK,MAAM,MAAM;AAAA,EAC7E,OAAO,GAAG,UAAU,MAAM,SAAS,WAAW,KAAK,OAAO,OAAO,MAAM,EAAE,SAAS,WAAW;AAAA;AASxF,IAAM,cAAc,CAAC,QAAgB,WAAsD;AAAA,EAChG,IAAI,WAAW;AAAA,IAAI,OAAO,OAAO,KAAK,MAAM,EAAE,WAAW;AAAA,EACzD,OAAO,QAAQ,MAAM,QAAQ,SAAS,OAAO,MAAM,GAAG;AAAA,EACtD,IAAI,WAAW,UAAU,SAAS,aAAa,WAAW,aAAa,UAAU,WAAW;AAAA,IAC1F,OAAO;AAAA,EACT;AAAA,EACA,MAAM,WAAW,OAAO,KAAK,QAAQ,WAAW;AAAA,EAChD,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,WAAW,GAAG,MAAM;AAAA,EAC5D,OAAO,SAAS,WAAW,OAAO,UAAU,gBAAgB,UAAU,MAAM;AAAA;;;ADnFvE,IAAM,SAAS,CAAC,UAA0B,QAAO,KAAK,OAAO,MAAM,EAAE,SAAS,QAAQ;AAGtF,IAAM,WAAW,CAAC,UAA0B,QAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,MAAM;AAQxF,IAAM,cAAc,CAAC,SAAmD;AAAA,EAC7E,MAAM,QAAgC,CAAC;AAAA,EACvC,WAAW,QAAQ,KAAK,MAAM,GAAG,GAAG;AAAA,IAClC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC3B,IAAI,KAAK;AAAA,MAAG,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,EACxE;AAAA,EACA,MAAM,QAAQ,MAAM;AAAA,EACpB,OAAO,UAAU,YAAY,EAAE,MAAM,MAAM,WAAW,GAAG,IAAI,EAAE,MAAM,MAAM,WAAW,IAAI,MAAM;AAAA;AAI3F,IAAM,WAAW,CAAC,MAAc,UACrC,QAAQ,cAAc,OAAO,KAAK;AAEpC,IAAM,QAAO,CAAC,UACZ,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC;AAGhE,IAAM,QAAQ,CAAC,SACpB,CAAC,GAAG,IAAI,EACL,OAAO,CAAC,QAAQ,QAAQ,EAAE,EAC1B,KAAK,EACL,KAAK,GAAG;AAON,IAAM,eAAe,CAAC,QAAgB,WAC3C,KAAK,QAAO,8BAA8B,eAAe;AAMpD,IAAM,mBAAmB,CAC9B,MACA,UACoC;AAAA,EACpC,MAAM,UAAkC,CAAC;AAAA,EACzC,WAAW,QAAQ,MAAK,KAAK,SAAS,GAAG;AAAA,IACvC,QAAQ,MAAM,UAAU,YAAY,IAAI;AAAA,IACxC,IAAI,SAAS;AAAA,MAAI,QAAQ,QAAQ,SAAS,SAAS,EAAE;AAAA,EACvD;AAAA,EACA,MAAM,UAAU,MAAK,KAAK,SAAS,EAAE,IAAI,CAAC,SAAS,YAAY,IAAI,EAAE,IAAI;AAAA,EACzE,OAAO;AAAA,IACL,QAAQ,KAAK,KAAK,SAAS;AAAA,IAI3B,MAAM,SAAS,KAAK,KAAK,OAAO,CAAC;AAAA,IACjC,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,QAAQ,MAAM,OAAO,KAAK,OAAO,CAAC;AAAA,IAClC,cAAc,aAAa,MAAM,MAAM,OAAO;AAAA,IAC9C,QAAQ,YAAY,KAAK,SAAS;AAAA,IAClC,eAAe,YAAY,KAAK,cAAc;AAAA,IAC9C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,MAAM,MAAM;AAAA,IAGZ,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,QAAQ,MAAM,OAAO;AAAA,IACrB,QAAQ;AAAA,IACR,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,KAAK,KAAK,KAAK,MAAM;AAAA,IACrB,UAAU,KAAK,KAAK,WAAW;AAAA,EACjC;AAAA;;;AD1FF,IAAM,iBAAgB,CAAC,OAAc,UAAmB;AAAA,KACnD;AAAA,EACH,cAAc,KAAK;AAAA,EACnB,aAAa,KAAK;AAAA,EAClB,MAAM,MAAM;AACd;AAEA,IAAM,QAAO,CACX,UACyF;AAAA,EACzF,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAc,8CAAsC,EAAE,MAAM,MAAM,KAAK,CAAC,EAAE,KACjE,aAAI,CAAC,SAAS;AAAA,WAChB;AAAA,QACH,gBAAgB,IAAI;AAAA,QACpB,eAAe,IAAI;AAAA,MACrB,EAAE,CACJ;AAAA,SACG;AAAA,MACH,OAAc,0CAAkC,EAAE,MAAM,MAAM,KAAK,CAAC,EAAE,KAC7D,aAAI,CAAC,SAAS;AAAA,WAChB;AAAA,QACH,gBAAgB,IAAI;AAAA,QACpB,eAAe,IAAI;AAAA,MACrB,EAAE,CACJ;AAAA,SACG;AAAA,MACH,OACG,6CAAqC,EAAE,MAAM,MAAM,KAAK,CAAC,EACzD,KAAY,aAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;AAAA;AAAA;AAIxC,IAAM,cAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,QAAQ,MAAK,KAAK,CAAC,EAAE,KACjC,aAAI,CAAC,QAAQ,iBAAiB,KAAK,KAAK,CAAC,GACzC,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAGK,IAAM,uBAAsB,CAAC,OAAc,MAAe,SAA8B;AAAA,EAC7F,MAAM,SACJ,SAAS,WACL;AAAA,IACE,UAAiB;AAAA,IACjB,MAAa;AAAA,IACb,SAAgB;AAAA,EAClB,EAAE,MAAM,QACR;AAAA,IACE,UAAiB;AAAA,IACjB,MAAa;AAAA,IACb,SAAgB;AAAA,EAClB,EAAE,MAAM;AAAA,EACd,OAAO,kBAAkB,QAAQ,eAAc,OAAO,IAAI,CAAC,EAAE,KAAY,eAAM;AAAA;AAG1E,IAAM,gBAAe,CAAC,OAAc,SAAkB;AAAA,EAC3D,MAAM,UAAS,eAAc,OAAO,IAAI;AAAA,EACxC,MAAM,YACJ,MAAM,SAAS,aACX,kBAAyB,yDAAiD,OAAM,EAAE,KACzE,iBAAe,gDAAwC,CAChE,IACA,MAAM,SAAS,SACb,kBAAyB,qDAA6C,OAAM,EAAE,KACrE,iBAAe,4CAAoC,CAC5D,IACA,kBAAyB,wDAAgD,OAAM,EAAE,KACxE,iBAAe,+CAAuC,CAC/D;AAAA,EACR,OAAO,OAAO,MAAM,QAAQ,aAAa,SAAS;AAAA;AAG7C,IAAM,gBAAe,CAAC,OAAc,SAAkB;AAAA,EAC3D,MAAM,UAAS,eAAc,OAAO,IAAI;AAAA,EACxC,MAAM,YACJ,MAAM,SAAS,aACX,kBAAyB,sDAA8C,OAAM,EAAE,KACtE,iBAAe,6CAAqC,CAC7D,IACA,MAAM,SAAS,SACb,kBAAyB,kDAA0C,OAAM,EAAE,KAClE,iBAAe,yCAAiC,CACzD,IACA,kBAAyB,qDAA6C,OAAM,EAAE,KACrE,iBAAe,4CAAoC,CAC5D;AAAA,EACR,OAAO,OAAO,MAAM,QAAQ,aAAa,SAAS;AAAA;AAI7C,IAAM,gBAAe,CAAC,UAAiB;AAAA,EAC5C,MAAM,UAAU,EAAE,MAAM,MAAM,KAAK;AAAA,EACnC,MAAM,YACJ,MAAM,SAAS,aACJ,iDAAyC,OAAO,IACvD,MAAM,SAAS,SACN,6CAAqC,OAAO,IAC5C,gDAAwC,OAAO;AAAA,EAC9D,OAAO,OAAO,MAAM,QAAQ,aAAa,SAAS,EAAE,KAC3C,kBAAS,YAAY,MAAa,aAAI,CAC/C;AAAA;;;AG/FF,IAAM,aAAgF;AAAA,EACpF,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACF;AAGO,IAAM,oBAAoB,CAAC,UAChC,WAAU,MAAM;;;AChBlB,IAAM,eAAe;AAGrB,IAAM,kBACJ;AACF,IAAM,oBAAoB;AAEnB,IAAM,mBAAmB,CAAC,SAC/B,kBAAkB,KAAK,IAAI,KAAK,gBAAgB,KAAK,IAAI;AAE3D,IAAM,WAAU,CAAC,UAA2B,UAAU,MAAM,CAAC,aAAa,KAAK,KAAK;AAG7E,IAAM,2BAA2B,CACtC,WAEA,OAAO,QAAQ,UAAU,CAAC,CAAC,EACxB,OAAO,EAAE,MAAM,WAAW,OAAO,UAAU,YAAY,iBAAiB,IAAI,CAAC,EAC7E,OAAO,IAAI,WAAW,SAAQ,KAAe,CAAC,EAC9C,IAAI,EAAE,UAAU,IAAI,EACpB,KAAK;AAOH,IAAM,0BAA0B,CAAC,QAAsC;AAAA,EAC5E,IAAI,QAAQ;AAAA,IAAW,OAAO,CAAC;AAAA,EAC/B,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,YAAY,oCAAoC,KAAK,GAAG,IAAI,MAAM;AAAA,EACxE,MAAM,KAAK,UAAU,YAAY,GAAG;AAAA,EACpC,IAAI,MAAM,GAAG;AAAA,IACX,MAAM,WAAW,UAAU,MAAM,GAAG,EAAE;AAAA,IACtC,MAAM,QAAQ,SAAS,QAAQ,GAAG;AAAA,IAClC,IAAI,SAAS,KAAK,SAAQ,SAAS,MAAM,QAAQ,CAAC,CAAC;AAAA,MAAG,IAAI,KAAK,UAAU;AAAA,EAC3E;AAAA,EAEA,MAAM,SAAS,IAAI,QAAQ,WAAW,EAAE;AAAA,EACxC,WAAW,QAAQ,OAAO,MAAM,OAAO,GAAG;AAAA,IACxC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC3B,MAAM,OAAO,KAAK,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE;AAAA,IAC7C,IAAI,MAAM,KAAK,iBAAiB,IAAI,KAAK,SAAQ,KAAK,MAAM,KAAK,CAAC,CAAC;AAAA,MAAG,IAAI,KAAK,IAAI,MAAM;AAAA,EAC3F;AAAA,EACA,OAAO;AAAA;;;ACvCT,IAAM,QAAoE;AAAA,EACxE,QAAQ,CAAC,YAAY,MAAM;AAAA,EAC3B,MAAM,CAAC,SAAS;AAAA,EAChB,gBAAgB,CAAC,YAAY,MAAM;AAAA,EACnC,QAAQ,CAAC,SAAS;AAAA,EAClB,QAAQ,CAAC,YAAY,MAAM;AAAA,EAC3B,eAAe,CAAC,YAAY,MAAM;AAAA,EAClC,QAAQ,CAAC,SAAS;AAAA,EAClB,MAAM,CAAC,MAAM;AAAA,EACb,UAAU,CAAC,MAAM;AAAA,EACjB,MAAM,CAAC,MAAM;AAAA,EACb,QAAQ,CAAC,SAAS;AAAA,EAClB,QAAQ,CAAC,MAAM;AAAA,EACf,KAAK,CAAC,SAAS;AAAA,EACf,UAAU,CAAC,MAAM;AACnB;AAEA,IAAM,WAA8D;AAAA,EAClE,UAAU,CAAC;AAAA,EACX,MAAM,CAAC,UAAU,cAAc;AAAA,EAC/B,SAAS,CAAC,OAAO,QAAQ;AAC3B;AAGA,IAAM,aAAa;AAGnB,IAAM,aACJ;AAQK,IAAM,WAAW,CAAC,UAA2B;AAAA,EAClD,MAAM,MAAgB,CAAC;AAAA,EACvB,YAAY,QAAO,UAAU,OAAO,QAAQ,KAAK,GAA0C;AAAA,IACzF,IAAI,MAAM,YAAW,aAAa,CAAC,MAAM,SAAS,MAAM,IAAI,GAAG;AAAA,MAC7D,IAAI,KAAK,IAAI,sBAAqB,MAAM,KAAK,GAAG,kBAAkB,MAAM,MAAM;AAAA,IAChF;AAAA,EACF;AAAA,EACA,WAAW,UAAS,SAAS,MAAM,OAAO;AAAA,IACxC,IAAI,MAAM,YAAW,aAAa,MAAM,YAAW;AAAA,MACjD,IAAI,KAAK,GAAG,MAAM,eAAe,SAAQ;AAAA,EAC7C;AAAA,EACA,WAAW,OAAO,CAAC,GAAG,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,GAAG,GAAG,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG;AAAA,IAC1F,IAAI,CAAC,WAAW,KAAK,GAAG;AAAA,MAAG,IAAI,KAAK,IAAI,wCAAwC;AAAA,EAClF;AAAA,EAEA,WAAW,QAAQ,yBAAyB,MAAM,MAAM,GAAG;AAAA,IACzD,IAAI,KAAK,WAAW,qCAAqC,YAAY;AAAA,EACvE;AAAA,EACA,WAAW,SAAS,wBAAwB,MAAM,GAAG,GAAG;AAAA,IACtD,IAAI,KAAK,SAAS,qCAAqC,YAAY;AAAA,EACrE;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,YAAY,CAAC,UAA8C,OAAO,UAAU;AAG3E,IAAM,gBAAgB,CAAC,OAAc,MAAmB,QAAQ,QAAQ;AAAA,EAC7E,MAAM,aAAsC,CAAC;AAAA,EAC7C,MAAM,UAAkC,CAAC;AAAA,EACzC,YAAY,MAAM,UAAU,OAAO,QAAQ,MAAM,UAAU,CAAC,CAAC,GAAG;AAAA,IAC9D,IAAI,UAAU,KAAK;AAAA,MAAG,WAAW,QAAQ;AAAA,IACpC;AAAA,cAAQ,QAAQ;AAAA,EACvB;AAAA,EACA,MAAM,SAAS,WAAW,YAAY,GAAG;AAAA,EACzC,MAAM,aAAsC,CAAC;AAAA,EAC7C,YAAY,MAAM,QAAQ,OAAO,QAAQ,MAAM,UAAU,CAAC,CAAC;AAAA,IAAG,WAAW,UAAU,UAAU;AAAA,EAC7F,IAAI,MAAM,aAAa;AAAA,IAAW,WAAW,cAAc,MAAM;AAAA,EACjE,MAAM,SAAS,WAAW,YAAY,GAAG;AAAA,EACzC,OAAO;AAAA,IACL,QAAQ,EAAE,SAAS,OAAO,SAAS,QAAQ,KAAK,YAAY,OAAO,OAAO,EAAE;AAAA,IAC5E;AAAA,EACF;AAAA;AAMF,IAAM,QAAO,CAAC,UAA8B,SAC1C,aAAa,aAAa,aAAa;AAGlC,IAAM,eAAe,CAAC,MAAuC,UAClE,KAAK,aAAa,MAAM,YAAY,SACpC,MAAK,MAAM,SAAS,KAAK,OAAO,KAChC,MAAK,MAAM,QAAQ,KAAK,MAAM,KAC9B,MAAK,MAAM,iBAAiB,KAAK,eAAe,KAChD,MAAK,MAAM,QAAQ,KAAK,MAAM,MAC7B,MAAM,SAAS,aAAa,MAAM,SAAS,KAAK,SACjD,MAAK,MAAM,MAAM,KAAK,IAAI,KAC1B,MAAK,MAAM,UAAU,KAAK,QAAQ,KAClC,MAAK,MAAM,KAAK,KAAK,GAAG,KACxB,MAAK,MAAM,QAAQ,KAAK,MAAM,KAC9B,MAAK,MAAM,MAAM,KAAK,IAAI,MACzB,MAAM,WAAW,aAAa,YAAY,MAAM,MAAM,MAAM,KAAK,YACjE,MAAM,mBAAmB,aAAa,YAAY,MAAM,cAAc,MAAM,KAAK;AAE7E,IAAM,cAAc,CACzB,MACA,OACA,WACe;AAAA,EACf,IAAI,MAAM,WAAW;AAAA,IAAW,OAAO;AAAA,EACvC,IAAI,MAAM,OAAO,KAAK,MAAM,MAAM,CAAC,MAAM,KAAK;AAAA,IAAQ,OAAO;AAAA,EAC7D,IAAI,OAAO,OAAO,QAAQ,SAAS;AAAA,IAAG,OAAO;AAAA,EAC7C,OAAO,aAAa,MAAM,MAAM,OAAO,OAAO,MAAM,MAAM,KAAK,eAAe,UAAU;AAAA;AAGnF,IAAM,cAAc,CACzB,MACA,OACA,QACA,WACe;AAAA,EACf,IAAI,MAAM,WAAW,aAAa,MAAM,aAAa;AAAA,IAAW,OAAO;AAAA,EACvE,IAAI,MAAM,WAAW,aAAa,MAAM,OAAO,KAAK,MAAM,MAAM,CAAC,MAAM,KAAK;AAAA,IAC1E,OAAO;AAAA,EACT,IAAI,OAAO,OAAO,QAAQ,SAAS,KAAK,WAAW;AAAA,IAAI,OAAO;AAAA,EAC9D,OAAO,YAAY,QAAQ,OAAO,OAAO,MAAM,IAAI,UAAU;AAAA;AAS/D,IAAM,cAAc,CAAC,OAAc,WACjC,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,SACnC,SAAS,MAAM,OAAO,OAAO,OAAO,UAAU,WAAW,EAAE,CAC7D;AAEF,IAAM,cAAc,CAAC,OAAc,WACjC,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,SAAS,MAAM,OAAO,OAAO,OAAO,SAAS,EAAE,CAAC;AAGhG,IAAM,aAAa,CAAC,UAAyD;AAAA,EAC3E,CAAC,UAAU,MAAM,UAAU,EAAE;AAAA,EAC7B,CAAC,QAAQ,MAAM,SAAS,YAAY,KAAK,OAAO,MAAM,IAAI,CAAC;AAAA,EAC3D,CAAC,WAAW,MAAM,WAAW,EAAE;AAAA,EAC/B,CAAC,gBAAgB,MAAM,mBAAmB,EAAE;AAAA,EAC5C,CAAC,UAAU,MAAM,UAAU,EAAE;AAAA,EAC7B,CAAC,QAAQ,MAAM,QAAQ,EAAE;AAAA,EACzB,CAAC,QAAQ,MAAM,SAAS,YAAY,KAAK,OAAO,MAAM,IAAI,CAAC;AAAA,EAC3D,CAAC,UAAU,MAAM,UAAU,EAAE;AAAA,EAC7B,CAAC,OAAO,MAAM,OAAO,EAAE;AAAA,EACvB,CAAC,YAAY,MAAM,YAAY,EAAE;AAAA,EACjC,CAAC,UAAU,MAAM,WAAW,YAAY,CAAC,IAAI,YAAY,MAAM,MAAM,EAAE,MAAM,GAAG,CAAC;AAAA,EACjF;AAAA,IACE;AAAA,IACA,MAAM,mBAAmB,YAAY,CAAC,IAAI,YAAY,MAAM,cAAc,EAAE,MAAM,GAAG;AAAA,EACvF;AACF;AAEA,IAAM,WAAW,CAAC,OAAc,QAC7B,MAA6C,SAAS;AAEzD,IAAM,QAAQ,CAAC,UACb,OAAO,UAAU,WAAW,UAAU,KAAK,MAAM,OAAO,CAAC,SAAS,SAAS,EAAE,EAAE,WAAW;AAQrF,IAAM,aAAa,CACxB,OACA,QACA,OACA,SACY;AAAA,EACZ,MAAM,OAAmD;AAAA,IACvD,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EAC1C;AAAA,EACA,MAAM,UAAoB,CAAC;AAAA,EAC3B,MAAM,MAAM,CAAC,KAAa,UAAsC;AAAA,IAC9D,IAAI,CAAC,MAAM,KAAK;AAAA,MAAG,KAAK,OAAO;AAAA,IAC1B,SAAI,SAAS;AAAA,MAAU,QAAQ,KAAK,GAAG;AAAA;AAAA,EAE9C,YAAY,KAAK,UAAU,WAAW,KAAK;AAAA,IAAG,IAAI,SAAS,OAAO,GAAG;AAAA,MAAG,IAAI,KAAK,KAAK;AAAA,EACtF,IAAI,MAAM,UAAU,MAAM,WAAW;AAAA,IAAW,IAAI,UAAU,YAAY,OAAO,MAAM,CAAC;AAAA,EACxF,IAAI,MAAM,UAAU,MAAM,WAAW;AAAA,IAAW,IAAI,UAAU,YAAY,OAAO,MAAM,CAAC;AAAA,EACxF,IAAI,MAAM,UAAU,MAAM,aAAa,WAAW;AAAA,IAChD,KAAK,cAAc,OAAO,OAAO,OAAO,eAAe;AAAA,EACzD;AAAA,EACA,IAAI,SAAS;AAAA,IAAU,KAAK,UAAU,MAAM;AAAA,EAC5C,IAAI,QAAQ,SAAS;AAAA,IAAG,KAAK,YAAY;AAAA,EACzC,OAAO;AAAA;;;ANvLT,IAAM,OAAO,CAAC,UAAiB,kCAAkC,MAAM,QAAQ,MAAM;AAErF,IAAM,UAAS,CAAC,UAAiB;AAAA,EAC/B,MAAM,UAAU,SAAS,KAAK;AAAA,EAC9B,OAAO,QAAQ,WAAW,IACf,gBACA,aAAI,IAAI,MAAM,GAAG,KAAK,KAAK,MAAM,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA;AAIpE,IAAM,UAAU,CAAC,MAAkB,OAAc,QAAgB,WAAmB;AAAA,EAClF,MAAM,SAAS,YAAY,MAAM,OAAO,MAAM,MAAM;AAAA,EACpD,MAAM,cAAc,YAAY,MAAM,OAAO,QAAQ,MAAM,MAAM;AAAA,EACjE,OAAO,aAAa,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,cAC5C,YACC,EAAE,QAAQ,QAAQ,YAAY;AAAA;AAIrC,IAAM,gBAAgB,CAAC,OAAc,QAAgB,UAAiB;AAAA,EACpE,MAAM,UAAU;AAAA,IACd,GAAI,MAAM,SAAS,OAAO,OAAO,UAAU,CAAC;AAAA,IAC5C,GAAI,MAAM,SAAS,OAAO,OAAO,UAAU,CAAC;AAAA,EAC9C;AAAA,EACA,OAAO,QAAQ,WAAW,IACf,gBACA,aACL,IAAI,MACF,GAAG,KAAK,KAAK,kDAAkD,QAAQ,KAAK,IAAI,OAC9E,6EACJ,CACF;AAAA;AAGC,IAAM,aAAW;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAiB7B,MAAM,GAAG,MAAM,cACZ,WAAW,YAAY,QAAO,IAAI,IAAW,eAAM,KAC3C,iBAAQ,YAAS,IAAI,CAAC,GACtB,aAAI,CAAC,SACV,SAAS,YAAY,YAAY,KAAK,MAAM,QAAQ,QAAQ,UAAU,GAAG,CAC3E,CACF;AAAA,EAOF,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAMO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,WAAW,aAAa,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAC/C,OAAO,QAAO,IAAI;AAAA,IAClB,IAAI,SAAS,cAAc,KAAK,SAAS,KAAK,QAAQ,KAAK,SAAS,KAAK,OAAO;AAAA,MAG9E,MAAM,cAAc,OAAO,YAAS,IAAI;AAAA,MACxC,MAAM,SAAS,cAAc,IAAI;AAAA,MACjC,MAAM,QACJ,gBAAgB,YACZ,EAAE,QAAQ,MAAM,QAAQ,KAAK,IAC7B,QAAQ,aAAa,MAAM,QAAQ,EAAE;AAAA,MAC3C,IAAI,UAAU,WAAW;AAAA,QACvB,OAAO,cAAc,MAAM,QAAQ,KAAK;AAAA,QACxC,MAAM,OAAO,gBAAgB,YAAY,WAAW;AAAA,QACpD,MAAM,OAAO,WAAW,MAAM,QAAQ,OAAO,IAAI;AAAA,QACjD,OAAO,UAAU,kBAAkB,IAAI,EAAE,OAAO,MAAM,gBAAgB,SAAS;AAAA,QAC/E,OAAO,qBAAoB,MAAM,MAAM,IAAI;AAAA,MAC7C;AAAA,MACA,OAAO,EAAE,QAAQ,WAAW,aAAa,KAAK,SAAS,KAAK,KAAK;AAAA,IACnE;AAAA,IACA,MAAM,OAAO,OAAO,YAAS,IAAI;AAAA,IACjC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAClD,OAAO,QAAQ,MAAM,MAAM,cAAc,IAAI,GAAG,OAAO,MAAM,MAAM,YAC9D,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACH,WAAW,GAAG,MAAM,aACX,aAAI,UAAU,GAAG;AAAA,IACtB,OAAO,QAAO,IAAI;AAAA,IAClB,MAAM,SAAS,cAAc,IAAI;AAAA,IACjC,MAAM,OAAO,OAAO,YAAS,IAAI;AAAA,IACjC,IAAI,SAAS,QAAQ,UAAU;AAAA,IAC/B,IAAI,SAAS,WAAW;AAAA,MACtB,MAAM,QAAQ,EAAE,QAAQ,MAAM,QAAQ,KAAK;AAAA,MAC3C,OAAO,cAAc,MAAM,QAAQ,KAAK;AAAA,MACxC,MAAM,OAAO,WAAW,MAAM,QAAQ,OAAO,QAAQ;AAAA,MAQrD,OAAO,UAAU,kBAAkB,IAAI,EAAE,QAAQ,MAAM,IAAI;AAAA,MAC3D,OAAO,cAAa,MAAM,IAAI;AAAA,MAC9B,SAAS,KAAK,OAAO,OAAO,MAAM;AAAA,IACpC,EAAO;AAAA,MACL,MAAM,QAAQ,QAAQ,MAAM,MAAM,QAAQ,MAAM;AAAA,MAChD,IAAI,UAAU,WAAW;AAAA,QACvB,OAAO,cAAc,MAAM,QAAQ,KAAK;AAAA,QACxC,MAAM,OAAO,WAAW,MAAM,QAAQ,OAAO,QAAQ;AAAA,QAErD,OAAO,UAAU,kBAAkB,IAAI,EAAE,QAAQ,MAAM,KAAK;AAAA,QAC5D,OAAO,cAAa,MAAM,IAAI;AAAA,QAC9B,IAAI,MAAM;AAAA,UAAQ,SAAS,KAAK,OAAO,OAAO,MAAM;AAAA,MACtD;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,YAAS,IAAI;AAAA,IAClC,IAAI,UAAU,WAAW;AAAA,MAEvB,OAAO,OAAc,aACnB,IAAI,MAAM,GAAG,KAAK,IAAI,gEAAgE,CACxF;AAAA,IACF;AAAA,IACA,OAAO,KAAK,OAAO,OAAO;AAAA,GAC3B;AAAA,EACH,QAAQ,GAAG,WAA4B,cAAa,IAAI;AAC1D;;;AD3DO,IAAM,wBAAwB,WAAgC,wBAAwB;AAMtF,IAAM,gCAAgC,MAClC,kBACP,uBACO,iBAAQ,sBAAsB,SAAS,GAAG,UAAQ,CAAC,CAC5D;;AQ3DF,qBAAS;AACT;AACA;;;AChFA,uBAAS;AAET;;;ACoCO,IAAM,YAAY;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKA,IAAM,WAAW,CAAC,UAAiD;AAAA,EACjE,MAAM,OAA+B,CAAC;AAAA,EACtC,WAAW,OAAO,WAAW;AAAA,IAC3B,MAAM,QAAQ,MAAM;AAAA,IACpB,IAAI,UAAU;AAAA,MAAW,KAAK,OAAO,OAAO,KAAK;AAAA,EACnD;AAAA,EACA,OAAO;AAAA;AAYF,IAAM,iBAAiB,CAC5B,UACuC;AAAA,EACvC,cAAc,IAAI,KAAK,eAAe,CAAC;AAAA,EACvC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,EACrC,gBAAgB,IAAI,KAAK,iBAAiB,CAAC;AAAA,EAC3C,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAC3C;AASO,IAAM,aAAa,CAAC,aAA+C,UACxE,UAAU,MAAM,CAAC,QAAQ,MAAM,SAAS,aAAa,MAAM,SAAS,YAAW,IAAI;AA2BrF,IAAM,iBAAiB,CAAC,UAAyB,UAAU,KAAK,CAAC,QAAQ,MAAM,SAAS,SAAS;AAEjG,IAAM,eAAe,CAAC,UAAyB;AAAA,EAC7C,IAAI,eAAe,KAAK;AAAA,IAAG;AAAA,EAC3B,MAAM,IAAI,MACR,gBAAgB,MAAM,uEACpB,cAAc,MAAM,wEACpB,gGACA,uFACJ;AAAA;AAIF,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAG7C,IAAM,UAAU,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAoB9F,IAAM,SAAQ,CAAC,WAAkD;AAAA,KAC5D,SAAS,KAAK;AAAA,KACd,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,KAAK,MAAM,OAAO,CAAC;AAAA,KACpC,OAAM,aAAa,QAAQ,MAAM,YAAY,CAAC;AAAA,KAC9C,OAAM,MAAM,MAAM,EAAE;AAAA,EACvB,UAAU,MAAM;AAAA,EAChB,OAAO,MAAM;AACf;AAWO,IAAM,cAAa,CAAC,UAAiD;AAAA,EAC1E,aAAa,KAAK;AAAA,EAClB,OAAO,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA;AA+BlC,IAAM,cAAa,CAAC,UAAiD;AAAA,EAC1E,aAAa,KAAK;AAAA,EAClB,OAAO,OAAM,KAAK;AAAA;;;ACvMpB,IAAM,QAAO,CAAI,WAAyB,SAAY,cAAa,aAAa,cAAa;AAEtF,IAAM,OAAmD;AAAA,EAU9D,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,IACpC,IAAI,MAAM;AAAA,OACP,eAAe,IAAI;AAAA,IACtB,aAAa,IAAI,KAAK,cAAc,EAAE;AAAA,IACtC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,IACvB,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IACnC,OAAO,KAAK,KAAK,UAAU,MAAM,KAAK;AAAA,EACxC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAWZ,UAAU,EAAE,QAAQ,0BAA0B,QAAQ,6BAA6B;AAAA,EACnF,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,YAC9B,YAAW,UAAU,MAAM,SAC3B,MAAK,MAAM,IAAI,YAAW,EAAE,KAC5B,MAAK,MAAM,cAAc,YAAW,YAAY,KAChD,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,WAAW,aAAY,KAAK;AAAA,EAC9B,MAAM,CAAC,UAAU,gBAAgB,MAAM;AAAA,EACvC,YAAY;AACd;;;ACnDA;AACA;AAOA,IAAM,WAAU,CAAC,UAAkC;AAAA,KAC7C,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,kBAAkB,YAAY,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc;AAAA,KACzE,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,oBAAoB,YAAY,CAAC,IAAI,EAAE,cAAc,KAAK,gBAAgB;AAAA,KAC/E,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,UAAU,YAAY,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;AAAA,KACjD,KAAK,gBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,KAAK,YAAY;AAAA,KACnE,KAAK,aAAa,YAAY,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS;AAChE;AAEA,IAAM,iBAAgB,CAAC,WAA2D;AAAA,KAC7E,SAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,IAAI,MAAM;AAAA,EACV,OAAO,MAAM;AAAA,EACb,UAAU,MAAM;AAClB;AAEA,IAAM,iBAAgB,CAAC,WAAwD;AAAA,KAC1E,SAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,IAAI,MAAM;AACZ;AAGA,IAAM,QAAO,CAAC,SAAiE;AAAA,KAC1E;AAAA,EACH,cAAc,IAAI;AAAA,EAClB,eAAe,IAAI;AAAA,EACnB,aAAa,IAAI;AAAA,EACjB,gBAAgB,IAAI;AAAA,EACpB,eAAe,IAAI;AAAA,EACnB,eAAe,IAAI;AAAA,EACnB,aAAa,IAAI;AACnB;AAGO,IAAM,WAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAe,uBAAe,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC7D,aAAI,CAAC,QAAQ,KAAK,WAAW,MAAK,GAAG,GAAG,KAAK,CAAC,GAC9C,kBAAS,oBAAoB,MAAa,iBAAQ,SAAS,CAAC,CACrE;AAEK,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,0BAAkB,eAAc,KAAK,CAAC,CAAC;AAE3E,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,uBAAe,eAAc,KAAK,CAAC,CAAC;AAGxE,IAAM,aAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EAEtB,KAAK,OAAO,SAAQ,KAAK,OAAO;AAAA,IAAW;AAAA,EAC3C,OAAO,OAAO,OAAO,MAAM,QAAQ,aAAoB,0BAAkB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC;AAAA,CAC3F;;;AH1DH,MAAQ,2BAAa,8BAAgB,WAAW,IAAI;AAE7C,IAAM,aAAW;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAoC,SAAQ,IAAI;AAAA,EACzD,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAKO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,KAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS;AAAA,MAAW,OAAO,WAAU,IAAI;AAAA,IACxC,SAAI,CAAC,KAAK,QAAQ,MAAM,IAAI;AAAA,MAAG,OAAO,WAAU,IAAI;AAAA,IAEzD,MAAM,QAAQ,OAAO,SAAQ,IAAI;AAAA,IACjC,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,cACnB,IAAI,MAAM,GAAG,KAAK,KAAK,IAAI,uCAAuC,CACpE;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAAoC,WAAU,IAAI;AAC/D;;;AD6GO,IAAM,cAAc,WAAsB,cAAc;AAmBxD,IAAM,sBAAsB,MACxB,kBAAO,aAAoB,iBAAQ,YAAY,SAAS,GAAG,UAAQ,CAAC,CAAC;;AK9HhF,qBAAS;AACT;AACA;;;ACvDA,uBAAS;AAET;;;AC+BO,IAAM,SAAQ;AAGrB,IAAM,SAAgC;AAAA,EACpC,IAAI;AAAA,EACJ,GAAG;AAAA,EACH,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AACP;AAkBO,IAAM,QAAQ,CAAC,UAA2B;AAAA,EAC/C,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK;AAAA,EAC7B,MAAM,QAAQ,wCAAwC,KAAK,GAAG;AAAA,EAC9D,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,MAAM,OAAO,OAAM,MAAM,MAAM;AAAA,EAC/B,OAAO,SAAS,YAAY,SAAQ,KAAK,MAAM,OAAO,MAAM,MAAM,GAAG,IAAI,IAAI;AAAA;AAYxE,IAAM,UAAU,CAAC,UACtB,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,KAAK,KAAK;AAsB9F,IAAM,SAAQ,CAAC,WAAyB;AAAA,EACtC,gBAAgB,MAAM;AAAA,EACtB,mBAAmB,MAAM,uBAAuB,OAAO,MAAM;AAAA,EAC7D,OAAO,MAAM;AAAA,KACT,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AAAA,KAClF,MAAM,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,KAC7C,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,KACtD,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW,OAAO,MAAM,UAAU,EAAE;AAAA,KAC5E,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,KACzD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,aAAa;AAAA,KAC1E,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC/D,MAAM,qBAAqB,YAC3B,CAAC,IACD,EAAE,iBAAiB,MAAM,mBAAmB,MAAM,IAAI;AAAA,KACtD,MAAM,qBAAqB,YAC3B,CAAC,IACD,EAAE,iBAAiB,OAAO,MAAM,gBAAgB,EAAE;AACxD;AAYO,IAAM,cAAa,CAAC,WAAiD;AAAA,KACvE,OAAM,KAAK;AAAA,EACd,IAAI,MAAM;AAAA,KACN,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB,MAAM,kBAAkB;AAC/F;AAUO,IAAM,cAAa,CAAC,UAAgD,OAAM,KAAK;AAE/E,IAAM,QAAiD;AAAA,EAiB5D,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,gBAAgB,QAAQ,KAAK,eAAe;AAAA,IAC5C,IAAI,MAAM;AAAA,IACV,aAAa,IAAI,KAAK,cAAc,MAAK;AAAA,IACzC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,IACvB,OAAO,KAAK,KAAK,UAAU,EAAE;AAAA,IAC7B,WAAW,MAAM,KAAK,UAAU;AAAA,IAChC,QAAQ,KAAK,KAAK,WAAW,EAAE;AAAA,IAC/B,aAAa,KAAK,KAAK,cAAc,EAAE;AAAA,IACvC,gBAAgB,KAAK,KAAK,iBAAiB,EAAE;AAAA,IAG7C,mBAAmB,KAAK,KAAK,oBAAoB,KAAK;AAAA,IACtD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IAGnC,iBAAiB,KAAK,KAAK,kBAAkB,KAAK;AAAA,IAClD,OAAO,KAAK,KAAK,UAAU,EAAE;AAAA,IAC7B,kBAAkB,KAAK,KAAK,mBAAmB,MAAM;AAAA,IACrD,iBAAiB,IAAI,KAAK,kBAAkB,MAAK;AAAA,EACnD;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAoBZ,UAAU,EAAE,QAAQ,yBAAyB,QAAQ,4BAA4B;AAAA,EACjF,SAAS,CAAC,aAAY,UACpB,YAAW,wBAAwB,MAAM,uBAAuB,SAChE,YAAW,UAAU,MAAM,SAC3B,YAAW,oBAAoB,MAAM,oBACpC,MAAM,WAAW,aAAa,YAAW,WAAW,MAAM,YAC1D,MAAM,OAAO,aAAa,YAAW,OAAO,MAAM,QAClD,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,aAAa,aAAa,YAAW,aAAa,MAAM,cAC9D,MAAM,YAAY,aAAa,YAAW,YAAY,MAAM,aAC5D,MAAM,UAAU,aAAa,YAAW,UAAU,MAAM,WAIxD,MAAM,qBAAqB,aAC1B,YAAW,qBAAqB,MAAM,sBACvC,MAAM,eAAe,aAAa,YAAW,eAAe,MAAM,gBAClE,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,qBAAqB,aAC1B,YAAW,qBAAqB,MAAM;AAAA,EAE1C,MAAM,CAAC,UAAU,eAAe,MAAM;AAAA,EACtC,YAAY;AACd;;;AC3OA;AACA;AAMA,IAAM,WAAU,CAAC,UAAkC;AAAA,KAC7C,KAAK,oBAAoB,YAAY,CAAC,IAAI,EAAE,cAAc,KAAK,gBAAgB;AAAA,KAC/E,KAAK,uBAAuB,YAAY,CAAC,IAAI,EAAE,iBAAiB,KAAK,mBAAmB;AAAA,KACxF,KAAK,aAAa,YAAY,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS;AAAA,KAC1D,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,UAAU,YAAY,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;AAAA,KACjD,KAAK,aAAa,YAAY,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS;AAAA,KAC1D,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,cAAc,YAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU;AAAA,KAC7D,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,gBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,KAAK,YAAY;AAAA,KACnE,KAAK,qBAAqB,YAAY,CAAC,IAAI,EAAE,eAAe,KAAK,iBAAiB;AAAA,KAClF,KAAK,qBAAqB,YAAY,CAAC,IAAI,EAAE,eAAe,KAAK,iBAAiB;AAAA,KAClF,KAAK,sBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB;AAC3F;AAEA,IAAM,iBAAgB,CAAC,WAAmD;AAAA,KACrE,SAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,IAAI,MAAM;AAAA,EACV,OAAO,MAAM;AAAA,EACb,cAAc,MAAM;AACtB;AAEA,IAAM,iBAAgB,CAAC,WAAsD;AAAA,KACxE,SAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