@homeflare/alchemy 0.41.0 → 0.43.0

package/dist/proxmox/index.js.map

@@ -1,8 +1,8 @@
 {
   "version": 3,
-  "sources": ["../src/proxmox/acl.ts", "../src/proxmox/constraint-guard.ts", "../src/proxmox/constraints.ts", "../src/proxmox/generated/constraints/pve-access.ts", "../src/proxmox/generated/constraints/pve-cluster-backup.ts", "../src/proxmox/generated/constraints/pve-cluster-ceph.ts", "../src/proxmox/generated/constraints/pve-cluster-firewall.ts", "../src/proxmox/generated/constraints/pve-cluster-ha.ts", "../src/proxmox/generated/constraints/pve-cluster-metrics.ts", "../src/proxmox/generated/constraints/pve-cluster-notifications.ts", "../src/proxmox/generated/constraints/pve-cluster-replication.ts", "../src/proxmox/generated/constraints/pve-cluster-sdn.ts", "../src/proxmox/generated/constraints/pve-nodes-ceph.ts", "../src/proxmox/generated/constraints/pve-nodes-disks.ts", "../src/proxmox/generated/constraints/pve-nodes-lxc.ts", "../src/proxmox/generated/constraints/pve-nodes-network.ts", "../src/proxmox/generated/constraints/pve-nodes-qemu.ts", "../src/proxmox/generated/constraints/pve-nodes-storage.ts", "../src/proxmox/generated/constraints/pve-pools.ts", "../src/proxmox/generated/constraints/pve-storage.ts", "../src/proxmox/generated/constraints/pbs-config.ts", "../src/proxmox/generated/constraints/index.ts", "../src/proxmox/acl-wire.ts", "../src/proxmox/distilled-pve.ts", "../src/proxmox/lease-cache.ts", "../src/proxmox/mint.ts", "../src/proxmox/credential-errors.ts", "../src/proxmox/members.ts", "../src/proxmox/unreadable-read.ts", "../src/proxmox/alertmanager-body.ts", "../src/proxmox/api-token.ts", "../src/proxmox/values.ts", "../src/proxmox/api-token-form.ts", "../src/proxmox/distilled-guard.ts", "../src/proxmox/backup-job.ts", "../src/proxmox/resource-guard.ts", "../src/proxmox/update-guard.ts", "../src/proxmox/backup-job-config.ts", "../src/proxmox/backup-job-distilled.ts", "../src/proxmox/ceph-daemon.ts", "../src/proxmox/ceph-daemon-form.ts", "../src/proxmox/ceph-daemon-wire.ts", "../src/proxmox/ceph-flag.ts", "../src/proxmox/resource.ts", "../src/proxmox/client.ts", "../src/proxmox/ceph-fs.ts", "../src/proxmox/ceph-fs-distilled.ts", "../src/proxmox/ceph-fs-wire.ts", "../src/proxmox/ceph-osd.ts", "../src/proxmox/ceph-osd-tree.ts", "../src/proxmox/ceph-osd-write.ts", "../src/proxmox/ceph-pool.ts", "../src/proxmox/ceph-pool-form.ts", "../src/proxmox/ceph-pool-settle.ts", "../src/proxmox/ceph-pool-wire.ts", "../src/proxmox/firewall-alias.ts", "../src/proxmox/firewall-alias-lifecycle.ts", "../src/proxmox/firewall-alias-form.ts", "../src/proxmox/firewall-alias-config.ts", "../src/proxmox/group.ts", "../src/proxmox/group-wire.ts", "../src/proxmox/ha-resource.ts", "../src/proxmox/ha-rule.ts", "../src/proxmox/ha-rule-form.ts", "../src/proxmox/lxc.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/ownership/probe.ts", "../src/proxmox/lxc-wire.ts", "../src/proxmox/lxc-props.ts", "../src/proxmox/lxc-volume.ts", "../src/proxmox/lxc-judge.ts", "../src/proxmox/lxc-create-form.ts", "../src/proxmox/lxc-identity.ts", "../src/proxmox/lxc-adoption.ts", "../src/ownership/adopting.ts", "../src/proxmox/lxc-lifecycle.ts", "../src/proxmox/lxc-errors.ts", "../src/proxmox/lxc-read.ts", "../src/proxmox/lxc-task.ts", "../src/proxmox/metric-server.ts", "../src/proxmox/metric-server-form.ts", "../src/proxmox/metric-server-otel.ts", "../src/proxmox/metric-server-config.ts", "../src/proxmox/metric-server-distilled.ts", "../src/proxmox/network-apply.ts", "../src/proxmox/network-apply-run.ts", "../src/proxmox/apply-endpoints.ts", "../src/proxmox/network-apply-read.ts", "../src/proxmox/node-network.ts", "../src/proxmox/node-network-form.ts", "../src/proxmox/node-network-wire.ts", "../src/proxmox/notification-matcher.ts", "../src/proxmox/notification-matcher-lifecycle.ts", "../src/proxmox/notification-matcher-form.ts", "../src/proxmox/notification-matcher-distilled.ts", "../src/proxmox/notification-sdk-input.ts", "../src/proxmox/notification-target.ts", "../src/proxmox/notification-target-lifecycle.ts", "../src/proxmox/notification-target-endpoint.ts", "../src/proxmox/notification-target-form.ts", "../src/proxmox/notification-target-spec.ts", "../src/proxmox/notification-target-distilled.ts", "../src/proxmox/pbs-datastore.ts", "../src/proxmox/pbs-datastore-lifecycle.ts", "../src/proxmox/pbs-datastore-form.ts", "../src/proxmox/pbs-datastore-wire.ts", "../src/proxmox/distilled-pbs.ts", "../src/proxmox/pbs-datastore-guard.ts", "../src/proxmox/pbs-datastore-endpoint.ts", "../src/proxmox/pbs-notification-matcher.ts", "../src/proxmox/pbs-notification-matcher-distilled.ts", "../src/proxmox/pbs-notification-input.ts", "../src/proxmox/pbs-notification-target.ts", "../src/proxmox/pbs-notification-target-lifecycle.ts", "../src/proxmox/pbs-notification-target-distilled.ts", "../src/proxmox/pbs-notification-target-wire.ts", "../src/secrets/write-only.ts", "../src/proxmox/pbs-notification-target-endpoint.ts", "../src/proxmox/credential-literals.ts", "../src/proxmox/pbs-notification-target-form.ts", "../src/proxmox/pbs-prune-job.ts", "../src/proxmox/pbs-prune-job-lifecycle.ts", "../src/proxmox/pbs-prune-job-form.ts", "../src/proxmox/pbs-prune-job-spec.ts", "../src/proxmox/pbs-prune-job-wire.ts", "../src/proxmox/pbs-sync-job.ts", "../src/proxmox/pbs-sync-job-lifecycle.ts", "../src/proxmox/pbs-sync-job-form.ts", "../src/proxmox/pbs-sync-job-wire.ts", "../src/proxmox/pbs-verify-job.ts", "../src/proxmox/pbs-verify-job-lifecycle.ts", "../src/proxmox/pbs-verify-job-form.ts", "../src/proxmox/pbs-verify-job-spec.ts", "../src/proxmox/pbs-verify-job-wire.ts", "../src/proxmox/pool.ts", "../src/proxmox/provision-baseline.ts", "../src/proxmox/provision-bootstrap.ts", "../src/proxmox/provision-declare.ts", "../src/proxmox/role.ts", "../src/proxmox/role-wire.ts", "../src/proxmox/user.ts", "../src/proxmox/user-wire.ts", "../src/proxmox/qemu.ts", "../src/proxmox/qemu-lifecycle.ts", "../src/proxmox/qemu-props.ts", "../src/proxmox/qemu-form.ts", "../src/proxmox/qemu-errors.ts", "../src/proxmox/qemu-volume.ts", "../src/proxmox/qemu-net.ts", "../src/proxmox/qemu-judge.ts", "../src/proxmox/qemu-read.ts", "../src/proxmox/qemu-task.ts", "../src/proxmox/storage-download.ts", "../src/proxmox/storage-download-lifecycle.ts", "../src/proxmox/storage-download-identity.ts", "../src/proxmox/storage-download-errors.ts", "../src/proxmox/storage-download-task.ts", "../src/proxmox/replication-job.ts", "../src/proxmox/replication-job-lifecycle.ts", "../src/proxmox/replication-job-form.ts", "../src/proxmox/replication-job-config.ts", "../src/proxmox/sdn-apply.ts", "../src/proxmox/sdn-apply-read.ts", "../src/proxmox/sdn-subnet.ts", "../src/proxmox/sdn-subnet-form.ts", "../src/proxmox/sdn-vnet.ts", "../src/proxmox/sdn-zone.ts", "../src/proxmox/storage.ts", "../src/proxmox/storage-plugin-options.ts", "../src/proxmox/storage-wire.ts", "../src/proxmox/storage-form.ts", "../src/proxmox/zfs-pool.ts", "../src/proxmox/zfs-pool-wire.ts", "../src/proxmox/zfs-pool-form.ts"],
+  "sources": ["../src/proxmox/acl.ts", "../src/proxmox/constraint-guard.ts", "../src/proxmox/constraints.ts", "../src/proxmox/generated/constraints/pve-access.ts", "../src/proxmox/generated/constraints/pve-cluster-backup.ts", "../src/proxmox/generated/constraints/pve-cluster-ceph.ts", "../src/proxmox/generated/constraints/pve-cluster-firewall.ts", "../src/proxmox/generated/constraints/pve-cluster-ha.ts", "../src/proxmox/generated/constraints/pve-cluster-metrics.ts", "../src/proxmox/generated/constraints/pve-cluster-notifications.ts", "../src/proxmox/generated/constraints/pve-cluster-replication.ts", "../src/proxmox/generated/constraints/pve-cluster-sdn.ts", "../src/proxmox/generated/constraints/pve-nodes-ceph.ts", "../src/proxmox/generated/constraints/pve-nodes-disks.ts", "../src/proxmox/generated/constraints/pve-nodes-lxc.ts", "../src/proxmox/generated/constraints/pve-nodes-network.ts", "../src/proxmox/generated/constraints/pve-nodes-qemu.ts", "../src/proxmox/generated/constraints/pve-nodes-storage.ts", "../src/proxmox/generated/constraints/pve-pools.ts", "../src/proxmox/generated/constraints/pve-storage.ts", "../src/proxmox/generated/constraints/pbs-config.ts", "../src/proxmox/generated/constraints/index.ts", "../src/proxmox/acl-wire.ts", "../src/proxmox/distilled-pve.ts", "../src/proxmox/lease-cache.ts", "../src/proxmox/credentials.ts", "../src/proxmox/mint.ts", "../src/proxmox/credential-errors.ts", "../src/proxmox/members.ts", "../src/proxmox/unreadable-read.ts", "../src/proxmox/alertmanager-body.ts", "../src/proxmox/api-token.ts", "../src/proxmox/values.ts", "../src/proxmox/api-token-form.ts", "../src/proxmox/distilled-guard.ts", "../src/proxmox/backup-job.ts", "../src/proxmox/resource-guard.ts", "../src/proxmox/update-guard.ts", "../src/proxmox/backup-job-config.ts", "../src/proxmox/backup-job-distilled.ts", "../src/proxmox/ceph-daemon.ts", "../src/proxmox/ceph-daemon-form.ts", "../src/proxmox/ceph-daemon-wire.ts", "../src/proxmox/ceph-flag.ts", "../src/proxmox/ceph-flag-wire.ts", "../src/proxmox/ceph-fs.ts", "../src/proxmox/ceph-fs-distilled.ts", "../src/proxmox/ceph-fs-wire.ts", "../src/proxmox/ceph-osd.ts", "../src/proxmox/ceph-osd-tree.ts", "../src/proxmox/ceph-osd-write.ts", "../src/proxmox/ceph-pool.ts", "../src/proxmox/ceph-pool-form.ts", "../src/proxmox/ceph-pool-settle.ts", "../src/proxmox/ceph-pool-wire.ts", "../src/proxmox/firewall-alias.ts", "../src/proxmox/firewall-alias-lifecycle.ts", "../src/proxmox/firewall-alias-form.ts", "../src/proxmox/firewall-alias-config.ts", "../src/proxmox/group.ts", "../src/proxmox/group-wire.ts", "../src/proxmox/ha-resource.ts", "../src/proxmox/resource.ts", "../src/proxmox/client.ts", "../src/proxmox/ha-rule.ts", "../src/proxmox/ha-rule-form.ts", "../src/proxmox/lxc.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/ownership/probe.ts", "../src/proxmox/lxc-wire.ts", "../src/proxmox/lxc-props.ts", "../src/proxmox/lxc-volume.ts", "../src/proxmox/lxc-judge.ts", "../src/proxmox/lxc-create-form.ts", "../src/proxmox/lxc-identity.ts", "../src/proxmox/lxc-adoption.ts", "../src/ownership/adopting.ts", "../src/proxmox/lxc-lifecycle.ts", "../src/proxmox/lxc-errors.ts", "../src/proxmox/lxc-read.ts", "../src/proxmox/lxc-task.ts", "../src/proxmox/metric-server.ts", "../src/proxmox/metric-server-form.ts", "../src/proxmox/metric-server-otel.ts", "../src/proxmox/metric-server-config.ts", "../src/proxmox/metric-server-distilled.ts", "../src/proxmox/network-apply.ts", "../src/proxmox/network-apply-run.ts", "../src/proxmox/apply-endpoints.ts", "../src/proxmox/network-apply-read.ts", "../src/proxmox/node-network.ts", "../src/proxmox/node-network-form.ts", "../src/proxmox/node-network-wire.ts", "../src/proxmox/notification-matcher.ts", "../src/proxmox/notification-matcher-lifecycle.ts", "../src/proxmox/notification-matcher-form.ts", "../src/proxmox/notification-matcher-distilled.ts", "../src/proxmox/notification-sdk-input.ts", "../src/proxmox/notification-target.ts", "../src/proxmox/notification-target-lifecycle.ts", "../src/proxmox/notification-target-endpoint.ts", "../src/proxmox/notification-target-form.ts", "../src/proxmox/notification-target-spec.ts", "../src/proxmox/notification-target-distilled.ts", "../src/proxmox/pbs-datastore.ts", "../src/proxmox/pbs-datastore-lifecycle.ts", "../src/proxmox/pbs-datastore-form.ts", "../src/proxmox/pbs-datastore-wire.ts", "../src/proxmox/distilled-pbs.ts", "../src/proxmox/pbs-datastore-guard.ts", "../src/proxmox/pbs-datastore-endpoint.ts", "../src/proxmox/pbs-notification-matcher.ts", "../src/proxmox/pbs-notification-matcher-distilled.ts", "../src/proxmox/pbs-notification-input.ts", "../src/proxmox/pbs-notification-target.ts", "../src/proxmox/pbs-notification-target-lifecycle.ts", "../src/proxmox/pbs-notification-target-distilled.ts", "../src/proxmox/pbs-notification-target-wire.ts", "../src/secrets/write-only.ts", "../src/proxmox/pbs-notification-target-endpoint.ts", "../src/proxmox/credential-literals.ts", "../src/proxmox/pbs-notification-target-form.ts", "../src/proxmox/pbs-prune-job.ts", "../src/proxmox/pbs-prune-job-lifecycle.ts", "../src/proxmox/pbs-prune-job-form.ts", "../src/proxmox/pbs-prune-job-spec.ts", "../src/proxmox/pbs-prune-job-wire.ts", "../src/proxmox/pbs-sync-job.ts", "../src/proxmox/pbs-sync-job-lifecycle.ts", "../src/proxmox/pbs-sync-job-form.ts", "../src/proxmox/pbs-sync-job-wire.ts", "../src/proxmox/pbs-verify-job.ts", "../src/proxmox/pbs-verify-job-lifecycle.ts", "../src/proxmox/pbs-verify-job-form.ts", "../src/proxmox/pbs-verify-job-spec.ts", "../src/proxmox/pbs-verify-job-wire.ts", "../src/proxmox/pool.ts", "../src/proxmox/provision-baseline.ts", "../src/proxmox/provision-bootstrap.ts", "../src/proxmox/provision-declare.ts", "../src/proxmox/role.ts", "../src/proxmox/role-wire.ts", "../src/proxmox/user.ts", "../src/proxmox/user-wire.ts", "../src/proxmox/qemu.ts", "../src/proxmox/qemu-lifecycle.ts", "../src/proxmox/qemu-props.ts", "../src/proxmox/qemu-form.ts", "../src/proxmox/qemu-errors.ts", "../src/proxmox/qemu-volume.ts", "../src/proxmox/qemu-net.ts", "../src/proxmox/qemu-judge.ts", "../src/proxmox/qemu-read.ts", "../src/proxmox/qemu-task.ts", "../src/proxmox/storage-download.ts", "../src/proxmox/storage-download-lifecycle.ts", "../src/proxmox/storage-download-identity.ts", "../src/proxmox/storage-download-errors.ts", "../src/proxmox/storage-download-task.ts", "../src/proxmox/replication-job.ts", "../src/proxmox/replication-job-lifecycle.ts", "../src/proxmox/replication-job-form.ts", "../src/proxmox/replication-job-config.ts", "../src/proxmox/sdn-apply.ts", "../src/proxmox/sdn-apply-read.ts", "../src/proxmox/sdn-subnet.ts", "../src/proxmox/sdn-subnet-form.ts", "../src/proxmox/sdn-vnet.ts", "../src/proxmox/sdn-zone.ts", "../src/proxmox/storage.ts", "../src/proxmox/storage-plugin-options.ts", "../src/proxmox/storage-wire.ts", "../src/proxmox/storage-form.ts", "../src/proxmox/zfs-pool.ts", "../src/proxmox/zfs-pool-wire.ts", "../src/proxmox/zfs-pool-form.ts"],
   "sourcesContent": [
-    "/**\n * `Proxmox.Acl` — one grant: a role bound to a subject at a path. The line that makes a role real.\n *\n * ★ USERS, GROUPS, ROLES AND TOKENS ARE ALL INERT UNTIL AN ACL BINDS THEM. A role is a named list\n *   of privileges that grants nothing by itself; a user can do nothing until\n *   {path, user|group|token, role} exists. That is what makes those four families worth declaring,\n *   and why the grants that let OpenBao mint a PVE token today are only clicks somebody made once.\n *\n * ⛔ THE ONE FAMILY THAT DOES NOT FIT A GENERIC PATH+FORM SHAPE, AND THE MISFIT IS MEASURED. The\n *   cluster's own schema — `/pve-docs/api-viewer/apidoc.js`, read unauthenticated 2026-09-13 —\n *   lists exactly TWO methods on `/access/acl`: GET and PUT. There is no DELETE (it answers\n *   \"Method 'DELETE /access/acl' not implemented\") and, less famously, NO POST either — which is\n *   why `@distilled.cloud/proxmox`'s generator, reading the same schema, emits `listAccessAcl` and\n *   `putAccessAcl` and NOTHING ELSE for this path. So create and update are the SAME call, `PUT\n *   /access/acl`, and removal is that PUT with `delete=1` — there is no `destroyAccessAcl` to call.\n *\n * ⛔ A SINGLE GRANT HAS NO URL OF ITS OWN. `GET /access/acl` answers ONE FLAT LIST for the whole\n *   cluster, so identity is the tuple (path, type, ugid, roleid), matched client-side in `find`\n *   below. Two resources declaring the SAME tuple are the SAME grant — Alchemy sees two resource\n *   ids, not one collision — and deleting either takes the access away from both, the same hazard\n *   as two guests declaring one vmid.\n *\n * ⛔ AND THAT LIST IS FILTERED BY WHO IS ASKING. The schema's own words for GET: \"The returned list\n *   is restricted to objects where you have rights to modify permissions.\" A credential that can\n *   read the cluster but not modify permissions is answered `[]` — not a 403, not an error — so\n *   the mount's `read` role needs permission-modify rights on the declared path exactly as\n *   `provision` does (below, `listAcl` reads with the `provision` role for this reason). Work\n *   reported on a grant that is plainly there means that role is too narrow.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()` ONTO `@distilled.cloud/proxmox`'s typed\n *   `access.listAccessAcl`/`access.putAccessAcl` (2026-09-23, decision 43's proxmox walk-down,\n *   the sub-area's first resource — ACL was already the misfit `pveOperations` could not cover\n *   cleanly, which is exactly why it goes first). `distilled-pve.ts`'s `runPve` replaces `pve()`:\n *   same lease reuse (lease-cache.ts), same cluster-member failover (members.ts), now handing the\n *   request itself to the SDK instead of a hand-assembled `HttpClientRequest`.\n *   ⛔ ONE DEAD BRANCH REMOVED, NOT PRESERVED: the old code's generic factory POSTed on a \"live\n *     undefined\" read, which its own header called unreachable on a healthy cluster and\n *     documented as MISLEADING — PVE has no POST here, so that 501 said nothing about the real\n *     failure. `@distilled.cloud/proxmox` has no `createAccessAcl` at all (the vendor schema has\n *     no POST to generate one from), so there is nothing to call that way. `reconcile` below\n *     always PUTs instead — the only write PVE actually implements for this path — so a read that\n *     genuinely failed now surfaces its REAL cause (a typed error, or `PveClusterExhausted`)\n *     rather than a confusing 501 from a verb that was never there.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as access from '@distilled.cloud/proxmox/access';\nimport * as Effect from 'effect/Effect';\nimport { attributesOf, bind, guardWrite, identity, matches, tuple } from './acl-wire.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport {\n  UNREADABLE,\n  type Unreadable,\n  readOrUnreadable,\n  unreadableWarning,\n} from './unreadable-read.ts';\n\n/** PVE's three kinds of subject. The read answers this word; the write wants its plural. */\nexport type AclSubjectType = 'user' | 'group' | 'token';\n\nexport interface AclProps extends WithTarget {\n  /**\n   * The PVE object path the grant is ON — `/`, `/pool/lab`, `/vms/101`, `/storage/local-zfs`.\n   * ⚠️ NOT THE API PATH — the endpoint is fixed (`access/acl`). PVE's API overloads the word,\n   *   so this file does too rather than renaming a field the cluster calls `path`.\n   */\n  path: string;\n  /** Which kind of subject `ugid` names. Identity: changing it is a different grant. */\n  type: AclSubjectType;\n  /** `alice@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */\n  ugid: string;\n  /** The role bound here, e.g. `PVEAuditor`. ⚠️ It must exist — PVE refuses an unknown roleid. */\n  roleid: string;\n  /** Inherit down the path. PVE's default is ON, and this is the grant's ONLY mutable field. */\n  propagate?: boolean;\n}\n\nexport interface AclAttributes {\n  path: string;\n  type: AclSubjectType;\n  ugid: string;\n  roleid: string;\n  propagate: boolean;\n  /** Presence, so a PUT-only family can tell \"matches\" from \"does not exist yet\" — see below. */\n  bound: boolean;\n}\n\nexport interface ProxmoxAcl extends Resource<\n  'Proxmox.Acl',\n  AclProps,\n  AclAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxAcl = Resource<ProxmoxAcl>('Proxmox.Acl');\n\n/**\n * ⛔ `readRole: 'provision'`, WITHOUT WHICH EVERY GRANT READS BACK AS ABSENT — see the header's\n *   ⛔ on filtering.\n * ★ `readOrUnreadable` (unreadable-read.ts) runs first: a REFUSED mint of `provision` — the\n *   \"cries wolf\" bug — comes back `UNREADABLE` instead of the `undefined` a genuine, SUCCESSFUL\n *   read (the row simply not being in the list) produces, so `diff` below can tell them apart.\n * ⛔ NO `orElseSucceed` HERE ANY MORE — found on 2026-09-24, the SAME bug class as the credential\n *   denial: it used to fold EVERY OTHER failure (a transport error, `PveClusterExhausted`, a\n *   decode failure) into `undefined` too, which then read exactly like a genuine absence and\n *   forced the same false `update`. Only a read that actually SUCCEEDS (and the grant is not in\n *   the list it returns) may mean absent now; every other failure propagates and fails the whole\n *   plan loudly — the engine's own contract for a failed `read`/`diff` (verify.ts's `readWithState`\n *   already expects and reports it as `'failed'`).\n */\nconst readAttributes = (props: AclProps) =>\n  readOrUnreadable(runPve(props.target, 'provision', false, access.listAccessAcl({}))).pipe(\n    Effect.map((rows) => (rows === UNREADABLE ? UNREADABLE : attributesOf(rows, props))),\n  );\n\n/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */\nconst dropUnreadable = (live: AclAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n\nexport const ProxmoxAclProvider = () =>\n  Provider.effect(\n    ProxmoxAcl,\n    Effect.succeed(\n      ProxmoxAcl.Provider.of({\n        /** ⛔ EMPTY LIKE EVERY OTHER PVE RESOURCE. Adopting every grant a human ever clicked is not adoption. */\n        list: () => Effect.succeed([]),\n        read: Effect.fn(function* ({ olds }) {\n          return dropUnreadable(yield* readAttributes(olds));\n        }),\n        /**\n         * ⛔ AN IDENTITY CHANGE IS A REPLACE. Editing `roleid` (or the subject, or the path) would\n         *   PUT the NEW grant and LEAVE THE OLD ONE BOUND; replace makes Alchemy `delete` the old\n         *   props first, the only thing that removes it. Create-first (Alchemy's default) is\n         *   deliberate: delete-first could remove the very grant the provision credential mints\n         *   against.\n         */\n        diff: Effect.fn(function* ({ news, output }) {\n          if (output !== undefined && isResolved(news) && identity(news) !== identity(output)) {\n            return { action: 'replace' } as const;\n          }\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(news);\n          if (output === undefined) return undefined;\n          const live = yield* readAttributes(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and\n          //   force `update` on a grant that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning('Proxmox.Acl', identity(news));\n            return { action: 'noop' } as const;\n          }\n          return live !== undefined && matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        /**\n         * ⚠️ THE READ-BACK GUARD, FOR A FAMILY WHOSE \"ABSENT\" IS `bound: false`, NOT `undefined`.\n         *   PVE answers 200 with `{\"data\":null}` on calls that did nothing: without this, a PUT\n         *   that silently no-oped is recorded as a landed grant and the next plan reads noop over\n         *   the gap.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the\n          //   write below, so `UNREADABLE` here is a near-impossible race, not the routine case\n          //   `diff` handles — treating it as \"not yet bound\" costs at most one redundant PUT.\n          const before = dropUnreadable(yield* readAttributes(news));\n          yield* guardWrite(news);\n          if (before === undefined || !matches(before, news)) {\n            yield* runPve(news.target, 'provision', true, access.putAccessAcl(bind(news)));\n          }\n          const after = dropUnreadable(yield* readAttributes(news));\n          if (after === undefined || !after.bound) {\n            return yield* Effect.die(\n              new Error(\n                `access/acl: the write returned no error but ${identity(news)} is still not ` +\n                  'bound. Either the PUT did nothing, or the read credential cannot see the ' +\n                  'grant -- GET /access/acl is filtered to paths you may MODIFY permissions on, ' +\n                  'so a read-only role is answered [] rather than 403.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ NOT A DESTROY CALL — THERE IS NONE. `DELETE /access/acl` is not implemented; removal\n         *   is the same PUT with `delete=1` and the identity tuple, no `propagate`, because\n         *   removal is keyed on the tuple and nothing else.\n         * ⚠️ IDEMPOTENT, AND CLUSTER-WIDE: removing a grant that is already gone is a no-op, but\n         *   the tuple is shared — re-read the header's second ⛔ before assuming this only takes\n         *   away what this stack declared.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          const removal: access.PutAccessAclRequest = { ...tuple(olds), delete: '1' };\n          yield* runPve(olds.target, 'provision', true, access.putAccessAcl(removal));\n        }),\n      }),\n    ),\n  );\n",
+    "/**\n * `Proxmox.Acl` — one grant: a role bound to a subject at a path. The line that makes a role real.\n *\n * ★ USERS, GROUPS, ROLES AND TOKENS ARE ALL INERT UNTIL AN ACL BINDS THEM. A role is a named list\n *   of privileges that grants nothing by itself; a user can do nothing until\n *   {path, user|group|token, role} exists. That is what makes those four families worth declaring,\n *   and why the grants that let OpenBao mint a PVE token today are only clicks somebody made once.\n *\n * ⛔ THE ONE FAMILY THAT DOES NOT FIT A GENERIC PATH+FORM SHAPE, AND THE MISFIT IS MEASURED. The\n *   cluster's own schema — `/pve-docs/api-viewer/apidoc.js`, read unauthenticated 2026-09-13 —\n *   lists exactly TWO methods on `/access/acl`: GET and PUT. There is no DELETE (it answers\n *   \"Method 'DELETE /access/acl' not implemented\") and, less famously, NO POST either — which is\n *   why `@distilled.cloud/proxmox`'s generator, reading the same schema, emits `listAccessAcl` and\n *   `putAccessAcl` and NOTHING ELSE for this path. So create and update are the SAME call, `PUT\n *   /access/acl`, and removal is that PUT with `delete=1` — there is no `destroyAccessAcl` to call.\n *\n * ⛔ A SINGLE GRANT HAS NO URL OF ITS OWN. `GET /access/acl` answers ONE FLAT LIST for the whole\n *   cluster, so identity is the tuple (path, type, ugid, roleid), matched client-side in `find`\n *   below. Two resources declaring the SAME tuple are the SAME grant — Alchemy sees two resource\n *   ids, not one collision — and deleting either takes the access away from both, the same hazard\n *   as two guests declaring one vmid.\n *\n * ⛔ AND THAT LIST IS FILTERED BY WHO IS ASKING. The schema's own words for GET: \"The returned list\n *   is restricted to objects where you have rights to modify permissions.\" A credential that can\n *   read the cluster but not modify permissions is answered `[]` — not a 403, not an error — so\n *   the mount's `read` role needs permission-modify rights on the declared path exactly as\n *   `provision` does (below, `listAcl` reads with the `provision` role for this reason). Work\n *   reported on a grant that is plainly there means that role is too narrow.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()` ONTO `@distilled.cloud/proxmox`'s typed\n *   `access.listAccessAcl`/`access.putAccessAcl` (2026-09-23, decision 43's proxmox walk-down,\n *   the sub-area's first resource — ACL was already the misfit `pveOperations` could not cover\n *   cleanly, which is exactly why it goes first). `distilled-pve.ts`'s `runPve` replaces `pve()`:\n *   same lease reuse (lease-cache.ts), same cluster-member failover (members.ts), now handing the\n *   request itself to the SDK instead of a hand-assembled `HttpClientRequest`.\n *   ⛔ ONE DEAD BRANCH REMOVED, NOT PRESERVED: the old code's generic factory POSTed on a \"live\n *     undefined\" read, which its own header called unreachable on a healthy cluster and\n *     documented as MISLEADING — PVE has no POST here, so that 501 said nothing about the real\n *     failure. `@distilled.cloud/proxmox` has no `createAccessAcl` at all (the vendor schema has\n *     no POST to generate one from), so there is nothing to call that way. `reconcile` below\n *     always PUTs instead — the only write PVE actually implements for this path — so a read that\n *     genuinely failed now surfaces its REAL cause (a typed error, or `PveClusterExhausted`)\n *     rather than a confusing 501 from a verb that was never there.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as access from '@distilled.cloud/proxmox/access';\nimport * as Effect from 'effect/Effect';\nimport { attributesOf, bind, guardWrite, identity, matches, tuple } from './acl-wire.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { mintTier } from './credentials.ts';\nimport {\n  UNREADABLE,\n  type Unreadable,\n  readOrUnreadable,\n  unreadableWarning,\n} from './unreadable-read.ts';\n\n/** PVE's three kinds of subject. The read answers this word; the write wants its plural. */\nexport type AclSubjectType = 'user' | 'group' | 'token';\n\nexport interface AclProps extends WithTarget {\n  /**\n   * The PVE object path the grant is ON — `/`, `/pool/lab`, `/vms/101`, `/storage/local-zfs`.\n   * ⚠️ NOT THE API PATH — the endpoint is fixed (`access/acl`). PVE's API overloads the word,\n   *   so this file does too rather than renaming a field the cluster calls `path`.\n   */\n  path: string;\n  /** Which kind of subject `ugid` names. Identity: changing it is a different grant. */\n  type: AclSubjectType;\n  /** `alice@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */\n  ugid: string;\n  /** The role bound here, e.g. `PVEAuditor`. ⚠️ It must exist — PVE refuses an unknown roleid. */\n  roleid: string;\n  /** Inherit down the path. PVE's default is ON, and this is the grant's ONLY mutable field. */\n  propagate?: boolean;\n}\n\nexport interface AclAttributes {\n  path: string;\n  type: AclSubjectType;\n  ugid: string;\n  roleid: string;\n  propagate: boolean;\n  /** Presence, so a PUT-only family can tell \"matches\" from \"does not exist yet\" — see below. */\n  bound: boolean;\n}\n\nexport interface ProxmoxAcl extends Resource<\n  'Proxmox.Acl',\n  AclProps,\n  AclAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxAcl = Resource<ProxmoxAcl>('Proxmox.Acl');\n\n/**\n * ⛔ `readRole: 'provision'`, WITHOUT WHICH EVERY GRANT READS BACK AS ABSENT — see the header's\n *   ⛔ on filtering.\n * ★ `readOrUnreadable` (unreadable-read.ts) runs first: a REFUSED mint of `provision` — the\n *   \"cries wolf\" bug — comes back `UNREADABLE` instead of the `undefined` a genuine, SUCCESSFUL\n *   read (the row simply not being in the list) produces, so `diff` below can tell them apart.\n * ⛔ NO `orElseSucceed` HERE ANY MORE — found on 2026-09-24, the SAME bug class as the credential\n *   denial: it used to fold EVERY OTHER failure (a transport error, `PveClusterExhausted`, a\n *   decode failure) into `undefined` too, which then read exactly like a genuine absence and\n *   forced the same false `update`. Only a read that actually SUCCEEDS (and the grant is not in\n *   the list it returns) may mean absent now; every other failure propagates and fails the whole\n *   plan loudly — the engine's own contract for a failed `read`/`diff` (verify.ts's `readWithState`\n *   already expects and reports it as `'failed'`).\n */\nconst readAttributes = (props: AclProps) =>\n  readOrUnreadable(runPve(props.target, 'provision', false, access.listAccessAcl({}))).pipe(\n    Effect.map((rows) => (rows === UNREADABLE ? UNREADABLE : attributesOf(rows, props))),\n  );\n\n/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */\nconst dropUnreadable = (live: AclAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n\nexport const ProxmoxAclProvider = () =>\n  Provider.effect(\n    ProxmoxAcl,\n    Effect.succeed(\n      ProxmoxAcl.Provider.of({\n        /** ⛔ EMPTY LIKE EVERY OTHER PVE RESOURCE. Adopting every grant a human ever clicked is not adoption. */\n        list: () => Effect.succeed([]),\n        read: Effect.fn(function* ({ olds }) {\n          return dropUnreadable(yield* readAttributes(olds));\n        }),\n        /**\n         * ⛔ AN IDENTITY CHANGE IS A REPLACE. Editing `roleid` (or the subject, or the path) would\n         *   PUT the NEW grant and LEAVE THE OLD ONE BOUND; replace makes Alchemy `delete` the old\n         *   props first, the only thing that removes it. Create-first (Alchemy's default) is\n         *   deliberate: delete-first could remove the very grant the provision credential mints\n         *   against.\n         */\n        diff: Effect.fn(function* ({ news, output }) {\n          if (output !== undefined && isResolved(news) && identity(news) !== identity(output)) {\n            return { action: 'replace' } as const;\n          }\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(news);\n          if (output === undefined) return undefined;\n          const live = yield* readAttributes(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and\n          //   force `update` on a grant that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning(\n              'Proxmox.Acl',\n              identity(news),\n              news.target.mount,\n              mintTier(news.target, 'provision'),\n            );\n            return { action: 'noop' } as const;\n          }\n          return live !== undefined && matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        /**\n         * ⚠️ THE READ-BACK GUARD, FOR A FAMILY WHOSE \"ABSENT\" IS `bound: false`, NOT `undefined`.\n         *   PVE answers 200 with `{\"data\":null}` on calls that did nothing: without this, a PUT\n         *   that silently no-oped is recorded as a landed grant and the next plan reads noop over\n         *   the gap.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the\n          //   write below, so `UNREADABLE` here is a near-impossible race, not the routine case\n          //   `diff` handles — treating it as \"not yet bound\" costs at most one redundant PUT.\n          const before = dropUnreadable(yield* readAttributes(news));\n          yield* guardWrite(news);\n          if (before === undefined || !matches(before, news)) {\n            yield* runPve(news.target, 'provision', true, access.putAccessAcl(bind(news)));\n          }\n          const after = dropUnreadable(yield* readAttributes(news));\n          if (after === undefined || !after.bound) {\n            return yield* Effect.die(\n              new Error(\n                `access/acl: the write returned no error but ${identity(news)} is still not ` +\n                  'bound. Either the PUT did nothing, or the read credential cannot see the ' +\n                  'grant -- GET /access/acl is filtered to paths you may MODIFY permissions on, ' +\n                  'so a read-only role is answered [] rather than 403.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ NOT A DESTROY CALL — THERE IS NONE. `DELETE /access/acl` is not implemented; removal\n         *   is the same PUT with `delete=1` and the identity tuple, no `propagate`, because\n         *   removal is keyed on the tuple and nothing else.\n         * ⚠️ IDEMPOTENT, AND CLUSTER-WIDE: removing a grant that is already gone is a no-op, but\n         *   the tuple is shared — re-read the header's second ⛔ before assuming this only takes\n         *   away what this stack declared.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          const removal: access.PutAccessAclRequest = { ...tuple(olds), delete: '1' };\n          yield* runPve(olds.target, 'provision', true, access.putAccessAcl(removal));\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * The generated tables, looked up by endpoint, and the refusal that stops a plan.\n *\n * ★ ONE FILE BETWEEN THE PROVIDERS AND THE GENERATED DATA, so `resource.ts` gains three lines\n *   rather than an import of two generated modules and a merge, and so a family that writes its\n *   own handlers (CephPool, PbsDatastore) reaches the same check by the same name.\n *\n * ⛔ AN UNKNOWN KEY IS A DEFECT, NOT A REASON TO SKIP THE CHECK. Silently passing would put us back\n *   where this started: a declaration nothing checked, and a plan that says so in no way at all.\n *   The generator resolves every key in its source scan against the vendor schema, so a key that\n *   is absent here means the tables were not regenerated — which the message says.\n */\nimport * as Effect from 'effect/Effect';\nimport type { PveForm } from './client.ts';\nimport { type EndpointConstraints, type EndpointKey, refusal, violations } from './constraints.ts';\nimport { PROXMOX_CONSTRAINTS } from './generated/constraints/index.ts';\n\nexport { PROXMOX_CONSTRAINTS };\n\nexport const constraintsFor = (key: EndpointKey): EndpointConstraints => {\n  const table = PROXMOX_CONSTRAINTS[key];\n  if (table === undefined) {\n    throw new Error(\n      `no vendor constraint table for '${key}'. It is named in this package but not generated: ` +\n        'run `bun codegen/constraints.ts` (see codegen/README.md).',\n    );\n  }\n  return table;\n};\n\n/** Every vendor rule this form breaks. Pure — a test calls it with a literal form. */\nexport const formViolations = (\n  key: EndpointKey,\n  form: PveForm,\n  presence: boolean,\n): readonly string[] => violations(constraintsFor(key), form, { presence });\n\n/**\n * ⛔ `Effect.die`, NOT `Effect.fail`. A declaration the vendor would reject is a DEFECT in the\n *   stack file, not a recoverable condition: there is no retry and no fallback that makes a\n *   129-character comment legal. The same call that refuses a write-back with no read-back\n *   (resource.ts) dies for the same reason.\n */\nexport const guardForm = (\n  key: EndpointKey | undefined,\n  form: PveForm,\n  presence: boolean,\n): Effect.Effect<void> =>\n  Effect.suspend(() => {\n    if (key === undefined) return Effect.void;\n    const found = formViolations(key, form, presence);\n    return found.length === 0 ? Effect.void : Effect.die(new Error(refusal(key, found)));\n  });\n",
     "/**\n * The vendor's own rules, checked here, before the request is built.\n *\n * 🔴 THE INCIDENT THIS EXISTS FOR, 2026-09-22. `homeflare-proxmox`'s first `deploy:pbs` adopted ten\n *   objects and then failed its one create: `PVE POST config/verify -> 400: parameter verification\n *   failed - comment: value may only be 128 characters long`. Half a deploy in, on the server, from\n *   a limit PBS publishes in its own schema and the generated `comment?: string` does not carry.\n *   Plan was green. `bun run check` was green. `hf-adopt-verify` was green — its offline fake serves\n *   a fixture and refuses anything but GET, so a newly declared object's VALUES are never exercised.\n *\n * ★ SO THE TABLE IS GENERATED AND THIS FILE IS THE READER. `generated/constraints/*` is emitted\n *   from the cluster's own `apidoc.js` by `bun codegen/constraints.ts`; nothing here is hand-typed,\n *   because a hand-typed limit is the tribal knowledge that was already in a doc comment and\n *   already did not run.\n *\n * ⛔ IT CHECKS THE FORM, NOT THE PROPS, AND THAT IS THE WHOLE POINT. The form is what goes on the\n *   wire: `String(props['max-depth'])`, `'0' | '1'` for a boolean, an omitted key for an undeclared\n *   field. A props-level check would pass values the form then mangles, and would have to be\n *   written once per family — which is how the copy that forgets a field gets written.\n *\n * ⚠️ WHAT IT DELIBERATELY DOES NOT ENFORCE, so nobody reads a green plan as more than it is. The\n *   full kind-by-kind table, with the counts measured over the 37 tabled endpoints, is in\n *   codegen/README.md. The short version:\n *   - a `format` NAME (PVE's `pve-calendar-event`, `pve-node`; 105 parameters here): the name is a\n *     validator PVE implements server-side and publishes nothing about. Recorded, never checked.\n *   - a `format` OBJECT — PBS's `notify`, `tuning`, `maintenance-mode`, PVE's `bwlimit`; 10\n *     parameters. It is a sub-schema for the inside of a PROPERTY STRING, and the packed keys\n *     carry their own limits. Not flattened, because a rule about `notify` is not a rule about\n *     `notify.gc`. ⛔ This is the largest remaining gap and it is a gap on purpose.\n *   - `requires` (8 parameters): \"this one needs that one\". A dependency, not a value rule.\n *   - `typetext` with nothing else, such as PBS `schedule`'s `<calendar-event>` (21 parameters).\n *     The schema states a syntax it does not describe; a malformed schedule still reaches PBS.\n *   - a pattern the generator could not translate faithfully (codegen/pattern.ts). Recorded\n *     verbatim as `patternSource`, never checked.\n *   Each of those is a fact in the table rather than a guess, which is the rule this follows:\n *   if the vendor did not state it, it is not enforced and the table says so.\n */\nimport type { PveForm } from './client.ts';\n\nexport interface ParamConstraint {\n  readonly type?: string;\n  /** From the vendor's `optional`. ⚠️ Checked on CREATE only — see `violations`. */\n  readonly required?: boolean;\n  readonly maxLength?: number;\n  readonly minLength?: number;\n  readonly minimum?: number;\n  readonly maximum?: number;\n  readonly enum?: readonly string[];\n  /**\n   * A JavaScript-safe EQUIVALENT. Absent when the vendor's dialect could not be carried over.\n   *\n   * ⛔ NOT THE VENDOR'S SPELLING, AND FOR PVE NOT EVEN THE SAME SHAPE. PVE publishes the inside of\n   *   an anchored match and applies `m/^$pattern$/` itself (MEASURED in JSONSchema.pm), so the\n   *   generator anchors it here. Quote `patternSource` at a human, never this.\n   */\n  readonly pattern?: string;\n  /** `m` when the vendor asked for multi-line. ⚠️ Dropping it enforces the wrong semantics. */\n  readonly patternFlags?: string;\n  /** The vendor's own spelling, always — what a violation message quotes, and the audit trail. */\n  readonly patternSource?: string;\n  /** PVE's server-side validator name. Recorded so a reader knows what is NOT checked here. */\n  readonly format?: string;\n  readonly default?: string;\n  /**\n   * The value rules describe each ELEMENT of a repeated key, not one joined string.\n   *\n   * ⚠️ RECORDED, NOT BRANCHED ON. `violations` already checks every element of an array value, so\n   *   this changes no behaviour — it tells a reader of the generated table why a `maxLength` of 32\n   *   sits on a parameter that carries a list.\n   */\n  readonly each?: true;\n}\n\nexport type EndpointConstraints = Readonly<Record<string, ParamConstraint>>;\n\n/** `POST /config/verify` — exactly how the generated tables key an endpoint. */\nexport type EndpointKey = string;\n\nexport interface ViolationOptions {\n  /**\n   * Check that every vendor-required parameter is present.\n   *\n   * ⛔ CREATE ONLY. An update form is deliberately PARTIAL — `formToSend` sends the fields that\n   *   changed and nothing else — so requiring presence there would refuse every ordinary edit.\n   */\n  readonly presence?: boolean;\n}\n\nconst lengthOf = (value: string): number => [...value].length;\n\n/**\n * ⚠️ `[...value].length`, NOT `value.length`. Proxmox counts characters; JavaScript counts UTF-16\n *   code units, so an emoji in a comment counts twice and a 128-character limit would refuse a\n *   comment PBS accepts. Rejecting a legal value at plan time is the one failure mode worse than\n *   the server 400 this replaces.\n */\nconst checkValue = (name: string, value: string, rule: ParamConstraint): string[] => {\n  const out: string[] = [];\n  if (rule.maxLength !== undefined && lengthOf(value) > rule.maxLength) {\n    out.push(`${name}: at most ${rule.maxLength} characters`);\n  }\n  if (rule.minLength !== undefined && lengthOf(value) < rule.minLength) {\n    out.push(`${name}: at least ${rule.minLength} characters`);\n  }\n  if (rule.enum !== undefined && !rule.enum.includes(value)) {\n    out.push(`${name}: must be one of ${rule.enum.join(', ')}`);\n  }\n  // ⚠️ `patternFlags` IS PASSED, NOT IGNORED. It carries the vendor's own `(?m)`; enforcing a\n  //   multi-line rule with single-line semantics refuses values the vendor accepts.\n  if (rule.pattern !== undefined && !new RegExp(rule.pattern, rule.patternFlags).test(value)) {\n    out.push(`${name}: must match ${rule.patternSource ?? rule.pattern}`);\n  }\n  // ⚠️ NUMBER-NESS IS NOT CHECKED, ONLY THE BOUND. The form is strings by construction and a\n  //   non-numeric string is a type error upstream; `Number('')` is 0, so a blank would read as in\n  //   range. Guarding on Number.isFinite keeps a blank from silently passing a minimum of 0.\n  const numeric = Number(value);\n  const bounded = rule.minimum !== undefined || rule.maximum !== undefined;\n  if (bounded && value !== '' && Number.isFinite(numeric)) {\n    if (rule.minimum !== undefined && numeric < rule.minimum) {\n      out.push(`${name}: at least ${rule.minimum}`);\n    }\n    if (rule.maximum !== undefined && numeric > rule.maximum) {\n      out.push(`${name}: at most ${rule.maximum}`);\n    }\n  }\n  return out;\n};\n\n/**\n * Every vendor rule this form breaks, in the order the parameters are declared. Pure: no network,\n * no clock, no environment — so `diff` can call it and a test can call it with a literal.\n *\n * ⚠️ A KEY THE TABLE DOES NOT MENTION IS NOT AN ERROR. The table carries the constrained\n *   parameters, not every parameter, and a form may legitimately send an unconstrained one.\n */\nexport const violations = (\n  table: EndpointConstraints,\n  form: PveForm,\n  options: ViolationOptions = {},\n): readonly string[] => {\n  const out: string[] = [];\n  for (const [name, rule] of Object.entries(table)) {\n    const value = form[name];\n    if (value === undefined) {\n      if (options.presence === true && rule.required === true) out.push(`${name}: required`);\n      continue;\n    }\n    // ⚠️ AN ARRAY IS REPEATED KEYS ON THE WIRE (client.ts), so every element faces the same rule.\n    for (const item of typeof value === 'string' ? [value] : value) {\n      out.push(...checkValue(name, item, rule));\n    }\n  }\n  return out;\n};\n\n/** The message a plan dies with. ⛔ Names the endpoint, because the rule belongs to the vendor. */\nexport const refusal = (endpoint: EndpointKey, found: readonly string[]): string =>\n  `${endpoint} would be rejected by the vendor:\\n  - ${found.join('\\n  - ')}\\n` +\n  \"These are the vendor's own limits, read from its published schema \" +\n  '(packages/alchemy/src/proxmox/generated/constraints). Fix the declaration.';\n",
     "/**\n * Generated pve-manager parameter constraints for `/access` — DO NOT EDIT BY HAND.\n *\n * Run: bun codegen/constraints.ts\n * Manifest entry: `pve-apidoc` — pve-manager 9.2.11/f6997e698c7933ea\n *   sha256 9def8f13611184ee, read on a PVE cluster node from\n *   /usr/share/pve-docs/api-viewer/apidoc.js\n *\n * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones\n * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED\n * and therefore unchecked at plan time.\n *\n * ⚠️ A `patternSource` with no `pattern` beside it is a rule that could NOT be carried into a\n *   JavaScript RegExp faithfully (codegen/pattern.ts). It is recorded and NOT enforced.\n * ⚠️ `pattern` IS NOT THE VENDOR'S SPELLING. For PVE it is anchored, because PVE applies\n *   `m/^$pattern$/` itself (JSONSchema.pm); for PBS it is the vendor's own, which already\n *   carries its anchors. `patternSource` is the spelling to quote at a human — param-rules.ts.\n * ⚠️ `each: true` means the value rules describe every ELEMENT of a repeated key, because the\n *   parameter is an array and stated its limits on `items`.\n */\nimport type { EndpointConstraints } from '../../constraints.ts';\n\nexport const PVE_ACCESS_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>> = {\n  \"pve:POST /access/groups\": {\n    \"groupid\": {\"format\":\"pve-groupid\",\"required\":true,\"type\":\"string\"},\n  },\n  \"pve:POST /access/roles\": {\n    \"privs\": {\"format\":\"pve-priv-list\",\"type\":\"string\"},\n    \"roleid\": {\"format\":\"pve-roleid\",\"required\":true,\"type\":\"string\"},\n  },\n  \"pve:POST /access/users\": {\n    \"comment\": {\"maxLength\":2048,\"type\":\"string\"},\n    \"email\": {\"format\":\"email-opt\",\"maxLength\":254,\"type\":\"string\"},\n    \"expire\": {\"minimum\":0,\"type\":\"integer\"},\n    \"firstname\": {\"maxLength\":1024,\"type\":\"string\"},\n    \"groups\": {\"format\":\"pve-groupid-list\",\"type\":\"string\"},\n    \"keys\": {\"pattern\":\"^[0-9a-zA-Z!=]{0,4096}\\\\n?$\",\"patternSource\":\"[0-9a-zA-Z!=]{0,4096}\",\"type\":\"string\"},\n    \"lastname\": {\"maxLength\":1024,\"type\":\"string\"},\n    \"password\": {\"maxLength\":64,\"minLength\":8,\"type\":\"string\"},\n    \"userid\": {\"format\":\"pve-userid\",\"maxLength\":64,\"required\":true,\"type\":\"string\"},\n  },\n  \"pve:PUT /access/acl\": {\n    \"groups\": {\"format\":\"pve-groupid-list\",\"type\":\"string\"},\n    \"path\": {\"required\":true,\"type\":\"string\"},\n    \"roles\": {\"format\":\"pve-roleid-list\",\"required\":true,\"type\":\"string\"},\n    \"tokens\": {\"format\":\"pve-tokenid-list\",\"type\":\"string\"},\n    \"users\": {\"format\":\"pve-userid-list\",\"type\":\"string\"},\n  },\n  \"pve:PUT /access/groups/{groupid}\": {},\n  \"pve:PUT /access/roles/{roleid}\": {\n    \"privs\": {\"format\":\"pve-priv-list\",\"type\":\"string\"},\n  },\n  \"pve:PUT /access/users/{userid}\": {\n    \"comment\": {\"maxLength\":2048,\"type\":\"string\"},\n    \"email\": {\"format\":\"email-opt\",\"maxLength\":254,\"type\":\"string\"},\n    \"expire\": {\"minimum\":0,\"type\":\"integer\"},\n    \"firstname\": {\"maxLength\":1024,\"type\":\"string\"},\n    \"groups\": {\"format\":\"pve-groupid-list\",\"type\":\"string\"},\n    \"keys\": {\"pattern\":\"^[0-9a-zA-Z!=]{0,4096}\\\\n?$\",\"patternSource\":\"[0-9a-zA-Z!=]{0,4096}\",\"type\":\"string\"},\n    \"lastname\": {\"maxLength\":1024,\"type\":\"string\"},\n  },\n  \"pve:PUT /access/users/{userid}/token/{tokenid}\": {\n    \"delete\": {\"format\":\"pve-configid-list\",\"type\":\"string\"},\n    \"expire\": {\"default\":\"same as user\",\"minimum\":0,\"type\":\"integer\"},\n  },\n};\n",
@@ -26,13 +26,14 @@
     "/**\n * Every generated Proxmox constraint table, merged — DO NOT EDIT BY HAND.\n *\n * Run: bun codegen/constraints.ts\n *\n * ⚠️ MERGING IS SAFE ONLY BECAUSE EVERY KEY IS PREFIXED `pve:`/`pbs:`. PVE and PBS both publish\n *   `PUT /access/acl` and `PUT /access/password` with DIFFERENT rules; an unprefixed merge would\n *   silently enforce one product's limits on the other's objects.\n */\nimport type { EndpointConstraints } from '../../constraints.ts';\nimport { PVE_ACCESS_CONSTRAINTS } from './pve-access.ts';\nimport { PVE_CLUSTER_BACKUP_CONSTRAINTS } from './pve-cluster-backup.ts';\nimport { PVE_CLUSTER_CEPH_CONSTRAINTS } from './pve-cluster-ceph.ts';\nimport { PVE_CLUSTER_FIREWALL_CONSTRAINTS } from './pve-cluster-firewall.ts';\nimport { PVE_CLUSTER_HA_CONSTRAINTS } from './pve-cluster-ha.ts';\nimport { PVE_CLUSTER_METRICS_CONSTRAINTS } from './pve-cluster-metrics.ts';\nimport { PVE_CLUSTER_NOTIFICATIONS_CONSTRAINTS } from './pve-cluster-notifications.ts';\nimport { PVE_CLUSTER_REPLICATION_CONSTRAINTS } from './pve-cluster-replication.ts';\nimport { PVE_CLUSTER_SDN_CONSTRAINTS } from './pve-cluster-sdn.ts';\nimport { PVE_NODES_CEPH_CONSTRAINTS } from './pve-nodes-ceph.ts';\nimport { PVE_NODES_DISKS_CONSTRAINTS } from './pve-nodes-disks.ts';\nimport { PVE_NODES_LXC_CONSTRAINTS } from './pve-nodes-lxc.ts';\nimport { PVE_NODES_NETWORK_CONSTRAINTS } from './pve-nodes-network.ts';\nimport { PVE_NODES_QEMU_CONSTRAINTS } from './pve-nodes-qemu.ts';\nimport { PVE_NODES_STORAGE_CONSTRAINTS } from './pve-nodes-storage.ts';\nimport { PVE_POOLS_CONSTRAINTS } from './pve-pools.ts';\nimport { PVE_STORAGE_CONSTRAINTS } from './pve-storage.ts';\nimport { PBS_CONFIG_CONSTRAINTS } from './pbs-config.ts';\n\nexport const PROXMOX_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>> = {\n  ...PVE_ACCESS_CONSTRAINTS,\n  ...PVE_CLUSTER_BACKUP_CONSTRAINTS,\n  ...PVE_CLUSTER_CEPH_CONSTRAINTS,\n  ...PVE_CLUSTER_FIREWALL_CONSTRAINTS,\n  ...PVE_CLUSTER_HA_CONSTRAINTS,\n  ...PVE_CLUSTER_METRICS_CONSTRAINTS,\n  ...PVE_CLUSTER_NOTIFICATIONS_CONSTRAINTS,\n  ...PVE_CLUSTER_REPLICATION_CONSTRAINTS,\n  ...PVE_CLUSTER_SDN_CONSTRAINTS,\n  ...PVE_NODES_CEPH_CONSTRAINTS,\n  ...PVE_NODES_DISKS_CONSTRAINTS,\n  ...PVE_NODES_LXC_CONSTRAINTS,\n  ...PVE_NODES_NETWORK_CONSTRAINTS,\n  ...PVE_NODES_QEMU_CONSTRAINTS,\n  ...PVE_NODES_STORAGE_CONSTRAINTS,\n  ...PVE_POOLS_CONSTRAINTS,\n  ...PVE_STORAGE_CONSTRAINTS,\n  ...PBS_CONFIG_CONSTRAINTS,\n};\n\n/**\n * sha256 of the merged table, truncated.\n *\n * ★ A DIGEST OF THE DATA, NOT OF THE FILE TEXT, so reformatting is not a stale generation while\n *   changing a 128 to a 129 by hand is. `tests/schema-manifest.test.ts` recomputes it.\n */\nexport const PROXMOX_CONSTRAINTS_DIGEST = '8b6745a471839974';\n",
     "/**\n * `Proxmox.Acl`'s wire shape: PVE's PUT form, identity, and how a live row becomes attributes.\n * Split out of acl.ts (2026-09-24) to keep that file under the 250-line cap once the cries-wolf\n * fix needed real space — the api-token.ts/api-token-form.ts seam, same reasoning: this file\n * answers \"what does PVE store\", acl.ts answers \"when has it changed\" and drives the provider.\n */\nimport type * as access from '@distilled.cloud/proxmox/access';\nimport { guardForm } from './constraint-guard.ts';\nimport type { AclAttributes, AclProps } from './acl.ts';\n\n/** ⚠️ PVE normalises ACL paths (collapses repeated slashes, strips the trailing one, adds a leading one). */\nexport const normalize = (raw: string) => `/${raw.split('/').filter(Boolean).join('/')}`;\n\n/** The write names the subject with a plural key that differs per kind; the read answers singular. */\nconst SUBJECT_FIELD = { group: 'groups', token: 'tokens', user: 'users' } as const;\n\n/** The vendor endpoint every write and every constraint check runs against. */\nconst ENDPOINT = 'pve:PUT /access/acl';\n\n/** The tuple PVE keys a grant by, as PUT's fields. */\nexport const tuple = (props: AclProps): access.PutAccessAclRequest => ({\n  path: normalize(props.path),\n  roles: props.roleid,\n  [SUBJECT_FIELD[props.type]]: props.ugid,\n});\n\n/** Create and update are one call: the tuple plus the single mutable field. */\nexport const bind = (props: AclProps): access.PutAccessAclRequest => ({\n  ...tuple(props),\n  propagate: props.propagate === false ? '0' : '1',\n});\n\n/** `guardForm` wants a plain string-valued form; distilled's request type carries `?` instead. */\nconst asForm = (body: access.PutAccessAclRequest): Record<string, string> =>\n  Object.fromEntries(Object.entries(body).filter((e): e is [string, string] => e[1] !== undefined));\n\n/**\n * ⚠️ ALWAYS PRESENCE-CHECKED. `bind`'s output IS the create form (there is no separate,\n *   narrower update form for this family — see acl.ts's header), so the vendor's\n *   required-parameter check is never wrong to run; the two separate create/update passes the\n *   generic factory ran elsewhere collapse to one call here without losing coverage.\n */\nexport const guardWrite = (props: AclProps) => guardForm(ENDPOINT, asForm(bind(props)), true);\n\n/** What a change of this string means: not an edit, a different grant. */\nexport const identity = (grant: Pick<AclAttributes, 'path' | 'roleid' | 'type' | 'ugid'>) =>\n  [normalize(grant.path), grant.type, grant.ugid, grant.roleid].join(' ');\n\nconst find = (rows: readonly access.ListAccessAclResponseBodyItem[], props: AclProps) =>\n  rows.find(\n    (row) =>\n      row.path === normalize(props.path) &&\n      row.type === props.type &&\n      row.ugid === props.ugid &&\n      row.roleid === props.roleid,\n  );\n\n/**\n * ⚠️ PVE answers `propagate` as 1/0 rather than true/false, and OMITS it when it carries the API\n *   default, which is ON. distilled's generated schema types it `unknown` for the same reason.\n */\nconst propagates = (row: access.ListAccessAclResponseBodyItem) => {\n  const value = row.propagate;\n  return value === undefined || value === 1 || value === true || value === '1';\n};\n\nexport const attributesOf = (\n  rows: readonly access.ListAccessAclResponseBodyItem[],\n  props: AclProps,\n): AclAttributes => {\n  const row = find(rows, props);\n  return {\n    bound: row !== undefined,\n    path: normalize(props.path),\n    propagate: row !== undefined && propagates(row),\n    roleid: props.roleid,\n    type: props.type,\n    ugid: props.ugid,\n  };\n};\n\nexport const matches = (attributes: AclAttributes, props: AclProps) =>\n  attributes.bound && attributes.propagate === (props.propagate !== false);\n",
     "/**\n * Running one `@distilled.cloud/proxmox` typed operation the way `client.ts`'s `pve()` ran a raw\n * HTTP call — same credential lease reuse (lease-cache.ts) and the same cluster-member failover\n * safety rule (members.ts), now handing the request itself to the SDK instead of building one.\n *\n * ★ THIS IS THE SEAM A DISTILLED-BACKED FAMILY CALLS INSTEAD OF `pve()`. `client.ts` stays for\n *   every family not yet migrated — see acl.ts, the first one, for what a migrated family looks\n *   like. A family migrates by calling its own `@distilled.cloud/proxmox/<segment>` typed\n *   operations through `runPve` below, never through a generic method+path+form call: that is\n *   what \"no hand-rolled client\" means in practice (upstream Alchemy PR 1425).\n *\n * ⚠️ THE WHOLE OPERATION IS RE-RUN PER MEMBER, NOT JUST ONE HTTP CALL. `executeOnCluster` in\n *   members.ts retries a single already-built `HttpClientRequest`; a distilled operation builds\n *   its OWN request internally from whatever `Credentials` it is given, so there is no request to\n *   hand between attempts. Failover here instead re-provides `Credentials` with the next member's\n *   `apiBaseUrl` and re-runs the same operation value. This is safe under the identical rule\n *   `executeOnCluster` documents and members.ts's classifiers still enforce: a write may repeat\n *   only on a PROVABLY pre-send transport failure (connection refused, DNS, a refused\n *   certificate) — never on a timeout after connect, and never on an HTTP answer of any kind,\n *   because an answer (even a typed error the SDK decoded) proves the request reached a live\n *   member and must not be sent again elsewhere. Reads may fail over on any transport failure.\n *\n * ⛔ A TYPED ANSWER-ERROR IS NEVER A REASON TO TRY ANOTHER MEMBER. `Forbidden`,\n *   `ParameterVerificationFailed`, `ClusterNodeUnreachable`, … all mean the request reached a\n *   member and that member answered — `isTransportFailure`/`isPreSendTransport` (members.ts)\n *   return `false` for all of them, exactly as they do for the `HttpClientResponse` case in\n *   `executeOnCluster`, since neither function inspects anything but a transport-level\n *   `HttpClientError`. Such an error propagates from here UNCHANGED — not wrapped, not retried —\n *   which is what lets a caller `catchTag` it directly.\n *\n * TRAP FOUND WHILE WRITING THE FAILOVER TEST: `Retry.none` on every attempt, and it is not\n *   optional. `@distilled.cloud/core`'s DEFAULT policy retries any error in its `ServerError`\n *   category automatically, with no caller opt-in (protocol.ts's own header names the mechanism:\n *   `core/category.ts`'s `isTransientError` via `makeDefault`) -- and that category covers\n *   transport failures too, not just 5xx answers: MEASURED -- a plain `listAccessAcl({})` against\n *   a member that refuses the connection hung past a 5-second test timeout, backing off inside\n *   the SDK before this file's own failover loop ever saw a failure to classify. Left enabled, a\n *   WRITE could be resent to the SAME member several times before `runPveWith` gets a result at\n *   all -- silently reintroducing, inside one member, the exact risk `executeOnCluster`\n *   (members.ts) exists to rule out across members (\"a request that may have reached a member\n *   must not be sent again\"). The hand-rolled client never auto-retried anything; member failover\n *   was its only resilience. `Retry.none` below keeps that property true here too.\n *\n * ⛔ GAP FOUND ON REVIEW, FIXED 2026-09-24: `Retry.none` only stops the SDK re-sending to the SAME\n *   member -- it added no bound on how long ONE attempt may wait. A member that accepts the TCP\n *   connection but never answers hung this whole function forever, since the for-loop below never\n *   got a result to classify and so never reached a healthy member. `MEMBER_TIMEOUT` (members.ts,\n *   shared with `client.ts`'s `executeOnCluster`) now bounds each attempt; `isTransportFailure`\n *   treats the resulting `Cause.TimeoutError` as failover-eligible for a read, and\n *   `isPreSendTransport` still refuses it for a write, for the same reason a post-send timeout\n *   always was refused.\n */\nimport type * as Cause from 'effect/Cause';\nimport type * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Result from 'effect/Result';\nimport type * as HttpClient from 'effect/unstable/http/HttpClient';\nimport { credentials as distilledPveCredentials } from '@distilled.cloud/proxmox/Credentials';\nimport type { ProxmoxOpContext } from '@distilled.cloud/proxmox/Protocol';\nimport * as ProxmoxRetry from '@distilled.cloud/proxmox/Retry';\nimport type { PveCredentialDenied } from './credential-errors.ts';\nimport type { PveCredential, PveRole, PveTarget } from './credentials.ts';\nimport { leased } from './lease-cache.ts';\nimport {\n  MEMBER_TIMEOUT,\n  type MemberAttempt,\n  describeTransport,\n  isPreSendTransport,\n  isTransportFailure,\n  noteGoodMember,\n  orderedMembers,\n  pveApiBase,\n} from './members.ts';\n\n/** Every member answered nothing usable — the direct successor to `client.ts`'s `clusterExhausted`. */\nexport class PveClusterExhausted extends Error {\n  constructor(readonly attempts: readonly MemberAttempt[]) {\n    super(`all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join('; ')}`);\n    this.name = 'PveClusterExhausted';\n  }\n}\n\n/**\n * Run `op` against `target`'s cluster on an ALREADY-HELD credential — the direct successor to\n * `client.ts`'s `pveWith`, for a caller reasoning about identity rather than cost (or a test that\n * wants a fixed, explicit credential rather than a live OpenBao mint — see distilled-pve.test.ts).\n *\n * @param isWrite Whether `op` may have a side effect once sent — decides which transport\n *   failures may retry on the next member. Pass `true` for anything that is not a plain read.\n * @param timeout Bound on ONE member's attempt — defaults to `MEMBER_TIMEOUT` (members.ts). A\n *   test passes a short one to prove failover/bounding without waiting out the real bound;\n *   production code never overrides it. A member that answers past this is failed over (a read)\n *   or failed outright (a write, since the request may already have landed) — see\n *   `isTransportFailure`/`isPreSendTransport`.\n */\nexport const runPveWith = <A, E>(\n  target: PveTarget,\n  credential: PveCredential,\n  isWrite: boolean,\n  op: Effect.Effect<A, E, ProxmoxOpContext>,\n  timeout: Duration.Input = MEMBER_TIMEOUT,\n): Effect.Effect<A, E | Cause.TimeoutError | PveClusterExhausted, HttpClient.HttpClient> =>\n  Effect.gen(function* () {\n    const attempts: MemberAttempt[] = [];\n    for (const member of orderedMembers(target)) {\n      const credLayer = distilledPveCredentials({\n        baseUrl: pveApiBase(member),\n        secret: credential.secret,\n        tokenId: credential.tokenId,\n      });\n      const outcome = yield* op.pipe(\n        ProxmoxRetry.none,\n        Effect.provide(credLayer),\n        Effect.timeout(timeout),\n        Effect.result,\n      );\n      if (Result.isSuccess(outcome)) {\n        noteGoodMember(target, member);\n        return outcome.success;\n      }\n      const mayRetry = isWrite\n        ? isPreSendTransport(outcome.failure)\n        : isTransportFailure(outcome.failure);\n      if (!mayRetry) return yield* Effect.fail(outcome.failure);\n      attempts.push({ member, why: describeTransport(outcome.failure) });\n    }\n    return yield* Effect.fail(new PveClusterExhausted(attempts));\n  });\n\n/**\n * `runPveWith`, minting/reusing a `role` lease exactly as `pve()` did — the seam a migrated\n * resource file calls.\n *\n * ⚠️ `| Error` IN THE RETURN TYPE IS `leased()`'s OWN FAILURE, NOT A NEW ONE THIS FILE ADDS.\n *   `mint.ts`'s `mint` fails with a plain `Error` for most refusals (sealed, no such role) and\n *   was never typed more narrowly there; `pve()` carried the same untyped possibility before\n *   this file existed, just without a signature that said so.\n *\n * ★ `| PveCredentialDenied` IS SPELLED OUT HERE, NOT LEFT TO COLLAPSE INTO `Error`. It IS an\n *   `Error` subtype (Data.TaggedError), so leaving it out of this union would still typecheck —\n *   but `Effect.catchTag('PveCredentialDenied', …)` downstream (unreadable-read.ts) needs the\n *   tag to be STATICALLY visible in the error channel to compile at all, not merely true at\n *   runtime. Naming it here is what lets a migrated family's `readOrUnreadable` catch it.\n */\nexport const runPve = <A, E>(\n  target: PveTarget,\n  role: PveRole,\n  isWrite: boolean,\n  op: Effect.Effect<A, E, ProxmoxOpContext>,\n): Effect.Effect<\n  A,\n  E | Cause.TimeoutError | PveClusterExhausted | PveCredentialDenied | Error,\n  HttpClient.HttpClient\n> =>\n  Effect.gen(function* () {\n    const credential = yield* leased(target, role);\n    return yield* runPveWith(target, credential, isWrite, op);\n  });\n",
-    "/**\n * One credential per (target, role) for the life of a run, instead of one per API call.\n *\n * 🔴 THE MEASUREMENT THAT MADE THIS NECESSARY. A single `alchemy plan` plus `deploy` of the C1\n *   stack — 98 resources — left **760 API token entries in `/etc/pve/user.cfg`**, counted on node-b\n *   immediately afterwards. `mint()` asked OpenBao for a new credential on EVERY call, and each\n *   mint creates a real Proxmox token: read, diff, reconcile and read-back each got their own. They\n *   drain as the leases expire (760 down to 712 over five minutes), so nothing was broken — but\n *   `/etc/pve` is pmxcfs, a REPLICATED cluster filesystem, and every one of those mints is a write\n *   to it that all three nodes must agree on. Two plans in quick succession stack thousands.\n *\n * ⛔ AND ON PBS THE COST IS SECONDS, NOT BYTES. `pbs_grant.go` waits for PBS to honour a freshly\n *   granted ACL before handing the credential over — measured at about 4.5s, and unavoidable,\n *   because PBS caches its parsed ACL config. Per mint. The ten PBS resources in pbs.ts would pay\n *   that ten times over for credentials identical to each other.\n *\n * ★ SO THE FIX IS TO STOP THROWING AWAY A CREDENTIAL THAT IS STILL VALID. This is strictly FEWER\n *   credentials in existence at once, not more: the lease TTL is untouched, and a token that would\n *   have been minted and abandoned is simply never minted. It is the same reasoning\n *   `network-apply.ts` already applies by hand when it threads one lease through `pveWith` for its\n *   apply and its task poll.\n *\n * ⚠️ THE CACHE IS PROCESS-SCOPED AND THAT IS THE INTENDED LIFETIME. A plan or a deploy is one\n *   process; the next one starts cold. Nothing is written to disk, and a credential never outlives\n *   the run that minted it.\n *\n * ⛔ IT IS NOT A PERFORMANCE CACHE, SO IT MUST NEVER SERVE A CREDENTIAL THAT COULD DIE MID-CALL.\n *   The provision lease is 300s and a deploy can run longer than that. A credential handed out at\n *   t+299 would fail the call it was handed to, and the failure surfaces as a 401 — which `read`\n *   folds into \"absent\", which is how a plan comes to say CREATE for an object that exists. That is\n *   the exact class of bug this package found three times in one day, so the margin below is\n *   deliberately generous rather than tuned.\n *\n * ★ THE MECHANISM IS EFFECT'S OWN `Cache`, AND THE HAND-WRITTEN ONE IT REPLACED WAS WRONG IN\n *   EXACTLY THE PLACE A LIBRARY IS NOT. A TTL map alone still minted 89 credentials for 98\n *   resources, because Alchemy plans concurrently and every resource missed in the same instant;\n *   the in-flight map added to fix that got the first miss right and the failure path wrong. A\n *   waiter woken by a FAILED or uncacheable mint claimed the slot without looking again, the\n *   waiters overwrote each other's claims, and each one's cleanup deleted somebody else's — the\n *   thundering herd back through the error door (found in review 2026-09-14, confirmed by\n *   reading). `Cache.get` shares one pending lookup among concurrent callers by design. MEASURED\n *   with a probe before this was written: ten concurrent gets on equal-but-distinct key objects ran\n *   the lookup once; a zero time-to-live ran it again for the next caller; a failure reached all\n *   ten waiters and was not kept.\n */\nimport * as Cache from 'effect/Cache';\nimport * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Exit from 'effect/Exit';\nimport { type ApiTarget, type PveCredential, type PveRole } from './credentials.ts';\nimport { mint } from './mint.ts';\n\n/**\n * Re-mint once a lease is inside this much of its end, in seconds.\n *\n * ⚠️ 60s AGAINST A 300s PROVISION LEASE MEANS A CACHED CREDENTIAL IS ONLY EVER HANDED OUT WITH AT\n *   LEAST A MINUTE LEFT. The slowest single call in this package is `network-apply`'s reload poll,\n *   and that mints its own lease deliberately — see the ⚠️ on `pveWith` there — so nothing using\n *   this cache comes near a minute.\n * ⚠️ A MOUNT REPORTING NO `lease_duration` IS NEVER CACHED: `leaseSeconds` is `0` and\n *   `timeToLive` answers zero. Not caching is always safe; caching a credential whose lifetime is\n *   unknown is not.\n */\nconst REMINT_MARGIN_SECONDS = 60;\n\n/**\n * What a credential is cached under.\n *\n * ⛔ KEYED ON THE OPENBAO MOUNT AND ROLE, NOT ON A MEMBER HOSTNAME. A PVE API token is\n *   cluster-wide — `user.cfg` is replicated — so node-b, node-c and node-d share one credential. Keying on\n *   `api` would mint three identical tokens when failover rotates members.\n * ★ THE MOUNT CANNOT COLLIDE ACROSS CLUSTERS: `proxmox-c1`, `proxmox-c2` and `pbs-c1` are\n *   distinct OpenBao mounts with distinct policies; two estates never share a mount name.\n * ★ A PLAIN OBJECT IS A SAFE KEY BECAUSE EFFECT COMPARES KEYS STRUCTURALLY — two separately built\n *   literals with the same fields are one entry, which the probe above measured.\n */\nexport type LeaseKey = {\n  readonly mount: string;\n  readonly role: PveRole;\n  readonly scheme: ApiTarget['scheme'];\n};\n\nconst keyOf = (target: ApiTarget, role: PveRole): LeaseKey => ({\n  mount: target.mount,\n  role,\n  scheme: target.scheme,\n});\n\n/**\n * How long a freshly minted credential may be handed out again.\n *\n * ⛔ ZERO FOR A FAILURE, FOR AN UNKNOWN LIFETIME AND FOR A LEASE INSIDE THE MARGIN. Zero means \"do\n *   not keep\": the callers already waiting on THIS mint still receive its result, and the next\n *   caller mints again. Keeping a failure would turn one refused mint into a refused run.\n * ⚠️ EXPORTED FOR THE TEST. The margin is the whole safety property, so it is pinned from both\n *   sides of its edge without waiting four minutes of wall clock.\n */\nexport const timeToLive = (exit: Exit.Exit<PveCredential, unknown>): Duration.Duration =>\n  Exit.isSuccess(exit) && exit.value.leaseSeconds > REMINT_MARGIN_SECONDS\n    ? Duration.seconds(exit.value.leaseSeconds - REMINT_MARGIN_SECONDS)\n    : Duration.zero;\n\n/**\n * A lease cache over any mint.\n *\n * ⚠️ ONE BEHAVIOUR CHANGED WITH THE MOVE TO `Cache`, DELIBERATELY. Callers waiting on a mint that\n *   FAILS now receive that failure, where the hand-written version had each of them mint again.\n *   They asked in the same instant for the same credential, and a plan with one failed resource\n *   fails either way — so the change is in how many errors the output lists, not in the outcome,\n *   and a sealed vault is asked once rather than ninety-eight times.\n * ★ `requireServicesAt: 'lookup'` IS WHAT LETS IT BE BUILT ONCE, AT IMPORT. The mint needs an\n *   `HttpClient`; that requirement moves to each `get`, where every caller already has one.\n * ⚠️ EXPORTED FOR THE TEST, which hands it a counting mint instead of calling OpenBao.\n */\nexport const makeLeases = <E, R>(mintFor: (key: LeaseKey) => Effect.Effect<PveCredential, E, R>) =>\n  Cache.makeWith(mintFor, { capacity: 64, requireServicesAt: 'lookup', timeToLive });\n\nconst targetForKey = (key: LeaseKey): ApiTarget =>\n  key.scheme === 'pbs'\n    ? { api: 'https://pbs.invalid/api2/json', mount: key.mount, scheme: 'pbs' }\n    : { members: [], mount: key.mount, scheme: 'pve' };\n\nconst leases = Effect.runSync(makeLeases((key) => mint(targetForKey(key), key.role)));\n\n/**\n * A credential for `role` on `target`: a still-valid lease when one is kept, one shared mint when\n * not.\n *\n * ★ client.ts is the one place that decides to use the cache. `mint` stays exported and unchanged\n *   for the caller that reasons about identity rather than cost — network-apply.ts.\n */\nexport const leased = (target: ApiTarget, role: PveRole) => Cache.get(leases, keyOf(target, role));\n",
-    "/**\n * Minting one PVE/PBS credential from OpenBao: `GET /v1/<mount>/creds/<role>`, alive for five\n * minutes. Split out of `credentials.ts` (2026-09-24) to keep that file's TYPES under the\n * 250-line cap once `PveCredentialDenied`'s catchers needed a real header there; the reasoning\n * for WHY the estate mints rather than stores a token is still credentials.ts's own header.\n *\n * ⛔ THE SECRET NEVER TOUCHES DISK, A LOG, OR ALCHEMY STATE — see credentials.ts's ⛔. Nothing\n *   here returns it to a resource; it is used to build a header and then dropped.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\nimport * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';\nimport * as Headers from 'effect/unstable/http/Headers';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\nimport { PveCredentialDenied } from './credential-errors.ts';\nimport type { ApiTarget, BaoEnvironment, PveCredential, PveRole } from './credentials.ts';\n\n/** openbao v2.6.2 api/env.go:22-34 — a present BAO_* wins, even empty; else its VAULT_* twin. */\nconst baoVariable = (env: BaoEnvironment, name: string) =>\n  env[`BAO_${name}`] ?? env[`VAULT_${name}`] ?? '';\n\n/**\n * Mint one credential for `role`: `GET /v1/<mount>/creds/<role>` on OpenBao's HTTP API.\n *\n * 🔴 IT SHELLED OUT TO `bao read -format=json` UNTIL 2026-09-14. The case for the CLI was that one\n *   client could not disagree with `bao kv get` about what this machine may do. <estate>/openbao then\n *   learned twice what deciding by stderr costs — every failure read as absent, and two commands\n *   said \"absent\" in different words — so this reads STATUS CODES: 2xx is a credential, and 403\n *   (denied), 404 (no such role or mount — a mint has no \"absent\"), 503 (sealed) all fail.\n * ★ THE ENVIRONMENT CONTRACT IS STILL THE CLI's, READ THE CLI's WAY, which keeps the case above\n *   true (openbao v2.6.2 api/client.go:34-66, 370, 503-507, 761-762, 776-785): BAO_AGENT_ADDR over\n *   BAO_ADDR over https://127.0.0.1:8200; BAO_NAMESPACE as X-Vault-Namespace; BAO_TOKEN as\n *   X-Vault-Token; X-Vault-Request always. <estate>/openbao/src/bao-address.ts has the long form.\n * ★ AGENT MODE IS NO BAO_TOKEN AND NO TOKEN HEADER. An Agent or Proxy listener with\n *   `api_proxy { use_auto_auth_token = true }` (or the older `cache { … }`) substitutes its\n *   auto-auth token exactly when a request carries none — command/agentproxyshared/cache/handler.go\n *   :29-38, command/agent.go:517-541, command/agent/config/config.go:288-292, and\n *   website/content/docs/agent-and-proxy/agent/apiproxy.mdx:57-62. The CLI's token-file fallback\n *   is deliberately not read. ⚠️ So an unset BAO_TOKEN aimed at a SERVER rather than an agent is a\n *   403, which reads like a missing grant rather than a missing variable.\n * ★ UNIX SOCKETS: `unix:///path` is plain HTTP to `localhost` over that socket, as the CLI does it\n *   (api/client.go:654-667). Bun's fetch takes a `unix` option; `FetchHttpClient.RequestInit` is\n *   Effect's documented way to pass fetch options, read from the calling fiber (effect\n *   FetchHttpClient.ts:59-72). Off Bun it REFUSES, rather than reach http://localhost:80.\n */\nexport const mint = (target: ApiTarget, role: PveRole, env: BaoEnvironment = process.env) =>\n  Effect.gen(function* () {\n    const path = `${target.mount}/creds/${role}`;\n    // ⛔ METHOD, PATH AND OpenBao's `errors` ONLY — never a header (the token), never a success\n    //   body (the credential is IN it, so echoing it would print the secret into a log).\n    const refuse = (status: number, detail: string) =>\n      new Error(`OpenBao GET /v1/${path} -> ${status === 0 ? 'no response' : status}: ${detail}`);\n    const address =\n      baoVariable(env, 'AGENT_ADDR') || baoVariable(env, 'ADDR') || 'https://127.0.0.1:8200';\n    const socket = address.startsWith('unix://') ? address.slice('unix://'.length) : undefined;\n    const base = socket === undefined ? address.replace(/\\/+$/, '') : 'http://localhost';\n    const headers: Record<string, string> = { 'X-Vault-Request': 'true' };\n    const namespace = baoVariable(env, 'NAMESPACE');\n    if (namespace !== '') headers['X-Vault-Namespace'] = namespace;\n    const token = baoVariable(env, 'TOKEN');\n    if (token !== '') headers['X-Vault-Token'] = token;\n    if (socket !== undefined && !('Bun' in globalThis)) {\n      return yield* Effect.fail(refuse(0, 'a unix:// address needs Bun fetch; this is not Bun'));\n    }\n\n    const client = yield* HttpClient.HttpClient;\n    // ⛔ Effect records request headers on the client span, and its default redaction list does\n    //   not name x-vault-token (effect Headers.ts:753-762). It is added for this call.\n    const redacted = yield* Headers.CurrentRedactedNames;\n    const defaults = Option.getOrElse(\n      yield* Effect.serviceOption(FetchHttpClient.RequestInit),\n      () => ({}),\n    );\n    const request = HttpClientRequest.get(`${base}/v1/${path}`).pipe(\n      HttpClientRequest.setHeaders(headers),\n    );\n    const exchange = client.execute(request).pipe(\n      Effect.flatMap((response) =>\n        Effect.map(response.text, (text) => ({ status: response.status, text })),\n      ),\n      // ⚠️ The CLI's default client timeout (api/client.go:324) — a hung agent must not hang a plan.\n      Effect.timeout('60 seconds'),\n      Effect.provideService(Headers.CurrentRedactedNames, [...redacted, 'x-vault-token']),\n    );\n    // ⚠️ `| undefined` under exactOptionalPropertyTypes: `socket` is narrowed to a string\n    //   only on the branch below, so the object literal genuinely carries\n    //   `unix: string | undefined` and the type must say so. The alternative — building\n    //   the key conditionally — hides that this request is the unix-socket path.\n    const init: RequestInit & { unix?: string | undefined } = { ...defaults, unix: socket };\n    const { status, text } = yield* (\n      socket === undefined\n        ? exchange\n        : Effect.provideService(exchange, FetchHttpClient.RequestInit, init)\n    ).pipe(\n      // ⛔ `.message` only — the error object holds the request, and the request holds the token.\n      Effect.mapError((cause) => refuse(0, cause.message)),\n    );\n\n    let parsed:\n      | {\n          lease_duration?: unknown;\n          data?: { token_id?: unknown; secret?: unknown };\n          errors?: unknown;\n        }\n      | undefined;\n    try {\n      parsed = JSON.parse(text) as typeof parsed;\n    } catch {\n      parsed = undefined;\n    }\n    if (status < 200 || status >= 300) {\n      const errors = parsed?.errors;\n      const isOpenBaoBody = Array.isArray(errors);\n      const detail = isOpenBaoBody ? errors.map(String).join('; ') : 'not an OpenBao error body';\n      /**\n       * ⛔ 403 GETS THE TYPED TAG ONLY WITH A GENUINE OpenBao ERROR BODY — found on adversarial\n       *   review 2026-09-24. Status alone is not enough: a WAF, a proxy in front of OpenBao, or an\n       *   mTLS terminator can answer 403 without OpenBao ever seeing the request, and `parsed` is\n       *   then `undefined`/`errors` is not an array (the `try`/`catch` above, or a body that\n       *   parses but isn't OpenBao's shape). That is an infrastructure fault, not \"this identity\n       *   is denied this role\" — tagging it `PveCredentialDenied` would fold a REAL outage into\n       *   \"unreadable, report noop\" exactly as quietly as the bug this fix exists to remove. Only\n       *   a parsed `errors` array is OpenBao's own documented error shape (mint.ts's own header),\n       *   so it is the one signal trusted here.\n       */\n      if (status === 403 && isOpenBaoBody) {\n        return yield* Effect.fail(new PveCredentialDenied({ detail, mount: target.mount, role }));\n      }\n      return yield* Effect.fail(refuse(status, detail || '(no errors given)'));\n    }\n    const tokenId = parsed?.data?.token_id;\n    const secret = parsed?.data?.secret;\n    if (typeof tokenId !== 'string' || typeof secret !== 'string') {\n      // ⛔ REFUSE RATHER THAN RETURN A HALF CREDENTIAL, and again WITHOUT quoting the body.\n      return yield* Effect.fail(\n        new Error(\n          `${target.mount}/creds/${role} returned no token_id/secret. Either this approle lacks ` +\n            `the grant, or the mount is not ${target.mount}. Say which mount and role you needed ` +\n            `than falling back to a stored credential -- every stored PVE token is read-only.`,\n        ),\n      );\n    }\n    const lease = parsed?.lease_duration;\n    const leaseSeconds = typeof lease === 'number' ? lease : 0;\n    return { leaseSeconds, secret, tokenId } satisfies PveCredential;\n  });\n\n/**\n * The header PVE wants. `PVEAPIToken=<tokenid>=<secret>`.\n *\n * ⚠️ THE SEPARATOR IS `=`, NOT `:`. Proxmox rejects the colon form with a 401 that says only\n *   \"authentication failure\", which reads as a bad credential rather than as a malformed header.\n */\nexport const authorization = (credential: PveCredential, target: ApiTarget): string =>\n  target.scheme === 'pbs'\n    ? `PBSAPIToken=${credential.tokenId}:${credential.secret}`\n    : `PVEAPIToken=${credential.tokenId}=${credential.secret}`;\n",
-    "/**\n * `credentials.ts`'s one typed mint failure (S21) — split out to keep that file under the\n * 250-line cap once this class grew a real header (2026-09-24, the cries-wolf fix).\n */\nimport * as Data from 'effect/Data';\nimport type { PveRole } from './credentials.ts';\n\n/**\n * OpenBao answered 403 to `GET /v1/<mount>/creds/<role>`: this identity's AppRole has no grant\n * for `role` on `mount` — measured 2026-09-24 as \"the agent lane cannot mint `provision`\" (the\n * lane's policy grants `read` but not `provision`). A TYPED tag, not the plain `Error` every\n * other mint failure still is (404 no such role/mount, 503 sealed, a network failure), because\n * this ONE case means \"refused, not evidence of anything about the object\" — a family's\n * `readOrUnreadable` (unreadable-read.ts) `catchTag`s exactly this, never any other mint\n * failure, which stays a hard error precisely because it is NOT a scoped refusal.\n *\n * ⛔ WHY NOT EVERY NON-2xx: A 503 (sealed) or a 404 (misconfigured mount/role) is the estate\n *   BROKEN, not this identity being narrowly scoped — folding those into \"unreadable, report\n *   noop\" would hide a real outage behind a quiet, misleadingly reassuring plan. Only 403 is\n *   \"this identity, this role, denied\" and safe to read as \"cannot see, not evidence of absence\".\n */\nexport class PveCredentialDenied extends Data.TaggedError('PveCredentialDenied')<{\n  readonly mount: string;\n  readonly role: PveRole;\n  readonly detail: string;\n}> {\n  override get message(): string {\n    return (\n      `OpenBao GET /v1/${this.mount}/creds/${this.role} -> 403: ${this.detail}. This identity's ` +\n      'AppRole has no grant for this role -- a refused read, not evidence the object is gone.'\n    );\n  }\n}\n",
+    "/**\n * One credential per (target, role) for the life of a run, instead of one per API call.\n *\n * 🔴 THE MEASUREMENT THAT MADE THIS NECESSARY. A single `alchemy plan` plus `deploy` of the C1\n *   stack — 98 resources — left **760 API token entries in `/etc/pve/user.cfg`**, counted on node-b\n *   immediately afterwards. `mint()` asked OpenBao for a new credential on EVERY call, and each\n *   mint creates a real Proxmox token: read, diff, reconcile and read-back each got their own. They\n *   drain as the leases expire (760 down to 712 over five minutes), so nothing was broken — but\n *   `/etc/pve` is pmxcfs, a REPLICATED cluster filesystem, and every one of those mints is a write\n *   to it that all three nodes must agree on. Two plans in quick succession stack thousands.\n *\n * ⛔ AND ON PBS THE COST IS SECONDS, NOT BYTES. `pbs_grant.go` waits for PBS to honour a freshly\n *   granted ACL before handing the credential over — measured at about 4.5s, and unavoidable,\n *   because PBS caches its parsed ACL config. Per mint. The ten PBS resources in pbs.ts would pay\n *   that ten times over for credentials identical to each other.\n *\n * ★ SO THE FIX IS TO STOP THROWING AWAY A CREDENTIAL THAT IS STILL VALID. This is strictly FEWER\n *   credentials in existence at once, not more: the lease TTL is untouched, and a token that would\n *   have been minted and abandoned is simply never minted. It is the same reasoning\n *   `network-apply.ts` already applies by hand when it threads one lease through `pveWith` for its\n *   apply and its task poll.\n *\n * ⚠️ THE CACHE IS PROCESS-SCOPED AND THAT IS THE INTENDED LIFETIME. A plan or a deploy is one\n *   process; the next one starts cold. Nothing is written to disk, and a credential never outlives\n *   the run that minted it.\n *\n * ⛔ IT IS NOT A PERFORMANCE CACHE, SO IT MUST NEVER SERVE A CREDENTIAL THAT COULD DIE MID-CALL.\n *   The provision lease is 300s and a deploy can run longer than that. A credential handed out at\n *   t+299 would fail the call it was handed to, and the failure surfaces as a 401 — which `read`\n *   folds into \"absent\", which is how a plan comes to say CREATE for an object that exists. That is\n *   the exact class of bug this package found three times in one day, so the margin below is\n *   deliberately generous rather than tuned.\n *\n * ★ THE MECHANISM IS EFFECT'S OWN `Cache`, AND THE HAND-WRITTEN ONE IT REPLACED WAS WRONG IN\n *   EXACTLY THE PLACE A LIBRARY IS NOT. A TTL map alone still minted 89 credentials for 98\n *   resources, because Alchemy plans concurrently and every resource missed in the same instant;\n *   the in-flight map added to fix that got the first miss right and the failure path wrong. A\n *   waiter woken by a FAILED or uncacheable mint claimed the slot without looking again, the\n *   waiters overwrote each other's claims, and each one's cleanup deleted somebody else's — the\n *   thundering herd back through the error door (found in review 2026-09-14, confirmed by\n *   reading). `Cache.get` shares one pending lookup among concurrent callers by design. MEASURED\n *   with a probe before this was written: ten concurrent gets on equal-but-distinct key objects ran\n *   the lookup once; a zero time-to-live ran it again for the next caller; a failure reached all\n *   ten waiters and was not kept.\n */\nimport * as Cache from 'effect/Cache';\nimport * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Exit from 'effect/Exit';\nimport {\n  type ApiTarget,\n  type BaoEnvironment,\n  type PveCredential,\n  type PveRole,\n  mintTier,\n} from './credentials.ts';\nimport { mint } from './mint.ts';\n\n/**\n * Re-mint once a lease is inside this much of its end, in seconds.\n *\n * ⚠️ 60s AGAINST A 300s PROVISION LEASE MEANS A CACHED CREDENTIAL IS ONLY EVER HANDED OUT WITH AT\n *   LEAST A MINUTE LEFT. The slowest single call in this package is `network-apply`'s reload poll,\n *   and that mints its own lease deliberately — see the ⚠️ on `pveWith` there — so nothing using\n *   this cache comes near a minute.\n * ⚠️ A MOUNT REPORTING NO `lease_duration` IS NEVER CACHED: `leaseSeconds` is `0` and\n *   `timeToLive` answers zero. Not caching is always safe; caching a credential whose lifetime is\n *   unknown is not.\n */\nconst REMINT_MARGIN_SECONDS = 60;\n\n/**\n * What a credential is cached under.\n *\n * ⛔ KEYED ON THE OPENBAO MOUNT AND TIER, NOT ON A MEMBER HOSTNAME OR ON `role` (M3, red team on\n *   K-T1). A PVE API token is cluster-wide — `user.cfg` is replicated — so node-b, node-c and\n *   node-d share one credential. Keying on `api` would mint three identical tokens when failover\n *   rotates members. `role` USED to be part of this key too, but the minted credential depends\n *   only on `(mount, scheme, tier)` — `role` only ever fed `mintTier` to re-derive the tier the\n *   key already carries — so `roles: { read: 'x', provision: 'x' }` (one tier for both roles, the\n *   shape `docs/credentials.md` itself recommends) used to open TWO cache entries and mint TWO\n *   byte-for-byte interchangeable tokens for what is provably one credential. Dropping `role`\n *   collapses that back to one entry without changing the default case, where `tier === role`\n *   already.\n * ★ THE MOUNT CANNOT COLLIDE ACROSS CLUSTERS: `proxmox-c1`, `proxmox-c2` and `pbs-c1` are\n *   distinct OpenBao mounts with distinct policies; two estates never share a mount name.\n * ★ A PLAIN OBJECT IS A SAFE KEY BECAUSE EFFECT COMPARES KEYS STRUCTURALLY — two separately built\n *   literals with the same fields are one entry, which the probe above measured.\n *\n * ⛔ `tier` IS THE KEY, NOT `role` (K-T1). `targetForKey` below has to RECONSTRUCT a target from\n *   the key alone (it does not keep the caller's original `ApiTarget` around), and a\n *   `PveTarget.roles` override lives on THAT original target, not on `role` — so without `tier`\n *   in the key, every `leased()` call for an overridden role would resolve its override once at\n *   the first `keyOf`, then reuse whatever `targetForKey` happens to reconstruct on a cache miss,\n *   and TWO DIFFERENT overrides sharing one `{mount, scheme}` (e.g. one consumer's default `read`\n *   tier and another's `roles: {read: 'x'}` override, same mount) would collide into ONE cache\n *   entry and hand each other's credential to the wrong caller. Resolving the tier at `keyOf` —\n *   where the real target is still in hand — and keying on it closes that: two different tiers\n *   are two different entries, always.\n */\nexport type LeaseKey = {\n  readonly mount: string;\n  readonly scheme: ApiTarget['scheme'];\n  readonly tier: string;\n};\n\n/**\n * ⚠️ EXPORTED FOR THE TEST (I1, red team on K-T1). This is the one line the whole PR exists\n *   for — `tier: mintTier(target, role)` is what makes an overridden `PveTarget.roles` reach the\n *   cached path at all. Nothing else in this file's test suite calls `keyOf` or `leased`\n *   directly, so without this export a regression here (e.g. reverting to `tier: role`) passed\n *   the whole suite silently.\n */\nexport const keyOf = (target: ApiTarget, role: PveRole): LeaseKey => ({\n  mount: target.mount,\n  scheme: target.scheme,\n  tier: mintTier(target, role),\n});\n\n/**\n * How long a freshly minted credential may be handed out again.\n *\n * ⛔ ZERO FOR A FAILURE, FOR AN UNKNOWN LIFETIME AND FOR A LEASE INSIDE THE MARGIN. Zero means \"do\n *   not keep\": the callers already waiting on THIS mint still receive its result, and the next\n *   caller mints again. Keeping a failure would turn one refused mint into a refused run.\n * ⚠️ EXPORTED FOR THE TEST. The margin is the whole safety property, so it is pinned from both\n *   sides of its edge without waiting four minutes of wall clock.\n */\nexport const timeToLive = (exit: Exit.Exit<PveCredential, unknown>): Duration.Duration =>\n  Exit.isSuccess(exit) && exit.value.leaseSeconds > REMINT_MARGIN_SECONDS\n    ? Duration.seconds(exit.value.leaseSeconds - REMINT_MARGIN_SECONDS)\n    : Duration.zero;\n\n/**\n * A lease cache over any mint.\n *\n * ⚠️ ONE BEHAVIOUR CHANGED WITH THE MOVE TO `Cache`, DELIBERATELY. Callers waiting on a mint that\n *   FAILS now receive that failure, where the hand-written version had each of them mint again.\n *   They asked in the same instant for the same credential, and a plan with one failed resource\n *   fails either way — so the change is in how many errors the output lists, not in the outcome,\n *   and a sealed vault is asked once rather than ninety-eight times.\n * ★ `requireServicesAt: 'lookup'` IS WHAT LETS IT BE BUILT ONCE, AT IMPORT. The mint needs an\n *   `HttpClient`; that requirement moves to each `get`, where every caller already has one.\n * ⚠️ EXPORTED FOR THE TEST, which hands it a counting mint instead of calling OpenBao.\n */\nexport const makeLeases = <E, R>(mintFor: (key: LeaseKey) => Effect.Effect<PveCredential, E, R>) =>\n  Cache.makeWith(mintFor, { capacity: 64, requireServicesAt: 'lookup', timeToLive });\n\n/**\n * ⛔ CARRIES `key.tier` BACK IN AS A `roles` OVERRIDE (K-T1), SO `mint`'S OWN `mintTier` CALL\n *   REPRODUCES THE SAME TIER `keyOf` ALREADY RESOLVED. This target is synthetic — it is never the\n *   caller's real `PveTarget` (`members`/`api` are throwaway placeholders `mint` never reads) —\n *   and, since M3 dropped `role` from `LeaseKey`, it no longer even knows which semantic role\n *   produced `key.tier`. It doesn't need to: `roles: { read: key.tier }` plus always minting with\n *   the fixed role `'read'` (below) makes `mintTier(targetForKey(key), 'read') === key.tier`\n *   unconditionally, because `mintTier` only ever consults the ONE role it's called with. Which\n *   role the ORIGINAL caller asked for is irrelevant here — `keyOf` already folded that into\n *   `key.tier` before this function ever sees the key.\n * ⚠️ THE PBS BRANCH MINTS WITH `key.tier` ITSELF AS THE ROLE, NOT `'read'`. A `PbsTarget` has no\n *   `roles` override (see `credentials.ts`'s ⛔ on `PbsTarget`), so `mintTier` for `scheme:'pbs'`\n *   always returns its `role` argument unchanged — meaning `key.tier` for a PBS key IS the literal\n *   role name (`'read'`/`'provision'`) `keyOf` recorded. Passing anything else here would ask\n *   OpenBao for the wrong tier.\n * ⚠️ EXPORTED FOR THE TEST, which checks that round trip directly rather than only through the\n *   cache's externally visible behaviour.\n */\nexport const targetForKey = (key: LeaseKey): ApiTarget =>\n  key.scheme === 'pbs'\n    ? { api: 'https://pbs.invalid/api2/json', mount: key.mount, scheme: 'pbs' }\n    : { members: [], mount: key.mount, roles: { read: key.tier }, scheme: 'pve' };\n\n/**\n * ⚠️ EXPORTED FOR THE TEST (second red-team pass on K-T1). `targetForKey`'s own tests call\n *   `mintTier(targetForKey(key), 'read')` to check the round trip, which hand-reproduces this\n *   function's fixed choice of `'read'` as the pve mint role rather than exercising it — change\n *   that choice here and those tests keep passing while a live cache miss mints the wrong tier.\n *   Testing this function directly (against a fake OpenBao) pins the choice itself.\n *\n * ⚠️ `env` DEFAULTS TO `process.env`, SAME AS `mint` ITSELF (credentials.ts) — the cache's real\n *   caller below (`Effect.runSync(makeLeases(mintForKey))`) always calls this with one argument,\n *   so the default is what production runs on. The parameter exists only so the test can pass a\n *   fake OpenBao's address without touching the real environment.\n */\nexport const mintForKey = (key: LeaseKey, env: BaoEnvironment = process.env) =>\n  mint(targetForKey(key), key.scheme === 'pbs' ? (key.tier as PveRole) : 'read', env);\n\nconst leases = Effect.runSync(makeLeases(mintForKey));\n\n/**\n * A credential for `role` on `target`: a still-valid lease when one is kept, one shared mint when\n * not.\n *\n * ★ client.ts is the one place that decides to use the cache. `mint` stays exported and unchanged\n *   for the caller that reasons about identity rather than cost — network-apply.ts.\n */\nexport const leased = (target: ApiTarget, role: PveRole) => Cache.get(leases, keyOf(target, role));\n",
+    "/**\n * The PVE credential a reconcile runs with: minted from OpenBao, alive for five minutes.\n *\n * ⛔ THERE IS NO STATIC WRITE TOKEN IN THIS ESTATE, AND THAT IS DELIBERATE. Every PVE token stored\n *   on the estate's static KV shelf is read-only — PVEAuditor on each cluster, Audit on PBS, all\n *   as one metrics user. The MCP proxmox client says why in its own header: the auditor token bounds\n *   what a BUG can do, independently of what the code bounds. Adding a long-lived write token to\n *   that shelf would delete the outer lock for every reader of the shelf, not just for this\n *   provider.\n *\n * ★ SO WRITES COME FROM A DYNAMIC MOUNT INSTEAD, which the estate already built: `proxmox-c1/`\n *   exposes two roles — `read` (ttl 3600s) and `provision` (ttl 300s, max 1800s, NOT renewable).\n *   A mint returns a PVE API token of its own, `hf-provision@pve!hf-provision-…-<timestamp>-<id>`,\n *   which expires on its own whether or not anything cleans up. Same shape as\n *   `cloudflare-<account>-<surface>/creds/<role>`, same reason.\n *   ⚠️ THAT PATH IS WRITTEN WITH `<surface>` RATHER THAN A GLOB ON PURPOSE: a `*` followed by\n *     a slash CLOSES THIS BLOCK COMMENT, and everything below it then parses as code. It cost\n *     six TS1005/TS1443 errors pointing at innocent lines twenty rows further down.\n *\n * ⚠️ FIVE MINUTES IS THE DESIGN, NOT AN OBSTACLE. A reconcile that cannot finish inside the lease\n *   should mint again rather than ask for a longer one: the short lease is what makes a leaked\n *   token uninteresting. `provision` is explicitly non-renewable, so there is no renew path to\n *   reach for.\n *\n * ⛔ THE SECRET NEVER TOUCHES DISK, A LOG, OR ALCHEMY STATE. Alchemy persists resource attributes\n *   WITHOUT encryption — StateEncoding.ts writes `Redacted` as `{\"@redacted\": <plaintext>}` — and\n *   this estate's state store is the `alchemy` Postgres, which a nightly job dumps. A PVE\n *   secret that reached an attribute would outlive its 300s lease by months, in four places.\n *   Nothing here returns it to a resource; it is used to build a header and then dropped.\n */\n/**\n * ★ NO SESSION, ON PURPOSE, AND THIS IS WHAT UNBLOCKED `wip/bao-policy`.\n *   `CommandExecutor.run` requires a `ScopedPlanStatusSession`, and Alchemy gives one to\n *   `reconcile` and `delete` but NOT to `read` or `diff` — so a provider built on `run` can only\n *   ever write. Alchemy's OWN Docker provider does not use `CommandExecutor` for this at all: it\n *   takes `ChildProcessSpawner` and pipes `ChildProcess.make(...)` through `spawner.spawn`, which\n *   needs a `Scope` and nothing else (Docker.ts:476-553). That was the pattern here until\n *   2026-09-14, when `mint` moved to `HttpClient` — which needs no session either, so `mint` is\n *   still callable from all four operations.\n *\n * ⛔ DO NOT SATISFY THE OLD SIGNATURE BY FAKING A SESSION. A session carries plan status Alchemy\n *   uses to report progress; inventing one would make read and diff report work they are not doing.\n */\n/** Which role a call needs. `read` for read/diff, `provision` for reconcile/delete. */\nexport type PveRole = 'read' | 'provision';\n\n/**\n * Where credentials come from, and which cluster they are for.\n *\n * ⚠️ A PARAMETER, NOT A CONSTANT, SO THIS PACKAGE CAN LEAVE THE ESTATE. Everything\n *   HomeFlare-specific — the mount name, the API host — belongs in the stack that declares\n *   resources, not in the provider. Anyone with an OpenBao mount that vends Proxmox API tokens can\n *   use this file unchanged; that is the whole difference between a provider and a script.\n */\nexport type PveTarget = {\n  /** OpenBao mount that vends API tokens for this host, e.g. `proxmox-c1`. */\n  readonly mount: string;\n  /**\n   * mgmt hostnames for cluster members, e.g. `node-b.mgmt.example.com`. Any member's :8006 API\n   * manages the whole cluster; `client.ts` failovers across them.\n   */\n  readonly members: readonly string[];\n  /**\n   * Which product answers at `api`. Defaults to `pve`.\n   *\n   * ★ PBS IS THE SAME CLIENT WITH A DIFFERENT AUTHORIZATION HEADER, AND THAT IS WHY THERE IS NO\n   *   SECOND CLIENT HERE. Proxmox Backup Server speaks the same `/api2/json` paths, wraps every\n   *   answer in the same `{\"data\": …}` envelope, and its OpenBao mount vends the same\n   *   `{token_id, secret}` shape — so `mint`, `pve()` and `pveOperations` all work against it\n   *   unchanged. The ONE difference is the header scheme: PVE spells it\n   *   `PVEAPIToken=<id>=<secret>` and PBS spells it `PBSAPIToken=<id>:<secret>` — a different\n   *   prefix AND a different separator.\n   *\n   * ⛔ IT IS REQUIRED, NOT OPTIONAL, AND THAT IS THE WHOLE TYPE-SAFETY ARGUMENT. A PBS target and\n   *   a PVE target are the same two strings, so with an OPTIONAL discriminant TypeScript's\n   *   structural typing would accept a PBS host wherever a PVE one belongs — and `pve()` would\n   *   then build `PVEAPIToken=<id>=<secret>` against a server wanting\n   *   `PBSAPIToken=<id>:<secret>`. Every call 401s, `pveOperations.read` folds that into \"absent\",\n   *   the plan says CREATE for an object that is plainly there, the POST is refused, and not one\n   *   symptom points at the header. Required, the mistake is a compile error instead.\n   *\n   * ⚠️ REASONED FROM PBS'S DOCUMENTED SCHEME, NOT MEASURED. The estate has no PBS credential yet\n   *   (there is no PBS mount in OpenBao), and an unauthenticated probe cannot tell the schemes\n   *   apart — `https://pbs.example.com:8007/api2/json/nodes` answers 401 to a missing header, a\n   *   PVE-shaped one and a PBS-shaped one alike. The first real token will confirm or correct it,\n   *   and a wrong guess fails closed with a 401 rather than doing something odd.\n   */\n  readonly scheme: 'pve';\n  /**\n   * Overrides which OpenBao mint TIER NAME (`<mount>/creds/<tier>`) a semantic role resolves to.\n   * Omitted or missing a role: unchanged, `role` is also the tier name, as every consumer before\n   * this field got. Present: `mintTier` below reads it first.\n   *\n   * ★ WHY A TARGET-LEVEL OVERRIDE, NOT A THIRD `PveRole`. A consumer whose OpenBao mount vends a\n   *   single least-privilege tier for BOTH read and write (one tier that can only ever reach the\n   *   scope that consumer needs, rather than the estate's general `read`/`provision` split) sets\n   *   `roles: { read: 'my-tier', provision: 'my-tier' }` and every read/diff/reconcile/delete this\n   *   package already issues resolves to that tier, with no new call site anywhere in the package.\n   *   Widening `PveRole` itself to a per-consumer string would instead touch every literal\n   *   `'read'`/`'provision'` call site across the package (`client.ts`, `lxc-read.ts`,\n   *   `lxc-task.ts`, `network-apply-read.ts`, `network-apply-run.ts`, `qemu-read.ts`,\n   *   `qemu-task.ts`, `storage-download-task.ts` — the eight this field's `mintTier` indirection\n   *   above already covers) for something only the TARGET, never the CALL, needs to know.\n   *\n   * ⛔ SET BOTH ROLES OR NEITHER (I2, red team on K-T1). An unmentioned role is NOT scoped down —\n   *   it still mints the estate-wide tier this file's own header describes (`hf-provision@pve`,\n   *   27 privileges including `Permissions.Modify`/`Sys.Modify` for `provision`). Setting only\n   *   `roles: { read: 'my-tier' }` leaves every reconcile/delete on this target minting that wide\n   *   credential while the plan output looks fully scoped down — nothing here warns. See\n   *   `docs/credentials.md`'s override paragraph for the same warning at the consumer-facing level.\n   */\n  readonly roles?: {\n    readonly read?: string;\n    readonly provision?: string;\n  };\n};\n\n/**\n * The same client against a Proxmox Backup Server. See the ⛔ on `scheme` above.\n * ⛔ NO `roles` FIELD. The estate has no PBS consumer with a scoped tier yet, and a PBS mount\n *   vending only `read`/`provision` is the same shape `mint.ts` always assumed — `mintTier` below\n *   never overrides a PBS target for exactly that reason. Add the field here, the same way, when\n *   a PBS consumer needs it.\n */\nexport type PbsTarget = {\n  readonly mount: string;\n  readonly api: string;\n  readonly scheme: 'pbs';\n};\n\n/** Either product. What `pve()` and `pveOperations` accept; what a RESOURCE accepts is narrower. */\nexport type ApiTarget = PbsTarget | PveTarget;\n\n/**\n * The OpenBao mint tier a role resolves to for `target` — `target.roles`'s override (PVE only)\n * or `role` itself, unchanged. THE single place `<mount>/creds/<tier>` gets its tier segment from\n * a `PveRole`: `mint.ts`'s path and `lease-cache.ts`'s cache key both call this rather than either\n * reading `role` or `target.roles` directly, so there is exactly one definition of \"the tier\" for\n * both to agree on — `lease-cache.ts`'s own header says why the cache needed this too, not just\n * the mint call.\n *\n * ⛔ AN OVERRIDE THAT IS NOT A PLAIN TIER NAME THROWS RATHER THAN BUILDING A PATH (M5, red team on\n *   K-T1; widened after a second red-team pass found the first fix incomplete). `role` itself is\n *   a compile-time literal and never needs this check; only `target.roles`, a plain string a\n *   caller can set to anything, does. This is an ALLOWLIST, not a denylist of `/` alone — the\n *   value is concatenated straight into `${mount}/creds/${tier}` and then into a URL (`mint.ts`),\n *   so `''`, `'..'`, `'?x'` and `'#x'` are each their own way to land on a DIFFERENT OpenBao path\n *   (a dropped segment, a parent path, a querystring, a fragment) without containing `/` at all.\n *   Every one of those produces a 404 `mint.ts`'s own `refuse` reports as a mint failure, and\n *   every `pveOperations` family folds a mint failure into \"absent\" (`unreadable-read.ts`'s ⛔),\n *   so the plan would say CREATE for an object that is plainly there instead of naming the bad\n *   config — the exact hazard the first version of this check believed it had closed. `role` is\n *   source-controlled and this fires at the first `mintTier` call, before any network request, so\n *   the fix cannot itself widen what an operator's config can reach.\n */\nconst VALID_TIER = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\nexport const mintTier = (target: ApiTarget, role: PveRole): string => {\n  if (target.scheme !== 'pve') return role;\n  const tier = target.roles?.[role];\n  if (tier === undefined) return role;\n  if (!VALID_TIER.test(tier)) {\n    throw new Error(\n      `PveTarget.roles.${role} = ${JSON.stringify(tier)} is not a valid OpenBao tier name -- ` +\n        'it would be interpolated straight into \"<mount>/creds/<tier>\" and must be a plain name ' +\n        '(letters, digits, \".\", \"_\", \"-\", not starting with one of those and not \"..\").',\n    );\n  }\n  return tier;\n};\n\n/**\n * What a mint returns.\n *\n * ⚠️ `secret` IS PRESENT AND MUST NOT BE PERSISTED. It is typed as a plain string rather than\n *   `Redacted` on purpose: Alchemy's Redacted is a STATE-ENCODING marker, not encryption, so\n *   wrapping it would imply a protection that does not exist. The protection here is that this\n *   value never leaves the function that builds the Authorization header.\n */\nexport type PveCredential = {\n  /** `hf-provision@pve!hf-provision-…` — an identifier, safe to log. */\n  readonly tokenId: string;\n  /** ⛔ NEVER LOG, NEVER PERSIST, NEVER RETURN FROM A RESOURCE. */\n  readonly secret: string;\n  /** Seconds the lease was granted for, as reported by OpenBao. */\n  readonly leaseSeconds: number;\n};\n\n/** The environment `mint` resolves OpenBao from — `process.env` unless a test passes its own. */\nexport type BaoEnvironment = Readonly<Record<string, string | undefined>>;\n\n// ★ `mint` and `authorization` live in mint.ts (2026-09-24) — this file is types only now, to\n//   stay under the 250-line cap once `PveCredentialDenied`'s catchers needed a real header. See\n//   mint.ts's own header. Importers: mint.ts, client.ts, lease-cache.ts, lxc-lifecycle.ts,\n//   network-apply.ts, credentials.test.ts.\n",
+    "/**\n * Minting one PVE/PBS credential from OpenBao: `GET /v1/<mount>/creds/<tier>`, alive for five\n * minutes. Split out of `credentials.ts` (2026-09-24) to keep that file's TYPES under the\n * 250-line cap once `PveCredentialDenied`'s catchers needed a real header there; the reasoning\n * for WHY the estate mints rather than stores a token is still credentials.ts's own header.\n *\n * ⛔ THE SECRET NEVER TOUCHES DISK, A LOG, OR ALCHEMY STATE — see credentials.ts's ⛔. Nothing\n *   here returns it to a resource; it is used to build a header and then dropped.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\nimport * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';\nimport * as Headers from 'effect/unstable/http/Headers';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\nimport { PveCredentialDenied } from './credential-errors.ts';\nimport { mintTier } from './credentials.ts';\nimport type { ApiTarget, BaoEnvironment, PveCredential, PveRole } from './credentials.ts';\n\n/** openbao v2.6.2 api/env.go:22-34 — a present BAO_* wins, even empty; else its VAULT_* twin. */\nconst baoVariable = (env: BaoEnvironment, name: string) =>\n  env[`BAO_${name}`] ?? env[`VAULT_${name}`] ?? '';\n\n/**\n * Mint one credential for `role`: `GET /v1/<mount>/creds/<tier>` on OpenBao's HTTP API, where\n * `tier` is `mintTier(target, role)` (credentials.ts) — `role` itself unless `target.roles`\n * overrides it (K-T1).\n *\n * 🔴 IT SHELLED OUT TO `bao read -format=json` UNTIL 2026-09-14. The case for the CLI was that one\n *   client could not disagree with `bao kv get` about what this machine may do. <estate>/openbao then\n *   learned twice what deciding by stderr costs — every failure read as absent, and two commands\n *   said \"absent\" in different words — so this reads STATUS CODES: 2xx is a credential, and 403\n *   (denied), 404 (no such role or mount — a mint has no \"absent\"), 503 (sealed) all fail.\n * ★ THE ENVIRONMENT CONTRACT IS STILL THE CLI's, READ THE CLI's WAY, which keeps the case above\n *   true (openbao v2.6.2 api/client.go:34-66, 370, 503-507, 761-762, 776-785): BAO_AGENT_ADDR over\n *   BAO_ADDR over https://127.0.0.1:8200; BAO_NAMESPACE as X-Vault-Namespace; BAO_TOKEN as\n *   X-Vault-Token; X-Vault-Request always. <estate>/openbao/src/bao-address.ts has the long form.\n * ★ AGENT MODE IS NO BAO_TOKEN AND NO TOKEN HEADER. An Agent or Proxy listener with\n *   `api_proxy { use_auto_auth_token = true }` (or the older `cache { … }`) substitutes its\n *   auto-auth token exactly when a request carries none — command/agentproxyshared/cache/handler.go\n *   :29-38, command/agent.go:517-541, command/agent/config/config.go:288-292, and\n *   website/content/docs/agent-and-proxy/agent/apiproxy.mdx:57-62. The CLI's token-file fallback\n *   is deliberately not read. ⚠️ So an unset BAO_TOKEN aimed at a SERVER rather than an agent is a\n *   403, which reads like a missing grant rather than a missing variable.\n * ★ UNIX SOCKETS: `unix:///path` is plain HTTP to `localhost` over that socket, as the CLI does it\n *   (api/client.go:654-667). Bun's fetch takes a `unix` option; `FetchHttpClient.RequestInit` is\n *   Effect's documented way to pass fetch options, read from the calling fiber (effect\n *   FetchHttpClient.ts:59-72). Off Bun it REFUSES, rather than reach http://localhost:80.\n */\nexport const mint = (target: ApiTarget, role: PveRole, env: BaoEnvironment = process.env) =>\n  Effect.gen(function* () {\n    // ⛔ THE ONE PLACE A `PveRole` BECOMES A TIER NAME. `mintTier` (credentials.ts) reads\n    //   `target.roles` when the target overrides it; every other line in this function uses\n    //   `tier`, never `role`, for anything that reaches OpenBao or an error message.\n    const tier = mintTier(target, role);\n    const path = `${target.mount}/creds/${tier}`;\n    // ⛔ METHOD, PATH AND OpenBao's `errors` ONLY — never a header (the token), never a success\n    //   body (the credential is IN it, so echoing it would print the secret into a log).\n    const refuse = (status: number, detail: string) =>\n      new Error(`OpenBao GET /v1/${path} -> ${status === 0 ? 'no response' : status}: ${detail}`);\n    const address =\n      baoVariable(env, 'AGENT_ADDR') || baoVariable(env, 'ADDR') || 'https://127.0.0.1:8200';\n    const socket = address.startsWith('unix://') ? address.slice('unix://'.length) : undefined;\n    const base = socket === undefined ? address.replace(/\\/+$/, '') : 'http://localhost';\n    const headers: Record<string, string> = { 'X-Vault-Request': 'true' };\n    const namespace = baoVariable(env, 'NAMESPACE');\n    if (namespace !== '') headers['X-Vault-Namespace'] = namespace;\n    const token = baoVariable(env, 'TOKEN');\n    if (token !== '') headers['X-Vault-Token'] = token;\n    if (socket !== undefined && !('Bun' in globalThis)) {\n      return yield* Effect.fail(refuse(0, 'a unix:// address needs Bun fetch; this is not Bun'));\n    }\n\n    const client = yield* HttpClient.HttpClient;\n    // ⛔ Effect records request headers on the client span, and its default redaction list does\n    //   not name x-vault-token (effect Headers.ts:753-762). It is added for this call.\n    const redacted = yield* Headers.CurrentRedactedNames;\n    const defaults = Option.getOrElse(\n      yield* Effect.serviceOption(FetchHttpClient.RequestInit),\n      () => ({}),\n    );\n    const request = HttpClientRequest.get(`${base}/v1/${path}`).pipe(\n      HttpClientRequest.setHeaders(headers),\n    );\n    const exchange = client.execute(request).pipe(\n      Effect.flatMap((response) =>\n        Effect.map(response.text, (text) => ({ status: response.status, text })),\n      ),\n      // ⚠️ The CLI's default client timeout (api/client.go:324) — a hung agent must not hang a plan.\n      Effect.timeout('60 seconds'),\n      Effect.provideService(Headers.CurrentRedactedNames, [...redacted, 'x-vault-token']),\n    );\n    // ⚠️ `| undefined` under exactOptionalPropertyTypes: `socket` is narrowed to a string\n    //   only on the branch below, so the object literal genuinely carries\n    //   `unix: string | undefined` and the type must say so. The alternative — building\n    //   the key conditionally — hides that this request is the unix-socket path.\n    const init: RequestInit & { unix?: string | undefined } = { ...defaults, unix: socket };\n    const { status, text } = yield* (\n      socket === undefined\n        ? exchange\n        : Effect.provideService(exchange, FetchHttpClient.RequestInit, init)\n    ).pipe(\n      // ⛔ `.message` only — the error object holds the request, and the request holds the token.\n      Effect.mapError((cause) => refuse(0, cause.message)),\n    );\n\n    let parsed:\n      | {\n          lease_duration?: unknown;\n          data?: { token_id?: unknown; secret?: unknown };\n          errors?: unknown;\n        }\n      | undefined;\n    try {\n      parsed = JSON.parse(text) as typeof parsed;\n    } catch {\n      parsed = undefined;\n    }\n    if (status < 200 || status >= 300) {\n      const errors = parsed?.errors;\n      const isOpenBaoBody = Array.isArray(errors);\n      const detail = isOpenBaoBody ? errors.map(String).join('; ') : 'not an OpenBao error body';\n      /**\n       * ⛔ 403 GETS THE TYPED TAG ONLY WITH A GENUINE OpenBao ERROR BODY — found on adversarial\n       *   review 2026-09-24. Status alone is not enough: a WAF, a proxy in front of OpenBao, or an\n       *   mTLS terminator can answer 403 without OpenBao ever seeing the request, and `parsed` is\n       *   then `undefined`/`errors` is not an array (the `try`/`catch` above, or a body that\n       *   parses but isn't OpenBao's shape). That is an infrastructure fault, not \"this identity\n       *   is denied this role\" — tagging it `PveCredentialDenied` would fold a REAL outage into\n       *   \"unreadable, report noop\" exactly as quietly as the bug this fix exists to remove. Only\n       *   a parsed `errors` array is OpenBao's own documented error shape (mint.ts's own header),\n       *   so it is the one signal trusted here.\n       */\n      if (status === 403 && isOpenBaoBody) {\n        return yield* Effect.fail(new PveCredentialDenied({ detail, mount: target.mount, tier }));\n      }\n      return yield* Effect.fail(refuse(status, detail || '(no errors given)'));\n    }\n    const tokenId = parsed?.data?.token_id;\n    const secret = parsed?.data?.secret;\n    if (typeof tokenId !== 'string' || typeof secret !== 'string') {\n      // ⛔ REFUSE RATHER THAN RETURN A HALF CREDENTIAL, and again WITHOUT quoting the body.\n      return yield* Effect.fail(\n        new Error(\n          `${target.mount}/creds/${tier} returned no token_id/secret. Either this approle lacks ` +\n            `the grant, or the mount is not ${target.mount}. Say which mount and role you needed ` +\n            `than falling back to a stored credential -- every stored PVE token is read-only.`,\n        ),\n      );\n    }\n    const lease = parsed?.lease_duration;\n    const leaseSeconds = typeof lease === 'number' ? lease : 0;\n    return { leaseSeconds, secret, tokenId } satisfies PveCredential;\n  });\n\n/**\n * The header PVE wants. `PVEAPIToken=<tokenid>=<secret>`.\n *\n * ⚠️ THE SEPARATOR IS `=`, NOT `:`. Proxmox rejects the colon form with a 401 that says only\n *   \"authentication failure\", which reads as a bad credential rather than as a malformed header.\n */\nexport const authorization = (credential: PveCredential, target: ApiTarget): string =>\n  target.scheme === 'pbs'\n    ? `PBSAPIToken=${credential.tokenId}:${credential.secret}`\n    : `PVEAPIToken=${credential.tokenId}=${credential.secret}`;\n",
+    "/**\n * `credentials.ts`'s one typed mint failure (S21) — split out to keep that file under the\n * 250-line cap once this class grew a real header (2026-09-24, the cries-wolf fix).\n */\nimport * as Data from 'effect/Data';\n\n/**\n * OpenBao answered 403 to `GET /v1/<mount>/creds/<tier>`: this identity's AppRole has no grant\n * for `tier` on `mount` — measured 2026-09-24 as \"the agent lane cannot mint `provision`\" (the\n * lane's policy grants `read` but not `provision`). A TYPED tag, not the plain `Error` every\n * other mint failure still is (404 no such role/mount, 503 sealed, a network failure), because\n * this ONE case means \"refused, not evidence of anything about the object\" — a family's\n * `readOrUnreadable` (unreadable-read.ts) `catchTag`s exactly this, never any other mint\n * failure, which stays a hard error precisely because it is NOT a scoped refusal.\n *\n * ⛔ WHY NOT EVERY NON-2xx: A 503 (sealed) or a 404 (misconfigured mount/role) is the estate\n *   BROKEN, not this identity being narrowly scoped — folding those into \"unreadable, report\n *   noop\" would hide a real outage behind a quiet, misleadingly reassuring plan. Only 403 is\n *   \"this identity, this role, denied\" and safe to read as \"cannot see, not evidence of absence\".\n *\n * ⛔ NO `role` FIELD (removed, K-T1 second red-team pass). `mint.ts` knows the semantic `PveRole`\n *   it was asked for, but `lease-cache.ts`'s synthetic `mintForKey` reconstruction (after M3\n *   dropped `role` from `LeaseKey`) cannot supply the ORIGINAL caller's role on a cache-path\n *   mint — only the tier. A `role` field would then read as `'read'` on every pve cache miss\n *   regardless of which role was actually denied, which is exactly the stale/misleading-field\n *   trap M6 existed to close, one layer down. `tier` alone is what the message reads and what\n *   `readOrUnreadable`'s callers act on; nothing needs the semantic role name.\n */\nexport class PveCredentialDenied extends Data.TaggedError('PveCredentialDenied')<{\n  readonly mount: string;\n  /**\n   * The OpenBao mint TIER actually requested (`credentials.ts`'s `mintTier`). ⛔ THE MESSAGE\n   *   READS THIS, NOT A SEMANTIC ROLE NAME: printing `'read'` for a denied `talos-provision`\n   *   mint would spell it as `creds/read`, exactly the path that was never called — silently\n   *   wrong at precisely the moment an operator is reading this string to decide whether a\n   *   grant, a policy or a target config is wrong (K-T1's own PR discussion).\n   */\n  readonly tier: string;\n  readonly detail: string;\n}> {\n  override get message(): string {\n    return (\n      `OpenBao GET /v1/${this.mount}/creds/${this.tier} -> 403: ${this.detail}. This identity's ` +\n      'AppRole has no grant for this role -- a refused read, not evidence the object is gone.'\n    );\n  }\n}\n",
     "/**\n * C1 cluster members: ordered failover, last-good preference, transport classification.\n *\n * ★ ANY MEMBER'S :8006 API MANAGES THE WHOLE CLUSTER — PVE proxies node paths itself — so the\n *   provider reaches the cluster through whichever member is up, not through one pinned node.\n *\n * ⛔ NEVER cluster-c1.example.com: it resolves to 192.0.2.250, which nothing serves.\n */\nimport * as Cause from 'effect/Cause';\nimport type * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Result from 'effect/Result';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientError from 'effect/unstable/http/HttpClientError';\nimport type * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\nimport type * as HttpClientResponse from 'effect/unstable/http/HttpClientResponse';\nimport type { PveTarget } from './credentials.ts';\n\nexport const PVE_API_PORT = 8006;\n\n/** Strict TLS, always :8006 — each node's certificate carries its mgmt name as a SAN. */\nexport const pveApiBase = (member: string) => `https://${member}:${String(PVE_API_PORT)}/api2/json`;\n\n/**\n * Bound on ONE member attempt, shared by `client.ts`'s `executeOnCluster` and\n * `distilled-pve.ts`'s `runPveWith` — both loop over `orderedMembers` and both call this file's\n * classifiers, so one constant keeps them in the same failure-mode boundary.\n *\n * ⛔ MEASURED GAP, FIXED 2026-09-24: before this, NOTHING bounded a single attempt. A member that\n *   accepted the TCP connection but never answered hung the whole call forever — the for-loop\n *   never produced a failure for `isTransportFailure`/`isPreSendTransport` to classify, so it\n *   never advanced to a healthy member. `isTimeoutCause` below existed already (written for this\n *   exact case, per its own comment: \"no answer after connect\") but nothing ever called\n *   `Effect.timeout` to produce one.\n * ★ TB4 (the live 3-member cluster, `homeflare-proxmox/src/target.ts`) waits at most 3× this\n *   before `PveClusterExhausted` — well under S26's ~90-second ceiling on a bounded wait.\n */\nexport const MEMBER_TIMEOUT: Duration.Input = '20 seconds';\n\n/** Process-scoped last member that answered, keyed by OpenBao mount (= one PVE cluster). */\nconst lastGoodByMount = new Map<string, string>();\n\n/** ⚠️ TESTS ONLY — resets sticky member choice between cases. */\nexport const resetLastGoodForTest = () => lastGoodByMount.clear();\n\nexport const noteGoodMember = (target: PveTarget, member: string) => {\n  lastGoodByMount.set(target.mount, member);\n};\n\n/** Last-good first, then the rest in configuration order. */\nexport const orderedMembers = (target: PveTarget): readonly string[] => {\n  const preferred = lastGoodByMount.get(target.mount);\n  if (preferred === undefined || !target.members.includes(preferred)) return target.members;\n  return [preferred, ...target.members.filter((member) => member !== preferred)];\n};\n\nconst errorCode = (cause: unknown): string | undefined => {\n  if (cause !== null && typeof cause === 'object') {\n    if ('code' in cause && typeof cause.code === 'string') return cause.code;\n    if ('cause' in cause) return errorCode((cause as { cause: unknown }).cause);\n  }\n  return undefined;\n};\n\nconst isTimeoutCause = (cause: unknown): boolean => {\n  const code = errorCode(cause);\n  if (code === 'AbortError' || code === 'ETIMEDOUT' || code === 'UND_ERR_CONNECT_TIMEOUT') {\n    return true;\n  }\n  return cause instanceof Error && /timed out|timeout/i.test(cause.message);\n};\n\n/**\n * Error codes that PROVE the request never left this machine.\n *\n * ★ MEASURED 2026-09-14 through Effect's FetchHttpClient on Bun 1.4. The codes are Bun's, not\n *   Node's, which made the first draft's Node-only list dead code for the commonest case:\n *     connection refused        cause.code = \"ConnectionRefused\"   (Node says ECONNREFUSED)\n *     name does not resolve     cause.code = \"ENOTFOUND\"\n *     wrong certificate name    cause.code = \"ERR_TLS_CERT_ALTNAME_INVALID\"\n *     no answer after connect   Effect's TimeoutError — not an HttpClientError at all\n * ⛔ CODES ONLY, NEVER MESSAGE TEXT. The first draft also matched /TLS|SSL|certificate/ in the\n *   message, and a connection that drops mid-response can mention TLS too — which would have sent a\n *   write that had already landed to a second node.\n * ⚠️ A CERTIFICATE failure is pre-send: the handshake has to finish before a byte of the request is\n *   written. A generic ERR_SSL_* is deliberately absent, because it can happen mid-stream.\n */\nconst PRE_SEND_CODES = new Set(['ConnectionRefused', 'ECONNREFUSED', 'ENOTFOUND', 'EAI_AGAIN']);\n\nconst isCertificateCode = (code: string) =>\n  /^(ERR_TLS_CERT_|CERT_|UNABLE_TO_VERIFY_|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT)/.test(code);\n\nconst isPreSendCause = (cause: unknown): boolean => {\n  const code = errorCode(cause);\n  return code !== undefined && (PRE_SEND_CODES.has(code) || isCertificateCode(code));\n};\n\n/**\n * Effect HttpClientError.reason._tag — see effect HttpClientError.ts RequestError vs ResponseError.\n * ★ TransportError | InvalidUrlError | EncodeError occur before a response exists; StatusCodeError\n *   and kin include a response. client.execute does NOT filter status, so HTTP answers are never\n *   TransportError — only the transport layer is.\n * ★ `Cause.TimeoutError` (from `MEMBER_TIMEOUT` below, via `Effect.timeout`) counts too — a read\n *   with no side effect to duplicate fails over on ANY transport failure, a hang included.\n */\nexport const isTransportFailure = (cause: unknown): boolean => {\n  if (Cause.isTimeoutError(cause)) return true;\n  if (!HttpClientError.isHttpClientError(cause)) return false;\n  const tag = cause.reason._tag;\n  return tag === 'TransportError' || tag === 'InvalidUrlError' || tag === 'EncodeError';\n};\n\n/**\n * Pre-send only: connection refused, DNS, a certificate refused — never a timeout after connect.\n * ⛔ `Cause.TimeoutError` (MEMBER_TIMEOUT firing) falls through to `false` here on purpose, same\n *   as any other non-`HttpClientError` cause: the request may already have reached the member, so\n *   a write must not repeat it elsewhere.\n */\nexport const isPreSendTransport = (cause: unknown): boolean => {\n  if (!HttpClientError.isHttpClientError(cause)) return false;\n  const { reason } = cause;\n  if (reason._tag === 'InvalidUrlError' || reason._tag === 'EncodeError') return true;\n  if (reason._tag === 'TransportError') {\n    if (isTimeoutCause(reason.cause)) return false;\n    return isPreSendCause(reason.cause);\n  }\n  return false;\n};\n\nexport const describeTransport = (cause: unknown): string => {\n  if (Cause.isTimeoutError(cause)) return `timed out after ${String(MEMBER_TIMEOUT)}`;\n  if (HttpClientError.isHttpClientError(cause)) return cause.message;\n  return String(cause);\n};\n\nexport type MemberAttempt = { readonly member: string; readonly why: string };\n\nexport type PveMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';\n\n/**\n * Run one request against cluster members with failover.\n *\n * ⛔ A POST/PUT/DELETE WHOSE REQUEST MAY HAVE REACHED A MEMBER MUST NOT BE SENT AGAIN TO ANOTHER.\n *   Only fail over a write on a provably pre-send transport failure — connection refused, DNS or a\n *   refused certificate. A timeout after sending is NOT pre-send: fail it, never repeat it. An HTTP\n *   status of any kind, including 5xx and PVE's 596, is the answer from a live member — retrying\n *   elsewhere can repeat a write.\n *\n * ★ Reads fail over on any transport failure, including timeout — no side effect to duplicate.\n *   MEASURED 2026-09-14: full C1 plans stayed all-noop with the first member refused (127.0.0.1)\n *   and with it unresolvable (n9.invalid).\n *\n * @param timeout Bound on ONE member's attempt — defaults to `MEMBER_TIMEOUT`. A test passes a\n *   short one to prove failover happens without waiting out the real bound; production code never\n *   overrides it.\n */\nexport const executeOnCluster = (\n  target: PveTarget,\n  method: PveMethod,\n  path: string,\n  build: (apiBase: string) => HttpClientRequest.HttpClientRequest,\n  timeout: Duration.Input = MEMBER_TIMEOUT,\n): Effect.Effect<\n  HttpClientResponse.HttpClientResponse,\n  {\n    readonly tag: 'cluster';\n    readonly method: PveMethod;\n    readonly path: string;\n    readonly attempts: readonly MemberAttempt[];\n  },\n  HttpClient.HttpClient\n> =>\n  Effect.gen(function* () {\n    /**\n     * ★ `HttpClient`, NOT RAW `fetch`, BECAUSE THAT IS WHAT ALCHEMY'S OWN PROVIDERS USE. Its\n     *   Hetzner provider builds on `FetchHttpClient.layer` and the `HttpClient` service\n     *   (src/Hetzner/Providers.ts), and there is no bare `fetch` anywhere in its Docker,\n     *   Kubernetes or GitHub providers. Going through the service rather than the global buys\n     *   the things a provider actually needs: a typed error channel instead of a thrown promise,\n     *   interruption when a plan is cancelled, whatever tracing the runtime has installed, and a\n     *   client that can be swapped for a stub in a test without monkey-patching a global.\n     *\n     * ⚠️ THE REQUIREMENT IS REAL AND IT PROPAGATES. Every operation carries `HttpClient`, so every\n     *   resource's Requirements type names it (PveRequirements in resource.ts) and the stack\n     *   provides `FetchHttpClient.layer`. That is the cost of the above, paid once.\n     */\n    const client = yield* HttpClient.HttpClient;\n    const isWrite = method !== 'GET';\n    const attempts: MemberAttempt[] = [];\n    for (const member of orderedMembers(target)) {\n      const outcome = yield* client\n        .execute(build(pveApiBase(member)))\n        .pipe(Effect.timeout(timeout), Effect.result);\n      if (Result.isSuccess(outcome)) {\n        noteGoodMember(target, member);\n        return outcome.success;\n      }\n      const why = describeTransport(outcome.failure);\n      attempts.push({ member, why });\n      const mayRetry = isWrite\n        ? isPreSendTransport(outcome.failure)\n        : isTransportFailure(outcome.failure);\n      if (!mayRetry) {\n        return yield* Effect.fail({ attempts, method, path, tag: 'cluster' as const });\n      }\n    }\n    return yield* Effect.fail({ attempts, method, path, tag: 'cluster' as const });\n  });\n",
-    "/**\n * The \"unreadable\" outcome a refused read produces — distinct from `undefined` (genuinely\n * absent) and from a real attributes object (present) — so `diff` stops treating a REFUSED read\n * the same as a confirmed-gone one. Fixes the \"cries wolf\" bug (measured 2026-09-24): on a lane\n * whose credential cannot mint `provision`, every already-correct ACL and storage row read back\n * as absent, and `diff` forced `update` for every one of them without comparing a single field,\n * because `.pipe(Effect.orElseSucceed(() => undefined))` folds every failure — a genuine 404, a\n * network blip, AND a permission refusal — into the one \"absent\" value `diff` cannot tell apart.\n *\n * ★ WHY A SENTINEL, NOT A FAILED `diff`. Upstream's `Diff` type is exactly\n *   `NoopDiff | UpdateDiff | ReplaceDiff` (`packages/alchemy/src/Diff.ts@v2.0.0-beta.79`) — there\n *   is no fourth \"unreadable\" action to return. And `Plan.ts`'s resource pass runs every\n *   resource's `diff` under `Effect.exit`, then FAILS THE WHOLE PLAN if even one failed\n *   (`diffFailures.length > 0` -> `Effect.failCause`, `Plan.ts@v2.0.0-beta.79` ~lines 1711-1731).\n *   So making `diff` FAIL on a refused read would not report one honest row — it would abort\n *   `bun run plan` for every OTHER resource in the stack too, worse than today's false \"update\".\n *   `{ action: 'noop' }` plus a logged warning is the only outcome that (a) never forces a write\n *   on a lane that cannot prove one is needed and (b) never takes the rest of the plan down with\n *   it — the \"noop-with-warning\" reading of the fix, over the alternative of a typed plan error.\n *\n * ⛔ ONLY THE CREDENTIAL DENIAL IS CAUGHT HERE. Other errors propagate to the caller.\n *   Legacy callers may still fold them, but the typed-absence follow-up makes User/Group/\n *   Storage catch only their SDK missing-object tag. Never infer a resource is absent from\n *   this sentinel. See credential-errors.ts's own ⛔ for why the OpenBao mint's 403 qualifies.\n */\nimport * as Effect from 'effect/Effect';\nimport type { PveCredentialDenied } from './credential-errors.ts';\n\n/** Distinct from `undefined` (absent) and from a real attributes object (present). */\nexport const UNREADABLE = Symbol('pve-unreadable');\nexport type Unreadable = typeof UNREADABLE;\n\n/**\n * Catches ONLY `PveCredentialDenied` and returns the sentinel. Compose this BEFORE the\n * caller's absence handling so a credential refusal cannot become a genuine absence.\n * This helper itself classifies neither SDK missing-object tags nor transport failures.\n *\n * ⚠️ `E | PveCredentialDenied` IN, `E` OUT — not a generic `E` narrowed by `Exclude`. `catchTag`\n *   needs the tag to be STATICALLY present in the error union to typecheck at all; a bare\n *   unconstrained `E` gives it nothing to match against. Every caller's `runPve` already carries\n *   `PveCredentialDenied` explicitly (distilled-pve.ts's own ★ on why), so this signature costs\n *   nothing at the call site.\n */\nexport const readOrUnreadable = <A, E, R>(\n  effect: Effect.Effect<A, E | PveCredentialDenied, R>,\n): Effect.Effect<A | Unreadable, E, R> =>\n  effect.pipe(Effect.catchTag('PveCredentialDenied', () => Effect.succeed(UNREADABLE)));\n\n/**\n * The warning `diff` logs when it reports `noop` for a row it could not actually read — visible\n * in `bun run plan`'s own output (Effect's default logger), even though the Diff type has\n * nowhere to carry the distinction through to the printed action. See the header for why a log\n * line, not a failed diff or a fourth Diff action, is what \"the plan reports\" means here.\n */\nexport const unreadableWarning = (type: string, identity: string): Effect.Effect<void> =>\n  Effect.logWarning(\n    `${type} ${identity}: the read was refused (no grant for this credential's role) -- ` +\n      'reporting noop rather than forcing an update with nothing compared. Re-plan on a lane ' +\n      'that can read this object before trusting this row.',\n  );\n",
+    "/**\n * The \"unreadable\" outcome a refused read produces — distinct from `undefined` (genuinely\n * absent) and from a real attributes object (present) — so `diff` stops treating a REFUSED read\n * the same as a confirmed-gone one. Fixes the \"cries wolf\" bug (measured 2026-09-24): on a lane\n * whose credential cannot mint `provision`, every already-correct ACL and storage row read back\n * as absent, and `diff` forced `update` for every one of them without comparing a single field,\n * because `.pipe(Effect.orElseSucceed(() => undefined))` folds every failure — a genuine 404, a\n * network blip, AND a permission refusal — into the one \"absent\" value `diff` cannot tell apart.\n *\n * ★ WHY A SENTINEL, NOT A FAILED `diff`. Upstream's `Diff` type is exactly\n *   `NoopDiff | UpdateDiff | ReplaceDiff` (`packages/alchemy/src/Diff.ts@v2.0.0-beta.79`) — there\n *   is no fourth \"unreadable\" action to return. And `Plan.ts`'s resource pass runs every\n *   resource's `diff` under `Effect.exit`, then FAILS THE WHOLE PLAN if even one failed\n *   (`diffFailures.length > 0` -> `Effect.failCause`, `Plan.ts@v2.0.0-beta.79` ~lines 1711-1731).\n *   So making `diff` FAIL on a refused read would not report one honest row — it would abort\n *   `bun run plan` for every OTHER resource in the stack too, worse than today's false \"update\".\n *   `{ action: 'noop' }` plus a logged warning is the only outcome that (a) never forces a write\n *   on a lane that cannot prove one is needed and (b) never takes the rest of the plan down with\n *   it — the \"noop-with-warning\" reading of the fix, over the alternative of a typed plan error.\n *\n * ⛔ ONLY THE CREDENTIAL DENIAL IS CAUGHT HERE. Other errors propagate to the caller.\n *   Legacy callers may still fold them, but the typed-absence follow-up makes User/Group/\n *   Storage catch only their SDK missing-object tag. Never infer a resource is absent from\n *   this sentinel. See credential-errors.ts's own ⛔ for why the OpenBao mint's 403 qualifies.\n */\nimport * as Effect from 'effect/Effect';\nimport type { PveCredentialDenied } from './credential-errors.ts';\n\n/** Distinct from `undefined` (absent) and from a real attributes object (present). */\nexport const UNREADABLE = Symbol('pve-unreadable');\nexport type Unreadable = typeof UNREADABLE;\n\n/**\n * Catches ONLY `PveCredentialDenied` and returns the sentinel. Compose this BEFORE the\n * caller's absence handling so a credential refusal cannot become a genuine absence.\n * This helper itself classifies neither SDK missing-object tags nor transport failures.\n *\n * ⚠️ `E | PveCredentialDenied` IN, `E` OUT — not a generic `E` narrowed by `Exclude`. `catchTag`\n *   needs the tag to be STATICALLY present in the error union to typecheck at all; a bare\n *   unconstrained `E` gives it nothing to match against. Every caller's `runPve` already carries\n *   `PveCredentialDenied` explicitly (distilled-pve.ts's own ★ on why), so this signature costs\n *   nothing at the call site.\n */\nexport const readOrUnreadable = <A, E, R>(\n  effect: Effect.Effect<A, E | PveCredentialDenied, R>,\n): Effect.Effect<A | Unreadable, E, R> =>\n  effect.pipe(Effect.catchTag('PveCredentialDenied', () => Effect.succeed(UNREADABLE)));\n\n/**\n * The warning `diff` logs when it reports `noop` for a row it could not actually read — visible\n * in `bun run plan`'s own output (Effect's default logger), even though the Diff type has\n * nowhere to carry the distinction through to the printed action. See the header for why a log\n * line, not a failed diff or a fourth Diff action, is what \"the plan reports\" means here.\n *\n * ⛔ M6 (Opus red team, K-T1): NAMES `mount` AND `tier`, NOT JUST THE RESOURCE. Before this, the\n *   line read \"no grant for this credential's role\" with nothing to act on — an operator debugging\n *   a scoped-down `PveTarget.roles` override (the whole point of K-T1) had to go re-derive which\n *   mount and tier the read actually asked OpenBao for before they could even open that mount's\n *   policy. `PveCredentialDenied`'s own message already made this exact call — reading `tier`, not\n *   `role`, per that class's own ⛔ — so this warning takes the same two fields for the same reason.\n */\nexport const unreadableWarning = (\n  type: string,\n  identity: string,\n  mount: string,\n  tier: string,\n): Effect.Effect<void> =>\n  Effect.logWarning(\n    `${type} ${identity}: the read of ${mount}/creds/${tier} was refused (no grant for this ` +\n      \"credential's role) -- reporting noop rather than forcing an update with nothing compared. \" +\n      'Re-plan on a lane that can read this object before trusting this row.',\n  );\n",
     "/**\n * A PBS webhook body that posts one Alertmanager v2 alert — `POST /api/v2/alerts` takes a JSON\n * ARRAY of `postableAlert`, each with a required `labels` map and an optional `annotations` map,\n * every value a string (Alertmanager's api/v2/openapi.yaml, read at main 2026-09-22).\n *\n * ★ PURE TEXT, NOT A RENDERER. PBS renders it, with Handlebars, at send time: `{{ severity }}`,\n *   `{{ title }}`, `{{ message }}`, `{{ timestamp }}` and `{{ fields.<name> }}` are the\n *   notification, and `json`, `escape` and `url-encode` are the only helpers\n *   (proxmox-notify endpoints/webhook.rs `setup_handlebars`, read at HEAD 2026-09-22).\n *\n * ⛔ THERE IS NO ESCAPING UNLESS THE TEMPLATE ASKS FOR IT. The webhook's Handlebars registers\n *   `no_escape` (\"There is no escape.\"), so `\"{{ message }}\"` breaks the JSON the first time a\n *   task log holds a quote or a newline — and a failed job's message is exactly a task log. Every\n *   value below goes through `json`, which emits a complete, quoted JSON string.\n * ⛔ A FIELD THE NOTIFICATION DOES NOT CARRY MUST NOT BE REACHED FOR BARE. `escape` on a missing\n *   field fails the whole render, and the notification is then lost — not degraded. MEASURED\n *   (2026-09-22) with handlebars-rust 5.1.2 and the webhook's three helpers restated from source:\n *   `{{ escape fields.job-id }}` over no fields errors \"param at index 0 required but not found\";\n *   `{{ json fields.job-id }}` renders `null`, valid JSON but not a label value. Garbage\n *   collection has no `job-id`, and the UI's \"Test\" button sends a notification with NO fields at\n *   all (lib.rs `test_target`). So every field-derived label sits inside\n *   `{{#if}}`, ends with its own comma, and the labels after them are always there: whichever\n *   fields are present, the object stays valid JSON.\n *\n * ⚠️ ALERTMANAGER RESOLVES IT BY ITSELF. With no `endsAt` it sets `now + resolve_timeout` (5m by\n *   default, api/v2/api.go `postAlertsHandler`), and PBS never sends a resolve — so a receiver\n *   with `send_resolved: true` reports \"resolved\" five minutes after a failure that nobody fixed.\n *   Page on the firing notification; do not read the resolve as a recovery.\n * ⚠️ `severity` IS PBS'S WORD, not Alertmanager convention: `info`, `notice`, `warning`, `error`,\n *   `unknown`. Route on `severity=\"error\"`, or relabel it in the Alertmanager config.\n */\n\nexport interface AlertmanagerBodyOptions {\n  /** The `alertname` label. Default `PbsNotification`; `job_type` says which job it was. */\n  readonly alertname?: string;\n  /** The `source` label. Default `pbs`. */\n  readonly source?: string;\n  /** Optional `generatorURL` — an absolute link back to the PBS UI. */\n  readonly generatorURL?: string;\n}\n\n/**\n * ⛔ AN OPTION IS PASTED INTO THE TEMPLATE, SO IT MAY NOT CARRY TEMPLATE SYNTAX. A `{{` in an\n *   alert name would be rendered by PBS as an expression; a brace or backslash is refused here\n *   rather than escaped, because Handlebars' escape rules are the renderer's, not this file's.\n */\nconst literal = (label: string, value: string): string => {\n  if (/[{}\\\\]/.test(value) || value === '') {\n    throw new Error(\n      `alertmanagerAlertBody: ${label} must be non-empty and hold no '{', '}' or '\\\\'`,\n    );\n  }\n  return JSON.stringify(value);\n};\n\n/**\n * ⛔ AN ABSOLUTE http(s) URL OR NOTHING. Alertmanager validates `generatorURL` as `format: uri`\n *   (api/v2/openapi.yaml) and answers 422 for the WHOLE post — so a typo here would not degrade\n *   one field, it would lose every notification, and only at send time.\n */\nconst absoluteUrl = (value: string): string => {\n  const text = literal('generatorURL', value);\n  let protocol = '';\n  try {\n    protocol = new URL(value).protocol;\n  } catch {\n    // not a URL at all: refused below, like a relative one\n  }\n  if (protocol !== 'https:' && protocol !== 'http:') {\n    throw new Error('alertmanagerAlertBody: generatorURL must be an absolute http(s) URL');\n  }\n  return text;\n};\n\n/** Label name → notification field. ⚠️ Label names must match `[a-zA-Z_][a-zA-Z0-9_]*`. */\nconst FIELD_LABELS: readonly (readonly [label: string, field: string])[] = [\n  ['job_type', 'type'],\n  ['job_id', 'job-id'],\n  ['datastore', 'datastore'],\n  ['hostname', 'hostname'],\n];\n\n/**\n * The body template. Declare it on a webhook target together with `Content-Type:\n * application/json`, method `post`, and the URL `<alertmanager>/api/v2/alerts`.\n *\n * ★ `fields.job-id` IS A VALID PATH: Handlebars-rust 5 (the version proxmox-notify pins) allows\n *   `-` in an identifier (grammar.pest `symbol_char`), as handlebars.js does. The same scratch\n *   build rendered this template for a GC failure, a verify failure and a field-less test\n *   notification, and each parsed as JSON with string-only labels. The adversarial review re-ran\n *   it over the test file's whole matrix — every PBS event's fields x five severities x hostile\n *   text, 840 renders with and without `generatorURL` — and every one parsed (2026-09-22).\n * ⚠️ THAT BUILD IS NOT PBS. The first real notification is the measurement that counts: send one\n *   with the target's \"Test\" button and read what Alertmanager received.\n */\nexport const alertmanagerAlertBody = (options: AlertmanagerBodyOptions = {}): string => {\n  const alertname = literal('alertname', options.alertname ?? 'PbsNotification');\n  const source = literal('source', options.source ?? 'pbs');\n  const labels = FIELD_LABELS.map(\n    ([label, field]) =>\n      `      {{#if fields.${field}}}\"${label}\": {{ json fields.${field} }},{{/if}}`,\n  );\n  const link =\n    options.generatorURL === undefined\n      ? ''\n      : `,\\n    \"generatorURL\": ${absoluteUrl(options.generatorURL)}`;\n  return [\n    '[',\n    '  {',\n    '    \"labels\": {',\n    ...labels,\n    '      \"severity\": {{ json severity }},',\n    `      \"alertname\": ${alertname},`,\n    `      \"source\": ${source}`,\n    '    },',\n    '    \"annotations\": {',\n    '      \"summary\": {{ json title }},',\n    '      \"description\": {{ json message }},',\n    '      \"timestamp\": \"{{ timestamp }}\"',\n    `    }${link}`,\n    '  }',\n    ']',\n    '',\n  ].join('\\n');\n};\n",