,IAAI,MAAM;AACZ;AAGA,IAAM,QAAO,CAAC,SAAgE;AAAA,KACzE;AAAA,EACH,gBAAgB,IAAI;AAAA,EACpB,mBAAmB,IAAI;AAAA,EACvB,aAAa,IAAI;AAAA,EACjB,WAAW,IAAI;AAAA,EACf,aAAa,IAAI;AAAA,EACjB,iBAAiB,IAAI;AAAA,EACrB,iBAAiB,IAAI;AAAA,EACrB,kBAAkB,IAAI;AAAA,EACtB,gBAAgB,IAAI;AACtB;AAGO,IAAM,WAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAe,sBAAc,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC5D,aAAI,CAAC,QAAQ,MAAK,WAAW,MAAK,GAAG,GAAG,KAAK,CAAC,GAC9C,kBAAS,mBAAmB,MAAa,iBAAQ,SAAS,CAAC,CACpE;AAEK,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,mBAAW,eAAc,KAAK,CAAC,CAAC;AAEpE,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,sBAAc,eAAc,KAAK,CAAC,CAAC;AAGvE,IAAM,aAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EAEtB,KAAK,OAAO,SAAQ,KAAK,OAAO;AAAA,IAAW;AAAA,EAC3C,OAAO,OAAO,OAAO,MAAM,QAAQ,aAAoB,yBAAiB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC;AAAA,CAC1F;;;AF7DH,MAAQ,2BAAa,8BAAgB,WAAW,KAAI;AAE7C,IAAM,aAAW;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAmC,SAAQ,IAAI;AAAA,EACxD,MAAM,GAAG,MAAM,aACN,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,MAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS;AAAA,MAAW,OAAO,WAAU,IAAI;AAAA,IACxC,SAAI,CAAC,MAAK,QAAQ,MAAM,IAAI;AAAA,MAAG,OAAO,WAAU,IAAI;AAAA,IAEzD,MAAM,QAAQ,OAAO,SAAQ,IAAI;AAAA,IACjC,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,cACnB,IAAI,MAAM,GAAG,MAAK,KAAK,IAAI,uCAAuC,CACpE;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAAmC,WAAU,IAAI;AAC9D;;;ADyKO,IAAM,aAAa,WAAqB,aAAa;AAWrD,IAAM,qBAAqB,MACvB,kBAAO,YAAmB,iBAAQ,WAAW,SAAS,GAAG,UAAQ,CAAC,CAAC;;AIjM9E,qBAAS;AACT;AACA;;;AClCA,uBAAS;AAET;;;AC6EO,IAAM,WAAW,CAAC,gBAAyB,kBAAkC;AAAA,EAClF,IAAI,CAAC;AAAA,IAAgB,OAAO;AAAA,EAG5B,IAAI,gBAAgB;AAAA,IAAG,OAAO;AAAA,EAC9B,OAAO,oCAAoC,OAAO,aAAa;AAAA;AAmC1D,IAAM,SAAQ,CAAC,WAAsD;AAAA,EAC1E,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM;AAAA,EAC9D,OAAO,MAAM;AAAA,KACT,MAAM,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC1D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AAAA,KAClF,MAAM,OAAO,aAAa,MAAM,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,KAChE,MAAM,sBAAsB,YAC5B,CAAC,IACD,EAAE,kBAAkB,OAAO,MAAM,iBAAiB,EAAE;AAC1D;;;ACjHO,IAAM,QAA2D;AAAA,EACtE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,iBAAiB,KAAK,KAAK,oBAAoB,IAAI;AAAA,IACzD,MAAM,gBAAgB,IAAI,KAAK,mBAAmB,EAAE;AAAA,IACpD,OAAO;AAAA,MACL,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,MACjC,IAAI,MAAM;AAAA,MACV,mBAAmB;AAAA,MACnB,aAAa,IAAI,KAAK,cAAc,EAAE;AAAA,MACtC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,MACvB,kBAAkB;AAAA,MAClB,UAAU,SAAS,gBAAgB,aAAa;AAAA,MAChD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,MACnC,OAAO,KAAK,KAAK,UAAU,MAAM,KAAK;AAAA,IACxC;AAAA;AAAA,EAcF,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA,EAaxD,UAAU,EAAE,QAAQ,2BAA2B,QAAQ,8BAA8B;AAAA,EACrF,SAAS,CAAC,aAAY,UACpB,YAAW,UAAU,MAAM,SAI3B,YAAW,cAAc,MAAM,YAAY,OAC3C,YAAW,wBAAwB,MAAM,uBAAuB,WAC/D,MAAM,sBAAsB,aAC3B,YAAW,sBAAsB,MAAM,uBACxC,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,OAAO,aAAa,YAAW,OAAO,MAAM,QAClD,MAAM,YAAY,aAAa,YAAW,YAAY,MAAM;AAAA,EAC/D,MAAM,CAAC,UAAU,iBAAiB,MAAM;AAAA,EACxC,YAAY;AACd;;;AC1EA;AACA;AAOA,IAAM,WAAU,CAAC,UAAkC;AAAA,KAC7C,KAAK,uBAAuB,YAAY,CAAC,IAAI,EAAE,iBAAiB,KAAK,mBAAmB;AAAA,KACxF,KAAK,aAAa,YAAY,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS;AAAA,KAC1D,KAAK,gBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,KAAK,YAAY;AAAA,KACnE,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,UAAU,YAAY,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;AAAA,KACjD,KAAK,sBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB;AAC3F;AAEA,IAAM,iBAAgB,CAAC,WAA0D;AAAA,KAC5E,SAAQ,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG,CAAC;AAAA,EAC5C,IAAI,MAAM;AAAA,EACV,OAAO,MAAM;AACf;AAEA,IAAM,iBAAgB,CAAC,WAA6D;AAAA,KAC/E,SAAQ,OAAM,KAAK,CAAC;AAAA,EACvB,IAAI,MAAM;AACZ;AAGA,IAAM,QAAO,CAAC,SAAkE;AAAA,KAC3E;AAAA,EACH,mBAAmB,IAAI;AAAA,EACvB,aAAa,IAAI;AAAA,EACjB,kBAAkB,IAAI;AACxB;AAGO,IAAM,WAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAe,wBAAgB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC9D,aAAI,CAAC,QAAQ,MAAK,WAAW,MAAK,GAAG,GAAG,KAAK,CAAC,GAC9C,kBAAS,qBAAqB,MAAa,iBAAQ,SAAS,CAAC,CACtE;AAEK,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,qBAAa,eAAc,KAAK,CAAC,CAAC;AAEtE,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,wBAAgB,eAAc,KAAK,CAAC,CAAC;AAGzE,IAAM,aAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EAEtB,KAAK,OAAO,SAAQ,KAAK,OAAO;AAAA,IAAW;AAAA,EAC3C,OAAO,OAAO,OAAO,MAAM,QAAQ,aAAoB,2BAAmB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC;AAAA,CAC5F;;;AHhDH,MAAQ,2BAAa,8BAAgB,WAAW,KAAI;AAE7C,IAAM,aAAW;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAwC,SAAQ,IAAI;AAAA,EAC7D,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAKO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,MAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS;AAAA,MAAW,OAAO,WAAU,IAAI;AAAA,IACxC,SAAI,CAAC,MAAK,QAAQ,MAAM,IAAI;AAAA,MAAG,OAAO,WAAU,IAAI;AAAA,IAEzD,MAAM,QAAQ,OAAO,SAAQ,IAAI;AAAA,IACjC,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,cACnB,IAAI,MAAM,GAAG,MAAK,KAAK,IAAI,uCAAuC,CACpE;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAAwC,WAAU,IAAI;AACnE;;;ADwFO,IAAM,eAAe,WAAuB,eAAe;AAgB3D,IAAM,uBAAuB,MACzB,kBAAO,cAAqB,iBAAQ,aAAa,SAAS,GAAG,UAAQ,CAAC,CAAC;;AK3IlF,qBAAS;AACT,uBAAS;AACT;AACA;AACA,8BAAS;AACT;AACA;AA6BO,IAAM,cAAc,WAAsB,cAAc;AAGxD,IAAM,iBAAiB,CAAC,WAAuC;AAAA,EACpE,SAAS,MAAM,WAAW;AAAA,EAC1B,QAAQ,MAAM;AAChB;AAGO,IAAM,iBAAiB,CAAC,WAA6D;AAAA,EAC1F,SAAS,MAAM,WAAW;AAC5B;AAEA,IAAM,QAAO;AAAA,EACX,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,OAAO;AAAA,MACL,SAAS,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU;AAAA,MACzD,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,QAAQ,SAAS;AAAA,MAC3D,QAAQ,MAAM;AAAA,IAChB;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAEZ,UAAU,EAAE,QAAQ,mBAAmB,QAAQ,0BAA0B;AAAA,EACzE,SAAS,CAAC,aAAY,UAAU,YAAW,aAAa,MAAM,WAAW;AAAA,EACzE,MAAM,CAAC,UAAU,SAAS,MAAM;AAAA,EAChC,YAAY;AACd;AAEA,MAAQ,2BAAa,8BAAgB,WAAW,KAAI;AAG7C,IAAM,WAAW,CAAC,UACvB,OAAO,MAAM,QAAQ,QAAQ,OAAa,cAAQ,EAAE,QAAQ,MAAM,OAAO,CAAC,CAAC,EAAE,KACpE,iBAAQ,CAAC,SACP,4BAA2B,eAAa,qBAAe,CAAC,EAAE,IAAI,EAAE,KAC9D,kBACL,MACE,IAAI,mBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC,CACL,GACO,YAAG,IAAI,CAChB,CACF,GACO,aAAI,CAAC,SAAS,MAAK,WAAW,KAAK,KAAK,GAAG,KAAK,CAAC,GACjD,kBAAS,gBAAgB,MAAa,iBAAQ,SAAS,CAAC,GACxD,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAEK,IAAM,cAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,aAAa,MAAY,iBAAW,EAAE,QAAQ,MAAM,OAAO,CAAC,CAAC,EAAE,KAC3E,kBAAS,gBAAgB,MAAa,aAAI,GAC1C,kBAAS,YAAY,MAAa,aAAI,CAC/C;AAEK,IAAM,sBAAsB,MACxB,kBACP,aACO,iBACL,YAAY,SAAS,GAAG;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,SAAS,IAAI;AAAA,EACjC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IACjC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,MAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IACjC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAY,iBAAW,eAAe,IAAI,CAAC,CAAC;AAAA,IACtF,EAAO;AAAA,MACL,MAAM,OAAO,WAAW,MAAK,SAAS,MAAM,MAAM,eAAe,IAAI,CAAC;AAAA,MACtE,IAAI,SAAS;AAAA,QACX,OAAO,OACL,KAAK,QACL,aACA,MACM,cAAQ;AAAA,aACT;AAAA,UACH,QAAQ,KAAK;AAAA,QACf,CAAC,CACH;AAAA;AAAA,IAEJ,MAAM,QAAQ,OAAO,SAAS,IAAI;AAAA,IAClC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