-    "/**\n * `Proxmox.ApiToken` — a PVE API token: the thing a service actually authenticates as.\n *\n * ⛔ THE SECRET EXISTS FOR ONE HTTP RESPONSE AND THEN NOWHERE. MEASURED from the cluster's own\n *   schema: POST returns `[\"full-tokenid\",\"info\",\"value\"]`; PUT returns `[\"comment\",\"expire\",\n *   \"full-tokenid\",\"privsep\",\"value\"]` with `value` present ONLY when `regenerate` was set; GET\n *   returns `[\"comment\",\"expire\",\"privsep\"]` and never the secret. PVE says it plainly on the\n *   POST: the value \"needs to be stored as it cannot be retrieved afterwards\".\n *\n * ⛔ SO A TOKEN THIS RESOURCE CREATES IS UNUSABLE, AND SAYING SO IS THE POINT OF THIS BLOCK. The\n *   secret may not become an attribute: Alchemy persists attributes UNENCRYPTED, and this estate's\n *   state store is a Postgres dumped nightly (the ⛔ in credentials.ts). So `reconcile` refuses\n *   before any POST, and what would land is a live credential in `/etc/pve/user.cfg` whose secret\n *   nobody holds. No `regenerate` rescues it, because a regenerated value is discarded the same\n *   way. The only escape is an operator who captured the value out of band — which this provider\n *   gives them no way to do.\n *   ★ SO POINT THIS FAMILY AT TOKENS THAT ALREADY EXIST. `comment`, `expire` and `privsep` are the\n *     whole of a token's policy, and declaring them is real work: it is how `expire` stops being\n *     whatever somebody typed in 2024. Mint NEW tokens where the secret can be caught — OpenBao's\n *     `proxmox-c1` mount, or a human at `pveum user token add`.\n *\n * ⛔ THERE IS NO `regenerate` PROP, AND IT IS NOT AN OVERSIGHT. PVE's own description: \"All users\n *   of the previous secret will lose access after this operation.\" A prop for it would revoke a\n *   live credential during a deploy whose plan said `update`, and hand back a replacement this\n *   provider is obliged to throw away — breakage with no recovery.\n *\n * ⚠️ THERE IS A SECOND WRITER TO THESE OBJECTS AND IT IS THE ONE THIS PROVIDER RUNS ON. OpenBao's\n *   `proxmox-c1` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` with an id it\n *   CHOOSES (`hf-<role>-<actor>-<entity6>-<stamp>-<nonce>`), so the two systems cannot collide on\n *   one object by accident — but they share the USER, and `Proxmox.User` deleting that account\n *   takes every one of its tokens with it. ⛔ DO NOT DECLARE A TOKEN UNDER A MINT USER: `expire`\n *   is what makes that dangerous — a 300-second lease token becomes a permanent one.\n *\n * ⚠️ PRIVILEGES, AND THE READ LANE CANNOT DO IT. MEASURED: all four methods on this path check\n *   `['or', ['userid-param','self'], ['userid-group', ['User.Modify']]]` — with no `Sys.Audit`\n *   alternative — so the 3600s read lease reaches at most its OWN account's tokens and is refused\n *   for every other userid. `readRole: 'provision'` below, for the same reason storage.ts,\n *   sdn-zone.ts and sdn-vnet.ts set it, at the same cost: every plan mints a 300s non-renewable\n *   provision lease just to read.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers`/`pveOperations` ONTO\n *   `@distilled.cloud/proxmox`'s typed `access.getAccessUserToken`/`putAccessUserToken`/\n *   `deleteAccessUserToken` (2026-09-24, decision 43's proxmox walk-down, the last access-family\n *   resource). There is no `createAccessUserToken` call anywhere in this file — the create branch\n *   was already provably unreachable before the migration (`reconcile` dies on an absent read\n *   before any create path runs), so nothing calls distilled's POST-shaped `updateAccessUserToken`\n *   operation either; see api-token-form.ts for why the generator gave it that name.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as access from '@distilled.cloud/proxmox/access';\nimport * as Effect from 'effect/Effect';\nimport { API_TOKEN_UPDATE, attributesOf, matches, shape } from './api-token-form.ts';\nimport { guardWrite } from './distilled-guard.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport {\n  UNREADABLE,\n  type Unreadable,\n  readOrUnreadable,\n  unreadableWarning,\n} from './unreadable-read.ts';\n\nexport interface ApiTokenProps extends WithTarget {\n  /**\n   * The account that owns the token, realm-qualified: `iac@pve`, `root@pam`. Identity.\n   *\n   * ⚠️ THE ACCOUNT MUST ALREADY EXIST. Every method here runs `check_user_exist` first, so a\n   *   token named under a missing user fails the READ (folded to \"absent\") and then fails the\n   *   create with \"no such user\" — the honest error, arriving one step after the misleading plan.\n   *   Sequence a `Proxmox.User` ahead of it and the ordering takes care of itself.\n   */\n  userid: string;\n  /**\n   * The token's own name, unique within the account. Identity.\n   *\n   * ⚠️ PVE HAS NO RENAME. Editing this prop (or `userid`) points `path` at a DIFFERENT token,\n   *   which reads as absent and is then created — leaving the old token LIVE, invisible to the\n   *   plan, while the new one is the unusable kind described at the top. Rename by declaring a\n   *   delete and a create.\n   *   ⛔ `diff` IS NOT OVERRIDDEN TO SAY `replace` THE WAY acl.ts DOES: there, replace removes a\n   *     grant that can be rebuilt from its own tuple; here it would DELETE a live token —\n   *     destroying an irrecoverable secret — to tidy up a name. Leaving the old token standing is\n   *     the lesser harm.\n   * ⚠️ PATTERN `[A-Za-z][A-Za-z0-9.\\-_]+`: a letter first, two characters minimum.\n   */\n  tokenid: string;\n  /** Free text in `pveum user token list` and the UI. Empty is how it is cleared — see `shape`. */\n  comment?: string;\n  /**\n   * Seconds since the epoch, or 0 for \"never expires\".\n   *\n   * ⛔ REQUIRED, AND THE SCHEMA WILL TELL YOU IT NEED NOT BE. It declares the default \"same as\n   *   user\", and the code never implements it: `generate_token` writes `expire` only when the\n   *   parameter is defined, and the parser does `$expire = 0 if !$expire`. Required, so \"this\n   *   token never expires\" is a sentence somebody had to type, rather than an omission that would\n   *   quietly WRITE 0 over a live deadline.\n   */\n  expire: number;\n  /**\n   * True keeps the token's privileges separate from its owner's — it gets NOTHING until an ACL\n   *   names `fullTokenid`. False gives it the owner's privileges entire.\n   *\n   * ⛔ REQUIRED FOR THE SAME REASON AS `expire`, AND THE BLAST RADIUS IS LARGER. Were this\n   *   optional, adopting a live token without mentioning `privsep` would plan an update to 1 and\n   *   STRIP a working credential of every privilege it has, silently.\n   */\n  privsep: boolean;\n}\n\nexport interface ApiTokenAttributes {\n  userid: string;\n  tokenid: string;\n  /** `<userid>!<tokenid>` — what `Proxmox.Acl` binds as its `ugid`. Derived; never compared. */\n  fullTokenid: string;\n  comment: string;\n  expire: number;\n  privsep: boolean;\n  /**\n   * ⛔ THERE IS NO `value` FIELD HERE AND THERE NEVER MAY BE. Adding one would write a working PVE\n   *   credential, in clear, into the state Postgres and into every nightly dump of it.\n   */\n}\n\nexport interface ProxmoxApiToken extends Resource<\n  'Proxmox.ApiToken',\n  ApiTokenProps,\n  ApiTokenAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ★ `retain` BY DEFAULT, AND THIS IS THE PLAINEST CASE FOR IT IN THE PACKAGE. A token's contents\n *   are one irreplaceable secret: delete it and the value is gone, and every holder loses access\n *   the instant `cfs_write_file` returns — with no error raised anywhere near them. `delete` is\n *   FULLY IMPLEMENTED and runs the moment a caller opts in with `.pipe(RemovalPolicy.destroy())`.\n */\nexport const ProxmoxApiToken = Resource<ProxmoxApiToken>('Proxmox.ApiToken', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * ⛔ `readRole: 'provision'` — see the header's ⚠️ on privileges.\n * ⛔ `{ userid, tokenid }`, NEVER THE WHOLE `props` — group.ts's readGroup has the full measured\n *   mechanism (kit 0.31.1's regression): an extra key beyond the schema's own path labels gets\n *   encoded onto this GET as a body, which a stricter fetch client refuses outright.\n * ⛔ NO `orElseSucceed` — a MISSING token's absence signal is a SUCCESSFUL read with `expire`/\n *   `privsep` both absent (`attributesOf`/api-token-form.ts, MEASURED pre-migration), unlike\n *   user.ts/group.ts's missing-object 500 — so this family never needed their folding split. A\n *   THROWN failure here is genuinely unexpected and must propagate and fail the plan loudly.\n */\nconst readToken = (props: ApiTokenProps) => {\n  const label = { tokenid: props.tokenid, userid: props.userid };\n  return readOrUnreadable(\n    runPve(props.target, 'provision', false, access.getAccessUserToken(label)),\n  ).pipe(Effect.map((live) => (live === UNREADABLE ? UNREADABLE : attributesOf(live, props))));\n};\n\n/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */\nconst dropUnreadable = (live: ApiTokenAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n\n/**\n * ⛔ THIS FAMILY ADOPTS AND MANAGES TOKENS; IT REFUSES TO MINT ONE — see the header. `reconcile`\n *   refuses by name before any write when the read finds nothing, so the create path this\n *   family's spec would otherwise need never runs, and no `createAccessUserToken`-shaped call\n *   exists in this file at all.\n */\nexport const ProxmoxApiTokenProvider = () =>\n  Provider.effect(\n    ProxmoxApiToken,\n    Effect.succeed(\n      ProxmoxApiToken.Provider.of({\n        /**\n         * ⛔ `list` IS EMPTY, AND FOR THIS FAMILY THAT MATTERS MORE THAN THE GENERIC ARGUMENT.\n         *   A token index handed to Alchemy would offer up `mint@pve!engine` and every live\n         *   OpenBao lease for adoption — and adoption is what makes a later plan willing to delete.\n         */\n        list: () => Effect.succeed([]),\n        read: Effect.fn(function* ({ olds }) {\n          return dropUnreadable(yield* readToken(olds));\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(API_TOKEN_UPDATE, shape(news), false);\n          if (output === undefined) return undefined;\n          const live = yield* readToken(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force\n          //   `update` on a token that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning('Proxmox.ApiToken', `${news.userid}!${news.tokenid}`);\n            return { action: 'noop' } as const;\n          }\n          // ⚠️ NO GUARDED-CREATE BRANCH HERE, UNLIKE EVERY OTHER FAMILY IN THIS SUB-AREA. There\n          //   is nothing to guard a create form for — `reconcile` refuses instead, and `diff`\n          //   answering `update` for an absent token is what routes a real deploy into that\n          //   refusal rather than silently reporting `noop` over a token that never landed.\n          return live !== undefined && matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the\n          //   read that fed `diff`'s `update` verdict, so `UNREADABLE` here is a narrow race, not\n          //   the routine case `diff` handles. Any OTHER read failure now propagates on its own\n          //   (readToken no longer folds it), so the die() message below is reached only on a\n          //   genuinely absent token, never on a transient failure wearing that message.\n          const before = dropUnreadable(yield* readToken(news));\n          if (before === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `${news.userid}!${news.tokenid}: this resource does not create API tokens. PVE ` +\n                  'returns the secret only in the create response and it cannot be stored, so a ' +\n                  'token made here would be a live credential nobody holds. Create it with ' +\n                  '`pveum user token add` and capture the value, or mint a short-lived one from ' +\n                  'the OpenBao proxmox mount (`bao read proxmox-c1/creds/<role>`) -- then declare ' +\n                  'it here to manage it.',\n              ),\n            );\n          }\n          yield* guardWrite(API_TOKEN_UPDATE, shape(news), false);\n          if (!matches(before, news)) {\n            yield* runPve(news.target, 'provision', true, access.putAccessUserToken(shape(news)));\n          }\n          const after = dropUnreadable(yield* readToken(news));\n          if (after === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `${news.userid}!${news.tokenid}: the write returned no error but the token is ` +\n                  'still absent. PVE wraps every answer in {\"data\":...} and can report success ' +\n                  'on a call that did nothing -- read back rather than trusting the status code.',\n              ),\n            );\n          }\n          return after;\n        }),\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            access.deleteAccessUserToken({ tokenid: olds.tokenid, userid: olds.userid }),\n          );\n        }),\n      }),\n    ),\n  );\n",
+    "/**\n * `Proxmox.ApiToken` — a PVE API token: the thing a service actually authenticates as.\n *\n * ⛔ THE SECRET EXISTS FOR ONE HTTP RESPONSE AND THEN NOWHERE. MEASURED from the cluster's own\n *   schema: POST returns `[\"full-tokenid\",\"info\",\"value\"]`; PUT returns `[\"comment\",\"expire\",\n *   \"full-tokenid\",\"privsep\",\"value\"]` with `value` present ONLY when `regenerate` was set; GET\n *   returns `[\"comment\",\"expire\",\"privsep\"]` and never the secret. PVE says it plainly on the\n *   POST: the value \"needs to be stored as it cannot be retrieved afterwards\".\n *\n * ⛔ SO A TOKEN THIS RESOURCE CREATES IS UNUSABLE, AND SAYING SO IS THE POINT OF THIS BLOCK. The\n *   secret may not become an attribute: Alchemy persists attributes UNENCRYPTED, and this estate's\n *   state store is a Postgres dumped nightly (the ⛔ in credentials.ts). So `reconcile` refuses\n *   before any POST, and what would land is a live credential in `/etc/pve/user.cfg` whose secret\n *   nobody holds. No `regenerate` rescues it, because a regenerated value is discarded the same\n *   way. The only escape is an operator who captured the value out of band — which this provider\n *   gives them no way to do.\n *   ★ SO POINT THIS FAMILY AT TOKENS THAT ALREADY EXIST. `comment`, `expire` and `privsep` are the\n *     whole of a token's policy, and declaring them is real work: it is how `expire` stops being\n *     whatever somebody typed in 2024. Mint NEW tokens where the secret can be caught — OpenBao's\n *     `proxmox-c1` mount, or a human at `pveum user token add`.\n *\n * ⛔ THERE IS NO `regenerate` PROP, AND IT IS NOT AN OVERSIGHT. PVE's own description: \"All users\n *   of the previous secret will lose access after this operation.\" A prop for it would revoke a\n *   live credential during a deploy whose plan said `update`, and hand back a replacement this\n *   provider is obliged to throw away — breakage with no recovery.\n *\n * ⚠️ THERE IS A SECOND WRITER TO THESE OBJECTS AND IT IS THE ONE THIS PROVIDER RUNS ON. OpenBao's\n *   `proxmox-c1` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` with an id it\n *   CHOOSES (`hf-<role>-<actor>-<entity6>-<stamp>-<nonce>`), so the two systems cannot collide on\n *   one object by accident — but they share the USER, and `Proxmox.User` deleting that account\n *   takes every one of its tokens with it. ⛔ DO NOT DECLARE A TOKEN UNDER A MINT USER: `expire`\n *   is what makes that dangerous — a 300-second lease token becomes a permanent one.\n *\n * ⚠️ PRIVILEGES, AND THE READ LANE CANNOT DO IT. MEASURED: all four methods on this path check\n *   `['or', ['userid-param','self'], ['userid-group', ['User.Modify']]]` — with no `Sys.Audit`\n *   alternative — so the 3600s read lease reaches at most its OWN account's tokens and is refused\n *   for every other userid. `readRole: 'provision'` below, for the same reason storage.ts,\n *   sdn-zone.ts and sdn-vnet.ts set it, at the same cost: every plan mints a 300s non-renewable\n *   provision lease just to read.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers`/`pveOperations` ONTO\n *   `@distilled.cloud/proxmox`'s typed `access.getAccessUserToken`/`putAccessUserToken`/\n *   `deleteAccessUserToken` (2026-09-24, decision 43's proxmox walk-down, the last access-family\n *   resource). There is no `createAccessUserToken` call anywhere in this file — the create branch\n *   was already provably unreachable before the migration (`reconcile` dies on an absent read\n *   before any create path runs), so nothing calls distilled's POST-shaped `updateAccessUserToken`\n *   operation either; see api-token-form.ts for why the generator gave it that name.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as access from '@distilled.cloud/proxmox/access';\nimport * as Effect from 'effect/Effect';\nimport { API_TOKEN_UPDATE, attributesOf, matches, shape } from './api-token-form.ts';\nimport { mintTier } from './credentials.ts';\nimport { guardWrite } from './distilled-guard.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport {\n  UNREADABLE,\n  type Unreadable,\n  readOrUnreadable,\n  unreadableWarning,\n} from './unreadable-read.ts';\n\nexport interface ApiTokenProps extends WithTarget {\n  /**\n   * The account that owns the token, realm-qualified: `iac@pve`, `root@pam`. Identity.\n   *\n   * ⚠️ THE ACCOUNT MUST ALREADY EXIST. Every method here runs `check_user_exist` first, so a\n   *   token named under a missing user fails the READ (folded to \"absent\") and then fails the\n   *   create with \"no such user\" — the honest error, arriving one step after the misleading plan.\n   *   Sequence a `Proxmox.User` ahead of it and the ordering takes care of itself.\n   */\n  userid: string;\n  /**\n   * The token's own name, unique within the account. Identity.\n   *\n   * ⚠️ PVE HAS NO RENAME. Editing this prop (or `userid`) points `path` at a DIFFERENT token,\n   *   which reads as absent and is then created — leaving the old token LIVE, invisible to the\n   *   plan, while the new one is the unusable kind described at the top. Rename by declaring a\n   *   delete and a create.\n   *   ⛔ `diff` IS NOT OVERRIDDEN TO SAY `replace` THE WAY acl.ts DOES: there, replace removes a\n   *     grant that can be rebuilt from its own tuple; here it would DELETE a live token —\n   *     destroying an irrecoverable secret — to tidy up a name. Leaving the old token standing is\n   *     the lesser harm.\n   * ⚠️ PATTERN `[A-Za-z][A-Za-z0-9.\\-_]+`: a letter first, two characters minimum.\n   */\n  tokenid: string;\n  /** Free text in `pveum user token list` and the UI. Empty is how it is cleared — see `shape`. */\n  comment?: string;\n  /**\n   * Seconds since the epoch, or 0 for \"never expires\".\n   *\n   * ⛔ REQUIRED, AND THE SCHEMA WILL TELL YOU IT NEED NOT BE. It declares the default \"same as\n   *   user\", and the code never implements it: `generate_token` writes `expire` only when the\n   *   parameter is defined, and the parser does `$expire = 0 if !$expire`. Required, so \"this\n   *   token never expires\" is a sentence somebody had to type, rather than an omission that would\n   *   quietly WRITE 0 over a live deadline.\n   */\n  expire: number;\n  /**\n   * True keeps the token's privileges separate from its owner's — it gets NOTHING until an ACL\n   *   names `fullTokenid`. False gives it the owner's privileges entire.\n   *\n   * ⛔ REQUIRED FOR THE SAME REASON AS `expire`, AND THE BLAST RADIUS IS LARGER. Were this\n   *   optional, adopting a live token without mentioning `privsep` would plan an update to 1 and\n   *   STRIP a working credential of every privilege it has, silently.\n   */\n  privsep: boolean;\n}\n\nexport interface ApiTokenAttributes {\n  userid: string;\n  tokenid: string;\n  /** `<userid>!<tokenid>` — what `Proxmox.Acl` binds as its `ugid`. Derived; never compared. */\n  fullTokenid: string;\n  comment: string;\n  expire: number;\n  privsep: boolean;\n  /**\n   * ⛔ THERE IS NO `value` FIELD HERE AND THERE NEVER MAY BE. Adding one would write a working PVE\n   *   credential, in clear, into the state Postgres and into every nightly dump of it.\n   */\n}\n\nexport interface ProxmoxApiToken extends Resource<\n  'Proxmox.ApiToken',\n  ApiTokenProps,\n  ApiTokenAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ★ `retain` BY DEFAULT, AND THIS IS THE PLAINEST CASE FOR IT IN THE PACKAGE. A token's contents\n *   are one irreplaceable secret: delete it and the value is gone, and every holder loses access\n *   the instant `cfs_write_file` returns — with no error raised anywhere near them. `delete` is\n *   FULLY IMPLEMENTED and runs the moment a caller opts in with `.pipe(RemovalPolicy.destroy())`.\n */\nexport const ProxmoxApiToken = Resource<ProxmoxApiToken>('Proxmox.ApiToken', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * ⛔ `readRole: 'provision'` — see the header's ⚠️ on privileges.\n * ⛔ `{ userid, tokenid }`, NEVER THE WHOLE `props` — group.ts's readGroup has the full measured\n *   mechanism (kit 0.31.1's regression): an extra key beyond the schema's own path labels gets\n *   encoded onto this GET as a body, which a stricter fetch client refuses outright.\n * ⛔ NO `orElseSucceed` — a MISSING token's absence signal is a SUCCESSFUL read with `expire`/\n *   `privsep` both absent (`attributesOf`/api-token-form.ts, MEASURED pre-migration), unlike\n *   user.ts/group.ts's missing-object 500 — so this family never needed their folding split. A\n *   THROWN failure here is genuinely unexpected and must propagate and fail the plan loudly.\n */\nconst readToken = (props: ApiTokenProps) => {\n  const label = { tokenid: props.tokenid, userid: props.userid };\n  return readOrUnreadable(\n    runPve(props.target, 'provision', false, access.getAccessUserToken(label)),\n  ).pipe(Effect.map((live) => (live === UNREADABLE ? UNREADABLE : attributesOf(live, props))));\n};\n\n/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */\nconst dropUnreadable = (live: ApiTokenAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n\n/**\n * ⛔ THIS FAMILY ADOPTS AND MANAGES TOKENS; IT REFUSES TO MINT ONE — see the header. `reconcile`\n *   refuses by name before any write when the read finds nothing, so the create path this\n *   family's spec would otherwise need never runs, and no `createAccessUserToken`-shaped call\n *   exists in this file at all.\n */\nexport const ProxmoxApiTokenProvider = () =>\n  Provider.effect(\n    ProxmoxApiToken,\n    Effect.succeed(\n      ProxmoxApiToken.Provider.of({\n        /**\n         * ⛔ `list` IS EMPTY, AND FOR THIS FAMILY THAT MATTERS MORE THAN THE GENERIC ARGUMENT.\n         *   A token index handed to Alchemy would offer up `mint@pve!engine` and every live\n         *   OpenBao lease for adoption — and adoption is what makes a later plan willing to delete.\n         */\n        list: () => Effect.succeed([]),\n        read: Effect.fn(function* ({ olds }) {\n          return dropUnreadable(yield* readToken(olds));\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(API_TOKEN_UPDATE, shape(news), false);\n          if (output === undefined) return undefined;\n          const live = yield* readToken(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force\n          //   `update` on a token that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning(\n              'Proxmox.ApiToken',\n              `${news.userid}!${news.tokenid}`,\n              news.target.mount,\n              mintTier(news.target, 'provision'),\n            );\n            return { action: 'noop' } as const;\n          }\n          // ⚠️ NO GUARDED-CREATE BRANCH HERE, UNLIKE EVERY OTHER FAMILY IN THIS SUB-AREA. There\n          //   is nothing to guard a create form for — `reconcile` refuses instead, and `diff`\n          //   answering `update` for an absent token is what routes a real deploy into that\n          //   refusal rather than silently reporting `noop` over a token that never landed.\n          return live !== undefined && matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the\n          //   read that fed `diff`'s `update` verdict, so `UNREADABLE` here is a narrow race, not\n          //   the routine case `diff` handles. Any OTHER read failure now propagates on its own\n          //   (readToken no longer folds it), so the die() message below is reached only on a\n          //   genuinely absent token, never on a transient failure wearing that message.\n          const before = dropUnreadable(yield* readToken(news));\n          if (before === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `${news.userid}!${news.tokenid}: this resource does not create API tokens. PVE ` +\n                  'returns the secret only in the create response and it cannot be stored, so a ' +\n                  'token made here would be a live credential nobody holds. Create it with ' +\n                  '`pveum user token add` and capture the value, or mint a short-lived one from ' +\n                  'the OpenBao proxmox mount (`bao read proxmox-c1/creds/<role>`) -- then declare ' +\n                  'it here to manage it.',\n              ),\n            );\n          }\n          yield* guardWrite(API_TOKEN_UPDATE, shape(news), false);\n          if (!matches(before, news)) {\n            yield* runPve(news.target, 'provision', true, access.putAccessUserToken(shape(news)));\n          }\n          const after = dropUnreadable(yield* readToken(news));\n          if (after === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `${news.userid}!${news.tokenid}: the write returned no error but the token is ` +\n                  'still absent. PVE wraps every answer in {\"data\":...} and can report success ' +\n                  'on a call that did nothing -- read back rather than trusting the status code.',\n              ),\n            );\n          }\n          return after;\n        }),\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            access.deleteAccessUserToken({ tokenid: olds.tokenid, userid: olds.userid }),\n          );\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * How PVE spells a value on the wire, and how to get it back to something comparable.\n *\n * ⛔ EVERY FUNCTION HERE WAS FOUND IN TWO OR MORE RESOURCE FILES, AND THE COPIES HAD DRIFTED.\n *   `num` was byte-identical in three files, so merging it is free. The boolean was NOT: four\n *   files declared `const flag` and meant four different things by it, including one that ran the\n *   other way round. That is the whole reason this module exists — not to save lines, but because\n *   a name that means four things is a bug waiting for the person who assumes it means the first\n *   one they read.\n *\n * ★ THE TWO DIRECTIONS ARE NAMED APART, DELIBERATELY. `bool` reads the wire and answers a\n *   TypeScript boolean; `flag` writes a form field and answers PVE's `'1'`/`'0'`. `storage.ts`\n *   held both under one name — `flag` there was the write direction while `flag` in three other\n *   files was the read direction — which typechecks in both files and is exactly the confusion\n *   that survives review.\n *\n * ⚠️ NOTHING HERE IS RESOURCE-SPECIFIC. A coercion that only one PVE object needs belongs in that\n *   object's file, where its reasoning sits next to the field it serves. `role.ts` keeps its own\n *   `canonical` for the same reason: that one sorts a privilege SET, which is a different idea\n *   from `canonicalToken` below however similar the names read.\n */\n\n/** ⚠️ `typeof value === 'number'` and not `Number(value)`: PVE sends `null` for an unset field. */\nexport const num = (value: unknown, fallback: number) =>\n  typeof value === 'number' ? value : fallback;\n\nexport const text = (value: unknown, fallback = '') =>\n  typeof value === 'string' ? value : fallback;\n\n/**\n * A PVE boolean off the wire.\n *\n * ⛔ THE FOUR SPELLINGS THIS REPLACES, AND WHY THIS ONE IS A SUPERSET OF ALL OF THEM. Measured in\n *   the files they came from: `backup-job` accepted `1 | true | '1'` with a caller's fallback;\n *   `sdn-vnet` the same three with no fallback; `storage` accepted only `1 | true`; `user` ran the\n *   value through `Number()` and asked `!== 0`. For the values PVE actually returns on these\n *   endpoints — `0` and `1` — all four agree, so accepting the union changes no live answer.\n *\n * ⚠️ THE ONE REAL DIFFERENCE IS `2`. `user.ts` would have read any non-zero number as true; this\n *   reads only `1`. No PVE field in this package is documented to return anything but 0 or 1, and\n *   a field that did would be a flag with more than two states — which is not a boolean, and\n *   should be read with `num` and named for what it is rather than quietly coerced here.\n *\n * ⚠️ `null`, `undefined` AND `''` ALL TAKE THE FALLBACK. An absent key means PVE's documented\n *   default for that field, which is not always `false` — so the default is the CALLER's to state,\n *   and `false` is only the fallback's own default for fields that really do default off.\n *\n * ⛔ THE EMPTY STRING IS ABSENT, NOT FALSE, AND GETTING THAT WRONG WRITES THE WRONG VALUE. A\n *   metric server is a SectionConfig section and can hand back `''` for an unset flag. Read as\n *   `false`, the two fields in this package that default ON — `backup-job.enabled` and\n *   `user.enable` — would come back disabled, `matches` would report an update nobody asked for,\n *   and the deploy would then WRITE `enabled=0` onto a live job. An empty string is not a\n *   boolean; it is the absence of one.\n */\nexport const bool = (value: unknown, fallback = false) =>\n  value === undefined || value === null || value === ''\n    ? fallback\n    : value === 1 || value === true || value === '1';\n\n/**\n * A boolean on its way INTO a PVE form.\n *\n * ⚠️ `undefined` IN, `undefined` OUT — an undeclared field must not be sent at all. Sending `'0'`\n *   for a prop the caller never set would write PVE's default over whatever is live, turning an\n *   omission into an edit.\n */\nexport const flag = (value?: boolean) => (value === undefined ? undefined : value ? '1' : '0');\n\n/**\n * A comma list PVE does not promise to give back in the order it was handed.\n *\n * ⚠️ `nodes` IS A SET AND PVE DOES NOT PRESERVE ITS ORDER. The zone plugin decodes the list into a\n *   hash and re-encodes it by joining that hash's keys, so the string you get back is not the one\n *   you sent. Sorting both sides is what stops a plan reporting an update because two names came\n *   back the other way round. `peers` gets the same treatment: it is a mesh, not a queue.\n */\nexport const csv = (value: readonly string[] | string | undefined) =>\n  (typeof value === 'string' ? value.split(',') : (value ?? []))\n    .map((part) => part.trim())\n    .filter((part) => part !== '')\n    .sort()\n    .join(',');\n\n/**\n * A comma list of guest IDs, in numeric order.\n *\n * ⚠️ ORDER IS NOT MEANING IN A GUEST LIST, SO IT MUST NOT BE A DIFF. PVE stores `vmid` as the\n *   comma-separated string it was handed and gives it back the same way, so a declaration listing\n *   the same guests in another order would otherwise be an update that rewrites the job to say\n *   exactly what it already said. Both sides are sorted numerically before they meet.\n *\n * ⚠️ NUMERIC, NOT LEXICAL — this is why it is not `csv`. Sorted as text, `101` precedes `99`.\n */\nexport const guestList = (value: unknown): string => {\n  const parts =\n    typeof value === 'string'\n      ? value.split(',')\n      : Array.isArray(value)\n        ? value.map((entry: unknown) => String(entry))\n        : [];\n  return parts\n    .map((part) => Number(part.trim()))\n    .filter((id) => Number.isFinite(id))\n    .sort((left, right) => left - right)\n    .map((id) => String(id))\n    .join(',');\n};\n\n/** `yes`/`true`/`on` and their opposites are the same value as 1/0 to PVE; make them one string. */\nexport const canonicalToken = (raw: string) => {\n  const lowered = raw.trim().toLowerCase();\n  if (['1', 'yes', 'true', 'on'].includes(lowered)) return '1';\n  if (['0', 'no', 'false', 'off'].includes(lowered)) return '0';\n  return lowered;\n};\n\n/**\n * A PVE property string, flattened to one comparable form.\n *\n * ⚠️ A PROPERTY STRING AND ITS PARSED FORM ARE ONE VALUE IN TWO SHAPES, AND PVE HANDS BACK\n *   WHICHEVER IT LIKES. MEASURED: `fleecing` is WRITTEN as the property string `fleecing=enabled=0`\n *   and READ BACK as the nested object {\"enabled\":0}. Comparing raw values would report an update\n *   on every plan for a job nobody touched — the same forever-diff a create-only field causes. So\n *   both sides are flattened here, sorted, and only then compared. `prune-backups` goes through\n *   the same funnel: same kind of value, the normalisation is free, and guessing which shape it\n *   comes back in is exactly the guess that costs a permanent diff.\n *\n * ⚠️ `defaultKey` EXISTS BECAUSE `fleecing=1` IS SHORTHAND FOR `fleecing=enabled=1`. PVE's format\n *   for it is written `[enabled=]<1|0>`, so a bare token is legal on write and comes back expanded\n *   on read; unexpanded, the short and long spellings never compare equal. `prune-backups` has no\n *   default key, so a bare token there is passed through as-is rather than invented into one.\n */\nexport const propertyString = (value: unknown, defaultKey?: string): string => {\n  const pairs: [string, string][] =\n    typeof value === 'string'\n      ? value.split(',').map((part) => {\n          const [key, ...rest] = part.split('=');\n          return rest.length === 0 && defaultKey !== undefined\n            ? [defaultKey, key ?? '']\n            : [key ?? '', rest.join('=')];\n        })\n      : typeof value === 'object' && value !== null\n        ? Object.entries(value).map(([key, entry]) => [key, String(entry)])\n        : [];\n  return pairs\n    .map(([key, entry]) => [key.trim(), canonicalToken(entry)] as const)\n    .filter(([key]) => key !== '')\n    .map(([key, entry]) => `${key}=${entry}`)\n    .sort()\n    .join(',');\n};\n\n/**\n * An integer PVE may have spelled as a string.\n *\n * ⚠️ PVE MAY HAND BACK EITHER `8086` OR `\"8086\"`. These objects are SectionConfig sections, and the\n *   integer check VALIDATES the parsed string rather than converting it, so whether a number\n *   arrives as a number is a property of the version you are talking to. `'8086' === 8086` is\n *   false, and that is an update consisting of nothing, reported on every plan forever.\n */\nexport const int = (value: unknown, fallback: number) => {\n  if (typeof value === 'number') return value;\n  const parsed = Number.parseInt(text(value), 10);\n  return Number.isNaN(parsed) ? fallback : parsed;\n};\n\n/**\n * A PVE update form with its clear-list attached, and the two guaranteed not to overlap.\n *\n * ⛔ PVE DIES IF A KEY IS SET AND DELETED IN ONE CALL, AND SIX FAMILIES HERE BUILT THAT FORM BY\n *   HAND. Measured in the shipped Perl on node-b — `PVE::SectionConfig::delete_from_config`, line 1860:\n *\n *     die \"cannot set and delete property '$k' at the same time!\\n\"\n *         if defined($new_options->{$k});\n *\n *   `defined` is the test, not truth, so `strict=0` or `comment=''` in the body counts as SET. The\n *   concrete failure: a live node-affinity rule with `strict 1` and a declaration carrying\n *   `strict: false`. `matches` reports an update; the clear-list has to name `strict`, because a\n *   PUT of `strict=0` merges a falsy value the plugin still stores; and if the body also emits\n *   `strict: '0'` the PUT is refused. The update never lands, the next plan reports the same\n *   update, and every deploy 500s — forever.\n *\n * ★ SO DISJOINTNESS IS ENFORCED HERE RATHER THAN REASONED ABOUT SIX TIMES. A cleared key is\n *   dropped from the body: CLEAR WINS. That is the right way round because a clear-list entry is\n *   computed from \"this prop is absent, and absent means remove it\", which is a deliberate\n *   statement, while the body's value for the same key is the coercion of that same absence —\n *   `flag(false)` is `'0'`, and `'0'` is exactly what must not be sent.\n *\n * ⚠️ UNDEFINED VALUES ARE DROPPED TOO, so a form builder may emit `undefined` for a field it does\n *   not set without the caller filtering first. `new URLSearchParams` would otherwise stringify it\n *   to the literal text \"undefined\".\n */\nexport const withClears = (\n  fields: Record<string, string | undefined>,\n  clear: readonly string[],\n): Record<string, string> => {\n  const cleared = new Set(clear);\n  const kept: Record<string, string> = {};\n  for (const [key, value] of Object.entries(fields)) {\n    if (value !== undefined && !cleared.has(key)) kept[key] = value;\n  }\n  return cleared.size === 0 ? kept : { ...kept, delete: [...cleared].join(',') };\n};\n",
     "import type { ApiTokenAttributes, ApiTokenProps } from './api-token.ts';\n/**\n * What a write to a PVE API token actually does, and the form that does it.\n *\n * ★ SPLIT OUT OF api-token.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is the one\n *   metric-server-form.ts draws: this file answers \"what does PVE store when this form arrives\",\n *   api-token.ts answers \"what a token is and when it has changed\". Nothing here reads the\n *   cluster and nothing here decides a diff.\n *\n * ⚠️ THE `import type` BACK TO api-token.ts IS A CYCLE ON PAPER ONLY. It is type-only, so it is\n *   erased before anything runs and `ApiTokenProps` stays in the file that declares the resource.\n *\n * ⛔ THE WRITE SEMANTICS BELOW ARE READ FROM THE CLUSTER'S OWN PERL RATHER THAN INFERRED FROM THE\n *   API SCHEMA — `/usr/share/perl5/PVE/API2/User.pm`, subs `generate_token` and\n *   `update_token_info`, read over SSH on node-b on 2026-09-13. The two disagree in exactly the place\n *   that costs a forever-diff: the schema gives `expire` the default \"same as user\", and the code\n *   never implements it. api-token.ts records what that means.\n *\n * ★ MIGRATED OFF THE GENERATED `generated/pve.ts` PARAM TYPES ONTO `@distilled.cloud/proxmox`'s\n *   typed `access.PutAccessUserTokenRequest`/`access.GetAccessUserTokenResponse` (2026-09-24) —\n *   the same three fields, still form-urlencoded strings on the wire; distilled's generator\n *   reads the identical vendor schema `generated/pve.ts` came from.\n */\nimport type * as access from '@distilled.cloud/proxmox/access';\nimport { bool, int, text } from './values.ts';\n\nexport const API_TOKEN_UPDATE = 'pve:PUT /access/users/{userid}/token/{tokenid}';\n\n/**\n * `<userid>!<tokenid>` — the name the rest of PVE calls this object by.\n *\n * ★ IT IS WHAT AN ACL BINDS. `Proxmox.Acl` with `type: 'token'` wants exactly this string as its\n *   `ugid`, so reporting it as an attribute is what lets a privilege-separated token be granted\n *   anything at all without somebody retyping the join by hand.\n *\n * ⚠️ DERIVED, NOT READ. MEASURED: `GET /access/users/metrics@pve/token/exporter` answers\n *   `{\"expire\":0,\"privsep\":0}` and echoes back neither half of its own identity. So this is built\n *   from props, cannot disagree with the path the read used, and is therefore true by\n *   construction — which is why it is reported and never compared.\n */\nexport const fullTokenid = (props: ApiTokenProps) => `${props.userid}!${props.tokenid}`;\n\n/**\n * Everything a token has, in the form PVE wants. Update sends exactly this (this family never\n * creates — see api-token.ts's header).\n *\n * ⚠️ EVERY FIELD IS SENT ON EVERY WRITE, THE EMPTY COMMENT INCLUDED, BECAUSE A PUT MERGES.\n *   MEASURED in `update_token_info`: `$token->{comment} = $param->{comment} if defined(...)`\n *   followed by `delete $token->{comment} if (!length $token->{comment})`. So `comment=` is how a\n *   comment is CLEARED; omitting it leaves the old text in place while `matches` goes on asking\n *   for an update the update cannot make. user.ts writes the same reasoning out for `groups`.\n *   ⚠️ THE `delete=` PARAMETER IS NOT USED AND WOULD NOT HELP. Its whitelist in that sub is\n *     literally `my $deletable = { comment => 1 };`, and anything else answers\n *     \"unknown option '<k>'\" — so `expire` and `privsep` have no clear path at all, which is the\n *     other half of why both are required props rather than optional ones.\n */\nexport const shape = (props: ApiTokenProps): access.PutAccessUserTokenRequest => ({\n  comment: props.comment ?? '',\n  expire: String(props.expire),\n  privsep: props.privsep ? '1' : '0',\n  tokenid: props.tokenid,\n  userid: props.userid,\n});\n\n/**\n * ★ NOTHING PVE REPORTS HERE IS UNWRITABLE, WHICH IS UNUSUAL IN THIS PACKAGE. The GET returns\n *   exactly `comment`, `expire` and `privsep`; PUT accepts exactly those three.\n * ⛔ `undefined` WHEN NEITHER FLAG IS THERE, BECAUSE BOTH ARE ALWAYS THERE FOR A REAL TOKEN.\n *   `user.cfg` materialises `expire` and `privsep` for every token it stores, so an answer\n *   carrying neither is not a token — the same \"distilled unwraps a missing object's `{\"data\":\n *   null}` to `{}`\" trap group.ts's header measures, checked here the way this guard already was\n *   before the distilled migration (api-token.ts's ⛔ on the create refusal cites the same\n *   MEASURED schema). Without this guard `bool`/`int` would invent one out of their fallbacks and\n *   the read-back guard in `reconcile` could never fire.\n */\nexport const attributesOf = (\n  live: access.GetAccessUserTokenResponse,\n  props: ApiTokenProps,\n): ApiTokenAttributes | undefined => {\n  if (live.expire === undefined && live.privsep === undefined) return undefined;\n  return {\n    comment: text(live.comment),\n    expire: int(live.expire, 0),\n    fullTokenid: fullTokenid(props),\n    /** ⚠️ FALLBACK `true`, MATCHING PVE'S API DEFAULT — unreachable given the guard above, but\n     *   wrong in the safe direction if a future release stops emitting the field. */\n    privsep: bool(live.privsep, true),\n    tokenid: props.tokenid,\n    userid: props.userid,\n  };\n};\n\n/**\n * ⚠️ EXACTLY THE THREE FIELDS A PUT CAN PUT BACK, WHICH IS ALSO EXACTLY WHAT THE GET REPORTS.\n *   MEASURED (pre-migration, replaying against four live token shapes — see the old PR): all\n *   answer noop; flipping `privsep` answers update; an empty body answers absent.\n */\nexport const matches = (attributes: ApiTokenAttributes, props: ApiTokenProps) =>\n  attributes.comment === (props.comment ?? '') &&\n  attributes.expire === props.expire &&\n  attributes.privsep === props.privsep;\n",
     "/**\n * Vendor-constraint guards (constraint-guard.ts) for a distilled-backed family — the seam\n * acl.ts's own local `guardWrite` established (acl-wire.ts), generalized once a second family\n * (Group) needed the SAME create/update split `resource.ts`'s `specGuards` (resource-guard.ts)\n * gives every family still on `client.ts`. `codegen/constraints.ts` scans this package's SOURCE\n * TEXT for the endpoint-key strings a caller passes here, so a family switching to this helper\n * changes nothing about which vendor rules apply — same keys, same generated tables.\n *\n * ★ WHY `asForm` IS THE ONLY TRANSLATION NEEDED. Distilled's generated request types for every\n *   PVE form-urlencoded operation are already `Record<string, string | undefined>` — the SAME\n *   shape `PveForm`/`guardForm` want, minus the `?`. There is no JSON vs form-encoding gap to\n *   bridge here the way client.ts's `pve()` had to.\n */\nimport type * as Effect from 'effect/Effect';\nimport { guardForm } from './constraint-guard.ts';\nimport type { EndpointKey } from './constraints.ts';\n\n/**\n * Drops non-string fields — distilled's request type carries `?`, `guardForm` wants a plain\n * form. ⚠️ `body: object`, NOT `Record<string, string | undefined>`: distilled's generated\n * request types are `interface`s with no index signature, so TypeScript refuses that stricter\n * parameter type for every one of them (\"index signature ... is missing\") even though every\n * field they declare fits it. `object` accepts any of them; the cast below is where the shape\n * is actually asserted, once, rather than at every call site.\n */\nexport const asForm = (body: object): Record<string, string> =>\n  Object.fromEntries(\n    Object.entries(body as Record<string, unknown>).filter(\n      (e): e is [string, string] => typeof e[1] === 'string',\n    ),\n  );\n\n/**\n * `presence`: whether a CREATE is really about to happen (required fields are enforced) or the\n * form is only being value-checked in passing — see resource-guard.ts's own header on why this\n * is not \"this is the create form\" but \"a create is really about to happen\".\n */\nexport const guardWrite = (\n  endpoint: EndpointKey,\n  body: object,\n  presence: boolean,\n): Effect.Effect<void> => guardForm(endpoint, asForm(body), presence);\n",
@@ -44,15 +45,14 @@
     "/**\n * `Proxmox.CephDaemon` — a Ceph monitor, manager or metadata server on one node.\n *\n * ★ ONE RESOURCE FOR THREE KINDS, AND THE SCHEMAS WERE CHECKED BEFORE THAT WAS DECIDED. Parsed\n *   from `/usr/share/pve-docs/api-viewer/apidoc.js` on node-b, 2026-09-13: mon, mgr and mds each\n *   expose GET on the collection and POST + DELETE on the id below it, each returns\n *   name/host/state/addr/ceph_version*, and the only divergence is the create parameter\n *   (`mon-address` / none / `hotstandby`) and the read-only extras (mon: quorum, rank; mds: rank,\n *   fs_name, standby_replay). Three near-identical files would have carried the traps below three\n *   times over and let them drift — the argument resource.ts already makes for the factory itself.\n *\n * ⛔ THE ONLY GET IS THE COLLECTION'S, AND IT ANSWERS FOR THE WHOLE CLUSTER. MEASURED:\n *   `GET /nodes/node-b/ceph/mon` returns node-b, node-c AND node-d, and `GET /nodes/node-c/ceph/mon` returns the same\n *   three IN A DIFFERENT ORDER — [node-d,node-b,node-c] from node-b, [node-c,node-b,node-d] from node-c — so a row is found by\n *   `name` and NEVER by position, and the `{node}` in the path is only the node being ASKED.\n *   MEASURED too: there is no GET on the id path at all; `pvesh get /nodes/node-b/ceph/mon/node-b` answers\n *   \"No 'get' handler defined for '/nodes/node-b/ceph/mon/node-b'\", and mgr and mds answer the same.\n *   That is why `path()` below is the COLLECTION, and that in turn is why `delete` is the one\n *   handler this file writes by hand: `pveOperations.destroy` sends its DELETE to `spec.path`,\n *   which here would be the collection — a 501 reported as a failed destroy, with the daemon still\n *   running. Same shape and same rule as the override in acl.ts: do not \"restore symmetry\" by\n *   pointing it back at `ops.destroy`.\n *\n * ⛔ WHAT A DESTROY ACTUALLY DOES, BECAUSE THE PLAN LINE SAYS ONLY \"delete\". REASONED FROM PVE'S\n *   AND CEPH'S DOCUMENTED BEHAVIOUR, NOT MEASURED — nothing on this cluster was destroyed to find\n *   out, and nothing should be to check. `mon`: stops ceph-mon@id, removes it from the monmap and\n *   strips its section from ceph.conf. THREE MONS TOLERATE ONE LOSS; TWO TOLERATE NONE. Removing\n *   two in one deploy — or removing the mon on the node whose API is serving the call — loses\n *   quorum, and a cluster without mon quorum BLOCKS every RBD and CephFS I/O rather than erroring\n *   it, so on this cluster every guest on `rbd-c1` hangs.\n *   `mds`: destroying a STANDBY is a non-event; destroying the ACTIVE one fails CephFS over,\n *   and with no standby left `cephfs-c1` goes unavailable. `mgr`: no guest I/O depends on it, but\n *   the last one takes the PG autoscaler, the dashboard and PVE's own Ceph status with it.\n *   Live on 2026-09-13: mon, mgr AND mds on each of node-b, node-c, node-d.\n *\n * ★ AND THE ONLY WAY TO REACH THAT DESTROY IS TO DELETE THE DECLARATION. `matches` is deliberately\n *   total (see its ⛔), so this resource CANNOT plan a `replace` — which is the one action that\n *   would tear down a live mon off the back of an edited field rather than a removed line.\n *\n * ⚠️ THE PRIVILEGES ARE ASYMMETRIC AND THE READ SIDE IS THE CHEAP ONE. The GET checks `any` of\n *   `Sys.Audit`/`Datastore.Audit` on `/`, and PVEAuditor holds both (MEASURED:\n *   `GET /access/roles/PVEAuditor`), so the mount's `read` role can see this family — unlike\n *   `Proxmox.Storage`, which 403s under that lease. POST and DELETE both check `Sys.Modify` on\n *   `/`, and MEASURED on this cluster the provision role already held it (it is in `PROVISION_PRIVILEGES`), so the provision lane\n *   needs no widening for once. ⚠️ `Sys.Modify` on the ROOT path is broad — it also buys\n *   datacenter options and every other cluster-wide config write — so it is worth knowing that\n *   this credential already has it rather than discovering it the next time something is scoped.\n *\n * ★ MIGRATED OFF `client.ts` (2026-09-24, decision 43, 2c) — ceph-daemon-wire.ts has the rename\n *   and why no protocol gap blocks any of the three kinds. The follow-up removes the preserved\n *   catch-all read fold: only a successful index without this daemon proves absence.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { DAEMON_ENDPOINTS, createForm } from './ceph-daemon-form.ts';\nimport { createDaemon, deleteDaemon, notCreated, readDaemon } from './ceph-daemon-wire.ts';\nimport { guardWrite } from './distilled-guard.ts';\nimport { type PveRequirements, type WithTarget } from './resource.ts';\n\n/**\n * Which Ceph daemon this is. The discriminant picks the collection, the create parameters and\n * which of the read-only extras below will even be populated.\n *\n * ⚠️ `osd` IS NOT HERE AND MUST NOT BE ADDED TO THIS UNION. `/nodes/{node}/ceph/osd` takes a disk\n *   device, wipes it, and its DELETE has a `cleanup` flag — a create that destroys data on the way\n *   in is a different resource with a different set of refusals, not a fourth case in this one.\n */\nexport type CephDaemonKind = 'mon' | 'mgr' | 'mds';\n\nexport interface CephDaemonProps extends WithTarget {\n  kind: CephDaemonKind;\n  /**\n   * The node the daemon RUNS on. Identity — a daemon cannot be moved, only destroyed and rebuilt.\n   * ⚠️ It is also the node whose API is asked, and the read is only as available as that node: a\n   *   failed index now propagates its error. Before the typed-read follow-up, a down node,\n   *   missing Ceph installation or 403 was folded to \"absent\"; its daemons planned `update`\n   *   and reconcile POSTed a create for a mon that already existed. PVE refused with \"monitor\n   *   already exists\", then read-back failed again, obscuring the original node read error.\n   *   That incident is why collection failure can never prove a daemon is missing.\n   */\n  node: string;\n  /**\n   * The daemon id. PVE defaults it to the nodename, and `daemonId` in ceph-daemon-form.ts resolves\n   * that default HERE rather than leaving it to PVE, because the id is a PATH SEGMENT: create,\n   * delete and the row lookup all need the same string, and a default resolved on the far side\n   * would leave three call sites guessing. Live on this cluster every daemon's name is its node.\n   */\n  name?: string;\n  /**\n   * mon only. Overrides the autodetected monitor IP; must sit in Ceph's public network — on this\n   * cluster that is 198.51.100.0/24, carried by `vmbr1.42`.\n   * ⛔ CREATE-ONLY AND NEVER COMPARED. PVE takes a bare ip-list on write and hands back `addr` as\n   *   `198.51.100.12:6789/0` — an address, a port and a nonce. The two are not the same string and\n   *   never will be, so diffing them would report a mismatch on every plan; with no PUT on this\n   *   family that mismatch becomes a REPLACE, and a replace of a mon is the quorum loss in the\n   *   header. Left out of `matches` on purpose.\n   */\n  'mon-address'?: string;\n  /**\n   * mds only. Makes this standby replay the active MDS's journal for a faster failover.\n   * ⛔ CREATE-ONLY AND NEVER COMPARED, AND THE FIELD THAT LOOKS LIKE ITS READBACK IS NOT ONE.\n   *   `standby_replay` in the list is the daemon's CURRENT state, not its configuration: MEASURED\n   *   2026-09-13, all three mds report `standby_replay: false`, node-c included — and node-c is the ACTIVE\n   *   mds, which is not a standby at all and so can never report true however it was created.\n   *   Comparing `hotstandby` to it would plan a replace against whichever mds Ceph happens to have\n   *   elected, i.e. against a value no declaration controls.\n   * ⚠️ SET ON A mon OR mgr IT IS DROPPED RATHER THAN SENT, and `mon-address` likewise on an mds:\n   *   each POST schema lists only its own parameter, so the wrong one is a 400 rather than an\n   *   ignored hint. A field silently dropped is the lesser of the two, but it IS dropped.\n   */\n  hotstandby?: boolean;\n}\n\n/**\n * Everything the cluster says about this daemon — reported, and (bar its identity) none of it\n * compared. Read the ⛔ on `matches` for why that is the only safe split on this family.\n */\nexport interface CephDaemonAttributes {\n  kind: CephDaemonKind;\n  node: string;\n  name: string;\n  /**\n   * The host Ceph says it runs on.\n   * ⚠️ REPORTED, NOT COMPARED, AND THAT IS A DELIBERATE BLIND SPOT. A daemon found under this name\n   *   on a DIFFERENT node than `node` declares plans as `noop`, which does hide a misdeclaration.\n   *   The alternative is worse: `host` is `optional` in the schema, so an absent one would read as\n   *   a mismatch, and with no PUT a mismatch is a replace — i.e. a missing field in one API answer\n   *   would destroy a live mon. When in doubt, out of `matches`; fix a wrong node by hand.\n   */\n  host: string;\n  /**\n   * mon `running`/`stopped`/`unknown`, mgr `active`/`standby`, mds `up:active`/`up:standby`/…\n   * ⛔ CEPH ELECTS THIS AND REWRITES IT WITHOUT ANYONE DECLARING ANYTHING. MEASURED: mgr node-b is\n   *   `active` while node-c and node-d are `standby`; mds node-c is `up:active` while node-b and node-d are\n   *   `up:standby`. Restart a daemon and the roles move. It is reported so a plan can show what is\n   *   live and kept out of `matches` so that an election is never a diff.\n   * ⚠️ IT ALSO MEANS THIS RESOURCE DOES NOT MANAGE WHETHER THE DAEMON IS RUNNING. A configured but\n   *   stopped daemon is still a row in the list, so it reads as present and plans `noop`.\n   */\n  state: string;\n  /** Ceph-formatted, e.g. `198.51.100.12:6789/0`. Reported; see `mon-address` for why never compared. */\n  addr: string;\n  /** `ceph_version_short`, e.g. `20.2.2`. Reported: a straggler after an upgrade is worth seeing. */\n  version: string;\n  /**\n   * mon rank in the monmap, mds rank in the filesystem, `-1` when the daemon has neither.\n   * ⛔ CEPH ASSIGNS IT AND NOTHING DECLARES IT. MEASURED: the mons are ranked node-d=0, node-c=1, node-b=2 —\n   *   monmap order, not declaration order — and the mds ranks are 0 for the active node-c and -1 for\n   *   the two standbys. Rank moves when a daemon is added, removed or restarted.\n   */\n  rank: number;\n  /** mon only: in the current quorum. Reported. MEASURED: all three mons are in quorum. */\n  quorum: boolean;\n  /** mds only, and NOT the readback of `hotstandby` — see the ⛔ on that prop. */\n  standbyReplay: boolean;\n  /**\n   * mds only: the CephFS this daemon currently serves — `cephfs-c1` here.\n   * ⛔ PRESENT ONLY ON THE ACTIVE MDS. MEASURED: node-c carries `fs_name`, node-b and node-d have no such key\n   *   at all. So it is empty for two of three identical declarations, and comparing it would\n   *   report work on exactly the daemons that are healthy standbys.\n   */\n  fsName: string;\n  /** A `ceph-<kind>@<id>` systemd unit is enabled on the host. Reported; absent reads as false. */\n  service: boolean;\n}\n\nexport interface ProxmoxCephDaemon extends Resource<\n  'Proxmox.CephDaemon',\n  CephDaemonProps,\n  CephDaemonAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a mon carrying quorum cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxCephDaemon = Resource<ProxmoxCephDaemon>('Proxmox.CephDaemon', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * ⛔ TOTAL, AND THIS IS THE REASON THE FILE EXISTS RATHER THAN A SHORTCUT PAST WRITING IT. Every\n *   field a declaration can carry is CREATE-ONLY and unreadable — `mon-address` comes back as a\n *   different kind of string, `hotstandby` comes back as a state Ceph elects — and every field\n *   the read returns is assigned by Ceph: state, rank, quorum, fs_name, standby_replay, addr,\n *   version. Nothing is left that is both declared and readable. So the honest comparison is\n *   \"does a daemon of this kind and name exist\", which `readDaemon` has already answered by\n *   returning a value at all, and anything further would be a diff no write could ever satisfy.\n *   ⛔ AND ON THIS FAMILY THAT DIFF IS NOT MERELY NOISY. There is no PUT, so a false mismatch\n *     would have to be a REPLACE — and replace on a mon is delete-then-create against a live\n *     quorum. A forever-diff here is a forever-OUTAGE-RISK.\n *   ⚠️ THE PRICE, STATED PLAINLY: editing `hotstandby` or `mon-address` on a declared daemon\n *     plans as `noop` and never applies. Same bargain storage.ts strikes for a changed `type`.\n *     Change one by removing the declaration and re-adding it, ONE DAEMON AT A TIME, reading the\n *     ⛔ on destroy in the header first.\n */\n/**\n * ★ The factory's shape with no `updateForm`: create if absent, else read back untouched.\n * ⛔ `guardWrite` RUNS RIGHT AFTER THE READ, UNCONDITIONALLY, NOT ONLY ON THE CREATE BRANCH —\n *   found on adversarial review, 2026-09-24, matching node-network.ts's own `reconcile`.\n *   `reconcile` also runs for an ADOPTED row with no fresh `diff` first (Plan.ts forces it after\n *   the probe even when `diff` said noop), so a guard only on the create branch would let a\n *   caller that skips `diff` (a resumed apply, a verify harness) reach `createDaemon` with\n *   `mon-address` — a real vendor rule — unchecked.\n * ★ EXPORTED SO A TEST CAN CALL IT DIRECTLY, bypassing `diff` — the shape the review's own proof\n *   needed: `findProvider` gives back the wrapped service, this gives the plain function.\n */\nexport const reconcileDaemon = Effect.fn(function* ({ news }: { news: CephDaemonProps }) {\n  const live = yield* readDaemon(news);\n  yield* guardWrite(DAEMON_ENDPOINTS[news.kind], createForm(news), live === undefined);\n  if (live !== undefined) return live;\n  yield* createDaemon(news);\n  const after = yield* readDaemon(news);\n  if (after === undefined) return yield* Effect.die(notCreated(news));\n  return after;\n});\n\nexport const ProxmoxCephDaemonProvider = () =>\n  Provider.effect(\n    ProxmoxCephDaemon,\n    Effect.succeed(\n      ProxmoxCephDaemon.Provider.of({\n        /** ⛔ Empty, like every other resource here — adopting the whole cluster's daemons is not\n         *   an accident anyone should be one `destroy` away from. Adoption stays explicit. */\n        list: () => Effect.succeed([]),\n        read: ({ olds }) => readDaemon(olds),\n        // ★ Matches the pre-migration factory shape exactly (resource.ts): present is settled.\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(DAEMON_ENDPOINTS[news.kind], createForm(news), output === undefined);\n          if (output === undefined) return undefined;\n          const live = yield* readDaemon(news);\n          if (live === undefined) {\n            yield* guardWrite(DAEMON_ENDPOINTS[news.kind], createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          return { action: 'noop' } as const;\n        }),\n        reconcile: ({ news }) => reconcileDaemon({ news }),\n        /**\n         * ⛔ THE DANGEROUS ONE. Re-read the destroy ⛔ in the header before letting a plan that\n         *   removes a mon run: two gone at once is a cluster with no quorum and every guest on\n         *   `rbd-c1` blocked on I/O.\n         */\n        delete: ({ olds }) => deleteDaemon(olds),\n      }),\n    ),\n  );\n",
     "/**\n * Where a Ceph daemon lives on the API, and what a declaration of one looks like as a PVE form.\n *\n * ★ SPLIT OUT OF ceph-daemon.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is a real\n *   one rather than a convenient line number — the same seam metric-server-form.ts cuts on.\n *   This file answers \"how does a declaration address ONE daemon\" — which URL, which body, and\n *   which row of the collection's answer is it. ceph-daemon.ts answers \"what does the cluster\n *   say about that daemon, and when has it changed\". Nothing here calls the API and nothing\n *   here decides a diff; `findRow` picks a row out of an answer its caller already fetched.\n *\n * ⛔ THE TWO PATHS ARE DIFFERENT AND THAT IS THE WHOLE REASON THIS FILE HAS TWO OF THEM. MEASURED\n *   on node-b, 2026-09-13: there is no GET on the id path — `pvesh get /nodes/node-b/ceph/mon/node-b` answers\n *   \"No 'get' handler defined\" — while POST and DELETE are registered ONLY there. So the read uses\n *   `collectionPath` and the two writes use `daemonPath`, and swapping either one is a silent\n *   501: a create that never lands, or a destroy that reports failure while the daemon runs on.\n *\n * ⚠️ THE `import type` BACK TO ceph-daemon.ts IS A CYCLE ON PAPER ONLY — type-only, so it is\n *   erased before anything runs. `CephDaemonProps` stays the resource's public shape, in the file\n *   that declares the resource.\n *\n * ⛔ POST AND DELETE RETURN A UPID, NOT AN OBJECT — both are `protected` task endpoints whose\n *   schema `returns` is a bare string. REASONED, NOT MEASURED: this cluster is read-only to me, so\n *   no create was ever run. The consequence to expect is that `reconcile` reads back immediately\n *   after the POST, and if the worker has not yet written ceph.conf the read-back still says\n *   absent and reconcile dies with \"the write returned no error but the object is still absent\".\n *   That refusal is honest — nothing is recorded for an object that is not there — and a second\n *   deploy converges once the task has finished, but it is a confusing FIRST-RUN failure. Watch\n *   the task in the PVE UI before concluding the create failed.\n *\n */\nimport type { CephDaemonAttributes, CephDaemonKind, CephDaemonProps } from './ceph-daemon.ts';\nimport type { EndpointKey } from './constraints.ts';\nimport { bool, flag, num, text } from './values.ts';\n\n/**\n * The vendor endpoint each kind is created at, as the generated tables key it.\n *\n * ⛔ ONE PER KIND, NOT A `{type}` PATH. PVE registers `mds`, `mgr` and `mon` as three separate\n *   nodes with three separate parameter schemas — `hotstandby` belongs to the first and\n *   `mon-address` to the third — so a single key would enforce one kind's rules on all three.\n *   `ceph-daemon.ts` indexes this by `props.kind` for exactly that reason, on every `guardWrite`.\n * ⛔ THE STRINGS MUST STAY LITERALS. `codegen/constraints.ts` finds the endpoints to table by\n *   SCANNING THIS PACKAGE'S TEXT, so a key assembled from `props.kind` would be tabled by\n *   nothing and `constraintsFor` would throw on the first deploy that reached it.\n * ⚠️ THE PARAMETER NAMES DIFFER AND ARE THE VENDOR'S OWN — `{name}`, `{id}`, `{monid}`. The\n *   generator resolves each against the schema, so a tidied-up spelling stops the build.\n * ⚠️ NO `update` HERE: none of the three kinds has a PUT — ceph-daemon-wire.ts's own header.\n */\nexport const DAEMON_ENDPOINTS: Readonly<Record<CephDaemonKind, EndpointKey>> = {\n  mds: 'pve:POST /nodes/{node}/ceph/mds/{name}',\n  mgr: 'pve:POST /nodes/{node}/ceph/mgr/{id}',\n  mon: 'pve:POST /nodes/{node}/ceph/mon/{monid}',\n};\n\n/**\n * PVE defaults the id to the nodename for all three kinds, and that default is resolved HERE\n * rather than left to PVE, because the id is a PATH SEGMENT: create, delete and the row lookup in\n * ceph-daemon.ts all need the same string, and a default resolved on the far side would leave\n * three call sites guessing. Live on this cluster every daemon's name equals its node.\n */\nexport const daemonId = (props: CephDaemonProps) => props.name ?? props.node;\n\n/**\n * The read path. ⚠️ `{node}` HERE IS ONLY THE NODE BEING ASKED, not a filter. MEASURED:\n *   `GET /nodes/node-b/ceph/mon` returns node-b, node-c AND node-d, and `GET /nodes/node-c/ceph/mon` returns the same\n *   three IN A DIFFERENT ORDER — [node-d,node-b,node-c] from node-b against [node-c,node-b,node-d] from node-c. A caller that took\n *   row zero, or assumed the list was this node's daemons, would be wrong on both counts.\n */\nexport const collectionPath = (props: CephDaemonProps) => `nodes/${props.node}/ceph/${props.kind}`;\n\n/** The write path: POST creates here, DELETE destroys here. Never read from — see the ⛔ above. */\nexport const daemonPath = (props: CephDaemonProps) => `${collectionPath(props)}/${daemonId(props)}`;\n\n/**\n * The create body, which is EMPTY for a mgr and nearly empty for the other two.\n *\n * ⚠️ THE ID IS NOT SENT, because it is already the last segment of the path being POSTed to — the\n *   same reasoning as metric-server.ts, where a second copy of the key can only disagree with the\n *   first. PVE's schema does accept `monid`/`id`/`name` as body parameters; the path wins, so\n *   sending one would be a second source of truth for the object's identity and nothing else.\n *\n * ⚠️ AND THE BRANCHES CANNOT BE ONE SHARED BODY. `hotstandby` is an mds parameter and\n *   `mon-address` a mon one; each POST schema lists only its own, so the wrong field is a 400\n *   rather than an ignored hint. Both are create-only — the ⛔s on those props say why neither is\n *   ever compared afterwards.\n */\nexport const createForm = (props: CephDaemonProps): Record<string, string> => {\n  if (props.kind === 'mon' && props['mon-address'] !== undefined) {\n    return { 'mon-address': props['mon-address'] };\n  }\n  const hotstandby = props.kind === 'mds' ? flag(props.hotstandby) : undefined;\n  return hotstandby === undefined ? {} : { hotstandby };\n};\n\n/**\n * ⚠️ THE COLLECTION ANSWERS AN ARRAY while the factory types `attributes`' first parameter as the\n *   `Record<string, unknown>` every other PVE read is shaped like — the same mismatch acl.ts\n *   carries, handled the same way: narrow the rows, trust none of them, and match on `name`.\n * ⚠️ MATCHED ON `name` ALONE, NEVER ON POSITION — the list comes back in a different order\n *   depending on which node was asked. See the ⚠️ on `collectionPath` above.\n */\nexport const findRow = (live: unknown, props: CephDaemonProps) =>\n  (Array.isArray(live) ? live : [])\n    .filter((row): row is Record<string, unknown> => typeof row === 'object' && row !== null)\n    .find((row) => row['name'] === daemonId(props));\n\n/**\n * One live row as attributes, or `undefined` — \"no daemon of this kind carries this name\".\n *\n * ★ HERE RATHER THAN IN ceph-daemon.ts FOR THE REASON THAT FILE'S SIBLING EXISTS AT ALL: the\n *   250-line cap, and a seam that is real. It reads the row `findRow` picked out of an answer its\n *   caller already fetched, three lines above, so the lookup and the mapping now live together\n *   instead of a function call apart.\n *\n * ⚠️ `undefined` WHEN NO ROW CARRIES THIS NAME: that is how the factory learns to create.\n */\nexport const daemonAttributes = (\n  live: Record<string, unknown>,\n  props: CephDaemonProps,\n): CephDaemonAttributes | undefined => {\n  const row = findRow(live, props);\n  if (row === undefined) return undefined;\n  return {\n    addr: text(row['addr']),\n    fsName: text(row['fs_name']),\n    host: text(row['host']),\n    kind: props.kind,\n    name: daemonId(props),\n    node: props.node,\n    quorum: bool(row['quorum']),\n    rank: num(row['rank'], -1),\n    service: bool(row['service']),\n    standbyReplay: bool(row['standby_replay']),\n    state: text(row['state']),\n    version: text(row['ceph_version_short']),\n  };\n};\n",
     "/**\n * `Proxmox.CephDaemon`'s distilled wire lane: one dispatch per kind, because mon/mgr/mds are three\n * separate distilled operations with three separate request shapes (`{node,monid}` /\n * `{node,id}` / `{node,name}`) — the SAME reason `DAEMON_ENDPOINTS` (ceph-daemon-form.ts) is a\n * per-kind table rather than one templated string.\n *\n * ⛔ ABSENCE IS A SUCCESSFUL INDEX WITH NO MATCHING ROW. The original transport swap\n *   preserved `pveOperations.read`'s catch-all fold; the 2026-09-24 follow-up removes it. A failed\n *   mon/mgr/mds list proves nothing about whether a daemon exists, so its SDK error propagates.\n *\n * ⚠️ `mon_address` IS THE ONE RENAME THIS FAMILY NEEDS — distilled's generator maps the wire name\n *   `mon-address` to `mon_address` on `UpdateNodeCephMonRequest` (`T.Body(\"mon-address\")`,\n *   confirmed against its schema), the same one-key pattern node-network-form.ts's `RENAMED`\n *   table carries for three fields. `hotstandby` needs no rename.\n */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport type { CephDaemonKind, CephDaemonProps } from './ceph-daemon.ts';\nimport { daemonAttributes, daemonId, daemonPath } from './ceph-daemon-form.ts';\nimport { runPve } from './distilled-pve.ts';\n\n/**\n * The index, per kind — the same array `daemonAttributes`/`findRow` already narrow.\n *\n * ⚠️ CAST TO `unknown[]` PER BRANCH, NOT LEFT TO INFERENCE. mon/mgr/mds answer three DIFFERENT\n *   row shapes (`ListNodeCephMonResponseBodyItem` and its two siblings), and a switch returning\n *   each as-is infers their INTERSECTION rather than their union — TypeScript refuses that under\n *   `exactOptionalPropertyTypes`. `daemonAttributes` already treats the row generically (it reads\n *   by string key, the same shape acl.ts narrows), so the cast costs nothing real.\n */\nconst listRows = (props: CephDaemonProps) => {\n  const node = props.node;\n  switch (props.kind) {\n    case 'mon':\n      return runPve(props.target, 'read', false, nodes.listNodeCephMon({ node })).pipe(\n        Effect.map((rows): unknown[] => rows),\n      );\n    case 'mgr':\n      return runPve(props.target, 'read', false, nodes.listNodeCephMgr({ node })).pipe(\n        Effect.map((rows): unknown[] => rows),\n      );\n    case 'mds':\n      return runPve(props.target, 'read', false, nodes.listNodeCephMds({ node })).pipe(\n        Effect.map((rows): unknown[] => rows),\n      );\n  }\n};\n\n/** A missing row is absent; a failed index read keeps its typed SDK error. */\nexport const readDaemon = (props: CephDaemonProps) =>\n  listRows(props).pipe(\n    Effect.map((rows) => daemonAttributes(rows as unknown as Record<string, unknown>, props)),\n  );\n\n/** POST — distilled's generator misnames it \"update\" (checked against `T.Http`); it is a create. */\nexport const createDaemon = (props: CephDaemonProps) => {\n  const node = props.node;\n  const id = daemonId(props);\n  switch (props.kind) {\n    case 'mon':\n      return runPve(\n        props.target,\n        'provision',\n        true,\n        nodes.updateNodeCephMon({\n          ...(props['mon-address'] === undefined ? {} : { mon_address: props['mon-address'] }),\n          monid: id,\n          node,\n        }),\n      );\n    case 'mgr':\n      return runPve(props.target, 'provision', true, nodes.updateNodeCephMgr({ id, node }));\n    case 'mds':\n      return runPve(\n        props.target,\n        'provision',\n        true,\n        nodes.updateNodeCephMds({\n          ...(props.hotstandby === undefined ? {} : { hotstandby: props.hotstandby ? '1' : '0' }),\n          name: id,\n          node,\n        }),\n      );\n  }\n};\n\n/** ⚠️ NO FLAGS ON ANY OF THE THREE — unlike CephFs/CephOsd, nothing here is at risk of a\n *   DELETE-body PVE would ignore, because nothing here is ever sent. */\nexport const deleteDaemon = (props: CephDaemonProps) => {\n  const node = props.node;\n  const id = daemonId(props);\n  switch (props.kind) {\n    case 'mon':\n      return runPve(props.target, 'provision', true, nodes.deleteNodeCephMon({ monid: id, node }));\n    case 'mgr':\n      return runPve(props.target, 'provision', true, nodes.deleteNodeCephMgr({ id, node }));\n    case 'mds':\n      return runPve(props.target, 'provision', true, nodes.deleteNodeCephMds({ name: id, node }));\n  }\n};\n\n/** Re-exported so ceph-daemon.ts can narrow a switch exhaustively without importing the union twice. */\nexport type { CephDaemonKind };\n\n/** ★ Moved here from ceph-daemon.ts's `reconcile` for the 250-line cap — matches ceph-fs.ts's own\n *  `notCreated`/`notDestroyed` seam: the message, not the decision to die, lives with the calls. */\nexport const notCreated = (props: CephDaemonProps) =>\n  new Error(\n    `${daemonPath(props)}: no ${props.kind} named ${daemonId(props)} in GET nodes/` +\n      `${props.node}/ceph/${props.kind} after the create task finished. POST answers a UPID, ` +\n      'not a result -- watch the task in the PVE UI (ceph-daemon-form.ts).',\n  );\n",
-    "/**\n * `Proxmox.CephFlag` — one cluster-wide Ceph OSD flag, declared: `noout`, `pause`, `norebalance`.\n *\n * ★ ONE RESOURCE PER FLAG, NOT ONE CARRYING ALL ELEVEN, AND THE CLUSTER'S OWN API DECIDED IT.\n *   MEASURED on C1 2026-09-13 (pve-manager 9.2.11, ceph tentacle 20.2.2) by reading\n *   `/usr/share/perl5/PVE/API2/Cluster/Ceph.pm` and the published schema in\n *   `/usr/share/pve-docs/api-viewer/apidoc.js`:\n *     · `PUT /cluster/ceph/flags` ends in `fork_worker('cephsetflags', ...)` and returns a STRING\n *       — a UPID. The bulk write is ASYNCHRONOUS, and this package has no task-polling machinery.\n *     · `PUT /cluster/ceph/flags/{flag}` calls `$rados->mon_command` inline and returns null. The\n *       per-flag write is SYNCHRONOUS.\n *   `pveOperations.reconcile` READS BACK after every write and refuses to record a value it did\n *   not see. Against the bulk endpoint that read-back races a worker which has not run yet, so it\n *   would record the OLD value as the new attributes — the one honesty mechanism in this package\n *   turned into a lie generator. Per-flag, the read-back means what it says.\n *   ★ THE SECOND REASON IS SMALLER AND STILL REAL. The bulk GET answers rows of\n *     `{name, description, value}`, and `description` is PVE's own English prose that no write\n *     accepts: compare it and you have a forever-update, report it and this provider is pretending\n *     to manage prose. `GET /cluster/ceph/flags/{flag}` answers a BARE BOOLEAN, so that trap\n *     cannot be written here at all. The brief's plural `Proxmox.CephFlags` became singular for\n *     those two reasons; the bulk endpoint is read by nothing in this package.\n *\n * ⛔ THESE ARE NOT CONFIGURATION. THEY ARE A HAND ON THE BRAKE, AND A DECLARATION CAN PULL IT OFF.\n *   `noout` is what a person sets before pulling a disk. A stack saying `value: false` reasserts\n *   that off on EVERY deploy — including a deploy somebody else runs, for an unrelated resource,\n *   twenty minutes into a maintenance window — and the plan line reads `Proxmox.CephFlag noout\n *   update`, which nobody reads as \"ceph is about to start rebalancing 128 PGs across three nodes\n *   while a disk is out of the chassis\".\n *   ★ SO `value` IS REQUIRED AND HAS NO DEFAULT, AND THAT IS THE MITIGATION. An optional `value`\n *     defaulting to false would make `CephFlag('noout', { flag: 'noout', target })` mean \"clear\n *     it\" — the dangerous direction, chosen by OMISSION. Here the dangerous sentence has to be\n *     typed out by a person. Do not add a default, and do not declare a flag merely to document\n *     that it is off: MEASURED 2026-09-13, all eleven flags on C1 read 0, so eleven\n *     `value: false` lines would plan green forever and do nothing except take the brake off\n *     whenever somebody happens to apply them.\n *\n * ⛔ `delete` DOES NOTHING, ON PURPOSE, AND THE ASYMMETRY OF THE TWO FAILURES IS THE ARGUMENT.\n *   `flags/{flag}` has exactly two methods, GET and PUT, so the factory's `destroy` would answer\n *   \"Method 'DELETE /cluster/ceph/flags/noout' not implemented\" on every teardown — whatever this\n *   handler does is INVENTED. The obvious invention, \"clear the flag\", is refused: removing a line\n *   from a stack file, or Alchemy collecting an old generation after a replace, would silently\n *   take the brake off and nothing would warn. Leaving a flag set that nothing declares any more\n *   is the opposite kind of failure — ceph reports `HEALTH_WARN ... flag(s) set` for every one of\n *   these, on `ceph -s`, in the PVE UI and in the `pve_*` metrics this estate already scrapes.\n *   A silent destructive failure loses to a loud inert one.\n *   ⚠️ THE RESIDUAL RISK, NAMED RATHER THAN DENIED: deleting a `value: true` declaration LEAVES\n *     THE FLAG SET. Retire a maintenance window by flipping the line to `value: false` and\n *     deploying BEFORE the line is removed, or a `noout` outlives the window that needed it.\n *   ⚠️ REASONED, NOT MEASURED: that health warning was not observed, because observing it means\n *     setting a flag on a live cluster and this file was researched read-only. Undeclaring stops\n *     MANAGING a flag; to clear one, declare `value: false` and deploy, where a plan says so.\n *\n * ⛔ `pause` IS TWO CEPH FLAGS AND THIS RESOURCE READS ONLY ONE OF THEM. MEASURED in\n *   `PVE::Ceph::Tools::get_real_flag_name`, whose own comment reads \"the 'pause' flag gets always\n *   set to both 'pauserd' and 'pausewr'\": PVE writes both and then decides the flag is set by\n *   looking at `pauserd` alone. A cluster where somebody ran `ceph osd unset pauserd` by hand\n *   still has `pausewr` — writes blocked, guests hung — and this resource reports `value: false`\n *   and plans `noop` straight past it. It cannot express a half-pause, so never use it to prove\n *   one is gone; `ceph osd dump | head -1` can.\n *   ⛔ `pause` AND `noup` ARE ALSO THE TWO THAT TAKE THE CLUSTER DOWN FROM A TYPO. `pause: true`\n *     stops all reads and writes, so every guest on `rbd-c1` — the cluster's only rbd pool,\n *     MEASURED 2026-09-13 — freezes on its root disk, and so does `cephfs-c1`. `noup: true`\n *     stops a rebooted OSD from ever rejoining. Neither is undone by deleting the line.\n *\n * ⚠️ PRIVILEGES, AND THE WRITE ONE IS A BIG ASK. Both GETs check `Sys.Audit` on `/`; both PUTs\n *   check `Sys.Modify` on `/`, and all four carry `allowtoken => 1`, so an API token may make the\n *   call at all. There is no `/ceph` ACL object to scope to — the check names the ROOT path\n *   literally — so granting the provision role `Sys.Modify` here also buys datacenter options,\n *   metric servers, notification targets and every other cluster-wide write, exactly as\n *   metric-server.ts warns about its own family.\n *   ⚠️ REASONED, NOT MEASURED: nothing here was exercised under a minted lease, because a mint\n *     writes an API token into the cluster and the brief for this file was reads only. Expect\n *     \"Permission check failed (/, Sys.Modify)\" on the first deploy, and widen deliberately.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { bool, flag } from './values.ts';\n\n/**\n * PVE's eleven flags, spelled as `PVE::Ceph::Tools::get_possible_osd_flags` spells them.\n *\n * ⚠️ THE ENUM IS CLOSED AND A TYPO IS A 400, WHICH IS WHY THIS IS A UNION AND NOT `string`. Both\n *   the GET and the PUT declare `additionalProperties => 0` over exactly this list.\n * ⚠️ CEPH HAS FLAGS PVE DOES NOT MODEL, and four of them are always on. MEASURED on C1:\n *   `ceph osd dump` reports `flags sortbitwise,recovery_deletes,purged_snapdirs,pglog_hardlimit`.\n *   PVE reads that same string and answers only about its own eleven, so the others can neither\n *   leak in here nor be set from here — `noautoscale` and `nosnaptrim` included.\n *   ⛔ IF SOMEBODY LATER \"IMPROVES\" THE READ BY PARSING `osd dump` DIRECTLY, those four become\n *     permanently-set flags that nothing declares: a forever-diff on a brand new cluster.\n */\nexport type CephFlagName =\n  | 'nobackfill'\n  | 'nodeep-scrub'\n  | 'nodown'\n  | 'noin'\n  | 'noout'\n  | 'norebalance'\n  | 'norecover'\n  | 'noscrub'\n  | 'notieragent'\n  | 'noup'\n  | 'pause';\n\nexport interface CephFlagProps extends WithTarget {\n  /**\n   * Which flag. PVE's primary key here, and the last segment of the path.\n   *\n   * ⚠️ EDITING IT IN PLACE ORPHANS THE OLD FLAG RATHER THAN MOVING ANYTHING. `diff` reads the NEW\n   *   path and reconcile writes it, while the old flag keeps whatever this stack last put there.\n   *   There is deliberately no replace override for it — acl.ts needs one because its `delete`\n   *   removes a real grant, and `delete` here is inert by design, so a replace would do exactly\n   *   what an update already does. Declare a second resource and set the old one to `value: false`\n   *   rather than renaming this one.\n   * ⛔ TWO RESOURCES DECLARING THE SAME FLAG ARE ONE CLUSTER OBJECT, and Alchemy sees two ids\n   *   rather than a collision — the acl.ts hazard exactly. Disagreeing, they take turns winning\n   *   and BOTH plan `update` for ever; agreeing, deleting either leaves the flag where the other\n   *   put it. One declaration per flag per cluster.\n   */\n  flag: CephFlagName;\n  /**\n   * Set the flag (`true`) or clear it (`false`).\n   *\n   * ⛔ REQUIRED, WITH NO DEFAULT — see the second ⛔ in the header, which is the whole safety\n   *   argument for this family. It is also the only field PVE accepts on this endpoint, and it is\n   *   not optional in the schema either: omitting it from the form is a 400, not an untouched\n   *   flag. (The BULK endpoint is the one where omission means \"leave it alone\"; this is not it.)\n   */\n  value: boolean;\n}\n\nexport interface CephFlagAttributes {\n  /**\n   * ⚠️ REPORTED, NEVER COMPARED. It is the path key the read was made WITH, copied back out of\n   *   props, so comparing it against props would be true by construction — the same reasoning\n   *   acl.ts gives for the four identity fields it also declines to diff.\n   */\n  flag: CephFlagName;\n  /** Whether ceph has the flag set right now. The only field `matches` looks at. */\n  value: boolean;\n}\n\nexport interface ProxmoxCephFlag extends Resource<\n  'Proxmox.CephFlag',\n  CephFlagProps,\n  CephFlagAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxCephFlag = Resource<ProxmoxCephFlag>('Proxmox.CephFlag');\n\nconst handlers = pveHandlers<CephFlagProps, CephFlagAttributes>({\n  /**\n   * ⚠️ `live` IS A BARE BOOLEAN HERE, NOT AN OBJECT, AND IT IS HANDED TO `bool` WHOLE ON PURPOSE.\n   *   `get_flag` returns perl `1` or `0` under a `type => 'boolean'` return schema, so the wire is\n   *   `{\"data\":0}` or `{\"data\":false}` depending on how the REST layer renders it. `bool` accepts\n   *   every one of those spellings, which is exactly why it is a shared coercion. The factory\n   *   types this parameter `Record<string, unknown>` because every OTHER PVE read is an object;\n   *   reaching for `live['value']` here would answer undefined on every plan and diff `false`\n   *   forever against a set flag.\n   *   ⚠️ THE SCALAR IS A MEASURED PROPERTY OF THIS PVE, NOT A PROMISE. A later version wrapping\n   *     the answer in an object would make `bool` read a SET flag as false, and `value: false`\n   *     would then plan `noop` over a live flag — silently. Re-measure\n   *     `GET /cluster/ceph/flags/noout` after a major upgrade; cheaper than a second parse path.\n   *\n   * ⛔ IT NEVER ANSWERS undefined, WHICH MAKES THE CREATE BRANCH UNREACHABLE, AND ITS ERROR WILL\n   *   MISLEAD YOU. All eleven flags always exist; there is nothing for \"absent\" to mean. So a POST\n   *   to `collection` means the READ failed — an expired 300s lease, node-b down, or ceph simply not\n   *   configured on the cluster (every one of these four handlers opens with\n   *   `check_ceph_configured()`, which dies). Read the resulting \"Method 'POST /cluster/ceph/flags'\n   *   not implemented\" as \"the read failed\" and go and look at the credential, not at ceph. Same\n   *   shape as the unreachable POST in acl.ts, same advice.\n   */\n  attributes: (live, props) => ({ flag: props.flag, value: bool(live) }),\n  collection: () => 'cluster/ceph/flags',\n  /**\n   * ⛔ UNREACHABLE — see the second ⛔ in `attributes`. It is written in the BULK endpoint's shape\n   *   (the flag name is the parameter, not `value`) rather than left empty, because that is the\n   *   only body `cluster/ceph/flags` has ever documented. Nothing sends it today.\n   */\n  createForm: (props) => ({ [props.flag]: flag(props.value) ?? '0' }),\n  endpoint: { update: 'pve:PUT /cluster/ceph/flags/{flag}' }, // ⛔ No create: see above.\n  /**\n   * ⚠️ `value` IS THE ONLY THING COMPARED, AND THE LIST OF THINGS DELIBERATELY NOT COMPARED IS THE\n   *   point of this resource. `flag` is props-derived (see `CephFlagAttributes`). `description`\n   *   and `name` exist only on the bulk GET, which this file does not read, so neither can be\n   *   compared by accident. Nothing PVE returns here is rewritten, re-ordered or re-typed by the\n   *   cluster, because all PVE returns here is one boolean.\n   *   ★ MEASURED: on C1, `GET /cluster/ceph/flags` answers value 0 for all eleven flags, so a\n   *     declaration of `value: false` reads back false and plans `noop`.\n   */\n  matches: (attributes, props) => attributes.value === props.value,\n  path: (props) => `cluster/ceph/flags/${props.flag}`,\n  /**\n   * ⚠️ ONLY `value` GOES IN THE BODY. `flag` is already bound by the path and the PUT declares\n   *   `additionalProperties => 0`, so a second copy in the form could only disagree with the URL.\n   * ⚠️ THE `?? '0'` IS UNREACHABLE, AND IS WRITTEN RATHER THAN CAST AWAY. `flag()` types its\n   *   answer `string | undefined` because it serves OPTIONAL props, and `value` here is required,\n   *   so the branch cannot be taken; a cast would claim a proof the type system has not made.\n   */\n  updateForm: (props) => ({ value: flag(props.value) ?? '0' }),\n});\n\nexport const ProxmoxCephFlagProvider = () =>\n  Provider.effect(\n    ProxmoxCephFlag,\n    Effect.succeed(\n      ProxmoxCephFlag.Provider.of({\n        /**\n         * ⚠️ NOT THE ONE-LINE `Provider.of(handlers)` EVERY OTHER FILE HERE USES, AND THE TWO\n         *   REASONS ARE BOTH acl.ts's. PVE implements no DELETE on this path, and the factory's\n         *   read-back guard is dead whenever `attributes` cannot answer undefined. Unlike acl.ts\n         *   this SPREADS the factory's handlers instead of retyping them, so `list`, `read` and\n         *   `diff` cannot drift from the shared ones — only the two that genuinely differ are\n         *   written out below.\n         */\n        ...handlers,\n        /** ⛔ Inert, deliberately. The third ⛔ in the header is the whole argument; read it. */\n        delete: () => Effect.void,\n        /**\n         * ⚠️ THE READ-BACK GUARD, RESTORED FOR A FAMILY WHOSE \"ABSENT\" DOES NOT EXIST.\n         *   `ops.reconcile` refuses when the object is still missing after a write, and a flag is\n         *   never missing, so that check can never fire here — exactly the hole acl.ts patches\n         *   with `bound`. PVE answers 200 with `{\"data\":null}` on calls that did nothing, and this\n         *   PUT's documented return IS null, so the status code carries no evidence at all.\n         * ⚠️ THE PER-FLAG PUT IS SYNCHRONOUS (`$rados->mon_command` inline, MEASURED in Ceph.pm),\n         *   which is what makes this check fair rather than a race against a worker task. If it\n         *   ever fires spuriously the honest fix is to look at the mon, not to delete the guard.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const after = yield* handlers.reconcile({ news });\n          if (after.value !== news.value) {\n            return yield* Effect.die(\n              new Error(\n                `cluster/ceph/flags/${news.flag}: the PUT returned no error but ceph still ` +\n                  `reports the flag ${after.value ? 'set' : 'clear'} rather than ` +\n                  `${news.value ? 'set' : 'clear'}. This endpoint's success is documented as a ` +\n                  'null body, so the status code proves nothing -- check `ceph osd dump | ' +\n                  'head -1` and the cluster log. `pause` in particular is two ceph flags read ' +\n                  'as one; see the header.',\n              ),\n            );\n          }\n          return after;\n        }),\n      }),\n    ),\n  );\n",
-    "/**\n * The four operations every PVE object shares, and the five handlers that wire them to Alchemy.\n *\n * ★ THE SHAPE THEY READ IS `PveSpec`, IN resource-spec.ts, WITH THE ARGUMENT FOR IT. This file was\n *   one file until 2026-09-22, when the vendor-constraint guard took it past the 250-line cap; the\n *   split is by what a reader is doing — declaring an object, or changing how every object is\n *   written — and the types are re-exported below so no importer moved.\n *\n * ⚠️ EVERY PVE ANSWER IS WRAPPED IN `{\"data\": ...}` AND A FAILED CALL CAN STILL BE HTTP 200 with\n *   `{\"data\": null}`. That is why `reconcile` below READS BACK and refuses when the object is still\n *   absent, rather than trusting a status code — see the ⛔ in that function.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport { pve } from './client.ts';\nimport { specGuards } from './resource-guard.ts';\nimport type { PveSpec, WithApiTarget } from './resource-spec.ts';\nimport { formToSend } from './update-guard.ts';\n\nexport type {\n  PveRequirements,\n  PveSpec,\n  WithApiTarget,\n  WithPbsTarget,\n  WithTarget,\n} from './resource-spec.ts';\n\nexport const pveOperations = <Props extends WithApiTarget, Attributes>(\n  spec: PveSpec<Props, Attributes>,\n) => {\n  const { guardCreate, guardUpdate } = specGuards(spec);\n\n  /** The live object, or undefined. ⚠️ A 404 and `{\"data\": null}` are ANSWERS, not failures. */\n  const read = (props: Props) =>\n    pve<Record<string, unknown>>(\n      props.target,\n      spec.readRole ?? 'read',\n      'GET',\n      spec.path(props),\n    ).pipe(\n      Effect.map((data) => (data == null ? undefined : spec.attributes(data, props))),\n      Effect.orElseSucceed(() => undefined),\n    );\n\n  return {\n    /**\n     * ★ EXPORTED SO A FAMILY THAT WRITES ITS OWN `reconcile` REACHES THE SAME CHECK BY THE SAME\n     *   NAME. CephPool, CephFs and ZfsPool all bypass the reconcile below — forked workers, a\n     *   settle loop, a destructive create — and without these two they would be checked at plan\n     *   time and not at apply time, which is exactly the gap an ADOPTED row falls through.\n     */\n    guardCreate,\n    guardUpdate,\n\n    read,\n\n    // ⚠️ `Input<Props>`, NOT `Props`. At plan time a prop can still be an unresolved Output or\n    //   Config; `isResolved` is the narrowing, so the parameter has to admit the wider type or\n    //   every caller casts — and a cast here would be a lie about what plan actually has.\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        // ⚠️ A prop can still be an unresolved Output at plan time. Alchemy's own providers guard\n        //   with isResolved and skip rather than guess; comparing a placeholder to a live value\n        //   reports an update nobody asked for.\n        if (!isResolved(news)) return undefined;\n        /**\n         * ⛔ THE VENDOR CHECK RUNS BEFORE THE `output === undefined` RETURN, AND THE ORDER IS THE\n         *   WHOLE FIX. `output === undefined` IS the resource Alchemy has no state for — the\n         *   create. Checking after it would leave exactly the case that failed on 2026-09-22\n         *   unchecked, and the refusal would arrive from the server, half a deploy in.\n         */\n        yield* guardCreate(news, output === undefined);\n        yield* guardUpdate(news);\n        if (output === undefined) return undefined;\n        const live = yield* read(news);\n        // ⚠️ `update`, NOT `create` — Alchemy's Diff admits only noop/update/replace. An object\n        //   Alchemy has state for but the cluster does not is drift, and reconcile repairs it.\n        if (live === undefined) {\n          /**\n           * ⛔ DRIFT REACHES `reconcile`'s POST, so the create form's required parameters ARE\n           *   about to go on the wire after all. Saying so here rather than leaving it to\n           *   reconcile keeps the refusal in `plan`, where an operator is reading.\n           */\n          yield* guardCreate(news, true);\n          return { action: 'update' } as const;\n        }\n        if (spec.matches(live, news)) return { action: 'noop' } as const;\n        // An object with no update path cannot be edited in place; say replace and mean it.\n        return spec.updateForm === undefined\n          ? ({ action: 'replace' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    reconcile: (news: Props) =>\n      Effect.gen(function* () {\n        const live = yield* read(news);\n        // ⚠️ CHECKED AGAIN HERE, AND NOT BECAUSE `diff` IS UNTRUSTED. `reconcile` also runs for an\n        //   ADOPTED row, whose diff answer Alchemy discards (verify/fake-engine.ts records it), and\n        //   a family that writes its own reconcile bypasses the one above entirely.\n        // ⛔ AFTER THE READ, BECAUSE THE READ IS WHAT SAYS WHICH REQUEST IS ABOUT TO BE MADE. A GET\n        //   changes nothing, so nothing has been written by the time a violation refuses the plan.\n        yield* guardCreate(news, live === undefined);\n        yield* guardUpdate(news);\n        if (live === undefined) {\n          yield* pve(\n            news.target,\n            'provision',\n            'POST',\n            spec.collection(news),\n            spec.createForm(news),\n          );\n        } else if (spec.updateForm !== undefined) {\n          /**\n           * ⛔ ADOPTING AN OBJECT THAT ALREADY MATCHES MUST NOT WRITE TO IT, AND WITHOUT THE\n           *   `matches` GUARD IT DID. Alchemy's `adopted` action is NOT a read: Apply.ts routes it\n           *   down the same branch as `update` and calls `reconcile` (Apply.ts:980 and :1045). So\n           *   the first time a declaration names an object Alchemy has no state for — which is\n           *   exactly what adopting the live estate means — reconcile runs, finds it present, and\n           *   fell through to this PUT.\n           *\n           *   For most families that was a pointless write-back of identical values. For\n           *   `Proxmox.NodeNetwork` it is worse than pointless: a PUT under `/nodes/{node}/network`\n           *   STAGES a change into `/etc/network/interfaces.new`, so merely adopting the interface\n           *   a node already has would leave that node with a pending network change waiting for an\n           *   apply — on a cluster whose Ceph traffic rides vmbr1.42. Adoption has to be free.\n           *\n           * ★ SO THE CONDITION IS THE SAME PREDICATE `diff` USES. If `matches` is true the object\n           *   already says what the declaration says, and there is nothing to write — by\n           *   definition, since every field this provider manages is a field `matches` compares.\n           *   A field deliberately left OUT of `matches` is one this resource does not manage, so\n           *   its drift is not this provider's to repair.\n           *\n           * ★ THE PREDICATE LIVES IN update-guard.ts NOW, with the ⚠️ on why an empty form is not a\n           *   write either, because CephPool and PbsDatastore write their own reconcile and need\n           *   the same one — CephPool did not have it (see that file).\n           */\n          const form = formToSend(spec.matches, live, news, spec.updateForm(news));\n          if (form !== undefined) {\n            yield* pve(news.target, 'provision', 'PUT', spec.path(news), form);\n          }\n        }\n        const after = yield* read(news);\n        if (after === undefined) {\n          /**\n           * ⛔ REFUSE RATHER THAN RETURN THE PROPS AS THOUGH THEY LANDED. PVE answers 200 with\n           *   `{\"data\": null}` on several endpoints, so \"no error\" is not evidence of a write. A\n           *   provider that returned its own inputs here would record state for an object that does\n           *   not exist, and the next plan would read `noop` over the gap.\n           */\n          return yield* Effect.die(\n            new Error(\n              `${spec.path(news)}: the write returned no error but the object is still absent. ` +\n                'PVE wraps every answer in {\"data\":...} and can report success on a call that did ' +\n                'nothing -- read back rather than trusting the status code.',\n            ),\n          );\n        }\n        return after;\n      }),\n\n    /**\n     * ⚠️ PVE REFUSES TO DELETE THINGS THAT ARE STILL IN USE — a pool holding guests, a storage with\n     *   volumes. That refusal is the cluster declining to orphan something because a line left a\n     *   file, so it is surfaced as-is rather than retried with a force flag.\n     */\n    destroy: (olds: Props) => pve(olds.target, 'provision', 'DELETE', spec.path(olds)),\n  };\n};\n\n/**\n * The five provider handlers for a spec'd PVE object, wired once.\n *\n * ⛔ THIS BLOCK WAS WRITTEN TEN TIMES BEFORE IT WAS EXTRACTED, and every copy was character for\n *   character identical apart from its comments: `list` answering empty, and four handlers whose\n *   entire body was `yield* ops.<same name>(<same argument>)`. Ten copies of a delegation is ten\n *   chances to delegate to the wrong one — `ops.read(olds)` inside `reconcile` typechecks, returns\n *   a plausible value, and turns every deploy into a no-op that reports success.\n *\n * ★ IT TAKES THE SPEC, NOT THE OPERATIONS, so a resource declares its four spec functions and\n *   stops. `pveOperations` stays exported for an object that genuinely needs a handler of its own;\n *   nothing in this package does yet, and the day one does it should be visibly different from the\n *   ten that are not.\n *\n * ⛔ IT STOPS AT THE HANDLERS AND DOES NOT RETURN THE LAYER, AND THAT IS NOT AN OVERSIGHT — it was\n *   written the other way first and reverted. Wrapping `Provider.effect(cls, …)` here means naming\n *   the resource class generically, and Alchemy's `Props<R>` and `R[\"Attributes\"]` are not the\n *   plain `Props` and `Attributes` this spec is written against: `Attributes` comes back as\n *   `Attributes & AttrOutput<Attributes[\"Attributes\"]>`. Against a free type variable TypeScript\n *   cannot prove those line up — \"could be instantiated with a different subtype\" — so the only\n *   way to compile a Layer-returning version is a cast, and a cast is a LIE ABOUT WHETHER THE\n *   HANDLERS MATCH THE RESOURCE, which is the one thing the call site exists to check. Leaving\n *   `Cls.Provider.of(...)` in each file keeps that check where the types are concrete and real.\n *   One line per resource is the price of it, and it is worth paying.\n *\n * ⚠️ `list` IS OPTIONAL IN `ProviderServiceInput` AND IS PASSED ANYWAY. An empty list is a claim —\n *   this provider adopts nothing — and it is made here for every PVE object at once, because the\n *   reasoning is identical for all of them: every PVE index endpoint answers with the whole\n *   cluster's objects, PVE's own built-ins included. `GET /pools` returns pools a human made years\n *   ago; `GET /access/roles` returns `Administrator`. Returning any of them would invite Alchemy to\n *   adopt an object it never created, and therefore one day to narrow or delete it. Adoption stays\n *   an explicit act. A resource with a reason to differ passes its own `list` and says why.\n */\nexport const pveHandlers = <Props extends WithApiTarget, Attributes extends object>(\n  spec: PveSpec<Props, Attributes>,\n) => {\n  const ops = pveOperations(spec);\n  return {\n    list: () => Effect.succeed([]),\n    read: ({ olds }: { olds: Props }) => ops.read(olds),\n    diff: ({ news, output }: { news: Input<Props>; output: Attributes | undefined }) =>\n      ops.diff(news, output),\n    reconcile: ({ news }: { news: Props }) => ops.reconcile(news),\n    delete: ({ olds }: { olds: Props }) => ops.destroy(olds),\n  };\n};\n",
-    "/**\n * One authenticated call to the Proxmox VE API.\n *\n * ★ PLAIN `fetch`, NO TLS ESCAPE HATCH, AND THAT IS A MEASURED CHOICE RATHER THAN AN OMISSION.\n *   Proxmox is usually met with `curl -k` because a fresh install serves its own self-signed\n *   certificate — I reached for `-k` myself before checking. This cluster serves a real Let's\n *   Encrypt certificate (`CN=cluster-c1.example.com`), and strict TLS answers 401, i.e. the\n *   handshake succeeds and only the credential is missing. So there is no `rejectUnauthorized`\n *   option here to be left switched on by accident in somebody else's estate.\n *\n * ⚠️ EVERY PVE ANSWER IS WRAPPED IN `{\"data\": ...}`, errors included — a failed call can still be\n *   HTTP 200 with `{\"data\": null}`. Unwrapping is not cosmetic; a caller that reads the envelope\n *   as the payload sees `undefined` and calls it \"absent\".\n */\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\nimport type { ApiTarget, PveCredential, PveRole, PveTarget } from './credentials.ts';\nimport { leased } from './lease-cache.ts';\nimport { authorization } from './mint.ts';\nimport { executeOnCluster } from './members.ts';\n\nexport class PveError extends Error {\n  constructor(\n    readonly status: number,\n    readonly method: string,\n    readonly path: string,\n    detail: string,\n  ) {\n    super(`PVE ${method} ${path} -> ${String(status)}: ${detail}`);\n    this.name = 'PveError';\n  }\n}\n\nconst clusterExhausted = (\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  attempts: ReadonlyArray<{ member: string; why: string }>,\n) =>\n  new PveError(\n    0,\n    method,\n    path,\n    `all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join('; ')}`,\n  );\n\n/**\n * A form body, where a value may be a LIST.\n *\n * ⛔ PVE AND PBS SPELL A MULTI-VALUED FIELD DIFFERENTLY, AND THE LIST FORM IS FOR PBS. PBS is Rust:\n *   its schemas use `type: array` — `delete` on every update endpoint is one — and its urlencoded\n *   decoder builds that array from REPEATED KEYS (`delete=a&delete=b`). PVE's Perl takes a comma\n *   string for the same idea, which is what `withClears` in values.ts produces, and for the one\n *   PVE field that genuinely needs repetition it wants a NUL-joined value instead (see\n *   notification-target.ts). So: PVE callers pass strings and are unaffected; a PBS caller that\n *   needs an array passes one and gets repeated keys rather than reaching for PVE's encoding.\n */\nexport type PveForm = Record<string, readonly string[] | string>;\n\n/** ⚠️ `append`, NOT `set`: a repeated key is the point, and `set` would keep only the last. */\nconst encode = (form: PveForm): string => {\n  const params = new URLSearchParams();\n  for (const [key, value] of Object.entries(form)) {\n    if (typeof value === 'string') params.append(key, value);\n    else for (const item of value) params.append(key, item);\n  }\n  return params.toString();\n};\n\nconst buildRequest = (\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  apiBase: string,\n  path: string,\n  credential: PveCredential,\n  target: ApiTarget,\n  form?: PveForm,\n) => {\n  const url = `${apiBase}/${path}`;\n  /**\n   * ⛔ THE CONTENT TYPE IS AN ARGUMENT TO `bodyText`, NOT AN ENTRY IN THE HEADER MAP, AND GETTING\n   *   THAT WRONG MADE EVERY WRITE IN THIS PACKAGE FAIL.\n   *\n   * 🔴 THE BUG, AND HOW IT HID FOR A WHOLE DAY. The header map DID set\n   *   `application/x-www-form-urlencoded` — and `bodyText(s)` with no second argument sets\n   *   `text/plain` and OVERWRITES it, because it is piped AFTER `setHeaders`. PVE and PBS accept\n   *   ONLY form encoding or JSON and reject everything else outright (measured in\n   *   proxmox-rest-server's `get_request_parameters`), so every create, update and delete this\n   *   package can perform was broken from the day the client was written.\n   *   ⛔ NOTHING CAUGHT IT BECAUSE NOTHING HAD EVER WRITTEN. Ninety-eight resources were adopted\n   *     against the live cluster and every one matched, so `reconcile` never reached a PUT. The\n   *     identical bug in <estate>/forgejo/src/client.ts surfaced the moment a write token existed\n   *     and answered `422 Unsupported Content-Type`; this one is the same line, found by looking.\n   *   ★ A PLAN THAT SAYS `noop` PROVES THE READ PATH AND NOTHING ELSE. That is the lesson worth\n   *     more than the fix.\n   *\n   * ⚠️ PVE TAKES FORM ENCODING, NOT JSON. Sending application/json is accepted and then SILENTLY\n   *   IGNORED on several endpoints, which reads as \"the API did nothing\" rather than as a wrong\n   *   content type — so the type below is load bearing in both directions.\n   */\n  return HttpClientRequest.make(method)(url).pipe(\n    HttpClientRequest.setHeaders({ Authorization: authorization(credential, target) }),\n    form === undefined\n      ? (self) => self\n      : HttpClientRequest.bodyText(encode(form), 'application/x-www-form-urlencoded'),\n  );\n};\n\nconst executeOne = (\n  target: ApiTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form: PveForm | undefined,\n  apiBase: string,\n) =>\n  Effect.gen(function* () {\n    const client = yield* HttpClient.HttpClient;\n    const request = buildRequest(method, apiBase, path, credential, target, form);\n    return yield* client\n      .execute(request)\n      .pipe(Effect.mapError((cause) => new PveError(0, method, path, String(cause))));\n  });\n\nconst readResponse = <T>(\n  response: {\n    status: number;\n    text: Effect.Effect<string, unknown>;\n    json: Effect.Effect<unknown, unknown>;\n  },\n  method: string,\n  path: string,\n) =>\n  Effect.gen(function* () {\n    /**\n     * ⛔ STATUS FIRST, THEN THE BODY, AND THE BODY IS READ EXACTLY ONCE. `text` and `json` both\n     *   consume the response stream, so asking for both is a bug waiting to happen. A failure is\n     *   read as TEXT because an error body is not reliably JSON — PVE answers HTML for some 5xx —\n     *   and a success is read as JSON by the client rather than by a hand-rolled `JSON.parse`.\n     */\n    if (response.status < 200 || response.status >= 300) {\n      // ⚠️ 401 HERE USUALLY MEANS THE LEASE EXPIRED, NOT THAT THE ROLE IS WRONG. `provision` is a\n      //   300s non-renewable lease; a long reconcile should mint again rather than widen the role.\n      const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ''));\n      return yield* Effect.fail(new PveError(response.status, method, path, detail.slice(0, 300)));\n    }\n    const body = (yield* response.json.pipe(\n      Effect.mapError((cause) => new PveError(0, method, path, String(cause))),\n    )) as { data?: T };\n    return body.data;\n  });\n\n/** A call that already holds a credential. Used when one mint serves several calls. */\nexport const pveWith = <T>(\n  target: ApiTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form?: PveForm,\n) =>\n  Effect.gen(function* () {\n    const response =\n      target.scheme === 'pve'\n        ? yield* executeOnCluster(target, method, path, (apiBase) =>\n            buildRequest(method, apiBase, path, credential, target, form),\n          ).pipe(\n            Effect.mapError((failure) =>\n              failure.tag === 'cluster'\n                ? clusterExhausted(failure.method, failure.path, failure.attempts)\n                : new PveError(0, method, path, String(failure)),\n            ),\n          )\n        : yield* executeOne(target, credential, method, path, form, target.api);\n    return yield* readResponse<T>(response, method, path);\n  });\n\n/**\n * Like `pveWith`, but returns the full JSON body — for endpoints whose answer lives beside `data`.\n *\n * ⚠️ `network-apply-read.ts` is the caller today; the local fetch there should fold into this once\n *   the envelope shape is stable across both paths.\n */\nexport const pveEnvelopeWith = (\n  target: PveTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n) =>\n  Effect.gen(function* () {\n    const response = yield* executeOnCluster(target, method, path, (apiBase) =>\n      buildRequest(method, apiBase, path, credential, target),\n    ).pipe(\n      Effect.mapError((failure) =>\n        failure.tag === 'cluster'\n          ? clusterExhausted(failure.method, failure.path, failure.attempts)\n          : new PveError(0, method, path, String(failure)),\n      ),\n    );\n    if (response.status < 200 || response.status >= 300) {\n      const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ''));\n      return yield* Effect.fail(new PveError(response.status, method, path, detail.slice(0, 300)));\n    }\n    return (yield* response.json.pipe(\n      Effect.mapError((cause) => new PveError(0, method, path, String(cause))),\n    )) as Record<string, unknown>;\n  });\n\n/**\n * Make one call on a credential for `role`, REUSING a still-valid lease rather than minting one.\n *\n * 🔴 IT USED TO MINT PER CALL, AND AT 98 RESOURCES THAT STOPPED BEING FREE. One plan plus deploy\n *   of the C1 stack left 760 token entries in `/etc/pve/user.cfg` — read, diff, reconcile and the\n *   read-back each minted their own, and `/etc/pve` is a replicated cluster filesystem every node\n *   has to agree on. src/lease-cache.ts carries the measurement and the safety argument.\n *\n * ⚠️ `pveWith` IS STILL THERE AND STILL TAKES AN EXPLICIT CREDENTIAL. network-apply.ts needs ONE\n *   identity across its apply and its task poll — PVE only skips the task-status privilege check\n *   for the task's OWNER — and it threads a lease through by hand for that. Caching makes that\n *   property easier to hold, never weaker, but the explicit path stays because that caller is\n *   reasoning about identity rather than about cost.\n *\n * ★ TASK POLL ON A DIFFERENT MEMBER THAN THE APPLY STILL HOLDS: the owner is the token id, not the\n *   node that received the PUT. Any member serves any task path; the privilege skip is keyed on\n *   whether the caller IS the task's owner.\n */\nexport const pve = <T>(\n  target: ApiTarget,\n  role: PveRole,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form?: PveForm,\n) =>\n  Effect.gen(function* () {\n    const credential = yield* leased(target, role);\n    return yield* pveWith<T>(target, credential, method, path, form);\n  });\n",
+    "/**\n * `Proxmox.CephFlag` — one cluster-wide Ceph OSD flag, declared: `noout`, `pause`, `norebalance`.\n *\n * ★ ONE RESOURCE PER FLAG, NOT ONE CARRYING ALL ELEVEN, AND THE CLUSTER'S OWN API DECIDED IT.\n *   MEASURED on C1 2026-09-13 (pve-manager 9.2.11, ceph tentacle 20.2.2) by reading\n *   `/usr/share/perl5/PVE/API2/Cluster/Ceph.pm` and the published schema in\n *   `/usr/share/pve-docs/api-viewer/apidoc.js`:\n *     · `PUT /cluster/ceph/flags` ends in `fork_worker('cephsetflags', ...)` and returns a STRING\n *       — a UPID. The bulk write is ASYNCHRONOUS, and this package has no task-polling machinery.\n *     · `PUT /cluster/ceph/flags/{flag}` calls `$rados->mon_command` inline and returns null. The\n *       per-flag write is SYNCHRONOUS.\n *   `pveOperations.reconcile` READS BACK after every write and refuses to record a value it did\n *   not see. Against the bulk endpoint that read-back races a worker which has not run yet, so it\n *   would record the OLD value as the new attributes — the one honesty mechanism in this package\n *   turned into a lie generator. Per-flag, the read-back means what it says.\n *   ★ THE SECOND REASON IS SMALLER AND STILL REAL. The bulk GET answers rows of\n *     `{name, description, value}`, and `description` is PVE's own English prose that no write\n *     accepts: compare it and you have a forever-update, report it and this provider is pretending\n *     to manage prose. `GET /cluster/ceph/flags/{flag}` answers a BARE BOOLEAN, so that trap\n *     cannot be written here at all. The brief's plural `Proxmox.CephFlags` became singular for\n *     those two reasons; the bulk endpoint is read by nothing in this package.\n *\n * ⛔ THESE ARE NOT CONFIGURATION. THEY ARE A HAND ON THE BRAKE, AND A DECLARATION CAN PULL IT OFF.\n *   `noout` is what a person sets before pulling a disk. A stack saying `value: false` reasserts\n *   that off on EVERY deploy — including a deploy somebody else runs, for an unrelated resource,\n *   twenty minutes into a maintenance window — and the plan line reads `Proxmox.CephFlag noout\n *   update`, which nobody reads as \"ceph is about to start rebalancing 128 PGs across three nodes\n *   while a disk is out of the chassis\".\n *   ★ SO `value` IS REQUIRED AND HAS NO DEFAULT, AND THAT IS THE MITIGATION. An optional `value`\n *     defaulting to false would make `CephFlag('noout', { flag: 'noout', target })` mean \"clear\n *     it\" — the dangerous direction, chosen by OMISSION. Here the dangerous sentence has to be\n *     typed out by a person. Do not add a default, and do not declare a flag merely to document\n *     that it is off: MEASURED 2026-09-13, all eleven flags on C1 read 0, so eleven\n *     `value: false` lines would plan green forever and do nothing except take the brake off\n *     whenever somebody happens to apply them.\n *\n * ⛔ `delete` DOES NOTHING, ON PURPOSE, AND THE ASYMMETRY OF THE TWO FAILURES IS THE ARGUMENT.\n *   `flags/{flag}` has exactly two methods, GET and PUT, so the factory's `destroy` would answer\n *   \"Method 'DELETE /cluster/ceph/flags/noout' not implemented\" on every teardown — whatever this\n *   handler does is INVENTED. The obvious invention, \"clear the flag\", is refused: removing a line\n *   from a stack file, or Alchemy collecting an old generation after a replace, would silently\n *   take the brake off and nothing would warn. Leaving a flag set that nothing declares any more\n *   is the opposite kind of failure — ceph reports `HEALTH_WARN ... flag(s) set` for every one of\n *   these, on `ceph -s`, in the PVE UI and in the `pve_*` metrics this estate already scrapes.\n *   A silent destructive failure loses to a loud inert one.\n *   ⚠️ THE RESIDUAL RISK, NAMED RATHER THAN DENIED: deleting a `value: true` declaration LEAVES\n *     THE FLAG SET. Retire a maintenance window by flipping the line to `value: false` and\n *     deploying BEFORE the line is removed, or a `noout` outlives the window that needed it.\n *   ⚠️ REASONED, NOT MEASURED: that health warning was not observed, because observing it means\n *     setting a flag on a live cluster and this file was researched read-only. Undeclaring stops\n *     MANAGING a flag; to clear one, declare `value: false` and deploy, where a plan says so.\n *\n * ⛔ `pause` IS TWO CEPH FLAGS AND THIS RESOURCE READS ONLY ONE OF THEM. MEASURED in\n *   `PVE::Ceph::Tools::get_real_flag_name`, whose own comment reads \"the 'pause' flag gets always\n *   set to both 'pauserd' and 'pausewr'\": PVE writes both and then decides the flag is set by\n *   looking at `pauserd` alone. A cluster where somebody ran `ceph osd unset pauserd` by hand\n *   still has `pausewr` — writes blocked, guests hung — and this resource reports `value: false`\n *   and plans `noop` straight past it. It cannot express a half-pause, so never use it to prove\n *   one is gone; `ceph osd dump | head -1` can.\n *   ⛔ `pause` AND `noup` ARE ALSO THE TWO THAT TAKE THE CLUSTER DOWN FROM A TYPO. `pause: true`\n *     stops all reads and writes, so every guest on `rbd-c1` — the cluster's only rbd pool,\n *     MEASURED 2026-09-13 — freezes on its root disk, and so does `cephfs-c1`. `noup: true`\n *     stops a rebooted OSD from ever rejoining. Neither is undone by deleting the line.\n *\n * ⚠️ PRIVILEGES, AND THE WRITE ONE IS A BIG ASK. Both GETs check `Sys.Audit` on `/`; both PUTs\n *   check `Sys.Modify` on `/`, and all four carry `allowtoken => 1`, so an API token may make the\n *   call at all. There is no `/ceph` ACL object to scope to — the check names the ROOT path\n *   literally — so granting the provision role `Sys.Modify` here also buys datacenter options,\n *   metric servers, notification targets and every other cluster-wide write, exactly as\n *   metric-server.ts warns about its own family.\n *   ⚠️ REASONED, NOT MEASURED: nothing here was exercised under a minted lease, because a mint\n *     writes an API token into the cluster and the brief for this file was reads only. Expect\n *     \"Permission check failed (/, Sys.Modify)\" on the first deploy, and widen deliberately.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport {\n  CEPH_FLAG_UPDATE,\n  readClusterCephFlag,\n  readClusterCephFlagForDiff,\n  updateForm,\n  writeClusterCephFlag,\n} from './ceph-flag-wire.ts';\nimport { mintTier } from './credentials.ts';\nimport { UNREADABLE, unreadableWarning } from './unreadable-read.ts';\nimport { guardWrite } from './distilled-guard.ts';\nimport type { CephFlagAttributes, CephFlagProps } from './ceph-flag-types.ts';\nimport type { PveRequirements } from './resource-spec.ts';\nimport { formToSend } from './update-guard.ts';\n\nexport type { CephFlagAttributes, CephFlagName, CephFlagProps } from './ceph-flag-types.ts';\n\nexport interface ProxmoxCephFlag extends Resource<\n  'Proxmox.CephFlag',\n  CephFlagProps,\n  CephFlagAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxCephFlag = Resource<ProxmoxCephFlag>('Proxmox.CephFlag');\n\n/**\n * ⚠️ `value` IS THE ONLY THING COMPARED, AND THE LIST OF THINGS DELIBERATELY NOT COMPARED IS THE\n *   point of this resource. `flag` is props-derived (see `CephFlagAttributes`). `description`\n *   and `name` exist only on the bulk GET, which this file does not read, so neither can be\n *   compared by accident. Nothing PVE returns here is rewritten, re-ordered or re-typed by the\n *   cluster, because all PVE returns here is one boolean.\n *   ★ MEASURED: on C1, `GET /cluster/ceph/flags` answers value 0 for all eleven flags, so a\n *     declaration of `value: false` reads back false and plans `noop`.\n */\nconst matches = (attributes: CephFlagAttributes, props: CephFlagProps) =>\n  attributes.value === props.value;\n\n/**\n * ★ MIGRATED OFF `pveHandlers`/`client.ts`'s generic `pve()` ONTO `@distilled.cloud/proxmox`'s\n *   typed `cluster.getClusterCephFlag`/`cluster.putClusterCephFlag` (ceph-flag-wire.ts).\n *   `pveHandlers` cannot run a distilled operation, so `diff`/`reconcile` are hand-written here,\n *   the same way ceph-pool.ts and backup-job.ts hand-write theirs for the same reason.\n *\n * ⛔ THIS FAMILY HAS NO CREATE KEY, AND THAT IS THE VENDOR'S DOING, NOT AN OMISSION HERE. PVE\n *   registers only `PUT /cluster/ceph/flags/{flag}`; `POST /cluster/ceph/flags` does not exist\n *   (constraints-forms.test.ts's own regression test), which is why the second ⛔ in the header\n *   above calls the create branch unreachable — there is no create form and no create endpoint to\n *   guard, only `CEPH_FLAG_UPDATE`.\n */\nexport const ProxmoxCephFlagProvider = () =>\n  Provider.effect(\n    ProxmoxCephFlag,\n    Effect.succeed(\n      ProxmoxCephFlag.Provider.of({\n        /** ⛔ Empty, like every resource in this package — see resource.ts's own ⚠️ on why. */\n        list: () => Effect.succeed([]),\n        read: ({ olds }) => readClusterCephFlag(olds),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(CEPH_FLAG_UPDATE, updateForm(news), false);\n          if (output === undefined) return undefined;\n          // ⛔ Never absent — see the second ⛔ above. A failed read other than a refused mint\n          //   propagates instead of reaching this point. A refused mint must NOT fail `diff`:\n          //   that aborts the whole plan (unreadable-read.ts). `read` still propagates.\n          const live = yield* readClusterCephFlagForDiff(news);\n          if (live === UNREADABLE) {\n            yield* unreadableWarning(\n              'Proxmox.CephFlag',\n              news.flag,\n              news.target.mount,\n              mintTier(news.target, 'read'),\n            );\n            return { action: 'noop' } as const;\n          }\n          return { action: matches(live, news) ? 'noop' : 'update' } as const;\n        }),\n        /** ⛔ Inert, deliberately. The third ⛔ in the header is the whole argument; read it. */\n        delete: () => Effect.void,\n        /**\n         * ⚠️ THE READ-BACK GUARD, RESTORED FOR A FAMILY WHOSE \"ABSENT\" DOES NOT EXIST. A generic\n         *   `reconcile` (resource.ts) refuses when the object is still missing after a write, and\n         *   a flag is never missing, so that check could never fire here. PVE answers 200 with\n         *   `{\"data\":null}` on calls that did nothing, and this PUT's documented return IS null,\n         *   so the status code carries no evidence at all — only a read-back does.\n         * ⚠️ THE PER-FLAG PUT IS SYNCHRONOUS (`$rados->mon_command` inline, MEASURED in Ceph.pm),\n         *   which is what makes this check fair rather than a race against a worker task. If it\n         *   ever fires spuriously the honest fix is to look at the mon, not to delete the guard.\n         * ⛔ `formToSend` IS WHAT MAKES ADOPTING AN ALREADY-MATCHING FLAG FREE. Alchemy's\n         *   `adopted` action reaches `reconcile` exactly like `update` does (resource.ts's own ⛔\n         *   on this), so without this guard adopting a flag that already reads correctly would\n         *   still fire a PUT — pointless against ceph, and update-guard.ts's header has the\n         *   incident where the equivalent gap on CephPool forked an unnecessary worker.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const live = yield* readClusterCephFlag(news);\n          const form = formToSend(matches, live, news, updateForm(news));\n          if (form !== undefined) {\n            yield* guardWrite(CEPH_FLAG_UPDATE, updateForm(news), false);\n            yield* writeClusterCephFlag(news);\n          }\n          const after = yield* readClusterCephFlag(news);\n          if (after.value !== news.value) {\n            return yield* Effect.die(\n              new Error(\n                `cluster/ceph/flags/${news.flag}: the PUT returned no error but ceph still ` +\n                  `reports the flag ${after.value ? 'set' : 'clear'} rather than ` +\n                  `${news.value ? 'set' : 'clear'}. This endpoint's success is documented as a ` +\n                  'null body, so the status code proves nothing -- check `ceph osd dump | ' +\n                  'head -1` and the cluster log. `pause` in particular is two ceph flags read ' +\n                  'as one; see the header.',\n              ),\n            );\n          }\n          return after;\n        }),\n      }),\n    ),\n  );\n",
+    "/**\n * `Proxmox.CephFlag`'s distilled wire lane: the read and the single-flag write.\n *\n * ★ SPLIT OUT OF ceph-flag.ts FOR THE 250-LINE CAP, mirroring ceph-pool-wire.ts's split by \"touches\n *   the cluster or not\" — ceph-flag.ts keeps the header, the props/attributes shapes, `matches` and\n *   the provider wiring; this file is the only place that calls `runPve` for this family.\n *\n * ⛔ NEITHER OPERATION HERE DECLARES A TYPED ABSENCE (`errors: []` on both `getClusterCephFlag` and\n *   `putClusterCephFlag`, MEASURED in distilled-proxmox/src/services/cluster.ts) — UNLIKE\n *   ceph-pool-wire.ts's `CephPoolNotFound`. All eleven flags always exist (ceph-flag.ts's own ⛔ on\n *   `CephFlagName` and on the old unreachable create branch), so there is no absence case to fold\n *   here. `readClusterCephFlag` therefore has no `catchTag` at all and lets every failure — a\n *   refused credential, a timeout, cluster exhaustion — propagate to the caller exactly as it\n *   arrived, rather than inventing an \"absent\" this family does not have. Simpler than\n *   ceph-pool-wire.ts's case, not harder.\n *   ⚠️ THIS IS A BEHAVIOR CHANGE FROM THE PRE-MIGRATION FACTORY, AND A DELIBERATE ONE. The old\n *     `pveOperations.read` folded EVERY failure into `undefined` via `Effect.orElseSucceed`, so an\n *     expired lease or node-b being down looked identical to \"the flag is absent\" (which cannot\n *     happen — see ceph-flag.ts). Now such a failure propagates as itself: a caller sees the real\n *     error (an expired 300s lease, node-b down, ceph not configured) rather than a misleading\n *     \"absent\" that would have sent `diff`/`reconcile` down a create path this endpoint has never\n *     implemented. Same advice as the old comment gave, sharper because the failure is no longer\n *     disguised.\n *\n * ⛔ THE PER-FLAG PUT IS SYNCHRONOUS (`$rados->mon_command` inline, MEASURED in Ceph.pm — see\n *   ceph-flag.ts's header), which is what makes reading back immediately after\n *   `writeClusterCephFlag` fair rather than a race against a worker task, unlike ceph-pool.ts's\n *   forked-worker writes.\n */\nimport * as cluster from '@distilled.cloud/proxmox/cluster';\nimport * as Effect from 'effect/Effect';\nimport type { CephFlagAttributes, CephFlagProps } from './ceph-flag.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { readOrUnreadable } from './unreadable-read.ts';\nimport { bool, flag } from './values.ts';\n\n/** The one endpoint this family writes, as `guardWrite` (distilled-guard.ts) keys it. */\nexport const CEPH_FLAG_UPDATE = 'pve:PUT /cluster/ceph/flags/{flag}';\n\n/**\n * ⚠️ `live` IS A BARE BOOLEAN HERE, NOT AN OBJECT, AND IT IS HANDED TO `bool` WHOLE ON PURPOSE.\n *   `get_flag` returns perl `1` or `0` under a `type => 'boolean'` return schema, so the wire is\n *   `{\"data\":0}` or `{\"data\":false}` depending on how the REST layer renders it — matching\n *   distilled's `GetClusterCephFlagResponse = unknown` (`S.Unknown.pipe(T.RawResponseRoot())`).\n *   `bool` accepts every one of those spellings, which is exactly why it is a shared coercion.\n *   ⚠️ THE SCALAR IS A MEASURED PROPERTY OF THIS PVE, NOT A PROMISE. A later version wrapping the\n *     answer in an object would make `bool` read a SET flag as false, and `value: false` would then\n *     plan `noop` over a live flag — silently. Re-measure `GET /cluster/ceph/flags/noout` after a\n *     major upgrade; cheaper than a second parse path.\n */\nconst attributesOf = (live: unknown, props: CephFlagProps): CephFlagAttributes => ({\n  flag: props.flag,\n  value: bool(live),\n});\n\n/**\n * ⛔ DIE ON THE POST-TRANSFORM SHAPE, NOT THE PRE-TRANSFORM ONE. `bool` treats a missing value as\n *   `false` because most callers hand it an optional PVE form field where that is correct — but\n *   here it would read an unmeasured \"no answer\" as \"flag is clear\". distilled's\n *   `transformResponse` maps a `{\"data\":null}` body to `{}` BEFORE this function sees it (a shape\n *   `get_flag`'s `type => 'boolean'` schema does not document and this PVE has never produced).\n *   Guarding only `null`/`undefined` lets that `{}` through, and `bool({})` is `false` — a plan\n *   of `noop` over a set brake, with no read-back guard, because `reconcile`'s guard only fires\n *   on a write. A success here is a scalar (`true`/`false`/`0`/`1`/`'0'`/`'1'`). Anything else,\n *   including the empty object the protocol substitutes for null, is the unmeasured shape.\n */\nexport const scalarFlagOrDie = (live: unknown, props: CephFlagProps) => {\n  const scalar =\n    typeof live === 'boolean' || live === 0 || live === 1 || live === '0' || live === '1';\n  return scalar\n    ? Effect.succeed(live)\n    : Effect.die(\n        new Error(\n          `cluster/ceph/flags/${props.flag}: GET answered ${JSON.stringify(live)}, not a bare ` +\n            \"boolean. This endpoint's success is a scalar; an empty object is what the protocol \" +\n            'substitutes for `{\"data\":null}`. Check `ceph osd dump | head -1` and the cluster ' +\n            'log rather than trust a coerced `false`.',\n        ),\n      );\n};\n\n/**\n * The live flag, as attributes.\n *\n * ⚠️ NO ABSENCE TAG, ON PURPOSE. Both operations declare `errors: []` (see the file header), so\n *   there is nothing to `catchTag` except `PveCredentialDenied`, and that one is caught by the\n *   caller that plans (`readClusterCephFlagForDiff`) — not here. `read` and `reconcile` must\n *   still see a refused mint as itself.\n */\nexport const readClusterCephFlag = (props: CephFlagProps) =>\n  runPve(props.target, 'read', false, cluster.getClusterCephFlag({ flag: props.flag })).pipe(\n    Effect.flatMap((live) => scalarFlagOrDie(live, props)),\n    Effect.map((live) => attributesOf(live, props)),\n  );\n\n/**\n * The same read, with a refused mint turned into `UNREADABLE`.\n *\n * ⛔ `diff` MUST NOT FAIL ON A REFUSED READ. Alchemy runs every resource's `diff` under\n *   `Effect.exit` and fails the whole plan if one fails (unreadable-read.ts). A lane that cannot\n *   mint `read` would otherwise abort every other row, not just this flag. `read` and\n *   `reconcile` keep the propagating form above.\n */\nexport const readClusterCephFlagForDiff = (props: CephFlagProps) =>\n  readOrUnreadable(readClusterCephFlag(props));\n\n/**\n * ⚠️ ONLY `value` GOES IN THE BODY. `flag` is already bound by the path and the PUT declares\n *   `additionalProperties => 0`, so a second copy in the form could only disagree with the URL.\n * ⚠️ THE `?? '0'` IS UNREACHABLE, AND IS WRITTEN RATHER THAN CAST AWAY. `flag()` types its answer\n *   `string | undefined` because it serves OPTIONAL props, and `value` here is required, so the\n *   branch cannot be taken; a cast would claim a proof the type system has not made.\n */\nexport const updateForm = (props: CephFlagProps) => ({ value: flag(props.value) ?? '0' });\n\n/** The actual `putClusterCephFlag` call — `updateForm`'s own `value`, so the two cannot disagree. */\nexport const writeClusterCephFlag = (props: CephFlagProps) =>\n  runPve(\n    props.target,\n    'provision',\n    true,\n    cluster.putClusterCephFlag({ flag: props.flag, value: updateForm(props).value }),\n  );\n",
     "/**\n * `Proxmox.CephFs` — a CephFS on the cluster's own Ceph. The filesystem a `cephfs` storage mounts.\n *\n * ⛔ A REPLACE OF THIS RESOURCE DESTROYS A LIVE FILESYSTEM, AND THERE IS NO PUT TO SAVE YOU FROM\n *   IT. MEASURED from the published schema on node-b, 2026-09-13: `/nodes/{node}/ceph/fs/{name}` has\n *   exactly two methods, POST and DELETE. A CephFS cannot be edited in place, so `updateForm` is\n *   left undefined and anything the factory can see as changed becomes a REPLACE — and Alchemy's\n *   replace is create-then-delete, where the delete is `destroyfs`: the entry leaves the MDS map,\n *   every mount on every node breaks, and whether the bytes survive rests on `remove-pools` alone.\n *   ★ WHICH IS THE WHOLE REASON `matches` COMPARES NOTHING. Read its ⛔ before adding a field to\n *     it. On every other resource in this package a forever-diff is an annoying plan line; on this\n *     one it is a live filesystem destroyed on every deploy, forever, because a background daemon\n *     moved a number nobody declared.\n *\n * ⛔ THERE IS NO SINGLE-OBJECT READ, WHICH INVERTS `path` AND `collection`. MEASURED on node-b:\n *     pvesh get /nodes/node-b/ceph/fs/cephfs-c1\n *       -> No 'get' handler defined for '/nodes/node-b/ceph/fs/cephfs-c1'\n *   `GET /nodes/{node}/ceph/fs` is a directory index and is the only read there is, so `path()`\n *   below returns the INDEX and `attributes` picks this filesystem out of the array client-side —\n *   the shape acl.ts uses for the one flat `GET /access/acl`. The POST goes to the `{name}` path,\n *   so `collection()` is the LONGER of the two strings, the mirror of metric-server.ts.\n *   ⚠️ AND THAT IS WHY EVERY HANDLER BELOW IS HAND-WRITTEN rather than taken from a factory. A\n *     factory `destroy` deletes the read path, which here is the index: `DELETE /nodes/{node}/\n *     ceph/fs` is not a route, so it would fail every destroy while the filesystem stayed exactly\n *     where it was. `reconcile` is hand-written for a second, independent reason — the forked\n *     worker — set out in ceph-fs-wire.ts. acl.ts is the precedent for a family that genuinely\n *     does not fit a shared shape.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()` ONTO `@distilled.cloud/proxmox`'s typed\n *   `nodes.listNodeCephFs`/`updateNodeCephFs` for the READ and the CREATE (2026-09-24, decision\n *   43's walk-down, 2c — ceph-fs-distilled.ts). DELETE originally stayed on `client.ts`:\n *   the SDK put its flags in a body that PVE discards (ceph-fs-wire.ts's history).\n *   SDK 0.3.0 fixes the query binding; delete now uses it and catches only CephFsNotFound.\n *   The typed-read follow-up removes the catch-all fold from `readFs`: a failed index must\n *   fail read/diff/reconcile/delete, not report a missing filesystem or a successful destroy.\n *\n * ⛔ CREATING A CephFS CREATES TWO CEPH POOLS, AND A `Proxmox.CephPool` MUST NOT ALSO DECLARE THEM.\n *   `createfs` builds `<name>_data` and `<name>_metadata` itself and refuses outright if either\n *   exists (\"ceph pools '…_data' and/or '…_metadata' already exist\"). MEASURED on C1: the live\n *   `cephfs-c1` owns `cephfs-c1_data` (id 6) and `cephfs-c1_metadata` (id 7), both of which\n *   `GET /nodes/node-b/ceph/pool` lists like any other pool — and `/nodes/{node}/ceph/pool/{name}` DOES\n *   have GET, PUT and DELETE, so a pool resource would be a clean `pveHandlers` fit and would\n *   adopt them without noticing. Declaring both is double management of one object: whichever\n *   reconciles first wins, and the loser either fails its create or PUTs `size`/`pg_num` onto pools\n *   this resource believes it owns. Declare the filesystem here and leave its two pools alone.\n *\n * ⚠️ `add-storage` IS A SECOND SIDE EFFECT AND IT LANDS IN storage.cfg. Set, `createfs` also calls\n *   `PVE::API2::Storage::Config->create` with type `cephfs`, content `backup,iso,vztmpl` and\n *   `fs-name <name>`. MEASURED: /etc/pve/storage.cfg on node-b holds exactly that — `cephfs:\n *   cephfs-c1` / `content backup,vztmpl,iso` / `fs-name cephfs-c1`. So a `Proxmox.Storage`\n *   declaring `cephfs-c1` would be managing an entry this resource created. Declare ONE of them:\n *   either `add-storage` here and no storage resource, or `add-storage` off and a\n *   `Proxmox.Storage` that reads this resource's `name` attribute — which also gets the ordering\n *   right for free, because Alchemy orders by data flow.\n *\n * ⚠️ `node` IS A ROUTE, NOT IDENTITY, AND MUST NEVER BE DIFFED. A CephFS is cluster-wide; the node\n *   in the path only says which node PVE proxies the call to. MEASURED: `GET /nodes/node-b/ceph/fs`,\n *   `…/node-c/…` and `…/node-d/…` returned the byte-identical array. So changing `node` plans `noop`, and\n *   two resources naming the same `name` on different nodes are the SAME filesystem — the vmid\n *   hazard from lxc.ts, with a filesystem on the end of it instead of a container.\n *\n * ⚠️ PRIVILEGES: the read lane needs `Sys.Audit` OR `Datastore.Audit` on `/`, which an auditor\n *   role already holds — unlike storage.ts, nothing needs widening before the first plan. The\n *   write side is in ceph-fs-wire.ts beside the calls, and in docs/privileges.md with the rest.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { createFs, destroyFs, readFs } from './ceph-fs-distilled.ts';\nimport { CEPH_FS_CREATE, createForm, notCreated, notDestroyed } from './ceph-fs-wire.ts';\nimport { guardWrite } from './distilled-guard.ts';\nimport { type PveRequirements, type WithTarget } from './resource.ts';\n\nexport interface CephFsProps extends WithTarget {\n  /** ⚠️ Which node answers the call, NOT which node holds the filesystem. See the header. */\n  node: string;\n  /**\n   * The filesystem name, and the cluster-wide primary key. PVE's pattern is `^[^:/\\s]+$`.\n   * ⛔ CHANGING IT IS A REPLACE, WHICH DESTROYS THE OLD FILESYSTEM. `diff` says so explicitly\n   *   below rather than letting the factory report a create-shaped `update` and orphan the old one.\n   */\n  name: string;\n  /**\n   * Placement groups for the backing data pool; the metadata pool gets a quarter of it, or 8 when\n   * this is under 32. PVE's default is 128.\n   *\n   * ⛔ CREATE-TIME ONLY, UNREADABLE, AND OWNED BY THE AUTOSCALER FROM THE SECOND IT LANDS. It is\n   *   never compared — see the ⛔ on `matches` — and this is not caution, it is measured. C1's\n   *   `cephfs-c1` was created with the default 128 (the arithmetic proves it: `cephfs-c1_metadata`\n   *   sits at 32, which is 128/4), and `cephfs-c1_data` reads pg_num 32 TODAY. The autoscaler moved\n   *   it by a factor of four, and it is not finished: `pg_autoscale_mode` is `on` for every pool on\n   *   this cluster and `cephfs-c1_metadata` already reports `pg_num_final: 16` against its live 32.\n   */\n  pg_num?: number;\n  /**\n   * Also write a `cephfs` storage entry for this filesystem. ⚠️ Create-time only and never read\n   *   back — it is an ACTION, not a field. See the header for what it does to `Proxmox.Storage`.\n   */\n  'add-storage'?: boolean;\n  /** ⛔ DELETE-TIME ONLY, AND IT ERASES THE DATA. Read the ⛔ on `destroyFs` before setting it. */\n  'remove-pools'?: boolean;\n  /**\n   * Delete the pveceph-managed storage entries too. ⚠️ PVE refuses unless they are already\n   *   disabled (\"storage '…' is not disabled, make sure to disable and unmount the storage first\"),\n   *   so this fails the destroy rather than unmounting anything out from under a running guest.\n   */\n  'remove-storages'?: boolean;\n}\n\n/**\n * ⚠️ EVERY FIELD HERE IS REPORTED AND NONE IS COMPARED. They exist so a plan, and the state entry\n *   behind it, can say what the declaration actually points at — which pools hold the bytes.\n */\nexport interface CephFsAttributes {\n  name: string;\n  /** The first data pool. PVE keeps it for compatibility; `data_pools` is the real answer. */\n  data_pool: string;\n  /**\n   * ⚠️ SORTED, AND IT IS A SET RATHER THAN A LIST. A CephFS can hold several data pools — added\n   *   with `ceph fs add_data_pool`, which this resource has no way to express — and PVE reports\n   *   them in the MDS map's own order. Sorting is what keeps this attribute stable across reads.\n   */\n  data_pools: string;\n  metadata_pool: string;\n  /**\n   * ⚠️ AN INTEGER THAT NAMES SOMETHING WRITTEN AS A NAME, AND THEREFORE A CLASSIC FOREVER-DIFF IF\n   *   IT EVER REACHED `matches`. PVE answers `metadata_pool_id: 7` while every write in this family\n   *   spells a pool by name. It is here to be read, never to be compared. `-1` means absent: the\n   *   field is optional in the schema and older PVE omits it.\n   */\n  metadata_pool_id: number;\n}\n\nexport interface ProxmoxCephFs extends Resource<\n  'Proxmox.CephFs',\n  CephFsProps,\n  CephFsAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a filesystem holding data cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxCephFs = Resource<ProxmoxCephFs>('Proxmox.CephFs', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * ⛔ NOTHING IS COMPARED, AND THAT IS THE MOST DELIBERATE LINE IN THIS FILE. A CephFS has no\n *   readable, writable field: the index returns only the name and the pools behind it, and every\n *   prop this resource accepts is create-time or delete-time. So \"present\" IS \"settled\", and the\n *   only honest comparison is none at all.\n *   ⚠️ THE TEMPTING ADDITION IS `pg_num`, AND IT WOULD BE THE WORST BUG THIS PACKAGE HAS SHIPPED.\n *     It is not in the index at all, so it can only be read from the pool endpoint — where the\n *     autoscaler owns it. MEASURED on C1 today: created at 128, live at 32, with the metadata\n *     pool already scheduled down to 16. Compared, that is an eternal mismatch — and since there\n *     is no update path, treating this as a diff would plan a REPLACE. The plan would destroy and\n *     rebuild a live filesystem on every deploy, triggered by a daemon on its own schedule.\n *   ⚠️ `data_pools` AND `metadata_pool_id` ARE OUT FOR THE ORDINARY REASONS: a set PVE returns\n *     in its own order, and an integer id for something written as a name. `name` is out because\n *     it is the FILTER that produced these attributes, so comparing it is true by construction —\n *     an identity change is handled in `diff`, not here. `node` is out because it is a route.\n */\nexport const ProxmoxCephFsProvider = () =>\n  Provider.effect(\n    ProxmoxCephFs,\n    Effect.succeed(\n      ProxmoxCephFs.Provider.of({\n        /**\n         * ⛔ EMPTY, LIKE EVERY OTHER RESOURCE HERE. The index answers with every filesystem on the\n         *   cluster, `cephfs-c1` included — the one holding this estate's ISOs and templates.\n         *   Adopting it would put Alchemy one `destroy` away from it. Adoption stays explicit.\n         */\n        list: () => Effect.succeed([]),\n        read: Effect.fn(function* ({ olds }) {\n          return yield* readFs(olds);\n        }),\n        /**\n         * ⛔ A CHANGED `name` IS A REPLACE, AND NOTHING ELSE CAN SAY SO. Left undetected, a rename\n         *   reads the NEW name, finds nothing, and plans the drift-shaped `update` this family uses\n         *   for \"Alchemy has state, the cluster does not\" — so reconcile would build the new\n         *   filesystem and LEAVE THE OLD ONE, with its pools, its storage entry and its bytes,\n         *   owned by nobody and invisible in every later plan.\n         *   ⛔ SAYING `replace` IS HONEST, AND IT IS ALSO WHAT MAKES A TYPO EXPENSIVE. Alchemy\n         *     creates first and deletes second, so the old filesystem is destroyed AFTER the new\n         *     one exists — with `remove-pools` unset the bytes are stranded rather than erased, and\n         *     that default is the only thing between a mis-typed rename and an unrecoverable one.\n         *     ⚠️ `node` is NOT part of identity and must never join this comparison.\n         */\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(CEPH_FS_CREATE, createForm(news), output === undefined);\n          if (output !== undefined && news.name !== output.name) {\n            return { action: 'replace' } as const;\n          }\n          if (output === undefined) return undefined;\n          const live = yield* readFs(news);\n          if (live === undefined) {\n            yield* guardWrite(CEPH_FS_CREATE, createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          // ⛔ SEE THE ⛔ ABOVE `ProxmoxCephFsProvider`: NOTHING ELSE IS COMPARED. Present is settled.\n          return { action: 'noop' } as const;\n        }),\n        /**\n         * ⚠️ THE READ-BACK IS KEPT EVEN THOUGH `createFs` ALREADY WAITED OUT THE TASK. Waiting\n         *   proves the task ENDED, reading proves the filesystem EXISTS, and PVE has shipped tasks\n         *   that end OK having done nothing.\n         * ⚠️ AN EXISTING FILESYSTEM IS RETURNED UNTOUCHED. There is no update call to make, so the\n         *   only write this handler can perform is a create; `diff` has already decided that a\n         *   real change is a replace, and Alchemy calls delete for the old generation itself.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const live = yield* readFs(news);\n          if (live !== undefined) return live;\n          yield* createFs(news);\n          const after = yield* readFs(news);\n          if (after === undefined) return yield* Effect.die(notCreated(news));\n          return after;\n        }),\n        /**\n         * ⛔ THE READ-BACK IS WHAT TURNS \"the task said OK\" INTO \"it is actually gone\": `destroyfs`\n         *   refuses while a non-disabled `cephfs` storage still references the filesystem, and that\n         *   refusal must fail the destroy rather than letting Alchemy drop the state entry for a\n         *   live object. `destroyFs` now uses the SDK query binding — ceph-fs-wire.ts preserves\n         *   the measured DELETE query-binding history.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          /**\n           * ⚠️ A FILESYSTEM SOMEBODY ALREADY REMOVED BY HAND IS NOT AN ERROR. `destroyfs` dies\n           *   synchronously with \"no such cephfs\", which would fail every destroy of a stack whose\n           *   filesystem was cleaned up outside Alchemy and leave the state entry unremovable\n           *   without editing the store. The original catch-all read fold could also report\n           *   success after a 403 without deleting anything, and could defeat read-back after a\n           *   write. `readFs` now propagates those failures: only a successful index with no\n           *   matching row may short-circuit this delete or confirm the filesystem is gone.\n           */\n          if ((yield* readFs(olds)) === undefined) return;\n          yield* destroyFs(olds);\n          const after = yield* readFs(olds);\n          if (after !== undefined) return yield* Effect.die(notDestroyed(olds));\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * `Proxmox.CephFs`'s distilled transport: index, create, delete and task status.\n * SDK 0.3.0 fixes DELETE query flags and supplies the measured CephFsNotFound tag.\n *\n * ⛔ `nodes.updateNodeCephFs` IS distilled's GENERATOR MISNAMING A CREATE, NOT A SECOND ENDPOINT.\n *   Checked directly against its schema (`T.Http({ method: \"POST\", uri:\n *   \"/nodes/{node}/ceph/fs/{name}\" })`) rather than trusted from the function name — it is the\n *   SAME single write PVE registers, `createfs`. Harmless once named here for what it is.\n *\n * ★ CREATE AND DELETE SHARE THE SAME BOUNDED POLL POLICY. The raw getNodeTaskStatus\n *   operation preserves this family's tolerance of a missing Sys.Audit grant or a node\n *   mid-restart until the deadline. The former SDK Task.awaitTask propagated poll failures;\n *   SDK PR #265 removed it because polling policy belongs in the provider.\n */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport type { CephFsProps } from './ceph-fs.ts';\nimport { POLL_ATTEMPTS, POLL_SECONDS, createForm, objectPath, readRow } from './ceph-fs-wire.ts';\nimport { runPve } from './distilled-pve.ts';\n\n/**\n * The index, read via distilled — the same shape `readRow` (ceph-fs-wire.ts) already narrows.\n *\n * ⛔ ABSENCE IS A SUCCESSFUL INDEX WITH NO MATCHING FILESYSTEM. The transport swap\n *   initially preserved the generic factory's catch-all fold. The 2026-09-24 follow-up removes it:\n *   a failed list is not proof that a filesystem is missing. Task polling below retains its\n *   separate bounded wait policy; it does not decide whether a resource exists.\n */\nexport const readFs = (props: CephFsProps) =>\n  runPve(props.target, 'read', false, nodes.listNodeCephFs({ node: props.node })).pipe(\n    Effect.map((rows) => readRow(rows as unknown as Record<string, unknown>, props)),\n  );\n\n/** `updateNodeCephFs`'s own request shape — `createForm`, translated. No field is renamed. */\nconst toDistilledCreate = (props: CephFsProps): nodes.UpdateNodeCephFsRequest =>\n  ({\n    ...createForm(props),\n    name: props.name,\n    node: props.node,\n  }) as unknown as nodes.UpdateNodeCephFsRequest;\n\n/**\n * Wait for a forked task. `exitstatus` is absent while running and exactly `OK` on success.\n * ⚠️ T.Label encodes the colon-filled UPID as one path segment, as the hand client did.\n */\nconst settleTask = (props: CephFsProps, upid: string) =>\n  Effect.gen(function* () {\n    for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt += 1) {\n      const status = yield* runPve(\n        props.target,\n        'read',\n        false,\n        nodes.getNodeTaskStatus({ node: props.node, upid }),\n      ).pipe(Effect.orElseSucceed(() => undefined));\n      if (status?.status === 'stopped') {\n        if (status.exitstatus === 'OK') return;\n        return yield* Effect.die(\n          new Error(\n            `${objectPath(props)}: PVE task ${upid} finished with \"${status.exitstatus ?? 'no exit status'}\". ` +\n              'The write returned HTTP 200 because it only forked the worker -- the real error is ' +\n              `in \\`pvesh get /nodes/${props.node}/tasks/${upid}/log\\`.`,\n          ),\n        );\n      }\n      yield* Effect.sleep(POLL_SECONDS * 1000);\n    }\n    return yield* Effect.die(\n      new Error(\n        `${objectPath(props)}: PVE task ${upid} was still running after ` +\n          `${String(POLL_ATTEMPTS * POLL_SECONDS)}s, or its status could not be read. Check the ` +\n          'task log, and check that the `read` role holds Sys.Audit on ' +\n          `/nodes/${props.node} -- each call mints a new token, so the poller is never the task ` +\n          'owner and is answered 403 rather than told to wait.',\n      ),\n    );\n  });\n\n/** POST the create, then wait for the worker. ⛔ The caller still reads back; see ceph-fs.ts. */\nexport const createFs = (props: CephFsProps) =>\n  Effect.gen(function* () {\n    const upid = yield* runPve(\n      props.target,\n      'provision',\n      true,\n      nodes.updateNodeCephFs(toDistilledCreate(props)),\n    );\n    // ⛔ NO UPID MEANS NO WORKER. PVE answers 200 with `{\"data\":null}` on calls that did nothing,\n    //   and here that is indistinguishable from success by status code alone. Refusing now is the\n    //   difference between a clear failure and a state entry for a filesystem nobody built.\n    if (upid === '') {\n      return yield* Effect.die(\n        new Error(\n          `${objectPath(props)}: POST returned no task id. PVE wraps every answer in ` +\n            '{\"data\":...} and can report success on a call that did nothing.',\n        ),\n      );\n    }\n    yield* settleTask(props, upid);\n  });\n\n/**\n * DELETE the filesystem, then wait for the worker.\n *\n * ⛔ WHAT THIS TAKES AWAY DEPENDS ENTIRELY ON `remove-pools`, AND THE DEFAULT IS THE SAFE ONE. With\n *   it unset PVE removes the filesystem from the MDS map and LEAVES the two pools on disk: every\n *   mount breaks, but the bytes are still there for an operator to recover. With it set the pools\n *   go too and nothing is recoverable. Leaving it unset also means a later create of the SAME name\n *   fails with \"ceph pools '<name>_data' and/or '<name>_metadata' already exist\" -- that refusal is\n *   a BRAKE, not a bug, and it is the last thing standing between a mis-typed rename and the data.\n */\nexport const destroyFs = (props: CephFsProps) =>\n  Effect.gen(function* () {\n    const upid = yield* runPve(\n      props.target,\n      'provision',\n      true,\n      nodes.deleteNodeCephFs({\n        node: props.node,\n        name: props.name,\n        // ⛔ Query fields, never a DELETE body. Omitted/false retains PVE's safe default.\n        ...(props['remove-pools'] === true ? { remove_pools: '1' } : {}),\n        ...(props['remove-storages'] === true ? { remove_storages: '1' } : {}),\n      }),\n    ).pipe(Effect.catchTag('CephFsNotFound', () => Effect.succeed('')));\n    // ⚠️ Missing already is idempotent; every other SDK error propagates. The caller's\n    //   successful index read must still confirm absence after the DELETE or task.\n    if (upid !== '') yield* settleTask(props, upid);\n  });\n",
     "/**\n * The wire lane of `Proxmox.CephFs`: how a PVE answer becomes attributes, how a declaration becomes\n * a PVE call, and how that call becomes a fact.\n *\n * ★ SPLIT OUT OF ceph-fs.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is a real one\n *   rather than a convenient line number. ceph-fs.ts answers \"what is a CephFS, and when has it\n *   changed\"; this file answers \"what does PVE say, what does it want, and has it finished\". On\n *   this family that is where all the strangeness lives — the read is an index and not an object,\n *   the paths are inverted, the delete takes its arguments in the query string, and both writes\n *   fork a worker — so keeping it in one place is what stops the next reader assuming the ordinary\n *   shape from the other nineteen resources. ⚠️ NOTHING HERE DECIDES A DIFF.\n *\n * ⚠️ THE `import type` BACK TO ceph-fs.ts IS A CYCLE ON PAPER ONLY. It is type-only and erased\n *   before anything runs, exactly as metric-server-form.ts imports `MetricServerProps`. The props\n *   stay the resource's public shape, declared in the file that declares the resource.\n *\n * ⛔ POST AND DELETE ANSWER WITH A UPID, NOT A RESULT — THE WRITE IS ASYNCHRONOUS AND A FAILED ONE\n *   IS STILL HTTP 200. Read from the cluster's own source, /usr/share/perl5/PVE/API2/Ceph/FS.pm on\n *   node-b: `createfs` and `destroyfs` both end `return $rpcenv->fork_worker(...)`. Two different lies\n *   come out of trusting that status code. A read-back straight after the POST reports \"still\n *   absent\" about a filesystem that is being built as it says so — which is precisely the message\n *   `pveOperations.reconcile` would print, pointing at the wrong cause. And a worker that dies\n *   INSIDE — the pool create, or the add-storage step, both of which are wrapped in `eval` — is\n *   never reported to the caller at all. `settle` below is the answer to both.\n *   ⚠️ REASONED FROM THAT SOURCE, NOT MEASURED. Nothing was written to this cluster, so the race\n *     has not been observed; only the `fork_worker` that guarantees it is there.\n *\n * ⛔ A DELETE BODY IS SILENTLY DISCARDED BY PVE, SO `remove-pools` GOES IN THE QUERY STRING.\n *   MEASURED in /usr/share/perl5/PVE/APIServer/AnyEvent.pm on node-b: line 928 reads the request\n *   content into params only `if ($method eq 'PUT' || $method eq 'POST')`, and line 1653 sends\n *   every other method down a branch that parses `$request->url->query()` and nothing else. So\n *   `pve(target, role, 'DELETE', path, form)` would send a body PVE never looks at: the flags would\n *   read as unset, the pools would quietly survive a delete that asked for them, and no error would\n *   be raised anywhere. sdn-apply.ts already puts `?pending=1` in the path for the same reason.\n *\n * ⚠️ THE TASK POLL RUNS ON THE `read` ROLE THOUGH IT SITS INSIDE reconcile, FOR TWO REASONS. It is\n *   a read, and resource.ts already mints `read` for its own read-back inside reconcile. And the\n *   leases differ where it matters: `provision` is 300s and explicitly non-renewable, so a create\n *   that waits out a slow worker on that lease can expire mid-poll, while `read` is 3600s.\n *\n * ⛔ THE POLLER IS NEVER THE TASK'S OWNER, WHICH COSTS A PRIVILEGE, AND THIS ONE IS MEASURED\n *   RATHER THAN FEARED. client.ts mints a fresh credential per call and the mount vends a NEW\n *   token id each time, so the token reading the status is never the token recorded in the UPID —\n *   and PVE compares them exactly. /usr/share/perl5/PVE/API2/Tasks.pm on node-b, `$check_task_user`:\n *   `return $user eq $fulltoken || $user eq $task->{user};`, above it the comment \"token only sees\n *   token tasks, user sees user + token tasks\". Token B of the same user matches neither branch.\n *   So the fallback is the schema's other clause for `GET /nodes/{node}/tasks/{upid}/status`: \"The\n *   user needs 'Sys.Audit' permissions on '/nodes/<node>' if they are not the owner of the task.\"\n *   Grant it on the `read` role, or every create burns the full cap below and reports the wrong\n *   cause.\n *\n * ★ THE ORIGINAL DISTILLED WALK MOVED READ AND CREATE FIRST, leaving DELETE here because\n *   SDK flags were annotated as body fields. Distilled Proxmox 0.3.0 fixes their query binding\n *   and adds the measured CephFsNotFound tag. All calls now live in ceph-fs-distilled.ts;\n *   this file keeps the pure forms, attributes and read-back failure messages. The protocol\n *   history above remains load-bearing: moving a DELETE flag back into a body loses it silently.\n */\nimport type { CephFsAttributes, CephFsProps } from './ceph-fs.ts';\nimport { csv, flag, int, text } from './values.ts';\n\n/**\n * This filesystem's row of the index, as attributes.\n *\n * ⚠️ `GET /nodes/{node}/ceph/fs` ANSWERS AN ARRAY, while the factory hands `attributes` the\n *   `Record<string, unknown>` every other PVE read is shaped like. Rows are narrowed rather than\n *   trusted, the same way acl.ts narrows its one flat grant list.\n *\n * ⛔ RETURNING undefined IS WHAT MAKES \"ABSENT\" MEAN ABSENT HERE, unlike acl.ts where the object is\n *   always present-but-unbound. A filesystem missing from the index has not been created, and\n *   `reconcile` takes the create branch on exactly that signal.\n */\nexport const readRow = (\n  live: Record<string, unknown>,\n  props: CephFsProps,\n): CephFsAttributes | undefined => {\n  const row = (Array.isArray(live) ? live : [])\n    .filter(\n      (entry): entry is Record<string, unknown> => typeof entry === 'object' && entry !== null,\n    )\n    .find((entry) => entry['name'] === props.name);\n  if (row === undefined) return undefined;\n  return {\n    data_pool: text(row['data_pool']),\n    data_pools: csv(\n      Array.isArray(row['data_pools'])\n        ? row['data_pools'].map((entry: unknown) => String(entry))\n        : [],\n    ),\n    metadata_pool: text(row['metadata_pool']),\n    metadata_pool_id: int(row['metadata_pool_id'], -1),\n    name: props.name,\n  };\n};\n\n/**\n * ⚠️ SHORT POLLS, LOW CAP. Ninety seconds covers two pool creates plus the ten seconds `createfs`\n *   itself spends waiting for an MDS to go active, and is short enough that a stuck task fails the\n *   deploy rather than parking it for the afternoon.\n */\n// ★ EXPORTED so ceph-fs-distilled.ts's OWN settle polls the same cadence and cap — one number.\nexport const POLL_SECONDS = 2;\nexport const POLL_ATTEMPTS = 45;\n\n/** ⚠️ `nodes/{n}/ceph/fs/{name}` — the POST and DELETE target, and NOT where a read goes. */\nexport const objectPath = (props: CephFsProps) => `nodes/${props.node}/ceph/fs/${props.name}`;\n\n/** The vendor rules `createForm` is checked against — `guardWrite`, distilled-guard.ts. */\nexport const CEPH_FS_CREATE = 'pve:POST /nodes/{node}/ceph/fs/{name}';\n\n/** Only the declared flags. ⚠️ An omitted one is PVE's own default, not a value to send. */\nconst field = (name: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [name]: value };\n\n/**\n * ⚠️ `name` IS DELIBERATELY ABSENT FROM THE FORM. It is already the last segment of the path being\n *   POSTed to — the metric-server.ts case again — and a second copy can only ever disagree with it.\n */\nexport const createForm = (props: CephFsProps): Record<string, string> => ({\n  ...field('add-storage', flag(props['add-storage'])),\n  ...field('pg_num', props.pg_num === undefined ? undefined : String(props.pg_num)),\n});\n\n/**\n * The two read-back failures, as messages rather than as guesses.\n *\n * ⛔ WAITING PROVES THE TASK ENDED; ONLY A READ PROVES THE FILESYSTEM DID OR DID NOT. `createfs`\n *   wraps its pool creates in an `eval` and CLEANS THEM UP on error before dying, so a worker can\n *   plausibly end having built and then removed everything it made. `destroyfs` refuses outright\n *   while a non-disabled `cephfs` storage still references the filesystem. Neither outcome is\n *   visible in a status code, which is why ceph-fs.ts reads back after both and dies with these.\n */\nexport const notCreated = (props: CephFsProps) =>\n  new Error(\n    `${objectPath(props)}: the create task finished but the filesystem is not in ` +\n      `GET nodes/${props.node}/ceph/fs. Check the task log -- a PVE worker can exit having ` +\n      'rolled back the pools it had just made.',\n  );\n\nexport const notDestroyed = (props: CephFsProps) =>\n  new Error(\n    `${objectPath(props)}: the destroy task finished but the filesystem is still in ` +\n      `GET nodes/${props.node}/ceph/fs. PVE refuses to destroy a CephFS while a PVE storage entry ` +\n      'of type cephfs still references it and is not disabled.',\n  );\n",
     "/**\n * `Proxmox.CephOsd` — one OSD in the cluster's CRUSH tree.\n *\n * ⛔ CREATE AND DELETE ARE IMPLEMENTED AND `root@pam` IS THE ONLY IDENTITY THAT CAN RUN THEM.\n *   That is PVE's restriction, not this package's caution, and it is MEASURED from the cluster's\n *   own schema (`/usr/share/pve-docs/api-viewer/apidoc.js`, 2026-09-13):\n *\n *     GET    /nodes/{node}/ceph/osd          -> {\"check\":[\"perm\",\"/\",[\"Sys.Audit\",\"Datastore.Audit\"],\"any\",1]}\n *     POST   /nodes/{node}/ceph/osd          -> *** no permissions block at all ***\n *     DELETE /nodes/{node}/ceph/osd/{osdid}  -> *** no permissions block at all ***\n *\n *   A PVE method with no permissions block is refused to every identity except `root@pam`, so an\n *   OpenBao-minted `hf-provision@pve!…` token is answered 403 however wide its role — widening\n *   the provision role cannot fix it. Compare the sibling families, which DO carry a check and\n *   therefore do work with a token: `ceph/fs`, `ceph/mon` and `disks/zfs` all want `Sys.Modify`.\n *\n * ⚠️ SO THE WRITE PATH IS HONEST RATHER THAN USEFUL. It is written out properly in\n *   `ceph-osd-write.ts` — read that file for what each verb destroys — and it will work for an\n *   operator running as root@pam. Through this package's credential it will 403, and a 403 is a\n *   better answer than a `delete` that silently does nothing while the plan claims otherwise.\n *\n * ★ WHAT IT IS ACTUALLY FOR, THEN: ASSERTION. It turns \"node-b, node-c and node-d each hold two ssd OSDs\"\n *   into a line a plan checks, and it gives Ceph-backed resources something real to depend on —\n *   read `osd.osdid` into an `rbd` storage's props and Alchemy orders that storage after the\n *   assertion, so a stack can no longer report a healthy Ceph storage on a cluster whose OSDs are\n *   gone. A replica that disappears becomes work in `plan` and a loud failure on the deploy.\n *\n * ⛔ THE WRITE VERBS MAY NOT EVEN BE REACHABLE FOR THIS PACKAGE'S CREDENTIAL. MEASURED from the\n *   cluster's own schema (`/usr/share/pve-docs/api-viewer/apidoc.js`, 2026-09-13): `index`,\n *   `osdindex`, `metadata` and `lv-info` each declare a `permissions` block, while `createosd`\n *   and `destroyosd` declare NONE — the key is absent, not empty. REASONED, NOT MEASURED: PVE\n *   refuses a method with no permissions block to everyone but `root@pam`, so an OpenBao-minted\n *   `hf-provision@pve!…` token would likely be answered 403 however wide its role. That is a\n *   reason to leave the write lane closed, not something to confirm by trying: if the reasoning\n *   is wrong, the confirmation costs a disk.\n *\n * ★ MIGRATED OFF `client.ts` ONTO `@distilled.cloud/proxmox` (2026-09-24, decision 43, 2c) — this\n *   file itself never called `pve()` directly, so nothing here changed; ceph-osd-tree.ts's own\n *   header has the read side (still no `Effect.orElseSucceed`, unlike every other migrated Ceph\n *   family), ceph-osd-write.ts's has the write side and the one pre-existing, out-of-scope gap\n *   this migration carries forward rather than fixes.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type { CephOsdAttributes } from './ceph-osd-tree.ts';\nimport { readOsd } from './ceph-osd-tree.ts';\nimport { createOsd, destroyOsd } from './ceph-osd-write.ts';\nimport type { PveRequirements } from './resource.ts';\nimport type { WithTarget } from './resource.ts';\n\n/**\n * ⚠️ RE-EXPORTED, NOT DECLARED HERE — it is built in ceph-osd-tree.ts, next to the walk that fills\n *   it in and to the reasoning for which of its fields may be compared. One name, one import.\n */\nexport type { CephOsdAttributes };\n\nexport interface CephOsdProps extends WithTarget {\n  /**\n   * Which node ANSWERS the read — not where the OSD lives. MEASURED: the tree node-b returns and the\n   * tree node-c returns are the same six leaves, node-d's included. Point this at any node that is up;\n   * `host` is the field that says where the disk is.\n   */\n  node: string;\n  /** `2` for `osd.2`. Identity, and an INTEGER — see the ⛔ on `findOsd` in ceph-osd-tree.ts. */\n  osdid: number;\n  /**\n   * The CRUSH host bucket this OSD must sit in. Undeclared means unmanaged, as in storage.ts.\n   *\n   * ⚠️ DECLARING IT IS AN ASSERTION WITH NO REPAIR. If osd.2 turns up under node-c, the plan reports\n   *   work every time and the deploy fails, because moving an OSD between failure domains is a\n   *   `ceph osd crush move` this provider will not perform. That is the intent: a replica in the\n   *   wrong failure domain is not something to converge quietly past.\n   */\n  host?: string;\n  /**\n   * `ssd` | `hdd` | `nvme`, asserted the same way as `host`.\n   *\n   * ⚠️ THE READ'S SPELLING IS KEPT rather than the create parameter's (`crush-device-class`).\n   *   This resource never writes, so the tree's name is the only one it has, and inventing a\n   *   second name for one field is exactly what values.ts exists to stop.\n   */\n  device_class?: string;\n  /**\n   * The block device to build this OSD from, e.g. `/dev/nvme1n1`. Declaring it makes the resource\n   * able to CREATE; leaving it out keeps the resource a pure assertion over an OSD that exists.\n   *\n   * ⛔ EVERYTHING ON THIS DEVICE IS DESTROYED BY A CREATE. `POST /nodes/{node}/ceph/osd` hands it\n   *   to `ceph-volume lvm create`, which zaps it. Declare it only for a disk that is genuinely\n   *   blank, and read the ⛔ about id allocation below before assuming the create will land as the\n   *   `osdid` written above.\n   */\n  dev?: string;\n  /**\n   * Zap the OSD's logical volumes on destroy (`cleanup=1`). Default false: the LVs are left behind\n   * so the disk can be re-added without a rebuild, which is the recoverable choice.\n   */\n  cleanup?: boolean;\n}\n\nexport interface ProxmoxCephOsd extends Resource<\n  'Proxmox.CephOsd',\n  CephOsdProps,\n  CephOsdAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ★ `retain` BY DEFAULT, FOLLOWING ALCHEMY'S OWN PRECEDENT. `GitHub.Repository` and\n *   `Cloudflare.Zone` default to retain \"because their contents are irreplaceable\"; an OSD is a\n *   replica of live data and qualifies twice over. Retain means DELETING THE DECLARATION DOES NOT\n *   DELETE THE OSD — Alchemy drops its state row and leaves the disk alone. `destroyOsd` is fully\n *   implemented in ceph-osd-write.ts and runs when the caller opts in with\n *   `.pipe(RemovalPolicy.destroy())`, so this is the Terraform `prevent_destroy` shape rather than\n *   a missing operation — and through a minted token it 403s anyway, per the ⛔ at the top.\n */\nexport const ProxmoxCephOsd = Resource<ProxmoxCephOsd>('Proxmox.CephOsd', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * The live OSD, or undefined when the tree has no leaf with that id.\n *\n * ⛔ NO `Effect.orElseSucceed(() => undefined)`, AND THAT IS THE ONE DELIBERATE DEPARTURE FROM\n *   `pveOperations.read`. The factory folds every failure into \"absent\" because a 404 is a\n *   legitimate answer on a per-object path — but this path is a COLLECTION that always exists\n *   while Ceph is installed, so a failure here is never \"the OSD is gone\". It is an unreachable\n *   node, an expired lease, a role without `Sys.Audit`, or a cluster with no Ceph at all. Folding\n *   those into \"absent\" would turn every one of them into the sentence \"osd.2 is missing\", which\n *   is the most alarming thing this provider can say and would be a lie in all four cases. Left\n *   to fail, the plan shows `PVE GET nodes/node-b/ceph/osd -> 500: …` and names the real problem.\n */\n\n/**\n * Whether the live OSD is the one that was declared.\n *\n * ⚠️ AN UNDECLARED FIELD IS NOT COMPARED, as in storage.ts: undeclared means unmanaged, and there\n *   is no default to fall back on — the whole point of a CRUSH placement is that it is a choice.\n *   Declaring nothing but `osdid` therefore asserts only presence, which is a perfectly good\n *   thing to assert about a replica and the safest declaration this resource accepts.\n */\nconst settled = (live: CephOsdAttributes, props: CephOsdProps) =>\n  (props.host === undefined || props.host === live.host) &&\n  (props.device_class === undefined || props.device_class === live.device_class);\n\nconst describe = (props: CephOsdProps) =>\n  `osd.${String(props.osdid)} (read via nodes/${props.node}/ceph/osd)`;\n\n/**\n * ⛔ HAND-WRITTEN RATHER THAN `pveHandlers(spec)`, and the reason is not that the shape does not\n *   fit — it fits perfectly, which is the danger. Given a spec, the factory's `reconcile` POSTs\n *   `createForm` at `collection` whenever the read says absent, and `destroy` DELETEs `path`.\n *   Wired to this family that is: build an OSD over whatever block device the props named, and\n *   remove a replica when somebody deletes a line from a stack file. acl.ts is the precedent for\n *   overriding the factory because PVE lacks a verb; this file overrides it because PVE HAS the\n *   verbs and they must not be reachable from a declaration.\n *\n * ⚠️ THERE IS NO `replace` PATH HERE AND THERE CANNOT BE ONE. Alchemy implements a replace as\n *   create-then-delete (or the reverse); with both of those refusing, `replace` could only ever\n *   be a failure wearing a different word. A changed `osdid` is simply a different assertion.\n */\nconst handlers = {\n  /**\n   * ⛔ EMPTY, as everywhere in this package, and here the stakes are at their highest. The tree is\n   *   the whole cluster's — adopting it would hand Alchemy six resources it never created, each\n   *   with a `delete` in its future. Adoption stays an explicit act, and for this family it stays\n   *   an act with no teeth: see `delete` below.\n   */\n  list: () => Effect.succeed([]),\n\n  read: Effect.fn(function* ({ olds }: { olds: CephOsdProps }) {\n    return yield* readOsd(olds);\n  }),\n\n  /**\n   * ⚠️ `update` IS THE LOUDEST WORD AVAILABLE, NOT A PROMISE TO FIX ANYTHING. Alchemy's Diff\n   *   admits only noop/update/replace, so a missing or misplaced OSD has to be spelled `update`\n   *   — and the deploy that follows fails on purpose in `reconcile`. A resource that answered\n   *   `noop` over a replica that is not there would be the exact lie this package keeps writing\n   *   guards against; a permanent entry in `plan` until a human puts a disk back is the cost, and\n   *   it is the right cost for a degraded pool.\n   */\n  diff: Effect.fn(function* ({\n    news,\n    output,\n  }: {\n    news: Input<CephOsdProps>;\n    output: CephOsdAttributes | undefined;\n  }) {\n    if (output === undefined || !isResolved(news)) return undefined;\n    const live = yield* readOsd(news);\n    if (live === undefined) return { action: 'update' } as const;\n    /**\n     * ⛔ THE RECORDED STATE MUST DESCRIBE THE OSD THE DECLARATION NOW NAMES. `settled` compares\n     *   only host and device_class, so changing `osdid: 2` to `3` reads osd.3, finds it on the\n     *   same host with the same class, and answers noop — which records nothing, leaving OSD 2's\n     *   crush_weight, pgs and name in state under a declaration that says 3. It is the OUTPUT's id\n     *   that must be checked: the LIVE id is found BY `news.osdid`, so comparing that is vacuous.\n     */\n    if (output.osdid !== news.osdid) return { action: 'update' } as const;\n    return settled(live, news) ? ({ action: 'noop' } as const) : ({ action: 'update' } as const);\n  }),\n\n  /**\n   * ⛔ THE ASSERTION, AND THE WHOLE REASON THIS PROVIDER IS HAND-WRITTEN. It reads, and then it\n   *   either records what it found or dies. It never POSTs. The first deploy of a declaration is\n   *   an adoption of an OSD that already exists; every later one is a check that it still does.\n   */\n  reconcile: Effect.fn(function* ({ news }: { news: CephOsdProps }) {\n    const live = yield* readOsd(news);\n    if (live === undefined) {\n      /**\n       * ⛔ CEPH ALLOCATES THE OSD ID; THE DECLARATION CANNOT CHOOSE IT. Measured from the schema:\n       *   `POST /nodes/{node}/ceph/osd` requires `dev` and takes `crush-device-class`, `db_dev`,\n       *   `wal_dev`, `encrypted` and `osds-per-device` — and NO id. The cluster assigns the next\n       *   free number. So a create only lands on the declared `osdid` when that number happens to\n       *   be the one Ceph picks, which for a fresh disk on a contiguous cluster it usually is.\n       *   The read-back below is what keeps that from being a silent mismatch: if Ceph assigned a\n       *   different id, the OSD this resource names is still absent and reconcile refuses.\n       */\n      return yield* createOsd(news);\n    }\n    if (!settled(live, news)) {\n      return yield* Effect.die(\n        new Error(\n          `${describe(news)}: exists but not as declared -- live host=${live.host} ` +\n            `device_class=${live.device_class}. Nothing here moves an OSD between hosts or ` +\n            'reclassifies it; fix the declaration, or move it deliberately with `ceph osd crush ' +\n            'move` / `ceph osd crush set-device-class` and deploy again.',\n        ),\n      );\n    }\n    return live;\n  }),\n\n  /**\n   * ⛔ REMOVING THE DECLARATION REMOVES THE ASSERTION, NOT THE REPLICA — the resource defaults\n   *   to `retain`, so this runs only on `.pipe(RemovalPolicy.destroy())`. What the DELETE actually\n   *   does to a live pool is documented on `destroyOsd` in ceph-osd-write.ts.\n   */\n  delete: Effect.fn(function* ({ olds }: { olds: CephOsdProps }) {\n    yield* destroyOsd(olds);\n  }),\n};\n\nexport const ProxmoxCephOsdProvider = () =>\n  Provider.effect(ProxmoxCephOsd, Effect.succeed(ProxmoxCephOsd.Provider.of(handlers)));\n",
     "/**\n * The CRUSH tree, walked down to one OSD leaf.\n *\n * ★ SPLIT OUT OF ceph-osd.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is the same\n *   one metric-server-form.ts cuts: this file answers \"what does the cluster say about osd.N\",\n *   ceph-osd.ts answers \"what is an OSD and what may a plan do about it\". Nothing here calls the\n *   API and nothing here decides a diff. `CephOsdAttributes` lives on this side of the seam\n *   because it is a description of what the TREE says — keeping each field's\n *   reported-never-compared reasoning against the line that builds it — and ceph-osd.ts re-exports\n *   it so a consumer still imports one name from one place. The `import type` back for\n *   `CephOsdProps` is a cycle on paper only: it is erased before anything runs.\n *\n * ⛔ `GET /nodes/{node}/ceph/osd` ANSWERS A TREE, NOT A LIST, AND IT IS THE WHOLE CLUSTER'S TREE.\n *   MEASURED 2026-09-13: asked of node-b it answers `{\"flags\":…,\"root\":{\"children\":[…]}}` whose\n *   leaves include osd.0 and osd.5 on node-d; asked of node-c it answers the identical six leaves. The\n *   `{node}` in the path chooses WHO ANSWERS, not what is listed. A provider that read it as \"the\n *   OSDs on this node\" would find osd.0 through node-b and then report it as living there.\n *\n * ⛔ AND THE SINGLE-OBJECT PATH CANNOT BE USED INSTEAD — THIS WALK EXISTS BECAUSE IT LIES.\n *   MEASURED: `GET /nodes/node-b/ceph/osd/99`, an id with no OSD behind it, answers HTTP 200 with\n *   `[{\"name\":\"metadata\"},{\"name\":\"lv-info\"}]` — byte for byte what `…/osd/2` answers for a real\n *   one. It is a directory index (its schema says `permissions: {\"user\":\"all\"}`), not a read of\n *   the OSD. Point `PveSpec.path` at it and every declared OSD is \"present\": `diff` reports\n *   `noop` over a dead replica forever, and `reconcile`'s read-back guard — the one thing that\n *   stops this package recording objects that do not exist — passes on an OSD that was never\n *   built. The only endpoint that can tell present from absent is the tree.\n *\n * ★ MEASURED ON C1 ON 2026-09-13, `GET /nodes/node-b/ceph/osd`. Six leaves, all `up` and `in`, Ceph\n *   20.2.2 tentacle:\n *\n *     id  name   host    device_class  crush_weight      reweight  pgs  status\n *     0   osd.0  node-d  ssd           1.86299133300781  1          99  up\n *     5   osd.5  node-d  ssd           1.86299133300781  1          94  up\n *     1   osd.1  node-c  ssd           1.86299133300781  1          96  up\n *     4   osd.4  node-c  ssd           1.81939697265625  1          97  up\n *     2   osd.2  node-b  ssd           1.81939697265625  1          88  up\n *     3   osd.3  node-b  ssd           1.81939697265625  1         105  up\n *\n *   `{ node: 'node-b', osdid: 2, host: 'node-b', device_class: 'ssd' }` plans `noop` against that row.\n *   That is the acceptance test this file was written to pass.\n *\n * ⚠️ EVERY OTHER COLUMN IS REPORTED AND NEVER COMPARED, FOR FOUR DIFFERENT REASONS. `pgs` is the\n *   autoscaler's placement rather than anybody's declaration — MEASURED, it spans 88 to 105 across\n *   six identical disks, and Ceph moves PGs whenever it rebalances. `crush_weight` is a FLOAT\n *   derived from device size (MEASURED: 1.86299133300781), so comparing it is float equality\n *   against a number Ceph recomputes on `crush reweight`. `reweight` is what\n *   `reweight-by-utilization` writes, unasked. `status` and `in` are daemon state: an OSD that\n *   flaps down while a node reboots would otherwise put work in the plan that no write this\n *   provider owns could ever clear. Each of those is the forever-update this package has already\n *   been bitten by, and each is out of `settled` below.\n *\n * ⚠️ THE CLUSTER'S OSD FLAGS ARE NOT AN ATTRIBUTE EITHER. The read carries\n *   `\"flags\":\"sortbitwise,recovery_deletes,purged_snapdirs,pglog_hardlimit\"` NEXT TO the root\n *   rather than inside any leaf: they describe the OSDMap, not this OSD. Recording them per-OSD\n *   would rewrite all six resources' state the moment somebody set `noout` for ten minutes of\n *   maintenance — the churn-that-reads-like-drift that keeps `digest` out of storage.ts.\n *\n */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport type { CephOsdProps } from './ceph-osd.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { bool, int, num, text } from './values.ts';\n\n/** A CRUSH node. Buckets carry `children`; an OSD leaf carries `type: 'osd'`. */\ntype CrushNode = Record<string, unknown>;\n\nconst branches = (node: CrushNode): CrushNode[] =>\n  (Array.isArray(node['children']) ? node['children'] : []).filter(\n    (child): child is CrushNode => typeof child === 'object' && child !== null,\n  );\n\n/**\n * Every OSD leaf under the tree root, at any depth.\n *\n * ⚠️ RECURSIVE BECAUSE THE TREE IS NOT THREE LEVELS DEEP BY LAW. C1 measures as\n *   root(`default`) -> host(node-b|node-c|node-d) -> osd, but CRUSH admits datacenter, rack and chassis\n *   buckets between them, and an OSD created outside a host bucket hangs off the root. Reaching\n *   in as `root.children[].children[]` would read this cluster correctly and answer \"absent\" —\n *   i.e. \"the replica is gone\" — on the first cluster that has a rack in it.\n *\n * ⚠️ THE OUTERMOST OBJECT IS NOT ITSELF A BUCKET. MEASURED: `root` is `{\"children\":[…],\"leaf\":0}`\n *   with no `type` and no `name`; the bucket called `default` is its first child. So the walk\n *   starts at `tree.root` and selects on `type === 'osd'` rather than assuming a shape.\n */\nexport const osdLeaves = (tree: CrushNode): CrushNode[] => {\n  const root = tree['root'];\n  const start: CrushNode = typeof root === 'object' && root !== null ? (root as CrushNode) : {};\n  const walk = (node: CrushNode): CrushNode[] => [\n    ...(node['type'] === 'osd' ? [node] : []),\n    ...branches(node).flatMap(walk),\n  ];\n  return walk(start);\n};\n\n/**\n * The leaf for one OSD id, or undefined when nothing in the tree carries it.\n *\n * ⛔ `id` COMES BACK AS A STRING HERE AND AS AN INTEGER EVERYWHERE ELSE, which is the \"an id\n *   returned one way and written another\" forever-diff in its most expensive form. MEASURED: the\n *   leaf for osd.2 carries `\"id\":\"2\"` (and the host buckets carry `\"id\":\"-7\"`), while\n *   `GET …/osd/2/metadata` carries `\"id\":2` and the `osdid` parameter on POST and DELETE is typed\n *   integer. `'2' === 2` is false, so a provider comparing the raw value finds NOTHING, calls\n *   every declared OSD absent — and, with a create path wired up, offers to build six OSDs over\n *   six live disks. `int` from values.ts is the narrowing, and `Number.NaN` is the fallback\n *   precisely because it equals nothing, id 0 included.\n *\n * ⚠️ FIRST MATCH WINS. OSD ids are unique cluster-wide, and PVE does not put the per-device-class\n *   shadow buckets (`default~ssd`) in this tree — MEASURED: the whole tree is one `default` root,\n *   three hosts, six leaves. If a future PVE did include them, taking the first match keeps the\n *   answer stable instead of reporting drift depending on which copy was walked into first.\n */\nexport const findOsd = (tree: CrushNode, osdid: number) =>\n  osdLeaves(tree).find((leaf) => int(leaf['id'], Number.NaN) === osdid);\n\nexport interface CephOsdAttributes {\n  /** Normalised to an integer here even though the tree spells it `\"2\"`. */\n  osdid: number;\n  /** `osd.2` — how Ceph, the UI and every log line name it. */\n  name: string;\n  /** COMPARED, but only when `props.host` is declared. */\n  host: string;\n  /** COMPARED, but only when `props.device_class` is declared. */\n  device_class: string;\n  /**\n   * ⚠️ REPORTED, NEVER COMPARED — `bluestore` on every live OSD and filestore has been gone for\n   *   years, so declaring it would add a field that cannot disagree. It is recorded because a\n   *   future objectstore change is exactly the kind of thing state should have caught in writing.\n   */\n  osdtype: string;\n  /** ⚠️ REPORTED, NEVER COMPARED. Daemon state — see the second ⚠️ in the header. */\n  status: string;\n  /** ⚠️ REPORTED, NEVER COMPARED. Ceph itself sets this to 0 after `mon_osd_down_out_interval`. */\n  in: boolean;\n  /** ⚠️ REPORTED, NEVER COMPARED. A float Ceph recomputes; comparing it is a permanent diff. */\n  crush_weight: number;\n  /** ⚠️ REPORTED, NEVER COMPARED. `reweight-by-utilization` owns this number, not a declaration. */\n  reweight: number;\n  /** ⚠️ REPORTED, NEVER COMPARED. The autoscaler moves PGs between OSDs whenever it likes. */\n  pgs: number;\n  /** Device capacity in bytes. Stable per disk, and the honest answer to \"how big is this OSD\". */\n  total_space: number;\n  /** `20.2.2`. ⚠️ Reported, never compared — an upgrade is not this resource's drift. */\n  ceph_version: string;\n}\n\n/**\n * One leaf, as the attributes a plan and the state store get to see.\n *\n * ⚠️ THE TELEMETRY IS DELIBERATELY DROPPED, NOT FORGOTTEN. The leaf also carries `bytes_used`,\n *   `percent_used`, `apply_latency_ms` and `commit_latency_ms`. MEASURED, AND THE MEASUREMENT SAYS\n *   THE OPPOSITE OF WHAT YOU WOULD EXPECT: across two reads minutes apart, all four were identical\n *   on every OSD, and both latencies read 0 — C1 was idle, so nothing was caught in the act. That\n *   these move is therefore REASONED, from what they count, not observed. Alchemy persists\n *   attributes; on a cluster doing work, keeping them would rewrite all six resources' state on\n *   every deploy and record a number that is stale by the time anybody reads it. What is kept is\n *   what a human asking \"what is this replica, and is it healthy\" needs; it is not a metrics feed.\n *\n * ⚠️ `osdid` AND `name` ARE THE NORMALISED ID AND ITS SPELLING, taken from the leaf rather than\n *   echoed from props, so that state records what the cluster said. They agree by construction\n *   here — the leaf was found BY id — but echoing props into attributes is how a resource ends up\n *   recording a declaration as though it were an observation.\n */\nexport const osdAttributes = (leaf: CrushNode, props: CephOsdProps): CephOsdAttributes => ({\n  ceph_version: text(leaf['ceph_version_short']),\n  crush_weight: num(leaf['crush_weight'], 0),\n  device_class: text(leaf['device_class']),\n  host: text(leaf['host']),\n  in: bool(leaf['in']),\n  name: text(leaf['name'], `osd.${String(props.osdid)}`),\n  osdid: int(leaf['id'], props.osdid),\n  osdtype: text(leaf['osdtype']),\n  pgs: num(leaf['pgs'], 0),\n  reweight: num(leaf['reweight'], 0),\n  status: text(leaf['status']),\n  total_space: num(leaf['total_space'], 0),\n});\n\n/**\n * The live OSD as attributes, or undefined.\n *\n * ★ IT LIVES HERE RATHER THAN IN ceph-osd.ts BECAUSE THE READ SIDE IS THIS FILE'S WHOLE JOB —\n *   `findOsd` and `osdAttributes` are the two halves it composes, and keeping the caller beside\n *   them is what let ceph-osd.ts come back under the 250-line cap when create and delete were\n *   added.\n *\n * ★ MIGRATED OFF `client.ts`'s `pve()` ONTO `@distilled.cloud/proxmox`'s typed `nodes.\n *   getNodeCephOsd` (2026-09-24, decision 43, 2c) — the tree endpoint, confirmed against\n *   distilled's own schema to still answer `{flags?, root: unknown}`, matching the shape\n *   `osdLeaves` already walks. ⛔ STILL NO `Effect.orElseSucceed` — the ⛔ on `handlers.read` in\n *   ceph-osd.ts is unchanged and is still the reason: this path is a collection that always\n *   exists while Ceph is installed, so a failure here is never \"the OSD is gone\" and must\n *   propagate rather than fold. This is the one migrated Ceph family that does NOT match\n *   ceph-pool-wire.ts's/ceph-fs-distilled.ts's single-fold shape, because it never had it.\n */\nexport const readOsd = (props: CephOsdProps) =>\n  runPve(props.target, 'read', false, nodes.getNodeCephOsd({ node: props.node })).pipe(\n    Effect.map((t) => {\n      const leaf = findOsd(t as unknown as CrushNode, props.osdid);\n      return leaf === undefined ? undefined : osdAttributes(leaf, props);\n    }),\n  );\n",
-    "/**\n * The two operations that change a disk: building an OSD and removing one.\n *\n * ★ SPLIT OUT OF ceph-osd.ts FOR THE 250-LINE CAP, and the seam is the honest one — this file is\n *   everything that WRITES, and ceph-osd.ts is the declaration and the assertion. A reader asking\n *   \"can this destroy my data\" has one file to read.\n *\n * ⛔ BOTH OF THESE ARE IRREVERSIBLE. `create` hands a block device to `ceph-volume lvm create`,\n *   which zaps it; `delete` takes a replica out of a live pool and Ceph immediately begins\n *   rewriting the missing copies across the remaining nodes. `Proxmox.CephOsd` therefore declares\n *   `defaultRemovalPolicy: 'retain'`, so removing a declaration does NOT reach `destroyOsd` — a\n *   caller opts in with `.pipe(RemovalPolicy.destroy())`.\n */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport { readOsd } from './ceph-osd-tree.ts';\nimport type { CephOsdProps } from './ceph-osd.ts';\nimport { guardForm } from './constraint-guard.ts';\nimport type { EndpointKey } from './constraints.ts';\nimport { runPve } from './distilled-pve.ts';\n\n/**\n * The vendor rules the create form is checked against at plan time.\n *\n * ⛔ DECLARED HERE RATHER THAN ON A SPEC BECAUSE THIS FAMILY HAS NO SPEC — `ceph-osd.ts` writes\n *   all five handlers by hand (the ⛔ there says why), so it cannot inherit the shared guard and\n *   would otherwise be the one family that writes to Ceph with nothing checking the body.\n * ⚠️ `dev` IS REQUIRED AND THE REFUSAL BELOW ALREADY COVERS IT, with a message about a missing\n *   replica that is far more useful than `dev: required`. The table is still worth checking: it\n *   also carries `db_dev_size` ≥ 1, `wal_dev_size` ≥ 0.5 and `osds-per-device` ≥ 1, and nothing\n *   else in this package knows those numbers.\n * ⚠️ THERE IS NO UPDATE KEY: PVE registers no PUT under `ceph/osd`, and an OSD is not editable.\n */\nexport const OSD_CREATE_ENDPOINT: EndpointKey = 'pve:POST /nodes/{node}/ceph/osd';\n\nconst describe = (props: CephOsdProps) => `osd.${String(props.osdid)} on ${props.node}`;\n\n/**\n * The create body. ★ Exported so the constraint proof can run the REAL form.\n * ⚠️ `dev` is `string | undefined` on the props and non-optional here: `createOsd` refuses first.\n */\nexport const createOsdForm = (props: CephOsdProps, dev: string): Record<string, string> => ({\n  dev,\n  ...(props.device_class === undefined ? {} : { 'crush-device-class': props.device_class }),\n});\n\nexport const createOsd = Effect.fn(function* (news: CephOsdProps) {\n  if (news.dev === undefined) {\n    return yield* Effect.die(\n      new Error(\n        `${describe(news)}: no such OSD in the CRUSH tree, and no \\`dev\\` was declared. ` +\n          'Without a device this resource is an ASSERTION over an OSD that must already ' +\n          'exist. Declare `dev` to let it create one -- which WIPES that device -- or fix ' +\n          'the declaration; if the disk was there yesterday, a replica is missing and Ceph ' +\n          'is degraded.',\n      ),\n    );\n  }\n  const form = createOsdForm(news, news.dev);\n  // ⛔ BEFORE THE POST, BECAUSE THE POST ZAPS A BLOCK DEVICE. A vendor rule broken here is worth\n  //   refusing at plan rather than discovering from a 400 after `ceph-volume` has run.\n  yield* guardForm(OSD_CREATE_ENDPOINT, form, true);\n  yield* runPve(\n    news.target,\n    'provision',\n    true,\n    nodes.createNodeCephOsd({\n      dev: news.dev,\n      node: news.node,\n      ...(news.device_class === undefined ? {} : { crush_device_class: news.device_class }),\n    }),\n  );\n  const created = yield* readOsd(news);\n  if (created === undefined) {\n    return yield* Effect.die(\n      new Error(\n        `${describe(news)}: the create returned no error but osd.${String(news.osdid)} is ` +\n          'still absent. Ceph allocates OSD ids and cannot be told which to use, so it most ' +\n          'likely assigned a different number -- check `ceph osd tree`, and declare the id it ' +\n          'actually gave the device rather than deploying again.',\n      ),\n    );\n  }\n  return created;\n});\n\n/**\n * ⛔ REMOVING THE DECLARATION REMOVES THE ASSERTION, NOT THE REPLICA, AND THAT ASYMMETRY IS THE\n *   POINT. `DELETE /nodes/{node}/ceph/osd/{osdid}` takes a replica out of a live pool — with\n *   `nobackfill`/`norecover` unset, Ceph immediately starts rewriting the missing copies across\n *   the two remaining nodes — and with `cleanup=1` it zaps the LVs as well. A stack file is\n *   edited by people in a hurry; a disk is not a thing a deleted line gets to destroy. Take an\n *   OSD out by hand, with the cluster healthy and `ceph -s` in front of you: `ceph osd out N`,\n *   wait for the backfill to finish, then `pveceph osd destroy N`.\n *\n * ★ SO IT IS IMPLEMENTED, AND THE RESOURCE DEFAULTS TO `retain` INSTEAD. Removing a declaration\n *   drops the state row and leaves the replica alone; a caller who really means it opts in with\n *   `.pipe(RemovalPolicy.destroy())`. That is the same shape Terraform gives `prevent_destroy`,\n *   and it beats a `delete` that silently does nothing — which is a lie to anyone reading the\n *   plan.\n *\n * ⚠️ `cleanup` DEFAULTS TO FALSE, so the logical volumes survive and the disk can be re-added\n *   without a rebuild. Ceph still starts backfilling the missing copies the moment the OSD goes.\n *\n * ⚠️ `cleanup` RIDES A DELETE BODY, ON `client.ts` AND ON DISTILLED ALIKE — PRE-EXISTING, NOT\n *   INTRODUCED HERE. `client.ts`'s own `buildRequest` (client.ts) puts `form` in the body for\n *   every method, DELETE included, and CHECKED against distilled's generated\n *   `DeleteNodeCephOsdRequest`: `cleanup` carries no `T.Query()` annotation either, so it also\n *   defaults to a body field. ceph-fs-wire.ts's own ⛔ (measured from PVE's `AnyEvent.pm`) is that\n *   PVE's server never reads a body on DELETE — so `cleanup=1` was ALREADY silently ignored by\n *   the live cluster before this migration, on the unmigrated code too. Migrating carries the\n *   SAME behaviour forward exactly, byte-for-byte, rather than introducing a new gap; unlike\n *   `Proxmox.CephFs`'s delete, this is not a reason to keep the call on the hand client. It has\n *   zero practical effect today regardless, since the whole DELETE 403s for this package's\n *   credential either way (the root-only ⛔ at the top of ceph-osd.ts) — flagged separately as a\n *   pre-existing, out-of-scope bug worth its own fix (move `cleanup` into the query string, the\n *   way `destroyPath` in ceph-fs-wire.ts already does).\n */\nexport const destroyOsd = (olds: CephOsdProps) =>\n  runPve(\n    olds.target,\n    'provision',\n    true,\n    nodes.deleteNodeCephOsd({\n      node: olds.node,\n      osdid: String(olds.osdid),\n      ...(olds.cleanup === true ? { cleanup: '1' } : {}),\n    }),\n  );\n",
+    "/**\n * The two operations that change a disk: building an OSD and removing one.\n *\n * ★ SPLIT OUT OF ceph-osd.ts FOR THE 250-LINE CAP, and the seam is the honest one — this file is\n *   everything that WRITES, and ceph-osd.ts is the declaration and the assertion. A reader asking\n *   \"can this destroy my data\" has one file to read.\n *\n * ⛔ BOTH OF THESE ARE IRREVERSIBLE. `create` hands a block device to `ceph-volume lvm create`,\n *   which zaps it; `delete` takes a replica out of a live pool and Ceph immediately begins\n *   rewriting the missing copies across the remaining nodes. `Proxmox.CephOsd` therefore declares\n *   `defaultRemovalPolicy: 'retain'`, so removing a declaration does NOT reach `destroyOsd` — a\n *   caller opts in with `.pipe(RemovalPolicy.destroy())`.\n */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport { readOsd } from './ceph-osd-tree.ts';\nimport type { CephOsdProps } from './ceph-osd.ts';\nimport { guardForm } from './constraint-guard.ts';\nimport type { EndpointKey } from './constraints.ts';\nimport { runPve } from './distilled-pve.ts';\n\n/**\n * The vendor rules the create form is checked against at plan time.\n *\n * ⛔ DECLARED HERE RATHER THAN ON A SPEC BECAUSE THIS FAMILY HAS NO SPEC — `ceph-osd.ts` writes\n *   all five handlers by hand (the ⛔ there says why), so it cannot inherit the shared guard and\n *   would otherwise be the one family that writes to Ceph with nothing checking the body.\n * ⚠️ `dev` IS REQUIRED AND THE REFUSAL BELOW ALREADY COVERS IT, with a message about a missing\n *   replica that is far more useful than `dev: required`. The table is still worth checking: it\n *   also carries `db_dev_size` ≥ 1, `wal_dev_size` ≥ 0.5 and `osds-per-device` ≥ 1, and nothing\n *   else in this package knows those numbers.\n * ⚠️ THERE IS NO UPDATE KEY: PVE registers no PUT under `ceph/osd`, and an OSD is not editable.\n */\nexport const OSD_CREATE_ENDPOINT: EndpointKey = 'pve:POST /nodes/{node}/ceph/osd';\n\nconst describe = (props: CephOsdProps) => `osd.${String(props.osdid)} on ${props.node}`;\n\n/**\n * The create body. ★ Exported so the constraint proof can run the REAL form.\n * ⚠️ `dev` is `string | undefined` on the props and non-optional here: `createOsd` refuses first.\n */\nexport const createOsdForm = (props: CephOsdProps, dev: string): Record<string, string> => ({\n  dev,\n  ...(props.device_class === undefined ? {} : { 'crush-device-class': props.device_class }),\n});\n\nexport const createOsd = Effect.fn(function* (news: CephOsdProps) {\n  if (news.dev === undefined) {\n    return yield* Effect.die(\n      new Error(\n        `${describe(news)}: no such OSD in the CRUSH tree, and no \\`dev\\` was declared. ` +\n          'Without a device this resource is an ASSERTION over an OSD that must already ' +\n          'exist. Declare `dev` to let it create one -- which WIPES that device -- or fix ' +\n          'the declaration; if the disk was there yesterday, a replica is missing and Ceph ' +\n          'is degraded.',\n      ),\n    );\n  }\n  const form = createOsdForm(news, news.dev);\n  // ⛔ BEFORE THE POST, BECAUSE THE POST ZAPS A BLOCK DEVICE. A vendor rule broken here is worth\n  //   refusing at plan rather than discovering from a 400 after `ceph-volume` has run.\n  yield* guardForm(OSD_CREATE_ENDPOINT, form, true);\n  yield* runPve(\n    news.target,\n    'provision',\n    true,\n    nodes.createNodeCephOsd({\n      dev: news.dev,\n      node: news.node,\n      ...(news.device_class === undefined ? {} : { crush_device_class: news.device_class }),\n    }),\n  );\n  const created = yield* readOsd(news);\n  if (created === undefined) {\n    return yield* Effect.die(\n      new Error(\n        `${describe(news)}: the create returned no error but osd.${String(news.osdid)} is ` +\n          'still absent. Ceph allocates OSD ids and cannot be told which to use, so it most ' +\n          'likely assigned a different number -- check `ceph osd tree`, and declare the id it ' +\n          'actually gave the device rather than deploying again.',\n      ),\n    );\n  }\n  return created;\n});\n\n/**\n * ⛔ REMOVING THE DECLARATION REMOVES THE ASSERTION, NOT THE REPLICA, AND THAT ASYMMETRY IS THE\n *   POINT. `DELETE /nodes/{node}/ceph/osd/{osdid}` takes a replica out of a live pool — with\n *   `nobackfill`/`norecover` unset, Ceph immediately starts rewriting the missing copies across\n *   the two remaining nodes — and with `cleanup=1` it zaps the LVs as well. A stack file is\n *   edited by people in a hurry; a disk is not a thing a deleted line gets to destroy. Take an\n *   OSD out by hand, with the cluster healthy and `ceph -s` in front of you: `ceph osd out N`,\n *   wait for the backfill to finish, then `pveceph osd destroy N`.\n *\n * ★ SO IT IS IMPLEMENTED, AND THE RESOURCE DEFAULTS TO `retain` INSTEAD. Removing a declaration\n *   drops the state row and leaves the replica alone; a caller who really means it opts in with\n *   `.pipe(RemovalPolicy.destroy())`. That is the same shape Terraform gives `prevent_destroy`,\n *   and it beats a `delete` that silently does nothing — which is a lie to anyone reading the\n *   plan.\n *\n * ⚠️ `cleanup` DEFAULTS TO FALSE, so the logical volumes survive and the disk can be re-added\n *   without a rebuild. Ceph still starts backfilling the missing copies the moment the OSD goes.\n *\n * ★ CORRECTED 2026-09-28: `cleanup` IS QUERY-BOUND ON DISTILLED, NOT BODY. This comment previously\n *   claimed `DeleteNodeCephOsdRequest.cleanup` carried no `T.Query()` annotation and so rode the\n *   DELETE body, silently ignored by PVE's server (which never reads a body on DELETE, per\n *   ceph-fs-wire.ts's measurement of `AnyEvent.pm`). That was true of the old `client.ts` hand\n *   client, but distilled-proxmox's generated schema\n *   (`packages/distilled-proxmox/src/services/nodes.ts`) declares\n *   `cleanup: S.optional(S.String.pipe(T.Query()))` — query-bound — as of SDK 0.3.0, the same fix\n *   that landed for the sibling `Proxmox.CephFs`'s `destroyFs`. Since this file already runs on\n *   distilled (`import * as nodes from '@distilled.cloud/proxmox/nodes'`), `cleanup: '1'` below\n *   reaches PVE correctly today. No code change needed here; this was a stale doc claim only.\n */\nexport const destroyOsd = (olds: CephOsdProps) =>\n  runPve(\n    olds.target,\n    'provision',\n    true,\n    nodes.deleteNodeCephOsd({\n      node: olds.node,\n      osdid: String(olds.osdid),\n      ...(olds.cleanup === true ? { cleanup: '1' } : {}),\n    }),\n  );\n",
     "/**\n * `Proxmox.CephPool` — a Ceph RADOS pool, declared. The richest Ceph family and the one a stack is\n * most likely to reach for, because every RBD disk in the cluster lives inside one.\n *\n * ⛔ IT DOES NOT USE `pveHandlers`, AND THE REASON IS MEASURED RATHER THAN STYLISTIC: THE READ AND\n *   THE WRITES SIT AT DIFFERENT PATHS. `GET /nodes/{node}/ceph/pool/{name}` is `poolindex` and\n *   answers `[{\"name\":\"status\"}]` — an INDEX OF CHILDREN, not the pool. The pool is one level\n *   further down, at `.../status` (`getpool`), which accepts no PUT and no DELETE. Every handler\n *   below is hand-written for that reason, on `client.ts` and now on distilled alike — acl.ts is\n *   the precedent for hand-writing over the factory.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()` ONTO `@distilled.cloud/proxmox`'s typed\n *   `nodes.getNodeCephPoolStatus`/`createNodeCephPool`/`putNodeCephPool`/`deleteNodeCephPool`/\n *   `listNodeCephPool` (2026-09-24, decision 43's walk-down, 2c). `distilled-pve.ts`'s `runPve`\n *   replaces `pve()`; `readPoolStatus` (ceph-pool-wire.ts) keeps the SAME single-fold shape this\n *   family always had — see that file's own header for why this migration does not also add the\n *   newer dual-path pattern `Proxmox.NodeNetwork` carries.\n *\n * ⛔ A CREATE FIRED AT A POOL THAT ALREADY EXISTS IS NOT A NO-OP, IT IS A PG MERGE — the second ⛔\n *   in ceph-pool-form.ts has the evidence, and `confirmAbsent` below is the guard that stops it.\n *\n * ⛔ EVERY WRITE HERE IS A FORKED WORKER. createpool, setpool and destroypool each return a UPID\n *   string, so HTTP 200 means \"the task started\" — an immediate read-back can see a pool that does\n *   not exist yet, or values that have not landed. `settle` waits for the cluster to agree.\n *\n * ⛔ THE FOUR POOLS ON C1 INCLUDE CEPH'S OWN, AND NONE OF THEM MAY BE ADOPTED. Measured\n *   2026-09-13: `.mgr` (application `mgr`, created and owned by the manager daemons),\n *   `cephfs-c1_data` and `cephfs-c1_metadata` (the two halves of the `cephfs-c1` filesystem —\n *   destroying either destroys the filesystem), and `rbd-c1`, the rbd pool the guests sit on.\n *   `list` answers empty like every resource in this package, so adoption stays an explicit act;\n *   the `applications` attribute is reported so that a plan SHOWS which of those a declaration hit.\n *\n * ⚠️ DELETING A POOL DESTROYS EVERY OBJECT IN IT AND CEPH DOES NOT ASK TWICE. Neither `force` nor\n *   `remove_storages` is ever sent, so PVE's refusal while a storage on the pool still lists RBD\n *   images is left standing. That refusal does NOT cover an RBD user outside storage.cfg.\n *\n * ⚠️ PRIVILEGES, AND THE WRITE LANE IS A BIG ASK. Read is `Sys.Audit` OR `Datastore.Audit` on `/`\n *   (PVEAuditor holds both, so the mount's `read` role covers read, diff and the guard). Create,\n *   update and delete each check `Sys.Modify` on `/` — there is no `/ceph` object to scope to, so\n *   granting it also buys datacenter options and every other cluster-wide write. Widen\n *   deliberately, the way `Pool.Allocate` was widened for `Proxmox.Pool`.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport {\n  type CephPoolAttributes,\n  type CephPoolProps,\n  createBody,\n  hint,\n  object,\n  same,\n  updateBody,\n} from './ceph-pool-form.ts';\nimport { confirmAbsent, settle } from './ceph-pool-settle.ts';\nimport {\n  CEPH_POOL_CREATE,\n  CEPH_POOL_UPDATE,\n  readPoolStatus,\n  toDistilledCreate,\n  toDistilledUpdate,\n} from './ceph-pool-wire.ts';\nimport { guardWrite } from './distilled-guard.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { type PveRequirements } from './resource.ts';\nimport { formToSend } from './update-guard.ts';\n\nexport type { CephPoolAttributes, CephPoolProps };\n\nexport interface ProxmoxCephPool extends Resource<\n  'Proxmox.CephPool',\n  CephPoolProps,\n  CephPoolAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a pool holding objects cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxCephPool = Resource<ProxmoxCephPool>('Proxmox.CephPool', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * ⛔ DECLARING WHAT IS LIVE MUST PLAN noop, AND EVERY OMISSION HERE IS WHY. Out, each with its\n *   reason on the prop it belongs to: `pg_num` (the autoscaler rewrites it), `application` (the\n *   write only ever ADDS to a list), `target_size_ratio` (float equality), `id`, `applications`\n *   and the three `no*` flags (PVE returns them and accepts none of them on write), `node` and\n *   `name` (the address the read was made at — true by construction, never a diff). In, and each\n *   measured to round-trip unchanged against C1's four pools on 2026-09-13: size 3, min_size 2,\n *   pg_autoscale_mode `on`, crush_rule `replicated_rule`, pg_num_min where it is set (16 on\n *   cephfs-c1_metadata, absent on rbd-c1), target_size in bytes — and each of the last two\n *   through `hint`, which drops a declared zero for the reason given on it.\n */\nconst matches = (attributes: CephPoolAttributes, props: CephPoolProps) =>\n  same(props.size, attributes.size, attributes.nosizechange) &&\n  same(props.min_size, attributes.min_size, attributes.nosizechange) &&\n  same(props.pg_autoscale_mode, attributes.pg_autoscale_mode) &&\n  same(hint(props.pg_num_min), attributes.pg_num_min, attributes.nopgchange) &&\n  same(props.crush_rule, attributes.crush_rule, attributes.crush_rule === '') &&\n  same(hint(props.target_size), attributes.target_size);\n\nexport const ProxmoxCephPoolProvider = () =>\n  Provider.effect(\n    ProxmoxCephPool,\n    Effect.succeed(\n      ProxmoxCephPool.Provider.of({\n        /** ⛔ Empty, and here it is what keeps `.mgr` and the two cephfs pools out — see the header. */\n        list: () => Effect.succeed([]),\n        read: ({ olds }) => readPoolStatus(olds),\n        /**\n         * ★ HAND-WRITTEN, matching the pre-migration `ops.diff` shape exactly (resource.ts) — this\n         *   family never used the factory's own `diff`/`reconcile` (only its `read`), and the\n         *   factory itself cannot run a distilled operation, so both are inlined here now.\n         */\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(CEPH_POOL_CREATE, createBody(news), output === undefined);\n          yield* guardWrite(CEPH_POOL_UPDATE, updateBody(news), false);\n          if (output === undefined) return undefined;\n          const live = yield* readPoolStatus(news);\n          if (live === undefined) {\n            yield* guardWrite(CEPH_POOL_CREATE, createBody(news), true);\n            return { action: 'update' } as const;\n          }\n          return matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        /**\n         * ⚠️ NOT A GENERIC reconcile: it POSTs the moment a read comes back empty, and reads back\n         *   once, immediately. Both are wrong for a family whose writes are forked workers and whose\n         *   create is destructive against a pool that is already there.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const live = yield* readPoolStatus(news);\n          let upid: string | undefined;\n          if (live === undefined) {\n            // ⛔ THE GUARD A GENERIC reconcile WOULD HAVE RUN, RESTORED. This handler replaces it\n            //   wholesale, so without these two calls an ADOPTED pool — whose diff answer Alchemy\n            //   discards — would reach the cluster with nothing having checked its body.\n            yield* guardWrite(CEPH_POOL_CREATE, createBody(news), true);\n            yield* confirmAbsent(news, object(news));\n            upid = yield* runPve(\n              news.target,\n              'provision',\n              true,\n              nodes.createNodeCephPool(toDistilledCreate(news)),\n            );\n          } else {\n            /**\n             * ⛔ ONLY WHEN `matches` IS FALSE. This PUT used to fire whenever the pool existed, so\n             *   adopting a pool that already matched — Plan.ts forces reconcile after the probe —\n             *   sent `setpool` and forked a worker on the live cluster. PVE skipping the unchanged\n             *   settings (ceph-pool-form.ts) made it harmless to Ceph, not free: it is still a\n             *   provision-lease write and a task in the cluster's list. update-guard.ts has the rest.\n             */\n            const form = formToSend(matches, live, news, updateBody(news));\n            if (form !== undefined) {\n              yield* guardWrite(CEPH_POOL_UPDATE, updateBody(news), false);\n              upid = yield* runPve(\n                news.target,\n                'provision',\n                true,\n                nodes.putNodeCephPool(toDistilledUpdate(news)),\n              );\n            }\n          }\n          const after = yield* settle(\n            news,\n            readPoolStatus,\n            (row) => row !== undefined && matches(row, news),\n          );\n          if (after === undefined || !matches(after, news)) {\n            return yield* Effect.die(\n              new Error(\n                `${object(news)}: the write returned no error but the pool still does not match ` +\n                  `the declaration after 60s. PVE answered with task ${upid ?? '(none)'} -- read ` +\n                  'its log with `pvesh get /nodes/<node>/tasks/<upid>/log` to see what Ceph ' +\n                  'refused.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ THIS DESTROYS EVERY OBJECT IN THE POOL. No `force`, so PVE's own check — it refuses\n         *   while a PVE storage on this pool still lists RBD images — is left standing; and no\n         *   `remove_storages`, so a storage.cfg section pointing here survives and stays somebody's\n         *   to remove deliberately.\n         * ⚠️ AND THE REFUSAL CAN ARRIVE AFTER THE RESPONSE, WHICH IS WHY THIS WAITS. The DELETE\n         *   forks a worker and answers 200 with a UPID, so mons running with\n         *   `mon_allow_pool_delete` false fail once the call has already returned. MEASURED on C1\n         *   2026-09-13: the config-db value is false while the running mons report true, i.e. it is\n         *   set in ceph.conf and the two sources disagree by design.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            nodes.deleteNodeCephPool({ name: olds.name, node: olds.node }),\n          );\n          const left = yield* settle(olds, readPoolStatus, (row) => row === undefined);\n          if (left !== undefined) {\n            return yield* Effect.die(\n              new Error(\n                `${object(olds)}: the DELETE returned no error but the pool is still there after ` +\n                  '60s. Either a storage on it still holds RBD images, or the mons are running ' +\n                  'with mon_allow_pool_delete false.',\n              ),\n            );\n          }\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * What a Ceph pool IS as a declaration, and the two different forms PVE wants it in.\n *\n * ★ SPLIT OUT OF ceph-pool.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is\n *   \"does this touch the cluster\" — the same one metric-server-form.ts draws, just with more on\n *   this side because this family needs it. Here: the declared shape, the reported shape, and the\n *   coercions that turn one into the other. There: reading C1, deciding a diff, and the four\n *   handlers. Nothing in this file makes a call or decides an action.\n * ⚠️ THE PROPS LIVE HERE RATHER THAN IN THE RESOURCE FILE, which is the one place this pair\n *   differs from metric-server / notification-target. There is no `import type` cycle back as a\n *   result; ceph-pool.ts re-exports both interfaces so the public surface is unchanged.\n *\n * ⛔ POST AND PUT DO NOT TAKE THE SAME PARAMETERS, AND BOTH EXTRAS ARE DESTRUCTIVE. MEASURED from\n *   the cluster's own schema (/usr/share/pve-docs/api-viewer/apidoc.js on node-b, pve-manager 9.2.11,\n *   2026-09-13): POST adds `add_storages` and `erasure-coding` to the shared set, PUT takes\n *   neither. Both are refused below, so what is left between the two bodies is `name`, which PUT\n *   reads from the path, and `pg_num`.\n *\n * ⛔ `pg_num` IS IN THE CREATE BODY AND NOT IN THE UPDATE BODY, AND THAT IS THE MOST IMPORTANT\n *   LINE IN THIS FILE. MEASURED in PVE::API2::Ceph::Pool::createpool on node-b: a POST carrying no\n *   `pg_num` gets 128 substituted (`$param->{pg_num} //= 128`), and PVE::Ceph::Tools::create_pool\n *   then runs `osd pool create` — which Ceph answers with SUCCESS for a pool that already exists,\n *   before applying the rest of the body to it. So a create fired at a live pool SETS its pg_num,\n *   and lowering pg_num starts a PG MERGE: hours of backfill across every OSD, on a cluster whose\n *   Ceph traffic shares vmbr1.42 with everything else. ceph-pool.ts guards the create for exactly\n *   that reason; this half simply never offers pg_num to an update.\n */\nimport type { WithTarget } from './resource.ts';\nimport { csv } from './values.ts';\n\nexport interface CephPoolProps extends WithTarget {\n  /**\n   * ⚠️ WHICH NODE THE CALL GOES THROUGH, NOT WHERE THE POOL LIVES. A pool is cluster-wide: node-b and\n   *   node-c answer byte-identically for `rbd-c1` (measured). The endpoint is node-scoped only\n   *   because PVE talks to the local RADOS socket, so this is a door, not a location — it is never\n   *   compared, and moving a declaration from node-b to node-c plans noop. Point it at a node you expect\n   *   to be up: a node that is down makes the read fail, and a failed read reads as \"absent\".\n   */\n  node: string;\n  /**\n   * Ceph's primary key, cluster-wide.\n   * ⛔ CHANGING IT DOES NOT RENAME ANYTHING. There is no rename in this API: the plan reads the new\n   *   name, finds nothing, and CREATES AN EMPTY POOL, leaving the old one and its data behind,\n   *   untracked. `replace` was considered and rejected — it would DELETE the old pool and every\n   *   image in it to satisfy an edited string. Rename by hand, deliberately, or not at all.\n   */\n  name: string;\n  /** Replicas per object, 1-7. ⚠️ Frozen when the pool carries Ceph's `nosizechange`. */\n  size?: number;\n  /** Replicas required to accept writes, 1-7. ⚠️ Frozen by `nosizechange` too. */\n  min_size?: number;\n  /**\n   * ⛔ CREATE-TIME ONLY, AND NEVER COMPARED — the single biggest noop hazard in this family. With\n   *   `pg_autoscale_mode` on or warn the autoscaler owns this number: MEASURED on C1, `rbd-c1`\n   *   sits at pg_num 128 while the autoscaler's own `pg_num_final` is 256, so a declaration\n   *   diffing it reports an update the moment Ceph decides to act. A split is gradual even with\n   *   the autoscaler off, and `nopgchange` can refuse the write outright — which kills the WHOLE\n   *   PUT, not just this field. Declare it as the birth size; steer it afterwards with\n   *   `pg_num_min`, or by hand.\n   */\n  pg_num?: number;\n  /** The floor the autoscaler may not go below. Operator-owned and stable, so it IS compared. */\n  pg_num_min?: number;\n  /** ⚠️ PVE's create default is `warn`; Ceph's own is `on`, which is what all four C1 pools have. */\n  pg_autoscale_mode?: 'off' | 'on' | 'warn';\n  /**\n   * The CRUSH rule BY NAME, e.g. `replicated_rule`.\n   * ★ THE SUSPECTED INTEGER-VS-NAME TRAP IS REAL BUT NOT ON THE PATH THIS RESOURCE READS, AND THAT\n   *   IS MEASURED BOTH WAYS. `GET .../ceph/pool` (the collection) reports `crush_rule: 0` with the\n   *   name beside it in `crush_rule_name`; `GET .../ceph/pool/{name}/status` reports\n   *   `crush_rule: \"replicated_rule\"` — the same spelling POST and PUT accept. Reading the\n   *   collection instead would reintroduce the forever-diff in a single edit.\n   */\n  crush_rule?: string;\n  /**\n   * ⛔ CREATE-TIME ONLY, AND NEVER COMPARED. PVE's PUT turns this into\n   *   `osd pool application enable` (Tools.pm:250-255), which ADDS a tag and never removes one,\n   *   and Ceph refuses a second application without `--yes-i-really-mean-it` — so an update would\n   *   either leave the pool tagged twice or die, and comparing one declared string against the\n   *   LIST that comes back is the set-in-arbitrary-order forever-diff. The live list is reported\n   *   as `applications` instead.\n   */\n  application?: 'cephfs' | 'rbd' | 'rgw';\n  /** Autoscaler size hint, ⚠️ IN BYTES — see the ⚠️ on `updateBody`. A `1T` string is not accepted. */\n  target_size?: number;\n  /**\n   * Autoscaler share of total capacity, 0-1.\n   * ⚠️ WRITTEN BUT NEVER DIFFED, because a float is not a safe equality: Ceph stores a double and\n   *   PVE prints about 15 significant digits, so a ratio that is not exactly representable would\n   *   report an update on every plan for a pool nobody touched.\n   */\n  target_size_ratio?: number;\n  /**\n   * ⛔ `never` ON PURPOSE, BOTH OF THEM, AND THE COMPILE ERROR IS THE FEATURE.\n   *   `erasure-coding` does not configure this pool — it makes PVE build TWO pools and name\n   *   neither of them what you declared: `<name>-data` for the EC data and `<name>-metadata` for\n   *   the replicated half (Pool.pm:517-530). Nothing would then exist at `{name}`, so every plan\n   *   would read absent and try to create it again, forever.\n   *   `add_storages` writes a section into storage.cfg that this graph does not own; declare a\n   *   `Proxmox.Storage` and pass this pool's `name` into it instead, which makes the link real.\n   */\n  'erasure-coding'?: never;\n  add_storages?: never;\n}\n\n/**\n * ⚠️ THE THREE `no*` FLAGS ARE REPORTED BECAUSE THEY EXPLAIN A REFUSAL. Ceph can freeze a pool's\n *   size or its PG shape, and `set_pool` dies on the whole PUT when any one parameter will not\n *   apply (Tools.pm:310). `matches` refuses to diff the fields they freeze, so these attributes\n *   are the only place a plan can show WHY a declared size is not being enforced. All three read\n *   false on all four C1 pools.\n * ⚠️ `pg_num`, `id` AND `applications` ARE REPORTED AND NEVER COMPARED — see the props above.\n * ⛔ NO `statistics` AND NO `autoscale_status`, though the verbose read returns both. They change\n *   every few seconds; persisting them would rewrite this resource's state on every deploy and\n *   read like drift. `UNSET` means the pool carries no value for that field.\n */\nexport interface CephPoolAttributes {\n  name: string;\n  /** The node the read went through. A debugging aid, not a property of the pool. */\n  node: string;\n  id: number;\n  size: number;\n  min_size: number;\n  pg_num: number;\n  pg_num_min: number;\n  pg_autoscale_mode: string;\n  /** ⚠️ Empty when PVE answered with a rule id instead of a name; `matches` then stops diffing it. */\n  crush_rule: string;\n  /** Sorted comma list, e.g. `rbd` or `cephfs`. Readable only under `?verbose=1`. */\n  applications: string;\n  target_size: number;\n  target_size_ratio: number;\n  nodelete: boolean;\n  nopgchange: boolean;\n  nosizechange: boolean;\n}\n\n/**\n * Where one pool is WRITTEN, and where a new one is POSTed.\n *\n * ⚠️ NEITHER IS WHERE IT IS READ — the read path is a segment longer and lives in ceph-pool.ts\n *   next to the ⛔ that explains it. These two are here because a path is wire knowledge, and\n *   because the create guard needs the collection without needing anything else from the spec.\n */\nexport const object = (props: CephPoolProps) => `nodes/${props.node}/ceph/pool/${props.name}`;\nexport const collection = (props: CephPoolProps) => `nodes/${props.node}/ceph/pool`;\n\n/**\n * ⚠️ \"NOT SET\" IS -1 AND NOT 0, for the reason metric-server-form.ts gives: `pg_num_min`,\n *   `target_size` and `target_size_ratio` each take 0 as a REAL value meaning \"no floor, no hint\",\n *   so a provider using 0 as its absent-marker cannot tell a declared zero from an undeclared\n *   field. Every one of these is >= 0, so -1 sits outside all of their ranges.\n */\nexport const UNSET = -1;\n\n/** ⚠️ PVE returns the tags as an ARRAY in Ceph's order, so `csv` sorts before anything sees them. */\nexport const applications = (value: unknown) =>\n  csv(Array.isArray(value) ? value.map((entry: unknown) => String(entry)) : []);\n\n/**\n * Declared? compare it. Undeclared, or frozen by a flag the pool carries? leave it alone.\n *\n * ⚠️ `frozen` IS THE WHOLE ANSWER TO \"A FIELD PVE WILL NOT ACCEPT ON WRITE\". Comparing one can only\n *   plan an update that no write can satisfy: work reported on every run, forever.\n */\nexport const same = <T>(declared: T | undefined, live: T, frozen = false) =>\n  declared === undefined || frozen || declared === live;\n\n/**\n * A declared autoscaler hint, or nothing when it is zero.\n *\n * ⚠️ A DECLARED ZERO IS \"NO FLOOR, NO HINT\", AND IT IS DELIBERATELY LEFT UNCOMPARED. REASONED, NOT\n *   MEASURED: all four C1 pools carry null for both `pg_num_min` and `target_size`, and finding\n *   out for certain would mean writing to the cluster. Ceph CLEARS both when they are set to 0 and\n *   `osd pool get all` then omits the key, which PVE reports as null and this pair reads as UNSET\n *   — so a declared 0 would compare 0 against -1 on every plan, forever. Mapping 0 to UNSET\n *   instead would be a guess in the OTHER direction, and wrong the same way if Ceph does report\n *   the zero. Neither guess is made: a zero is still written, and then left unmanaged exactly like\n *   an undeclared field.\n */\nexport const hint = (value: number | undefined) => (value === 0 ? undefined : value);\n\n/** One optional field, present in the form only when it was declared. */\nconst field = (name: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [name]: value };\n\n/** ⚠️ Not named `digits`: `target_size_ratio` is a fraction, and `String` is right for both. */\nconst numeric = (value: number | undefined) => (value === undefined ? undefined : String(value));\n\n/**\n * The PUT body: everything POST and PUT both accept, `pg_num` excepted. `createBody` builds on it,\n * the way storage.ts's `mutable` serves both of its forms. `name` is the path's last segment on an\n * update and is not repeated here.\n *\n * ⚠️ SAFE TO RE-APPLY TO A POOL THAT ALREADY MATCHES (reconcile leaned on it until update-guard.ts).\n *   MEASURED in PVE::Ceph::Tools::set_pool (Tools.pm:293-300): it reads `osd pool get all` first\n *   and SKIPS every unchanged setting, so the undrifted fields that ride along cost one mon read.\n * ⛔ BUT A SETTING THAT DID CHANGE AND CANNOT BE APPLIED KILLS THE WHOLE PUT. Tools.pm:310 dies\n *   with \"Could not set: <fields>\" if any parameter is left unapplied, so a pool carrying Ceph's\n *   `nosizechange` fails an entire update over one field. That is why the `no*` flags are reported\n *   and why `matches` refuses to diff what they freeze.\n *\n * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED — storage.ts's rule, and the opposite of\n *   Proxmox.Pool's. Undeclared means UNMANAGED here, because a pool has no one set of defaults to\n *   fall back on: PVE's POST fills in size 3, min_size 2, application rbd and pg_autoscale_mode\n *   'warn' (MEASURED in createpool), while Ceph's own defaults — which is what every pool on C1\n *   was actually born with — put pg_autoscale_mode at 'on'. Guessing either set would rewrite a\n *   pool somebody tuned by hand.\n *\n * ⛔ THERE IS NO `delete=` HERE AND THERE MUST NOT BE ONE. `setpool` is not a SectionConfig write:\n *   it turns each parameter into an `osd pool set`, and Ceph has no \"unset\" for size, min_size or\n *   crush_rule. metric-server-form.ts clears an undeclared optional because status.cfg supports\n *   it; the same move here would send a parameter PVE has no verb for.\n *\n * ⚠️ `target_size` IS BYTES ON THE WIRE IN BOTH DIRECTIONS, WHICH IS WHY THE PROP IS A NUMBER AND\n *   NOT PVE's `1T` STRING. MEASURED: the API parses the string with PVE::JSONSchema::parse_size\n *   and stores Ceph's `target_size_bytes` (Pool.pm:474-477 for POST, 683-686 for PUT), and\n *   `GET .../status` hands that integer back under the name `target_size` (Pool.pm:878). Run on\n *   node-b, `parse_size('1099511627776')` returns 1099511627776 — bare digits are bytes, no\n *   multiplier — so a byte count survives the round trip exactly, while a declared `1T` would read\n *   back as 1099511627776 and diff against itself on every plan, forever.\n */\nexport const updateBody = (props: CephPoolProps): Record<string, string> => ({\n  ...field('crush_rule', props.crush_rule),\n  ...field('min_size', numeric(props.min_size)),\n  ...field('pg_autoscale_mode', props.pg_autoscale_mode),\n  ...field('pg_num_min', numeric(props.pg_num_min)),\n  ...field('size', numeric(props.size)),\n  ...field('target_size', numeric(props.target_size)),\n  ...field('target_size_ratio', numeric(props.target_size_ratio)),\n});\n\n/**\n * The POST body.\n *\n * ⛔ `add_storages=0` IS SENT EXPLICITLY RATHER THAN LEFT OUT, AND THE DEFAULT IS NOT WHAT IT LOOKS\n *   LIKE. MEASURED at Pool.pm:481 — `$add_storages = 1 if $ec && !defined($add_storages)` — so for\n *   an erasure-coded pool PVE turns it ON when the parameter is absent. A pool created with it\n *   writes a NEW SECTION INTO storage.cfg that this graph does not own: `Proxmox.Storage` would\n *   not know about it, `alchemy destroy` would leave it behind, and the first person to notice\n *   would be whoever found a storage nobody declared.\n */\nexport const createBody = (props: CephPoolProps): Record<string, string> => ({\n  ...updateBody(props),\n  ...field('application', props.application),\n  ...field('pg_num', numeric(props.pg_num)),\n  add_storages: '0',\n  name: props.name,\n});\n",
     "/**\n * Waiting for Ceph to finish, which is a concern of its own.\n *\n * ★ SPLIT OUT OF ceph-pool.ts FOR THE 250-LINE CAP, and the seam is real: every other PVE family\n *   in this package writes and reads back in one breath, because PVE's config endpoints are\n *   synchronous. Ceph's are not — a pool delete returns before the PGs are gone — so this file is\n *   the polling that difference forces, and ceph-pool.ts is the declaration.\n */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport type { CephPoolAttributes, CephPoolProps } from './ceph-pool-form.ts';\nimport { runPve } from './distilled-pve.ts';\nimport type { PveRequirements } from './resource.ts';\n\n/**\n * ⚠️ THE DEPENDENCIES ARE PASSED IN RATHER THAN IMPORTED, and that is what made this file\n *   separable at all. `ops.read` — now `readPoolStatus` (ceph-pool-wire.ts) — is a module-level\n *   binding in ceph-pool.ts; importing it back would be a runtime cycle, and duplicating it would\n *   be two definitions of one path. Passing it is the pattern zfs-pool-write.ts already uses.\n *   The error parameter preserves the reader's typed failures through settle; it is not `never`.\n */\nexport type PoolRead<E> = (\n  props: CephPoolProps,\n) => Effect.Effect<CephPoolAttributes | undefined, E, PveRequirements>;\n\n/**\n * ⛔ THE GUARD ON THE CREATE. The original read folded 403s/timeouts into absence, so this\n *   independent index check prevented creating over a live pool. The typed reader now\n *   propagates those failures, but a `CephPoolNotFound` must still not override a listed pool:\n *   the measured PG-merge risk warrants keeping both observations. Failed index reads also\n *   propagate. An empty list is trusted: the collection refuses a narrow role with 403 rather\n *   than filtering, so `[]` really does mean a cluster with no pools.\n *\n * ⚠️ `describe` IS STILL A PLAIN STRING (ceph-pool.ts builds it from `object`/`collection` in\n *   ceph-pool-form.ts) — this function no longer takes a `collection` PATH, since\n *   `nodes.listNodeCephPool` addresses the endpoint itself; the parameter list keeps `describe`\n *   only, to name the object in the refusal message.\n */\nexport const confirmAbsent = (props: CephPoolProps, describe: string) =>\n  runPve(props.target, 'read', false, nodes.listNodeCephPool({ node: props.node })).pipe(\n    Effect.flatMap((rows) =>\n      rows.some((row) => row.pool_name === props.name)\n        ? Effect.die(\n            new Error(\n              `${describe}: the cluster lists this pool but its status could not be read, ` +\n                'so this deploy will NOT create over it. Check that the node is up and that the ' +\n                'read role holds Sys.Audit or Datastore.Audit on / -- a create here would apply ' +\n                'pg_num to a live pool and start a PG merge.',\n            ),\n          )\n        : Effect.void,\n    ),\n  );\n\n/**\n * Wait for the cluster to agree, then answer the last thing it said.\n *\n * ★ IT POLLS `matches`, THE SAME PREDICATE `diff` USES, so \"settled\" has exactly one definition in\n *   this file. Polling `/nodes/{node}/tasks/{upid}/status` instead would read the worker's own\n *   exit status, but it needs `Sys.Audit` on the node for a token that is NOT the one that started\n *   the task — every `pve` call mints a fresh token, so the task's owner check cannot pass.\n * ⚠️ SHORT POLLS, LOW CAP: 2s apart, 30 tries, about a minute. A pool create takes seconds; one\n *   still unsettled after a minute is a fault to surface, not a wait to lengthen.\n */\nexport const settle = <E>(\n  props: CephPoolProps,\n  read: PoolRead<E>,\n  done: (live: CephPoolAttributes | undefined) => boolean,\n) =>\n  Effect.gen(function* () {\n    for (let attempt = 0; attempt < 30; attempt += 1) {\n      const live = yield* read(props);\n      if (done(live)) return live;\n      yield* Effect.sleep('2 seconds');\n    }\n    return yield* read(props);\n  });\n",
@@ -61,9 +61,11 @@
     "/** Named SDK operations; pve-firewall 6.0.5 Aliases.pm supplies exact absence and idempotent delete. */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as cluster from '@distilled.cloud/proxmox/cluster';\nimport { ProxmoxParseError } from '@distilled.cloud/proxmox/Errors';\nimport * as Effect from 'effect/Effect';\nimport type { FirewallAliasAttributes, FirewallAliasProps } from './firewall-alias.ts';\nimport { firewallAliasSpec as spec } from './firewall-alias-config.ts';\nimport { cidr, fold } from './firewall-alias-form.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { specGuards } from './resource-guard.ts';\nimport { formToSend } from './update-guard.ts';\n\nconst { guardCreate, guardUpdate } = specGuards(spec);\n\nexport const readFirewallAlias = (props: FirewallAliasProps) =>\n  runPve(props.target, 'read', false, cluster.getClusterFirewallAlias({ name: props.name })).pipe(\n    Effect.flatMap((live) => {\n      // Vendor's GET schema is bare object; read_alias returns the stored name/cidr entry.\n      // ⛔ A malformed successful read is not absence and must never authorize a POST.\n      if (\n        live === null ||\n        typeof live !== 'object' ||\n        Array.isArray(live) ||\n        !('name' in live) ||\n        typeof live.name !== 'string' ||\n        fold(live.name) !== fold(props.name) ||\n        !('cidr' in live) ||\n        typeof live.cidr !== 'string' ||\n        cidr(live.cidr) === ''\n      ) {\n        return Effect.fail(\n          new ProxmoxParseError({\n            body: undefined,\n            cause: 'Firewall alias response does not match the requested vendor identity',\n          }),\n        );\n      }\n      return Effect.succeed(spec.attributes({ ...live }, props));\n    }),\n    Effect.catchTag('FirewallAliasNotFound', () => Effect.succeed(undefined)),\n  );\n\n/** Vendor deletion silently removes a missing key. All actual SDK failures still propagate. */\nexport const deleteFirewallAlias = (props: FirewallAliasProps) =>\n  runPve(props.target, 'provision', true, cluster.deleteClusterFirewallAlias({ name: props.name }));\n\nexport const firewallAliasHandlers = {\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: FirewallAliasProps }) => readFirewallAlias(olds),\n  diff: Effect.fn(function* ({\n    news,\n    output,\n  }: {\n    news: Input<FirewallAliasProps>;\n    output: FirewallAliasAttributes | undefined;\n  }) {\n    if (!isResolved(news)) return undefined;\n    yield* guardCreate(news, output === undefined);\n    yield* guardUpdate(news);\n    if (output === undefined) return undefined;\n    // A case-only spelling is the same vendor key; a real rename remains create-first replacement.\n    if (fold(news.name) !== fold(output.name)) return { action: 'replace' } as const;\n    const live = yield* readFirewallAlias(news);\n    if (live === undefined) {\n      yield* guardCreate(news, true);\n      return { action: 'update' } as const;\n    }\n    return { action: spec.matches(live, news) ? 'noop' : 'update' } as const;\n  }),\n  reconcile: Effect.fn(function* ({ news }: { news: FirewallAliasProps }) {\n    const live = yield* readFirewallAlias(news);\n    yield* guardCreate(news, live === undefined);\n    yield* guardUpdate(news);\n    if (live === undefined) {\n      yield* runPve(\n        news.target,\n        'provision',\n        true,\n        cluster.createClusterFirewallAlias(spec.createForm(news)),\n      );\n    } else {\n      const form = formToSend(spec.matches, live, news, spec.updateForm(news));\n      if (form !== undefined)\n        yield* runPve(\n          news.target,\n          'provision',\n          true,\n          cluster.putClusterFirewallAlias({ ...form, name: news.name }),\n        );\n    }\n    const after = yield* readFirewallAlias(news);\n    if (after === undefined)\n      return yield* Effect.fail(\n        new Error(`${spec.path(news)}: write returned success but the resource is still absent`),\n      );\n    return after;\n  }),\n  delete: ({ olds }: { olds: FirewallAliasProps }) => deleteFirewallAlias(olds),\n};\n",
     "/**\n * A firewall alias on the wire: what PVE stores, and what it quietly changes on the way.\n *\n * ★ SPLIT OUT OF firewall-alias.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is the\n *   same one metric-server.ts and node-network.ts cut: this file answers \"what does the cluster do\n *   to a value\", firewall-alias.ts answers \"what is an alias and when has it changed\". Nothing here\n *   reads the cluster and nothing here decides a diff.\n *\n * ⛔ THE PUT IS A FULL REPLACE, WHICH IS THE EXACT INVERSE OF metric-server.ts — DO NOT COPY THAT\n *   FILE'S RULE OVER HERE. A metric server is a SectionConfig section and a PUT merges into it, so\n *   an omitted field SURVIVES and a managed optional needs a matching `delete=` or it can never be\n *   cleared. An alias is not: `update_alias` builds `$data = { name, cidr }`, adds `comment` only\n *   when it is truthy, and assigns the whole hash over the old one. So an omitted `comment` is\n *   CLEARED here, there is no `delete` parameter on this endpoint at all, and sending\n *   `comment=''` would be a second spelling of the same thing.\n *\n * ⚠️ THE SAME REPLACE MAKES `cidr` REQUIRED ON EVERY UPDATE. PVE's PUT schema does not mark it\n *   optional, and the Perl would build an entry with an undefined cidr if it could — so `body`\n *   below sends it on update as well as on create, rather than treating it as \"only send what\n *   changed\".\n */\nimport type { FirewallAliasProps } from './firewall-alias.ts';\nimport { text } from './values.ts';\n\n/**\n * The alias key, as PVE computes it.\n *\n * ⚠️ EVERY ENTRY POINT LOWERS THE NAME AND NOTHING LOWERS THE STORED ONE: create, read, update and\n *   delete all start `my $name = lc($param->{name})`, while the entry keeps `name => $param->{name}`\n *   as written. So this is identity, and the stored spelling is decoration. Used by `diff` to tell\n *   an edit from a different alias — a comparison of the raw names would call a re-capitalisation a\n *   replace, and delete an alias to put back the same one.\n */\nexport const fold = (name: string) => name.trim().toLowerCase();\n\n/**\n * A CIDR reduced to the one form PVE will hand back.\n *\n * ⛔ MEASURED by running the cluster's own `PVE::Firewall::parse_alias` on node-b (pve-manager 9.2.11,\n *   2026-09-13) — a pure function over a string, no config read and none written:\n *     `10.1.1.5/32`     -> `10.1.1.5`        a /32 host suffix is STRIPPED\n *     `2001:0DB8::1/128`-> `2001:0DB8::1`    a /128 is stripped, and the case is NOT folded\n *     `2001:db8::/32`   -> `2001:db8::/32`   a /32 on IPv6 is a real prefix and SURVIVES\n *   `parse_ip_or_cidr` is where it happens: `s|/32$||` under the IPv4 branch and `s|/128$||` under\n *   the IPv6 one. Unmatched, a declared `10.1.1.5/32` reads back as `10.1.1.5` and reports an\n *   update on every plan for the rest of time, each deploy writing back a value it already holds.\n *\n * ⛔ SO THE STRIP IS VERSION-AWARE, AND AN UNCONDITIONAL `/32` WOULD CORRUPT THE COMPARISON. A\n *   colon cannot appear in an IPv4 address and must appear in an IPv6 one, which is the whole\n *   discriminator PVE's own two regexes come down to here. Reading `2001:db8::/32` as\n *   `2001:db8::` would make a /32 prefix compare equal to a single host.\n *\n * ⚠️ AND IT STOPS THERE, ON PURPOSE. PVE does not lowercase, zero-pad or compress an IPv6 literal,\n *   so neither may this: it stores what it was handed and gives that back, which means any spelling\n *   is stable once written. Canonicalising further would make `matches` call two DIFFERENT stored\n *   strings equal and report noop over real drift — the same lie as missing a rewrite, pointed the\n *   other way.\n */\nexport const cidr = (value: unknown) => {\n  const raw = text(value).trim();\n  const host = raw.includes(':') ? '/128' : '/32';\n  return raw.endsWith(host) ? raw.slice(0, -host.length) : raw;\n};\n\n/**\n * A comment reduced to the one form PVE will hand back.\n *\n * ⚠️ AN ALIAS COMMENT IS A TRAILING `#` ON ITS LINE IN `cluster.fw`, AND THE ROUND TRIP TRIMS IT.\n *   MEASURED with the same parser run: `Cmt 10.2.0.0/16 #   spaced comment   ` comes back as\n *   `spaced comment`. `parse_alias` strips the surrounding whitespace (`s/\\s*#\\s*(.*?)\\s*$//`) and\n *   `format_aliases` refuses to write a blank one at all, so an untrimmed declaration would diff\n *   against its own stored form forever.\n *\n * ⛔ A COMMENT OF EXACTLY `0` CANNOT BE STORED, AND READING THAT AS DRIFT WOULD LOOP FOREVER.\n *   MEASURED: `Zero 10.3.0.0/16 # 0` parses to an entry with NO comment key. Both the create and\n *   the update guard with Perl's `if $param->{comment}`, and `'0'` is false in Perl — so the string\n *   is dropped before it ever reaches the file, on write as well as on read. Folded to `''` here\n *   because that is what the cluster will do with it: a declaration asking for something PVE will\n *   not keep should plan as noop and be documented, not diff on every plan and be unfixable by the\n *   very PUT the diff asks for.\n *\n * ⚠️ A LINE FEED IS A 400, NOT A TRUNCATION. `pve_fw_verify_comment_spec` dies with \"comment must\n *   not contain a line feed\", which is the honest answer and is left to PVE rather than silently\n *   flattened here — flattening would store something the declaration did not say.\n */\nexport const comment = (value: unknown) => {\n  const trimmed = text(value).trim();\n  return trimmed === '0' ? '' : trimmed;\n};\n\n/**\n * Everything mutable, in the form PVE wants. Create adds `name`; update sends exactly this.\n *\n * ⚠️ `name` IS NOT SENT ON UPDATE BECAUSE IT IS ALREADY THE LAST SEGMENT OF THE PATH BEING PUT TO,\n *   and a second copy can only disagree with it — the same reasoning metric-server.ts gives for\n *   omitting its `id`. PVE takes the path segment as `$param->{name}` and writes it back as the\n *   stored spelling, so a PUT for any other reason also re-capitalises the entry to match the\n *   declaration. That is a side effect worth knowing about and not worth causing on its own.\n *\n * ⚠️ THE NORMALISED CIDR IS WHAT GETS WRITTEN, NOT THE DECLARED SPELLING. PVE stores the parameter\n *   verbatim into `cluster.fw` and only strips the host suffix when it reads the file back, so\n *   sending `10.1.1.5` rather than `10.1.1.5/32` leaves the file saying exactly what the next read\n *   will answer. Both settle; this one leaves no pair of values that merely happen to agree.\n *\n * ⚠️ `rename` IS DELIBERATELY ABSENT — see the ⚠️ on renames in firewall-alias.ts. A `rename` in\n *   this form would be a second, invisible identity for the object, set from a field the resource\n *   does not have.\n */\nexport const body = (props: FirewallAliasProps): Record<string, string> & { cidr: string } => {\n  const note = comment(props.comment);\n  return { cidr: cidr(props.cidr), ...(note === '' ? {} : { comment: note }) };\n};\n",
     "/** Existing alias normalization and forms, independent of the named SDK transport. */\nimport type { FirewallAliasAttributes, FirewallAliasProps } from './firewall-alias.ts';\nimport type { PveSpec } from './resource-spec.ts';\nimport { body, cidr, comment } from './firewall-alias-form.ts';\nimport { int, text } from './values.ts';\n\nexport const firewallAliasSpec = {\n  /** The SDK read refuses malformed successful payloads before applying these normalizers. */\n  attributes: (live, props) => {\n    const address = cidr(live['cidr']);\n    return {\n      cidr: address,\n      comment: comment(live['comment']),\n      ipversion: int(live['ipversion'], 0),\n      /** The read checks identity; the stored spelling is preserved for display. */\n      name: text(live['name'], props.name),\n    };\n  },\n  collection: () => 'cluster/firewall/aliases',\n  createForm: (props) => ({ ...body(props), name: props.name }),\n  /**\n   * ⚠️ EXACTLY THE TWO FIELDS A PUT CAN PUT BACK, both sides through the same normalisers. `name`\n   *   is identity and case-only drift (see the header); `ipversion` is derived and unwritable.\n   *   Comparing either would report an update that no update can settle.\n   */\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: {\n    create: 'pve:POST /cluster/firewall/aliases',\n    update: 'pve:PUT /cluster/firewall/aliases/{name}',\n  },\n  matches: (attributes, props) =>\n    attributes.cidr === cidr(props.cidr) && attributes.comment === comment(props.comment),\n  /**\n   * ⚠️ UNESCAPED ON PURPOSE: `pve-fw-alias` admits only `[A-Za-z][A-Za-z0-9\\-\\_]+`, so there is no\n   *   character here that a URL would need to encode, and PVE lowercases the segment on arrival.\n   */\n  path: (props) => `cluster/firewall/aliases/${props.name}`,\n  updateForm: body,\n} satisfies PveSpec<FirewallAliasProps, FirewallAliasAttributes>;\n",
-    "/**\n * `Proxmox.Group` — a PVE group: a name, a comment, and the set of users PVE hangs off it.\n *\n * ★ DECLARING `hf-mint` IS THE WHOLE POINT OF THIS FAMILY. `mint@pve` holds the `MintTokens` role\n *   ON THE PATH `/access/groups/hf-mint` — measured from `GET /access/acl`, 2026-09-13 — which is\n *   what confines the OpenBao proxmox engine to minting inside that one group. The group is the\n *   fence around the credential every other resource in this package runs on, and until now it was\n *   something a human typed on a node once. `user.ts` calls that account the branch it sits on;\n *   this is the branch's other end.\n *\n * ⛔ MEMBERSHIP IS NOT SETTABLE HERE, SO IT IS REPORTED AND NEVER DIFFED. Measured from the\n *   cluster's own schema: `POST /access/groups` and `PUT /access/groups/{groupid}` each accept\n *   EXACTLY `groupid` and `comment`, both with `additionalProperties: 0`. There is no members\n *   parameter to send. Membership is written from the other side — the `groups` field on each\n *   USER, which `user.ts` already owns — so `members` below is an attribute, out of `matches`,\n *   exactly like `pool.members` and `user.tokens`. Declared here it would be a diff that no write\n *   in this file could ever settle.\n *\n * ⛔ THE INDEX AND THE ITEM DISAGREE ABOUT BOTH THE NAME AND THE TYPE, and this file reads only the\n *   item. MEASURED against node-b, 2026-09-13:\n *     GET /access/groups         -> [{\"groupid\":\"hf-mint\",\"comment\":\"…\",\n *                                     \"users\":\"hf-provision@pve,hf-read@pve\"}, …]\n *     GET /access/groups/hf-mint -> {\"comment\":\"…\",\"members\":[\"hf-provision@pve\",\"hf-read@pve\"]}\n *   The index says `users` and hands back a COMMA STRING; the item says `members` and hands back an\n *   ARRAY. distilled's generator reflects the SAME split (`GetAccessGroupResponse.members: string[]`\n *   vs `ListAccessGroupsResponseBodyItem.users?: string`), so reading the item is what keeps this\n *   file on the array shape it already normalises.\n *\n * ⛔ AND THE ITEM'S ORDER IS NOT STABLE BETWEEN TWO CONSECUTIVE CALLS. MEASURED, seconds apart, on\n *   the same endpoint:\n *     [\"root@pam\",\"alice@pve\",\"alice@pam\",\"alice@example.com@corp\"]\n *     [\"alice@pam\",\"alice@pve\",\"alice@example.com@corp\",\"root@pam\"]\n *   `read_group` builds it as `[keys %{ $data->{users} }]` — a bare Perl hash key list, whose order\n *   is randomised per process — while the INDEX sorts (`join(',', sort keys …)`). So the array is\n *   sorted on the way into `attributes` as well as being kept out of `matches`: unsorted, Alchemy's\n *   stored state would churn on every read even with nothing to diff.\n *\n * ⚠️ `groupid` IS NOT ECHOED BY THE ITEM READ. Its return schema is `additionalProperties: 0` over\n *   exactly `comment` and `members`, so the id comes from props — the same arrangement, and the\n *   same reason, as `user.ts`.\n *\n * ★ PRIVILEGES: NOTHING HAD TO BE WIDENED. Measured with `pveum user permissions`, 2026-09-13:\n *     · item GET checks `['perm','/access/groups',['Sys.Audit','Group.Allocate'], any => 1]`, and\n *       `hf-read@pve` already holds `Sys.Audit` there. So `readAttributes` below reads with the\n *       default `read` role — unlike acl.ts, user.ts and api-token.ts, whose item/list reads PVE\n *       gates on an allocate privilege the 3600s read lease does not hold.\n *     · POST, PUT and DELETE each check `Group.Allocate` on `/access/groups`, and\n *       `hf-provision@pve` holds it via the provision role (`PROVISION_PRIVILEGES`).\n *\n * ⛔ `retain` BY DEFAULT, BECAUSE DELETING A GROUP DESTROYS TWO THINGS THIS FILE CANNOT PUT BACK.\n *   Measured in `PVE::AccessControl` on the node:\n *     · The member list IS the group. `user.cfg` stores it on the GROUP line and DERIVES each\n *       user's `groups` map from it at parse time. Deleting the group deletes the list, and this\n *       resource has no `members` prop to restore it from.\n *     · `delete_group_acl` then walks the whole ACL tree and drops every grant where the group is\n *       the SUBJECT. On this cluster that is `admins -> Administrator on /` and\n *       `automation -> PVEAuditor on /`: whole populations of access, gone in one call, with no\n *       confirmation and nothing in the plan to suggest it.\n *   `delete` is FULLY IMPLEMENTED — `DELETE /access/groups/{groupid}` exists — so\n *   `.pipe(RemovalPolicy.destroy())` really removes the group.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s\n *   typed `access.getAccessGroup`/`createAccessGroup`/`putAccessGroup`/`deleteAccessGroup`\n *   (2026-09-24, decision 43's proxmox walk-down, access sub-area, second resource after Acl).\n *   `distilled-pve.ts`'s `runPve` replaces `pve()` as in acl.ts; the CRIES-WOLF FIX\n *   (unreadable-read.ts) is wired the same way: a refused `provision` mint on the WRITE-side\n *   guard, or a refused `read` mint on the plain read, reports `noop` with a warning rather than\n *   forcing `update` with nothing compared.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as access from '@distilled.cloud/proxmox/access';\nimport * as Effect from 'effect/Effect';\nimport { guardWrite } from './distilled-guard.ts';\nimport {\n  GROUP_CREATE,\n  GROUP_UPDATE,\n  createForm,\n  dropUnreadable,\n  matches,\n  readGroup,\n  readGroupOrFail,\n  updateForm,\n} from './group-wire.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { UNREADABLE, unreadableWarning } from './unreadable-read.ts';\n\nexport interface GroupProps extends WithTarget {\n  /**\n   * PVE's primary key for a group.\n   *\n   * ⚠️ THERE IS NO RENAME, AND THE FAILURE IS WORSE HERE THAN FOR A ROLE. Editing this makes `path`\n   *   point at a different group, which reads as absent and is created empty — while the old group\n   *   keeps its members and its ACL grants with nobody managing it. Two groups then both look\n   *   right in the UI and only one of them grants anything.\n   */\n  groupid: string;\n  /** Free text shown in the UI — the only mutable field a group has. See `storedComment` below. */\n  comment?: string;\n}\n\nexport interface GroupAttributes {\n  groupid: string;\n  comment: string;\n  /**\n   * Who is in the group, sorted — reported so a plan can say what a delete would strip, never\n   * compared, because this endpoint cannot set it. See the two ⛔s in the header.\n   */\n  members: string[];\n}\n\nexport interface ProxmoxGroup extends Resource<\n  'Proxmox.Group',\n  GroupProps,\n  GroupAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a delete takes the membership and the group's grants. See the header. */\nexport const ProxmoxGroup = Resource<ProxmoxGroup>('Proxmox.Group', {\n  defaultRemovalPolicy: 'retain',\n});\n\nexport const ProxmoxGroupProvider = () =>\n  Provider.effect(\n    ProxmoxGroup,\n    Effect.succeed(\n      ProxmoxGroup.Provider.of({\n        /**\n         * ⛔ THE EMPTY `list` MATTERS HERE. `GET /access/groups` answers every group on the\n         *   cluster, `admins` (grants `Administrator` on `/`) included. Adoption stays explicit.\n         */\n        list: () => Effect.succeed([]),\n        // ⚠️ FOLDS ONLY WHEN `output` IS `undefined` — MEASURED 2026-09-24, an adversarial review\n        //   of this very fix caught the gap. The engine calls this ONE hook from FOUR places\n        //   (alchemy/src/{Plan,Apply,Drift}.ts), and only `output` tells them apart: Plan.ts's\n        //   cold-start adoption probe and interrupted-create recovery, and Apply.ts's\n        //   delete-recovery, all pass `output: undefined` — nothing is confirmed to exist yet, so\n        //   `readGroup`'s fold is still needed there or a brand-new group could never be adopted\n        //   or created. `Drift.ts` (`alchemy drift`/`sync`/`deploy --detect-drift`) is different:\n        //   it calls this on an ALREADY-CONFIRMED row (`output: old.attr`, defined), exactly\n        //   `diff`'s own situation below — a transient failure folded to `undefined` there is\n        //   reported as `{action: 'missing'}` with NO error at all, the cries-wolf bug again, one\n        //   command over. `readGroupOrFail` on that branch propagates it instead.\n        read: Effect.fn(function* ({ olds, output }) {\n          return dropUnreadable(\n            yield* output === undefined ? readGroup(olds) : readGroupOrFail(olds),\n          );\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(GROUP_CREATE, createForm(news), output === undefined);\n          yield* guardWrite(GROUP_UPDATE, updateForm(news), false);\n          if (output === undefined) return undefined;\n          // ⚠️ `readGroupOrFail`, NOT `readGroup` — see that function's own ⛔. A genuine\n          //   TRANSIENT failure here propagates and fails the whole plan loudly instead of\n          //   folding to \"absent\" and forcing a false update, the cries-wolf class of bug.\n          const live = yield* readGroupOrFail(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force\n          //   `update` on a group that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning('Proxmox.Group', news.groupid);\n            return { action: 'noop' } as const;\n          }\n          if (live === undefined) {\n            // Drift: state says this group exists, the cluster disagrees. reconcile recreates it.\n            yield* guardWrite(GROUP_CREATE, createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          return matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the\n          //   write below (same lease-cache key), so `UNREADABLE` here is a narrow race, not the\n          //   routine case `diff` handles. ⛔ UNLIKE acl.ts's PUT-only bind, a group's create is\n          //   NOT idempotent the same way: if this narrow race DOES land as `undefined` while the\n          //   group is genuinely already there, PVE answers \"group already exists\" rather than\n          //   silently converging — a loud failure, not a silent duplicate.\n          const before = dropUnreadable(yield* readGroup(news));\n          yield* guardWrite(GROUP_CREATE, createForm(news), before === undefined);\n          yield* guardWrite(GROUP_UPDATE, updateForm(news), false);\n          if (before === undefined) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              access.createAccessGroup(createForm(news)),\n            );\n          } else if (!matches(before, news)) {\n            yield* runPve(news.target, 'provision', true, access.putAccessGroup(updateForm(news)));\n          }\n          const after = dropUnreadable(yield* readGroup(news));\n          if (after === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `access/groups/${news.groupid}: the write returned no error but the group is ` +\n                  'still absent. PVE wraps every answer in {\"data\":...} and can report success ' +\n                  'on a call that did nothing -- read back rather than trusting the status code.',\n              ),\n            );\n          }\n          return after;\n        }),\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            access.deleteAccessGroup({ groupid: olds.groupid }),\n          );\n        }),\n      }),\n    ),\n  );\n",
+    "/**\n * `Proxmox.Group` — a PVE group: a name, a comment, and the set of users PVE hangs off it.\n *\n * ★ DECLARING `hf-mint` IS THE WHOLE POINT OF THIS FAMILY. `mint@pve` holds the `MintTokens` role\n *   ON THE PATH `/access/groups/hf-mint` — measured from `GET /access/acl`, 2026-09-13 — which is\n *   what confines the OpenBao proxmox engine to minting inside that one group. The group is the\n *   fence around the credential every other resource in this package runs on, and until now it was\n *   something a human typed on a node once. `user.ts` calls that account the branch it sits on;\n *   this is the branch's other end.\n *\n * ⛔ MEMBERSHIP IS NOT SETTABLE HERE, SO IT IS REPORTED AND NEVER DIFFED. Measured from the\n *   cluster's own schema: `POST /access/groups` and `PUT /access/groups/{groupid}` each accept\n *   EXACTLY `groupid` and `comment`, both with `additionalProperties: 0`. There is no members\n *   parameter to send. Membership is written from the other side — the `groups` field on each\n *   USER, which `user.ts` already owns — so `members` below is an attribute, out of `matches`,\n *   exactly like `pool.members` and `user.tokens`. Declared here it would be a diff that no write\n *   in this file could ever settle.\n *\n * ⛔ THE INDEX AND THE ITEM DISAGREE ABOUT BOTH THE NAME AND THE TYPE, and this file reads only the\n *   item. MEASURED against node-b, 2026-09-13:\n *     GET /access/groups         -> [{\"groupid\":\"hf-mint\",\"comment\":\"…\",\n *                                     \"users\":\"hf-provision@pve,hf-read@pve\"}, …]\n *     GET /access/groups/hf-mint -> {\"comment\":\"…\",\"members\":[\"hf-provision@pve\",\"hf-read@pve\"]}\n *   The index says `users` and hands back a COMMA STRING; the item says `members` and hands back an\n *   ARRAY. distilled's generator reflects the SAME split (`GetAccessGroupResponse.members: string[]`\n *   vs `ListAccessGroupsResponseBodyItem.users?: string`), so reading the item is what keeps this\n *   file on the array shape it already normalises.\n *\n * ⛔ AND THE ITEM'S ORDER IS NOT STABLE BETWEEN TWO CONSECUTIVE CALLS. MEASURED, seconds apart, on\n *   the same endpoint:\n *     [\"root@pam\",\"alice@pve\",\"alice@pam\",\"alice@example.com@corp\"]\n *     [\"alice@pam\",\"alice@pve\",\"alice@example.com@corp\",\"root@pam\"]\n *   `read_group` builds it as `[keys %{ $data->{users} }]` — a bare Perl hash key list, whose order\n *   is randomised per process — while the INDEX sorts (`join(',', sort keys …)`). So the array is\n *   sorted on the way into `attributes` as well as being kept out of `matches`: unsorted, Alchemy's\n *   stored state would churn on every read even with nothing to diff.\n *\n * ⚠️ `groupid` IS NOT ECHOED BY THE ITEM READ. Its return schema is `additionalProperties: 0` over\n *   exactly `comment` and `members`, so the id comes from props — the same arrangement, and the\n *   same reason, as `user.ts`.\n *\n * ★ PRIVILEGES: NOTHING HAD TO BE WIDENED. Measured with `pveum user permissions`, 2026-09-13:\n *     · item GET checks `['perm','/access/groups',['Sys.Audit','Group.Allocate'], any => 1]`, and\n *       `hf-read@pve` already holds `Sys.Audit` there. So `readAttributes` below reads with the\n *       default `read` role — unlike acl.ts, user.ts and api-token.ts, whose item/list reads PVE\n *       gates on an allocate privilege the 3600s read lease does not hold.\n *     · POST, PUT and DELETE each check `Group.Allocate` on `/access/groups`, and\n *       `hf-provision@pve` holds it via the provision role (`PROVISION_PRIVILEGES`).\n *\n * ⛔ `retain` BY DEFAULT, BECAUSE DELETING A GROUP DESTROYS TWO THINGS THIS FILE CANNOT PUT BACK.\n *   Measured in `PVE::AccessControl` on the node:\n *     · The member list IS the group. `user.cfg` stores it on the GROUP line and DERIVES each\n *       user's `groups` map from it at parse time. Deleting the group deletes the list, and this\n *       resource has no `members` prop to restore it from.\n *     · `delete_group_acl` then walks the whole ACL tree and drops every grant where the group is\n *       the SUBJECT. On this cluster that is `admins -> Administrator on /` and\n *       `automation -> PVEAuditor on /`: whole populations of access, gone in one call, with no\n *       confirmation and nothing in the plan to suggest it.\n *   `delete` is FULLY IMPLEMENTED — `DELETE /access/groups/{groupid}` exists — so\n *   `.pipe(RemovalPolicy.destroy())` really removes the group.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s\n *   typed `access.getAccessGroup`/`createAccessGroup`/`putAccessGroup`/`deleteAccessGroup`\n *   (2026-09-24, decision 43's proxmox walk-down, access sub-area, second resource after Acl).\n *   `distilled-pve.ts`'s `runPve` replaces `pve()` as in acl.ts; the CRIES-WOLF FIX\n *   (unreadable-read.ts) is wired the same way: a refused `provision` mint on the WRITE-side\n *   guard, or a refused `read` mint on the plain read, reports `noop` with a warning rather than\n *   forcing `update` with nothing compared.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as access from '@distilled.cloud/proxmox/access';\nimport * as Effect from 'effect/Effect';\nimport { guardWrite } from './distilled-guard.ts';\nimport {\n  GROUP_CREATE,\n  GROUP_UPDATE,\n  createForm,\n  dropUnreadable,\n  matches,\n  readGroup,\n  readGroupOrFail,\n  updateForm,\n} from './group-wire.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { mintTier } from './credentials.ts';\nimport { UNREADABLE, unreadableWarning } from './unreadable-read.ts';\n\nexport interface GroupProps extends WithTarget {\n  /**\n   * PVE's primary key for a group.\n   *\n   * ⚠️ THERE IS NO RENAME, AND THE FAILURE IS WORSE HERE THAN FOR A ROLE. Editing this makes `path`\n   *   point at a different group, which reads as absent and is created empty — while the old group\n   *   keeps its members and its ACL grants with nobody managing it. Two groups then both look\n   *   right in the UI and only one of them grants anything.\n   */\n  groupid: string;\n  /** Free text shown in the UI — the only mutable field a group has. See `storedComment` below. */\n  comment?: string;\n}\n\nexport interface GroupAttributes {\n  groupid: string;\n  comment: string;\n  /**\n   * Who is in the group, sorted — reported so a plan can say what a delete would strip, never\n   * compared, because this endpoint cannot set it. See the two ⛔s in the header.\n   */\n  members: string[];\n}\n\nexport interface ProxmoxGroup extends Resource<\n  'Proxmox.Group',\n  GroupProps,\n  GroupAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a delete takes the membership and the group's grants. See the header. */\nexport const ProxmoxGroup = Resource<ProxmoxGroup>('Proxmox.Group', {\n  defaultRemovalPolicy: 'retain',\n});\n\nexport const ProxmoxGroupProvider = () =>\n  Provider.effect(\n    ProxmoxGroup,\n    Effect.succeed(\n      ProxmoxGroup.Provider.of({\n        /**\n         * ⛔ THE EMPTY `list` MATTERS HERE. `GET /access/groups` answers every group on the\n         *   cluster, `admins` (grants `Administrator` on `/`) included. Adoption stays explicit.\n         */\n        list: () => Effect.succeed([]),\n        // ⚠️ FOLDS ONLY WHEN `output` IS `undefined` — MEASURED 2026-09-24, an adversarial review\n        //   of this very fix caught the gap. The engine calls this ONE hook from FOUR places\n        //   (alchemy/src/{Plan,Apply,Drift}.ts), and only `output` tells them apart: Plan.ts's\n        //   cold-start adoption probe and interrupted-create recovery, and Apply.ts's\n        //   delete-recovery, all pass `output: undefined` — nothing is confirmed to exist yet, so\n        //   `readGroup`'s fold is still needed there or a brand-new group could never be adopted\n        //   or created. `Drift.ts` (`alchemy drift`/`sync`/`deploy --detect-drift`) is different:\n        //   it calls this on an ALREADY-CONFIRMED row (`output: old.attr`, defined), exactly\n        //   `diff`'s own situation below — a transient failure folded to `undefined` there is\n        //   reported as `{action: 'missing'}` with NO error at all, the cries-wolf bug again, one\n        //   command over. `readGroupOrFail` on that branch propagates it instead.\n        read: Effect.fn(function* ({ olds, output }) {\n          return dropUnreadable(\n            yield* output === undefined ? readGroup(olds) : readGroupOrFail(olds),\n          );\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(GROUP_CREATE, createForm(news), output === undefined);\n          yield* guardWrite(GROUP_UPDATE, updateForm(news), false);\n          if (output === undefined) return undefined;\n          // ⚠️ `readGroupOrFail`, NOT `readGroup` — see that function's own ⛔. A genuine\n          //   TRANSIENT failure here propagates and fails the whole plan loudly instead of\n          //   folding to \"absent\" and forcing a false update, the cries-wolf class of bug.\n          const live = yield* readGroupOrFail(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force\n          //   `update` on a group that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning(\n              'Proxmox.Group',\n              news.groupid,\n              news.target.mount,\n              mintTier(news.target, 'read'),\n            );\n            return { action: 'noop' } as const;\n          }\n          if (live === undefined) {\n            // Drift: state says this group exists, the cluster disagrees. reconcile recreates it.\n            yield* guardWrite(GROUP_CREATE, createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          return matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the\n          //   write below (same lease-cache key), so `UNREADABLE` here is a narrow race, not the\n          //   routine case `diff` handles. ⛔ UNLIKE acl.ts's PUT-only bind, a group's create is\n          //   NOT idempotent the same way: if this narrow race DOES land as `undefined` while the\n          //   group is genuinely already there, PVE answers \"group already exists\" rather than\n          //   silently converging — a loud failure, not a silent duplicate.\n          const before = dropUnreadable(yield* readGroup(news));\n          yield* guardWrite(GROUP_CREATE, createForm(news), before === undefined);\n          yield* guardWrite(GROUP_UPDATE, updateForm(news), false);\n          if (before === undefined) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              access.createAccessGroup(createForm(news)),\n            );\n          } else if (!matches(before, news)) {\n            yield* runPve(news.target, 'provision', true, access.putAccessGroup(updateForm(news)));\n          }\n          const after = dropUnreadable(yield* readGroup(news));\n          if (after === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `access/groups/${news.groupid}: the write returned no error but the group is ` +\n                  'still absent. PVE wraps every answer in {\"data\":...} and can report success ' +\n                  'on a call that did nothing -- read back rather than trusting the status code.',\n              ),\n            );\n          }\n          return after;\n        }),\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            access.deleteAccessGroup({ groupid: olds.groupid }),\n          );\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * `Proxmox.Group`'s wire shape: PVE's create/update forms, how a live item becomes attributes,\n * and the read itself. Split out of group.ts (2026-09-24) to keep that file under the 250-line\n * cap — the api-token.ts/api-token-form.ts seam, same reasoning as acl.ts/acl-wire.ts.\n */\nimport * as access from '@distilled.cloud/proxmox/access';\nimport * as Effect from 'effect/Effect';\nimport { runPve } from './distilled-pve.ts';\nimport type { GroupAttributes, GroupProps } from './group.ts';\nimport { UNREADABLE, type Unreadable, readOrUnreadable } from './unreadable-read.ts';\nimport { csv, text } from './values.ts';\n\nexport const GROUP_CREATE = 'pve:POST /access/groups';\nexport const GROUP_UPDATE = 'pve:PUT /access/groups/{groupid}';\n\n/**\n * The comment PVE will actually END UP HOLDING for a given declaration.\n *\n * ⛔ PVE CANNOT STORE THE COMMENT `'0'`, AND A PROVIDER THAT DOES NOT MODEL THAT DIFFS FOREVER.\n *   `create_group`/`write_user_config`/the config parser all test the comment for TRUTH, and in\n *   Perl the one-character string `'0'` is false. So a declared `comment: '0'` is accepted by the\n *   API, dropped on the way to `user.cfg`, and read back as absent. Normalising BOTH sides is how\n *   `values.ts` already treats `''` as the absence of a boolean rather than as `false`.\n */\nexport const storedComment = (comment: string | undefined) => {\n  const value = comment ?? '';\n  return value === '0' ? '' : value;\n};\n\n/** The item read's `members` array, sorted into something two plans can agree on — group.ts's header. */\nconst memberList = (live: readonly string[]): string[] => {\n  const joined = csv(live.map((member) => text(member)));\n  return joined === '' ? [] : joined.split(',');\n};\n\nexport const createForm = (props: GroupProps): access.CreateAccessGroupRequest => ({\n  comment: storedComment(props.comment),\n  groupid: props.groupid,\n});\n\n/** ⚠️ ALWAYS SENT, EVEN EMPTY — that is how a comment is CLEARED (see group.ts's own header). */\nexport const updateForm = (props: GroupProps): access.PutAccessGroupRequest => ({\n  comment: storedComment(props.comment),\n  groupid: props.groupid,\n});\n\nconst attributesOf = (live: access.GetAccessGroupResponse, props: GroupProps): GroupAttributes => ({\n  /**\n   * ⚠️ ABSENT IS EMPTY, NOT MISSING — `read_group` sets `comment` only `if defined(…)`. distilled\n   *   types it `comment?: string`, so `text()`'s `''` fallback meets the same normalisation.\n   */\n  comment: text(live.comment),\n  /** ⚠️ FROM PROPS — the item read never echoes the id back. */\n  groupid: props.groupid,\n  members: memberList(live.members),\n});\n\n/**\n * ⚠️ `members` IS NOT COMPARED, AND NOTHING ELSE IS LEFT TO COMPARE. `comment` is the only field\n *   a PUT here accepts, so it is the only field whose drift this provider can repair.\n */\nexport const matches = (attributes: GroupAttributes, props: GroupProps) =>\n  attributes.comment === storedComment(props.comment);\n\n/**\n * ★ Default `read` role — nothing widened for this family, see group.ts's header privileges note.\n * ⛔ `{ groupid: props.groupid }`, NEVER THE WHOLE `props` — MEASURED 2026-09-24, the regression\n *   in kit 0.31.1. `GetAccessGroupRequest`'s schema declares only `groupid` (a path label); any\n *   OTHER key on the object passed to `access.getAccessGroup` — `target`, `comment`, every field\n *   this family's own props carry — is treated by distilled's `buildRequest` as an \"unknown key\"\n *   and JSON-encoded onto the request as a BODY, on every one of these bodyless GETs. A stricter\n *   fetch client than a bare `bun run` of this file refuses a GET carrying any body at all\n *   (`TypeError [ERR_INVALID_ARG_VALUE]: fetch() request with GET/HEAD method cannot have body`),\n *   which `runPveWith` retries across every member and exhausts identically —\n *   `PveClusterExhausted`, then silently folded to \"absent\" by the old `orElseSucceed`, forcing a\n *   false `update` on every group. `role.ts`'s list call and acl.ts's `listAccessAcl({})` were\n *   never at risk: both are always called with a literal `{}`.\n * ⛔ `live.members === undefined` IS DEFENSIVE, NOT THE ABSENCE SIGNAL — CORRECTED 2026-09-24.\n *   This file previously claimed a missing group answers 200 with `{\"data\":null}`, unwrapped to\n *   `{}`. MEASURED against the live cluster: `GET /access/groups/{missing}` answers a genuine 500\n *   (\"group '…' does not exist\"), the SAME shape as user.ts's own measured 500 — there is no\n *   success-path absence signal here at all. The check stays as insurance against a future PVE\n *   release that does answer `{}`, but this function is what actually carries the \"not found\"\n *   case, as a thrown error — `readGroup` below is the one that folds it.\n */\nexport const readGroupOrFail = (props: GroupProps) =>\n  readOrUnreadable(\n    runPve(props.target, 'read', false, access.getAccessGroup({ groupid: props.groupid })),\n  ).pipe(\n    Effect.map((live) =>\n      live === UNREADABLE\n        ? UNREADABLE\n        : live.members === undefined\n          ? undefined\n          : attributesOf(live, props),\n    ),\n  );\n\n/**\n * ⛔ ONLY `GroupNotFound` MEANS ABSENT. The initial distilled transport swap preserved a\n *   catch-all fold because PVE reports missing objects as HTTP 500. SDK PR 265 now types that\n *   measured message, so permission errors, unrelated 500s and exhausted transports propagate\n *   instead of triggering a speculative create (decision 49 follow-up, 2026-09-24).\n * ★ `readGroupOrFail` remains the strict path used for an already-confirmed state row. This\n *   change narrows cold reads/reconcile without changing that existing drift/diff contract.\n */\nexport const readGroup = (props: GroupProps) =>\n  readGroupOrFail(props).pipe(Effect.catchTag('GroupNotFound', () => Effect.succeed(undefined)));\n\n/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */\nexport const dropUnreadable = (live: GroupAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n",
     "/**\n * `Proxmox.HaResource` — a guest's HA membership, declared.\n *\n * ★ WITHOUT ONE OF THESE, EVERY GUEST THIS PACKAGE DECLARES IS PINNED TO THE NODE THE LINE NAMED\n *   AND DIES WITH IT. The target is a three-node quorate cluster holding zero HA resources, so\n *   `node` in `LxcProps` is the whole of a container's availability story: lose that node and the\n *   container is simply gone until a person notices. Declaring a guest without declaring its HA\n *   membership is half a declaration, which is why this lives beside `lxc.ts` rather than in a\n *   runbook somebody reads after an outage.\n *\n * ⚠️ `state` READS LIKE STATUS AND IS CONFIGURATION. `started | stopped | disabled | ignored` is\n *   the state the CRM is ASKED for; a line in the HA config file, not a reading off the cluster,\n *   so it is a prop and it is compared. `LxcAttributes.status` is the opposite case — reported,\n *   never declared — and confusing the two inverts the meaning: `state: 'stopped'` here says \"HA\n *   should hold this guest stopped and still relocate it on node failure\", not \"it is stopped\".\n *\n * ⛔ AND YET IT MOVES POWER, WHICH IS THE ONE PLACE THIS PACKAGE'S \"PLANS DO NOT START THINGS\" RULE\n *   BENDS. `lxc.ts` and `qemu.ts` refuse to own power state precisely so a deploy is not a\n *   maintenance window — but the CRM acts on whatever this file says. The default `started` will\n *   BOOT a stopped guest within seconds of the write, and `stopped` will SHUT DOWN a running one.\n *   There is no way to declare HA membership without declaring intent, so the intent is at least\n *   explicit and diffable here; read a plan that touches `state` as a plan that touches uptime.\n *\n * ⛔ `sid` CARRIES ITS TYPE PREFIX — `ct:101`, `vm:100` — AND READ ANSWERS IN THE PREFIXED FORM.\n *   POST also takes the bare `101` shortcut; taking it would leave a resource keyed on a spelling\n *   PVE never returns, and every plan comparing `101` against `ct:101`. So the prefixed form is\n *   required here and it is what goes into the path.\n *   ⚠️ EDITING `sid` IN PLACE ORPHANS THE OLD MEMBERSHIP. `diff` reads the NEW path, finds nothing\n *     and calls that drift, so reconcile creates the new entry and the old one stays under HA with\n *     nothing declaring it. Retire the declaration and add a second one instead of renaming.\n *\n * ⛔ MEASURED ON PVE 9.2: `/cluster/ha/groups` ANSWERS HTTP 500 — groups were removed in PVE 9,\n *   even though the published API schema still documents the endpoint AND a `group` parameter on\n *   this very resource. Nothing here sends `group`. The successor is `/cluster/ha/rules`\n *   (node-affinity and resource-affinity) and that is the next family to add; do not port the old\n *   groups endpoint back just because the docs still describe it.\n *\n * ⚠️ RECONCILE NEEDS `Sys.Console` ON `/`, WHICH THE PROVISION ROLE LACKED WHEN THIS WAS WRITTEN\n *   (`PROVISION_PRIVILEGES` carries it now — ha-rule.ts has the measurement). Read and diff are\n *   fine — `GET /cluster/ha/resources/{sid}` checks `Sys.Audit`, which the role already has — while\n *   POST, PUT and DELETE all check `Sys.Console` on `/` and will answer \"Permission check failed\n *   (/, Sys.Console)\" on a role without it. Widen it knowingly: `Sys.Console` is also what\n *   opens a root shell on every node (`/nodes/{node}/vncshell`, `termproxy`), so granting it to the\n *   provision credential buys HA membership at the price of node console access. A separate role\n *   for HA writes is the narrower answer if that trade is not wanted.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { num } from './values.ts';\n\n/**\n * The requested states this provider admits.\n *\n * ⚠️ `enabled` IS DELIBERATELY ABSENT. PVE accepts it and documents it as an alias for `started`,\n *   which means a resource declared as `enabled` can be read back as `started` — and `matches`\n *   would then report an update on every plan, forever, over a difference in spelling. One spelling\n *   per state is the only version of this that settles.\n */\nexport type HaState = 'started' | 'stopped' | 'disabled' | 'ignored';\n\nexport interface HaResourceProps extends WithTarget {\n  /** ⛔ PREFIXED AND CLUSTER-WIDE: `ct:101`, `vm:100`. Changing it is a different object. */\n  sid: string;\n  /** What the CRM should aim for. Defaults to `started`, PVE's own default. */\n  state?: HaState;\n  /** Free text shown in the HA panel. Max 4096 characters. */\n  comment?: string;\n  /** Restart tries on the SAME node before the manager gives up and relocates. Default 1. */\n  max_restart?: number;\n  /** Relocation tries before the resource is left in `error`. Default 1. */\n  max_relocate?: number;\n}\n\nexport interface HaResourceAttributes {\n  /** As PVE returns it, prefix included. */\n  sid: string;\n  /** `ct` | `vm`. Implied by the prefix, reported so a plan can say what is being protected. */\n  type: string;\n  /**\n   * ⚠️ TYPED `string`, NOT `HaState`, because this is whatever the config file holds — including an\n   *   `enabled` a person wrote in the UI. Narrowing it here would be a claim about someone else's\n   *   edit rather than a report of it.\n   */\n  state: string;\n  comment: string;\n  max_restart: number;\n  max_relocate: number;\n}\n\nexport interface ProxmoxHaResource extends Resource<\n  'Proxmox.HaResource',\n  HaResourceProps,\n  HaResourceAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxHaResource = Resource<ProxmoxHaResource>('Proxmox.HaResource');\n\n/** `ct:101` -> `ct`. ⚠️ `?? ''` because noUncheckedIndexedAccess types `split()[0]` as optional. */\nconst kind = (sid: string) => sid.split(':')[0] ?? '';\n\n/**\n * ⚠️ NO `type` IN EITHER FORM, ON PURPOSE. The prefix in `sid` already names it on create, and PUT\n *   does not accept `type` at all — sending it on create only would make the two shapes diverge for\n *   no gain, and sending it on update is a parameter-verification failure.\n */\nconst shape = (props: HaResourceProps) => ({\n  comment: props.comment ?? '',\n  max_relocate: String(props.max_relocate ?? 1),\n  max_restart: String(props.max_restart ?? 1),\n  state: props.state ?? 'started',\n});\n\nconst handlers = pveHandlers<HaResourceProps, HaResourceAttributes>({\n  attributes: (live, props) => ({\n    comment: typeof live['comment'] === 'string' ? live['comment'] : '',\n    max_relocate: num(live['max_relocate'], 1),\n    max_restart: num(live['max_restart'], 1),\n    sid: typeof live['sid'] === 'string' ? live['sid'] : props.sid,\n    state: typeof live['state'] === 'string' ? live['state'] : 'started',\n    type: typeof live['type'] === 'string' ? live['type'] : kind(props.sid),\n  }),\n  /**\n   * ⚠️ CLUSTER-SCOPED, SO THERE IS NO NODE IN THE PATH — and that is the point of the object. The\n   *   guest's node is where it happens to run now; this resource is the statement that it may run\n   *   somewhere else tomorrow.\n   */\n  collection: () => 'cluster/ha/resources',\n  createForm: (props) => ({ ...shape(props), sid: props.sid }),\n  /**\n   * ⚠️ `digest` IS NOT COMPARED AND IS NOT AN ATTRIBUTE. It changes whenever ANY line of the HA\n   *   config changes, including one written for a different guest, so diffing it would report an\n   *   update on this resource because somebody else edited theirs.\n   * ⚠️ `sid` AND `type` ARE NOT COMPARED EITHER: sid is the path, so a change there is a different\n   *   object, and type is create-only — it is read back from the prefix, never edited.\n   */\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: {\n    create: 'pve:POST /cluster/ha/resources',\n    update: 'pve:PUT /cluster/ha/resources/{sid}',\n  },\n  matches: (attributes, props) =>\n    attributes.state === (props.state ?? 'started') &&\n    attributes.comment === (props.comment ?? '') &&\n    attributes.max_restart === (props.max_restart ?? 1) &&\n    attributes.max_relocate === (props.max_relocate ?? 1),\n  /**\n   * ⚠️ THE COLON GOES INTO THE URL RAW. RFC 3986 allows `:` inside a path segment and PVE matches\n   *   the sid as one segment, so no `encodeURIComponent` here; percent-encoding it would make the\n   *   request depend on a proxy normalising `%3A` back before the dispatcher sees it.\n   */\n  path: (props) => `cluster/ha/resources/${props.sid}`,\n  updateForm: shape,\n});\n\n/**\n* ⛔ Empty for the same reason as every other resource here: adoption must be explicit.\n*   `GET /cluster/ha/resources` would hand back every guest an operator has ever put under\n*   HA, and adopting those means one day deleting them.\n \n *\n* ⛔ DELETE DEFAULTS TO `purge=1` AND THE FACTORY SENDS NO FORM, SO THAT DEFAULT APPLIES:\n*   PVE strips the sid out of every HA rule referencing it and DELETES a rule that had no\n*   other member. Destroying an HA membership can therefore take an affinity rule with it,\n*   which matters once the rules family lands.\n* ⚠️ It does NOT stop or remove the guest. The container keeps running exactly where it is,\n*   only unmanaged — so removing this resource is how a guest is handed back to its node,\n*   not how it is decommissioned.\n \n */\nexport const ProxmoxHaResourceProvider = () =>\n  Provider.effect(ProxmoxHaResource, Effect.succeed(ProxmoxHaResource.Provider.of(handlers)));\n",
+    "/**\n * The four operations every PVE object shares, and the five handlers that wire them to Alchemy.\n *\n * ★ THE SHAPE THEY READ IS `PveSpec`, IN resource-spec.ts, WITH THE ARGUMENT FOR IT. This file was\n *   one file until 2026-09-22, when the vendor-constraint guard took it past the 250-line cap; the\n *   split is by what a reader is doing — declaring an object, or changing how every object is\n *   written — and the types are re-exported below so no importer moved.\n *\n * ⚠️ EVERY PVE ANSWER IS WRAPPED IN `{\"data\": ...}` AND A FAILED CALL CAN STILL BE HTTP 200 with\n *   `{\"data\": null}`. That is why `reconcile` below READS BACK and refuses when the object is still\n *   absent, rather than trusting a status code — see the ⛔ in that function.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport { pve } from './client.ts';\nimport { specGuards } from './resource-guard.ts';\nimport type { PveSpec, WithApiTarget } from './resource-spec.ts';\nimport { formToSend } from './update-guard.ts';\n\nexport type {\n  PveRequirements,\n  PveSpec,\n  WithApiTarget,\n  WithPbsTarget,\n  WithTarget,\n} from './resource-spec.ts';\n\nexport const pveOperations = <Props extends WithApiTarget, Attributes>(\n  spec: PveSpec<Props, Attributes>,\n) => {\n  const { guardCreate, guardUpdate } = specGuards(spec);\n\n  /** The live object, or undefined. ⚠️ A 404 and `{\"data\": null}` are ANSWERS, not failures. */\n  const read = (props: Props) =>\n    pve<Record<string, unknown>>(\n      props.target,\n      spec.readRole ?? 'read',\n      'GET',\n      spec.path(props),\n    ).pipe(\n      Effect.map((data) => (data == null ? undefined : spec.attributes(data, props))),\n      Effect.orElseSucceed(() => undefined),\n    );\n\n  return {\n    /**\n     * ★ EXPORTED SO A FAMILY THAT WRITES ITS OWN `reconcile` REACHES THE SAME CHECK BY THE SAME\n     *   NAME. CephPool, CephFs and ZfsPool all bypass the reconcile below — forked workers, a\n     *   settle loop, a destructive create — and without these two they would be checked at plan\n     *   time and not at apply time, which is exactly the gap an ADOPTED row falls through.\n     */\n    guardCreate,\n    guardUpdate,\n\n    read,\n\n    // ⚠️ `Input<Props>`, NOT `Props`. At plan time a prop can still be an unresolved Output or\n    //   Config; `isResolved` is the narrowing, so the parameter has to admit the wider type or\n    //   every caller casts — and a cast here would be a lie about what plan actually has.\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        // ⚠️ A prop can still be an unresolved Output at plan time. Alchemy's own providers guard\n        //   with isResolved and skip rather than guess; comparing a placeholder to a live value\n        //   reports an update nobody asked for.\n        if (!isResolved(news)) return undefined;\n        /**\n         * ⛔ THE VENDOR CHECK RUNS BEFORE THE `output === undefined` RETURN, AND THE ORDER IS THE\n         *   WHOLE FIX. `output === undefined` IS the resource Alchemy has no state for — the\n         *   create. Checking after it would leave exactly the case that failed on 2026-09-22\n         *   unchecked, and the refusal would arrive from the server, half a deploy in.\n         */\n        yield* guardCreate(news, output === undefined);\n        yield* guardUpdate(news);\n        if (output === undefined) return undefined;\n        const live = yield* read(news);\n        // ⚠️ `update`, NOT `create` — Alchemy's Diff admits only noop/update/replace. An object\n        //   Alchemy has state for but the cluster does not is drift, and reconcile repairs it.\n        if (live === undefined) {\n          /**\n           * ⛔ DRIFT REACHES `reconcile`'s POST, so the create form's required parameters ARE\n           *   about to go on the wire after all. Saying so here rather than leaving it to\n           *   reconcile keeps the refusal in `plan`, where an operator is reading.\n           */\n          yield* guardCreate(news, true);\n          return { action: 'update' } as const;\n        }\n        if (spec.matches(live, news)) return { action: 'noop' } as const;\n        // An object with no update path cannot be edited in place; say replace and mean it.\n        return spec.updateForm === undefined\n          ? ({ action: 'replace' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    reconcile: (news: Props) =>\n      Effect.gen(function* () {\n        const live = yield* read(news);\n        // ⚠️ CHECKED AGAIN HERE, AND NOT BECAUSE `diff` IS UNTRUSTED. `reconcile` also runs for an\n        //   ADOPTED row, whose diff answer Alchemy discards (verify/fake-engine.ts records it), and\n        //   a family that writes its own reconcile bypasses the one above entirely.\n        // ⛔ AFTER THE READ, BECAUSE THE READ IS WHAT SAYS WHICH REQUEST IS ABOUT TO BE MADE. A GET\n        //   changes nothing, so nothing has been written by the time a violation refuses the plan.\n        yield* guardCreate(news, live === undefined);\n        yield* guardUpdate(news);\n        if (live === undefined) {\n          yield* pve(\n            news.target,\n            'provision',\n            'POST',\n            spec.collection(news),\n            spec.createForm(news),\n          );\n        } else if (spec.updateForm !== undefined) {\n          /**\n           * ⛔ ADOPTING AN OBJECT THAT ALREADY MATCHES MUST NOT WRITE TO IT, AND WITHOUT THE\n           *   `matches` GUARD IT DID. Alchemy's `adopted` action is NOT a read: Apply.ts routes it\n           *   down the same branch as `update` and calls `reconcile` (Apply.ts:980 and :1045). So\n           *   the first time a declaration names an object Alchemy has no state for — which is\n           *   exactly what adopting the live estate means — reconcile runs, finds it present, and\n           *   fell through to this PUT.\n           *\n           *   For most families that was a pointless write-back of identical values. For\n           *   `Proxmox.NodeNetwork` it is worse than pointless: a PUT under `/nodes/{node}/network`\n           *   STAGES a change into `/etc/network/interfaces.new`, so merely adopting the interface\n           *   a node already has would leave that node with a pending network change waiting for an\n           *   apply — on a cluster whose Ceph traffic rides vmbr1.42. Adoption has to be free.\n           *\n           * ★ SO THE CONDITION IS THE SAME PREDICATE `diff` USES. If `matches` is true the object\n           *   already says what the declaration says, and there is nothing to write — by\n           *   definition, since every field this provider manages is a field `matches` compares.\n           *   A field deliberately left OUT of `matches` is one this resource does not manage, so\n           *   its drift is not this provider's to repair.\n           *\n           * ★ THE PREDICATE LIVES IN update-guard.ts NOW, with the ⚠️ on why an empty form is not a\n           *   write either, because CephPool and PbsDatastore write their own reconcile and need\n           *   the same one — CephPool did not have it (see that file).\n           */\n          const form = formToSend(spec.matches, live, news, spec.updateForm(news));\n          if (form !== undefined) {\n            yield* pve(news.target, 'provision', 'PUT', spec.path(news), form);\n          }\n        }\n        const after = yield* read(news);\n        if (after === undefined) {\n          /**\n           * ⛔ REFUSE RATHER THAN RETURN THE PROPS AS THOUGH THEY LANDED. PVE answers 200 with\n           *   `{\"data\": null}` on several endpoints, so \"no error\" is not evidence of a write. A\n           *   provider that returned its own inputs here would record state for an object that does\n           *   not exist, and the next plan would read `noop` over the gap.\n           */\n          return yield* Effect.die(\n            new Error(\n              `${spec.path(news)}: the write returned no error but the object is still absent. ` +\n                'PVE wraps every answer in {\"data\":...} and can report success on a call that did ' +\n                'nothing -- read back rather than trusting the status code.',\n            ),\n          );\n        }\n        return after;\n      }),\n\n    /**\n     * ⚠️ PVE REFUSES TO DELETE THINGS THAT ARE STILL IN USE — a pool holding guests, a storage with\n     *   volumes. That refusal is the cluster declining to orphan something because a line left a\n     *   file, so it is surfaced as-is rather than retried with a force flag.\n     */\n    destroy: (olds: Props) => pve(olds.target, 'provision', 'DELETE', spec.path(olds)),\n  };\n};\n\n/**\n * The five provider handlers for a spec'd PVE object, wired once.\n *\n * ⛔ THIS BLOCK WAS WRITTEN TEN TIMES BEFORE IT WAS EXTRACTED, and every copy was character for\n *   character identical apart from its comments: `list` answering empty, and four handlers whose\n *   entire body was `yield* ops.<same name>(<same argument>)`. Ten copies of a delegation is ten\n *   chances to delegate to the wrong one — `ops.read(olds)` inside `reconcile` typechecks, returns\n *   a plausible value, and turns every deploy into a no-op that reports success.\n *\n * ★ IT TAKES THE SPEC, NOT THE OPERATIONS, so a resource declares its four spec functions and\n *   stops. `pveOperations` stays exported for an object that genuinely needs a handler of its own;\n *   nothing in this package does yet, and the day one does it should be visibly different from the\n *   ten that are not.\n *\n * ⛔ IT STOPS AT THE HANDLERS AND DOES NOT RETURN THE LAYER, AND THAT IS NOT AN OVERSIGHT — it was\n *   written the other way first and reverted. Wrapping `Provider.effect(cls, …)` here means naming\n *   the resource class generically, and Alchemy's `Props<R>` and `R[\"Attributes\"]` are not the\n *   plain `Props` and `Attributes` this spec is written against: `Attributes` comes back as\n *   `Attributes & AttrOutput<Attributes[\"Attributes\"]>`. Against a free type variable TypeScript\n *   cannot prove those line up — \"could be instantiated with a different subtype\" — so the only\n *   way to compile a Layer-returning version is a cast, and a cast is a LIE ABOUT WHETHER THE\n *   HANDLERS MATCH THE RESOURCE, which is the one thing the call site exists to check. Leaving\n *   `Cls.Provider.of(...)` in each file keeps that check where the types are concrete and real.\n *   One line per resource is the price of it, and it is worth paying.\n *\n * ⚠️ `list` IS OPTIONAL IN `ProviderServiceInput` AND IS PASSED ANYWAY. An empty list is a claim —\n *   this provider adopts nothing — and it is made here for every PVE object at once, because the\n *   reasoning is identical for all of them: every PVE index endpoint answers with the whole\n *   cluster's objects, PVE's own built-ins included. `GET /pools` returns pools a human made years\n *   ago; `GET /access/roles` returns `Administrator`. Returning any of them would invite Alchemy to\n *   adopt an object it never created, and therefore one day to narrow or delete it. Adoption stays\n *   an explicit act. A resource with a reason to differ passes its own `list` and says why.\n */\nexport const pveHandlers = <Props extends WithApiTarget, Attributes extends object>(\n  spec: PveSpec<Props, Attributes>,\n) => {\n  const ops = pveOperations(spec);\n  return {\n    list: () => Effect.succeed([]),\n    read: ({ olds }: { olds: Props }) => ops.read(olds),\n    diff: ({ news, output }: { news: Input<Props>; output: Attributes | undefined }) =>\n      ops.diff(news, output),\n    reconcile: ({ news }: { news: Props }) => ops.reconcile(news),\n    delete: ({ olds }: { olds: Props }) => ops.destroy(olds),\n  };\n};\n",
+    "/**\n * One authenticated call to the Proxmox VE API.\n *\n * ★ PLAIN `fetch`, NO TLS ESCAPE HATCH, AND THAT IS A MEASURED CHOICE RATHER THAN AN OMISSION.\n *   Proxmox is usually met with `curl -k` because a fresh install serves its own self-signed\n *   certificate — I reached for `-k` myself before checking. This cluster serves a real Let's\n *   Encrypt certificate (`CN=cluster-c1.example.com`), and strict TLS answers 401, i.e. the\n *   handshake succeeds and only the credential is missing. So there is no `rejectUnauthorized`\n *   option here to be left switched on by accident in somebody else's estate.\n *\n * ⚠️ EVERY PVE ANSWER IS WRAPPED IN `{\"data\": ...}`, errors included — a failed call can still be\n *   HTTP 200 with `{\"data\": null}`. Unwrapping is not cosmetic; a caller that reads the envelope\n *   as the payload sees `undefined` and calls it \"absent\".\n */\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\nimport type { ApiTarget, PveCredential, PveRole, PveTarget } from './credentials.ts';\nimport { leased } from './lease-cache.ts';\nimport { authorization } from './mint.ts';\nimport { executeOnCluster } from './members.ts';\n\nexport class PveError extends Error {\n  constructor(\n    readonly status: number,\n    readonly method: string,\n    readonly path: string,\n    detail: string,\n  ) {\n    super(`PVE ${method} ${path} -> ${String(status)}: ${detail}`);\n    this.name = 'PveError';\n  }\n}\n\nconst clusterExhausted = (\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  attempts: ReadonlyArray<{ member: string; why: string }>,\n) =>\n  new PveError(\n    0,\n    method,\n    path,\n    `all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join('; ')}`,\n  );\n\n/**\n * A form body, where a value may be a LIST.\n *\n * ⛔ PVE AND PBS SPELL A MULTI-VALUED FIELD DIFFERENTLY, AND THE LIST FORM IS FOR PBS. PBS is Rust:\n *   its schemas use `type: array` — `delete` on every update endpoint is one — and its urlencoded\n *   decoder builds that array from REPEATED KEYS (`delete=a&delete=b`). PVE's Perl takes a comma\n *   string for the same idea, which is what `withClears` in values.ts produces, and for the one\n *   PVE field that genuinely needs repetition it wants a NUL-joined value instead (see\n *   notification-target.ts). So: PVE callers pass strings and are unaffected; a PBS caller that\n *   needs an array passes one and gets repeated keys rather than reaching for PVE's encoding.\n */\nexport type PveForm = Record<string, readonly string[] | string>;\n\n/** ⚠️ `append`, NOT `set`: a repeated key is the point, and `set` would keep only the last. */\nconst encode = (form: PveForm): string => {\n  const params = new URLSearchParams();\n  for (const [key, value] of Object.entries(form)) {\n    if (typeof value === 'string') params.append(key, value);\n    else for (const item of value) params.append(key, item);\n  }\n  return params.toString();\n};\n\nconst buildRequest = (\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  apiBase: string,\n  path: string,\n  credential: PveCredential,\n  target: ApiTarget,\n  form?: PveForm,\n) => {\n  const url = `${apiBase}/${path}`;\n  /**\n   * ⛔ THE CONTENT TYPE IS AN ARGUMENT TO `bodyText`, NOT AN ENTRY IN THE HEADER MAP, AND GETTING\n   *   THAT WRONG MADE EVERY WRITE IN THIS PACKAGE FAIL.\n   *\n   * 🔴 THE BUG, AND HOW IT HID FOR A WHOLE DAY. The header map DID set\n   *   `application/x-www-form-urlencoded` — and `bodyText(s)` with no second argument sets\n   *   `text/plain` and OVERWRITES it, because it is piped AFTER `setHeaders`. PVE and PBS accept\n   *   ONLY form encoding or JSON and reject everything else outright (measured in\n   *   proxmox-rest-server's `get_request_parameters`), so every create, update and delete this\n   *   package can perform was broken from the day the client was written.\n   *   ⛔ NOTHING CAUGHT IT BECAUSE NOTHING HAD EVER WRITTEN. Ninety-eight resources were adopted\n   *     against the live cluster and every one matched, so `reconcile` never reached a PUT. The\n   *     identical bug in <estate>/forgejo/src/client.ts surfaced the moment a write token existed\n   *     and answered `422 Unsupported Content-Type`; this one is the same line, found by looking.\n   *   ★ A PLAN THAT SAYS `noop` PROVES THE READ PATH AND NOTHING ELSE. That is the lesson worth\n   *     more than the fix.\n   *\n   * ⚠️ PVE TAKES FORM ENCODING, NOT JSON. Sending application/json is accepted and then SILENTLY\n   *   IGNORED on several endpoints, which reads as \"the API did nothing\" rather than as a wrong\n   *   content type — so the type below is load bearing in both directions.\n   */\n  return HttpClientRequest.make(method)(url).pipe(\n    HttpClientRequest.setHeaders({ Authorization: authorization(credential, target) }),\n    form === undefined\n      ? (self) => self\n      : HttpClientRequest.bodyText(encode(form), 'application/x-www-form-urlencoded'),\n  );\n};\n\nconst executeOne = (\n  target: ApiTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form: PveForm | undefined,\n  apiBase: string,\n) =>\n  Effect.gen(function* () {\n    const client = yield* HttpClient.HttpClient;\n    const request = buildRequest(method, apiBase, path, credential, target, form);\n    return yield* client\n      .execute(request)\n      .pipe(Effect.mapError((cause) => new PveError(0, method, path, String(cause))));\n  });\n\nconst readResponse = <T>(\n  response: {\n    status: number;\n    text: Effect.Effect<string, unknown>;\n    json: Effect.Effect<unknown, unknown>;\n  },\n  method: string,\n  path: string,\n) =>\n  Effect.gen(function* () {\n    /**\n     * ⛔ STATUS FIRST, THEN THE BODY, AND THE BODY IS READ EXACTLY ONCE. `text` and `json` both\n     *   consume the response stream, so asking for both is a bug waiting to happen. A failure is\n     *   read as TEXT because an error body is not reliably JSON — PVE answers HTML for some 5xx —\n     *   and a success is read as JSON by the client rather than by a hand-rolled `JSON.parse`.\n     */\n    if (response.status < 200 || response.status >= 300) {\n      // ⚠️ 401 HERE USUALLY MEANS THE LEASE EXPIRED, NOT THAT THE ROLE IS WRONG. `provision` is a\n      //   300s non-renewable lease; a long reconcile should mint again rather than widen the role.\n      const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ''));\n      return yield* Effect.fail(new PveError(response.status, method, path, detail.slice(0, 300)));\n    }\n    const body = (yield* response.json.pipe(\n      Effect.mapError((cause) => new PveError(0, method, path, String(cause))),\n    )) as { data?: T };\n    return body.data;\n  });\n\n/** A call that already holds a credential. Used when one mint serves several calls. */\nexport const pveWith = <T>(\n  target: ApiTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form?: PveForm,\n) =>\n  Effect.gen(function* () {\n    const response =\n      target.scheme === 'pve'\n        ? yield* executeOnCluster(target, method, path, (apiBase) =>\n            buildRequest(method, apiBase, path, credential, target, form),\n          ).pipe(\n            Effect.mapError((failure) =>\n              failure.tag === 'cluster'\n                ? clusterExhausted(failure.method, failure.path, failure.attempts)\n                : new PveError(0, method, path, String(failure)),\n            ),\n          )\n        : yield* executeOne(target, credential, method, path, form, target.api);\n    return yield* readResponse<T>(response, method, path);\n  });\n\n/**\n * Like `pveWith`, but returns the full JSON body — for endpoints whose answer lives beside `data`.\n *\n * ⚠️ `network-apply-read.ts` is the caller today; the local fetch there should fold into this once\n *   the envelope shape is stable across both paths.\n */\nexport const pveEnvelopeWith = (\n  target: PveTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n) =>\n  Effect.gen(function* () {\n    const response = yield* executeOnCluster(target, method, path, (apiBase) =>\n      buildRequest(method, apiBase, path, credential, target),\n    ).pipe(\n      Effect.mapError((failure) =>\n        failure.tag === 'cluster'\n          ? clusterExhausted(failure.method, failure.path, failure.attempts)\n          : new PveError(0, method, path, String(failure)),\n      ),\n    );\n    if (response.status < 200 || response.status >= 300) {\n      const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ''));\n      return yield* Effect.fail(new PveError(response.status, method, path, detail.slice(0, 300)));\n    }\n    return (yield* response.json.pipe(\n      Effect.mapError((cause) => new PveError(0, method, path, String(cause))),\n    )) as Record<string, unknown>;\n  });\n\n/**\n * Make one call on a credential for `role`, REUSING a still-valid lease rather than minting one.\n *\n * 🔴 IT USED TO MINT PER CALL, AND AT 98 RESOURCES THAT STOPPED BEING FREE. One plan plus deploy\n *   of the C1 stack left 760 token entries in `/etc/pve/user.cfg` — read, diff, reconcile and the\n *   read-back each minted their own, and `/etc/pve` is a replicated cluster filesystem every node\n *   has to agree on. src/lease-cache.ts carries the measurement and the safety argument.\n *\n * ⚠️ `pveWith` IS STILL THERE AND STILL TAKES AN EXPLICIT CREDENTIAL. network-apply.ts needs ONE\n *   identity across its apply and its task poll — PVE only skips the task-status privilege check\n *   for the task's OWNER — and it threads a lease through by hand for that. Caching makes that\n *   property easier to hold, never weaker, but the explicit path stays because that caller is\n *   reasoning about identity rather than about cost.\n *\n * ★ TASK POLL ON A DIFFERENT MEMBER THAN THE APPLY STILL HOLDS: the owner is the token id, not the\n *   node that received the PUT. Any member serves any task path; the privilege skip is keyed on\n *   whether the caller IS the task's owner.\n */\nexport const pve = <T>(\n  target: ApiTarget,\n  role: PveRole,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form?: PveForm,\n) =>\n  Effect.gen(function* () {\n    const credential = yield* leased(target, role);\n    return yield* pveWith<T>(target, credential, method, path, form);\n  });\n",
     "/**\n * `Proxmox.HaRule` — where the CRM may place a guest, and which guests must not share a node.\n *\n * ★ THIS IS THE PVE 9 SUCCESSOR TO HA GROUPS, AND THE GROUPS ENDPOINT IS GONE. MEASURED on node-b\n *   (pve-manager/9.2.11, 2026-09-13): `pvesh get /cluster/ha/groups` answers `cannot index groups:\n *   ha groups have been migrated to rules`, and `/etc/pve/ha/` holds `rules.cfg` with no\n *   `groups.cfg` beside it. The published schema still documents groups and still offers a `group`\n *   parameter on `Proxmox.HaResource`; both are dead. Do not port them back.\n *\n * ★ ONE RESOURCE FOR BOTH RULE TYPES, ON THE ceph-daemon.ts ARGUMENT AND AFTER READING BOTH\n *   PLUGINS. `PVE::HA::Rules::NodeAffinity` and `::ResourceAffinity` share `resources`, `affinity`,\n *   `disable` and `comment`; node-affinity adds `nodes` and `strict` and nothing else diverges. The\n *   endpoint, the path, the create/update/delete calls, the `order` and `digest` traps below and\n *   the list normalisation are identical for both. Two files would have carried every one of those\n *   traps twice and let them drift.\n *   ⛔ `type` IS CREATE-ONLY. MEASURED in `/usr/share/perl5/PVE/API2/HA/Rules.pm`: `update_rule`\n *     takes the plugin from the STORED rule (`my $type = $rule->{type};`) and never rewrites it. So\n *     `attributes` reports a rule of the other type as ABSENT, which sends reconcile down the\n *     create branch and makes PVE refuse with `HA rule '<id>' already defined` — a loud, accurate\n *     error rather than a PUT pushing node-affinity fields at a resource-affinity rule.\n *     ⛔ AND YET IT IS SENT ON THE UPDATE ANYWAY, because the PUT is validated against a `oneOf`\n *       keyed on it and refuses the whole body without it. That one is worth reading in full: it\n *       is the ⛔ on `required` in ha-rule-form.ts.\n *\n * ⛔ THREE FIELDS PVE RETURNS AND NO WRITE ACCEPTS, EACH ONE A FOREVER-UPDATE IF COMPARED.\n *   `order` is an ORDINAL PVE ASSIGNS ITSELF (`$rules->{order}->{$ruleid} =\n *   PVE::HA::Rules::get_next_ordinal($rules)`) and it appears in no create or update schema at all;\n *   it is reported in attributes and never compared. `digest` is the digest of the WHOLE rules\n *   file, so it moves when a rule written for somebody else's guests moves — it is not even an\n *   attribute, for the reason ha-resource.ts gives. `errors` is PVE's own feasibility verdict,\n *   recomputed across every rule on every read; reported, never compared. See `problems` in\n *   ha-rule-form.ts.\n *\n * ⚠️ IT COMPOSES WITH `Proxmox.HaResource`, AND THE EDGE IS REAL RATHER THAN TIDY. MEASURED:\n *   `create_rule` runs `$assert_valid_resources_param`, which calls\n *   `PVE::HA::Config::service_is_configured($resource)` for every sid and dies `cannot use\n *   unmanaged resource(s) <sid>` if one is not already an HA resource. A rule naming a sid nothing\n *   has put under HA is a HARD 400, not a warning — so `resources` should be written as the\n *   HaResource's own attribute (`resources: [web.sid, db.sid]`) and let Alchemy order the deploy,\n *   not as a bare string that happens to match. `$assert_valid_nodes_param` refuses a non-existent\n *   node the same way.\n *   ⛔ AND THE EDGE RUNS BACK THE OTHER WAY, WHERE ALCHEMY CANNOT SEE IT. Destroying an\n *     `HaResource` deletes with PVE's default `purge=1`, which strips that sid out of every rule\n *     and DELETES any rule left with no members. So a plan that only removes a guest can remove\n *     this resource's object from under it; the next plan then reads absent and recreates it, or\n *     fails on the `unmanaged resource` check if the guest is gone for good.\n *\n * ⚠️ BOTH LANES ALREADY HAVE THE PRIVILEGES, WHICH IS NEW. MEASURED 2026-09-13:\n *   GET (collection and item) checks `Sys.Audit` on `/` and the built-in `PVEAuditor` holds it, so\n *   `readRole` stays the default `read` lease — unlike storage.ts and the SDN families. POST, PUT\n *   and DELETE all check `Sys.Console` on `/`, and the provision role now returns `Sys.Console` among\n *   its 27 privileges (`PROVISION_PRIVILEGES`, provision-baseline.ts). The warning in ha-resource.ts's header — that\n *   `Sys.Console` is missing — is stale; the role was widened, and the price it named still stands:\n *   `Sys.Console` is also what opens a root shell on every node.\n *\n * ⚠️ REMOVAL IS THE PLAIN DEFAULT, DELIBERATELY, AND `delete` IS THE FACTORY'S. An HA rule is\n *   exactly a line of TypeScript — nothing in it is irreplaceable the way a Ceph pool or a ZFS\n *   vdev is — so the `retain` default that resource.ts explains does not apply. Read the plan for\n *   what it is, though: while a negative resource-affinity rule is absent, nothing stops the CRM\n *   putting both halves of a pair on one node.\n *\n * ⚠️ A READ GOES THROUGH THE GROUPS MIGRATION. Every GET calls `migrate_groups_to_rules`, so on a\n *   cluster that still has `groups.cfg` the answer includes SYNTHETIC rules nobody declared. This\n *   cluster has none, so nothing is injected here; a rule id colliding with an old group name on a\n *   cluster that does would read back something this provider never wrote.\n *\n * ⚠️ A CHANGED `type` READS AS `update` IN THE PLAN AND FAILS AS \"already defined\" ON THE APPLY,\n *   AND THOSE TWO WORDS POINT AWAY FROM THE CAUSE. `attributes` answers undefined when the live\n *   rule's type disagrees, so `diff` takes resource.ts's `live === undefined` branch and says\n *   update; reconcile then reads undefined, POSTs, and PVE refuses because the rule is plainly\n *   there. The cause is that `type` is create-only. metric-server.ts has the same shape, so this\n *   is the package's consistent behaviour rather than a quirk of this file — but it is worth\n *   knowing before reading the error. Delete the declaration and write a new one to change a type.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { body, clearList, commentText, nodeList, problems } from './ha-rule-form.ts';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { bool, csv, int, text, withClears } from './values.ts';\n\nexport type HaRuleType = 'node-affinity' | 'resource-affinity';\n\n/**\n * ⛔ REQUIRED ON BOTH TYPES, AND THAT IS A DELIBERATE NARROWING OF PVE'S SCHEMA. PVE makes it\n *   optional for node-affinity (defaulting to `positive`) and mandatory for resource-affinity. A\n *   provider that mirrored that has two bad options when a declaration omits it: guess `positive`,\n *   which silently flips a live `negative` rule — the one keeping two guests APART — into one that\n *   pins them together; or leave it out of the write, which makes `matches` disagree with a live\n *   `negative` rule forever while every PUT changes nothing. Requiring one word from the caller\n *   removes both.\n */\nexport type HaAffinity = 'positive' | 'negative';\n\ninterface HaRuleBase extends WithTarget {\n  /** A `pve-configid`: a letter, then letters, digits, `-` and `_`. Identity — renaming is a new\n   *  rule, and the old one stays behind exactly as `sid` does in ha-resource.ts. */\n  rule: string;\n  /**\n   * The HA resources this rule constrains, as prefixed sids — `ct:101`, `vm:100`.\n   * ⚠️ EVERY ONE MUST ALREADY BE UNDER HA. See the composition ⚠️ in the header: this is an\n   *   ordering edge, and the honest way to express it is the HaResource's own `sid` attribute.\n   */\n  resources: readonly string[] | string;\n  affinity: HaAffinity;\n  /** Keep the rule in the file but stop the CRM applying it. ⛔ Clearing it needs `delete=disable`\n   *  — see the ⛔ in `optional` in ha-rule-form.ts. */\n  disable?: boolean;\n  /** Free text shown in the HA panel. Max 4096 characters. */\n  comment?: string;\n}\n\nexport interface NodeAffinityRuleProps extends HaRuleBase {\n  type: 'node-affinity';\n  /**\n   * Cluster nodes, each optionally `<node>:<priority>`. Higher priority wins; the numbers are\n   * relative and nothing else. ⚠️ REQUIRED BY THE TYPE, not merely by PVE — an optional `nodes`\n   * would let a declaration that cannot describe any live rule sit in a permanent update loop.\n   */\n  nodes: readonly string[] | string;\n  /** `false` (PVE's default) makes the nodes a PREFERENCE; `true` makes them the only nodes the\n   *  resources may run on, and the resources STOP when none of them is available. */\n  strict?: boolean;\n}\n\nexport interface ResourceAffinityRuleProps extends HaRuleBase {\n  type: 'resource-affinity';\n}\n\n/**\n * ⚠️ A UNION, NOT ONE FLAT INTERFACE WITH OPTIONAL EXTRAS, because `nodes` and `strict` are not\n *   merely unused on a resource-affinity rule — PVE's oneOf declares `additionalProperties: 0`, so\n *   sending either is a 400, and comparing either would be a diff no write could ever settle. The\n *   union makes both unwritable rather than ignored.\n */\nexport type HaRuleProps = NodeAffinityRuleProps | ResourceAffinityRuleProps;\n\nexport interface HaRuleAttributes {\n  rule: string;\n  type: HaRuleType;\n  /** ⚠️ NORMALISED, NOT RAW. PVE returns `join(',', sort keys %$hash)` — a re-sorted SET. */\n  resources: string;\n  /** ⚠️ Normalised by `nodeList`; always `''` on a resource-affinity rule, which has no nodes. */\n  nodes: string;\n  affinity: string;\n  strict: boolean;\n  disable: boolean;\n  comment: string;\n  /** ⛔ PVE-ASSIGNED AND UNWRITABLE. Reported so a plan can show it; never compared. */\n  order: number;\n  /** ⛔ PVE's feasibility verdict for this rule. Reported; never compared. */\n  errors: string;\n}\n\nexport interface ProxmoxHaRule extends Resource<\n  'Proxmox.HaRule',\n  HaRuleProps,\n  HaRuleAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxHaRule = Resource<ProxmoxHaRule>('Proxmox.HaRule');\n\nconst handlers = pveHandlers<HaRuleProps, HaRuleAttributes>({\n  attributes: (live, props) => {\n    /**\n     * ⛔ A RULE OF THE OTHER TYPE IS ANOTHER OBJECT, AND \"ABSENT\" IS THE HONEST ANSWER — the same\n     *   move metric-server.ts makes, for the same reason: `type` cannot be changed by a PUT, so\n     *   reporting the foreign rule as missing makes reconcile POST and PVE refuse because the id\n     *   is taken. An older PVE that omitted `type` from the read would fall through and be trusted.\n     */\n    const liveType = text(live['type']);\n    if (liveType !== '' && liveType !== props.type) return undefined;\n    return {\n      affinity: text(live['affinity']),\n      comment: text(live['comment']),\n      /**\n       * ⚠️ ABSENT WHEN OFF, AND THAT IS NOT THE SAME AS `false` BY ACCIDENT. MEASURED in\n       *   `PVE::HA::Rules::set_rule_defaults`: a default is materialised into the read only when it\n       *   is TRUTHY, so `disable` (no default) and `strict` (default 0) are simply missing from an\n       *   enabled, non-strict rule while `affinity` (default `positive`) is always present.\n       */\n      disable: bool(live['disable'], false),\n      errors: problems(live['errors']),\n      nodes: nodeList(typeof live['nodes'] === 'string' ? live['nodes'] : undefined),\n      order: int(live['order'], 0),\n      resources: csv(typeof live['resources'] === 'string' ? live['resources'] : undefined),\n      rule: text(live['rule'], props.rule),\n      strict: bool(live['strict'], false),\n      type: props.type,\n    };\n  },\n  collection: () => 'cluster/ha/rules',\n  /** ⚠️ ONLY `rule` IS ADDED HERE: the POST is to the collection, so the id is not in the path.\n   *   `type` is already in `body` — the PUT needs it too, for the reason ha-rule-form.ts gives. */\n  createForm: (props) => ({ ...body(props), rule: props.rule }),\n  /**\n   * ⛔ ONLY FIELDS A WRITE CAN ACTUALLY SET ARE COMPARED. `order`, `errors` and `digest` are out\n   *   for the reason the header gives at length — each would report an update that the PUT it\n   *   triggers cannot satisfy, on every plan, forever. `rule` and `type` are out too: one is the\n   *   key the object was read by, the other is refused rather than updated.\n   * ⚠️ `nodes` AND `strict` ARE COMPARED ONLY ON A NODE-AFFINITY RULE. They do not exist on the\n   *   other plugin, so `attributes.nodes` is `''` and `attributes.strict` is `false` there by\n   *   construction — comparing them would be comparing a declaration against nothing.\n   * ⚠️ THE COMMENT IS COMPARED AS PVE WILL STORE IT, not as it was declared — `commentText` and\n   *   its ⛔ explain why a `%XX` in a comment does not survive the round trip.\n   */\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: { create: 'pve:POST /cluster/ha/rules', update: 'pve:PUT /cluster/ha/rules/{rule}' },\n  matches: (attributes, props) =>\n    attributes.resources === csv(props.resources) &&\n    attributes.affinity === props.affinity &&\n    attributes.comment === commentText(props.comment ?? '') &&\n    attributes.disable === (props.disable === true) &&\n    (props.type !== 'node-affinity' ||\n      (attributes.nodes === nodeList(props.nodes) &&\n        attributes.strict === (props.strict === true))),\n  /** ⚠️ A `pve-configid` has no `/` or `:` in it, so there is nothing here to encode. */\n  path: (props) => `cluster/ha/rules/${props.rule}`,\n  /**\n   * ⛔ THE `delete=` HALF IS WHAT MAKES THIS SETTLE. A PUT merges into the stored rule and a\n   *   `disable=0` is thrown away before the plugin sees it, so without the clear list a rule\n   *   disabled by hand could never be re-enabled by a declaration and every plan would report the\n   *   same update. `clearList` and `body` come off one table — see ha-rule-form.ts.\n   */\n  updateForm: (props) => {\n    const clear = clearList(props);\n    const fields = body(props);\n    return withClears(fields, clear);\n  },\n});\n\n/**\n * ⛔ THE EMPTY `list` FROM `pveHandlers` STANDS, AND IT COSTS NOTHING HERE TODAY.\n *   `GET /cluster/ha/rules` MEASURED `[]` on this cluster on 2026-09-13 — but the same call on a\n *   cluster somebody has used returns every rule an operator ever clicked, plus the synthetic ones\n *   the groups migration invents on read. Adopting either is how a later `alchemy destroy` removes\n *   a separation rule nobody declared. Adoption stays an explicit act.\n */\nexport const ProxmoxHaRuleProvider = () =>\n  Provider.effect(ProxmoxHaRule, Effect.succeed(ProxmoxHaRule.Provider.of(handlers)));\n",
     "/**\n * An HA rule's props as the form PVE wants, and the two lists PVE re-spells on the way back.\n *\n * ★ SPLIT OUT OF ha-rule.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is the same\n *   one metric-server-form.ts and node-network-form.ts cut: this file answers \"how does a\n *   declaration become a PVE form, and what shape does PVE hand back\", ha-rule.ts answers \"what is\n *   an HA rule and when has it changed\". Nothing here reads the cluster or decides a diff.\n *\n * ⚠️ THE `import type` BACK TO ha-rule.ts IS A CYCLE ON PAPER ONLY. It is type-only, so it is\n *   erased before anything runs, and `HaRuleProps` stays public in the file declaring the resource.\n */\nimport type { HaRuleProps } from './ha-rule.ts';\nimport { csv } from './values.ts';\n\n/**\n * A `<node>[:<pri>]` list, spelled the way PVE gives it back.\n *\n * ⛔ THIS IS NOT `csv`, AND THE DIFFERENCE IS A FOREVER-DIFF. MEASURED by reading\n *   `/usr/share/perl5/PVE/HA/Rules/NodeAffinity.pm` on node-b (2026-09-13): `decode_plugin_value`\n *   turns the list into a HASH keyed by node name, and `encode_plugin_value` rebuilds it with\n *   `for my $node (sort keys %$value)` — sorted by NODE NAME, never by the token — emitting the\n *   bare name whenever the priority is falsy, because `PVE::HA::Tools::parse_node_priority` reads\n *   a missing priority as 0. So a declared `node-c:1,node-b:0` is handed back as `node-b,node-c:1`: re-ordered AND\n *   re-spelled. Compare the raw strings and every plan reports an update, forever.\n *\n * ⚠️ SORTED BY NAME, NOT BY TOKEN, AND THE TWO GENUINELY DIVERGE. `csv` sorts whole tokens. Node\n *   names may contain `-` — `parse_node_priority`'s own regex is\n *   `[a-zA-Z0-9]([a-zA-Z0-9\\-]*[a-zA-Z0-9])?` — and `-` (0x2D) sorts before `:` (0x3A), so `node-b-a`\n *   and `node-b:5` come out in one order by token and the other by name. PVE sorts by the name, so\n *   this does too.\n *\n * ⚠️ LAST ENTRY WINS FOR A REPEATED NODE, because PVE's decode is a hash assignment and a hash\n *   keeps one value per key. A declaration saying `node-b:1,node-b:5` is stored as `node-b:5`; matching that\n *   is what a Map gives for free.\n */\nexport const nodeList = (value: readonly string[] | string | undefined) => {\n  const ranked = new Map<string, number>();\n  for (const entry of typeof value === 'string' ? value.split(',') : (value ?? [])) {\n    const [node, priority] = entry.trim().split(':');\n    if (node === undefined || node === '') continue;\n    const rank = Number.parseInt(priority ?? '0', 10);\n    ranked.set(node, Number.isNaN(rank) ? 0 : rank);\n  }\n  return [...ranked.keys()]\n    .sort()\n    .map((node) => {\n      const rank = ranked.get(node) ?? 0;\n      return rank === 0 ? node : `${node}:${String(rank)}`;\n    })\n    .join(',');\n};\n\n/**\n * PVE's own verdict on whether the rule can be satisfied, flattened to one reportable string.\n *\n * ⚠️ COMPUTED, NEVER DECLARED, AND NEVER COMPARED. `PVE::API2::HA::Rules` runs `check_feasibility`\n *   over the WHOLE rule set on every read and attaches whatever it finds to each rule as\n *   `errors => { <option> => \"<message>, <message>\" }`. It therefore changes when somebody else's\n *   rule changes, and none of it is a parameter any write accepts. It belongs in attributes so a\n *   plan can show that PVE considers this rule unsatisfiable, and nowhere near `matches`.\n */\nexport const problems = (value: unknown) =>\n  typeof value === 'object' && value !== null\n    ? Object.entries(value)\n        .map(([option, message]) => `${option}: ${String(message)}`)\n        .sort()\n        .join('; ')\n    : '';\n\n/**\n * A comment as PVE will actually STORE it, which is not always the string it was handed.\n *\n * ⛔ PVE DECODES `%XX` OUT OF EVERY COMMENT ON THE WAY IN AND NEVER PUTS IT BACK. MEASURED:\n *   `PVE::SectionConfig::check_config` runs `decode_value` over each submitted field (line 1625 on\n *   this node), the base rule plugin's `decode_value` sends `comment` through\n *   `PVE::ParseUtils::decode_text` — `uri_unescape` then a utf8 decode — and `$get_api_ha_rule`\n *   hands the comment straight back WITHOUT re-encoding it (only `resources` and `nodes` are\n *   re-encoded there). So a declared `deploy%20window` is stored and returned as `deploy window`,\n *   and a `matches` comparing the declared string would report an update on every plan forever\n *   while every PUT wrote exactly what was already there.\n *\n * ★ SO THE COMPARISON MIRRORS THE DECODE RATHER THAN FIGHTING IT. Both sides then say what the\n *   cluster will really hold, which is the same move `nodeList` above makes for a re-sorted list.\n * ⚠️ GROUPS OF `%XX` ARE DECODED TOGETHER so a multi-byte utf8 sequence survives; a lone `%` or a\n *   malformed sequence is left alone, as `uri_unescape` leaves it. The one place this differs from\n *   Perl is a sequence that is valid percent-encoding but invalid utf8: Perl substitutes U+FFFD,\n *   this leaves the escape. Nothing in a comment should be reaching for that.\n */\nexport const commentText = (raw: string) =>\n  raw.replace(/(?:%[0-9a-fA-F]{2})+/g, (escaped) => {\n    try {\n      return decodeURIComponent(escaped);\n    } catch {\n      return escaped;\n    }\n  });\n\n/**\n * Every managed optional, per type: the value to send, or undefined for \"clear it\".\n *\n * ⛔ `disable=0` DOES NOT CLEAR A DISABLED RULE, AND THAT IS THE WORST TRAP IN THIS FAMILY.\n *   MEASURED in `/usr/share/perl5/PVE/API2/HA/Rules.pm`: both `create_rule` and `update_rule` run\n *   `delete $param->{disable} if !$param->{disable};` BEFORE the plugin sees the form. A PUT\n *   carrying `disable=0` is therefore a PUT carrying nothing — PVE answers 200, the rule stays\n *   disabled, `matches` reports an update on the next plan, and the loop never settles. The only\n *   way back on is `delete=disable`, which is why `disable` is in this table rather than in\n *   `required` below.\n *\n * ⛔ AND THE BRANCHES CANNOT BE ONE SHARED MAP. `PVE::SectionConfig::delete_from_config` dies\n *   `no such option '<k>'` for an option the plugin does not declare and `unable to delete\n *   required option '<k>'` for one it requires — so `delete=strict` against a resource-affinity\n *   rule is a hard failure, and `delete=nodes` or `delete=resources` would be one against either.\n *   Only `comment`, `disable` and (node-affinity only) `strict` are clearable at all.\n *\n * ⚠️ AN EMPTY `comment` IS A CLEARED ONE. PVE stores whatever string it is given, so writing `''`\n *   would leave the option present and empty rather than absent; `matches` reads both as `''`, but\n *   only the delete actually removes the line.\n */\nexport const optional = (props: HaRuleProps): Record<string, string | undefined> => ({\n  comment: props.comment === undefined || props.comment === '' ? undefined : props.comment,\n  disable: props.disable === true ? '1' : undefined,\n  ...(props.type === 'node-affinity' ? { strict: props.strict === true ? '1' : undefined } : {}),\n});\n\n/**\n * The fields sent on EVERY write, create and update alike.\n *\n * ⛔ `type` GOES OUT ON THE UPDATE TOO, AND LEAVING IT OFF BREAKS EVERY PUT. It reads like a\n *   create-only discriminant — the handler certainly treats it as one, taking the plugin from the\n *   STORED rule — but the PUT is still validated against a `oneOf` keyed on it. MEASURED in\n *   `PVE::JSONSchema::check_one_of` on this node: when the type property is absent the validator\n *   marks EVERY other key unknown and, unless the whole `oneOf` is itself optional, errors on the\n *   type property; its own comment says \"Its type property is otherwise never optional\", and\n *   `SectionConfig::updateSchema` builds that `oneOf` through `combine_schemas` without an\n *   `optional` flag. So an update that omitted it would fail parameter verification with a pile of\n *   \"unexpected property\" errors pointing at the fields it did send. It is safe to send because a\n *   rule of the other type is reported ABSENT by `attributes` and never reaches a PUT.\n *\n * ⚠️ `affinity` IS SENT UNCONDITIONALLY FOR BOTH TYPES. PVE requires it on a resource-affinity\n *   create and defaults it to `positive` on a node-affinity one; sending it either way means the\n *   read-back matches on the first plan after the create rather than relying on PVE materialising\n *   its own default into the file.\n *\n * ⚠️ THE LISTS GO OUT IN THEIR NORMALISED FORM, which is not required but is free: PVE re-sorts\n *   them anyway, so writing what it will hand back keeps the config file readable next to the\n *   declaration that produced it.\n *\n * ⚠️ NO `digest`. PVE accepts one on PUT as an optimistic lock, but the only digest this provider\n *   could send is the one from its own read moments earlier — and it is a digest of the WHOLE\n *   rules file, so any unrelated rule written in between would turn a correct update into a\n *   spurious failure. The factory's read-back guard is the check that stays.\n */\nconst required = (props: HaRuleProps): Record<string, string> => ({\n  affinity: props.affinity,\n  resources: csv(props.resources),\n  type: props.type,\n  ...(props.type === 'node-affinity' ? { nodes: nodeList(props.nodes) } : {}),\n});\n\nexport const body = (props: HaRuleProps) => {\n  const fields = required(props);\n  for (const [option, value] of Object.entries(optional(props))) {\n    if (value !== undefined) fields[option] = value;\n  }\n  return fields;\n};\n\n/**\n * The options an update must explicitly remove.\n *\n * ⛔ A PUT THAT OMITS A FIELD DOES NOT CLEAR IT — `update_rule` merges the form into the stored\n *   rule (`$rule->{$_} = $opts->{$_} for keys $opts->%*`) — so a managed optional needs a matching\n *   `delete=` the moment its prop goes away. Both halves come off the one table above, which makes\n *   \"managed but not clearable\" impossible to write here.\n * ⚠️ NEVER BOTH AT ONCE: `delete_from_config` dies `cannot set and delete property '<k>' at the\n *   same time!`. The table answers a value or `undefined`, never both, so the two lists are\n *   disjoint by construction.\n * ⚠️ THE CREATE FORM CANNOT USE THIS. `POST /cluster/ha/rules` has no `delete` parameter at all\n *   (MEASURED from the cluster's own schema), and it needs none: an omitted optional on a brand\n *   new rule is simply absent.\n */\nexport const clearList = (props: HaRuleProps) =>\n  Object.entries(optional(props))\n    .filter(([, value]) => value === undefined)\n    .map(([option]) => option);\n",
     "/**\n * `Proxmox.Lxc` — a container, declared: adopted as it runs, or created from a template.\n *\n * ★ THE PROVISIONING BASELINE HOLDS WHAT THIS NEEDS (provision-baseline.ts): on `/`, VM.Allocate,\n *   VM.Audit, VM.Config.{CPU,Disk,HWType,Memory,Network,Options}, VM.PowerMgmt,\n *   Datastore.AllocateSpace, Datastore.Audit, SDN.Use, Sys.Audit. What no token can do — device\n *   passthrough, bind mounts, features beyond nesting — PVE keeps for root@pam, and lxc-judge.ts\n *   refuses at plan with the `pct set` to run instead.\n *\n * ⛔ NOTHING HERE PLANS A REPLACE, AND NOTHING DESTROYS A GUEST BY DEFAULT. A replace of a guest is\n *   a delete of a running machine and its disks, so every change PVE cannot make in place — a new\n *   vmid, another template, an unprivileged flip, a storage move, a smaller disk, a move to\n *   another node — FAILS the plan with a sentence instead. `defaultRemovalPolicy: 'retain'`:\n *   dropping the declaration drops the state row and leaves the guest running; only\n *   `RemovalPolicy.destroy()` reaches `destroyGuest`, which deletes only a guest that still\n *   matches its last declaration, and PVE still refuses a running or protected one.\n * ⛔ AND NOTHING HERE WRITES A VOLUME IT DID NOT ALLOCATE. A create takes `storage:GiB` only\n *   (lxc-create-form.ts), and a deploy that planned a create never writes onto a guest it finds.\n *\n * ⛔ AND AN ADOPTION NEVER CHANGES A GUEST (lxc-adoption.ts). A guest this stack adopts is taken\n *   over exactly as it runs: any key the declaration says otherwise FAILS the plan, by name (never\n *   by value), and reconcile asks again before it would write. Only an exact match adopts.\n * ⚠️ AN UPDATE STILL PLANS `update` WITHOUT A PROPERTY DIFF, so `diff` LOGS the keys a deploy would\n *   write, by name, as a warning — the only place a plan says what the deploy will change.\n *\n * ⚠️ POWER STATE IS NOT DECLARED. `onboot` is config; start and stop are an operator's act, as for\n *   `Proxmox.Vm`. `start: 1` starts a guest once, after the create that built it, and never again.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type Owner, refuseTakeover } from '../ownership/adopt.ts';\nimport { ownedRead } from '../ownership/probe.ts';\nimport { provingResumes } from '../ownership/resume.ts';\nimport { createRefusals } from './lxc-create-form.ts';\nimport { identityRefusals } from './lxc-identity.ts';\nimport { refuseAdoptedDrift } from './lxc-adoption.ts';\nimport { judge } from './lxc-judge.ts';\nimport {\n  LxcRefusedError,\n  type LxcWhere,\n  attributesOf,\n  createGuest,\n  destroyGuest,\n  readLive,\n  updateGuest,\n} from './lxc-lifecycle.ts';\nimport type { LxcAttributes, LxcProps } from './lxc-props.ts';\nimport type { PveRequirements } from './resource.ts';\nimport { text } from './values.ts';\n\nexport type { LxcAttributes, LxcProps } from './lxc-props.ts';\n\nexport interface ProxmoxLxc extends Resource<\n  'Proxmox.Lxc',\n  LxcProps,\n  LxcAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a guest's disks cannot be rebuilt from a line. See resource.ts. */\nexport const ProxmoxLxc = Resource<ProxmoxLxc>('Proxmox.Lxc', { defaultRemovalPolicy: 'retain' });\n\n/** The ownership fields of one call (ownership/adopt.ts), with this resource's attributes. */\ntype LxcOwner = Owner & { readonly output: LxcAttributes | undefined };\n\nconst refused = (reasons: readonly string[]) =>\n  Effect.fail(new LxcRefusedError(reasons.join('\\n')));\n\n/**\n * ★ A ROW WITH NO ATTRIBUTES IS AN UNFINISHED CREATE. provingResumes (ownership/resume.ts) asks\n *   `read` whether the guest there is that create's before this runs, and notes it for the apply\n *   that follows, so reconcile can tell our own interrupted create from a guest somebody else put\n *   at this vmid.\n */\nconst diff = (owner: LxcOwner, news: Input<LxcProps>, olds: LxcProps) =>\n  Effect.gen(function* () {\n    const { output } = owner;\n    const identity = identityRefusals(news, olds, output);\n    if (identity.length > 0) return yield* refused(identity);\n    if (output === undefined) return undefined;\n    if (!isResolved(news)) return undefined;\n    const live = yield* readLive(news);\n    // ⚠️ `update`, not `create`: state exists and the guest does not. reconcile rebuilds it from\n    //   `ostemplate`, or refuses when there is none — an adopted guest has no recipe.\n    // ⛔ AND THE PLAN SAYS SO. A bare `update` here read as an edit while the deploy would build a\n    //   NEW guest with empty volumes; an uncreatable one now fails at plan rather than at deploy.\n    if (live === undefined) {\n      const refusals = createRefusals(news);\n      if (refusals.length > 0) return yield* refused(refusals);\n      yield* Effect.logWarning(\n        `Proxmox.Lxc ${news.node}/${String(news.vmid)}: the cluster lists no guest with this ` +\n          'vmid -- a deploy CREATES it again from ostemplate, with new, empty volumes.',\n      );\n      return { action: 'update' } as const;\n    }\n    const change = judge(news, live);\n    yield* refuseAdoptedDrift(owner, news, live, change);\n    if (change.refuse.length > 0) return yield* refused(change.refuse);\n    const moved = news.node !== output.node;\n    if (change.drift.length === 0 && !moved) return { action: 'noop' } as const;\n    const what =\n      change.drift.length === 0\n        ? `the guest is on ${news.node} now, not ${output.node} -- a deploy re-records it, ` +\n          'writing nothing.'\n        : `live config differs from the declaration in ${change.drift.join(', ')} -- a ` +\n          'deploy writes these.';\n    yield* Effect.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: ${what}`);\n    return { action: 'update' } as const;\n  });\n\n/**\n * ⛔ THE SAME JUDGE AS `diff`, RE-RUN AGAINST A FRESH READ, AND AN EMPTY CHANGE WRITES NOTHING.\n *   Apply routes `adopted` through reconcile (resource.ts has the Apply.ts lines), so this is what\n *   runs on the first deploy after an adoption; for a guest that already matches it is two GETs,\n *   and for one edited since the plan it is a refusal, never a write (lxc-adoption.ts).\n * ⛔ AND IT READS BACK AND JUDGES AGAIN. PVE answers 200 on writes that did nothing, so a change\n *   that did not land is a failure here, not a state row claiming it did. ⚠️ A change PVE parked\n *   as pending on a running guest DOES read back (GET config merges `[pending]` unless asked for\n *   `current`), so it passes here and takes effect at the guest's next restart.\n * ⛔ A CREATE NEVER WRITES ONTO A GUEST THAT IS ALREADY THERE. `output` undefined means the plan\n *   said `create`: its adoption probe saw no guest, or never ran (Plan.ts skips it while any prop\n *   is an unresolved Output — a `net0` built from a vnet created in the same deploy). Finding one\n *   now, it is first an OWNERSHIP question (docs/ownership.md): `refuseTakeover` lets it through\n *   only for this resource's own interrupted create or under `--adopt` / `adopt(true)`, and\n *   otherwise refuses and forgets the `creating` row, a matching guest included. Then a CONTENT\n *   one: a guest that already matches is recorded with no write; any other refuses even under\n *   `--adopt`, until a plan can show the keys a deploy would write onto it.\n */\nconst reconcile = (owner: LxcOwner, news: LxcProps) =>\n  Effect.gen(function* () {\n    const { output } = owner;\n    const identity = identityRefusals(news, news, output);\n    if (identity.length > 0) return yield* refused(identity);\n    const live = yield* readLive(news);\n    if (live === undefined) {\n      const refusals = createRefusals(news);\n      if (refusals.length > 0) return yield* refused(refusals);\n      yield* createGuest(news);\n    } else {\n      if (output === undefined) {\n        yield* refuseTakeover(owner, `Proxmox.Lxc CT ${String(news.vmid)} on ${news.node}`);\n      }\n      const change = judge(news, live);\n      if (output === undefined && change.drift.length > 0) {\n        return yield* refused([\n          `CT ${String(news.vmid)} already exists on ${news.node} and differs in ` +\n            `${change.drift.join(', ')}, but this deploy planned a create. A create never writes ` +\n            'onto an existing guest: plan again, so the plan can show it and adopt it.',\n        ]);\n      }\n      yield* refuseAdoptedDrift(owner, news, live, change);\n      if (change.refuse.length > 0) return yield* refused(change.refuse);\n      if (change.drift.length > 0) yield* updateGuest(news, change, text(live['digest']));\n    }\n    const after = yield* readLive(news);\n    if (after === undefined) {\n      return yield* refused([\n        `CT ${String(news.vmid)}: the write returned no error but the guest is still absent.`,\n      ]);\n    }\n    const left = judge(news, after).drift;\n    if (left.length > 0) {\n      return yield* refused([\n        `CT ${String(news.vmid)}: after the write, ${left.join(', ')} still differ from the ` +\n          'declaration. PVE may have normalised the value (tags are lower-cased by default) -- ' +\n          'declare what it stores.',\n      ]);\n    }\n    return attributesOf(news, after);\n  });\n\nconst whereOf = (olds: LxcProps, output: LxcAttributes | undefined): LxcWhere => ({\n  node: output?.node ?? olds.node,\n  target: olds.target,\n  vmid: output?.vmid ?? olds.vmid,\n});\n\n/**\n * ⛔ NO LIVE GUEST IS ADOPTED WITHOUT `--adopt`, NOT EVEN ONE THAT MATCHES (docs/ownership.md,\n *   decided 2026-09-21). With no state this read is Alchemy's adoption probe (Plan.ts), and plain\n *   attributes would mean \"ours\", adopted silently. Matching is not proof: a pasted config or a\n *   mistyped vmid reads the same as our own guest, and once state claims it,\n *   `RemovalPolicy.destroy()` deletes it and its volumes from its real owner. So it reads\n *   `Unowned`, and the plan fails \"Cannot adopt\" until `adopt(true)` or `--adopt` says so.\n * ★ THE RECOVERY READ STILL FINISHES OUR OWN CREATE. A `creating` row whose deploy died after the\n *   POST carries its own instance id; `ownedRead` accepts the guest when the state store records\n *   that id AND the guest still matches the row's props — the same judge `diff` uses.\n * ⚠️ UNLIKE `CaddyConfig`, which keeps adopting an identical config because its delete never\n *   touches Caddy: a container's delete removes a machine and its disks.\n */\nconst read = (owner: LxcOwner, olds: LxcProps) =>\n  Effect.gen(function* () {\n    const where = whereOf(olds, owner.output);\n    const live = yield* readLive(where);\n    if (live === undefined) return undefined;\n    const settled = Effect.sync(() => judge(olds, live).drift.length === 0);\n    return yield* ownedRead(owner, attributesOf(where, live), settled);\n  });\n\n/**\n * ⛔ HAND-WRITTEN RATHER THAN `pveHandlers`: a guest reads failures as failures, grows disks\n *   through a second endpoint, waits on tasks and refuses what the factory would replace. `list`\n *   is empty for the reason it is everywhere here: `GET /nodes/{n}/lxc` lists every guest on the\n *   node, and adopting one is a declaration, never a side effect of registering the provider.\n */\ntype Asked = { readonly fqn: string; readonly instanceId: string };\n\nconst handlers = {\n  delete: ({ olds, output }: { olds: LxcProps; output: LxcAttributes }) =>\n    destroyGuest(whereOf(olds, output), olds),\n  diff: ({\n    fqn,\n    instanceId,\n    news,\n    olds,\n    output,\n  }: Asked & { news: Input<LxcProps>; olds: LxcProps; output: LxcAttributes | undefined }) =>\n    diff({ fqn, instanceId, output }, news, olds),\n  list: () => Effect.succeed([]),\n  read: ({\n    fqn,\n    instanceId,\n    olds,\n    output,\n  }: Asked & { olds: LxcProps; output: LxcAttributes | undefined }) =>\n    read({ fqn, instanceId, output }, olds),\n  reconcile: ({\n    fqn,\n    instanceId,\n    news,\n    output,\n  }: Asked & { news: LxcProps; output: LxcAttributes | undefined }) =>\n    reconcile({ fqn, instanceId, output }, news),\n};\n\nexport const ProxmoxLxcProvider = () =>\n  Provider.effect(\n    ProxmoxLxc,\n    Effect.succeed(ProxmoxLxc.Provider.of(handlers)).pipe(Effect.map(provingResumes)),\n  );\n",
@@ -93,7 +95,7 @@
     "/** The reload itself: one node, one lease, one task, then a health check. */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport { guardNetworkApply } from './apply-endpoints.ts';\nimport { runPveWith } from './distilled-pve.ts';\nimport { mint } from './mint.ts';\nimport { awaitTask, degradedReason, pendingCount } from './network-apply-read.ts';\nimport type { NetworkApplyProps } from './network-apply.ts';\nimport { text } from './values.ts';\n\n/** Stop the deploy, loudly, with the node in the message. ⚠️ A die here is the SAFE outcome. */\nconst refuse = (node: string, why: string) =>\n  Effect.die(new Error(`Proxmox.NetworkApply ${node}: ${why}`));\n\nexport const applyNetwork = (props: NetworkApplyProps) =>\n  Effect.gen(function* () {\n    const node = props.node;\n    const staged = yield* pendingCount(props.target, node);\n    /**\n     * ⛔ NOTHING STAGED MEANS NOTHING TO APPLY, AND THIS BRANCH IS A SAFETY PROPERTY RATHER THAN AN\n     *   OPTIMISATION. `reconcile` also runs on CREATE — the first time this resource appears in a\n     *   stack, before `diff` has ever been consulted — and the PVE worker runs `ifreload -a`\n     *   UNCONDITIONALLY, staged file or not. Without this branch, adding `Proxmox.NetworkApply` to\n     *   a stack describing the cluster as it already is would reload networking on every node it\n     *   names, for nothing. Adoption must cost nothing; that is true here in the strongest sense.\n     */\n    if (staged === 0) return { node, pending: 0 };\n\n    const before = yield* degradedReason(props.target);\n    if (before !== undefined) {\n      return yield* refuse(\n        node,\n        `refusing to reload networking on a cluster that is already degraded (${before}). ` +\n          'Ceph spans these nodes -- fix the cluster first, then re-run the deploy.',\n      );\n    }\n\n    /**\n     * ⚠️ ONE LEASE FOR BOTH CALLS, VIA `runPveWith` RATHER THAN `runPve`. Each mint returns a NEW token\n     *   id, and the task-status endpoint only skips its `Sys.Audit` check for the task's OWNER —\n     *   so polling with a fresh mint is a different identity and needs a privilege this role does\n     *   not have. The `provision` lease is 300s and non-renewable, which is far longer than a\n     *   reload and is the reason no renew path is reached for.\n     */\n    // ⛔ BEFORE THE MINT AND THE RELOAD. The apply takes no body, so this is the lookup rather\n    //   than a value check: a vendor that moved this endpoint fails here, not mid-ifreload.\n    yield* guardNetworkApply;\n    const credential = yield* mint(props.target, 'provision');\n    const upid = text(\n      yield* runPveWith(props.target, credential, true, nodes.putNodeNetwork({ node })),\n    );\n    if (upid === '') {\n      return yield* refuse(\n        node,\n        'the apply returned no UPID. PVE wraps every answer in {\"data\":...} and can report success ' +\n          'on a call that did nothing -- the reload cannot be confirmed, so it is not claimed.',\n      );\n    }\n\n    /**\n     * ⛔ POLLING `pending` INSTEAD OF THE TASK WOULD REPORT SUCCESS BEFORE THE NETWORK WAS TOUCHED.\n     *   MEASURED in the worker above: the `rename` happens FIRST and `ifreload -a` second, so the\n     *   staged file — and therefore `changes`, and therefore `pending` — disappears while the\n     *   reload has not yet started. A provider that watched the count would call a reload that had\n     *   not run, and a reload that then FAILED, a success. The task's exitstatus is the only\n     *   honest answer.\n     */\n    const exitstatus = yield* awaitTask(props.target, credential, node, upid);\n    if (exitstatus !== 'OK') {\n      return yield* refuse(\n        node,\n        `the reload ended \"${exitstatus}\" (${upid}). Read it from ANOTHER node -- ` +\n          `\\`pvesh get /nodes/${node}/tasks/${upid}/log\\` -- and do not apply the next node until ` +\n          'this one is understood.',\n      );\n    }\n\n    const after = yield* degradedReason(props.target);\n    if (after !== undefined) {\n      return yield* refuse(\n        node,\n        `the reload reported OK but the cluster is now degraded (${after}). The next ` +\n          'node has NOT been applied. Restore this one before continuing -- Ceph runs over these ' +\n          'links and a second reload now would take pools below min_size.',\n      );\n    }\n\n    const left = yield* pendingCount(props.target, node);\n    if (left !== 0) {\n      return yield* refuse(\n        node,\n        `the reload reported OK but ${String(left)} staged line(s) remain. The running config does ` +\n          'not match the declared one, and saying otherwise is the lie this resource exists to stop.',\n      );\n    }\n    return { node, pending: left };\n  });\n",
     "/**\n * The two applies, and the vendor endpoints they publish through.\n *\n * ★ AN ACTION ENDPOINT IS STILL WIRED, EVEN THOUGH ITS TABLE IS EMPTY, AND THE REASON IS THE\n *   GENERATOR RATHER THAN THE VALIDATOR. `PUT /nodes/{node}/network` and `PUT /cluster/sdn` take\n *   no body at all — there is nothing for a length or a range to be wrong about — but\n *   `codegen/constraints.ts` RESOLVES every key named in this package against the vendor's own\n *   schema and STOPS when one is absent. So the key buys the thing these two families most need:\n *   a PVE that moves, renames or withdraws the apply fails `bun run check` instead of failing an\n *   `ifreload -a` on three nodes at once.\n * ⚠️ AND THE LOOKUP IS NOT FREE EITHER. `constraintsFor` throws when a key has no table, so a\n *   checkout whose generated tables were never refreshed refuses the apply with the command to\n *   run rather than quietly doing nothing — the same defect `constraint-guard.ts` names.\n *\n * ⛔ NEITHER OF THESE IS A CREATE, AND NEITHER FAMILY HAS A `PveSpec`. Both write their own five\n *   handlers (an apply is not an object — see the ⛔ in each file), so they reach the shared check\n *   through `guardForm` by name, exactly as `pbs-datastore-endpoint.ts` does.\n */\nimport type * as Effect from 'effect/Effect';\nimport { guardForm } from './constraint-guard.ts';\nimport type { EndpointKey } from './constraints.ts';\n\n/** ⚠️ `{node}` is a path segment, so this really does take no form keys at all. */\nexport const NETWORK_APPLY_ENDPOINT: EndpointKey = 'pve:PUT /nodes/{node}/network';\n\n/**\n * ⛔ CLUSTER-WIDE. One PUT publishes every staged zone, vnet and subnet on every node; there is no\n *   per-object apply and no pre-apply veto. `sdn-apply.ts` is the whole argument.\n */\nexport const SDN_APPLY_ENDPOINT: EndpointKey = 'pve:PUT /cluster/sdn';\n\nexport const guardNetworkApply: Effect.Effect<void> = guardForm(NETWORK_APPLY_ENDPOINT, {}, true);\n\nexport const guardSdnApply: Effect.Effect<void> = guardForm(SDN_APPLY_ENDPOINT, {}, true);\n",
     "/**\n * How this package finds out what a node has STAGED, and whether the cluster survived an apply.\n *\n * ★ SPLIT OUT OF network-apply.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is a real\n *   one rather than a convenient line number: this file answers \"what is true on the cluster right\n *   now\", network-apply.ts answers \"what does the resource do about it\". Nothing here decides a\n *   diff, and the only write in either file is the apply itself.\n *\n * ⛔ THE PENDING STATE IS NOT IN `data`, WHICH IS WHY THIS FILE DOES ITS OWN FETCH. MEASURED in the\n *   cluster's own source on node-b, 2026-09-13 — not inferred from documentation:\n *     PVE/API2/Network.pm   my $tmp = PVE::INotify::read_file('interfaces', 1);\n *                           $rpcenv->set_result_attrib('changes', $changes) if $changes;\n *     PVE/HTTPServer.pm     if (my $diff = $rpcenv->get_result_attrib('changes')) {\n *                               $resp->{changes} = $diff;\n *                           }\n *   So the answer is `{\"data\":[…interfaces…],\"changes\":\"<unified diff>\"}`: `changes` is a SIBLING\n *   of `data`, set only when the diff is non-empty. `client.ts`'s `pve()` returns `body.data` and\n *   drops the envelope, so the one readable pending signal is invisible to every other resource in\n *   this package. Without the fetch below, `Proxmox.NetworkApply` could not diff honestly at all.\n *   ★ `listNodeNetwork` keeps a string `changes` sibling. The protocol unwraps every other\n *     envelope. The diff string is counted here and then dropped.\n *\n * ⛔ AND THE INTERFACE ROWS CANNOT TELL YOU EITHER. MEASURED in PVE/INotify.pm `read_file`: when\n *   `/etc/network/interfaces.new` exists, THAT is the file that gets parsed, so\n *   `GET /nodes/{node}/network` answers with the STAGED config and a node about to be reconfigured\n *   looks identical to one already running it. Same trap `sdn-apply.ts` documents for `?running=1`.\n *\n * ⚠️ `active` IS NOT A PENDING SIGNAL, AND THE OBVIOUS SHORTCUT IS MEASURABLY WRONG. On node-b and node-c,\n *   with nothing staged anywhere (VERIFIED 2026-09-13: `/etc/network/interfaces.new` absent on node-b,\n *   node-c and node-d), `wlan0` already comes back with no `active` key at all. Counting interfaces that\n *   are not up as \"pending\" would report an update on two of the three nodes forever.\n *\n * ⚠️ ONE THING GENUINELY CANNOT BE SEEN FROM HERE, AND IT IS SMALL. The diff is computed as\n *   `diff -b -N -u`, so a staged file differing from the live one ONLY in whitespace produces no\n *   `changes` at all. This module reports that node as settled while `interfaces.new` still sits\n *   there waiting for the next reload anybody triggers. The file's existence is not exposed by the\n *   API in any other form, so the alternative is not a better read — it is SSH.\n */\nimport * as cluster from '@distilled.cloud/proxmox/cluster';\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport { runPve, runPveWith } from './distilled-pve.ts';\nimport { type PveCredential, type PveTarget } from './credentials.ts';\nimport { leased } from './lease-cache.ts';\nimport { bool, text } from './values.ts';\n\n/** What the cluster looked like the moment it was asked. Never persisted — see network-apply.ts. */\nexport type ClusterHealth = { quorate: boolean; offline: readonly string[] };\n\n/**\n * The unified diff between a node's applied interfaces file and its staged one, or `''`.\n *\n * ⛔ THIS STRING NEVER LEAVES THIS MODULE, AND THAT IS A SECRET RULE, NOT A STYLE ONE. Alchemy\n *   persists attributes UNENCRYPTED (credentials.ts spells out why), and `/etc/network/interfaces`\n *   is a file that can legally contain `wpa-psk` — node-b and node-c both carry a `wlan0`, MEASURED — as\n *   well as any `pre-up` command somebody wrote. A diff of that file in a state store is a secret\n *   in a state store. Only the COUNT below ever escapes.\n */\nconst stagedDiff = (target: PveTarget, node: string) =>\n  Effect.gen(function* () {\n    // ⚠️ THE `read` ROLE IS ENOUGH, AND DELIBERATELY SO. The schema's permission for this GET is\n    //   `\"user\": \"all\"` — no privilege check at all — so the pending read never needs the\n    //   provisioning lease, and a plan stays a plan even if the write role is missing entirely.\n    // ⛔ THROUGH THE LEASE CACHE, NOT `mint`. This read needs no particular identity — only the\n    //   apply and its task poll do, and network-apply.ts mints for those itself. Minting here left\n    //   SIX extra `hf-read@pve` tokens on node-b per C1 plan (one per node, for read and for diff),\n    //   MEASURED 2026-09-14 while the cache itself made one read mint for the whole run.\n    const credential = yield* leased(target, 'read');\n    const live = yield* runPveWith(target, credential, false, nodes.listNodeNetwork({ node }));\n    // ⛔ The diff string is not returned from pendingCount and is not an attribute.\n    return Array.isArray(live) ? '' : live.changes;\n  });\n\n/**\n * Changed lines in a unified diff.\n *\n * ⚠️ A NON-EMPTY DIFF IS NEVER REPORTED AS ZERO, WHICH IS WHAT `Math.max` IS FOR. The `+++`/`---`\n *   headers have to be skipped, and a removed line whose own text starts with `---` is skipped with\n *   them; a staged change consisting of nothing else would otherwise count 0 and be reported as\n *   \"settled\", which is the exact lie this resource exists to prevent. The count is informational —\n *   the resource only ever compares it to zero — so an occasional undercount of 1 is harmless while\n *   an undercount to zero is not.\n */\nexport const pendingLines = (diff: string) => {\n  if (diff === '') return 0;\n  const changed = diff\n    .split('\\n')\n    .filter(\n      (line) =>\n        (line.startsWith('+') || line.startsWith('-')) &&\n        !line.startsWith('+++') &&\n        !line.startsWith('---'),\n    ).length;\n  return Math.max(changed, 1);\n};\n\n/** How many staged lines this node is carrying. Zero is the only settled value. */\nexport const pendingCount = (target: PveTarget, node: string) =>\n  stagedDiff(target, node).pipe(Effect.map(pendingLines));\n\n/**\n * Quorum, and every member that is not online.\n *\n * ⛔ QUORUM ALONE IS NOT THE CHECK, AND ON A THREE-NODE CLUSTER IT WOULD MISS THE ACCIDENT THIS\n *   RESOURCE IS AFRAID OF. Losing ONE of three leaves `quorate: 1` — MEASURED shape on C1:\n *   `{\"id\":\"cluster\",\"name\":\"HF-C1\",\"nodes\":3,\"quorate\":1,…}` plus one row per node with\n *   `online: 1`. So a reload that drops node-b off the network is invisible to `quorate` and visible\n *   only as `online: 0` on that row. Both are checked, and the node names come back so the failure\n *   message can say WHICH member went away.\n *\n * ⚠️ AN UNCLUSTERED NODE IS QUORATE BY DEFINITION. A standalone PVE answers with node rows and no\n *   `cluster` row; reading that absence as \"not quorate\" would make this resource undeclarable on\n *   every single-node install.\n *\n * ⚠️ THIS ONE NEEDS `Sys.Audit` ON `/` — the only privilege in this family beyond the apply itself.\n *   It is asked of the `read` role, which is auditor-shaped, rather than of `provision`.\n */\nconst clusterHealth = (target: PveTarget) =>\n  runPve(target, 'read', false, cluster.listClusterStatus({})).pipe(\n    Effect.map((rows) => {\n      const all = rows ?? [];\n      const cluster = all.find((row) => row.type === 'cluster');\n      return {\n        offline: all\n          .filter((row) => row.type === 'node' && !bool(row.online))\n          .map((row) => text(row.name, '<unnamed>')),\n        quorate: cluster === undefined ? true : bool(cluster.quorate),\n      } satisfies ClusterHealth;\n    }),\n  );\n\n/**\n * Why the cluster is not healthy, or `undefined` when it is.\n *\n * ★ A REASON RATHER THAN A BOOLEAN, BECAUSE THE CALLER'S ONLY USE FOR IT IS A REFUSAL MESSAGE.\n *   \"The deploy stopped because the cluster was degraded\" is not actionable at three in the\n *   morning; \"quorate=true offline=[node-c]\" is. The two callers in network-apply.ts ask this before\n *   the reload and again after it, and the second answer is the one that stops the chain from\n *   reaching the next node.\n *\n * ⚠️ A MEMBER OFFLINE FOR AN UNRELATED REASON BLOCKS EVERY APPLY, AND THAT IS THE INTENDED\n *   BEHAVIOUR RATHER THAN AN OVERSIGHT. A node down for maintenance is one failure away from the\n *   pools losing min_size; reloading another node's networking while it is out is the move that\n *   completes the outage. Bring it back, or apply by hand with the cluster in front of you.\n */\nexport const degradedReason = (target: PveTarget) =>\n  clusterHealth(target).pipe(\n    Effect.map((health) =>\n      health.quorate && health.offline.length === 0\n        ? undefined\n        : `quorate=${String(health.quorate)} offline=[${health.offline.join(', ')}]`,\n    ),\n  );\n\n/**\n * ⛔ NOT AN EXITSTATUS PVE CAN RETURN, AND THAT IS THE POINT. The caller compares against `'OK'`;\n *   these two say WHY the answer is not OK without needing a second branch for \"we do not know\".\n */\nexport const UNREACHABLE =\n  'the task could not be read -- the node stopped answering, or this lease cannot see it';\nconst STILL_RUNNING = 'still running when this provider stopped waiting';\n\n/**\n * How long to wait on `ifreload`, in one-second polls.\n *\n * ⚠️ THIRTY SECONDS IS A CEILING, NOT AN EXPECTATION. A reload of a handful of interfaces finishes\n *   in a second or two; past thirty, something is wrong in a way a deploy cannot fix by waiting,\n *   and the honest move is to stop and name the task rather than park the stack on it.\n */\nconst ATTEMPTS = 30;\n\n/**\n * Wait for one `srvreload` task and answer its exitstatus.\n *\n * ⛔ THE APPLY IS ASYNCHRONOUS AND ITS 200 MEANS NOTHING. MEASURED: `reload_network_config` ends\n *   `return $rpcenv->fork_worker('srvreload', 'networking', $authuser, $worker)`, so the PUT\n *   returns a UPID the instant the worker is forked — before `ifreload -a` has run, let alone\n *   succeeded. Waiting for the task is the only way to learn the outcome.\n *\n * ⛔ AND IT MUST BE POLLED WITH THE CREDENTIAL THAT STARTED IT. The task-status schema says\n *   `\"user\": \"all\"` with the note \"needs 'Sys.Audit' on '/nodes/<node>' if they are not the owner\n *   of the task\". Every mint returns a NEW token id, so a second mint is a different identity and\n *   is not the owner — which is why this takes a `PveCredential` and the caller keeps one lease\n *   across both calls, instead of widening the provisioning role to read its own tasks.\n *\n * ★ A poll failure stays `UNREACHABLE`. `getNodeTaskStatus` would otherwise fail the reload\n *   on the connection drop this function exists to survive.\n */\nexport const awaitTask = (\n  target: PveTarget,\n  credential: PveCredential,\n  node: string,\n  upid: string,\n  // ★ A CALLER WHOSE TASK IS SLOWER THAN A RELOAD SAYS SO: an LXC create unpacks a template.\n  attempts: number = ATTEMPTS,\n) =>\n  Effect.gen(function* () {\n    // ★ The SDK percent-encodes the UPID label. PVE APIServer unescapes it before routing.\n    for (let attempt = 0; attempt < attempts; attempt += 1) {\n      /**\n       * ⛔ A FAILED POLL IS NOT A FAILED RELOAD, AND CALLING IT ONE WOULD BE THE WORST KIND OF\n       *   WRONG. If the member serving the poll is the node being reloaded, `ifreload -a` can drop\n       *   the very connection this poll rides on — see network-apply.ts.\n       *   The reload may well have succeeded. So the call is collapsed to \"we cannot see the task\"\n       *   and the caller reports the outcome as UNKNOWN, with the UPID, rather than guessing.\n       * ⚠️ A 403 LANDS HERE TOO, AND IT READS THE SAME. If the polling identity is somehow not the\n       *   task's owner, the endpoint wants `Sys.Audit` on the node and this sees only \"no answer\" —\n       *   which is why `UNREACHABLE` names both possibilities rather than blaming the network.\n       */\n      const status = yield* runPveWith(\n        target,\n        credential,\n        false,\n        nodes.getNodeTaskStatus({ node, upid }),\n      ).pipe(Effect.orElseSucceed(() => undefined));\n      if (status === undefined) return UNREACHABLE;\n      if (status.status === 'stopped') return text(status.exitstatus, 'stopped with no exitstatus');\n      yield* Effect.sleep('1 second');\n    }\n    return STILL_RUNNING;\n  });\n",
-    "/**\n * `Proxmox.NodeNetwork` — one stanza of a node's `/etc/network/interfaces`, declared.\n *\n * ⛔ DECLARING THIS RESOURCE IS SAFE. APPLYING IT IS A SEPARATE, DELIBERATE ACT, AND IT IS NOT\n *   PERFORMED HERE. Every write under `/nodes/{node}/network/{iface}` lands in\n *   `/etc/network/interfaces.new` and changes no running interface. MEASURED, from PVE::INotify:\n *   `$shadowfiles = { '/etc/network/interfaces' => '/etc/network/interfaces.new' }`, and\n *   `read_file` reads the SHADOW when it exists. The apply is `PUT /nodes/{node}/network`, which\n *   renames the shadow over the real file and runs `ifreload -a`; the revert is\n *   `DELETE /nodes/{node}/network`, which simply unlinks the shadow. A sibling resource models\n *   that apply — this one never calls it, exactly as `Proxmox.SdnZone` never calls\n *   `Proxmox.SdnApply`.\n *\n * ⛔ `Proxmox.NetworkApply` STAYS ON `client.ts`, NOT MIGRATED WITH THIS FILE — network-apply-\n *   read.ts's own header has the two MEASURED reasons distilled cannot represent yet.\n *\n * ⛔ CEPH ON C1 RIDES TWO NETWORKS AND THIS API ONLY SEES ONE OF THEM. Measured from\n *   `/etc/pve/ceph.conf` on 2026-09-13:\n *\n *     public_network  = 198.51.100.0/24     -> vmbr1.42, which this resource DOES see\n *     cluster_network = 203.0.113.0/24     -> every OSD's cluster_addr: .102 / .103 / .104\n *\n *   The cluster network — OSD REPLICATION, the traffic that rebuilds a lost replica — lives on\n *   `203.0.113.10X/32` addresses carried by `tb0`, `tb1` and `dummy_c1`: the Thunderbolt mesh —\n *   TB4's own fabric ports, EXCLUDED from this family by decision 28/29/9 (SdnFabric owns them).\n *\n * ⛔ AND THOSE ADDRESSES ARE INVISIBLE HERE, WHICH IS THE TRAP. They are declared in\n *   `/etc/network/interfaces.d/sdn`, and PVE's network API does not parse that directory.\n *   MEASURED: `GET /nodes/node-b/network/tb0` answers `{\"method\":\"manual\",\"type\":\"eth\",…}` with NO\n *   address, while `ip -br -4 addr` shows `tb0  UP  203.0.113.102/32`. So this resource reports\n *   tb0 and tb1 as address-less manual ports and will plan `noop` over them — implicitly\n *   asserting they carry no address, which is FALSE.\n *\n *   The consequence, stated plainly: declaring tb0/tb1 from what this API reports and then\n *   DESTROYING or applying over them takes out OSD replication on a cluster whose pools are\n *   size 3 / min_size 2. They read as the most boring interfaces on the node and are the two most\n *   dangerous. Leave them undeclared; if they must be managed, manage the file that actually\n *   owns them, not this resource.\n *\n * ⚠️ Two ways this file limits the damage on the interfaces it CAN see: `cidr` is compared\n *   unconditionally (node-network-wire.ts's own ⛔ on `matches`), and a live interface whose\n *   `type` disagrees with the declaration is reported ABSENT rather than retyped\n *   (node-network-wire.ts's `attributesOf`).\n *\n * ★ THE REASON IT EXISTS IS THAT THE STAGED READ CANNOT TELL YOU THE NETWORK IS RIGHT — it can\n *   only tell you the FILE is. Once anything is staged, `GET /nodes/{node}/network/{iface}`\n *   answers from `interfaces.new`, so `matches` compares a declaration against a pending file and\n *   reports `noop` over a node whose running config has not moved. The apply resource is what\n *   closes that gap; this resource's `noop` means \"the file says what you said\", no more.\n *\n * ⚠️ PRIVILEGES ARE COARSER HERE THAN ANYWHERE ELSE IN THE PACKAGE: reads want `Sys.Audit` on\n *   `/nodes/{node}`, every write `Sys.Modify` on it — and there is no `/nodes/{node}/network` ACL\n *   object to scope to, so that also buys the node's services, certificates, DNS and time.\n *   Collected with every other family in docs/privileges.md.\n *\n * ★ A RECONCILE OVER A MATCHING INTERFACE IS A NO-WRITE. `reconcile` below gates the PUT on\n *   `matches` first — adopting an interface a node already has must not leave it holding a\n *   pending network change, since a PUT under `/nodes/{node}/network/{iface}` STAGES one.\n *\n * ⚠️ WHAT IS STILL TRUE: when `matches` is false the PUT rewrites the whole stanza, and that can\n *   ADD lines the file did not have — a `vlan-raw-device vmbr1` under `vmbr1.42`, where PVE had\n *   been deriving it from the name. Harmless in content, and it costs nothing until somebody\n *   applies; one more reason the apply is a separate resource.\n *\n * ⚠️ `list` IS EMPTY, AND HERE THAT MATTERS MORE THAN ANYWHERE ELSE IN THIS PACKAGE. The index\n *   returns every interface the node has, `vmbr0`, `bond0` and the Ceph vlan included. Adopting\n *   them would put Alchemy one `destroy` away from staging the removal of a node's uplink — and\n *   `delete_network` has NO in-use check at all: MEASURED, it deletes the hash entry and writes\n *   the file. Adoption stays explicit.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s\n *   typed `nodes.getNodeNetwork`/`createNodeNetwork`/`putNodeNetwork2`/`deleteNodeNetwork2`\n *   (2026-09-24, decision 43). Dual-path read and `read`'s `output`-branching wired like every\n *   other migrated family; node-network-wire.ts's `readInterfaceOrFail` has the new nuance.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport { guardWrite } from './distilled-guard.ts';\nimport {\n  NODE_NETWORK_CREATE,\n  NODE_NETWORK_UPDATE,\n  type NodeNetworkProps,\n  createForm,\n  updateForm,\n} from './node-network-form.ts';\nimport {\n  dropUnreadable,\n  matches,\n  readInterface,\n  readInterfaceOrFail,\n} from './node-network-wire.ts';\nimport type { NodeNetworkAttributes } from './node-network-wire.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { type PveRequirements } from './resource-spec.ts';\nimport { UNREADABLE, unreadableWarning } from './unreadable-read.ts';\n\nexport type { NodeNetworkAttributes, NodeNetworkType } from './node-network-wire.ts';\n// ⚠️ MOVED TO node-network-form.ts IN THIS PR'S LINE-CAP TRIM — every field on it is already\n//   documented there against `body`/`createForm`/`updateForm`, so it travels with them rather\n//   than duplicating that documentation here. Nothing about its shape changed.\nexport type { NodeNetworkProps } from './node-network-form.ts';\n\nexport interface ProxmoxNodeNetwork extends Resource<\n  'Proxmox.NodeNetwork',\n  NodeNetworkProps,\n  NodeNetworkAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a node's only uplink cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxNodeNetwork = Resource<ProxmoxNodeNetwork>('Proxmox.NodeNetwork', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * The three fields distilled's generator renamed to an underscore (`bond-primary`, `vlan-id`,\n * `vlan-raw-device`) — everything else round-trips as-is. `storage-form.ts`'s `underscored` is a\n * generic transform for a free-form bag; this family's fields are all named ahead of time, so a\n * small local map is clearer than importing a generic helper for three keys. Moved here from\n * node-network-form.ts in this PR's line-cap trim — this is the only caller.\n */\nconst RENAMED: Readonly<Record<string, string>> = {\n  'bond-primary': 'bond_primary',\n  'vlan-id': 'vlan_id',\n  'vlan-raw-device': 'vlan_raw_device',\n};\n\nconst toDistilled = (form: Record<string, string>): Record<string, string> =>\n  Object.fromEntries(Object.entries(form).map(([key, value]) => [RENAMED[key] ?? key, value]));\n\n/** The actual `createNodeNetwork` call body — `createForm`, translated once. See `toDistilled`. */\nconst toDistilledCreate = (props: NodeNetworkProps): nodes.CreateNodeNetworkRequest =>\n  ({\n    ...toDistilled(createForm(props)),\n    node: props.node,\n  }) as unknown as nodes.CreateNodeNetworkRequest;\n\n/** The actual `putNodeNetwork2` call body — `updateForm`, translated once. See `toDistilledCreate`. */\nconst toDistilledUpdate = (props: NodeNetworkProps): nodes.PutNodeNetwork2Request =>\n  ({\n    ...toDistilled(updateForm(props)),\n    iface: props.iface,\n    node: props.node,\n  }) as unknown as nodes.PutNodeNetwork2Request;\n\nexport const ProxmoxNodeNetworkProvider = () =>\n  Provider.effect(\n    ProxmoxNodeNetwork,\n    Effect.succeed(\n      ProxmoxNodeNetwork.Provider.of({\n        /**\n         * ⛔ EMPTY, AND HERE IT MATTERS MORE THAN ANYWHERE ELSE IN THIS PACKAGE. `GET\n         *   /nodes/{node}/network` returns every interface the node has. Adoption stays explicit.\n         */\n        list: () => Effect.succeed([]),\n        // ⚠️ FOLDS ONLY WHEN `output` IS `undefined`, restored by adversarial review after a\n        //   first draft dropped it — node-network-wire.ts's `readInterface` has the reasoning.\n        read: Effect.fn(function* ({ olds, output }) {\n          return dropUnreadable(\n            yield* output === undefined ? readInterface(olds) : readInterfaceOrFail(olds),\n          );\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(NODE_NETWORK_CREATE, createForm(news), output === undefined);\n          yield* guardWrite(NODE_NETWORK_UPDATE, updateForm(news), false);\n          if (output === undefined) return undefined;\n          const live = yield* readInterfaceOrFail(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused mint used to fall into `undefined` and force `update`\n          //   on an interface that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning('Proxmox.NodeNetwork', `${news.node}/${news.iface}`);\n            return { action: 'noop' } as const;\n          }\n          if (live === undefined) {\n            yield* guardWrite(NODE_NETWORK_CREATE, createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          return matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        /**\n         * ⛔ THE DESTROY IS STAGED LIKE EVERY OTHER WRITE, WHICH MAKES IT THE ONE RECOVERABLE\n         *   DESTROY IN THIS PACKAGE. It removes the stanza from `interfaces.new` and nothing\n         *   else; `DELETE /nodes/{node}/network` (a DIFFERENT, collection-level endpoint —\n         *   `Proxmox.NetworkApply`'s own revert, never called here) puts the node back by\n         *   unlinking that file. It becomes irreversible the moment somebody applies — and PVE\n         *   performs NO in-use check before removing an interface other bridges or Ceph still\n         *   stand on.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const before = dropUnreadable(yield* readInterface(news));\n          yield* guardWrite(NODE_NETWORK_CREATE, createForm(news), before === undefined);\n          yield* guardWrite(NODE_NETWORK_UPDATE, updateForm(news), false);\n          if (before === undefined) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              nodes.createNodeNetwork(toDistilledCreate(news)),\n            );\n          } else if (!matches(before, news)) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              nodes.putNodeNetwork2(toDistilledUpdate(news)),\n            );\n          }\n          const after = dropUnreadable(yield* readInterface(news));\n          if (after === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `nodes/${news.node}/network/${news.iface}: wrote with no error, but the ` +\n                  'interface is still absent -- PVE wraps every answer in {\"data\":...} and can ' +\n                  'report success on a call that did nothing, so read back rather than trust it.',\n              ),\n            );\n          }\n          return after;\n        }),\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            nodes.deleteNodeNetwork2({ iface: olds.iface, node: olds.node }),\n          );\n        }),\n      }),\n    ),\n  );\n",
+    "/**\n * `Proxmox.NodeNetwork` — one stanza of a node's `/etc/network/interfaces`, declared.\n *\n * ⛔ DECLARING THIS RESOURCE IS SAFE. APPLYING IT IS A SEPARATE, DELIBERATE ACT, AND IT IS NOT\n *   PERFORMED HERE. Every write under `/nodes/{node}/network/{iface}` lands in\n *   `/etc/network/interfaces.new` and changes no running interface. MEASURED, from PVE::INotify:\n *   `$shadowfiles = { '/etc/network/interfaces' => '/etc/network/interfaces.new' }`, and\n *   `read_file` reads the SHADOW when it exists. The apply is `PUT /nodes/{node}/network`, which\n *   renames the shadow over the real file and runs `ifreload -a`; the revert is\n *   `DELETE /nodes/{node}/network`, which simply unlinks the shadow. A sibling resource models\n *   that apply — this one never calls it, exactly as `Proxmox.SdnZone` never calls\n *   `Proxmox.SdnApply`.\n *\n * ⛔ `Proxmox.NetworkApply` STAYS ON `client.ts`, NOT MIGRATED WITH THIS FILE — network-apply-\n *   read.ts's own header has the two MEASURED reasons distilled cannot represent yet.\n *\n * ⛔ CEPH ON C1 RIDES TWO NETWORKS AND THIS API ONLY SEES ONE OF THEM. Measured from\n *   `/etc/pve/ceph.conf` on 2026-09-13:\n *\n *     public_network  = 198.51.100.0/24     -> vmbr1.42, which this resource DOES see\n *     cluster_network = 203.0.113.0/24     -> every OSD's cluster_addr: .102 / .103 / .104\n *\n *   The cluster network — OSD REPLICATION, the traffic that rebuilds a lost replica — lives on\n *   `203.0.113.10X/32` addresses carried by `tb0`, `tb1` and `dummy_c1`: the Thunderbolt mesh —\n *   TB4's own fabric ports, EXCLUDED from this family by decision 28/29/9 (SdnFabric owns them).\n *\n * ⛔ AND THOSE ADDRESSES ARE INVISIBLE HERE, WHICH IS THE TRAP. They are declared in\n *   `/etc/network/interfaces.d/sdn`, and PVE's network API does not parse that directory.\n *   MEASURED: `GET /nodes/node-b/network/tb0` answers `{\"method\":\"manual\",\"type\":\"eth\",…}` with NO\n *   address, while `ip -br -4 addr` shows `tb0  UP  203.0.113.102/32`. So this resource reports\n *   tb0 and tb1 as address-less manual ports and will plan `noop` over them — implicitly\n *   asserting they carry no address, which is FALSE.\n *\n *   The consequence, stated plainly: declaring tb0/tb1 from what this API reports and then\n *   DESTROYING or applying over them takes out OSD replication on a cluster whose pools are\n *   size 3 / min_size 2. They read as the most boring interfaces on the node and are the two most\n *   dangerous. Leave them undeclared; if they must be managed, manage the file that actually\n *   owns them, not this resource.\n *\n * ⚠️ Two ways this file limits the damage on the interfaces it CAN see: `cidr` is compared\n *   unconditionally (node-network-wire.ts's own ⛔ on `matches`), and a live interface whose\n *   `type` disagrees with the declaration is reported ABSENT rather than retyped\n *   (node-network-wire.ts's `attributesOf`).\n *\n * ★ THE REASON IT EXISTS IS THAT THE STAGED READ CANNOT TELL YOU THE NETWORK IS RIGHT — it can\n *   only tell you the FILE is. Once anything is staged, `GET /nodes/{node}/network/{iface}`\n *   answers from `interfaces.new`, so `matches` compares a declaration against a pending file and\n *   reports `noop` over a node whose running config has not moved. The apply resource is what\n *   closes that gap; this resource's `noop` means \"the file says what you said\", no more.\n *\n * ⚠️ PRIVILEGES ARE COARSER HERE THAN ANYWHERE ELSE IN THE PACKAGE: reads want `Sys.Audit` on\n *   `/nodes/{node}`, every write `Sys.Modify` on it — and there is no `/nodes/{node}/network` ACL\n *   object to scope to, so that also buys the node's services, certificates, DNS and time.\n *   Collected with every other family in docs/privileges.md.\n *\n * ★ A RECONCILE OVER A MATCHING INTERFACE IS A NO-WRITE. `reconcile` below gates the PUT on\n *   `matches` first — adopting an interface a node already has must not leave it holding a\n *   pending network change, since a PUT under `/nodes/{node}/network/{iface}` STAGES one.\n *\n * ⚠️ WHAT IS STILL TRUE: when `matches` is false the PUT rewrites the whole stanza, and that can\n *   ADD lines the file did not have — a `vlan-raw-device vmbr1` under `vmbr1.42`, where PVE had\n *   been deriving it from the name. Harmless in content, and it costs nothing until somebody\n *   applies; one more reason the apply is a separate resource.\n *\n * ⚠️ `list` IS EMPTY, AND HERE THAT MATTERS MORE THAN ANYWHERE ELSE IN THIS PACKAGE. The index\n *   returns every interface the node has, `vmbr0`, `bond0` and the Ceph vlan included. Adopting\n *   them would put Alchemy one `destroy` away from staging the removal of a node's uplink — and\n *   `delete_network` has NO in-use check at all: MEASURED, it deletes the hash entry and writes\n *   the file. Adoption stays explicit.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s\n *   typed `nodes.getNodeNetwork`/`createNodeNetwork`/`putNodeNetwork2`/`deleteNodeNetwork2`\n *   (2026-09-24, decision 43). Dual-path read and `read`'s `output`-branching wired like every\n *   other migrated family; node-network-wire.ts's `readInterfaceOrFail` has the new nuance.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport { guardWrite } from './distilled-guard.ts';\nimport {\n  NODE_NETWORK_CREATE,\n  NODE_NETWORK_UPDATE,\n  type NodeNetworkProps,\n  createForm,\n  updateForm,\n} from './node-network-form.ts';\nimport {\n  dropUnreadable,\n  matches,\n  readInterface,\n  readInterfaceOrFail,\n} from './node-network-wire.ts';\nimport type { NodeNetworkAttributes } from './node-network-wire.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { mintTier } from './credentials.ts';\nimport { type PveRequirements } from './resource-spec.ts';\nimport { UNREADABLE, unreadableWarning } from './unreadable-read.ts';\n\nexport type { NodeNetworkAttributes, NodeNetworkType } from './node-network-wire.ts';\n// ⚠️ MOVED TO node-network-form.ts IN THIS PR'S LINE-CAP TRIM — every field on it is already\n//   documented there against `body`/`createForm`/`updateForm`, so it travels with them rather\n//   than duplicating that documentation here. Nothing about its shape changed.\nexport type { NodeNetworkProps } from './node-network-form.ts';\n\nexport interface ProxmoxNodeNetwork extends Resource<\n  'Proxmox.NodeNetwork',\n  NodeNetworkProps,\n  NodeNetworkAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a node's only uplink cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxNodeNetwork = Resource<ProxmoxNodeNetwork>('Proxmox.NodeNetwork', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * The three fields distilled's generator renamed to an underscore (`bond-primary`, `vlan-id`,\n * `vlan-raw-device`) — everything else round-trips as-is. `storage-form.ts`'s `underscored` is a\n * generic transform for a free-form bag; this family's fields are all named ahead of time, so a\n * small local map is clearer than importing a generic helper for three keys. Moved here from\n * node-network-form.ts in this PR's line-cap trim — this is the only caller.\n */\nconst RENAMED: Readonly<Record<string, string>> = {\n  'bond-primary': 'bond_primary',\n  'vlan-id': 'vlan_id',\n  'vlan-raw-device': 'vlan_raw_device',\n};\n\nconst toDistilled = (form: Record<string, string>): Record<string, string> =>\n  Object.fromEntries(Object.entries(form).map(([key, value]) => [RENAMED[key] ?? key, value]));\n\n/** The actual `createNodeNetwork` call body — `createForm`, translated once. See `toDistilled`. */\nconst toDistilledCreate = (props: NodeNetworkProps): nodes.CreateNodeNetworkRequest =>\n  ({\n    ...toDistilled(createForm(props)),\n    node: props.node,\n  }) as unknown as nodes.CreateNodeNetworkRequest;\n\n/** The actual `putNodeNetwork2` call body — `updateForm`, translated once. See `toDistilledCreate`. */\nconst toDistilledUpdate = (props: NodeNetworkProps): nodes.PutNodeNetwork2Request =>\n  ({\n    ...toDistilled(updateForm(props)),\n    iface: props.iface,\n    node: props.node,\n  }) as unknown as nodes.PutNodeNetwork2Request;\n\nexport const ProxmoxNodeNetworkProvider = () =>\n  Provider.effect(\n    ProxmoxNodeNetwork,\n    Effect.succeed(\n      ProxmoxNodeNetwork.Provider.of({\n        /**\n         * ⛔ EMPTY, AND HERE IT MATTERS MORE THAN ANYWHERE ELSE IN THIS PACKAGE. `GET\n         *   /nodes/{node}/network` returns every interface the node has. Adoption stays explicit.\n         */\n        list: () => Effect.succeed([]),\n        // ⚠️ FOLDS ONLY WHEN `output` IS `undefined`, restored by adversarial review after a\n        //   first draft dropped it — node-network-wire.ts's `readInterface` has the reasoning.\n        read: Effect.fn(function* ({ olds, output }) {\n          return dropUnreadable(\n            yield* output === undefined ? readInterface(olds) : readInterfaceOrFail(olds),\n          );\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(NODE_NETWORK_CREATE, createForm(news), output === undefined);\n          yield* guardWrite(NODE_NETWORK_UPDATE, updateForm(news), false);\n          if (output === undefined) return undefined;\n          const live = yield* readInterfaceOrFail(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused mint used to fall into `undefined` and force `update`\n          //   on an interface that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning(\n              'Proxmox.NodeNetwork',\n              `${news.node}/${news.iface}`,\n              news.target.mount,\n              mintTier(news.target, 'read'),\n            );\n            return { action: 'noop' } as const;\n          }\n          if (live === undefined) {\n            yield* guardWrite(NODE_NETWORK_CREATE, createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          return matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        /**\n         * ⛔ THE DESTROY IS STAGED LIKE EVERY OTHER WRITE, WHICH MAKES IT THE ONE RECOVERABLE\n         *   DESTROY IN THIS PACKAGE. It removes the stanza from `interfaces.new` and nothing\n         *   else; `DELETE /nodes/{node}/network` (a DIFFERENT, collection-level endpoint —\n         *   `Proxmox.NetworkApply`'s own revert, never called here) puts the node back by\n         *   unlinking that file. It becomes irreversible the moment somebody applies — and PVE\n         *   performs NO in-use check before removing an interface other bridges or Ceph still\n         *   stand on.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const before = dropUnreadable(yield* readInterface(news));\n          yield* guardWrite(NODE_NETWORK_CREATE, createForm(news), before === undefined);\n          yield* guardWrite(NODE_NETWORK_UPDATE, updateForm(news), false);\n          if (before === undefined) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              nodes.createNodeNetwork(toDistilledCreate(news)),\n            );\n          } else if (!matches(before, news)) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              nodes.putNodeNetwork2(toDistilledUpdate(news)),\n            );\n          }\n          const after = dropUnreadable(yield* readInterface(news));\n          if (after === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `nodes/${news.node}/network/${news.iface}: wrote with no error, but the ` +\n                  'interface is still absent -- PVE wraps every answer in {\"data\":...} and can ' +\n                  'report success on a call that did nothing, so read back rather than trust it.',\n              ),\n            );\n          }\n          return after;\n        }),\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            nodes.deleteNodeNetwork2({ iface: olds.iface, node: olds.node }),\n          );\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * `Proxmox.NodeNetwork`'s declared shape (`NodeNetworkProps`) and WRITE side, plus the wire\n * coercions the read side needs too — kept here since neither `matches` nor `updateForm` makes\n * sense without agreeing on the same normalisation. Split out of node-network.ts (2026-09-24,\n * the distilled migration; `Props` joined it in this PR's later line-cap trim) — the\n * storage.ts/storage-form.ts seam.\n */\nimport type { NodeNetworkType } from './node-network-wire.ts';\nimport { type WithTarget } from './resource-spec.ts';\nimport { flag, text, withClears } from './values.ts';\n\nexport interface NodeNetworkProps extends WithTarget {\n  /** Which node's file this stanza lives in. Interfaces are per node, never cluster-wide. */\n  node: string;\n  /** `vmbr0`, `bond0`, `vmbr1.42`. 2-20 characters, PVE's `pve-iface` format. */\n  iface: string;\n  /** ⛔ REQUIRED ON EVERY WRITE, update included, never used to retype — see node-network-wire.ts. */\n  type: NodeNetworkType;\n  /**\n   * `198.51.100.12/24`. ⛔ THE ONE FIELD WITH NO UNMANAGED MODE: leaving it out is an instruction\n   * to make the interface `manual`, not an instruction to leave its address alone. The ⛔ on\n   * `updateForm` in node-network-form.ts has the measurement and the consequence.\n   */\n  cidr?: string;\n  /** ⚠️ PVE allows exactly ONE default gateway per node and refuses a second with \"Default\n   *  gateway already exists on interface '<other>'\". On C1 it is vmbr0.41's. */\n  gateway?: string;\n  /**\n   * `auto <iface>` in the file. Absent on read means off, which is why `bool`'s fallback is used.\n   * ⚠️ UNDECLARED IS UNMANAGED ON AN UPDATE AND OFF ON A CREATE — the same asymmetry storage.ts\n   *   has, and it bites harder here: an interface created without `autostart` is one the node\n   *   will not bring up at boot. Every C1 bridge, bond and vlan carries it.\n   */\n  autostart?: boolean;\n  /** 1280-65520. Unset leaves the file without an `mtu` line and the kernel default in force. */\n  mtu?: number;\n  /** ⚠️ Round-trips only after normalisation — see `comment` in node-network-wire.ts. */\n  comments?: string;\n  /** Space-separated, a SET: `enp87s0`, or `bond0`. ⚠️ PVE refuses a port already used elsewhere. */\n  bridge_ports?: string;\n  /** `2-4094`, or `2 100-200`. Only written when `bridge_vlan_aware` is on. */\n  bridge_vids?: string;\n  /** ⛔ A `false` here is sent as `delete=`, never as `0` — node-network-form.ts's ⛔ says why. */\n  bridge_vlan_aware?: boolean;\n  /**\n   * A bond's members, space separated. ⚠️ THE PARAMETER IS `slaves`, NOT `bond_slaves`, in BOTH\n   * directions on this PVE: MEASURED, the POST/PUT schema names only `slaves` and the GET returns\n   * `\"slaves\":\"enp2s0f0np0 enp2s0f1np1\"`. `bond_slaves` appears nowhere in Network.pm here.\n   */\n  slaves?: string;\n  bond_mode?: string;\n  /** ⚠️ Only written when `bond_mode` is `balance-xor` or `802.3ad`; ignored otherwise. */\n  bond_xmit_hash_policy?: string;\n  /** active-backup only. Kept hyphenated because that is the wire name. */\n  'bond-primary'?: string;\n  /** ⚠️ DERIVED FROM A DOTTED NAME. `vmbr1.42` reports `vlan-id` 42 with no such line in the file;\n   *  declaring it there is harmless but adds a line the file did not have. */\n  'vlan-id'?: number;\n  'vlan-raw-device'?: string;\n}\n\nexport const NODE_NETWORK_CREATE = 'pve:POST /nodes/{node}/network';\nexport const NODE_NETWORK_UPDATE = 'pve:PUT /nodes/{node}/network/{iface}';\n\n/**\n * \"Not set\", for the three integers this family reports.\n *\n * ⚠️ 0 CANNOT BE THE ABSENT-MARKER AND -1 CAN. `mtu` is 1280-65520, `vlan-id` 1-4094 and PVE's\n *   `priority` starts at 1 (1 is reserved for `lo`), so -1 is outside every one of their ranges\n *   while 0 is merely outside today's. metric-server-form.ts keeps its own constant for the same\n *   reason and against different ranges; one shared UNSET would have to be right for both.\n */\nexport const UNSET = -1;\n\n/**\n * A space-separated interface list, flattened to one comparable form.\n *\n * ⚠️ `bridge_ports` AND `slaves` ARE SETS, AND PVE NORMALISES THEIR SEPARATORS BUT NOT THEIR ORDER.\n *   MEASURED in PVE::Network::Interfaces: the writer does `s/[;,\\s]+/ /g` on both before emitting\n *   them, and the reader hands the resulting string straight back — so `enp2s0f1np1 enp2s0f0np0`\n *   survives a round trip in the order it was written. Order carries no meaning for a bridge's\n *   ports or a bond's slaves, so a declaration that lists them the other way round is the SAME\n *   declaration; comparing raw strings would report an update that rewrites the file to say\n *   exactly what it already said. Both sides are sorted here and only then compared.\n *\n * ⚠️ IT IS NOT `csv` FROM values.ts. That one joins with commas, and a comma in\n *   `/etc/network/interfaces` is not a separator — PVE's own comment above the writer says the\n *   list \"must be space separated! other separators will cause problems\". Sending a comma-joined\n *   value would be accepted by `split_list` and then written back as spaces, which is a second\n *   spelling of one value and therefore a second chance to diff.\n *\n * ⚠️ `bridge_vids` GOES THROUGH THE SAME FUNNEL and its sort is LEXICAL, which is correct only\n *   because a vid list is a set: `2-4094` is one token, and `100-200 2` and `2 100-200` allow the\n *   same VLANs. Nothing here should be reused for a list whose order is meaning.\n */\nexport const ifaceList = (value: unknown) =>\n  text(value)\n    .split(/[\\s,;]+/)\n    .filter((part) => part !== '')\n    .sort()\n    .join(' ');\n\n/**\n * A comment off the wire, with the newline PVE adds taken back off.\n *\n * ⛔ `comments` NEVER ROUND-TRIPS RAW, AND THAT IS A FOREVER-DIFF IF IT IS NOT NORMALISED.\n *   MEASURED in the reader: each `#...` line is appended as `$comment . \"\\n\"`, so a declared\n *   `ceph transport` comes back as `ceph transport\\n` and the two never compare equal.\n * ⚠️ AND THE READER FOLDS `comments6` INTO `comments` (`$d->{comments} .= $comments6`), so on an\n *   interface that carries an IPv6 comment a declared `comments` CANNOT match what comes back.\n *   C1 has none; on an interface that does, leave `comments` undeclared rather than fighting it.\n */\nexport const comment = (value: unknown) => text(value).replace(/\\s+$/, '');\n\n/** Undeclared is unmanaged: neither sent nor compared. */\nexport const same = <T>(declared: T | undefined, live: T) =>\n  declared === undefined || declared === live;\n\nexport const sameList = (declared: string | undefined, live: string) =>\n  declared === undefined || ifaceList(declared) === live;\n\nexport const sameComment = (declared: string | undefined, live: string) =>\n  declared === undefined || comment(declared) === live;\n\nconst field = (name: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [name]: value };\n\n/**\n * The fields sent on EVERY write, create and update alike.\n *\n * ⚠️ UNDECLARED IS UNMANAGED — not sent, and not compared either. PVE's PUT MERGES the form into\n *   the existing stanza (`foreach my $k (keys %$param) { $ifaces->{$iface}->{$k} = $param->{$k} }`),\n *   so an omitted parameter is left exactly as it was. `cidr` is the one exception and it is not\n *   a small one — see node-network.ts's own ⛔.\n *\n * ⛔ `type` IS REQUIRED ON THE PUT, NOT ONLY ON THE POST. It carries no `optional` in either\n *   schema (CONFIRMED again in distilled's generated `PutNodeNetwork2Request`/\n *   `CreateNodeNetworkRequest`), and the merge above writes it straight into the stanza — so a PUT\n *   naming the wrong type would RETYPE A LIVE INTERFACE in the file. node-network-wire.ts's\n *   `attributesOf` refuses that case before it can reach here.\n *\n * ⛔ `bridge_vlan_aware` IS SENT ONLY WHEN TRUE, AND A FALSE ONE IS A `delete=`. MEASURED in the\n *   writer: the test is `if (defined($d->{bridge_vlan_aware}))`, not a truth test, so `0` is\n *   defined and PVE writes `bridge-vlan-aware yes` anyway. Sending `0` would therefore turn the\n *   flag ON, read back as `1`, and diff forever while lying about which way it went.\n *\n * ⚠️ `netmask` IS A WRITABLE PARAMETER AND IS DELIBERATELY NOT OFFERED. PVE raises\n *   \"netmask conflicts with cidr\" when both are sent, and the reader rewrites whatever was written\n *   into prefix form — MEASURED: node-b's vmbr1.42 reports `\"netmask\":\"24\"`, never `255.255.255.0`.\n *   A resource accepting both spellings would let a declaration diff against its own value.\n *\n * ★ HYPHENATED, THE WIRE SHAPE — `guardWrite` (node-network.ts) checks this form directly, keyed\n *   by PVE's own names (`generated/constraints/pve-nodes-network.ts`). `toDistilledCreate`/\n *   `toDistilledUpdate` below translate a COPY for the actual SDK call — storage-form.ts's\n *   `underscored` has the fuller measurement of why the wire itself does not need this rename\n *   (distilled's own `T.Body()` annotation re-hyphenates on the way out either way), reused here\n *   only for the three fields this family's schema renames: `bond-primary`, `vlan-id`,\n *   `vlan-raw-device` -> `bond_primary`, `vlan_id`, `vlan_raw_device`.\n */\nexport const body = (props: NodeNetworkProps): Record<string, string> => ({\n  ...field('autostart', flag(props.autostart)),\n  ...field('bond-primary', props['bond-primary']),\n  ...field('bond_mode', props.bond_mode),\n  ...field('bond_xmit_hash_policy', props.bond_xmit_hash_policy),\n  ...field('bridge_ports', props.bridge_ports),\n  ...field('bridge_vids', props.bridge_vids),\n  ...field('bridge_vlan_aware', props.bridge_vlan_aware === true ? '1' : undefined),\n  ...field('cidr', props.cidr),\n  ...field('comments', props.comments),\n  ...field('gateway', props.gateway),\n  ...field('mtu', props.mtu === undefined ? undefined : String(props.mtu)),\n  ...field('slaves', props.slaves),\n  ...field('vlan-id', props['vlan-id'] === undefined ? undefined : String(props['vlan-id'])),\n  ...field('vlan-raw-device', props['vlan-raw-device']),\n  type: props.type,\n});\n\n/**\n * The create form: `body` plus the name of the interface being created.\n *\n * 🔴 `iface` MUST BE IN THE BODY, NOT ONLY THE PATH — `POST /nodes/{node}/network` declares\n *   `iface` REQUIRED (`pve-iface`, 2..20) and `{node}` is its only path parameter, CONFIRMED again\n *   in distilled's generated `CreateNodeNetworkRequest`, which carries `iface` as a plain body\n *   field, never a `T.Label()`. The pre-distilled client.ts version of this file shipped without\n *   it for a time (see the git history around 2026-09-22) — every create this family had ever\n *   planned would have 400ed, caught only because every C1 interface had been adopted, never\n *   created, so nothing exercised the POST until the vendor table was wired in.\n *\n * ⚠️ NOT ADDED TO `body`, BECAUSE THE PUT MUST NOT CARRY IT. `additionalProperties => 0` on the\n *   update schema makes a second copy of the name a 400 rather than an ignored hint.\n */\nexport const createForm = (props: NodeNetworkProps): Record<string, string> => ({\n  ...body(props),\n  iface: props.iface,\n});\n\n/**\n * The update form: `body` plus the two fields that can only be cleared explicitly.\n *\n * ⛔ `delete=cidr` IS SENT WHENEVER `cidr` IS UNDECLARED, AND IT IS THE LESSER OF TWO EVILS RATHER\n *   THAN A GOOD OUTCOME. PVE recomputes the method on every write from the form alone —\n *   `$param->{method} = $param->{address} ? 'static' : 'manual'` — so a PUT WITHOUT an address\n *   makes the interface manual no matter what the caller intended. Left at that, the merge would\n *   leave the old `address` and `netmask` in the hash and the writer would emit an `address` line\n *   under `iface … inet manual`: a stanza PVE's own UI cannot produce. Clearing cidr explicitly at\n *   least produces a clean, honest manual interface — and `matches` compares `cidr`\n *   UNCONDITIONALLY, so the plan says so first.\n *\n * ⛔ ON vmbr1.42 THAT IS THE CEPH TRANSPORT. A declaration of that interface without its `cidr` is\n *   a declaration that it should have no address, applied across three nodes. The plan will read\n *   `1 to update` rather than `noop`; do not wave it through.\n *\n * ⚠️ `delete` IS A PUT-ONLY PARAMETER. The POST schema has no `delete` at all, which is why\n *   `createForm` calls `body` directly rather than going through this function.\n */\nexport const updateForm = (props: NodeNetworkProps): Record<string, string> => {\n  const clear = [\n    ...(props.cidr === undefined ? ['cidr'] : []),\n    ...(props.bridge_vlan_aware === false ? ['bridge_vlan_aware'] : []),\n  ];\n  return withClears(body(props), clear);\n};\n\n// ⚠️ `toDistilledCreate`/`toDistilledUpdate` MOVED TO node-network.ts IN THIS PR'S LINE-CAP\n//   TRIM — the only caller, and the only place `nodes.CreateNodeNetworkRequest`/\n//   `PutNodeNetwork2Request` were otherwise needed. `createForm`/`updateForm` above are unchanged.\n",
     "/**\n * `Proxmox.NodeNetwork`'s READ side: the coercions in both directions, the read itself, and\n * `matches`. Split out of node-network-form.ts (2026-09-24, the distilled migration) — the\n * storage.ts/storage-wire.ts seam; the write side stays in node-network-form.ts.\n *\n * * ⛔ THE LAST SEVEN ARE REPORTED AND NEVER COMPARED, AND EACH ONE IS A MEASURED FOREVER-DIFF.\n *   `priority` is assigned by PVE FROM FILE ORDER — `my $priority = 2; ... $d->{priority} =\n *   $priority++` — and it is not a POST or PUT parameter at all. MEASURED ACROSS C1: vmbr1.42 is\n *   priority 16 on node-b and node-c and 15 on node-d, because node-d has no `wlan0` above it. One\n *   declaration reused across three nodes would diff on exactly one of them, forever, over nothing.\n *   `method` is RECOMPUTED on every write from whether the form carried an address, `families` is\n *   recomputed the same way and never written to the file, `active` and `exists` describe the\n *   kernel rather than the config, and `bond_miimon`, `bridge_stp` and `bridge_fd` are emitted by\n *   PVE's writer with defaults (100, `off`, 0) while appearing in NEITHER write schema —\n *   `additionalProperties => 0` means sending one is a 400. Live proof of all three: node-b's bond0\n *   returns `bond_miimon \"100\"` and vmbr1 returns `bridge_stp \"off\"`, `bridge_fd \"0\"`, none of\n *   which any declaration can set.\n */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport { runPve } from './distilled-pve.ts';\nimport {\n  type NodeNetworkProps,\n  UNSET,\n  comment,\n  ifaceList,\n  same,\n  sameComment,\n  sameList,\n} from './node-network-form.ts';\nimport { UNREADABLE, type Unreadable, readOrUnreadable } from './unreadable-read.ts';\nimport { bool, int, text } from './values.ts';\n\n/**\n * PVE's interface types. `unknown` is what a NIC it does not manage reports — node-b and node-c\n * both report `wlan0` that way, and node-d has no such interface at all.\n *\n * ⚠️ THAT ASYMMETRY IS A TRAP FOR A DECLARATION SHARED ACROSS NODES. On node-d the read answers\n *   400 (\"interface does not exist\"), which this provider cannot tell from \"deleted\", so\n *   reconcile POSTs — writing a stanza for a card that is not in the machine. Declare per node\n *   what each node actually has; a physical interface is discovered, not decided.\n */\nexport type NodeNetworkType =\n  | 'OVSBond'\n  | 'OVSBridge'\n  | 'OVSIntPort'\n  | 'OVSPort'\n  | 'alias'\n  | 'bond'\n  | 'bridge'\n  | 'eth'\n  | 'fabric'\n  | 'unknown'\n  | 'vlan'\n  | 'vnet';\n\n/**\n * ⛔ THE LAST SEVEN ARE REPORTED AND NEVER COMPARED — each is a MEASURED forever-diff, and the\n *   evidence for every one of them is below, beside the code that reads them.\n */\nexport interface NodeNetworkAttributes {\n  node: string;\n  iface: string;\n  type: string;\n  cidr: string;\n  gateway: string;\n  autostart: boolean;\n  mtu: number;\n  comments: string;\n  bridge_ports: string;\n  bridge_vids: string;\n  bridge_vlan_aware: boolean;\n  slaves: string;\n  bond_mode: string;\n  bond_xmit_hash_policy: string;\n  'bond-primary': string;\n  'vlan-id': number;\n  'vlan-raw-device': string;\n  priority: number;\n  method: string;\n  families: string;\n  active: boolean;\n  exists: boolean;\n  bond_miimon: string;\n  bridge_stp: string;\n  bridge_fd: string;\n}\n\n/**\n * One live interface as attributes. `live` is cast past `GetNodeNetworkResponse`'s own TS type\n * (`{method, type}`) — MEASURED: the generated schema is a lower bound, not the full shape (PVE's\n * response varies by interface type, and the apidoc this was generated from does not enumerate\n * every field it can carry), but decoding does NOT strip the extras (Effect Schema's `S.Struct` is\n * structural, not exact) — every field PVE actually returns survives to this object at runtime,\n * confirmed against the full measured `vmbr0` response below.\n *\n * ⚠️ EVERY FIELD PVE REPORTS IS CARRIED HERE, INCLUDING THE SEVEN NO DECLARATION CAN SET. A plan\n *   that cannot show `priority`, `method` or `bond_miimon` cannot explain why it is ignoring them,\n *   and the next person to read a forever-diff would start by adding them to `matches`. They are\n *   reported precisely so that they are visibly OUT of it — see the ⛔ above the module header.\n */\nconst attributesOf = (\n  live: unknown,\n  props: NodeNetworkProps,\n): NodeNetworkAttributes | undefined => {\n  const data = live as Record<string, unknown>;\n  /**\n   * ⛔ AN INTERFACE OF ANOTHER TYPE IS ANOTHER OBJECT, AND \"ABSENT\" IS THE SAFE ANSWER — the\n   *   same call metric-server.ts makes, for a worse reason. `type` is required on the PUT and\n   *   the PUT MERGES, so a declaration naming `bridge` for what is really a vlan would write\n   *   `type bridge` into the stanza and PVE's writer would then emit bridge-ports and\n   *   bridge-stp lines for vmbr1.42. Reporting absent instead makes reconcile POST a create,\n   *   which PVE refuses with \"interface already exists\": loud, and it changes nothing.\n   */\n  const liveType = text(data['type']);\n  if (liveType !== '' && liveType !== props.type) return undefined;\n  return {\n    active: bool(data['active']),\n    autostart: bool(data['autostart']),\n    'bond-primary': text(data['bond-primary']),\n    bond_miimon: text(data['bond_miimon']),\n    bond_mode: text(data['bond_mode']),\n    bond_xmit_hash_policy: text(data['bond_xmit_hash_policy']),\n    bridge_fd: text(data['bridge_fd']),\n    bridge_ports: ifaceList(data['bridge_ports']),\n    bridge_stp: text(data['bridge_stp']),\n    bridge_vids: ifaceList(data['bridge_vids']),\n    bridge_vlan_aware: bool(data['bridge_vlan_aware']),\n    /** ⚠️ DERIVED BY THE READER from address+netmask, and always present when an address is. */\n    cidr: text(data['cidr']),\n    comments: comment(data['comments']),\n    exists: bool(data['exists']),\n    families: Array.isArray(data['families']) ? data['families'].join(',') : '',\n    gateway: text(data['gateway']),\n    iface: props.iface,\n    method: text(data['method']),\n    mtu: int(data['mtu'], UNSET),\n    node: props.node,\n    priority: int(data['priority'], UNSET),\n    slaves: ifaceList(data['slaves']),\n    type: liveType === '' ? props.type : liveType,\n    'vlan-id': int(data['vlan-id'], UNSET),\n    'vlan-raw-device': text(data['vlan-raw-device']),\n  };\n};\n\n/**\n * ★ Default `read` role — `Sys.Audit` on `/nodes/{node}` (node-network.ts's header).\n * ⛔ `{ node: props.node, iface: props.iface }`, NEVER THE WHOLE `props` — storage.ts's/user.ts's\n *   own ⛔, the kit 0.31.1 regression: `GetNodeNetworkRequest`'s schema declares only `node` and\n *   `iface` (both path labels); any OTHER key on the object passed to `nodes.getNodeNetwork` is\n *   treated by distilled's `buildRequest` as an \"unknown key\" and JSON-encoded onto this bodyless\n *   GET, which a stricter fetch client refuses outright.\n * ⛔ A MISSING INTERFACE IS A 400, NOT A 500 AND NOT A 404 — MEASURED against the live cluster\n *   (TB4 `n2`, read-role, read-only probe, 2026-09-24): `GET /nodes/n2/network/vmbr9` answers\n *   `{\"errors\":{\"iface\":\"interface does not exist\"},\"data\":null,\"message\":\"Parameter verification\n *   failed.\\n\"}` at HTTP 400 — a THIRD shape, different from every other migrated family's\n *   measured 500. `@distilled.cloud/proxmox` types this as a genuine typed error,\n *   `NetworkInterfaceNotFound` (`nodes.ts`, generated from `patches/nodes/network-errors.json`),\n *   attached ONLY to `getNodeNetwork`'s error union and matched by the SDK's own\n *   `errorEnvelope`/`matchTypedError` against the EXACT sole-field body `errors.iface ===\n *   \"interface does not exist\"` — the precision the code here used to check by hand\n *   (`error.errors['iface'] === '…'`) is now the SDK's own matcher contract, not this file's.\n *   Any 400 that fails that exact match (a different field, a different message, more than one\n *   field) decodes as the generic `ParameterVerificationFailed` instead, never this tag.\n * ⛔ ONLY THIS EXACT SIGNAL MEANS ABSENT, EVEN WITH THE FOLD BELOW. A different 400 reason\n *   (`ParameterVerificationFailed`), a permission gap, a network blip, or any other failure is\n *   never read as \"this interface is not there\" — `diff` calls this directly and propagates\n *   every one of them loudly.\n */\nexport const readInterfaceOrFail = (props: NodeNetworkProps) =>\n  readOrUnreadable(\n    runPve(\n      props.target,\n      'read',\n      false,\n      nodes.getNodeNetwork({ iface: props.iface, node: props.node }),\n    ).pipe(Effect.catchTag('NetworkInterfaceNotFound', () => Effect.succeed(undefined))),\n  ).pipe(\n    Effect.map((live) => {\n      if (live === UNREADABLE) return UNREADABLE;\n      return live === undefined ? undefined : attributesOf(live, props);\n    }),\n  );\n\n/**\n * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`'s adoption/recovery branch\n *   AND `reconcile` MAY USE IT — FOUND BY ADVERSARIAL REVIEW, 2026-09-24: a first draft used\n *   `readInterfaceOrFail` (precise, non-folding) for EVERY caller, on the reasoning that a typed,\n *   parsed absence signal made folding unnecessary. That reasoning conflated two different\n *   questions: HOW PRECISELY a signal means absent (this family's is unusually precise), and\n *   WHETHER a given caller can safely treat an UNRELATED failure as \"proceed as though absent\"\n *   (storage.ts's/user.ts's own reasoning: a wrongful fold costs at most a redundant\n *   `createNodeNetwork` POST, refused loudly). Plan.ts's cold-start adoption probe and\n *   interrupted-create recovery, and Apply.ts's delete recovery, all call `read` with\n *   `output: undefined` and NO catch of their own (`Plan.ts` v2.0.0-beta.79 ~line 1308) — and\n *   Plan.ts fails the WHOLE PLAN, every other resource included, if that call throws. A malformed\n *   `iface` in ONE brand-new declaration (a `ParameterVerificationFailed`, DIFFERENT from the\n *   `NetworkInterfaceNotFound` absence tag) would abort `bun run plan` for the entire stack under\n *   the precise-only design,\n *   where every other migrated family instead defers that same malformed declaration to a scoped,\n *   loud refusal at apply. This restores that same fold for those three call sites.\n */\nexport const readInterface = (props: NodeNetworkProps) =>\n  readInterfaceOrFail(props).pipe(Effect.orElseSucceed(() => undefined));\n\n/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */\nexport const dropUnreadable = (live: NodeNetworkAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n\n/**\n * ⛔ `cidr` IS THE ONLY FIELD COMPARED WHEN UNDECLARED, AND THAT ASYMMETRY IS THE POINT. Every\n *   other field here follows storage.ts: undeclared means unmanaged, so it is neither sent nor\n *   compared and a plan cannot report an update no write could satisfy. `cidr` cannot be\n *   unmanaged, because PVE derives `method` from the presence of an address IN THE FORM — an\n *   omission is an edit. Comparing it unconditionally is what makes that edit visible in `plan`\n *   instead of at `ifreload` time.\n *\n * ⚠️ NOTHING IN THE REPORTED-ONLY BLOCK IS HERE, and that is what makes the C1 declaration\n *   plan as `noop` on all three nodes at once — the module header lists them and the\n *   measurement behind each.\n */\nexport const matches = (attributes: NodeNetworkAttributes, props: NodeNetworkProps) =>\n  attributes.cidr === (props.cidr ?? '') &&\n  same(props.gateway, attributes.gateway) &&\n  same(props.autostart, attributes.autostart) &&\n  same(props.mtu, attributes.mtu) &&\n  sameComment(props.comments, attributes.comments) &&\n  sameList(props.bridge_ports, attributes.bridge_ports) &&\n  sameList(props.bridge_vids, attributes.bridge_vids) &&\n  same(props.bridge_vlan_aware, attributes.bridge_vlan_aware) &&\n  sameList(props.slaves, attributes.slaves) &&\n  same(props.bond_mode, attributes.bond_mode) &&\n  same(props.bond_xmit_hash_policy, attributes.bond_xmit_hash_policy) &&\n  same(props['bond-primary'], attributes['bond-primary']) &&\n  same(props['vlan-id'], attributes['vlan-id']) &&\n  same(props['vlan-raw-device'], attributes['vlan-raw-device']);\n",
     "/**\n * `Proxmox.NotificationMatcher` — which notifications a PVE cluster sends to which targets.\n *\n * ★ THE HALF OF THE NOTIFICATION SYSTEM notification-target.ts LEAVES OPEN. A target is where a\n *   message CAN go; a matcher decides whether it DOES. A cluster ships one, `default-matcher`,\n *   routing everything to `mail-to-root`, and a target no matcher names receives nothing — so a\n *   declared webhook with no matcher is a delivery path that is never used, and looks finished.\n *\n * ★ ADOPTING THE BUILT-IN AS IT IS: declare what it holds and nothing more. MEASURED on PVE\n *   9.2.11 (2026-09-22, `pvesh get /cluster/notifications/matchers/default-matcher`): mode `all`,\n *   one target `mail-to-root`, no rules, the comment \"Route all notifications to mail-to-root\".\n *   ```ts\n *   ProxmoxNotificationMatcher('default-matcher', {\n *     target: cluster, name: 'default-matcher', targets: ['mail-to-root'],\n *   });\n *   ```\n *   That plans `noop` and deploys with no write (notification-matcher.test.ts). Leaving `comment`\n *   out leaves it alone; every rule field is compared — notification-matcher-form.ts says why.\n *\n * ★ WHAT THIS NEEDS, READ OFF THE CLUSTER'S OWN SCHEMA (generated/pve.ts source, 9.2.11):\n *     read      GET matchers/{name}   Mapping.Audit or Mapping.Modify on /mapping/notifications\n *     write     POST, PUT, DELETE     Mapping.Modify on /mapping/notifications\n *   The same pair as `Proxmox.NotificationTarget`, with that file's ⚠️ about granting it on `/`.\n *   ⛔ `Mapping.Use` IS NOT ENOUGH, though the COLLECTION GET accepts it: the per-object read this\n *     family makes lists only Audit and Modify (pve-manager API2/Cluster/Notifications.pm\n *     `get_matcher`, read at HEAD 2026-09-22 — corrected here; PR 95 said Use sufficed).\n *   ⛔ THE OLD HAND CLIENT FOLDED A MISSING READ PRIVILEGE INTO \"ABSENT\", planning a duplicate\n *     create. The distilled read now catches only NotFound: a refused read fails the plan.\n *     The noop still requires a read lease holding Mapping.Audit.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type {\n  NotificationMatcherAttributes,\n  NotificationMatcherFields,\n} from './notification-matcher-form.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { matcherHandlers } from './notification-matcher-lifecycle.ts';\n\nexport interface NotificationMatcherProps extends NotificationMatcherFields, WithTarget {}\n\nexport interface ProxmoxNotificationMatcher extends Resource<\n  'Proxmox.NotificationMatcher',\n  NotificationMatcherProps,\n  NotificationMatcherAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ⚠️ NO `defaultRemovalPolicy: 'retain'`, for notification-target.ts's reason: a matcher holds no\n *   data, and a plan line is the only warning a delete gets. On `default-matcher` the delete\n *   REVERTS it to the shipped rule instead — see `origin` on the attributes.\n */\nexport const ProxmoxNotificationMatcher = Resource<ProxmoxNotificationMatcher>(\n  'Proxmox.NotificationMatcher',\n);\n\nexport const ProxmoxNotificationMatcherProvider = () =>\n  Provider.effect(\n    ProxmoxNotificationMatcher,\n    Effect.succeed(ProxmoxNotificationMatcher.Provider.of(matcherHandlers)),\n  );\n",
@@ -143,9 +145,9 @@
     "/**\n * The provisioning baseline: the access every PVE cluster and node needs before a stack built on\n * this package can manage it — one role, the users OpenBao mints tokens for, the group that fences\n * the mint, and the grants that bind them. ONE description, read by both halves:\n *   · provision-declare.ts turns it into `Proxmox.Role`/`Group`/`User`/`Acl` resources, so a stack\n *     adopts the baseline and keeps it (drift is a plan, not a 403 weeks later);\n *   · provision-bootstrap.ts turns it into the one-time root commands for a NEW cluster or node.\n * The two cannot drift apart because neither holds a name or a privilege of its own.\n *\n * ⛔ THE PROVISION LANE CANNOT CREATE ITSELF. Every write here runs as a token OpenBao mints for the\n *   provision user, and minting needs that user to exist, in the mint group, bound to this role.\n *   So a new cluster is bootstrapped ONCE by root@pam with the generated commands, and the stack\n *   then adopts what they made (docs/provision-baseline.md).\n *\n * ★ ONE PRIVILEGE LIST FOR EVERY FAMILY, NOT A ROLE PER RESOURCE. The list is what the families'\n *   reconciles need, unioned — the set a hand-kept provision role reached one 403 at a time, each\n *   step recorded where it was hit (pool.ts, sdn-vnet.ts, ha-rule.ts). It includes what the lane needs\n *   to manage THIS baseline (`Sys.Modify` for the role, `Realm.AllocateUser`/`User.Modify` for the\n *   users, `Group.Allocate`, `Permissions.Modify` for the grants), so declaring it can never narrow\n *   the lane out of its own repair (role.ts: \"A ROLE CAN LOCK ITS OWN PROVIDER OUT\").\n * ⚠️ NOT EVERY FAMILY: root@pam-only writes (device passthrough, bind mounts — lxc-judge.ts) and\n *   privileges a family names as still missing (`VM.Replicate`, replication-job.ts) are outside it.\n */\n\n/** The provision role's privileges, sorted — the exact set, never an addition to a live one. */\nexport const PROVISION_PRIVILEGES: readonly string[] = Object.freeze([\n  'Datastore.Allocate',\n  'Datastore.AllocateSpace',\n  'Datastore.Audit',\n  'Group.Allocate',\n  'Mapping.Audit',\n  'Mapping.Modify',\n  'Permissions.Modify',\n  'Pool.Allocate',\n  'Pool.Audit',\n  'Realm.AllocateUser',\n  'SDN.Allocate',\n  'SDN.Audit',\n  'SDN.Use',\n  'Sys.Audit',\n  'Sys.Console',\n  'Sys.Modify',\n  'User.Modify',\n  'VM.Allocate',\n  'VM.Audit',\n  'VM.Backup',\n  'VM.Config.CPU',\n  'VM.Config.Disk',\n  'VM.Config.HWType',\n  'VM.Config.Memory',\n  'VM.Config.Network',\n  'VM.Config.Options',\n  'VM.PowerMgmt',\n]);\n\n/** The names a baseline uses. Every field has a generic default (`PROVISION_DEFAULTS`). */\nexport interface CoreProvisionNames {\n  /** The role holding `PROVISION_PRIVILEGES` on `/`. */\n  readonly role?: string | undefined;\n  /** The user OpenBao's `provision` role mints tokens for, realm-qualified. */\n  readonly provisionUser?: string | undefined;\n  /** The group whose members OpenBao may mint for — the fence around the mint. */\n  readonly mintGroup?: string | undefined;\n  /** The user OpenBao's `read` role mints for, or `null` for a baseline with no read lane. */\n  readonly readUser?: string | null | undefined;\n  /** The role the read user holds on `/`. ⛔ It must already exist: a built-in, or one you declare. */\n  readonly readRole?: string | undefined;\n  /** The comment on the group and both users — how a person on the node learns what they are. */\n  readonly comment?: string | undefined;\n}\n\n/** Every core name, resolved: what `PROVISION_DEFAULTS` holds and what a baseline is built from. */\nexport type ResolvedProvisionNames = {\n  readonly [K in keyof CoreProvisionNames]-?: Exclude<CoreProvisionNames[K], undefined>;\n};\n\n/**\n * `CoreProvisionNames` plus a comment per object, each defaulting to `comment`.\n *\n * ⛔ WHY PER OBJECT: AN EXISTING CLUSTER IS THE NORMAL CASE, NOT THE EXCEPTION. One `comment` for\n *   three objects can only describe a cluster this baseline made. On one that already has a mint\n *   group and a read user — with their own live comments, which a stack elsewhere may already\n *   declare — a single comment makes `provisionBootstrap` rewrite objects nobody asked it to\n *   touch, and the next deploy of that stack writes them back. Measured on an estate cluster\n *   2026-09-22, where `hf-mint` had NO comment and `hf-read@pve` named its own mount.\n * ★ Overriding one does not change the others: `comment` stays the default for every object that\n *   has no override, so the generic case is still one string.\n * ⚠️ Each is checked like `comment` is, and a `null` `readUser` drops `readComment` with its lane.\n */\nexport interface ProvisionNames extends CoreProvisionNames {\n  /** The mint group's comment. Defaults to `comment`. */\n  readonly groupComment?: string | undefined;\n  /** The provision user's comment. Defaults to `comment`. */\n  readonly provisionComment?: string | undefined;\n  /** The read user's comment. Defaults to `comment`. Ignored when `readUser` is `null`. */\n  readonly readComment?: string | undefined;\n}\n\n/** The resolved comment for each object a baseline holds. */\nexport type ProvisionComments = {\n  readonly [K in 'group' | ProvisionLane]: string;\n};\n\n/** Which credential lane a user or a grant belongs to — the OpenBao role that mints for it. */\nexport type ProvisionLane = 'provision' | 'read';\n\n/** ★ Generic, kit-prefixed names: nothing here is any one estate's. */\nexport const PROVISION_DEFAULTS: ResolvedProvisionNames = Object.freeze({\n  comment:\n    'provision baseline from @homeflare/alchemy - OpenBao mints short-lived tokens for members',\n  mintGroup: 'hf-mint',\n  provisionUser: 'hf-provision@pve',\n  readRole: 'PVEAuditor',\n  readUser: 'hf-read@pve',\n  role: 'HfProvisioner',\n});\n\n/** A baseline, resolved: exactly what the declaration holds and the bootstrap makes. */\nexport interface ProvisionBaseline {\n  readonly role: { readonly roleid: string; readonly privs: readonly string[] };\n  readonly group: { readonly groupid: string; readonly comment: string };\n  readonly users: readonly {\n    readonly lane: ProvisionLane;\n    readonly userid: string;\n    readonly comment: string;\n    readonly groups: readonly string[];\n  }[];\n  /** Each binds one user to one role on `/`, with propagate — the only shape the lanes need. */\n  readonly grants: readonly {\n    readonly lane: ProvisionLane;\n    readonly userid: string;\n    readonly roleid: string;\n  }[];\n}\n\n/**\n * ⛔ NAMES ARE CHECKED HERE, ONCE, FOR BOTH HALVES — and conservatively. The bootstrap pastes them\n *   into a root shell, so a name that would need quoting is refused rather than quoted: PVE's own\n *   ids (`pve-roleid`, `pve-groupid`, `pve-userid`) are narrower than what a shell tolerates.\n */\nconst ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\nconst USERID = /^[A-Za-z0-9][A-Za-z0-9._-]*@[A-Za-z][A-Za-z0-9._-]*$/;\nconst COMMENT = /^[A-Za-z0-9 ._,:()@/+-]*$/;\n\nconst problems = (\n  names: ResolvedProvisionNames,\n  comments: ProvisionComments,\n  given: ProvisionNames,\n): string[] => {\n  const found: string[] = [];\n  if (!ID.test(names.role)) found.push(`role \\`${names.role}\\` is not a PVE role id`);\n  if (!ID.test(names.mintGroup)) found.push(`mintGroup \\`${names.mintGroup}\\` is not a group id`);\n  if (!ID.test(names.readRole)) found.push(`readRole \\`${names.readRole}\\` is not a PVE role id`);\n  for (const [field, userid] of [\n    ['provisionUser', names.provisionUser],\n    ['readUser', names.readUser],\n  ] as const) {\n    if (userid !== null && !USERID.test(userid)) {\n      found.push(`${field} \\`${userid}\\` is not a realm-qualified user id (name@realm)`);\n    }\n  }\n  if (names.readUser === names.provisionUser) found.push('readUser and provisionUser are one user');\n  // ⛔ EVERY comment THE BASELINE WILL HOLD, not just the shared one: each is pasted into `sh` and\n  //    into a Perl `q{}`. ⚠️ `readComment` only when there is a read lane — a `null` `readUser`\n  //    drops the user, so nothing would ever be pasted.\n  // ★ NAMED BY WHERE THE VALUE CAME FROM, and said once. A bad shared `comment` is one problem\n  //   called `comment`, not three called after overrides the caller never passed.\n  const source = (override: string | undefined, field: string) =>\n    override === undefined ? 'comment' : field;\n  const checked: (readonly [string, string])[] = [\n    [source(given.groupComment, 'groupComment'), comments.group],\n    [source(given.provisionComment, 'provisionComment'), comments.provision],\n  ];\n  if (names.readUser !== null) {\n    checked.push([source(given.readComment, 'readComment'), comments.read]);\n  }\n  const said = new Set<string>();\n  for (const [field, comment] of checked) {\n    if (COMMENT.test(comment) || said.has(field)) continue;\n    said.add(field);\n    found.push(`${field} holds a character the bootstrap will not quote`);\n  }\n  return found;\n};\n\n/** Resolve `names` over the defaults and check them. Throws with every problem at once. */\nexport const provisionBaseline = (names: ProvisionNames = {}): ProvisionBaseline => {\n  // ⚠️ The per-object comments are taken out first: they are not core names, so they must not land\n  //    in `resolved`, which `PROVISION_DEFAULTS` types and a caller may build a literal of.\n  const { groupComment, provisionComment, readComment, ...core } = names;\n  // ⚠️ An explicit `undefined` means \"the default\", not \"blank\": spread alone would keep it.\n  const given = Object.entries(core).filter(([, value]) => value !== undefined);\n  const resolved: ResolvedProvisionNames = {\n    ...PROVISION_DEFAULTS,\n    ...Object.fromEntries(given),\n  };\n  // ★ `?? resolved.comment`, so an override changes ONE object and the generic case stays one\n  //   string. ⚠️ `??` and not `||`: an empty comment is a real value — a live object with none.\n  const comments: ProvisionComments = {\n    group: groupComment ?? resolved.comment,\n    provision: provisionComment ?? resolved.comment,\n    read: readComment ?? resolved.comment,\n  };\n  const found = problems(resolved, comments, names);\n  if (found.length > 0) throw new Error(`provision baseline: ${found.join('; ')}`);\n  const lanes: [ProvisionLane, string, string][] = [\n    ['provision', resolved.provisionUser, resolved.role],\n  ];\n  if (resolved.readUser !== null) lanes.push(['read', resolved.readUser, resolved.readRole]);\n  return {\n    grants: lanes.map(([lane, userid, roleid]) => ({ lane, roleid, userid })),\n    group: { comment: comments.group, groupid: resolved.mintGroup },\n    role: { privs: PROVISION_PRIVILEGES, roleid: resolved.role },\n    users: lanes.map(([lane, userid]) => ({\n      comment: comments[lane],\n      groups: [resolved.mintGroup],\n      lane,\n      userid,\n    })),\n  };\n};\n",
     "/**\n * `provisionBootstrap` — the provisioning baseline (provision-baseline.ts) as the one-time root\n * commands for a NEW cluster or node: a POSIX `sh` script, printed, never run from here.\n *\n *     bun -e \"import { provisionBootstrap } from '@homeflare/alchemy/proxmox';\n *             process.stdout.write(provisionBootstrap())\" | ssh root@<node> sh\n *\n * ⛔ WHY IT EXISTS: THE PROVISION LANE CANNOT CREATE ITSELF. Every resource in this package runs as a\n *   token OpenBao mints for the provision user, and a cluster without that user, its group and its\n *   grant has nothing to mint for — the plan that would create them cannot authenticate. So root\n *   makes them once, and the stack adopts and keeps them (provision-declare.ts). This is the only\n *   hand step, and it is generated from the same baseline the stack declares.\n * ⛔ NEVER A TOKEN, NEVER A PASSWORD. The users are created with neither: OpenBao mints short-lived\n *   tokens for them later, and an `@pve` user with no password cannot log in to the UI. Nothing\n *   secret is in the script, so it can be read, reviewed and pasted.\n * ★ CHECK, THEN CHANGE — IDEMPOTENT BY CONSTRUCTION. Each object is read first (`pvesh get … json`,\n *   parsed with Perl's core JSON::PP, which every PVE node has), compared with the baseline, and\n *   written only when it differs, naming what it does. A second run prints `ok` for everything and\n *   writes nothing. It also CONVERGES: a role with other privileges is set to exactly the baseline,\n *   as the stack's `Proxmox.Role` would set it (role.ts: a declaration replaces the set).\n * ★ ONE NODE PER CLUSTER. Users, groups, roles and ACLs live in `/etc/pve/user.cfg`, which pmxcfs\n *   shares across the cluster: a node joining a cluster that has the baseline needs nothing, and a\n *   run there is all `ok`. A new standalone node or a new cluster is where it creates.\n * ⚠️ NAMES ARE NOT QUOTED INTO SAFETY, THEY ARE REFUSED INTO IT: provision-baseline.ts admits only\n *   characters that need no quoting in `sh` or in a Perl `q{}`.\n */\nimport {\n  type ProvisionBaseline,\n  type ProvisionNames,\n  provisionBaseline,\n} from './provision-baseline.ts';\n\nconst HEADER = `#!/bin/sh\n# Provisioning baseline bootstrap, generated by @homeflare/alchemy (provisionBootstrap).\n# Run ONCE, as root, on one node of a NEW cluster (or a new standalone node). Every step reads\n# first and writes only what differs; a second run changes nothing. No token, no password.\nset -eu\n[ \"$(id -u)\" -eq 0 ] || { echo 'bootstrap: run this as root' >&2; exit 1; }\ncommand -v pvesh >/dev/null 2>&1 || { echo 'bootstrap: no pvesh; run this on a PVE node' >&2; exit 1; }\nperl -MJSON::PP -e 1 || { echo 'bootstrap: perl cannot load JSON::PP' >&2; exit 1; }\n\n# get <api-path> <perl>: print <perl> evaluated over the object at <api-path> (as $d).\n# Fails, silently, when the object does not exist: the empty input is not JSON.\nget() {\n  pvesh get \"$1\" --output-format json 2>/dev/null | perl -MJSON::PP -0777 -ne \"\\\\$d = decode_json(\\\\$_); $2\" 2>/dev/null\n}\n`;\n\n/** A Perl string literal with no interpolation — `@pve` in a double-quoted one is an array. */\nconst perlText = (text: string) => `q{${text}}`;\n\n/** The user fields `Proxmox.User` compares, as one line both sides can produce. */\nconst USER_STATE =\n  'my $g = $d->{groups} // []; $g = [split /,/, $g] unless ref $g; ' +\n  'print join(\";\", \"groups=\" . join(\",\", sort @$g), \"enable=\" . (($d->{enable} // 1) ? 1 : 0), ' +\n  '\"expire=\" . ($d->{expire} // 0), \"email=\" . ($d->{email} // \"\"), ' +\n  '\"firstname=\" . ($d->{firstname} // \"\"), \"lastname=\" . ($d->{lastname} // \"\"), ' +\n  '\"comment=\" . ($d->{comment} // \"\"))';\n\nconst roleStep = ({ role }: ProvisionBaseline): string => {\n  const privs = [...role.privs].sort().join(',');\n  return `\n# Role ${role.roleid}: exactly the provision privileges, on no path yet.\nwant='${privs}'\nif have=$(get /access/roles/${role.roleid} 'print join(\",\", sort grep { /\\\\./ } keys %$d)'); then\n  if [ \"$have\" = \"$want\" ]; then echo 'role ${role.roleid}: ok'\n  else echo 'role ${role.roleid}: setting the baseline privileges'; pveum role modify ${role.roleid} --privs \"$want\"; fi\nelse\n  echo 'role ${role.roleid}: adding'; pveum role add ${role.roleid} --privs \"$want\"\nfi\n`;\n};\n\nconst groupStep = ({ group }: ProvisionBaseline): string => `\n# Group ${group.groupid}: OpenBao may mint only for its members.\nif have=$(get /access/groups/${group.groupid} 'print $d->{comment} // \"\"'); then\n  if [ \"$have\" = '${group.comment}' ]; then echo 'group ${group.groupid}: ok'\n  else echo 'group ${group.groupid}: setting the comment'; pveum group modify ${group.groupid} --comment '${group.comment}'; fi\nelse\n  echo 'group ${group.groupid}: adding'; pveum group add ${group.groupid} --comment '${group.comment}'\nfi\n`;\n\nconst userStep = (user: ProvisionBaseline['users'][number]): string => {\n  const groups = [...user.groups].sort().join(',');\n  const want = `groups=${groups};enable=1;expire=0;email=;firstname=;lastname=;comment=${user.comment}`;\n  const fields = `--groups ${groups} --comment '${user.comment}'`;\n  return `\n# User ${user.userid} (the ${user.lane} lane): in ${groups}, enabled, no password.\nif have=$(get /access/users/${user.userid} '${USER_STATE}'); then\n  if [ \"$have\" = '${want}' ]; then echo 'user ${user.userid}: ok'\n  else echo 'user ${user.userid}: setting groups, comment and account fields'\n    pveum user modify ${user.userid} ${fields} --enable 1 --expire 0 --email '' --firstname '' --lastname ''; fi\nelse\n  echo 'user ${user.userid}: adding'; pveum user add ${user.userid} ${fields}\nfi\n`;\n};\n\nconst grantStep = (grant: ProvisionBaseline['grants'][number]): string => {\n  const match =\n    `print scalar grep { $_->{path} eq \"/\" && $_->{type} eq \"user\" && ` +\n    `$_->{ugid} eq ${perlText(grant.userid)} && $_->{roleid} eq ${perlText(grant.roleid)} && ` +\n    `($_->{propagate} // 1) } @$d`;\n  return `\n# Grant: ${grant.userid} holds ${grant.roleid} on /, propagated (the ${grant.lane} lane).\nif [ \"$(get /access/acl '${match}')\" = 1 ]; then echo 'grant ${grant.userid} ${grant.roleid} /: ok'\nelse echo 'grant ${grant.userid} ${grant.roleid} /: adding'; pveum acl modify / --users ${grant.userid} --roles ${grant.roleid} --propagate 1; fi\n`;\n};\n\n/** A role the baseline binds but does not own — the read lane's — must already exist. */\nconst requireRole = (roleid: string): string => `\nget /access/roles/${roleid} 'print 1' >/dev/null || { echo 'bootstrap: role ${roleid} does not exist; create it, or name another readRole' >&2; exit 1; }\n`;\n\n/**\n * The script for `names` (defaults: `PROVISION_DEFAULTS`). Pure: it reads nothing and runs nothing.\n * Throws, like `provisionBaseline`, on a name the baseline refuses.\n */\nexport const provisionBootstrap = (names: ProvisionNames = {}): string => {\n  const baseline = provisionBaseline(names);\n  const borrowed = baseline.grants\n    .map((grant) => grant.roleid)\n    .filter((roleid) => roleid !== baseline.role.roleid);\n  return [\n    HEADER,\n    ...[...new Set(borrowed)].map(requireRole),\n    roleStep(baseline),\n    groupStep(baseline),\n    ...baseline.users.map(userStep),\n    ...baseline.grants.map(grantStep),\n    `\\necho 'provision baseline: done. Next: point the OpenBao proxmox mount at these users, then deploy the stack that declares this baseline with --adopt.'\\n`,\n  ].join('');\n};\n",
     "/**\n * `declareProvisionBaseline` — the provisioning baseline (provision-baseline.ts) as resources, so a\n * stack adopts what the bootstrap made and keeps it: the role, the mint group, one user per lane\n * (its group membership included) and the grant binding each user to its role on `/`.\n *\n *     const lane = yield* declareProvisionBaseline('pve', target);\n *     // names are generic by default; a site passes its own:\n *     const lane = yield* declareProvisionBaseline('pve', target, { role: 'Provisioner' });\n *\n * Provide `ProxmoxRoleProvider()`, `ProxmoxGroupProvider()`, `ProxmoxUserProvider()` and\n * `ProxmoxAclProvider()` with `FetchHttpClient.layer`.\n *\n * ⛔ EVERY RESOURCE HERE RETAINS. This is the branch the whole package sits on (user.ts): dropping\n *   the call from a stack must drop state, never the role, the users or their grants — deleting the\n *   provision user revokes every lease at once, the plan that would recreate it included.\n * ⛔ ADOPTION IS THE OPERATOR'S TO STATE, AS EVERYWHERE IN THE KIT (docs/ownership.md). The first\n *   deploy after the bootstrap finds all of this live with no state: run it with `--adopt`, or pass\n *   `{ adopt: true }`, which pipes `adopt(true)` onto each resource. `{ adopt: false }` pins them\n *   refused under a deploy-wide `--adopt`. Left out, the deploy's own policy decides.\n *   ⚠️ TODAY THE FOUR FAMILIES STILL READ A LIVE OBJECT WITH NO STATE AS OURS (the `pveHandlers`\n *     limit in ownership.md), so the flag is not yet what stops a claim. It is stated here so that\n *     when they follow the rule, a stack built on this helper already says what it means.\n * ★ THE BOOTSTRAP MAKES EXACTLY THIS, so a clean adoption writes nothing: the same privileges, the\n *   same comment, the same single group per user (provision-bootstrap.ts reads the same baseline).\n * ★ PLAIN NAMES, NOT ONE RESOURCE'S OUTPUT IN ANOTHER'S PROPS. An Output would order the creates,\n *   but Alchemy skips the adoption probe while any prop is one (Plan.ts), so the first deploy after\n *   the bootstrap would plan `create` for objects that are all there. Order never matters here:\n *   nothing in this package can run before the bootstrap, and after it everything exists.\n */\nimport { adopt } from 'alchemy/AdoptPolicy';\nimport * as RemovalPolicy from 'alchemy/RemovalPolicy';\nimport * as Effect from 'effect/Effect';\nimport { ProxmoxAcl } from './acl.ts';\nimport type { PveTarget } from './credentials.ts';\nimport { ProxmoxGroup } from './group.ts';\nimport { type ProvisionNames, provisionBaseline } from './provision-baseline.ts';\nimport { ProxmoxRole } from './role.ts';\nimport { ProxmoxUser } from './user.ts';\n\nexport interface DeclareProvisionOptions {\n  /** `true`/`false` pipe `adopt(…)` onto every resource; omitted, the deploy's policy decides. */\n  readonly adopt?: boolean;\n}\n\n/**\n * The baseline for one cluster. `id` prefixes every logical id (`<id>-role`, `<id>-mint-group`,\n * `<id>-provision-user`, `<id>-provision-grant`, and the `read` pair), so one stack can declare a\n * baseline per cluster. `users` and `grants` come back in `baseline.users` / `baseline.grants`\n * order: provision, then read. Fails, before declaring anything, on a name the baseline refuses.\n */\nexport const declareProvisionBaseline = (\n  id: string,\n  target: PveTarget,\n  names: ProvisionNames = {},\n  options: DeclareProvisionOptions = {},\n) =>\n  Effect.gen(function* () {\n    const baseline = yield* Effect.try({\n      catch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),\n      try: () => provisionBaseline(names),\n    });\n    const owned = <A, R>(resource: Effect.Effect<A, never, R>) => {\n      const kept = resource.pipe(RemovalPolicy.retain());\n      return options.adopt === undefined ? kept : kept.pipe(adopt(options.adopt));\n    };\n    const role = yield* owned(\n      ProxmoxRole(`${id}-role`, {\n        privs: [...baseline.role.privs],\n        roleid: baseline.role.roleid,\n        target,\n      }),\n    );\n    const group = yield* owned(ProxmoxGroup(`${id}-mint-group`, { ...baseline.group, target }));\n    // ★ `Effect.all` over mapped declarations (sequential), as cloudflare-permission-groups.ts does:\n    //   oxlint's unicorn/no-array-for-each cannot tell `Effect.forEach` from `Array#forEach`.\n    const users = yield* Effect.all(\n      baseline.users.map((user) =>\n        owned(\n          ProxmoxUser(`${id}-${user.lane}-user`, {\n            comment: user.comment,\n            groups: [...user.groups],\n            target,\n            userid: user.userid,\n          }),\n        ),\n      ),\n    );\n    const grants = yield* Effect.all(\n      baseline.grants.map((grant) =>\n        owned(\n          ProxmoxAcl(`${id}-${grant.lane}-grant`, {\n            path: '/',\n            propagate: true,\n            roleid: grant.roleid,\n            target,\n            type: 'user',\n            ugid: grant.userid,\n          }),\n        ),\n      ),\n    );\n    return { baseline, grants, group, role, users };\n  });\n",