MACF,SAAS,KAAK,6DAChB,CACF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EAED,QAAQ,GAAG,WAAW,YAAW,IAAI;AACvC,CAAC,CACH,CACF;;AC1IK,IAAM,uBAA0C,OAAO,OAAO;AAAA,EACnE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAsDM,IAAM,qBAA6C,OAAO,OAAO;AAAA,EACtE,SACE;AAAA,EACF,WAAW;AAAA,EACX,eAAe;AAAA,EACf,UAAU;AAAA,EACV,UAAU;AAAA,EACV,MAAM;AACR,CAAC;AAyBD,IAAM,KAAK;AACX,IAAM,SAAS;AACf,IAAM,UAAU;AAEhB,IAAM,YAAW,CACf,QACA,UACA,UACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,GAAG,KAAK,OAAM,IAAI;AAAA,IAAG,MAAM,KAAK,UAAU,OAAM,6BAA6B;AAAA,EAClF,IAAI,CAAC,GAAG,KAAK,OAAM,SAAS;AAAA,IAAG,MAAM,KAAK,eAAe,OAAM,+BAA+B;AAAA,EAC9F,IAAI,CAAC,GAAG,KAAK,OAAM,QAAQ;AAAA,IAAG,MAAM,KAAK,cAAc,OAAM,iCAAiC;AAAA,EAC9F,YAAY,QAAO,WAAW;AAAA,IAC5B,CAAC,iBAAiB,OAAM,aAAa;AAAA,IACrC,CAAC,YAAY,OAAM,QAAQ;AAAA,EAC7B,GAAY;AAAA,IACV,IAAI,WAAW,QAAQ,CAAC,OAAO,KAAK,MAAM,GAAG;AAAA,MAC3C,MAAM,KAAK,GAAG,YAAW,wDAAwD;AAAA,IACnF;AAAA,EACF;AAAA,EACA,IAAI,OAAM,aAAa,OAAM;AAAA,IAAe,MAAM,KAAK,yCAAyC;AAAA,EAMhG,MAAM,SAAS,CAAC,UAA8B,WAC5C,aAAa,YAAY,YAAY;AAAA,EACvC,MAAM,UAAyC;AAAA,IAC7C,CAAC,OAAO,MAAM,cAAc,cAAc,GAAG,SAAS,KAAK;AAAA,IAC3D,CAAC,OAAO,MAAM,kBAAkB,kBAAkB,GAAG,SAAS,SAAS;AAAA,EACzE;AAAA,EACA,IAAI,OAAM,aAAa,MAAM;AAAA,IAC3B,QAAQ,KAAK,CAAC,OAAO,MAAM,aAAa,aAAa,GAAG,SAAS,IAAI,CAAC;AAAA,EACxE;AAAA,EACA,MAAM,OAAO,IAAI;AAAA,EACjB,YAAY,QAAO,aAAY,SAAS;AAAA,IACtC,IAAI,QAAQ,KAAK,QAAO,KAAK,KAAK,IAAI,MAAK;AAAA,MAAG;AAAA,IAC9C,KAAK,IAAI,MAAK;AAAA,IACd,MAAM,KAAK,GAAG,uDAAsD;AAAA,EACtE;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,oBAAoB,CAAC,SAAwB,CAAC,MAAyB;AAAA,EAGlF,QAAQ,cAAc,kBAAkB,gBAAgB,SAAS;AAAA,EAEjE,MAAM,QAAQ,OAAO,QAAQ,IAAI,EAAE,OAAO,IAAI,WAAW,UAAU,SAAS;AAAA,EAC5E,MAAM,WAAmC;AAAA,OACpC;AAAA,OACA,OAAO,YAAY,KAAK;AAAA,EAC7B;AAAA,EAGA,MAAM,WAA8B;AAAA,IAClC,OAAO,gBAAgB,SAAS;AAAA,IAChC,WAAW,oBAAoB,SAAS;AAAA,IACxC,MAAM,eAAe,SAAS;AAAA,EAChC;AAAA,EACA,MAAM,QAAQ,UAAS,UAAU,UAAU,MAAK;AAAA,EAChD,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,IAAI,MAAM,uBAAuB,MAAM,KAAK,IAAI,GAAG;AAAA,EAC/E,MAAM,QAA2C;AAAA,IAC/C,CAAC,aAAa,SAAS,eAAe,SAAS,IAAI;AAAA,EACrD;AAAA,EACA,IAAI,SAAS,aAAa;AAAA,IAAM,MAAM,KAAK,CAAC,QAAQ,SAAS,UAAU,SAAS,QAAQ,CAAC;AAAA,EACzF,OAAO;AAAA,IACL,QAAQ,MAAM,IAAI,EAAE,MAAM,QAAQ,aAAa,EAAE,MAAM,QAAQ,OAAO,EAAE;AAAA,IACxE,OAAO,EAAE,SAAS,SAAS,OAAO,SAAS,SAAS,UAAU;AAAA,IAC9D,MAAM,EAAE,OAAO,sBAAsB,QAAQ,SAAS,KAAK;AAAA,IAC3D,OAAO,MAAM,IAAI,EAAE,MAAM,aAAa;AAAA,MACpC,SAAS,SAAS;AAAA,MAClB,QAAQ,CAAC,SAAS,SAAS;AAAA,MAC3B;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AAAA;;AC3LF,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBf,IAAM,WAAW,CAAC,UAAiB,KAAK;AAGxC,IAAM,aACJ,qEACA,iGACA,sEACA,mFACA;AAEF,IAAM,WAAW,GAAG,WAAsC;AAAA,EACxD,MAAM,QAAQ,CAAC,GAAG,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG;AAAA,EAC7C,OAAO;AAAA,SACA,KAAK;AAAA,QACN;AAAA,8BACsB,KAAK;AAAA,8CACW,KAAK;AAAA,oBAC/B,KAAK,+DAA+D,KAAK;AAAA;AAAA,eAE9E,KAAK,mCAAmC,KAAK;AAAA;AAAA;AAAA;AAK5D,IAAM,YAAY,GAAG,YAAuC;AAAA,UAClD,MAAM;AAAA,+BACe,MAAM;AAAA,oBACjB,MAAM,gCAAgC,MAAM;AAAA,qBAC3C,MAAM,qDAAqD,MAAM,sBAAsB,MAAM;AAAA;AAAA,gBAElG,MAAM,qCAAqC,MAAM,sBAAsB,MAAM;AAAA;AAAA;AAI7F,IAAM,WAAW,CAAC,SAAqD;AAAA,EACrE,MAAM,SAAS,CAAC,GAAG,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG;AAAA,EAC/C,MAAM,OAAO,UAAU,gEAAgE,KAAK;AAAA,EAC5F,MAAM,UAAS,YAAY,qBAAqB,KAAK;AAAA,EACrD,OAAO;AAAA,SACA,KAAK,eAAe,KAAK,kBAAkB;AAAA,8BACtB,KAAK,WAAW;AAAA,oBAC1B,4BAA4B,KAAK;AAAA,oBACjC,KAAK;AAAA,wBACD,KAAK,UAAU;AAAA;AAAA,eAExB,KAAK,mCAAmC,KAAK,UAAU;AAAA;AAAA;AAAA;AAKtE,IAAM,YAAY,CAAC,UAAuD;AAAA,EACxE,MAAM,QACJ,sEACA,iBAAiB,SAAS,MAAM,MAAM,wBAAwB,SAAS,MAAM,MAAM,UACnF;AAAA,EACF,OAAO;AAAA,WACE,MAAM,gBAAgB,MAAM,gCAAgC,MAAM;AAAA,2BAClD,oCAAoC,MAAM,UAAU,MAAM;AAAA,mBAClE,MAAM,UAAU,MAAM,iDAAiD,MAAM,kBAAkB,MAAM;AAAA;AAAA;AAKxH,IAAM,cAAc,CAAC,WAA2B;AAAA,oBAC5B,0DAA0D;AAAA;AAOvE,IAAM,qBAAqB,CAAC,SAAwB,CAAC,MAAc;AAAA,EACxE,MAAM,WAAW,kBAAkB,MAAK;AAAA,EACxC,MAAM,WAAW,SAAS,OACvB,IAAI,CAAC,UAAU,MAAM,MAAM,EAC3B,OAAO,CAAC,WAAW,WAAW,SAAS,KAAK,MAAM;AAAA,EACrD,OAAO;AAAA,IACL;AAAA,IACA,GAAG,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,WAAW;AAAA,IACzC,SAAS,QAAQ;AAAA,IACjB,UAAU,QAAQ;AAAA,IAClB,GAAG,SAAS,MAAM,IAAI,QAAQ;AAAA,IAC9B,GAAG,SAAS,OAAO,IAAI,SAAS;AAAA,IAChC;AAAA;AAAA;AAAA,EACF,EAAE,KAAK,EAAE;AAAA;;ACxGX;AACA;AACA;;;ACkBA,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AC7CO,IAAM,cAAc;AACpB,IAAM,cAAc;AAUpB,IAAM,aAAY,CAAC,UACxB,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK;AAEjF,IAAM,cAAa,CAAC,WAAsD;AAAA,EAC/E,OAAO,WAAU,MAAM,KAAK,EAAE,KAAK,GAAG;AAAA,EACtC,QAAQ,MAAM;AAChB;AAMO,IAAM,cAAa,CAAC,WAAmD;AAAA,EAC5E,OAAO,WAAU,MAAM,KAAK,EAAE,KAAK,GAAG;AAAA,EACtC,QAAQ,MAAM;AAChB;AAEO,IAAM,QAAO,CAAC,MAAyD,WAC5E,KAAK,KAAK,CAAC,QAAQ,IAAI,WAAW,MAAM;AAEnC,IAAM,gBAAe,CAC1B,KACA,WACoB;AAAA,EACpB,OAAO,WAAU,IAAI,UAAU,YAAY,CAAC,IAAI,IAAI,MAAM,MAAM,GAAG,CAAC;AAAA,EACpE,QAAQ,MAAM;AAChB;AAEO,IAAM,WAAU,CAAC,aAA4B,UAClD,WAAU,YAAW,KAAK,EAAE,KAAK,GAAG,MAAM,WAAU,MAAM,KAAK,EAAE,KAAK,GAAG;;;AD2DpE,IAAM,cAAc,WAAsB,cAAc;AAW/D,IAAM,WAAW,CAAC,UAChB,iBAAiB,OAAO,MAAM,QAAQ,QAAQ,OAAc,wBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,KACzE,aAAI,CAAC,SAAS;AAAA,EACnB,IAAI,SAAS;AAAA,IAAY,OAAO;AAAA,EAChC,MAAM,MAAM,MAAK,MAAM,MAAM,MAAM;AAAA,EACnC,OAAO,QAAQ,YAAY,YAAY,cAAa,KAAK,KAAK;AAAA,CAC/D,CACH;AAGF,IAAM,kBAAiB,CAAC,SACtB,SAAS,aAAa,YAAY;AAE7B,IAAM,sBAAsB,MACxB,kBACP,aACO,iBACL,YAAY,SAAS,GAAG;AAAA,EAKtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,GAC5C;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IAGjC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,gBAAgB,KAAK,MAAM;AAAA,MACpD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,IAAI;AAAA,MACrD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAKxC,MAAM,SAAS,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IACnD,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,YAAW,IAAI,CAAC,CAC1C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,sBAAc,YAAW,IAAI,CAAC,CAAC;AAAA,IACtF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IAClD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,gBAAgB,KAAK,yDACnB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,EAAE,QAAQ,KAAK,OAAO,CAAC,CACjD;AAAA,GACD;AACH,CAAC,CACH,CACF;;;AE5JF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACrDA;AACA;AAMO,IAAM,cAAc;AACpB,IAAM,cAAc;AAU3B,IAAM,OAAM,CAAC,UAAmB;AAAA,EAC9B,MAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,CAAC;AAAA,EACpE,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA;AAQ5C,IAAM,WAAW,CAAC,UAA6B;AAAA,EAC7C,MAAM,MAAiB,MAAM,QAAQ,KAAK,IACtC,QACA,OAAO,UAAU,WACf,MAAM,MAAM,GAAG,IACf,CAAC;AAAA,EACP,MAAM,SAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,UAAU,EAAE;AAAA,EACnF,OAAO,CAAC,GAAG,IAAI,IAAI,MAAK,CAAC,EAAE,KAAK;AAAA;AASlC,IAAM,aAAa,CAAC,UAClB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,OAAO,KAAK,KAAK,EAAE,KAAK,IACxB,CAAC;AAGP,IAAM,SAAQ,CAAC,WAAsB;AAAA,EACnC,SAAS,MAAM,WAAW;AAAA,EAC1B,OAAO,MAAM,SAAS;AAAA,EACtB,QAAQ,MAAM,WAAW,QAAQ,MAAM;AAAA,EACvC,QAAQ,OAAO,MAAM,UAAU,CAAC;AAAA,EAChC,WAAW,MAAM,aAAa;AAAA,EAQ9B,QAAQ,SAAS,MAAM,MAAM,EAAE,KAAK,GAAG;AAAA,EACvC,UAAU,MAAM,YAAY;AAC9B;AAEO,IAAM,cAAa,CAAC,WAAsD;AAAA,KAC5E,OAAM,KAAK;AAAA,EACd,QAAQ,MAAM;AAChB;AAEO,IAAM,cAAa,CAAC,WAAmD;AAAA,KACzE,OAAM,KAAK;AAAA,EACd,QAAQ,MAAM;AAChB;AAEA,IAAM,gBAAe,CAAC,MAAoC,WAAsC;AAAA,EAC9F,SAAS,KAAK,KAAK,OAAO;AAAA,EAC1B,OAAO,KAAK,KAAK,KAAK;AAAA,EAMtB,QAAQ,KAAK,KAAK,QAAQ,IAAI;AAAA,EAC9B,QAAQ,KAAI,KAAK,MAAM;AAAA,EACvB,WAAW,KAAK,KAAK,SAAS;AAAA,EAC9B,QAAQ,SAAS,KAAK,MAAM;AAAA,EAC5B,UAAU,KAAK,KAAK,QAAQ;AAAA,EAC5B,QAAQ,WAAW,KAAK,MAAM;AAAA,EAE9B,QAAQ,MAAM;AAChB;AAMO,IAAM,WAAU,CAAC,aAA4B,UAClD,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,WAAW,MAAM,SAAS,OACrC,YAAW,YAAY,MAAM,WAAW,UACxC,YAAW,YAAY,MAAM,UAAU,MACvC,YAAW,eAAe,MAAM,aAAa,OAC7C,YAAW,cAAc,MAAM,YAAY,OAC3C,YAAW,OAAO,KAAK,GAAG,MAAM,SAAS,MAAM,MAAM,EAAE,KAAK,GAAG;AAe1D,IAAM,iBAAiB,CAAC,UAC7B,iBACE,OAAO,MAAM,QAAQ,QAAQ,OAAc,sBAAc,EAAE,QAAQ,MAAM,OAAO,CAAC,CAAC,CACpF,EAAE,KAAY,aAAI,CAAC,SAAU,SAAS,aAAa,aAAa,cAAa,MAAM,KAAK,CAAE,CAAC;AAUtF,IAAM,WAAW,CAAC,UACvB,eAAe,KAAK,EAAE,KAAY,kBAAS,gBAAgB,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAGtF,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;;;ADrB7B,IAAM,cAAc,WAAsB,cAAc;AAExD,IAAM,sBAAsB,MACxB,kBACP,aACO,iBACL,YAAY,SAAS,GAAG;AAAA,EAMtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAY7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,SAAS,IAAI,IAAI,eAAe,IAAI,CACpE;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IAGvC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,gBAAgB,KAAK,MAAM;AAAA,MACpD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,IAAI;AAAA,MACrD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAKxC,MAAM,SAAS,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IACnD,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,YAAW,IAAI,CAAC,CAC1C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,sBAAc,YAAW,IAAI,CAAC,CAAC;AAAA,IACtF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IAClD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,gBAAgB,KAAK,4DACnB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,EAAE,QAAQ,KAAK,OAAO,CAAC,CACjD;AAAA,GACD;AACH,CAAC,CACH,CACF;;;AH3KK,IAAM,2BAA2B,CACtC,IACA,QACA,SAAwB,CAAC,GACzB,UAAmC,CAAC,MAE7B,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAc,aAAI;AAAA,IACjC,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,IAC3E,KAAK,MAAM,kBAAkB,MAAK;AAAA,EACpC,CAAC;AAAA,EACD,MAAM,QAAQ,CAAO,aAAyC;AAAA,IAC5D,MAAM,OAAO,SAAS,KAAmB,qBAAO,CAAC;AAAA,IACjD,OAAO,QAAQ,UAAU,YAAY,OAAO,KAAK,KAAK,MAAM,QAAQ,KAAK,CAAC;AAAA;AAAA,EAE5E,MAAM,OAAO,OAAO,MAClB,YAAY,GAAG,WAAW;AAAA,IACxB,OAAO,CAAC,GAAG,SAAS,KAAK,KAAK;AAAA,IAC9B,QAAQ,SAAS,KAAK;AAAA,IACtB;AAAA,EACF,CAAC,CACH;AAAA,EACA,MAAM,QAAQ,OAAO,MAAM,aAAa,GAAG,iBAAiB,KAAK,SAAS,OAAO,OAAO,CAAC,CAAC;AAAA,EAG1F,MAAM,QAAQ,OAAc,aAC1B,SAAS,MAAM,IAAI,CAAC,SAClB,MACE,YAAY,GAAG,MAAM,KAAK,aAAa;AAAA,IACrC,SAAS,KAAK;AAAA,IACd,QAAQ,CAAC,GAAG,KAAK,MAAM;AAAA,IACvB;AAAA,IACA,QAAQ,KAAK;AAAA,EACf,CAAC,CACH,CACF,CACF;AAAA,EACA,MAAM,SAAS,OAAc,aAC3B,SAAS,OAAO,IAAI,CAAC,UACnB,MACE,WAAW,GAAG,MAAM,MAAM,cAAc;AAAA,IACtC,MAAM;AAAA,IACN,WAAW;AAAA,IACX,QAAQ,MAAM;AAAA,IACd;AAAA,IACA,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,EACd,CAAC,CACH,CACF,CACF;AAAA,EACA,OAAO,EAAE,UAAU,QAAQ,OAAO,MAAM,MAAM;AAAA,CAC/C;;AKtFH,qBAAS;AACT;AACA;AAoCO,IAAM,YAAY,WAAoB,YAAY;AAGlD,IAAM,cAAa,CAAC,WAAoB,KAAK,OAAM,KAAK,GAAG,MAAM,OAAO,MAAM,IAAI,EAAE;AAE3F,IAAM,SAAQ,CAAC,WAAoB;AAAA,EACjC,OAAO,OAAO,MAAM,SAAS,CAAC;AAAA,EAC9B,QAAQ,OAAO,MAAM,UAAU,GAAG;AAAA,EAClC,MAAM,MAAM,QAAQ,KAAK,OAAO,MAAM,IAAI;AAAA,EAC1C,QAAQ,MAAM,WAAW,OAAO,MAAM;AAAA,EACtC,SAAS,OAAO,MAAM,WAAW,CAAC;AAAA,KAC9B,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AACzD;AAEA,IAAM,aAAW,YAAmC;AAAA,EAClD,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,IAC3B,QAAQ,IAAI,KAAK,WAAW,GAAG;AAAA,IAC/B,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,IACxD,MAAM,MAAM;AAAA,IACZ,QAAQ,KAAK,cAAc,KAAK,KAAK,cAAc;AAAA,IACnD,SAAS,IAAI,KAAK,YAAY,CAAC;AAAA,IAC/B,MAAM,MAAM;AAAA,EACd;AAAA,EACA,YAAY,CAAC,UAAU,SAAS,MAAM;AAAA,EACtC;AAAA,EAEA,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,aAAY,UACpB,YAAW,UAAU,MAAM,QAAQ,KAAK,OAAO,MAAM,IAAI,QACzD,YAAW,YAAY,MAAM,UAAU,QACvC,YAAW,WAAW,MAAM,SAAS,MACrC,YAAW,aAAa,MAAM,WAAW,MACzC,YAAW,YAAY,MAAM,WAAW;AAAA,EAC1C,MAAM,CAAC,UAAU,SAAS,MAAM,aAAa,OAAO,MAAM,IAAI;AAAA,EAC9D,YAAY;AACd,CAAC;AAEM,IAAM,oBAAoB,MACtB,kBAAO,WAAkB,iBAAQ,UAAU,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACX5E,qBAAS;AACT;AACA;;;AC/DO,IAAM,mBAAmB;AASzB,IAAM,QAAQ,CAAC,UACpB,GAAG,OAAO,MAAM,KAAK,KAAK,OAAO,MAAM,MAAM;AAe/C,IAAM,UAAQ,CAAC,WAAgC;AAAA,EAC7C,SAAS,MAAM,WAAW;AAAA,EAC1B,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EACxC,UAAU,MAAM,YAAY;AAAA,KACxB,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,OAAO,MAAM,IAAI,EAAE;AACjE;AAUO,IAAM,cAAa,CAAC,WAAgC;AAAA,KACtD,QAAM,KAAK;AAAA,EACd,IAAI,MAAM,KAAK;AAAA,EACf,QAAQ,MAAM;AAAA,EACd,MAAM;AACR;AAgBO,IAAM,cAAa,CAAC,WAAgC;AAAA,KACtD,QAAM,KAAK;AAAA,EACd,QAAQ;AACV;;;AD4EO,IAAM,wBAAwB,WAAgC,wBAAwB;AAY7F,IAAM,SAAS,CAAC,UAA2B;AAAA,EACzC,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,SAAS,OAAO,WAAW,KAAK,KAAK,CAAC;AAAA,EAC5C,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA;AAG5C,IAAM,aAAW,YAA2D;AAAA,EAY1E,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,IACpC,OAAO,IAAI,KAAK,UAAU,MAAM,KAAK;AAAA,IACrC,IAAI,KAAK,KAAK,OAAO,MAAM,KAAK,CAAC;AAAA,IACjC,QAAQ,IAAI,KAAK,WAAW,MAAM,MAAM;AAAA,IACxC,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,YAAY,KAAK,KAAK,eAAe,EAAE;AAAA,IACvC,UAAU,KAAK,KAAK,aAAa,gBAAgB;AAAA,IACjD,QAAQ,KAAK,KAAK,WAAW,EAAE;AAAA,IAC/B,YAAY,KAAK,KAAK,WAAW,MAAM,UAAU;AAAA,IACjD,MAAM,KAAK,KAAK,SAAS,OAAO;AAAA,EAClC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAmBZ,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,aAAY,UACpB,YAAW,eAAe,MAC1B,YAAW,cAAc,MAAM,YAAY,qBAC3C,YAAW,aAAa,MAAM,YAAY,SAC1C,YAAW,aAAa,MAAM,WAAW,QACxC,MAAM,SAAS,aAAa,YAAW,SAAS,MAAM;AAAA,EACzD,MAAM,CAAC,UAAU,uBAAuB,MAAM,KAAK;AAAA,EACnD,YAAY;AACd,CAAC;AAUM,IAAM,gCAAgC,MAClC,kBACP,uBACO,iBAAQ,sBAAsB,SAAS,GAAG,UAAQ,CAAC,CAC5D;;AE7NF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACHA;AAkBA,IAAM,SAAS;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA2BO,IAAM,kBAAkB,CAAC,UAC9B,iBAAiB,YAAY,MAAM,WAAW;AAGhD,IAAM,gBAAgB,CAAC,WACd,aACL,OAAO,IAAI,CAAC,eACV,IAAkB,QAAQ,QAAQ,OAAO,GAAG,sBAAsB,EAAE,KAC3D,aAAI,CAAC,UAAU,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,SAAS,EAAE,MAAM,GAQ1E,iBAAQ,iBAAiB,MAAa,iBAAQ,CAAC,CAAC,CACzD,CACF,GACA,EAAE,aAAa,YAAY,CAC7B,EAAE,KAAY,aAAI,CAAC,WAAW,OAAO,OAAO,CAAC,OAAO,WAAU,QAAQ,QAAO,CAAC,CAAC,CAAC;AAU3E,IAAM,eAAe,CAC1B,QACA,YAC4B;AAAA,EAC5B,IAAI,WAAW,aAAa,YAAY;AAAA,IAAW,OAAO;AAAA,EAC1D,IAAI,WAAW,aAAa,YAAY;AAAA,IAAW,OAAO;AAAA,EAC1D,OAAO,WAAW,UAAU,IAAI;AAAA;AAiBlC,IAAM,gBAAgB,CAAC,WACd,aACL,CAAC,WAAW,SAAS,EAAE,IAAI,CAAC,SAC1B,IAAa,QAAQ,QAAQ,OAAO,2BAA2B,QAAQ,EAAE,KAChE,aAAI,UAAS,GACb,iBAAQ,iBAAiB,MAAa,iBAAQ,SAAS,CAAC,CACjE,CACF,GACA,EAAE,aAAa,YAAY,CAC7B,EAAE,KACO,iBAAQ,EAAE,QAAQ,aAAa;AAAA,EACpC,MAAM,UAAU,aAAa,QAAQ,OAAO;AAAA,EAC5C,OAAO,YAAY,iBACR,aACL,IAAI,MACF,uFACE,6DACJ,CACF,IACO,iBAAQ,OAAO;AAAA,CAC3B,CACH;AAGK,IAAM,aAAY,CAAC,UAA2B,KAAK,UAAU,SAAS,KAAK,CAAC;AAEnF,IAAM,WAAW,CAAC,UAA4B;AAAA,EAC5C,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAO,MACJ,IAAI,QAAQ,EACZ,KAAK,CAAC,MAAM,UAAU,KAAK,UAAU,IAAI,EAAE,cAAc,KAAK,UAAU,KAAK,CAAC,CAAC;AAAA,EACpF;AAAA,EACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,MAAM,UAAU,OAAO,QAAQ,KAAgC,EAC5D,OAAO,EAAE,SAAS,QAAQ,QAAQ,EAClC,KAAK,EAAE,QAAQ,WAAW,KAAK,cAAc,KAAK,CAAC;AAAA,IACtD,OAAO,OAAO,YAAY,QAAQ,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,SAAS,KAAK,CAAC,CAAC,CAAC;AAAA,EACjF;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