-    "/**\n * `Proxmox.Role` — a PVE role: one name, one set of privileges. The object every other resource\n * in this package stands on, because a role is what the provision credential actually holds.\n *\n * ★ THIS IS WHERE pool.ts's ⚠️ STOPS BEING A MEMORY. Declared here, a hand edit shows up as\n *   `1 to update` rather than as a 403 six weeks later in the middle of something else.\n *\n * ⚠️ A DECLARATION REPLACES THE PRIVILEGE SET; IT DOES NOT ADD TO IT. `PUT /access/roles/{roleid}`\n *   accepts an `append` flag and this resource deliberately never sends it (role-wire.ts) — with\n *   append a role could only ever grow, the same perpetual diff by a different road. The\n *   consequence: anything a human added by hand is REVOKED on the next deploy unless it is in\n *   `privs`. Copy the live set out of `pveum role list` before declaring a role that already\n *   exists; do not type it from memory.\n *\n * ⛔ A ROLE CAN LOCK ITS OWN PROVIDER OUT, AND NOTHING IN THIS PACKAGE CAN UNDO IT. Reconcile runs\n *   as the provision credential, and that credential holds a role. Declare THAT role without the\n *   privileges the provider needs — `Sys.Modify` on `/access` above all — and the write succeeds,\n *   after which every later plan reads 403 and the repair has to happen out of band as `root@pam`\n *   over SSH.\n *\n * ⚠️ PVE REFUSES TO EDIT ITS OWN BUILT-IN ROLES (`Administrator`, `NoAccess`, the `PVE*` set), and\n *   the LIST read (below) DOES carry the `special` flag that marks them, unlike the item endpoint\n *   this file used before the distilled migration — `role-wire.ts`'s `attributesOf` does not use\n *   it, but a caller reading `list`'s own answer could. A declaration aimed at a built-in role\n *   still reads back cleanly and fails at write time. Declare roles you own.\n *\n * ★ PRIVILEGES A RECONCILE NEEDS: `Sys.Audit` on `/access` to read and diff, `Sys.Modify` on\n *   `/access` to create, update or delete. Not `Permissions.Modify` — that is a different object.\n *\n * ★ READ VIA THE LIST, NOT THE ITEM — A DELIBERATE CHANGE FROM THE PRE-MIGRATION CODE, AND THE\n *   REASON IS THE ITEM'S OWN GENERATED SCHEMA. `access.getAccessRole`'s response\n *   (`GetAccessRoleResponse`) enumerates a FIXED list of ~47 known privilege field names\n *   (`Sys_Modify`, `VM_Allocate`, …), each its own optional property — MEASURED in\n *   `@distilled.cloud/proxmox`'s generated `access.ts`. A privilege this package's generator did\n *   not know about would silently not appear as a field at all, and this file's old `privs: []`\n *   reconstruction would drop it from state without a diff ever seeing the loss. The LIST read\n *   (`access.listAccessRoles`) answers `privs` as the SAME plain comma string PVE's item read\n *   also disagreed with the index about pre-migration — a shape with no fixed enumeration to fall\n *   behind. `find` below (role-wire.ts) does the item-read's old job client-side.\n * ⚠️ REASONED, NOT MEASURED, THAT THE LIST READ NEEDS NO MORE THAN `read`'s AUDITOR SHAPE. The\n *   item read's own privilege check (`Sys.Audit` on `/access`) was measured; the list's was not\n *   separately checked, but PVE's own convention is that an index read is never MORE restrictive\n *   than its item. `readRole` stays at the default `read` on that basis, same as before.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s\n *   typed `access.listAccessRoles`/`createAccessRole`/`putAccessRole`/`deleteAccessRole`\n *   (2026-09-24, decision 43's proxmox walk-down). `distilled-pve.ts`'s `runPve` replaces\n *   `pve()`; the cries-wolf fix is wired the same way as acl.ts, group.ts and user.ts.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as access from '@distilled.cloud/proxmox/access';\nimport * as Effect from 'effect/Effect';\nimport { guardWrite } from './distilled-guard.ts';\nimport {\n  ROLE_CREATE,\n  ROLE_UPDATE,\n  attributesOf,\n  createForm,\n  find,\n  matches,\n  updateForm,\n} from './role-wire.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport {\n  UNREADABLE,\n  type Unreadable,\n  readOrUnreadable,\n  unreadableWarning,\n} from './unreadable-read.ts';\n\nexport interface RoleProps extends WithTarget {\n  /**\n   * PVE's primary key for a role.\n   *\n   * ⚠️ THERE IS NO RENAME. `path` is built from this, so changing it makes the factory read\n   *   nothing live, create a role under the new name, and leave the old one on the cluster with\n   *   nobody managing it. Delete the resource and declare a new one rather than editing this.\n   */\n  roleid: string;\n  /**\n   * The COMPLETE privilege set, e.g. `['VM.Allocate', 'VM.Audit', 'Sys.Audit']`. Order and\n   * duplicates do not matter — see the header — but completeness does: this list is the\n   * role, not an addition to it.\n   *\n   * ⚠️ DECLARE AT LEAST ONE. A role with no privileges grants nothing and reads back as an empty\n   *   document, which reconcile cannot tell apart from an object that is not there.\n   */\n  privs: string[];\n}\n\nexport interface RoleAttributes {\n  roleid: string;\n  /** Sorted and de-duplicated on the way in, so persisted state is identical across plans. */\n  privs: string[];\n}\n\nexport interface ProxmoxRole extends Resource<\n  'Proxmox.Role',\n  RoleProps,\n  RoleAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxRole = Resource<ProxmoxRole>('Proxmox.Role');\n\n/**\n * ★ Default `read` role — see the header's ⚠️ on the list read's privilege requirement.\n * ⛔ NO `orElseSucceed` — found 2026-09-24, the same bug class as the credential denial fix. A\n *   role's absence is ALWAYS a SUCCESSFUL read (the list comes back and the role is not in it —\n *   `access.listAccessRoles` never 404s/500s per-role the way `getAccessUser`/`getAccessGroup`\n *   do, MEASURED), so this family never needed a folding/non-folding split the way user.ts and\n *   group.ts do: any THROWN failure here is genuinely unexpected and must propagate and fail the\n *   whole plan loudly, in `diff`, `read` and `reconcile` alike — never fold to \"absent → update\".\n */\nconst readRole = (props: RoleProps) =>\n  readOrUnreadable(runPve(props.target, 'read', false, access.listAccessRoles({}))).pipe(\n    Effect.map((rows) => {\n      if (rows === UNREADABLE) return UNREADABLE;\n      const row = find(rows, props.roleid);\n      return row === undefined ? undefined : attributesOf(row, props);\n    }),\n  );\n\n/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */\nconst dropUnreadable = (live: RoleAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n\nexport const ProxmoxRoleProvider = () =>\n  Provider.effect(\n    ProxmoxRole,\n    Effect.succeed(\n      ProxmoxRole.Provider.of({\n        /**\n         * ⛔ AN EMPTY LIST, AND NOWHERE DOES IT MATTER MORE. `GET /access/roles` returns every\n         *   role on the cluster, PVE's own built-ins included. Adoption is an explicit act.\n         */\n        list: () => Effect.succeed([]),\n        read: Effect.fn(function* ({ olds }) {\n          return dropUnreadable(yield* readRole(olds));\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(ROLE_CREATE, createForm(news), output === undefined);\n          yield* guardWrite(ROLE_UPDATE, updateForm(news), false);\n          if (output === undefined) return undefined;\n          const live = yield* readRole(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force\n          //   `update` on a role that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning('Proxmox.Role', news.roleid);\n            return { action: 'noop' } as const;\n          }\n          if (live === undefined) {\n            yield* guardWrite(ROLE_CREATE, createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          return matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the\n          //   write below, so `UNREADABLE` here is a narrow race, not the routine case `diff`\n          //   handles — and a wrongful create in that race fails loudly (\"already exists\")\n          //   rather than silently duplicating, group.ts's reconcile has the same note.\n          const before = dropUnreadable(yield* readRole(news));\n          yield* guardWrite(ROLE_CREATE, createForm(news), before === undefined);\n          yield* guardWrite(ROLE_UPDATE, updateForm(news), false);\n          if (before === undefined) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              access.createAccessRole(createForm(news)),\n            );\n          } else if (!matches(before, news)) {\n            yield* runPve(news.target, 'provision', true, access.putAccessRole(updateForm(news)));\n          }\n          const after = dropUnreadable(yield* readRole(news));\n          if (after === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `access/roles/${news.roleid}: the write returned no error but the role is ` +\n                  'still absent. PVE wraps every answer in {\"data\":...} and can report success ' +\n                  'on a call that did nothing -- read back rather than trusting the status code.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ DO NOT CARRY resource.ts's DESTROY REASSURANCE OVER TO THIS ONE. PVE does not refuse\n         *   to delete a role still in use — whoever is bound to it loses those privileges the\n         *   moment it goes, and the credential THIS PROVIDER runs with is bound through exactly\n         *   such a binding. Checking who holds a role before removing it is an operator's job.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            access.deleteAccessRole({ roleid: olds.roleid }),\n          );\n        }),\n      }),\n    ),\n  );\n",
+    "/**\n * `Proxmox.Role` — a PVE role: one name, one set of privileges. The object every other resource\n * in this package stands on, because a role is what the provision credential actually holds.\n *\n * ★ THIS IS WHERE pool.ts's ⚠️ STOPS BEING A MEMORY. Declared here, a hand edit shows up as\n *   `1 to update` rather than as a 403 six weeks later in the middle of something else.\n *\n * ⚠️ A DECLARATION REPLACES THE PRIVILEGE SET; IT DOES NOT ADD TO IT. `PUT /access/roles/{roleid}`\n *   accepts an `append` flag and this resource deliberately never sends it (role-wire.ts) — with\n *   append a role could only ever grow, the same perpetual diff by a different road. The\n *   consequence: anything a human added by hand is REVOKED on the next deploy unless it is in\n *   `privs`. Copy the live set out of `pveum role list` before declaring a role that already\n *   exists; do not type it from memory.\n *\n * ⛔ A ROLE CAN LOCK ITS OWN PROVIDER OUT, AND NOTHING IN THIS PACKAGE CAN UNDO IT. Reconcile runs\n *   as the provision credential, and that credential holds a role. Declare THAT role without the\n *   privileges the provider needs — `Sys.Modify` on `/access` above all — and the write succeeds,\n *   after which every later plan reads 403 and the repair has to happen out of band as `root@pam`\n *   over SSH.\n *\n * ⚠️ PVE REFUSES TO EDIT ITS OWN BUILT-IN ROLES (`Administrator`, `NoAccess`, the `PVE*` set), and\n *   the LIST read (below) DOES carry the `special` flag that marks them, unlike the item endpoint\n *   this file used before the distilled migration — `role-wire.ts`'s `attributesOf` does not use\n *   it, but a caller reading `list`'s own answer could. A declaration aimed at a built-in role\n *   still reads back cleanly and fails at write time. Declare roles you own.\n *\n * ★ PRIVILEGES A RECONCILE NEEDS: `Sys.Audit` on `/access` to read and diff, `Sys.Modify` on\n *   `/access` to create, update or delete. Not `Permissions.Modify` — that is a different object.\n *\n * ★ READ VIA THE LIST, NOT THE ITEM — A DELIBERATE CHANGE FROM THE PRE-MIGRATION CODE, AND THE\n *   REASON IS THE ITEM'S OWN GENERATED SCHEMA. `access.getAccessRole`'s response\n *   (`GetAccessRoleResponse`) enumerates a FIXED list of ~47 known privilege field names\n *   (`Sys_Modify`, `VM_Allocate`, …), each its own optional property — MEASURED in\n *   `@distilled.cloud/proxmox`'s generated `access.ts`. A privilege this package's generator did\n *   not know about would silently not appear as a field at all, and this file's old `privs: []`\n *   reconstruction would drop it from state without a diff ever seeing the loss. The LIST read\n *   (`access.listAccessRoles`) answers `privs` as the SAME plain comma string PVE's item read\n *   also disagreed with the index about pre-migration — a shape with no fixed enumeration to fall\n *   behind. `find` below (role-wire.ts) does the item-read's old job client-side.\n * ⚠️ REASONED, NOT MEASURED, THAT THE LIST READ NEEDS NO MORE THAN `read`'s AUDITOR SHAPE. The\n *   item read's own privilege check (`Sys.Audit` on `/access`) was measured; the list's was not\n *   separately checked, but PVE's own convention is that an index read is never MORE restrictive\n *   than its item. `readRole` stays at the default `read` on that basis, same as before.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s\n *   typed `access.listAccessRoles`/`createAccessRole`/`putAccessRole`/`deleteAccessRole`\n *   (2026-09-24, decision 43's proxmox walk-down). `distilled-pve.ts`'s `runPve` replaces\n *   `pve()`; the cries-wolf fix is wired the same way as acl.ts, group.ts and user.ts.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as access from '@distilled.cloud/proxmox/access';\nimport * as Effect from 'effect/Effect';\nimport { guardWrite } from './distilled-guard.ts';\nimport {\n  ROLE_CREATE,\n  ROLE_UPDATE,\n  attributesOf,\n  createForm,\n  find,\n  matches,\n  updateForm,\n} from './role-wire.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { mintTier } from './credentials.ts';\nimport {\n  UNREADABLE,\n  type Unreadable,\n  readOrUnreadable,\n  unreadableWarning,\n} from './unreadable-read.ts';\n\nexport interface RoleProps extends WithTarget {\n  /**\n   * PVE's primary key for a role.\n   *\n   * ⚠️ THERE IS NO RENAME. `path` is built from this, so changing it makes the factory read\n   *   nothing live, create a role under the new name, and leave the old one on the cluster with\n   *   nobody managing it. Delete the resource and declare a new one rather than editing this.\n   */\n  roleid: string;\n  /**\n   * The COMPLETE privilege set, e.g. `['VM.Allocate', 'VM.Audit', 'Sys.Audit']`. Order and\n   * duplicates do not matter — see the header — but completeness does: this list is the\n   * role, not an addition to it.\n   *\n   * ⚠️ DECLARE AT LEAST ONE. A role with no privileges grants nothing and reads back as an empty\n   *   document, which reconcile cannot tell apart from an object that is not there.\n   */\n  privs: string[];\n}\n\nexport interface RoleAttributes {\n  roleid: string;\n  /** Sorted and de-duplicated on the way in, so persisted state is identical across plans. */\n  privs: string[];\n}\n\nexport interface ProxmoxRole extends Resource<\n  'Proxmox.Role',\n  RoleProps,\n  RoleAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxRole = Resource<ProxmoxRole>('Proxmox.Role');\n\n/**\n * ★ Default `read` role — see the header's ⚠️ on the list read's privilege requirement.\n * ⛔ NO `orElseSucceed` — found 2026-09-24, the same bug class as the credential denial fix. A\n *   role's absence is ALWAYS a SUCCESSFUL read (the list comes back and the role is not in it —\n *   `access.listAccessRoles` never 404s/500s per-role the way `getAccessUser`/`getAccessGroup`\n *   do, MEASURED), so this family never needed a folding/non-folding split the way user.ts and\n *   group.ts do: any THROWN failure here is genuinely unexpected and must propagate and fail the\n *   whole plan loudly, in `diff`, `read` and `reconcile` alike — never fold to \"absent → update\".\n */\nconst readRole = (props: RoleProps) =>\n  readOrUnreadable(runPve(props.target, 'read', false, access.listAccessRoles({}))).pipe(\n    Effect.map((rows) => {\n      if (rows === UNREADABLE) return UNREADABLE;\n      const row = find(rows, props.roleid);\n      return row === undefined ? undefined : attributesOf(row, props);\n    }),\n  );\n\n/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */\nconst dropUnreadable = (live: RoleAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n\nexport const ProxmoxRoleProvider = () =>\n  Provider.effect(\n    ProxmoxRole,\n    Effect.succeed(\n      ProxmoxRole.Provider.of({\n        /**\n         * ⛔ AN EMPTY LIST, AND NOWHERE DOES IT MATTER MORE. `GET /access/roles` returns every\n         *   role on the cluster, PVE's own built-ins included. Adoption is an explicit act.\n         */\n        list: () => Effect.succeed([]),\n        read: Effect.fn(function* ({ olds }) {\n          return dropUnreadable(yield* readRole(olds));\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(ROLE_CREATE, createForm(news), output === undefined);\n          yield* guardWrite(ROLE_UPDATE, updateForm(news), false);\n          if (output === undefined) return undefined;\n          const live = yield* readRole(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force\n          //   `update` on a role that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning(\n              'Proxmox.Role',\n              news.roleid,\n              news.target.mount,\n              mintTier(news.target, 'read'),\n            );\n            return { action: 'noop' } as const;\n          }\n          if (live === undefined) {\n            yield* guardWrite(ROLE_CREATE, createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          return matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the\n          //   write below, so `UNREADABLE` here is a narrow race, not the routine case `diff`\n          //   handles — and a wrongful create in that race fails loudly (\"already exists\")\n          //   rather than silently duplicating, group.ts's reconcile has the same note.\n          const before = dropUnreadable(yield* readRole(news));\n          yield* guardWrite(ROLE_CREATE, createForm(news), before === undefined);\n          yield* guardWrite(ROLE_UPDATE, updateForm(news), false);\n          if (before === undefined) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              access.createAccessRole(createForm(news)),\n            );\n          } else if (!matches(before, news)) {\n            yield* runPve(news.target, 'provision', true, access.putAccessRole(updateForm(news)));\n          }\n          const after = dropUnreadable(yield* readRole(news));\n          if (after === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `access/roles/${news.roleid}: the write returned no error but the role is ` +\n                  'still absent. PVE wraps every answer in {\"data\":...} and can report success ' +\n                  'on a call that did nothing -- read back rather than trusting the status code.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ DO NOT CARRY resource.ts's DESTROY REASSURANCE OVER TO THIS ONE. PVE does not refuse\n         *   to delete a role still in use — whoever is bound to it loses those privileges the\n         *   moment it goes, and the credential THIS PROVIDER runs with is bound through exactly\n         *   such a binding. Checking who holds a role before removing it is an operator's job.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            access.deleteAccessRole({ roleid: olds.roleid }),\n          );\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * `Proxmox.Role`'s wire shape: PVE's create/update forms and how a live list row becomes\n * attributes. Split out of role.ts (2026-09-24, the distilled migration) to keep that file\n * under the 250-line cap — the api-token.ts/api-token-form.ts seam.\n */\nimport type * as access from '@distilled.cloud/proxmox/access';\nimport type { RoleAttributes, RoleProps } from './role.ts';\n\nexport const ROLE_CREATE = 'pve:POST /access/roles';\nexport const ROLE_UPDATE = 'pve:PUT /access/roles/{roleid}';\n\n/**\n * The only shape two privilege sets may be compared in: sorted, de-duplicated, blanks dropped.\n *\n * ⚠️ THE TRIM AND THE EMPTY FILTER ARE NOT DECORATION. `'A,B,'.split(',')` yields a trailing `''`,\n *   and a hand-written list is quite likely to carry a stray space after a comma. Either one turns\n *   into a phantom member that no live answer can contain, so `matches` would be false on every\n *   plan and the deploy would rewrite the role to exactly what it already was.\n */\nexport const canonical = (privs: readonly string[]): string[] =>\n  [...new Set(privs.map((priv) => priv.trim()).filter((priv) => priv.length > 0))].sort();\n\nexport const createForm = (props: RoleProps): access.CreateAccessRoleRequest => ({\n  privs: canonical(props.privs).join(','),\n  roleid: props.roleid,\n});\n\n/**\n * ⚠️ NO `append` FIELD, DELIBERATELY. Sending `append=1` would make every update additive, so a\n *   privilege could be granted from here but never taken away — see role.ts's own header.\n */\nexport const updateForm = (props: RoleProps): access.PutAccessRoleRequest => ({\n  privs: canonical(props.privs).join(','),\n  roleid: props.roleid,\n});\n\nexport const find = (rows: readonly access.ListAccessRolesResponseBodyItem[], roleid: string) =>\n  rows.find((row) => row.roleid === roleid);\n\nexport const attributesOf = (\n  row: access.ListAccessRolesResponseBodyItem,\n  props: RoleProps,\n): RoleAttributes => ({\n  privs: canonical(row.privs === undefined ? [] : row.privs.split(',')),\n  roleid: props.roleid,\n});\n\nexport const matches = (attributes: RoleAttributes, props: RoleProps) =>\n  canonical(attributes.privs).join(',') === canonical(props.privs).join(',');\n",
-    "/**\n * `Proxmox.User` — a PVE account. The identity every other resource in this package borrows.\n *\n * ★ THIS IS THE ONE OBJECT THAT CAN CUT THE BRANCH IT SITS ON. The user the credential mount vends\n *   tokens for, and the group whose members are allowed to mint, are what `credentials.ts`\n *   ultimately asks OpenBao for. A cluster rebuilt without them cannot plan ANY resource here —\n *   including the plan that would recreate them, which needs a credential to run. So this resource\n *   is drift repair for an account that already exists (comment, email, enable, expire, groups),\n *   not a bootstrap: the first mint user is made on a node with `pveum user add`, by a human, once.\n *\n * ⛔ THERE IS NO `password` PROP, AND ADDING ONE WOULD BE A LEAK RATHER THAN A FEATURE. Alchemy\n *   writes resource state WITHOUT encryption — see the ⛔ in `credentials.ts` — so a password prop\n *   would sit in clear in whatever database the stack points `state` at, and in every backup of it.\n *   It is also unnecessary: `password` is accepted only by the CREATE call, changing one afterwards\n *   is `PUT /access/password` (a different endpoint, a different privilege), and an account in a\n *   realm such as `@pam`, `@ldap` or `@openid` has no PVE-side password at all — the realm holds\n *   it. Out of scope by design. `keys` (TFA) is omitted for the same reason.\n *\n * ⚠️ `groups` COMES BACK AS AN ARRAY AND GOES OUT AS A COMMA STRING, and the asymmetry is the whole\n *   trap. GET answers `[\"a\",\"b\"]`, POST/PUT want `a,b`, and PVE returns the list in ITS order, not\n *   the declared one. Both sides are normalised to a sorted, deduplicated set — see user-wire.ts.\n *\n * ⚠️ `tokens` IS NESTED AND IS NOT SETTABLE THROUGH THIS ENDPOINT. The read hands back a map of the\n *   account's API tokens; `PUT /access/users/{userid}` has no parameter for them, because they are\n *   their own objects under `.../token/{tokenid}` (api-token.ts). So they are reported as an\n *   attribute and kept OUT of `matches`, exactly like `pool.members`. Reported, never declared.\n *\n * ⚠️ RECONCILE NEEDS PRIVILEGES A GUEST-ONLY ROLE DOES NOT HOLD, so they are stated rather than met\n *   as a 403 in the middle of a deploy. `PROVISION_PRIVILEGES` (provision-baseline.ts) carries:\n *     · `Realm.AllocateUser` on `/access/realm/<realm>` — create and delete.\n *     · `User.Modify` on `/access/groups`, and on `/access/groups/<group>` for EVERY group named in\n *       `groups` — create, update and delete. PVE checks the groups you are granting, not just the\n *       user, so a role wide enough to edit the account can still be refused for one group.\n *     · `Sys.Audit` (or `User.Modify`) for the read, which the `read` role's auditor already has.\n *\n * ⚠️ A MISSING USER IS A 500, NOT A 404 — MEASURED against the live cluster, \"no such user\n *   ('x@pve')\". The first SDK migration exposed it as `InternalServerError`, so its create\n *   workflow needed a catch-all fold. SDK PR #265 now recognizes `UserNotFound`; `readUser`\n *   catches only that tag, letting other cold-read/reconcile failures propagate. The strict\n *   `readUserOrFail` path for confirmed rows remains unchanged: its original transient-failure\n *   fix stopped the cries-wolf update with nothing compared (user-wire.ts).\n *\n * ⚠️ THE WIRE URL FOR THIS FAMILY CHANGED, THOUGH NOTHING A CALLER SEES DID. MEASURED\n *   (user.test.ts): distilled's `{userid}` label substitution percent-encodes it —\n *   `iac@pve` -> `.../access/users/iac%40pve` — where `client.ts`'s plain string concatenation\n *   sent the `@` literally. A real PVE (any HTTP server) decodes both the same way, so this is\n *   not a behaviour change a stack observes; a fake in a test has to decode it, `client.ts`'s\n *   own fixtures never had to.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s\n *   typed `access.getAccessUser`/`createAccessUser`/`putAccessUser`/`deleteAccessUser`\n *   (2026-09-24, decision 43's proxmox walk-down, access sub-area). `distilled-pve.ts`'s `runPve`\n *   replaces `pve()` as in acl.ts and group.ts; the cries-wolf fix is wired the same way.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as access from '@distilled.cloud/proxmox/access';\nimport * as Effect from 'effect/Effect';\nimport { guardWrite } from './distilled-guard.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { UNREADABLE, unreadableWarning } from './unreadable-read.ts';\nimport {\n  USER_CREATE,\n  USER_UPDATE,\n  createForm,\n  dropUnreadable,\n  matches,\n  readUser,\n  readUserOrFail,\n  updateForm,\n} from './user-wire.ts';\n\nexport interface UserProps extends WithTarget {\n  /**\n   * ⛔ REALM-QUALIFIED, ALWAYS: `someone@pve`, `someone@pam`. The realm is part of PVE's primary\n   *   key, and a bare name is refused with \"value does not look like a valid user id\".\n   *\n   * ⚠️ PVE HAS NO RENAME. Editing this prop makes the path point at a DIFFERENT account, which\n   *   reads as absent and is then created — while the old one stays on the cluster with its tokens\n   *   and its ACL entries. Renaming is a delete and a create, and should be declared as one.\n   */\n  userid: string;\n  /** Free text shown in the UI. */\n  comment?: string;\n  /** PVE accepts the empty string here; that is how an address is cleared. */\n  email?: string;\n  /** Default true, matching PVE's own `enable=1`. False disables login without deleting anything. */\n  enable?: boolean;\n  /** Seconds since the epoch. 0 — the default — means the account never expires. */\n  expire?: number;\n  /** Group memberships. Order and duplicates carry no meaning — see the ⚠️ in the header. */\n  groups?: string[];\n  firstname?: string;\n  lastname?: string;\n}\n\nexport interface UserAttributes {\n  userid: string;\n  comment: string;\n  email: string;\n  enable: boolean;\n  expire: number;\n  /** Normalised: sorted, deduplicated, whatever shape the cluster used on the wire. */\n  groups: string[];\n  firstname: string;\n  lastname: string;\n  /**\n   * API token names this account owns. Reported so a plan can show what a delete would revoke;\n   * never compared, because this endpoint cannot set them.\n   */\n  tokens: string[];\n}\n\nexport interface ProxmoxUser extends Resource<\n  'Proxmox.User',\n  UserProps,\n  UserAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxUser = Resource<ProxmoxUser>('Proxmox.User');\n\nexport const ProxmoxUserProvider = () =>\n  Provider.effect(\n    ProxmoxUser,\n    Effect.succeed(\n      ProxmoxUser.Provider.of({\n        /**\n         * ⛔ EMPTY, AND MORE POINTEDLY SO HERE THAN ANYWHERE ELSE. `GET /access/users` answers\n         *   with every account on the cluster: `root@pam`, every human who logs in, every service\n         *   identity someone made years ago. Adoption is an explicit act.\n         */\n        list: () => Effect.succeed([]),\n        // ⚠️ FOLDS ONLY WHEN `output` IS `undefined` — MEASURED 2026-09-24, an adversarial review\n        //   of this very fix caught the gap. The engine calls this ONE hook from FOUR places\n        //   (alchemy/src/{Plan,Apply,Drift}.ts), and only `output` tells them apart: Plan.ts's\n        //   cold-start adoption probe and interrupted-create recovery, and Apply.ts's\n        //   delete-recovery, all pass `output: undefined` — nothing is confirmed to exist yet, so\n        //   `readUser`'s fold is still needed there or a brand-new account could never be adopted\n        //   or created. `Drift.ts` (`alchemy drift`/`sync`/`deploy --detect-drift`) is different:\n        //   it calls this on an ALREADY-CONFIRMED row (`output: old.attr`, defined), exactly\n        //   `diff`'s own situation below — a transient failure folded to `undefined` there is\n        //   reported as `{action: 'missing'}` with NO error at all, the cries-wolf bug again, one\n        //   command over. `readUserOrFail` on that branch propagates it instead.\n        read: Effect.fn(function* ({ olds, output }) {\n          return dropUnreadable(\n            yield* output === undefined ? readUser(olds) : readUserOrFail(olds),\n          );\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(USER_CREATE, createForm(news), output === undefined);\n          yield* guardWrite(USER_UPDATE, updateForm(news), false);\n          if (output === undefined) return undefined;\n          // ⚠️ `readUserOrFail`, NOT `readUser` — see that function's own header (user-wire.ts).\n          //   A genuine failure here propagates and fails the whole plan loudly instead of\n          //   folding to \"absent\" and forcing a false update, the cries-wolf class of bug.\n          const live = yield* readUserOrFail(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force\n          //   `update` on an account that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning('Proxmox.User', news.userid);\n            return { action: 'noop' } as const;\n          }\n          if (live === undefined) {\n            yield* guardWrite(USER_CREATE, createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          return matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the\n          //   write below, so `UNREADABLE` here is a narrow race, not the routine case `diff`\n          //   handles — and a wrongful create in that race fails loudly (\"already exists\")\n          //   rather than silently duplicating, group.ts's reconcile has the same note.\n          const before = dropUnreadable(yield* readUser(news));\n          yield* guardWrite(USER_CREATE, createForm(news), before === undefined);\n          yield* guardWrite(USER_UPDATE, updateForm(news), false);\n          if (before === undefined) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              access.createAccessUser(createForm(news)),\n            );\n          } else if (!matches(before, news)) {\n            yield* runPve(news.target, 'provision', true, access.putAccessUser(updateForm(news)));\n          }\n          const after = dropUnreadable(yield* readUser(news));\n          if (after === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `access/users/${news.userid}: the write returned no error but the account is ` +\n                  'still absent. PVE wraps every answer in {\"data\":...} and can report success ' +\n                  'on a call that did nothing -- read back rather than trusting the status code.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ DELETING A USER TAKES ITS API TOKENS AND ITS ACL ENTRIES WITH IT, in one call and\n         *   without a confirmation. For the identity a credential mount vends from, that revokes\n         *   every outstanding lease at once and every plan in this package stops working — this\n         *   one included. PVE refuses only for `root@pam`; for everyone else it simply obeys.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            access.deleteAccessUser({ userid: olds.userid }),\n          );\n        }),\n      }),\n    ),\n  );\n",
+    "/**\n * `Proxmox.User` — a PVE account. The identity every other resource in this package borrows.\n *\n * ★ THIS IS THE ONE OBJECT THAT CAN CUT THE BRANCH IT SITS ON. The user the credential mount vends\n *   tokens for, and the group whose members are allowed to mint, are what `credentials.ts`\n *   ultimately asks OpenBao for. A cluster rebuilt without them cannot plan ANY resource here —\n *   including the plan that would recreate them, which needs a credential to run. So this resource\n *   is drift repair for an account that already exists (comment, email, enable, expire, groups),\n *   not a bootstrap: the first mint user is made on a node with `pveum user add`, by a human, once.\n *\n * ⛔ THERE IS NO `password` PROP, AND ADDING ONE WOULD BE A LEAK RATHER THAN A FEATURE. Alchemy\n *   writes resource state WITHOUT encryption — see the ⛔ in `credentials.ts` — so a password prop\n *   would sit in clear in whatever database the stack points `state` at, and in every backup of it.\n *   It is also unnecessary: `password` is accepted only by the CREATE call, changing one afterwards\n *   is `PUT /access/password` (a different endpoint, a different privilege), and an account in a\n *   realm such as `@pam`, `@ldap` or `@openid` has no PVE-side password at all — the realm holds\n *   it. Out of scope by design. `keys` (TFA) is omitted for the same reason.\n *\n * ⚠️ `groups` COMES BACK AS AN ARRAY AND GOES OUT AS A COMMA STRING, and the asymmetry is the whole\n *   trap. GET answers `[\"a\",\"b\"]`, POST/PUT want `a,b`, and PVE returns the list in ITS order, not\n *   the declared one. Both sides are normalised to a sorted, deduplicated set — see user-wire.ts.\n *\n * ⚠️ `tokens` IS NESTED AND IS NOT SETTABLE THROUGH THIS ENDPOINT. The read hands back a map of the\n *   account's API tokens; `PUT /access/users/{userid}` has no parameter for them, because they are\n *   their own objects under `.../token/{tokenid}` (api-token.ts). So they are reported as an\n *   attribute and kept OUT of `matches`, exactly like `pool.members`. Reported, never declared.\n *\n * ⚠️ RECONCILE NEEDS PRIVILEGES A GUEST-ONLY ROLE DOES NOT HOLD, so they are stated rather than met\n *   as a 403 in the middle of a deploy. `PROVISION_PRIVILEGES` (provision-baseline.ts) carries:\n *     · `Realm.AllocateUser` on `/access/realm/<realm>` — create and delete.\n *     · `User.Modify` on `/access/groups`, and on `/access/groups/<group>` for EVERY group named in\n *       `groups` — create, update and delete. PVE checks the groups you are granting, not just the\n *       user, so a role wide enough to edit the account can still be refused for one group.\n *     · `Sys.Audit` (or `User.Modify`) for the read, which the `read` role's auditor already has.\n *\n * ⚠️ A MISSING USER IS A 500, NOT A 404 — MEASURED against the live cluster, \"no such user\n *   ('x@pve')\". The first SDK migration exposed it as `InternalServerError`, so its create\n *   workflow needed a catch-all fold. SDK PR #265 now recognizes `UserNotFound`; `readUser`\n *   catches only that tag, letting other cold-read/reconcile failures propagate. The strict\n *   `readUserOrFail` path for confirmed rows remains unchanged: its original transient-failure\n *   fix stopped the cries-wolf update with nothing compared (user-wire.ts).\n *\n * ⚠️ THE WIRE URL FOR THIS FAMILY CHANGED, THOUGH NOTHING A CALLER SEES DID. MEASURED\n *   (user.test.ts): distilled's `{userid}` label substitution percent-encodes it —\n *   `iac@pve` -> `.../access/users/iac%40pve` — where `client.ts`'s plain string concatenation\n *   sent the `@` literally. A real PVE (any HTTP server) decodes both the same way, so this is\n *   not a behaviour change a stack observes; a fake in a test has to decode it, `client.ts`'s\n *   own fixtures never had to.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` ONTO `@distilled.cloud/proxmox`'s\n *   typed `access.getAccessUser`/`createAccessUser`/`putAccessUser`/`deleteAccessUser`\n *   (2026-09-24, decision 43's proxmox walk-down, access sub-area). `distilled-pve.ts`'s `runPve`\n *   replaces `pve()` as in acl.ts and group.ts; the cries-wolf fix is wired the same way.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as access from '@distilled.cloud/proxmox/access';\nimport * as Effect from 'effect/Effect';\nimport { guardWrite } from './distilled-guard.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { mintTier } from './credentials.ts';\nimport { UNREADABLE, unreadableWarning } from './unreadable-read.ts';\nimport {\n  USER_CREATE,\n  USER_UPDATE,\n  createForm,\n  dropUnreadable,\n  matches,\n  readUser,\n  readUserOrFail,\n  updateForm,\n} from './user-wire.ts';\n\nexport interface UserProps extends WithTarget {\n  /**\n   * ⛔ REALM-QUALIFIED, ALWAYS: `someone@pve`, `someone@pam`. The realm is part of PVE's primary\n   *   key, and a bare name is refused with \"value does not look like a valid user id\".\n   *\n   * ⚠️ PVE HAS NO RENAME. Editing this prop makes the path point at a DIFFERENT account, which\n   *   reads as absent and is then created — while the old one stays on the cluster with its tokens\n   *   and its ACL entries. Renaming is a delete and a create, and should be declared as one.\n   */\n  userid: string;\n  /** Free text shown in the UI. */\n  comment?: string;\n  /** PVE accepts the empty string here; that is how an address is cleared. */\n  email?: string;\n  /** Default true, matching PVE's own `enable=1`. False disables login without deleting anything. */\n  enable?: boolean;\n  /** Seconds since the epoch. 0 — the default — means the account never expires. */\n  expire?: number;\n  /** Group memberships. Order and duplicates carry no meaning — see the ⚠️ in the header. */\n  groups?: string[];\n  firstname?: string;\n  lastname?: string;\n}\n\nexport interface UserAttributes {\n  userid: string;\n  comment: string;\n  email: string;\n  enable: boolean;\n  expire: number;\n  /** Normalised: sorted, deduplicated, whatever shape the cluster used on the wire. */\n  groups: string[];\n  firstname: string;\n  lastname: string;\n  /**\n   * API token names this account owns. Reported so a plan can show what a delete would revoke;\n   * never compared, because this endpoint cannot set them.\n   */\n  tokens: string[];\n}\n\nexport interface ProxmoxUser extends Resource<\n  'Proxmox.User',\n  UserProps,\n  UserAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxUser = Resource<ProxmoxUser>('Proxmox.User');\n\nexport const ProxmoxUserProvider = () =>\n  Provider.effect(\n    ProxmoxUser,\n    Effect.succeed(\n      ProxmoxUser.Provider.of({\n        /**\n         * ⛔ EMPTY, AND MORE POINTEDLY SO HERE THAN ANYWHERE ELSE. `GET /access/users` answers\n         *   with every account on the cluster: `root@pam`, every human who logs in, every service\n         *   identity someone made years ago. Adoption is an explicit act.\n         */\n        list: () => Effect.succeed([]),\n        // ⚠️ FOLDS ONLY WHEN `output` IS `undefined` — MEASURED 2026-09-24, an adversarial review\n        //   of this very fix caught the gap. The engine calls this ONE hook from FOUR places\n        //   (alchemy/src/{Plan,Apply,Drift}.ts), and only `output` tells them apart: Plan.ts's\n        //   cold-start adoption probe and interrupted-create recovery, and Apply.ts's\n        //   delete-recovery, all pass `output: undefined` — nothing is confirmed to exist yet, so\n        //   `readUser`'s fold is still needed there or a brand-new account could never be adopted\n        //   or created. `Drift.ts` (`alchemy drift`/`sync`/`deploy --detect-drift`) is different:\n        //   it calls this on an ALREADY-CONFIRMED row (`output: old.attr`, defined), exactly\n        //   `diff`'s own situation below — a transient failure folded to `undefined` there is\n        //   reported as `{action: 'missing'}` with NO error at all, the cries-wolf bug again, one\n        //   command over. `readUserOrFail` on that branch propagates it instead.\n        read: Effect.fn(function* ({ olds, output }) {\n          return dropUnreadable(\n            yield* output === undefined ? readUser(olds) : readUserOrFail(olds),\n          );\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(USER_CREATE, createForm(news), output === undefined);\n          yield* guardWrite(USER_UPDATE, updateForm(news), false);\n          if (output === undefined) return undefined;\n          // ⚠️ `readUserOrFail`, NOT `readUser` — see that function's own header (user-wire.ts).\n          //   A genuine failure here propagates and fails the whole plan loudly instead of\n          //   folding to \"absent\" and forcing a false update, the cries-wolf class of bug.\n          const live = yield* readUserOrFail(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force\n          //   `update` on an account that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning(\n              'Proxmox.User',\n              news.userid,\n              news.target.mount,\n              mintTier(news.target, 'read'),\n            );\n            return { action: 'noop' } as const;\n          }\n          if (live === undefined) {\n            yield* guardWrite(USER_CREATE, createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          return matches(live, news)\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the\n          //   write below, so `UNREADABLE` here is a narrow race, not the routine case `diff`\n          //   handles — and a wrongful create in that race fails loudly (\"already exists\")\n          //   rather than silently duplicating, group.ts's reconcile has the same note.\n          const before = dropUnreadable(yield* readUser(news));\n          yield* guardWrite(USER_CREATE, createForm(news), before === undefined);\n          yield* guardWrite(USER_UPDATE, updateForm(news), false);\n          if (before === undefined) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              access.createAccessUser(createForm(news)),\n            );\n          } else if (!matches(before, news)) {\n            yield* runPve(news.target, 'provision', true, access.putAccessUser(updateForm(news)));\n          }\n          const after = dropUnreadable(yield* readUser(news));\n          if (after === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `access/users/${news.userid}: the write returned no error but the account is ` +\n                  'still absent. PVE wraps every answer in {\"data\":...} and can report success ' +\n                  'on a call that did nothing -- read back rather than trusting the status code.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ DELETING A USER TAKES ITS API TOKENS AND ITS ACL ENTRIES WITH IT, in one call and\n         *   without a confirmation. For the identity a credential mount vends from, that revokes\n         *   every outstanding lease at once and every plan in this package stops working — this\n         *   one included. PVE refuses only for `root@pam`; for everyone else it simply obeys.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            access.deleteAccessUser({ userid: olds.userid }),\n          );\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * `Proxmox.User`'s wire shape: PVE's create/update forms, how a live item becomes attributes,\n * and the read itself. Split out of user.ts (2026-09-24, the distilled migration) to keep that\n * file under the 250-line cap — the api-token.ts/api-token-form.ts seam.\n */\nimport * as access from '@distilled.cloud/proxmox/access';\nimport * as Effect from 'effect/Effect';\nimport { runPve } from './distilled-pve.ts';\nimport type { UserAttributes, UserProps } from './user.ts';\nimport { UNREADABLE, type Unreadable, readOrUnreadable } from './unreadable-read.ts';\nimport { bool, text } from './values.ts';\n\nexport const USER_CREATE = 'pve:POST /access/users';\nexport const USER_UPDATE = 'pve:PUT /access/users/{userid}';\n\n/**\n * ⚠️ MORE FORGIVING THAN `lxc.ts`'s `num`, ON PURPOSE, AND DELIBERATELY NOT `values.ts`'s\n *   `int` (a different function of the same name, `Number.parseInt` on a STRING with a\n *   caller-given fallback). PVE's JSON is generated from a Perl schema and an integer field can\n *   arrive as `0` or `\"0\"` depending on the release and the endpoint; `Number(value ?? 0)`\n *   accepts either without a strict `typeof === 'number'` that would silently fall back for the\n *   string form and report an update `matches` can never settle.\n */\nconst int = (value: unknown) => {\n  const parsed = typeof value === 'number' ? value : Number(value ?? 0);\n  return Number.isFinite(parsed) ? parsed : 0;\n};\n\n/**\n * An array (what the read returns), a comma string (what older releases and the write side use), or\n * nothing — in; a sorted, deduplicated list out. Both sides of `matches` go through this, which is\n * the only reason the diff ever settles.\n */\nconst groupSet = (value: unknown): string[] => {\n  const raw: unknown[] = Array.isArray(value)\n    ? value\n    : typeof value === 'string'\n      ? value.split(',')\n      : [];\n  const names = raw.map((group) => text(group).trim()).filter((group) => group !== '');\n  return [...new Set(names)].sort();\n};\n\n/**\n * ⚠️ THE SHAPE DEPENDS ON WHICH ENDPOINT YOU ASKED. Reading ONE user gives an object keyed by\n *   token name; distilled types it `tokens?: unknown` for the same reason (the item and index\n *   responses disagree, and this provider only ever reads the item). Anything but that shape is\n *   reported as \"no tokens\" rather than guessed at.\n */\nconst tokenNames = (value: unknown): string[] =>\n  typeof value === 'object' && value !== null && !Array.isArray(value)\n    ? Object.keys(value).sort()\n    : [];\n\n/** Everything mutable, in the form PVE wants. Create adds `userid`; update sends exactly this. */\nconst shape = (props: UserProps) => ({\n  comment: props.comment ?? '',\n  email: props.email ?? '',\n  enable: props.enable === false ? '0' : '1',\n  expire: String(props.expire ?? 0),\n  firstname: props.firstname ?? '',\n  /**\n   * ⚠️ ALWAYS SENT, EVEN EMPTY. Omitting `groups` on a PUT leaves the existing memberships in\n   *   place, so a group removed from the declaration would never actually be removed. Same for\n   *   `email` and `comment`: the empty string is how PVE is told to clear a field.\n   * ⚠️ AND `append` IS DELIBERATELY NOT SET. Its default (0) REPLACES the list; setting it to 1\n   *   would turn every reconcile into an add-only merge, which is the same non-settling diff.\n   */\n  groups: groupSet(props.groups).join(','),\n  lastname: props.lastname ?? '',\n});\n\nexport const createForm = (props: UserProps): access.CreateAccessUserRequest => ({\n  ...shape(props),\n  userid: props.userid,\n});\n\nexport const updateForm = (props: UserProps): access.PutAccessUserRequest => ({\n  ...shape(props),\n  userid: props.userid,\n});\n\nconst attributesOf = (live: access.GetAccessUserResponse, props: UserProps): UserAttributes => ({\n  comment: text(live.comment),\n  email: text(live.email),\n  /**\n   * ⚠️ ABSENT MEANS ENABLED. PVE's schema defaults `enable` to 1 and does not always write the\n   *   key back for an enabled account. Reading absence as `false` would report an update on\n   *   every plan and then DISABLE the account on the deploy that \"fixed\" it.\n   */\n  enable: bool(live.enable, true),\n  expire: int(live.expire),\n  firstname: text(live.firstname),\n  groups: groupSet(live.groups),\n  lastname: text(live.lastname),\n  tokens: tokenNames(live.tokens),\n  /** ⚠️ FROM PROPS: `GET /access/users/{userid}` does not echo the userid back in its data. */\n  userid: props.userid,\n});\n\n/**\n * ⚠️ `tokens` IS NOT COMPARED, and neither is anything create-only. What is compared is exactly\n *   what a PUT can put back; a field PVE reports but will not accept is drift nobody can fix.\n */\nexport const matches = (attributes: UserAttributes, props: UserProps) =>\n  attributes.comment === (props.comment ?? '') &&\n  attributes.email === (props.email ?? '') &&\n  attributes.enable === (props.enable !== false) &&\n  attributes.expire === (props.expire ?? 0) &&\n  attributes.firstname === (props.firstname ?? '') &&\n  attributes.lastname === (props.lastname ?? '') &&\n  attributes.groups.join(',') === groupSet(props.groups).join(',');\n\n/**\n * ★ Default `read` role for this family — only the write side needs `provision`.\n * ⛔ `{ userid: props.userid }`, NEVER THE WHOLE `props` — MEASURED 2026-09-24, the regression in\n *   kit 0.31.1. `GetAccessUserRequest`'s schema declares only `userid` (a path label); any OTHER\n *   key on the object passed to `access.getAccessUser` — `target`, `comment`, every field this\n *   family's own props carry — is treated by distilled's `buildRequest` as an \"unknown key\" and\n *   JSON-encoded onto the request as a BODY, on every one of these bodyless GETs. A stricter\n *   fetch client than a bare `bun run` of this file refuses a GET carrying any body at all\n *   (`TypeError [ERR_INVALID_ARG_VALUE]: fetch() request with GET/HEAD method cannot have body`),\n *   which `runPveWith` retries across every member and exhausts identically —\n *   `PveClusterExhausted`, then silently folded to \"absent\" by the old `orElseSucceed`, forcing a\n *   false `update` on every account.\n */\nexport const readUserOrFail = (props: UserProps) =>\n  readOrUnreadable(\n    runPve(props.target, 'read', false, access.getAccessUser({ userid: props.userid })),\n  ).pipe(Effect.map((live) => (live === UNREADABLE ? UNREADABLE : attributesOf(live, props))));\n\n/**\n * ⛔ ONLY `UserNotFound` MEANS ABSENT. The initial distilled transport swap preserved a\n *   catch-all fold because PVE reports missing objects as HTTP 500. SDK PR 265 now types that\n *   measured message, so permission errors, unrelated 500s and exhausted transports propagate\n *   instead of triggering a speculative create (decision 49 follow-up, 2026-09-24).\n * ★ `readUserOrFail` remains the strict path used for an already-confirmed state row. This\n *   change narrows cold reads/reconcile without changing that existing drift/diff contract.\n */\nexport const readUser = (props: UserProps) =>\n  readUserOrFail(props).pipe(Effect.catchTag('UserNotFound', () => Effect.succeed(undefined)));\n\n/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */\nexport const dropUnreadable = (live: UserAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n",
     "/**\n * `Proxmox.Vm` — a QEMU virtual machine, declared. Exported (not just Provider-only) since\n * 2026-09-26 for Talos: see qemu-props.ts for what a declaration may say and why `cipassword`\n * and `machine` may never be one of them.\n *\n * ⚠️ CREATE is `POST /nodes/{node}/qemu`. GET and PUT stay on `.../qemu/{vmid}/config`.\n *   ⛔ DELETE is `DELETE /nodes/{node}/qemu/{vmid}` (`destroy_vm` in qemu-server Qemu.pm). The\n *   config route is not a destroy. A missing config file is `QemuConfigNotFound` only.\n *\n * ⛔ `vmid` IS CLUSTER-WIDE AND SHARED WITH CONTAINERS. A VM and an LXC cannot hold the same id, so\n *   these two resources compete for one number space. Declaring both with vmid 101 is not a\n *   collision Alchemy can see -- they are different resource types -- and PVE refuses the second\n *   with \"already exists\". Pick ids per cluster, not per kind.\n *\n * ⛔ THIS RESOURCE NEVER MIGRATES. `qemu-read.ts` refuses the plan outright when the declared vmid\n *   is found running on a DIFFERENT node than the one declared (\"A migration is not an update\") --\n *   unchanged by the 2026-09-26 export, and exactly what keeps a node-pinned Talos VM pinned.\n *\n * ⚠️ POWER STATE IS NEITHER DECLARED NOR REPORTED. There is no `running` prop and `VmAttributes`\n *   carries no `status` field (qemu-props.ts) — starting and stopping a VM from a plan would make a\n *   deploy a maintenance window, and the estate has one of those already.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { qemuHandlers } from './qemu-lifecycle.ts';\nimport type { PveRequirements } from './resource.ts';\nimport type { VmAttributes, VmProps } from './qemu-props.ts';\n\nexport type { VmAttributes, VmProps } from './qemu-props.ts';\n\nexport interface ProxmoxVm extends Resource<\n  'Proxmox.Vm',\n  VmProps,\n  VmAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a VM's disks cannot be rebuilt from a line. See resource.ts / lxc.ts. */\nexport const ProxmoxVm = Resource<ProxmoxVm>('Proxmox.Vm', { defaultRemovalPolicy: 'retain' });\n\nexport { createForm } from './qemu-form.ts';\n\n/**\n * ⛔ Destroy uses deleteNodeQemu (`DELETE /nodes/{node}/qemu/{vmid}`), not the config path.\n *   The old factory sent both reads and deletes to `.../config`.\n */\nexport const ProxmoxVmProvider = () =>\n  Provider.effect(ProxmoxVm, Effect.succeed(ProxmoxVm.Provider.of(qemuHandlers)));\n",
     "/**\n * QEMU lifecycle on named operations.\n * ⛔ GET and PUT use `/nodes/{node}/qemu/{vmid}/config`. DELETE uses `/nodes/{node}/qemu/{vmid}`.\n *   qemu-server Qemu.pm names that second route `destroy_vm`. Sending DELETE to the config\n *   route does not destroy the guest.\n *\n * ⛔ WRITES GO THROUGH `qemu-judge.ts`, NOT A WHOLE-FORM PUT (2026-09-26, red-team C1/C2/I1 on\n *   PR 297). `judge` decides per key, on the live volume id and live MAC (qemu-volume.ts,\n *   qemu-net.ts); only drifted keys are sent. `ownedRead`/`refuseTakeover` (C2) refuse to adopt or\n *   write a live VM this stack holds no state for, unless `--adopt` / `adopt(true)` says so —\n *   ownership.md's rule, ported here the way openbao/policy.ts already does it. `identityRefusal`\n *   (I1) refuses a changed vmid rather than building a second VM.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport { refuseTakeover } from '../ownership/adopt.ts';\nimport { ownedRead } from '../ownership/probe.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { createForm, formRefusals, updateForm } from './qemu-form.ts';\nimport { QemuRefusedError } from './qemu-errors.ts';\nimport { identityRefusal, judge } from './qemu-judge.ts';\nimport {\n  type VmAttributes,\n  type VmProps,\n  declaredKeys,\n  declaredValue,\n  isManagedKey,\n  storedConfig,\n  wireValue,\n} from './qemu-props.ts';\nimport { readVm } from './qemu-read.ts';\nimport { qemuTask } from './qemu-task.ts';\nimport type { PveSpec } from './resource-spec.ts';\nimport { specGuards } from './resource-guard.ts';\n\nconst CREATE_POLLS = 180;\nconst DELETE_POLLS = 60;\n\nconst attributesOf = (live: Record<string, unknown>, props: VmProps): VmAttributes => ({\n  config: storedConfig(live),\n  node: props.node,\n  vmid: props.vmid,\n});\n\n/**\n * ⚠️ KEPT ONLY TO SATISFY `PveSpec`'S REQUIRED FIELD — `qemu-judge.ts`'s `judge` is what diff and\n *   reconcile actually decide by, since a plain string compare is exactly the bug C1 found (it\n *   never matches the \"new disk\" or MAC-less spellings a declaration may use).\n */\nconst matches = (attributes: VmAttributes, props: VmProps) =>\n  declaredKeys(props)\n    .filter(isManagedKey)\n    .every((key) => attributes.config[key] === wireValue(declaredValue(props, key)));\n\nconst spec = {\n  attributes: attributesOf,\n  collection: (props: VmProps) => `nodes/${props.node}/qemu`,\n  createForm,\n  endpoint: {\n    create: 'pve:POST /nodes/{node}/qemu',\n    update: 'pve:PUT /nodes/{node}/qemu/{vmid}/config',\n  },\n  matches,\n  path: (props: VmProps) => `nodes/${props.node}/qemu/${String(props.vmid)}/config`,\n  updateForm,\n} satisfies PveSpec<VmProps, VmAttributes>;\n\nconst { guardCreate, guardUpdate } = specGuards(spec);\n\nexport const readQemu = (props: VmProps) =>\n  readVm(props).pipe(\n    Effect.map((live) =>\n      live === undefined\n        ? undefined\n        : // ⚠️ WIDENED ON PURPOSE. `GetNodeQemuConfigResponse` types only the keys pve-manager's\n          //   apidoc names as SCALARS; it cannot express `scsi[n]`/`net[n]`/`ipconfig[n]` at all\n          //   (qemu-props.ts's header), so it carries no index signature. `storedConfig` reads\n          //   those keys anyway, because the ACTUAL wire response has them (protocol-http.ts's\n          //   `mapKeys` passes an unrecognised key through undecoded, both directions) — this\n          //   cast only tells TypeScript what runtime already knows.\n          attributesOf(live as unknown as Record<string, unknown>, props),\n    ),\n  );\n\n/** No purge, no skiplock, no destroy-unreferenced-disks. A missing config is already gone. */\nexport const deleteQemu = (props: VmProps) =>\n  qemuTask(\n    props,\n    nodes.deleteNodeQemu({ node: props.node, vmid: String(props.vmid) }),\n    `destroy VM ${String(props.vmid)}`,\n    DELETE_POLLS,\n  ).pipe(Effect.catchTag('QemuConfigNotFound', () => Effect.void));\n\n/**\n * ★ ONE PLACE, RUN BEFORE EVERY DIFF AND EVERY RECONCILE. A key smuggled past `VmProps`'s types\n *   (a cast, a JS caller: `cipassword`, `machine`, `hookscript`) is refused here rather than\n *   silently dropped from the form or silently sent — the same rule `lxc-create-form.ts` enforces\n *   for `Proxmox.Lxc`, and the check `qemu-props.ts`'s `cipassword?: never`/`machine?: never`\n *   cannot make by itself once a caller casts around the type.\n */\nconst refuseUnmanaged = (props: VmProps) => {\n  const refused = formRefusals(props);\n  return refused.length === 0 ? Effect.void : Effect.fail(new QemuRefusedError(refused.join('\\n')));\n};\n\nconst refuseChange = (change: { readonly refuse: readonly string[] }) =>\n  change.refuse.length === 0\n    ? Effect.void\n    : Effect.fail(new QemuRefusedError(change.refuse.join('\\n')));\n\nexport const qemuHandlers = {\n  list: () => Effect.succeed([]),\n  /**\n   * ⛔ `Unowned` UNLESS STATE ALREADY VOUCHES FOR IT (C2). With no attributes this is Alchemy's\n   *   adoption probe or the recovery read for an interrupted create (ownership/probe.ts); `settled`\n   *   is the same `judge` reconcile uses, so \"proven ours\" and \"reconcile would write nothing\" are\n   *   the same question asked once.\n   */\n  read: Effect.fn(function* ({\n    fqn,\n    instanceId,\n    olds,\n    output,\n  }: {\n    fqn: string;\n    instanceId: string;\n    olds: VmProps;\n    output: VmAttributes | undefined;\n  }) {\n    const found = yield* readQemu(olds);\n    const settled = Effect.sync(\n      () => found !== undefined && judge(olds, found.config).drift.length === 0,\n    );\n    return yield* ownedRead({ fqn, instanceId, output }, found, settled);\n  }),\n  diff: Effect.fn(function* ({\n    news,\n    olds,\n    output,\n  }: {\n    news: Input<VmProps>;\n    olds: VmProps;\n    output: VmAttributes | undefined;\n  }) {\n    if (!isResolved(news)) return undefined;\n    const identity = identityRefusal(news.vmid, output?.vmid ?? olds.vmid);\n    if (identity !== undefined) return yield* Effect.fail(new QemuRefusedError(identity));\n    yield* refuseUnmanaged(news);\n    yield* guardCreate(news, output === undefined);\n    yield* guardUpdate(news);\n    if (output === undefined) return undefined;\n    const live = yield* readQemu(news);\n    if (live === undefined) {\n      // ⚠️ `update`, not `create`: state exists and the VM does not. reconcile rebuilds it from the\n      //   declaration -- said here too, so an operator reading the plan sees it before the deploy.\n      yield* Effect.logWarning(\n        `Proxmox.Vm ${news.node}/${String(news.vmid)}: the cluster lists no VM with this vmid -- ` +\n          'a deploy CREATES it again, with new, empty volumes.',\n      );\n      yield* guardCreate(news, true);\n      return { action: 'update' } as const;\n    }\n    const change = judge(news, live.config);\n    yield* refuseChange(change);\n    return { action: change.drift.length === 0 ? 'noop' : 'update' } as const;\n  }),\n  reconcile: Effect.fn(function* ({\n    fqn,\n    instanceId,\n    news,\n    olds,\n    output,\n  }: {\n    fqn: string;\n    instanceId: string;\n    news: VmProps;\n    olds: VmProps | undefined;\n    output: VmAttributes | undefined;\n  }) {\n    const identity = identityRefusal(news.vmid, output?.vmid ?? olds?.vmid);\n    if (identity !== undefined) return yield* Effect.fail(new QemuRefusedError(identity));\n    yield* refuseUnmanaged(news);\n    const live = yield* readQemu(news);\n    yield* guardCreate(news, live === undefined);\n    yield* guardUpdate(news);\n    if (live === undefined) {\n      yield* qemuTask(\n        news,\n        nodes.createNodeQemu({ ...createForm(news), node: news.node }),\n        `create VM ${String(news.vmid)}`,\n        CREATE_POLLS,\n      );\n    } else {\n      // ⛔ C2: a live VM this stack holds no state for is refused unless adoption is on — dies\n      //   (never returns) for a fresh create/replace generation; a no-op otherwise (adopt.ts).\n      yield* refuseTakeover(\n        { fqn, instanceId, output },\n        `Proxmox.Vm VM ${String(news.vmid)} on ${news.node}`,\n      );\n      const change = judge(news, live.config);\n      yield* refuseChange(change);\n      if (Object.keys(change.put).length > 0) {\n        yield* runPve(\n          news.target,\n          'provision',\n          true,\n          nodes.putNodeQemuConfig({ ...change.put, node: news.node, vmid: String(news.vmid) }),\n        );\n      }\n    }\n    const after = yield* readQemu(news);\n    if (after === undefined) {\n      return yield* Effect.fail(\n        new QemuRefusedError(\n          `${spec.path(news)}: write returned success but the VM is still absent`,\n        ),\n      );\n    }\n    const left = judge(news, after.config);\n    if (left.drift.length > 0) {\n      return yield* Effect.fail(\n        new QemuRefusedError(\n          `${spec.path(news)}: after the write, ${left.drift.join(', ')} still differ from the ` +\n            'declaration. PVE may have normalised the value -- declare what it stores.',\n        ),\n      );\n    }\n    return after;\n  }),\n  delete: ({ olds }: { olds: VmProps }) => deleteQemu(olds),\n};\n",
@@ -172,15 +174,15 @@
     "/**\n * How a subnet crosses the wire in both directions, and what PVE actually calls its path.\n *\n * ★ SPLIT OUT OF sdn-subnet.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, on the seam\n *   node-network-form.ts cuts rather than at a convenient line number: this file owns the\n *   COERCIONS in BOTH directions plus the derived id, because a read that normalises differently\n *   from the write that produced it is exactly how a forever-diff is born. sdn-subnet.ts answers\n *   \"what is a subnet, and when has it changed\". Nothing here calls the cluster.\n *\n * ⚠️ THE `import type` BACK TO sdn-subnet.ts IS A CYCLE ON PAPER ONLY — type-only, so it is erased\n *   before anything runs and `SdnSubnetProps` stays in the file that declares the resource.\n */\nimport type { SdnSubnetProps } from './sdn-subnet.ts';\nimport { propertyString, withClears } from './values.ts';\n\n/** One DHCP pool. PVE's property-string keys are `start-address`/`end-address`; see `rangeString`. */\nexport type DhcpRange = { start: string; end: string };\n\n/**\n * The id PVE files a subnet under — and therefore the path segment GET, PUT and DELETE address it\n * by, which is NOT the value POST is handed.\n *\n * ⛔ MEASURED from `/usr/share/perl5/PVE/API2/Network/SDN/Subnets.pm` on pve-manager 9.2.11, in\n *   the create handler: `my $id = $cidr =~ s/\\//-/r; $id = \"$zoneid-$id\";`. So `subnet=10.0.0.0/24`\n *   goes out and `lab-10.0.0.0-24` is what exists afterwards. A CIDR cannot be a path segment\n *   anyway — it carries a slash — so there is no spelling of this endpoint that takes the CIDR.\n *\n * ⚠️ `.replace`, NOT `.replaceAll`, AND THE PARITY IS DELIBERATE. Perl's `s/\\//-/r` has no `/g`, so\n *   it rewrites the FIRST slash only. A CIDR has exactly one, so the two agree on every legal\n *   input; they would stop agreeing on an illegal one, and agreeing with PVE is the point.\n */\nexport const subnetId = (props: Pick<SdnSubnetProps, 'cidr' | 'zone'>) =>\n  `${props.zone}-${props.cidr.replace('/', '-')}`;\n\n/** A range on its way OUT. PVE stores the string verbatim; nothing rewrites it. */\nconst rangeString = (range: DhcpRange) => `start-address=${range.start},end-address=${range.end}`;\n\n/**\n * DHCP ranges, from either shape, as one comparable string.\n *\n * ⛔ THIS FAMILY'S WRITE SHAPE AND READ SHAPE ARE DIFFERENT, WHICH IS THE CLASSIC FOREVER-DIFF.\n *   MEASURED from the API module: `$scfg->{'dhcp-range'} = get_dhcp_ranges($scfg)` runs\n *   `parse_property_string` over every stored element, so a range WRITTEN as the string\n *   `start-address=10.0.0.10,end-address=10.0.0.20` is READ BACK as the object\n *   `{\"start-address\":\"10.0.0.10\",\"end-address\":\"10.0.0.20\"}`. `propertyString` in values.ts\n *   flattens both shapes to one sorted form and exists for exactly this — see its own ⚠️.\n *\n * ⚠️ AND IT IS A LIST, SO ORDER MUST NOT BE MEANING. PVE validates only that ranges do not overlap\n *   and stores them in the order given; two declarations naming the same pools the other way round\n *   are the same subnet. Sorting is what stops that being an update, exactly as `csv` does for a\n *   zone's `nodes`.\n *\n * ⚠️ `;` IS THE JOINER BECAUSE `,` AND `=` ARE BOTH INSIDE THE VALUES. It never appears in an IPv4\n *   or IPv6 address or in a property-string key, so the joined form cannot be ambiguous.\n */\nexport const dhcpRanges = (value: unknown): string =>\n  (Array.isArray(value) ? value : [])\n    .map((entry: unknown) => propertyString(entry))\n    .filter((entry) => entry !== '')\n    .sort()\n    .join(';');\n\n/** The declared side of that same comparison, through the same funnel so it cannot drift. */\nexport const declaredRanges = (range: DhcpRange | undefined) =>\n  range === undefined ? '' : dhcpRanges([rangeString(range)]);\n\n/**\n * ⚠️ AN EMPTY STRING IS HOW A CALLER SPELLS \"UNSET\", AND IT MUST NOT REACH PVE. `gateway` and\n *   `dhcp-dns-server` are `format => 'ip'` and `dnszoneprefix` is `format => 'dns-name'`, so `''`\n *   is a parameter-verification 400 rather than a clear. Clearing is a separate verb — `delete=`.\n */\nconst unset = (value: string | undefined) =>\n  value === undefined || value === '' ? undefined : value;\n\n/**\n * Every optional this resource MANAGES: the value to send, or `undefined` meaning \"clear it\".\n *\n * ⛔ ONE TABLE FEEDS BOTH HALVES OF AN UPDATE, the way metric-server-form.ts does it, and for the\n *   same measured reason: A PUT THAT OMITS A FIELD DOES NOT CLEAR IT. PVE merges the form into the\n *   existing section (`$data->{$_} = $opts->{$_} for keys $opts->%*`), so dropping `gateway` from a\n *   declaration leaves the old gateway in place and `matches` asks for the same update forever.\n *   Deriving the form and the `delete=` list from one map makes \"managed but not clearable\"\n *   impossible to write here.\n *\n * ⛔ AND THE TWO HALVES MUST NOT OVERLAP. MEASURED in `PVE::SectionConfig::delete_from_config`\n *   (SectionConfig.pm:1853): naming a key in BOTH the form and `delete=` dies with \"cannot set and\n *   delete property '<k>' at the same time!\". Because both halves are read off this one map, an\n *   entry is in exactly one of them by construction.\n *\n * ⛔ NOTHING SET OUT OF BAND MAY BE LISTED HERE. A field in this map is CLEARED the moment it is\n *   undeclared, so a live subnet whose DHCP pool an operator widened in the UI is narrowed back on\n *   the next deploy. That is full ownership, the same bargain sdn-vnet.ts strikes over `alias`, and\n *   it is a bargain rather than an accident only while this list stays deliberate.\n *\n * ⚠️ `snat` IS ABSENT ON PURPOSE AND LIVES IN `body` INSTEAD. It is a boolean, and `0` and \"never\n *   declared\" are the same subnet to PVE and to `matches`, so sending an explicit `0` converges\n *   without a `delete=` — the same choice sdn-vnet.ts makes for `vlanaware` and `isolate-ports`.\n */\nexport const optional = (props: SdnSubnetProps): Record<string, string | undefined> => ({\n  'dhcp-dns-server': unset(props.dhcpDnsServer),\n  'dhcp-range': props.dhcpRange === undefined ? undefined : rangeString(props.dhcpRange),\n  dnszoneprefix: unset(props.dnszoneprefix),\n  gateway: unset(props.gateway),\n});\n\n/**\n * The fields sent on EVERY write, create and update alike.\n *\n * ⚠️ `vnet` IS SENT THOUGH THE URL ALREADY CARRIES IT. PVE's handler reads `$param->{vnet}` to\n *   resolve the zone for its permission check, and it is a declared parameter of both the create\n *   and the update schema, so sending the same value the path carries is accepted and removes this\n *   file's dependence on the router injecting a path placeholder into the parameter hash.\n */\nexport const body = (props: SdnSubnetProps): Record<string, string> => ({\n  snat: props.snat === true ? '1' : '0',\n  vnet: props.vnet,\n  ...Object.fromEntries(\n    Object.entries(optional(props)).filter(\n      (entry): entry is [string, string] => entry[1] !== undefined,\n    ),\n  ),\n});\n\n/**\n * ⚠️ `type` IS HARDCODED, NOT A PROP. PVE's create schema declares it as an enum with exactly one\n *   member, `subnet`, so a prop for it could only ever hold one value — and the POST refuses to\n *   proceed without it, which is the parameter-verification error sdn-vnet.ts records.\n */\nexport const createForm = (props: SdnSubnetProps): Record<string, string> => ({\n  ...body(props),\n  subnet: props.cidr,\n  type: 'subnet',\n});\n\n/**\n * ★ CLEARING AN OPTION THAT WAS NEVER SET IS A SILENT NO-OP, AND THIS IS MEASURED RATHER THAN\n *   HOPED FOR. sdn-vnet.ts flags the same `delete=` habit as REASONED-not-measured and warns that a\n *   first update on a bare object would carry `delete=alias,tag`. Read off the code both endpoints\n *   share — `PVE::SectionConfig::delete_from_config`, SectionConfig.pm:1853-1866 — the loop dies\n *   only for an option that is unknown to the plugin, not optional, fixed, or also being set; for\n *   an option simply absent from the section it runs `delete $config->{$k}` on a missing key and\n *   moves on. All four keys above are `optional => 1` in `SubnetPlugin::options`, so a bare\n *   subnet's first update carries `delete=dhcp-dns-server,dhcp-range,dnszoneprefix,gateway` and\n *   PVE accepts it. `vnet` is `optional => 0` there and is never in this list.\n *\n * ⚠️ TWO OF THOSE FOUR NAMES ARE HYPHENATED, WHICH NO OTHER FAMILY HERE HAS PUT IN A `delete=`.\n *   The parameter's format is `pve-configid-list`, and a name that failed it would 400 the whole\n *   update rather than skip one field. MEASURED: `$CONFIGID_RE` is `qr/[a-z][a-z0-9_-]+/i`\n *   (JSONSchema.pm:30), so a hyphen after the first character is legal and all four pass.\n */\nexport const updateForm = (props: SdnSubnetProps): Record<string, string> => {\n  const clear = Object.entries(optional(props))\n    .filter(([, value]) => value === undefined)\n    .map(([key]) => key);\n  return withClears(body(props), clear);\n};\n",
     "/**\n * `Proxmox.SdnVnet` — the bridge a guest actually attaches to.\n *\n * ★ THIS IS THE OBJECT THAT CLOSES THE GAP BETWEEN A DECLARED CONTAINER AND A DECLARED NETWORK.\n *   `Proxmox.Lxc` takes `net0: name=eth0,bridge=vmbr0,ip=dhcp`, in which the bridge is a string\n *   nothing checks. A vnet's id IS the bridge PVE builds on every node of its zone, so declaring\n *   the vnet and passing its `bridge` attribute into `net0` turns that string into a reference\n *   Alchemy can order and a plan can show.\n *\n * ⚠️ MEASURED: CREATING A VNET CHECKS PERMISSION AT `/sdn/zones/-`, NOT AT THE VNET. The ACL path\n *   is the ZONE's, so a vnet whose zone does not exist yet fails as a PERMISSION error rather than\n *   as \"no such zone\" — and you go off widening a role that was never the problem. `zone` is\n *   therefore a hard dependency edge, not a convention: pass the zone resource's own attribute so\n *   Alchemy creates the zone first. A zone name typed in as a literal buys no ordering at all.\n *\n * ⛔ THE READ-BACK AFTER A WRITE PROVES THE STAGING FILE AND NOTHING MORE — the same trap as\n *   `sdn-zone`, and it walks straight through the factory's guard. PVE's SDN endpoints write\n *   `/etc/pve/sdn/vnets.cfg`; nothing reaches a node's `/etc/network/interfaces` until\n *   `PUT /cluster/sdn` applies the staged config. `pveOperations.reconcile` reads back and refuses\n *   when an object is absent, and a vnet that exists only on paper SATISFIES that read: reconcile\n *   reports success, the next plan says noop, and no bridge exists anywhere on the cluster.\n *   This resource does NOT issue the apply, deliberately. One vnet's reconcile cannot decide to\n *   commit every other pending SDN change in the cluster, including ones a human staged in the UI\n *   and has not finished. Apply stays an operator's act — `pvesh set /cluster/sdn`.\n *\n * ★ SUBNETS ARE A SIBLING RESOURCE, NOT A FIELD HERE. The gateway and the DHCP ranges guests take\n *   addresses from hang off `cluster/sdn/vnets/{vnet}/subnets`, which MEASURED refuses a POST that\n *   omits `type` or `subnet` (\"parameter verification failed\"). Same factory, one path deeper, and\n *   it depends on this resource the way this one depends on the zone.\n *\n * ⛔ read/diff NEED SDN.Allocate TOO, NOT SDN.Audit — corrected 2026-09-13 against the cluster's\n *   schema. `GET /cluster/sdn/vnets/{vnet}` is checked against SDN.Allocate exactly as the zone\n *   item endpoint is, while only the COLLECTION read accepts SDN.Audit. An auditor-shaped `read`\n *   lease is therefore refused, and `pveOperations.read` turns that refusal into \"absent\" rather\n *   than an error — see the ⛔ in sdn-zone.ts and docs/privileges.md.\n *\n * ⚠️ PRIVILEGES, AND THE ESTATE'S CREDENTIAL HELD NONE OF THEM UNTIL 2026-09-13. reconcile and\n *   delete mint `provision` and need SDN.Allocate on `/sdn/zones`, or on the one zone if scoped. The provision role granted\n *   only SDN.Use then, which is what a GUEST needs in order to attach to a vnet and NOT what\n *   creating one needs, so a container on a vnet worked while the vnet itself 403'd. It was widened\n *   the way Pool.Allocate was, and `PROVISION_PRIVILEGES` (provision-baseline.ts) now carries\n *   SDN.Allocate and SDN.Audit.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { bool, withClears } from './values.ts';\n\nexport interface SdnVnetProps extends WithTarget {\n  /**\n   * ⛔ THE PRIMARY KEY AND THE BRIDGE NAME AT ONCE. PVE caps it at eight alphanumeric characters\n   *   because it becomes a real interface on every node in the zone. There is no rename: a new id\n   *   is a new bridge, and every guest whose `net0` still names the old one stays on the old one.\n   */\n  vnet: string;\n  /**\n   * The SDN zone that owns it. Mutable — a vnet can be moved between zones — but see the ⚠️ at the\n   * top of this file: the zone has to exist first, and passing a zone resource's attribute instead\n   * of a literal is the only thing that makes Alchemy order them.\n   */\n  zone: string;\n  /** Free text shown in the UI. Mutable; clear it by dropping the prop, never by passing `''`. */\n  alias?: string;\n  /** VLAN id or VXLAN VNI, depending on the zone's type. Mutable. Absent means untagged. */\n  tag?: number;\n  /** Let guests on this bridge carry their own VLAN tags. Mutable. */\n  vlanaware?: boolean;\n  /**\n   * Stop guests on this bridge from reaching each other directly. Mutable.\n   * ⚠️ The wire name is `isolate-ports`, with a hyphen — see the ⚠️ on `shape` for why that costs\n   *   attention in two places rather than one.\n   */\n  isolatePorts?: boolean;\n}\n\nexport interface SdnVnetAttributes {\n  vnet: string;\n  /**\n   * The same string as `vnet`, duplicated on purpose: it is the name a guest's `net0` must carry.\n   * Referencing it from a `Proxmox.Lxc`'s props is what makes Alchemy build the network before the\n   * container. A hardcoded `vmbr1` in `net0` is a string nothing checks and nothing orders.\n   */\n  bridge: string;\n  zone: string;\n  alias: string;\n  /**\n   * Absent when the vnet is untagged — see `tagOf` for why this is optional and not `0`.\n   * ⚠️ `| undefined` IS LOAD-BEARING under exactOptionalPropertyTypes: the attributes\n   *   builder always sets this key, writing `undefined` for an untagged vnet, so the type\n   *   must permit a present-but-undefined value as well as an absent one. Without it the\n   *   read path does not typecheck, and 0 is a real VLAN id so it cannot be the sentinel.\n   */\n  tag?: number | undefined;\n  vlanaware: boolean;\n  isolatePorts: boolean;\n}\n\nexport interface ProxmoxSdnVnet extends Resource<\n  'Proxmox.SdnVnet',\n  SdnVnetProps,\n  SdnVnetAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxSdnVnet = Resource<ProxmoxSdnVnet>('Proxmox.SdnVnet');\n\n/**\n * ⚠️ AN ABSENT TAG IS `undefined`, NOT 0, which is why `SdnVnetAttributes.tag` is optional rather\n *   than falling back the way `memory` does in lxc.ts. VLAN id 0 and VXLAN VNI 0 are real values,\n *   so a 0 fallback would report an untagged vnet as tagged 0 and then diff forever against a\n *   declaration that asks for no tag at all.\n */\nconst tagOf = (value: unknown) => (typeof value === 'number' ? value : undefined);\n\n/**\n * The fields PVE accepts on create and on update alike.\n *\n * ⚠️ THE WIRE NAME IS `isolate-ports`, WITH A HYPHEN; the prop is `isolatePorts` so no call site\n *   has to quote it. Both halves of that mapping have to be right: the form key here AND the read\n *   in `attributes`. `live['isolatePorts']` would be `undefined` forever, which reads as \"the\n *   cluster does not have it set\" and makes every plan ask for the same update, for good.\n */\nconst shape = (props: SdnVnetProps): Record<string, string> => {\n  const alias = props.alias ?? '';\n  return {\n    // ⚠️ THE TWO BOOLEANS ARE ALWAYS SENT, `0` INCLUDED, AND THAT IS NOT AN OVERSIGHT. `0` and\n    //   \"never declared\" mean the same thing to PVE and to `matches` below, so an explicit `0`\n    //   makes the two converge — which is why neither ever appears in the `delete` list.\n    'isolate-ports': props.isolatePorts === true ? '1' : '0',\n    vlanaware: props.vlanaware === true ? '1' : '0',\n    zone: props.zone,\n    // ⚠️ AN EMPTY ALIAS IS OMITTED, NOT SENT AS `''`. `''` is how this file spells \"unset\", and\n    //   unset goes through the `delete` parameter below; sending it as a value would ask PVE to\n    //   store an empty description, which is a different request from having none.\n    ...(alias === '' ? {} : { alias }),\n    ...(props.tag === undefined ? {} : { tag: String(props.tag) }),\n  };\n};\n\n/**\n * ⛔ OMITTING A FIELD DOES NOT CLEAR IT. PVE keeps whatever the config already holds, so a\n *   declaration that DROPS its alias would diff as `update` forever: `matches` compares `''`\n *   against the live text, the PUT says nothing about alias, and the next plan asks for the very\n *   same update. PVE's own answer is the `delete` parameter — a comma-separated list of properties\n *   to unset — which exists on the update endpoint only. That is why create does not come through\n *   here and calls `shape` directly.\n *\n * ⚠️ REASONED FROM PVE'S UPDATE SCHEMA, NOT MEASURED ON A CLUSTER — unlike the two MEASURED facts\n *   at the top of this file, and the difference is worth a reader's attention. `delete` is what\n *   `SectionConfig::updateSchema` adds to every PVE update endpoint, and unsetting a property that\n *   was never set is a no-op there. If THIS endpoint turns out to disagree, the blast radius is\n *   wider than the feature: a plain `{ vnet, zone }` vnet has neither alias nor tag, so its very\n *   first update carries `delete=alias,tag` and every update fails, not just an unset. The symptom\n *   is a 400 \"parameter verification failed\" naming `delete`; the fix is to drop this list and\n *   accept the forever-update on unset instead. Verify it once against a live vnet.\n */\nconst updateForm = (props: SdnVnetProps): Record<string, string> => {\n  const unset = [\n    ...((props.alias ?? '') === '' ? ['alias'] : []),\n    ...(props.tag === undefined ? ['tag'] : []),\n  ];\n  return withClears(shape(props), unset);\n};\n\nconst handlers = pveHandlers<SdnVnetProps, SdnVnetAttributes>({\n  // ⛔ PVE gates this family's ITEM read on the allocate privilege, not the audit one — see\n  //   `readRole` in resource.ts. The auditor-shaped lease reads 403, which `read` turns into\n  //   \"absent\", and the plan then says create for an object that is plainly there.\n  readRole: 'provision',\n  attributes: (live, props) => ({\n    alias: typeof live['alias'] === 'string' ? live['alias'] : '',\n    bridge: props.vnet,\n    isolatePorts: bool(live['isolate-ports']),\n    tag: tagOf(live['tag']),\n    vlanaware: bool(live['vlanaware']),\n    vnet: props.vnet,\n    /**\n     * ⚠️ `''` RATHER THAN `props.zone` WHEN PVE DOES NOT SAY. Echoing the declared zone back would\n     *   make an unreadable zone look like agreement; `''` matches no declared zone, so the plan\n     *   reports drift instead. A vnet in the wrong zone is attached to the wrong network, and this\n     *   is the one field here where a spurious update costs less than a missed one.\n     */\n    zone: typeof live['zone'] === 'string' ? live['zone'] : '',\n  }),\n  collection: () => 'cluster/sdn/vnets',\n  createForm: (props) => ({ ...shape(props), vnet: props.vnet }),\n  /**\n   * ⚠️ `vnet`, `bridge` AND WHETHER THE CONFIG IS APPLIED ARE ABSENT FROM THIS COMPARISON ON\n   *   PURPOSE. The first two are the path — a changed id is a different object, not an edit — and\n   *   staged-vs-running is a fact about the cluster rather than about the declaration. Diffing it\n   *   would report an update on every plan until somebody ran the apply, and then report another\n   *   one the moment anybody else staged anything at all.\n   */\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: { create: 'pve:POST /cluster/sdn/vnets', update: 'pve:PUT /cluster/sdn/vnets/{vnet}' },\n  matches: (attributes, props) =>\n    attributes.zone === props.zone &&\n    attributes.alias === (props.alias ?? '') &&\n    attributes.tag === props.tag &&\n    attributes.vlanaware === (props.vlanaware === true) &&\n    attributes.isolatePorts === (props.isolatePorts === true),\n  /**\n   * ⚠️ NO QUERY STRING HERE, HOWEVER TEMPTING. `?pending=1` would surface whether the staged\n   *   config has been applied, but the factory uses this one path for GET, PUT and DELETE alike,\n   *   and PVE answers an unexpected parameter on a write with \"parameter verification failed\".\n   *   That is why staged-ness is documented at the top of this file rather than made an attribute.\n   */\n  path: (props) => `cluster/sdn/vnets/${props.vnet}`,\n  updateForm,\n});\n\n/**\n* ⛔ EMPTY, LIKE EVERY OTHER RESOURCE IN THIS PACKAGE. `GET /cluster/sdn/vnets` answers\n*   with every vnet on the cluster, and on an estate already running SDN those are\n*   load-bearing bridges with guests on them. Returning them would invite Alchemy to\n*   adopt — and therefore one day delete — a network nobody declared here. Adoption is an\n*   explicit act.\n \n *\n* ⛔ A DELETE IS STAGED LIKE EVERY OTHER SDN WRITE. The vnet leaves `vnets.cfg` at once and\n*   the bridge stays up on every node until `PUT /cluster/sdn` applies the removal, so a\n*   plan reporting \"1 deleted\" has taken nothing off the network yet. Nothing here applies\n*   on the operator's behalf: see the ⛔ at the top of this file.\n \n */\nexport const ProxmoxSdnVnetProvider = () =>\n  Provider.effect(ProxmoxSdnVnet, Effect.succeed(ProxmoxSdnVnet.Provider.of(handlers)));\n",
     "/**\n * `Proxmox.SdnZone` — the network a declared guest sits on, finally declared too.\n *\n * ★ WHY THIS ONE MATTERS MORE THAN IT LOOKS. Every guest NIC here names a bridge —\n *   `net0=name=eth0,bridge=vmbr0` — that nothing in this package declares: a hand-built interface,\n *   repeated per node, that a container silently depends on. A zone is the first piece of that\n *   dependency PVE will let a plan own.\n *\n * ⛔ SDN WRITES ARE STAGED, NOT APPLIED, AND THAT DEFEATS THE FACTORY'S READ-BACK GUARANTEE.\n *   POST and PUT under `cluster/sdn/zones` edit `/etc/pve/sdn/zones.cfg` and change NOTHING on any\n *   node. The plain GET reads that same staged file back, so `pveOperations` sees its own write,\n *   finds the object present, and reports a success in which no node gained an interface. The\n *   applied state is a different document — `.running-config` beside it — and `?pending=1` is the\n *   read that tells them apart: it returns a merged view with a `state` of new/changed/deleted.\n *\n * ⛔ THE APPLY CANNOT LIVE IN THIS RECONCILE, so it is absent rather than forgotten.\n *   `PUT /cluster/sdn` is the atomic pending-to-apply and it applies the WHOLE staged config —\n *   every zone, vnet and subnet, on every node. Called from a per-resource reconcile it would push\n *   some OTHER resource's half-written zone out to the cluster at whatever point the plan ordering\n *   reached this one, and PVE has no pre-apply hook to veto that. The apply belongs to ONE object\n *   that depends on all of them — a sibling `Proxmox.SdnApply` over `cluster/sdn`, or a stack-level\n *   hook that runs last — so that \"declared\" and \"live on the nodes\" stay two visible steps.\n *\n * ⚠️ SO THESE ATTRIBUTES DESCRIBE THE STAGED ZONE, and there is deliberately no `applied` flag:\n *   the factory uses ONE path for GET, PUT and DELETE, and PVE's parameter schemas are closed, so\n *   an unexpected `pending` on the PUT is a 400 rather than an ignored hint. Reading `?pending=1`\n *   means re-implementing the operations this file exists to share, and an `applied: true` that\n *   was never measured is worse than an absent one. Deploying this resource does not change the\n *   network; it changes what the next apply will do.\n *\n * ⛔ THE READ THIS RESOURCE PERFORMS NEEDS SDN.Allocate, NOT SDN.Audit, AND AN EARLIER DRAFT OF\n *   THIS COMMENT SAID OTHERWISE. Read off the cluster's own schema on 2026-09-13:\n *\n *     GET /cluster/sdn/zones          -> \"list entries where you have SDN.Audit or SDN.Allocate\"\n *     GET /cluster/sdn/zones/{zone}   -> {\"check\": [\"perm\", \"/sdn/zones/{zone}\", [\"SDN.Allocate\"]]}\n *\n *   `pveOperations.read` calls the ITEM endpoint, so an auditor-shaped `read` lease is REFUSED —\n *   and the refusal does not surface as a 403. `read` folds every failure into `undefined`, which\n *   the factory reads as \"absent\", so the plan says create, the POST goes out, and PVE answers\n *   that the zone already exists. This is the same class as Proxmox.Storage; see\n *   docs/privileges.md, \"The failure that does not look like a permission problem\".\n *\n * ⚠️ THE REST OF THE PRIVILEGES. Writes need SDN.Allocate (`/sdn/zones` to create,\n *   `/sdn/zones/{zone}` to update or delete); the apply — `Proxmox.SdnApply`, which is what\n *   actually publishes any of this — needs SDN.Allocate on `/sdn` itself. SDN.Use is NOT among\n *   them: it permits attaching a guest to an existing vnet and nothing else.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { csv, int, text, withClears } from './values.ts';\n\n/** PVE's zone plugins. Which one a zone is decides which fields below it will even accept. */\nexport type SdnZoneType = 'evpn' | 'qinq' | 'simple' | 'vlan' | 'vxlan';\n\nexport interface SdnZoneProps extends WithTarget {\n  /**\n   * PVE's primary key. ⚠️ AT MOST EIGHT LOWERCASE ALPHANUMERICS, first one a letter: the id lands\n   *   in generated interface names, so PVE enforces it with a regex whose rejection reads as\n   *   \"value does not match the regex pattern\" rather than as \"your name is too long\".\n   */\n  zone: string;\n  /**\n   * ⛔ CREATE-TIME ONLY. `PUT /cluster/sdn/zones/{zone}` has no `type` parameter at all — a\n   *   section's type is fixed when it is written. Changing it here is not an update PVE can\n   *   perform; the ⛔ in `attributes` turns that edit into a refusal instead of a silent no-op.\n   */\n  type: SdnZoneType;\n  /** Accepted by every zone type. Unset means the zone inherits the underlying bridge's MTU. */\n  mtu?: number;\n  /** ⚠️ WHICH NODES THE ZONE IS DEPLOYED TO. Unset means EVERY node, not none. */\n  nodes?: string[];\n  /** IPAM plugin id. Unset is the built-in `pve` one — the two are one zone, see `sameIpam`. */\n  ipam?: string;\n  /** DNS plugin id used to register guest records. */\n  dns?: string;\n  /** The domain those records are registered under, e.g. `example.internal`. */\n  dnszone?: string;\n  /** vxlan only, and REQUIRED there: the peer addresses the tunnel mesh is built from. */\n  peers?: string[];\n  /** evpn only, and required there. PVE's own hyphenated name, so no mapping to get wrong. */\n  'vrf-vxlan'?: number;\n  /** qinq only, and required there: the service VLAN tag the zone's vnets are stacked inside. */\n  tag?: number;\n  /** vlan and qinq only, and required in both: the existing bridge the zone is carved out of. */\n  bridge?: string;\n}\n\n/**\n * ⛔ NO `digest` HERE, ON PURPOSE. PVE returns one, but it is the digest of the WHOLE zones.cfg\n *   file rather than of this section — declaring a SECOND zone would rewrite this one's stored\n *   attributes, and comparing it would report an update on a zone nobody touched.\n */\nexport interface SdnZoneAttributes {\n  zone: string;\n  type: SdnZoneType;\n  /** 0 when unset, which is PVE's \"inherit from the bridge\" rather than an MTU of zero. */\n  mtu: number;\n  /** Normalised: split, sorted, rejoined. Never compare a raw PVE string to it — see `csv`. */\n  nodes: string;\n  /** The EFFECTIVE ipam: an absent one is reported as `pve`, because that is what will be used. */\n  ipam: string;\n  dns: string;\n  dnszone: string;\n  peers: string;\n  'vrf-vxlan': number;\n  tag: number;\n  bridge: string;\n  /** ⚠️ THE REMINDER IN THE STATE ITSELF: staged config. No value here says a node has the zone. */\n  readonly staged: true;\n}\n\nexport interface ProxmoxSdnZone extends Resource<\n  'Proxmox.SdnZone',\n  SdnZoneProps,\n  SdnZoneAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxSdnZone = Resource<ProxmoxSdnZone>('Proxmox.SdnZone');\n\n/**\n * ⚠️ AN ABSENT `ipam` AND `ipam pve` ARE THE SAME ZONE. `pve` is the built-in default, and whether\n *   PVE materialises that word into zones.cfg on create is version-dependent — so comparing the\n *   raw values reports an update on the plan immediately AFTER the create, on a zone this provider\n *   just wrote itself. Normalising both sides is loop-proof under either behaviour.\n */\nconst sameIpam = (live: string, declared: string | undefined) =>\n  (live === '' ? 'pve' : live) === (declared === undefined || declared === '' ? 'pve' : declared);\n\n/**\n * The mutable fields, spread in only when defined.\n *\n * ⚠️ AN EMPTY STRING IS NOT \"UNSET\" FOR AN INTEGER FIELD. `mtu=` fails PVE's parameter check\n *   outright instead of clearing the value, so the pool.ts habit of sending `''` for an absent\n *   optional does not carry over here. Clearing is a separate verb — see `clearable`.\n */\nconst body = (props: SdnZoneProps): Record<string, string> => ({\n  ...(props.bridge === undefined ? {} : { bridge: props.bridge }),\n  ...(props.dns === undefined ? {} : { dns: props.dns }),\n  ...(props.dnszone === undefined ? {} : { dnszone: props.dnszone }),\n  ...(props.ipam === undefined ? {} : { ipam: props.ipam }),\n  ...(props.mtu === undefined ? {} : { mtu: String(props.mtu) }),\n  ...(props.nodes === undefined ? {} : { nodes: csv(props.nodes) }),\n  ...(props.peers === undefined ? {} : { peers: csv(props.peers) }),\n  ...(props.tag === undefined ? {} : { tag: String(props.tag) }),\n  ...(props['vrf-vxlan'] === undefined ? {} : { 'vrf-vxlan': String(props['vrf-vxlan']) }),\n});\n\n/**\n * Which managed fields PVE will let `delete=` clear, per zone type.\n *\n * ⛔ A PUT THAT SIMPLY OMITS A FIELD DOES NOT CLEAR IT. PVE merges the form into the existing\n *   section, so dropping `mtu` from a declaration leaves the old MTU in place and `matches`\n *   reports an update on every plan forever — the exact bug this table exists to prevent.\n * ⛔ AND THE LIST CANNOT BE THE SAME FOR EVERY TYPE. `delete=<opt>` dies with \"no such option\"\n *   when the option is not in that plugin's schema (`peers` on a simple zone) and with \"unable to\n *   delete required option\" when it is required there. `bridge`, `tag`, `peers` and `vrf-vxlan`\n *   are required by the only types that accept them, so none of the four is ever clearable: a\n *   zone that lost one is a replace, not an update.\n * ⚠️ `ipam` IS OMITTED FOR evpn DELIBERATELY. It is optional on the other four; on evpn its\n *   optionality has moved between releases, and a wrong entry here is a hard 400 on EVERY update\n *   rather than a cosmetic diff. Dropping `ipam` from an evpn declaration therefore reports an\n *   update that does not converge — visible, unlike a wrong delete that breaks the zone.\n */\nconst clearable: Record<SdnZoneType, readonly string[]> = {\n  evpn: ['dns', 'dnszone', 'mtu', 'nodes'],\n  qinq: ['dns', 'dnszone', 'ipam', 'mtu', 'nodes'],\n  simple: ['dns', 'dnszone', 'ipam', 'mtu', 'nodes'],\n  vlan: ['dns', 'dnszone', 'ipam', 'mtu', 'nodes'],\n  vxlan: ['dns', 'dnszone', 'ipam', 'mtu', 'nodes'],\n};\n\nconst handlers = pveHandlers<SdnZoneProps, SdnZoneAttributes>({\n  // ⛔ PVE gates this family's ITEM read on the allocate privilege, not the audit one — see\n  //   `readRole` in resource.ts. The auditor-shaped lease reads 403, which `read` turns into\n  //   \"absent\", and the plan then says create for an object that is plainly there.\n  readRole: 'provision',\n  attributes: (live, props) => {\n    /**\n     * ⛔ A ZONE OF ANOTHER TYPE IS ANOTHER OBJECT, AND \"ABSENT\" IS THE HONEST ANSWER. A PUT cannot\n     *   change `type`, and the factory only calls a change `replace` for a resource with no update\n     *   path — which this is not. Reporting the foreign zone as missing makes reconcile POST, and\n     *   PVE refuses with \"sdn zone ID 'x' already defined\": a loud, accurate error instead of a\n     *   silent noop over somebody else's zone. An older PVE that omits `type` falls through.\n     */\n    const liveType = text(live['type']);\n    if (liveType !== '' && liveType !== props.type) return undefined;\n    return {\n      bridge: text(live['bridge']),\n      dns: text(live['dns']),\n      dnszone: text(live['dnszone']),\n      ipam: text(live['ipam']) === '' ? 'pve' : text(live['ipam']),\n      mtu: int(live['mtu'], 0),\n      nodes: csv(text(live['nodes'])),\n      peers: csv(text(live['peers'])),\n      staged: true,\n      tag: int(live['tag'], 0),\n      type: props.type,\n      'vrf-vxlan': int(live['vrf-vxlan'], 0),\n      zone: props.zone,\n    };\n  },\n  collection: () => 'cluster/sdn/zones',\n  createForm: (props) => ({ ...body(props), type: props.type, zone: props.zone }),\n  /**\n   * ⚠️ `type` AND `zone` ARE NOT COMPARED. `zone` is the key the object was read by, and `type` is\n   *   handled above by refusing to recognise a zone of the wrong one. Comparing either here would\n   *   produce a diff whose update can never satisfy it.\n   */\n  /** The vendor rules these forms are checked against at plan time — resource-spec.ts. */\n  endpoint: { create: 'pve:POST /cluster/sdn/zones', update: 'pve:PUT /cluster/sdn/zones/{zone}' },\n  matches: (attributes, props) =>\n    attributes.mtu === (props.mtu ?? 0) &&\n    attributes.nodes === csv(props.nodes) &&\n    sameIpam(attributes.ipam, props.ipam) &&\n    attributes.dns === (props.dns ?? '') &&\n    attributes.dnszone === (props.dnszone ?? '') &&\n    attributes.peers === csv(props.peers) &&\n    attributes['vrf-vxlan'] === (props['vrf-vxlan'] ?? 0) &&\n    attributes.tag === (props.tag ?? 0) &&\n    attributes.bridge === (props.bridge ?? ''),\n  path: (props) => `cluster/sdn/zones/${props.zone}`,\n  updateForm: (props) => {\n    const fields = body(props);\n    const clear = clearable[props.type].filter((option) => fields[option] === undefined);\n    return withClears(fields, clear);\n  },\n});\n\n/**\n* ⛔ Empty for the same reason as every other resource here, and with extra force for SDN:\n*   `GET /cluster/sdn/zones` answers with the zones the cluster's whole network already\n*   runs on. Adopting those would make a later `alchemy destroy` a cluster-wide outage.\n \n *\n* ⛔ A DELETE IS STAGED TOO, AND THAT IS THE HALF PEOPLE FORGET. The section leaves\n*   zones.cfg and Alchemy drops the resource, but the zone KEEPS RUNNING on every node\n*   until something applies `PUT /cluster/sdn`: a destroy nobody applies reads as complete\n*   in the plan and has not happened on the cluster.\n* ⚠️ PVE also refuses to remove a zone that still holds vnets. That refusal is kept — it is\n*   the cluster declining to orphan a network because a line left a file.\n \n */\nexport const ProxmoxSdnZoneProvider = () =>\n  Provider.effect(ProxmoxSdnZone, Effect.succeed(ProxmoxSdnZone.Provider.of(handlers)));\n",
-    "/**\n * `Proxmox.Storage` — one entry in `/etc/pve/storage.cfg`, declared. Cluster-scoped like a pool,\n * which is why `path` and `collection` carry no node segment though a storage is used per node.\n *\n * ★ THIS IS THE OBJECT EVERY CONTAINER ALREADY DEPENDS ON AND NOTHING DECLARES. `LxcProps.storage`\n *   and the prefix of `LxcProps.ostemplate` (`local:vztmpl/...`) are bare strings, so a container's\n *   rootfs points at something outside the graph: rebuild a node and the plan still reads `noop`\n *   right up to the create that fails because the storage is not there. Passing this resource's\n *   `storage` attribute into `LxcProps.storage` makes the dependency real — Alchemy orders by data\n *   flow, so the storage reconciles first because the container reads a value out of it.\n *\n * ⛔ ONE PRIVILEGE COVERS THIS WHOLE FAMILY AND IT IS `Datastore.Allocate` ON `/storage`. Create,\n *   update, delete AND the single-object read all check it — `Datastore.Audit` is not enough for\n *   any of them. MEASURED: `GET /storage/local` under the auditor-scoped `read` lease answers 403\n *   \"Permission check failed (/storage/local, Datastore.Allocate)\". So this family reads with\n *   `provision`, same as acl.ts and unlike group.ts/user.ts — `provision-baseline.ts` carries\n *   `Datastore.Allocate`.\n *\n * ⛔ ON A LANE WHOSE CREDENTIAL CANNOT MINT `provision` (the agent's `read`-role lane), THIS\n *   FAMILY SHIPPED WITH THE ORIGINAL CRIES-WOLF BUG — measured live, 2026-09-24: `bun run plan`\n *   showed all 5 storages (`cephfs-tb4`, `cephtb4`, `local`, `local-zfs`, `pbs`) as `update`, with\n *   no warning, because `client.ts`'s `pveOperations.read` folded the REFUSED mint into `undefined`\n *   the same way it folds a genuine absence — `unreadable-read.ts`'s own header names this family\n *   by name as one of the two the fix was written for. Migrated here the way acl.ts/group.ts/\n *   user.ts were (kit 0.31.1/0.31.2): a refused `provision` mint now reports `noop` with a logged\n *   warning instead of forcing `update` with nothing compared.\n *\n * ⛔ A MISSING STORAGE IS A 500, NOT A 404 — MEASURED against the live cluster (TB4, 2026-09-24,\n *   admin lane, read-only `GET /storage/hf-measure-nonexistent-probe`): `{\"message\":\"storage\n *   '...' does not exist\\n\"}` at HTTP 500. `storage-wire.ts`'s `readStorageOrFail`/`readStorage`\n *   carry the same dual-path split as user.ts/group.ts for exactly this reason — see that file.\n *\n * ⛔ `maxfiles` IS GONE — A MEASURED `@distilled.cloud/proxmox` SDK GAP, NOT A SCOPE TRIM. The\n *   vendor's generated `CreateStorageRequest`/`PutStorageRequest` (storage-wire.ts's `mutable`)\n *   have no `maxfiles` field at all — grepped across the whole package, not just this endpoint —\n *   where `prune-backups`, its documented replacement, is present and correctly wired\n *   (`T.Body(\"prune-backups\")` on the generated `prune_backups` property). Silently dropping a\n *   declared `maxfiles` value would have been the same class of bug this whole migration exists to\n *   close: a write that looks like it landed and did not. So `maxfiles?: never` below, the same\n *   COMPILE-ERROR treatment `StorageLocator`'s `password`/`keyring`/`encryption-key` already get —\n *   a declaration that sets it is refused before a plan ever runs, not silently ignored by one.\n *   None of this cluster's 5 live storages set it (measured, live response bodies below). If a\n *   consumer genuinely needs it, the fix belongs in `@distilled.cloud/proxmox`'s generator, not a\n *   hand-rolled bypass here — see the provider-walk-down doctrine on vendor gaps.\n *\n * ⛔ EVERY HYPHENATED PVE FIELD NAME BECOMES AN UNDERSCORE IN DISTILLED'S GENERATED TYPESCRIPT —\n *   MEASURED across the WHOLE generated `CreateStorageRequest`/`PutStorageRequest`, not one field:\n *   `prune-backups` -> `prune_backups`, `fs-name` -> `fs_name`, `max-protected-backups` ->\n *   `max_protected_backups`, and so on for every plugin field `StorageLocator`'s free-form bag can\n *   carry (`cephfs-tb4`'s own live locator uses `fs-name`, measured below). No other family\n *   migrated so far has a hyphenated field at all, so this is new here. `storage-wire.ts`'s\n *   `underscored` translates a form BUILT with PVE's own names into distilled's shape, but ONLY\n *   for the actual SDK call (`toDistilledCreate`/`toDistilledUpdate`) — never for the form\n *   `guardWrite` checks (`createForm`/`updateForm`), which the generated vendor-constraint tables\n *   key by PVE's own hyphenated names. Running the translation before that check would make it\n *   silently stop inspecting the very fields it exists to catch.\n *\n * ⛔ THERE IS NO `password` PROP AND THERE MUST NEVER BE ONE. PBS and CIFS storages take one at\n *   create time, and Alchemy persists attributes UNENCRYPTED — a secret in props is one careless\n *   line away from being an attribute, and from there it is in the state store's nightly dump. So\n *   `StorageLocator` types `password`, `keyring` and `encryption-key` as `never`: declaring one is\n *   a COMPILE ERROR rather than a leak somebody finds in a backup months later. Set it once out of\n *   band (`pvesm set <id> --password`); PVE never returns it on read, so nothing here could diff it\n *   anyway.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` (`resource.ts`) ONTO\n *   `@distilled.cloud/proxmox`'s typed `storage.getStorage`/`createStorage`/`putStorage`/\n *   `deleteStorage` (2026-09-24, decision 43's proxmox walk-down, nodes/storage sub-area, first\n *   resource). `distilled-pve.ts`'s `runPve` replaces `pve()`; the cries-wolf fix is wired the\n *   same way as acl.ts/group.ts/user.ts.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as storage from '@distilled.cloud/proxmox/storage';\nimport * as Effect from 'effect/Effect';\nimport { guardWrite } from './distilled-guard.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport {\n  STORAGE_CREATE,\n  STORAGE_UPDATE,\n  createForm,\n  toDistilledCreate,\n  toDistilledUpdate,\n  updateForm,\n} from './storage-form.ts';\nimport { dropUnreadable, matches, readStorage, readStorageOrFail } from './storage-wire.ts';\nimport { UNREADABLE, unreadableWarning } from './unreadable-read.ts';\nimport type { StorageAttributes } from './storage-wire.ts';\nimport type { StorageLocator } from './storage-form.ts';\n\n/** Re-exported so a caller of this file still finds them here, unchanged by the split below. */\nexport type { StorageAttributes, StorageLocator };\n\nexport interface StorageProps extends WithTarget {\n  /** PVE's primary key, cluster-wide — the string an LXC's `storage` and `ostemplate` name. */\n  storage: string;\n  /**\n   * `dir` | `nfs` | `cifs` | `pbs` | `zfspool` | `lvmthin` | `rbd` | … ⚠️ CREATE-ONLY, so a changed\n   * `type` plans as `noop` (see `matches`). PVE cannot retype a storage: remove and redeclare.\n   */\n  type: string;\n  /** ⚠️ Create-only, one shape per plugin. See `StorageLocator`. */\n  locator?: StorageLocator;\n  /** `images,rootdir,vztmpl,iso,backup,snippets`. PVE reports `none` for an empty set. */\n  content?: string;\n  /**\n   * Node restriction, e.g. `node-a,node-b`. ⚠️ A STORAGE WITH A `nodes` LIST DOES NOT EXIST ANYWHERE ELSE:\n   * an LXC declared on a node outside it fails at create with \"storage not available on node\".\n   */\n  nodes?: string;\n  /** Keeps the definition but stops PVE using it. */\n  disable?: boolean;\n  /**\n   * Tells PVE the same volumes are visible from every node — a claim, not a mechanism.\n   * ⚠️ ONLY SENT WHEN THE TYPE'S OWN PLUGIN ACCEPTS IT (storage-plugin-options.ts, vendor-cited)\n   *   — elsewhere it is dropped from the wire, and a disagreeing declared value dies the plan\n   *   loud (storage-wire.ts's `matches`) rather than PUTting a field PVE would refuse outright.\n   */\n  shared?: boolean;\n  /** `off` | `metadata` | `falloc` | `full`. File-based plugins only. */\n  preallocation?: string;\n  /**\n   * `keep-last=3,keep-daily=7,…`. ⚠️ THE WIRE NAME IS KEPT, HYPHEN AND ALL: a `pruneBackups` that\n   * quietly becomes `prune-backups` in the form body is a second name for one thing.\n   */\n  'prune-backups'?: string;\n  comment?: string;\n  /** ⛔ REMOVED — a measured `@distilled.cloud/proxmox` gap, not a scope trim. See the header. */\n  maxfiles?: never;\n}\n\nexport interface ProxmoxStorage extends Resource<\n  'Proxmox.Storage',\n  StorageProps,\n  StorageAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a storage holding volumes cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxStorage = Resource<ProxmoxStorage>('Proxmox.Storage', {\n  defaultRemovalPolicy: 'retain',\n});\n\nexport const ProxmoxStorageProvider = () =>\n  Provider.effect(\n    ProxmoxStorage,\n    Effect.succeed(\n      ProxmoxStorage.Provider.of({\n        /**\n         * ⛔ EMPTY, AND HERE IT MATTERS MORE THAN ANYWHERE ELSE IN THIS PACKAGE. `GET /storage`\n         *   returns every definition on the cluster, `local` and `local-lvm`/`local-zfs` included:\n         *   the installer's own, that every guest's rootfs sits on. Adopting those would put\n         *   Alchemy one `delete` away from the cluster's disks. Adoption is explicit, always.\n         */\n        list: () => Effect.succeed([]),\n        // ⚠️ FOLDS ONLY WHEN `output` IS `undefined` — user.ts's/group.ts's own ⚠️, applied here\n        //   from the start rather than found by a later review: the engine calls this hook from\n        //   Plan.ts's adoption probe and interrupted-create recovery and Apply.ts's delete\n        //   recovery (all `output: undefined`, nothing confirmed exists yet — `readStorage`'s fold\n        //   is still needed) as well as Drift.ts (`output: old.attr`, an ALREADY-CONFIRMED row,\n        //   `diff`'s own situation — `readStorageOrFail` there instead, or a transient failure\n        //   reports a silent `{action: 'missing'}` with no error at all).\n        read: Effect.fn(function* ({ olds, output }) {\n          return dropUnreadable(\n            yield* output === undefined ? readStorage(olds) : readStorageOrFail(olds),\n          );\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(STORAGE_CREATE, createForm(news), output === undefined);\n          // ⚠️ `live: undefined`: no read yet, so this only sanity-checks the FULL declared set\n          //   (storage-form.ts's `updateForm` doc) — `reconcile` builds the actual partial body.\n          yield* guardWrite(STORAGE_UPDATE, updateForm(news, undefined), false);\n          if (output === undefined) return undefined;\n          // ⚠️ `readStorageOrFail`, NOT `readStorage` — see that function's own ⛔ in\n          //   storage-wire.ts. A genuine TRANSIENT failure here propagates and fails the whole\n          //   plan loudly instead of folding to \"absent\" and forcing a false update.\n          const live = yield* readStorageOrFail(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force\n          //   `update` on a storage that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning('Proxmox.Storage', news.storage);\n            return { action: 'noop' } as const;\n          }\n          if (live === undefined) {\n            yield* guardWrite(STORAGE_CREATE, createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          return (yield* matches(live, news))\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the\n          //   write below, so `UNREADABLE` here is a narrow race, not the routine case `diff`\n          //   handles — group.ts's/user.ts's reconcile have the same note.\n          const before = dropUnreadable(yield* readStorage(news));\n          yield* guardWrite(STORAGE_CREATE, createForm(news), before === undefined);\n          // ★ COMPUTED ONCE, THEN REUSED FOR BOTH THE GUARD AND THE WRITE — storage-form.ts's own\n          //   ⚠️ on `toDistilledUpdate`: `update` is the partial body (only fields that differ\n          //   from `before`, and never `shared` for a type that doesn't accept it), so the\n          //   constraint check below inspects exactly what the PUT, if any, will carry.\n          const update = updateForm(news, before);\n          yield* guardWrite(STORAGE_UPDATE, update, false);\n          if (before === undefined) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              storage.createStorage(toDistilledCreate(news)),\n            );\n          } else if (!(yield* matches(before, news))) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              storage.putStorage(toDistilledUpdate(update)),\n            );\n          }\n          const after = dropUnreadable(yield* readStorage(news));\n          if (after === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `storage/${news.storage}: the write returned no error but the storage is still ` +\n                  'absent. PVE wraps every answer in {\"data\":...} and can report success on a ' +\n                  'call that did nothing -- read back rather than trusting the status code.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⚠️ THIS REMOVES THE DEFINITION, NOT THE DATA. PVE drops the section from storage.cfg and\n         *   leaves the volumes on disk untouched — so the loss is not the bytes, it is that guests\n         *   whose config still names this storage can no longer resolve their own disks.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            storage.deleteStorage({ storage: olds.storage }),\n          );\n        }),\n      }),\n    ),\n  );\n",
+    "/**\n * `Proxmox.Storage` — one entry in `/etc/pve/storage.cfg`, declared. Cluster-scoped like a pool,\n * which is why `path` and `collection` carry no node segment though a storage is used per node.\n *\n * ★ THIS IS THE OBJECT EVERY CONTAINER ALREADY DEPENDS ON AND NOTHING DECLARES. `LxcProps.storage`\n *   and the prefix of `LxcProps.ostemplate` (`local:vztmpl/...`) are bare strings, so a container's\n *   rootfs points at something outside the graph: rebuild a node and the plan still reads `noop`\n *   right up to the create that fails because the storage is not there. Passing this resource's\n *   `storage` attribute into `LxcProps.storage` makes the dependency real — Alchemy orders by data\n *   flow, so the storage reconciles first because the container reads a value out of it.\n *\n * ⛔ ONE PRIVILEGE COVERS THIS WHOLE FAMILY AND IT IS `Datastore.Allocate` ON `/storage`. Create,\n *   update, delete AND the single-object read all check it — `Datastore.Audit` is not enough for\n *   any of them. MEASURED: `GET /storage/local` under the auditor-scoped `read` lease answers 403\n *   \"Permission check failed (/storage/local, Datastore.Allocate)\". So this family reads with\n *   `provision`, same as acl.ts and unlike group.ts/user.ts — `provision-baseline.ts` carries\n *   `Datastore.Allocate`.\n *\n * ⛔ ON A LANE WHOSE CREDENTIAL CANNOT MINT `provision` (the agent's `read`-role lane), THIS\n *   FAMILY SHIPPED WITH THE ORIGINAL CRIES-WOLF BUG — measured live, 2026-09-24: `bun run plan`\n *   showed all 5 storages (`cephfs-tb4`, `cephtb4`, `local`, `local-zfs`, `pbs`) as `update`, with\n *   no warning, because `client.ts`'s `pveOperations.read` folded the REFUSED mint into `undefined`\n *   the same way it folds a genuine absence — `unreadable-read.ts`'s own header names this family\n *   by name as one of the two the fix was written for. Migrated here the way acl.ts/group.ts/\n *   user.ts were (kit 0.31.1/0.31.2): a refused `provision` mint now reports `noop` with a logged\n *   warning instead of forcing `update` with nothing compared.\n *\n * ⛔ A MISSING STORAGE IS A 500, NOT A 404 — MEASURED against the live cluster (TB4, 2026-09-24,\n *   admin lane, read-only `GET /storage/hf-measure-nonexistent-probe`): `{\"message\":\"storage\n *   '...' does not exist\\n\"}` at HTTP 500. `storage-wire.ts`'s `readStorageOrFail`/`readStorage`\n *   carry the same dual-path split as user.ts/group.ts for exactly this reason — see that file.\n *\n * ⛔ `maxfiles` IS GONE — A MEASURED `@distilled.cloud/proxmox` SDK GAP, NOT A SCOPE TRIM. The\n *   vendor's generated `CreateStorageRequest`/`PutStorageRequest` (storage-wire.ts's `mutable`)\n *   have no `maxfiles` field at all — grepped across the whole package, not just this endpoint —\n *   where `prune-backups`, its documented replacement, is present and correctly wired\n *   (`T.Body(\"prune-backups\")` on the generated `prune_backups` property). Silently dropping a\n *   declared `maxfiles` value would have been the same class of bug this whole migration exists to\n *   close: a write that looks like it landed and did not. So `maxfiles?: never` below, the same\n *   COMPILE-ERROR treatment `StorageLocator`'s `password`/`keyring`/`encryption-key` already get —\n *   a declaration that sets it is refused before a plan ever runs, not silently ignored by one.\n *   None of this cluster's 5 live storages set it (measured, live response bodies below). If a\n *   consumer genuinely needs it, the fix belongs in `@distilled.cloud/proxmox`'s generator, not a\n *   hand-rolled bypass here — see the provider-walk-down doctrine on vendor gaps.\n *\n * ⛔ EVERY HYPHENATED PVE FIELD NAME BECOMES AN UNDERSCORE IN DISTILLED'S GENERATED TYPESCRIPT —\n *   MEASURED across the WHOLE generated `CreateStorageRequest`/`PutStorageRequest`, not one field:\n *   `prune-backups` -> `prune_backups`, `fs-name` -> `fs_name`, `max-protected-backups` ->\n *   `max_protected_backups`, and so on for every plugin field `StorageLocator`'s free-form bag can\n *   carry (`cephfs-tb4`'s own live locator uses `fs-name`, measured below). No other family\n *   migrated so far has a hyphenated field at all, so this is new here. `storage-wire.ts`'s\n *   `underscored` translates a form BUILT with PVE's own names into distilled's shape, but ONLY\n *   for the actual SDK call (`toDistilledCreate`/`toDistilledUpdate`) — never for the form\n *   `guardWrite` checks (`createForm`/`updateForm`), which the generated vendor-constraint tables\n *   key by PVE's own hyphenated names. Running the translation before that check would make it\n *   silently stop inspecting the very fields it exists to catch.\n *\n * ⛔ THERE IS NO `password` PROP AND THERE MUST NEVER BE ONE. PBS and CIFS storages take one at\n *   create time, and Alchemy persists attributes UNENCRYPTED — a secret in props is one careless\n *   line away from being an attribute, and from there it is in the state store's nightly dump. So\n *   `StorageLocator` types `password`, `keyring` and `encryption-key` as `never`: declaring one is\n *   a COMPILE ERROR rather than a leak somebody finds in a backup months later. Set it once out of\n *   band (`pvesm set <id> --password`); PVE never returns it on read, so nothing here could diff it\n *   anyway.\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveHandlers` (`resource.ts`) ONTO\n *   `@distilled.cloud/proxmox`'s typed `storage.getStorage`/`createStorage`/`putStorage`/\n *   `deleteStorage` (2026-09-24, decision 43's proxmox walk-down, nodes/storage sub-area, first\n *   resource). `distilled-pve.ts`'s `runPve` replaces `pve()`; the cries-wolf fix is wired the\n *   same way as acl.ts/group.ts/user.ts.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as storage from '@distilled.cloud/proxmox/storage';\nimport * as Effect from 'effect/Effect';\nimport { guardWrite } from './distilled-guard.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { runPve } from './distilled-pve.ts';\nimport {\n  STORAGE_CREATE,\n  STORAGE_UPDATE,\n  createForm,\n  toDistilledCreate,\n  toDistilledUpdate,\n  updateForm,\n} from './storage-form.ts';\nimport { dropUnreadable, matches, readStorage, readStorageOrFail } from './storage-wire.ts';\nimport { mintTier } from './credentials.ts';\nimport { UNREADABLE, unreadableWarning } from './unreadable-read.ts';\nimport type { StorageAttributes } from './storage-wire.ts';\nimport type { StorageLocator } from './storage-form.ts';\n\n/** Re-exported so a caller of this file still finds them here, unchanged by the split below. */\nexport type { StorageAttributes, StorageLocator };\n\nexport interface StorageProps extends WithTarget {\n  /** PVE's primary key, cluster-wide — the string an LXC's `storage` and `ostemplate` name. */\n  storage: string;\n  /**\n   * `dir` | `nfs` | `cifs` | `pbs` | `zfspool` | `lvmthin` | `rbd` | … ⚠️ CREATE-ONLY, so a changed\n   * `type` plans as `noop` (see `matches`). PVE cannot retype a storage: remove and redeclare.\n   */\n  type: string;\n  /** ⚠️ Create-only, one shape per plugin. See `StorageLocator`. */\n  locator?: StorageLocator;\n  /** `images,rootdir,vztmpl,iso,backup,snippets`. PVE reports `none` for an empty set. */\n  content?: string;\n  /**\n   * Node restriction, e.g. `node-a,node-b`. ⚠️ A STORAGE WITH A `nodes` LIST DOES NOT EXIST ANYWHERE ELSE:\n   * an LXC declared on a node outside it fails at create with \"storage not available on node\".\n   */\n  nodes?: string;\n  /** Keeps the definition but stops PVE using it. */\n  disable?: boolean;\n  /**\n   * Tells PVE the same volumes are visible from every node — a claim, not a mechanism.\n   * ⚠️ ONLY SENT WHEN THE TYPE'S OWN PLUGIN ACCEPTS IT (storage-plugin-options.ts, vendor-cited)\n   *   — elsewhere it is dropped from the wire, and a disagreeing declared value dies the plan\n   *   loud (storage-wire.ts's `matches`) rather than PUTting a field PVE would refuse outright.\n   */\n  shared?: boolean;\n  /** `off` | `metadata` | `falloc` | `full`. File-based plugins only. */\n  preallocation?: string;\n  /**\n   * `keep-last=3,keep-daily=7,…`. ⚠️ THE WIRE NAME IS KEPT, HYPHEN AND ALL: a `pruneBackups` that\n   * quietly becomes `prune-backups` in the form body is a second name for one thing.\n   */\n  'prune-backups'?: string;\n  comment?: string;\n  /** ⛔ REMOVED — a measured `@distilled.cloud/proxmox` gap, not a scope trim. See the header. */\n  maxfiles?: never;\n}\n\nexport interface ProxmoxStorage extends Resource<\n  'Proxmox.Storage',\n  StorageProps,\n  StorageAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a storage holding volumes cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxStorage = Resource<ProxmoxStorage>('Proxmox.Storage', {\n  defaultRemovalPolicy: 'retain',\n});\n\nexport const ProxmoxStorageProvider = () =>\n  Provider.effect(\n    ProxmoxStorage,\n    Effect.succeed(\n      ProxmoxStorage.Provider.of({\n        /**\n         * ⛔ EMPTY, AND HERE IT MATTERS MORE THAN ANYWHERE ELSE IN THIS PACKAGE. `GET /storage`\n         *   returns every definition on the cluster, `local` and `local-lvm`/`local-zfs` included:\n         *   the installer's own, that every guest's rootfs sits on. Adopting those would put\n         *   Alchemy one `delete` away from the cluster's disks. Adoption is explicit, always.\n         */\n        list: () => Effect.succeed([]),\n        // ⚠️ FOLDS ONLY WHEN `output` IS `undefined` — user.ts's/group.ts's own ⚠️, applied here\n        //   from the start rather than found by a later review: the engine calls this hook from\n        //   Plan.ts's adoption probe and interrupted-create recovery and Apply.ts's delete\n        //   recovery (all `output: undefined`, nothing confirmed exists yet — `readStorage`'s fold\n        //   is still needed) as well as Drift.ts (`output: old.attr`, an ALREADY-CONFIRMED row,\n        //   `diff`'s own situation — `readStorageOrFail` there instead, or a transient failure\n        //   reports a silent `{action: 'missing'}` with no error at all).\n        read: Effect.fn(function* ({ olds, output }) {\n          return dropUnreadable(\n            yield* output === undefined ? readStorage(olds) : readStorageOrFail(olds),\n          );\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* guardWrite(STORAGE_CREATE, createForm(news), output === undefined);\n          // ⚠️ `live: undefined`: no read yet, so this only sanity-checks the FULL declared set\n          //   (storage-form.ts's `updateForm` doc) — `reconcile` builds the actual partial body.\n          yield* guardWrite(STORAGE_UPDATE, updateForm(news, undefined), false);\n          if (output === undefined) return undefined;\n          // ⚠️ `readStorageOrFail`, NOT `readStorage` — see that function's own ⛔ in\n          //   storage-wire.ts. A genuine TRANSIENT failure here propagates and fails the whole\n          //   plan loudly instead of folding to \"absent\" and forcing a false update.\n          const live = yield* readStorageOrFail(news);\n          // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force\n          //   `update` on a storage that was plainly there — see unreadable-read.ts.\n          if (live === UNREADABLE) {\n            yield* unreadableWarning(\n              'Proxmox.Storage',\n              news.storage,\n              news.target.mount,\n              mintTier(news.target, 'provision'),\n            );\n            return { action: 'noop' } as const;\n          }\n          if (live === undefined) {\n            yield* guardWrite(STORAGE_CREATE, createForm(news), true);\n            return { action: 'update' } as const;\n          }\n          return (yield* matches(live, news))\n            ? ({ action: 'noop' } as const)\n            : ({ action: 'update' } as const);\n        }),\n        reconcile: Effect.fn(function* ({ news }) {\n          // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the\n          //   write below, so `UNREADABLE` here is a narrow race, not the routine case `diff`\n          //   handles — group.ts's/user.ts's reconcile have the same note.\n          const before = dropUnreadable(yield* readStorage(news));\n          yield* guardWrite(STORAGE_CREATE, createForm(news), before === undefined);\n          // ★ COMPUTED ONCE, THEN REUSED FOR BOTH THE GUARD AND THE WRITE — storage-form.ts's own\n          //   ⚠️ on `toDistilledUpdate`: `update` is the partial body (only fields that differ\n          //   from `before`, and never `shared` for a type that doesn't accept it), so the\n          //   constraint check below inspects exactly what the PUT, if any, will carry.\n          const update = updateForm(news, before);\n          yield* guardWrite(STORAGE_UPDATE, update, false);\n          if (before === undefined) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              storage.createStorage(toDistilledCreate(news)),\n            );\n          } else if (!(yield* matches(before, news))) {\n            yield* runPve(\n              news.target,\n              'provision',\n              true,\n              storage.putStorage(toDistilledUpdate(update)),\n            );\n          }\n          const after = dropUnreadable(yield* readStorage(news));\n          if (after === undefined) {\n            return yield* Effect.die(\n              new Error(\n                `storage/${news.storage}: the write returned no error but the storage is still ` +\n                  'absent. PVE wraps every answer in {\"data\":...} and can report success on a ' +\n                  'call that did nothing -- read back rather than trusting the status code.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⚠️ THIS REMOVES THE DEFINITION, NOT THE DATA. PVE drops the section from storage.cfg and\n         *   leaves the volumes on disk untouched — so the loss is not the bytes, it is that guests\n         *   whose config still names this storage can no longer resolve their own disks.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          yield* runPve(\n            olds.target,\n            'provision',\n            true,\n            storage.deleteStorage({ storage: olds.storage }),\n          );\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * Which PVE storage plugin TYPES accept the `shared` property on write (create or update) — from\n * each plugin's own `options()` in vendor source, NOT the generic combined property list\n * `pve-apidoc` documentation carries (storage.ts's own header has that gap: apidoc.js merges\n * every plugin's fields into one flat list for display, so `shared` LOOKS like a plain valid\n * property of PUT /storage/{storage} there — `generated/pve/storage.ts`'s own\n * `StorageStoragePutParams.shared` came from exactly that merged list, and so did the constraint\n * codegen's own inclusion of `shared` as a recognized wire field). The check PVE actually runs is\n * PER STORAGE TYPE, against that concrete plugin's own `options()` accepted-key set\n * (PVE::SectionConfig) — a key the plugin never names is refused outright, which is why a cephfs\n * PUT carrying `shared` answers `unexpected property 'shared'` even though the apidoc schema and\n * the generated wire types both carry the field.\n *\n * MEASURED against github.com/proxmox/pve-storage (the official read-only GitHub mirror of\n * git.proxmox.com/pve-storage.git), branch `master`, read 2026-09-27 — each plugin's own\n * `sub options` block. Extended 2026-09-27 (PR 314's own red team) to cover the five types the\n * first pass left unverified rather than guessed at; only these two lists moved:\n *\n *   accepts `shared` (`shared => { optional => 1 }`):\n *     DirPlugin.pm:85, LVMPlugin.pm:453, BTRFSPlugin.pm:69, ESXiPlugin.pm:52\n *\n *   `shared` is ABSENT from `options()` entirely — PVE's per-type accepted-key check refuses it\n *   on both create and update, whatever the combined apidoc schema shows:\n *     CephFSPlugin.pm, RBDPlugin.pm, ZFSPoolPlugin.pm, LvmThinPlugin.pm, NFSPlugin.pm,\n *     CIFSPlugin.pm, PBSPlugin.pm, ISCSIPlugin.pm, ISCSIDirectPlugin.pm, ZFSPlugin.pm (the remote\n *     ZFS-over-iSCSI plugin, distinct from `zfspool`)\n *\n * `storage-cephfs-tb4`'s PUT failure (measured 2026-09-27, `bun run deploy`,\n * `InternalServerError: update storage failed: unexpected property 'shared'`) is exactly this:\n * `cephfs` has no `shared` in its own `options()`, so the base class's generic `shared` property\n * (`PVE::Storage::Plugin`'s `$defaultData->{propertyList}`: `type => 'boolean', optional => 1`,\n * no `fixed`) is never in the accepted set for that plugin, whether or not the declared value\n * would have matched what PVE already has.\n *\n * ⚠️ STILL NOT EXHAUSTIVE. Every PVE plugin type is now checked against vendor source EXCEPT\n *   whatever ships after this file was last read — `sharedAccepted` treats an unrecognized type\n *   as NOT accepting `shared`, the safe default: a wrongly-excluded type just never sends a\n *   declared `shared` (storage-form.ts's `mutable`) and, if the declared value actually disagrees\n *   with what PVE reports, the plan dies loud rather than lying `noop` (storage-wire.ts's\n *   `matches`) — it does not risk a second `unexpected property` 500. Read a new plugin's own\n *   `options()` on github.com/proxmox/pve-storage before adding it to either list.\n */\nconst SHARED_ACCEPTED_TYPES: ReadonlySet<string> = new Set(['dir', 'lvm', 'btrfs', 'esxi']);\n\nexport const sharedAccepted = (type: string): boolean => SHARED_ACCEPTED_TYPES.has(type);\n",
     "/**\n * `Proxmox.Storage`'s READ side: how a live item becomes attributes, the read itself, and\n * `matches`. Split out of storage.ts (2026-09-24, the distilled migration); the write side is\n * storage-form.ts (that file's own header has the reasoning) — both stay under the 250-line cap,\n * the api-token.ts/api-token-form.ts seam.\n */\nimport * as storage from '@distilled.cloud/proxmox/storage';\nimport * as Effect from 'effect/Effect';\nimport { runPve } from './distilled-pve.ts';\nimport { sharedAccepted } from './storage-plugin-options.ts';\nimport type { MutableFields } from './storage-form.ts';\nimport type { StorageProps } from './storage.ts';\nimport { UNREADABLE, type Unreadable, readOrUnreadable } from './unreadable-read.ts';\nimport { bool } from './values.ts';\n\nexport interface StorageAttributes {\n  storage: string;\n  /** Reported so a plan can show what it points at; never diffed — storage.ts's `type` doc. */\n  type: string;\n  content: string;\n  nodes: string;\n  disable: boolean;\n  shared: boolean;\n  preallocation: string;\n  'prune-backups': string;\n  comment: string;\n}\n\nconst str = (value: unknown, fallback = '') => (typeof value === 'string' ? value : fallback);\n\n/**\n * ⚠️ PVE RE-SERIALISES ITS LIST FIELDS IN ITS OWN ORDER — `content` and `nodes` are parsed into a\n *   set and written back sorted, `prune-backups` is a property string that comes back in schema\n *   order. Comparing raw strings would report an update for `iso,backup` against `backup,iso` on\n *   every plan, and the PUT would \"fix\" it into the identical string. Trimming matters too: a\n *   declared `iso, backup` would otherwise never equal what PVE stores.\n */\nconst tokens = (value: string) =>\n  value\n    .split(',')\n    .map((part) => part.trim())\n    .filter((part) => part !== '')\n    .sort()\n    .join(',');\n\nexport const sameList = (declared: string | undefined, live: string) =>\n  declared === undefined || tokens(declared) === tokens(live);\n\nexport const same = <T>(declared: T | undefined, live: T) =>\n  declared === undefined || declared === live;\n\n/**\n * ⚠️ `digest` IS DELIBERATELY NOT AN ATTRIBUTE. PVE returns one on every storage read and it\n *   covers storage.cfg as a FILE, not this section of it, so keeping it would rewrite this\n *   resource's state whenever an unrelated storage was edited — churn that reads like drift.\n * ⛔ `maxfiles` IS NOT REPORTED, AND `StorageProps.maxfiles` NO LONGER EXISTS — see storage.ts's\n *   header for the measured SDK gap this reflects.\n */\nconst attributesOf = (live: unknown, props: StorageProps): StorageAttributes => {\n  const data = live as Record<string, unknown>;\n  return {\n    comment: str(data['comment']),\n    content: str(data['content']),\n    disable: bool(data['disable']),\n    nodes: str(data['nodes']),\n    preallocation: str(data['preallocation']),\n    'prune-backups': str(data['prune-backups']),\n    shared: bool(data['shared']),\n    storage: props.storage,\n    type: str(data['type'], props.type),\n  };\n};\n\n/**\n * ★ Default `read` role WOULD READ 403 — see storage.ts's header on why this family reads with\n *   `provision`, the same as acl.ts and unlike group.ts/user.ts.\n * ⛔ `{ storage: props.storage }`, NEVER THE WHOLE `props` — user.ts/group.ts's own ⛔, the\n *   kit 0.31.1 regression: `GetStorageRequest`'s schema declares only `storage` (a path label);\n *   any OTHER key on the object passed to `storage.getStorage` is treated by distilled's\n *   `buildRequest` as an \"unknown key\" and JSON-encoded onto this bodyless GET, which a stricter\n *   fetch client refuses outright.\n * ⛔ A MISSING STORAGE IS A 500, NOT A 404 — MEASURED against the live cluster (TB4, 2026-09-24,\n *   admin lane, read-only probe): `GET /storage/hf-measure-nonexistent-probe` answers\n *   `{\"message\":\"storage 'hf-measure-nonexistent-probe' does not exist\\n\",\"data\":null}` at HTTP\n *   500 — the SAME shape as user.ts's and group.ts's own measured 500, not the clean\n *   `{\"data\":null}` at 200 this file's pre-migration comment assumed for every read failure\n *   (client.ts's `pveOperations.read` could not tell the two apart either way, folding both into\n *   \"absent\"). `readStorage` below (used by `read`/`reconcile`) still folds it, exactly as\n *   `readUser`/`readGroup` do, so a brand-new declaration can still be created; `readStorageOrFail`\n *   (used by `diff`) does not.\n */\nexport const readStorageOrFail = (props: StorageProps) =>\n  readOrUnreadable(\n    runPve(props.target, 'provision', false, storage.getStorage({ storage: props.storage })),\n  ).pipe(Effect.map((live) => (live === UNREADABLE ? UNREADABLE : attributesOf(live, props))));\n\n/**\n * ⛔ ONLY `StorageNotFound` MEANS ABSENT. The initial distilled transport swap preserved a\n *   catch-all fold because PVE reports missing objects as HTTP 500. SDK PR 265 now types that\n *   measured message, so permission errors, unrelated 500s and exhausted transports propagate\n *   instead of triggering a speculative create (decision 49 follow-up, 2026-09-24).\n * ★ `readStorageOrFail` remains the strict path used for an already-confirmed state row. This\n *   change narrows cold reads/reconcile without changing that existing drift/diff contract.\n */\nexport const readStorage = (props: StorageProps) =>\n  readStorageOrFail(props).pipe(\n    Effect.catchTag('StorageNotFound', () => Effect.succeed(undefined)),\n  );\n\n/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */\nexport const dropUnreadable = (live: StorageAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n\n/**\n * The declared fields (of the 7 `mutable()` — storage-form.ts — ever writes) whose value\n * genuinely differs from what PVE just reported. `matches` below and storage-form.ts's\n * `updateForm` share this one comparison, so the plan's noop/update verdict and the partial PUT\n * body it sends can never disagree about what \"changed\" means for a list, a boolean or `shared`.\n *\n * ⛔ `shared` IS SKIPPED ENTIRELY FOR A TYPE THAT DOESN'T ACCEPT IT (storage-plugin-options.ts's\n *   `sharedAccepted`, vendor-cited there) — the same treatment `type` already gets below\n *   (create-only, never compared) and for the identical reason: PVE will never apply a `shared`\n *   PUT for cephfs/rbd/zfspool/… (it 500s, `unexpected property 'shared'` — the bug this family\n *   shipped with, measured 2026-09-27), so comparing it against a live value that can never move\n *   to match could only ever report `update` forever. Without this skip, `mutable()`'s own gate\n *   (storage-form.ts) would still keep `shared` out of the wire body, but `matches` would keep\n *   reporting drift for a field nothing can ever apply — a plan that never reaches noop.\n */\nexport const changedProps = (\n  live: StorageAttributes,\n  props: StorageProps,\n): Partial<MutableFields> => ({\n  ...(sameList(props.content, live.content) ? {} : { content: props.content }),\n  ...(sameList(props.nodes, live.nodes) ? {} : { nodes: props.nodes }),\n  ...(sameList(props['prune-backups'], live['prune-backups'])\n    ? {}\n    : { 'prune-backups': props['prune-backups'] }),\n  ...(same(props.disable, live.disable) ? {} : { disable: props.disable }),\n  ...(sharedAccepted(props.type) && !same(props.shared, live.shared)\n    ? { shared: props.shared }\n    : {}),\n  ...(same(props.preallocation, live.preallocation) ? {} : { preallocation: props.preallocation }),\n  ...(same(props.comment, live.comment) ? {} : { comment: props.comment }),\n});\n\n/**\n * ⚠️ `type` IS NEVER COMPARED — CREATE-ONLY (`storage.ts`'s own `StorageProps.type` doc), so a\n *   changed declaration plans `noop` on it, same as before the migration.\n *\n * ⛔ A DECLARED `shared` A TYPE CAN NEVER APPLY MUST FAIL LOUD, NOT NOOP FOREVER — PR 314's own\n *   red team, 2026-09-27. `changedProps` above leaves `shared` out of its result whenever the\n *   type is outside `sharedAccepted`, on purpose (PVE 500s on the PUT otherwise) — but that\n *   means a genuinely disagreeing declared value would otherwise vanish into an empty diff and\n *   report `noop` forever, with the recorded attribute silently stuck on whatever PVE already\n *   has. `maxfiles` (storage.ts's header) refuses that same class of bug at compile time; this is\n *   the update-time equivalent for a field that can't be typed away. So this checks the ONE case\n *   `changedProps` deliberately can't see — declared and live actually differ, on a type that can\n *   never carry the write — and dies with a message naming the fix, before `changedProps` runs.\n */\nexport const matches = (attributes: StorageAttributes, props: StorageProps) =>\n  !sharedAccepted(props.type) && !same(props.shared, attributes.shared)\n    ? Effect.die(\n        new Error(\n          `storage/${props.storage}: declared shared: ${String(props.shared)}, but PVE reports ` +\n            `${String(attributes.shared)} and '${props.type}' storages never accept a 'shared' ` +\n            'write (storage-plugin-options.ts) -- remove the declared shared or set it to match ' +\n            'what PVE already reports; this value can never be applied.',\n        ),\n      )\n    : Effect.succeed(Object.keys(changedProps(attributes, props)).length === 0);\n",
     "/**\n * `Proxmox.Storage`'s WRITE side: the locator bag, the create/update forms, and the translation\n * into distilled's own typed request shape. Split out of storage-wire.ts (2026-09-24) to keep\n * both files under the 250-line cap — the api-token.ts/api-token-form.ts seam, same reasoning.\n */\nimport type * as storage from '@distilled.cloud/proxmox/storage';\nimport { sharedAccepted } from './storage-plugin-options.ts';\nimport type { StorageProps } from './storage.ts';\nimport { changedProps } from './storage-wire.ts';\nimport type { StorageAttributes } from './storage-wire.ts';\nimport { flag } from './values.ts';\n\nexport const STORAGE_CREATE = 'pve:POST /storage';\nexport const STORAGE_UPDATE = 'pve:PUT /storage/{storage}';\n\n/**\n * The create-time, plugin-specific half of a storage: `dir` wants `path`, `nfs` `server`+`export`,\n * `cifs` `server`+`share`, `pbs` `server`+`datastore`, `rbd` `pool`+`monhost`, `lvmthin`\n * `vgname`+`thinpool`, `zfspool` `pool`. A bag rather than two dozen named fields, because PVE\n * ships about that many plugins and each brings its own locator. ⚠️ Never diffed — see `matches`\n * (storage-wire.ts).\n *\n * ⛔ `password`, `keyring` AND `encryption-key` ARE `never` ON PURPOSE — see the ⛔ in storage.ts's\n *   header. POSITIVE-CONTROLLED rather than assumed: all three are a compile error, `TS2322: Type\n *   'string' is not assignable to type 'undefined'`.\n * ⚠️ EVERY KEY IN THIS BAG GOES THROUGH `underscored` (below) BEFORE IT REACHES DISTILLED — see\n *   that function's own header. A caller writes PVE's own field names here (`fs-name`, matching\n *   `pvesm`/pve-docs), never distilled's renamed ones.\n */\nexport type StorageLocator = Record<string, string> & {\n  password?: never;\n  keyring?: never;\n  'encryption-key'?: never;\n};\n\nconst field = (name: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [name]: value };\n\n/**\n * ⚠️ THE CAST DROPS THE THREE `never` GUARDS AND NOTHING ELSE, and it is load-bearing rather than\n *   lazy: an intersection carrying OPTIONAL properties is not assignable to `Record<string,string>`\n *   at all, so the guards and the form body cannot both exist without one conversion. At runtime a\n *   locator is a plain string map; the guards only ever existed to fail a declaration.\n */\nconst locatorForm = (locator: StorageLocator | undefined) =>\n  ({ ...locator }) as Record<string, string>;\n\n/**\n * ★ ROUTES EVERY OUTGOING FIELD THROUGH DISTILLED'S OWN TYPED PROPERTY, RATHER THAN THROUGH ITS\n *   \"UNKNOWN KEY\" FALLBACK — NOT BECAUSE THE WIRE NEEDS THE UNDERSCORED SPELLING. MEASURED both\n *   ways (`storage-read-failure.test.ts`'s create test, run once with this function and once\n *   without it): PVE's own hyphenated name (`content-dirs=…`) reaches the wire either way —\n *   `@distilled.cloud/proxmox`'s generated `T.Body(\"content-dirs\")` annotation re-hyphenates its\n *   underscored `content_dirs` property on the way out, AND an untranslated hyphenated key also\n *   passes through unchanged as an \"unknown key\", form-encoded alongside the recognized ones (the\n *   GET-request version of that same passthrough is what caused kit 0.31.1's regression — see\n *   user.ts/group.ts — but a POST/PUT is already body-bearing, so the failure mode there doesn't\n *   apply). So EITHER path is wire-correct for a plain rename. What `underscored` buys instead:\n *   distilled's own schema only runs its declared per-field logic (a `T.Body()` rename, but also\n *   whatever type coercion or list-joining a FUTURE plugin field might carry) for a property it\n *   recognizes — an unrecognized key gets none of that, silently. `StorageLocator` is free-form\n *   on purpose (the header's own reasoning), so this file cannot enumerate every field a plugin\n *   might need; routing through the recognized property is the one way to get distilled's own\n *   per-field handling for a field this package's author never tried, rather than a bare rename.\n *   Renamed against every hyphenated field on the generated `CreateStorageRequest`/\n *   `PutStorageRequest` today (`prune-backups` -> `prune_backups`, `fs-name` -> `fs_name`,\n *   `max-protected-backups` -> `max_protected_backups`, `zfs-base-path` -> `zfs_base_path`,\n *   `content-dirs` -> `content_dirs`, `saferemove-stepsize` -> `saferemove_stepsize`, and so on) —\n *   a generic transform, not a lookup table, for the same free-form reason. No other migrated\n *   family (acl/group/role/user/api-token) hit any of this: none of their fields are hyphenated.\n * ⛔ NEVER APPLIED TO THE FORM `guardWrite` CHECKS, REGARDLESS. The generated vendor-constraint\n *   tables (`generated/constraints/pve-storage.ts`) are keyed by PVE's OWN hyphenated names —\n *   running this first would make every constraint on `prune-backups`, `fs-name`, etc. silently\n *   never match, the vendor check passing over a value it never actually inspected. `createForm`/\n *   `updateForm` stay hyphenated for exactly that reason; only `toDistilledCreate`/\n *   `toDistilledUpdate` (the actual SDK call, storage.ts's `reconcile`) apply this.\n */\nconst underscored = (form: Record<string, string>): Record<string, string> =>\n  Object.fromEntries(Object.entries(form).map(([key, value]) => [key.replaceAll('-', '_'), value]));\n\n/**\n * The 7 fields `mutable()` reads, narrowed out of `StorageProps` — not `StorageProps` itself, so\n * a partial diff (storage-wire.ts's `changedProps`, which carries none of `storage`/`locator`/\n * `target`) can satisfy this type directly.\n */\nexport type MutableFields = Pick<\n  StorageProps,\n  'comment' | 'content' | 'disable' | 'nodes' | 'preallocation' | 'prune-backups' | 'shared'\n>;\n\n/**\n * The mutable half, for create and update alike.\n *\n * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED: undeclared means UNMANAGED here, unlike\n *   `Proxmox.Pool` where an absent comment means `''`. A storage has no single default to fall back\n *   on — `content` defaults per plugin, and clearing a field needs an explicit `delete=` parameter\n *   rather than an empty value — so a guessed default would rewrite a storage somebody tuned by\n *   hand, and comparing one would report drift nobody declared.\n *\n * ⚠️ RECONCILE PUTs UNCONDITIONALLY whenever the object exists (group.ts's own reconcile has the\n *   same note), so this form must be safe to re-apply to a storage that already matches. It is:\n *   the declared set and nothing else, and PVE leaves absent parameters alone.\n *\n * ★ KEPT HYPHENATED (`'prune-backups'`, PVE's own wire name), NOT DISTILLED'S UNDERSCORED\n *   `prune_backups` — this form is what `guardWrite` checks (storage.ts), and the generated\n *   vendor-constraint table is keyed by PVE's own names (`underscored`'s own header has the\n *   measured evidence). `toDistilledCreate`/`toDistilledUpdate` translate a COPY for the actual\n *   SDK call; this function and its callers never see the underscored form.\n *\n * ⛔ `shared` IS GATED BY TYPE — `sharedAccepted` (storage-plugin-options.ts, vendor-cited): most\n *   plugins refuse it outright (\"unexpected property 'shared'\", the measured bug this gate\n *   fixes), so it is dropped here regardless of what the caller passed, for both create and\n *   update alike — `type` is always required precisely so this gate can run on the FULL declared\n *   set at create time too, not only on a partial update diff.\n */\nconst mutable = (type: string, props: MutableFields) => ({\n  ...field('comment', props.comment),\n  ...field('content', props.content),\n  ...field('disable', flag(props.disable)),\n  ...field('nodes', props.nodes),\n  ...field('preallocation', props.preallocation),\n  ...field('prune-backups', props['prune-backups']),\n  ...(sharedAccepted(type) ? field('shared', flag(props.shared)) : {}),\n});\n\n/**\n * ⚠️ THE BAG IS SPREAD FIRST SO NOTHING IN IT CAN SHADOW A FIELD THIS RESOURCE MANAGES. A stray\n *   `storage` or `type` in a locator would otherwise rename the object being created, and PVE\n *   would build the wrong thing under a name Alchemy then records as the declared one.\n * ★ HYPHENATED, THE WIRE SHAPE — `guardWrite` (storage.ts) checks this form directly; see\n *   `underscored`'s header for why translating it here would blind that check.\n */\nexport const createForm = (props: StorageProps): Record<string, string> => ({\n  ...locatorForm(props.locator),\n  ...mutable(props.type, props),\n  storage: props.storage,\n  type: props.type,\n});\n\n/**\n * ⚠️ `type` AND THE LOCATOR ARE NEVER SENT ON UPDATE — PVE's PUT refuses the create-only fields\n *   (`PutStorageRequest` has no `type`, and the plugin locator fields it does carry are for a\n *   different purpose: moving an existing volume, not re-pointing the definition), and comparing\n *   either could only plan an update that no write can apply: a plan that reports work forever.\n *\n * ★ PARTIAL ON A KNOWN LIVE OBJECT — THE FIX FOR THE MEASURED BUG. `live === undefined` means\n *   there is no live row to diff against yet (`diff()`'s own early sanity check, run before any\n *   read; and the \"about to create\" branch in `reconcile()`) and this returns the FULL declared\n *   set, same as before this change. Once `live` is a real read, only `changedProps`\n *   (storage-wire.ts) — the declared fields that actually differ from what PVE just reported —\n *   reach the wire. Before this, `reconcile` PUT the full declared set whenever ANYTHING\n *   differed, so a declared `shared` that already MATCHED live still rode along on every update;\n *   for `storage-cephfs-tb4` (`content` was the only real drift, measured 2026-09-27) that meant\n *   sending `shared` to a plugin whose own `options()` never accepts it (storage-plugin-options.ts\n *   has the vendor citation), and PVE answered `unexpected property 'shared'`.\n */\nexport const updateForm = (\n  props: StorageProps,\n  live: StorageAttributes | undefined,\n): Record<string, string> => ({\n  ...mutable(props.type, live === undefined ? props : changedProps(live, props)),\n  storage: props.storage,\n});\n\n/**\n * The actual `createStorage` call body — `createForm`, translated once. See `underscored`.\n * ⚠️ `as unknown as` — same load-bearing cast as `locatorForm`'s own ⚠️: a plain\n *   `Record<string,string>` does not structurally overlap a named-field interface enough for\n *   TypeScript to accept a direct cast, even though every field it carries fits one of the\n *   interface's own (all-optional-but-two) properties.\n */\nexport const toDistilledCreate = (props: StorageProps): storage.CreateStorageRequest =>\n  underscored(createForm(props)) as unknown as storage.CreateStorageRequest;\n\n/**\n * The actual `putStorage` call body — translated once. See `toDistilledCreate`.\n * ⚠️ TAKES THE ALREADY-BUILT FORM, NOT `props`+`live` — storage.ts's `reconcile` computes\n *   `updateForm(news, before)` exactly ONCE and passes that SAME object here and to `guardWrite`,\n *   so the vendor-constraint check and the wire body can never diverge. Two independent calls to\n *   `updateForm`, each running its own `changedProps`, would still agree today, but \"the guard\n *   checks what is actually sent\" (the house rule this fix follows) should not depend on that.\n */\nexport const toDistilledUpdate = (form: Record<string, string>): storage.PutStorageRequest =>\n  underscored(form) as unknown as storage.PutStorageRequest;\n",
-    "/**\n * `Proxmox.ZfsPool` — a zpool built on one node's physical disks, declared.\n *\n * ⛔ A CREATE HERE WIPES THE DISKS IT IS GIVEN AND THERE IS NO UNDO. `POST /nodes/{node}/disks/zfs`\n *   runs `zpool create` on the block devices named in `devices`; whatever was on them is gone the\n *   moment the worker runs. Every other decision in this file follows from that one sentence, and\n *   each of them is written out below rather than left to be inferred.\n *\n * ⛔ ★ CORRECTED 2026-09-23 — THIS PARAGRAPH PREVIOUSLY SAID \"DESTROY IS REFUSED\" AND \"`delete`\n *   MAKES NO API CALL\". THAT WAS FALSE: MEASURED against this file's own `handlers.delete` below,\n *   which calls `destroyPool`, which sends `DELETE /nodes/{node}/disks/zfs/{name}` — the node's\n *   own source forks `zfsremove`, which runs `zpool destroy <name>` unconditionally, and with\n *   `cleanup-disks` then calls `wipe_blockdev` on every member (neither flag is offered as a prop,\n *   because there is no call here for them to reach). `delete` is FULLY IMPLEMENTED, per S14\n *   (alchemy-provider-standard): a `delete` that silently does nothing lies to whoever reads the\n *   plan. What actually keeps an ordinary removed declaration from reaching it is\n *   `defaultRemovalPolicy: 'retain'` below — Alchemy SKIPS `provider.delete` entirely for an\n *   orphaned or destroyed resource under `retain`, so the state row drops and the zpool and its\n *   data are left exactly where they are. The asymmetry is still the whole argument: an ORPHANED\n *   pool is recoverable (declare it again, or destroy it by hand once a human has looked at which\n *   disks are in it), a DESTROYED pool is not — which is why `retain` is the default rather than a\n *   documented caution, and why `delete` runs only for a caller who opts in by name with\n *   `.pipe(RemovalPolicy.destroy())`. See the ★ on `defaultRemovalPolicy` in resource-spec.ts, and\n *   zfs-pool-adopt.test.ts's mutation row, which pins exactly one DELETE reaching the fake cluster.\n *\n * ⛔ THERE IS NO PUT ON THIS FAMILY AT ALL. MEASURED from the cluster's own published schema\n *   (`/usr/share/pve-docs/api-viewer/apidoc.js`, read on node-b 2026-09-13): `/nodes/{node}/disks/zfs`\n *   has GET and POST, `/nodes/{node}/disks/zfs/{name}` has GET and DELETE, and that is the whole\n *   surface — CONFIRMED again in `@distilled.cloud/proxmox`'s generated `nodes.ts`, which declares\n *   no `putNodeDiskZfs` at all. So `matches` (zfs-pool-wire.ts) always answers `true`: there is\n *   nothing to plan a replace over, and the family's one write is the create below.\n *\n * ⛔ NOT ONE CREATE PARAMETER COMES BACK ON READ, SO `matches` COMPARES NOTHING. MEASURED against\n *   the live cluster: `GET /nodes/n2/disks/zfs/rpool` answers exactly\n *   `{action?, children, errors, name, scan?, state, status?}` — no `ashift`, no `compression`, no\n *   `raidlevel`, no `devices`, no `add_storage`. Every create parameter is write-only. There is\n *   therefore no field a declaration and a live pool can both be asked about, and a `matches` that\n *   invented one would plan a replace — i.e. a `zpool destroy` — over a difference it could never\n *   verify in the first place.\n *\n * ⚠️ AND WHAT THE INDEX RETURNS IS LIVE TELEMETRY, NOT CONFIGURATION. `GET /nodes/node-b/disks/zfs`\n *   gives `alloc`, `free`, `frag`, `dedup`, `size`, `health`. MEASURED: two reads of node-b seconds\n *   apart returned `alloc` 14474944512 then 14472740864 — it moves on its own, with no declaration\n *   anywhere near it. `scan` in the detail read moves the same way (it carries the last scrub), and\n *   `status`/`action` appear and vanish as ZFS feature flags and faults come and go. None of them\n *   is compared, and the three churning strings are kept out of the state store entirely rather\n *   than rewriting this resource's row every time somebody writes a file.\n *\n * ⛔ A MISSING POOL IS A 500, NOT A 404 — MEASURED against the live cluster (TB4 n2, 2026-09-24,\n *   read-role, read-only probe): `GET /nodes/n2/disks/zfs/hf-measure-nonexistent-pool` answers a\n *   generic shelled-out command failure at HTTP 500, the same shape as every other family this\n *   package has migrated. `zfs-pool-wire.ts` carries the same dual-path read PR 239/243\n *   established: `readPoolOrFail` (non-folding, used by `diff`) and `readPool` (folding, used by\n *   `createPool`'s settle-poll and by `read`/`reconcile`).\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveOperations` ONTO `@distilled.cloud/proxmox`'s\n *   typed `nodes.getNodeDiskZfs`/`createNodeDiskZfs`/`deleteNodeDiskZfs` (2026-09-24, decision\n *   43's proxmox walk-down, nodes/storage sub-area). `distilled-pve.ts`'s `runPve` replaces\n *   `pve()`; the cries-wolf fix is wired the same way as every other migrated family. `reconcile`\n *   and `delete` are still hand-written (never the factory) for the SAME two reasons as before the\n *   migration — the forked-worker settle-poll, and a DELETE that destroys data — now calling\n *   `zfs-pool-form.ts`'s `createPool`/`destroyPool` directly instead of through `pveHandlers`.\n *\n * ⚠️ PRIVILEGES, FROM THE SCHEMA. Read and diff need `Sys.Audit` on `/` — both GETs check it.\n *   Reconcile needs `Sys.Modify` on `/` for the POST. `Datastore.Allocate` on `/storage` is NOT\n *   needed, because `add_storage` is not offered — see the ⛔ on `ZfsPoolProps`.\n *   ★ CORRECTED 2026-09-23, ALONGSIDE THE HEADER ABOVE: `delete` needs `Sys.Modify` on `/` too,\n *   for the DELETE it now sends under `.pipe(RemovalPolicy.destroy())` — the whole `disks/zfs`\n *   family checks it, not only the POST. MEASURED the same day as the rest of this paragraph:\n *   `ceph-osd.ts`'s own privilege comparison names `disks/zfs` as one of the sibling families\n *   whose write verbs DO carry a `Sys.Modify` check, unlike `ceph/osd`'s create and delete, which\n *   carry no permissions block at all and 403 for any identity but `root@pam`.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { asForm } from './distilled-guard.ts';\nimport { guardForm } from './constraint-guard.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { UNREADABLE, unreadableWarning } from './unreadable-read.ts';\nimport { dropUnreadable, readPool, readPoolOrFail } from './zfs-pool-wire.ts';\nimport type { ZfsPoolAttributes } from './zfs-pool-wire.ts';\nimport { createForm, createPool, destroyPool, zfsPoolCreateEndpoint } from './zfs-pool-form.ts';\nimport type { ZfsCompression, ZfsRaidLevel } from './zfs-pool-form.ts';\n\nexport type { ZfsPoolAttributes } from './zfs-pool-wire.ts';\nexport type { ZfsCompression, ZfsRaidLevel } from './zfs-pool-form.ts';\n\n/**\n * ⛔ THERE IS NO `add_storage`, `cleanup-config` OR `cleanup-disks` PROP, AND THAT IS NOT AN\n *   OVERSIGHT. The last two belong to the DELETE this resource refuses to make. `add_storage=1`\n *   would have the POST build a `Proxmox.Storage`-shaped object this resource does not own, cannot\n *   see on any later read, and cannot remove — invisible to every diff forever, and a collision\n *   waiting for the day somebody also declares the storage properly. Declare a `Proxmox.Storage`\n *   with `type: 'zfspool'` and `locator: { pool: <this pool's name> }` instead, reading the `name`\n *   attribute below so Alchemy orders the storage after the pool.\n */\nexport interface ZfsPoolProps extends WithTarget {\n  /**\n   * ⛔ A ZPOOL IS NODE-LOCAL AND THIS IS HALF ITS IDENTITY. Changing it moves nothing: `path` then\n   *   points at a different node, the read answers absent, and reconcile tries to CREATE the pool\n   *   over there — on whatever `/dev/...` happens to answer to those names on that machine.\n   *   Declare a separate resource per node instead.\n   */\n  node: string;\n  /** The zpool name, and PVE's key for it on this node. ⚠️ Changing it creates a SECOND pool. */\n  name: string;\n  /**\n   * The block devices to build it on.\n   *\n   * ⛔ NAME THEM BY `/dev/disk/by-id/...`, NOT `/dev/sdb`. Kernel names are not stable across\n   *   reboots; a by-id link is. MEASURED in the node's source: PVE resolves what it is handed to a\n   *   by-id link only AFTER it has decided the device is free, so a stale `/dev/sdb` in a stack\n   *   file is checked against, and then wiped, whichever disk currently answers to that name.\n   * ⚠️ ORDER IS MEANING FOR `raid10` AND IS PRESERVED — PVE walks the list two at a time and makes\n   *   each pair a mirror. This is why the form uses a plain join and NOT `csv()` from values.ts:\n   *   `csv` sorts, and sorting this list silently re-pairs the mirrors into a different pool.\n   * ⚠️ PVE's only guard is `assert_disk_unused`, i.e. its own `disk_is_used` over the same `used`\n   *   column the Disks view shows. A blank disk it considers free is wiped with no confirmation.\n   *\n   * ⛔ OPTIONAL SINCE DECISION 9 (2026-09-23), AND OMITTING IT MEANS SOMETHING SPECIFIC: leaving\n   *   both this and `raidlevel` undeclared declares an ADOPT-ONLY pool — one this resource may\n   *   read and report but never build. That is the only shape available for a pool PVE's own POST\n   *   schema cannot fully describe, such as n1's `speed`, whose layout is a stripe and whose\n   *   `raidlevel` enum (above) has no stripe to declare. `createForm` (zfs-pool-form.ts) omits\n   *   both keys when they are absent, and `createPool` refuses before any POST if the pool it\n   *   would need to build is not already there — an adopt-only declaration never creates. Declare\n   *   both fields together for a pool this resource should build from scratch; declaring only one\n   *   of the two is refused the same way, since PVE's POST requires both.\n   */\n  devices?: readonly string[];\n  raidlevel?: ZfsRaidLevel;\n  /**\n   * Sector size exponent, 9–16, PVE default 12.\n   *\n   * ⛔ WRITE-ONLY AND IMMUTABLE FOR THE LIFE OF THE POOL. It is consumed by `zpool create -o\n   *   ashift=` and never returned by any read on this family, so changing it later plans as `noop`\n   *   and changes nothing. A different ashift means destroying and rebuilding the pool, by hand,\n   *   with the data moved off first.\n   */\n  ashift?: number;\n  /**\n   * ⚠️ Write-only in the same way as `ashift`: applied by `zfs set compression=` at create time and\n   *   never read back, so a later change plans `noop`. Change it with `zfs set` on the node.\n   */\n  compression?: ZfsCompression;\n  /**\n   * `data=<integer>,spares=<integer>`. ⚠️ THE WIRE NAME IS KEPT, HYPHEN AND ALL, for the reason\n   * `storage.ts` keeps `prune-backups`: a second spelling is a second name for one thing.\n   * ⚠️ PVE refuses it outright unless `raidlevel` is one of the `draid*` levels.\n   */\n  'draid-config'?: string;\n}\n\nexport interface ProxmoxZfsPool extends Resource<\n  'Proxmox.ZfsPool',\n  ZfsPoolProps,\n  ZfsPoolAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a pool holding datasets cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxZfsPool = Resource<ProxmoxZfsPool>('Proxmox.ZfsPool', {\n  defaultRemovalPolicy: 'retain',\n});\n\nexport const ProxmoxZfsPoolProvider = () =>\n  Provider.effect(\n    ProxmoxZfsPool,\n    Effect.succeed(\n      ProxmoxZfsPool.Provider.of({\n        /** ⛔ EMPTY — `GET /nodes/{node}/disks/zfs` returns telemetry for every pool on the node,\n         *   `rpool` included. Adoption stays explicit. */\n        list: () => Effect.succeed([]),\n        // ⚠️ FOLDS ONLY WHEN `output` IS `undefined` — storage.ts's own ⚠️, applied here from the\n        //   start: `output === undefined` (Plan.ts's adoption probe, Apply.ts's delete recovery)\n        //   keeps `readPool`'s fold; `output !== undefined` (Drift.ts's already-confirmed row)\n        //   uses `readPoolOrFail` instead, so `alchemy drift` never reports a transient failure as\n        //   a silent `{action: 'missing'}`.\n        read: Effect.fn(function* ({ olds, output }) {\n          return dropUnreadable(\n            yield* output === undefined ? readPool(olds) : readPoolOrFail(olds),\n          );\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          // ⚠️ `guardForm`, NOT `guardWrite` — the only migrated family whose create-guard is\n          //   CONDITIONAL. `guardWrite`'s own signature requires a real `EndpointKey`, but decision\n          //   9's adopt-only mode needs `undefined` some of the time (`zfsPoolCreateEndpoint`'s own\n          //   header) — `guardForm` (constraint-guard.ts) is the one `distilled-guard.ts`'s\n          //   `guardWrite` itself calls, and it already accepts `EndpointKey | undefined`.\n          yield* guardForm(\n            zfsPoolCreateEndpoint(news),\n            asForm(createForm(news)),\n            output === undefined,\n          );\n          if (output === undefined) return undefined;\n          // ⚠️ `readPoolOrFail`, NOT `readPool` — a genuine TRANSIENT failure here propagates and\n          //   fails the whole plan loudly instead of folding to \"absent\" and forcing a false\n          //   update, the cries-wolf class of bug.\n          const live = yield* readPoolOrFail(news);\n          if (live === UNREADABLE) {\n            yield* unreadableWarning('Proxmox.ZfsPool', `${news.node}/${news.name}`);\n            return { action: 'noop' } as const;\n          }\n          // ⛔ FOUND WRITING THIS FILE, 2026-09-24 — an earlier edit that removed the dead\n          //   `matches()` call (zfs-pool-wire.ts's own ⛔) took this whole branch out with it,\n          //   leaving a genuinely-absent pool planning `noop` unconditionally instead of `update`\n          //   — a silent no-op on a state row Alchemy still holds, caught by\n          //   zfs-pool-adopt.test.ts's own \"an adopted pool that vanishes\" case rejecting the plan\n          //   loudly rather than resolving. Restored before this PR opened.\n          if (live === undefined) {\n            yield* guardForm(zfsPoolCreateEndpoint(news), asForm(createForm(news)), true);\n            return { action: 'update' } as const;\n          }\n          // A live pool means `noop`, unconditionally — `matches` (zfs-pool-wire.ts's own ⛔)\n          // always answers `true`, since every create parameter is write-only: there is nothing a\n          // declaration and a live pool can be compared on, so nothing here can ever be a replace.\n          return { action: 'noop' } as const;\n        }),\n        /**\n         * ⛔ THE ONLY WRITE THIS FAMILY EVER MAKES IS `createPool`'s create — see zfs-pool-form.ts.\n         *   An existing pool is returned exactly as read, unwritten.\n         * ⚠️ `readPool` PIPED THROUGH `dropUnreadable` — `createPool`'s settle-poll treats a\n         *   refused mid-poll credential exactly like \"not found yet\" (its own header), so its own\n         *   `read` parameter is typed `Attributes | undefined`, never `Unreadable`; folding here is\n         *   what keeps that true rather than leaking the sentinel into `reconcile`'s own return\n         *   value, which the engine expects to be real attributes or nothing.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          return yield* createPool(news, (props) =>\n            readPool(props).pipe(Effect.map(dropUnreadable)),\n          );\n        }),\n        delete: Effect.fn(function* ({ olds }) {\n          yield* destroyPool(olds);\n        }),\n      }),\n    ),\n  );\n",
+    "/**\n * `Proxmox.ZfsPool` — a zpool built on one node's physical disks, declared.\n *\n * ⛔ A CREATE HERE WIPES THE DISKS IT IS GIVEN AND THERE IS NO UNDO. `POST /nodes/{node}/disks/zfs`\n *   runs `zpool create` on the block devices named in `devices`; whatever was on them is gone the\n *   moment the worker runs. Every other decision in this file follows from that one sentence, and\n *   each of them is written out below rather than left to be inferred.\n *\n * ⛔ ★ CORRECTED 2026-09-23 — THIS PARAGRAPH PREVIOUSLY SAID \"DESTROY IS REFUSED\" AND \"`delete`\n *   MAKES NO API CALL\". THAT WAS FALSE: MEASURED against this file's own `handlers.delete` below,\n *   which calls `destroyPool`, which sends `DELETE /nodes/{node}/disks/zfs/{name}` — the node's\n *   own source forks `zfsremove`, which runs `zpool destroy <name>` unconditionally, and with\n *   `cleanup-disks` then calls `wipe_blockdev` on every member (neither flag is offered as a prop,\n *   because there is no call here for them to reach). `delete` is FULLY IMPLEMENTED, per S14\n *   (alchemy-provider-standard): a `delete` that silently does nothing lies to whoever reads the\n *   plan. What actually keeps an ordinary removed declaration from reaching it is\n *   `defaultRemovalPolicy: 'retain'` below — Alchemy SKIPS `provider.delete` entirely for an\n *   orphaned or destroyed resource under `retain`, so the state row drops and the zpool and its\n *   data are left exactly where they are. The asymmetry is still the whole argument: an ORPHANED\n *   pool is recoverable (declare it again, or destroy it by hand once a human has looked at which\n *   disks are in it), a DESTROYED pool is not — which is why `retain` is the default rather than a\n *   documented caution, and why `delete` runs only for a caller who opts in by name with\n *   `.pipe(RemovalPolicy.destroy())`. See the ★ on `defaultRemovalPolicy` in resource-spec.ts, and\n *   zfs-pool-adopt.test.ts's mutation row, which pins exactly one DELETE reaching the fake cluster.\n *\n * ⛔ THERE IS NO PUT ON THIS FAMILY AT ALL. MEASURED from the cluster's own published schema\n *   (`/usr/share/pve-docs/api-viewer/apidoc.js`, read on node-b 2026-09-13): `/nodes/{node}/disks/zfs`\n *   has GET and POST, `/nodes/{node}/disks/zfs/{name}` has GET and DELETE, and that is the whole\n *   surface — CONFIRMED again in `@distilled.cloud/proxmox`'s generated `nodes.ts`, which declares\n *   no `putNodeDiskZfs` at all. So `matches` (zfs-pool-wire.ts) always answers `true`: there is\n *   nothing to plan a replace over, and the family's one write is the create below.\n *\n * ⛔ NOT ONE CREATE PARAMETER COMES BACK ON READ, SO `matches` COMPARES NOTHING. MEASURED against\n *   the live cluster: `GET /nodes/n2/disks/zfs/rpool` answers exactly\n *   `{action?, children, errors, name, scan?, state, status?}` — no `ashift`, no `compression`, no\n *   `raidlevel`, no `devices`, no `add_storage`. Every create parameter is write-only. There is\n *   therefore no field a declaration and a live pool can both be asked about, and a `matches` that\n *   invented one would plan a replace — i.e. a `zpool destroy` — over a difference it could never\n *   verify in the first place.\n *\n * ⚠️ AND WHAT THE INDEX RETURNS IS LIVE TELEMETRY, NOT CONFIGURATION. `GET /nodes/node-b/disks/zfs`\n *   gives `alloc`, `free`, `frag`, `dedup`, `size`, `health`. MEASURED: two reads of node-b seconds\n *   apart returned `alloc` 14474944512 then 14472740864 — it moves on its own, with no declaration\n *   anywhere near it. `scan` in the detail read moves the same way (it carries the last scrub), and\n *   `status`/`action` appear and vanish as ZFS feature flags and faults come and go. None of them\n *   is compared, and the three churning strings are kept out of the state store entirely rather\n *   than rewriting this resource's row every time somebody writes a file.\n *\n * ⛔ A MISSING POOL IS A 500, NOT A 404 — MEASURED against the live cluster (TB4 n2, 2026-09-24,\n *   read-role, read-only probe): `GET /nodes/n2/disks/zfs/hf-measure-nonexistent-pool` answers a\n *   generic shelled-out command failure at HTTP 500, the same shape as every other family this\n *   package has migrated. `zfs-pool-wire.ts` carries the same dual-path read PR 239/243\n *   established: `readPoolOrFail` (non-folding, used by `diff`) and `readPool` (folding, used by\n *   `createPool`'s settle-poll and by `read`/`reconcile`).\n *\n * ★ MIGRATED OFF `client.ts`'s generic `pve()`/`pveOperations` ONTO `@distilled.cloud/proxmox`'s\n *   typed `nodes.getNodeDiskZfs`/`createNodeDiskZfs`/`deleteNodeDiskZfs` (2026-09-24, decision\n *   43's proxmox walk-down, nodes/storage sub-area). `distilled-pve.ts`'s `runPve` replaces\n *   `pve()`; the cries-wolf fix is wired the same way as every other migrated family. `reconcile`\n *   and `delete` are still hand-written (never the factory) for the SAME two reasons as before the\n *   migration — the forked-worker settle-poll, and a DELETE that destroys data — now calling\n *   `zfs-pool-form.ts`'s `createPool`/`destroyPool` directly instead of through `pveHandlers`.\n *\n * ⚠️ PRIVILEGES, FROM THE SCHEMA. Read and diff need `Sys.Audit` on `/` — both GETs check it.\n *   Reconcile needs `Sys.Modify` on `/` for the POST. `Datastore.Allocate` on `/storage` is NOT\n *   needed, because `add_storage` is not offered — see the ⛔ on `ZfsPoolProps`.\n *   ★ CORRECTED 2026-09-23, ALONGSIDE THE HEADER ABOVE: `delete` needs `Sys.Modify` on `/` too,\n *   for the DELETE it now sends under `.pipe(RemovalPolicy.destroy())` — the whole `disks/zfs`\n *   family checks it, not only the POST. MEASURED the same day as the rest of this paragraph:\n *   `ceph-osd.ts`'s own privilege comparison names `disks/zfs` as one of the sibling families\n *   whose write verbs DO carry a `Sys.Modify` check, unlike `ceph/osd`'s create and delete, which\n *   carry no permissions block at all and 403 for any identity but `root@pam`.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { asForm } from './distilled-guard.ts';\nimport { guardForm } from './constraint-guard.ts';\nimport type { PveRequirements, WithTarget } from './resource-spec.ts';\nimport { mintTier } from './credentials.ts';\nimport { UNREADABLE, unreadableWarning } from './unreadable-read.ts';\nimport { dropUnreadable, readPool, readPoolOrFail } from './zfs-pool-wire.ts';\nimport type { ZfsPoolAttributes } from './zfs-pool-wire.ts';\nimport { createForm, createPool, destroyPool, zfsPoolCreateEndpoint } from './zfs-pool-form.ts';\nimport type { ZfsCompression, ZfsRaidLevel } from './zfs-pool-form.ts';\n\nexport type { ZfsPoolAttributes } from './zfs-pool-wire.ts';\nexport type { ZfsCompression, ZfsRaidLevel } from './zfs-pool-form.ts';\n\n/**\n * ⛔ THERE IS NO `add_storage`, `cleanup-config` OR `cleanup-disks` PROP, AND THAT IS NOT AN\n *   OVERSIGHT. The last two belong to the DELETE this resource refuses to make. `add_storage=1`\n *   would have the POST build a `Proxmox.Storage`-shaped object this resource does not own, cannot\n *   see on any later read, and cannot remove — invisible to every diff forever, and a collision\n *   waiting for the day somebody also declares the storage properly. Declare a `Proxmox.Storage`\n *   with `type: 'zfspool'` and `locator: { pool: <this pool's name> }` instead, reading the `name`\n *   attribute below so Alchemy orders the storage after the pool.\n */\nexport interface ZfsPoolProps extends WithTarget {\n  /**\n   * ⛔ A ZPOOL IS NODE-LOCAL AND THIS IS HALF ITS IDENTITY. Changing it moves nothing: `path` then\n   *   points at a different node, the read answers absent, and reconcile tries to CREATE the pool\n   *   over there — on whatever `/dev/...` happens to answer to those names on that machine.\n   *   Declare a separate resource per node instead.\n   */\n  node: string;\n  /** The zpool name, and PVE's key for it on this node. ⚠️ Changing it creates a SECOND pool. */\n  name: string;\n  /**\n   * The block devices to build it on.\n   *\n   * ⛔ NAME THEM BY `/dev/disk/by-id/...`, NOT `/dev/sdb`. Kernel names are not stable across\n   *   reboots; a by-id link is. MEASURED in the node's source: PVE resolves what it is handed to a\n   *   by-id link only AFTER it has decided the device is free, so a stale `/dev/sdb` in a stack\n   *   file is checked against, and then wiped, whichever disk currently answers to that name.\n   * ⚠️ ORDER IS MEANING FOR `raid10` AND IS PRESERVED — PVE walks the list two at a time and makes\n   *   each pair a mirror. This is why the form uses a plain join and NOT `csv()` from values.ts:\n   *   `csv` sorts, and sorting this list silently re-pairs the mirrors into a different pool.\n   * ⚠️ PVE's only guard is `assert_disk_unused`, i.e. its own `disk_is_used` over the same `used`\n   *   column the Disks view shows. A blank disk it considers free is wiped with no confirmation.\n   *\n   * ⛔ OPTIONAL SINCE DECISION 9 (2026-09-23), AND OMITTING IT MEANS SOMETHING SPECIFIC: leaving\n   *   both this and `raidlevel` undeclared declares an ADOPT-ONLY pool — one this resource may\n   *   read and report but never build. That is the only shape available for a pool PVE's own POST\n   *   schema cannot fully describe, such as n1's `speed`, whose layout is a stripe and whose\n   *   `raidlevel` enum (above) has no stripe to declare. `createForm` (zfs-pool-form.ts) omits\n   *   both keys when they are absent, and `createPool` refuses before any POST if the pool it\n   *   would need to build is not already there — an adopt-only declaration never creates. Declare\n   *   both fields together for a pool this resource should build from scratch; declaring only one\n   *   of the two is refused the same way, since PVE's POST requires both.\n   */\n  devices?: readonly string[];\n  raidlevel?: ZfsRaidLevel;\n  /**\n   * Sector size exponent, 9–16, PVE default 12.\n   *\n   * ⛔ WRITE-ONLY AND IMMUTABLE FOR THE LIFE OF THE POOL. It is consumed by `zpool create -o\n   *   ashift=` and never returned by any read on this family, so changing it later plans as `noop`\n   *   and changes nothing. A different ashift means destroying and rebuilding the pool, by hand,\n   *   with the data moved off first.\n   */\n  ashift?: number;\n  /**\n   * ⚠️ Write-only in the same way as `ashift`: applied by `zfs set compression=` at create time and\n   *   never read back, so a later change plans `noop`. Change it with `zfs set` on the node.\n   */\n  compression?: ZfsCompression;\n  /**\n   * `data=<integer>,spares=<integer>`. ⚠️ THE WIRE NAME IS KEPT, HYPHEN AND ALL, for the reason\n   * `storage.ts` keeps `prune-backups`: a second spelling is a second name for one thing.\n   * ⚠️ PVE refuses it outright unless `raidlevel` is one of the `draid*` levels.\n   */\n  'draid-config'?: string;\n}\n\nexport interface ProxmoxZfsPool extends Resource<\n  'Proxmox.ZfsPool',\n  ZfsPoolProps,\n  ZfsPoolAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a pool holding datasets cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxZfsPool = Resource<ProxmoxZfsPool>('Proxmox.ZfsPool', {\n  defaultRemovalPolicy: 'retain',\n});\n\nexport const ProxmoxZfsPoolProvider = () =>\n  Provider.effect(\n    ProxmoxZfsPool,\n    Effect.succeed(\n      ProxmoxZfsPool.Provider.of({\n        /** ⛔ EMPTY — `GET /nodes/{node}/disks/zfs` returns telemetry for every pool on the node,\n         *   `rpool` included. Adoption stays explicit. */\n        list: () => Effect.succeed([]),\n        // ⚠️ FOLDS ONLY WHEN `output` IS `undefined` — storage.ts's own ⚠️, applied here from the\n        //   start: `output === undefined` (Plan.ts's adoption probe, Apply.ts's delete recovery)\n        //   keeps `readPool`'s fold; `output !== undefined` (Drift.ts's already-confirmed row)\n        //   uses `readPoolOrFail` instead, so `alchemy drift` never reports a transient failure as\n        //   a silent `{action: 'missing'}`.\n        read: Effect.fn(function* ({ olds, output }) {\n          return dropUnreadable(\n            yield* output === undefined ? readPool(olds) : readPoolOrFail(olds),\n          );\n        }),\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          // ⚠️ `guardForm`, NOT `guardWrite` — the only migrated family whose create-guard is\n          //   CONDITIONAL. `guardWrite`'s own signature requires a real `EndpointKey`, but decision\n          //   9's adopt-only mode needs `undefined` some of the time (`zfsPoolCreateEndpoint`'s own\n          //   header) — `guardForm` (constraint-guard.ts) is the one `distilled-guard.ts`'s\n          //   `guardWrite` itself calls, and it already accepts `EndpointKey | undefined`.\n          yield* guardForm(\n            zfsPoolCreateEndpoint(news),\n            asForm(createForm(news)),\n            output === undefined,\n          );\n          if (output === undefined) return undefined;\n          // ⚠️ `readPoolOrFail`, NOT `readPool` — a genuine TRANSIENT failure here propagates and\n          //   fails the whole plan loudly instead of folding to \"absent\" and forcing a false\n          //   update, the cries-wolf class of bug.\n          const live = yield* readPoolOrFail(news);\n          if (live === UNREADABLE) {\n            yield* unreadableWarning(\n              'Proxmox.ZfsPool',\n              `${news.node}/${news.name}`,\n              news.target.mount,\n              mintTier(news.target, 'read'),\n            );\n            return { action: 'noop' } as const;\n          }\n          // ⛔ FOUND WRITING THIS FILE, 2026-09-24 — an earlier edit that removed the dead\n          //   `matches()` call (zfs-pool-wire.ts's own ⛔) took this whole branch out with it,\n          //   leaving a genuinely-absent pool planning `noop` unconditionally instead of `update`\n          //   — a silent no-op on a state row Alchemy still holds, caught by\n          //   zfs-pool-adopt.test.ts's own \"an adopted pool that vanishes\" case rejecting the plan\n          //   loudly rather than resolving. Restored before this PR opened.\n          if (live === undefined) {\n            yield* guardForm(zfsPoolCreateEndpoint(news), asForm(createForm(news)), true);\n            return { action: 'update' } as const;\n          }\n          // A live pool means `noop`, unconditionally — `matches` (zfs-pool-wire.ts's own ⛔)\n          // always answers `true`, since every create parameter is write-only: there is nothing a\n          // declaration and a live pool can be compared on, so nothing here can ever be a replace.\n          return { action: 'noop' } as const;\n        }),\n        /**\n         * ⛔ THE ONLY WRITE THIS FAMILY EVER MAKES IS `createPool`'s create — see zfs-pool-form.ts.\n         *   An existing pool is returned exactly as read, unwritten.\n         * ⚠️ `readPool` PIPED THROUGH `dropUnreadable` — `createPool`'s settle-poll treats a\n         *   refused mid-poll credential exactly like \"not found yet\" (its own header), so its own\n         *   `read` parameter is typed `Attributes | undefined`, never `Unreadable`; folding here is\n         *   what keeps that true rather than leaking the sentinel into `reconcile`'s own return\n         *   value, which the engine expects to be real attributes or nothing.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          return yield* createPool(news, (props) =>\n            readPool(props).pipe(Effect.map(dropUnreadable)),\n          );\n        }),\n        delete: Effect.fn(function* ({ olds }) {\n          yield* destroyPool(olds);\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * `Proxmox.ZfsPool`'s READ side: the live-to-attributes shape, the read itself, and `matches`.\n * Split out of zfs-pool.ts (2026-09-24, the distilled migration) — the storage.ts/storage-wire.ts\n * seam; the write side is zfs-pool-form.ts.\n */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport * as Effect from 'effect/Effect';\nimport { runPve } from './distilled-pve.ts';\nimport type { ZfsPoolProps } from './zfs-pool.ts';\nimport { UNREADABLE, type Unreadable, readOrUnreadable } from './unreadable-read.ts';\nimport { text } from './values.ts';\n\n/**\n * ⚠️ EVERYTHING HERE IS REPORTED, NOTHING HERE IS COMPARED — see the ⛔ on `matches` below. These\n *   exist so a plan and the state store can say what the pool actually is, on a family where the\n *   declaration and the live object share no comparable field at all.\n */\nexport interface ZfsPoolAttributes {\n  /** ★ The value a `Proxmox.Storage` should read to order itself after this pool. */\n  name: string;\n  node: string;\n  /** `ONLINE` | `DEGRADED` | `FAULTED` | … Health, not configuration. */\n  state: string;\n  /** ZFS's own error summary, e.g. `No known data errors`. */\n  errors: string;\n  /**\n   * The leaf devices ZFS reports, in vdev order, comma-joined.\n   *\n   * ⚠️ THIS IS WHAT ZFS RESOLVED, NOT WHAT WAS DECLARED, and the two normally differ: PVE rewrites\n   *   a `/dev/sdb` into a by-id link before creating, and ZFS reports partition paths (`…-part3`)\n   *   for a pool built on partitions — MEASURED, that is exactly what node-b's `rpool` reports.\n   *   Never compare it with `props.devices`.\n   */\n  devices: string;\n}\n\n/**\n * The device paths at the bottom of PVE's vdev tree, in the order ZFS reports them.\n *\n * ⚠️ \"NO CHILDREN\" IS THE LEAF TEST, AND IT IS NOT A GUESS — MEASURED in the node's `preparetree`,\n *   which sets `leaf` to 0 when there are children and 1 otherwise. Reading the flag would work\n *   equally well; recursing on `children` needs no second field to be present and is what makes\n *   nested sections (mirrors inside a raid10, `spares`, `cache`) flatten correctly.\n */\nexport const leafDevices = (children: unknown): string[] =>\n  Array.isArray(children)\n    ? children.flatMap((entry: unknown) => {\n        const vdev = entry as { children?: unknown; name?: unknown };\n        const nested = leafDevices(vdev.children);\n        return nested.length > 0 ? nested : [text(vdev.name)].filter((name) => name !== '');\n      })\n    : [];\n\n/**\n * ⚠️ `scan`, `status` AND `action` ARE DELIBERATELY NOT ATTRIBUTES. All three are advisory strings\n *   ZFS rewrites on its own — `scan` on every scrub, the other two as feature flags and faults come\n *   and go — so keeping them would rewrite this resource's state row for reasons no declaration\n *   caused. Same reasoning as `digest` in storage.ts.\n */\nconst attributesOf = (\n  live: nodes.GetNodeDiskZfsResponse,\n  props: ZfsPoolProps,\n): ZfsPoolAttributes => ({\n  devices: leafDevices(live.children).join(','),\n  errors: text(live.errors, 'unknown'),\n  name: props.name,\n  node: props.node,\n  state: text(live.state, 'unknown'),\n});\n\n/**\n * ★ Default `read` role — `Sys.Audit` on `/` is all this GET checks (zfs-pool.ts's header).\n * ⛔ `{ node: props.node, name: props.name }`, NEVER THE WHOLE `props` — storage.ts's/user.ts's own\n *   ⛔, the kit 0.31.1 regression: `GetNodeDiskZfsRequest`'s schema declares only `node` and `name`\n *   (both path labels); any OTHER key on the object passed to `nodes.getNodeDiskZfs` is treated by\n *   distilled's `buildRequest` as an \"unknown key\" and JSON-encoded onto this bodyless GET, which a\n *   stricter fetch client refuses outright.\n * ⛔ A MISSING POOL IS A 500, NOT A 404 — MEASURED against the live cluster (TB4 n2, 2026-09-24,\n *   read-role, read-only probe): `GET /nodes/n2/disks/zfs/hf-measure-nonexistent-pool` answers\n *   `{\"message\":\"command '/sbin/zpool status -P hf-measure-nonexistent-pool' failed: exit code\n *   1\\n\",\"data\":null}` at HTTP 500 — PVE shells out to `zpool status` and reports its exit code\n *   as a generic command failure, not a typed \"not found\". The same shape as user.ts's/group.ts's/\n *   storage.ts's own measured 500s. `readPool` below (used by `createPool`'s settle-poll and by\n *   `reconcile`/`read`) still folds it, exactly as `readUser`/`readGroup`/`readStorage` do — the\n *   whole reason `createPool` can tell \"not built yet\" from \"forbidden\" only by giving up after\n *   `SETTLE_ATTEMPTS` (zfs-pool-form.ts's own ⚠️ on that); `readPoolOrFail` (used by `diff`) does\n *   not fold it, so a genuine transient failure there propagates and fails the plan loudly instead.\n */\nexport const readPoolOrFail = (props: ZfsPoolProps) =>\n  readOrUnreadable(\n    runPve(\n      props.target,\n      'read',\n      false,\n      nodes.getNodeDiskZfs({ name: props.name, node: props.node }),\n    ),\n  ).pipe(\n    Effect.map((live) => {\n      if (live === UNREADABLE) return UNREADABLE;\n      // ⚠️ A detail answer with no `name` is not a pool — same shape check zfs-pool-spec.ts made,\n      //   kept as a defensive fallback now that the 500 above is the measured absence signal.\n      return text(live.name) === '' ? undefined : attributesOf(live, props);\n    }),\n  );\n\n/**\n * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `createPool`'s settle-poll AND\n *   `read`/`reconcile` MAY USE IT — user.ts's `readUser` has the full reasoning. Safe here because\n *   a wrongful fold during create costs at most a redundant `createNodeDiskZfs` POST, which PVE\n *   refuses loudly (\"pool already exists\") rather than silently corrupting anything — zfs-pool.ts's\n *   own header, measured.\n * ⛔ `zfs-pool.ts`'s `diff` does **NOT** use this — the same bug class as the credential denial fix:\n *   folding a TRANSIENT failure into \"absent\" at PLAN TIME would force a false `update` with\n *   nothing compared. `diff` calls `readPoolOrFail` directly, so a genuine failure there propagates\n *   and fails the whole plan loudly instead.\n */\nexport const readPool = (props: ZfsPoolProps) =>\n  readPoolOrFail(props).pipe(Effect.orElseSucceed(() => undefined));\n\n/** `read`/`reconcile`/`createPool` return `Attributes | undefined`; only `diff` sees `UNREADABLE`. */\nexport const dropUnreadable = (live: ZfsPoolAttributes | Unreadable | undefined) =>\n  live === UNREADABLE ? undefined : live;\n\n/**\n * ⛔ THERE IS NO `matches` FUNCTION HERE — UNLIKE EVERY OTHER MIGRATED FAMILY, AND DELIBERATELY.\n *   Every create parameter on this family is write-only (this file's own `attributesOf`), so\n *   there is nothing a declaration and a live pool can ever be compared on — a `matches` that\n *   invented one would plan a replace (`zpool destroy`, since this family has no PUT) over a\n *   difference it could never verify. `zfs-pool.ts`'s `diff` returns `noop` unconditionally once a\n *   pool is found, rather than calling a function that would only ever return `true` — found by\n *   adversarial review that an earlier draft exported one here anyway, unused by anything.\n */\n",
     "/**\n * The create lane for `Proxmox.ZfsPool`: the form PVE wants, and the wait for the worker it forks.\n * Split out of zfs-pool.ts (2026-09-24, the distilled migration) — same seam as before, now naming\n * the write side the way storage.ts/storage-form.ts does.\n *\n * ⚠️ `createPool` TAKES THE READ AS A PARAMETER, GENERIC IN ITS ERROR AND REQUIREMENT CHANNELS,\n *   rather than importing the read module and coupling to its exact effect shape here. This file\n *   answers \"how does a declaration become a pool on disks\"; zfs-pool-wire.ts answers \"what is a\n *   zpool, and when has it changed\" — the caller (zfs-pool.ts) is what ties the two together, so\n *   this file cannot accidentally read the cluster differently from `diff`.\n */\nimport * as Effect from 'effect/Effect';\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport { asForm } from './distilled-guard.ts';\nimport { guardForm } from './constraint-guard.ts';\nimport { runPve } from './distilled-pve.ts';\nimport { text } from './values.ts';\nimport type { ZfsPoolAttributes, ZfsPoolProps } from './zfs-pool.ts';\nimport type { NodesNodeDisksZfsPostParams } from './generated/pve.ts';\n\nexport const ZFS_POOL_CREATE = 'pve:POST /nodes/{node}/disks/zfs';\n\n/**\n * PVE's layouts, generated (2026-09-23) from `NodesNodeDisksZfsPostParams['raidlevel']`\n * (`generated/pve.ts`, manifest `pve-apidoc` pve-manager 9.2.11 sha256 9def8f13…) rather than\n * hand-typed, per decision 9. ⚠️ Each has a minimum disk count PVE enforces, and `raid10` needs an\n * even one. ⛔ THERE IS NO `stripe` IN THIS ENUM. n1's `speed` pool is one (decision 14 accepts it\n * as-is): `ZfsPoolProps` (zfs-pool.ts) is why a stripe pool is declarable at all — as an\n * ADOPT-ONLY declaration with no `raidlevel`, never as a full one.\n */\nexport type ZfsRaidLevel = NonNullable<NodesNodeDisksZfsPostParams['raidlevel']>;\n\n/** Generated the same way, from `NodesNodeDisksZfsPostParams['compression']`. */\nexport type ZfsCompression = NonNullable<NodesNodeDisksZfsPostParams['compression']>;\n\n/**\n * ★ CHECKED AGAINST THE VENDOR TABLE ONLY FOR A FULL DECLARATION — decision 9's adopt-only mode.\n *   `guardCreate` (distilled-guard.ts's `guardWrite`) runs on the FIRST plan of ANY declaration and\n *   checks the create form's REQUIRED fields whenever this resolves to the real endpoint key — and\n *   PVE marks both `devices` and `raidlevel` required (codegen/constraints's `pve-nodes-disks`\n *   row). An adopt-only declaration deliberately omits both, so checking it would refuse a MATCHING\n *   adoption at plan time, before `read` ever ran. Returning `undefined` (no key) makes the guard a\n *   no-op for an adopt-only declaration, while a FULL one (`devices` and `raidlevel` both present)\n *   is checked exactly as before — zfs-pool.ts's `diff` passes this as the `guardWrite` endpoint.\n * ⚠️ THE RUNTIME BACKSTOP IS `createPool` BELOW, NOT THIS FUNCTION. Skipping the plan-time guard\n *   for an adopt-only declaration does not skip the check that the pool is actually there —\n *   `createPool` refuses before any POST when the read comes back absent and either field is\n *   undefined, which is what a genuinely absent adopt-only declaration hits at apply time.\n */\nexport const zfsPoolCreateEndpoint = (props: ZfsPoolProps) =>\n  props.devices === undefined || props.raidlevel === undefined ? undefined : ZFS_POOL_CREATE;\n\n/**\n * The wire form, PVE's own field names — what `guardWrite` (zfs-pool.ts) checks.\n *\n * ⚠️ `devices` IS JOINED IN DECLARED ORDER AND NOT PUT THROUGH `csv()` FROM values.ts. `csv` sorts,\n *   and PVE walks this list two at a time to pair `raid10` mirrors — MEASURED in the node's own\n *   `PVE::API2::Disks::ZFS` — so sorting it builds a different pool from the one declared. The list\n *   is never compared against anything, so it needs no normalisation, only faithful order.\n * ⚠️ AN OMITTED OPTIONAL IS NOT SENT. PVE's own defaults (ashift 12, compression on) are then\n *   applied by the node. Sending a guessed default would be indistinguishable here — the values\n *   are unreadable afterwards either way — but it would put a number in the request that no\n *   declaration asked for, and this is the one call that writes to physical disks.\n * ⚠️ `node` IS NOT IN THE FORM: it is the `nodes/{node}` path label, and a second copy could only\n *   disagree with it.\n * ⚠️ EVERY KEY IS OMITTED WHEN ABSENT, `devices` AND `raidlevel` INCLUDED — not just the optional\n *   ones. An adopt-only declaration (both undefined, decision 9) must produce a form `createPool`'s\n *   own guard can inspect for their absence, and one this function itself does not throw building.\n */\nexport const createForm = (props: ZfsPoolProps): Record<string, string> => ({\n  ...(props.devices === undefined ? {} : { devices: props.devices.join(',') }),\n  name: props.name,\n  ...(props.raidlevel === undefined ? {} : { raidlevel: props.raidlevel }),\n  ...(props.ashift === undefined ? {} : { ashift: String(props.ashift) }),\n  ...(props.compression === undefined ? {} : { compression: props.compression }),\n  ...(props['draid-config'] === undefined ? {} : { 'draid-config': props['draid-config'] }),\n});\n\n/**\n * The actual `createNodeDiskZfs` call body — `createForm` plus the `node` label, `draid-config`\n * renamed to distilled's `draid_config` (`T.Body(\"draid-config\")` on the generated schema; the\n * ONE hyphenated field this family's create form carries — storage-form.ts's `underscored` has\n * the fuller measurement, not repeated here for one field).\n *\n * ⚠️ `as unknown as` — `devices`/`raidlevel` are REQUIRED in distilled's generated\n *   `CreateNodeDiskZfsRequest`, so an adopt-only form (both omitted) cannot satisfy it structurally\n *   even though it is a valid PVE request for `guardWrite`'s purposes. `createPool` below refuses\n *   before ever reaching this cast when either is genuinely missing, so the cast never carries a\n *   request distilled's OWN required fields would reject in practice.\n */\nconst toDistilledCreate = (props: ZfsPoolProps): nodes.CreateNodeDiskZfsRequest => {\n  const form = createForm(props);\n  return {\n    ...form,\n    draid_config: form['draid-config'],\n    node: props.node,\n  } as unknown as nodes.CreateNodeDiskZfsRequest;\n};\n\n/** 30 reads, 2s apart. A create that has not landed in a minute has gone wrong, not gone slow. */\nconst SETTLE_ATTEMPTS = 30;\n\n/**\n * Create the pool if it is absent, and otherwise leave it completely alone.\n *\n * ⛔ THE POST ONLY FORKS A WORKER. MEASURED in `/usr/share/perl5/PVE/API2/Disks/ZFS.pm` on node-b:\n *   the create handler ends in `$rpcenv->fork_worker('zfscreate', ...)` and its HTTP answer is a\n *   UPID returned the instant the worker is forked — before `zpool create` has run, let alone\n *   finished. A read-back taken immediately would report a successful create as the failure \"the\n *   write returned no error but the object is still absent\". THAT is why this function polls.\n *\n * ⚠️ THERE IS NO UPDATE BRANCH BECAUSE PVE HAS NO PUT HERE. An existing pool is returned exactly as\n *   read, unwritten: the only write this resource ever makes is the create of a pool that is not\n *   there. Do not add a \"repair\" write; there is no field it could set.\n *\n * ⛔ AND IF THE READ IS WRONG, THE POST IS STILL SAFE — measured, not hoped for. `readPool` folds a\n *   403 or an unreachable node into \"absent\", so a too-narrow lease would send this down the create\n *   path over a live pool. PVE's handler calls `get_pool_data()` before it forks anything and dies\n *   with \"pool '<name>' already exists on node '<node>'\", and `assert_disk_unused` refuses every\n *   device that pool is holding. A create aimed at a pool that is really there fails loudly rather\n *   than wiping it.\n *\n * ⚠️ SHORT POLLS WITH A HARD CAP, NOT ONE LONG WAIT, NOT `@distilled.cloud/proxmox`'s `awaitTask`.\n *   `readPool` cannot tell \"not yet\" from \"forbidden\" — both fold to `undefined` — so the loop\n *   gives up with the UPID rather than retrying forever, and the UPID is the only thing that leads\n *   to the worker's real error. Distilled's own task-status poller exists (`Task.ts`) and would\n *   remove this ambiguity, but swapping to it changes this resource's OBSERVABLE behaviour (what a\n *   caller sees on a slow create) beyond a transport swap — left as a follow-up, not folded into a\n *   migration PR silently.\n *\n * ⛔ THE SAME AMBIGUITY MAKES A RE-RUN AFTER THE GIVE-UP DIE GENUINELY UNSAFE, NOT MERELY SLOW TO\n *   CONFIRM — FOUND BY ADVERSARIAL REVIEW, 2026-09-24, of THIS migration, though the shape is\n *   unchanged from before it (`git blame` shows the same settle-poll pre-dates this PR). \"If the\n *   read is wrong, the POST is still safe\" above is true for the FIRST call into this function —\n *   PVE's own `get_pool_data()` refuses a create over a pool it can already see. It is NOT true\n *   for a SECOND deploy attempt started while the FIRST worker is still mid-`zpool create`: that\n *   worker has not yet made the pool visible to a read, so `existing = yield* read(props)` at the\n *   top of THIS call can also fold to `undefined` — not because the pool is gone, but because the\n *   first attempt has not finished — and this function would POST a SECOND `zpool create` at the\n *   SAME devices while the first is still writing them. There is no lock or marker anywhere in\n *   this package that would stop it. The give-up message below says so explicitly and names the\n *   task log to check FIRST; that message, and an operator reading it, are the only safeguard.\n *\n * ⛔ THE ADOPT-ONLY GUARD, RIGHT AFTER THE READ AND BEFORE ANYTHING ELSE. Decision 9 (2026-09-23):\n *   omitting `devices` and `raidlevel` declares a pool this resource may only ADOPT, for a pool\n *   PVE's own schema cannot fully describe — n1's `speed` is a stripe, and `raidlevel`'s enum has\n *   no stripe (zfs-pool.ts). `zfsPoolCreateEndpoint` above already keeps the vendor constraint\n *   guard from refusing such a declaration at PLAN time; this is the matching refusal at APPLY\n *   time, for the one case that guard cannot see — the pool genuinely is not there.\n */\nexport const createPool = <E, R>(\n  props: ZfsPoolProps,\n  read: (props: ZfsPoolProps) => Effect.Effect<ZfsPoolAttributes | undefined, E, R>,\n) =>\n  Effect.gen(function* () {\n    const existing = yield* read(props);\n    if (existing !== undefined) return existing;\n\n    if (props.devices === undefined || props.raidlevel === undefined) {\n      return yield* Effect.die(\n        new Error(\n          `${props.node}/${props.name}: this is an adopt-only declaration (no \\`devices\\` or ` +\n            '`raidlevel`) and the pool is not there to adopt. An adopt-only Proxmox.ZfsPool never ' +\n            'creates -- declare both fields for a pool this resource should build, or point this ' +\n            'declaration at a pool that already exists on this node.',\n        ),\n      );\n    }\n\n    /**\n     * ⛔ FOUND BY ADVERSARIAL REVIEW, 2026-09-24 — `diff` NEVER RUNS FOR A GENUINELY FIRST-EVER\n     *   DECLARATION. Upstream `Plan.ts` routes a brand-new resource (`oldState === undefined`)\n     *   straight to `action: 'create'` without ever calling `provider.diff` — so `zfs-pool.ts`'s\n     *   own `guardForm` call (which checks THIS SAME form) never runs for that plan, and this was\n     *   THE ONLY WRITE PATH IN THE FAMILY WITH NO VENDOR CHECK AT ALL, before or after this\n     *   migration. `ceph-pool.ts`'s own hand-written `reconcile` already re-runs its create guard\n     *   for exactly this reason (an ADOPTED row's `diff` answer is discarded by Plan.ts too); this\n     *   is the same fix for this family. A malformed `ashift` or `draid-config` is now refused\n     *   here, before the POST, rather than reaching the wire and refused only by PVE itself.\n     */\n    yield* guardForm(zfsPoolCreateEndpoint(props), asForm(createForm(props)), true);\n\n    const upid = yield* runPve(\n      props.target,\n      'provision',\n      true,\n      nodes.createNodeDiskZfs(toDistilledCreate(props)),\n    );\n\n    const settle = (attempts: number): Effect.Effect<ZfsPoolAttributes | undefined, E, R> =>\n      Effect.gen(function* () {\n        const live = yield* read(props);\n        if (live !== undefined || attempts <= 0) return live;\n        yield* Effect.sleep('2 seconds');\n        return yield* settle(attempts - 1);\n      });\n\n    const after = yield* settle(SETTLE_ATTEMPTS);\n    if (after === undefined) {\n      return yield* Effect.die(\n        new Error(\n          `nodes/${props.node}/disks/zfs/${props.name}: POST returned ${text(upid, '(no UPID)')} ` +\n            'but the pool has not appeared. That POST only forks a `zfscreate` worker, so the task ' +\n            `holds the real error -- read it with \\`pvesh get /nodes/${props.node}/tasks/<upid>/log\\`. ` +\n            'NOTHING WAS RETRIED AND NOTHING WAS CLEANED UP: if the worker reached `zpool create`, ' +\n            'the declared devices have already been written to. DO NOT RE-RUN THIS DEPLOY BEFORE ' +\n            'READING THAT LOG: `read` cannot tell \"the worker is still running\" from \"the pool is ' +\n            'genuinely gone\", so a re-run this soon can POST a SECOND `zpool create` at the SAME ' +\n            'devices while the first one is still mid-write -- confirm the task finished (one way ' +\n            'or the other) before trying again.',\n        ),\n      );\n    }\n    return after;\n  });\n\n/**\n * ⛔ `DELETE /nodes/{node}/disks/zfs/{name}` RUNS `zpool destroy` AND THE DATASETS GO WITH IT. Per\n *   S14 (alchemy-provider-standard), it is implemented rather than stubbed — a `delete` that\n *   silently does nothing lies to whoever reads the plan — and what keeps an ordinary removed\n *   declaration from reaching it is the resource's `defaultRemovalPolicy: 'retain'` (zfs-pool.ts):\n *   an orphaned pool is forgotten, not destroyed, unless a caller opts in with\n *   `.pipe(RemovalPolicy.destroy())`. See the corrected header in zfs-pool.ts.\n *\n * ⚠️ `cleanup-config`/`cleanup-disks` ARE NOT SENT. The first would additionally remove the PVE\n *   storage entry pointing at this pool, which is a different object with its own resource\n *   (`Proxmox.Storage`); one resource reaching over to delete another's is how a stack ends up with\n *   state describing something that is gone. Neither is offered as a prop, for the same reason.\n */\nexport const destroyPool = (props: ZfsPoolProps) =>\n  runPve(\n    props.target,\n    'provision',\n    true,\n    nodes.deleteNodeDiskZfs({ name: props.name, node: props.node }),\n  );\n"
   ],
-  "mappings": ";AA4CA;AACA;AACA;AACA;AACA;;;ACpCA;;;AC4EA,IAAM,WAAW,CAAC,UAA0B,CAAC,GAAG,KAAK,EAAE;AAQvD,IAAM,aAAa,CAAC,MAAc,OAAe,SAAoC;AAAA,EACnF,MAAM,MAAgB,CAAC;AAAA,EACvB,IAAI,KAAK,cAAc,aAAa,SAAS,KAAK,IAAI,KAAK,WAAW;AAAA,IACpE,IAAI,KAAK,GAAG,iBAAiB,KAAK,sBAAsB;AAAA,EAC1D;AAAA,EACA,IAAI,KAAK,cAAc,aAAa,SAAS,KAAK,IAAI,KAAK,WAAW;AAAA,IACpE,IAAI,KAAK,GAAG,kBAAkB,KAAK,sBAAsB;AAAA,EAC3D;AAAA,EACA,IAAI,KAAK,SAAS,aAAa,CAAC,KAAK,KAAK,SAAS,KAAK,GAAG;AAAA,IACzD,IAAI,KAAK,GAAG,wBAAwB,KAAK,KAAK,KAAK,IAAI,GAAG;AAAA,EAC5D;AAAA,EAGA,IAAI,KAAK,YAAY,aAAa,CAAC,IAAI,OAAO,KAAK,SAAS,KAAK,YAAY,EAAE,KAAK,KAAK,GAAG;AAAA,IAC1F,IAAI,KAAK,GAAG,oBAAoB,KAAK,iBAAiB,KAAK,SAAS;AAAA,EACtE;AAAA,EAIA,MAAM,UAAU,OAAO,KAAK;AAAA,EAC5B,MAAM,UAAU,KAAK,YAAY,aAAa,KAAK,YAAY;AAAA,EAC/D,IAAI,WAAW,UAAU,MAAM,OAAO,SAAS,OAAO,GAAG;AAAA,IACvD,IAAI,KAAK,YAAY,aAAa,UAAU,KAAK,SAAS;AAAA,MACxD,IAAI,KAAK,GAAG,kBAAkB,KAAK,SAAS;AAAA,IAC9C;AAAA,IACA,IAAI,KAAK,YAAY,aAAa,UAAU,KAAK,SAAS;AAAA,MACxD,IAAI,KAAK,GAAG,iBAAiB,KAAK,SAAS;AAAA,IAC7C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,aAAa,CACxB,OACA,MACA,UAA4B,CAAC,MACP;AAAA,EACtB,MAAM,MAAgB,CAAC;AAAA,EACvB,YAAY,MAAM,SAAS,OAAO,QAAQ,KAAK,GAAG;AAAA,IAChD,MAAM,QAAQ,KAAK;AAAA,IACnB,IAAI,UAAU,WAAW;AAAA,MACvB,IAAI,QAAQ,aAAa,QAAQ,KAAK,aAAa;AAAA,QAAM,IAAI,KAAK,GAAG,gBAAgB;AAAA,MACrF;AAAA,IACF;AAAA,IAEA,WAAW,QAAQ,OAAO,UAAU,WAAW,CAAC,KAAK,IAAI,OAAO;AAAA,MAC9D,IAAI,KAAK,GAAG,WAAW,MAAM,MAAM,IAAI,CAAC;AAAA,IAC1C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,UAAU,CAAC,UAAuB,UAC7C,GAAG;AAAA,MAAkD,MAAM,KAAK;AAAA,KAAQ;AAAA,IACxE,uEACA;;;ACzIK,IAAM,yBAAwE;AAAA,EACnF,2BAA2B;AAAA,IACzB,SAAW,EAAC,QAAS,eAAc,UAAW,MAAK,MAAO,SAAQ;AAAA,EACpE;AAAA,EACA,0BAA0B;AAAA,IACxB,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,QAAU,EAAC,QAAS,cAAa,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,0BAA0B;AAAA,IACxB,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,aAAY,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC9D,QAAU,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACvC,WAAa,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,MAAQ,EAAC,SAAU,+BAA8B,eAAgB,yBAAwB,MAAO,SAAQ;AAAA,IACxG,UAAY,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC7C,UAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,QAAS,cAAa,WAAY,IAAG,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjF;AAAA,EACA,uBAAuB;AAAA,IACrB,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,MAAQ,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACxC,OAAS,EAAC,QAAS,mBAAkB,UAAW,MAAK,MAAO,SAAQ;AAAA,IACpE,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,OAAS,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,EACtD;AAAA,EACA,oCAAoC,CAAC;AAAA,EACrC,kCAAkC;AAAA,IAChC,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EACpD;AAAA,EACA,kCAAkC;AAAA,IAChC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,aAAY,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC9D,QAAU,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACvC,WAAa,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,MAAQ,EAAC,SAAU,+BAA8B,eAAgB,yBAAwB,MAAO,SAAQ;AAAA,IACxG,UAAY,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,EAC/C;AAAA,EACA,kDAAkD;AAAA,IAChD,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,SAAU,gBAAe,SAAU,GAAE,MAAO,UAAS;AAAA,EAClE;AACF;;;AC3CO,IAAM,iCAAgF;AAAA,EAC3F,4BAA4B;AAAA,IAC1B,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,SAAU,KAAI,MAAO,CAAC,KAAI,KAAI,QAAO,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC/E,KAAO,EAAC,SAAU,+BAA8B,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IAC/F,SAAW,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACpD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,IAAM,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACjE,UAAY,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACzD,kBAAoB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACnF,QAAU,EAAC,QAAS,0BAAyB,MAAO,SAAQ;AAAA,IAC5D,MAAQ,EAAC,SAAU,YAAW,MAAO,CAAC,YAAW,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClF,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,kBAAkB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACnD,qBAAqB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IAC9G,6BAA6B,EAAC,MAAO,CAAC,UAAS,QAAO,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,aAAe,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IAC7D,iBAAiB,EAAC,SAAU,cAAa,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjF,UAAY,EAAC,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1E,WAAa,EAAC,SAAU,2BAA0B,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IACrG,UAAY,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACxD,SAAW,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACrD,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EACnD;AAAA,EACA,gCAAgC;AAAA,IAC9B,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,SAAU,KAAI,MAAO,CAAC,KAAI,KAAI,QAAO,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC/E,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACpD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACjE,UAAY,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACzD,kBAAoB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACnF,QAAU,EAAC,QAAS,0BAAyB,MAAO,SAAQ;AAAA,IAC5D,MAAQ,EAAC,SAAU,YAAW,MAAO,CAAC,YAAW,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClF,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,kBAAkB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACnD,qBAAqB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IAC9G,6BAA6B,EAAC,MAAO,CAAC,UAAS,QAAO,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,aAAe,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IAC7D,iBAAiB,EAAC,SAAU,cAAa,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjF,UAAY,EAAC,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1E,WAAa,EAAC,SAAU,2BAA0B,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IACrG,UAAY,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACxD,SAAW,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACrD,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EACnD;AACF;;;ACnDO,IAAM,+BAA8E;AAAA,EACzF,sCAAsC;AAAA,IACpC,OAAS,EAAC,UAAW,MAAK,MAAO,UAAS;AAAA,EAC5C;AACF;;;ACJO,IAAM,mCAAkF;AAAA,EAC7F,sCAAsC;AAAA,IACpC,MAAQ,EAAC,QAAS,YAAW,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5D,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,oCAAmC,eAAgB,8BAA6B,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjK;AAAA,EACA,4CAA4C;AAAA,IAC1C,MAAQ,EAAC,QAAS,YAAW,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5D,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,oCAAmC,eAAgB,8BAA6B,MAAO,SAAQ;AAAA,EACnJ;AACF;;;ACZO,IAAM,6BAA4E;AAAA,EACvF,kCAAkC;AAAA,IAChC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACjD,cAAgB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3D,aAAe,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1D,KAAO,EAAC,QAAS,4BAA2B,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3E,OAAS,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,WAAU,WAAU,YAAW,SAAS,GAAE,MAAO,SAAQ;AAAA,IACzG,MAAQ,EAAC,MAAO,CAAC,MAAK,IAAI,GAAE,MAAO,SAAQ;AAAA,EAC7C;AAAA,EACA,8BAA8B;AAAA,IAC5B,UAAY,EAAC,MAAO,CAAC,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IAC3D,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,WAAa,EAAC,QAAS,2BAA0B,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChF,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,uCAAuC;AAAA,IACrC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,OAAS,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACjD,cAAgB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3D,aAAe,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1D,OAAS,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,WAAU,WAAU,YAAW,SAAS,GAAE,MAAO,SAAQ;AAAA,EAC3G;AAAA,EACA,oCAAoC;AAAA,IAClC,UAAY,EAAC,MAAO,CAAC,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IAC3D,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,WAAa,EAAC,QAAS,2BAA0B,MAAO,SAAQ;AAAA,EAClE;AACF;;;AChCO,IAAM,kCAAiF;AAAA,EAC5F,yCAAyC;AAAA,IACvC,eAAiB,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC/E,iBAAiB,EAAC,SAAU,YAAW,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,KAAO,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,KAAI,MAAO,UAAS;AAAA,IACvE,oBAAoB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC5E,gBAAgB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACjD,sBAAsB,EAAC,SAAU,YAAW,SAAU,MAAK,MAAO,UAAS;AAAA,IAC3E,iBAAiB,EAAC,SAAU,SAAQ,MAAO,CAAC,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC3E,4BAA4B,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC7D,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,UAAW,MAAK,MAAO,UAAS;AAAA,IACrE,OAAS,EAAC,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,WAAU,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7D,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,MAAQ,EAAC,MAAO,CAAC,YAAW,YAAW,eAAe,GAAE,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjH;AAAA,EACA,wCAAwC;AAAA,IACtC,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,eAAiB,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC/E,iBAAiB,EAAC,SAAU,YAAW,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,KAAO,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,KAAI,MAAO,UAAS;AAAA,IACvE,oBAAoB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC5E,gBAAgB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACjD,sBAAsB,EAAC,SAAU,YAAW,SAAU,MAAK,MAAO,UAAS;AAAA,IAC3E,iBAAiB,EAAC,SAAU,SAAQ,MAAO,CAAC,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC3E,4BAA4B,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC7D,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,UAAW,MAAK,MAAO,UAAS;AAAA,IACrE,OAAS,EAAC,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,WAAU,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7D,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,EACxD;AACF;;;ACpCO,IAAM,wCAAuF;AAAA,EAClG,oDAAoD;AAAA,IAClD,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC1C,OAAS,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC3C;AAAA,EACA,sDAAsD;AAAA,IACpD,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,IAChE,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,kDAAkD;AAAA,IAChD,gBAAgB,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,IAChE,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC5C;AAAA,EACA,qDAAqD;AAAA,IACnD,QAAU,EAAC,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IACtE,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,KAAO,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EACzC;AAAA,EACA,4CAA4C;AAAA,IAC1C,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,EAC/D;AAAA,EACA,0DAA0D;AAAA,IACxD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,EAC3C;AAAA,EACA,4DAA4D;AAAA,IAC1D,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,EAClE;AAAA,EACA,wDAAwD;AAAA,IACtD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,IAChE,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,EAC/E;AAAA,EACA,2DAA2D;AAAA,IACzD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,EACxD;AAAA,EACA,kDAAkD;AAAA,IAChD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,EAC/D;AACF;;;ACzDO,IAAM,sCAAqF;AAAA,EAChG,iCAAiC;AAAA,IAC/B,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,IAAM,EAAC,QAAS,0BAAyB,SAAU,kCAAiC,eAAgB,4BAA2B,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9J,MAAQ,EAAC,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpC,YAAc,EAAC,MAAO,CAAC,SAAQ,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtD,UAAY,EAAC,SAAU,QAAO,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3F,QAAU,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,YAAW,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9D,MAAQ,EAAC,MAAO,CAAC,OAAO,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC3D;AAAA,EACA,qCAAqC;AAAA,IACnC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,MAAQ,EAAC,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpC,YAAc,EAAC,MAAO,CAAC,SAAQ,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtD,UAAY,EAAC,SAAU,QAAO,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3F,QAAU,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,EAChD;AACF;;;ACpBO,IAAM,8BAA6E;AAAA,EACxF,+BAA+B;AAAA,IAC7B,OAAS,EAAC,WAAY,KAAI,eAAgB,qCAAoC,MAAO,SAAQ;AAAA,IAC7F,KAAO,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,MAAQ,EAAC,MAAO,CAAC,MAAM,GAAE,MAAO,SAAQ;AAAA,IACxC,MAAQ,EAAC,WAAY,GAAE,WAAY,GAAE,SAAU,yCAAwC,eAAgB,mCAAkC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACxK,MAAQ,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC1C;AAAA,EACA,8CAA8C;AAAA,IAC5C,mBAAmB,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,IACjD,cAAc,EAAC,MAAO,MAAK,QAAS,sBAAqB,MAAO,QAAO;AAAA,IACvE,eAAiB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACrD,SAAW,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,QAAS,qBAAoB,UAAW,MAAK,MAAO,SAAQ;AAAA,IACvE,MAAQ,EAAC,MAAO,CAAC,QAAQ,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC5D;AAAA,EACA,+BAA+B;AAAA,IAC7B,MAAQ,EAAC,MAAO,CAAC,SAAS,GAAE,MAAO,SAAQ;AAAA,IAC3C,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,WAAa,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACtD,qBAAqB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC3C,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,OAAS,EAAC,QAAS,WAAU,MAAO,SAAQ;AAAA,IAC5C,aAAa,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC5D,yBAAyB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,2CAA0C,eAAgB,qCAAoC,MAAO,QAAO;AAAA,IACzL,KAAO,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACpC,MAAQ,EAAC,MAAO,CAAC,QAAO,UAAS,QAAO,UAAS,QAAO,OAAO,GAAE,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IACxH,iBAAiB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IAChF,aAAa,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7D,cAAc,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5E,MAAQ,EAAC,WAAY,GAAE,WAAY,GAAE,SAAU,yCAAwC,eAAgB,mCAAkC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC1K;AAAA,EACA,wBAAwB,CAAC;AAAA,EACzB,qCAAqC;AAAA,IACnC,OAAS,EAAC,WAAY,KAAI,eAAgB,qCAAoC,MAAO,SAAQ;AAAA,IAC7F,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,KAAO,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,EACzD;AAAA,EACA,sDAAsD;AAAA,IACpD,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,mBAAmB,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,IACjD,cAAc,EAAC,MAAO,MAAK,QAAS,sBAAqB,MAAO,QAAO;AAAA,IACvE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,eAAiB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACrD,SAAW,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,EAC3C;AAAA,EACA,qCAAqC;AAAA,IACnC,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,MAAQ,EAAC,MAAO,CAAC,SAAS,GAAE,MAAO,SAAQ;AAAA,IAC3C,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,WAAa,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACtD,qBAAqB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC3C,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,OAAS,EAAC,QAAS,WAAU,MAAO,SAAQ;AAAA,IAC5C,aAAa,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC5D,yBAAyB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,2CAA0C,eAAgB,qCAAoC,MAAO,QAAO;AAAA,IACzL,KAAO,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACpC,iBAAiB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IAChF,aAAa,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7D,cAAc,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,EAC9E;AACF;;;ACnEO,IAAM,6BAA4E;AAAA,EACvF,yCAAyC;AAAA,IACvC,QAAU,EAAC,SAAU,OAAM,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,EACzE;AAAA,EACA,0CAA0C,CAAC;AAAA,EAC3C,wCAAwC,CAAC;AAAA,EACzC,2CAA2C;AAAA,IACzC,eAAe,EAAC,QAAS,WAAU,MAAO,SAAQ;AAAA,EACpD;AAAA,EACA,mCAAmC;AAAA,IACjC,aAAe,EAAC,SAAU,GAAE,MAAO,SAAQ;AAAA,IAC3C,KAAO,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACvC,mBAAmB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAChD,cAAgB,EAAC,SAAU,KAAI,MAAO,SAAQ;AAAA,EAChD;AAAA,EACA,oCAAoC;AAAA,IAClC,aAAe,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,UAAS,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,UAAY,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,MAAQ,EAAC,eAAgB,oBAAmB,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3E,mBAAqB,EAAC,SAAU,QAAO,MAAO,CAAC,MAAK,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IACjF,QAAU,EAAC,SAAU,OAAM,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACvE,YAAc,EAAC,SAAU,OAAM,MAAO,UAAS;AAAA,IAC/C,MAAQ,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IAC/D,aAAe,EAAC,SAAU,qCAAoC,eAAgB,+BAA8B,MAAO,SAAQ;AAAA,EAC7H;AAAA,EACA,0CAA0C;AAAA,IACxC,aAAe,EAAC,MAAO,CAAC,OAAM,UAAS,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,UAAY,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,mBAAqB,EAAC,MAAO,CAAC,MAAK,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,YAAc,EAAC,SAAU,OAAM,MAAO,UAAS;AAAA,IAC/C,MAAQ,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACjD,aAAe,EAAC,SAAU,qCAAoC,eAAgB,+BAA8B,MAAO,SAAQ;AAAA,EAC7H;AACF;;;AClCO,IAAM,8BAA6E;AAAA,EACxF,oCAAoC;AAAA,IAClC,QAAU,EAAC,SAAU,MAAK,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,aAAe,EAAC,SAAU,MAAK,MAAO,CAAC,MAAK,OAAM,QAAO,OAAM,QAAO,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IACnG,SAAW,EAAC,QAAS,eAAc,UAAW,MAAK,MAAO,SAAQ;AAAA,IAClE,MAAQ,EAAC,QAAS,kBAAiB,UAAW,MAAK,MAAO,SAAQ;AAAA,IAClE,WAAa,EAAC,MAAO,CAAC,UAAS,UAAS,UAAS,SAAQ,UAAS,UAAS,SAAQ,UAAS,QAAQ,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EACvI;AACF;;;ACRO,IAAM,4BAA2E;AAAA,EACtF,8BAA8B;AAAA,IAC5B,MAAQ,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,QAAO,SAAQ,SAAQ,WAAU,SAAS,GAAE,MAAO,SAAQ;AAAA,IACtG,SAAW,EAAC,SAAU,mDAAkD,SAAU,GAAE,MAAO,SAAQ;AAAA,IACnG,OAAS,EAAC,SAAU,OAAM,MAAO,CAAC,SAAQ,WAAU,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC1E,OAAS,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,UAAY,EAAC,SAAU,KAAI,SAAU,MAAK,SAAU,GAAE,MAAO,SAAQ;AAAA,IACrE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,YAAc,EAAC,SAAU,cAAa,eAAgB,wCAAuC,MAAO,SAAQ;AAAA,IAC5G,KAAO,EAAC,eAAgB,6FAA4F,MAAO,SAAQ;AAAA,IACnI,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,UAAY,EAAC,QAAS,YAAW,WAAY,KAAI,MAAO,SAAQ;AAAA,IAChE,MAAQ,EAAC,MAAO,CAAC,UAAS,UAAS,aAAY,QAAO,UAAS,WAAU,WAAU,YAAW,YAAW,iBAAiB,GAAE,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,SAAU,OAAM,SAAU,IAAG,MAAO,UAAS;AAAA,IACxD,YAAc,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACnE,YAAc,EAAC,WAAY,KAAI,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9D,QAAU,EAAC,MAAO,CAAC,UAAS,UAAS,UAAS,UAAS,UAAS,YAAW,aAAY,UAAS,UAAS,SAAQ,WAAW,GAAE,MAAO,SAAQ;AAAA,IAC7I,UAAY,EAAC,WAAY,GAAE,MAAO,SAAQ;AAAA,IAC1C,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,cAAgB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACzD,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,SAAU,SAAQ,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvE,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IAC9D,MAAQ,EAAC,QAAS,YAAW,SAAU,WAAU,SAAU,KAAI,UAAW,MAAK,MAAO,UAAS;AAAA,EACjG;AAAA,EACA,2CAA2C;AAAA,IACzC,MAAQ,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,QAAO,SAAQ,SAAQ,WAAU,SAAS,GAAE,MAAO,SAAQ;AAAA,IACtG,OAAS,EAAC,SAAU,OAAM,MAAO,CAAC,SAAQ,WAAU,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC1E,OAAS,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,UAAY,EAAC,SAAU,KAAI,SAAU,MAAK,SAAU,GAAE,MAAO,SAAQ;AAAA,IACrE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,YAAc,EAAC,SAAU,cAAa,eAAgB,wCAAuC,MAAO,SAAQ;AAAA,IAC5G,KAAO,EAAC,eAAgB,6FAA4F,MAAO,SAAQ;AAAA,IACnI,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,UAAY,EAAC,QAAS,YAAW,WAAY,KAAI,MAAO,SAAQ;AAAA,IAChE,MAAQ,EAAC,MAAO,CAAC,UAAS,UAAS,aAAY,QAAO,UAAS,WAAU,WAAU,YAAW,YAAW,iBAAiB,GAAE,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,SAAU,OAAM,SAAU,IAAG,MAAO,UAAS;AAAA,IACxD,YAAc,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACnE,QAAU,EAAC,MAAO,CAAC,UAAS,UAAS,UAAS,UAAS,UAAS,YAAW,aAAY,UAAS,UAAS,SAAQ,WAAW,GAAE,MAAO,SAAQ;AAAA,IAC7I,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,cAAgB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACzD,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,EAChE;AAAA,EACA,2CAA2C;AAAA,IACzC,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,MAAQ,EAAC,MAAO,CAAC,UAAS,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,OAAO,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC58D,MAAQ,EAAC,SAAU,mCAAkC,eAAgB,6BAA4B,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClI;AACF;;;AC3DO,IAAM,gCAA+E;AAAA,EAC1F,kCAAkC;AAAA,IAChC,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,gBAAgB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACrD,WAAa,EAAC,MAAO,CAAC,cAAa,iBAAgB,eAAc,aAAY,WAAU,eAAc,eAAc,eAAc,oBAAmB,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IACvL,uBAAyB,EAAC,MAAO,CAAC,UAAS,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,cAAgB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC1D,aAAe,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACpE,MAAQ,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC1C,OAAS,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC3C,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,aAAY,WAAY,IAAG,WAAY,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3F,KAAO,EAAC,SAAU,OAAM,SAAU,MAAK,MAAO,UAAS;AAAA,IACvD,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,YAAc,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACnD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,QAAU,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACpD,MAAQ,EAAC,MAAO,CAAC,UAAS,QAAO,OAAM,SAAQ,QAAO,UAAS,aAAY,WAAU,WAAU,cAAa,QAAO,SAAS,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7J,WAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,mBAAmB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,EAC1D;AAAA,EACA,iCAAiC,CAAC;AAAA,EAClC,yCAAyC;AAAA,IACvC,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,gBAAgB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACrD,WAAa,EAAC,MAAO,CAAC,cAAa,iBAAgB,eAAc,aAAY,WAAU,eAAc,eAAc,eAAc,oBAAmB,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IACvL,uBAAyB,EAAC,MAAO,CAAC,UAAS,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,cAAgB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC1D,aAAe,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACpE,MAAQ,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC1C,OAAS,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC3C,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,KAAO,EAAC,SAAU,OAAM,SAAU,MAAK,MAAO,UAAS;AAAA,IACvD,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,YAAc,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACnD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,QAAU,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACpD,MAAQ,EAAC,MAAO,CAAC,UAAS,QAAO,OAAM,SAAQ,QAAO,UAAS,aAAY,WAAU,WAAU,cAAa,QAAO,SAAS,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7J,WAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,mBAAmB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,EAC1D;AACF;;;ACtDO,IAAM,6BAA4E;AAAA,EACvF,+BAA+B;AAAA,IAC7B,UAAY,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAClD,WAAW,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACvD,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpD,SAAW,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3C,SAAW,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACxC,MAAQ,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtE,MAAQ,EAAC,QAAS,eAAc,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,SAAU,oCAAmC,eAAgB,8BAA6B,MAAO,SAAQ;AAAA,IACjJ,SAAW,EAAC,SAAU,mDAAkD,SAAU,GAAE,MAAO,UAAS;AAAA,IACpG,OAAS,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,YAAY,GAAE,MAAO,SAAQ;AAAA,IACzE,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,KAAO,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAClD,UAAY,EAAC,SAAU,KAAI,SAAU,KAAI,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,cAAc,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,SAAU,oBAAmB,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IACxF,WAAa,EAAC,MAAO,CAAC,OAAM,KAAI,MAAM,GAAE,MAAO,SAAQ;AAAA,IACvD,0BAA0B,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACpE,aAAa,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACzD,eAAe,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,MAAO,CAAC,MAAK,SAAQ,MAAK,SAAQ,SAAQ,MAAK,MAAK,MAAK,SAAQ,SAAQ,SAAQ,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,SAAQ,MAAK,MAAK,IAAI,GAAE,MAAO,SAAQ;AAAA,IACvL,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAQ,UAAS,WAAU,YAAW,YAAW,mBAAkB,cAAa,WAAW,GAAE,MAAO,SAAQ;AAAA,IACtI,kBAAoB,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,SAAQ;AAAA,IAChE,eAAiB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5D,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,YAAc,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACtD,QAAU,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,OAAM,OAAM,QAAO,QAAO,UAAS,QAAO,QAAO,SAAQ,SAAQ,OAAM,OAAM,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpJ,eAAe,EAAC,SAAU,0CAAyC,eAAgB,oCAAmC,MAAO,SAAQ;AAAA,IACrI,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,aAAY,mBAAkB,sBAAqB,WAAU,QAAQ,GAAE,MAAO,SAAQ;AAAA,IAC/H,aAAa,EAAC,SAAU,6BAA4B,eAAgB,uBAAsB,MAAO,SAAQ;AAAA,IACzG,QAAU,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,SAAW,EAAC,QAAS,kBAAiB,WAAY,KAAI,MAAO,SAAQ;AAAA,IACrE,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAClD,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IACjD,WAAa,EAAC,SAAU,OAAM,SAAU,sEAAqE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,IAC3M,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACrD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,SAAW,EAAC,SAAU,qBAAoB,SAAU,uEAAsE,eAAgB,iEAAgE,MAAO,SAAQ;AAAA,IACzN,MAAQ,EAAC,QAAS,YAAW,SAAU,WAAU,SAAU,KAAI,UAAW,MAAK,MAAO,UAAS;AAAA,IAC/F,gBAAkB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC5D,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,EACzD;AAAA,EACA,4CAA4C;AAAA,IAC1C,UAAY,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAClD,WAAW,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACvD,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpD,SAAW,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACxC,MAAQ,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtE,MAAQ,EAAC,QAAS,eAAc,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,SAAU,oCAAmC,eAAgB,8BAA6B,MAAO,SAAQ;AAAA,IACjJ,OAAS,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,YAAY,GAAE,MAAO,SAAQ;AAAA,IACzE,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,KAAO,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAClD,UAAY,EAAC,SAAU,KAAI,SAAU,KAAI,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,cAAc,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,SAAU,oBAAmB,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IACxF,WAAa,EAAC,MAAO,CAAC,OAAM,KAAI,MAAM,GAAE,MAAO,SAAQ;AAAA,IACvD,aAAa,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACzD,eAAe,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,MAAO,CAAC,MAAK,SAAQ,MAAK,SAAQ,SAAQ,MAAK,MAAK,MAAK,SAAQ,SAAQ,SAAQ,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,SAAQ,MAAK,MAAK,IAAI,GAAE,MAAO,SAAQ;AAAA,IACvL,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAQ,UAAS,WAAU,YAAW,YAAW,mBAAkB,cAAa,WAAW,GAAE,MAAO,SAAQ;AAAA,IACtI,kBAAoB,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,SAAQ;AAAA,IAChE,eAAiB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5D,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,YAAc,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACtD,QAAU,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,OAAM,OAAM,QAAO,QAAO,UAAS,QAAO,QAAO,SAAQ,SAAQ,OAAM,OAAM,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpJ,eAAe,EAAC,SAAU,0CAAyC,eAAgB,oCAAmC,MAAO,SAAQ;AAAA,IACrI,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,aAAY,mBAAkB,sBAAqB,WAAU,QAAQ,GAAE,MAAO,SAAQ;AAAA,IAC/H,aAAa,EAAC,SAAU,6BAA4B,eAAgB,uBAAsB,MAAO,SAAQ;AAAA,IACzG,QAAU,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,SAAW,EAAC,QAAS,kBAAiB,WAAY,KAAI,MAAO,SAAQ;AAAA,IACrE,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAClD,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IACjD,WAAa,EAAC,SAAU,OAAM,SAAU,sEAAqE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,IAC3M,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,SAAW,EAAC,SAAU,qBAAoB,SAAU,uEAAsE,eAAgB,iEAAgE,MAAO,SAAQ;AAAA,IACzN,gBAAkB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC5D,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,EACzD;AACF;;;ACtGO,IAAM,gCAA+E;AAAA,EAC1F,yDAAyD;AAAA,IACvD,sBAAsB,EAAC,MAAO,CAAC,OAAM,QAAO,UAAS,UAAS,UAAS,QAAQ,GAAE,MAAO,SAAQ;AAAA,IAChG,SAAW,EAAC,MAAO,CAAC,OAAM,UAAS,QAAQ,GAAE,QAAS,uBAAsB,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3G,UAAY,EAAC,WAAY,KAAI,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5D,KAAO,EAAC,SAAU,qBAAoB,eAAgB,eAAc,UAAW,MAAK,MAAO,SAAQ;AAAA,EACrG;AACF;;;ACPO,IAAM,wBAAuE;AAAA,EAClF,mBAAmB;AAAA,IACjB,QAAU,EAAC,QAAS,cAAa,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,2BAA2B;AAAA,IACzB,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,KAAO,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EAClD;AACF;;;ACRO,IAAM,0BAAyE;AAAA,EACpF,qBAAqB;AAAA,IACnB,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjD,WAAa,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IAClE,SAAW,EAAC,QAAS,4BAA2B,MAAO,SAAQ;AAAA,IAC/D,gBAAgB,EAAC,QAAS,yBAAwB,MAAO,SAAQ;AAAA,IACjE,QAAU,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1C,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,aAAe,EAAC,SAAU,6CAA4C,eAAgB,uCAAsC,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,MAAO,CAAC,OAAM,SAAQ,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IACjE,WAAW,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACnD,yBAAyB,EAAC,SAAU,4EAA2E,SAAU,IAAG,MAAO,UAAS;AAAA,IAC5I,SAAW,EAAC,QAAS,+BAA8B,MAAO,SAAQ;AAAA,IAClE,YAAc,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IAC1D,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC5C,MAAQ,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACpD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,QAAU,EAAC,QAAS,0BAAyB,MAAO,SAAQ;AAAA,IAC5D,eAAiB,EAAC,SAAU,YAAW,MAAO,CAAC,OAAM,YAAW,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IAChG,iBAAiB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAC1D,uBAAuB,EAAC,SAAU,MAAK,MAAO,CAAC,KAAI,KAAI,KAAI,KAAI,MAAK,IAAI,GAAE,MAAO,UAAS;AAAA,IAC1F,QAAU,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IACxD,YAAc,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,OAAM,OAAM,KAAI,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClG,SAAW,EAAC,QAAS,kBAAiB,UAAW,MAAK,MAAO,SAAQ;AAAA,IACrE,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,UAAY,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IAC1D,MAAQ,EAAC,MAAO,CAAC,SAAQ,UAAS,QAAO,OAAM,QAAO,SAAQ,eAAc,OAAM,WAAU,OAAM,OAAM,OAAM,OAAM,SAAS,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9J,QAAU,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IACxD,iBAAiB,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,EAC/D;AAAA,EACA,8BAA8B;AAAA,IAC5B,WAAa,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IAClE,SAAW,EAAC,QAAS,4BAA2B,MAAO,SAAQ;AAAA,IAC/D,gBAAgB,EAAC,QAAS,yBAAwB,MAAO,SAAQ;AAAA,IACjE,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1C,aAAe,EAAC,SAAU,6CAA4C,eAAgB,uCAAsC,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,MAAO,CAAC,OAAM,SAAQ,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IACjE,WAAW,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACnD,yBAAyB,EAAC,SAAU,4EAA2E,SAAU,IAAG,MAAO,UAAS;AAAA,IAC5I,SAAW,EAAC,QAAS,+BAA8B,MAAO,SAAQ;AAAA,IAClE,YAAc,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IAC1D,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC5C,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,eAAiB,EAAC,SAAU,YAAW,MAAO,CAAC,OAAM,YAAW,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IAChG,iBAAiB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAC1D,uBAAuB,EAAC,SAAU,MAAK,MAAO,CAAC,KAAI,KAAI,KAAI,KAAI,MAAK,IAAI,GAAE,MAAO,UAAS;AAAA,IAC1F,QAAU,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IACxD,YAAc,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,OAAM,OAAM,KAAI,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClG,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,iBAAiB,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,EAC/D;AACF;;;ACzDO,IAAM,yBAAwE;AAAA,EACnF,8BAA8B;AAAA,IAC5B,kBAAkB,EAAC,SAAU,iDAAgD,eAAgB,mDAAkD,MAAO,SAAQ;AAAA,IAC9J,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,qBAAqB,EAAC,SAAU,uBAAsB,MAAO,CAAC,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IACtH,eAAe,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,qEAAoE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,IACzN,MAAQ,EAAC,WAAY,MAAK,WAAY,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EACzE;AAAA,EACA,qDAAqD;AAAA,IACnD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IAC9I,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,EACjF;AAAA,EACA,iDAAiD;AAAA,IAC/C,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,gBAAgB,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IAC9I,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IAC/E,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,QAAU,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC5C;AAAA,EACA,oDAAoD;AAAA,IAClD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IACvF,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IAC/E,KAAO,EAAC,SAAU,mmHAAsmH,eAAgB,qmHAAwmH,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjxO;AAAA,EACA,2CAA2C;AAAA,IACzC,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IAC/E,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,EAC5K;AAAA,EACA,0BAA0B;AAAA,IACxB,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,IAAM,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3K,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,UAAY,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAChL;AAAA,EACA,yBAAyB;AAAA,IACvB,yBAAyB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,IAClL,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,aAAa,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IAC1D,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,IAAM,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3K,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,2KAA0K,eAAgB,+JAA8J,MAAO,SAAQ;AAAA,IACxZ,WAAW,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACxD,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC/J,aAAa,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IACrP,gBAAgB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACrL,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC1E,iBAAiB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC9C,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AAAA,EACA,2BAA2B;AAAA,IACzB,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,IAAM,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3K,aAAa,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACpE,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,kBAAkB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC/C,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AAAA,EACA,oCAAoC;AAAA,IAClC,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,eAAc,iBAAgB,kBAAiB,aAAY,eAAc,cAAa,eAAc,gBAAe,eAAc,cAAa,eAAc,UAAS,qBAAoB,UAAS,oBAAmB,2BAA0B,wBAAwB,GAAE,MAAO,QAAO;AAAA,IAChU,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,qBAAqB,EAAC,SAAU,uBAAsB,MAAO,CAAC,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IACtH,eAAe,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,qEAAoE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,EAC3N;AAAA,EACA,2DAA2D;AAAA,IACzD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,UAAS,WAAU,WAAU,gBAAe,UAAS,aAAa,GAAE,MAAO,QAAO;AAAA,IACjH,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,EAChJ;AAAA,EACA,uDAAuD;AAAA,IACrD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,UAAS,WAAU,WAAU,UAAS,eAAc,YAAW,QAAO,UAAU,GAAE,MAAO,QAAO;AAAA,IAC/H,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IAC9I,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,EACvD;AAAA,EACA,0DAA0D;AAAA,IACxD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,WAAU,UAAS,QAAO,QAAQ,GAAE,MAAO,QAAO;AAAA,IAC3F,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,QAAU,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IACvE,KAAO,EAAC,SAAU,mmHAAsmH,eAAgB,qmHAAwmH,MAAO,SAAQ;AAAA,EACjwO;AAAA,EACA,iDAAiD;AAAA,IAC/C,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,WAAU,gBAAe,kBAAiB,eAAc,kBAAiB,QAAO,QAAQ,GAAE,MAAO,QAAO;AAAA,IACjJ,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,EAC5K;AAAA,EACA,8BAA8B;AAAA,IAC5B,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,WAAU,MAAK,aAAY,aAAY,eAAc,cAAa,eAAc,gBAAe,aAAa,GAAE,MAAO,QAAO;AAAA,IACrK,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,EAChK;AAAA,EACA,6BAA6B;AAAA,IAC3B,yBAAyB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,IAClL,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,aAAa,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IAC1D,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,UAAS,SAAQ,WAAU,YAAW,mBAAkB,gBAAe,WAAU,YAAW,YAAW,aAAY,MAAK,aAAY,aAAY,iBAAgB,kBAAiB,iBAAgB,gBAAe,mBAAkB,kBAAiB,kBAAiB,yBAAwB,gBAAgB,GAAE,MAAO,QAAO;AAAA,IAC3V,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,2KAA0K,eAAgB,+JAA8J,MAAO,SAAQ;AAAA,IACxZ,WAAW,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACxD,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC/J,aAAa,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IACrP,gBAAgB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IACrK,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9J,kBAAkB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC1E,iBAAiB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC9C,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AAAA,EACA,+BAA+B;AAAA,IAC7B,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,mBAAkB,WAAU,YAAW,kBAAiB,MAAK,aAAY,gBAAe,gBAAgB,GAAE,MAAO,QAAO;AAAA,IACvJ,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,aAAa,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACpE,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,kBAAkB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC/C,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9J,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AACF;;;AC7KO,IAAM,sBAAqE;AAAA,KAC7E;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AACL;;;ApB7BO,IAAM,iBAAiB,CAAC,QAA0C;AAAA,EACvE,MAAM,QAAQ,oBAAoB;AAAA,EAClC,IAAI,UAAU,WAAW;AAAA,IACvB,MAAM,IAAI,MACR,mCAAmC,0DACjC,2DACJ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,iBAAiB,CAC5B,KACA,MACA,aACsB,WAAW,eAAe,GAAG,GAAG,MAAM,EAAE,SAAS,CAAC;AAQnE,IAAM,YAAY,CACvB,KACA,MACA,aAEO,eAAQ,MAAM;AAAA,EACnB,IAAI,QAAQ;AAAA,IAAW,OAAc;AAAA,EACrC,MAAM,QAAQ,eAAe,KAAK,MAAM,QAAQ;AAAA,EAChD,OAAO,MAAM,WAAW,IAAW,cAAc,WAAI,IAAI,MAAM,QAAQ,KAAK,KAAK,CAAC,CAAC;AAAA,CACpF;;;AqBzCI,IAAM,YAAY,CAAC,QAAgB,IAAI,IAAI,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG;AAGrF,IAAM,gBAAgB,EAAE,OAAO,UAAU,OAAO,UAAU,MAAM,QAAQ;AAGxE,IAAM,WAAW;AAGV,IAAM,QAAQ,CAAC,WAAiD;AAAA,EACrE,MAAM,UAAU,MAAM,IAAI;AAAA,EAC1B,OAAO,MAAM;AAAA,GACZ,cAAc,MAAM,QAAQ,MAAM;AACrC;AAGO,IAAM,OAAO,CAAC,WAAiD;AAAA,KACjE,MAAM,KAAK;AAAA,EACd,WAAW,MAAM,cAAc,QAAQ,MAAM;AAC/C;AAGA,IAAM,SAAS,CAAC,SACd,OAAO,YAAY,OAAO,QAAQ,IAAI,EAAE,OAAO,CAAC,MAA6B,EAAE,OAAO,SAAS,CAAC;AAQ3F,IAAM,aAAa,CAAC,UAAoB,UAAU,UAAU,OAAO,KAAK,KAAK,CAAC,GAAG,IAAI;AAGrF,IAAM,WAAW,CAAC,UACvB,CAAC,UAAU,MAAM,IAAI,GAAG,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,EAAE,KAAK,GAAG;AAExE,IAAM,OAAO,CAAC,MAAuD,UACnE,KAAK,KACH,CAAC,QACC,IAAI,SAAS,UAAU,MAAM,IAAI,KACjC,IAAI,SAAS,MAAM,QACnB,IAAI,SAAS,MAAM,QACnB,IAAI,WAAW,MAAM,MACzB;AAMF,IAAM,aAAa,CAAC,QAA8C;AAAA,EAChE,MAAM,QAAQ,IAAI;AAAA,EAClB,OAAO,UAAU,aAAa,UAAU,KAAK,UAAU,QAAQ,UAAU;AAAA;AAGpE,IAAM,eAAe,CAC1B,MACA,UACkB;AAAA,EAClB,MAAM,MAAM,KAAK,MAAM,KAAK;AAAA,EAC5B,OAAO;AAAA,IACL,OAAO,QAAQ;AAAA,IACf,MAAM,UAAU,MAAM,IAAI;AAAA,IAC1B,WAAW,QAAQ,aAAa,WAAW,GAAG;AAAA,IAC9C,QAAQ,MAAM;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,EACd;AAAA;AAGK,IAAM,UAAU,CAAC,YAA2B,UACjD,WAAW,SAAS,WAAW,eAAe,MAAM,cAAc;;;AC5BpE;AACA;AAEA,wBAAS;AAET;;;ACdA;AACA;AACA;AACA;;;ACvCA;AACA;AACA;AACA;AACA;AACA;;;ACVA;AAAA;AAiBO,MAAM,4BAAiC,iBAAY,qBAAqB,EAI5E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,mBAAmB,KAAK,eAAe,KAAK,gBAAgB,KAAK,6BACjE;AAAA;AAGN;;;ADbA,IAAM,cAAc,CAAC,KAAqB,SACxC,IAAI,OAAO,WAAW,IAAI,SAAS,WAAW;AA0BzC,IAAM,OAAO,CAAC,QAAmB,MAAe,MAAsB,QAAQ,QAC5E,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,GAAG,OAAO,eAAe;AAAA,EAGtC,MAAM,SAAS,CAAC,SAAgB,WAC9B,IAAI,MAAM,mBAAmB,WAAW,YAAW,IAAI,gBAAgB,YAAW,QAAQ;AAAA,EAC5F,MAAM,UACJ,YAAY,KAAK,YAAY,KAAK,YAAY,KAAK,MAAM,KAAK;AAAA,EAChE,MAAM,SAAS,QAAQ,WAAW,SAAS,IAAI,QAAQ,MAAM,UAAU,MAAM,IAAI;AAAA,EACjF,MAAM,OAAO,WAAW,YAAY,QAAQ,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAClE,MAAM,UAAkC,EAAE,mBAAmB,OAAO;AAAA,EACpE,MAAM,YAAY,YAAY,KAAK,WAAW;AAAA,EAC9C,IAAI,cAAc;AAAA,IAAI,QAAQ,uBAAuB;AAAA,EACrD,MAAM,QAAQ,YAAY,KAAK,OAAO;AAAA,EACtC,IAAI,UAAU;AAAA,IAAI,QAAQ,mBAAmB;AAAA,EAC7C,IAAI,WAAW,aAAa,EAAE,SAAS,aAAa;AAAA,IAClD,OAAO,OAAc,aAAK,OAAO,GAAG,oDAAoD,CAAC;AAAA,EAC3F;AAAA,EAEA,MAAM,SAAS,OAAkB;AAAA,EAGjC,MAAM,WAAW,OAAe;AAAA,EAChC,MAAM,WAAkB,iBACtB,OAAc,sBAA8B,2BAAW,GACvD,OAAO,CAAC,EACV;AAAA,EACA,MAAM,UAA4B,sBAAI,GAAG,WAAW,MAAM,EAAE,KACxC,6BAAW,OAAO,CACtC;AAAA,EACA,MAAM,WAAW,OAAO,QAAQ,OAAO,EAAE,KAChC,gBAAQ,CAAC,aACP,YAAI,SAAS,MAAM,CAAC,WAAU,EAAE,QAAQ,SAAS,QAAQ,YAAK,EAAE,CACzE,GAEO,gBAAQ,YAAY,GACpB,uBAAuB,8BAAsB,CAAC,GAAG,UAAU,eAAe,CAAC,CACpF;AAAA,EAKA,MAAM,OAAoD,KAAK,UAAU,MAAM,OAAO;AAAA,EACtF,QAAQ,QAAQ,SAAS,QACvB,WAAW,YACP,WACO,uBAAe,UAA0B,6BAAa,IAAI,GACrE,KAEO,iBAAS,CAAC,UAAU,OAAO,GAAG,MAAM,OAAO,CAAC,CACrD;AAAA,EAEA,IAAI;AAAA,EAOJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,IAAI;AAAA,IACxB,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,EAEX,IAAI,SAAS,OAAO,UAAU,KAAK;AAAA,IACjC,MAAM,SAAS,QAAQ;AAAA,IACvB,MAAM,gBAAgB,MAAM,QAAQ,MAAM;AAAA,IAC1C,MAAM,SAAS,gBAAgB,OAAO,IAAI,MAAM,EAAE,KAAK,IAAI,IAAI;AAAA,IAY/D,IAAI,WAAW,OAAO,eAAe;AAAA,MACnC,OAAO,OAAc,aAAK,IAAI,oBAAoB,EAAE,QAAQ,OAAO,OAAO,OAAO,KAAK,CAAC,CAAC;AAAA,IAC1F;AAAA,IACA,OAAO,OAAc,aAAK,OAAO,QAAQ,UAAU,mBAAmB,CAAC;AAAA,EACzE;AAAA,EACA,MAAM,UAAU,QAAQ,MAAM;AAAA,EAC9B,MAAM,SAAS,QAAQ,MAAM;AAAA,EAC7B,IAAI,OAAO,YAAY,YAAY,OAAO,WAAW,UAAU;AAAA,IAE7D,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,eAAe,iEACvB,kCAAkC,OAAO,gDACzC,kFACJ,CACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,QAAQ;AAAA,EACtB,MAAM,eAAe,OAAO,UAAU,WAAW,QAAQ;AAAA,EACzD,OAAO,EAAE,cAAc,QAAQ,QAAQ;AAAA,CACxC;AAQI,IAAM,gBAAgB,CAAC,YAA2B,WACvD,OAAO,WAAW,QACd,eAAe,WAAW,WAAW,WAAW,WAChD,eAAe,WAAW,WAAW,WAAW;;;AD9FtD,IAAM,wBAAwB;AAmB9B,IAAM,QAAQ,CAAC,QAAmB,UAA6B;AAAA,EAC7D,OAAO,OAAO;AAAA,EACd;AAAA,EACA,QAAQ,OAAO;AACjB;AAWO,IAAM,aAAa,CAAC,SACpB,eAAU,IAAI,KAAK,KAAK,MAAM,eAAe,wBACrC,iBAAQ,KAAK,MAAM,eAAe,qBAAqB,IACvD;AAcR,IAAM,aAAa,CAAO,YACzB,eAAS,SAAS,EAAE,UAAU,IAAI,mBAAmB,UAAU,WAAW,CAAC;AAEnF,IAAM,eAAe,CAAC,QACpB,IAAI,WAAW,QACX,EAAE,KAAK,iCAAiC,OAAO,IAAI,OAAO,QAAQ,MAAM,IACxE,EAAE,SAAS,CAAC,GAAG,OAAO,IAAI,OAAO,QAAQ,MAAM;AAErD,IAAM,SAAgB,gBAAQ,WAAW,CAAC,QAAQ,KAAK,aAAa,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAS7E,IAAM,SAAS,CAAC,QAAmB,SAAwB,UAAI,QAAQ,MAAM,QAAQ,IAAI,CAAC;;;AG3HjG;AAEA;AACA;AACA;AACA;AAKO,IAAM,eAAe;AAGrB,IAAM,aAAa,CAAC,WAAmB,WAAW,UAAU,OAAO,YAAY;AAgB/E,IAAM,iBAAiC;AAG9C,IAAM,kBAAkB,IAAI;AAKrB,IAAM,iBAAiB,CAAC,QAAmB,WAAmB;AAAA,EACnE,gBAAgB,IAAI,OAAO,OAAO,MAAM;AAAA;AAInC,IAAM,iBAAiB,CAAC,WAAyC;AAAA,EACtE,MAAM,YAAY,gBAAgB,IAAI,OAAO,KAAK;AAAA,EAClD,IAAI,cAAc,aAAa,CAAC,OAAO,QAAQ,SAAS,SAAS;AAAA,IAAG,OAAO,OAAO;AAAA,EAClF,OAAO,CAAC,WAAW,GAAG,OAAO,QAAQ,OAAO,CAAC,WAAW,WAAW,SAAS,CAAC;AAAA;AAG/E,IAAM,YAAY,CAAC,UAAuC;AAAA,EACxD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,IAAI,UAAU,SAAS,OAAO,MAAM,SAAS;AAAA,MAAU,OAAO,MAAM;AAAA,IACpE,IAAI,WAAW;AAAA,MAAO,OAAO,UAAW,MAA6B,KAAK;AAAA,EAC5E;AAAA,EACA;AAAA;AAGF,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,IAAI,SAAS,gBAAgB,SAAS,eAAe,SAAS,2BAA2B;AAAA,IACvF,OAAO;AAAA,EACT;AAAA,EACA,OAAO,iBAAiB,SAAS,qBAAqB,KAAK,MAAM,OAAO;AAAA;AAkB1E,IAAM,iBAAiB,IAAI,IAAI,CAAC,qBAAqB,gBAAgB,aAAa,WAAW,CAAC;AAE9F,IAAM,oBAAoB,CAAC,SACzB,mFAAmF,KAAK,IAAI;AAE9F,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,OAAO,SAAS,cAAc,eAAe,IAAI,IAAI,KAAK,kBAAkB,IAAI;AAAA;AAW3E,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAU,qBAAe,KAAK;AAAA,IAAG,OAAO;AAAA,EACxC,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,MAAM,MAAM,MAAM,OAAO;AAAA,EACzB,OAAO,QAAQ,oBAAoB,QAAQ,qBAAqB,QAAQ;AAAA;AASnE,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,QAAQ,WAAW;AAAA,EACnB,IAAI,OAAO,SAAS,qBAAqB,OAAO,SAAS;AAAA,IAAe,OAAO;AAAA,EAC/E,IAAI,OAAO,SAAS,kBAAkB;AAAA,IACpC,IAAI,eAAe,OAAO,KAAK;AAAA,MAAG,OAAO;AAAA,IACzC,OAAO,eAAe,OAAO,KAAK;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,oBAAoB,CAAC,UAA2B;AAAA,EAC3D,IAAU,qBAAe,KAAK;AAAA,IAAG,OAAO,mBAAmB,OAAO,cAAc;AAAA,EAChF,IAAoB,kCAAkB,KAAK;AAAA,IAAG,OAAO,MAAM;AAAA,EAC3D,OAAO,OAAO,KAAK;AAAA;AAwBd,IAAM,mBAAmB,CAC9B,QACA,QACA,MACA,OACA,WAA0B,mBAWnB,YAAI,UAAU,GAAG;AAAA,EActB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,UAAU,WAAW;AAAA,EAC3B,MAAM,WAA4B,CAAC;AAAA,EACnC,WAAW,UAAU,eAAe,MAAM,GAAG;AAAA,IAC3C,MAAM,UAAU,OAAO,OACpB,QAAQ,MAAM,WAAW,MAAM,CAAC,CAAC,EACjC,KAAY,gBAAQ,QAAO,GAAU,cAAM;AAAA,IAC9C,IAAW,iBAAU,OAAO,GAAG;AAAA,MAC7B,eAAe,QAAQ,MAAM;AAAA,MAC7B,OAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,MAAM,kBAAkB,QAAQ,OAAO;AAAA,IAC7C,SAAS,KAAK,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,MAAM,WAAW,UACb,mBAAmB,QAAQ,OAAO,IAClC,mBAAmB,QAAQ,OAAO;AAAA,IACtC,IAAI,CAAC,UAAU;AAAA,MACb,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,IAC/E;AAAA,EACF;AAAA,EACA,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,CAC9E;;;AJpII,MAAM,4BAA4B,MAAM;AAAA,EACxB;AAAA,EAArB,WAAW,CAAU,UAAoC;AAAA,IACvD,MAAM,uBAAuB,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG;AAAA,IADpE;AAAA,IAEnB,KAAK,OAAO;AAAA;AAEhB;AAeO,IAAM,aAAa,CACxB,QACA,YACA,SACA,IACA,WAA0B,mBAEnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAA4B,CAAC;AAAA,EACnC,WAAW,UAAU,eAAe,MAAM,GAAG;AAAA,IAC3C,MAAM,YAAY,wBAAwB;AAAA,MACxC,SAAS,WAAW,MAAM;AAAA,MAC1B,QAAQ,WAAW;AAAA,MACnB,SAAS,WAAW;AAAA,IACtB,CAAC;AAAA,IACD,MAAM,UAAU,OAAO,GAAG,KACX,mBACN,gBAAQ,SAAS,GACjB,gBAAQ,QAAO,GACf,cACT;AAAA,IACA,IAAW,kBAAU,OAAO,GAAG;AAAA,MAC7B,eAAe,QAAQ,MAAM;AAAA,MAC7B,OAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,WAAW,UACb,mBAAmB,QAAQ,OAAO,IAClC,mBAAmB,QAAQ,OAAO;AAAA,IACtC,IAAI,CAAC;AAAA,MAAU,OAAO,OAAc,aAAK,QAAQ,OAAO;AAAA,IACxD,SAAS,KAAK,EAAE,QAAQ,KAAK,kBAAkB,QAAQ,OAAO,EAAE,CAAC;AAAA,EACnE;AAAA,EACA,OAAO,OAAc,aAAK,IAAI,oBAAoB,QAAQ,CAAC;AAAA,CAC5D;AAiBI,IAAM,SAAS,CACpB,QACA,MACA,SACA,OAMO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,WAAW,QAAQ,YAAY,SAAS,EAAE;AAAA,CACzD;;;AKpIH;AAIO,IAAM,aAAa,OAAO,gBAAgB;AAc1C,IAAM,mBAAmB,CAC9B,WAEA,OAAO,KAAY,iBAAS,uBAAuB,MAAa,gBAAQ,UAAU,CAAC,CAAC;AAQ/E,IAAM,oBAAoB,CAAC,MAAc,cACvC,mBACL,GAAG,QAAQ,8EACT,2FACA,qDACJ;;;A5BsCK,IAAM,aAAa,SAAqB,aAAa;AAgB5D,IAAM,iBAAiB,CAAC,UACtB,iBAAiB,OAAO,MAAM,QAAQ,aAAa,OAAc,qBAAc,CAAC,CAAC,CAAC,CAAC,EAAE,KAC5E,YAAI,CAAC,SAAU,SAAS,aAAa,aAAa,aAAa,MAAM,KAAK,CAAE,CACrF;AAGF,IAAM,iBAAiB,CAAC,SACtB,SAAS,aAAa,YAAY;AAE7B,IAAM,qBAAqB,MACvB,gBACP,YACO,gBACL,WAAW,SAAS,GAAG;AAAA,EAErB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,WAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,GAClD;AAAA,EAQD,MAAa,WAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,WAAW,aAAa,WAAW,IAAI,KAAK,SAAS,IAAI,MAAM,SAAS,MAAM,GAAG;AAAA,MACnF,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,IAAI,CAAC,WAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,WAAW,IAAI;AAAA,IACtB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IAGvC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,eAAe,SAAS,IAAI,CAAC;AAAA,MACtD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,OAAO,SAAS,aAAa,QAAQ,MAAM,IAAI,IAC1C,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAOD,WAAkB,WAAG,UAAU,GAAG,QAAQ;AAAA,IAIxC,MAAM,SAAS,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,IACzD,OAAO,WAAW,IAAI;AAAA,IACtB,IAAI,WAAW,aAAa,CAAC,QAAQ,QAAQ,IAAI,GAAG;AAAA,MAClD,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,oBAAa,KAAK,IAAI,CAAC,CAAC;AAAA,IAC/E;AAAA,IACA,MAAM,QAAQ,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,IACxD,IAAI,UAAU,aAAa,CAAC,MAAM,OAAO;AAAA,MACvC,OAAO,OAAc,YACnB,IAAI,MACF,+CAA+C,SAAS,IAAI,oBAC1D,8EACA,kFACA,qDACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EASD,QAAe,WAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,MAAM,UAAsC,KAAK,MAAM,IAAI,GAAG,QAAQ,IAAI;AAAA,IAC1E,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,oBAAa,OAAO,CAAC;AAAA,GAC3E;AACH,CAAC,CACH,CACF;;A6BzJF,IAAM,UAAU,CAAC,OAAe,UAA0B;AAAA,EACxD,IAAI,SAAS,KAAK,KAAK,KAAK,UAAU,IAAI;AAAA,IACxC,MAAM,IAAI,MACR,0BAA0B,sDAC5B;AAAA,EACF;AAAA,EACA,OAAO,KAAK,UAAU,KAAK;AAAA;AAQ7B,IAAM,cAAc,CAAC,UAA0B;AAAA,EAC7C,MAAM,OAAO,QAAQ,gBAAgB,KAAK;AAAA,EAC1C,IAAI,WAAW;AAAA,EACf,IAAI;AAAA,IACF,WAAW,IAAI,IAAI,KAAK,EAAE;AAAA,IAC1B,MAAM;AAAA,EAGR,IAAI,aAAa,YAAY,aAAa,SAAS;AAAA,IACjD,MAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAAA,EACA,OAAO;AAAA;AAIT,IAAM,eAAqE;AAAA,EACzE,CAAC,YAAY,MAAM;AAAA,EACnB,CAAC,UAAU,QAAQ;AAAA,EACnB,CAAC,aAAa,WAAW;AAAA,EACzB,CAAC,YAAY,UAAU;AACzB;AAeO,IAAM,wBAAwB,CAAC,UAAmC,CAAC,MAAc;AAAA,EACtF,MAAM,YAAY,QAAQ,aAAa,QAAQ,aAAa,iBAAiB;AAAA,EAC7E,MAAM,SAAS,QAAQ,UAAU,QAAQ,UAAU,KAAK;AAAA,EACxD,MAAM,SAAS,aAAa,IAC1B,EAAE,OAAO,WACP,sBAAsB,WAAW,0BAA0B,kBAC/D;AAAA,EACA,MAAM,OACJ,QAAQ,iBAAiB,YACrB,KACA;AAAA,sBAA0B,YAAY,QAAQ,YAAY;AAAA,EAChE,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA,sBAAsB;AAAA,IACtB,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AAAA,CAAI;AAAA;;AC3Eb,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AC7BO,IAAM,MAAM,CAAC,OAAgB,aAClC,OAAO,UAAU,WAAW,QAAQ;AAE/B,IAAM,OAAO,CAAC,OAAgB,WAAW,OAC9C,OAAO,UAAU,WAAW,QAAQ;AA2B/B,IAAM,OAAO,CAAC,OAAgB,WAAW,UAC9C,UAAU,aAAa,UAAU,QAAQ,UAAU,KAC/C,WACA,UAAU,KAAK,UAAU,QAAQ,UAAU;AAS1C,IAAM,OAAO,CAAC,UAAqB,UAAU,YAAY,YAAY,QAAQ,MAAM;AAUnF,IAAM,MAAM,CAAC,WACjB,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,IAAK,SAAS,CAAC,GACxD,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAYN,IAAM,YAAY,CAAC,UAA2B;AAAA,EACnD,MAAM,QACJ,OAAO,UAAU,WACb,MAAM,MAAM,GAAG,IACf,MAAM,QAAQ,KAAK,IACjB,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IAC3C,CAAC;AAAA,EACT,OAAO,MACJ,IAAI,CAAC,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,EACjC,OAAO,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,EAClC,KAAK,CAAC,MAAM,UAAU,OAAO,KAAK,EAClC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,EACtB,KAAK,GAAG;AAAA;AAIN,IAAM,iBAAiB,CAAC,QAAgB;AAAA,EAC7C,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAAA,EACvC,IAAI,CAAC,KAAK,OAAO,QAAQ,IAAI,EAAE,SAAS,OAAO;AAAA,IAAG,OAAO;AAAA,EACzD,IAAI,CAAC,KAAK,MAAM,SAAS,KAAK,EAAE,SAAS,OAAO;AAAA,IAAG,OAAO;AAAA,EAC1D,OAAO;AAAA;AAmBF,IAAM,iBAAiB,CAAC,OAAgB,eAAgC;AAAA,EAC7E,MAAM,QACJ,OAAO,UAAU,WACb,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS;AAAA,IAC7B,OAAO,QAAQ,QAAQ,KAAK,MAAM,GAAG;AAAA,IACrC,OAAO,KAAK,WAAW,KAAK,eAAe,YACvC,CAAC,YAAY,OAAO,EAAE,IACtB,CAAC,OAAO,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,GAC/B,IACD,OAAO,UAAU,YAAY,UAAU,OACrC,OAAO,QAAQ,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC,IAChE,CAAC;AAAA,EACT,OAAO,MACJ,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,KAAK,GAAG,eAAe,KAAK,CAAC,CAAU,EAClE,OAAO,EAAE,SAAS,QAAQ,EAAE,EAC5B,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,EACvC,KAAK,EACL,KAAK,GAAG;AAAA;AAWN,IAAM,MAAM,CAAC,OAAgB,aAAqB;AAAA,EACvD,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,SAAS,OAAO,SAAS,KAAK,KAAK,GAAG,EAAE;AAAA,EAC9C,OAAO,OAAO,MAAM,MAAM,IAAI,WAAW;AAAA;AA6BpC,IAAM,aAAa,CACxB,QACA,UAC2B;AAAA,EAC3B,MAAM,UAAU,IAAI,IAAI,KAAK;AAAA,EAC7B,MAAM,OAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;AAAA,IACjD,IAAI,UAAU,aAAa,CAAC,QAAQ,IAAI,GAAG;AAAA,MAAG,KAAK,OAAO;AAAA,EAC5D;AAAA,EACA,OAAO,QAAQ,SAAS,IAAI,OAAO,KAAK,MAAM,QAAQ,CAAC,GAAG,OAAO,EAAE,KAAK,GAAG,EAAE;AAAA;;;AC/KxE,IAAM,mBAAmB;AAczB,IAAM,cAAc,CAAC,UAAyB,GAAG,MAAM,UAAU,MAAM;AAgBvE,IAAM,QAAQ,CAAC,WAA4D;AAAA,EAChF,SAAS,MAAM,WAAW;AAAA,EAC1B,QAAQ,OAAO,MAAM,MAAM;AAAA,EAC3B,SAAS,MAAM,UAAU,MAAM;AAAA,EAC/B,SAAS,MAAM;AAAA,EACf,QAAQ,MAAM;AAChB;AAaO,IAAM,gBAAe,CAC1B,MACA,UACmC;AAAA,EACnC,IAAI,KAAK,WAAW,aAAa,KAAK,YAAY;AAAA,IAAW;AAAA,EAC7D,OAAO;AAAA,IACL,SAAS,KAAK,KAAK,OAAO;AAAA,IAC1B,QAAQ,IAAI,KAAK,QAAQ,CAAC;AAAA,IAC1B,aAAa,YAAY,KAAK;AAAA,IAG9B,SAAS,KAAK,KAAK,SAAS,IAAI;AAAA,IAChC,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,EAChB;AAAA;AAQK,IAAM,WAAU,CAAC,YAAgC,UACtD,WAAW,aAAa,MAAM,WAAW,OACzC,WAAW,WAAW,MAAM,UAC5B,WAAW,YAAY,MAAM;;;AC3ExB,IAAM,UAAS,CAAC,SACrB,OAAO,YACL,OAAO,QAAQ,IAA+B,EAAE,OAC9C,CAAC,MAA6B,OAAO,EAAE,OAAO,QAChD,CACF;AAOK,IAAM,cAAa,CACxB,UACA,MACA,aACwB,UAAU,UAAU,QAAO,IAAI,GAAG,QAAQ;;;AHkG7D,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAYD,IAAM,YAAY,CAAC,UAAyB;AAAA,EAC1C,MAAM,QAAQ,EAAE,SAAS,MAAM,SAAS,QAAQ,MAAM,OAAO;AAAA,EAC7D,OAAO,iBACL,OAAO,MAAM,QAAQ,aAAa,OAAc,2BAAmB,KAAK,CAAC,CAC3E,EAAE,KAAY,YAAI,CAAC,SAAU,SAAS,aAAa,aAAa,cAAa,MAAM,KAAK,CAAE,CAAC;AAAA;AAI7F,IAAM,kBAAiB,CAAC,SACtB,SAAS,aAAa,YAAY;AAQ7B,IAAM,0BAA0B,MAC5B,iBACP,iBACO,gBACL,gBAAgB,SAAS,GAAG;AAAA,EAM1B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,WAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,GAC7C;AAAA,EACD,MAAa,WAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,kBAAkB,MAAM,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,UAAU,IAAI;AAAA,IAGlC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,oBAAoB,GAAG,KAAK,UAAU,KAAK,SAAS;AAAA,MAC7E,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IAKA,OAAO,SAAS,aAAa,SAAQ,MAAM,IAAI,IAC1C,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,WAAG,UAAU,GAAG,QAAQ;AAAA,IAMxC,MAAM,SAAS,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACpD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,UAAU,KAAK,4DACrB,kFACA,6EACA,kFACA,oFACA,uBACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO,YAAW,kBAAkB,MAAM,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MAC1B,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,2BAAmB,MAAM,IAAI,CAAC,CAAC;AAAA,IACtF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACnD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,UAAU,KAAK,2DACrB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAe,WAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,8BAAsB,EAAE,SAAS,KAAK,SAAS,QAAQ,KAAK,OAAO,CAAC,CAC7E;AAAA,GACD;AACH,CAAC,CACH,CACF;;AI1NF,qBAAS;AACT,uBAAS;AACT;;;ACxBA;AAIO,IAAM,aAAa,CACxB,SACG;AAAA,EAEH,MAAM,cAAc,CAAC,UACnB,OAAO,KAAK,aAAa,aAAa,KAAK,SAAS,KAAK,IAAI,KAAK;AAAA,EAqBpE,MAAM,cAAc,CAAC,OAAc,aAC1B,gBAAQ,MAAM;AAAA,IACnB,MAAM,SAAS,YAAY,KAAK,GAAG;AAAA,IACnC,OAAO,WAAW,YACP,eACP,UAAU,QAAQ,KAAK,WAAW,KAAK,GAAG,QAAQ;AAAA,GACvD;AAAA,EAOH,MAAM,cAAc,CAAC,UACZ,gBAAQ,MAAM;AAAA,IACnB,MAAM,SAAS,YAAY,KAAK,GAAG;AAAA,IACnC,IAAI,WAAW;AAAA,MAAW,OAAc;AAAA,IACxC,MAAM,OAAO,KAAK,aAAa,KAAK;AAAA,IACpC,OAAO,SAAS,YAAmB,eAAO,UAAU,QAAQ,MAAM,KAAK;AAAA,GACxE;AAAA,EAEH,OAAO,EAAE,aAAa,YAAY;AAAA;;;AClC7B,IAAM,aAAa,CACxB,UACA,MACA,OACA,SACsB,SAAQ,MAAM,KAAK,KAAK,OAAO,KAAK,IAAI,EAAE,WAAW,IAAI,YAAY;;;ACL7F,IAAM,SAAQ,CAAC,WAA2B;AAAA,EACxC,KAAK,MAAM,QAAQ,OAAO,MAAM;AAAA,EAChC,SAAS,MAAM,YAAY,QAAQ,MAAM;AAAA,EACzC,MAAM,MAAM,QAAQ;AAAA,EACpB,qBAAqB,MAAM,wBAAwB;AAAA,EACnD,iBAAiB,MAAM,qBAAqB,OAAO,MAAM;AAAA,EACzD,UAAU,MAAM;AAAA,KACZ,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,UAAU,MAAM,OAAO,EAAE;AAAA,KACvE,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC/D,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB,MAAM,kBAAkB;AAAA,KACzF,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,KACnD,MAAM,qBAAqB,YAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,iBAAiB;AAAA,KACtF,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,UAAU,MAAM,IAAI,EAAE;AACpE;AAEO,IAAM,gBAAgB;AAAA,EAQ3B,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,KAAK,KAAK,KAAK,QAAQ,KAAK;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,IAAI;AAAA,IACnC,SAAS,UAAU,KAAK,UAAU;AAAA,IAClC,UAAU,eAAe,KAAK,aAAa,SAAS;AAAA,IACpD,IAAI,MAAM;AAAA,IACV,MAAM,KAAK,KAAK,SAAS,UAAU;AAAA,IACnC,YAAY,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;AAAA,IACtE,kBAAkB,KAAK,KAAK,mBAAmB,EAAE;AAAA,IACjD,qBAAqB,KAAK,KAAK,sBAAsB,MAAM;AAAA,IAC3D,MAAM,KAAK,KAAK,SAAS,EAAE;AAAA,IAC3B,iBAAiB,eAAe,KAAK,gBAAgB;AAAA,IACrD,iBAAiB,KAAK,KAAK,kBAAkB,KAAK;AAAA,IAClD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IACnC,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,MAAM,UAAU,KAAK,OAAO;AAAA,EAC9B;AAAA,EACA,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA,EAGxD,UAAU,EAAE,QAAQ,4BAA4B,QAAQ,+BAA+B;AAAA,EACvF,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,YAC9B,WAAW,aAAa,MAAM,YAAY,UAC1C,WAAW,SAAS,MAAM,QAAQ,SAClC,WAAW,UAAU,MAAM,QAAQ,eACnC,WAAW,0BAA0B,MAAM,wBAAwB,WACnE,WAAW,sBAAsB,MAAM,qBAAqB,UAC3D,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,SAAS,aAAa,WAAW,SAAS,UAAU,MAAM,IAAI,OACpE,MAAM,YAAY,aAAa,WAAW,YAAY,UAAU,MAAM,OAAO,OAC7E,MAAM,sBAAsB,aAC3B,WAAW,sBAAsB,MAAM,uBACxC,MAAM,qBAAqB,aAC1B,WAAW,qBAAqB,eAAe,MAAM,gBAAgB,OACtE,MAAM,aAAa,aAClB,WAAW,aAAa,eAAe,MAAM,UAAU,SAAS;AAAA,EACpE,MAAM,CAAC,UAAU,kBAAkB,MAAM;AAAA,EACzC,YAAY;AACd;;;AC7FA;AACA;AACA;AACA;AAMO,IAAM,mBAAmB,CAC9B,OACA,OAAO,cAAc,WAAW,KAAK,MACD;AAAA,EACpC;AAAA,IACE,kBAAkB;AAAA,IAClB,qBAAqB;AAAA,IACrB,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,OACd;AAAA,MACD;AAAA,EACJ,OAAO;AAAA,OACF;AAAA,IACH,IAAI,MAAM;AAAA,IACV;AAAA,IACA;AAAA,OACI,mBAAmB,YAAY,CAAC,IAAI,EAAE,eAAe;AAAA,OACrD,kBAAkB,YAAY,CAAC,IAAI,EAAE,cAAc;AAAA,EACzD;AAAA;AAQK,IAAM,gBAAgB,CAAC,UAC5B,OAAO,MAAM,QAAQ,QAAQ,OAAe,yBAAiB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAGvE,iBAAQ,CAAC,SACP,2BAA2B,cAAe,gCAAwB,CAAC,EAAE;AAAA,KACvE;AAAA,EACH,eAAe;AAAA,EACf,UAAU;AACZ,CAAC,EAAE,KACM,kBACL,MACE,IAAI,kBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC,CACL,GACO,YAAG,IAAI,CAChB,CACF,GACO,aAAI,CAAC,SACV,cAAc,WACZ;AAAA,KACK;AAAA,EACH,YAAY,KAAK;AAAA,EACjB,kBAAkB,KAAK;AAAA,EACvB,qBAAqB,KAAK;AAAA,EAC1B,iBACE,OAAO,KAAK,kBAAkB,YAAY,KAAK,kBAAkB,OAC7D,OAAO,YACL,OAAO,QAAQ,KAAK,aAAa,EAAE,IAAI,EAAE,KAAK,WAAW;AAAA,IACvD,IAAI,WAAW,KAAK,GAAG;AAAA,IACvB;AAAA,EACF,CAAC,CACH,IACA,KAAK;AAAA,EACX,iBAAiB,KAAK;AACxB,GACA,KACF,CACF,GACO,kBAAS,qBAAqB,MAAa,iBAAQ,SAAS,CAAC,GAC7D,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAEK,IAAM,kBAAkB,CAAC,UAC9B,OAAO,MAAM,QAAQ,aAAa,MAAc,4BAAoB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC9E,kBAAS,qBAAqB,MAAa,aAAI,GAC/C,kBAAS,YAAY,MAAa,aAAI,CAC/C;;;AJ9CF;AACA;AAqEO,IAAM,mBAAmB,UAA2B,mBAAmB;AAO9E,MAAQ,aAAa,gBAAgB,WAAW,aAAa;AAGtD,IAAM,2BAA2B,MAC7B,iBACP,kBACO,iBACL,iBAAiB,SAAS,GAAG;AAAA,EAC3B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,cAAc,IAAI;AAAA,EACtC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,YAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,cAAc,IAAI;AAAA,IACtC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,cAAc,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GACxE;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,cAAc,IAAI;AAAA,IACtC,OAAO,YAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,YAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OACL,KAAK,QACL,aACA,MACQ,6BAAoB,iBAAiB,IAAI,CAAC,CACpD;AAAA,IACF,EAAO;AAAA,MACL,MAAM,OAAO,WACX,cAAc,SACd,MACA,MACA,cAAc,WAAW,IAAI,CAC/B;AAAA,MACA,IAAI,SAAS;AAAA,QACX,OAAO,OACL,KAAK,QACL,aACA,MACQ,0BAAiB,iBAAiB,MAAM,IAAI,CAAC,CACvD;AAAA;AAAA,IAEJ,MAAM,QAAQ,OAAO,cAAc,IAAI;AAAA,IACvC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MACF,GAAG,cAAc,KAAK,IAAI,4DAC5B,CACF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAAW,gBAAgB,IAAI;AAC5C,CAAC,CACH,CACF;;AK5HF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACPO,IAAM,mBAAkE;AAAA,EAC7E,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACP;AAQO,IAAM,WAAW,CAAC,UAA2B,MAAM,QAAQ,MAAM;AAQjE,IAAM,iBAAiB,CAAC,UAA2B,SAAS,MAAM,aAAa,MAAM;AAGrF,IAAM,aAAa,CAAC,UAA2B,GAAG,eAAe,KAAK,KAAK,SAAS,KAAK;AAezF,IAAM,aAAa,CAAC,UAAmD;AAAA,EAC5E,IAAI,MAAM,SAAS,SAAS,MAAM,mBAAmB,WAAW;AAAA,IAC9D,OAAO,EAAE,eAAe,MAAM,eAAe;AAAA,EAC/C;AAAA,EACA,MAAM,aAAa,MAAM,SAAS,QAAQ,KAAK,MAAM,UAAU,IAAI;AAAA,EACnE,OAAO,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AAAA;AAU/C,IAAM,UAAU,CAAC,MAAe,WACpC,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAC5B,OAAO,CAAC,QAAwC,OAAO,QAAQ,YAAY,QAAQ,IAAI,EACvF,KAAK,CAAC,QAAQ,IAAI,YAAY,SAAS,KAAK,CAAC;AAY3C,IAAM,mBAAmB,CAC9B,MACA,UACqC;AAAA,EACrC,MAAM,MAAM,QAAQ,MAAM,KAAK;AAAA,EAC/B,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,OAAO;AAAA,IACL,MAAM,KAAK,IAAI,OAAO;AAAA,IACtB,QAAQ,KAAK,IAAI,UAAU;AAAA,IAC3B,MAAM,KAAK,IAAI,OAAO;AAAA,IACtB,MAAM,MAAM;AAAA,IACZ,MAAM,SAAS,KAAK;AAAA,IACpB,MAAM,MAAM;AAAA,IACZ,QAAQ,KAAK,IAAI,SAAS;AAAA,IAC1B,MAAM,IAAI,IAAI,SAAS,EAAE;AAAA,IACzB,SAAS,KAAK,IAAI,UAAU;AAAA,IAC5B,eAAe,KAAK,IAAI,iBAAiB;AAAA,IACzC,OAAO,KAAK,IAAI,QAAQ;AAAA,IACxB,SAAS,KAAK,IAAI,qBAAqB;AAAA,EACzC;AAAA;;;ACxHF;AACA;AAcA,IAAM,WAAW,CAAC,UAA2B;AAAA,EAC3C,MAAM,OAAO,MAAM;AAAA,EACnB,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAgB,EAAE,KAAK,CAAC,CAAC,EAAE,KACnE,aAAI,CAAC,SAAoB,IAAI,CACtC;AAAA,SACG;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAgB,EAAE,KAAK,CAAC,CAAC,EAAE,KACnE,aAAI,CAAC,SAAoB,IAAI,CACtC;AAAA,SACG;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAgB,EAAE,KAAK,CAAC,CAAC,EAAE,KACnE,aAAI,CAAC,SAAoB,IAAI,CACtC;AAAA;AAAA;AAKC,IAAM,aAAa,CAAC,UACzB,SAAS,KAAK,EAAE,KACP,aAAI,CAAC,SAAS,iBAAiB,MAA4C,KAAK,CAAC,CAC1F;AAGK,IAAM,eAAe,CAAC,UAA2B;AAAA,EACtD,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,KAAK,SAAS,KAAK;AAAA,EACzB,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,OACL,MAAM,QACN,aACA,MACM,wBAAkB;AAAA,WAClB,MAAM,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,eAAe;AAAA,QAClF,OAAO;AAAA,QACP;AAAA,MACF,CAAC,CACH;AAAA,SACG;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,IAAI,KAAK,CAAC,CAAC;AAAA,SACjF;AAAA,MACH,OAAO,OACL,MAAM,QACN,aACA,MACM,wBAAkB;AAAA,WAClB,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,MAAM,aAAa,MAAM,IAAI;AAAA,QACrF,MAAM;AAAA,QACN;AAAA,MACF,CAAC,CACH;AAAA;AAAA;AAMC,IAAM,eAAe,CAAC,UAA2B;AAAA,EACtD,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,KAAK,SAAS,KAAK;AAAA,EACzB,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;AAAA,SACxF;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,IAAI,KAAK,CAAC,CAAC;AAAA,SACjF;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC;AAAA;AAAA;AASzF,IAAM,aAAa,CAAC,UACzB,IAAI,MACF,GAAG,WAAW,KAAK,SAAS,MAAM,cAAc,SAAS,KAAK,oBAC5D,GAAG,MAAM,aAAa,MAAM,+DAC5B,qEACJ;;;AFkEK,IAAM,oBAAoB,UAA4B,sBAAsB;AAAA,EACjF,sBAAsB;AACxB,CAAC;AA6BM,IAAM,kBAAyB,YAAG,UAAU,GAAG,QAAmC;AAAA,EACvF,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,EACnC,OAAO,YAAW,iBAAiB,KAAK,OAAO,WAAW,IAAI,GAAG,SAAS,SAAS;AAAA,EACnF,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,OAAO,aAAa,IAAI;AAAA,EACxB,MAAM,QAAQ,OAAO,WAAW,IAAI;AAAA,EACpC,IAAI,UAAU;AAAA,IAAW,OAAO,OAAc,aAAI,WAAW,IAAI,CAAC;AAAA,EAClE,OAAO;AAAA,CACR;AAEM,IAAM,4BAA4B,MAC9B,iBACP,mBACO,iBACL,kBAAkB,SAAS,GAAG;AAAA,EAG5B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,WAAW,IAAI;AAAA,EAEnC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,iBAAiB,KAAK,OAAO,WAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrF,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,IACnC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,iBAAiB,KAAK,OAAO,WAAW,IAAI,GAAG,IAAI;AAAA,MACrE,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,OAAO;AAAA,GACzB;AAAA,EACD,WAAW,GAAG,WAAW,gBAAgB,EAAE,KAAK,CAAC;AAAA,EAMjD,QAAQ,GAAG,WAAW,aAAa,IAAI;AACzC,CAAC,CACH,CACF;;AG9KF,qBAAS;AACT;AACA;;;AChEA,uBAAS;AAET;;;ACAA;AACA;AACA;AAMO,MAAM,iBAAiB,MAAM;AAAA,EAEvB;AAAA,EACA;AAAA,EACA;AAAA,EAHX,WAAW,CACA,QACA,QACA,MACT,QACA;AAAA,IACA,MAAM,OAAO,UAAU,WAAW,OAAO,MAAM,MAAM,QAAQ;AAAA,IALpD;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,mBAAmB,CACvB,QACA,MACA,aAEA,IAAI,SACF,GACA,QACA,MACA,uBAAuB,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,GAChF;AAgBF,IAAM,SAAS,CAAC,SAA0B;AAAA,EACxC,MAAM,SAAS,IAAI;AAAA,EACnB,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,OAAO,UAAU;AAAA,MAAU,OAAO,OAAO,KAAK,KAAK;AAAA,IAClD;AAAA,iBAAW,QAAQ;AAAA,QAAO,OAAO,OAAO,KAAK,IAAI;AAAA,EACxD;AAAA,EACA,OAAO,OAAO,SAAS;AAAA;AAGzB,IAAM,eAAe,CACnB,QACA,SACA,MACA,YACA,QACA,SACG;AAAA,EACH,MAAM,MAAM,GAAG,WAAW;AAAA,EAsB1B,OAAyB,wBAAK,MAAM,EAAE,GAAG,EAAE,KACvB,8BAAW,EAAE,eAAe,cAAc,YAAY,MAAM,EAAE,CAAC,GACjF,SAAS,YACL,CAAC,SAAS,OACQ,4BAAS,OAAO,IAAI,GAAG,mCAAmC,CAClF;AAAA;AAGF,IAAM,aAAa,CACjB,QACA,YACA,QACA,MACA,MACA,YAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,UAAU,aAAa,QAAQ,SAAS,MAAM,YAAY,QAAQ,IAAI;AAAA,EAC5E,OAAO,OAAO,OACX,QAAQ,OAAO,EACf,KAAY,kBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,CACjF;AAEH,IAAM,eAAe,CACnB,UAKA,QACA,SAEO,aAAI,UAAU,GAAG;AAAA,EAOtB,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AAAA,IAGnD,MAAM,SAAS,OAAO,SAAS,KAAK,KAAY,uBAAc,MAAM,EAAE,CAAC;AAAA,IACvE,OAAO,OAAc,cAAK,IAAI,SAAS,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,EAC7F;AAAA,EACA,MAAM,OAAQ,OAAO,SAAS,KAAK,KAC1B,kBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CACzE;AAAA,EACA,OAAO,KAAK;AAAA,CACb;AAGI,IAAM,UAAU,CACrB,QACA,YACA,QACA,MACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WACJ,OAAO,WAAW,QACd,OAAO,iBAAiB,QAAQ,QAAQ,MAAM,CAAC,YAC7C,aAAa,QAAQ,SAAS,MAAM,YAAY,QAAQ,IAAI,CAC9D,EAAE,KACO,kBAAS,CAAC,YACf,QAAQ,QAAQ,YACZ,iBAAiB,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,IAC/D,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,OAAO,CAAC,CACnD,CACF,IACA,OAAO,WAAW,QAAQ,YAAY,QAAQ,MAAM,MAAM,OAAO,GAAG;AAAA,EAC1E,OAAO,OAAO,aAAgB,UAAU,QAAQ,IAAI;AAAA,CACrD;AAmDI,IAAM,MAAM,CACjB,QACA,MACA,QACA,MACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,QAAW,QAAQ,YAAY,QAAQ,MAAM,IAAI;AAAA,CAChE;;;AD9MI,IAAM,gBAAgB,CAC3B,SACG;AAAA,EACH,QAAQ,2BAAa,8BAAgB,WAAW,IAAI;AAAA,EAGpD,MAAM,OAAO,CAAC,UACZ,IACE,MAAM,QACN,KAAK,YAAY,QACjB,OACA,KAAK,KAAK,KAAK,CACjB,EAAE,KACO,aAAI,CAAC,SAAU,QAAQ,OAAO,YAAY,KAAK,WAAW,MAAM,KAAK,CAAE,GACvE,uBAAc,MAAG;AAAA,IAAG;AAAA,GAAS,CACtC;AAAA,EAEF,OAAO;AAAA,IAOL;AAAA,IACA;AAAA,IAEA;AAAA,IAKA,MAAM,CAAC,MAAoB,WAClB,aAAI,UAAU,GAAG;AAAA,MAItB,IAAI,CAAC,YAAW,IAAI;AAAA,QAAG;AAAA,MAOvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,MAC7C,OAAO,aAAY,IAAI;AAAA,MACvB,IAAI,WAAW;AAAA,QAAW;AAAA,MAC1B,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAG7B,IAAI,SAAS,WAAW;AAAA,QAMtB,OAAO,aAAY,MAAM,IAAI;AAAA,QAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,MAC5B;AAAA,MACA,IAAI,KAAK,QAAQ,MAAM,IAAI;AAAA,QAAG,OAAO,EAAE,QAAQ,OAAO;AAAA,MAEtD,OAAO,KAAK,eAAe,YACtB,EAAE,QAAQ,UAAU,IACpB,EAAE,QAAQ,SAAS;AAAA,KACzB;AAAA,IAEH,WAAW,CAAC,SACH,aAAI,UAAU,GAAG;AAAA,MACtB,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAM7B,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,MAC3C,OAAO,aAAY,IAAI;AAAA,MACvB,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,IACL,KAAK,QACL,aACA,QACA,KAAK,WAAW,IAAI,GACpB,KAAK,WAAW,IAAI,CACtB;AAAA,MACF,EAAO,SAAI,KAAK,eAAe,WAAW;AAAA,QAyBxC,MAAM,OAAO,WAAW,KAAK,SAAS,MAAM,MAAM,KAAK,WAAW,IAAI,CAAC;AAAA,QACvE,IAAI,SAAS,WAAW;AAAA,UACtB,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,KAAK,KAAK,IAAI,GAAG,IAAI;AAAA,QACnE;AAAA,MACF;AAAA,MACA,MAAM,QAAQ,OAAO,KAAK,IAAI;AAAA,MAC9B,IAAI,UAAU,WAAW;AAAA,QAOvB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,KAAK,KAAK,IAAI,oEACf,sFACA,4DACJ,CACF;AAAA,MACF;AAAA,MACA,OAAO;AAAA,KACR;AAAA,IAOH,SAAS,CAAC,SAAgB,IAAI,KAAK,QAAQ,aAAa,UAAU,KAAK,KAAK,IAAI,CAAC;AAAA,EACnF;AAAA;AAoCK,IAAM,cAAc,CACzB,SACG;AAAA,EACH,MAAM,MAAM,cAAc,IAAI;AAAA,EAC9B,OAAO;AAAA,IACL,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,GAAG,WAA4B,IAAI,KAAK,IAAI;AAAA,IAClD,MAAM,GAAG,MAAM,aACb,IAAI,KAAK,MAAM,MAAM;AAAA,IACvB,WAAW,GAAG,WAA4B,IAAI,UAAU,IAAI;AAAA,IAC5D,QAAQ,GAAG,WAA4B,IAAI,QAAQ,IAAI;AAAA,EACzD;AAAA;;;AD/DK,IAAM,kBAAkB,UAA0B,kBAAkB;AAE3E,IAAM,WAAW,YAA+C;AAAA,EAsB9D,YAAY,CAAC,MAAM,WAAW,EAAE,MAAM,MAAM,MAAM,OAAO,KAAK,IAAI,EAAE;AAAA,EACpE,YAAY,MAAM;AAAA,EAMlB,YAAY,CAAC,WAAW,GAAG,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,IAAI;AAAA,EACjE,UAAU,EAAE,QAAQ,qCAAqC;AAAA,EAUzD,SAAS,CAAC,YAAY,UAAU,WAAW,UAAU,MAAM;AAAA,EAC3D,MAAM,CAAC,UAAU,sBAAsB,MAAM;AAAA,EAQ7C,YAAY,CAAC,WAAW,EAAE,OAAO,KAAK,MAAM,KAAK,KAAK,IAAI;AAC5D,CAAC;AAEM,IAAM,0BAA0B,MAC5B,iBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,KASvB;AAAA,EAEH,QAAQ,MAAa;AAAA,EAWrB,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,QAAQ,OAAO,SAAS,UAAU,EAAE,KAAK,CAAC;AAAA,IAChD,IAAI,MAAM,UAAU,KAAK,OAAO;AAAA,MAC9B,OAAO,OAAc,aACnB,IAAI,MACF,sBAAsB,KAAK,oDACzB,oBAAoB,MAAM,QAAQ,QAAQ,yBAC1C,GAAG,KAAK,QAAQ,QAAQ,yDACxB,4EACA,gFACA,yBACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AACH,CAAC,CACH,CACF;;AGxLF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACtDA;AACA;;;ACwDO,IAAM,UAAU,CACrB,MACA,UACiC;AAAA,EACjC,MAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GACxC,OACC,CAAC,UAA4C,OAAO,UAAU,YAAY,UAAU,IACtF,EACC,KAAK,CAAC,UAAU,MAAM,YAAY,MAAM,IAAI;AAAA,EAC/C,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,OAAO;AAAA,IACL,WAAW,KAAK,IAAI,YAAY;AAAA,IAChC,YAAY,IACV,MAAM,QAAQ,IAAI,aAAa,IAC3B,IAAI,cAAc,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IACvD,CAAC,CACP;AAAA,IACA,eAAe,KAAK,IAAI,gBAAgB;AAAA,IACxC,kBAAkB,IAAI,IAAI,qBAAqB,EAAE;AAAA,IACjD,MAAM,MAAM;AAAA,EACd;AAAA;AASK,IAAM,eAAe;AACrB,IAAM,gBAAgB;AAGtB,IAAM,aAAa,CAAC,UAAuB,SAAS,MAAM,gBAAgB,MAAM;AAGhF,IAAM,iBAAiB;AAG9B,IAAM,QAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAMtC,IAAM,cAAa,CAAC,WAAgD;AAAA,KACtE,MAAM,eAAe,KAAK,MAAM,cAAc,CAAC;AAAA,KAC/C,MAAM,UAAU,MAAM,WAAW,YAAY,YAAY,OAAO,MAAM,MAAM,CAAC;AAClF;AAWO,IAAM,cAAa,CAAC,UACzB,IAAI,MACF,GAAG,WAAW,KAAK,8DACjB,aAAa,MAAM,sEACnB,yCACJ;AAEK,IAAM,eAAe,CAAC,UAC3B,IAAI,MACF,GAAG,WAAW,KAAK,iEACjB,aAAa,MAAM,6EACnB,yDACJ;;;ADnHK,IAAM,SAAS,CAAC,UACrB,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAe,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACvE,aAAI,CAAC,SAAS,QAAQ,MAA4C,KAAK,CAAC,CACjF;AAGF,IAAM,oBAAoB,CAAC,WACxB;AAAA,KACI,YAAW,KAAK;AAAA,EACnB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AACd;AAMF,IAAM,aAAa,CAAC,OAAoB,SAC/B,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,eAAe,WAAW,GAAG;AAAA,IAC3D,MAAM,SAAS,OAAO,OACpB,MAAM,QACN,QACA,OACM,yBAAkB,EAAE,MAAM,MAAM,MAAM,KAAK,CAAC,CACpD,EAAE,KAAY,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CAAC;AAAA,IAC5C,IAAI,QAAQ,WAAW,WAAW;AAAA,MAChC,IAAI,OAAO,eAAe;AAAA,QAAM;AAAA,MAChC,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,eAAe,uBAAuB,OAAO,cAAc,wBAC5E,wFACA,yBAAyB,MAAM,cAAc,aACjD,CACF;AAAA,IACF;AAAA,IACA,OAAc,eAAM,eAAe,IAAI;AAAA,EACzC;AAAA,EACA,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,eAAe,kCAChC,GAAG,OAAO,gBAAgB,YAAY,oDACtC,iEACA,UAAU,MAAM,0EAChB,qDACJ,CACF;AAAA,CACD;AAGI,IAAM,WAAW,CAAC,UAChB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,aACA,MACM,wBAAiB,kBAAkB,KAAK,CAAC,CACjD;AAAA,EAIA,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,4DACjB,iEACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,WAAW,OAAO,IAAI;AAAA,CAC9B;AAYI,IAAM,YAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,aACA,MACM,wBAAiB;AAAA,IACrB,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,OAER,MAAM,oBAAoB,OAAO,EAAE,cAAc,IAAI,IAAI,CAAC;AAAA,OAC1D,MAAM,uBAAuB,OAAO,EAAE,iBAAiB,IAAI,IAAI,CAAC;AAAA,EACtE,CAAC,CACH,EAAE,KAAY,kBAAS,kBAAkB,MAAa,iBAAQ,EAAE,CAAC,CAAC;AAAA,EAGlE,IAAI,SAAS;AAAA,IAAI,OAAO,WAAW,OAAO,IAAI;AAAA,CAC/C;;;ADgBI,IAAM,gBAAgB,UAAwB,kBAAkB;AAAA,EACrE,sBAAsB;AACxB,CAAC;AAkBM,IAAM,wBAAwB,MAC1B,iBACP,eACO,iBACL,cAAc,SAAS,GAAG;AAAA,EAMxB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,OAAO,IAAI;AAAA,GAC1B;AAAA,EAaD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,gBAAgB,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACxE,IAAI,WAAW,aAAa,KAAK,SAAS,OAAO,MAAM;AAAA,MACrD,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,OAAO,IAAI;AAAA,IAC/B,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,gBAAgB,YAAW,IAAI,GAAG,IAAI;AAAA,MACxD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAEA,OAAO,EAAE,QAAQ,OAAO;AAAA,GACzB;AAAA,EASD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,OAAO,IAAI;AAAA,IAC/B,IAAI,SAAS;AAAA,MAAW,OAAO;AAAA,IAC/B,OAAO,SAAS,IAAI;AAAA,IACpB,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,IAChC,IAAI,UAAU;AAAA,MAAW,OAAO,OAAc,aAAI,YAAW,IAAI,CAAC;AAAA,IAClE,OAAO;AAAA,GACR;AAAA,EAQD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IAUrC,KAAK,OAAO,OAAO,IAAI,OAAO;AAAA,MAAW;AAAA,IACzC,OAAO,UAAU,IAAI;AAAA,IACrB,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,IAChC,IAAI,UAAU;AAAA,MAAW,OAAO,OAAc,aAAI,aAAa,IAAI,CAAC;AAAA,GACrE;AACH,CAAC,CACH,CACF;;AG1MF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACYA;AACA;AAQA,IAAM,WAAW,CAAC,UACf,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC,GAAG,OACxD,CAAC,UAA8B,OAAO,UAAU,YAAY,UAAU,IACxE;AAeK,IAAM,YAAY,CAAC,SAAiC;AAAA,EACzD,MAAM,OAAO,KAAK;AAAA,EAClB,MAAM,QAAmB,OAAO,SAAS,YAAY,SAAS,OAAQ,OAAqB,CAAC;AAAA,EAC5F,MAAM,OAAO,CAAC,SAAiC;AAAA,IAC7C,GAAI,KAAK,YAAY,QAAQ,CAAC,IAAI,IAAI,CAAC;AAAA,IACvC,GAAG,SAAS,IAAI,EAAE,QAAQ,IAAI;AAAA,EAChC;AAAA,EACA,OAAO,KAAK,KAAK;AAAA;AAoBZ,IAAM,UAAU,CAAC,MAAiB,UACvC,UAAU,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,OAAO,OAAO,GAAG,MAAM,KAAK;AAkD/D,IAAM,gBAAgB,CAAC,MAAiB,WAA4C;AAAA,EACzF,cAAc,KAAK,KAAK,qBAAqB;AAAA,EAC7C,cAAc,IAAI,KAAK,iBAAiB,CAAC;AAAA,EACzC,cAAc,KAAK,KAAK,eAAe;AAAA,EACvC,MAAM,KAAK,KAAK,OAAO;AAAA,EACvB,IAAI,KAAK,KAAK,KAAK;AAAA,EACnB,MAAM,KAAK,KAAK,SAAS,OAAO,OAAO,MAAM,KAAK,GAAG;AAAA,EACrD,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK;AAAA,EAClC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,EACvB,UAAU,IAAI,KAAK,aAAa,CAAC;AAAA,EACjC,QAAQ,KAAK,KAAK,SAAS;AAAA,EAC3B,aAAa,IAAI,KAAK,gBAAgB,CAAC;AACzC;AAmBO,IAAM,UAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAe,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACvE,aAAI,CAAC,MAAM;AAAA,EAChB,MAAM,OAAO,QAAQ,GAA2B,MAAM,KAAK;AAAA,EAC3D,OAAO,SAAS,YAAY,YAAY,cAAc,MAAM,KAAK;AAAA,CAClE,CACH;;;AC5LF;AACA;AAmBO,IAAM,sBAAmC;AAEhD,IAAM,WAAW,CAAC,UAAwB,OAAO,OAAO,MAAM,KAAK,QAAQ,MAAM;AAM1E,IAAM,gBAAgB,CAAC,OAAqB,SAAyC;AAAA,EAC1F;AAAA,KACI,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,sBAAsB,MAAM,aAAa;AACzF;AAEO,IAAM,YAAmB,YAAG,UAAU,CAAC,MAAoB;AAAA,EAChE,IAAI,KAAK,QAAQ,WAAW;AAAA,IAC1B,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,SAAS,IAAI,oEACd,kFACA,oFACA,qFACA,cACJ,CACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,cAAc,MAAM,KAAK,GAAG;AAAA,EAGzC,OAAO,UAAU,qBAAqB,MAAM,IAAI;AAAA,EAChD,OAAO,OACL,KAAK,QACL,aACA,MACM,yBAAkB;AAAA,IACtB,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,OACP,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,oBAAoB,KAAK,aAAa;AAAA,EACrF,CAAC,CACH;AAAA,EACA,MAAM,UAAU,OAAO,QAAQ,IAAI;AAAA,EACnC,IAAI,YAAY,WAAW;AAAA,IACzB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,SAAS,IAAI,2CAA2C,OAAO,KAAK,KAAK,UAC1E,sFACA,wFACA,uDACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAkCM,IAAM,aAAa,CAAC,SACzB,OACE,KAAK,QACL,aACA,MACM,yBAAkB;AAAA,EACtB,MAAM,KAAK;AAAA,EACX,OAAO,OAAO,KAAK,KAAK;AAAA,KACpB,KAAK,YAAY,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC;AAClD,CAAC,CACH;;;AFTK,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAuBD,IAAM,UAAU,CAAC,MAAyB,WACvC,MAAM,SAAS,aAAa,MAAM,SAAS,KAAK,UAChD,MAAM,iBAAiB,aAAa,MAAM,iBAAiB,KAAK;AAEnE,IAAM,YAAW,CAAC,UAChB,OAAO,OAAO,MAAM,KAAK,qBAAqB,MAAM;AAetD,IAAM,YAAW;AAAA,EAOf,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAE7B,MAAa,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC3D,OAAO,OAAO,QAAQ,IAAI;AAAA,GAC3B;AAAA,EAUD,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,KAIC;AAAA,IACD,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IAC/C,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAQlD,IAAI,OAAO,UAAU,KAAK;AAAA,MAAO,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC3D,OAAO,QAAQ,MAAM,IAAI,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAClF;AAAA,EAOD,WAAkB,YAAG,UAAU,GAAG,QAAgC;AAAA,IAChE,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MAUtB,OAAO,OAAO,UAAU,IAAI;AAAA,IAC9B;AAAA,IACA,IAAI,CAAC,QAAQ,MAAM,IAAI,GAAG;AAAA,MACxB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,UAAS,IAAI,8CAA8C,KAAK,UACjE,gBAAgB,KAAK,8DACrB,wFACA,6DACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC7D,OAAO,WAAW,IAAI;AAAA,GACvB;AACH;AAEO,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,SAAQ,CAAC,CAAC;;AG/MtF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACkGO,IAAM,SAAS,CAAC,UAAyB,SAAS,MAAM,kBAAkB,MAAM;AAShF,IAAM,QAAQ;AAGd,IAAM,eAAe,CAAC,UAC3B,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;AAQvE,IAAM,OAAO,CAAI,UAAyB,MAAS,SAAS,UACjE,aAAa,aAAa,UAAU,aAAa;AAc5C,IAAM,OAAO,CAAC,UAA+B,UAAU,IAAI,YAAY;AAG9E,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAG7C,IAAM,UAAU,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAmCvF,IAAM,aAAa,CAAC,WAAkD;AAAA,KACxE,OAAM,cAAc,MAAM,UAAU;AAAA,KACpC,OAAM,YAAY,QAAQ,MAAM,QAAQ,CAAC;AAAA,KACzC,OAAM,qBAAqB,MAAM,iBAAiB;AAAA,KAClD,OAAM,cAAc,QAAQ,MAAM,UAAU,CAAC;AAAA,KAC7C,OAAM,QAAQ,QAAQ,MAAM,IAAI,CAAC;AAAA,KACjC,OAAM,eAAe,QAAQ,MAAM,WAAW,CAAC;AAAA,KAC/C,OAAM,qBAAqB,QAAQ,MAAM,iBAAiB,CAAC;AAChE;AAYO,IAAM,aAAa,CAAC,WAAkD;AAAA,KACxE,WAAW,KAAK;AAAA,KAChB,OAAM,eAAe,MAAM,WAAW;AAAA,KACtC,OAAM,UAAU,QAAQ,MAAM,MAAM,CAAC;AAAA,EACxC,cAAc;AAAA,EACd,MAAM,MAAM;AACd;;;AChPA;AACA;AA6BO,IAAM,gBAAgB,CAAC,OAAsB,cAClD,OAAO,MAAM,QAAQ,QAAQ,OAAa,wBAAiB,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACzE,iBAAQ,CAAC,SACd,KAAK,KAAK,CAAC,QAAQ,IAAI,cAAc,MAAM,IAAI,IACpC,aACL,IAAI,MACF,GAAG,8EACD,oFACA,oFACA,6CACJ,CACF,IACO,aACb,CACF;AAYK,IAAM,SAAS,CACpB,OACA,MACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,IAAI,WAAW,GAAG;AAAA,IAChD,MAAM,OAAO,OAAO,KAAK,KAAK;AAAA,IAC9B,IAAI,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACvB,OAAc,eAAM,WAAW;AAAA,EACjC;AAAA,EACA,OAAO,OAAO,KAAK,KAAK;AAAA,CACzB;;;AC3DH;AACA;AAwBA,IAAM,gBAAe,CAAC,MAAe,UAAyD;AAAA,EAC5F,MAAM,MAAM;AAAA,EACZ,IAAI,OAAO,IAAI,YAAY;AAAA,IAAU;AAAA,EACrC,OAAO;AAAA,IACL,cAAc,aAAa,IAAI,mBAAmB;AAAA,IAClD,YAAY,KAAK,IAAI,aAAa;AAAA,IAClC,IAAI,IAAI,IAAI,OAAO,KAAK;AAAA,IACxB,UAAU,IAAI,IAAI,aAAa,KAAK;AAAA,IACpC,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,IACZ,UAAU,KAAK,IAAI,WAAW;AAAA,IAC9B,YAAY,KAAK,IAAI,aAAa;AAAA,IAClC,cAAc,KAAK,IAAI,eAAe;AAAA,IACtC,mBAAmB,KAAK,IAAI,oBAAoB;AAAA,IAChD,QAAQ,IAAI,IAAI,WAAW,KAAK;AAAA,IAChC,YAAY,IAAI,IAAI,eAAe,KAAK;AAAA,IACxC,MAAM,IAAI,IAAI,SAAS,KAAK;AAAA,IAC5B,aAAa,IAAI,IAAI,gBAAgB,KAAK;AAAA,IAC1C,mBAAmB,IAAI,IAAI,sBAAsB,KAAK;AAAA,EACxD;AAAA;AAWK,IAAM,iBAAiB,CAAC,UAC7B,OACE,MAAM,QACN,QACA,OACM,6BAAsB,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,IAAI,CAAC,CAClF,EAAE,KACO,aAAI,CAAC,SAAS,cAAa,MAAM,KAAK,CAAC,GACvC,kBAAS,oBAAoB,MAAa,iBAAQ,SAAS,CAAC,CACrE;AAGK,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AAGzB,IAAM,qBAAoB,CAAC,WAC/B;AAAA,KACI,WAAW,KAAK;AAAA,EACnB,MAAM,MAAM;AACd;AAGK,IAAM,oBAAoB,CAAC,WAC/B;AAAA,KACI,WAAW,KAAK;AAAA,EACnB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AACd;;;AHpBK,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAaD,IAAM,WAAU,CAAC,YAAgC,UAC/C,KAAK,MAAM,MAAM,WAAW,MAAM,WAAW,YAAY,KACzD,KAAK,MAAM,UAAU,WAAW,UAAU,WAAW,YAAY,KACjE,KAAK,MAAM,mBAAmB,WAAW,iBAAiB,KAC1D,KAAK,KAAK,MAAM,UAAU,GAAG,WAAW,YAAY,WAAW,UAAU,KACzE,KAAK,MAAM,YAAY,WAAW,YAAY,WAAW,eAAe,EAAE,KAC1E,KAAK,KAAK,MAAM,WAAW,GAAG,WAAW,WAAW;AAE/C,IAAM,0BAA0B,MAC5B,iBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,EAE1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,eAAe,IAAI;AAAA,EAMvC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAC1E,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,KAAK;AAAA,IAC3D,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IACvC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,IAAI;AAAA,MAC1D,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAMD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IACvC,IAAI;AAAA,IACJ,IAAI,SAAS,WAAW;AAAA,MAItB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,IAAI;AAAA,MAC1D,OAAO,cAAc,MAAM,OAAO,IAAI,CAAC;AAAA,MACvC,OAAO,OAAO,OACZ,KAAK,QACL,aACA,MACM,0BAAmB,mBAAkB,IAAI,CAAC,CAClD;AAAA,IACF,EAAO;AAAA,MAQL,MAAM,OAAO,WAAW,UAAS,MAAM,MAAM,WAAW,IAAI,CAAC;AAAA,MAC7D,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,KAAK;AAAA,QAC3D,OAAO,OAAO,OACZ,KAAK,QACL,aACA,MACM,uBAAgB,kBAAkB,IAAI,CAAC,CAC/C;AAAA,MACF;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,OACnB,MACA,gBACA,CAAC,QAAQ,QAAQ,aAAa,SAAQ,KAAK,IAAI,CACjD;AAAA,IACA,IAAI,UAAU,aAAa,CAAC,SAAQ,OAAO,IAAI,GAAG;AAAA,MAChD,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,IAAI,sEACZ,qDAAqD,QAAQ,sBAC7D,8EACA,UACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAYD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACM,0BAAmB,EAAE,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK,CAAC,CAC/D;AAAA,IACA,MAAM,OAAO,OAAO,OAAO,MAAM,gBAAgB,CAAC,QAAQ,QAAQ,SAAS;AAAA,IAC3E,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,IAAI,uEACZ,iFACA,mCACJ,CACF;AAAA,IACF;AAAA,GACD;AACH,CAAC,CACH,CACF;;AI3HF,qBAAS;AACT;AACA;;;AC/FA,uBAAS;AAET;AACA,8BAAS;AACT;;;AC4BO,IAAM,OAAO,CAAC,SAAiB,KAAK,KAAK,EAAE,YAAY;AAyBvD,IAAM,OAAO,CAAC,UAAmB;AAAA,EACtC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK;AAAA,EAC7B,MAAM,OAAO,IAAI,SAAS,GAAG,IAAI,SAAS;AAAA,EAC1C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,GAAG,CAAC,KAAK,MAAM,IAAI;AAAA;AAwBpD,IAAM,UAAU,CAAC,UAAmB;AAAA,EACzC,MAAM,UAAU,KAAK,KAAK,EAAE,KAAK;AAAA,EACjC,OAAO,YAAY,MAAM,KAAK;AAAA;AAqBzB,IAAM,OAAO,CAAC,UAAyE;AAAA,EAC5F,MAAM,OAAO,QAAQ,MAAM,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,MAAO,SAAS,KAAK,CAAC,IAAI,EAAE,SAAS,KAAK,EAAG;AAAA;;;ACxGtE,IAAM,oBAAoB;AAAA,EAE/B,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,UAAU,KAAK,KAAK,OAAO;AAAA,IACjC,OAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,QAAQ,KAAK,UAAU;AAAA,MAChC,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,MAEnC,MAAM,KAAK,KAAK,SAAS,MAAM,IAAI;AAAA,IACrC;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,KAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAO3D,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,YAAY,UACpB,WAAW,SAAS,KAAK,MAAM,IAAI,KAAK,WAAW,YAAY,QAAQ,MAAM,OAAO;AAAA,EAKtF,MAAM,CAAC,UAAU,4BAA4B,MAAM;AAAA,EACnD,YAAY;AACd;;;AFzBA,MAAQ,2BAAa,8BAAgB,WAAW,iBAAI;AAE7C,IAAM,oBAAoB,CAAC,UAChC,OAAO,MAAM,QAAQ,QAAQ,OAAe,iCAAwB,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KAClF,iBAAQ,CAAC,SAAS;AAAA,EAGvB,IACE,SAAS,QACT,OAAO,SAAS,YAChB,MAAM,QAAQ,IAAI,KAClB,EAAE,UAAU,SACZ,OAAO,KAAK,SAAS,YACrB,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,KACnC,EAAE,UAAU,SACZ,OAAO,KAAK,SAAS,YACrB,KAAK,KAAK,IAAI,MAAM,IACpB;AAAA,IACA,OAAc,cACZ,IAAI,mBAAkB;AAAA,MACpB,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC,CACH;AAAA,EACF;AAAA,EACA,OAAc,iBAAQ,kBAAK,WAAW,KAAK,KAAK,GAAG,KAAK,CAAC;AAAA,CAC1D,GACM,kBAAS,yBAAyB,MAAa,iBAAQ,SAAS,CAAC,CAC1E;AAGK,IAAM,sBAAsB,CAAC,UAClC,OAAO,MAAM,QAAQ,aAAa,MAAc,oCAA2B,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC;AAE3F,IAAM,wBAAwB;AAAA,EACnC,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAyC,kBAAkB,IAAI;AAAA,EACxE,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,KAIC;AAAA,IACD,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAE1B,IAAI,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI;AAAA,MAAG,OAAO,EAAE,QAAQ,UAAU;AAAA,IACtE,MAAM,OAAO,OAAO,kBAAkB,IAAI;AAAA,IAC1C,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,kBAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAsC;AAAA,IACtE,MAAM,OAAO,OAAO,kBAAkB,IAAI;AAAA,IAC1C,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OACL,KAAK,QACL,aACA,MACQ,oCAA2B,kBAAK,WAAW,IAAI,CAAC,CAC1D;AAAA,IACF,EAAO;AAAA,MACL,MAAM,OAAO,WAAW,kBAAK,SAAS,MAAM,MAAM,kBAAK,WAAW,IAAI,CAAC;AAAA,MACvE,IAAI,SAAS;AAAA,QACX,OAAO,OACL,KAAK,QACL,aACA,MACQ,iCAAwB,KAAK,MAAM,MAAM,KAAK,KAAK,CAAC,CAC9D;AAAA;AAAA,IAEJ,MAAM,QAAQ,OAAO,kBAAkB,IAAI;AAAA,IAC3C,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MAAM,GAAG,kBAAK,KAAK,IAAI,4DAA4D,CACzF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAAyC,oBAAoB,IAAI;AAC9E;;;AD2CO,IAAM,uBAAuB,UAA+B,uBAAuB;AAGnF,IAAM,+BAA+B,MACjC,iBACP,sBACO,iBAAQ,qBAAqB,SAAS,GAAG,qBAAqB,CAAC,CACxE;;AIhFF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACpEA;AACA;AAMO,IAAM,eAAe;AACrB,IAAM,eAAe;AAWrB,IAAM,gBAAgB,CAAC,aAAgC;AAAA,EAC5D,MAAM,QAAQ,YAAW;AAAA,EACzB,OAAO,UAAU,MAAM,KAAK;AAAA;AAI9B,IAAM,aAAa,CAAC,SAAsC;AAAA,EACxD,MAAM,SAAS,IAAI,KAAK,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC;AAAA,EACrD,OAAO,WAAW,KAAK,CAAC,IAAI,OAAO,MAAM,GAAG;AAAA;AAGvC,IAAM,cAAa,CAAC,WAAwD;AAAA,EACjF,SAAS,cAAc,MAAM,OAAO;AAAA,EACpC,SAAS,MAAM;AACjB;AAGO,IAAM,aAAa,CAAC,WAAqD;AAAA,EAC9E,SAAS,cAAc,MAAM,OAAO;AAAA,EACpC,SAAS,MAAM;AACjB;AAEA,IAAM,gBAAe,CAAC,MAAqC,WAAwC;AAAA,EAKjG,SAAS,KAAK,KAAK,OAAO;AAAA,EAE1B,SAAS,MAAM;AAAA,EACf,SAAS,WAAW,KAAK,OAAO;AAClC;AAMO,IAAM,WAAU,CAAC,YAA6B,UACnD,WAAW,YAAY,cAAc,MAAM,OAAO;AAuB7C,IAAM,kBAAkB,CAAC,UAC9B,iBACE,OAAO,MAAM,QAAQ,QAAQ,OAAc,uBAAe,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CACvF,EAAE,KACO,aAAI,CAAC,SACV,SAAS,aACL,aACA,KAAK,YAAY,YACf,YACA,cAAa,MAAM,KAAK,CAChC,CACF;AAUK,IAAM,YAAY,CAAC,UACxB,gBAAgB,KAAK,EAAE,KAAY,kBAAS,iBAAiB,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAGxF,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;;;ADW7B,IAAM,eAAe,WAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAEM,IAAM,uBAAuB,MACzB,kBACP,cACO,iBACL,aAAa,SAAS,GAAG;AAAA,EAKvB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAY7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,UAAU,IAAI,IAAI,gBAAgB,IAAI,CACtE;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACtE,OAAO,YAAW,cAAc,WAAW,IAAI,GAAG,KAAK;AAAA,IACvD,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,gBAAgB,IAAI;AAAA,IAGxC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,iBAAiB,KAAK,OAAO;AAAA,MACtD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MAEtB,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,IAAI;AAAA,MACtD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAOxC,MAAM,SAAS,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACpD,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACtE,OAAO,YAAW,cAAc,WAAW,IAAI,GAAG,KAAK;AAAA,IACvD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACO,0BAAkB,YAAW,IAAI,CAAC,CAC3C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,uBAAe,WAAW,IAAI,CAAC,CAAC;AAAA,IACvF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACnD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,iBAAiB,KAAK,2DACpB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,0BAAkB,EAAE,SAAS,KAAK,QAAQ,CAAC,CACpD;AAAA,GACD;AACH,CAAC,CACH,CACF;;AE5KF,qBAAS;AACT;AACA;AAmDO,IAAM,oBAAoB,WAA4B,oBAAoB;AAGjF,IAAM,OAAO,CAAC,QAAgB,IAAI,MAAM,GAAG,EAAE,MAAM;AAOnD,IAAM,SAAQ,CAAC,WAA4B;AAAA,EACzC,SAAS,MAAM,WAAW;AAAA,EAC1B,cAAc,OAAO,MAAM,gBAAgB,CAAC;AAAA,EAC5C,aAAa,OAAO,MAAM,eAAe,CAAC;AAAA,EAC1C,OAAO,MAAM,SAAS;AACxB;AAEA,IAAM,YAAW,YAAmD;AAAA,EAClE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAAA,IACjE,cAAc,IAAI,KAAK,iBAAiB,CAAC;AAAA,IACzC,aAAa,IAAI,KAAK,gBAAgB,CAAC;AAAA,IACvC,KAAK,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,MAAM;AAAA,IAC3D,OAAO,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC3D,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,KAAK,MAAM,GAAG;AAAA,EACxE;AAAA,EAMA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,KAAK,MAAM,IAAI;AAAA,EAS1D,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,YAAY,UACpB,WAAW,WAAW,MAAM,SAAS,cACrC,WAAW,aAAa,MAAM,WAAW,OACzC,WAAW,iBAAiB,MAAM,eAAe,MACjD,WAAW,kBAAkB,MAAM,gBAAgB;AAAA,EAMrD,MAAM,CAAC,UAAU,wBAAwB,MAAM;AAAA,EAC/C,YAAY;AACd,CAAC;AAiBM,IAAM,4BAA4B,MAC9B,kBAAO,mBAA0B,iBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;;ACpG5F,qBAAS;AACT;AACA;;;ACzCO,IAAM,WAAW,CAAC,UAAkD;AAAA,EACzE,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,SAAS,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,IAAK,SAAS,CAAC,GAAI;AAAA,IAChF,OAAO,MAAM,YAAY,MAAM,KAAK,EAAE,MAAM,GAAG;AAAA,IAC/C,IAAI,SAAS,aAAa,SAAS;AAAA,MAAI;AAAA,IACvC,MAAM,OAAO,OAAO,SAAS,YAAY,KAAK,EAAE;AAAA,IAChD,OAAO,IAAI,MAAM,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI;AAAA,EAChD;AAAA,EACA,OAAO,CAAC,GAAG,OAAO,KAAK,CAAC,EACrB,KAAK,EACL,IAAI,CAAC,SAAS;AAAA,IACb,MAAM,OAAO,OAAO,IAAI,IAAI,KAAK;AAAA,IACjC,OAAO,SAAS,IAAI,OAAO,GAAG,QAAQ,OAAO,IAAI;AAAA,GAClD,EACA,KAAK,GAAG;AAAA;AAYN,IAAM,WAAW,CAAC,UACvB,OAAO,UAAU,YAAY,UAAU,OACnC,OAAO,QAAQ,KAAK,EACjB,IAAI,EAAE,QAAQ,aAAa,GAAG,WAAW,OAAO,OAAO,GAAG,EAC1D,KAAK,EACL,KAAK,IAAI,IACZ;AAqBC,IAAM,cAAc,CAAC,QAC1B,IAAI,QAAQ,yBAAyB,CAAC,YAAY;AAAA,EAChD,IAAI;AAAA,IACF,OAAO,mBAAmB,OAAO;AAAA,IACjC,MAAM;AAAA,IACN,OAAO;AAAA;AAAA,CAEV;AAuBI,IAAM,WAAW,CAAC,WAA4D;AAAA,EACnF,SAAS,MAAM,YAAY,aAAa,MAAM,YAAY,KAAK,YAAY,MAAM;AAAA,EACjF,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,KACpC,MAAM,SAAS,kBAAkB,EAAE,QAAQ,MAAM,WAAW,OAAO,MAAM,UAAU,IAAI,CAAC;AAC9F;AA8BA,IAAM,WAAW,CAAC,WAAgD;AAAA,EAChE,UAAU,MAAM;AAAA,EAChB,WAAW,IAAI,MAAM,SAAS;AAAA,EAC9B,MAAM,MAAM;AAAA,KACR,MAAM,SAAS,kBAAkB,EAAE,OAAO,SAAS,MAAM,KAAK,EAAE,IAAI,CAAC;AAC3E;AAEO,IAAM,QAAO,CAAC,UAAuB;AAAA,EAC1C,MAAM,SAAS,SAAS,KAAK;AAAA,EAC7B,YAAY,QAAQ,UAAU,OAAO,QAAQ,SAAS,KAAK,CAAC,GAAG;AAAA,IAC7D,IAAI,UAAU;AAAA,MAAW,OAAO,UAAU;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAiBF,IAAM,YAAY,CAAC,UACxB,OAAO,QAAQ,SAAS,KAAK,CAAC,EAC3B,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,YAAY,MAAM;;;ADtBtB,IAAM,gBAAgB,WAAwB,gBAAgB;AAErE,IAAM,YAAW,YAA2C;AAAA,EAC1D,YAAY,CAAC,MAAM,UAAU;AAAA,IAO3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,UAAU,KAAK,KAAK,WAAW;AAAA,MAC/B,SAAS,KAAK,KAAK,UAAU;AAAA,MAO7B,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,MACpC,QAAQ,SAAS,KAAK,SAAS;AAAA,MAC/B,OAAO,SAAS,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW,SAAS;AAAA,MAC7E,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,MAC3B,WAAW,IAAI,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,SAAS;AAAA,MACpF,MAAM,KAAK,KAAK,SAAS,MAAM,IAAI;AAAA,MACnC,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,MAClC,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAGlB,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAa3D,UAAU,EAAE,QAAQ,8BAA8B,QAAQ,mCAAmC;AAAA,EAC7F,SAAS,CAAC,YAAY,UACpB,WAAW,cAAc,IAAI,MAAM,SAAS,KAC5C,WAAW,aAAa,MAAM,YAC9B,WAAW,YAAY,YAAY,MAAM,WAAW,EAAE,KACtD,WAAW,aAAa,MAAM,YAAY,UACzC,MAAM,SAAS,mBACb,WAAW,UAAU,SAAS,MAAM,KAAK,KACxC,WAAW,YAAY,MAAM,WAAW;AAAA,EAE9C,MAAM,CAAC,UAAU,oBAAoB,MAAM;AAAA,EAO3C,YAAY,CAAC,UAAU;AAAA,IACrB,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7B,MAAM,SAAS,MAAK,KAAK;AAAA,IACzB,OAAO,WAAW,QAAQ,KAAK;AAAA;AAEnC,CAAC;AASM,IAAM,wBAAwB,MAC1B,kBAAO,eAAsB,iBAAQ,cAAc,SAAS,GAAG,SAAQ,CAAC,CAAC;;AErNpF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACvBA;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,YAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,iBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,gBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,cAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,cAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,aAAW,uBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,aAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,uBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,aACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAaK,IAAM,sBAAsB,CAAC,KAAa,eACxC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,eAAM;AAAA,CACtE;;;AFxFI,IAAM,eAAe,CAAC,QACpB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,uBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,uBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AIjG9B,oBAAS;AACT;AAcO,IAAM,aAAa,CACxB,KACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,iBAAiB,IAAI,KAAK,IAAI,UAAU;AAAA,EAChE,IAAI,aAAa;AAAA,IAAU,OAAO;AAAA,EAClC,IAAI,aAAa,WAAW;AAAA,IAC1B,OAAc,oBACZ,GAAG,IAAI,mFACL,iFACJ;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,WAAW,CAAC,WACT,YACE,oBACL,GAAG,IAAI,+EACL,IAAI,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM,kCAChE,GACA,KACF;AAAA,EACF,OAAO,OAAO,SAAQ,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,CAChF;AAOI,IAAM,YAAY,CACvB,KACA,OACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,UAAU,aAAa,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EAC5D,QAAQ,OAAO,WAAW,KAAK,QAAO,KAAK,QAAQ,SAAQ,KAAK;AAAA,CACjE;;;AC3DI,IAAM,QAAQ,CAAC,OAAe,eACnC,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,IAAI,CAAC,SAA2B;AAAA,EAC/B,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,IAAI,OAAO;AAAA,IAAI,OAAO,CAAC,cAAc,MAAM,eAAe,YAAY,KAAK,IAAI;AAAA,EAC/E,OAAO,CAAC,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,CAC5D;AAOL,IAAM,WAAuE;AAAA,EAC3E,KAAK,EAAE,cAAc,IAAI;AAAA,EACzB,UAAU,EAAE,cAAc,KAAK,MAAM,KAAK,QAAQ,KAAK,OAAO,KAAK,SAAS,IAAI;AAAA,EAChF,KAAK,EAAE,UAAU,KAAK,gBAAgB,KAAK,WAAW,KAAK,MAAM,OAAO;AAAA,EACxE,QAAQ,EAAE,QAAQ,KAAK,WAAW,KAAK,OAAO,KAAK,WAAW,KAAK,IAAI,KAAK,QAAQ,IAAI;AAC1F;AAGA,IAAM,QAAQ,IAAI,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,OAAO,IAAI,IAAI,CAAC,SAAS,cAAc,CAAC;AAG9C,IAAM,iBAAiB,CAAC,KAAa,UAAkB;AAAA,EACrD,IAAI,MAAM,IAAI,GAAG;AAAA,IAAG,OAAO,eAAe,KAAK;AAAA,EAC/C,IAAI,KAAK,IAAI,GAAG;AAAA,IACd,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG;AAAA,EAClF,IAAI,QAAQ;AAAA,IAAU,OAAO,MAAM,YAAY;AAAA,EAC/C,OAAO;AAAA;AAIF,IAAM,YAAY,CACvB,OACA,QACA,eACwB;AAAA,EACxB,MAAM,WAAW,SAAS,WAAW,CAAC;AAAA,EACtC,MAAM,MAAM,IAAI;AAAA,EAChB,YAAY,KAAK,QAAQ,MAAM,OAAO,UAAU,GAAG;AAAA,IACjD,MAAM,YAAY,eAAe,KAAK,GAAG;AAAA,IACzC,IAAI,SAAS,SAAS;AAAA,MAAW,IAAI,IAAI,KAAK,SAAS;AAAA,EACzD;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,UAAU,CAAC,MAA2B,UACjD,KAAK,SAAS,MAAM,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,WAAW,MAAM,IAAI,GAAG,MAAM,KAAK;AAGjF,IAAM,aAAa,CAAC,UACzB,CAAC,GAAG,KAAG,EACJ,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,EACvC,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,WAAW,CAAC,OAA0B,OAA0B,CAAC,MAC5E,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,MAAI,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,MAAI,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EACxF,IAAI,CAAC,QAAQ,GAAG,OAAO,MAAI,IAAI,GAAG,KAAK,IAAI,EAC3C,KAAK,GAAG;AAMN,IAAM,UAAU,CAAC,UAAkB,SAAiB;AAAA,EACzD,MAAM,OAAO,UAAU,UAAU,KAAK;AAAA,EACtC,MAAM,OAAO,UAAU,MAAM,KAAK;AAAA,EAClC,IAAI,CAAC,KAAK,IAAI,QAAQ;AAAA,IAAG,KAAK,OAAO,QAAQ;AAAA,EAC7C,OAAO,EAAE,MAAM,KAAK;AAAA;AAQf,IAAM,WAAW,CAAC,UAAkB,SAA6B;AAAA,EACtE,MAAM,OAAO,IAAI,IAAI,MAAM,QAAQ,CAAC;AAAA,EACpC,MAAM,MAAM,SAAS,YAAY,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,IAAI,QAAQ;AAAA,EAC9E,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,QAAQ;AAAA,IAAW,KAAK,IAAI,UAAU,GAAG;AAAA,EACpE,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC;AAAA;AAIzB,IAAM,SAAS,CAAC,UACrB,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,SAAS,EAAE,OAAO,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,EAC5D,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,EAC9B,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,cAAc,CAAC,UAC1B,MACG,MAAM,SAAS,EACf,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,GAAG;AAMN,IAAM,kBAAkB,CAAC,UAAkB,MAAM,QAAQ,QAAQ,EAAE;AAGnE,IAAM,eAA8E;AAAA,EACzF,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,OAAO;AAAA,EACP,UAAU;AAAA,EACV,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,SAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AACP;AAGO,IAAM,YAAiC,IAAI,IAAI;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,kBAAoD;AAAA,EAC/D,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,KAAK;AACP;AAGO,IAAM,aAAa,CAAC,KAAa,UAA0B;AAAA,EAChE,MAAM,QAAO,aAAa;AAAA,EAC1B,IAAI,UAAS;AAAA,IAAU,OAAO,OAAO,OAAO,KAAK,CAAC;AAAA,EAClD,IAAI,UAAS;AAAA,IAAQ,OAAO,eAAe,KAAK;AAAA,EAChD,IAAI,QAAQ;AAAA,IAAe,OAAO,gBAAgB,KAAK;AAAA,EACvD,IAAI,QAAQ;AAAA,IAAY,OAAO,WAAW,UAAU,OAAO,UAAU,CAAC;AAAA,EACtE,IAAI,QAAQ,gBAAgB,QAAQ;AAAA,IAAgB,OAAO,YAAY,KAAK;AAAA,EAC5E,IAAI,QAAQ;AAAA,IAAW,OAAO,eAAe,OAAO,OAAO;AAAA,EAC3D,IAAI,QAAQ;AAAA,IAAQ,OAAO,OAAO,KAAK;AAAA,EACvC,OAAO;AAAA;;;ACrFF,IAAM,WAAgC,IAAI,IAAI;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,UAAU;AAAA,EACrB,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AACP;AAKO,IAAM,aAAa,CAAC,QAA8D;AAAA,EACvF,MAAM,QAAQ,6BAA6B,KAAK,GAAG;AAAA,EACnD,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,MAAM,SAAS,MAAM;AAAA,EACrB,MAAM,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC7B,OAAO,QAAQ,QAAQ,UAAU,CAAC,QAAQ,KAAK,IAAI;AAAA;AAI9C,IAAM,aAAkC,IAAI,IAAI;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,gBAAgB,CAAC,OAAiB,QAC5C,MAA6C;AAGzC,IAAM,eAAe,CAAC,UAC3B,OAAO,KAAK,KAAK,EACd,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,GAAG,KAAK,cAAc,OAAO,GAAG,MAAM,SAAS,EAC/E,KAAK;AAGH,IAAM,YAAY,CAAC,UACxB,UAAU,OAAO,MAAM,UAAU,QAAQ,MAAM,OAAO,KAAK;AAStD,IAAM,eAAe,CAAC,QAC3B,aAAa,SAAS,aACtB,QAAQ,kBACR,QAAQ,YACR,WAAW,GAAG,MAAM;AAUf,IAAM,eAAe,CAAC,SAA0D;AAAA,EACrF,MAAM,MAA8B,CAAC;AAAA,EACrC,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,CAAC,aAAa,GAAG,KAAK,SAAS,IAAI,GAAG;AAAA,MAAG;AAAA,IAC7C,IAAI,UAAU,QAAQ,UAAU,aAAa,OAAO,UAAU;AAAA,MAAU;AAAA,IACxE,IAAI,OAAO,UAAU,KAAK;AAAA,EAC5B;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,YAAY,CAAC,SAA4C;AAAA,EACpE,MAAM,MAAM,KAAK;AAAA,EACjB,IAAI,CAAC,MAAM,QAAQ,GAAG;AAAA,IAAG,OAAO,CAAC;AAAA,EACjC,OAAO,IACJ,IAAI,CAAC,SAAmB,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,EAAE,IAAI,EAAG,EACnE,OAAO,CAAC,QAAQ,QAAQ,EAAE;AAAA;;;AC9L/B,IAAM,WAAW;AAEjB,IAAM,QAA0C;AAAA,EAC9C,GAAG,QAAQ;AAAA,EACX,GAAG;AAAA,EACH,GAAG,QAAQ;AAAA,EACX,GAAG,QAAQ;AACb;AAGO,IAAM,YAAY,CAAC,UAAqC;AAAA,EAC7D,MAAM,QAAQ,6BAA6B,KAAK,MAAK,KAAK,CAAC;AAAA,EAC3D,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,OAAO,KAAK,MAAM,OAAO,MAAM,EAAE,KAAK,MAAM,OAAO,YAAY,IAAK,MAAM,MAAM,OAAO,EAAG;AAAA;AAkBrF,IAAM,cAAc,CAAC,UAAyB;AAAA,EACnD,OAAO,SAAS,MAAM,OAAM,QAAQ;AAAA,EACpC,MAAM,OAAO,QAAQ,OAAO,WAAW,MAAM,KAAK;AAAA,EAClD,MAAM,UAAU,UAAU,OAAM,UAAU,QAAQ;AAAA,EAClD,QAAQ,OAAO,QAAQ;AAAA,EACvB,MAAM,WAAW,QAAQ,IAAI,MAAM;AAAA,EACnC,QAAQ,OAAO,MAAM;AAAA,EACrB,MAAM,QAAQ,SAAS,KAAK,IAAI;AAAA,EAChC,IAAI,UAAU,MAAM;AAAA,IAClB,MAAM,MAAM,GAAG,MAAM,MAAM;AAAA,IAC3B,OAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,MAAM,UAAU,GAAG;AAAA,MACnB,UAAU;AAAA,MACV,QAAQ,MAAM,MAAM;AAAA,MACpB,SAAS;AAAA,IACX;AAAA,EACF;AAAA,EACA,MAAM,OAAO,aAAa,YAAY,YAAY,UAAU,QAAQ;AAAA,EACpE,IAAI,KAAK,WAAW,GAAG,GAAG;AAAA,IACxB,MAAM,QAAO,KAAK,WAAW,OAAO,IAAI,WAAW;AAAA,IACnD,OAAO,EAAE,aAAM,SAAS,MAAM,UAAU,QAAQ,MAAM,SAAS,GAAG;AAAA,EACpE;AAAA,EACA,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE;AAAA,IAC3C,SAAS,OAAO,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC;AAAA,EAC7C;AAAA;AAaK,IAAM,aAAa,CAAC,WAAmB,OAAO,SAAS,UAAU,OAAO,SAAS;AAOxF,IAAM,UAAU,CAAC,MAAc,aAAqB;AAAA,EAClD,MAAM,QAAQ,CAAC,GAAG,KAAK,UAAU,KAAK,SAAS;AAAA,EAC/C,YAAY,KAAK,UAAU,SAAS;AAAA,IAAS,MAAM,KAAK,GAAG,OAAO,OAAO;AAAA,EACzE,IAAI,KAAK,aAAa;AAAA,IAAW,MAAM,KAAK,QAAQ,KAAK,UAAU;AAAA,EACnE,OAAO,MAAM,KAAK,GAAG;AAAA;AAGhB,IAAM,cAAc,CAAC,KAAa,UAAkB,SAAgC;AAAA,EACzF,MAAM,OAAO,YAAY,QAAQ;AAAA,EACjC,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,IAAI,WAAW,IAAI,KAAK,WAAW,IAAI,GAAG;AAAA,IACxC,MAAM,QACJ,KAAK,SAAS,KAAK,QAAQ,KAAK,WAAW,KAAK,UAAU,QAAQ,KAAK,SAAS,KAAK,OAAO;AAAA,IAC9F,OAAO,QAAO,CAAC,IAAI,EAAE,UAAU,KAAK;AAAA,EACtC;AAAA,EACA,IAAI,KAAK,WAAW,KAAK,QAAQ;AAAA,IAC/B,OAAO;AAAA,MACL,QACE,GAAG,yBAAyB,KAAK,uBAAuB,KAAK,0BAC7D;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI,KAAK,SAAS,YAAY,KAAK,YAAY,KAAK,SAAS;AAAA,IAC3D,OAAO;AAAA,MACL,QACE,GAAG,wBAAwB,KAAK,2BAA2B,KAAK,+BAChE;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI;AAAA,EACJ,IAAI,KAAK,SAAS,aAAa,KAAK,SAAS,aAAa,KAAK,SAAS,KAAK,MAAM;AAAA,IACjF,IAAI,KAAK,OAAO,KAAK,MAAM;AAAA,MACzB,OAAO;AAAA,QACL,QACE,GAAG,iBAAiB,KAAK,YAAY,kCACrC,GAAG,KAAK,YAAY,uEACpB;AAAA,MACJ;AAAA,IACF;AAAA,IACA,SAAS,KAAK;AAAA,EAChB;AAAA,EACA,MAAM,MAAM,QAAQ,KAAK,SAAS,KAAK,OAAO,IAAI,YAAY,QAAQ,MAAM,IAAI;AAAA,EAChF,OAAO;AAAA,OACD,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,OAC/B,WAAW,YAAY,CAAC,IAAI,EAAE,OAAO;AAAA,EAC3C;AAAA;;;ACnGF,IAAM,QAAO,CAAC,UACZ,UAAU,aAAa,UAAU,OAAO,YAAY,UAAU,KAAK;AAG9D,IAAM,WAAW,CAAC,MAAc,KAAa,OAAe,QACjE,GAAG,QAAQ,kFACX,aAAa,OAAO,IAAI,KAAK,UAAU,KAAK,YAAY,QAAQ,KAAK,QAAQ,gBAC7E;AAGF,IAAM,cAAc,CAAC,UACnB,IAAI,IACF,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,QAAQ,UAAU,QAAQ,eAAe,KAAK,CAAC,CAAC,CAC3F;AASK,IAAM,mBAAmB,CAC9B,MACA,MACA,iBACY;AAAA,EACZ,IAAI,CAAC;AAAA,IAAc,OAAO;AAAA,EAC1B,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,IAAI,SAAS;AAAA,IAAW,OAAO,EAAE,KAAK,SAAS,KAAM,KAAK,SAAS,KAAK,KAAK,IAAI,SAAS;AAAA,EAC1F,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,MAAM,OAAO,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACrD,OAAO,CAAC,GAAG,IAAI,EAAE,KACf,CAAC,QAAQ,QAAQ,cAAc,KAAK,IAAI,GAAG,KAAK,SAAS,KAAK,IAAI,GAAG,KAAK,GAC5E;AAAA;AAGK,IAAM,aAAa,CAAC,iBACzB,eAAe,kCAAkC;AAE5C,IAAM,QAAQ,CAAC,OAAiB,SAA6C;AAAA,EAClF,MAAM,MAA8B,CAAC;AAAA,EACrC,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,SAA2C,CAAC;AAAA,EAClD,MAAM,SAAmB,CAAC;AAAA,EAC1B,MAAM,QAAQ,IAAI;AAAA,EAClB,MAAM,eAAe,KAAK,KAAK,iBAAiB,KAAK;AAAA,EAErD,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,OAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IAChD,MAAM,OAAO,MAAK,KAAK,IAAI;AAAA,IAC3B,MAAM,UAAU,WAAW,GAAG;AAAA,IAE9B,IAAI,QAAQ,gBAAgB;AAAA,MAC1B,IAAI,eAAe,IAAI,MAAM,eAAe,QAAQ,GAAG,GAAG;AAAA,QACxD,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KACL,sBAAsB,QAAQ,iBAAiB,6CAC7C,uFACJ;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,IAEA,IAAI,QAAQ,YAAY,UAAU,OAAO,MAAM;AAAA,MAC7C,IAAI,SAAS,IAAI;AAAA,QACf,IAAI,SAAS;AAAA,UAAW;AAAA,QACxB,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KACL,GAAG,4EACL;AAAA,MACF,EAAO,SAAI,SAAS,WAAW;AAAA,QAC7B,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,WAAW,YAAY,IAAI,CAAC,GAAG;AAAA,UACjC,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,+BAA+B,CAAC;AAAA,QAC9E,EAAO;AAAA,cAAI,OAAO;AAAA,MACpB,EAAO;AAAA,QACL,MAAM,UAAU,YAAY,KAAK,MAAM,IAAI;AAAA,QAC3C,IAAI,QAAQ,WAAW;AAAA,UAAW,OAAO,KAAK,QAAQ,MAAM;AAAA,QAC5D,IAAI,QAAQ,aAAa,MAAM;AAAA,UAC7B,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,+BAA+B,CAAC;AAAA,QAC9E;AAAA,QACA,IAAI,QAAQ,QAAQ;AAAA,UAAW,IAAI,OAAO,QAAQ;AAAA,QAClD,IAAI,QAAQ,WAAW;AAAA,UAAW,OAAO,KAAK,EAAE,MAAM,KAAK,MAAM,QAAQ,OAAO,CAAC;AAAA,QACjF,IAAI,OAAO,KAAK,OAAO,EAAE,SAAS;AAAA,UAAG,MAAM,IAAI,GAAG;AAAA;AAAA,MAEpD;AAAA,IACF;AAAA,IAEA,IAAI,UAAU,OAAO,OAAO;AAAA,MAC1B,MAAM,QAAO,SAAS,KAAK,SAAS,YAAY,SAAS,aAAa,QAAQ,MAAM,IAAI;AAAA,MACxF,IAAI,CAAC,OAAM;AAAA,QACT,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,qBAAqB,CAAC;AAAA,MACpE;AAAA,MACA;AAAA,IACF;AAAA,IAEA,IAAI,UAAU,OAAO,OAAO;AAAA,MAC1B,IAAI,SAAS,IAAI;AAAA,QACf,IAAI,SAAS,WAAW;AAAA,UACtB,MAAM,IAAI,GAAG;AAAA,UACb,MAAM,KAAK,GAAG;AAAA,QAChB;AAAA,MACF,EAAO,SAAI,SAAS,WAAW;AAAA,QAC7B,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,OAAO;AAAA,MACb,EAAO;AAAA,QACL,MAAM,OAAO,QAAQ,MAAM,IAAI;AAAA,QAC/B,IAAI,CAAC,QAAQ,KAAK,MAAM,KAAK,IAAI,GAAG;AAAA,UAClC,MAAM,IAAI,GAAG;AAAA,UACb,IAAI,OAAO,SAAS,MAAM,IAAI;AAAA,QAChC;AAAA;AAAA,MAEF;AAAA,IACF;AAAA,IAEA,IAAI,CAAC,aAAa,GAAG,GAAG;AAAA,MACtB,MAAM,IAAI,GAAG;AAAA,MACb,OAAO,KAAK,GAAG,8CAA8C;AAAA,MAC7D;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,SAAS,KAAK,KAAK,WAAW,KAAK,IAAI;AAAA,IACtD,MAAM,UAAU,QAAQ,gBAAgB;AAAA,IACxC,MAAM,MAAM,YAAY,YAAY,KAAK,WAAW,KAAK,OAAO;AAAA,IAChE,IAAI,WAAW;AAAA,MAAK;AAAA,IACpB,MAAM,IAAI,GAAG;AAAA,IAEb,MAAM,OAAO,QAAQ,aAAa,SAAS;AAAA,IAC3C,IAAI,QAAQ,cAAc,iBAAiB,QAAQ,IAAI,QAAQ,WAAW,YAAY,GAAG;AAAA,MACvF,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,WAAW,YAAY,CAAC,CAAC;AAAA,IACvE,EAAO,SAAI,SAAS,MAAM,UAAU,IAAI,GAAG,GAAG;AAAA,MAC5C,MAAM,KAAK,GAAG;AAAA,IAChB,EAAO,SAAI,SAAS,IAAI;AAAA,MACtB,OAAO,KAAK,GAAG,2DAA2D;AAAA,IAC5E,EAAO;AAAA,UAAI,OAAO;AAAA,EACpB;AAAA,EACA,OAAO,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,QAAQ,OAAO;AAAA;AAIhE,IAAM,UAAU,CAAC,MAAc,SAC7B,WAAW,UAAU,MAAM,OAAO,MAAM,CAAC,MAAM,WAAW,UAAU,MAAM,OAAO,MAAM,CAAC;;;ACtK1F,IAAM,iBAAiB,CAAC,KAAa,UACnC,GAAG,QAAQ,kFACX,gGACA;AAGK,IAAM,iBAAiB,CAAC,UAA8B;AAAA,EAC3D,MAAM,SAAmB,CAAC;AAAA,EAC1B,IAAI,MAAM,eAAe,aAAa,MAAM,eAAe,IAAI;AAAA,IAC7D,OAAO,KACL,MAAM,OAAO,MAAM,IAAI,uBAAuB,MAAM,sCAClD,kFACJ;AAAA,EACF;AAAA,EACA,MAAM,eAAe,MAAM,iBAAiB,YAAY,OAAO,KAAK,MAAM,YAAY;AAAA,EACtF,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,QAAQ,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IACjD,MAAM,SAAS,WAAW,GAAG,IAAI;AAAA,IAGjC,IAAI,CAAC,aAAa,GAAG;AAAA,MAAG,OAAO,KAAK,GAAG,8CAA8C;AAAA,IACrF,IAAI,UAAU;AAAA,MAAI;AAAA,IAClB,IAAI,WAAW;AAAA,MAAO,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,qBAAqB,CAAC;AAAA,IACzF,MAAM,SAAS,WAAW,QAAQ,QAAQ,WAAW,YAAY,KAAK,IAAI;AAAA,IAC1E,IAAI,WAAW,aAAa,WAAW,MAAM,GAAG;AAAA,MAC9C,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,+BAA+B,CAAC;AAAA,IAC/E;AAAA,IACA,IAAI,QAAQ,SAAS;AAAA,MAAU,OAAO,KAAK,eAAe,KAAK,KAAK,CAAC;AAAA,IACrE,IAAI,QAAQ,cAAc,iBAAiB,IAAI,OAAO,YAAY,GAAG;AAAA,MACnE,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,WAAW,YAAY,CAAC,CAAC;AAAA,IACxE;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,cAAa,CAAC,UAA4C;AAAA,EACrE,MAAM,OAA+B,EAAE,MAAM,OAAO,MAAM,IAAI,EAAE;AAAA,EAChE,IAAI,MAAM,eAAe;AAAA,IAAW,KAAK,gBAAgB,MAAM;AAAA,EAC/D,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,UAAU,MAAM,KAAK;AAAA,EACpE,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,QAAQ,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IACjD,IAAI,UAAU;AAAA,MAAI;AAAA,IAClB,KAAK,OAAO,QAAQ,aAAa,WAAW,KAAK,KAAK,IAAI;AAAA,EAC5D;AAAA,EACA,OAAO;AAAA;;;ACnET,IAAM,QAAQ,CAAC,MAAe,QAAyB;AAAA,EACrD,MAAM,QAAkB,KAAiC;AAAA,EACzD,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,QAAQ;AAAA;AAcnE,IAAM,mBAAmB,CAC9B,MACA,MACA,WACa;AAAA,EACb,MAAM,MAAM,QAAQ,QAAQ,KAAK;AAAA,EACjC,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EAC/B,MAAM,WAAW,MAAM,MAAM,YAAY;AAAA,EACzC,MAAM,UAAoB,CAAC;AAAA,EAC3B,IAAI,SAAS,aAAa,SAAS,KAAK;AAAA,IACtC,QAAQ,KACN,SAAS,OAAO,GAAG,QAAQ,OAAO,IAAI,iDACpC,2DACJ;AAAA,EACF;AAAA,EACA,IAAI,aAAa,aAAa,KAAK,eAAe,aAAa,aAAa,KAAK,YAAY;AAAA,IAC3F,QAAQ,KAAK,2EAA2E;AAAA,EAC1F;AAAA,EACA,OAAO;AAAA;;;ACtBT;;;ACKA;AAWO,IAAM,WAAW,CACtB,OACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW,OAAO;AAAA,EACvC,MAAM,aAAa,OAAO,mBAAmB,MAAM,KAAK,MAAM,UAAU;AAAA,EACxE,IAAI,eAAe,aAAa,WAAW,aAAa;AAAA,IAAM,OAAO;AAAA,EACrE,IAAI,WAAW,SAAS,aAAa,WAAW,SAAS;AAAA,IAAM,OAAO;AAAA,EACtE,OAAO,EAAE,OAAO,WAAW,OAAO,SAAQ,WAAW,KAAK,CAAC;AAAA,CAC5D;;;AC/BH;AACA;;;ACZO,MAAM,wBAAwB,MAAM;AAAA,EACvB,OAAO;AAC3B;;;ACMA;AACA;AACA;AAMO,IAAM,WAAW,CAAC,UAChB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,MAAM,QAAQ,MAAM;AAAA,EACrD,MAAM,SAAS,OAAO,WACpB,MAAM,QACN,YACA,OACM,wBAAiB,EAAE,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,IAAI,EAAE,CAAC,CACvE,EAAE,KACO,aAAI,CAAC,UAAU,EAAE,MAAM,OAAO,UAAU,EAAE,GAC1C,kBAAS,qBAAqB,CAAC,UAAiB,iBAAQ,EAAE,MAAM,WAAW,MAAM,CAAC,CAAC,CAC5F;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,MAAM,OAAgB,OAAO;AAAA,IAE7B,IACE,SAAS,QACT,OAAO,SAAS,YAChB,MAAM,QAAQ,IAAI,KAClB,EAAE,YAAY,SACd,OAAO,KAAK,WAAW,YACvB,KAAK,WAAW,IAChB;AAAA,MACA,OAAO,OAAc,cACnB,IAAI,gBACF,MAAM,OAAO,MAAM,IAAI,8DACzB,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,OAAO,WAClB,MAAM,QACN,YACA,OACQ,8BAAqB,EAAE,MAAM,KAAK,CAAC,CAC7C;AAAA,EAEA,IACE,CAAC,MAAM,QAAQ,IAAI,KACnB,KAAK,KACH,CAAC,QACC,CAAC,OAAO,cAAc,OAAO,KAAK,IAAI,CAAC,KACvC,OAAO,KAAK,IAAI,KAAK,KACrB,OAAO,KAAK,SAAS,YACrB,IAAI,SAAS,MACb,CAAC,CAAC,OAAO,MAAM,EAAE,SAAS,IAAI,IAAI,CACtC,GACA;AAAA,IACA,OAAO,OAAc,cACnB,IAAI,gBAAgB,oDAAoD,CAC1E;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,KAAK,KAAK,CAAC,QAAQ,OAAO,IAAI,IAAI,MAAM,MAAM,IAAI;AAAA,EAChE,IAAI,UAAU,aAAa,MAAM,SAAS,MAAM,QAAQ,MAAM,SAAS,OAAO;AAAA,IAC5E,OAAO,OAAc,cAAK,OAAO,KAAK;AAAA,EACxC;AAAA,EACA,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,cACnB,IAAI,gBACF,QAAQ,OAAO,MAAM,IAAI,UAAU,KAAK,MAAM,MAAM,OAAO,UACzD,GAAG,KAAK,MAAM,MAAM,GAAG,yBAAyB,MAAM,iCACtD,oFACJ,CACF;AAAA,EACF;AAAA,EACA;AAAA,CACD;;;ACtFH;AAEA;AAgBO,IAAM,UAAU,CACrB,OACA,WACA,MACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,KAAK,OAAO,WAAW,MAAM,QAAQ,YAAY,MAAM,SAAS,CAAC;AAAA,EAC9E,IAAI,SAAS;AAAA,IACX,OAAO,OAAc,cACnB,IAAI,gBACF,GAAG,qFACL,CACF;AAAA,EACF,IAAI,OAAO;AAAA,EACX,SAAS,UAAU,EAAG,UAAU,OAAO,WAAW;AAAA,IAChD,MAAM,SAAS,OAAO,WACpB,MAAM,QACN,YACA,OACM,yBAAkB,EAAE,MAAM,MAAM,MAAM,KAAK,CAAC,CACpD,EAAE,KAAY,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CAAC;AAAA,IAW5C,IAAI,WAAW,aAAa,OAAO,WAAW,WAAW;AAAA,MACvD,OACE;AAAA,MACF;AAAA,IACF;AAAA,IACA,IAAI,OAAO,WAAW,WAAW;AAAA,MAC/B,OAAO,KAAK,OAAO,YAAY,4BAA4B;AAAA,MAC3D;AAAA,IACF;AAAA,IACA,OAAc,eAAM,UAAU;AAAA,EAChC;AAAA,EACA,IAAI,SAAS;AAAA,IACX,OAAO,OAAc,cACnB,IAAI,gBACF,GAAG,cAAc,eAAe,kCAAkC,MAAM,gBACtE,GAAG,6CACP,CACF;AAAA,CACH;;;AHzBH,IAAM,gBAAgB;AAAA,EACpB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAGA,IAAM,eAAe;AACrB,IAAM,aAAa;AAEZ,IAAM,gBAAe,CAAC,OAAiB,UAAkD;AAAA,EAC9F,QAAQ,aAAa,IAAI;AAAA,EACzB,MAAM,MAAM;AAAA,EACZ,SAAS,UAAU,IAAI;AAAA,EACvB,MAAM,MAAM;AACd;AAGO,IAAM,cAAc,CAAC,UACnB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,YAAW,KAAK;AAAA,EAQ7B,OAAO,UAAU,cAAc,QAAQ,MAAM,IAAI;AAAA,EACjD,OAAO,OAAO,QACZ,OACM,sBAAc;AAAA,OACf;AAAA,IACH,MAAM,MAAM;AAAA,IACZ,MAAM,OAAO,MAAM,IAAI;AAAA,IACvB,YAAY,KAAK,KAAK,aAAa;AAAA,EACrC,CAAC,GACD,aAAa,OAAO,MAAM,IAAI,KAC9B,YACF;AAAA,CACD;AAYI,IAAM,cAAc,CAAC,OAAiB,QAAmB,WACvD,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,KAAK,OAAO,GAAG,EAAE,SAAS,KAAK,OAAO,MAAM,SAAS,GAAG;AAAA,IACjE,MAAM,OAAO,WACX,KAAK,OAAO,QAAS,WAAW,KAAK,CAAC,IAAI,EAAE,OAAO,EAAG,GACtD,OAAO,KACT;AAAA,IAEA,OAAO,UAAU,cAAc,QAAQ,MAAM,KAAK;AAAA,IAClD,OAAO,OACL,MAAM,QACN,aACA,MACM,yBAAiB,KAAK,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,IAAI,EAAE,CAAC,CAChF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,OAAO,QAAQ;AAAA,IAChC,MAAM,QAAQ,EAAE,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK;AAAA,IAGjD,OAAO,UAAU,cAAc,QAAQ,OAAO,IAAI;AAAA,IAClD,OAAO,QACL,OACM,yBAAiB,KAAK,OAAO,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,IAAI,EAAE,CAAC,GAC/E,QAAQ,KAAK,cAAc,OAAO,MAAM,IAAI,QAAQ,KAAK,QACzD,UACF;AAAA,EACF;AAAA,CACD;AAYI,IAAM,eAAe,CAAC,OAAiB,aACrC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,SAAS,KAAK;AAAA,EAClC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,MAAM,UAAU,IAAI,EAAE;AAAA,EACpC,IAAI,MAAM,SAAS,GAAG;AAAA,IACpB,OAAO,OAAc,cACnB,IAAI,gBACF,cAAc,OAAO,MAAM,IAAI,mBAAmB,MAAM,qCACtD,gBAAgB,MAAM,KAAK,IAAI,qDAC/B,8EACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,QACL,OACM,sBAAc,EAAE,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,IAAI,EAAE,CAAC,GAClE,cAAc,OAAO,MAAM,IAAI,KAC/B,UACF;AAAA,CACD;;;AFlII,IAAM,kBAAkB,CAAC,OAAiB,UAC/C,MAAM,OAAO,MAAM,IAAI,QAAQ,MAAM,kCAAkC,MAAM,KAAK,IAAI,WACtF,gGACA,+FACA;AAMK,IAAM,qBAAqB,CAChC,OACA,OACA,MACA,WAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,MAAM,WAAW;AAAA,IAAG;AAAA,EAC/B,MAAM,WAAU,CAAC,aACR,cAAK,MAAM,MAAM,UAAsB,IAAI,EAAE,MAAM,WAAW,CAAC;AAAA,EACxE,IAAI,EAAE,OAAO,SAAS,OAAO,QAAO;AAAA,IAAI;AAAA,EACxC,OAAO,OAAc,cAAK,IAAI,gBAAgB,gBAAgB,OAAO,OAAO,KAAK,CAAC,CAAC;AAAA,CACpF;;;AZeI,IAAM,aAAa,WAAqB,eAAe,EAAE,sBAAsB,SAAS,CAAC;AAKhG,IAAM,UAAU,CAAC,YACR,cAAK,IAAI,gBAAgB,QAAQ,KAAK;AAAA,CAAI,CAAC,CAAC;AAQrD,IAAM,OAAO,CAAC,OAAiB,MAAuB,SAC7C,aAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,WAAW;AAAA,EACnB,MAAM,YAAW,iBAAiB,MAAM,MAAM,MAAM;AAAA,EACpD,IAAI,UAAS,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,SAAQ;AAAA,EACvD,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,IAAI,CAAC,aAAW,IAAI;AAAA,IAAG;AAAA,EACvB,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,EAKjC,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,WAAW,eAAe,IAAI;AAAA,IACpC,IAAI,SAAS,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,QAAQ;AAAA,IACvD,OAAc,oBACZ,eAAe,KAAK,QAAQ,OAAO,KAAK,IAAI,6CAC1C,6EACJ;AAAA,IACA,OAAO,EAAE,QAAQ,SAAS;AAAA,EAC5B;AAAA,EACA,MAAM,SAAS,MAAM,MAAM,IAAI;AAAA,EAC/B,OAAO,mBAAmB,OAAO,MAAM,MAAM,MAAM;AAAA,EACnD,IAAI,OAAO,OAAO,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,OAAO,MAAM;AAAA,EACjE,MAAM,QAAQ,KAAK,SAAS,OAAO;AAAA,EACnC,IAAI,OAAO,MAAM,WAAW,KAAK,CAAC;AAAA,IAAO,OAAO,EAAE,QAAQ,OAAO;AAAA,EACjE,MAAM,OACJ,OAAO,MAAM,WAAW,IACpB,mBAAmB,KAAK,iBAAiB,OAAO,qCAChD,qBACA,+CAA+C,OAAO,MAAM,KAAK,IAAI,YACrE;AAAA,EACN,OAAc,oBAAW,eAAe,KAAK,QAAQ,OAAO,KAAK,IAAI,MAAM,MAAM;AAAA,EACjF,OAAO,EAAE,QAAQ,SAAS;AAAA,CAC3B;AAoBH,IAAM,YAAY,CAAC,OAAiB,SAC3B,aAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,WAAW;AAAA,EACnB,MAAM,YAAW,iBAAiB,MAAM,MAAM,MAAM;AAAA,EACpD,IAAI,UAAS,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,SAAQ;AAAA,EACvD,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,EACjC,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,WAAW,eAAe,IAAI;AAAA,IACpC,IAAI,SAAS,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,QAAQ;AAAA,IACvD,OAAO,YAAY,IAAI;AAAA,EACzB,EAAO;AAAA,IACL,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,eAAe,OAAO,kBAAkB,OAAO,KAAK,IAAI,QAAQ,KAAK,MAAM;AAAA,IACpF;AAAA,IACA,MAAM,SAAS,MAAM,MAAM,IAAI;AAAA,IAC/B,IAAI,WAAW,aAAa,OAAO,MAAM,SAAS,GAAG;AAAA,MACnD,OAAO,OAAO,QAAQ;AAAA,QACpB,MAAM,OAAO,KAAK,IAAI,uBAAuB,KAAK,yBAChD,GAAG,OAAO,MAAM,KAAK,IAAI,gEACzB;AAAA,MACJ,CAAC;AAAA,IACH;AAAA,IACA,OAAO,mBAAmB,OAAO,MAAM,MAAM,MAAM;AAAA,IACnD,IAAI,OAAO,OAAO,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,OAAO,MAAM;AAAA,IACjE,IAAI,OAAO,MAAM,SAAS;AAAA,MAAG,OAAO,YAAY,MAAM,QAAQ,KAAK,KAAK,SAAS,CAAC;AAAA;AAAA,EAEpF,MAAM,QAAQ,OAAO,SAAS,IAAI;AAAA,EAClC,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAO,QAAQ;AAAA,MACpB,MAAM,OAAO,KAAK,IAAI;AAAA,IACxB,CAAC;AAAA,EACH;AAAA,EACA,MAAM,OAAO,MAAM,MAAM,KAAK,EAAE;AAAA,EAChC,IAAI,KAAK,SAAS,GAAG;AAAA,IACnB,OAAO,OAAO,QAAQ;AAAA,MACpB,MAAM,OAAO,KAAK,IAAI,uBAAuB,KAAK,KAAK,IAAI,6BACzD,yFACA;AAAA,IACJ,CAAC;AAAA,EACH;AAAA,EACA,OAAO,cAAa,MAAM,KAAK;AAAA,CAChC;AAEH,IAAM,UAAU,CAAC,MAAgB,YAAiD;AAAA,EAChF,MAAM,QAAQ,QAAQ,KAAK;AAAA,EAC3B,QAAQ,KAAK;AAAA,EACb,MAAM,QAAQ,QAAQ,KAAK;AAC7B;AAeA,IAAM,OAAO,CAAC,OAAiB,SACtB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,QAAQ,MAAM,MAAM,MAAM;AAAA,EACxC,MAAM,OAAO,OAAO,SAAS,KAAK;AAAA,EAClC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,WAAiB,cAAK,MAAM,MAAM,MAAM,IAAI,EAAE,MAAM,WAAW,CAAC;AAAA,EACtE,OAAO,OAAO,UAAU,OAAO,cAAa,OAAO,IAAI,GAAG,QAAO;AAAA,CAClE;AAUH,IAAM,YAAW;AAAA,EACf,QAAQ,GAAG,MAAM,aACf,aAAa,QAAQ,MAAM,MAAM,GAAG,IAAI;AAAA,EAC1C,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,KAAK,EAAE,KAAK,YAAY,OAAO,GAAG,MAAM,IAAI;AAAA,EAC9C,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,KAAK,EAAE,KAAK,YAAY,OAAO,GAAG,IAAI;AAAA,EACxC,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,UAAU,EAAE,KAAK,YAAY,OAAO,GAAG,IAAI;AAC/C;AAEO,IAAM,qBAAqB,MACvB,kBACP,YACO,iBAAQ,WAAW,SAAS,GAAG,SAAQ,CAAC,EAAE,KAAY,aAAI,cAAc,CAAC,CAClF;;AkBrNF,qBAAS;AACT,uBAAS;AACT;;;ACVO,IAAM,SAAQ;AAErB,IAAM,MAAM,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAuBnF,IAAM,YAAW,CAAC,UAAiE;AAAA,EACxF,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,EAAE,KAAK,IAAI,MAAM,GAAG,GAAG,MAAM,MAAM,MAAM,SAAS,IAAI,MAAM,OAAO,EAAE;AAAA,SACzE;AAAA,MACH,OAAO;AAAA,QACL,mBAAmB,MAAM;AAAA,QACzB,QAAQ,MAAM;AAAA,QACd,eAAe,MAAM;AAAA,QACrB,iBAAiB,IAAI,MAAM,gBAAgB;AAAA,QAC3C,KAAK,IAAI,MAAM,GAAG;AAAA,QAClB,cAAc,MAAM;AAAA,QACpB,SAAS,IAAI,MAAM,OAAO;AAAA,MAC5B;AAAA,SACG;AAAA,MACH,OAAO;AAAA,QACL,oBAAoB,MAAM;AAAA,QAC1B,sBAAsB,IAAI,MAAM,qBAAqB;AAAA,QACrD,aAAa,MAAM;AAAA,QACnB,iBAAiB,MAAM;AAAA,QACvB,gBAAgB,IAAI,MAAM,eAAe;AAAA,MAC3C;AAAA;AAAA;AAWN,IAAM,eAAe,CAAC,UAAqD;AAAA,EACzE,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,CAAC;AAAA,SACL;AAAA,MACH,OAAO,EAAE,sBAAsB,MAAM,0BAA0B,QAAQ,MAAM,IAAI;AAAA,SAC9E;AAAA,MACH,OAAO,EAAE,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,IAAI;AAAA;AAAA;AAcjF,IAAM,YAAW,CAAC,WAAsD;AAAA,EACtE,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EACxC,MAAM,OAAO,MAAM,IAAI;AAAA,EACvB,QAAQ,MAAM;AAAA,KACX,aAAa,KAAK;AACvB;AAEO,IAAM,QAAO,CAAC,UAA6B;AAAA,EAChD,MAAM,SAAS,UAAS,KAAK;AAAA,EAC7B,YAAY,QAAQ,UAAU,OAAO,QAAQ,UAAS,KAAK,CAAC,GAAG;AAAA,IAC7D,IAAI,UAAU;AAAA,MAAW,OAAO,UAAU;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,SAAS,CAAC,UAA6B;AAAA,EAClD,MAAM,QAAQ,OAAO,QAAQ,UAAS,KAAK,CAAC,EACzC,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,YAAY,MAAM;AAAA,EAC3B,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;AAW/B,IAAM,cAAa,CAAC,WAA8B,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,KAAK;;;AChErF,IAAM,iBAAiB,CAAC,UAA+D;AAAA,EAC5F,oBAAoB,KAAK,KAAK,mBAAmB;AAAA,EACjD,sBAAsB,IAAI,KAAK,uBAAuB,MAAK;AAAA,EAC3D,aAAa,KAAK,KAAK,YAAY;AAAA,EACnC,iBAAiB,KAAK,KAAK,gBAAgB;AAAA,EAC3C,gBAAgB,IAAI,KAAK,iBAAiB,MAAK;AAAA,EAC/C,mBAAmB,KAAK,KAAK,oBAAoB,IAAI;AACvD;AASO,IAAM,cAAc,CACzB,YACA,UAEA,WAAW,yBAAyB,MAAM,uBAAuB,OACjE,WAAW,2BAA2B,MAAM,yBAAyB,WACrE,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,sBAAsB,MAAM,oBAAoB,OAC3D,WAAW,qBAAqB,MAAM,mBAAmB,WACzD,WAAW,wBAAwB,MAAM,uBAAuB;;;AClFlE,IAAM,cAAc,CAAC,YAAoC,UAAsC;AAAA,EAC7F,IAAI,MAAM,SAAS;AAAA,IAAiB,OAAO,YAAY,YAAY,KAAK;AAAA,EACxE,MAAM,SACJ,WAAW,SAAS,MAAM,OAAO,WAAU,WAAW,aAAa,MAAM,WAAW;AAAA,EACtF,IAAI,MAAM,SAAS;AAAA,IAAY,OAAO,UAAU,WAAW,UAAU,MAAM,QAAQ;AAAA,EACnF,OACE,UACA,WAAW,mBAAmB,MAAM,iBAAiB,OACrD,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,YAAY,MAAM,UAAU,OACvC,WAAW,wBAAwB,MAAM,sBAAsB,OAC/D,WAAW,sBAAsB,MAAM,oBAAoB,WAC3D,WAAW,2BAA2B,MAAM,0BAA0B;AAAA;AAInE,IAAM,mBAAmB;AAAA,EAC9B,YAAY,CAAC,MAAM,UAAU;AAAA,IAQ3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,SACF,eAAe,IAAI;AAAA,MACtB,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,MAC/C,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,MACpC,IAAI,MAAM;AAAA,MACV,eAAe,KAAK,KAAK,gBAAgB;AAAA,MACzC,iBAAiB,IAAI,KAAK,kBAAkB,MAAK;AAAA,MACjD,KAAK,IAAI,KAAK,QAAQ,MAAK;AAAA,MAC3B,cAAc,KAAK,KAAK,eAAe;AAAA,MACvC,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,MAAM,IAAI,KAAK,SAAS,CAAC;AAAA,MACzB,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,SAAS,IAAI,KAAK,YAAY,MAAK;AAAA,MACnC,MAAM,MAAM;AAAA,MACZ,sBAAsB,KAAK,KAAK,uBAAuB,IAAI;AAAA,IAC7D;AAAA;AAAA,EAGF,YAAY,CAAC,UAAU,0BAA0B,MAAM;AAAA,EAEvD,YAAY;AAAA,EAMZ,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EAKA,SAAS,CAAC,YAAY,UACpB,WAAW,WAAW,MAAM,UAC5B,WAAW,SAAS,MAAM,QAC1B,WAAW,aAAa,MAAM,YAAY,SAC1C,YAAY,YAAY,KAAK;AAAA,EAC/B,MAAM,CAAC,UAAU,0BAA0B,MAAM;AAAA,EAEjD,YAAY;AACd;;;ACrFA;AACA,8BAAS;AACT;AACA;AAWO,IAAM,sBAAsB,CAAC,UAClC,OAAO,MAAM,QAAQ,QAAQ,OAAe,iCAAwB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC9E,iBAAQ,CAAC,UACP,4BAA2B,eAAc,gBAAe,eAAO,CAAC,EAAE,KAAI,EAAE,KACtE,kBACL,MACE,IAAI,mBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC,CACL,CACF,CACF,GACO,kBAAS,wBAAwB,MAAa,iBAAQ,SAAS,CAAC,GAChE,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAEK,IAAM,mBAAmB,CAAC,UAC/B,oBAAoB,KAAK,EAAE,KAClB,aAAI,CAAC,QAAS,QAAQ,YAAY,YAAY,iBAAiB,WAAW,KAAK,KAAK,CAAE,CAC/F;AAGK,IAAM,sBAAsB,CACjC,OACA,UAC4C;AAAA,KACzC,QAAO;AAAA,IACR,iBAAiB,KAAK;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,eAAe,KAAK;AAAA,IACpB,eAAe,KAAK;AAAA,IACpB,KAAK,KAAK;AAAA,IACV,cAAc,KAAK;AAAA,IACnB,kBAAkB,KAAK;AAAA,IACvB,oBAAoB,KAAK;AAAA,IACzB,WAAW,KAAK;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,cAAc,KAAK;AAAA,IACnB,iBAAiB,KAAK;AAAA,IACtB,MAAM,KAAK;AAAA,IACX,SAAS,KAAK;AAAA,IACd,oBAAoB,KAAK;AAAA,EAC3B,CAAwF;AAAA,EACxF,IAAI,MAAM;AAAA,EACV,MAAM,OAAO,MAAM,IAAI;AAAA,EACvB,QAAQ,MAAM;AAChB;AAOO,IAAM,qBAAqB,CAAC,UAC1B,aAAI,UAAU,GAAG;AAAA,EACtB,KAAK,OAAO,oBAAoB,KAAK,OAAO;AAAA,IAAW;AAAA,EACvD,OAAO,OACL,MAAM,QACN,aACA,MACQ,oCAA2B,EAAE,IAAI,MAAM,GAAG,CAAC,CACrD;AAAA,CACD;;;AJrCH;AACA;AA6FO,IAAM,sBAAsB,WAA8B,sBAAsB;AAWvF,MAAQ,2BAAa,8BAAgB,WAAW,gBAAgB;AAGzD,IAAM,8BAA8B,MAChC,kBACP,qBACO,iBACL,oBAAoB,SAAS,GAAG;AAAA,EAC9B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,iBAAiB,IAAI;AAAA,EACzC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,iBAAiB,IAAI;AAAA,IACzC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,iBAAiB,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC3E;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,iBAAiB,IAAI;AAAA,IACzC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OACL,KAAK,QACL,aACA,MACQ,oCAA2B;AAAA,WAC9B,oBAAoB,MAAM,iBAAiB,WAAW,IAAI,CAAC;AAAA,QAC9D,MAAM,KAAK;AAAA,MACb,CAAC,CACH;AAAA,IACF,EAAO;AAAA,MACL,MAAM,OAAO,WACX,iBAAiB,SACjB,MACA,MACA,iBAAiB,WAAW,IAAI,CAClC;AAAA,MACA,IAAI,SAAS;AAAA,QACX,OAAO,OACL,KAAK,QACL,aACA,MACQ,iCAAwB,oBAAoB,MAAM,IAAI,CAAC,CACjE;AAAA;AAAA,IAEJ,MAAM,QAAQ,OAAO,iBAAiB,IAAI;AAAA,IAC1C,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MACF,GAAG,iBAAiB,KAAK,IAAI,4DAC/B,CACF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAAW,mBAAmB,IAAI;AAC/C,CAAC,CACH,CACF;;AKlKF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACpDA;AACA;;;ACqBO,IAAM,yBAAsC;AAM5C,IAAM,qBAAkC;AAExC,IAAM,oBAAyC,UAAU,wBAAwB,CAAC,GAAG,IAAI;AAEzF,IAAM,gBAAqC,UAAU,oBAAoB,CAAC,GAAG,IAAI;;;ACKxF;AACA;AACA;AAkBA,IAAM,aAAa,CAAC,QAAmB,SAC9B,aAAI,UAAU,GAAG;AAAA,EAQtB,MAAM,aAAa,OAAO,OAAO,QAAQ,MAAM;AAAA,EAC/C,MAAM,OAAO,OAAO,WAAW,QAAQ,YAAY,OAAa,wBAAgB,EAAE,KAAK,CAAC,CAAC;AAAA,EAEzF,OAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK;AAAA,CACxC;AAYI,IAAM,eAAe,CAAC,UAAiB;AAAA,EAC5C,IAAI,UAAS;AAAA,IAAI,OAAO;AAAA,EACxB,MAAM,UAAU,MACb,MAAM;AAAA,CAAI,EACV,OACC,CAAC,UACE,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,MAC5C,CAAC,KAAK,WAAW,KAAK,KACtB,CAAC,KAAK,WAAW,KAAK,CAC1B,EAAE;AAAA,EACJ,OAAO,KAAK,IAAI,SAAS,CAAC;AAAA;AAIrB,IAAM,eAAe,CAAC,QAAmB,SAC9C,WAAW,QAAQ,IAAI,EAAE,KAAY,aAAI,YAAY,CAAC;AAmBxD,IAAM,gBAAgB,CAAC,WACrB,OAAO,QAAQ,QAAQ,OAAe,2BAAkB,CAAC,CAAC,CAAC,EAAE,KACpD,aAAI,CAAC,SAAS;AAAA,EACnB,MAAM,MAAM,QAAQ,CAAC;AAAA,EACrB,MAAM,WAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,SAAS,SAAS;AAAA,EACxD,OAAO;AAAA,IACL,SAAS,IACN,OAAO,CAAC,QAAQ,IAAI,SAAS,UAAU,CAAC,KAAK,IAAI,MAAM,CAAC,EACxD,IAAI,CAAC,QAAQ,KAAK,IAAI,MAAM,WAAW,CAAC;AAAA,IAC3C,SAAS,aAAY,YAAY,OAAO,KAAK,SAAQ,OAAO;AAAA,EAC9D;AAAA,CACD,CACH;AAgBK,IAAM,iBAAiB,CAAC,WAC7B,cAAc,MAAM,EAAE,KACb,aAAI,CAAC,WACV,OAAO,WAAW,OAAO,QAAQ,WAAW,IACxC,YACA,WAAW,OAAO,OAAO,OAAO,cAAc,OAAO,QAAQ,KAAK,IAAI,IAC5E,CACF;AAMK,IAAM,cACX;AACF,IAAM,gBAAgB;AAStB,IAAM,WAAW;AAmBV,IAAM,YAAY,CACvB,QACA,YACA,MACA,MAEA,WAAmB,aAEZ,aAAI,UAAU,GAAG;AAAA,EAEtB,SAAS,UAAU,EAAG,UAAU,UAAU,WAAW,GAAG;AAAA,IAWtD,MAAM,SAAS,OAAO,WACpB,QACA,YACA,OACM,0BAAkB,EAAE,MAAM,KAAK,CAAC,CACxC,EAAE,KAAY,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CAAC;AAAA,IAC5C,IAAI,WAAW;AAAA,MAAW,OAAO;AAAA,IACjC,IAAI,OAAO,WAAW;AAAA,MAAW,OAAO,KAAK,OAAO,YAAY,4BAA4B;AAAA,IAC5F,OAAc,eAAM,UAAU;AAAA,EAChC;AAAA,EACA,OAAO;AAAA,CACR;;;AFjNH,IAAM,SAAS,CAAC,MAAc,QACrB,aAAI,IAAI,MAAM,wBAAwB,SAAS,KAAK,CAAC;AAEvD,IAAM,eAAe,CAAC,UACpB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,SAAS,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,EASrD,IAAI,WAAW;AAAA,IAAG,OAAO,EAAE,MAAM,SAAS,EAAE;AAAA,EAE5C,MAAM,SAAS,OAAO,eAAe,MAAM,MAAM;AAAA,EACjD,IAAI,WAAW,WAAW;AAAA,IACxB,OAAO,OAAO,OACZ,MACA,wEAAwE,cACtE,0EACJ;AAAA,EACF;AAAA,EAWA,OAAO;AAAA,EACP,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,KACX,OAAO,WAAW,MAAM,QAAQ,YAAY,MAAY,uBAAe,EAAE,KAAK,CAAC,CAAC,CAClF;AAAA,EACA,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAO,OACZ,MACA,+FACE,qFACJ;AAAA,EACF;AAAA,EAUA,MAAM,aAAa,OAAO,UAAU,MAAM,QAAQ,YAAY,MAAM,IAAI;AAAA,EACxE,IAAI,eAAe,MAAM;AAAA,IACvB,OAAO,OAAO,OACZ,MACA,qBAAqB,gBAAgB,yCACnC,sBAAsB,cAAc,wDACpC,yBACJ;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,OAAO,eAAe,MAAM,MAAM;AAAA,EAChD,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAO,OACZ,MACA,2DAA2D,sBACzD,2FACA,gEACJ;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,EACnD,IAAI,SAAS,GAAG;AAAA,IACd,OAAO,OAAO,OACZ,MACA,8BAA8B,OAAO,IAAI,sDACvC,2FACJ;AAAA,EACF;AAAA,EACA,OAAO,EAAE,MAAM,SAAS,KAAK;AAAA,CAC9B;;;ADoBI,IAAM,sBAAsB,WAA8B,sBAAsB;AAEvF,IAAM,QAAO,CAAC,UACZ,aAAa,MAAM,QAAQ,MAAM,IAAI,EAAE,KAC9B,aAAI,CAAC,aAAa,EAAE,MAAM,MAAM,MAAM,QAAQ,EAAE,CACzD;AAYF,IAAM,QAAO,CAAC,SACL,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,CAAC,aAAW,IAAI;AAAA,IAAG;AAAA,EACvB,QAAQ,YAAY,OAAO,MAAK,IAAI;AAAA,EACpC,OAAO,YAAY,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,CAC5E;AAaH,IAAM,YAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM,GAAG,WAA+C,MAAK,IAAI;AAAA,EACjE,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAwC,MAAK,IAAI;AAAA,EAC1D,WAAW,GAAG,WAAwC,aAAa,IAAI;AACzE;AAEO,IAAM,8BAA8B,MAChC,kBAAO,qBAA4B,iBAAQ,oBAAoB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AIrFhG,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AClBO,IAAM,sBAAsB;AAC5B,IAAM,sBAAsB;AAU5B,IAAM,SAAQ;AAuBd,IAAM,YAAY,CAAC,UACxB,KAAK,KAAK,EACP,MAAM,SAAS,EACf,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAYN,IAAM,WAAU,CAAC,UAAmB,KAAK,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAGlE,IAAM,QAAO,CAAI,UAAyB,SAC/C,aAAa,aAAa,aAAa;AAElC,IAAM,WAAW,CAAC,UAA8B,SACrD,aAAa,aAAa,UAAU,QAAQ,MAAM;AAE7C,IAAM,cAAc,CAAC,UAA8B,SACxD,aAAa,aAAa,SAAQ,QAAQ,MAAM;AAElD,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAkCtC,IAAM,QAAO,CAAC,WAAqD;AAAA,KACrE,OAAM,aAAa,KAAK,MAAM,SAAS,CAAC;AAAA,KACxC,OAAM,gBAAgB,MAAM,eAAe;AAAA,KAC3C,OAAM,aAAa,MAAM,SAAS;AAAA,KAClC,OAAM,yBAAyB,MAAM,qBAAqB;AAAA,KAC1D,OAAM,gBAAgB,MAAM,YAAY;AAAA,KACxC,OAAM,eAAe,MAAM,WAAW;AAAA,KACtC,OAAM,qBAAqB,MAAM,sBAAsB,OAAO,MAAM,SAAS;AAAA,KAC7E,OAAM,QAAQ,MAAM,IAAI;AAAA,KACxB,OAAM,YAAY,MAAM,QAAQ;AAAA,KAChC,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,OAAO,MAAM,QAAQ,YAAY,YAAY,OAAO,MAAM,GAAG,CAAC;AAAA,KACpE,OAAM,UAAU,MAAM,MAAM;AAAA,KAC5B,OAAM,WAAW,MAAM,eAAe,YAAY,YAAY,OAAO,MAAM,UAAU,CAAC;AAAA,KACtF,OAAM,mBAAmB,MAAM,kBAAkB;AAAA,EACpD,MAAM,MAAM;AACd;AAgBO,IAAM,cAAa,CAAC,WAAqD;AAAA,KAC3E,MAAK,KAAK;AAAA,EACb,OAAO,MAAM;AACf;AAqBO,IAAM,cAAa,CAAC,UAAoD;AAAA,EAC7E,MAAM,QAAQ;AAAA,IACZ,GAAI,MAAM,SAAS,YAAY,CAAC,MAAM,IAAI,CAAC;AAAA,IAC3C,GAAI,MAAM,sBAAsB,QAAQ,CAAC,mBAAmB,IAAI,CAAC;AAAA,EACnE;AAAA,EACA,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;;;AC1MtC;AACA;AAkFA,IAAM,gBAAe,CACnB,MACA,UACsC;AAAA,EACtC,MAAM,OAAO;AAAA,EASb,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,EAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,IAAM;AAAA,EAChD,OAAO;AAAA,IACL,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,aAAa,KAAK,KAAK,cAAc;AAAA,IACrC,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,uBAAuB,KAAK,KAAK,wBAAwB;AAAA,IACzD,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,cAAc,UAAU,KAAK,eAAe;AAAA,IAC5C,YAAY,KAAK,KAAK,aAAa;AAAA,IACnC,aAAa,UAAU,KAAK,cAAc;AAAA,IAC1C,mBAAmB,KAAK,KAAK,oBAAoB;AAAA,IAEjD,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,UAAU,SAAQ,KAAK,WAAW;AAAA,IAClC,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,UAAU,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,YAAY,KAAK,GAAG,IAAI;AAAA,IACzE,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,OAAO,MAAM;AAAA,IACb,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,KAAK,IAAI,KAAK,QAAQ,MAAK;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,UAAU,IAAI,KAAK,aAAa,MAAK;AAAA,IACrC,QAAQ,UAAU,KAAK,SAAS;AAAA,IAChC,MAAM,aAAa,KAAK,MAAM,OAAO;AAAA,IACrC,WAAW,IAAI,KAAK,YAAY,MAAK;AAAA,IACrC,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,EACjD;AAAA;AA2BK,IAAM,sBAAsB,CAAC,UAClC,iBACE,OACE,MAAM,QACN,QACA,OACM,uBAAe,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,KAAK,CAAC,CAC/D,EAAE,KAAY,kBAAS,4BAA4B,MAAa,iBAAQ,SAAS,CAAC,CAAC,CACrF,EAAE,KACO,aAAI,CAAC,SAAS;AAAA,EACnB,IAAI,SAAS;AAAA,IAAY,OAAO;AAAA,EAChC,OAAO,SAAS,YAAY,YAAY,cAAa,MAAM,KAAK;AAAA,CACjE,CACH;AAoBK,IAAM,gBAAgB,CAAC,UAC5B,oBAAoB,KAAK,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAGhE,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;AAc7B,IAAM,WAAU,CAAC,YAAmC,UACzD,WAAW,UAAU,MAAM,QAAQ,OACnC,MAAK,MAAM,SAAS,WAAW,OAAO,KACtC,MAAK,MAAM,WAAW,WAAW,SAAS,KAC1C,MAAK,MAAM,KAAK,WAAW,GAAG,KAC9B,YAAY,MAAM,UAAU,WAAW,QAAQ,KAC/C,SAAS,MAAM,cAAc,WAAW,YAAY,KACpD,SAAS,MAAM,aAAa,WAAW,WAAW,KAClD,MAAK,MAAM,mBAAmB,WAAW,iBAAiB,KAC1D,SAAS,MAAM,QAAQ,WAAW,MAAM,KACxC,MAAK,MAAM,WAAW,WAAW,SAAS,KAC1C,MAAK,MAAM,uBAAuB,WAAW,qBAAqB,KAClE,MAAK,MAAM,iBAAiB,WAAW,eAAe,KACtD,MAAK,MAAM,YAAY,WAAW,UAAU,KAC5C,MAAK,MAAM,oBAAoB,WAAW,kBAAkB;;;AF1HvD,IAAM,qBAAqB,WAA6B,uBAAuB;AAAA,EACpF,sBAAsB;AACxB,CAAC;AASD,IAAM,UAA4C;AAAA,EAChD,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,mBAAmB;AACrB;AAEA,IAAM,cAAc,CAAC,SACnB,OAAO,YAAY,OAAO,QAAQ,IAAI,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,CAAC,CAAC;AAG7F,IAAM,qBAAoB,CAAC,WACxB;AAAA,KACI,YAAY,YAAW,KAAK,CAAC;AAAA,EAChC,MAAM,MAAM;AACd;AAGF,IAAM,qBAAoB,CAAC,WACxB;AAAA,KACI,YAAY,YAAW,KAAK,CAAC;AAAA,EAChC,OAAO,MAAM;AAAA,EACb,MAAM,MAAM;AACd;AAEK,IAAM,6BAA6B,MAC/B,kBACP,oBACO,iBACL,mBAAmB,SAAS,GAAG;AAAA,EAK7B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAG7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,cAAc,IAAI,IAAI,oBAAoB,IAAI,CAC9E;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAC7E,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,KAAK;AAAA,IAC9D,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,oBAAoB,IAAI;AAAA,IAG5C,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,uBAAuB,GAAG,KAAK,QAAQ,KAAK,OAAO;AAAA,MAC5E,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,IAAI;AAAA,MAC7D,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAUD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,SAAS,gBAAe,OAAO,cAAc,IAAI,CAAC;AAAA,IACxD,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAC7E,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,KAAK;AAAA,IAC9D,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACM,0BAAkB,mBAAkB,IAAI,CAAC,CACjD;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OACL,KAAK,QACL,aACA,MACM,wBAAgB,mBAAkB,IAAI,CAAC,CAC/C;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,cAAc,IAAI,CAAC;AAAA,IACvD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,SAAS,KAAK,gBAAgB,KAAK,yCACjC,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACM,2BAAmB,EAAE,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,CAAC,CACjE;AAAA,GACD;AACH,CAAC,CACH,CACF;;AG9MF,qBAAS;AACT;AACA;;;AC/BA,uBAAS;AAET;;;ACuFA,IAAM,OAAO,CAAC,UACZ,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC;AAGvE,IAAM,QAAQ,CAAC,QAA2B,cACxC,OAAO,IAAI,CAAC,SAAS,UAAU,KAAK,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,SAAS,EAAE;AAQ3E,IAAM,WAAW,CAAC,SAChB,KACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAEb,IAAM,SAAQ,CAAC,SAAyB;AAAA,EACtC,IAAI,CAAC,KAAK,WAAW,QAAQ;AAAA,IAAG,OAAO;AAAA,EACvC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,IAAI,KAAK;AAAA,IAAG,OAAO;AAAA,EACnB,MAAM,SAAS,KAAK,MAAM,KAAK,CAAC,EAAE,MAAM,GAAG;AAAA,EAC3C,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,KAAK,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,KAAK,GAAG;AAAA;AAG7E,IAAM,QAAO,CAAC,SAAyB;AAGhC,IAAM,iBAAiB,CAAC,YAAuC;AAAA,EACpE,kBAAkB,MAAM,OAAO,qBAAqB,CAAC,GAAG,KAAI,EAAE,KAAK;AAAA,EACnE,eAAe,MAAM,OAAO,kBAAkB,CAAC,GAAG,MAAK,EAAE,KAAK;AAAA,EAC9D,kBAAkB,MAAM,OAAO,qBAAqB,CAAC,GAAG,QAAQ,EAAE,KAAK;AAAA,EACvE,SAAS,MAAM,OAAO,SAAS,KAAI,EAAE,KAAK;AAC5C;AAEO,IAAM,oBAAoB,CAC/B,MACA,UACmC;AAAA,EACnC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,gBAAgB,KAAK,KAAK,eAAe;AAAA,EACzC,kBAAkB,MAAM,KAAK,KAAK,iBAAiB,GAAG,KAAI,EAAE,KAAK;AAAA,EACjE,eAAe,MAAM,KAAK,KAAK,cAAc,GAAG,MAAK,EAAE,KAAK;AAAA,EAC5D,kBAAkB,MAAM,KAAK,KAAK,iBAAiB,GAAG,QAAQ,EAAE,KAAK;AAAA,EAErE,MAAM,KAAK,KAAK,SAAS,KAAK,KAAK;AAAA,EACnC;AAAA,EACA,QAAQ,KAAK,KAAK,SAAS;AAAA,EAC3B,SAAS,MAAM,KAAK,KAAK,SAAS,GAAG,KAAI,EAAE,KAAK;AAClD;AAEA,IAAM,QAAQ,CAAC,GAAsB,MACnC,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,UAAU,SAAS,EAAE,MAAM;AAE9D,IAAM,iBAAiB,CAC5B,YACA,WACY;AAAA,EACZ,MAAM,QAAQ,eAAe,MAAM;AAAA,EACnC,OACE,WAAW,aAAa,OAAO,YAAY,SAC3C,WAAW,qBAAqB,OAAO,oBAAoB,SAC3D,WAAW,UAAU,OAAO,QAAQ,UACpC,MAAM,WAAW,SAAS,MAAM,OAAO,KACvC,MAAM,WAAW,mBAAmB,MAAM,iBAAiB,KAC3D,MAAM,WAAW,gBAAgB,MAAM,cAAc,KACrD,MAAM,WAAW,mBAAmB,MAAM,iBAAiB,MAC1D,OAAO,YAAY,aAAa,WAAW,YAAY,OAAO;AAAA;AAYnE,IAAM,SAAS,CAAC,YAAuC;AAAA,EACrD,SAAS,OAAO,YAAY,OAAQ,MAAiB;AAAA,EACrD,gBAAgB,OAAO,oBAAoB,OAAQ,MAAiB;AAAA,EACpE,MAAM,OAAO,QAAS;AACxB;AAEA,IAAM,QAAQ,CAAC,WAAiF;AAAA,EAC9F,MAAM,QAAQ,eAAe,MAAM;AAAA,EACnC,MAAM,MAAiD,CAAC;AAAA,EACxD,IAAI,MAAM,kBAAkB,SAAS;AAAA,IAAG,IAAI,oBAAoB,MAAM;AAAA,EACtE,IAAI,MAAM,eAAe,SAAS;AAAA,IAAG,IAAI,iBAAiB,MAAM;AAAA,EAChE,IAAI,MAAM,kBAAkB,SAAS;AAAA,IAAG,IAAI,oBAAoB,MAAM;AAAA,EACtE,IAAI,MAAM,QAAQ,SAAS;AAAA,IAAG,IAAI,SAAS,MAAM;AAAA,EACjD,OAAO;AAAA;AASF,IAAM,oBAAoB,CAAC,YAA0D;AAAA,KACvF,OAAO,MAAM;AAAA,KACb,MAAM,MAAM;AAAA,KACX,OAAO,YAAY,aAAa,OAAO,YAAY,KAAK,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;AAAA,EAC3F,MAAM,OAAO;AACf;AAOO,IAAM,oBAAoB,CAAC,WAAyD;AAAA,EACzF,MAAM,UAAU,MAAM,MAAM;AAAA,EAC5B,MAAM,UACJ,CAAC,kBAAkB,eAAe,kBAAkB,QAAQ,EAC5D,OAAO,CAAC,QAAQ,QAAQ,SAAS,SAAS;AAAA,EAC5C,IAAI,OAAO,YAAY;AAAA,IAAI,QAAQ,KAAK,SAAS;AAAA,EACjD,OAAO;AAAA,OACF,OAAO,MAAM;AAAA,OACb;AAAA,OACC,OAAO,YAAY,aAAa,OAAO,YAAY,KAAK,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;AAAA,OACvF,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ,QAAQ;AAAA,EACpD;AAAA;;;AC1NF;AACA;;;ACDA,8BAAS;AACT;AACA;AACA;AAAA;AAGO,MAAM,mCAAwC,kBAAY,4BAA4B,EAE1F;AAAC;AAOG,IAAM,sBAAsB,CAAuB,QAAW,WAC5D,4BAA2B,eAAO,MAAM,GAAG,EAAE,kBAAkB,QAAQ,CAAC,EAC7E,OAAO,YACL,OAAO,QAAQ,MAAM,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,WAAW,KAAK,GAAG,GAAG,KAAK,CAAC,CAChF,CACF,EAAE,KACO,kBAAS,MAAM,IAAI,2BAA2B,EAAE,WAAW,yBAAyB,CAAC,CAAC,CAC/F;AAGK,IAAM,uBACX,CAAuB,WACvB,CAAC,UACQ,4BAA2B,eAAO,MAAM,CAAC,EAAE,KAAI,EAAE,KAC/C,YAAG,KAAI,GACP,kBACL,MACE,IAAI,mBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC,CACL,CACF;;;AD1BG,IAAM,cAAc,CAAC,UAC1B,OACE,MAAM,QACN,QACA,OACQ,uCAA8B,EAAE,MAAM,MAAM,KAAK,CAAC,CAC5D,EAAE,KACO,iBAAQ,qBAA6B,8CAAqC,CAAC,GAC3E,aAAI,CAAC,SACV,kBACE;AAAA,KACK;AAAA,EACH,gBAAgB,KAAK;AAAA,EACrB,kBAAkB,KAAK;AAAA,EACvB,eAAe,KAAK;AAAA,EACpB,kBAAkB,KAAK;AACzB,GACA,MAAM,IACR,CACF,GACO,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAEK,IAAM,gBAAgB,CAAC,UACrB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO,oBACX,kDACR,kBAAkB,KAAK,CACzB;AAAA,EACA,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAc,0CAAiC,KAAK,CAAC;AAAA,CAC/F;AAEI,IAAM,gBAAgB,CAAC,UACrB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO,oBAA4B,+CAAsC;AAAA,OAClF,kBAAkB,KAAK;AAAA,IAC1B,MAAM,MAAM;AAAA,EACd,CAAC;AAAA,EACD,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAc,uCAA8B,KAAK,CAAC;AAAA,CAC5F;AAEI,IAAM,gBAAgB,CAAC,UAC5B,OACE,MAAM,QACN,aACA,MACQ,0CAAiC,EAAE,MAAM,MAAM,KAAK,CAAC,CAC/D,EAAE,KAAY,kBAAS,YAAY,MAAa,aAAI,CAAC;;;AFxCvD,IAAM,QAAQ,CAAC,OAAc,WAC3B,UAAU,4CAA4C,kBAAkB,KAAK,GAAG,MAAM,EAAE,KAC/E,iBACL,UAAU,kDAAkD,kBAAkB,KAAK,GAAG,KAAK,CAC7F,CACF;AAEK,IAAM,kBAAkB;AAAA,EAE7B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WACA,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,YAAY,IAAI;AAAA,IACpC,OAAO,MAAM,MAAM,SAAS,SAAS;AAAA,IACrC,OAAO;AAAA,GACR;AAAA,EACH,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAMO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,IAAI,KAAK,SAAS,KAAK;AAAA,MAAM,OAAO,EAAE,QAAQ,UAAU;AAAA,IACxD,OAAO,MAAM,MAAM,WAAW,SAAS;AAAA,IACvC,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,YAAY,IAAI;AAAA,IACpC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,MAAM,MAAM,IAAI;AAAA,MACvB,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,eAAe,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GACjE;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,YAAY,IAAI;AAAA,IACpC,OAAO,MAAM,MAAM,SAAS,SAAS;AAAA,IACrC,IAAI,SAAS;AAAA,MAAW,OAAO,cAAc,IAAI;AAAA,IAC5C,SAAI,CAAC,eAAe,MAAM,IAAI;AAAA,MAAG,OAAO,cAAc,IAAI;AAAA,IAC/D,MAAM,QAAQ,OAAO,YAAY,IAAI;AAAA,IACrC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,aACnB,IAAI,MAAM,wBAAwB,KAAK,+CAA+C,CACxF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAA4B,cAAc,IAAI;AAC3D;;;ADfO,IAAM,6BAA6B,WACxC,6BACF;AAEO,IAAM,qCAAqC,MACvC,kBACP,4BACO,iBAAQ,2BAA2B,SAAS,GAAG,eAAe,CAAC,CACxE;;AKZF,qBAAS;AACT;AACA;;;ACpDA,uBAAS;AAET;;;ACqBA,IAAM,YAA6E;AAAA,EACjF,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACF;AAGO,IAAM,iBAAiB,CAAC,UAC7B,UAAU,MAAM;;;AChBlB,IAAM,eAAe;AAGd,IAAM,SAAS,CAAC,UAA2B;AAAA,EAChD,MAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,OAAO,SAAS,EAAE,GAAG,EAAE;AAAA,EAC1F,OAAO,OAAO,MAAM,MAAM,IAAI,IAAI;AAAA;AAGpC,IAAM,SAAS,CAAC,UACd,MACG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAWN,IAAM,cAAc,CAAC,UAC1B,OACE,MAAM,QAAQ,KAAK,IACf,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IACzC,OAAO,UAAU,WACf,MAAM,MAAM,SAAS,IACrB,CAAC,CACT;AAGK,IAAM,aAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AAE1F,IAAM,MAAM,CAAC,KAAa,UACxB,UAAU,YAAY,CAAC,IAAI,GAAG,MAAM,MAAM;AAoBrC,IAAM,SAAQ,CAAC,WAA4D;AAAA,EAChF,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,KACrC,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,QAAQ,MAAM,IAAI;AAAA,KACtB,IAAI,WAAW,MAAM,OAAO;AAAA,KAC5B,IAAI,gBAAgB,MAAM,eAAe;AAAA,KACzC,IAAI,UAAU,MAAM,WAAW,YAAY,YAAY,MAAM,OAAO,KAAK,YAAY,CAAC;AAAA,KACtF,IAAI,UAAU,MAAM,WAAW,YAAY,YAAY,YAAY,MAAM,MAAM,CAAC;AAAA,KAChF,IACD,eACA,MAAM,mBAAmB,YAAY,YAAY,YAAY,MAAM,cAAc,CACnF;AAAA,KACG,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,QAAQ,MAAM,IAAI;AAAA,KACtB,IAAI,QAAQ,MAAM,SAAS,YAAY,YAAY,OAAO,MAAM,IAAI,CAAC;AAAA,KACrE,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,OAAO,MAAM,GAAG;AAAA,KACpB,IAAI,YAAY,MAAM,QAAQ;AACnC;AAQO,IAAM,cAAc,CAAC,WAA4D;AAAA,KACnF,OAAM,KAAK;AAAA,EACd,MAAM,MAAM;AACd;;;AC1GO,IAAM,aAA6E;AAAA,EAOxF,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,SAAS,KAAK,eAAe,KAAK,KAAK,eAAe;AAAA,IACtD,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,QAAQ,WAAW,KAAK,SAAS;AAAA,IACjC,QAAQ,YAAY,KAAK,SAAS;AAAA,IAClC,eAAe,YAAY,KAAK,cAAc;AAAA,IAC9C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,MAAM,MAAM;AAAA,IACZ,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,KAAK,KAAK,KAAK,MAAM;AAAA,IACrB,UAAU,KAAK,KAAK,WAAW;AAAA,EACjC;AAAA,EACA,YAAY,CAAC,UAAU,mCAAmC,MAAM;AAAA,EAEhE,YAAY;AAAA,EAEZ,UAAU;AAAA,EAUV,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,YAAY,UACzC,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,aAAa,aAAa,WAAW,aAAa,MAAM,cAC9D,MAAM,oBAAoB,aAAa,WAAW,oBAAoB,MAAM,qBAC5E,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,QAAQ,aAAa,WAAW,QAAQ,MAAM,SACpD,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,WAAW,aAAa,WAAW,WAAW,YAAY,MAAM,MAAM,OAC5E,MAAM,mBAAmB,aACxB,WAAW,mBAAmB,YAAY,MAAM,cAAc,OAC/D,MAAM,WAAW,aAAa,WAAW,WAAW,WAAW,MAAM,MAAM;AAAA,EAC9E,MAAM,CAAC,UAAU,mCAAmC,MAAM,QAAQ,MAAM;AAAA,EACxE,YAAY;AACd;;;AClEA;AAEA;AAOA,IAAM,QAAO,CACX,UAC6E;AAAA,EAC7E,MAAM,UAAU,EAAE,MAAM,MAAM,KAAK;AAAA,EACnC,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAe,8CAAqC,OAAO,EAAE,KACpD,iBAAQ,qBAA6B,qDAA4C,CAAC,GAClF,aAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAClC;AAAA,SACG;AAAA,MACH,OAAe,gDAAuC,OAAO,EAAE,KACtD,iBACL,qBAA6B,uDAA8C,CAC7E,GACO,aAAI,CAAC,SAAS;AAAA,WAChB;AAAA,QACH,gBAAgB,IAAI;AAAA,QACpB,eAAe,IAAI;AAAA,MACrB,EAAE,CACJ;AAAA,SACG;AAAA,MACH,OAAe,4CAAmC,OAAO,EAAE,KAClD,iBAAQ,qBAA6B,mDAA0C,CAAC,GAChF,aAAI,CAAC,SAAS;AAAA,WAChB;AAAA,QACH,gBAAgB,IAAI;AAAA,QACpB,eAAe,IAAI;AAAA,MACrB,EAAE,CACJ;AAAA,SACG;AAAA,MACH,OAAe,+CAAsC,OAAO,EAAE,KACrD,iBAAQ,qBAA6B,sDAA6C,CAAC,GACnF,aAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAClC;AAAA;AAAA;AAIC,IAAM,aAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,QAAQ,OAAO,MAAK,KAAK,CAAC,EAAE,KACxC,aAAI,CAAC,QAAQ,WAAW,WAAW,KAAK,KAAK,CAAC,GAC9C,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAGF,IAAM,SAAS,CAAC,OAAc,WAAoB;AAAA,EAChD,MAAM,OAA0C;AAAA,OAC1C,SAAS,YAAY,KAAK,IAAI,OAAM,KAAK;AAAA,IAC7C,MAAM,MAAM;AAAA,EACd;AAAA,EACA,MAAM,UAAoB,CAAC;AAAA,EAC3B,YAAY,KAAK,WAAW;AAAA,IAC1B,CAAC,UAAU,MAAM,WAAW,YAAY,YAAY,CAAC,GAAG,MAAM,MAAM,CAAC;AAAA,IACrE;AAAA,MACE;AAAA,MACA,MAAM,WAAW,YAAY,YAAY,YAAY,MAAM,MAAM,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAAA,IAC9F;AAAA,IACA;AAAA,MACE;AAAA,MACA,MAAM,mBAAmB,YACrB,YACA,YAAY,MAAM,cAAc,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAAA,IACjE;AAAA,EACF,GAAY;AAAA,IACV,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,IAAI,OAAO,SAAS;AAAA,MAAG,KAAK,OAAO;AAAA,IAC9B;AAAA,MACH,OAAO,KAAK;AAAA,MACZ,IAAI,CAAC;AAAA,QAAQ,QAAQ,KAAK,GAAG;AAAA;AAAA,EAEjC;AAAA,EAEA,IAAI,QAAQ,SAAS;AAAA,IAAG,KAAK,SAAS;AAAA,EACtC,OAAO;AAAA;AAIF,IAAM,sBAAsB,CAAC,OAAc,WAAoB;AAAA,EACpE,MAAM,SAAS,SACX;AAAA,IACE,UAAkB;AAAA,IAClB,MAAc;AAAA,IACd,QAAgB;AAAA,IAChB,SAAiB;AAAA,EACnB,EAAE,MAAM,QACR;AAAA,IACE,UAAkB;AAAA,IAClB,MAAc;AAAA,IACd,QAAgB;AAAA,IAChB,SAAiB;AAAA,EACnB,EAAE,MAAM;AAAA,EACZ,OAAO,oBAAoB,QAAQ,OAAO,OAAO,MAAM,CAAC,EAAE,KAAY,eAAM;AAAA;AAGvE,IAAM,eAAe,CAAC,UAAiB;AAAA,EAC5C,MAAM,OAAO,OAAO,OAAO,IAAI;AAAA,EAC/B,MAAM,YACJ,MAAM,SAAS,aACX,oBAA4B,2DAAkD,IAAI,EAAE,KAC3E,iBAAgB,kDAAyC,CAClE,IACA,MAAM,SAAS,SACb,oBAA4B,uDAA8C,IAAI,EAAE,KACvE,iBAAgB,8CAAqC,CAC9D,IACA,MAAM,SAAS,WACb,oBAA4B,yDAAgD,IAAI,EAAE,KACzE,iBAAgB,gDAAuC,CAChE,IACA,oBAA4B,0DAAiD,IAAI,EAAE,KAC1E,iBAAgB,iDAAwC,CACjE;AAAA,EACV,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAM,SAAS;AAAA;AAGnD,IAAM,eAAe,CAAC,UAAiB;AAAA,EAC5C,MAAM,OAAO,OAAO,OAAO,KAAK;AAAA,EAChC,MAAM,YACJ,MAAM,SAAS,aACX,oBAA4B,wDAA+C,IAAI,EAAE,KACxE,iBAAgB,+CAAsC,CAC/D,IACA,MAAM,SAAS,SACb,oBAA4B,oDAA2C,IAAI,EAAE,KACpE,iBAAgB,2CAAkC,CAC3D,IACA,MAAM,SAAS,WACb,oBAA4B,sDAA6C,IAAI,EAAE,KACtE,iBAAgB,6CAAoC,CAC7D,IACA,oBAA4B,uDAA8C,IAAI,EAAE,KACvE,iBAAgB,8CAAqC,CAC9D;AAAA,EACV,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAM,SAAS;AAAA;AAGnD,IAAM,eAAe,CAAC,UAAiB;AAAA,EAC5C,MAAM,UAAU,EAAE,MAAM,MAAM,KAAK;AAAA,EACnC,MAAM,YACJ,MAAM,SAAS,aACH,mDAA0C,OAAO,IACzD,MAAM,SAAS,SACL,+CAAsC,OAAO,IACrD,MAAM,SAAS,WACL,iDAAwC,OAAO,IAC/C,kDAAyC,OAAO;AAAA,EAClE,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAM,SAAS,EAAE,KACjD,kBAAS,YAAY,MAAa,aAAI,CAC/C;AAAA;;;AJ5IF,MAAQ,2BAAa,8BAAgB,WAAW,UAAU;AAC1D,IAAM,SAAQ,CAAC,OAAc,WAC3B,aAAY,OAAO,MAAM,EAAE,KAAY,iBAAQ,aAAY,KAAK,CAAC,CAAC;AAC7D,IAAM,iBAAiB;AAAA,EAE5B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WACA,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,IACnC,OAAO,OAAM,MAAM,SAAS,SAAS;AAAA,IACrC,OAAO;AAAA,GACR;AAAA,EACH,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAMO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAEvB,IAAI,KAAK,SAAS,KAAK,QAAQ,KAAK,SAAS,KAAK,MAAM;AAAA,MAGtD,MAAM,cAAc,OAAO,WAAW,IAAI;AAAA,MAC1C,OAAO,OAAM,MAAM,gBAAgB,SAAS;AAAA,MAC5C,OAAO,oBAAoB,MAAM,gBAAgB,SAAS;AAAA,MAC1D,OAAO,EAAE,QAAQ,WAAW,aAAa,KAAK,SAAS,KAAK,KAAK;AAAA,IACnE;AAAA,IACA,OAAO,OAAM,MAAM,WAAW,SAAS;AAAA,IACvC,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,IACnC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAM,MAAM,IAAI;AAAA,MACvB,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,WAAW,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GACrE;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,IACnC,OAAO,OAAM,MAAM,SAAS,SAAS;AAAA,IACrC,IAAI,SAAS;AAAA,MAAW,OAAO,aAAa,IAAI;AAAA,IAC3C,SAAI,CAAC,WAAW,QAAQ,MAAM,IAAI;AAAA,MAAG,OAAO,aAAa,IAAI;AAAA,IAClE,MAAM,QAAQ,OAAO,WAAW,IAAI;AAAA,IACpC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,aACnB,IAAI,MAAM,uBAAuB,KAAK,+CAA+C,CACvF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EAEH,QAAQ,GAAG,WAA4B,aAAa,IAAI;AAC1D;;;AD2EO,IAAM,4BAA4B,WACvC,4BACF;AAQO,IAAM,oCAAoC,MACtC,kBACP,2BACO,iBAAQ,0BAA0B,SAAS,GAAG,cAAc,CAAC,CACtE;;AMjHF,qBAAS;AACT;AACA;;;ACnDA,uBAAS;AAET;;;ACgFO,IAAM,aAAa,CACxB,MACA,WAC4B;AAAA,EAC5B,SAAS,eAAe,KAAK,UAAU;AAAA,EACvC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,0BAA0B,KAAK,KAAK,yBAAyB,EAAE,KAAK;AAAA,EACpE,eAAe,KAAK,KAAK,cAAc,EAAE,KAAK;AAAA,EAC9C,cAAc,IAAI,KAAK,eAAe,CAAC;AAAA,EACvC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,EACrC,gBAAgB,IAAI,KAAK,iBAAiB,CAAC;AAAA,EAC3C,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,oBAAoB,eAAe,KAAK,qBAAqB,MAAM;AAAA,EACnE,MAAM,MAAM;AAAA,EACZ,2BAA2B,eAAe,KAAK,0BAA0B;AAAA,EACzE,QAAQ,eAAe,KAAK,SAAS;AAAA,EACrC,eAAe,KAAK,KAAK,cAAc;AAAA,EACvC,MAAM,KAAK,KAAK,OAAO;AAAA,EACvB,kBAAkB,KAAK,KAAK,iBAAiB,EAAE,KAAK;AAAA,EACpD,QAAQ,eAAe,KAAK,SAAS;AAAA,EACrC,cAAc,KAAK,KAAK,aAAa;AACvC;AAEA,IAAM,QAAO,CAAI,UAAyB,SAAY,aAAa,aAAa,aAAa;AAYtF,IAAM,WAAU,CAAC,MAA8B,UACpD,MAAK,MAAM,SAAS,KAAK,OAAO,KAChC,MAAK,MAAM,gBAAgB,KAAK,GAAG,KAAK,cAAc,KACtD,MAAK,MAAM,mBAAmB,KAAK,GAAG,KAAK,iBAAiB,KAC5D,MAAK,MAAM,cAAc,KAAK,YAAY,KAC1C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,eAAe,KAAK,aAAa,KAC5C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,iBAAiB,KAAK,eAAe,KAChD,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,2BAA2B,KAAK,GAAG,KAAK,yBAAyB,MAC3E,MAAM,+BAA+B,aACpC,eAAe,MAAM,0BAA0B,MAAM,KAAK,+BAC5D,MAAK,MAAM,eAAe,KAAK,aAAa,MAC3C,MAAM,WAAW,aAAa,eAAe,MAAM,MAAM,MAAM,KAAK,YACpE,MAAM,WAAW,aAAa,eAAe,MAAM,MAAM,MAAM,KAAK,YACpE,MAAM,wBAAwB,aAC7B,eAAe,MAAM,qBAAqB,MAAM,MAAM,KAAK;AAE/D,IAAM,OAAM,CAAC,KAAa,UACxB,UAAU,YAAY,CAAC,IAAI,GAAG,MAAM,MAAM;AAG5C,IAAM,QAAQ,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAY5F,IAAM,UAAU,CAAC,WAAsD;AAAA,KAClE,KAAI,WAAW,MAAM,OAAO;AAAA,KAC5B,KAAI,eAAe,MAAM,gBAAgB,KAAK,CAAC;AAAA,KAC/C,KAAI,cAAc,MAAM,MAAM,aAAa,CAAC;AAAA,KAC5C,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,aAAa,MAAM,MAAM,YAAY,CAAC;AAAA,KAC1C,KAAI,gBAAgB,MAAM,MAAM,eAAe,CAAC;AAAA,KAChD,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,0BAA0B,MAAM,yBAAyB;AAAA,KAC7D,KAAI,oBAAoB,MAAM,mBAAmB;AAAA,KACjD,KAAI,2BAA2B,MAAM,0BAA0B;AAAA,KAC/D,KAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,KAAI,eAAe,MAAM,cAAc;AAAA,KACvC,KAAI,kBAAkB,MAAM,mBAAmB,KAAK,CAAC;AAAA,KACrD,KAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,KAAI,cAAc,KAAK,MAAM,aAAa,CAAC;AAChD;AAWO,IAAM,cAAa,CAAC,WAAsD;AAAA,KAC5E,QAAQ,KAAK;AAAA,EAChB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,KAKR,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAClE;AAqBO,IAAM,cAAa,CAAC,UAAqD,QAAQ,KAAK;AAEtF,IAAM,UAAS,CAAC,UAA6B,oBAAoB,MAAM;;;ACvN9E;AACA;;;ACOA;AAEA;AAGA;AAQO,IAAM,aAAa,CACxB,QACA,YACA,IACA,WAA0B,mBAE1B,GAAG,KACK,YACC,iBACL,YAAY;AAAA,EACV,SAAS,OAAO;AAAA,EAChB,QAAQ,WAAW;AAAA,EACnB,SAAS,WAAW;AACtB,CAAC,CACH,GACO,iBAAQ,QAAO,CACxB;AAGK,IAAM,SAAS,CACpB,QACA,MACA,OAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,WAAW,QAAQ,YAAY,EAAE;AAAA,CAChD;;;ADzCH,IAAM,UAAU,CAAC,UAAkC;AAAA,KAC7C,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,8BAA8B,YACnC,CAAC,IACD,EAAE,wBAAwB,KAAK,0BAA0B;AAAA,KACzD,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,kBAAkB,YAAY,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc;AAAA,KACzE,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,oBAAoB,YAAY,CAAC,IAAI,EAAE,cAAc,KAAK,gBAAgB;AAAA,KAC/E,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,wBAAwB,YAAY,CAAC,IAAI,EAAE,kBAAkB,KAAK,oBAAoB;AAAA,KAC3F,KAAK,+BAA+B,YACpC,CAAC,IACD,EAAE,yBAAyB,KAAK,2BAA2B;AAAA,KAC3D,KAAK,cAAc,YAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU;AAAA,KAC7D,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,sBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB;AAAA,KACrF,KAAK,cAAc,YAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU;AAAA,KAC7D,KAAK,kBAAkB,YAAY,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc;AAC/E;AAEA,IAAM,gBAAgB,CAAC,WAAmE;AAAA,KACrF,QAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,KACR,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAClE;AAEA,IAAM,gBAAgB,CAAC,WAAgE;AAAA,KAClF,QAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,MAAM,MAAM;AACd;AAEA,IAAM,OAAO,CAAC,SAAqE;AAAA,KAC9E;AAAA,EACH,0BAA0B,IAAI;AAAA,EAC9B,eAAe,IAAI;AAAA,EACnB,cAAc,IAAI;AAAA,EAClB,eAAe,IAAI;AAAA,EACnB,aAAa,IAAI;AAAA,EACjB,gBAAgB,IAAI;AAAA,EACpB,eAAe,IAAI;AAAA,EACnB,eAAe,IAAI;AAAA,EACnB,oBAAoB,IAAI;AAAA,EACxB,2BAA2B,IAAI;AAAA,EAC/B,eAAe,IAAI;AAAA,EACnB,kBAAkB,IAAI;AAAA,EACtB,cAAc,IAAI;AACpB;AAaO,IAAM,UAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAe,0BAAmB,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACrE,aAAI,CAAC,SAAS,WAAW,KAAK,IAAI,GAAG,KAAK,CAAC,GAC3C,kBAAS,qBAAqB,MAAa,iBAAQ,SAAS,CAAC,CACtE;AAEK,IAAM,YAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,6BAAsB,cAAc,KAAK,CAAC,CAAC;AAE/E,IAAM,YAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,0BAAmB,cAAc,KAAK,CAAC,CAAC;AAG5E,IAAM,YAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EAEtB,KAAK,OAAO,QAAQ,KAAK,OAAO;AAAA,IAAW;AAAA,EAC3C,OAAO,OAAO,OACZ,MAAM,QACN,aACO,6BAAsB,EAAE,MAAM,MAAM,KAAK,CAAC,CACnD;AAAA,CACD;;;AErFH;AAgBA,IAAM,WAAW,CAAC,MAAc,UAAkB;AAAA,EAChD,MAAM,OAAO,CAAC,UAAmB,MAAM,SAAS,IAAI,MAAM,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAChF,OAAO,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA;AAQ3B,IAAM,YAAY,CAAC,MAA8B,UACtD,KAAK,SAAS,MAAM,SAAS,KAAK,MAAM,MAAM,IAAI,IACvC,gBACA,aACL,IAAI,MACF,GAAG,QAAO,KAAK,oBAAoB,MAAM,sBAAsB,KAAK,oBAClE,sFACA,wFACA,0FACA,uCACJ,CACF;AAgBC,IAAM,eAAe,CAAC,MAA8B,UACzD,MAAM,YAAY,aAAa,eAAe,MAAM,OAAO,MAAM,KAAK,UAC3D,gBACA,aACL,IAAI,MACF,GAAG,QAAO,KAAK,uBAAuB,MAAM,2BAC1C,GAAG,KAAK,YAAY,KAAK,+BAA+B,KAAK,0BAC7D,yFACA,yFACA,iFACA,+BACJ,CACF;AA0BC,IAAM,UAAS,CAAU,OAA8B,SACrD,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,IAAI,WAAW,GAAG;AAAA,IAChD,MAAM,OAAO,OAAO;AAAA,IACpB,IAAI,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACvB,OAAc,eAAM,WAAW;AAAA,EACjC;AAAA,EACA,OAAO,OAAO;AAAA,CACf;;;AC/FH;AAMO,IAAM,qBAAqF;AAAA,EAChG,QAAQ;AAAA,EACR,QAAQ;AACV;AAGO,IAAM,sBAAsB,CAAC,UAC3B,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,UAAU,mBAAmB,QAAQ,YAAW,KAAK,GAAG,IAAI;AAAA,EACnE,OAAO,UAAU,mBAAmB,QAAQ,YAAW,KAAK,GAAG,KAAK;AAAA,CACrE;;;ALjBI,IAAM,YAAW;AAAA,EAMtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAwC,QAAQ,IAAI;AAAA,EAO7D,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAKO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAGvB,OAAO,oBAAoB,IAAI;AAAA,IAC/B,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAGhC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAClD,OAAO,UAAU,MAAM,IAAI;AAAA,IAC3B,OAAO,aAAa,MAAM,IAAI;AAAA,IAC9B,OAAO,SAAQ,MAAM,IAAI,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAClF;AAAA,EAMH,WAAkB,YAAG,UAAU,GAAG,QAAqC;AAAA,IAErE,OAAO,oBAAoB,IAAI;AAAA,IAC/B,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,UAAU,IAAI;AAAA,IACvB,EAAO;AAAA,MACL,OAAO,UAAU,MAAM,IAAI;AAAA,MAC3B,OAAO,aAAa,MAAM,IAAI;AAAA,MAE9B,MAAM,OAAO,WAAW,UAAS,MAAM,MAAM,YAAW,IAAI,CAAC;AAAA,MAC7D,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,UAAU,IAAI;AAAA,MACvB;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,QAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,QAAQ,aAAa,SAAQ,KAAK,IAAI,CAAC;AAAA,IAC3F,IAAI,UAAU,aAAa,CAAC,SAAQ,OAAO,IAAI,GAAG;AAAA,MAKhD,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,QAAO,IAAI,qEACZ,+DACA,gFACA,mFACA,2DACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAgBD,QAAe,YAAG,UAAU,GAAG,QAAqC;AAAA,IAClE,OAAO,UAAU,IAAI;AAAA,IACrB,MAAM,OAAO,OAAO,QAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,QAAQ,SAAS;AAAA,IACpE,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,QAAO,IAAI,mEACZ,kFACA,kEACA,GAAG,KAAK,0EACZ,CACF;AAAA,IACF;AAAA,GACD;AACH;;;ADkCO,IAAM,eAAe,WAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAEM,IAAM,uBAAuB,MACzB,kBAAO,cAAqB,iBAAQ,aAAa,SAAS,GAAG,SAAQ,CAAC,CAAC;;AO9GlF,qBAAS;AACT;AACA,uBAAS;AAET;;;AC7CA;AACA;;;ACDA;AACA;AACA;AAAA;AAEO,MAAM,oCAAyC,kBAAY,6BAA6B,EAE5F;AAAC;AAQG,IAAM,oBAAoB,CAAuB,QAAW,YAC1D,4BAA2B,eAAO,MAAM,CAAC,EAAE,OAAM,EAAE,KACjD,kBACL,MACE,IAAI,4BAA4B;AAAA,EAC9B,SACE;AACJ,CAAC,CACL,CACF;;;ADZK,IAAM,eAAc,CAAC,UAC1B,OAAO,MAAM,QAAQ,QAAe,qCAA6B,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KAC/E,aAAI,CAAC,QACV,kBACE;AAAA,KACK;AAAA,EACH,gBAAgB,IAAI;AAAA,EACpB,kBAAkB,IAAI;AAAA,EACtB,eAAe,IAAI;AAAA,EACnB,kBAAkB,IAAI;AACxB,GACA,MAAM,IACR,CACF,GACO,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAGF,IAAM,gBAAgB,CAAC,OAAc,UAAiD;AAAA,KACjF;AAAA,EACH,cAAc,KAAK;AAAA,EACnB,gBAAgB,KAAK;AAAA,EACrB,aAAa,KAAK;AAAA,EAClB,gBAAgB,KAAK;AAAA,EACrB,MAAM,MAAM;AACd;AAEO,IAAM,iBAAgB,CAAC,OAAc,SAC1C,OACE,MAAM,QACN,aACA,kBACS,gDACP,cAAc,OAAO,IAAI,CAC3B,EAAE,KAAY,iBAAe,uCAA+B,CAAC,CAC/D;AAEK,IAAM,iBAAgB,CAAC,OAAc,SAC1C,OACE,MAAM,QACN,aACA,kBAAyB,6CAAqC,cAAc,OAAO,IAAI,CAAC,EAAE,KACjF,iBAAe,oCAA4B,CACpD,CACF;AAGK,IAAM,iBAAgB,CAAC,UAC5B,OACE,MAAM,QACN,aACO,wCAAgC,EAAE,MAAM,MAAM,KAAK,CAAC,CAC7D,EAAE,KAAY,kBAAS,YAAY,MAAa,aAAI,CAAC;;;ADUhD,IAAM,yBAAyB,WAAiC,yBAAyB;AAKhG,IAAM,eAAc,CAAC,OAAc,oBACjC,UAAU,2CAA2C,kBAAkB,KAAK,GAAG,eAAe;AAChG,IAAM,eAAc,CAAC,UACnB,UAAU,iDAAiD,kBAAkB,KAAK,GAAG,KAAK;AAO5F,IAAM,YAAW;AAAA,EAEf,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAA4B,aAAY,IAAI;AAAA,EACrD,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAMO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,IAAI,KAAK,SAAS,KAAK;AAAA,MAAM,OAAO,EAAE,QAAQ,UAAU;AAAA,IACxD,MAAM,OAAO,OAAO,aAAY,IAAI;AAAA,IACpC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,eAAe,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GACjE;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,aAAY,IAAI;AAAA,IACpC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS;AAAA,MAAW,OAAO,eAAc,MAAM,kBAAkB,IAAI,CAAC;AAAA,IACrE,SAAI,CAAC,eAAe,MAAM,IAAI;AAAA,MAAG,OAAO,eAAc,MAAM,kBAAkB,IAAI,CAAC;AAAA,IACxF,MAAM,QAAQ,OAAO,aAAY,IAAI;AAAA,IACrC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MACF,iCAAiC,KAAK,oEACxC,CACF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAA4B,eAAc,IAAI;AAC3D;AAEO,IAAM,iCAAiC,MACnC,kBACP,wBACO,iBAAQ,uBAAuB,SAAS,GAAG,SAAQ,CAAC,CAC7D;;AG9GF,qBAAS;AACT;AACA;;;ACjBA,uBAAS;AAET;;;ACRA;AAKA;;;ACMA,mBAAS;;;ACYT;AACA;AAmBO,IAAM,aAAa,CACxB,MACA,MAAmB,QAAQ,QACoE;AAAA,EAC/F,MAAM,SAAiC,CAAC;AAAA,EACxC,MAAM,UAAoB,CAAC;AAAA,EAC3B,YAAY,KAAK,QAAQ,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC7C,MAAM,QAAQ,IAAI,IAAI;AAAA,IACtB,IAAI,UAAU,aAAa,UAAU;AAAA,MAAI,QAAQ,KAAK,IAAI,OAAO;AAAA,IAC5D;AAAA,aAAO,OAAO;AAAA,EACrB;AAAA,EACA,OAAO,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG,OAAO;AAAA;AAQzD,IAAM,OAAO,EAAE,GAAG,OAAQ,QAAQ,KAAK,OAAO,MAAM,GAAG,GAAG,GAAG,EAAE;AAC/D,IAAM,SAAS;AAGf,IAAM,YAAY,CAAC,WACjB,KAAK,UACH,OAAO,KAAK,MAAM,EACf,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CACpC;AAEF,IAAM,SAAS,CAAC,MAAc,WAC5B,WAAW,UAAU,MAAM,GAAG,MAAM,IAAI,IAAI;AASvC,IAAM,OAAO,CAAC,QAA0C,SAA0B;AAAA,EACvF,IAAI,OAAO,KAAK,MAAM,EAAE,WAAW;AAAA,IAAG,OAAO;AAAA,EAC7C,MAAM,QAAQ,SAAS,YAAY,YAAY,EAAE,IAAI,OAAO,KAAK,MAAM,MAAM;AAAA,EAC7E,OAAO,GAAG,UAAU,MAAM,SAAS,WAAW,KAAK,OAAO,OAAO,MAAM,EAAE,SAAS,WAAW;AAAA;AASxF,IAAM,cAAc,CAAC,QAAgB,WAAsD;AAAA,EAChG,IAAI,WAAW;AAAA,IAAI,OAAO,OAAO,KAAK,MAAM,EAAE,WAAW;AAAA,EACzD,OAAO,QAAQ,MAAM,QAAQ,SAAS,OAAO,MAAM,GAAG;AAAA,EACtD,IAAI,WAAW,UAAU,SAAS,aAAa,WAAW,aAAa,UAAU,WAAW;AAAA,IAC1F,OAAO;AAAA,EACT;AAAA,EACA,MAAM,WAAW,OAAO,KAAK,QAAQ,WAAW;AAAA,EAChD,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,WAAW,GAAG,MAAM;AAAA,EAC5D,OAAO,SAAS,WAAW,OAAO,UAAU,gBAAgB,UAAU,MAAM;AAAA;;;ADnFvE,IAAM,SAAS,CAAC,UAA0B,QAAO,KAAK,OAAO,MAAM,EAAE,SAAS,QAAQ;AAGtF,IAAM,WAAW,CAAC,UAA0B,QAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,MAAM;AAQxF,IAAM,cAAc,CAAC,SAAmD;AAAA,EAC7E,MAAM,QAAgC,CAAC;AAAA,EACvC,WAAW,QAAQ,KAAK,MAAM,GAAG,GAAG;AAAA,IAClC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC3B,IAAI,KAAK;AAAA,MAAG,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,EACxE;AAAA,EACA,MAAM,QAAQ,MAAM;AAAA,EACpB,OAAO,UAAU,YAAY,EAAE,MAAM,MAAM,WAAW,GAAG,IAAI,EAAE,MAAM,MAAM,WAAW,IAAI,MAAM;AAAA;AAI3F,IAAM,WAAW,CAAC,MAAc,UACrC,QAAQ,cAAc,OAAO,KAAK;AAEpC,IAAM,QAAO,CAAC,UACZ,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC;AAGhE,IAAM,QAAQ,CAAC,SACpB,CAAC,GAAG,IAAI,EACL,OAAO,CAAC,QAAQ,QAAQ,EAAE,EAC1B,KAAK,EACL,KAAK,GAAG;AAON,IAAM,eAAe,CAAC,QAAgB,WAC3C,KAAK,QAAO,8BAA8B,eAAe;AAMpD,IAAM,mBAAmB,CAC9B,MACA,UACoC;AAAA,EACpC,MAAM,UAAkC,CAAC;AAAA,EACzC,WAAW,QAAQ,MAAK,KAAK,SAAS,GAAG;AAAA,IACvC,QAAQ,MAAM,UAAU,YAAY,IAAI;AAAA,IACxC,IAAI,SAAS;AAAA,MAAI,QAAQ,QAAQ,SAAS,SAAS,EAAE;AAAA,EACvD;AAAA,EACA,MAAM,UAAU,MAAK,KAAK,SAAS,EAAE,IAAI,CAAC,SAAS,YAAY,IAAI,EAAE,IAAI;AAAA,EACzE,OAAO;AAAA,IACL,QAAQ,KAAK,KAAK,SAAS;AAAA,IAI3B,MAAM,SAAS,KAAK,KAAK,OAAO,CAAC;AAAA,IACjC,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,QAAQ,MAAM,OAAO,KAAK,OAAO,CAAC;AAAA,IAClC,cAAc,aAAa,MAAM,MAAM,OAAO;AAAA,IAC9C,QAAQ,YAAY,KAAK,SAAS;AAAA,IAClC,eAAe,YAAY,KAAK,cAAc;AAAA,IAC9C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,MAAM,MAAM;AAAA,IAGZ,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,QAAQ,MAAM,OAAO;AAAA,IACrB,QAAQ;AAAA,IACR,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,KAAK,KAAK,KAAK,MAAM;AAAA,IACrB,UAAU,KAAK,KAAK,WAAW;AAAA,EACjC;AAAA;;;AD1FF,IAAM,iBAAgB,CAAC,OAAc,UAAmB;AAAA,KACnD;AAAA,EACH,cAAc,KAAK;AAAA,EACnB,aAAa,KAAK;AAAA,EAClB,MAAM,MAAM;AACd;AAEA,IAAM,QAAO,CACX,UACyF;AAAA,EACzF,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAc,8CAAsC,EAAE,MAAM,MAAM,KAAK,CAAC,EAAE,KACjE,aAAI,CAAC,SAAS;AAAA,WAChB;AAAA,QACH,gBAAgB,IAAI;AAAA,QACpB,eAAe,IAAI;AAAA,MACrB,EAAE,CACJ;AAAA,SACG;AAAA,MACH,OAAc,0CAAkC,EAAE,MAAM,MAAM,KAAK,CAAC,EAAE,KAC7D,aAAI,CAAC,SAAS;AAAA,WAChB;AAAA,QACH,gBAAgB,IAAI;AAAA,QACpB,eAAe,IAAI;AAAA,MACrB,EAAE,CACJ;AAAA,SACG;AAAA,MACH,OACG,6CAAqC,EAAE,MAAM,MAAM,KAAK,CAAC,EACzD,KAAY,aAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;AAAA;AAAA;AAIxC,IAAM,cAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,QAAQ,MAAK,KAAK,CAAC,EAAE,KACjC,aAAI,CAAC,QAAQ,iBAAiB,KAAK,KAAK,CAAC,GACzC,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAGK,IAAM,uBAAsB,CAAC,OAAc,MAAe,SAA8B;AAAA,EAC7F,MAAM,SACJ,SAAS,WACL;AAAA,IACE,UAAiB;AAAA,IACjB,MAAa;AAAA,IACb,SAAgB;AAAA,EAClB,EAAE,MAAM,QACR;AAAA,IACE,UAAiB;AAAA,IACjB,MAAa;AAAA,IACb,SAAgB;AAAA,EAClB,EAAE,MAAM;AAAA,EACd,OAAO,kBAAkB,QAAQ,eAAc,OAAO,IAAI,CAAC,EAAE,KAAY,eAAM;AAAA;AAG1E,IAAM,gBAAe,CAAC,OAAc,SAAkB;AAAA,EAC3D,MAAM,UAAS,eAAc,OAAO,IAAI;AAAA,EACxC,MAAM,YACJ,MAAM,SAAS,aACX,kBAAyB,yDAAiD,OAAM,EAAE,KACzE,iBAAe,gDAAwC,CAChE,IACA,MAAM,SAAS,SACb,kBAAyB,qDAA6C,OAAM,EAAE,KACrE,iBAAe,4CAAoC,CAC5D,IACA,kBAAyB,wDAAgD,OAAM,EAAE,KACxE,iBAAe,+CAAuC,CAC/D;AAAA,EACR,OAAO,OAAO,MAAM,QAAQ,aAAa,SAAS;AAAA;AAG7C,IAAM,gBAAe,CAAC,OAAc,SAAkB;AAAA,EAC3D,MAAM,UAAS,eAAc,OAAO,IAAI;AAAA,EACxC,MAAM,YACJ,MAAM,SAAS,aACX,kBAAyB,sDAA8C,OAAM,EAAE,KACtE,iBAAe,6CAAqC,CAC7D,IACA,MAAM,SAAS,SACb,kBAAyB,kDAA0C,OAAM,EAAE,KAClE,iBAAe,yCAAiC,CACzD,IACA,kBAAyB,qDAA6C,OAAM,EAAE,KACrE,iBAAe,4CAAoC,CAC5D;AAAA,EACR,OAAO,OAAO,MAAM,QAAQ,aAAa,SAAS;AAAA;AAI7C,IAAM,gBAAe,CAAC,UAAiB;AAAA,EAC5C,MAAM,UAAU,EAAE,MAAM,MAAM,KAAK;AAAA,EACnC,MAAM,YACJ,MAAM,SAAS,aACJ,iDAAyC,OAAO,IACvD,MAAM,SAAS,SACN,6CAAqC,OAAO,IAC5C,gDAAwC,OAAO;AAAA,EAC9D,OAAO,OAAO,MAAM,QAAQ,aAAa,SAAS,EAAE,KAC3C,kBAAS,YAAY,MAAa,aAAI,CAC/C;AAAA;;;AG/FF,IAAM,aAAgF;AAAA,EACpF,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACF;AAGO,IAAM,oBAAoB,CAAC,UAChC,WAAU,MAAM;;;AChBlB,IAAM,eAAe;AAGrB,IAAM,kBACJ;AACF,IAAM,oBAAoB;AAEnB,IAAM,mBAAmB,CAAC,SAC/B,kBAAkB,KAAK,IAAI,KAAK,gBAAgB,KAAK,IAAI;AAE3D,IAAM,WAAU,CAAC,UAA2B,UAAU,MAAM,CAAC,aAAa,KAAK,KAAK;AAG7E,IAAM,2BAA2B,CACtC,WAEA,OAAO,QAAQ,UAAU,CAAC,CAAC,EACxB,OAAO,EAAE,MAAM,WAAW,OAAO,UAAU,YAAY,iBAAiB,IAAI,CAAC,EAC7E,OAAO,IAAI,WAAW,SAAQ,KAAe,CAAC,EAC9C,IAAI,EAAE,UAAU,IAAI,EACpB,KAAK;AAOH,IAAM,0BAA0B,CAAC,QAAsC;AAAA,EAC5E,IAAI,QAAQ;AAAA,IAAW,OAAO,CAAC;AAAA,EAC/B,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,YAAY,oCAAoC,KAAK,GAAG,IAAI,MAAM;AAAA,EACxE,MAAM,KAAK,UAAU,YAAY,GAAG;AAAA,EACpC,IAAI,MAAM,GAAG;AAAA,IACX,MAAM,WAAW,UAAU,MAAM,GAAG,EAAE;AAAA,IACtC,MAAM,QAAQ,SAAS,QAAQ,GAAG;AAAA,IAClC,IAAI,SAAS,KAAK,SAAQ,SAAS,MAAM,QAAQ,CAAC,CAAC;AAAA,MAAG,IAAI,KAAK,UAAU;AAAA,EAC3E;AAAA,EAEA,MAAM,SAAS,IAAI,QAAQ,WAAW,EAAE;AAAA,EACxC,WAAW,QAAQ,OAAO,MAAM,OAAO,GAAG;AAAA,IACxC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC3B,MAAM,OAAO,KAAK,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE;AAAA,IAC7C,IAAI,MAAM,KAAK,iBAAiB,IAAI,KAAK,SAAQ,KAAK,MAAM,KAAK,CAAC,CAAC;AAAA,MAAG,IAAI,KAAK,IAAI,MAAM;AAAA,EAC3F;AAAA,EACA,OAAO;AAAA;;;ACvCT,IAAM,QAAoE;AAAA,EACxE,QAAQ,CAAC,YAAY,MAAM;AAAA,EAC3B,MAAM,CAAC,SAAS;AAAA,EAChB,gBAAgB,CAAC,YAAY,MAAM;AAAA,EACnC,QAAQ,CAAC,SAAS;AAAA,EAClB,QAAQ,CAAC,YAAY,MAAM;AAAA,EAC3B,eAAe,CAAC,YAAY,MAAM;AAAA,EAClC,QAAQ,CAAC,SAAS;AAAA,EAClB,MAAM,CAAC,MAAM;AAAA,EACb,UAAU,CAAC,MAAM;AAAA,EACjB,MAAM,CAAC,MAAM;AAAA,EACb,QAAQ,CAAC,SAAS;AAAA,EAClB,QAAQ,CAAC,MAAM;AAAA,EACf,KAAK,CAAC,SAAS;AAAA,EACf,UAAU,CAAC,MAAM;AACnB;AAEA,IAAM,WAA8D;AAAA,EAClE,UAAU,CAAC;AAAA,EACX,MAAM,CAAC,UAAU,cAAc;AAAA,EAC/B,SAAS,CAAC,OAAO,QAAQ;AAC3B;AAGA,IAAM,aAAa;AAGnB,IAAM,aACJ;AAQK,IAAM,WAAW,CAAC,UAA2B;AAAA,EAClD,MAAM,MAAgB,CAAC;AAAA,EACvB,YAAY,QAAO,UAAU,OAAO,QAAQ,KAAK,GAA0C;AAAA,IACzF,IAAI,MAAM,YAAW,aAAa,CAAC,MAAM,SAAS,MAAM,IAAI,GAAG;AAAA,MAC7D,IAAI,KAAK,IAAI,sBAAqB,MAAM,KAAK,GAAG,kBAAkB,MAAM,MAAM;AAAA,IAChF;AAAA,EACF;AAAA,EACA,WAAW,UAAS,SAAS,MAAM,OAAO;AAAA,IACxC,IAAI,MAAM,YAAW,aAAa,MAAM,YAAW;AAAA,MACjD,IAAI,KAAK,GAAG,MAAM,eAAe,SAAQ;AAAA,EAC7C;AAAA,EACA,WAAW,OAAO,CAAC,GAAG,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,GAAG,GAAG,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG;AAAA,IAC1F,IAAI,CAAC,WAAW,KAAK,GAAG;AAAA,MAAG,IAAI,KAAK,IAAI,wCAAwC;AAAA,EAClF;AAAA,EAEA,WAAW,QAAQ,yBAAyB,MAAM,MAAM,GAAG;AAAA,IACzD,IAAI,KAAK,WAAW,qCAAqC,YAAY;AAAA,EACvE;AAAA,EACA,WAAW,SAAS,wBAAwB,MAAM,GAAG,GAAG;AAAA,IACtD,IAAI,KAAK,SAAS,qCAAqC,YAAY;AAAA,EACrE;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,YAAY,CAAC,UAA8C,OAAO,UAAU;AAG3E,IAAM,gBAAgB,CAAC,OAAc,MAAmB,QAAQ,QAAQ;AAAA,EAC7E,MAAM,aAAsC,CAAC;AAAA,EAC7C,MAAM,UAAkC,CAAC;AAAA,EACzC,YAAY,MAAM,UAAU,OAAO,QAAQ,MAAM,UAAU,CAAC,CAAC,GAAG;AAAA,IAC9D,IAAI,UAAU,KAAK;AAAA,MAAG,WAAW,QAAQ;AAAA,IACpC;AAAA,cAAQ,QAAQ;AAAA,EACvB;AAAA,EACA,MAAM,SAAS,WAAW,YAAY,GAAG;AAAA,EACzC,MAAM,aAAsC,CAAC;AAAA,EAC7C,YAAY,MAAM,QAAQ,OAAO,QAAQ,MAAM,UAAU,CAAC,CAAC;AAAA,IAAG,WAAW,UAAU,UAAU;AAAA,EAC7F,IAAI,MAAM,aAAa;AAAA,IAAW,WAAW,cAAc,MAAM;AAAA,EACjE,MAAM,SAAS,WAAW,YAAY,GAAG;AAAA,EACzC,OAAO;AAAA,IACL,QAAQ,EAAE,SAAS,OAAO,SAAS,QAAQ,KAAK,YAAY,OAAO,OAAO,EAAE;AAAA,IAC5E;AAAA,EACF;AAAA;AAMF,IAAM,QAAO,CAAC,UAA8B,SAC1C,aAAa,aAAa,aAAa;AAGlC,IAAM,eAAe,CAAC,MAAuC,UAClE,KAAK,aAAa,MAAM,YAAY,SACpC,MAAK,MAAM,SAAS,KAAK,OAAO,KAChC,MAAK,MAAM,QAAQ,KAAK,MAAM,KAC9B,MAAK,MAAM,iBAAiB,KAAK,eAAe,KAChD,MAAK,MAAM,QAAQ,KAAK,MAAM,MAC7B,MAAM,SAAS,aAAa,MAAM,SAAS,KAAK,SACjD,MAAK,MAAM,MAAM,KAAK,IAAI,KAC1B,MAAK,MAAM,UAAU,KAAK,QAAQ,KAClC,MAAK,MAAM,KAAK,KAAK,GAAG,KACxB,MAAK,MAAM,QAAQ,KAAK,MAAM,KAC9B,MAAK,MAAM,MAAM,KAAK,IAAI,MACzB,MAAM,WAAW,aAAa,YAAY,MAAM,MAAM,MAAM,KAAK,YACjE,MAAM,mBAAmB,aAAa,YAAY,MAAM,cAAc,MAAM,KAAK;AAE7E,IAAM,cAAc,CACzB,MACA,OACA,WACe;AAAA,EACf,IAAI,MAAM,WAAW;AAAA,IAAW,OAAO;AAAA,EACvC,IAAI,MAAM,OAAO,KAAK,MAAM,MAAM,CAAC,MAAM,KAAK;AAAA,IAAQ,OAAO;AAAA,EAC7D,IAAI,OAAO,OAAO,QAAQ,SAAS;AAAA,IAAG,OAAO;AAAA,EAC7C,OAAO,aAAa,MAAM,MAAM,OAAO,OAAO,MAAM,MAAM,KAAK,eAAe,UAAU;AAAA;AAGnF,IAAM,cAAc,CACzB,MACA,OACA,QACA,WACe;AAAA,EACf,IAAI,MAAM,WAAW,aAAa,MAAM,aAAa;AAAA,IAAW,OAAO;AAAA,EACvE,IAAI,MAAM,WAAW,aAAa,MAAM,OAAO,KAAK,MAAM,MAAM,CAAC,MAAM,KAAK;AAAA,IAC1E,OAAO;AAAA,EACT,IAAI,OAAO,OAAO,QAAQ,SAAS,KAAK,WAAW;AAAA,IAAI,OAAO;AAAA,EAC9D,OAAO,YAAY,QAAQ,OAAO,OAAO,MAAM,IAAI,UAAU;AAAA;AAS/D,IAAM,cAAc,CAAC,OAAc,WACjC,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,SACnC,SAAS,MAAM,OAAO,OAAO,OAAO,UAAU,WAAW,EAAE,CAC7D;AAEF,IAAM,cAAc,CAAC,OAAc,WACjC,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,SAAS,MAAM,OAAO,OAAO,OAAO,SAAS,EAAE,CAAC;AAGhG,IAAM,aAAa,CAAC,UAAyD;AAAA,EAC3E,CAAC,UAAU,MAAM,UAAU,EAAE;AAAA,EAC7B,CAAC,QAAQ,MAAM,SAAS,YAAY,KAAK,OAAO,MAAM,IAAI,CAAC;AAAA,EAC3D,CAAC,WAAW,MAAM,WAAW,EAAE;AAAA,EAC/B,CAAC,gBAAgB,MAAM,mBAAmB,EAAE;AAAA,EAC5C,CAAC,UAAU,MAAM,UAAU,EAAE;AAAA,EAC7B,CAAC,QAAQ,MAAM,QAAQ,EAAE;AAAA,EACzB,CAAC,QAAQ,MAAM,SAAS,YAAY,KAAK,OAAO,MAAM,IAAI,CAAC;AAAA,EAC3D,CAAC,UAAU,MAAM,UAAU,EAAE;AAAA,EAC7B,CAAC,OAAO,MAAM,OAAO,EAAE;AAAA,EACvB,CAAC,YAAY,MAAM,YAAY,EAAE;AAAA,EACjC,CAAC,UAAU,MAAM,WAAW,YAAY,CAAC,IAAI,YAAY,MAAM,MAAM,EAAE,MAAM,GAAG,CAAC;AAAA,EACjF;AAAA,IACE;AAAA,IACA,MAAM,mBAAmB,YAAY,CAAC,IAAI,YAAY,MAAM,cAAc,EAAE,MAAM,GAAG;AAAA,EACvF;AACF;AAEA,IAAM,WAAW,CAAC,OAAc,QAC7B,MAA6C,SAAS;AAEzD,IAAM,QAAQ,CAAC,UACb,OAAO,UAAU,WAAW,UAAU,KAAK,MAAM,OAAO,CAAC,SAAS,SAAS,EAAE,EAAE,WAAW;AAQrF,IAAM,aAAa,CACxB,OACA,QACA,OACA,SACY;AAAA,EACZ,MAAM,OAAmD;AAAA,IACvD,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EAC1C;AAAA,EACA,MAAM,UAAoB,CAAC;AAAA,EAC3B,MAAM,MAAM,CAAC,KAAa,UAAsC;AAAA,IAC9D,IAAI,CAAC,MAAM,KAAK;AAAA,MAAG,KAAK,OAAO;AAAA,IAC1B,SAAI,SAAS;AAAA,MAAU,QAAQ,KAAK,GAAG;AAAA;AAAA,EAE9C,YAAY,KAAK,UAAU,WAAW,KAAK;AAAA,IAAG,IAAI,SAAS,OAAO,GAAG;AAAA,MAAG,IAAI,KAAK,KAAK;AAAA,EACtF,IAAI,MAAM,UAAU,MAAM,WAAW;AAAA,IAAW,IAAI,UAAU,YAAY,OAAO,MAAM,CAAC;AAAA,EACxF,IAAI,MAAM,UAAU,MAAM,WAAW;AAAA,IAAW,IAAI,UAAU,YAAY,OAAO,MAAM,CAAC;AAAA,EACxF,IAAI,MAAM,UAAU,MAAM,aAAa,WAAW;AAAA,IAChD,KAAK,cAAc,OAAO,OAAO,OAAO,eAAe;AAAA,EACzD;AAAA,EACA,IAAI,SAAS;AAAA,IAAU,KAAK,UAAU,MAAM;AAAA,EAC5C,IAAI,QAAQ,SAAS;AAAA,IAAG,KAAK,YAAY;AAAA,EACzC,OAAO;AAAA;;;ANvLT,IAAM,OAAO,CAAC,UAAiB,kCAAkC,MAAM,QAAQ,MAAM;AAErF,IAAM,UAAS,CAAC,UAAiB;AAAA,EAC/B,MAAM,UAAU,SAAS,KAAK;AAAA,EAC9B,OAAO,QAAQ,WAAW,IACf,gBACA,aAAI,IAAI,MAAM,GAAG,KAAK,KAAK,MAAM,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA;AAIpE,IAAM,UAAU,CAAC,MAAkB,OAAc,QAAgB,WAAmB;AAAA,EAClF,MAAM,SAAS,YAAY,MAAM,OAAO,MAAM,MAAM;AAAA,EACpD,MAAM,cAAc,YAAY,MAAM,OAAO,QAAQ,MAAM,MAAM;AAAA,EACjE,OAAO,aAAa,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,cAC5C,YACC,EAAE,QAAQ,QAAQ,YAAY;AAAA;AAIrC,IAAM,gBAAgB,CAAC,OAAc,QAAgB,UAAiB;AAAA,EACpE,MAAM,UAAU;AAAA,IACd,GAAI,MAAM,SAAS,OAAO,OAAO,UAAU,CAAC;AAAA,IAC5C,GAAI,MAAM,SAAS,OAAO,OAAO,UAAU,CAAC;AAAA,EAC9C;AAAA,EACA,OAAO,QAAQ,WAAW,IACf,gBACA,aACL,IAAI,MACF,GAAG,KAAK,KAAK,kDAAkD,QAAQ,KAAK,IAAI,OAC9E,6EACJ,CACF;AAAA;AAGC,IAAM,YAAW;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAiB7B,MAAM,GAAG,MAAM,cACZ,WAAW,YAAY,QAAO,IAAI,IAAW,eAAM,KAC3C,iBAAQ,YAAS,IAAI,CAAC,GACtB,aAAI,CAAC,SACV,SAAS,YAAY,YAAY,KAAK,MAAM,QAAQ,QAAQ,UAAU,GAAG,CAC3E,CACF;AAAA,EAOF,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAMO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,WAAW,aAAa,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAC/C,OAAO,QAAO,IAAI;AAAA,IAClB,IAAI,SAAS,cAAc,KAAK,SAAS,KAAK,QAAQ,KAAK,SAAS,KAAK,OAAO;AAAA,MAG9E,MAAM,cAAc,OAAO,YAAS,IAAI;AAAA,MACxC,MAAM,SAAS,cAAc,IAAI;AAAA,MACjC,MAAM,QACJ,gBAAgB,YACZ,EAAE,QAAQ,MAAM,QAAQ,KAAK,IAC7B,QAAQ,aAAa,MAAM,QAAQ,EAAE;AAAA,MAC3C,IAAI,UAAU,WAAW;AAAA,QACvB,OAAO,cAAc,MAAM,QAAQ,KAAK;AAAA,QACxC,MAAM,OAAO,gBAAgB,YAAY,WAAW;AAAA,QACpD,MAAM,OAAO,WAAW,MAAM,QAAQ,OAAO,IAAI;AAAA,QACjD,OAAO,UAAU,kBAAkB,IAAI,EAAE,OAAO,MAAM,gBAAgB,SAAS;AAAA,QAC/E,OAAO,qBAAoB,MAAM,MAAM,IAAI;AAAA,MAC7C;AAAA,MACA,OAAO,EAAE,QAAQ,WAAW,aAAa,KAAK,SAAS,KAAK,KAAK;AAAA,IACnE;AAAA,IACA,MAAM,OAAO,OAAO,YAAS,IAAI;AAAA,IACjC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAClD,OAAO,QAAQ,MAAM,MAAM,cAAc,IAAI,GAAG,OAAO,MAAM,MAAM,YAC9D,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACH,WAAW,GAAG,MAAM,aACX,aAAI,UAAU,GAAG;AAAA,IACtB,OAAO,QAAO,IAAI;AAAA,IAClB,MAAM,SAAS,cAAc,IAAI;AAAA,IACjC,MAAM,OAAO,OAAO,YAAS,IAAI;AAAA,IACjC,IAAI,SAAS,QAAQ,UAAU;AAAA,IAC/B,IAAI,SAAS,WAAW;AAAA,MACtB,MAAM,QAAQ,EAAE,QAAQ,MAAM,QAAQ,KAAK;AAAA,MAC3C,OAAO,cAAc,MAAM,QAAQ,KAAK;AAAA,MACxC,MAAM,OAAO,WAAW,MAAM,QAAQ,OAAO,QAAQ;AAAA,MAQrD,OAAO,UAAU,kBAAkB,IAAI,EAAE,QAAQ,MAAM,IAAI;AAAA,MAC3D,OAAO,cAAa,MAAM,IAAI;AAAA,MAC9B,SAAS,KAAK,OAAO,OAAO,MAAM;AAAA,IACpC,EAAO;AAAA,MACL,MAAM,QAAQ,QAAQ,MAAM,MAAM,QAAQ,MAAM;AAAA,MAChD,IAAI,UAAU,WAAW;AAAA,QACvB,OAAO,cAAc,MAAM,QAAQ,KAAK;AAAA,QACxC,MAAM,OAAO,WAAW,MAAM,QAAQ,OAAO,QAAQ;AAAA,QAErD,OAAO,UAAU,kBAAkB,IAAI,EAAE,QAAQ,MAAM,KAAK;AAAA,QAC5D,OAAO,cAAa,MAAM,IAAI;AAAA,QAC9B,IAAI,MAAM;AAAA,UAAQ,SAAS,KAAK,OAAO,OAAO,MAAM;AAAA,MACtD;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,YAAS,IAAI;AAAA,IAClC,IAAI,UAAU,WAAW;AAAA,MAEvB,OAAO,OAAc,aACnB,IAAI,MAAM,GAAG,KAAK,IAAI,gEAAgE,CACxF;AAAA,IACF;AAAA,IACA,OAAO,KAAK,OAAO,OAAO;AAAA,GAC3B;AAAA,EACH,QAAQ,GAAG,WAA4B,cAAa,IAAI;AAC1D;;;AD3DO,IAAM,wBAAwB,WAAgC,wBAAwB;AAMtF,IAAM,gCAAgC,MAClC,kBACP,uBACO,iBAAQ,sBAAsB,SAAS,GAAG,SAAQ,CAAC,CAC5D;;AQ3DF,qBAAS;AACT;AACA;;;AChFA,uBAAS;AAET;;;ACoCO,IAAM,YAAY;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKA,IAAM,WAAW,CAAC,UAAiD;AAAA,EACjE,MAAM,OAA+B,CAAC;AAAA,EACtC,WAAW,OAAO,WAAW;AAAA,IAC3B,MAAM,QAAQ,MAAM;AAAA,IACpB,IAAI,UAAU;AAAA,MAAW,KAAK,OAAO,OAAO,KAAK;AAAA,EACnD;AAAA,EACA,OAAO;AAAA;AAYF,IAAM,iBAAiB,CAC5B,UACuC;AAAA,EACvC,cAAc,IAAI,KAAK,eAAe,CAAC;AAAA,EACvC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,EACrC,gBAAgB,IAAI,KAAK,iBAAiB,CAAC;AAAA,EAC3C,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAC3C;AASO,IAAM,aAAa,CAAC,aAA+C,UACxE,UAAU,MAAM,CAAC,QAAQ,MAAM,SAAS,aAAa,MAAM,SAAS,YAAW,IAAI;AA2BrF,IAAM,iBAAiB,CAAC,UAAyB,UAAU,KAAK,CAAC,QAAQ,MAAM,SAAS,SAAS;AAEjG,IAAM,eAAe,CAAC,UAAyB;AAAA,EAC7C,IAAI,eAAe,KAAK;AAAA,IAAG;AAAA,EAC3B,MAAM,IAAI,MACR,gBAAgB,MAAM,uEACpB,cAAc,MAAM,wEACpB,gGACA,uFACJ;AAAA;AAIF,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAG7C,IAAM,UAAU,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAoB9F,IAAM,SAAQ,CAAC,WAAkD;AAAA,KAC5D,SAAS,KAAK;AAAA,KACd,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,KAAK,MAAM,OAAO,CAAC;AAAA,KACpC,OAAM,aAAa,QAAQ,MAAM,YAAY,CAAC;AAAA,KAC9C,OAAM,MAAM,MAAM,EAAE;AAAA,EACvB,UAAU,MAAM;AAAA,EAChB,OAAO,MAAM;AACf;AAWO,IAAM,cAAa,CAAC,UAAiD;AAAA,EAC1E,aAAa,KAAK;AAAA,EAClB,OAAO,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA;AA+BlC,IAAM,cAAa,CAAC,UAAiD;AAAA,EAC1E,aAAa,KAAK;AAAA,EAClB,OAAO,OAAM,KAAK;AAAA;;;ACvMpB,IAAM,QAAO,CAAI,WAAyB,SAAY,cAAa,aAAa,cAAa;AAEtF,IAAM,OAAmD;AAAA,EAU9D,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,IACpC,IAAI,MAAM;AAAA,OACP,eAAe,IAAI;AAAA,IACtB,aAAa,IAAI,KAAK,cAAc,EAAE;AAAA,IACtC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,IACvB,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IACnC,OAAO,KAAK,KAAK,UAAU,MAAM,KAAK;AAAA,EACxC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAWZ,UAAU,EAAE,QAAQ,0BAA0B,QAAQ,6BAA6B;AAAA,EACnF,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,YAC9B,YAAW,UAAU,MAAM,SAC3B,MAAK,MAAM,IAAI,YAAW,EAAE,KAC5B,MAAK,MAAM,cAAc,YAAW,YAAY,KAChD,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,WAAW,aAAY,KAAK;AAAA,EAC9B,MAAM,CAAC,UAAU,gBAAgB,MAAM;AAAA,EACvC,YAAY;AACd;;;ACnDA;AACA;AAOA,IAAM,WAAU,CAAC,UAAkC;AAAA,KAC7C,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,kBAAkB,YAAY,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc;AAAA,KACzE,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,oBAAoB,YAAY,CAAC,IAAI,EAAE,cAAc,KAAK,gBAAgB;AAAA,KAC/E,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,UAAU,YAAY,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;AAAA,KACjD,KAAK,gBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,KAAK,YAAY;AAAA,KACnE,KAAK,aAAa,YAAY,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS;AAChE;AAEA,IAAM,iBAAgB,CAAC,WAA2D;AAAA,KAC7E,SAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,IAAI,MAAM;AAAA,EACV,OAAO,MAAM;AAAA,EACb,UAAU,MAAM;AAClB;AAEA,IAAM,iBAAgB,CAAC,WAAwD;AAAA,KAC1E,SAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,IAAI,MAAM;AACZ;AAGA,IAAM,QAAO,CAAC,SAAiE;AAAA,KAC1E;AAAA,EACH,cAAc,IAAI;AAAA,EAClB,eAAe,IAAI;AAAA,EACnB,aAAa,IAAI;AAAA,EACjB,gBAAgB,IAAI;AAAA,EACpB,eAAe,IAAI;AAAA,EACnB,eAAe,IAAI;AAAA,EACnB,aAAa,IAAI;AACnB;AAGO,IAAM,WAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAe,uBAAe,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC7D,aAAI,CAAC,QAAQ,KAAK,WAAW,MAAK,GAAG,GAAG,KAAK,CAAC,GAC9C,kBAAS,oBAAoB,MAAa,iBAAQ,SAAS,CAAC,CACrE;AAEK,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,0BAAkB,eAAc,KAAK,CAAC,CAAC;AAE3E,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,uBAAe,eAAc,KAAK,CAAC,CAAC;AAGxE,IAAM,aAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EAEtB,KAAK,OAAO,SAAQ,KAAK,OAAO;AAAA,IAAW;AAAA,EAC3C,OAAO,OAAO,OAAO,MAAM,QAAQ,aAAoB,0BAAkB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC;AAAA,CAC3F;;;AH1DH,MAAQ,2BAAa,8BAAgB,WAAW,IAAI;AAE7C,IAAM,aAAW;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAoC,SAAQ,IAAI;AAAA,EACzD,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAKO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,KAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS;AAAA,MAAW,OAAO,WAAU,IAAI;AAAA,IACxC,SAAI,CAAC,KAAK,QAAQ,MAAM,IAAI;AAAA,MAAG,OAAO,WAAU,IAAI;AAAA,IAEzD,MAAM,QAAQ,OAAO,SAAQ,IAAI;AAAA,IACjC,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,cACnB,IAAI,MAAM,GAAG,KAAK,KAAK,IAAI,uCAAuC,CACpE;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAAoC,WAAU,IAAI;AAC/D;;;AD6GO,IAAM,cAAc,WAAsB,cAAc;AAmBxD,IAAM,sBAAsB,MACxB,kBAAO,aAAoB,iBAAQ,YAAY,SAAS,GAAG,UAAQ,CAAC,CAAC;;AK9HhF,qBAAS;AACT;AACA;;;ACvDA,uBAAS;AAET;;;AC+BO,IAAM,SAAQ;AAGrB,IAAM,SAAgC;AAAA,EACpC,IAAI;AAAA,EACJ,GAAG;AAAA,EACH,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AACP;AAkBO,IAAM,QAAQ,CAAC,UAA2B;AAAA,EAC/C,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK;AAAA,EAC7B,MAAM,QAAQ,wCAAwC,KAAK,GAAG;AAAA,EAC9D,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,MAAM,OAAO,OAAM,MAAM,MAAM;AAAA,EAC/B,OAAO,SAAS,YAAY,SAAQ,KAAK,MAAM,OAAO,MAAM,MAAM,GAAG,IAAI,IAAI;AAAA;AAYxE,IAAM,UAAU,CAAC,UACtB,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,KAAK,KAAK;AAsB9F,IAAM,SAAQ,CAAC,WAAyB;AAAA,EACtC,gBAAgB,MAAM;AAAA,EACtB,mBAAmB,MAAM,uBAAuB,OAAO,MAAM;AAAA,EAC7D,OAAO,MAAM;AAAA,KACT,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AAAA,KAClF,MAAM,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,KAC7C,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,KACtD,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW,OAAO,MAAM,UAAU,EAAE;AAAA,KAC5E,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,KACzD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,aAAa;AAAA,KAC1E,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC/D,MAAM,qBAAqB,YAC3B,CAAC,IACD,EAAE,iBAAiB,MAAM,mBAAmB,MAAM,IAAI;AAAA,KACtD,MAAM,qBAAqB,YAC3B,CAAC,IACD,EAAE,iBAAiB,OAAO,MAAM,gBAAgB,EAAE;AACxD;AAYO,IAAM,cAAa,CAAC,WAAiD;AAAA,KACvE,OAAM,KAAK;AAAA,EACd,IAAI,MAAM;AAAA,KACN,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB,MAAM,kBAAkB;AAC/F;AAUO,IAAM,cAAa,CAAC,UAAgD,OAAM,KAAK;AAE/E,IAAM,QAAiD;AAAA,EAiB5D,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,gBAAgB,QAAQ,KAAK,eAAe;AAAA,IAC5C,IAAI,MAAM;AAAA,IACV,aAAa,IAAI,KAAK,cAAc,MAAK;AAAA,IACzC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,IACvB,OAAO,KAAK,KAAK,UAAU,EAAE;AAAA,IAC7B,WAAW,MAAM,KAAK,UAAU;AAAA,IAChC,QAAQ,KAAK,KAAK,WAAW,EAAE;AAAA,IAC/B,aAAa,KAAK,KAAK,cAAc,EAAE;AAAA,IACvC,gBAAgB,KAAK,KAAK,iBAAiB,EAAE;AAAA,IAG7C,mBAAmB,KAAK,KAAK,oBAAoB,KAAK;AAAA,IACtD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IAGnC,iBAAiB,KAAK,KAAK,kBAAkB,KAAK;AAAA,IAClD,OAAO,KAAK,KAAK,UAAU,EAAE;AAAA,IAC7B,kBAAkB,KAAK,KAAK,mBAAmB,MAAM;AAAA,IACrD,iBAAiB,IAAI,KAAK,kBAAkB,MAAK;AAAA,EACnD;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAoBZ,UAAU,EAAE,QAAQ,yBAAyB,QAAQ,4BAA4B;AAAA,EACjF,SAAS,CAAC,aAAY,UACpB,YAAW,wBAAwB,MAAM,uBAAuB,SAChE,YAAW,UAAU,MAAM,SAC3B,YAAW,oBAAoB,MAAM,oBACpC,MAAM,WAAW,aAAa,YAAW,WAAW,MAAM,YAC1D,MAAM,OAAO,aAAa,YAAW,OAAO,MAAM,QAClD,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,aAAa,aAAa,YAAW,aAAa,MAAM,cAC9D,MAAM,YAAY,aAAa,YAAW,YAAY,MAAM,aAC5D,MAAM,UAAU,aAAa,YAAW,UAAU,MAAM,WAIxD,MAAM,qBAAqB,aAC1B,YAAW,qBAAqB,MAAM,sBACvC,MAAM,eAAe,aAAa,YAAW,eAAe,MAAM,gBAClE,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,qBAAqB,aAC1B,YAAW,qBAAqB,MAAM;AAAA,EAE1C,MAAM,CAAC,UAAU,eAAe,MAAM;AAAA,EACtC,YAAY;AACd;;;AC3OA;AACA;AAMA,IAAM,WAAU,CAAC,UAAkC;AAAA,KAC7C,KAAK,oBAAoB,YAAY,CAAC,IAAI,EAAE,cAAc,KAAK,gBAAgB;AAAA,KAC/E,KAAK,uBAAuB,YAAY,CAAC,IAAI,EAAE,iBAAiB,KAAK,mBAAmB;AAAA,KACxF,KAAK,aAAa,YAAY,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS;AAAA,KAC1D,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,UAAU,YAAY,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;AAAA,KACjD,KAAK,aAAa,YAAY,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS;AAAA,KAC1D,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,cAAc,YAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU;AAAA,KAC7D,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,gBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,KAAK,YAAY;AAAA,KACnE,KAAK,qBAAqB,YAAY,CAAC,IAAI,EAAE,eAAe,KAAK,iBAAiB;AAAA,KAClF,KAAK,qBAAqB,YAAY,CAAC,IAAI,EAAE,eAAe,KAAK,iBAAiB;AAAA,KAClF,KAAK,sBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB;AAC3F;AAEA,IAAM,iBAAgB,CAAC,WAAmD;AAAA,KACrE,SAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,IAAI,MAAM;AAAA,EACV,OAAO,MAAM;AAAA,EACb,cAAc,MAAM;AACtB;AAEA,IAAM,iBAAgB,CAAC,WAAsD;AAAA,KACxE,SAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,IAAI,MAAM;AACZ;AAGA,IAAM,QAAO,CAAC,SAAgE;AAAA,KACzE;AAAA,EACH,gBAAgB,IAAI;AAAA,EACpB,mBAAmB,IAAI;AAAA,EACvB,aAAa,IAAI;AAAA,EACjB,WAAW,IAAI;AAAA,EACf,aAAa,IAAI;AAAA,EACjB,iBAAiB,IAAI;AAAA,EACrB,iBAAiB,IAAI;AAAA,EACrB,kBAAkB,IAAI;AAAA,EACtB,gBAAgB,IAAI;AACtB;AAGO,IAAM,WAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAe,sBAAc,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC5D,aAAI,CAAC,QAAQ,MAAK,WAAW,MAAK,GAAG,GAAG,KAAK,CAAC,GAC9C,kBAAS,mBAAmB,MAAa,iBAAQ,SAAS,CAAC,CACpE;AAEK,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,mBAAW,eAAc,KAAK,CAAC,CAAC;AAEpE,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,sBAAc,eAAc,KAAK,CAAC,CAAC;AAGvE,IAAM,aAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EAEtB,KAAK,OAAO,SAAQ,KAAK,OAAO;AAAA,IAAW;AAAA,EAC3C,OAAO,OAAO,OAAO,MAAM,QAAQ,aAAoB,yBAAiB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC;AAAA,CAC1F;;;AF7DH,MAAQ,2BAAa,8BAAgB,WAAW,KAAI;AAE7C,IAAM,aAAW;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAmC,SAAQ,IAAI;AAAA,EACxD,MAAM,GAAG,MAAM,aACN,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,MAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS;AAAA,MAAW,OAAO,WAAU,IAAI;AAAA,IACxC,SAAI,CAAC,MAAK,QAAQ,MAAM,IAAI;AAAA,MAAG,OAAO,WAAU,IAAI;AAAA,IAEzD,MAAM,QAAQ,OAAO,SAAQ,IAAI;AAAA,IACjC,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,cACnB,IAAI,MAAM,GAAG,MAAK,KAAK,IAAI,uCAAuC,CACpE;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAAmC,WAAU,IAAI;AAC9D;;;ADyKO,IAAM,aAAa,WAAqB,aAAa;AAWrD,IAAM,qBAAqB,MACvB,kBAAO,YAAmB,iBAAQ,WAAW,SAAS,GAAG,UAAQ,CAAC,CAAC;;AIjM9E,qBAAS;AACT;AACA;;;AClCA,uBAAS;AAET;;;AC6EO,IAAM,WAAW,CAAC,gBAAyB,kBAAkC;AAAA,EAClF,IAAI,CAAC;AAAA,IAAgB,OAAO;AAAA,EAG5B,IAAI,gBAAgB;AAAA,IAAG,OAAO;AAAA,EAC9B,OAAO,oCAAoC,OAAO,aAAa;AAAA;AAmC1D,IAAM,SAAQ,CAAC,WAAsD;AAAA,EAC1E,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM;AAAA,EAC9D,OAAO,MAAM;AAAA,KACT,MAAM,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC1D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AAAA,KAClF,MAAM,OAAO,aAAa,MAAM,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,KAChE,MAAM,sBAAsB,YAC5B,CAAC,IACD,EAAE,kBAAkB,OAAO,MAAM,iBAAiB,EAAE;AAC1D;;;ACjHO,IAAM,QAA2D;AAAA,EACtE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,iBAAiB,KAAK,KAAK,oBAAoB,IAAI;AAAA,IACzD,MAAM,gBAAgB,IAAI,KAAK,mBAAmB,EAAE;AAAA,IACpD,OAAO;AAAA,MACL,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,MACjC,IAAI,MAAM;AAAA,MACV,mBAAmB;AAAA,MACnB,aAAa,IAAI,KAAK,cAAc,EAAE;AAAA,MACtC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,MACvB,kBAAkB;AAAA,MAClB,UAAU,SAAS,gBAAgB,aAAa;AAAA,MAChD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,MACnC,OAAO,KAAK,KAAK,UAAU,MAAM,KAAK;AAAA,IACxC;AAAA;AAAA,EAcF,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA,EAaxD,UAAU,EAAE,QAAQ,2BAA2B,QAAQ,8BAA8B;AAAA,EACrF,SAAS,CAAC,aAAY,UACpB,YAAW,UAAU,MAAM,SAI3B,YAAW,cAAc,MAAM,YAAY,OAC3C,YAAW,wBAAwB,MAAM,uBAAuB,WAC/D,MAAM,sBAAsB,aAC3B,YAAW,sBAAsB,MAAM,uBACxC,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,OAAO,aAAa,YAAW,OAAO,MAAM,QAClD,MAAM,YAAY,aAAa,YAAW,YAAY,MAAM;AAAA,EAC/D,MAAM,CAAC,UAAU,iBAAiB,MAAM;AAAA,EACxC,YAAY;AACd;;;AC1EA;AACA;AAOA,IAAM,WAAU,CAAC,UAAkC;AAAA,KAC7C,KAAK,uBAAuB,YAAY,CAAC,IAAI,EAAE,iBAAiB,KAAK,mBAAmB;AAAA,KACxF,KAAK,aAAa,YAAY,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS;AAAA,KAC1D,KAAK,gBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,KAAK,YAAY;AAAA,KACnE,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,UAAU,YAAY,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;AAAA,KACjD,KAAK,sBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB;AAC3F;AAEA,IAAM,iBAAgB,CAAC,WAA0D;AAAA,KAC5E,SAAQ,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG,CAAC;AAAA,EAC5C,IAAI,MAAM;AAAA,EACV,OAAO,MAAM;AACf;AAEA,IAAM,iBAAgB,CAAC,WAA6D;AAAA,KAC/E,SAAQ,OAAM,KAAK,CAAC;AAAA,EACvB,IAAI,MAAM;AACZ;AAGA,IAAM,QAAO,CAAC,SAAkE;AAAA,KAC3E;AAAA,EACH,mBAAmB,IAAI;AAAA,EACvB,aAAa,IAAI;AAAA,EACjB,kBAAkB,IAAI;AACxB;AAGO,IAAM,WAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAe,wBAAgB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC9D,aAAI,CAAC,QAAQ,MAAK,WAAW,MAAK,GAAG,GAAG,KAAK,CAAC,GAC9C,kBAAS,qBAAqB,MAAa,iBAAQ,SAAS,CAAC,CACtE;AAEK,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,qBAAa,eAAc,KAAK,CAAC,CAAC;AAEtE,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,wBAAgB,eAAc,KAAK,CAAC,CAAC;AAGzE,IAAM,aAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EAEtB,KAAK,OAAO,SAAQ,KAAK,OAAO;AAAA,IAAW;AAAA,EAC3C,OAAO,OAAO,OAAO,MAAM,QAAQ,aAAoB,2BAAmB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC;AAAA,CAC5F;;;AHhDH,MAAQ,2BAAa,8BAAgB,WAAW,KAAI;AAE7C,IAAM,aAAW;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAwC,SAAQ,IAAI;AAAA,EAC7D,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAKO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,MAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS;AAAA,MAAW,OAAO,WAAU,IAAI;AAAA,IACxC,SAAI,CAAC,MAAK,QAAQ,MAAM,IAAI;AAAA,MAAG,OAAO,WAAU,IAAI;AAAA,IAEzD,MAAM,QAAQ,OAAO,SAAQ,IAAI;AAAA,IACjC,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,cACnB,IAAI,MAAM,GAAG,MAAK,KAAK,IAAI,uCAAuC,CACpE;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAAwC,WAAU,IAAI;AACnE;;;ADwFO,IAAM,eAAe,WAAuB,eAAe;AAgB3D,IAAM,uBAAuB,MACzB,kBAAO,cAAqB,iBAAQ,aAAa,SAAS,GAAG,UAAQ,CAAC,CAAC;;AK3IlF,qBAAS;AACT,uBAAS;AACT;AACA;AACA,8BAAS;AACT;AACA;AA6BO,IAAM,cAAc,WAAsB,cAAc;AAGxD,IAAM,iBAAiB,CAAC,WAAuC;AAAA,EACpE,SAAS,MAAM,WAAW;AAAA,EAC1B,QAAQ,MAAM;AAChB;AAGO,IAAM,iBAAiB,CAAC,WAA6D;AAAA,EAC1F,SAAS,MAAM,WAAW;AAC5B;AAEA,IAAM,QAAO;AAAA,EACX,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,OAAO;AAAA,MACL,SAAS,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU;AAAA,MACzD,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,QAAQ,SAAS;AAAA,MAC3D,QAAQ,MAAM;AAAA,IAChB;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAEZ,UAAU,EAAE,QAAQ,mBAAmB,QAAQ,0BAA0B;AAAA,EACzE,SAAS,CAAC,aAAY,UAAU,YAAW,aAAa,MAAM,WAAW;AAAA,EACzE,MAAM,CAAC,UAAU,SAAS,MAAM;AAAA,EAChC,YAAY;AACd;AAEA,MAAQ,2BAAa,8BAAgB,WAAW,KAAI;AAG7C,IAAM,WAAW,CAAC,UACvB,OAAO,MAAM,QAAQ,QAAQ,OAAa,cAAQ,EAAE,QAAQ,MAAM,OAAO,CAAC,CAAC,EAAE,KACpE,iBAAQ,CAAC,SACP,4BAA2B,eAAa,qBAAe,CAAC,EAAE,IAAI,EAAE,KAC9D,kBACL,MACE,IAAI,mBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC,CACL,GACO,YAAG,IAAI,CAChB,CACF,GACO,aAAI,CAAC,SAAS,MAAK,WAAW,KAAK,KAAK,GAAG,KAAK,CAAC,GACjD,kBAAS,gBAAgB,MAAa,iBAAQ,SAAS,CAAC,GACxD,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAEK,IAAM,cAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,aAAa,MAAY,iBAAW,EAAE,QAAQ,MAAM,OAAO,CAAC,CAAC,EAAE,KAC3E,kBAAS,gBAAgB,MAAa,aAAI,GAC1C,kBAAS,YAAY,MAAa,aAAI,CAC/C;AAEK,IAAM,sBAAsB,MACxB,kBACP,aACO,iBACL,YAAY,SAAS,GAAG;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,SAAS,IAAI;AAAA,EACjC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IACjC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,MAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IACjC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAY,iBAAW,eAAe,IAAI,CAAC,CAAC;AAAA,IACtF,EAAO;AAAA,MACL,MAAM,OAAO,WAAW,MAAK,SAAS,MAAM,MAAM,eAAe,IAAI,CAAC;AAAA,MACtE,IAAI,SAAS;AAAA,QACX,OAAO,OACL,KAAK,QACL,aACA,MACM,cAAQ;AAAA,aACT;AAAA,UACH,QAAQ,KAAK;AAAA,QACf,CAAC,CACH;AAAA;AAAA,IAEJ,MAAM,QAAQ,OAAO,SAAS,IAAI;AAAA,IAClC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MACF,SAAS,KAAK,6DAChB,CACF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EAED,QAAQ,GAAG,WAAW,YAAW,IAAI;AACvC,CAAC,CACH,CACF;;AC1IK,IAAM,uBAA0C,OAAO,OAAO;AAAA,EACnE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAsDM,IAAM,qBAA6C,OAAO,OAAO;AAAA,EACtE,SACE;AAAA,EACF,WAAW;AAAA,EACX,eAAe;AAAA,EACf,UAAU;AAAA,EACV,UAAU;AAAA,EACV,MAAM;AACR,CAAC;AAyBD,IAAM,KAAK;AACX,IAAM,SAAS;AACf,IAAM,UAAU;AAEhB,IAAM,YAAW,CACf,QACA,UACA,UACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,GAAG,KAAK,OAAM,IAAI;AAAA,IAAG,MAAM,KAAK,UAAU,OAAM,6BAA6B;AAAA,EAClF,IAAI,CAAC,GAAG,KAAK,OAAM,SAAS;AAAA,IAAG,MAAM,KAAK,eAAe,OAAM,+BAA+B;AAAA,EAC9F,IAAI,CAAC,GAAG,KAAK,OAAM,QAAQ;AAAA,IAAG,MAAM,KAAK,cAAc,OAAM,iCAAiC;AAAA,EAC9F,YAAY,QAAO,WAAW;AAAA,IAC5B,CAAC,iBAAiB,OAAM,aAAa;AAAA,IACrC,CAAC,YAAY,OAAM,QAAQ;AAAA,EAC7B,GAAY;AAAA,IACV,IAAI,WAAW,QAAQ,CAAC,OAAO,KAAK,MAAM,GAAG;AAAA,MAC3C,MAAM,KAAK,GAAG,YAAW,wDAAwD;AAAA,IACnF;AAAA,EACF;AAAA,EACA,IAAI,OAAM,aAAa,OAAM;AAAA,IAAe,MAAM,KAAK,yCAAyC;AAAA,EAMhG,MAAM,SAAS,CAAC,UAA8B,WAC5C,aAAa,YAAY,YAAY;AAAA,EACvC,MAAM,UAAyC;AAAA,IAC7C,CAAC,OAAO,MAAM,cAAc,cAAc,GAAG,SAAS,KAAK;AAAA,IAC3D,CAAC,OAAO,MAAM,kBAAkB,kBAAkB,GAAG,SAAS,SAAS;AAAA,EACzE;AAAA,EACA,IAAI,OAAM,aAAa,MAAM;AAAA,IAC3B,QAAQ,KAAK,CAAC,OAAO,MAAM,aAAa,aAAa,GAAG,SAAS,IAAI,CAAC;AAAA,EACxE;AAAA,EACA,MAAM,OAAO,IAAI;AAAA,EACjB,YAAY,QAAO,aAAY,SAAS;AAAA,IACtC,IAAI,QAAQ,KAAK,QAAO,KAAK,KAAK,IAAI,MAAK;AAAA,MAAG;AAAA,IAC9C,KAAK,IAAI,MAAK;AAAA,IACd,MAAM,KAAK,GAAG,uDAAsD;AAAA,EACtE;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,oBAAoB,CAAC,SAAwB,CAAC,MAAyB;AAAA,EAGlF,QAAQ,cAAc,kBAAkB,gBAAgB,SAAS;AAAA,EAEjE,MAAM,QAAQ,OAAO,QAAQ,IAAI,EAAE,OAAO,IAAI,WAAW,UAAU,SAAS;AAAA,EAC5E,MAAM,WAAmC;AAAA,OACpC;AAAA,OACA,OAAO,YAAY,KAAK;AAAA,EAC7B;AAAA,EAGA,MAAM,WAA8B;AAAA,IAClC,OAAO,gBAAgB,SAAS;AAAA,IAChC,WAAW,oBAAoB,SAAS;AAAA,IACxC,MAAM,eAAe,SAAS;AAAA,EAChC;AAAA,EACA,MAAM,QAAQ,UAAS,UAAU,UAAU,MAAK;AAAA,EAChD,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,IAAI,MAAM,uBAAuB,MAAM,KAAK,IAAI,GAAG;AAAA,EAC/E,MAAM,QAA2C;AAAA,IAC/C,CAAC,aAAa,SAAS,eAAe,SAAS,IAAI;AAAA,EACrD;AAAA,EACA,IAAI,SAAS,aAAa;AAAA,IAAM,MAAM,KAAK,CAAC,QAAQ,SAAS,UAAU,SAAS,QAAQ,CAAC;AAAA,EACzF,OAAO;AAAA,IACL,QAAQ,MAAM,IAAI,EAAE,MAAM,QAAQ,aAAa,EAAE,MAAM,QAAQ,OAAO,EAAE;AAAA,IACxE,OAAO,EAAE,SAAS,SAAS,OAAO,SAAS,SAAS,UAAU;AAAA,IAC9D,MAAM,EAAE,OAAO,sBAAsB,QAAQ,SAAS,KAAK;AAAA,IAC3D,OAAO,MAAM,IAAI,EAAE,MAAM,aAAa;AAAA,MACpC,SAAS,SAAS;AAAA,MAClB,QAAQ,CAAC,SAAS,SAAS;AAAA,MAC3B;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AAAA;;AC3LF,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBf,IAAM,WAAW,CAAC,UAAiB,KAAK;AAGxC,IAAM,aACJ,qEACA,iGACA,sEACA,mFACA;AAEF,IAAM,WAAW,GAAG,WAAsC;AAAA,EACxD,MAAM,QAAQ,CAAC,GAAG,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG;AAAA,EAC7C,OAAO;AAAA,SACA,KAAK;AAAA,QACN;AAAA,8BACsB,KAAK;AAAA,8CACW,KAAK;AAAA,oBAC/B,KAAK,+DAA+D,KAAK;AAAA;AAAA,eAE9E,KAAK,mCAAmC,KAAK;AAAA;AAAA;AAAA;AAK5D,IAAM,YAAY,GAAG,YAAuC;AAAA,UAClD,MAAM;AAAA,+BACe,MAAM;AAAA,oBACjB,MAAM,gCAAgC,MAAM;AAAA,qBAC3C,MAAM,qDAAqD,MAAM,sBAAsB,MAAM;AAAA;AAAA,gBAElG,MAAM,qCAAqC,MAAM,sBAAsB,MAAM;AAAA;AAAA;AAI7F,IAAM,WAAW,CAAC,SAAqD;AAAA,EACrE,MAAM,SAAS,CAAC,GAAG,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG;AAAA,EAC/C,MAAM,OAAO,UAAU,gEAAgE,KAAK;AAAA,EAC5F,MAAM,UAAS,YAAY,qBAAqB,KAAK;AAAA,EACrD,OAAO;AAAA,SACA,KAAK,eAAe,KAAK,kBAAkB;AAAA,8BACtB,KAAK,WAAW;AAAA,oBAC1B,4BAA4B,KAAK;AAAA,oBACjC,KAAK;AAAA,wBACD,KAAK,UAAU;AAAA;AAAA,eAExB,KAAK,mCAAmC,KAAK,UAAU;AAAA;AAAA;AAAA;AAKtE,IAAM,YAAY,CAAC,UAAuD;AAAA,EACxE,MAAM,QACJ,sEACA,iBAAiB,SAAS,MAAM,MAAM,wBAAwB,SAAS,MAAM,MAAM,UACnF;AAAA,EACF,OAAO;AAAA,WACE,MAAM,gBAAgB,MAAM,gCAAgC,MAAM;AAAA,2BAClD,oCAAoC,MAAM,UAAU,MAAM;AAAA,mBAClE,MAAM,UAAU,MAAM,iDAAiD,MAAM,kBAAkB,MAAM;AAAA;AAAA;AAKxH,IAAM,cAAc,CAAC,WAA2B;AAAA,oBAC5B,0DAA0D;AAAA;AAOvE,IAAM,qBAAqB,CAAC,SAAwB,CAAC,MAAc;AAAA,EACxE,MAAM,WAAW,kBAAkB,MAAK;AAAA,EACxC,MAAM,WAAW,SAAS,OACvB,IAAI,CAAC,UAAU,MAAM,MAAM,EAC3B,OAAO,CAAC,WAAW,WAAW,SAAS,KAAK,MAAM;AAAA,EACrD,OAAO;AAAA,IACL;AAAA,IACA,GAAG,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,WAAW;AAAA,IACzC,SAAS,QAAQ;AAAA,IACjB,UAAU,QAAQ;AAAA,IAClB,GAAG,SAAS,MAAM,IAAI,QAAQ;AAAA,IAC9B,GAAG,SAAS,OAAO,IAAI,SAAS;AAAA,IAChC;AAAA;AAAA;AAAA,EACF,EAAE,KAAK,EAAE;AAAA;;ACxGX;AACA;AACA;;;ACkBA,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AC7CO,IAAM,cAAc;AACpB,IAAM,cAAc;AAUpB,IAAM,aAAY,CAAC,UACxB,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK;AAEjF,IAAM,cAAa,CAAC,WAAsD;AAAA,EAC/E,OAAO,WAAU,MAAM,KAAK,EAAE,KAAK,GAAG;AAAA,EACtC,QAAQ,MAAM;AAChB;AAMO,IAAM,cAAa,CAAC,WAAmD;AAAA,EAC5E,OAAO,WAAU,MAAM,KAAK,EAAE,KAAK,GAAG;AAAA,EACtC,QAAQ,MAAM;AAChB;AAEO,IAAM,QAAO,CAAC,MAAyD,WAC5E,KAAK,KAAK,CAAC,QAAQ,IAAI,WAAW,MAAM;AAEnC,IAAM,gBAAe,CAC1B,KACA,WACoB;AAAA,EACpB,OAAO,WAAU,IAAI,UAAU,YAAY,CAAC,IAAI,IAAI,MAAM,MAAM,GAAG,CAAC;AAAA,EACpE,QAAQ,MAAM;AAChB;AAEO,IAAM,WAAU,CAAC,aAA4B,UAClD,WAAU,YAAW,KAAK,EAAE,KAAK,GAAG,MAAM,WAAU,MAAM,KAAK,EAAE,KAAK,GAAG;;;AD2DpE,IAAM,cAAc,WAAsB,cAAc;AAW/D,IAAM,WAAW,CAAC,UAChB,iBAAiB,OAAO,MAAM,QAAQ,QAAQ,OAAc,wBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,KACzE,aAAI,CAAC,SAAS;AAAA,EACnB,IAAI,SAAS;AAAA,IAAY,OAAO;AAAA,EAChC,MAAM,MAAM,MAAK,MAAM,MAAM,MAAM;AAAA,EACnC,OAAO,QAAQ,YAAY,YAAY,cAAa,KAAK,KAAK;AAAA,CAC/D,CACH;AAGF,IAAM,kBAAiB,CAAC,SACtB,SAAS,aAAa,YAAY;AAE7B,IAAM,sBAAsB,MACxB,kBACP,aACO,iBACL,YAAY,SAAS,GAAG;AAAA,EAKtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,GAC5C;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IAGjC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,gBAAgB,KAAK,MAAM;AAAA,MACpD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,IAAI;AAAA,MACrD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAKxC,MAAM,SAAS,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IACnD,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,YAAW,IAAI,CAAC,CAC1C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,sBAAc,YAAW,IAAI,CAAC,CAAC;AAAA,IACtF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IAClD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,gBAAgB,KAAK,yDACnB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,EAAE,QAAQ,KAAK,OAAO,CAAC,CACjD;AAAA,GACD;AACH,CAAC,CACH,CACF;;;AE5JF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACrDA;AACA;AAMO,IAAM,cAAc;AACpB,IAAM,cAAc;AAU3B,IAAM,OAAM,CAAC,UAAmB;AAAA,EAC9B,MAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,CAAC;AAAA,EACpE,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA;AAQ5C,IAAM,WAAW,CAAC,UAA6B;AAAA,EAC7C,MAAM,MAAiB,MAAM,QAAQ,KAAK,IACtC,QACA,OAAO,UAAU,WACf,MAAM,MAAM,GAAG,IACf,CAAC;AAAA,EACP,MAAM,SAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,UAAU,EAAE;AAAA,EACnF,OAAO,CAAC,GAAG,IAAI,IAAI,MAAK,CAAC,EAAE,KAAK;AAAA;AASlC,IAAM,aAAa,CAAC,UAClB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,OAAO,KAAK,KAAK,EAAE,KAAK,IACxB,CAAC;AAGP,IAAM,SAAQ,CAAC,WAAsB;AAAA,EACnC,SAAS,MAAM,WAAW;AAAA,EAC1B,OAAO,MAAM,SAAS;AAAA,EACtB,QAAQ,MAAM,WAAW,QAAQ,MAAM;AAAA,EACvC,QAAQ,OAAO,MAAM,UAAU,CAAC;AAAA,EAChC,WAAW,MAAM,aAAa;AAAA,EAQ9B,QAAQ,SAAS,MAAM,MAAM,EAAE,KAAK,GAAG;AAAA,EACvC,UAAU,MAAM,YAAY;AAC9B;AAEO,IAAM,cAAa,CAAC,WAAsD;AAAA,KAC5E,OAAM,KAAK;AAAA,EACd,QAAQ,MAAM;AAChB;AAEO,IAAM,cAAa,CAAC,WAAmD;AAAA,KACzE,OAAM,KAAK;AAAA,EACd,QAAQ,MAAM;AAChB;AAEA,IAAM,gBAAe,CAAC,MAAoC,WAAsC;AAAA,EAC9F,SAAS,KAAK,KAAK,OAAO;AAAA,EAC1B,OAAO,KAAK,KAAK,KAAK;AAAA,EAMtB,QAAQ,KAAK,KAAK,QAAQ,IAAI;AAAA,EAC9B,QAAQ,KAAI,KAAK,MAAM;AAAA,EACvB,WAAW,KAAK,KAAK,SAAS;AAAA,EAC9B,QAAQ,SAAS,KAAK,MAAM;AAAA,EAC5B,UAAU,KAAK,KAAK,QAAQ;AAAA,EAC5B,QAAQ,WAAW,KAAK,MAAM;AAAA,EAE9B,QAAQ,MAAM;AAChB;AAMO,IAAM,WAAU,CAAC,aAA4B,UAClD,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,WAAW,MAAM,SAAS,OACrC,YAAW,YAAY,MAAM,WAAW,UACxC,YAAW,YAAY,MAAM,UAAU,MACvC,YAAW,eAAe,MAAM,aAAa,OAC7C,YAAW,cAAc,MAAM,YAAY,OAC3C,YAAW,OAAO,KAAK,GAAG,MAAM,SAAS,MAAM,MAAM,EAAE,KAAK,GAAG;AAe1D,IAAM,iBAAiB,CAAC,UAC7B,iBACE,OAAO,MAAM,QAAQ,QAAQ,OAAc,sBAAc,EAAE,QAAQ,MAAM,OAAO,CAAC,CAAC,CACpF,EAAE,KAAY,aAAI,CAAC,SAAU,SAAS,aAAa,aAAa,cAAa,MAAM,KAAK,CAAE,CAAC;AAUtF,IAAM,WAAW,CAAC,UACvB,eAAe,KAAK,EAAE,KAAY,kBAAS,gBAAgB,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAGtF,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;;;ADrB7B,IAAM,cAAc,WAAsB,cAAc;AAExD,IAAM,sBAAsB,MACxB,kBACP,aACO,iBACL,YAAY,SAAS,GAAG;AAAA,EAMtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAY7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,SAAS,IAAI,IAAI,eAAe,IAAI,CACpE;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IAGvC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,gBAAgB,KAAK,MAAM;AAAA,MACpD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,IAAI;AAAA,MACrD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAKxC,MAAM,SAAS,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IACnD,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,YAAW,IAAI,CAAC,CAC1C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,sBAAc,YAAW,IAAI,CAAC,CAAC;AAAA,IACtF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IAClD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,gBAAgB,KAAK,4DACnB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,EAAE,QAAQ,KAAK,OAAO,CAAC,CACjD;AAAA,GACD;AACH,CAAC,CACH,CACF;;;AH3KK,IAAM,2BAA2B,CACtC,IACA,QACA,SAAwB,CAAC,GACzB,UAAmC,CAAC,MAE7B,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAc,aAAI;AAAA,IACjC,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,IAC3E,KAAK,MAAM,kBAAkB,MAAK;AAAA,EACpC,CAAC;AAAA,EACD,MAAM,QAAQ,CAAO,aAAyC;AAAA,IAC5D,MAAM,OAAO,SAAS,KAAmB,qBAAO,CAAC;AAAA,IACjD,OAAO,QAAQ,UAAU,YAAY,OAAO,KAAK,KAAK,MAAM,QAAQ,KAAK,CAAC;AAAA;AAAA,EAE5E,MAAM,OAAO,OAAO,MAClB,YAAY,GAAG,WAAW;AAAA,IACxB,OAAO,CAAC,GAAG,SAAS,KAAK,KAAK;AAAA,IAC9B,QAAQ,SAAS,KAAK;AAAA,IACtB;AAAA,EACF,CAAC,CACH;AAAA,EACA,MAAM,QAAQ,OAAO,MAAM,aAAa,GAAG,iBAAiB,KAAK,SAAS,OAAO,OAAO,CAAC,CAAC;AAAA,EAG1F,MAAM,QAAQ,OAAc,aAC1B,SAAS,MAAM,IAAI,CAAC,SAClB,MACE,YAAY,GAAG,MAAM,KAAK,aAAa;AAAA,IACrC,SAAS,KAAK;AAAA,IACd,QAAQ,CAAC,GAAG,KAAK,MAAM;AAAA,IACvB;AAAA,IACA,QAAQ,KAAK;AAAA,EACf,CAAC,CACH,CACF,CACF;AAAA,EACA,MAAM,SAAS,OAAc,aAC3B,SAAS,OAAO,IAAI,CAAC,UACnB,MACE,WAAW,GAAG,MAAM,MAAM,cAAc;AAAA,IACtC,MAAM;AAAA,IACN,WAAW;AAAA,IACX,QAAQ,MAAM;AAAA,IACd;AAAA,IACA,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,EACd,CAAC,CACH,CACF,CACF;AAAA,EACA,OAAO,EAAE,UAAU,QAAQ,OAAO,MAAM,MAAM;AAAA,CAC/C;;AKhFH,qBAAS;AACT;AACA;;;ACXA,uBAAS;AAET;AACA;;;ACoEA,IAAM,cAAkC,IAAI,IAAI,CAAC,QAAQ,UAAU,MAAM,CAAC;AAGnE,IAAM,WAAU;AAAA,EACrB,KAAK;AAAA,EACL,UAAU;AAAA,EACV,KAAK;AAAA,EACL,MAAM;AAAA,EACN,QAAQ;AACV;AAIO,IAAM,cAAa,CAAC,QAA8D;AAAA,EACvF,MAAM,QAAQ,+CAA+C,KAAK,GAAG;AAAA,EACrE,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,MAAM,SAAS,MAAM;AAAA,EACrB,MAAM,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC7B,OAAO,QAAQ,SAAQ,UAAU,CAAC,QAAQ,KAAK,IAAI;AAAA;AAIrD,IAAM,cAAmC,IAAI,IAAI;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,IAAM,gBAAe,CAAC,QAC3B,YAAY,IAAI,GAAG,KAAK,YAAW,GAAG,MAAM;AAGvC,IAAM,iBAAgB,CAAC,OAAgB,QAC3C,MAA6C;AAGzC,IAAM,gBAAe,CAAC,UAC3B,OAAO,KAAK,KAAK,EACd,OAAO,CAAC,QAAQ,CAAC,YAAW,IAAI,GAAG,KAAK,eAAc,OAAO,GAAG,MAAM,SAAS,EAC/E,KAAK;AAGH,IAAM,aAAY,CAAC,UACxB,UAAU,OAAO,MAAM,UAAU,QAAQ,MAAM,OAAO,KAAK;AAStD,IAAM,gBAAe,CAAC,SAA0D;AAAA,EACrF,MAAM,MAA8B,CAAC;AAAA,EACrC,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,CAAC,cAAa,GAAG;AAAA,MAAG;AAAA,IACxB,IAAI,UAAU,QAAQ,UAAU,aAAa,OAAO,UAAU;AAAA,MAAU;AAAA,IACxE,IAAI,OAAO,WAAU,KAAK;AAAA,EAC5B;AAAA,EACA,OAAO;AAAA;;;ACtIF,IAAM,eAAe,CAAC,UAC3B,cAAa,KAAK,EACf,OAAO,CAAC,QAAQ,CAAC,cAAa,GAAG,CAAC,EAClC,IAAI,CAAC,QAAQ,GAAG,qDAAqD,OAAO,MAAM,IAAI,KAAK;AAGzF,IAAM,OAAO,CAAC,UAA2C;AAAA,EAC9D,MAAM,MAA8B,CAAC;AAAA,EACrC,WAAW,OAAO,cAAa,KAAK,GAAG;AAAA,IACrC,IAAI,CAAC,cAAa,GAAG;AAAA,MAAG;AAAA,IACxB,IAAI,OAAO,WAAU,eAAc,OAAO,GAAG,CAAC;AAAA,EAChD;AAAA,EACA,OAAO;AAAA;AAWF,IAAM,cAAa,CAAC,WAAoB;AAAA,KAC1C,KAAK,KAAK;AAAA,EACb,MAAM,OAAO,MAAM,IAAI;AACzB;AAGO,IAAM,cAAa;;;ACjDnB,MAAM,yBAAyB,MAAM;AAAA,EAC1C,WAAW,CAAC,SAAiB;AAAA,IAC3B,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA;AAEhB;;;ACqDA,IAAM,YAAW;AAEjB,IAAM,gBAAgB;AAsBf,IAAM,YAAY,CAAC,UAAuB;AAAA,EAC/C,MAAM,OAAO,UAAS,KAAK,KAAI,KAAK,cAAc,KAAK,KAAI;AAAA,EAC3D,IAAI,SAAS,MAAM;AAAA,IACjB,OAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,IAAI;AAAA,MACb,MAAM;AAAA,MACN,QAAQ,KAAK,MAAM;AAAA,MACnB,SAAS;AAAA,IACX;AAAA,EACF;AAAA,EACA,OAAO,UAAU,QAAQ,MAAK,MAAM,GAAG;AAAA,EACvC,MAAM,MAAM,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpC,MAAM,SAAS,OAAO,KAAM,SAAS,MAAO,SAAS,IAAI,MAAM,GAAG,EAAE;AAAA,EACpE,MAAM,UAAU,OAAO,KAAK,MAAM,SAAS,IAAI,MAAM,KAAK,CAAC;AAAA,EAC3D,MAAM,UAAU,IAAI,IAClB,KAAK,IAAI,CAAC,SAA2B;AAAA,IACnC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC3B,OAAO,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,GAAG,EAAE,GAAG,KAAK,MAAM,KAAK,CAAC,CAAC;AAAA,GACvE,CACH;AAAA,EACA,MAAM,OAAO,QAAQ,IAAI,MAAM;AAAA,EAC/B,QAAQ,OAAO,MAAM;AAAA,EACrB,IAAI,YAAY,OAAO,QAAQ,IAAI,aAAa,GAAG;AAAA,IACjD,QAAQ,OAAO,aAAa;AAAA,IAC5B,OAAO,EAAE,MAAM,SAAS,SAAS,MAAM,WAAW,QAAQ,SAAS,GAAG;AAAA,EACxE;AAAA,EACA,OAAO,EAAE,MAAM,UAAU,SAAS,MAAM,QAAQ,QAAQ;AAAA;AAc1D,IAAM,eAAe,CACnB,QACA,SACA,SACA,SAEA;AAAA,EACE,GAAG,UAAU;AAAA,EACb,GAAG,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,GAAG,KAAK,GAAG;AAAA,EAC3C,GAAI,SAAS,YAAY,CAAC,IAAI,CAAC,QAAQ,MAAM;AAC/C,EAAE,KAAK,GAAG;AAEL,IAAM,YAAY,CAAC,KAAa,WAAkB,SAA8B;AAAA,EACrF,MAAM,OAAO,UAAU,SAAQ;AAAA,EAC/B,MAAM,OAAO,UAAU,IAAI;AAAA,EAC3B,IAAI,KAAK,WAAW,KAAK,QAAQ;AAAA,IAC/B,OAAO;AAAA,MACL,QACE,GAAG,yBAAyB,KAAK,uBAAuB,KAAK,2BAC7D;AAAA,IACJ;AAAA,EACF;AAAA,EAUA,IAAI,KAAK,SAAS,SAAS;AAAA,IACzB,IAAI,KAAK,QAAQ,SAAS;AAAA,MAAG,OAAO,CAAC;AAAA,IACrC,IAAI,CAAC,GAAG,KAAK,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC;AAAA,MAAG,OAAO,CAAC;AAAA,IAC5E,OAAO,EAAE,KAAK,aAAa,KAAK,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI,EAAE;AAAA,EACjF;AAAA,EACA,IAAI,KAAK,YAAY,KAAK,SAAS;AAAA,IACjC,OAAO;AAAA,MACL,QACE,GAAG,wBAAwB,KAAK,2BAA2B,KAAK,yBAChE;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI,KAAK,SAAS,aAAa,KAAK,SAAS,aAAa,KAAK,SAAS,KAAK,MAAM;AAAA,IACjF,OAAO;AAAA,MACL,QACE,GAAG,sBAAsB,KAAK,8BAA8B,KAAK,8BACjE;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI,QAAQ,KAAK,SAAS,KAAK,OAAO;AAAA,IAAG,OAAO,CAAC;AAAA,EAEjD,OAAO,EAAE,KAAK,aAAa,KAAK,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI,EAAE;AAAA;;;AC9JjF,IAAM,aAAa;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,IAAM,WAAW,CAAC,UAChB,IAAI,IACF,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,IAAI,CAAC,SAA2B;AAAA,EAC/B,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,OAAO,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,GAAG,EAAE,GAAG,KAAK,MAAM,KAAK,CAAC,CAAC;AAAA,CACvE,CACL;AAEF,IAAM,WAAW,CAAC,UAChB,WAAW,KAAK,CAAC,UAAU,MAAI,IAAI,KAAK,CAAC;AAGpC,IAAM,WAAU,CAAC,WAAkB,SAAiB;AAAA,EACzD,MAAM,OAAO,SAAS,SAAQ;AAAA,EAC9B,MAAM,OAAO,SAAS,IAAI;AAAA,EAC1B,MAAM,YAAY,SAAS,IAAI;AAAA,EAC/B,MAAM,YAAY,SAAS,IAAI;AAAA,EAC/B,IAAI,cAAc,cAAc,KAAK,IAAI,SAAS,KAAK,QAAQ,MAAM,cAAc,WAAW;AAAA,IAC5F,KAAK,IAAI,WAAW,KAAK,IAAI,SAAS,KAAK,EAAE;AAAA,EAC/C;AAAA,EACA,OAAO,EAAE,MAAM,KAAK;AAAA;AAGf,IAAM,UAAU,CAAC,WAAkB,SAA0B;AAAA,EAClE,QAAQ,MAAM,SAAS,SAAQ,WAAU,IAAI;AAAA,EAC7C,OAAO,KAAK,SAAS,KAAK,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC;AAAA;AAI1E,IAAM,YAAW,CAAC,WAAkB,SAAyB;AAAA,EAClE,MAAM,OAAO,SAAS,SAAQ;AAAA,EAC9B,MAAM,YAAY,SAAS,IAAI;AAAA,EAC/B,MAAM,OAAO,SAAS,IAAI;AAAA,EAC1B,MAAM,YAAY,SAAS,IAAI;AAAA,EAC/B,IAAI,cAAc,cAAc,KAAK,IAAI,SAAS,KAAK,QAAQ,MAAM,cAAc,WAAW;AAAA,IAC5F,KAAK,IAAI,WAAW,KAAK,IAAI,SAAS,KAAK,EAAE;AAAA,EAC/C;AAAA,EACA,OAAO,CAAC,GAAG,IAAI,EAAE,IAAI,EAAE,GAAG,OAAQ,MAAM,KAAK,IAAI,GAAG,KAAK,GAAI,EAAE,KAAK,GAAG;AAAA;;;ACnDlE,IAAM,SAAQ,CAAC,OAAgB,YAA6C;AAAA,EACjF,MAAM,MAA8B,CAAC;AAAA,EACrC,MAAM,UAAmB,CAAC;AAAA,EAC1B,MAAM,QAAQ,IAAI;AAAA,EAElB,WAAW,OAAO,cAAa,KAAK,GAAG;AAAA,IACrC,MAAM,OAAO,WAAU,eAAc,OAAO,GAAG,CAAC;AAAA,IAChD,MAAM,OAAO,QAAO;AAAA,IACpB,MAAM,SAAS,YAAW,GAAG,IAAI;AAAA,IAEjC,IAAI,WAAW,UAAU,WAAW,OAAO;AAAA,MACzC,IAAI,SAAS,WAAW;AAAA,QACtB,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,OAAO;AAAA,MACb,EAAO;AAAA,QACL,MAAM,UAAU,UAAU,KAAK,MAAM,IAAI;AAAA,QACzC,IAAI,QAAQ,WAAW,WAAW;AAAA,UAChC,MAAM,IAAI,GAAG;AAAA,UACb,QAAO,KAAK,QAAQ,MAAM;AAAA,QAC5B,EAAO,SAAI,QAAQ,QAAQ,WAAW;AAAA,UACpC,MAAM,IAAI,GAAG;AAAA,UACb,IAAI,OAAO,QAAQ;AAAA,QACrB;AAAA;AAAA,MAEF;AAAA,IACF;AAAA,IAEA,IAAI,WAAW,OAAO;AAAA,MACpB,IAAI,SAAS,WAAW;AAAA,QACtB,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,OAAO;AAAA,MACb,EAAO,SAAI,CAAC,QAAQ,MAAM,IAAI,GAAG;AAAA,QAC/B,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,OAAO,UAAS,MAAM,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AAAA,IAIA,IAAI,UAAU,QAAQ,KAAK;AAAA,MACzB,MAAM,IAAI,GAAG;AAAA,MACb,IAAI,OAAO;AAAA,IACb;AAAA,EACF;AAAA,EACA,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,gBAAO;AAAA;AAS1C,IAAM,kBAAkB,CAAC,MAAc,QAC5C,QAAQ,aAAa,SAAS,MAC1B,YACA,SAAS,OAAO,GAAG,QAAQ,OAAO,IAAI,wDACtC;;;AC7EN;AACA;AACA;AAOA,IAAM,aAAa,CAAC,OAAO,MAAM;AAE1B,IAAM,SAAS,CAAC,UACd,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,MAAM,QAAQ,MAAM;AAAA,EACrD,MAAM,SAAS,OAAO,WACpB,MAAM,QACN,YACA,OACM,0BAAkB,EAAE,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,IAAI,EAAE,CAAC,CACxE,EAAE,KACO,aAAI,CAAC,UAAU,EAAE,MAAM,OAAO,UAAU,EAAE,GAC1C,kBAAS,sBAAsB,CAAC,UAAiB,iBAAQ,EAAE,MAAM,WAAW,MAAM,CAAC,CAAC,CAC7F;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,MAAM,OAAO,OAAO;AAAA,IAEpB,IAAI,OAAO,KAAK,WAAW,YAAY,KAAK,WAAW,IAAI;AAAA,MACzD,OAAO,OAAc,cACnB,IAAI,iBACF,MAAM,OAAO,MAAM,IAAI,wDACzB,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,OAAO,WAClB,MAAM,QACN,YACA,OACQ,+BAAqB,EAAE,MAAM,KAAK,CAAC,CAC7C;AAAA,EACA,IACE,CAAC,MAAM,QAAQ,IAAI,KACnB,KAAK,KACH,CAAC,QACC,CAAC,OAAO,cAAc,OAAO,KAAK,IAAI,CAAC,KACvC,OAAO,KAAK,IAAI,KAAK,KACrB,OAAO,KAAK,SAAS,YACrB,IAAI,SAAS,MACb,CAAC,WAAW,SAAS,IAAI,IAAmC,CAChE,GACA;AAAA,IACA,OAAO,OAAc,cACnB,IAAI,iBAAiB,oDAAoD,CAC3E;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,KAAK,KAAK,CAAC,QAAQ,OAAO,IAAI,IAAI,MAAM,MAAM,IAAI;AAAA,EAChE,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,IAAI,MAAM,SAAS,MAAM,QAAQ,MAAM,SAAS;AAAA,IAAQ,OAAO,OAAc,cAAK,OAAO,KAAK;AAAA,EAC9F,OAAO,OAAc,cACnB,IAAI,iBACF,QAAQ,OAAO,MAAM,IAAI,UAAU,KAAK,MAAM,MAAM,OAAO,UACzD,GAAG,KAAK,MAAM,MAAM,GAAG,kBAAkB,MAAM,iCAC/C,oFACJ,CACF;AAAA,CACD;;;ACvEH;AAEA;AAWO,IAAM,WAAW,CACtB,OACA,WACA,MACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,KAAK,OAAO,WAAW,MAAM,QAAQ,YAAY,MAAM,SAAS,CAAC;AAAA,EAC9E,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAc,cACnB,IAAI,iBACF,GAAG,qFACL,CACF;AAAA,EACF;AAAA,EACA,IAAI,OAAO;AAAA,EACX,SAAS,UAAU,EAAG,UAAU,OAAO,WAAW;AAAA,IAChD,MAAM,SAAS,OAAO,WACpB,MAAM,QACN,YACA,OACM,0BAAkB,EAAE,MAAM,MAAM,MAAM,KAAK,CAAC,CACpD,EAAE,KAAY,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CAAC;AAAA,IAS5C,IAAI,WAAW,aAAa,OAAO,WAAW,WAAW;AAAA,MACvD,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,IAAI,OAAO,WAAW,WAAW;AAAA,MAC/B,OAAO,KAAK,OAAO,YAAY,4BAA4B;AAAA,MAC3D;AAAA,IACF;AAAA,IACA,OAAc,eAAM,UAAU;AAAA,EAChC;AAAA,EACA,IAAI,SAAS,MAAM;AAAA,IACjB,OAAO,OAAc,cACnB,IAAI,iBACF,GAAG,cAAc,eAAe,2DAClC,CACF;AAAA,EACF;AAAA,CACD;;;AR1BH,IAAM,gBAAe;AACrB,IAAM,eAAe;AAErB,IAAM,gBAAe,CAAC,MAA+B,WAAkC;AAAA,EACrF,QAAQ,cAAa,IAAI;AAAA,EACzB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AACd;AAOA,IAAM,WAAU,CAAC,aAA0B,UACzC,cAAa,KAAK,EACf,OAAO,aAAY,EACnB,MAAM,CAAC,QAAQ,YAAW,OAAO,SAAS,WAAU,eAAc,OAAO,GAAG,CAAC,CAAC;AAEnF,IAAM,QAAO;AAAA,EACX,YAAY;AAAA,EACZ,YAAY,CAAC,UAAmB,SAAS,MAAM;AAAA,EAC/C;AAAA,EACA,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,EACA,MAAM,CAAC,UAAmB,SAAS,MAAM,aAAa,OAAO,MAAM,IAAI;AAAA,EACvE;AACF;AAEA,MAAQ,4BAAa,+BAAgB,WAAW,KAAI;AAE7C,IAAM,WAAW,CAAC,UACvB,OAAO,KAAK,EAAE,KACL,aAAI,CAAC,SACV,SAAS,YACL,YAOA,cAAa,MAA4C,KAAK,CACpE,CACF;AAGK,IAAM,aAAa,CAAC,UACzB,SACE,OACM,uBAAe,EAAE,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,IAAI,EAAE,CAAC,GACnE,cAAc,OAAO,MAAM,IAAI,KAC/B,YACF,EAAE,KAAY,kBAAS,sBAAsB,MAAa,aAAI,CAAC;AASjE,IAAM,kBAAkB,CAAC,UAAmB;AAAA,EAC1C,MAAM,WAAU,aAAa,KAAK;AAAA,EAClC,OAAO,SAAQ,WAAW,IAAW,gBAAc,cAAK,IAAI,iBAAiB,SAAQ,KAAK;AAAA,CAAI,CAAC,CAAC;AAAA;AAGlG,IAAM,eAAe,CAAC,WACpB,OAAO,OAAO,WAAW,IACd,gBACA,cAAK,IAAI,iBAAiB,OAAO,OAAO,KAAK;AAAA,CAAI,CAAC,CAAC;AAEzD,IAAM,eAAe;AAAA,EAC1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAO7B,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,KAMC;AAAA,IACD,MAAM,QAAQ,OAAO,SAAS,IAAI;AAAA,IAClC,MAAM,WAAiB,cACrB,MAAM,UAAU,aAAa,OAAM,MAAM,MAAM,MAAM,EAAE,MAAM,WAAW,CAC1E;AAAA,IACA,OAAO,OAAO,UAAU,EAAE,KAAK,YAAY,OAAO,GAAG,OAAO,QAAO;AAAA,GACpE;AAAA,EACD,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,KAKC;AAAA,IACD,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,MAAM,YAAW,gBAAgB,KAAK,MAAM,QAAQ,QAAQ,KAAK,IAAI;AAAA,IACrE,IAAI,cAAa;AAAA,MAAW,OAAO,OAAc,cAAK,IAAI,iBAAiB,SAAQ,CAAC;AAAA,IACpF,OAAO,gBAAgB,IAAI;AAAA,IAC3B,OAAO,cAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,cAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IACjC,IAAI,SAAS,WAAW;AAAA,MAGtB,OAAc,oBACZ,cAAc,KAAK,QAAQ,OAAO,KAAK,IAAI,kDACzC,qDACJ;AAAA,MACA,OAAO,cAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,MAAM,SAAS,OAAM,MAAM,KAAK,MAAM;AAAA,IACtC,OAAO,aAAa,MAAM;AAAA,IAC1B,OAAO,EAAE,QAAQ,OAAO,MAAM,WAAW,IAAI,SAAS,SAAS;AAAA,GAChE;AAAA,EACD,WAAkB,YAAG,UAAU;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,KAOC;AAAA,IACD,MAAM,YAAW,gBAAgB,KAAK,MAAM,QAAQ,QAAQ,MAAM,IAAI;AAAA,IACtE,IAAI,cAAa;AAAA,MAAW,OAAO,OAAc,cAAK,IAAI,iBAAiB,SAAQ,CAAC;AAAA,IACpF,OAAO,gBAAgB,IAAI;AAAA,IAC3B,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IACjC,OAAO,cAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,cAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,SACL,MACM,uBAAe,KAAK,YAAW,IAAI,GAAG,MAAM,KAAK,KAAK,CAAC,GAC7D,aAAa,OAAO,KAAK,IAAI,KAC7B,aACF;AAAA,IACF,EAAO;AAAA,MAGL,OAAO,eACL,EAAE,KAAK,YAAY,OAAO,GAC1B,iBAAiB,OAAO,KAAK,IAAI,QAAQ,KAAK,MAChD;AAAA,MACA,MAAM,SAAS,OAAM,MAAM,KAAK,MAAM;AAAA,MACtC,OAAO,aAAa,MAAM;AAAA,MAC1B,IAAI,OAAO,KAAK,OAAO,GAAG,EAAE,SAAS,GAAG;AAAA,QACtC,OAAO,OACL,KAAK,QACL,aACA,MACM,0BAAkB,KAAK,OAAO,KAAK,MAAM,KAAK,MAAM,MAAM,OAAO,KAAK,IAAI,EAAE,CAAC,CACrF;AAAA,MACF;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,SAAS,IAAI;AAAA,IAClC,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,cACnB,IAAI,iBACF,GAAG,MAAK,KAAK,IAAI,sDACnB,CACF;AAAA,IACF;AAAA,IACA,MAAM,OAAO,OAAM,MAAM,MAAM,MAAM;AAAA,IACrC,IAAI,KAAK,MAAM,SAAS,GAAG;AAAA,MACzB,OAAO,OAAc,cACnB,IAAI,iBACF,GAAG,MAAK,KAAK,IAAI,uBAAuB,KAAK,MAAM,KAAK,IAAI,6BAC1D,2EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAA8B,WAAW,IAAI;AAC1D;;;ADhMO,IAAM,YAAY,WAAoB,cAAc,EAAE,sBAAsB,SAAS,CAAC;AAQtF,IAAM,oBAAoB,MACtB,kBAAO,WAAkB,iBAAQ,UAAU,SAAS,GAAG,YAAY,CAAC,CAAC;;AUfhF,qBAAS;AACT;AACA;;;AC1BA,uBAAS;AAET;AACA;;;ACEA,IAAM,SAAkD;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAWO,IAAM,gBAAgB,CAC3B,MACA,SACoB;AAAA,EACpB,IAAI,SAAS;AAAA,IAAW,OAAO,EAAE,MAAM,OAAO;AAAA,EAC9C,IAAI,KAAK,aAAa,KAAK,YAAY,KAAK,YAAY,KAAK,SAAS;AAAA,IACpE,OAAO,EAAE,MAAM,UAAU;AAAA,EAC3B;AAAA,EACA,MAAM,UAAU,OAAO,OAAO,CAAC,QAAQ,KAAK,SAAS,KAAK,IAAI;AAAA,EAC9D,IAAI,QAAQ,WAAW;AAAA,IAAG,OAAO,EAAE,MAAM,OAAO;AAAA,EAChD,OAAO;AAAA,IACL,MAAM;AAAA,IACN,QACE,GAAG,KAAK,aAAa,QAAQ,KAAK,IAAI,qDACtC,4FACA;AAAA,EACJ;AAAA;;;AC/CK,MAAM,oCAAoC,MAAM;AAAA,EACrD,WAAW,CAAC,SAAiB;AAAA,IAC3B,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA;AAEhB;;;ACCA;AAEA;AAoBO,IAAM,sBAAsB,CACjC,OACA,WACA,MACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,KAAK,OAAO,WAAW,MAAM,QAAQ,YAAY,MAAM,SAAS,CAAC;AAAA,EAC9E,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAc,cACnB,IAAI,4BACF,GAAG,qFACL,CACF;AAAA,EACF;AAAA,EACA,IAAI,OAAO;AAAA,EACX,SAAS,UAAU,EAAG,UAAU,OAAO,WAAW;AAAA,IAChD,MAAM,SAAS,OAAO,WACpB,MAAM,QACN,YACA,OACM,0BAAkB,EAAE,MAAM,MAAM,MAAM,KAAK,CAAC,CACpD,EAAE,KAAY,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CAAC;AAAA,IAE5C,IAAI,WAAW,aAAa,OAAO,WAAW,WAAW;AAAA,MACvD,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,IAAI,OAAO,WAAW,WAAW;AAAA,MAC/B,OAAO,KAAK,OAAO,YAAY,4BAA4B;AAAA,MAC3D;AAAA,IACF;AAAA,IACA,OAAc,eAAM,UAAU;AAAA,EAChC;AAAA,EACA,IAAI,SAAS,MAAM;AAAA,IACjB,OAAO,OAAc,cACnB,IAAI,4BACF,GAAG,cAAc,eAAe,2DAClC,CACF;AAAA,EACF;AAAA,CACD;;;AH/CH,IAAM,gBAAe;AACrB,IAAM,gBAAe;AAGrB,IAAM,oBAAoB;AAYnB,IAAM,eAAe,CAAC,WAAiC;AAAA,EAC5D,UAAU,MAAM;AAAA,EAChB,sBAAsB,MAAM;AAAA,KACxB,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,EAC5E,SAAS;AAAA,EACT,UAAU,MAAM;AAAA,EAChB,MAAM,MAAM;AAAA,EACZ,SAAS,MAAM;AAAA,EACf,KAAK,MAAM;AAAA,KACP,MAAM,uBAAuB,YAC7B,CAAC,IACD,EAAE,uBAAuB,MAAM,qBAAqB,MAAM,IAAI;AACpE;AAOO,IAAM,kBAAiB,CAAC,UAA0C;AAAA,EACvE,MAAM,UAAmB,CAAC;AAAA,EAC1B,IAAI,MAAM,SAAS,KAAK,MAAM,IAAI;AAAA,IAChC,QAAO,KACL,GAAG,MAAM,6EACX;AAAA,EACF;AAAA,EACA,OAAO,QAAO,OACZ,eAAe,mBAAmB,aAAa,KAAK,GAAG,IAAI,EAAE,IAC3D,CAAC,QAAQ,GAAG,MAAM,aAAa,KACjC,CACF;AAAA;AAUK,IAAM,eAAe,CAAC,UACpB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,QACA,OACM,+BAAuB;AAAA,IAC3B,SAAS;AAAA,IACT,MAAM,MAAM;AAAA,IACZ,SAAS,MAAM;AAAA,EACjB,CAAC,CACH;AAAA,EACA,IAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;AAAA,IACxB,OAAO,OAAc,cACnB,IAAI,4BACF,GAAG,MAAM,wDACX,CACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,MAAM,SAAS,IAAI,MAAM,UAAU,CAAC;AAAA,EACzE,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,OAAO;AAAA,IACL,UAAU,MAAM;AAAA,IAChB,QAAQ,KAAK,MAAM,QAAQ,KAAK;AAAA,IAChC,MAAM,MAAM;AAAA,IACZ,MAAM,IAAI,MAAM,MAAM,CAAC;AAAA,IACvB,SAAS,MAAM;AAAA,IACf,OAAO,KAAK,MAAM,OAAO,EAAE;AAAA,EAC7B;AAAA,CACD;AAGI,IAAM,kBAAkB,CAAC,UACvB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,aAAa,KAAK;AAAA,EACtC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,OAAO,oBACL,OACM,iCAAyB;AAAA,IAC7B,MAAM,MAAM;AAAA,IACZ,SAAS,MAAM;AAAA,IACf,QAAQ,KAAK;AAAA,EACf,CAAC,GACD,UAAU,KAAK,SACf,aACF;AAAA,CACD;AAEI,IAAM,0BAA0B;AAAA,EACrC,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAQ7B,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,KAMC;AAAA,IACD,MAAM,QAAQ,OAAO,aAAa,IAAI;AAAA,IACtC,OAAO,OAAO,UAAU,EAAE,KAAK,YAAY,OAAO,GAAG,OAAc,iBAAQ,IAAI,CAAC;AAAA,GACjF;AAAA,EACD,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,KAKC;AAAA,IACD,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,MAAM,WAAU,gBAAe,IAAI;AAAA,IACnC,IAAI,SAAQ,SAAS,GAAG;AAAA,MACtB,OAAO,OAAc,cAAK,IAAI,4BAA4B,SAAQ,KAAK;AAAA,CAAI,CAAC,CAAC;AAAA,IAC/E;AAAA,IACA,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,YAAW,cAAc,MAAM,IAAI;AAAA,IACzC,IAAI,UAAS,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC5D,MAAM,OAAO,OAAO,aAAa,IAAI;AAAA,IAKrC,IAAI,UAAS,SAAS,iBAAiB,SAAS,WAAW;AAAA,MACzD,OAAO,OAAc,cAAK,IAAI,4BAA4B,UAAS,MAAM,CAAC;AAAA,IAC5E;AAAA,IACA,OAAO,EAAE,QAAQ,SAAS,YAAY,WAAW,OAAO;AAAA,GACzD;AAAA,EACD,WAAkB,YAAG,UAAU;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,KAMC;AAAA,IACD,MAAM,WAAU,gBAAe,IAAI;AAAA,IACnC,IAAI,SAAQ,SAAS,GAAG;AAAA,MACtB,OAAO,OAAc,cAAK,IAAI,4BAA4B,SAAQ,KAAK;AAAA,CAAI,CAAC,CAAC;AAAA,IAC/E;AAAA,IACA,MAAM,OAAO,OAAO,aAAa,IAAI;AAAA,IACrC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,oBACL,MACM,gCAAwB,aAAa,IAAI,CAAC,GAChD,YAAY,KAAK,iBAAiB,KAAK,WACvC,aACF;AAAA,IACF,EAAO;AAAA,MAIL,OAAO,eACL,EAAE,KAAK,YAAY,OAAO,GAC1B,2BAA2B,KAAK,eAAe,KAAK,SACtD;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,aAAa,IAAI;AAAA,IACtC,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,cACnB,IAAI,4BACF,GAAG,KAAK,6CAA6C,KAAK,0BACxD,gFACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAA2C,gBAAgB,IAAI;AAC5E;;;AD9KO,IAAM,yBAAyB,WAAiC,yBAAyB;AAEzF,IAAM,iCAAiC,MACnC,kBACP,wBACO,iBAAQ,uBAAuB,SAAS,GAAG,uBAAuB,CAAC,CAC5E;;AK2BF,qBAAS;AACT;AACA;;;ACrFA,uBAAS;AAET;AACA,8BAAS;AACT;AACA;;;ACkBO,IAAM,mBAAmB;AASzB,IAAM,QAAQ,CAAC,UACpB,GAAG,OAAO,MAAM,KAAK,KAAK,OAAO,MAAM,MAAM;AAe/C,IAAM,SAAQ,CAAC,WAAgC;AAAA,EAC7C,SAAS,MAAM,WAAW;AAAA,EAC1B,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EACxC,UAAU,MAAM,YAAY;AAAA,KACxB,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,OAAO,MAAM,IAAI,EAAE;AACjE;AAUO,IAAM,cAAa,CAAC,WAAgC;AAAA,KACtD,OAAM,KAAK;AAAA,EACd,IAAI,MAAM,KAAK;AAAA,EACf,QAAQ,MAAM;AAAA,EACd,MAAM;AACR;AAgBO,IAAM,cAAa,CAAC,WAAgC;AAAA,KACtD,OAAM,KAAK;AAAA,EACd,QAAQ;AACV;;;ACxEA,IAAM,SAAS,CAAC,UAA2B;AAAA,EACzC,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,SAAS,OAAO,WAAW,KAAK,KAAK,CAAC;AAAA,EAC5C,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA;AAGrC,IAAM,qBAAqB;AAAA,EAWhC,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,IACpC,OAAO,IAAI,KAAK,UAAU,MAAM,KAAK;AAAA,IACrC,IAAI,KAAK,KAAK,OAAO,MAAM,KAAK,CAAC;AAAA,IACjC,QAAQ,IAAI,KAAK,WAAW,MAAM,MAAM;AAAA,IACxC,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,YAAY,KAAK,KAAK,eAAe,EAAE;AAAA,IACvC,UAAU,KAAK,KAAK,aAAa,gBAAgB;AAAA,IACjD,QAAQ,KAAK,KAAK,WAAW,EAAE;AAAA,IAC/B,YAAY,KAAK,KAAK,WAAW,MAAM,UAAU;AAAA,IACjD,MAAM,KAAK,KAAK,SAAS,OAAO;AAAA,EAClC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAmBZ,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,aAAY,UACpB,YAAW,eAAe,MAC1B,YAAW,cAAc,MAAM,YAAY,qBAC3C,YAAW,aAAa,MAAM,YAAY,SAC1C,YAAW,aAAa,MAAM,WAAW,QACxC,MAAM,SAAS,aAAa,YAAW,SAAS,MAAM;AAAA,EACzD,MAAM,CAAC,UAAU,uBAAuB,MAAM,KAAK;AAAA,EACnD,YAAY;AACd;;;AF/DA,MAAQ,4BAAa,+BAAgB,WAAW,kBAAI;AACpD,IAAM,YAAY,MAChB,IAAI,mBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC;AAEI,IAAM,qBAAqB,CAAC,UACjC,OAAO,MAAM,QAAQ,QAAQ,OAAe,gCAAsB,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,EAAE,KAChF,iBAAQ,CAAC,SAQP,4BAA2B,eAAe,uCAA6B,CAAC,EAAE;AAAA,KAC5E;AAAA,EACH,OAAO,IAAI,KAAK,OAAO,OAAO,GAAG;AAAA,EACjC,QAAQ,IAAI,KAAK,QAAQ,OAAO,GAAG;AAAA,EACnC,MAAM;AACR,CAAC,EAAE,KAAY,kBAAS,SAAS,GAAU,YAAG,IAAI,CAAC,CACrD,GACO,iBAAQ,CAAC,SAId,KAAK,OAAO,MAAM,KAAK,KACvB,IAAI,KAAK,OAAO,OAAO,GAAG,MAAM,MAAM,SACtC,IAAI,KAAK,QAAQ,OAAO,GAAG,MAAM,MAAM,SAC5B,iBAAQ,mBAAK,WAAW,KAAK,KAAK,GAAG,KAAK,CAAC,IAC3C,cAAK,UAAU,CAAC,CAC7B,GACO,kBAAS,0BAA0B,MAAa,iBAAQ,SAAS,CAAC,CAC3E;AAGK,IAAM,uBAAuB,CAAC,UACnC,OACE,MAAM,QACN,aACA,MACQ,mCAAyB,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC,CACvD,EAAE,KAAY,kBAAS,0BAA0B,MAAa,aAAI,CAAC;AAE9D,IAAM,yBAAyB;AAAA,EAEpC,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAA0C,mBAAmB,IAAI;AAAA,EAC1E,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,KAIC;AAAA,IACD,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,cAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,cAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,mBAAmB,IAAI;AAAA,IAC3C,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,cAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,mBAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAuC;AAAA,IACvE,MAAM,OAAO,OAAO,mBAAmB,IAAI;AAAA,IAC3C,OAAO,cAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,cAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OACL,KAAK,QACL,aACA,MACQ,mCAAyB,mBAAK,WAAW,IAAI,CAAC,CACxD;AAAA,IACF,EAAO;AAAA,MACL,MAAM,QAAO,WAAW,mBAAK,SAAS,MAAM,MAAM,mBAAK,WAAW,IAAI,CAAC;AAAA,MACvE,IAAI,UAAS;AAAA,QACX,OAAO,OACL,KAAK,QACL,aACA,MACQ,gCAAsB,KAAK,OAAM,IAAI,MAAM,IAAI,EAAE,CAAC,CAC5D;AAAA;AAAA,IAEJ,MAAM,QAAQ,OAAO,mBAAmB,IAAI;AAAA,IAC5C,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MAAM,GAAG,mBAAK,KAAK,IAAI,4DAA4D,CACzF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAA0C,qBAAqB,IAAI;AAChF;;;ADkDO,IAAM,wBAAwB,WAAgC,wBAAwB;AAUtF,IAAM,gCAAgC,MAClC,kBACP,uBACO,iBAAQ,sBAAsB,SAAS,GAAG,sBAAsB,CAAC,CAC1E;;AIhJF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACHA;AAkBA,IAAM,SAAS;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA2BO,IAAM,kBAAkB,CAAC,UAC9B,iBAAiB,YAAY,MAAM,WAAW;AAGhD,IAAM,gBAAgB,CAAC,WACd,aACL,OAAO,IAAI,CAAC,eACV,IAAkB,QAAQ,QAAQ,OAAO,GAAG,sBAAsB,EAAE,KAC3D,aAAI,CAAC,UAAU,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,SAAS,EAAE,MAAM,GAQ1E,iBAAQ,iBAAiB,MAAa,iBAAQ,CAAC,CAAC,CACzD,CACF,GACA,EAAE,aAAa,YAAY,CAC7B,EAAE,KAAY,aAAI,CAAC,WAAW,OAAO,OAAO,CAAC,OAAO,WAAU,QAAQ,QAAO,CAAC,CAAC,CAAC;AAU3E,IAAM,eAAe,CAC1B,QACA,YAC4B;AAAA,EAC5B,IAAI,WAAW,aAAa,YAAY;AAAA,IAAW,OAAO;AAAA,EAC1D,IAAI,WAAW,aAAa,YAAY;AAAA,IAAW,OAAO;AAAA,EAC1D,OAAO,WAAW,UAAU,IAAI;AAAA;AAiBlC,IAAM,gBAAgB,CAAC,WACd,aACL,CAAC,WAAW,SAAS,EAAE,IAAI,CAAC,SAC1B,IAAa,QAAQ,QAAQ,OAAO,2BAA2B,QAAQ,EAAE,KAChE,aAAI,UAAS,GACb,iBAAQ,iBAAiB,MAAa,iBAAQ,SAAS,CAAC,CACjE,CACF,GACA,EAAE,aAAa,YAAY,CAC7B,EAAE,KACO,iBAAQ,EAAE,QAAQ,aAAa;AAAA,EACpC,MAAM,UAAU,aAAa,QAAQ,OAAO;AAAA,EAC5C,OAAO,YAAY,iBACR,aACL,IAAI,MACF,uFACE,6DACJ,CACF,IACO,iBAAQ,OAAO;AAAA,CAC3B,CACH;AAGK,IAAM,aAAY,CAAC,UAA2B,KAAK,UAAU,SAAS,KAAK,CAAC;AAEnF,IAAM,WAAW,CAAC,UAA4B;AAAA,EAC5C,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAO,MACJ,IAAI,QAAQ,EACZ,KAAK,CAAC,MAAM,UAAU,KAAK,UAAU,IAAI,EAAE,cAAc,KAAK,UAAU,KAAK,CAAC,CAAC;AAAA,EACpF;AAAA,EACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,MAAM,UAAU,OAAO,QAAQ,KAAgC,EAC5D,OAAO,EAAE,SAAS,QAAQ,QAAQ,EAClC,KAAK,EAAE,QAAQ,WAAW,KAAK,cAAc,KAAK,CAAC;AAAA,IACtD,OAAO,OAAO,YAAY,QAAQ,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,SAAS,KAAK,CAAC,CAAC,CAAC;AAAA,EACjF;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,kBAAkB,CAAC,WACvB,aAAI,CAAC,cAAc,MAAM,GAAG,cAAc,MAAM,CAAC,GAAG,EAAE,aAAa,YAAY,CAAC,EAAE,KAChF,aAAI,EAAE,QAAQ,YAAY,SAAS,MAAM,CAClD;;;ADjHK,IAAM,kBAAkB,WAA0B,kBAAkB;AAE3E,IAAM,QAAO,CAAC,UACZ,gBAAgB,MAAM,MAAM,EAAE,KAAY,aAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC;AAEpE,IAAM,0BAA0B,MAC5B,kBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,EAE1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAE7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,MAAK,IAAI;AAAA,GACxB;AAAA,EAQD,MAAa,YAAG,UAAU,GAAG,QAAwC;AAAA,IACnE,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,QAAQ,YAAY,OAAO,MAAK,IAAI;AAAA,IACpC,OAAO,YAAY,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAC5E;AAAA,EAED,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAiBxC,MAAM,SAAS,OAAO,MAAK,IAAI;AAAA,IAC/B,IAAI,OAAO,YAAY;AAAA,MAAG,OAAO;AAAA,IAIjC,OAAO;AAAA,IACP,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,aAAa;AAAA,IAOzD,MAAM,QAAQ,OAAO,MAAK,IAAI;AAAA,IAC9B,IAAI,MAAM,YAAY,GAAG;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,0CAA0C,OAAO,MAAM,OAAO,qBAC5D,mFACA,yEACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EASD,QAAQ,MAAa;AACvB,CAAC,CACH,CACF;;AE/FF,qBAAS;AACT;AACA;;;ACjCO,IAAM,WAAW,CAAC,UACvB,GAAG,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK,GAAG;AAG9C,IAAM,cAAc,CAAC,UAAqB,iBAAiB,MAAM,qBAAqB,MAAM;AAoBrF,IAAM,aAAa,CAAC,WACxB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAC9B,IAAI,CAAC,UAAmB,eAAe,KAAK,CAAC,EAC7C,OAAO,CAAC,UAAU,UAAU,EAAE,EAC9B,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,iBAAiB,CAAC,UAC7B,UAAU,YAAY,KAAK,WAAW,CAAC,YAAY,KAAK,CAAC,CAAC;AAO5D,IAAM,QAAQ,CAAC,UACb,UAAU,aAAa,UAAU,KAAK,YAAY;AA0B7C,IAAM,YAAW,CAAC,WAA+D;AAAA,EACtF,mBAAmB,MAAM,MAAM,aAAa;AAAA,EAC5C,cAAc,MAAM,cAAc,YAAY,YAAY,YAAY,MAAM,SAAS;AAAA,EACrF,eAAe,MAAM,MAAM,aAAa;AAAA,EACxC,SAAS,MAAM,MAAM,OAAO;AAC9B;AAUO,IAAM,QAAO,CAAC,WAAmD;AAAA,EACtE,MAAM,MAAM,SAAS,OAAO,MAAM;AAAA,EAClC,MAAM,MAAM;AAAA,KACT,OAAO,YACR,OAAO,QAAQ,UAAS,KAAK,CAAC,EAAE,OAC9B,CAAC,UAAqC,MAAM,OAAO,SACrD,CACF;AACF;AAOO,IAAM,eAAa,CAAC,WAAmD;AAAA,KACzE,MAAK,KAAK;AAAA,EACb,QAAQ,MAAM;AAAA,EACd,MAAM;AACR;AAkBO,IAAM,cAAa,CAAC,UAAkD;AAAA,EAC3E,MAAM,QAAQ,OAAO,QAAQ,UAAS,KAAK,CAAC,EACzC,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,SAAS,GAAG;AAAA,EACrB,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;;;ADY/B,IAAM,mBAAmB,WAA2B,mBAAmB;AAE9E,IAAM,aAAW,YAAiD;AAAA,EAChE,YAAY,CAAC,MAAM,UAAU;AAAA,IAS3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,eAAe,KAAK,KAAK,kBAAkB;AAAA,MAC3C,WAAW,WAAW,KAAK,aAAa;AAAA,MACxC,eAAe,KAAK,KAAK,gBAAgB;AAAA,MACzC,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,MAAM,IAAI,KAAK,SAAS,CAAC;AAAA,MACzB,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,QAAQ;AAAA,MACR,UAAU,SAAS,KAAK;AAAA,MACxB,MAAM,MAAM;AAAA,MACZ,MAAM,KAAK,KAAK,OAAO;AAAA,IACzB;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAClD;AAAA,EAEA,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EAeA,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,UAAU,MAAM,SAAS,SACpC,YAAW,mBAAmB,MAAM,iBAAiB,OACrD,YAAW,mBAAmB,MAAM,iBAAiB,OACrD,YAAW,cAAc,eAAe,MAAM,SAAS;AAAA,EAOzD,MAAM,CAAC,UAAU,qBAAqB,MAAM,gBAAgB,SAAS,KAAK;AAAA,EAC1E;AACF,CAAC;AAYM,IAAM,2BAA2B,MAC7B,kBAAO,kBAAyB,iBAAQ,iBAAiB,SAAS,GAAG,UAAQ,CAAC,CAAC;;AEvM1F,qBAAS;AACT;AACA;AA6DO,IAAM,iBAAiB,WAAyB,iBAAiB;AAQxE,IAAM,QAAQ,CAAC,UAAoB,OAAO,UAAU,WAAW,QAAQ;AAUvE,IAAM,UAAQ,CAAC,UAAgD;AAAA,EAC7D,MAAM,QAAQ,MAAM,SAAS;AAAA,EAC7B,OAAO;AAAA,IAIL,iBAAiB,MAAM,iBAAiB,OAAO,MAAM;AAAA,IACrD,WAAW,MAAM,cAAc,OAAO,MAAM;AAAA,IAC5C,MAAM,MAAM;AAAA,OAIR,UAAU,KAAK,CAAC,IAAI,EAAE,MAAM;AAAA,OAC5B,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,EAC9D;AAAA;AAoBF,IAAM,cAAa,CAAC,UAAgD;AAAA,EAClE,MAAM,SAAQ;AAAA,IACZ,IAAK,MAAM,SAAS,QAAQ,KAAK,CAAC,OAAO,IAAI,CAAC;AAAA,IAC9C,GAAI,MAAM,QAAQ,YAAY,CAAC,KAAK,IAAI,CAAC;AAAA,EAC3C;AAAA,EACA,OAAO,WAAW,QAAM,KAAK,GAAG,MAAK;AAAA;AAGvC,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EACV,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,OAAO,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC3D,QAAQ,MAAM;AAAA,IACd,cAAc,KAAK,KAAK,gBAAgB;AAAA,IACxC,KAAK,MAAM,KAAK,MAAM;AAAA,IACtB,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,MAAM,MAAM;AAAA,IAOZ,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,EAC1D;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,QAAM,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAS5D,UAAU,EAAE,QAAQ,+BAA+B,QAAQ,oCAAoC;AAAA,EAC/F,SAAS,CAAC,aAAY,UACpB,YAAW,SAAS,MAAM,QAC1B,YAAW,WAAW,MAAM,SAAS,OACrC,YAAW,QAAQ,MAAM,OACzB,YAAW,eAAe,MAAM,cAAc,SAC9C,YAAW,kBAAkB,MAAM,iBAAiB;AAAA,EAOtD,MAAM,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAC5C;AACF,CAAC;AAgBM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACrLtF,qBAAS;AACT;AACA;AAwEO,IAAM,iBAAiB,WAAyB,iBAAiB;AAQxE,IAAM,WAAW,CAAC,MAAc,eAC7B,SAAS,KAAK,QAAQ,WAAW,cAAa,aAAa,cAAa,KAAK,QAAQ;AASxF,IAAM,QAAO,CAAC,WAAiD;AAAA,KACzD,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,KACzD,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,KAChD,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,KACnD,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,KACxD,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,KAAK,EAAE;AAAA,KAC3D,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,KAAK,EAAE;AAAA,KAC3D,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,KACxD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AACxF;AAkBA,IAAM,YAAoD;AAAA,EACxD,MAAM,CAAC,OAAO,WAAW,OAAO,OAAO;AAAA,EACvC,MAAM,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EAC/C,QAAQ,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EACjD,MAAM,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EAC/C,OAAO,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAClD;AAEA,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EACV,YAAY,CAAC,MAAM,UAAU;AAAA,IAQ3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,KAAK,KAAK,KAAK,MAAM;AAAA,MACrB,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,MAAM,KAAK,KAAK,OAAO,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO;AAAA,MAC3D,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,MACvB,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AAAA,MAC9B,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AAAA,MAC9B,QAAQ;AAAA,MACR,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,MACvB,MAAM,MAAM;AAAA,MACZ,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,MACrC,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK;AAAA,EAO7E,UAAU,EAAE,QAAQ,+BAA+B,QAAQ,oCAAoC;AAAA,EAC/F,SAAS,CAAC,aAAY,UACpB,YAAW,SAAS,MAAM,OAAO,MACjC,YAAW,UAAU,IAAI,MAAM,KAAK,KACpC,SAAS,YAAW,MAAM,MAAM,IAAI,KACpC,YAAW,SAAS,MAAM,OAAO,OACjC,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,UAAU,IAAI,MAAM,KAAK,KACpC,YAAW,kBAAkB,MAAM,gBAAgB,MACnD,YAAW,SAAS,MAAM,OAAO,MACjC,YAAW,YAAY,MAAM,UAAU;AAAA,EACzC,MAAM,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAC5C,YAAY,CAAC,UAAU;AAAA,IACrB,MAAM,UAAS,MAAK,KAAK;AAAA,IACzB,MAAM,QAAQ,UAAU,MAAM,MAAM,OAAO,CAAC,WAAW,QAAO,YAAY,SAAS;AAAA,IACnF,OAAO,WAAW,SAAQ,KAAK;AAAA;AAEnC,CAAC;AAgBM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;AChLtF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACjCA,IAAM,wBAA6C,IAAI,IAAI,CAAC,OAAO,OAAO,SAAS,MAAM,CAAC;AAEnF,IAAM,iBAAiB,CAAC,SAA0B,sBAAsB,IAAI,IAAI;;;ACtCvF;AACA;AAqBA,IAAM,OAAM,CAAC,OAAgB,WAAW,OAAQ,OAAO,UAAU,WAAW,QAAQ;AASpF,IAAM,SAAS,CAAC,UACd,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAEN,IAAM,YAAW,CAAC,WAA8B,SACrD,cAAa,aAAa,OAAO,SAAQ,MAAM,OAAO,IAAI;AAErD,IAAM,QAAO,CAAI,WAAyB,SAC/C,cAAa,aAAa,cAAa;AASzC,IAAM,iBAAe,CAAC,MAAe,UAA2C;AAAA,EAC9E,MAAM,OAAO;AAAA,EACb,OAAO;AAAA,IACL,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,OAAO,KAAI,KAAK,QAAQ;AAAA,IACxB,eAAe,KAAI,KAAK,gBAAgB;AAAA,IACxC,iBAAiB,KAAI,KAAK,gBAAgB;AAAA,IAC1C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,SAAS,MAAM;AAAA,IACf,MAAM,KAAI,KAAK,SAAS,MAAM,IAAI;AAAA,EACpC;AAAA;AAqBK,IAAM,oBAAoB,CAAC,UAChC,iBACE,OAAO,MAAM,QAAQ,aAAa,OAAe,mBAAW,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CACzF,EAAE,KAAY,aAAI,CAAC,SAAU,SAAS,aAAa,aAAa,eAAa,MAAM,KAAK,CAAE,CAAC;AAUtF,IAAM,cAAc,CAAC,UAC1B,kBAAkB,KAAK,EAAE,KAChB,kBAAS,mBAAmB,MAAa,iBAAQ,SAAS,CAAC,CACpE;AAGK,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;AAiB7B,IAAM,eAAe,CAC1B,MACA,WAC4B;AAAA,KACxB,UAAS,MAAM,SAAS,KAAK,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KACtE,UAAS,MAAM,OAAO,KAAK,KAAK,IAAI,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,KAC9D,UAAS,MAAM,kBAAkB,KAAK,gBAAgB,IACtD,CAAC,IACD,EAAE,iBAAiB,MAAM,iBAAiB;AAAA,KAC1C,MAAK,MAAM,SAAS,KAAK,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAClE,eAAe,MAAM,IAAI,KAAK,CAAC,MAAK,MAAM,QAAQ,KAAK,MAAM,IAC7D,EAAE,QAAQ,MAAM,OAAO,IACvB,CAAC;AAAA,KACD,MAAK,MAAM,eAAe,KAAK,aAAa,IAAI,CAAC,IAAI,EAAE,eAAe,MAAM,cAAc;AAAA,KAC1F,MAAK,MAAM,SAAS,KAAK,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AACxE;AAgBO,IAAM,YAAU,CAAC,aAA+B,UACrD,CAAC,eAAe,MAAM,IAAI,KAAK,CAAC,MAAK,MAAM,QAAQ,YAAW,MAAM,IACzD,aACL,IAAI,MACF,WAAW,MAAM,6BAA6B,OAAO,MAAM,MAAM,wBAC/D,GAAG,OAAO,YAAW,MAAM,UAAU,MAAM,4CAC3C,wFACA,4DACJ,CACF,IACO,iBAAQ,OAAO,KAAK,aAAa,aAAY,KAAK,CAAC,EAAE,WAAW,CAAC;;;AC7JvE,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;AAsB9B,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAQ7C,IAAM,cAAc,CAAC,aAClB,KAAK,QAAQ;AAgChB,IAAM,cAAc,CAAC,UACnB,OAAO,YAAY,OAAO,QAAQ,KAAI,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,WAAW,KAAK,GAAG,GAAG,KAAK,CAAC,CAAC;AAqClG,IAAM,WAAU,CAAC,MAAc,WAA0B;AAAA,KACpD,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,KAAK,MAAM,OAAO,CAAC;AAAA,KACpC,OAAM,SAAS,MAAM,KAAK;AAAA,KAC1B,OAAM,iBAAiB,MAAM,aAAa;AAAA,KAC1C,OAAM,iBAAiB,MAAM,gBAAgB;AAAA,KAC5C,eAAe,IAAI,IAAI,OAAM,UAAU,KAAK,MAAM,MAAM,CAAC,IAAI,CAAC;AACpE;AASO,IAAM,eAAa,CAAC,WAAiD;AAAA,KACvE,YAAY,MAAM,OAAO;AAAA,KACzB,SAAQ,MAAM,MAAM,KAAK;AAAA,EAC5B,SAAS,MAAM;AAAA,EACf,MAAM,MAAM;AACd;AAmBO,IAAM,cAAa,CACxB,OACA,UAC4B;AAAA,KACzB,SAAQ,MAAM,MAAM,SAAS,YAAY,QAAQ,aAAa,MAAM,KAAK,CAAC;AAAA,EAC7E,SAAS,MAAM;AACjB;AASO,IAAM,qBAAoB,CAAC,UAChC,YAAY,aAAW,KAAK,CAAC;AAUxB,IAAM,qBAAoB,CAAC,UAChC,YAAY,KAAI;;;AHzCX,IAAM,iBAAiB,WAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAEM,IAAM,yBAAyB,MAC3B,kBACP,gBACO,iBACL,eAAe,SAAS,GAAG;AAAA,EAOzB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAQ7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,YAAY,IAAI,IAAI,kBAAkB,IAAI,CAC1E;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,gBAAgB,aAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAGxE,OAAO,YAAW,gBAAgB,YAAW,MAAM,SAAS,GAAG,KAAK;AAAA,IACpE,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,kBAAkB,IAAI;AAAA,IAG1C,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,mBAAmB,KAAK,OAAO;AAAA,MACxD,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,gBAAgB,aAAW,IAAI,GAAG,IAAI;AAAA,MACxD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,QAAQ,OAAO,UAAQ,MAAM,IAAI,KAC5B,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAIxC,MAAM,SAAS,gBAAe,OAAO,YAAY,IAAI,CAAC;AAAA,IACtD,OAAO,YAAW,gBAAgB,aAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAKxE,MAAM,UAAS,YAAW,MAAM,MAAM;AAAA,IACtC,OAAO,YAAW,gBAAgB,SAAQ,KAAK;AAAA,IAC/C,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACQ,uBAAc,mBAAkB,IAAI,CAAC,CAC/C;AAAA,IACF,EAAO,SAAI,EAAE,OAAO,UAAQ,QAAQ,IAAI,IAAI;AAAA,MAC1C,OAAO,OACL,KAAK,QACL,aACA,MACQ,oBAAW,mBAAkB,OAAM,CAAC,CAC9C;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,YAAY,IAAI,CAAC;AAAA,IACrD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,WAAW,KAAK,mEACd,gFACA,0EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAMD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACQ,uBAAc,EAAE,SAAS,KAAK,QAAQ,CAAC,CACjD;AAAA,GACD;AACH,CAAC,CACH,CACF;;AIhLF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACvEA;AACA;AAsCO,IAAM,cAAc,CAAC,aAC1B,MAAM,QAAQ,QAAQ,IAClB,SAAS,QAAQ,CAAC,UAAmB;AAAA,EACnC,MAAM,OAAO;AAAA,EACb,MAAM,SAAS,YAAY,KAAK,QAAQ;AAAA,EACxC,OAAO,OAAO,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,SAAS,EAAE;AAAA,CACnF,IACD,CAAC;AAQP,IAAM,iBAAe,CACnB,MACA,WACuB;AAAA,EACvB,SAAS,YAAY,KAAK,QAAQ,EAAE,KAAK,GAAG;AAAA,EAC5C,QAAQ,KAAK,KAAK,QAAQ,SAAS;AAAA,EACnC,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,EACZ,OAAO,KAAK,KAAK,OAAO,SAAS;AACnC;AAoBO,IAAM,iBAAiB,CAAC,UAC7B,iBACE,OACE,MAAM,QACN,QACA,OACM,uBAAe,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK,CAAC,CAC7D,CACF,EAAE,KACO,aAAI,CAAC,SAAS;AAAA,EACnB,IAAI,SAAS;AAAA,IAAY,OAAO;AAAA,EAGhC,OAAO,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,eAAa,MAAM,KAAK;AAAA,CACrE,CACH;AAaK,IAAM,YAAW,CAAC,UACvB,eAAe,KAAK,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAG3D,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;;;AC9GpC;AACA;AAQO,IAAM,kBAAkB;AA6BxB,IAAM,wBAAwB,CAAC,UACpC,MAAM,YAAY,aAAa,MAAM,cAAc,YAAY,YAAY;AAmBtE,IAAM,eAAa,CAAC,WAAiD;AAAA,KACtE,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ,KAAK,GAAG,EAAE;AAAA,EAC1E,MAAM,MAAM;AAAA,KACR,MAAM,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,KAClE,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,MAAM,MAAM,EAAE;AAAA,KACjE,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,KACxE,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,gBAAgB;AACzF;AAcA,IAAM,qBAAoB,CAAC,UAAwD;AAAA,EACjF,MAAM,QAAO,aAAW,KAAK;AAAA,EAC7B,OAAO;AAAA,OACF;AAAA,IACH,cAAc,MAAK;AAAA,IACnB,MAAM,MAAM;AAAA,EACd;AAAA;AAIF,IAAM,kBAAkB;AAkDjB,IAAM,cAAa,CACxB,OACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,MAAK,KAAK;AAAA,EAClC,IAAI,aAAa;AAAA,IAAW,OAAO;AAAA,EAEnC,IAAI,MAAM,YAAY,aAAa,MAAM,cAAc,WAAW;AAAA,IAChE,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,MAAM,QAAQ,MAAM,gEACrB,0FACA,yFACA,yDACJ,CACF;AAAA,EACF;AAAA,EAaA,OAAO,UAAU,sBAAsB,KAAK,GAAG,QAAO,aAAW,KAAK,CAAC,GAAG,IAAI;AAAA,EAE9E,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,aACA,MACM,0BAAkB,mBAAkB,KAAK,CAAC,CAClD;AAAA,EAEA,MAAM,UAAS,CAAC,aACP,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,MAAK,KAAK;AAAA,IAC9B,IAAI,SAAS,aAAa,YAAY;AAAA,MAAG,OAAO;AAAA,IAChD,OAAc,eAAM,WAAW;AAAA,IAC/B,OAAO,OAAO,QAAO,WAAW,CAAC;AAAA,GAClC;AAAA,EAEH,MAAM,QAAQ,OAAO,QAAO,eAAe;AAAA,EAC3C,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,aACnB,IAAI,MACF,SAAS,MAAM,kBAAkB,MAAM,uBAAuB,KAAK,MAAM,WAAW,OAClF,2FACA,2DAA2D,MAAM,8BACjE,2FACA,yFACA,0FACA,yFACA,0FACA,oCACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAeI,IAAM,cAAc,CAAC,UAC1B,OACE,MAAM,QACN,aACA,MACM,0BAAkB,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK,CAAC,CAChE;;;AFvEK,IAAM,iBAAiB,WAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAEM,IAAM,yBAAyB,MAC3B,kBACP,gBACO,kBACL,eAAe,SAAS,GAAG;AAAA,EAGzB,MAAM,MAAa,kBAAQ,CAAC,CAAC;AAAA,EAM7B,MAAa,aAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,UAAS,IAAI,IAAI,eAAe,IAAI,CACpE;AAAA,GACD;AAAA,EACD,MAAa,aAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAMvB,OAAO,UACL,sBAAsB,IAAI,GAC1B,QAAO,aAAW,IAAI,CAAC,GACvB,WAAW,SACb;AAAA,IACA,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IACvC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBAAkB,mBAAmB,GAAG,KAAK,QAAQ,KAAK,MAAM;AAAA,MACvE,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IAOA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,UAAU,sBAAsB,IAAI,GAAG,QAAO,aAAW,IAAI,CAAC,GAAG,IAAI;AAAA,MAC5E,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAIA,OAAO,EAAE,QAAQ,OAAO;AAAA,GACzB;AAAA,EAUD,WAAkB,aAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,OAAO,OAAO,YAAW,MAAM,CAAC,UAC9B,UAAS,KAAK,EAAE,KAAY,cAAI,eAAc,CAAC,CACjD;AAAA,GACD;AAAA,EACD,QAAe,aAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,YAAY,IAAI;AAAA,GACxB;AACH,CAAC,CACH,CACF;",
-  "debugId": "23CD7F01601D5A3A64756E2164756E21",