,kBAAkB,CAAC,WACvB,aAAI,CAAC,cAAc,MAAM,GAAG,cAAc,MAAM,CAAC,GAAG,EAAE,aAAa,YAAY,CAAC,EAAE,KAChF,aAAI,EAAE,QAAQ,YAAY,SAAS,MAAM,CAClD;;;ADjHK,IAAM,kBAAkB,WAA0B,kBAAkB;AAE3E,IAAM,QAAO,CAAC,UACZ,gBAAgB,MAAM,MAAM,EAAE,KAAY,aAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC;AAEpE,IAAM,0BAA0B,MAC5B,kBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,EAE1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAE7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,MAAK,IAAI;AAAA,GACxB;AAAA,EAQD,MAAa,YAAG,UAAU,GAAG,QAAwC;AAAA,IACnE,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,QAAQ,YAAY,OAAO,MAAK,IAAI;AAAA,IACpC,OAAO,YAAY,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAC5E;AAAA,EAED,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAiBxC,MAAM,SAAS,OAAO,MAAK,IAAI;AAAA,IAC/B,IAAI,OAAO,YAAY;AAAA,MAAG,OAAO;AAAA,IAIjC,OAAO;AAAA,IACP,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,aAAa;AAAA,IAOzD,MAAM,QAAQ,OAAO,MAAK,IAAI;AAAA,IAC9B,IAAI,MAAM,YAAY,GAAG;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,0CAA0C,OAAO,MAAM,OAAO,qBAC5D,mFACA,yEACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EASD,QAAQ,MAAa;AACvB,CAAC,CACH,CACF;;AE/FF,qBAAS;AACT;AACA;;;ACjCO,IAAM,WAAW,CAAC,UACvB,GAAG,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK,GAAG;AAG9C,IAAM,cAAc,CAAC,UAAqB,iBAAiB,MAAM,qBAAqB,MAAM;AAoBrF,IAAM,aAAa,CAAC,WACxB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAC9B,IAAI,CAAC,UAAmB,eAAe,KAAK,CAAC,EAC7C,OAAO,CAAC,UAAU,UAAU,EAAE,EAC9B,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,iBAAiB,CAAC,UAC7B,UAAU,YAAY,KAAK,WAAW,CAAC,YAAY,KAAK,CAAC,CAAC;AAO5D,IAAM,QAAQ,CAAC,UACb,UAAU,aAAa,UAAU,KAAK,YAAY;AA0B7C,IAAM,YAAW,CAAC,WAA+D;AAAA,EACtF,mBAAmB,MAAM,MAAM,aAAa;AAAA,EAC5C,cAAc,MAAM,cAAc,YAAY,YAAY,YAAY,MAAM,SAAS;AAAA,EACrF,eAAe,MAAM,MAAM,aAAa;AAAA,EACxC,SAAS,MAAM,MAAM,OAAO;AAC9B;AAUO,IAAM,QAAO,CAAC,WAAmD;AAAA,EACtE,MAAM,MAAM,SAAS,OAAO,MAAM;AAAA,EAClC,MAAM,MAAM;AAAA,KACT,OAAO,YACR,OAAO,QAAQ,UAAS,KAAK,CAAC,EAAE,OAC9B,CAAC,UAAqC,MAAM,OAAO,SACrD,CACF;AACF;AAOO,IAAM,eAAa,CAAC,WAAmD;AAAA,KACzE,MAAK,KAAK;AAAA,EACb,QAAQ,MAAM;AAAA,EACd,MAAM;AACR;AAkBO,IAAM,cAAa,CAAC,UAAkD;AAAA,EAC3E,MAAM,QAAQ,OAAO,QAAQ,UAAS,KAAK,CAAC,EACzC,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,SAAS,GAAG;AAAA,EACrB,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;;;ADY/B,IAAM,mBAAmB,WAA2B,mBAAmB;AAE9E,IAAM,aAAW,YAAiD;AAAA,EAChE,YAAY,CAAC,MAAM,UAAU;AAAA,IAS3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,eAAe,KAAK,KAAK,kBAAkB;AAAA,MAC3C,WAAW,WAAW,KAAK,aAAa;AAAA,MACxC,eAAe,KAAK,KAAK,gBAAgB;AAAA,MACzC,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,MAAM,IAAI,KAAK,SAAS,CAAC;AAAA,MACzB,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,QAAQ;AAAA,MACR,UAAU,SAAS,KAAK;AAAA,MACxB,MAAM,MAAM;AAAA,MACZ,MAAM,KAAK,KAAK,OAAO;AAAA,IACzB;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAClD;AAAA,EAEA,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EAeA,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,UAAU,MAAM,SAAS,SACpC,YAAW,mBAAmB,MAAM,iBAAiB,OACrD,YAAW,mBAAmB,MAAM,iBAAiB,OACrD,YAAW,cAAc,eAAe,MAAM,SAAS;AAAA,EAOzD,MAAM,CAAC,UAAU,qBAAqB,MAAM,gBAAgB,SAAS,KAAK;AAAA,EAC1E;AACF,CAAC;AAYM,IAAM,2BAA2B,MAC7B,kBAAO,kBAAyB,iBAAQ,iBAAiB,SAAS,GAAG,UAAQ,CAAC,CAAC;;AEvM1F,qBAAS;AACT;AACA;AA6DO,IAAM,iBAAiB,WAAyB,iBAAiB;AAQxE,IAAM,QAAQ,CAAC,UAAoB,OAAO,UAAU,WAAW,QAAQ;AAUvE,IAAM,UAAQ,CAAC,UAAgD;AAAA,EAC7D,MAAM,QAAQ,MAAM,SAAS;AAAA,EAC7B,OAAO;AAAA,IAIL,iBAAiB,MAAM,iBAAiB,OAAO,MAAM;AAAA,IACrD,WAAW,MAAM,cAAc,OAAO,MAAM;AAAA,IAC5C,MAAM,MAAM;AAAA,OAIR,UAAU,KAAK,CAAC,IAAI,EAAE,MAAM;AAAA,OAC5B,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,EAC9D;AAAA;AAoBF,IAAM,cAAa,CAAC,UAAgD;AAAA,EAClE,MAAM,SAAQ;AAAA,IACZ,IAAK,MAAM,SAAS,QAAQ,KAAK,CAAC,OAAO,IAAI,CAAC;AAAA,IAC9C,GAAI,MAAM,QAAQ,YAAY,CAAC,KAAK,IAAI,CAAC;AAAA,EAC3C;AAAA,EACA,OAAO,WAAW,QAAM,KAAK,GAAG,MAAK;AAAA;AAGvC,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EACV,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,OAAO,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC3D,QAAQ,MAAM;AAAA,IACd,cAAc,KAAK,KAAK,gBAAgB;AAAA,IACxC,KAAK,MAAM,KAAK,MAAM;AAAA,IACtB,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,MAAM,MAAM;AAAA,IAOZ,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,EAC1D;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,QAAM,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAS5D,UAAU,EAAE,QAAQ,+BAA+B,QAAQ,oCAAoC;AAAA,EAC/F,SAAS,CAAC,aAAY,UACpB,YAAW,SAAS,MAAM,QAC1B,YAAW,WAAW,MAAM,SAAS,OACrC,YAAW,QAAQ,MAAM,OACzB,YAAW,eAAe,MAAM,cAAc,SAC9C,YAAW,kBAAkB,MAAM,iBAAiB;AAAA,EAOtD,MAAM,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAC5C;AACF,CAAC;AAgBM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACrLtF,qBAAS;AACT;AACA;AAwEO,IAAM,iBAAiB,WAAyB,iBAAiB;AAQxE,IAAM,WAAW,CAAC,MAAc,eAC7B,SAAS,KAAK,QAAQ,WAAW,cAAa,aAAa,cAAa,KAAK,QAAQ;AASxF,IAAM,QAAO,CAAC,WAAiD;AAAA,KACzD,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,KACzD,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,KAChD,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,KACnD,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,KACxD,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,KAAK,EAAE;AAAA,KAC3D,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,KAAK,EAAE;AAAA,KAC3D,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,KACxD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AACxF;AAkBA,IAAM,YAAoD;AAAA,EACxD,MAAM,CAAC,OAAO,WAAW,OAAO,OAAO;AAAA,EACvC,MAAM,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EAC/C,QAAQ,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EACjD,MAAM,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EAC/C,OAAO,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAClD;AAEA,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EACV,YAAY,CAAC,MAAM,UAAU;AAAA,IAQ3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,KAAK,KAAK,KAAK,MAAM;AAAA,MACrB,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,MAAM,KAAK,KAAK,OAAO,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO;AAAA,MAC3D,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,MACvB,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AAAA,MAC9B,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AAAA,MAC9B,QAAQ;AAAA,MACR,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,MACvB,MAAM,MAAM;AAAA,MACZ,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,MACrC,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK;AAAA,EAO7E,UAAU,EAAE,QAAQ,+BAA+B,QAAQ,oCAAoC;AAAA,EAC/F,SAAS,CAAC,aAAY,UACpB,YAAW,SAAS,MAAM,OAAO,MACjC,YAAW,UAAU,IAAI,MAAM,KAAK,KACpC,SAAS,YAAW,MAAM,MAAM,IAAI,KACpC,YAAW,SAAS,MAAM,OAAO,OACjC,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,UAAU,IAAI,MAAM,KAAK,KACpC,YAAW,kBAAkB,MAAM,gBAAgB,MACnD,YAAW,SAAS,MAAM,OAAO,MACjC,YAAW,YAAY,MAAM,UAAU;AAAA,EACzC,MAAM,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAC5C,YAAY,CAAC,UAAU;AAAA,IACrB,MAAM,UAAS,MAAK,KAAK;AAAA,IACzB,MAAM,QAAQ,UAAU,MAAM,MAAM,OAAO,CAAC,WAAW,QAAO,YAAY,SAAS;AAAA,IACnF,OAAO,WAAW,SAAQ,KAAK;AAAA;AAEnC,CAAC;AAgBM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;AChLtF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AClEO,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;AAsB9B,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAQ7C,IAAM,cAAc,CAAC,aAClB,KAAK,QAAQ;AAgChB,IAAM,cAAc,CAAC,SACnB,OAAO,YAAY,OAAO,QAAQ,IAAI,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,WAAW,KAAK,GAAG,GAAG,KAAK,CAAC,CAAC;AAqBlG,IAAM,WAAU,CAAC,WAAyB;AAAA,KACrC,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,KAAK,MAAM,OAAO,CAAC;AAAA,KACpC,OAAM,SAAS,MAAM,KAAK;AAAA,KAC1B,OAAM,iBAAiB,MAAM,aAAa;AAAA,KAC1C,OAAM,iBAAiB,MAAM,gBAAgB;AAAA,KAC7C,OAAM,UAAU,KAAK,MAAM,MAAM,CAAC;AACvC;AASO,IAAM,eAAa,CAAC,WAAiD;AAAA,KACvE,YAAY,MAAM,OAAO;AAAA,KACzB,SAAQ,KAAK;AAAA,EAChB,SAAS,MAAM;AAAA,EACf,MAAM,MAAM;AACd;AAQO,IAAM,cAAa,CAAC,WAAiD;AAAA,KACvE,SAAQ,KAAK;AAAA,EAChB,SAAS,MAAM;AACjB;AASO,IAAM,qBAAoB,CAAC,UAChC,YAAY,aAAW,KAAK,CAAC;AAGxB,IAAM,qBAAoB,CAAC,UAChC,YAAY,YAAW,KAAK,CAAC;;;ACzI/B;AACA;AAmBA,IAAM,OAAM,CAAC,OAAgB,WAAW,OAAQ,OAAO,UAAU,WAAW,QAAQ;AASpF,IAAM,SAAS,CAAC,UACd,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAEN,IAAM,YAAW,CAAC,WAA8B,SACrD,cAAa,aAAa,OAAO,SAAQ,MAAM,OAAO,IAAI;AAErD,IAAM,QAAO,CAAI,WAAyB,SAC/C,cAAa,aAAa,cAAa;AASzC,IAAM,gBAAe,CAAC,MAAe,UAA2C;AAAA,EAC9E,MAAM,OAAO;AAAA,EACb,OAAO;AAAA,IACL,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,OAAO,KAAI,KAAK,QAAQ;AAAA,IACxB,eAAe,KAAI,KAAK,gBAAgB;AAAA,IACxC,iBAAiB,KAAI,KAAK,gBAAgB;AAAA,IAC1C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,SAAS,MAAM;AAAA,IACf,MAAM,KAAI,KAAK,SAAS,MAAM,IAAI;AAAA,EACpC;AAAA;AAqBK,IAAM,oBAAoB,CAAC,UAChC,iBACE,OAAO,MAAM,QAAQ,aAAa,OAAe,mBAAW,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CACzF,EAAE,KAAY,aAAI,CAAC,SAAU,SAAS,aAAa,aAAa,cAAa,MAAM,KAAK,CAAE,CAAC;AAUtF,IAAM,cAAc,CAAC,UAC1B,kBAAkB,KAAK,EAAE,KAChB,kBAAS,mBAAmB,MAAa,iBAAQ,SAAS,CAAC,CACpE;AAGK,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;AAM7B,IAAM,WAAU,CAAC,aAA+B,UACrD,UAAS,MAAM,SAAS,YAAW,OAAO,KAC1C,UAAS,MAAM,OAAO,YAAW,KAAK,KACtC,UAAS,MAAM,kBAAkB,YAAW,gBAAgB,KAC5D,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,MAAK,MAAM,QAAQ,YAAW,MAAM,KACpC,MAAK,MAAM,eAAe,YAAW,aAAa,KAClD,MAAK,MAAM,SAAS,YAAW,OAAO;;;AFejC,IAAM,iBAAiB,WAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAEM,IAAM,yBAAyB,MAC3B,kBACP,gBACO,iBACL,eAAe,SAAS,GAAG;AAAA,EAOzB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAQ7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,YAAY,IAAI,IAAI,kBAAkB,IAAI,CAC1E;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,gBAAgB,aAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACxE,OAAO,YAAW,gBAAgB,YAAW,IAAI,GAAG,KAAK;AAAA,IACzD,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,kBAAkB,IAAI;AAAA,IAG1C,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,mBAAmB,KAAK,OAAO;AAAA,MACxD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,gBAAgB,aAAW,IAAI,GAAG,IAAI;AAAA,MACxD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAIxC,MAAM,SAAS,gBAAe,OAAO,YAAY,IAAI,CAAC;AAAA,IACtD,OAAO,YAAW,gBAAgB,aAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACxE,OAAO,YAAW,gBAAgB,YAAW,IAAI,GAAG,KAAK;AAAA,IACzD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACQ,uBAAc,mBAAkB,IAAI,CAAC,CAC/C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OACL,KAAK,QACL,aACA,MACQ,oBAAW,mBAAkB,IAAI,CAAC,CAC5C;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,YAAY,IAAI,CAAC;AAAA,IACrD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,WAAW,KAAK,mEACd,gFACA,0EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAMD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACQ,uBAAc,EAAE,SAAS,KAAK,QAAQ,CAAC,CACjD;AAAA,GACD;AACH,CAAC,CACH,CACF;;AGpKF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACvEA;AACA;AAsCO,IAAM,cAAc,CAAC,aAC1B,MAAM,QAAQ,QAAQ,IAClB,SAAS,QAAQ,CAAC,UAAmB;AAAA,EACnC,MAAM,OAAO;AAAA,EACb,MAAM,SAAS,YAAY,KAAK,QAAQ;AAAA,EACxC,OAAO,OAAO,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,SAAS,EAAE;AAAA,CACnF,IACD,CAAC;AAQP,IAAM,iBAAe,CACnB,MACA,WACuB;AAAA,EACvB,SAAS,YAAY,KAAK,QAAQ,EAAE,KAAK,GAAG;AAAA,EAC5C,QAAQ,KAAK,KAAK,QAAQ,SAAS;AAAA,EACnC,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,EACZ,OAAO,KAAK,KAAK,OAAO,SAAS;AACnC;AAoBO,IAAM,iBAAiB,CAAC,UAC7B,iBACE,OACE,MAAM,QACN,QACA,OACM,uBAAe,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK,CAAC,CAC7D,CACF,EAAE,KACO,aAAI,CAAC,SAAS;AAAA,EACnB,IAAI,SAAS;AAAA,IAAY,OAAO;AAAA,EAGhC,OAAO,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,eAAa,MAAM,KAAK;AAAA,CACrE,CACH;AAaK,IAAM,YAAW,CAAC,UACvB,eAAe,KAAK,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAG3D,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;;;AC9GpC;AACA;AAQO,IAAM,kBAAkB;AA6BxB,IAAM,wBAAwB,CAAC,UACpC,MAAM,YAAY,aAAa,MAAM,cAAc,YAAY,YAAY;AAmBtE,IAAM,eAAa,CAAC,WAAiD;AAAA,KACtE,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ,KAAK,GAAG,EAAE;AAAA,EAC1E,MAAM,MAAM;AAAA,KACR,MAAM,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,KAClE,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,MAAM,MAAM,EAAE;AAAA,KACjE,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,KACxE,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,gBAAgB;AACzF;AAcA,IAAM,qBAAoB,CAAC,UAAwD;AAAA,EACjF,MAAM,OAAO,aAAW,KAAK;AAAA,EAC7B,OAAO;AAAA,OACF;AAAA,IACH,cAAc,KAAK;AAAA,IACnB,MAAM,MAAM;AAAA,EACd;AAAA;AAIF,IAAM,kBAAkB;AAkDjB,IAAM,cAAa,CACxB,OACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,MAAK,KAAK;AAAA,EAClC,IAAI,aAAa;AAAA,IAAW,OAAO;AAAA,EAEnC,IAAI,MAAM,YAAY,aAAa,MAAM,cAAc,WAAW;AAAA,IAChE,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,MAAM,QAAQ,MAAM,gEACrB,0FACA,yFACA,yDACJ,CACF;AAAA,EACF;AAAA,EAaA,OAAO,UAAU,sBAAsB,KAAK,GAAG,QAAO,aAAW,KAAK,CAAC,GAAG,IAAI;AAAA,EAE9E,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,aACA,MACM,0BAAkB,mBAAkB,KAAK,CAAC,CAClD;AAAA,EAEA,MAAM,UAAS,CAAC,aACP,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,MAAK,KAAK;AAAA,IAC9B,IAAI,SAAS,aAAa,YAAY;AAAA,MAAG,OAAO;AAAA,IAChD,OAAc,eAAM,WAAW;AAAA,IAC/B,OAAO,OAAO,QAAO,WAAW,CAAC;AAAA,GAClC;AAAA,EAEH,MAAM,QAAQ,OAAO,QAAO,eAAe;AAAA,EAC3C,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,aACnB,IAAI,MACF,SAAS,MAAM,kBAAkB,MAAM,uBAAuB,KAAK,MAAM,WAAW,OAClF,2FACA,2DAA2D,MAAM,8BACjE,2FACA,yFACA,0FACA,yFACA,0FACA,oCACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAeI,IAAM,cAAc,CAAC,UAC1B,OACE,MAAM,QACN,aACA,MACM,0BAAkB,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK,CAAC,CAChE;;;AFvEK,IAAM,iBAAiB,WAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAEM,IAAM,yBAAyB,MAC3B,kBACP,gBACO,iBACL,eAAe,SAAS,GAAG;AAAA,EAGzB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAM7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,UAAS,IAAI,IAAI,eAAe,IAAI,CACpE;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAMvB,OAAO,UACL,sBAAsB,IAAI,GAC1B,QAAO,aAAW,IAAI,CAAC,GACvB,WAAW,SACb;AAAA,IACA,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IACvC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,mBAAmB,GAAG,KAAK,QAAQ,KAAK,MAAM;AAAA,MACvE,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IAOA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,UAAU,sBAAsB,IAAI,GAAG,QAAO,aAAW,IAAI,CAAC,GAAG,IAAI;AAAA,MAC5E,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAIA,OAAO,EAAE,QAAQ,OAAO;AAAA,GACzB;AAAA,EAUD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,OAAO,OAAO,YAAW,MAAM,CAAC,UAC9B,UAAS,KAAK,EAAE,KAAY,aAAI,eAAc,CAAC,CACjD;AAAA,GACD;AAAA,EACD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,YAAY,IAAI;AAAA,GACxB;AACH,CAAC,CACH,CACF;",
+  "debugId": "ECA89AEF81AD3AD164756E2164756E21",
   "names": []
 }