+  "mappings": ";AA4CA;AACA;AACA;AACA;AACA;;;ACpCA;;;AC4EA,IAAM,WAAW,CAAC,UAA0B,CAAC,GAAG,KAAK,EAAE;AAQvD,IAAM,aAAa,CAAC,MAAc,OAAe,SAAoC;AAAA,EACnF,MAAM,MAAgB,CAAC;AAAA,EACvB,IAAI,KAAK,cAAc,aAAa,SAAS,KAAK,IAAI,KAAK,WAAW;AAAA,IACpE,IAAI,KAAK,GAAG,iBAAiB,KAAK,sBAAsB;AAAA,EAC1D;AAAA,EACA,IAAI,KAAK,cAAc,aAAa,SAAS,KAAK,IAAI,KAAK,WAAW;AAAA,IACpE,IAAI,KAAK,GAAG,kBAAkB,KAAK,sBAAsB;AAAA,EAC3D;AAAA,EACA,IAAI,KAAK,SAAS,aAAa,CAAC,KAAK,KAAK,SAAS,KAAK,GAAG;AAAA,IACzD,IAAI,KAAK,GAAG,wBAAwB,KAAK,KAAK,KAAK,IAAI,GAAG;AAAA,EAC5D;AAAA,EAGA,IAAI,KAAK,YAAY,aAAa,CAAC,IAAI,OAAO,KAAK,SAAS,KAAK,YAAY,EAAE,KAAK,KAAK,GAAG;AAAA,IAC1F,IAAI,KAAK,GAAG,oBAAoB,KAAK,iBAAiB,KAAK,SAAS;AAAA,EACtE;AAAA,EAIA,MAAM,UAAU,OAAO,KAAK;AAAA,EAC5B,MAAM,UAAU,KAAK,YAAY,aAAa,KAAK,YAAY;AAAA,EAC/D,IAAI,WAAW,UAAU,MAAM,OAAO,SAAS,OAAO,GAAG;AAAA,IACvD,IAAI,KAAK,YAAY,aAAa,UAAU,KAAK,SAAS;AAAA,MACxD,IAAI,KAAK,GAAG,kBAAkB,KAAK,SAAS;AAAA,IAC9C;AAAA,IACA,IAAI,KAAK,YAAY,aAAa,UAAU,KAAK,SAAS;AAAA,MACxD,IAAI,KAAK,GAAG,iBAAiB,KAAK,SAAS;AAAA,IAC7C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,aAAa,CACxB,OACA,MACA,UAA4B,CAAC,MACP;AAAA,EACtB,MAAM,MAAgB,CAAC;AAAA,EACvB,YAAY,MAAM,SAAS,OAAO,QAAQ,KAAK,GAAG;AAAA,IAChD,MAAM,QAAQ,KAAK;AAAA,IACnB,IAAI,UAAU,WAAW;AAAA,MACvB,IAAI,QAAQ,aAAa,QAAQ,KAAK,aAAa;AAAA,QAAM,IAAI,KAAK,GAAG,gBAAgB;AAAA,MACrF;AAAA,IACF;AAAA,IAEA,WAAW,QAAQ,OAAO,UAAU,WAAW,CAAC,KAAK,IAAI,OAAO;AAAA,MAC9D,IAAI,KAAK,GAAG,WAAW,MAAM,MAAM,IAAI,CAAC;AAAA,IAC1C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,UAAU,CAAC,UAAuB,UAC7C,GAAG;AAAA,MAAkD,MAAM,KAAK;AAAA,KAAQ;AAAA,IACxE,uEACA;;;ACzIK,IAAM,yBAAwE;AAAA,EACnF,2BAA2B;AAAA,IACzB,SAAW,EAAC,QAAS,eAAc,UAAW,MAAK,MAAO,SAAQ;AAAA,EACpE;AAAA,EACA,0BAA0B;AAAA,IACxB,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,QAAU,EAAC,QAAS,cAAa,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,0BAA0B;AAAA,IACxB,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,aAAY,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC9D,QAAU,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACvC,WAAa,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,MAAQ,EAAC,SAAU,+BAA8B,eAAgB,yBAAwB,MAAO,SAAQ;AAAA,IACxG,UAAY,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC7C,UAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,QAAS,cAAa,WAAY,IAAG,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjF;AAAA,EACA,uBAAuB;AAAA,IACrB,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,MAAQ,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACxC,OAAS,EAAC,QAAS,mBAAkB,UAAW,MAAK,MAAO,SAAQ;AAAA,IACpE,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,OAAS,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,EACtD;AAAA,EACA,oCAAoC,CAAC;AAAA,EACrC,kCAAkC;AAAA,IAChC,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EACpD;AAAA,EACA,kCAAkC;AAAA,IAChC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,aAAY,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC9D,QAAU,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACvC,WAAa,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,MAAQ,EAAC,SAAU,+BAA8B,eAAgB,yBAAwB,MAAO,SAAQ;AAAA,IACxG,UAAY,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,EAC/C;AAAA,EACA,kDAAkD;AAAA,IAChD,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,SAAU,gBAAe,SAAU,GAAE,MAAO,UAAS;AAAA,EAClE;AACF;;;AC3CO,IAAM,iCAAgF;AAAA,EAC3F,4BAA4B;AAAA,IAC1B,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,SAAU,KAAI,MAAO,CAAC,KAAI,KAAI,QAAO,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC/E,KAAO,EAAC,SAAU,+BAA8B,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IAC/F,SAAW,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACpD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,IAAM,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACjE,UAAY,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACzD,kBAAoB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACnF,QAAU,EAAC,QAAS,0BAAyB,MAAO,SAAQ;AAAA,IAC5D,MAAQ,EAAC,SAAU,YAAW,MAAO,CAAC,YAAW,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClF,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,kBAAkB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACnD,qBAAqB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IAC9G,6BAA6B,EAAC,MAAO,CAAC,UAAS,QAAO,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,aAAe,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IAC7D,iBAAiB,EAAC,SAAU,cAAa,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjF,UAAY,EAAC,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1E,WAAa,EAAC,SAAU,2BAA0B,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IACrG,UAAY,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACxD,SAAW,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACrD,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EACnD;AAAA,EACA,gCAAgC;AAAA,IAC9B,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,SAAU,KAAI,MAAO,CAAC,KAAI,KAAI,QAAO,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC/E,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACpD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACjE,UAAY,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACzD,kBAAoB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACnF,QAAU,EAAC,QAAS,0BAAyB,MAAO,SAAQ;AAAA,IAC5D,MAAQ,EAAC,SAAU,YAAW,MAAO,CAAC,YAAW,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClF,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,kBAAkB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACnD,qBAAqB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IAC9G,6BAA6B,EAAC,MAAO,CAAC,UAAS,QAAO,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,aAAe,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IAC7D,iBAAiB,EAAC,SAAU,cAAa,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjF,UAAY,EAAC,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1E,WAAa,EAAC,SAAU,2BAA0B,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IACrG,UAAY,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACxD,SAAW,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACrD,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EACnD;AACF;;;ACnDO,IAAM,+BAA8E;AAAA,EACzF,sCAAsC;AAAA,IACpC,OAAS,EAAC,UAAW,MAAK,MAAO,UAAS;AAAA,EAC5C;AACF;;;ACJO,IAAM,mCAAkF;AAAA,EAC7F,sCAAsC;AAAA,IACpC,MAAQ,EAAC,QAAS,YAAW,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5D,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,oCAAmC,eAAgB,8BAA6B,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjK;AAAA,EACA,4CAA4C;AAAA,IAC1C,MAAQ,EAAC,QAAS,YAAW,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5D,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,oCAAmC,eAAgB,8BAA6B,MAAO,SAAQ;AAAA,EACnJ;AACF;;;ACZO,IAAM,6BAA4E;AAAA,EACvF,kCAAkC;AAAA,IAChC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACjD,cAAgB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3D,aAAe,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1D,KAAO,EAAC,QAAS,4BAA2B,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3E,OAAS,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,WAAU,WAAU,YAAW,SAAS,GAAE,MAAO,SAAQ;AAAA,IACzG,MAAQ,EAAC,MAAO,CAAC,MAAK,IAAI,GAAE,MAAO,SAAQ;AAAA,EAC7C;AAAA,EACA,8BAA8B;AAAA,IAC5B,UAAY,EAAC,MAAO,CAAC,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IAC3D,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,WAAa,EAAC,QAAS,2BAA0B,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChF,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,uCAAuC;AAAA,IACrC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,OAAS,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACjD,cAAgB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3D,aAAe,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1D,OAAS,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,WAAU,WAAU,YAAW,SAAS,GAAE,MAAO,SAAQ;AAAA,EAC3G;AAAA,EACA,oCAAoC;AAAA,IAClC,UAAY,EAAC,MAAO,CAAC,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IAC3D,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,WAAa,EAAC,QAAS,2BAA0B,MAAO,SAAQ;AAAA,EAClE;AACF;;;AChCO,IAAM,kCAAiF;AAAA,EAC5F,yCAAyC;AAAA,IACvC,eAAiB,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC/E,iBAAiB,EAAC,SAAU,YAAW,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,KAAO,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,KAAI,MAAO,UAAS;AAAA,IACvE,oBAAoB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC5E,gBAAgB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACjD,sBAAsB,EAAC,SAAU,YAAW,SAAU,MAAK,MAAO,UAAS;AAAA,IAC3E,iBAAiB,EAAC,SAAU,SAAQ,MAAO,CAAC,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC3E,4BAA4B,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC7D,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,UAAW,MAAK,MAAO,UAAS;AAAA,IACrE,OAAS,EAAC,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,WAAU,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7D,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,MAAQ,EAAC,MAAO,CAAC,YAAW,YAAW,eAAe,GAAE,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjH;AAAA,EACA,wCAAwC;AAAA,IACtC,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,eAAiB,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC/E,iBAAiB,EAAC,SAAU,YAAW,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,KAAO,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,KAAI,MAAO,UAAS;AAAA,IACvE,oBAAoB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC5E,gBAAgB,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IACjD,sBAAsB,EAAC,SAAU,YAAW,SAAU,MAAK,MAAO,UAAS;AAAA,IAC3E,iBAAiB,EAAC,SAAU,SAAQ,MAAO,CAAC,QAAO,OAAO,GAAE,MAAO,SAAQ;AAAA,IAC3E,4BAA4B,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC7D,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,UAAW,MAAK,MAAO,UAAS;AAAA,IACrE,OAAS,EAAC,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,WAAU,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7D,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,EACxD;AACF;;;ACpCO,IAAM,wCAAuF;AAAA,EAClG,oDAAoD;AAAA,IAClD,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC1C,OAAS,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC3C;AAAA,EACA,sDAAsD;AAAA,IACpD,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,IAChE,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,kDAAkD;AAAA,IAChD,gBAAgB,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,IAChE,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC5C;AAAA,EACA,qDAAqD;AAAA,IACnD,QAAU,EAAC,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IACtE,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,KAAO,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EACzC;AAAA,EACA,4CAA4C;AAAA,IAC1C,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,MAAQ,EAAC,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,EAC/D;AAAA,EACA,0DAA0D;AAAA,IACxD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,EAC3C;AAAA,EACA,4DAA4D;AAAA,IAC1D,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,EAClE;AAAA,EACA,wDAAwD;AAAA,IACtD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,MAAO,MAAK,QAAS,qBAAoB,MAAO,QAAO;AAAA,IAClE,eAAe,EAAC,MAAO,MAAK,QAAS,cAAa,MAAO,QAAO;AAAA,IAChE,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,EAC/E;AAAA,EACA,2DAA2D;AAAA,IACzD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,EACxD;AAAA,EACA,kDAAkD;AAAA,IAChD,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,IAC7D,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,QAAU,EAAC,MAAO,MAAK,QAAS,gBAAe,MAAO,QAAO;AAAA,EAC/D;AACF;;;ACzDO,IAAM,sCAAqF;AAAA,EAChG,iCAAiC;AAAA,IAC/B,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,IAAM,EAAC,QAAS,0BAAyB,SAAU,kCAAiC,eAAgB,4BAA2B,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9J,MAAQ,EAAC,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpC,YAAc,EAAC,MAAO,CAAC,SAAQ,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtD,UAAY,EAAC,SAAU,QAAO,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3F,QAAU,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,QAAS,YAAW,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9D,MAAQ,EAAC,MAAO,CAAC,OAAO,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC3D;AAAA,EACA,qCAAqC;AAAA,IACnC,SAAW,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAC5C,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,MAAQ,EAAC,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpC,YAAc,EAAC,MAAO,CAAC,SAAQ,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtD,UAAY,EAAC,SAAU,QAAO,QAAS,sBAAqB,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3F,QAAU,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,EAChD;AACF;;;ACpBO,IAAM,8BAA6E;AAAA,EACxF,+BAA+B;AAAA,IAC7B,OAAS,EAAC,WAAY,KAAI,eAAgB,qCAAoC,MAAO,SAAQ;AAAA,IAC7F,KAAO,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,MAAQ,EAAC,MAAO,CAAC,MAAM,GAAE,MAAO,SAAQ;AAAA,IACxC,MAAQ,EAAC,WAAY,GAAE,WAAY,GAAE,SAAU,yCAAwC,eAAgB,mCAAkC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACxK,MAAQ,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC1C;AAAA,EACA,8CAA8C;AAAA,IAC5C,mBAAmB,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,IACjD,cAAc,EAAC,MAAO,MAAK,QAAS,sBAAqB,MAAO,QAAO;AAAA,IACvE,eAAiB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACrD,SAAW,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,QAAS,qBAAoB,UAAW,MAAK,MAAO,SAAQ;AAAA,IACvE,MAAQ,EAAC,MAAO,CAAC,QAAQ,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC5D;AAAA,EACA,+BAA+B;AAAA,IAC7B,MAAQ,EAAC,MAAO,CAAC,SAAS,GAAE,MAAO,SAAQ;AAAA,IAC3C,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,WAAa,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACtD,qBAAqB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC3C,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,OAAS,EAAC,QAAS,WAAU,MAAO,SAAQ;AAAA,IAC5C,aAAa,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC5D,yBAAyB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,2CAA0C,eAAgB,qCAAoC,MAAO,QAAO;AAAA,IACzL,KAAO,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACpC,MAAQ,EAAC,MAAO,CAAC,QAAO,UAAS,QAAO,UAAS,QAAO,OAAO,GAAE,QAAS,gBAAe,UAAW,MAAK,MAAO,SAAQ;AAAA,IACxH,iBAAiB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IAChF,aAAa,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7D,cAAc,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5E,MAAQ,EAAC,WAAY,GAAE,WAAY,GAAE,SAAU,yCAAwC,eAAgB,mCAAkC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC1K;AAAA,EACA,wBAAwB,CAAC;AAAA,EACzB,qCAAqC;AAAA,IACnC,OAAS,EAAC,WAAY,KAAI,eAAgB,qCAAoC,MAAO,SAAQ;AAAA,IAC7F,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,KAAO,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,EACzD;AAAA,EACA,sDAAsD;AAAA,IACpD,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,mBAAmB,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,IACjD,cAAc,EAAC,MAAO,MAAK,QAAS,sBAAqB,MAAO,QAAO;AAAA,IACvE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,eAAiB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACrD,SAAW,EAAC,QAAS,MAAK,MAAO,SAAQ;AAAA,EAC3C;AAAA,EACA,qCAAqC;AAAA,IACnC,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,MAAQ,EAAC,MAAO,CAAC,SAAS,GAAE,MAAO,SAAQ;AAAA,IAC3C,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,WAAa,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACtD,qBAAqB,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC3C,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,OAAS,EAAC,QAAS,WAAU,MAAO,SAAQ;AAAA,IAC5C,aAAa,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC5D,yBAAyB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,2CAA0C,eAAgB,qCAAoC,MAAO,QAAO;AAAA,IACzL,KAAO,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACpC,iBAAiB,EAAC,SAAU,UAAS,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IAChF,aAAa,EAAC,SAAU,UAAS,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7D,cAAc,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,EAC9E;AACF;;;ACnEO,IAAM,6BAA4E;AAAA,EACvF,yCAAyC;AAAA,IACvC,QAAU,EAAC,SAAU,OAAM,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,EACzE;AAAA,EACA,0CAA0C,CAAC;AAAA,EAC3C,wCAAwC,CAAC;AAAA,EACzC,2CAA2C;AAAA,IACzC,eAAe,EAAC,QAAS,WAAU,MAAO,SAAQ;AAAA,EACpD;AAAA,EACA,mCAAmC;AAAA,IACjC,aAAe,EAAC,SAAU,GAAE,MAAO,SAAQ;AAAA,IAC3C,KAAO,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACvC,mBAAmB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAChD,cAAgB,EAAC,SAAU,KAAI,MAAO,SAAQ;AAAA,EAChD;AAAA,EACA,oCAAoC;AAAA,IAClC,aAAe,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,UAAS,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,UAAY,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,MAAQ,EAAC,eAAgB,oBAAmB,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3E,mBAAqB,EAAC,SAAU,QAAO,MAAO,CAAC,MAAK,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IACjF,QAAU,EAAC,SAAU,OAAM,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACvE,YAAc,EAAC,SAAU,OAAM,MAAO,UAAS;AAAA,IAC/C,MAAQ,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IAC/D,aAAe,EAAC,SAAU,qCAAoC,eAAgB,+BAA8B,MAAO,SAAQ;AAAA,EAC7H;AAAA,EACA,0CAA0C;AAAA,IACxC,aAAe,EAAC,MAAO,CAAC,OAAM,UAAS,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,UAAY,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,mBAAqB,EAAC,MAAO,CAAC,MAAK,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAChE,QAAU,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,YAAc,EAAC,SAAU,OAAM,MAAO,UAAS;AAAA,IAC/C,MAAQ,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACjD,aAAe,EAAC,SAAU,qCAAoC,eAAgB,+BAA8B,MAAO,SAAQ;AAAA,EAC7H;AACF;;;AClCO,IAAM,8BAA6E;AAAA,EACxF,oCAAoC;AAAA,IAClC,QAAU,EAAC,SAAU,MAAK,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACnE,aAAe,EAAC,SAAU,MAAK,MAAO,CAAC,MAAK,OAAM,QAAO,OAAM,QAAO,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IACnG,SAAW,EAAC,QAAS,eAAc,UAAW,MAAK,MAAO,SAAQ;AAAA,IAClE,MAAQ,EAAC,QAAS,kBAAiB,UAAW,MAAK,MAAO,SAAQ;AAAA,IAClE,WAAa,EAAC,MAAO,CAAC,UAAS,UAAS,UAAS,SAAQ,UAAS,UAAS,SAAQ,UAAS,QAAQ,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EACvI;AACF;;;ACRO,IAAM,4BAA2E;AAAA,EACtF,8BAA8B;AAAA,IAC5B,MAAQ,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,QAAO,SAAQ,SAAQ,WAAU,SAAS,GAAE,MAAO,SAAQ;AAAA,IACtG,SAAW,EAAC,SAAU,mDAAkD,SAAU,GAAE,MAAO,SAAQ;AAAA,IACnG,OAAS,EAAC,SAAU,OAAM,MAAO,CAAC,SAAQ,WAAU,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC1E,OAAS,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,UAAY,EAAC,SAAU,KAAI,SAAU,MAAK,SAAU,GAAE,MAAO,SAAQ;AAAA,IACrE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,YAAc,EAAC,SAAU,cAAa,eAAgB,wCAAuC,MAAO,SAAQ;AAAA,IAC5G,KAAO,EAAC,eAAgB,6FAA4F,MAAO,SAAQ;AAAA,IACnI,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,UAAY,EAAC,QAAS,YAAW,WAAY,KAAI,MAAO,SAAQ;AAAA,IAChE,MAAQ,EAAC,MAAO,CAAC,UAAS,UAAS,aAAY,QAAO,UAAS,WAAU,WAAU,YAAW,YAAW,iBAAiB,GAAE,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,SAAU,OAAM,SAAU,IAAG,MAAO,UAAS;AAAA,IACxD,YAAc,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACnE,YAAc,EAAC,WAAY,KAAI,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9D,QAAU,EAAC,MAAO,CAAC,UAAS,UAAS,UAAS,UAAS,UAAS,YAAW,aAAY,UAAS,UAAS,SAAQ,WAAW,GAAE,MAAO,SAAQ;AAAA,IAC7I,UAAY,EAAC,WAAY,GAAE,MAAO,SAAQ;AAAA,IAC1C,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,cAAgB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACzD,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,SAAU,SAAQ,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvE,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IAC9D,MAAQ,EAAC,QAAS,YAAW,SAAU,WAAU,SAAU,KAAI,UAAW,MAAK,MAAO,UAAS;AAAA,EACjG;AAAA,EACA,2CAA2C;AAAA,IACzC,MAAQ,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,QAAO,SAAQ,SAAQ,WAAU,SAAS,GAAE,MAAO,SAAQ;AAAA,IACtG,OAAS,EAAC,SAAU,OAAM,MAAO,CAAC,SAAQ,WAAU,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC1E,OAAS,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,UAAY,EAAC,SAAU,KAAI,SAAU,MAAK,SAAU,GAAE,MAAO,SAAQ;AAAA,IACrE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,YAAc,EAAC,SAAU,cAAa,eAAgB,wCAAuC,MAAO,SAAQ;AAAA,IAC5G,KAAO,EAAC,eAAgB,6FAA4F,MAAO,SAAQ;AAAA,IACnI,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,UAAY,EAAC,QAAS,YAAW,WAAY,KAAI,MAAO,SAAQ;AAAA,IAChE,MAAQ,EAAC,MAAO,CAAC,UAAS,UAAS,aAAY,QAAO,UAAS,WAAU,WAAU,YAAW,YAAW,iBAAiB,GAAE,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,SAAU,OAAM,SAAU,IAAG,MAAO,UAAS;AAAA,IACxD,YAAc,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACnE,QAAU,EAAC,MAAO,CAAC,UAAS,UAAS,UAAS,UAAS,UAAS,YAAW,aAAY,UAAS,UAAS,SAAQ,WAAW,GAAE,MAAO,SAAQ;AAAA,IAC7I,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,cAAgB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACzD,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,EAChE;AAAA,EACA,2CAA2C;AAAA,IACzC,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,MAAQ,EAAC,MAAO,CAAC,UAAS,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,OAAM,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,QAAO,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,SAAQ,OAAO,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC58D,MAAQ,EAAC,SAAU,mCAAkC,eAAgB,6BAA4B,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClI;AACF;;;AC3DO,IAAM,gCAA+E;AAAA,EAC1F,kCAAkC;AAAA,IAChC,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,gBAAgB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACrD,WAAa,EAAC,MAAO,CAAC,cAAa,iBAAgB,eAAc,aAAY,WAAU,eAAc,eAAc,eAAc,oBAAmB,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IACvL,uBAAyB,EAAC,MAAO,CAAC,UAAS,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,cAAgB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC1D,aAAe,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACpE,MAAQ,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC1C,OAAS,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC3C,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,QAAS,aAAY,WAAY,IAAG,WAAY,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3F,KAAO,EAAC,SAAU,OAAM,SAAU,MAAK,MAAO,UAAS;AAAA,IACvD,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,YAAc,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACnD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,QAAU,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACpD,MAAQ,EAAC,MAAO,CAAC,UAAS,QAAO,OAAM,SAAQ,QAAO,UAAS,aAAY,WAAU,WAAU,cAAa,QAAO,SAAS,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7J,WAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,mBAAmB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,EAC1D;AAAA,EACA,iCAAiC,CAAC;AAAA,EAClC,yCAAyC;AAAA,IACvC,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,gBAAgB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACrD,WAAa,EAAC,MAAO,CAAC,cAAa,iBAAgB,eAAc,aAAY,WAAU,eAAc,eAAc,eAAc,oBAAmB,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IACvL,uBAAyB,EAAC,MAAO,CAAC,UAAS,YAAW,UAAU,GAAE,MAAO,SAAQ;AAAA,IACjF,cAAgB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC1D,aAAe,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IACpE,MAAQ,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC1C,OAAS,EAAC,QAAS,UAAS,MAAO,SAAQ;AAAA,IAC3C,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC3C,UAAY,EAAC,QAAS,QAAO,MAAO,SAAQ;AAAA,IAC5C,KAAO,EAAC,SAAU,OAAM,SAAU,MAAK,MAAO,UAAS;AAAA,IACvD,SAAW,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,YAAc,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,IACnD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,WAAa,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACvD,SAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,QAAU,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACpD,MAAQ,EAAC,MAAO,CAAC,UAAS,QAAO,OAAM,SAAQ,QAAO,UAAS,aAAY,WAAU,WAAU,cAAa,QAAO,SAAS,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7J,WAAW,EAAC,SAAU,MAAK,SAAU,GAAE,MAAO,UAAS;AAAA,IACvD,mBAAmB,EAAC,QAAS,aAAY,MAAO,SAAQ;AAAA,EAC1D;AACF;;;ACtDO,IAAM,6BAA4E;AAAA,EACvF,+BAA+B;AAAA,IAC7B,UAAY,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAClD,WAAW,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACvD,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpD,SAAW,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC3C,SAAW,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACxC,MAAQ,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtE,MAAQ,EAAC,QAAS,eAAc,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,SAAU,oCAAmC,eAAgB,8BAA6B,MAAO,SAAQ;AAAA,IACjJ,SAAW,EAAC,SAAU,mDAAkD,SAAU,GAAE,MAAO,UAAS;AAAA,IACpG,OAAS,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,YAAY,GAAE,MAAO,SAAQ;AAAA,IACzE,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,KAAO,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAClD,UAAY,EAAC,SAAU,KAAI,SAAU,KAAI,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,cAAc,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,SAAU,oBAAmB,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IACxF,WAAa,EAAC,MAAO,CAAC,OAAM,KAAI,MAAM,GAAE,MAAO,SAAQ;AAAA,IACvD,0BAA0B,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACpE,aAAa,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACzD,eAAe,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,MAAO,CAAC,MAAK,SAAQ,MAAK,SAAQ,SAAQ,MAAK,MAAK,MAAK,SAAQ,SAAQ,SAAQ,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,SAAQ,MAAK,MAAK,IAAI,GAAE,MAAO,SAAQ;AAAA,IACvL,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAQ,UAAS,WAAU,YAAW,YAAW,mBAAkB,cAAa,WAAW,GAAE,MAAO,SAAQ;AAAA,IACtI,kBAAoB,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,SAAQ;AAAA,IAChE,eAAiB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5D,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,YAAc,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACtD,QAAU,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,OAAM,OAAM,QAAO,QAAO,UAAS,QAAO,QAAO,SAAQ,SAAQ,OAAM,OAAM,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpJ,eAAe,EAAC,SAAU,0CAAyC,eAAgB,oCAAmC,MAAO,SAAQ;AAAA,IACrI,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,aAAY,mBAAkB,sBAAqB,WAAU,QAAQ,GAAE,MAAO,SAAQ;AAAA,IAC/H,aAAa,EAAC,SAAU,6BAA4B,eAAgB,uBAAsB,MAAO,SAAQ;AAAA,IACzG,QAAU,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,SAAW,EAAC,QAAS,kBAAiB,WAAY,KAAI,MAAO,SAAQ;AAAA,IACrE,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAClD,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IACjD,WAAa,EAAC,SAAU,OAAM,SAAU,sEAAqE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,IAC3M,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACrD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,SAAW,EAAC,SAAU,qBAAoB,SAAU,uEAAsE,eAAgB,iEAAgE,MAAO,SAAQ;AAAA,IACzN,MAAQ,EAAC,QAAS,YAAW,SAAU,WAAU,SAAU,KAAI,UAAW,MAAK,MAAO,UAAS;AAAA,IAC/F,gBAAkB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC5D,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,EACzD;AAAA,EACA,4CAA4C;AAAA,IAC1C,UAAY,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAClD,WAAW,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACvD,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpD,SAAW,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IACxC,MAAQ,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,MAAM,GAAE,MAAO,SAAQ;AAAA,IACtE,MAAQ,EAAC,QAAS,eAAc,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,SAAU,oCAAmC,eAAgB,8BAA6B,MAAO,SAAQ;AAAA,IACjJ,OAAS,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC/C,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IACvD,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,YAAY,GAAE,MAAO,SAAQ;AAAA,IACzE,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,KAAO,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAClD,UAAY,EAAC,SAAU,KAAI,SAAU,KAAI,SAAU,GAAE,MAAO,SAAQ;AAAA,IACpE,UAAY,EAAC,SAAU,mCAAkC,SAAU,QAAO,SAAU,GAAE,MAAO,UAAS;AAAA,IACtG,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,aAAe,EAAC,WAAY,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,YAAc,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACvD,cAAc,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IACxD,SAAW,EAAC,SAAU,oBAAmB,QAAS,wBAAuB,MAAO,SAAQ;AAAA,IACxF,WAAa,EAAC,MAAO,CAAC,OAAM,KAAI,MAAM,GAAE,MAAO,SAAQ;AAAA,IACvD,aAAa,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACzD,eAAe,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,MAAO,CAAC,MAAK,SAAQ,MAAK,SAAQ,SAAQ,MAAK,MAAK,MAAK,SAAQ,SAAQ,SAAQ,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,MAAK,SAAQ,MAAK,MAAK,IAAI,GAAE,MAAO,SAAQ;AAAA,IACvL,MAAQ,EAAC,MAAO,CAAC,UAAS,SAAQ,UAAS,WAAU,YAAW,YAAW,mBAAkB,cAAa,WAAW,GAAE,MAAO,SAAQ;AAAA,IACtI,kBAAoB,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,SAAQ;AAAA,IAChE,eAAiB,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5D,MAAQ,EAAC,QAAS,YAAW,MAAO,SAAQ;AAAA,IAC5C,YAAc,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACtD,QAAU,EAAC,SAAU,SAAQ,MAAO,CAAC,SAAQ,OAAM,OAAM,QAAO,QAAO,UAAS,QAAO,QAAO,SAAQ,SAAQ,OAAM,OAAM,SAAS,GAAE,MAAO,SAAQ;AAAA,IACpJ,eAAe,EAAC,SAAU,0CAAyC,eAAgB,oCAAmC,MAAO,SAAQ;AAAA,IACrI,QAAU,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACvD,MAAQ,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IAC9C,QAAU,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,aAAY,mBAAkB,sBAAqB,WAAU,QAAQ,GAAE,MAAO,SAAQ;AAAA,IAC/H,aAAa,EAAC,SAAU,6BAA4B,eAAgB,uBAAsB,MAAO,SAAQ;AAAA,IACzG,QAAU,EAAC,SAAU,QAAO,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,SAAW,EAAC,QAAS,kBAAiB,WAAY,KAAI,MAAO,SAAQ;AAAA,IACrE,KAAO,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IAClD,SAAW,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,SAAW,EAAC,QAAS,cAAa,MAAO,SAAQ;AAAA,IACjD,WAAa,EAAC,SAAU,OAAM,SAAU,sEAAqE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,IAC3M,SAAW,EAAC,QAAS,qBAAoB,MAAO,SAAQ;AAAA,IACxD,MAAQ,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IAChD,OAAS,EAAC,SAAU,KAAI,SAAU,GAAE,MAAO,UAAS;AAAA,IACpD,SAAW,EAAC,SAAU,qBAAoB,SAAU,uEAAsE,eAAgB,iEAAgE,MAAO,SAAQ;AAAA,IACzN,gBAAkB,EAAC,QAAS,kBAAiB,MAAO,SAAQ;AAAA,IAC5D,UAAY,EAAC,QAAS,mBAAkB,MAAO,SAAQ;AAAA,EACzD;AACF;;;ACtGO,IAAM,gCAA+E;AAAA,EAC1F,yDAAyD;AAAA,IACvD,sBAAsB,EAAC,MAAO,CAAC,OAAM,QAAO,UAAS,UAAS,UAAS,QAAQ,GAAE,MAAO,SAAQ;AAAA,IAChG,SAAW,EAAC,MAAO,CAAC,OAAM,UAAS,QAAQ,GAAE,QAAS,uBAAsB,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3G,UAAY,EAAC,WAAY,KAAI,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5D,KAAO,EAAC,SAAU,qBAAoB,eAAgB,eAAc,UAAW,MAAK,MAAO,SAAQ;AAAA,EACrG;AACF;;;ACPO,IAAM,wBAAuE;AAAA,EAClF,mBAAmB;AAAA,IACjB,QAAU,EAAC,QAAS,cAAa,UAAW,MAAK,MAAO,SAAQ;AAAA,EAClE;AAAA,EACA,2BAA2B;AAAA,IACzB,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,KAAO,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,EAClD;AACF;;;ACRO,IAAM,0BAAyE;AAAA,EACpF,qBAAqB;AAAA,IACnB,MAAQ,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IACjD,WAAa,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IAClE,SAAW,EAAC,QAAS,4BAA2B,MAAO,SAAQ;AAAA,IAC/D,gBAAgB,EAAC,QAAS,yBAAwB,MAAO,SAAQ;AAAA,IACjE,QAAU,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1C,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,aAAe,EAAC,SAAU,6CAA4C,eAAgB,uCAAsC,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,MAAO,CAAC,OAAM,SAAQ,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IACjE,WAAW,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACnD,yBAAyB,EAAC,SAAU,4EAA2E,SAAU,IAAG,MAAO,UAAS;AAAA,IAC5I,SAAW,EAAC,QAAS,+BAA8B,MAAO,SAAQ;AAAA,IAClE,YAAc,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IAC1D,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC5C,MAAQ,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACpD,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,QAAU,EAAC,QAAS,0BAAyB,MAAO,SAAQ;AAAA,IAC5D,eAAiB,EAAC,SAAU,YAAW,MAAO,CAAC,OAAM,YAAW,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IAChG,iBAAiB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAC1D,uBAAuB,EAAC,SAAU,MAAK,MAAO,CAAC,KAAI,KAAI,KAAI,KAAI,MAAK,IAAI,GAAE,MAAO,UAAS;AAAA,IAC1F,QAAU,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IACxD,YAAc,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,OAAM,OAAM,KAAI,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClG,SAAW,EAAC,QAAS,kBAAiB,UAAW,MAAK,MAAO,SAAQ;AAAA,IACrE,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,UAAY,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IAC1D,MAAQ,EAAC,MAAO,CAAC,SAAQ,UAAS,QAAO,OAAM,QAAO,SAAQ,eAAc,OAAM,WAAU,OAAM,OAAM,OAAM,OAAM,SAAS,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9J,QAAU,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IACxD,iBAAiB,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,EAC/D;AAAA,EACA,8BAA8B;AAAA,IAC5B,WAAa,EAAC,QAAS,6BAA4B,MAAO,SAAQ;AAAA,IAClE,SAAW,EAAC,QAAS,4BAA2B,MAAO,SAAQ;AAAA,IAC/D,gBAAgB,EAAC,QAAS,yBAAwB,MAAO,SAAQ;AAAA,IACjE,QAAU,EAAC,QAAS,qBAAoB,WAAY,MAAK,MAAO,SAAQ;AAAA,IACxE,QAAU,EAAC,WAAY,IAAG,MAAO,SAAQ;AAAA,IACzC,QAAU,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC1C,aAAe,EAAC,SAAU,6CAA4C,eAAgB,uCAAsC,MAAO,SAAQ;AAAA,IAC3I,QAAU,EAAC,MAAO,CAAC,OAAM,SAAQ,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IACjE,WAAW,EAAC,QAAS,gBAAe,MAAO,SAAQ;AAAA,IACnD,yBAAyB,EAAC,SAAU,4EAA2E,SAAU,IAAG,MAAO,UAAS;AAAA,IAC5I,SAAW,EAAC,QAAS,+BAA8B,MAAO,SAAQ;AAAA,IAClE,YAAc,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IAC1D,OAAS,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAClD,SAAW,EAAC,QAAS,uBAAsB,MAAO,SAAQ;AAAA,IAC1D,UAAY,EAAC,WAAY,KAAI,MAAO,SAAQ;AAAA,IAC5C,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,eAAiB,EAAC,SAAU,YAAW,MAAO,CAAC,OAAM,YAAW,UAAS,MAAM,GAAE,MAAO,SAAQ;AAAA,IAChG,iBAAiB,EAAC,QAAS,iBAAgB,MAAO,SAAQ;AAAA,IAC1D,uBAAuB,EAAC,SAAU,MAAK,MAAO,CAAC,KAAI,KAAI,KAAI,KAAI,MAAK,IAAI,GAAE,MAAO,UAAS;AAAA,IAC1F,QAAU,EAAC,QAAS,sBAAqB,MAAO,SAAQ;AAAA,IACxD,YAAc,EAAC,SAAU,WAAU,MAAO,CAAC,WAAU,OAAM,OAAM,KAAI,OAAM,MAAM,GAAE,MAAO,SAAQ;AAAA,IAClG,QAAU,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,IACtD,iBAAiB,EAAC,QAAS,oBAAmB,MAAO,SAAQ;AAAA,EAC/D;AACF;;;ACzDO,IAAM,yBAAwE;AAAA,EACnF,8BAA8B;AAAA,IAC5B,kBAAkB,EAAC,SAAU,iDAAgD,eAAgB,mDAAkD,MAAO,SAAQ;AAAA,IAC9J,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,qBAAqB,EAAC,SAAU,uBAAsB,MAAO,CAAC,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IACtH,eAAe,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,qEAAoE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,IACzN,MAAQ,EAAC,WAAY,MAAK,WAAY,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,EACzE;AAAA,EACA,qDAAqD;AAAA,IACnD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IAC9I,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,EACjF;AAAA,EACA,iDAAiD;AAAA,IAC/C,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,gBAAgB,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAChD,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IAC9I,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IAC/E,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,IACrD,QAAU,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAC5C;AAAA,EACA,oDAAoD;AAAA,IAClD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,UAAW,MAAK,MAAO,SAAQ;AAAA,IACvF,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IAC/E,KAAO,EAAC,SAAU,mmHAAsmH,eAAgB,qmHAAwmH,UAAW,MAAK,MAAO,SAAQ;AAAA,EACjxO;AAAA,EACA,2CAA2C;AAAA,IACzC,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,MAAQ,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC7K,QAAU,EAAC,MAAO,CAAC,gBAAe,WAAU,kBAAkB,GAAE,MAAO,SAAQ;AAAA,IAC/E,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,EAC5K;AAAA,EACA,0BAA0B;AAAA,IACxB,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,IAAM,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3K,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,UAAY,EAAC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC5C,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,EAChL;AAAA,EACA,yBAAyB;AAAA,IACvB,yBAAyB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,IAClL,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,aAAa,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IAC1D,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,IAAM,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3K,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,2KAA0K,eAAgB,+JAA8J,MAAO,SAAQ;AAAA,IACxZ,WAAW,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACxD,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC/J,aAAa,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IACrP,gBAAgB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IACrL,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC1E,iBAAiB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC9C,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AAAA,EACA,2BAA2B;AAAA,IACzB,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,IAAM,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC3K,aAAa,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACpE,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,kBAAkB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC/C,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,UAAW,MAAK,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AAAA,EACA,oCAAoC;AAAA,IAClC,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,eAAc,iBAAgB,kBAAiB,aAAY,eAAc,cAAa,eAAc,gBAAe,eAAc,cAAa,eAAc,UAAS,qBAAoB,UAAS,oBAAmB,2BAA0B,wBAAwB,GAAE,MAAO,QAAO;AAAA,IAChU,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,qBAAqB,EAAC,SAAU,uBAAsB,MAAO,CAAC,mBAAkB,qBAAqB,GAAE,MAAO,SAAQ;AAAA,IACtH,eAAe,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,qEAAoE,eAAgB,gEAA+D,MAAO,SAAQ;AAAA,EAC3N;AAAA,EACA,2DAA2D;AAAA,IACzD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,UAAS,WAAU,WAAU,gBAAe,UAAS,aAAa,GAAE,MAAO,QAAO;AAAA,IACjH,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,EAChJ;AAAA,EACA,uDAAuD;AAAA,IACrD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,UAAS,WAAU,WAAU,UAAS,eAAc,YAAW,QAAO,UAAU,GAAE,MAAO,QAAO;AAAA,IAC/H,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IACzI,eAAe,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,QAAO;AAAA,IAC9I,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,YAAW,YAAW,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7E,MAAQ,EAAC,SAAU,OAAM,SAAU,GAAE,MAAO,UAAS;AAAA,EACvD;AAAA,EACA,0DAA0D;AAAA,IACxD,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,WAAU,UAAS,QAAO,QAAQ,GAAE,MAAO,QAAO;AAAA,IAC3F,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,QAAU,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IACvE,KAAO,EAAC,SAAU,mmHAAsmH,eAAgB,qmHAAwmH,MAAO,SAAQ;AAAA,EACjwO;AAAA,EACA,iDAAiD;AAAA,IAC/C,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,WAAU,gBAAe,kBAAiB,eAAc,kBAAiB,QAAO,QAAQ,GAAE,MAAO,QAAO;AAAA,IACjJ,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,MAAQ,EAAC,SAAU,OAAM,MAAO,CAAC,OAAM,KAAK,GAAE,MAAO,SAAQ;AAAA,IAC7D,QAAU,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,EAC5K;AAAA,EACA,8BAA8B;AAAA,IAC5B,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,WAAU,WAAU,MAAK,aAAY,aAAY,eAAc,cAAa,eAAc,gBAAe,aAAa,GAAE,MAAO,QAAO;AAAA,IACrK,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,cAAc,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC3C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC1C,gBAAgB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC7C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,eAAe,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC5C,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,EAChK;AAAA,EACA,6BAA6B;AAAA,IAC3B,yBAAyB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9K,kBAAkB,EAAC,MAAO,MAAK,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,QAAO;AAAA,IAClL,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,aAAa,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IAC1D,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,UAAS,SAAQ,WAAU,YAAW,mBAAkB,gBAAe,WAAU,YAAW,YAAW,aAAY,MAAK,aAAY,aAAY,iBAAgB,kBAAiB,iBAAgB,gBAAe,mBAAkB,kBAAiB,kBAAiB,yBAAwB,gBAAgB,GAAE,MAAO,QAAO;AAAA,IAC3V,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,aAAa,EAAC,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACtD,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,2KAA0K,eAAgB,+JAA8J,MAAO,SAAQ;AAAA,IACxZ,WAAW,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACxD,YAAY,EAAC,WAAY,IAAG,WAAY,GAAE,MAAO,SAAQ;AAAA,IACzD,QAAU,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC/J,aAAa,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IACrP,gBAAgB,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IACrK,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9J,kBAAkB,EAAC,SAAU,QAAO,MAAO,CAAC,QAAO,MAAM,GAAE,MAAO,SAAQ;AAAA,IAC1E,iBAAiB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC9C,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AAAA,EACA,+BAA+B;AAAA,IAC7B,SAAW,EAAC,WAAY,KAAI,SAAU,0BAAyB,eAAgB,qBAAoB,MAAO,SAAQ;AAAA,IAClH,QAAU,EAAC,MAAO,MAAK,MAAO,CAAC,mBAAkB,WAAU,YAAW,kBAAiB,MAAK,aAAY,gBAAe,gBAAgB,GAAE,MAAO,QAAO;AAAA,IACvJ,QAAU,EAAC,SAAU,kBAAiB,eAAgB,oBAAmB,MAAO,SAAQ;AAAA,IACxF,aAAa,EAAC,SAAU,KAAI,SAAU,GAAE,SAAU,GAAE,MAAO,UAAS;AAAA,IACpE,IAAM,EAAC,WAAY,KAAI,SAAU,uFAAsF,eAAgB,yFAAwF,MAAO,SAAQ;AAAA,IAC9O,kBAAkB,EAAC,SAAU,GAAE,MAAO,UAAS;AAAA,IAC/C,gBAAgB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,IACxE,OAAS,EAAC,WAAY,IAAG,WAAY,GAAE,SAAU,uCAAsC,eAAgB,yCAAwC,MAAO,SAAQ;AAAA,IAC9J,kBAAkB,EAAC,SAAU,KAAI,SAAU,IAAG,SAAU,GAAE,MAAO,UAAS;AAAA,EAC5E;AACF;;;AC7KO,IAAM,sBAAqE;AAAA,KAC7E;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AAAA,KACA;AACL;;;ApB7BO,IAAM,iBAAiB,CAAC,QAA0C;AAAA,EACvE,MAAM,QAAQ,oBAAoB;AAAA,EAClC,IAAI,UAAU,WAAW;AAAA,IACvB,MAAM,IAAI,MACR,mCAAmC,0DACjC,2DACJ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,iBAAiB,CAC5B,KACA,MACA,aACsB,WAAW,eAAe,GAAG,GAAG,MAAM,EAAE,SAAS,CAAC;AAQnE,IAAM,YAAY,CACvB,KACA,MACA,aAEO,eAAQ,MAAM;AAAA,EACnB,IAAI,QAAQ;AAAA,IAAW,OAAc;AAAA,EACrC,MAAM,QAAQ,eAAe,KAAK,MAAM,QAAQ;AAAA,EAChD,OAAO,MAAM,WAAW,IAAW,cAAc,WAAI,IAAI,MAAM,QAAQ,KAAK,KAAK,CAAC,CAAC;AAAA,CACpF;;;AqBzCI,IAAM,YAAY,CAAC,QAAgB,IAAI,IAAI,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG;AAGrF,IAAM,gBAAgB,EAAE,OAAO,UAAU,OAAO,UAAU,MAAM,QAAQ;AAGxE,IAAM,WAAW;AAGV,IAAM,QAAQ,CAAC,WAAiD;AAAA,EACrE,MAAM,UAAU,MAAM,IAAI;AAAA,EAC1B,OAAO,MAAM;AAAA,GACZ,cAAc,MAAM,QAAQ,MAAM;AACrC;AAGO,IAAM,OAAO,CAAC,WAAiD;AAAA,KACjE,MAAM,KAAK;AAAA,EACd,WAAW,MAAM,cAAc,QAAQ,MAAM;AAC/C;AAGA,IAAM,SAAS,CAAC,SACd,OAAO,YAAY,OAAO,QAAQ,IAAI,EAAE,OAAO,CAAC,MAA6B,EAAE,OAAO,SAAS,CAAC;AAQ3F,IAAM,aAAa,CAAC,UAAoB,UAAU,UAAU,OAAO,KAAK,KAAK,CAAC,GAAG,IAAI;AAGrF,IAAM,WAAW,CAAC,UACvB,CAAC,UAAU,MAAM,IAAI,GAAG,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,EAAE,KAAK,GAAG;AAExE,IAAM,OAAO,CAAC,MAAuD,UACnE,KAAK,KACH,CAAC,QACC,IAAI,SAAS,UAAU,MAAM,IAAI,KACjC,IAAI,SAAS,MAAM,QACnB,IAAI,SAAS,MAAM,QACnB,IAAI,WAAW,MAAM,MACzB;AAMF,IAAM,aAAa,CAAC,QAA8C;AAAA,EAChE,MAAM,QAAQ,IAAI;AAAA,EAClB,OAAO,UAAU,aAAa,UAAU,KAAK,UAAU,QAAQ,UAAU;AAAA;AAGpE,IAAM,eAAe,CAC1B,MACA,UACkB;AAAA,EAClB,MAAM,MAAM,KAAK,MAAM,KAAK;AAAA,EAC5B,OAAO;AAAA,IACL,OAAO,QAAQ;AAAA,IACf,MAAM,UAAU,MAAM,IAAI;AAAA,IAC1B,WAAW,QAAQ,aAAa,WAAW,GAAG;AAAA,IAC9C,QAAQ,MAAM;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,EACd;AAAA;AAGK,IAAM,UAAU,CAAC,YAA2B,UACjD,WAAW,SAAS,WAAW,eAAe,MAAM,cAAc;;;AC5BpE;AACA;AAEA,wBAAS;AAET;;;ACdA;AACA;AACA;AACA;;;AC2GA,IAAM,aAAa;AAEZ,IAAM,WAAW,CAAC,QAAmB,SAA0B;AAAA,EACpE,IAAI,OAAO,WAAW;AAAA,IAAO,OAAO;AAAA,EACpC,MAAM,OAAO,OAAO,QAAQ;AAAA,EAC5B,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,IAAI,CAAC,WAAW,KAAK,IAAI,GAAG;AAAA,IAC1B,MAAM,IAAI,MACR,mBAAmB,UAAU,KAAK,UAAU,IAAI,2CAC9C,4FACA,gFACJ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;AC/JT;AACA;AACA;AACA;AACA;AACA;;;ACVA;AAAA;AAwBO,MAAM,4BAAiC,iBAAY,qBAAqB,EAW5E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,mBAAmB,KAAK,eAAe,KAAK,gBAAgB,KAAK,6BACjE;AAAA;AAGN;;;AD1BA,IAAM,cAAc,CAAC,KAAqB,SACxC,IAAI,OAAO,WAAW,IAAI,SAAS,WAAW;AA4BzC,IAAM,OAAO,CAAC,QAAmB,MAAe,MAAsB,QAAQ,QAC5E,YAAI,UAAU,GAAG;AAAA,EAItB,MAAM,OAAO,SAAS,QAAQ,IAAI;AAAA,EAClC,MAAM,OAAO,GAAG,OAAO,eAAe;AAAA,EAGtC,MAAM,SAAS,CAAC,SAAgB,WAC9B,IAAI,MAAM,mBAAmB,WAAW,YAAW,IAAI,gBAAgB,YAAW,QAAQ;AAAA,EAC5F,MAAM,UACJ,YAAY,KAAK,YAAY,KAAK,YAAY,KAAK,MAAM,KAAK;AAAA,EAChE,MAAM,SAAS,QAAQ,WAAW,SAAS,IAAI,QAAQ,MAAM,UAAU,MAAM,IAAI;AAAA,EACjF,MAAM,OAAO,WAAW,YAAY,QAAQ,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAClE,MAAM,UAAkC,EAAE,mBAAmB,OAAO;AAAA,EACpE,MAAM,YAAY,YAAY,KAAK,WAAW;AAAA,EAC9C,IAAI,cAAc;AAAA,IAAI,QAAQ,uBAAuB;AAAA,EACrD,MAAM,QAAQ,YAAY,KAAK,OAAO;AAAA,EACtC,IAAI,UAAU;AAAA,IAAI,QAAQ,mBAAmB;AAAA,EAC7C,IAAI,WAAW,aAAa,EAAE,SAAS,aAAa;AAAA,IAClD,OAAO,OAAc,aAAK,OAAO,GAAG,oDAAoD,CAAC;AAAA,EAC3F;AAAA,EAEA,MAAM,SAAS,OAAkB;AAAA,EAGjC,MAAM,WAAW,OAAe;AAAA,EAChC,MAAM,WAAkB,iBACtB,OAAc,sBAA8B,2BAAW,GACvD,OAAO,CAAC,EACV;AAAA,EACA,MAAM,UAA4B,sBAAI,GAAG,WAAW,MAAM,EAAE,KACxC,6BAAW,OAAO,CACtC;AAAA,EACA,MAAM,WAAW,OAAO,QAAQ,OAAO,EAAE,KAChC,gBAAQ,CAAC,aACP,YAAI,SAAS,MAAM,CAAC,WAAU,EAAE,QAAQ,SAAS,QAAQ,YAAK,EAAE,CACzE,GAEO,gBAAQ,YAAY,GACpB,uBAAuB,8BAAsB,CAAC,GAAG,UAAU,eAAe,CAAC,CACpF;AAAA,EAKA,MAAM,OAAoD,KAAK,UAAU,MAAM,OAAO;AAAA,EACtF,QAAQ,QAAQ,SAAS,QACvB,WAAW,YACP,WACO,uBAAe,UAA0B,6BAAa,IAAI,GACrE,KAEO,iBAAS,CAAC,UAAU,OAAO,GAAG,MAAM,OAAO,CAAC,CACrD;AAAA,EAEA,IAAI;AAAA,EAOJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,IAAI;AAAA,IACxB,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,EAEX,IAAI,SAAS,OAAO,UAAU,KAAK;AAAA,IACjC,MAAM,SAAS,QAAQ;AAAA,IACvB,MAAM,gBAAgB,MAAM,QAAQ,MAAM;AAAA,IAC1C,MAAM,SAAS,gBAAgB,OAAO,IAAI,MAAM,EAAE,KAAK,IAAI,IAAI;AAAA,IAY/D,IAAI,WAAW,OAAO,eAAe;AAAA,MACnC,OAAO,OAAc,aAAK,IAAI,oBAAoB,EAAE,QAAQ,OAAO,OAAO,OAAO,KAAK,CAAC,CAAC;AAAA,IAC1F;AAAA,IACA,OAAO,OAAc,aAAK,OAAO,QAAQ,UAAU,mBAAmB,CAAC;AAAA,EACzE;AAAA,EACA,MAAM,UAAU,QAAQ,MAAM;AAAA,EAC9B,MAAM,SAAS,QAAQ,MAAM;AAAA,EAC7B,IAAI,OAAO,YAAY,YAAY,OAAO,WAAW,UAAU;AAAA,IAE7D,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,eAAe,iEACvB,kCAAkC,OAAO,gDACzC,kFACJ,CACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,QAAQ;AAAA,EACtB,MAAM,eAAe,OAAO,UAAU,WAAW,QAAQ;AAAA,EACzD,OAAO,EAAE,cAAc,QAAQ,QAAQ;AAAA,CACxC;AAQI,IAAM,gBAAgB,CAAC,YAA2B,WACvD,OAAO,WAAW,QACd,eAAe,WAAW,WAAW,WAAW,WAChD,eAAe,WAAW,WAAW,WAAW;;;AF/FtD,IAAM,wBAAwB;AA4CvB,IAAM,QAAQ,CAAC,QAAmB,UAA6B;AAAA,EACpE,OAAO,OAAO;AAAA,EACd,QAAQ,OAAO;AAAA,EACf,MAAM,SAAS,QAAQ,IAAI;AAC7B;AAWO,IAAM,aAAa,CAAC,SACpB,eAAU,IAAI,KAAK,KAAK,MAAM,eAAe,wBACrC,iBAAQ,KAAK,MAAM,eAAe,qBAAqB,IACvD;AAcR,IAAM,aAAa,CAAO,YACzB,eAAS,SAAS,EAAE,UAAU,IAAI,mBAAmB,UAAU,WAAW,CAAC;AAoB5E,IAAM,eAAe,CAAC,QAC3B,IAAI,WAAW,QACX,EAAE,KAAK,iCAAiC,OAAO,IAAI,OAAO,QAAQ,MAAM,IACxE,EAAE,SAAS,CAAC,GAAG,OAAO,IAAI,OAAO,OAAO,EAAE,MAAM,IAAI,KAAK,GAAG,QAAQ,MAAM;AAczE,IAAM,aAAa,CAAC,KAAe,MAAsB,QAAQ,QACtE,KAAK,aAAa,GAAG,GAAG,IAAI,WAAW,QAAS,IAAI,OAAmB,QAAQ,GAAG;AAEpF,IAAM,SAAgB,gBAAQ,WAAW,UAAU,CAAC;AAS7C,IAAM,SAAS,CAAC,QAAmB,SAAwB,UAAI,QAAQ,MAAM,QAAQ,IAAI,CAAC;;;AI3LjG;AAEA;AACA;AACA;AACA;AAKO,IAAM,eAAe;AAGrB,IAAM,aAAa,CAAC,WAAmB,WAAW,UAAU,OAAO,YAAY;AAgB/E,IAAM,iBAAiC;AAG9C,IAAM,kBAAkB,IAAI;AAKrB,IAAM,iBAAiB,CAAC,QAAmB,WAAmB;AAAA,EACnE,gBAAgB,IAAI,OAAO,OAAO,MAAM;AAAA;AAInC,IAAM,iBAAiB,CAAC,WAAyC;AAAA,EACtE,MAAM,YAAY,gBAAgB,IAAI,OAAO,KAAK;AAAA,EAClD,IAAI,cAAc,aAAa,CAAC,OAAO,QAAQ,SAAS,SAAS;AAAA,IAAG,OAAO,OAAO;AAAA,EAClF,OAAO,CAAC,WAAW,GAAG,OAAO,QAAQ,OAAO,CAAC,WAAW,WAAW,SAAS,CAAC;AAAA;AAG/E,IAAM,YAAY,CAAC,UAAuC;AAAA,EACxD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,IAAI,UAAU,SAAS,OAAO,MAAM,SAAS;AAAA,MAAU,OAAO,MAAM;AAAA,IACpE,IAAI,WAAW;AAAA,MAAO,OAAO,UAAW,MAA6B,KAAK;AAAA,EAC5E;AAAA,EACA;AAAA;AAGF,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,IAAI,SAAS,gBAAgB,SAAS,eAAe,SAAS,2BAA2B;AAAA,IACvF,OAAO;AAAA,EACT;AAAA,EACA,OAAO,iBAAiB,SAAS,qBAAqB,KAAK,MAAM,OAAO;AAAA;AAkB1E,IAAM,iBAAiB,IAAI,IAAI,CAAC,qBAAqB,gBAAgB,aAAa,WAAW,CAAC;AAE9F,IAAM,oBAAoB,CAAC,SACzB,mFAAmF,KAAK,IAAI;AAE9F,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,OAAO,SAAS,cAAc,eAAe,IAAI,IAAI,KAAK,kBAAkB,IAAI;AAAA;AAW3E,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAU,qBAAe,KAAK;AAAA,IAAG,OAAO;AAAA,EACxC,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,MAAM,MAAM,MAAM,OAAO;AAAA,EACzB,OAAO,QAAQ,oBAAoB,QAAQ,qBAAqB,QAAQ;AAAA;AASnE,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,QAAQ,WAAW;AAAA,EACnB,IAAI,OAAO,SAAS,qBAAqB,OAAO,SAAS;AAAA,IAAe,OAAO;AAAA,EAC/E,IAAI,OAAO,SAAS,kBAAkB;AAAA,IACpC,IAAI,eAAe,OAAO,KAAK;AAAA,MAAG,OAAO;AAAA,IACzC,OAAO,eAAe,OAAO,KAAK;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,oBAAoB,CAAC,UAA2B;AAAA,EAC3D,IAAU,qBAAe,KAAK;AAAA,IAAG,OAAO,mBAAmB,OAAO,cAAc;AAAA,EAChF,IAAoB,kCAAkB,KAAK;AAAA,IAAG,OAAO,MAAM;AAAA,EAC3D,OAAO,OAAO,KAAK;AAAA;AAwBd,IAAM,mBAAmB,CAC9B,QACA,QACA,MACA,OACA,WAA0B,mBAWnB,YAAI,UAAU,GAAG;AAAA,EActB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,UAAU,WAAW;AAAA,EAC3B,MAAM,WAA4B,CAAC;AAAA,EACnC,WAAW,UAAU,eAAe,MAAM,GAAG;AAAA,IAC3C,MAAM,UAAU,OAAO,OACpB,QAAQ,MAAM,WAAW,MAAM,CAAC,CAAC,EACjC,KAAY,gBAAQ,QAAO,GAAU,cAAM;AAAA,IAC9C,IAAW,iBAAU,OAAO,GAAG;AAAA,MAC7B,eAAe,QAAQ,MAAM;AAAA,MAC7B,OAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,MAAM,kBAAkB,QAAQ,OAAO;AAAA,IAC7C,SAAS,KAAK,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,MAAM,WAAW,UACb,mBAAmB,QAAQ,OAAO,IAClC,mBAAmB,QAAQ,OAAO;AAAA,IACtC,IAAI,CAAC,UAAU;AAAA,MACb,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,IAC/E;AAAA,EACF;AAAA,EACA,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,CAC9E;;;ALpII,MAAM,4BAA4B,MAAM;AAAA,EACxB;AAAA,EAArB,WAAW,CAAU,UAAoC;AAAA,IACvD,MAAM,uBAAuB,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG;AAAA,IADpE;AAAA,IAEnB,KAAK,OAAO;AAAA;AAEhB;AAeO,IAAM,aAAa,CACxB,QACA,YACA,SACA,IACA,WAA0B,mBAEnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAA4B,CAAC;AAAA,EACnC,WAAW,UAAU,eAAe,MAAM,GAAG;AAAA,IAC3C,MAAM,YAAY,wBAAwB;AAAA,MACxC,SAAS,WAAW,MAAM;AAAA,MAC1B,QAAQ,WAAW;AAAA,MACnB,SAAS,WAAW;AAAA,IACtB,CAAC;AAAA,IACD,MAAM,UAAU,OAAO,GAAG,KACX,mBACN,gBAAQ,SAAS,GACjB,gBAAQ,QAAO,GACf,cACT;AAAA,IACA,IAAW,kBAAU,OAAO,GAAG;AAAA,MAC7B,eAAe,QAAQ,MAAM;AAAA,MAC7B,OAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,WAAW,UACb,mBAAmB,QAAQ,OAAO,IAClC,mBAAmB,QAAQ,OAAO;AAAA,IACtC,IAAI,CAAC;AAAA,MAAU,OAAO,OAAc,aAAK,QAAQ,OAAO;AAAA,IACxD,SAAS,KAAK,EAAE,QAAQ,KAAK,kBAAkB,QAAQ,OAAO,EAAE,CAAC;AAAA,EACnE;AAAA,EACA,OAAO,OAAc,aAAK,IAAI,oBAAoB,QAAQ,CAAC;AAAA,CAC5D;AAiBI,IAAM,SAAS,CACpB,QACA,MACA,SACA,OAMO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,WAAW,QAAQ,YAAY,SAAS,EAAE;AAAA,CACzD;;;AMpIH;AAIO,IAAM,aAAa,OAAO,gBAAgB;AAc1C,IAAM,mBAAmB,CAC9B,WAEA,OAAO,KAAY,iBAAS,uBAAuB,MAAa,gBAAQ,UAAU,CAAC,CAAC;AAe/E,IAAM,oBAAoB,CAC/B,MACA,WACA,OACA,SAEO,mBACL,GAAG,QAAQ,0BAAyB,eAAe,yCACjD,+FACA,uEACJ;;;A7B2BK,IAAM,aAAa,SAAqB,aAAa;AAgB5D,IAAM,iBAAiB,CAAC,UACtB,iBAAiB,OAAO,MAAM,QAAQ,aAAa,OAAc,qBAAc,CAAC,CAAC,CAAC,CAAC,EAAE,KAC5E,YAAI,CAAC,SAAU,SAAS,aAAa,aAAa,aAAa,MAAM,KAAK,CAAE,CACrF;AAGF,IAAM,iBAAiB,CAAC,SACtB,SAAS,aAAa,YAAY;AAE7B,IAAM,qBAAqB,MACvB,gBACP,YACO,gBACL,WAAW,SAAS,GAAG;AAAA,EAErB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,WAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,GAClD;AAAA,EAQD,MAAa,WAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,WAAW,aAAa,WAAW,IAAI,KAAK,SAAS,IAAI,MAAM,SAAS,MAAM,GAAG;AAAA,MACnF,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,IAAI,CAAC,WAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,WAAW,IAAI;AAAA,IACtB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IAGvC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBACL,eACA,SAAS,IAAI,GACb,KAAK,OAAO,OACZ,SAAS,KAAK,QAAQ,WAAW,CACnC;AAAA,MACA,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,OAAO,SAAS,aAAa,QAAQ,MAAM,IAAI,IAC1C,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAOD,WAAkB,WAAG,UAAU,GAAG,QAAQ;AAAA,IAIxC,MAAM,SAAS,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,IACzD,OAAO,WAAW,IAAI;AAAA,IACtB,IAAI,WAAW,aAAa,CAAC,QAAQ,QAAQ,IAAI,GAAG;AAAA,MAClD,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,oBAAa,KAAK,IAAI,CAAC,CAAC;AAAA,IAC/E;AAAA,IACA,MAAM,QAAQ,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,IACxD,IAAI,UAAU,aAAa,CAAC,MAAM,OAAO;AAAA,MACvC,OAAO,OAAc,YACnB,IAAI,MACF,+CAA+C,SAAS,IAAI,oBAC1D,8EACA,kFACA,qDACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EASD,QAAe,WAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,MAAM,UAAsC,KAAK,MAAM,IAAI,GAAG,QAAQ,IAAI;AAAA,IAC1E,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,oBAAa,OAAO,CAAC;AAAA,GAC3E;AACH,CAAC,CACH,CACF;;A8B/JF,IAAM,UAAU,CAAC,OAAe,UAA0B;AAAA,EACxD,IAAI,SAAS,KAAK,KAAK,KAAK,UAAU,IAAI;AAAA,IACxC,MAAM,IAAI,MACR,0BAA0B,sDAC5B;AAAA,EACF;AAAA,EACA,OAAO,KAAK,UAAU,KAAK;AAAA;AAQ7B,IAAM,cAAc,CAAC,UAA0B;AAAA,EAC7C,MAAM,OAAO,QAAQ,gBAAgB,KAAK;AAAA,EAC1C,IAAI,WAAW;AAAA,EACf,IAAI;AAAA,IACF,WAAW,IAAI,IAAI,KAAK,EAAE;AAAA,IAC1B,MAAM;AAAA,EAGR,IAAI,aAAa,YAAY,aAAa,SAAS;AAAA,IACjD,MAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAAA,EACA,OAAO;AAAA;AAIT,IAAM,eAAqE;AAAA,EACzE,CAAC,YAAY,MAAM;AAAA,EACnB,CAAC,UAAU,QAAQ;AAAA,EACnB,CAAC,aAAa,WAAW;AAAA,EACzB,CAAC,YAAY,UAAU;AACzB;AAeO,IAAM,wBAAwB,CAAC,UAAmC,CAAC,MAAc;AAAA,EACtF,MAAM,YAAY,QAAQ,aAAa,QAAQ,aAAa,iBAAiB;AAAA,EAC7E,MAAM,SAAS,QAAQ,UAAU,QAAQ,UAAU,KAAK;AAAA,EACxD,MAAM,SAAS,aAAa,IAC1B,EAAE,OAAO,WACP,sBAAsB,WAAW,0BAA0B,kBAC/D;AAAA,EACA,MAAM,OACJ,QAAQ,iBAAiB,YACrB,KACA;AAAA,sBAA0B,YAAY,QAAQ,YAAY;AAAA,EAChE,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA,sBAAsB;AAAA,IACtB,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AAAA,CAAI;AAAA;;AC3Eb,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AC7BO,IAAM,MAAM,CAAC,OAAgB,aAClC,OAAO,UAAU,WAAW,QAAQ;AAE/B,IAAM,OAAO,CAAC,OAAgB,WAAW,OAC9C,OAAO,UAAU,WAAW,QAAQ;AA2B/B,IAAM,OAAO,CAAC,OAAgB,WAAW,UAC9C,UAAU,aAAa,UAAU,QAAQ,UAAU,KAC/C,WACA,UAAU,KAAK,UAAU,QAAQ,UAAU;AAS1C,IAAM,OAAO,CAAC,UAAqB,UAAU,YAAY,YAAY,QAAQ,MAAM;AAUnF,IAAM,MAAM,CAAC,WACjB,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,IAAK,SAAS,CAAC,GACxD,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAYN,IAAM,YAAY,CAAC,UAA2B;AAAA,EACnD,MAAM,QACJ,OAAO,UAAU,WACb,MAAM,MAAM,GAAG,IACf,MAAM,QAAQ,KAAK,IACjB,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IAC3C,CAAC;AAAA,EACT,OAAO,MACJ,IAAI,CAAC,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,EACjC,OAAO,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,EAClC,KAAK,CAAC,MAAM,UAAU,OAAO,KAAK,EAClC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,EACtB,KAAK,GAAG;AAAA;AAIN,IAAM,iBAAiB,CAAC,QAAgB;AAAA,EAC7C,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAAA,EACvC,IAAI,CAAC,KAAK,OAAO,QAAQ,IAAI,EAAE,SAAS,OAAO;AAAA,IAAG,OAAO;AAAA,EACzD,IAAI,CAAC,KAAK,MAAM,SAAS,KAAK,EAAE,SAAS,OAAO;AAAA,IAAG,OAAO;AAAA,EAC1D,OAAO;AAAA;AAmBF,IAAM,iBAAiB,CAAC,OAAgB,eAAgC;AAAA,EAC7E,MAAM,QACJ,OAAO,UAAU,WACb,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS;AAAA,IAC7B,OAAO,QAAQ,QAAQ,KAAK,MAAM,GAAG;AAAA,IACrC,OAAO,KAAK,WAAW,KAAK,eAAe,YACvC,CAAC,YAAY,OAAO,EAAE,IACtB,CAAC,OAAO,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,GAC/B,IACD,OAAO,UAAU,YAAY,UAAU,OACrC,OAAO,QAAQ,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC,IAChE,CAAC;AAAA,EACT,OAAO,MACJ,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,KAAK,GAAG,eAAe,KAAK,CAAC,CAAU,EAClE,OAAO,EAAE,SAAS,QAAQ,EAAE,EAC5B,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,EACvC,KAAK,EACL,KAAK,GAAG;AAAA;AAWN,IAAM,MAAM,CAAC,OAAgB,aAAqB;AAAA,EACvD,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,SAAS,OAAO,SAAS,KAAK,KAAK,GAAG,EAAE;AAAA,EAC9C,OAAO,OAAO,MAAM,MAAM,IAAI,WAAW;AAAA;AA6BpC,IAAM,aAAa,CACxB,QACA,UAC2B;AAAA,EAC3B,MAAM,UAAU,IAAI,IAAI,KAAK;AAAA,EAC7B,MAAM,OAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;AAAA,IACjD,IAAI,UAAU,aAAa,CAAC,QAAQ,IAAI,GAAG;AAAA,MAAG,KAAK,OAAO;AAAA,EAC5D;AAAA,EACA,OAAO,QAAQ,SAAS,IAAI,OAAO,KAAK,MAAM,QAAQ,CAAC,GAAG,OAAO,EAAE,KAAK,GAAG,EAAE;AAAA;;;AC/KxE,IAAM,mBAAmB;AAczB,IAAM,cAAc,CAAC,UAAyB,GAAG,MAAM,UAAU,MAAM;AAgBvE,IAAM,QAAQ,CAAC,WAA4D;AAAA,EAChF,SAAS,MAAM,WAAW;AAAA,EAC1B,QAAQ,OAAO,MAAM,MAAM;AAAA,EAC3B,SAAS,MAAM,UAAU,MAAM;AAAA,EAC/B,SAAS,MAAM;AAAA,EACf,QAAQ,MAAM;AAChB;AAaO,IAAM,gBAAe,CAC1B,MACA,UACmC;AAAA,EACnC,IAAI,KAAK,WAAW,aAAa,KAAK,YAAY;AAAA,IAAW;AAAA,EAC7D,OAAO;AAAA,IACL,SAAS,KAAK,KAAK,OAAO;AAAA,IAC1B,QAAQ,IAAI,KAAK,QAAQ,CAAC;AAAA,IAC1B,aAAa,YAAY,KAAK;AAAA,IAG9B,SAAS,KAAK,KAAK,SAAS,IAAI;AAAA,IAChC,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,EAChB;AAAA;AAQK,IAAM,WAAU,CAAC,YAAgC,UACtD,WAAW,aAAa,MAAM,WAAW,OACzC,WAAW,WAAW,MAAM,UAC5B,WAAW,YAAY,MAAM;;;AC3ExB,IAAM,UAAS,CAAC,SACrB,OAAO,YACL,OAAO,QAAQ,IAA+B,EAAE,OAC9C,CAAC,MAA6B,OAAO,EAAE,OAAO,QAChD,CACF;AAOK,IAAM,cAAa,CACxB,UACA,MACA,aACwB,UAAU,UAAU,QAAO,IAAI,GAAG,QAAQ;;;AHmG7D,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAYD,IAAM,YAAY,CAAC,UAAyB;AAAA,EAC1C,MAAM,QAAQ,EAAE,SAAS,MAAM,SAAS,QAAQ,MAAM,OAAO;AAAA,EAC7D,OAAO,iBACL,OAAO,MAAM,QAAQ,aAAa,OAAc,2BAAmB,KAAK,CAAC,CAC3E,EAAE,KAAY,YAAI,CAAC,SAAU,SAAS,aAAa,aAAa,cAAa,MAAM,KAAK,CAAE,CAAC;AAAA;AAI7F,IAAM,kBAAiB,CAAC,SACtB,SAAS,aAAa,YAAY;AAQ7B,IAAM,0BAA0B,MAC5B,iBACP,iBACO,gBACL,gBAAgB,SAAS,GAAG;AAAA,EAM1B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,WAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,GAC7C;AAAA,EACD,MAAa,WAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,kBAAkB,MAAM,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,UAAU,IAAI;AAAA,IAGlC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBACL,oBACA,GAAG,KAAK,UAAU,KAAK,WACvB,KAAK,OAAO,OACZ,SAAS,KAAK,QAAQ,WAAW,CACnC;AAAA,MACA,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IAKA,OAAO,SAAS,aAAa,SAAQ,MAAM,IAAI,IAC1C,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,WAAG,UAAU,GAAG,QAAQ;AAAA,IAMxC,MAAM,SAAS,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACpD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,UAAU,KAAK,4DACrB,kFACA,6EACA,kFACA,oFACA,uBACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO,YAAW,kBAAkB,MAAM,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MAC1B,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,2BAAmB,MAAM,IAAI,CAAC,CAAC;AAAA,IACtF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACnD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,UAAU,KAAK,2DACrB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAe,WAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,8BAAsB,EAAE,SAAS,KAAK,SAAS,QAAQ,KAAK,OAAO,CAAC,CAC7E;AAAA,GACD;AACH,CAAC,CACH,CACF;;AIhOF,qBAAS;AACT,uBAAS;AACT;;;ACxBA;AAIO,IAAM,aAAa,CACxB,SACG;AAAA,EAEH,MAAM,cAAc,CAAC,UACnB,OAAO,KAAK,aAAa,aAAa,KAAK,SAAS,KAAK,IAAI,KAAK;AAAA,EAqBpE,MAAM,cAAc,CAAC,OAAc,aAC1B,gBAAQ,MAAM;AAAA,IACnB,MAAM,SAAS,YAAY,KAAK,GAAG;AAAA,IACnC,OAAO,WAAW,YACP,eACP,UAAU,QAAQ,KAAK,WAAW,KAAK,GAAG,QAAQ;AAAA,GACvD;AAAA,EAOH,MAAM,cAAc,CAAC,UACZ,gBAAQ,MAAM;AAAA,IACnB,MAAM,SAAS,YAAY,KAAK,GAAG;AAAA,IACnC,IAAI,WAAW;AAAA,MAAW,OAAc;AAAA,IACxC,MAAM,OAAO,KAAK,aAAa,KAAK;AAAA,IACpC,OAAO,SAAS,YAAmB,eAAO,UAAU,QAAQ,MAAM,KAAK;AAAA,GACxE;AAAA,EAEH,OAAO,EAAE,aAAa,YAAY;AAAA;;;AClC7B,IAAM,aAAa,CACxB,UACA,MACA,OACA,SACsB,SAAQ,MAAM,KAAK,KAAK,OAAO,KAAK,IAAI,EAAE,WAAW,IAAI,YAAY;;;ACL7F,IAAM,SAAQ,CAAC,WAA2B;AAAA,EACxC,KAAK,MAAM,QAAQ,OAAO,MAAM;AAAA,EAChC,SAAS,MAAM,YAAY,QAAQ,MAAM;AAAA,EACzC,MAAM,MAAM,QAAQ;AAAA,EACpB,qBAAqB,MAAM,wBAAwB;AAAA,EACnD,iBAAiB,MAAM,qBAAqB,OAAO,MAAM;AAAA,EACzD,UAAU,MAAM;AAAA,KACZ,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,UAAU,MAAM,OAAO,EAAE;AAAA,KACvE,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC/D,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB,MAAM,kBAAkB;AAAA,KACzF,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,KACnD,MAAM,qBAAqB,YAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,iBAAiB;AAAA,KACtF,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,UAAU,MAAM,IAAI,EAAE;AACpE;AAEO,IAAM,gBAAgB;AAAA,EAQ3B,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,KAAK,KAAK,KAAK,QAAQ,KAAK;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,IAAI;AAAA,IACnC,SAAS,UAAU,KAAK,UAAU;AAAA,IAClC,UAAU,eAAe,KAAK,aAAa,SAAS;AAAA,IACpD,IAAI,MAAM;AAAA,IACV,MAAM,KAAK,KAAK,SAAS,UAAU;AAAA,IACnC,YAAY,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;AAAA,IACtE,kBAAkB,KAAK,KAAK,mBAAmB,EAAE;AAAA,IACjD,qBAAqB,KAAK,KAAK,sBAAsB,MAAM;AAAA,IAC3D,MAAM,KAAK,KAAK,SAAS,EAAE;AAAA,IAC3B,iBAAiB,eAAe,KAAK,gBAAgB;AAAA,IACrD,iBAAiB,KAAK,KAAK,kBAAkB,KAAK;AAAA,IAClD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IACnC,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,MAAM,UAAU,KAAK,OAAO;AAAA,EAC9B;AAAA,EACA,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA,EAGxD,UAAU,EAAE,QAAQ,4BAA4B,QAAQ,+BAA+B;AAAA,EACvF,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,YAC9B,WAAW,aAAa,MAAM,YAAY,UAC1C,WAAW,SAAS,MAAM,QAAQ,SAClC,WAAW,UAAU,MAAM,QAAQ,eACnC,WAAW,0BAA0B,MAAM,wBAAwB,WACnE,WAAW,sBAAsB,MAAM,qBAAqB,UAC3D,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,SAAS,aAAa,WAAW,SAAS,UAAU,MAAM,IAAI,OACpE,MAAM,YAAY,aAAa,WAAW,YAAY,UAAU,MAAM,OAAO,OAC7E,MAAM,sBAAsB,aAC3B,WAAW,sBAAsB,MAAM,uBACxC,MAAM,qBAAqB,aAC1B,WAAW,qBAAqB,eAAe,MAAM,gBAAgB,OACtE,MAAM,aAAa,aAClB,WAAW,aAAa,eAAe,MAAM,UAAU,SAAS;AAAA,EACpE,MAAM,CAAC,UAAU,kBAAkB,MAAM;AAAA,EACzC,YAAY;AACd;;;AC7FA;AACA;AACA;AACA;AAMO,IAAM,mBAAmB,CAC9B,OACA,OAAO,cAAc,WAAW,KAAK,MACD;AAAA,EACpC;AAAA,IACE,kBAAkB;AAAA,IAClB,qBAAqB;AAAA,IACrB,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,OACd;AAAA,MACD;AAAA,EACJ,OAAO;AAAA,OACF;AAAA,IACH,IAAI,MAAM;AAAA,IACV;AAAA,IACA;AAAA,OACI,mBAAmB,YAAY,CAAC,IAAI,EAAE,eAAe;AAAA,OACrD,kBAAkB,YAAY,CAAC,IAAI,EAAE,cAAc;AAAA,EACzD;AAAA;AAQK,IAAM,gBAAgB,CAAC,UAC5B,OAAO,MAAM,QAAQ,QAAQ,OAAe,yBAAiB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAGvE,iBAAQ,CAAC,SACP,2BAA2B,cAAe,gCAAwB,CAAC,EAAE;AAAA,KACvE;AAAA,EACH,eAAe;AAAA,EACf,UAAU;AACZ,CAAC,EAAE,KACM,kBACL,MACE,IAAI,kBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC,CACL,GACO,YAAG,IAAI,CAChB,CACF,GACO,aAAI,CAAC,SACV,cAAc,WACZ;AAAA,KACK;AAAA,EACH,YAAY,KAAK;AAAA,EACjB,kBAAkB,KAAK;AAAA,EACvB,qBAAqB,KAAK;AAAA,EAC1B,iBACE,OAAO,KAAK,kBAAkB,YAAY,KAAK,kBAAkB,OAC7D,OAAO,YACL,OAAO,QAAQ,KAAK,aAAa,EAAE,IAAI,EAAE,KAAK,WAAW;AAAA,IACvD,IAAI,WAAW,KAAK,GAAG;AAAA,IACvB;AAAA,EACF,CAAC,CACH,IACA,KAAK;AAAA,EACX,iBAAiB,KAAK;AACxB,GACA,KACF,CACF,GACO,kBAAS,qBAAqB,MAAa,iBAAQ,SAAS,CAAC,GAC7D,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAEK,IAAM,kBAAkB,CAAC,UAC9B,OAAO,MAAM,QAAQ,aAAa,MAAc,4BAAoB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC9E,kBAAS,qBAAqB,MAAa,aAAI,GAC/C,kBAAS,YAAY,MAAa,aAAI,CAC/C;;;AJ9CF;AACA;AAqEO,IAAM,mBAAmB,UAA2B,mBAAmB;AAO9E,MAAQ,aAAa,gBAAgB,WAAW,aAAa;AAGtD,IAAM,2BAA2B,MAC7B,iBACP,kBACO,iBACL,iBAAiB,SAAS,GAAG;AAAA,EAC3B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,cAAc,IAAI;AAAA,EACtC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,YAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,cAAc,IAAI;AAAA,IACtC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,cAAc,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GACxE;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,cAAc,IAAI;AAAA,IACtC,OAAO,YAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,YAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OACL,KAAK,QACL,aACA,MACQ,6BAAoB,iBAAiB,IAAI,CAAC,CACpD;AAAA,IACF,EAAO;AAAA,MACL,MAAM,OAAO,WACX,cAAc,SACd,MACA,MACA,cAAc,WAAW,IAAI,CAC/B;AAAA,MACA,IAAI,SAAS;AAAA,QACX,OAAO,OACL,KAAK,QACL,aACA,MACQ,0BAAiB,iBAAiB,MAAM,IAAI,CAAC,CACvD;AAAA;AAAA,IAEJ,MAAM,QAAQ,OAAO,cAAc,IAAI;AAAA,IACvC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MACF,GAAG,cAAc,KAAK,IAAI,4DAC5B,CACF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAAW,gBAAgB,IAAI;AAC5C,CAAC,CACH,CACF;;AK5HF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACPO,IAAM,mBAAkE;AAAA,EAC7E,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACP;AAQO,IAAM,WAAW,CAAC,UAA2B,MAAM,QAAQ,MAAM;AAQjE,IAAM,iBAAiB,CAAC,UAA2B,SAAS,MAAM,aAAa,MAAM;AAGrF,IAAM,aAAa,CAAC,UAA2B,GAAG,eAAe,KAAK,KAAK,SAAS,KAAK;AAezF,IAAM,aAAa,CAAC,UAAmD;AAAA,EAC5E,IAAI,MAAM,SAAS,SAAS,MAAM,mBAAmB,WAAW;AAAA,IAC9D,OAAO,EAAE,eAAe,MAAM,eAAe;AAAA,EAC/C;AAAA,EACA,MAAM,aAAa,MAAM,SAAS,QAAQ,KAAK,MAAM,UAAU,IAAI;AAAA,EACnE,OAAO,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AAAA;AAU/C,IAAM,UAAU,CAAC,MAAe,WACpC,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAC5B,OAAO,CAAC,QAAwC,OAAO,QAAQ,YAAY,QAAQ,IAAI,EACvF,KAAK,CAAC,QAAQ,IAAI,YAAY,SAAS,KAAK,CAAC;AAY3C,IAAM,mBAAmB,CAC9B,MACA,UACqC;AAAA,EACrC,MAAM,MAAM,QAAQ,MAAM,KAAK;AAAA,EAC/B,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,OAAO;AAAA,IACL,MAAM,KAAK,IAAI,OAAO;AAAA,IACtB,QAAQ,KAAK,IAAI,UAAU;AAAA,IAC3B,MAAM,KAAK,IAAI,OAAO;AAAA,IACtB,MAAM,MAAM;AAAA,IACZ,MAAM,SAAS,KAAK;AAAA,IACpB,MAAM,MAAM;AAAA,IACZ,QAAQ,KAAK,IAAI,SAAS;AAAA,IAC1B,MAAM,IAAI,IAAI,SAAS,EAAE;AAAA,IACzB,SAAS,KAAK,IAAI,UAAU;AAAA,IAC5B,eAAe,KAAK,IAAI,iBAAiB;AAAA,IACzC,OAAO,KAAK,IAAI,QAAQ;AAAA,IACxB,SAAS,KAAK,IAAI,qBAAqB;AAAA,EACzC;AAAA;;;ACxHF;AACA;AAcA,IAAM,WAAW,CAAC,UAA2B;AAAA,EAC3C,MAAM,OAAO,MAAM;AAAA,EACnB,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAgB,EAAE,KAAK,CAAC,CAAC,EAAE,KACnE,aAAI,CAAC,SAAoB,IAAI,CACtC;AAAA,SACG;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAgB,EAAE,KAAK,CAAC,CAAC,EAAE,KACnE,aAAI,CAAC,SAAoB,IAAI,CACtC;AAAA,SACG;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAgB,EAAE,KAAK,CAAC,CAAC,EAAE,KACnE,aAAI,CAAC,SAAoB,IAAI,CACtC;AAAA;AAAA;AAKC,IAAM,aAAa,CAAC,UACzB,SAAS,KAAK,EAAE,KACP,aAAI,CAAC,SAAS,iBAAiB,MAA4C,KAAK,CAAC,CAC1F;AAGK,IAAM,eAAe,CAAC,UAA2B;AAAA,EACtD,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,KAAK,SAAS,KAAK;AAAA,EACzB,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,OACL,MAAM,QACN,aACA,MACM,wBAAkB;AAAA,WAClB,MAAM,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,eAAe;AAAA,QAClF,OAAO;AAAA,QACP;AAAA,MACF,CAAC,CACH;AAAA,SACG;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,IAAI,KAAK,CAAC,CAAC;AAAA,SACjF;AAAA,MACH,OAAO,OACL,MAAM,QACN,aACA,MACM,wBAAkB;AAAA,WAClB,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,MAAM,aAAa,MAAM,IAAI;AAAA,QACrF,MAAM;AAAA,QACN;AAAA,MACF,CAAC,CACH;AAAA;AAAA;AAMC,IAAM,eAAe,CAAC,UAA2B;AAAA,EACtD,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,KAAK,SAAS,KAAK;AAAA,EACzB,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;AAAA,SACxF;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,IAAI,KAAK,CAAC,CAAC;AAAA,SACjF;AAAA,MACH,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAY,wBAAkB,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC;AAAA;AAAA;AASzF,IAAM,aAAa,CAAC,UACzB,IAAI,MACF,GAAG,WAAW,KAAK,SAAS,MAAM,cAAc,SAAS,KAAK,oBAC5D,GAAG,MAAM,aAAa,MAAM,+DAC5B,qEACJ;;;AFkEK,IAAM,oBAAoB,UAA4B,sBAAsB;AAAA,EACjF,sBAAsB;AACxB,CAAC;AA6BM,IAAM,kBAAyB,YAAG,UAAU,GAAG,QAAmC;AAAA,EACvF,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,EACnC,OAAO,YAAW,iBAAiB,KAAK,OAAO,WAAW,IAAI,GAAG,SAAS,SAAS;AAAA,EACnF,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,OAAO,aAAa,IAAI;AAAA,EACxB,MAAM,QAAQ,OAAO,WAAW,IAAI;AAAA,EACpC,IAAI,UAAU;AAAA,IAAW,OAAO,OAAc,aAAI,WAAW,IAAI,CAAC;AAAA,EAClE,OAAO;AAAA,CACR;AAEM,IAAM,4BAA4B,MAC9B,iBACP,mBACO,iBACL,kBAAkB,SAAS,GAAG;AAAA,EAG5B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,WAAW,IAAI;AAAA,EAEnC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,iBAAiB,KAAK,OAAO,WAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrF,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,IACnC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,iBAAiB,KAAK,OAAO,WAAW,IAAI,GAAG,IAAI;AAAA,MACrE,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,OAAO;AAAA,GACzB;AAAA,EACD,WAAW,GAAG,WAAW,gBAAgB,EAAE,KAAK,CAAC;AAAA,EAMjD,QAAQ,GAAG,WAAW,aAAa,IAAI;AACzC,CAAC,CACH,CACF;;AG9KF,qBAAS;AACT,uBAAS;AACT;AACA;;;AChDA;AACA;AAOO,IAAM,mBAAmB;AAahC,IAAM,gBAAe,CAAC,MAAe,WAA8C;AAAA,EACjF,MAAM,MAAM;AAAA,EACZ,OAAO,KAAK,IAAI;AAClB;AAaO,IAAM,kBAAkB,CAAC,MAAe,UAAyB;AAAA,EACtE,MAAM,SACJ,OAAO,SAAS,aAAa,SAAS,KAAK,SAAS,KAAK,SAAS,OAAO,SAAS;AAAA,EACpF,OAAO,SACI,iBAAQ,IAAI,IACZ,aACL,IAAI,MACF,sBAAsB,MAAM,sBAAsB,KAAK,UAAU,IAAI,mBACnE,wFACA,sFACA,0CACJ,CACF;AAAA;AAWC,IAAM,sBAAsB,CAAC,UAClC,OAAO,MAAM,QAAQ,QAAQ,OAAe,4BAAmB,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KAC7E,iBAAQ,CAAC,SAAS,gBAAgB,MAAM,KAAK,CAAC,GAC9C,aAAI,CAAC,SAAS,cAAa,MAAM,KAAK,CAAC,CAChD;AAUK,IAAM,6BAA6B,CAAC,UACzC,iBAAiB,oBAAoB,KAAK,CAAC;AAStC,IAAM,aAAa,CAAC,WAA0B,EAAE,OAAO,KAAK,MAAM,KAAK,KAAK,IAAI;AAGhF,IAAM,uBAAuB,CAAC,UACnC,OACE,MAAM,QACN,aACA,MACQ,4BAAmB,EAAE,MAAM,MAAM,MAAM,OAAO,WAAW,KAAK,EAAE,MAAM,CAAC,CACjF;;;ADpBK,IAAM,kBAAkB,UAA0B,kBAAkB;AAW3E,IAAM,WAAU,CAAC,YAAgC,UAC/C,WAAW,UAAU,MAAM;AActB,IAAM,0BAA0B,MAC5B,iBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,EAE1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,oBAAoB,IAAI;AAAA,EAC5C,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,KAAK;AAAA,IAC3D,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,2BAA2B,IAAI;AAAA,IACnD,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBACL,oBACA,KAAK,MACL,KAAK,OAAO,OACZ,SAAS,KAAK,QAAQ,MAAM,CAC9B;AAAA,MACA,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,OAAO,EAAE,QAAQ,SAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC1D;AAAA,EAED,QAAQ,MAAa;AAAA,EAgBrB,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,oBAAoB,IAAI;AAAA,IAC5C,MAAM,OAAO,WAAW,UAAS,MAAM,MAAM,WAAW,IAAI,CAAC;AAAA,IAC7D,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,KAAK;AAAA,MAC3D,OAAO,qBAAqB,IAAI;AAAA,IAClC;AAAA,IACA,MAAM,QAAQ,OAAO,oBAAoB,IAAI;AAAA,IAC7C,IAAI,MAAM,UAAU,KAAK,OAAO;AAAA,MAC9B,OAAO,OAAc,aACnB,IAAI,MACF,sBAAsB,KAAK,oDACzB,oBAAoB,MAAM,QAAQ,QAAQ,yBAC1C,GAAG,KAAK,QAAQ,QAAQ,yDACxB,4EACA,gFACA,yBACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AACH,CAAC,CACH,CACF;;AEnIF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACtDA;AACA;;;ACwDO,IAAM,UAAU,CACrB,MACA,UACiC;AAAA,EACjC,MAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GACxC,OACC,CAAC,UAA4C,OAAO,UAAU,YAAY,UAAU,IACtF,EACC,KAAK,CAAC,UAAU,MAAM,YAAY,MAAM,IAAI;AAAA,EAC/C,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,OAAO;AAAA,IACL,WAAW,KAAK,IAAI,YAAY;AAAA,IAChC,YAAY,IACV,MAAM,QAAQ,IAAI,aAAa,IAC3B,IAAI,cAAc,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IACvD,CAAC,CACP;AAAA,IACA,eAAe,KAAK,IAAI,gBAAgB;AAAA,IACxC,kBAAkB,IAAI,IAAI,qBAAqB,EAAE;AAAA,IACjD,MAAM,MAAM;AAAA,EACd;AAAA;AASK,IAAM,eAAe;AACrB,IAAM,gBAAgB;AAGtB,IAAM,aAAa,CAAC,UAAuB,SAAS,MAAM,gBAAgB,MAAM;AAGhF,IAAM,iBAAiB;AAG9B,IAAM,QAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAMtC,IAAM,cAAa,CAAC,WAAgD;AAAA,KACtE,MAAM,eAAe,KAAK,MAAM,cAAc,CAAC;AAAA,KAC/C,MAAM,UAAU,MAAM,WAAW,YAAY,YAAY,OAAO,MAAM,MAAM,CAAC;AAClF;AAWO,IAAM,cAAa,CAAC,UACzB,IAAI,MACF,GAAG,WAAW,KAAK,8DACjB,aAAa,MAAM,sEACnB,yCACJ;AAEK,IAAM,eAAe,CAAC,UAC3B,IAAI,MACF,GAAG,WAAW,KAAK,iEACjB,aAAa,MAAM,6EACnB,yDACJ;;;ADnHK,IAAM,SAAS,CAAC,UACrB,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAe,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACvE,aAAI,CAAC,SAAS,QAAQ,MAA4C,KAAK,CAAC,CACjF;AAGF,IAAM,oBAAoB,CAAC,WACxB;AAAA,KACI,YAAW,KAAK;AAAA,EACnB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AACd;AAMF,IAAM,aAAa,CAAC,OAAoB,SAC/B,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,eAAe,WAAW,GAAG;AAAA,IAC3D,MAAM,SAAS,OAAO,OACpB,MAAM,QACN,QACA,OACM,yBAAkB,EAAE,MAAM,MAAM,MAAM,KAAK,CAAC,CACpD,EAAE,KAAY,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CAAC;AAAA,IAC5C,IAAI,QAAQ,WAAW,WAAW;AAAA,MAChC,IAAI,OAAO,eAAe;AAAA,QAAM;AAAA,MAChC,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,eAAe,uBAAuB,OAAO,cAAc,wBAC5E,wFACA,yBAAyB,MAAM,cAAc,aACjD,CACF;AAAA,IACF;AAAA,IACA,OAAc,eAAM,eAAe,IAAI;AAAA,EACzC;AAAA,EACA,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,eAAe,kCAChC,GAAG,OAAO,gBAAgB,YAAY,oDACtC,iEACA,UAAU,MAAM,0EAChB,qDACJ,CACF;AAAA,CACD;AAGI,IAAM,WAAW,CAAC,UAChB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,aACA,MACM,wBAAiB,kBAAkB,KAAK,CAAC,CACjD;AAAA,EAIA,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,4DACjB,iEACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,WAAW,OAAO,IAAI;AAAA,CAC9B;AAYI,IAAM,YAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,aACA,MACM,wBAAiB;AAAA,IACrB,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,OAER,MAAM,oBAAoB,OAAO,EAAE,cAAc,IAAI,IAAI,CAAC;AAAA,OAC1D,MAAM,uBAAuB,OAAO,EAAE,iBAAiB,IAAI,IAAI,CAAC;AAAA,EACtE,CAAC,CACH,EAAE,KAAY,kBAAS,kBAAkB,MAAa,iBAAQ,EAAE,CAAC,CAAC;AAAA,EAGlE,IAAI,SAAS;AAAA,IAAI,OAAO,WAAW,OAAO,IAAI;AAAA,CAC/C;;;ADgBI,IAAM,gBAAgB,UAAwB,kBAAkB;AAAA,EACrE,sBAAsB;AACxB,CAAC;AAkBM,IAAM,wBAAwB,MAC1B,iBACP,eACO,iBACL,cAAc,SAAS,GAAG;AAAA,EAMxB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,OAAO,IAAI;AAAA,GAC1B;AAAA,EAaD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,gBAAgB,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACxE,IAAI,WAAW,aAAa,KAAK,SAAS,OAAO,MAAM;AAAA,MACrD,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,OAAO,IAAI;AAAA,IAC/B,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,gBAAgB,YAAW,IAAI,GAAG,IAAI;AAAA,MACxD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAEA,OAAO,EAAE,QAAQ,OAAO;AAAA,GACzB;AAAA,EASD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,OAAO,IAAI;AAAA,IAC/B,IAAI,SAAS;AAAA,MAAW,OAAO;AAAA,IAC/B,OAAO,SAAS,IAAI;AAAA,IACpB,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,IAChC,IAAI,UAAU;AAAA,MAAW,OAAO,OAAc,aAAI,YAAW,IAAI,CAAC;AAAA,IAClE,OAAO;AAAA,GACR;AAAA,EAQD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IAUrC,KAAK,OAAO,OAAO,IAAI,OAAO;AAAA,MAAW;AAAA,IACzC,OAAO,UAAU,IAAI;AAAA,IACrB,MAAM,QAAQ,OAAO,OAAO,IAAI;AAAA,IAChC,IAAI,UAAU;AAAA,MAAW,OAAO,OAAc,aAAI,aAAa,IAAI,CAAC;AAAA,GACrE;AACH,CAAC,CACH,CACF;;AG1MF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACYA;AACA;AAQA,IAAM,WAAW,CAAC,UACf,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC,GAAG,OACxD,CAAC,UAA8B,OAAO,UAAU,YAAY,UAAU,IACxE;AAeK,IAAM,YAAY,CAAC,SAAiC;AAAA,EACzD,MAAM,OAAO,KAAK;AAAA,EAClB,MAAM,QAAmB,OAAO,SAAS,YAAY,SAAS,OAAQ,OAAqB,CAAC;AAAA,EAC5F,MAAM,OAAO,CAAC,SAAiC;AAAA,IAC7C,GAAI,KAAK,YAAY,QAAQ,CAAC,IAAI,IAAI,CAAC;AAAA,IACvC,GAAG,SAAS,IAAI,EAAE,QAAQ,IAAI;AAAA,EAChC;AAAA,EACA,OAAO,KAAK,KAAK;AAAA;AAoBZ,IAAM,UAAU,CAAC,MAAiB,UACvC,UAAU,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,OAAO,OAAO,GAAG,MAAM,KAAK;AAkD/D,IAAM,gBAAgB,CAAC,MAAiB,WAA4C;AAAA,EACzF,cAAc,KAAK,KAAK,qBAAqB;AAAA,EAC7C,cAAc,IAAI,KAAK,iBAAiB,CAAC;AAAA,EACzC,cAAc,KAAK,KAAK,eAAe;AAAA,EACvC,MAAM,KAAK,KAAK,OAAO;AAAA,EACvB,IAAI,KAAK,KAAK,KAAK;AAAA,EACnB,MAAM,KAAK,KAAK,SAAS,OAAO,OAAO,MAAM,KAAK,GAAG;AAAA,EACrD,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK;AAAA,EAClC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,EACvB,UAAU,IAAI,KAAK,aAAa,CAAC;AAAA,EACjC,QAAQ,KAAK,KAAK,SAAS;AAAA,EAC3B,aAAa,IAAI,KAAK,gBAAgB,CAAC;AACzC;AAmBO,IAAM,UAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAQ,OAAa,sBAAe,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACvE,aAAI,CAAC,MAAM;AAAA,EAChB,MAAM,OAAO,QAAQ,GAA2B,MAAM,KAAK;AAAA,EAC3D,OAAO,SAAS,YAAY,YAAY,cAAc,MAAM,KAAK;AAAA,CAClE,CACH;;;AC5LF;AACA;AAmBO,IAAM,sBAAmC;AAEhD,IAAM,WAAW,CAAC,UAAwB,OAAO,OAAO,MAAM,KAAK,QAAQ,MAAM;AAM1E,IAAM,gBAAgB,CAAC,OAAqB,SAAyC;AAAA,EAC1F;AAAA,KACI,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,sBAAsB,MAAM,aAAa;AACzF;AAEO,IAAM,YAAmB,YAAG,UAAU,CAAC,MAAoB;AAAA,EAChE,IAAI,KAAK,QAAQ,WAAW;AAAA,IAC1B,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,SAAS,IAAI,oEACd,kFACA,oFACA,qFACA,cACJ,CACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,cAAc,MAAM,KAAK,GAAG;AAAA,EAGzC,OAAO,UAAU,qBAAqB,MAAM,IAAI;AAAA,EAChD,OAAO,OACL,KAAK,QACL,aACA,MACM,yBAAkB;AAAA,IACtB,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,OACP,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,oBAAoB,KAAK,aAAa;AAAA,EACrF,CAAC,CACH;AAAA,EACA,MAAM,UAAU,OAAO,QAAQ,IAAI;AAAA,EACnC,IAAI,YAAY,WAAW;AAAA,IACzB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,SAAS,IAAI,2CAA2C,OAAO,KAAK,KAAK,UAC1E,sFACA,wFACA,uDACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AA+BM,IAAM,aAAa,CAAC,SACzB,OACE,KAAK,QACL,aACA,MACM,yBAAkB;AAAA,EACtB,MAAM,KAAK;AAAA,EACX,OAAO,OAAO,KAAK,KAAK;AAAA,KACpB,KAAK,YAAY,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC;AAClD,CAAC,CACH;;;AFNK,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAuBD,IAAM,UAAU,CAAC,MAAyB,WACvC,MAAM,SAAS,aAAa,MAAM,SAAS,KAAK,UAChD,MAAM,iBAAiB,aAAa,MAAM,iBAAiB,KAAK;AAEnE,IAAM,YAAW,CAAC,UAChB,OAAO,OAAO,MAAM,KAAK,qBAAqB,MAAM;AAetD,IAAM,WAAW;AAAA,EAOf,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAE7B,MAAa,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC3D,OAAO,OAAO,QAAQ,IAAI;AAAA,GAC3B;AAAA,EAUD,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,KAIC;AAAA,IACD,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IAC/C,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAQlD,IAAI,OAAO,UAAU,KAAK;AAAA,MAAO,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC3D,OAAO,QAAQ,MAAM,IAAI,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAClF;AAAA,EAOD,WAAkB,YAAG,UAAU,GAAG,QAAgC;AAAA,IAChE,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MAUtB,OAAO,OAAO,UAAU,IAAI;AAAA,IAC9B;AAAA,IACA,IAAI,CAAC,QAAQ,MAAM,IAAI,GAAG;AAAA,MACxB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,UAAS,IAAI,8CAA8C,KAAK,UACjE,gBAAgB,KAAK,8DACrB,wFACA,6DACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC7D,OAAO,WAAW,IAAI;AAAA,GACvB;AACH;AAEO,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,QAAQ,CAAC,CAAC;;AG/MtF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACkGO,IAAM,SAAS,CAAC,UAAyB,SAAS,MAAM,kBAAkB,MAAM;AAShF,IAAM,QAAQ;AAGd,IAAM,eAAe,CAAC,UAC3B,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;AAQvE,IAAM,OAAO,CAAI,UAAyB,MAAS,SAAS,UACjE,aAAa,aAAa,UAAU,aAAa;AAc5C,IAAM,OAAO,CAAC,UAA+B,UAAU,IAAI,YAAY;AAG9E,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAG7C,IAAM,UAAU,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAmCvF,IAAM,aAAa,CAAC,WAAkD;AAAA,KACxE,OAAM,cAAc,MAAM,UAAU;AAAA,KACpC,OAAM,YAAY,QAAQ,MAAM,QAAQ,CAAC;AAAA,KACzC,OAAM,qBAAqB,MAAM,iBAAiB;AAAA,KAClD,OAAM,cAAc,QAAQ,MAAM,UAAU,CAAC;AAAA,KAC7C,OAAM,QAAQ,QAAQ,MAAM,IAAI,CAAC;AAAA,KACjC,OAAM,eAAe,QAAQ,MAAM,WAAW,CAAC;AAAA,KAC/C,OAAM,qBAAqB,QAAQ,MAAM,iBAAiB,CAAC;AAChE;AAYO,IAAM,aAAa,CAAC,WAAkD;AAAA,KACxE,WAAW,KAAK;AAAA,KAChB,OAAM,eAAe,MAAM,WAAW;AAAA,KACtC,OAAM,UAAU,QAAQ,MAAM,MAAM,CAAC;AAAA,EACxC,cAAc;AAAA,EACd,MAAM,MAAM;AACd;;;AChPA;AACA;AA6BO,IAAM,gBAAgB,CAAC,OAAsB,cAClD,OAAO,MAAM,QAAQ,QAAQ,OAAa,wBAAiB,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACzE,iBAAQ,CAAC,SACd,KAAK,KAAK,CAAC,QAAQ,IAAI,cAAc,MAAM,IAAI,IACpC,aACL,IAAI,MACF,GAAG,8EACD,oFACA,oFACA,6CACJ,CACF,IACO,aACb,CACF;AAYK,IAAM,SAAS,CACpB,OACA,MACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,IAAI,WAAW,GAAG;AAAA,IAChD,MAAM,OAAO,OAAO,KAAK,KAAK;AAAA,IAC9B,IAAI,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACvB,OAAc,eAAM,WAAW;AAAA,EACjC;AAAA,EACA,OAAO,OAAO,KAAK,KAAK;AAAA,CACzB;;;AC3DH;AACA;AAwBA,IAAM,gBAAe,CAAC,MAAe,UAAyD;AAAA,EAC5F,MAAM,MAAM;AAAA,EACZ,IAAI,OAAO,IAAI,YAAY;AAAA,IAAU;AAAA,EACrC,OAAO;AAAA,IACL,cAAc,aAAa,IAAI,mBAAmB;AAAA,IAClD,YAAY,KAAK,IAAI,aAAa;AAAA,IAClC,IAAI,IAAI,IAAI,OAAO,KAAK;AAAA,IACxB,UAAU,IAAI,IAAI,aAAa,KAAK;AAAA,IACpC,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,IACZ,UAAU,KAAK,IAAI,WAAW;AAAA,IAC9B,YAAY,KAAK,IAAI,aAAa;AAAA,IAClC,cAAc,KAAK,IAAI,eAAe;AAAA,IACtC,mBAAmB,KAAK,IAAI,oBAAoB;AAAA,IAChD,QAAQ,IAAI,IAAI,WAAW,KAAK;AAAA,IAChC,YAAY,IAAI,IAAI,eAAe,KAAK;AAAA,IACxC,MAAM,IAAI,IAAI,SAAS,KAAK;AAAA,IAC5B,aAAa,IAAI,IAAI,gBAAgB,KAAK;AAAA,IAC1C,mBAAmB,IAAI,IAAI,sBAAsB,KAAK;AAAA,EACxD;AAAA;AAWK,IAAM,iBAAiB,CAAC,UAC7B,OACE,MAAM,QACN,QACA,OACM,6BAAsB,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,IAAI,CAAC,CAClF,EAAE,KACO,aAAI,CAAC,SAAS,cAAa,MAAM,KAAK,CAAC,GACvC,kBAAS,oBAAoB,MAAa,iBAAQ,SAAS,CAAC,CACrE;AAGK,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AAGzB,IAAM,qBAAoB,CAAC,WAC/B;AAAA,KACI,WAAW,KAAK;AAAA,EACnB,MAAM,MAAM;AACd;AAGK,IAAM,oBAAoB,CAAC,WAC/B;AAAA,KACI,WAAW,KAAK;AAAA,EACnB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AACd;;;AHpBK,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAaD,IAAM,WAAU,CAAC,YAAgC,UAC/C,KAAK,MAAM,MAAM,WAAW,MAAM,WAAW,YAAY,KACzD,KAAK,MAAM,UAAU,WAAW,UAAU,WAAW,YAAY,KACjE,KAAK,MAAM,mBAAmB,WAAW,iBAAiB,KAC1D,KAAK,KAAK,MAAM,UAAU,GAAG,WAAW,YAAY,WAAW,UAAU,KACzE,KAAK,MAAM,YAAY,WAAW,YAAY,WAAW,eAAe,EAAE,KAC1E,KAAK,KAAK,MAAM,WAAW,GAAG,WAAW,WAAW;AAE/C,IAAM,0BAA0B,MAC5B,iBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,EAE1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,eAAe,IAAI;AAAA,EAMvC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAC1E,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,KAAK;AAAA,IAC3D,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IACvC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,IAAI;AAAA,MAC1D,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAMD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IACvC,IAAI;AAAA,IACJ,IAAI,SAAS,WAAW;AAAA,MAItB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,IAAI;AAAA,MAC1D,OAAO,cAAc,MAAM,OAAO,IAAI,CAAC;AAAA,MACvC,OAAO,OAAO,OACZ,KAAK,QACL,aACA,MACM,0BAAmB,mBAAkB,IAAI,CAAC,CAClD;AAAA,IACF,EAAO;AAAA,MAQL,MAAM,OAAO,WAAW,UAAS,MAAM,MAAM,WAAW,IAAI,CAAC;AAAA,MAC7D,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,YAAW,kBAAkB,WAAW,IAAI,GAAG,KAAK;AAAA,QAC3D,OAAO,OAAO,OACZ,KAAK,QACL,aACA,MACM,uBAAgB,kBAAkB,IAAI,CAAC,CAC/C;AAAA,MACF;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,OACnB,MACA,gBACA,CAAC,QAAQ,QAAQ,aAAa,SAAQ,KAAK,IAAI,CACjD;AAAA,IACA,IAAI,UAAU,aAAa,CAAC,SAAQ,OAAO,IAAI,GAAG;AAAA,MAChD,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,IAAI,sEACZ,qDAAqD,QAAQ,sBAC7D,8EACA,UACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAYD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACM,0BAAmB,EAAE,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK,CAAC,CAC/D;AAAA,IACA,MAAM,OAAO,OAAO,OAAO,MAAM,gBAAgB,CAAC,QAAQ,QAAQ,SAAS;AAAA,IAC3E,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,IAAI,uEACZ,iFACA,mCACJ,CACF;AAAA,IACF;AAAA,GACD;AACH,CAAC,CACH,CACF;;AI3HF,qBAAS;AACT;AACA;;;AC/FA,uBAAS;AAET;AACA,8BAAS;AACT;;;AC4BO,IAAM,OAAO,CAAC,SAAiB,KAAK,KAAK,EAAE,YAAY;AAyBvD,IAAM,OAAO,CAAC,UAAmB;AAAA,EACtC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK;AAAA,EAC7B,MAAM,OAAO,IAAI,SAAS,GAAG,IAAI,SAAS;AAAA,EAC1C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,GAAG,CAAC,KAAK,MAAM,IAAI;AAAA;AAwBpD,IAAM,UAAU,CAAC,UAAmB;AAAA,EACzC,MAAM,UAAU,KAAK,KAAK,EAAE,KAAK;AAAA,EACjC,OAAO,YAAY,MAAM,KAAK;AAAA;AAqBzB,IAAM,OAAO,CAAC,UAAyE;AAAA,EAC5F,MAAM,OAAO,QAAQ,MAAM,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,MAAO,SAAS,KAAK,CAAC,IAAI,EAAE,SAAS,KAAK,EAAG;AAAA;;;ACxGtE,IAAM,oBAAoB;AAAA,EAE/B,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,UAAU,KAAK,KAAK,OAAO;AAAA,IACjC,OAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,QAAQ,KAAK,UAAU;AAAA,MAChC,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,MAEnC,MAAM,KAAK,KAAK,SAAS,MAAM,IAAI;AAAA,IACrC;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,KAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAO3D,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,YAAY,UACpB,WAAW,SAAS,KAAK,MAAM,IAAI,KAAK,WAAW,YAAY,QAAQ,MAAM,OAAO;AAAA,EAKtF,MAAM,CAAC,UAAU,4BAA4B,MAAM;AAAA,EACnD,YAAY;AACd;;;AFzBA,MAAQ,2BAAa,8BAAgB,WAAW,iBAAI;AAE7C,IAAM,oBAAoB,CAAC,UAChC,OAAO,MAAM,QAAQ,QAAQ,OAAe,iCAAwB,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KAClF,iBAAQ,CAAC,SAAS;AAAA,EAGvB,IACE,SAAS,QACT,OAAO,SAAS,YAChB,MAAM,QAAQ,IAAI,KAClB,EAAE,UAAU,SACZ,OAAO,KAAK,SAAS,YACrB,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,KACnC,EAAE,UAAU,SACZ,OAAO,KAAK,SAAS,YACrB,KAAK,KAAK,IAAI,MAAM,IACpB;AAAA,IACA,OAAc,cACZ,IAAI,mBAAkB;AAAA,MACpB,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC,CACH;AAAA,EACF;AAAA,EACA,OAAc,iBAAQ,kBAAK,WAAW,KAAK,KAAK,GAAG,KAAK,CAAC;AAAA,CAC1D,GACM,kBAAS,yBAAyB,MAAa,iBAAQ,SAAS,CAAC,CAC1E;AAGK,IAAM,sBAAsB,CAAC,UAClC,OAAO,MAAM,QAAQ,aAAa,MAAc,oCAA2B,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC;AAE3F,IAAM,wBAAwB;AAAA,EACnC,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAyC,kBAAkB,IAAI;AAAA,EACxE,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,KAIC;AAAA,IACD,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAE1B,IAAI,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI;AAAA,MAAG,OAAO,EAAE,QAAQ,UAAU;AAAA,IACtE,MAAM,OAAO,OAAO,kBAAkB,IAAI;AAAA,IAC1C,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,kBAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAsC;AAAA,IACtE,MAAM,OAAO,OAAO,kBAAkB,IAAI;AAAA,IAC1C,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OACL,KAAK,QACL,aACA,MACQ,oCAA2B,kBAAK,WAAW,IAAI,CAAC,CAC1D;AAAA,IACF,EAAO;AAAA,MACL,MAAM,OAAO,WAAW,kBAAK,SAAS,MAAM,MAAM,kBAAK,WAAW,IAAI,CAAC;AAAA,MACvE,IAAI,SAAS;AAAA,QACX,OAAO,OACL,KAAK,QACL,aACA,MACQ,iCAAwB,KAAK,MAAM,MAAM,KAAK,KAAK,CAAC,CAC9D;AAAA;AAAA,IAEJ,MAAM,QAAQ,OAAO,kBAAkB,IAAI;AAAA,IAC3C,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MAAM,GAAG,kBAAK,KAAK,IAAI,4DAA4D,CACzF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAAyC,oBAAoB,IAAI;AAC9E;;;AD2CO,IAAM,uBAAuB,UAA+B,uBAAuB;AAGnF,IAAM,+BAA+B,MACjC,iBACP,sBACO,iBAAQ,qBAAqB,SAAS,GAAG,qBAAqB,CAAC,CACxE;;AIhFF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACpEA;AACA;AAMO,IAAM,eAAe;AACrB,IAAM,eAAe;AAWrB,IAAM,gBAAgB,CAAC,aAAgC;AAAA,EAC5D,MAAM,QAAQ,YAAW;AAAA,EACzB,OAAO,UAAU,MAAM,KAAK;AAAA;AAI9B,IAAM,aAAa,CAAC,SAAsC;AAAA,EACxD,MAAM,SAAS,IAAI,KAAK,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC;AAAA,EACrD,OAAO,WAAW,KAAK,CAAC,IAAI,OAAO,MAAM,GAAG;AAAA;AAGvC,IAAM,cAAa,CAAC,WAAwD;AAAA,EACjF,SAAS,cAAc,MAAM,OAAO;AAAA,EACpC,SAAS,MAAM;AACjB;AAGO,IAAM,cAAa,CAAC,WAAqD;AAAA,EAC9E,SAAS,cAAc,MAAM,OAAO;AAAA,EACpC,SAAS,MAAM;AACjB;AAEA,IAAM,gBAAe,CAAC,MAAqC,WAAwC;AAAA,EAKjG,SAAS,KAAK,KAAK,OAAO;AAAA,EAE1B,SAAS,MAAM;AAAA,EACf,SAAS,WAAW,KAAK,OAAO;AAClC;AAMO,IAAM,WAAU,CAAC,YAA6B,UACnD,WAAW,YAAY,cAAc,MAAM,OAAO;AAuB7C,IAAM,kBAAkB,CAAC,UAC9B,iBACE,OAAO,MAAM,QAAQ,QAAQ,OAAc,uBAAe,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CACvF,EAAE,KACO,aAAI,CAAC,SACV,SAAS,aACL,aACA,KAAK,YAAY,YACf,YACA,cAAa,MAAM,KAAK,CAChC,CACF;AAUK,IAAM,YAAY,CAAC,UACxB,gBAAgB,KAAK,EAAE,KAAY,kBAAS,iBAAiB,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAGxF,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;;;ADY7B,IAAM,eAAe,WAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAEM,IAAM,uBAAuB,MACzB,kBACP,cACO,iBACL,aAAa,SAAS,GAAG;AAAA,EAKvB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAY7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,UAAU,IAAI,IAAI,gBAAgB,IAAI,CACtE;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACtE,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,KAAK;AAAA,IACvD,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,gBAAgB,IAAI;AAAA,IAGxC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBACL,iBACA,KAAK,SACL,KAAK,OAAO,OACZ,SAAS,KAAK,QAAQ,MAAM,CAC9B;AAAA,MACA,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MAEtB,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,IAAI;AAAA,MACtD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAOxC,MAAM,SAAS,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACpD,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACtE,OAAO,YAAW,cAAc,YAAW,IAAI,GAAG,KAAK;AAAA,IACvD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACO,0BAAkB,YAAW,IAAI,CAAC,CAC3C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,uBAAe,YAAW,IAAI,CAAC,CAAC;AAAA,IACvF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,UAAU,IAAI,CAAC;AAAA,IACnD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,iBAAiB,KAAK,2DACpB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,0BAAkB,EAAE,SAAS,KAAK,QAAQ,CAAC,CACpD;AAAA,GACD;AACH,CAAC,CACH,CACF;;AElLF,qBAAS;AACT;AACA;;;ACpCA,uBAAS;AAET;;;ACAA;AACA;AACA;AAMO,MAAM,iBAAiB,MAAM;AAAA,EAEvB;AAAA,EACA;AAAA,EACA;AAAA,EAHX,WAAW,CACA,QACA,QACA,MACT,QACA;AAAA,IACA,MAAM,OAAO,UAAU,WAAW,OAAO,MAAM,MAAM,QAAQ;AAAA,IALpD;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,mBAAmB,CACvB,QACA,MACA,aAEA,IAAI,SACF,GACA,QACA,MACA,uBAAuB,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,GAChF;AAgBF,IAAM,SAAS,CAAC,SAA0B;AAAA,EACxC,MAAM,SAAS,IAAI;AAAA,EACnB,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,OAAO,UAAU;AAAA,MAAU,OAAO,OAAO,KAAK,KAAK;AAAA,IAClD;AAAA,iBAAW,QAAQ;AAAA,QAAO,OAAO,OAAO,KAAK,IAAI;AAAA,EACxD;AAAA,EACA,OAAO,OAAO,SAAS;AAAA;AAGzB,IAAM,eAAe,CACnB,QACA,SACA,MACA,YACA,QACA,SACG;AAAA,EACH,MAAM,MAAM,GAAG,WAAW;AAAA,EAsB1B,OAAyB,wBAAK,MAAM,EAAE,GAAG,EAAE,KACvB,8BAAW,EAAE,eAAe,cAAc,YAAY,MAAM,EAAE,CAAC,GACjF,SAAS,YACL,CAAC,SAAS,OACQ,4BAAS,OAAO,IAAI,GAAG,mCAAmC,CAClF;AAAA;AAGF,IAAM,aAAa,CACjB,QACA,YACA,QACA,MACA,MACA,YAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,UAAU,aAAa,QAAQ,SAAS,MAAM,YAAY,QAAQ,IAAI;AAAA,EAC5E,OAAO,OAAO,OACX,QAAQ,OAAO,EACf,KAAY,kBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,CACjF;AAEH,IAAM,eAAe,CACnB,UAKA,QACA,SAEO,aAAI,UAAU,GAAG;AAAA,EAOtB,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AAAA,IAGnD,MAAM,SAAS,OAAO,SAAS,KAAK,KAAY,uBAAc,MAAM,EAAE,CAAC;AAAA,IACvE,OAAO,OAAc,cAAK,IAAI,SAAS,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,EAC7F;AAAA,EACA,MAAM,QAAQ,OAAO,SAAS,KAAK,KAC1B,kBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CACzE;AAAA,EACA,OAAO,MAAK;AAAA,CACb;AAGI,IAAM,UAAU,CACrB,QACA,YACA,QACA,MACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WACJ,OAAO,WAAW,QACd,OAAO,iBAAiB,QAAQ,QAAQ,MAAM,CAAC,YAC7C,aAAa,QAAQ,SAAS,MAAM,YAAY,QAAQ,IAAI,CAC9D,EAAE,KACO,kBAAS,CAAC,YACf,QAAQ,QAAQ,YACZ,iBAAiB,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,IAC/D,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,OAAO,CAAC,CACnD,CACF,IACA,OAAO,WAAW,QAAQ,YAAY,QAAQ,MAAM,MAAM,OAAO,GAAG;AAAA,EAC1E,OAAO,OAAO,aAAgB,UAAU,QAAQ,IAAI;AAAA,CACrD;AAmDI,IAAM,MAAM,CACjB,QACA,MACA,QACA,MACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,QAAW,QAAQ,YAAY,QAAQ,MAAM,IAAI;AAAA,CAChE;;;AD9MI,IAAM,gBAAgB,CAC3B,SACG;AAAA,EACH,QAAQ,2BAAa,8BAAgB,WAAW,IAAI;AAAA,EAGpD,MAAM,OAAO,CAAC,UACZ,IACE,MAAM,QACN,KAAK,YAAY,QACjB,OACA,KAAK,KAAK,KAAK,CACjB,EAAE,KACO,aAAI,CAAC,SAAU,QAAQ,OAAO,YAAY,KAAK,WAAW,MAAM,KAAK,CAAE,GACvE,uBAAc,MAAG;AAAA,IAAG;AAAA,GAAS,CACtC;AAAA,EAEF,OAAO;AAAA,IAOL;AAAA,IACA;AAAA,IAEA;AAAA,IAKA,MAAM,CAAC,MAAoB,WAClB,aAAI,UAAU,GAAG;AAAA,MAItB,IAAI,CAAC,aAAW,IAAI;AAAA,QAAG;AAAA,MAOvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,MAC7C,OAAO,aAAY,IAAI;AAAA,MACvB,IAAI,WAAW;AAAA,QAAW;AAAA,MAC1B,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAG7B,IAAI,SAAS,WAAW;AAAA,QAMtB,OAAO,aAAY,MAAM,IAAI;AAAA,QAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,MAC5B;AAAA,MACA,IAAI,KAAK,QAAQ,MAAM,IAAI;AAAA,QAAG,OAAO,EAAE,QAAQ,OAAO;AAAA,MAEtD,OAAO,KAAK,eAAe,YACtB,EAAE,QAAQ,UAAU,IACpB,EAAE,QAAQ,SAAS;AAAA,KACzB;AAAA,IAEH,WAAW,CAAC,SACH,aAAI,UAAU,GAAG;AAAA,MACtB,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAM7B,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,MAC3C,OAAO,aAAY,IAAI;AAAA,MACvB,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,IACL,KAAK,QACL,aACA,QACA,KAAK,WAAW,IAAI,GACpB,KAAK,WAAW,IAAI,CACtB;AAAA,MACF,EAAO,SAAI,KAAK,eAAe,WAAW;AAAA,QAyBxC,MAAM,OAAO,WAAW,KAAK,SAAS,MAAM,MAAM,KAAK,WAAW,IAAI,CAAC;AAAA,QACvE,IAAI,SAAS,WAAW;AAAA,UACtB,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,KAAK,KAAK,IAAI,GAAG,IAAI;AAAA,QACnE;AAAA,MACF;AAAA,MACA,MAAM,QAAQ,OAAO,KAAK,IAAI;AAAA,MAC9B,IAAI,UAAU,WAAW;AAAA,QAOvB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,KAAK,KAAK,IAAI,oEACf,sFACA,4DACJ,CACF;AAAA,MACF;AAAA,MACA,OAAO;AAAA,KACR;AAAA,IAOH,SAAS,CAAC,SAAgB,IAAI,KAAK,QAAQ,aAAa,UAAU,KAAK,KAAK,IAAI,CAAC;AAAA,EACnF;AAAA;AAoCK,IAAM,cAAc,CACzB,SACG;AAAA,EACH,MAAM,MAAM,cAAc,IAAI;AAAA,EAC9B,OAAO;AAAA,IACL,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,GAAG,WAA4B,IAAI,KAAK,IAAI;AAAA,IAClD,MAAM,GAAG,MAAM,aACb,IAAI,KAAK,MAAM,MAAM;AAAA,IACvB,WAAW,GAAG,WAA4B,IAAI,UAAU,IAAI;AAAA,IAC5D,QAAQ,GAAG,WAA4B,IAAI,QAAQ,IAAI;AAAA,EACzD;AAAA;;;ADnHK,IAAM,oBAAoB,WAA4B,oBAAoB;AAGjF,IAAM,OAAO,CAAC,QAAgB,IAAI,MAAM,GAAG,EAAE,MAAM;AAOnD,IAAM,SAAQ,CAAC,WAA4B;AAAA,EACzC,SAAS,MAAM,WAAW;AAAA,EAC1B,cAAc,OAAO,MAAM,gBAAgB,CAAC;AAAA,EAC5C,aAAa,OAAO,MAAM,eAAe,CAAC;AAAA,EAC1C,OAAO,MAAM,SAAS;AACxB;AAEA,IAAM,YAAW,YAAmD;AAAA,EAClE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAAA,IACjE,cAAc,IAAI,KAAK,iBAAiB,CAAC;AAAA,IACzC,aAAa,IAAI,KAAK,gBAAgB,CAAC;AAAA,IACvC,KAAK,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,MAAM;AAAA,IAC3D,OAAO,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC3D,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,KAAK,MAAM,GAAG;AAAA,EACxE;AAAA,EAMA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,KAAK,MAAM,IAAI;AAAA,EAS1D,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,YAAY,UACpB,WAAW,WAAW,MAAM,SAAS,cACrC,WAAW,aAAa,MAAM,WAAW,OACzC,WAAW,iBAAiB,MAAM,eAAe,MACjD,WAAW,kBAAkB,MAAM,gBAAgB;AAAA,EAMrD,MAAM,CAAC,UAAU,wBAAwB,MAAM;AAAA,EAC/C,YAAY;AACd,CAAC;AAiBM,IAAM,4BAA4B,MAC9B,kBAAO,mBAA0B,iBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AGpG5F,qBAAS;AACT;AACA;;;ACzCO,IAAM,WAAW,CAAC,UAAkD;AAAA,EACzE,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,SAAS,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,IAAK,SAAS,CAAC,GAAI;AAAA,IAChF,OAAO,MAAM,YAAY,MAAM,KAAK,EAAE,MAAM,GAAG;AAAA,IAC/C,IAAI,SAAS,aAAa,SAAS;AAAA,MAAI;AAAA,IACvC,MAAM,OAAO,OAAO,SAAS,YAAY,KAAK,EAAE;AAAA,IAChD,OAAO,IAAI,MAAM,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI;AAAA,EAChD;AAAA,EACA,OAAO,CAAC,GAAG,OAAO,KAAK,CAAC,EACrB,KAAK,EACL,IAAI,CAAC,SAAS;AAAA,IACb,MAAM,OAAO,OAAO,IAAI,IAAI,KAAK;AAAA,IACjC,OAAO,SAAS,IAAI,OAAO,GAAG,QAAQ,OAAO,IAAI;AAAA,GAClD,EACA,KAAK,GAAG;AAAA;AAYN,IAAM,WAAW,CAAC,UACvB,OAAO,UAAU,YAAY,UAAU,OACnC,OAAO,QAAQ,KAAK,EACjB,IAAI,EAAE,QAAQ,aAAa,GAAG,WAAW,OAAO,OAAO,GAAG,EAC1D,KAAK,EACL,KAAK,IAAI,IACZ;AAqBC,IAAM,cAAc,CAAC,QAC1B,IAAI,QAAQ,yBAAyB,CAAC,YAAY;AAAA,EAChD,IAAI;AAAA,IACF,OAAO,mBAAmB,OAAO;AAAA,IACjC,MAAM;AAAA,IACN,OAAO;AAAA;AAAA,CAEV;AAuBI,IAAM,WAAW,CAAC,WAA4D;AAAA,EACnF,SAAS,MAAM,YAAY,aAAa,MAAM,YAAY,KAAK,YAAY,MAAM;AAAA,EACjF,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,KACpC,MAAM,SAAS,kBAAkB,EAAE,QAAQ,MAAM,WAAW,OAAO,MAAM,UAAU,IAAI,CAAC;AAC9F;AA8BA,IAAM,WAAW,CAAC,WAAgD;AAAA,EAChE,UAAU,MAAM;AAAA,EAChB,WAAW,IAAI,MAAM,SAAS;AAAA,EAC9B,MAAM,MAAM;AAAA,KACR,MAAM,SAAS,kBAAkB,EAAE,OAAO,SAAS,MAAM,KAAK,EAAE,IAAI,CAAC;AAC3E;AAEO,IAAM,QAAO,CAAC,UAAuB;AAAA,EAC1C,MAAM,SAAS,SAAS,KAAK;AAAA,EAC7B,YAAY,QAAQ,UAAU,OAAO,QAAQ,SAAS,KAAK,CAAC,GAAG;AAAA,IAC7D,IAAI,UAAU;AAAA,MAAW,OAAO,UAAU;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAiBF,IAAM,YAAY,CAAC,UACxB,OAAO,QAAQ,SAAS,KAAK,CAAC,EAC3B,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,YAAY,MAAM;;;ADtBtB,IAAM,gBAAgB,WAAwB,gBAAgB;AAErE,IAAM,YAAW,YAA2C;AAAA,EAC1D,YAAY,CAAC,MAAM,UAAU;AAAA,IAO3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,UAAU,KAAK,KAAK,WAAW;AAAA,MAC/B,SAAS,KAAK,KAAK,UAAU;AAAA,MAO7B,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,MACpC,QAAQ,SAAS,KAAK,SAAS;AAAA,MAC/B,OAAO,SAAS,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW,SAAS;AAAA,MAC7E,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,MAC3B,WAAW,IAAI,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,SAAS;AAAA,MACpF,MAAM,KAAK,KAAK,SAAS,MAAM,IAAI;AAAA,MACnC,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,MAClC,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAGlB,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAa3D,UAAU,EAAE,QAAQ,8BAA8B,QAAQ,mCAAmC;AAAA,EAC7F,SAAS,CAAC,YAAY,UACpB,WAAW,cAAc,IAAI,MAAM,SAAS,KAC5C,WAAW,aAAa,MAAM,YAC9B,WAAW,YAAY,YAAY,MAAM,WAAW,EAAE,KACtD,WAAW,aAAa,MAAM,YAAY,UACzC,MAAM,SAAS,mBACb,WAAW,UAAU,SAAS,MAAM,KAAK,KACxC,WAAW,YAAY,MAAM,WAAW;AAAA,EAE9C,MAAM,CAAC,UAAU,oBAAoB,MAAM;AAAA,EAO3C,YAAY,CAAC,UAAU;AAAA,IACrB,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7B,MAAM,SAAS,MAAK,KAAK;AAAA,IACzB,OAAO,WAAW,QAAQ,KAAK;AAAA;AAEnC,CAAC;AASM,IAAM,wBAAwB,MAC1B,kBAAO,eAAsB,iBAAQ,cAAc,SAAS,GAAG,SAAQ,CAAC,CAAC;;AErNpF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACvBA;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,YAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,iBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,gBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,cAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,cAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,aAAW,uBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,aAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,uBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,aACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAaK,IAAM,sBAAsB,CAAC,KAAa,eACxC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,eAAM;AAAA,CACtE;;;AFxFI,IAAM,eAAe,CAAC,QACpB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,uBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,uBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AIjG9B,oBAAS;AACT;AAcO,IAAM,aAAa,CACxB,KACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,iBAAiB,IAAI,KAAK,IAAI,UAAU;AAAA,EAChE,IAAI,aAAa;AAAA,IAAU,OAAO;AAAA,EAClC,IAAI,aAAa,WAAW;AAAA,IAC1B,OAAc,oBACZ,GAAG,IAAI,mFACL,iFACJ;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,WAAW,CAAC,WACT,YACE,oBACL,GAAG,IAAI,+EACL,IAAI,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM,kCAChE,GACA,KACF;AAAA,EACF,OAAO,OAAO,SAAQ,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,CAChF;AAOI,IAAM,YAAY,CACvB,KACA,OACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,UAAU,aAAa,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EAC5D,QAAQ,OAAO,WAAW,KAAK,QAAO,KAAK,QAAQ,SAAQ,KAAK;AAAA,CACjE;;;AC3DI,IAAM,QAAQ,CAAC,OAAe,eACnC,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,IAAI,CAAC,SAA2B;AAAA,EAC/B,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,IAAI,OAAO;AAAA,IAAI,OAAO,CAAC,cAAc,MAAM,eAAe,YAAY,KAAK,IAAI;AAAA,EAC/E,OAAO,CAAC,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,CAC5D;AAOL,IAAM,WAAuE;AAAA,EAC3E,KAAK,EAAE,cAAc,IAAI;AAAA,EACzB,UAAU,EAAE,cAAc,KAAK,MAAM,KAAK,QAAQ,KAAK,OAAO,KAAK,SAAS,IAAI;AAAA,EAChF,KAAK,EAAE,UAAU,KAAK,gBAAgB,KAAK,WAAW,KAAK,MAAM,OAAO;AAAA,EACxE,QAAQ,EAAE,QAAQ,KAAK,WAAW,KAAK,OAAO,KAAK,WAAW,KAAK,IAAI,KAAK,QAAQ,IAAI;AAC1F;AAGA,IAAM,QAAQ,IAAI,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,OAAO,IAAI,IAAI,CAAC,SAAS,cAAc,CAAC;AAG9C,IAAM,iBAAiB,CAAC,KAAa,UAAkB;AAAA,EACrD,IAAI,MAAM,IAAI,GAAG;AAAA,IAAG,OAAO,eAAe,KAAK;AAAA,EAC/C,IAAI,KAAK,IAAI,GAAG;AAAA,IACd,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG;AAAA,EAClF,IAAI,QAAQ;AAAA,IAAU,OAAO,MAAM,YAAY;AAAA,EAC/C,OAAO;AAAA;AAIF,IAAM,YAAY,CACvB,OACA,QACA,eACwB;AAAA,EACxB,MAAM,WAAW,SAAS,WAAW,CAAC;AAAA,EACtC,MAAM,MAAM,IAAI;AAAA,EAChB,YAAY,KAAK,QAAQ,MAAM,OAAO,UAAU,GAAG;AAAA,IACjD,MAAM,YAAY,eAAe,KAAK,GAAG;AAAA,IACzC,IAAI,SAAS,SAAS;AAAA,MAAW,IAAI,IAAI,KAAK,SAAS;AAAA,EACzD;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,UAAU,CAAC,MAA2B,UACjD,KAAK,SAAS,MAAM,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,WAAW,MAAM,IAAI,GAAG,MAAM,KAAK;AAGjF,IAAM,aAAa,CAAC,UACzB,CAAC,GAAG,KAAG,EACJ,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,EACvC,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,WAAW,CAAC,OAA0B,OAA0B,CAAC,MAC5E,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,MAAI,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,MAAI,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EACxF,IAAI,CAAC,QAAQ,GAAG,OAAO,MAAI,IAAI,GAAG,KAAK,IAAI,EAC3C,KAAK,GAAG;AAMN,IAAM,UAAU,CAAC,UAAkB,SAAiB;AAAA,EACzD,MAAM,OAAO,UAAU,UAAU,KAAK;AAAA,EACtC,MAAM,OAAO,UAAU,MAAM,KAAK;AAAA,EAClC,IAAI,CAAC,KAAK,IAAI,QAAQ;AAAA,IAAG,KAAK,OAAO,QAAQ;AAAA,EAC7C,OAAO,EAAE,MAAM,KAAK;AAAA;AAQf,IAAM,WAAW,CAAC,UAAkB,SAA6B;AAAA,EACtE,MAAM,OAAO,IAAI,IAAI,MAAM,QAAQ,CAAC;AAAA,EACpC,MAAM,MAAM,SAAS,YAAY,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,IAAI,QAAQ;AAAA,EAC9E,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,QAAQ;AAAA,IAAW,KAAK,IAAI,UAAU,GAAG;AAAA,EACpE,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC;AAAA;AAIzB,IAAM,SAAS,CAAC,UACrB,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,SAAS,EAAE,OAAO,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,EAC5D,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,EAC9B,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,cAAc,CAAC,UAC1B,MACG,MAAM,SAAS,EACf,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,GAAG;AAMN,IAAM,kBAAkB,CAAC,UAAkB,MAAM,QAAQ,QAAQ,EAAE;AAGnE,IAAM,eAA8E;AAAA,EACzF,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,OAAO;AAAA,EACP,UAAU;AAAA,EACV,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,SAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AACP;AAGO,IAAM,YAAiC,IAAI,IAAI;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,kBAAoD;AAAA,EAC/D,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,KAAK;AACP;AAGO,IAAM,aAAa,CAAC,KAAa,UAA0B;AAAA,EAChE,MAAM,QAAO,aAAa;AAAA,EAC1B,IAAI,UAAS;AAAA,IAAU,OAAO,OAAO,OAAO,KAAK,CAAC;AAAA,EAClD,IAAI,UAAS;AAAA,IAAQ,OAAO,eAAe,KAAK;AAAA,EAChD,IAAI,QAAQ;AAAA,IAAe,OAAO,gBAAgB,KAAK;AAAA,EACvD,IAAI,QAAQ;AAAA,IAAY,OAAO,WAAW,UAAU,OAAO,UAAU,CAAC;AAAA,EACtE,IAAI,QAAQ,gBAAgB,QAAQ;AAAA,IAAgB,OAAO,YAAY,KAAK;AAAA,EAC5E,IAAI,QAAQ;AAAA,IAAW,OAAO,eAAe,OAAO,OAAO;AAAA,EAC3D,IAAI,QAAQ;AAAA,IAAQ,OAAO,OAAO,KAAK;AAAA,EACvC,OAAO;AAAA;;;ACrFF,IAAM,WAAgC,IAAI,IAAI;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,UAAU;AAAA,EACrB,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AACP;AAKO,IAAM,aAAa,CAAC,QAA8D;AAAA,EACvF,MAAM,QAAQ,6BAA6B,KAAK,GAAG;AAAA,EACnD,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,MAAM,SAAS,MAAM;AAAA,EACrB,MAAM,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC7B,OAAO,QAAQ,QAAQ,UAAU,CAAC,QAAQ,KAAK,IAAI;AAAA;AAI9C,IAAM,aAAkC,IAAI,IAAI;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,gBAAgB,CAAC,OAAiB,QAC5C,MAA6C;AAGzC,IAAM,eAAe,CAAC,UAC3B,OAAO,KAAK,KAAK,EACd,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,GAAG,KAAK,cAAc,OAAO,GAAG,MAAM,SAAS,EAC/E,KAAK;AAGH,IAAM,YAAY,CAAC,UACxB,UAAU,OAAO,MAAM,UAAU,QAAQ,MAAM,OAAO,KAAK;AAStD,IAAM,eAAe,CAAC,QAC3B,aAAa,SAAS,aACtB,QAAQ,kBACR,QAAQ,YACR,WAAW,GAAG,MAAM;AAUf,IAAM,eAAe,CAAC,SAA0D;AAAA,EACrF,MAAM,MAA8B,CAAC;AAAA,EACrC,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,CAAC,aAAa,GAAG,KAAK,SAAS,IAAI,GAAG;AAAA,MAAG;AAAA,IAC7C,IAAI,UAAU,QAAQ,UAAU,aAAa,OAAO,UAAU;AAAA,MAAU;AAAA,IACxE,IAAI,OAAO,UAAU,KAAK;AAAA,EAC5B;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,YAAY,CAAC,SAA4C;AAAA,EACpE,MAAM,MAAM,KAAK;AAAA,EACjB,IAAI,CAAC,MAAM,QAAQ,GAAG;AAAA,IAAG,OAAO,CAAC;AAAA,EACjC,OAAO,IACJ,IAAI,CAAC,SAAmB,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,EAAE,IAAI,EAAG,EACnE,OAAO,CAAC,QAAQ,QAAQ,EAAE;AAAA;;;AC9L/B,IAAM,WAAW;AAEjB,IAAM,QAA0C;AAAA,EAC9C,GAAG,QAAQ;AAAA,EACX,GAAG;AAAA,EACH,GAAG,QAAQ;AAAA,EACX,GAAG,QAAQ;AACb;AAGO,IAAM,YAAY,CAAC,UAAqC;AAAA,EAC7D,MAAM,QAAQ,6BAA6B,KAAK,MAAK,KAAK,CAAC;AAAA,EAC3D,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,OAAO,KAAK,MAAM,OAAO,MAAM,EAAE,KAAK,MAAM,OAAO,YAAY,IAAK,MAAM,MAAM,OAAO,EAAG;AAAA;AAkBrF,IAAM,cAAc,CAAC,UAAyB;AAAA,EACnD,OAAO,SAAS,MAAM,OAAM,QAAQ;AAAA,EACpC,MAAM,OAAO,QAAQ,OAAO,WAAW,MAAM,KAAK;AAAA,EAClD,MAAM,UAAU,UAAU,OAAM,UAAU,QAAQ;AAAA,EAClD,QAAQ,OAAO,QAAQ;AAAA,EACvB,MAAM,WAAW,QAAQ,IAAI,MAAM;AAAA,EACnC,QAAQ,OAAO,MAAM;AAAA,EACrB,MAAM,QAAQ,SAAS,KAAK,IAAI;AAAA,EAChC,IAAI,UAAU,MAAM;AAAA,IAClB,MAAM,MAAM,GAAG,MAAM,MAAM;AAAA,IAC3B,OAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,MAAM,UAAU,GAAG;AAAA,MACnB,UAAU;AAAA,MACV,QAAQ,MAAM,MAAM;AAAA,MACpB,SAAS;AAAA,IACX;AAAA,EACF;AAAA,EACA,MAAM,OAAO,aAAa,YAAY,YAAY,UAAU,QAAQ;AAAA,EACpE,IAAI,KAAK,WAAW,GAAG,GAAG;AAAA,IACxB,MAAM,QAAO,KAAK,WAAW,OAAO,IAAI,WAAW;AAAA,IACnD,OAAO,EAAE,aAAM,SAAS,MAAM,UAAU,QAAQ,MAAM,SAAS,GAAG;AAAA,EACpE;AAAA,EACA,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE;AAAA,IAC3C,SAAS,OAAO,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC;AAAA,EAC7C;AAAA;AAaK,IAAM,aAAa,CAAC,WAAmB,OAAO,SAAS,UAAU,OAAO,SAAS;AAOxF,IAAM,UAAU,CAAC,MAAc,aAAqB;AAAA,EAClD,MAAM,QAAQ,CAAC,GAAG,KAAK,UAAU,KAAK,SAAS;AAAA,EAC/C,YAAY,KAAK,UAAU,SAAS;AAAA,IAAS,MAAM,KAAK,GAAG,OAAO,OAAO;AAAA,EACzE,IAAI,KAAK,aAAa;AAAA,IAAW,MAAM,KAAK,QAAQ,KAAK,UAAU;AAAA,EACnE,OAAO,MAAM,KAAK,GAAG;AAAA;AAGhB,IAAM,cAAc,CAAC,KAAa,UAAkB,SAAgC;AAAA,EACzF,MAAM,OAAO,YAAY,QAAQ;AAAA,EACjC,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,IAAI,WAAW,IAAI,KAAK,WAAW,IAAI,GAAG;AAAA,IACxC,MAAM,QACJ,KAAK,SAAS,KAAK,QAAQ,KAAK,WAAW,KAAK,UAAU,QAAQ,KAAK,SAAS,KAAK,OAAO;AAAA,IAC9F,OAAO,QAAO,CAAC,IAAI,EAAE,UAAU,KAAK;AAAA,EACtC;AAAA,EACA,IAAI,KAAK,WAAW,KAAK,QAAQ;AAAA,IAC/B,OAAO;AAAA,MACL,QACE,GAAG,yBAAyB,KAAK,uBAAuB,KAAK,0BAC7D;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI,KAAK,SAAS,YAAY,KAAK,YAAY,KAAK,SAAS;AAAA,IAC3D,OAAO;AAAA,MACL,QACE,GAAG,wBAAwB,KAAK,2BAA2B,KAAK,+BAChE;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI;AAAA,EACJ,IAAI,KAAK,SAAS,aAAa,KAAK,SAAS,aAAa,KAAK,SAAS,KAAK,MAAM;AAAA,IACjF,IAAI,KAAK,OAAO,KAAK,MAAM;AAAA,MACzB,OAAO;AAAA,QACL,QACE,GAAG,iBAAiB,KAAK,YAAY,kCACrC,GAAG,KAAK,YAAY,uEACpB;AAAA,MACJ;AAAA,IACF;AAAA,IACA,SAAS,KAAK;AAAA,EAChB;AAAA,EACA,MAAM,MAAM,QAAQ,KAAK,SAAS,KAAK,OAAO,IAAI,YAAY,QAAQ,MAAM,IAAI;AAAA,EAChF,OAAO;AAAA,OACD,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,OAC/B,WAAW,YAAY,CAAC,IAAI,EAAE,OAAO;AAAA,EAC3C;AAAA;;;ACnGF,IAAM,QAAO,CAAC,UACZ,UAAU,aAAa,UAAU,OAAO,YAAY,UAAU,KAAK;AAG9D,IAAM,WAAW,CAAC,MAAc,KAAa,OAAe,QACjE,GAAG,QAAQ,kFACX,aAAa,OAAO,IAAI,KAAK,UAAU,KAAK,YAAY,QAAQ,KAAK,QAAQ,gBAC7E;AAGF,IAAM,cAAc,CAAC,UACnB,IAAI,IACF,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,QAAQ,UAAU,QAAQ,eAAe,KAAK,CAAC,CAAC,CAC3F;AASK,IAAM,mBAAmB,CAC9B,MACA,MACA,iBACY;AAAA,EACZ,IAAI,CAAC;AAAA,IAAc,OAAO;AAAA,EAC1B,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,IAAI,SAAS;AAAA,IAAW,OAAO,EAAE,KAAK,SAAS,KAAM,KAAK,SAAS,KAAK,KAAK,IAAI,SAAS;AAAA,EAC1F,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,MAAM,OAAO,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACrD,OAAO,CAAC,GAAG,IAAI,EAAE,KACf,CAAC,QAAQ,QAAQ,cAAc,KAAK,IAAI,GAAG,KAAK,SAAS,KAAK,IAAI,GAAG,KAAK,GAC5E;AAAA;AAGK,IAAM,aAAa,CAAC,iBACzB,eAAe,kCAAkC;AAE5C,IAAM,QAAQ,CAAC,OAAiB,SAA6C;AAAA,EAClF,MAAM,MAA8B,CAAC;AAAA,EACrC,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,SAA2C,CAAC;AAAA,EAClD,MAAM,SAAmB,CAAC;AAAA,EAC1B,MAAM,QAAQ,IAAI;AAAA,EAClB,MAAM,eAAe,KAAK,KAAK,iBAAiB,KAAK;AAAA,EAErD,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,OAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IAChD,MAAM,OAAO,MAAK,KAAK,IAAI;AAAA,IAC3B,MAAM,UAAU,WAAW,GAAG;AAAA,IAE9B,IAAI,QAAQ,gBAAgB;AAAA,MAC1B,IAAI,eAAe,IAAI,MAAM,eAAe,QAAQ,GAAG,GAAG;AAAA,QACxD,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KACL,sBAAsB,QAAQ,iBAAiB,6CAC7C,uFACJ;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,IAEA,IAAI,QAAQ,YAAY,UAAU,OAAO,MAAM;AAAA,MAC7C,IAAI,SAAS,IAAI;AAAA,QACf,IAAI,SAAS;AAAA,UAAW;AAAA,QACxB,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KACL,GAAG,4EACL;AAAA,MACF,EAAO,SAAI,SAAS,WAAW;AAAA,QAC7B,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,WAAW,YAAY,IAAI,CAAC,GAAG;AAAA,UACjC,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,+BAA+B,CAAC;AAAA,QAC9E,EAAO;AAAA,cAAI,OAAO;AAAA,MACpB,EAAO;AAAA,QACL,MAAM,UAAU,YAAY,KAAK,MAAM,IAAI;AAAA,QAC3C,IAAI,QAAQ,WAAW;AAAA,UAAW,OAAO,KAAK,QAAQ,MAAM;AAAA,QAC5D,IAAI,QAAQ,aAAa,MAAM;AAAA,UAC7B,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,+BAA+B,CAAC;AAAA,QAC9E;AAAA,QACA,IAAI,QAAQ,QAAQ;AAAA,UAAW,IAAI,OAAO,QAAQ;AAAA,QAClD,IAAI,QAAQ,WAAW;AAAA,UAAW,OAAO,KAAK,EAAE,MAAM,KAAK,MAAM,QAAQ,OAAO,CAAC;AAAA,QACjF,IAAI,OAAO,KAAK,OAAO,EAAE,SAAS;AAAA,UAAG,MAAM,IAAI,GAAG;AAAA;AAAA,MAEpD;AAAA,IACF;AAAA,IAEA,IAAI,UAAU,OAAO,OAAO;AAAA,MAC1B,MAAM,QAAO,SAAS,KAAK,SAAS,YAAY,SAAS,aAAa,QAAQ,MAAM,IAAI;AAAA,MACxF,IAAI,CAAC,OAAM;AAAA,QACT,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,qBAAqB,CAAC;AAAA,MACpE;AAAA,MACA;AAAA,IACF;AAAA,IAEA,IAAI,UAAU,OAAO,OAAO;AAAA,MAC1B,IAAI,SAAS,IAAI;AAAA,QACf,IAAI,SAAS,WAAW;AAAA,UACtB,MAAM,IAAI,GAAG;AAAA,UACb,MAAM,KAAK,GAAG;AAAA,QAChB;AAAA,MACF,EAAO,SAAI,SAAS,WAAW;AAAA,QAC7B,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,OAAO;AAAA,MACb,EAAO;AAAA,QACL,MAAM,OAAO,QAAQ,MAAM,IAAI;AAAA,QAC/B,IAAI,CAAC,QAAQ,KAAK,MAAM,KAAK,IAAI,GAAG;AAAA,UAClC,MAAM,IAAI,GAAG;AAAA,UACb,IAAI,OAAO,SAAS,MAAM,IAAI;AAAA,QAChC;AAAA;AAAA,MAEF;AAAA,IACF;AAAA,IAEA,IAAI,CAAC,aAAa,GAAG,GAAG;AAAA,MACtB,MAAM,IAAI,GAAG;AAAA,MACb,OAAO,KAAK,GAAG,8CAA8C;AAAA,MAC7D;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,SAAS,KAAK,KAAK,WAAW,KAAK,IAAI;AAAA,IACtD,MAAM,UAAU,QAAQ,gBAAgB;AAAA,IACxC,MAAM,MAAM,YAAY,YAAY,KAAK,WAAW,KAAK,OAAO;AAAA,IAChE,IAAI,WAAW;AAAA,MAAK;AAAA,IACpB,MAAM,IAAI,GAAG;AAAA,IAEb,MAAM,OAAO,QAAQ,aAAa,SAAS;AAAA,IAC3C,IAAI,QAAQ,cAAc,iBAAiB,QAAQ,IAAI,QAAQ,WAAW,YAAY,GAAG;AAAA,MACvF,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,WAAW,YAAY,CAAC,CAAC;AAAA,IACvE,EAAO,SAAI,SAAS,MAAM,UAAU,IAAI,GAAG,GAAG;AAAA,MAC5C,MAAM,KAAK,GAAG;AAAA,IAChB,EAAO,SAAI,SAAS,IAAI;AAAA,MACtB,OAAO,KAAK,GAAG,2DAA2D;AAAA,IAC5E,EAAO;AAAA,UAAI,OAAO;AAAA,EACpB;AAAA,EACA,OAAO,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,QAAQ,OAAO;AAAA;AAIhE,IAAM,UAAU,CAAC,MAAc,SAC7B,WAAW,UAAU,MAAM,OAAO,MAAM,CAAC,MAAM,WAAW,UAAU,MAAM,OAAO,MAAM,CAAC;;;ACtK1F,IAAM,iBAAiB,CAAC,KAAa,UACnC,GAAG,QAAQ,kFACX,gGACA;AAGK,IAAM,iBAAiB,CAAC,UAA8B;AAAA,EAC3D,MAAM,SAAmB,CAAC;AAAA,EAC1B,IAAI,MAAM,eAAe,aAAa,MAAM,eAAe,IAAI;AAAA,IAC7D,OAAO,KACL,MAAM,OAAO,MAAM,IAAI,uBAAuB,MAAM,sCAClD,kFACJ;AAAA,EACF;AAAA,EACA,MAAM,eAAe,MAAM,iBAAiB,YAAY,OAAO,KAAK,MAAM,YAAY;AAAA,EACtF,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,QAAQ,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IACjD,MAAM,SAAS,WAAW,GAAG,IAAI;AAAA,IAGjC,IAAI,CAAC,aAAa,GAAG;AAAA,MAAG,OAAO,KAAK,GAAG,8CAA8C;AAAA,IACrF,IAAI,UAAU;AAAA,MAAI;AAAA,IAClB,IAAI,WAAW;AAAA,MAAO,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,qBAAqB,CAAC;AAAA,IACzF,MAAM,SAAS,WAAW,QAAQ,QAAQ,WAAW,YAAY,KAAK,IAAI;AAAA,IAC1E,IAAI,WAAW,aAAa,WAAW,MAAM,GAAG;AAAA,MAC9C,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,+BAA+B,CAAC;AAAA,IAC/E;AAAA,IACA,IAAI,QAAQ,SAAS;AAAA,MAAU,OAAO,KAAK,eAAe,KAAK,KAAK,CAAC;AAAA,IACrE,IAAI,QAAQ,cAAc,iBAAiB,IAAI,OAAO,YAAY,GAAG;AAAA,MACnE,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,WAAW,YAAY,CAAC,CAAC;AAAA,IACxE;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,cAAa,CAAC,UAA4C;AAAA,EACrE,MAAM,OAA+B,EAAE,MAAM,OAAO,MAAM,IAAI,EAAE;AAAA,EAChE,IAAI,MAAM,eAAe;AAAA,IAAW,KAAK,gBAAgB,MAAM;AAAA,EAC/D,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,UAAU,MAAM,KAAK;AAAA,EACpE,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,QAAQ,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IACjD,IAAI,UAAU;AAAA,MAAI;AAAA,IAClB,KAAK,OAAO,QAAQ,aAAa,WAAW,KAAK,KAAK,IAAI;AAAA,EAC5D;AAAA,EACA,OAAO;AAAA;;;ACnET,IAAM,QAAQ,CAAC,MAAe,QAAyB;AAAA,EACrD,MAAM,QAAkB,KAAiC;AAAA,EACzD,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,QAAQ;AAAA;AAcnE,IAAM,mBAAmB,CAC9B,MACA,MACA,WACa;AAAA,EACb,MAAM,MAAM,QAAQ,QAAQ,KAAK;AAAA,EACjC,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EAC/B,MAAM,WAAW,MAAM,MAAM,YAAY;AAAA,EACzC,MAAM,UAAoB,CAAC;AAAA,EAC3B,IAAI,SAAS,aAAa,SAAS,KAAK;AAAA,IACtC,QAAQ,KACN,SAAS,OAAO,GAAG,QAAQ,OAAO,IAAI,iDACpC,2DACJ;AAAA,EACF;AAAA,EACA,IAAI,aAAa,aAAa,KAAK,eAAe,aAAa,aAAa,KAAK,YAAY;AAAA,IAC3F,QAAQ,KAAK,2EAA2E;AAAA,EAC1F;AAAA,EACA,OAAO;AAAA;;;ACtBT;;;ACKA;AAWO,IAAM,WAAW,CACtB,OACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW,OAAO;AAAA,EACvC,MAAM,aAAa,OAAO,mBAAmB,MAAM,KAAK,MAAM,UAAU;AAAA,EACxE,IAAI,eAAe,aAAa,WAAW,aAAa;AAAA,IAAM,OAAO;AAAA,EACrE,IAAI,WAAW,SAAS,aAAa,WAAW,SAAS;AAAA,IAAM,OAAO;AAAA,EACtE,OAAO,EAAE,OAAO,WAAW,OAAO,SAAQ,WAAW,KAAK,CAAC;AAAA,CAC5D;;;AC/BH;AACA;;;ACZO,MAAM,wBAAwB,MAAM;AAAA,EACvB,OAAO;AAC3B;;;ACMA;AACA;AACA;AAMO,IAAM,WAAW,CAAC,UAChB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,MAAM,QAAQ,MAAM;AAAA,EACrD,MAAM,SAAS,OAAO,WACpB,MAAM,QACN,YACA,OACM,wBAAiB,EAAE,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,IAAI,EAAE,CAAC,CACvE,EAAE,KACO,aAAI,CAAC,UAAU,EAAE,MAAM,OAAO,UAAU,EAAE,GAC1C,kBAAS,qBAAqB,CAAC,UAAiB,iBAAQ,EAAE,MAAM,WAAW,MAAM,CAAC,CAAC,CAC5F;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,MAAM,OAAgB,OAAO;AAAA,IAE7B,IACE,SAAS,QACT,OAAO,SAAS,YAChB,MAAM,QAAQ,IAAI,KAClB,EAAE,YAAY,SACd,OAAO,KAAK,WAAW,YACvB,KAAK,WAAW,IAChB;AAAA,MACA,OAAO,OAAc,cACnB,IAAI,gBACF,MAAM,OAAO,MAAM,IAAI,8DACzB,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,OAAO,WAClB,MAAM,QACN,YACA,OACQ,8BAAqB,EAAE,MAAM,KAAK,CAAC,CAC7C;AAAA,EAEA,IACE,CAAC,MAAM,QAAQ,IAAI,KACnB,KAAK,KACH,CAAC,QACC,CAAC,OAAO,cAAc,OAAO,KAAK,IAAI,CAAC,KACvC,OAAO,KAAK,IAAI,KAAK,KACrB,OAAO,KAAK,SAAS,YACrB,IAAI,SAAS,MACb,CAAC,CAAC,OAAO,MAAM,EAAE,SAAS,IAAI,IAAI,CACtC,GACA;AAAA,IACA,OAAO,OAAc,cACnB,IAAI,gBAAgB,oDAAoD,CAC1E;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,KAAK,KAAK,CAAC,QAAQ,OAAO,IAAI,IAAI,MAAM,MAAM,IAAI;AAAA,EAChE,IAAI,UAAU,aAAa,MAAM,SAAS,MAAM,QAAQ,MAAM,SAAS,OAAO;AAAA,IAC5E,OAAO,OAAc,cAAK,OAAO,KAAK;AAAA,EACxC;AAAA,EACA,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,cACnB,IAAI,gBACF,QAAQ,OAAO,MAAM,IAAI,UAAU,KAAK,MAAM,MAAM,OAAO,UACzD,GAAG,KAAK,MAAM,MAAM,GAAG,yBAAyB,MAAM,iCACtD,oFACJ,CACF;AAAA,EACF;AAAA,EACA;AAAA,CACD;;;ACtFH;AAEA;AAgBO,IAAM,UAAU,CACrB,OACA,WACA,MACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,KAAK,OAAO,WAAW,MAAM,QAAQ,YAAY,MAAM,SAAS,CAAC;AAAA,EAC9E,IAAI,SAAS;AAAA,IACX,OAAO,OAAc,cACnB,IAAI,gBACF,GAAG,qFACL,CACF;AAAA,EACF,IAAI,OAAO;AAAA,EACX,SAAS,UAAU,EAAG,UAAU,OAAO,WAAW;AAAA,IAChD,MAAM,SAAS,OAAO,WACpB,MAAM,QACN,YACA,OACM,yBAAkB,EAAE,MAAM,MAAM,MAAM,KAAK,CAAC,CACpD,EAAE,KAAY,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CAAC;AAAA,IAW5C,IAAI,WAAW,aAAa,OAAO,WAAW,WAAW;AAAA,MACvD,OACE;AAAA,MACF;AAAA,IACF;AAAA,IACA,IAAI,OAAO,WAAW,WAAW;AAAA,MAC/B,OAAO,KAAK,OAAO,YAAY,4BAA4B;AAAA,MAC3D;AAAA,IACF;AAAA,IACA,OAAc,eAAM,UAAU;AAAA,EAChC;AAAA,EACA,IAAI,SAAS;AAAA,IACX,OAAO,OAAc,cACnB,IAAI,gBACF,GAAG,cAAc,eAAe,kCAAkC,MAAM,gBACtE,GAAG,6CACP,CACF;AAAA,CACH;;;AHzBH,IAAM,gBAAgB;AAAA,EACpB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAGA,IAAM,eAAe;AACrB,IAAM,aAAa;AAEZ,IAAM,gBAAe,CAAC,OAAiB,UAAkD;AAAA,EAC9F,QAAQ,aAAa,IAAI;AAAA,EACzB,MAAM,MAAM;AAAA,EACZ,SAAS,UAAU,IAAI;AAAA,EACvB,MAAM,MAAM;AACd;AAGO,IAAM,cAAc,CAAC,UACnB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,YAAW,KAAK;AAAA,EAQ7B,OAAO,UAAU,cAAc,QAAQ,MAAM,IAAI;AAAA,EACjD,OAAO,OAAO,QACZ,OACM,sBAAc;AAAA,OACf;AAAA,IACH,MAAM,MAAM;AAAA,IACZ,MAAM,OAAO,MAAM,IAAI;AAAA,IACvB,YAAY,KAAK,KAAK,aAAa;AAAA,EACrC,CAAC,GACD,aAAa,OAAO,MAAM,IAAI,KAC9B,YACF;AAAA,CACD;AAYI,IAAM,cAAc,CAAC,OAAiB,QAAmB,WACvD,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,KAAK,OAAO,GAAG,EAAE,SAAS,KAAK,OAAO,MAAM,SAAS,GAAG;AAAA,IACjE,MAAM,OAAO,WACX,KAAK,OAAO,QAAS,WAAW,KAAK,CAAC,IAAI,EAAE,OAAO,EAAG,GACtD,OAAO,KACT;AAAA,IAEA,OAAO,UAAU,cAAc,QAAQ,MAAM,KAAK;AAAA,IAClD,OAAO,OACL,MAAM,QACN,aACA,MACM,yBAAiB,KAAK,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,IAAI,EAAE,CAAC,CAChF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,OAAO,QAAQ;AAAA,IAChC,MAAM,QAAQ,EAAE,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK;AAAA,IAGjD,OAAO,UAAU,cAAc,QAAQ,OAAO,IAAI;AAAA,IAClD,OAAO,QACL,OACM,yBAAiB,KAAK,OAAO,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,IAAI,EAAE,CAAC,GAC/E,QAAQ,KAAK,cAAc,OAAO,MAAM,IAAI,QAAQ,KAAK,QACzD,UACF;AAAA,EACF;AAAA,CACD;AAYI,IAAM,eAAe,CAAC,OAAiB,aACrC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,SAAS,KAAK;AAAA,EAClC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,MAAM,UAAU,IAAI,EAAE;AAAA,EACpC,IAAI,MAAM,SAAS,GAAG;AAAA,IACpB,OAAO,OAAc,cACnB,IAAI,gBACF,cAAc,OAAO,MAAM,IAAI,mBAAmB,MAAM,qCACtD,gBAAgB,MAAM,KAAK,IAAI,qDAC/B,8EACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,QACL,OACM,sBAAc,EAAE,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,IAAI,EAAE,CAAC,GAClE,cAAc,OAAO,MAAM,IAAI,KAC/B,UACF;AAAA,CACD;;;AFlII,IAAM,kBAAkB,CAAC,OAAiB,UAC/C,MAAM,OAAO,MAAM,IAAI,QAAQ,MAAM,kCAAkC,MAAM,KAAK,IAAI,WACtF,gGACA,+FACA;AAMK,IAAM,qBAAqB,CAChC,OACA,OACA,MACA,WAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,MAAM,WAAW;AAAA,IAAG;AAAA,EAC/B,MAAM,WAAU,CAAC,aACR,cAAK,MAAM,MAAM,UAAsB,IAAI,EAAE,MAAM,WAAW,CAAC;AAAA,EACxE,IAAI,EAAE,OAAO,SAAS,OAAO,QAAO;AAAA,IAAI;AAAA,EACxC,OAAO,OAAc,cAAK,IAAI,gBAAgB,gBAAgB,OAAO,OAAO,KAAK,CAAC,CAAC;AAAA,CACpF;;;AZeI,IAAM,aAAa,WAAqB,eAAe,EAAE,sBAAsB,SAAS,CAAC;AAKhG,IAAM,UAAU,CAAC,YACR,cAAK,IAAI,gBAAgB,QAAQ,KAAK;AAAA,CAAI,CAAC,CAAC;AAQrD,IAAM,OAAO,CAAC,OAAiB,MAAuB,SAC7C,aAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,WAAW;AAAA,EACnB,MAAM,YAAW,iBAAiB,MAAM,MAAM,MAAM;AAAA,EACpD,IAAI,UAAS,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,SAAQ;AAAA,EACvD,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,IAAI,CAAC,aAAW,IAAI;AAAA,IAAG;AAAA,EACvB,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,EAKjC,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,WAAW,eAAe,IAAI;AAAA,IACpC,IAAI,SAAS,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,QAAQ;AAAA,IACvD,OAAc,oBACZ,eAAe,KAAK,QAAQ,OAAO,KAAK,IAAI,6CAC1C,6EACJ;AAAA,IACA,OAAO,EAAE,QAAQ,SAAS;AAAA,EAC5B;AAAA,EACA,MAAM,SAAS,MAAM,MAAM,IAAI;AAAA,EAC/B,OAAO,mBAAmB,OAAO,MAAM,MAAM,MAAM;AAAA,EACnD,IAAI,OAAO,OAAO,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,OAAO,MAAM;AAAA,EACjE,MAAM,QAAQ,KAAK,SAAS,OAAO;AAAA,EACnC,IAAI,OAAO,MAAM,WAAW,KAAK,CAAC;AAAA,IAAO,OAAO,EAAE,QAAQ,OAAO;AAAA,EACjE,MAAM,OACJ,OAAO,MAAM,WAAW,IACpB,mBAAmB,KAAK,iBAAiB,OAAO,qCAChD,qBACA,+CAA+C,OAAO,MAAM,KAAK,IAAI,YACrE;AAAA,EACN,OAAc,oBAAW,eAAe,KAAK,QAAQ,OAAO,KAAK,IAAI,MAAM,MAAM;AAAA,EACjF,OAAO,EAAE,QAAQ,SAAS;AAAA,CAC3B;AAoBH,IAAM,YAAY,CAAC,OAAiB,SAC3B,aAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,WAAW;AAAA,EACnB,MAAM,YAAW,iBAAiB,MAAM,MAAM,MAAM;AAAA,EACpD,IAAI,UAAS,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,SAAQ;AAAA,EACvD,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,EACjC,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,WAAW,eAAe,IAAI;AAAA,IACpC,IAAI,SAAS,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,QAAQ;AAAA,IACvD,OAAO,YAAY,IAAI;AAAA,EACzB,EAAO;AAAA,IACL,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,eAAe,OAAO,kBAAkB,OAAO,KAAK,IAAI,QAAQ,KAAK,MAAM;AAAA,IACpF;AAAA,IACA,MAAM,SAAS,MAAM,MAAM,IAAI;AAAA,IAC/B,IAAI,WAAW,aAAa,OAAO,MAAM,SAAS,GAAG;AAAA,MACnD,OAAO,OAAO,QAAQ;AAAA,QACpB,MAAM,OAAO,KAAK,IAAI,uBAAuB,KAAK,yBAChD,GAAG,OAAO,MAAM,KAAK,IAAI,gEACzB;AAAA,MACJ,CAAC;AAAA,IACH;AAAA,IACA,OAAO,mBAAmB,OAAO,MAAM,MAAM,MAAM;AAAA,IACnD,IAAI,OAAO,OAAO,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,OAAO,MAAM;AAAA,IACjE,IAAI,OAAO,MAAM,SAAS;AAAA,MAAG,OAAO,YAAY,MAAM,QAAQ,KAAK,KAAK,SAAS,CAAC;AAAA;AAAA,EAEpF,MAAM,QAAQ,OAAO,SAAS,IAAI;AAAA,EAClC,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAO,QAAQ;AAAA,MACpB,MAAM,OAAO,KAAK,IAAI;AAAA,IACxB,CAAC;AAAA,EACH;AAAA,EACA,MAAM,OAAO,MAAM,MAAM,KAAK,EAAE;AAAA,EAChC,IAAI,KAAK,SAAS,GAAG;AAAA,IACnB,OAAO,OAAO,QAAQ;AAAA,MACpB,MAAM,OAAO,KAAK,IAAI,uBAAuB,KAAK,KAAK,IAAI,6BACzD,yFACA;AAAA,IACJ,CAAC;AAAA,EACH;AAAA,EACA,OAAO,cAAa,MAAM,KAAK;AAAA,CAChC;AAEH,IAAM,UAAU,CAAC,MAAgB,YAAiD;AAAA,EAChF,MAAM,QAAQ,QAAQ,KAAK;AAAA,EAC3B,QAAQ,KAAK;AAAA,EACb,MAAM,QAAQ,QAAQ,KAAK;AAC7B;AAeA,IAAM,OAAO,CAAC,OAAiB,SACtB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,QAAQ,MAAM,MAAM,MAAM;AAAA,EACxC,MAAM,OAAO,OAAO,SAAS,KAAK;AAAA,EAClC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,WAAiB,cAAK,MAAM,MAAM,MAAM,IAAI,EAAE,MAAM,WAAW,CAAC;AAAA,EACtE,OAAO,OAAO,UAAU,OAAO,cAAa,OAAO,IAAI,GAAG,QAAO;AAAA,CAClE;AAUH,IAAM,YAAW;AAAA,EACf,QAAQ,GAAG,MAAM,aACf,aAAa,QAAQ,MAAM,MAAM,GAAG,IAAI;AAAA,EAC1C,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,KAAK,EAAE,KAAK,YAAY,OAAO,GAAG,MAAM,IAAI;AAAA,EAC9C,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,KAAK,EAAE,KAAK,YAAY,OAAO,GAAG,IAAI;AAAA,EACxC,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,UAAU,EAAE,KAAK,YAAY,OAAO,GAAG,IAAI;AAC/C;AAEO,IAAM,qBAAqB,MACvB,kBACP,YACO,iBAAQ,WAAW,SAAS,GAAG,SAAQ,CAAC,EAAE,KAAY,aAAI,cAAc,CAAC,CAClF;;AkBrNF,qBAAS;AACT,uBAAS;AACT;;;ACVO,IAAM,SAAQ;AAErB,IAAM,MAAM,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAuBnF,IAAM,YAAW,CAAC,UAAiE;AAAA,EACxF,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,EAAE,KAAK,IAAI,MAAM,GAAG,GAAG,MAAM,MAAM,MAAM,SAAS,IAAI,MAAM,OAAO,EAAE;AAAA,SACzE;AAAA,MACH,OAAO;AAAA,QACL,mBAAmB,MAAM;AAAA,QACzB,QAAQ,MAAM;AAAA,QACd,eAAe,MAAM;AAAA,QACrB,iBAAiB,IAAI,MAAM,gBAAgB;AAAA,QAC3C,KAAK,IAAI,MAAM,GAAG;AAAA,QAClB,cAAc,MAAM;AAAA,QACpB,SAAS,IAAI,MAAM,OAAO;AAAA,MAC5B;AAAA,SACG;AAAA,MACH,OAAO;AAAA,QACL,oBAAoB,MAAM;AAAA,QAC1B,sBAAsB,IAAI,MAAM,qBAAqB;AAAA,QACrD,aAAa,MAAM;AAAA,QACnB,iBAAiB,MAAM;AAAA,QACvB,gBAAgB,IAAI,MAAM,eAAe;AAAA,MAC3C;AAAA;AAAA;AAWN,IAAM,eAAe,CAAC,UAAqD;AAAA,EACzE,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,CAAC;AAAA,SACL;AAAA,MACH,OAAO,EAAE,sBAAsB,MAAM,0BAA0B,QAAQ,MAAM,IAAI;AAAA,SAC9E;AAAA,MACH,OAAO,EAAE,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,IAAI;AAAA;AAAA;AAcjF,IAAM,YAAW,CAAC,WAAsD;AAAA,EACtE,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EACxC,MAAM,OAAO,MAAM,IAAI;AAAA,EACvB,QAAQ,MAAM;AAAA,KACX,aAAa,KAAK;AACvB;AAEO,IAAM,QAAO,CAAC,UAA6B;AAAA,EAChD,MAAM,SAAS,UAAS,KAAK;AAAA,EAC7B,YAAY,QAAQ,UAAU,OAAO,QAAQ,UAAS,KAAK,CAAC,GAAG;AAAA,IAC7D,IAAI,UAAU;AAAA,MAAW,OAAO,UAAU;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,SAAS,CAAC,UAA6B;AAAA,EAClD,MAAM,QAAQ,OAAO,QAAQ,UAAS,KAAK,CAAC,EACzC,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,YAAY,MAAM;AAAA,EAC3B,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;AAW/B,IAAM,cAAa,CAAC,WAA8B,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,KAAK;;;AChErF,IAAM,iBAAiB,CAAC,UAA+D;AAAA,EAC5F,oBAAoB,KAAK,KAAK,mBAAmB;AAAA,EACjD,sBAAsB,IAAI,KAAK,uBAAuB,MAAK;AAAA,EAC3D,aAAa,KAAK,KAAK,YAAY;AAAA,EACnC,iBAAiB,KAAK,KAAK,gBAAgB;AAAA,EAC3C,gBAAgB,IAAI,KAAK,iBAAiB,MAAK;AAAA,EAC/C,mBAAmB,KAAK,KAAK,oBAAoB,IAAI;AACvD;AASO,IAAM,cAAc,CACzB,YACA,UAEA,WAAW,yBAAyB,MAAM,uBAAuB,OACjE,WAAW,2BAA2B,MAAM,yBAAyB,WACrE,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,sBAAsB,MAAM,oBAAoB,OAC3D,WAAW,qBAAqB,MAAM,mBAAmB,WACzD,WAAW,wBAAwB,MAAM,uBAAuB;;;AClFlE,IAAM,cAAc,CAAC,YAAoC,UAAsC;AAAA,EAC7F,IAAI,MAAM,SAAS;AAAA,IAAiB,OAAO,YAAY,YAAY,KAAK;AAAA,EACxE,MAAM,SACJ,WAAW,SAAS,MAAM,OAAO,WAAU,WAAW,aAAa,MAAM,WAAW;AAAA,EACtF,IAAI,MAAM,SAAS;AAAA,IAAY,OAAO,UAAU,WAAW,UAAU,MAAM,QAAQ;AAAA,EACnF,OACE,UACA,WAAW,mBAAmB,MAAM,iBAAiB,OACrD,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,YAAY,MAAM,UAAU,OACvC,WAAW,wBAAwB,MAAM,sBAAsB,OAC/D,WAAW,sBAAsB,MAAM,oBAAoB,WAC3D,WAAW,2BAA2B,MAAM,0BAA0B;AAAA;AAInE,IAAM,mBAAmB;AAAA,EAC9B,YAAY,CAAC,MAAM,UAAU;AAAA,IAQ3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,SACF,eAAe,IAAI;AAAA,MACtB,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,MAC/C,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,MACpC,IAAI,MAAM;AAAA,MACV,eAAe,KAAK,KAAK,gBAAgB;AAAA,MACzC,iBAAiB,IAAI,KAAK,kBAAkB,MAAK;AAAA,MACjD,KAAK,IAAI,KAAK,QAAQ,MAAK;AAAA,MAC3B,cAAc,KAAK,KAAK,eAAe;AAAA,MACvC,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,MAAM,IAAI,KAAK,SAAS,CAAC;AAAA,MACzB,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,SAAS,IAAI,KAAK,YAAY,MAAK;AAAA,MACnC,MAAM,MAAM;AAAA,MACZ,sBAAsB,KAAK,KAAK,uBAAuB,IAAI;AAAA,IAC7D;AAAA;AAAA,EAGF,YAAY,CAAC,UAAU,0BAA0B,MAAM;AAAA,EAEvD,YAAY;AAAA,EAMZ,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EAKA,SAAS,CAAC,YAAY,UACpB,WAAW,WAAW,MAAM,UAC5B,WAAW,SAAS,MAAM,QAC1B,WAAW,aAAa,MAAM,YAAY,SAC1C,YAAY,YAAY,KAAK;AAAA,EAC/B,MAAM,CAAC,UAAU,0BAA0B,MAAM;AAAA,EAEjD,YAAY;AACd;;;ACrFA;AACA,8BAAS;AACT;AACA;AAWO,IAAM,sBAAsB,CAAC,UAClC,OAAO,MAAM,QAAQ,QAAQ,OAAe,iCAAwB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC9E,iBAAQ,CAAC,UACP,4BAA2B,eAAc,gBAAe,eAAO,CAAC,EAAE,KAAI,EAAE,KACtE,kBACL,MACE,IAAI,mBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC,CACL,CACF,CACF,GACO,kBAAS,wBAAwB,MAAa,iBAAQ,SAAS,CAAC,GAChE,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAEK,IAAM,mBAAmB,CAAC,UAC/B,oBAAoB,KAAK,EAAE,KAClB,aAAI,CAAC,QAAS,QAAQ,YAAY,YAAY,iBAAiB,WAAW,KAAK,KAAK,CAAE,CAC/F;AAGK,IAAM,sBAAsB,CACjC,OACA,UAC4C;AAAA,KACzC,QAAO;AAAA,IACR,iBAAiB,KAAK;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,eAAe,KAAK;AAAA,IACpB,eAAe,KAAK;AAAA,IACpB,KAAK,KAAK;AAAA,IACV,cAAc,KAAK;AAAA,IACnB,kBAAkB,KAAK;AAAA,IACvB,oBAAoB,KAAK;AAAA,IACzB,WAAW,KAAK;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,cAAc,KAAK;AAAA,IACnB,iBAAiB,KAAK;AAAA,IACtB,MAAM,KAAK;AAAA,IACX,SAAS,KAAK;AAAA,IACd,oBAAoB,KAAK;AAAA,EAC3B,CAAwF;AAAA,EACxF,IAAI,MAAM;AAAA,EACV,MAAM,OAAO,MAAM,IAAI;AAAA,EACvB,QAAQ,MAAM;AAChB;AAOO,IAAM,qBAAqB,CAAC,UAC1B,aAAI,UAAU,GAAG;AAAA,EACtB,KAAK,OAAO,oBAAoB,KAAK,OAAO;AAAA,IAAW;AAAA,EACvD,OAAO,OACL,MAAM,QACN,aACA,MACQ,oCAA2B,EAAE,IAAI,MAAM,GAAG,CAAC,CACrD;AAAA,CACD;;;AJrCH;AACA;AA6FO,IAAM,sBAAsB,WAA8B,sBAAsB;AAWvF,MAAQ,2BAAa,8BAAgB,WAAW,gBAAgB;AAGzD,IAAM,8BAA8B,MAChC,kBACP,qBACO,iBACL,oBAAoB,SAAS,GAAG;AAAA,EAC9B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,iBAAiB,IAAI;AAAA,EACzC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,iBAAiB,IAAI;AAAA,IACzC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,iBAAiB,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC3E;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,iBAAiB,IAAI;AAAA,IACzC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OACL,KAAK,QACL,aACA,MACQ,oCAA2B;AAAA,WAC9B,oBAAoB,MAAM,iBAAiB,WAAW,IAAI,CAAC;AAAA,QAC9D,MAAM,KAAK;AAAA,MACb,CAAC,CACH;AAAA,IACF,EAAO;AAAA,MACL,MAAM,OAAO,WACX,iBAAiB,SACjB,MACA,MACA,iBAAiB,WAAW,IAAI,CAClC;AAAA,MACA,IAAI,SAAS;AAAA,QACX,OAAO,OACL,KAAK,QACL,aACA,MACQ,iCAAwB,oBAAoB,MAAM,IAAI,CAAC,CACjE;AAAA;AAAA,IAEJ,MAAM,QAAQ,OAAO,iBAAiB,IAAI;AAAA,IAC1C,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MACF,GAAG,iBAAiB,KAAK,IAAI,4DAC/B,CACF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAAW,mBAAmB,IAAI;AAC/C,CAAC,CACH,CACF;;AKlKF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACpDA;AACA;;;ACqBO,IAAM,yBAAsC;AAM5C,IAAM,qBAAkC;AAExC,IAAM,oBAAyC,UAAU,wBAAwB,CAAC,GAAG,IAAI;AAEzF,IAAM,gBAAqC,UAAU,oBAAoB,CAAC,GAAG,IAAI;;;ACKxF;AACA;AACA;AAkBA,IAAM,aAAa,CAAC,QAAmB,SAC9B,aAAI,UAAU,GAAG;AAAA,EAQtB,MAAM,aAAa,OAAO,OAAO,QAAQ,MAAM;AAAA,EAC/C,MAAM,OAAO,OAAO,WAAW,QAAQ,YAAY,OAAa,wBAAgB,EAAE,KAAK,CAAC,CAAC;AAAA,EAEzF,OAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK;AAAA,CACxC;AAYI,IAAM,eAAe,CAAC,UAAiB;AAAA,EAC5C,IAAI,UAAS;AAAA,IAAI,OAAO;AAAA,EACxB,MAAM,UAAU,MACb,MAAM;AAAA,CAAI,EACV,OACC,CAAC,UACE,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,MAC5C,CAAC,KAAK,WAAW,KAAK,KACtB,CAAC,KAAK,WAAW,KAAK,CAC1B,EAAE;AAAA,EACJ,OAAO,KAAK,IAAI,SAAS,CAAC;AAAA;AAIrB,IAAM,eAAe,CAAC,QAAmB,SAC9C,WAAW,QAAQ,IAAI,EAAE,KAAY,aAAI,YAAY,CAAC;AAmBxD,IAAM,gBAAgB,CAAC,WACrB,OAAO,QAAQ,QAAQ,OAAe,2BAAkB,CAAC,CAAC,CAAC,EAAE,KACpD,aAAI,CAAC,SAAS;AAAA,EACnB,MAAM,MAAM,QAAQ,CAAC;AAAA,EACrB,MAAM,WAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,SAAS,SAAS;AAAA,EACxD,OAAO;AAAA,IACL,SAAS,IACN,OAAO,CAAC,QAAQ,IAAI,SAAS,UAAU,CAAC,KAAK,IAAI,MAAM,CAAC,EACxD,IAAI,CAAC,QAAQ,KAAK,IAAI,MAAM,WAAW,CAAC;AAAA,IAC3C,SAAS,aAAY,YAAY,OAAO,KAAK,SAAQ,OAAO;AAAA,EAC9D;AAAA,CACD,CACH;AAgBK,IAAM,iBAAiB,CAAC,WAC7B,cAAc,MAAM,EAAE,KACb,aAAI,CAAC,WACV,OAAO,WAAW,OAAO,QAAQ,WAAW,IACxC,YACA,WAAW,OAAO,OAAO,OAAO,cAAc,OAAO,QAAQ,KAAK,IAAI,IAC5E,CACF;AAMK,IAAM,cACX;AACF,IAAM,gBAAgB;AAStB,IAAM,WAAW;AAmBV,IAAM,YAAY,CACvB,QACA,YACA,MACA,MAEA,WAAmB,aAEZ,aAAI,UAAU,GAAG;AAAA,EAEtB,SAAS,UAAU,EAAG,UAAU,UAAU,WAAW,GAAG;AAAA,IAWtD,MAAM,SAAS,OAAO,WACpB,QACA,YACA,OACM,0BAAkB,EAAE,MAAM,KAAK,CAAC,CACxC,EAAE,KAAY,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CAAC;AAAA,IAC5C,IAAI,WAAW;AAAA,MAAW,OAAO;AAAA,IACjC,IAAI,OAAO,WAAW;AAAA,MAAW,OAAO,KAAK,OAAO,YAAY,4BAA4B;AAAA,IAC5F,OAAc,eAAM,UAAU;AAAA,EAChC;AAAA,EACA,OAAO;AAAA,CACR;;;AFjNH,IAAM,SAAS,CAAC,MAAc,QACrB,aAAI,IAAI,MAAM,wBAAwB,SAAS,KAAK,CAAC;AAEvD,IAAM,eAAe,CAAC,UACpB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,SAAS,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,EASrD,IAAI,WAAW;AAAA,IAAG,OAAO,EAAE,MAAM,SAAS,EAAE;AAAA,EAE5C,MAAM,SAAS,OAAO,eAAe,MAAM,MAAM;AAAA,EACjD,IAAI,WAAW,WAAW;AAAA,IACxB,OAAO,OAAO,OACZ,MACA,wEAAwE,cACtE,0EACJ;AAAA,EACF;AAAA,EAWA,OAAO;AAAA,EACP,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,KACX,OAAO,WAAW,MAAM,QAAQ,YAAY,MAAY,uBAAe,EAAE,KAAK,CAAC,CAAC,CAClF;AAAA,EACA,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAO,OACZ,MACA,+FACE,qFACJ;AAAA,EACF;AAAA,EAUA,MAAM,aAAa,OAAO,UAAU,MAAM,QAAQ,YAAY,MAAM,IAAI;AAAA,EACxE,IAAI,eAAe,MAAM;AAAA,IACvB,OAAO,OAAO,OACZ,MACA,qBAAqB,gBAAgB,yCACnC,sBAAsB,cAAc,wDACpC,yBACJ;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,OAAO,eAAe,MAAM,MAAM;AAAA,EAChD,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAO,OACZ,MACA,2DAA2D,sBACzD,2FACA,gEACJ;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,EACnD,IAAI,SAAS,GAAG;AAAA,IACd,OAAO,OAAO,OACZ,MACA,8BAA8B,OAAO,IAAI,sDACvC,2FACJ;AAAA,EACF;AAAA,EACA,OAAO,EAAE,MAAM,SAAS,KAAK;AAAA,CAC9B;;;ADoBI,IAAM,sBAAsB,WAA8B,sBAAsB;AAEvF,IAAM,QAAO,CAAC,UACZ,aAAa,MAAM,QAAQ,MAAM,IAAI,EAAE,KAC9B,aAAI,CAAC,aAAa,EAAE,MAAM,MAAM,MAAM,QAAQ,EAAE,CACzD;AAYF,IAAM,QAAO,CAAC,SACL,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,CAAC,aAAW,IAAI;AAAA,IAAG;AAAA,EACvB,QAAQ,YAAY,OAAO,MAAK,IAAI;AAAA,EACpC,OAAO,YAAY,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,CAC5E;AAaH,IAAM,YAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM,GAAG,WAA+C,MAAK,IAAI;AAAA,EACjE,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAwC,MAAK,IAAI;AAAA,EAC1D,WAAW,GAAG,WAAwC,aAAa,IAAI;AACzE;AAEO,IAAM,8BAA8B,MAChC,kBAAO,qBAA4B,iBAAQ,oBAAoB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AIrFhG,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AClBO,IAAM,sBAAsB;AAC5B,IAAM,sBAAsB;AAU5B,IAAM,SAAQ;AAuBd,IAAM,YAAY,CAAC,UACxB,KAAK,KAAK,EACP,MAAM,SAAS,EACf,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAYN,IAAM,WAAU,CAAC,UAAmB,KAAK,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAGlE,IAAM,QAAO,CAAI,UAAyB,SAC/C,aAAa,aAAa,aAAa;AAElC,IAAM,WAAW,CAAC,UAA8B,SACrD,aAAa,aAAa,UAAU,QAAQ,MAAM;AAE7C,IAAM,cAAc,CAAC,UAA8B,SACxD,aAAa,aAAa,SAAQ,QAAQ,MAAM;AAElD,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAkCtC,IAAM,QAAO,CAAC,WAAqD;AAAA,KACrE,OAAM,aAAa,KAAK,MAAM,SAAS,CAAC;AAAA,KACxC,OAAM,gBAAgB,MAAM,eAAe;AAAA,KAC3C,OAAM,aAAa,MAAM,SAAS;AAAA,KAClC,OAAM,yBAAyB,MAAM,qBAAqB;AAAA,KAC1D,OAAM,gBAAgB,MAAM,YAAY;AAAA,KACxC,OAAM,eAAe,MAAM,WAAW;AAAA,KACtC,OAAM,qBAAqB,MAAM,sBAAsB,OAAO,MAAM,SAAS;AAAA,KAC7E,OAAM,QAAQ,MAAM,IAAI;AAAA,KACxB,OAAM,YAAY,MAAM,QAAQ;AAAA,KAChC,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,OAAO,MAAM,QAAQ,YAAY,YAAY,OAAO,MAAM,GAAG,CAAC;AAAA,KACpE,OAAM,UAAU,MAAM,MAAM;AAAA,KAC5B,OAAM,WAAW,MAAM,eAAe,YAAY,YAAY,OAAO,MAAM,UAAU,CAAC;AAAA,KACtF,OAAM,mBAAmB,MAAM,kBAAkB;AAAA,EACpD,MAAM,MAAM;AACd;AAgBO,IAAM,cAAa,CAAC,WAAqD;AAAA,KAC3E,MAAK,KAAK;AAAA,EACb,OAAO,MAAM;AACf;AAqBO,IAAM,cAAa,CAAC,UAAoD;AAAA,EAC7E,MAAM,QAAQ;AAAA,IACZ,GAAI,MAAM,SAAS,YAAY,CAAC,MAAM,IAAI,CAAC;AAAA,IAC3C,GAAI,MAAM,sBAAsB,QAAQ,CAAC,mBAAmB,IAAI,CAAC;AAAA,EACnE;AAAA,EACA,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;;;AC1MtC;AACA;AAkFA,IAAM,gBAAe,CACnB,MACA,UACsC;AAAA,EACtC,MAAM,OAAO;AAAA,EASb,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,EAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,IAAM;AAAA,EAChD,OAAO;AAAA,IACL,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,aAAa,KAAK,KAAK,cAAc;AAAA,IACrC,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,uBAAuB,KAAK,KAAK,wBAAwB;AAAA,IACzD,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,cAAc,UAAU,KAAK,eAAe;AAAA,IAC5C,YAAY,KAAK,KAAK,aAAa;AAAA,IACnC,aAAa,UAAU,KAAK,cAAc;AAAA,IAC1C,mBAAmB,KAAK,KAAK,oBAAoB;AAAA,IAEjD,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,UAAU,SAAQ,KAAK,WAAW;AAAA,IAClC,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,UAAU,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,YAAY,KAAK,GAAG,IAAI;AAAA,IACzE,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,OAAO,MAAM;AAAA,IACb,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,KAAK,IAAI,KAAK,QAAQ,MAAK;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,UAAU,IAAI,KAAK,aAAa,MAAK;AAAA,IACrC,QAAQ,UAAU,KAAK,SAAS;AAAA,IAChC,MAAM,aAAa,KAAK,MAAM,OAAO;AAAA,IACrC,WAAW,IAAI,KAAK,YAAY,MAAK;AAAA,IACrC,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,EACjD;AAAA;AA2BK,IAAM,sBAAsB,CAAC,UAClC,iBACE,OACE,MAAM,QACN,QACA,OACM,uBAAe,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,KAAK,CAAC,CAC/D,EAAE,KAAY,kBAAS,4BAA4B,MAAa,iBAAQ,SAAS,CAAC,CAAC,CACrF,EAAE,KACO,aAAI,CAAC,SAAS;AAAA,EACnB,IAAI,SAAS;AAAA,IAAY,OAAO;AAAA,EAChC,OAAO,SAAS,YAAY,YAAY,cAAa,MAAM,KAAK;AAAA,CACjE,CACH;AAoBK,IAAM,gBAAgB,CAAC,UAC5B,oBAAoB,KAAK,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAGhE,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;AAc7B,IAAM,WAAU,CAAC,YAAmC,UACzD,WAAW,UAAU,MAAM,QAAQ,OACnC,MAAK,MAAM,SAAS,WAAW,OAAO,KACtC,MAAK,MAAM,WAAW,WAAW,SAAS,KAC1C,MAAK,MAAM,KAAK,WAAW,GAAG,KAC9B,YAAY,MAAM,UAAU,WAAW,QAAQ,KAC/C,SAAS,MAAM,cAAc,WAAW,YAAY,KACpD,SAAS,MAAM,aAAa,WAAW,WAAW,KAClD,MAAK,MAAM,mBAAmB,WAAW,iBAAiB,KAC1D,SAAS,MAAM,QAAQ,WAAW,MAAM,KACxC,MAAK,MAAM,WAAW,WAAW,SAAS,KAC1C,MAAK,MAAM,uBAAuB,WAAW,qBAAqB,KAClE,MAAK,MAAM,iBAAiB,WAAW,eAAe,KACtD,MAAK,MAAM,YAAY,WAAW,UAAU,KAC5C,MAAK,MAAM,oBAAoB,WAAW,kBAAkB;;;AFzHvD,IAAM,qBAAqB,WAA6B,uBAAuB;AAAA,EACpF,sBAAsB;AACxB,CAAC;AASD,IAAM,UAA4C;AAAA,EAChD,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,mBAAmB;AACrB;AAEA,IAAM,cAAc,CAAC,SACnB,OAAO,YAAY,OAAO,QAAQ,IAAI,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,CAAC,CAAC;AAG7F,IAAM,qBAAoB,CAAC,WACxB;AAAA,KACI,YAAY,YAAW,KAAK,CAAC;AAAA,EAChC,MAAM,MAAM;AACd;AAGF,IAAM,qBAAoB,CAAC,WACxB;AAAA,KACI,YAAY,YAAW,KAAK,CAAC;AAAA,EAChC,OAAO,MAAM;AAAA,EACb,MAAM,MAAM;AACd;AAEK,IAAM,6BAA6B,MAC/B,kBACP,oBACO,iBACL,mBAAmB,SAAS,GAAG;AAAA,EAK7B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAG7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,cAAc,IAAI,IAAI,oBAAoB,IAAI,CAC9E;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAC7E,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,KAAK;AAAA,IAC9D,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,oBAAoB,IAAI;AAAA,IAG5C,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBACL,uBACA,GAAG,KAAK,QAAQ,KAAK,SACrB,KAAK,OAAO,OACZ,SAAS,KAAK,QAAQ,MAAM,CAC9B;AAAA,MACA,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,IAAI;AAAA,MAC7D,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAUD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,SAAS,gBAAe,OAAO,cAAc,IAAI,CAAC;AAAA,IACxD,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAC7E,OAAO,YAAW,qBAAqB,YAAW,IAAI,GAAG,KAAK;AAAA,IAC9D,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACM,0BAAkB,mBAAkB,IAAI,CAAC,CACjD;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OACL,KAAK,QACL,aACA,MACM,wBAAgB,mBAAkB,IAAI,CAAC,CAC/C;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,cAAc,IAAI,CAAC;AAAA,IACvD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,SAAS,KAAK,gBAAgB,KAAK,yCACjC,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACM,2BAAmB,EAAE,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,CAAC,CACjE;AAAA,GACD;AACH,CAAC,CACH,CACF;;AGpNF,qBAAS;AACT;AACA;;;AC/BA,uBAAS;AAET;;;ACuFA,IAAM,OAAO,CAAC,UACZ,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC;AAGvE,IAAM,QAAQ,CAAC,QAA2B,cACxC,OAAO,IAAI,CAAC,SAAS,UAAU,KAAK,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,SAAS,EAAE;AAQ3E,IAAM,WAAW,CAAC,SAChB,KACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAEb,IAAM,SAAQ,CAAC,SAAyB;AAAA,EACtC,IAAI,CAAC,KAAK,WAAW,QAAQ;AAAA,IAAG,OAAO;AAAA,EACvC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,IAAI,KAAK;AAAA,IAAG,OAAO;AAAA,EACnB,MAAM,SAAS,KAAK,MAAM,KAAK,CAAC,EAAE,MAAM,GAAG;AAAA,EAC3C,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,KAAK,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,KAAK,GAAG;AAAA;AAG7E,IAAM,QAAO,CAAC,SAAyB;AAGhC,IAAM,iBAAiB,CAAC,YAAuC;AAAA,EACpE,kBAAkB,MAAM,OAAO,qBAAqB,CAAC,GAAG,KAAI,EAAE,KAAK;AAAA,EACnE,eAAe,MAAM,OAAO,kBAAkB,CAAC,GAAG,MAAK,EAAE,KAAK;AAAA,EAC9D,kBAAkB,MAAM,OAAO,qBAAqB,CAAC,GAAG,QAAQ,EAAE,KAAK;AAAA,EACvE,SAAS,MAAM,OAAO,SAAS,KAAI,EAAE,KAAK;AAC5C;AAEO,IAAM,oBAAoB,CAC/B,MACA,UACmC;AAAA,EACnC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,gBAAgB,KAAK,KAAK,eAAe;AAAA,EACzC,kBAAkB,MAAM,KAAK,KAAK,iBAAiB,GAAG,KAAI,EAAE,KAAK;AAAA,EACjE,eAAe,MAAM,KAAK,KAAK,cAAc,GAAG,MAAK,EAAE,KAAK;AAAA,EAC5D,kBAAkB,MAAM,KAAK,KAAK,iBAAiB,GAAG,QAAQ,EAAE,KAAK;AAAA,EAErE,MAAM,KAAK,KAAK,SAAS,KAAK,KAAK;AAAA,EACnC;AAAA,EACA,QAAQ,KAAK,KAAK,SAAS;AAAA,EAC3B,SAAS,MAAM,KAAK,KAAK,SAAS,GAAG,KAAI,EAAE,KAAK;AAClD;AAEA,IAAM,QAAQ,CAAC,GAAsB,MACnC,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,UAAU,SAAS,EAAE,MAAM;AAE9D,IAAM,iBAAiB,CAC5B,YACA,WACY;AAAA,EACZ,MAAM,QAAQ,eAAe,MAAM;AAAA,EACnC,OACE,WAAW,aAAa,OAAO,YAAY,SAC3C,WAAW,qBAAqB,OAAO,oBAAoB,SAC3D,WAAW,UAAU,OAAO,QAAQ,UACpC,MAAM,WAAW,SAAS,MAAM,OAAO,KACvC,MAAM,WAAW,mBAAmB,MAAM,iBAAiB,KAC3D,MAAM,WAAW,gBAAgB,MAAM,cAAc,KACrD,MAAM,WAAW,mBAAmB,MAAM,iBAAiB,MAC1D,OAAO,YAAY,aAAa,WAAW,YAAY,OAAO;AAAA;AAYnE,IAAM,SAAS,CAAC,YAAuC;AAAA,EACrD,SAAS,OAAO,YAAY,OAAQ,MAAiB;AAAA,EACrD,gBAAgB,OAAO,oBAAoB,OAAQ,MAAiB;AAAA,EACpE,MAAM,OAAO,QAAS;AACxB;AAEA,IAAM,QAAQ,CAAC,WAAiF;AAAA,EAC9F,MAAM,QAAQ,eAAe,MAAM;AAAA,EACnC,MAAM,MAAiD,CAAC;AAAA,EACxD,IAAI,MAAM,kBAAkB,SAAS;AAAA,IAAG,IAAI,oBAAoB,MAAM;AAAA,EACtE,IAAI,MAAM,eAAe,SAAS;AAAA,IAAG,IAAI,iBAAiB,MAAM;AAAA,EAChE,IAAI,MAAM,kBAAkB,SAAS;AAAA,IAAG,IAAI,oBAAoB,MAAM;AAAA,EACtE,IAAI,MAAM,QAAQ,SAAS;AAAA,IAAG,IAAI,SAAS,MAAM;AAAA,EACjD,OAAO;AAAA;AASF,IAAM,oBAAoB,CAAC,YAA0D;AAAA,KACvF,OAAO,MAAM;AAAA,KACb,MAAM,MAAM;AAAA,KACX,OAAO,YAAY,aAAa,OAAO,YAAY,KAAK,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;AAAA,EAC3F,MAAM,OAAO;AACf;AAOO,IAAM,oBAAoB,CAAC,WAAyD;AAAA,EACzF,MAAM,UAAU,MAAM,MAAM;AAAA,EAC5B,MAAM,UACJ,CAAC,kBAAkB,eAAe,kBAAkB,QAAQ,EAC5D,OAAO,CAAC,QAAQ,QAAQ,SAAS,SAAS;AAAA,EAC5C,IAAI,OAAO,YAAY;AAAA,IAAI,QAAQ,KAAK,SAAS;AAAA,EACjD,OAAO;AAAA,OACF,OAAO,MAAM;AAAA,OACb;AAAA,OACC,OAAO,YAAY,aAAa,OAAO,YAAY,KAAK,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;AAAA,OACvF,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ,QAAQ;AAAA,EACpD;AAAA;;;AC1NF;AACA;;;ACDA,8BAAS;AACT;AACA;AACA;AAAA;AAGO,MAAM,mCAAwC,kBAAY,4BAA4B,EAE1F;AAAC;AAOG,IAAM,sBAAsB,CAAuB,QAAW,WAC5D,4BAA2B,eAAO,MAAM,GAAG,EAAE,kBAAkB,QAAQ,CAAC,EAC7E,OAAO,YACL,OAAO,QAAQ,MAAM,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,WAAW,KAAK,GAAG,GAAG,KAAK,CAAC,CAChF,CACF,EAAE,KACO,kBAAS,MAAM,IAAI,2BAA2B,EAAE,WAAW,yBAAyB,CAAC,CAAC,CAC/F;AAGK,IAAM,uBACX,CAAuB,WACvB,CAAC,UACQ,4BAA2B,eAAO,MAAM,CAAC,EAAE,KAAI,EAAE,KAC/C,YAAG,KAAI,GACP,kBACL,MACE,IAAI,mBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC,CACL,CACF;;;AD1BG,IAAM,cAAc,CAAC,UAC1B,OACE,MAAM,QACN,QACA,OACQ,uCAA8B,EAAE,MAAM,MAAM,KAAK,CAAC,CAC5D,EAAE,KACO,iBAAQ,qBAA6B,8CAAqC,CAAC,GAC3E,aAAI,CAAC,SACV,kBACE;AAAA,KACK;AAAA,EACH,gBAAgB,KAAK;AAAA,EACrB,kBAAkB,KAAK;AAAA,EACvB,eAAe,KAAK;AAAA,EACpB,kBAAkB,KAAK;AACzB,GACA,MAAM,IACR,CACF,GACO,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAEK,IAAM,gBAAgB,CAAC,UACrB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO,oBACX,kDACR,kBAAkB,KAAK,CACzB;AAAA,EACA,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAc,0CAAiC,KAAK,CAAC;AAAA,CAC/F;AAEI,IAAM,gBAAgB,CAAC,UACrB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO,oBAA4B,+CAAsC;AAAA,OAClF,kBAAkB,KAAK;AAAA,IAC1B,MAAM,MAAM;AAAA,EACd,CAAC;AAAA,EACD,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAc,uCAA8B,KAAK,CAAC;AAAA,CAC5F;AAEI,IAAM,gBAAgB,CAAC,UAC5B,OACE,MAAM,QACN,aACA,MACQ,0CAAiC,EAAE,MAAM,MAAM,KAAK,CAAC,CAC/D,EAAE,KAAY,kBAAS,YAAY,MAAa,aAAI,CAAC;;;AFxCvD,IAAM,QAAQ,CAAC,OAAc,WAC3B,UAAU,4CAA4C,kBAAkB,KAAK,GAAG,MAAM,EAAE,KAC/E,iBACL,UAAU,kDAAkD,kBAAkB,KAAK,GAAG,KAAK,CAC7F,CACF;AAEK,IAAM,kBAAkB;AAAA,EAE7B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WACA,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,YAAY,IAAI;AAAA,IACpC,OAAO,MAAM,MAAM,SAAS,SAAS;AAAA,IACrC,OAAO;AAAA,GACR;AAAA,EACH,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAMO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,IAAI,KAAK,SAAS,KAAK;AAAA,MAAM,OAAO,EAAE,QAAQ,UAAU;AAAA,IACxD,OAAO,MAAM,MAAM,WAAW,SAAS;AAAA,IACvC,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,YAAY,IAAI;AAAA,IACpC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,MAAM,MAAM,IAAI;AAAA,MACvB,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,eAAe,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GACjE;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,YAAY,IAAI;AAAA,IACpC,OAAO,MAAM,MAAM,SAAS,SAAS;AAAA,IACrC,IAAI,SAAS;AAAA,MAAW,OAAO,cAAc,IAAI;AAAA,IAC5C,SAAI,CAAC,eAAe,MAAM,IAAI;AAAA,MAAG,OAAO,cAAc,IAAI;AAAA,IAC/D,MAAM,QAAQ,OAAO,YAAY,IAAI;AAAA,IACrC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,aACnB,IAAI,MAAM,wBAAwB,KAAK,+CAA+C,CACxF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAA4B,cAAc,IAAI;AAC3D;;;ADfO,IAAM,6BAA6B,WACxC,6BACF;AAEO,IAAM,qCAAqC,MACvC,kBACP,4BACO,iBAAQ,2BAA2B,SAAS,GAAG,eAAe,CAAC,CACxE;;AKZF,qBAAS;AACT;AACA;;;ACpDA,uBAAS;AAET;;;ACqBA,IAAM,YAA6E;AAAA,EACjF,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACF;AAGO,IAAM,iBAAiB,CAAC,UAC7B,UAAU,MAAM;;;AChBlB,IAAM,eAAe;AAGd,IAAM,SAAS,CAAC,UAA2B;AAAA,EAChD,MAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,OAAO,SAAS,EAAE,GAAG,EAAE;AAAA,EAC1F,OAAO,OAAO,MAAM,MAAM,IAAI,IAAI;AAAA;AAGpC,IAAM,SAAS,CAAC,UACd,MACG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAWN,IAAM,cAAc,CAAC,UAC1B,OACE,MAAM,QAAQ,KAAK,IACf,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IACzC,OAAO,UAAU,WACf,MAAM,MAAM,SAAS,IACrB,CAAC,CACT;AAGK,IAAM,aAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AAE1F,IAAM,MAAM,CAAC,KAAa,UACxB,UAAU,YAAY,CAAC,IAAI,GAAG,MAAM,MAAM;AAoBrC,IAAM,SAAQ,CAAC,WAA4D;AAAA,EAChF,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,KACrC,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,QAAQ,MAAM,IAAI;AAAA,KACtB,IAAI,WAAW,MAAM,OAAO;AAAA,KAC5B,IAAI,gBAAgB,MAAM,eAAe;AAAA,KACzC,IAAI,UAAU,MAAM,WAAW,YAAY,YAAY,MAAM,OAAO,KAAK,YAAY,CAAC;AAAA,KACtF,IAAI,UAAU,MAAM,WAAW,YAAY,YAAY,YAAY,MAAM,MAAM,CAAC;AAAA,KAChF,IACD,eACA,MAAM,mBAAmB,YAAY,YAAY,YAAY,MAAM,cAAc,CACnF;AAAA,KACG,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,QAAQ,MAAM,IAAI;AAAA,KACtB,IAAI,QAAQ,MAAM,SAAS,YAAY,YAAY,OAAO,MAAM,IAAI,CAAC;AAAA,KACrE,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,OAAO,MAAM,GAAG;AAAA,KACpB,IAAI,YAAY,MAAM,QAAQ;AACnC;AAQO,IAAM,cAAc,CAAC,WAA4D;AAAA,KACnF,OAAM,KAAK;AAAA,EACd,MAAM,MAAM;AACd;;;AC1GO,IAAM,aAA6E;AAAA,EAOxF,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,SAAS,KAAK,eAAe,KAAK,KAAK,eAAe;AAAA,IACtD,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,QAAQ,WAAW,KAAK,SAAS;AAAA,IACjC,QAAQ,YAAY,KAAK,SAAS;AAAA,IAClC,eAAe,YAAY,KAAK,cAAc;AAAA,IAC9C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,MAAM,MAAM;AAAA,IACZ,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,KAAK,KAAK,KAAK,MAAM;AAAA,IACrB,UAAU,KAAK,KAAK,WAAW;AAAA,EACjC;AAAA,EACA,YAAY,CAAC,UAAU,mCAAmC,MAAM;AAAA,EAEhE,YAAY;AAAA,EAEZ,UAAU;AAAA,EAUV,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,YAAY,UACzC,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,aAAa,aAAa,WAAW,aAAa,MAAM,cAC9D,MAAM,oBAAoB,aAAa,WAAW,oBAAoB,MAAM,qBAC5E,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,QAAQ,aAAa,WAAW,QAAQ,MAAM,SACpD,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,WAAW,aAAa,WAAW,WAAW,YAAY,MAAM,MAAM,OAC5E,MAAM,mBAAmB,aACxB,WAAW,mBAAmB,YAAY,MAAM,cAAc,OAC/D,MAAM,WAAW,aAAa,WAAW,WAAW,WAAW,MAAM,MAAM;AAAA,EAC9E,MAAM,CAAC,UAAU,mCAAmC,MAAM,QAAQ,MAAM;AAAA,EACxE,YAAY;AACd;;;AClEA;AAEA;AAOA,IAAM,QAAO,CACX,UAC6E;AAAA,EAC7E,MAAM,UAAU,EAAE,MAAM,MAAM,KAAK;AAAA,EACnC,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAe,+CAAqC,OAAO,EAAE,KACpD,iBAAQ,qBAA6B,sDAA4C,CAAC,GAClF,aAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAClC;AAAA,SACG;AAAA,MACH,OAAe,iDAAuC,OAAO,EAAE,KACtD,iBACL,qBAA6B,wDAA8C,CAC7E,GACO,aAAI,CAAC,SAAS;AAAA,WAChB;AAAA,QACH,gBAAgB,IAAI;AAAA,QACpB,eAAe,IAAI;AAAA,MACrB,EAAE,CACJ;AAAA,SACG;AAAA,MACH,OAAe,6CAAmC,OAAO,EAAE,KAClD,iBAAQ,qBAA6B,oDAA0C,CAAC,GAChF,aAAI,CAAC,SAAS;AAAA,WAChB;AAAA,QACH,gBAAgB,IAAI;AAAA,QACpB,eAAe,IAAI;AAAA,MACrB,EAAE,CACJ;AAAA,SACG;AAAA,MACH,OAAe,gDAAsC,OAAO,EAAE,KACrD,iBAAQ,qBAA6B,uDAA6C,CAAC,GACnF,aAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAClC;AAAA;AAAA;AAIC,IAAM,aAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,QAAQ,OAAO,MAAK,KAAK,CAAC,EAAE,KACxC,aAAI,CAAC,QAAQ,WAAW,WAAW,KAAK,KAAK,CAAC,GAC9C,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAGF,IAAM,SAAS,CAAC,OAAc,WAAoB;AAAA,EAChD,MAAM,OAA0C;AAAA,OAC1C,SAAS,YAAY,KAAK,IAAI,OAAM,KAAK;AAAA,IAC7C,MAAM,MAAM;AAAA,EACd;AAAA,EACA,MAAM,UAAoB,CAAC;AAAA,EAC3B,YAAY,KAAK,WAAW;AAAA,IAC1B,CAAC,UAAU,MAAM,WAAW,YAAY,YAAY,CAAC,GAAG,MAAM,MAAM,CAAC;AAAA,IACrE;AAAA,MACE;AAAA,MACA,MAAM,WAAW,YAAY,YAAY,YAAY,MAAM,MAAM,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAAA,IAC9F;AAAA,IACA;AAAA,MACE;AAAA,MACA,MAAM,mBAAmB,YACrB,YACA,YAAY,MAAM,cAAc,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAAA,IACjE;AAAA,EACF,GAAY;AAAA,IACV,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,IAAI,OAAO,SAAS;AAAA,MAAG,KAAK,OAAO;AAAA,IAC9B;AAAA,MACH,OAAO,KAAK;AAAA,MACZ,IAAI,CAAC;AAAA,QAAQ,QAAQ,KAAK,GAAG;AAAA;AAAA,EAEjC;AAAA,EAEA,IAAI,QAAQ,SAAS;AAAA,IAAG,KAAK,SAAS;AAAA,EACtC,OAAO;AAAA;AAIF,IAAM,sBAAsB,CAAC,OAAc,WAAoB;AAAA,EACpE,MAAM,SAAS,SACX;AAAA,IACE,UAAkB;AAAA,IAClB,MAAc;AAAA,IACd,QAAgB;AAAA,IAChB,SAAiB;AAAA,EACnB,EAAE,MAAM,QACR;AAAA,IACE,UAAkB;AAAA,IAClB,MAAc;AAAA,IACd,QAAgB;AAAA,IAChB,SAAiB;AAAA,EACnB,EAAE,MAAM;AAAA,EACZ,OAAO,oBAAoB,QAAQ,OAAO,OAAO,MAAM,CAAC,EAAE,KAAY,eAAM;AAAA;AAGvE,IAAM,eAAe,CAAC,UAAiB;AAAA,EAC5C,MAAM,OAAO,OAAO,OAAO,IAAI;AAAA,EAC/B,MAAM,YACJ,MAAM,SAAS,aACX,oBAA4B,4DAAkD,IAAI,EAAE,KAC3E,iBAAgB,mDAAyC,CAClE,IACA,MAAM,SAAS,SACb,oBAA4B,wDAA8C,IAAI,EAAE,KACvE,iBAAgB,+CAAqC,CAC9D,IACA,MAAM,SAAS,WACb,oBAA4B,0DAAgD,IAAI,EAAE,KACzE,iBAAgB,iDAAuC,CAChE,IACA,oBAA4B,2DAAiD,IAAI,EAAE,KAC1E,iBAAgB,kDAAwC,CACjE;AAAA,EACV,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAM,SAAS;AAAA;AAGnD,IAAM,eAAe,CAAC,UAAiB;AAAA,EAC5C,MAAM,OAAO,OAAO,OAAO,KAAK;AAAA,EAChC,MAAM,YACJ,MAAM,SAAS,aACX,oBAA4B,yDAA+C,IAAI,EAAE,KACxE,iBAAgB,gDAAsC,CAC/D,IACA,MAAM,SAAS,SACb,oBAA4B,qDAA2C,IAAI,EAAE,KACpE,iBAAgB,4CAAkC,CAC3D,IACA,MAAM,SAAS,WACb,oBAA4B,uDAA6C,IAAI,EAAE,KACtE,iBAAgB,8CAAoC,CAC7D,IACA,oBAA4B,wDAA8C,IAAI,EAAE,KACvE,iBAAgB,+CAAqC,CAC9D;AAAA,EACV,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAM,SAAS;AAAA;AAGnD,IAAM,eAAe,CAAC,UAAiB;AAAA,EAC5C,MAAM,UAAU,EAAE,MAAM,MAAM,KAAK;AAAA,EACnC,MAAM,YACJ,MAAM,SAAS,aACH,oDAA0C,OAAO,IACzD,MAAM,SAAS,SACL,gDAAsC,OAAO,IACrD,MAAM,SAAS,WACL,kDAAwC,OAAO,IAC/C,mDAAyC,OAAO;AAAA,EAClE,OAAO,OAAO,MAAM,QAAQ,aAAa,MAAM,SAAS,EAAE,KACjD,kBAAS,YAAY,MAAa,aAAI,CAC/C;AAAA;;;AJ5IF,MAAQ,2BAAa,8BAAgB,WAAW,UAAU;AAC1D,IAAM,SAAQ,CAAC,OAAc,WAC3B,aAAY,OAAO,MAAM,EAAE,KAAY,iBAAQ,aAAY,KAAK,CAAC,CAAC;AAC7D,IAAM,iBAAiB;AAAA,EAE5B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WACA,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,IACnC,OAAO,OAAM,MAAM,SAAS,SAAS;AAAA,IACrC,OAAO;AAAA,GACR;AAAA,EACH,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAMO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAEvB,IAAI,KAAK,SAAS,KAAK,QAAQ,KAAK,SAAS,KAAK,MAAM;AAAA,MAGtD,MAAM,cAAc,OAAO,WAAW,IAAI;AAAA,MAC1C,OAAO,OAAM,MAAM,gBAAgB,SAAS;AAAA,MAC5C,OAAO,oBAAoB,MAAM,gBAAgB,SAAS;AAAA,MAC1D,OAAO,EAAE,QAAQ,WAAW,aAAa,KAAK,SAAS,KAAK,KAAK;AAAA,IACnE;AAAA,IACA,OAAO,OAAM,MAAM,WAAW,SAAS;AAAA,IACvC,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,IACnC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAM,MAAM,IAAI;AAAA,MACvB,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,WAAW,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GACrE;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,WAAW,IAAI;AAAA,IACnC,OAAO,OAAM,MAAM,SAAS,SAAS;AAAA,IACrC,IAAI,SAAS;AAAA,MAAW,OAAO,aAAa,IAAI;AAAA,IAC3C,SAAI,CAAC,WAAW,QAAQ,MAAM,IAAI;AAAA,MAAG,OAAO,aAAa,IAAI;AAAA,IAClE,MAAM,QAAQ,OAAO,WAAW,IAAI;AAAA,IACpC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,aACnB,IAAI,MAAM,uBAAuB,KAAK,+CAA+C,CACvF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EAEH,QAAQ,GAAG,WAA4B,aAAa,IAAI;AAC1D;;;AD2EO,IAAM,4BAA4B,WACvC,4BACF;AAQO,IAAM,oCAAoC,MACtC,kBACP,2BACO,iBAAQ,0BAA0B,SAAS,GAAG,cAAc,CAAC,CACtE;;AMjHF,qBAAS;AACT;AACA;;;ACnDA,uBAAS;AAET;;;ACgFO,IAAM,aAAa,CACxB,MACA,WAC4B;AAAA,EAC5B,SAAS,eAAe,KAAK,UAAU;AAAA,EACvC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,0BAA0B,KAAK,KAAK,yBAAyB,EAAE,KAAK;AAAA,EACpE,eAAe,KAAK,KAAK,cAAc,EAAE,KAAK;AAAA,EAC9C,cAAc,IAAI,KAAK,eAAe,CAAC;AAAA,EACvC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,EACrC,gBAAgB,IAAI,KAAK,iBAAiB,CAAC;AAAA,EAC3C,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,oBAAoB,eAAe,KAAK,qBAAqB,MAAM;AAAA,EACnE,MAAM,MAAM;AAAA,EACZ,2BAA2B,eAAe,KAAK,0BAA0B;AAAA,EACzE,QAAQ,eAAe,KAAK,SAAS;AAAA,EACrC,eAAe,KAAK,KAAK,cAAc;AAAA,EACvC,MAAM,KAAK,KAAK,OAAO;AAAA,EACvB,kBAAkB,KAAK,KAAK,iBAAiB,EAAE,KAAK;AAAA,EACpD,QAAQ,eAAe,KAAK,SAAS;AAAA,EACrC,cAAc,KAAK,KAAK,aAAa;AACvC;AAEA,IAAM,QAAO,CAAI,UAAyB,SAAY,aAAa,aAAa,aAAa;AAYtF,IAAM,WAAU,CAAC,MAA8B,UACpD,MAAK,MAAM,SAAS,KAAK,OAAO,KAChC,MAAK,MAAM,gBAAgB,KAAK,GAAG,KAAK,cAAc,KACtD,MAAK,MAAM,mBAAmB,KAAK,GAAG,KAAK,iBAAiB,KAC5D,MAAK,MAAM,cAAc,KAAK,YAAY,KAC1C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,eAAe,KAAK,aAAa,KAC5C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,iBAAiB,KAAK,eAAe,KAChD,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,2BAA2B,KAAK,GAAG,KAAK,yBAAyB,MAC3E,MAAM,+BAA+B,aACpC,eAAe,MAAM,0BAA0B,MAAM,KAAK,+BAC5D,MAAK,MAAM,eAAe,KAAK,aAAa,MAC3C,MAAM,WAAW,aAAa,eAAe,MAAM,MAAM,MAAM,KAAK,YACpE,MAAM,WAAW,aAAa,eAAe,MAAM,MAAM,MAAM,KAAK,YACpE,MAAM,wBAAwB,aAC7B,eAAe,MAAM,qBAAqB,MAAM,MAAM,KAAK;AAE/D,IAAM,OAAM,CAAC,KAAa,UACxB,UAAU,YAAY,CAAC,IAAI,GAAG,MAAM,MAAM;AAG5C,IAAM,QAAQ,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAY5F,IAAM,UAAU,CAAC,WAAsD;AAAA,KAClE,KAAI,WAAW,MAAM,OAAO;AAAA,KAC5B,KAAI,eAAe,MAAM,gBAAgB,KAAK,CAAC;AAAA,KAC/C,KAAI,cAAc,MAAM,MAAM,aAAa,CAAC;AAAA,KAC5C,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,aAAa,MAAM,MAAM,YAAY,CAAC;AAAA,KAC1C,KAAI,gBAAgB,MAAM,MAAM,eAAe,CAAC;AAAA,KAChD,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,0BAA0B,MAAM,yBAAyB;AAAA,KAC7D,KAAI,oBAAoB,MAAM,mBAAmB;AAAA,KACjD,KAAI,2BAA2B,MAAM,0BAA0B;AAAA,KAC/D,KAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,KAAI,eAAe,MAAM,cAAc;AAAA,KACvC,KAAI,kBAAkB,MAAM,mBAAmB,KAAK,CAAC;AAAA,KACrD,KAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,KAAI,cAAc,KAAK,MAAM,aAAa,CAAC;AAChD;AAWO,IAAM,cAAa,CAAC,WAAsD;AAAA,KAC5E,QAAQ,KAAK;AAAA,EAChB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,KAKR,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAClE;AAqBO,IAAM,cAAa,CAAC,UAAqD,QAAQ,KAAK;AAEtF,IAAM,UAAS,CAAC,UAA6B,oBAAoB,MAAM;;;ACvN9E;AACA;;;ACOA;AAEA;AAGA;AAQO,IAAM,aAAa,CACxB,QACA,YACA,IACA,WAA0B,mBAE1B,GAAG,KACK,YACC,iBACL,YAAY;AAAA,EACV,SAAS,OAAO;AAAA,EAChB,QAAQ,WAAW;AAAA,EACnB,SAAS,WAAW;AACtB,CAAC,CACH,GACO,iBAAQ,QAAO,CACxB;AAGK,IAAM,SAAS,CACpB,QACA,MACA,OAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,WAAW,QAAQ,YAAY,EAAE;AAAA,CAChD;;;ADzCH,IAAM,UAAU,CAAC,UAAkC;AAAA,KAC7C,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,8BAA8B,YACnC,CAAC,IACD,EAAE,wBAAwB,KAAK,0BAA0B;AAAA,KACzD,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,kBAAkB,YAAY,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc;AAAA,KACzE,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,oBAAoB,YAAY,CAAC,IAAI,EAAE,cAAc,KAAK,gBAAgB;AAAA,KAC/E,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,wBAAwB,YAAY,CAAC,IAAI,EAAE,kBAAkB,KAAK,oBAAoB;AAAA,KAC3F,KAAK,+BAA+B,YACpC,CAAC,IACD,EAAE,yBAAyB,KAAK,2BAA2B;AAAA,KAC3D,KAAK,cAAc,YAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU;AAAA,KAC7D,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,sBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB;AAAA,KACrF,KAAK,cAAc,YAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU;AAAA,KAC7D,KAAK,kBAAkB,YAAY,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc;AAC/E;AAEA,IAAM,gBAAgB,CAAC,WAAmE;AAAA,KACrF,QAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,KACR,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAClE;AAEA,IAAM,gBAAgB,CAAC,WAAgE;AAAA,KAClF,QAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,MAAM,MAAM;AACd;AAEA,IAAM,OAAO,CAAC,SAAqE;AAAA,KAC9E;AAAA,EACH,0BAA0B,IAAI;AAAA,EAC9B,eAAe,IAAI;AAAA,EACnB,cAAc,IAAI;AAAA,EAClB,eAAe,IAAI;AAAA,EACnB,aAAa,IAAI;AAAA,EACjB,gBAAgB,IAAI;AAAA,EACpB,eAAe,IAAI;AAAA,EACnB,eAAe,IAAI;AAAA,EACnB,oBAAoB,IAAI;AAAA,EACxB,2BAA2B,IAAI;AAAA,EAC/B,eAAe,IAAI;AAAA,EACnB,kBAAkB,IAAI;AAAA,EACtB,cAAc,IAAI;AACpB;AAaO,IAAM,UAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAe,0BAAmB,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KACrE,aAAI,CAAC,SAAS,WAAW,KAAK,IAAI,GAAG,KAAK,CAAC,GAC3C,kBAAS,qBAAqB,MAAa,iBAAQ,SAAS,CAAC,CACtE;AAEK,IAAM,YAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,6BAAsB,cAAc,KAAK,CAAC,CAAC;AAE/E,IAAM,YAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,0BAAmB,cAAc,KAAK,CAAC,CAAC;AAG5E,IAAM,YAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EAEtB,KAAK,OAAO,QAAQ,KAAK,OAAO;AAAA,IAAW;AAAA,EAC3C,OAAO,OAAO,OACZ,MAAM,QACN,aACO,6BAAsB,EAAE,MAAM,MAAM,KAAK,CAAC,CACnD;AAAA,CACD;;;AErFH;AAgBA,IAAM,WAAW,CAAC,MAAc,UAAkB;AAAA,EAChD,MAAM,OAAO,CAAC,UAAmB,MAAM,SAAS,IAAI,MAAM,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAChF,OAAO,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA;AAQ3B,IAAM,YAAY,CAAC,MAA8B,UACtD,KAAK,SAAS,MAAM,SAAS,KAAK,MAAM,MAAM,IAAI,IACvC,gBACA,aACL,IAAI,MACF,GAAG,QAAO,KAAK,oBAAoB,MAAM,sBAAsB,KAAK,oBAClE,sFACA,wFACA,0FACA,uCACJ,CACF;AAgBC,IAAM,eAAe,CAAC,MAA8B,UACzD,MAAM,YAAY,aAAa,eAAe,MAAM,OAAO,MAAM,KAAK,UAC3D,gBACA,aACL,IAAI,MACF,GAAG,QAAO,KAAK,uBAAuB,MAAM,2BAC1C,GAAG,KAAK,YAAY,KAAK,+BAA+B,KAAK,0BAC7D,yFACA,yFACA,iFACA,+BACJ,CACF;AA0BC,IAAM,UAAS,CAAU,OAA8B,SACrD,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,IAAI,WAAW,GAAG;AAAA,IAChD,MAAM,OAAO,OAAO;AAAA,IACpB,IAAI,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACvB,OAAc,eAAM,WAAW;AAAA,EACjC;AAAA,EACA,OAAO,OAAO;AAAA,CACf;;;AC/FH;AAMO,IAAM,qBAAqF;AAAA,EAChG,QAAQ;AAAA,EACR,QAAQ;AACV;AAGO,IAAM,sBAAsB,CAAC,UAC3B,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,UAAU,mBAAmB,QAAQ,YAAW,KAAK,GAAG,IAAI;AAAA,EACnE,OAAO,UAAU,mBAAmB,QAAQ,YAAW,KAAK,GAAG,KAAK;AAAA,CACrE;;;ALjBI,IAAM,YAAW;AAAA,EAMtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAwC,QAAQ,IAAI;AAAA,EAO7D,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAKO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAGvB,OAAO,oBAAoB,IAAI;AAAA,IAC/B,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAGhC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAClD,OAAO,UAAU,MAAM,IAAI;AAAA,IAC3B,OAAO,aAAa,MAAM,IAAI;AAAA,IAC9B,OAAO,SAAQ,MAAM,IAAI,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAClF;AAAA,EAMH,WAAkB,YAAG,UAAU,GAAG,QAAqC;AAAA,IAErE,OAAO,oBAAoB,IAAI;AAAA,IAC/B,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,UAAU,IAAI;AAAA,IACvB,EAAO;AAAA,MACL,OAAO,UAAU,MAAM,IAAI;AAAA,MAC3B,OAAO,aAAa,MAAM,IAAI;AAAA,MAE9B,MAAM,OAAO,WAAW,UAAS,MAAM,MAAM,YAAW,IAAI,CAAC;AAAA,MAC7D,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,UAAU,IAAI;AAAA,MACvB;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,QAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,QAAQ,aAAa,SAAQ,KAAK,IAAI,CAAC;AAAA,IAC3F,IAAI,UAAU,aAAa,CAAC,SAAQ,OAAO,IAAI,GAAG;AAAA,MAKhD,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,QAAO,IAAI,qEACZ,+DACA,gFACA,mFACA,2DACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAgBD,QAAe,YAAG,UAAU,GAAG,QAAqC;AAAA,IAClE,OAAO,UAAU,IAAI;AAAA,IACrB,MAAM,OAAO,OAAO,QAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,QAAQ,SAAS;AAAA,IACpE,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,QAAO,IAAI,mEACZ,kFACA,kEACA,GAAG,KAAK,0EACZ,CACF;AAAA,IACF;AAAA,GACD;AACH;;;ADkCO,IAAM,eAAe,WAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAEM,IAAM,uBAAuB,MACzB,kBAAO,cAAqB,iBAAQ,aAAa,SAAS,GAAG,SAAQ,CAAC,CAAC;;AO9GlF,qBAAS;AACT;AACA,uBAAS;AAET;;;AC7CA;AACA;;;ACDA;AACA;AACA;AAAA;AAEO,MAAM,oCAAyC,kBAAY,6BAA6B,EAE5F;AAAC;AAQG,IAAM,oBAAoB,CAAuB,QAAW,YAC1D,4BAA2B,eAAO,MAAM,CAAC,EAAE,OAAM,EAAE,KACjD,kBACL,MACE,IAAI,4BAA4B;AAAA,EAC9B,SACE;AACJ,CAAC,CACL,CACF;;;ADZK,IAAM,eAAc,CAAC,UAC1B,OAAO,MAAM,QAAQ,QAAe,qCAA6B,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,KAC/E,aAAI,CAAC,QACV,kBACE;AAAA,KACK;AAAA,EACH,gBAAgB,IAAI;AAAA,EACpB,kBAAkB,IAAI;AAAA,EACtB,eAAe,IAAI;AAAA,EACnB,kBAAkB,IAAI;AACxB,GACA,MAAM,IACR,CACF,GACO,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAGF,IAAM,gBAAgB,CAAC,OAAc,UAAiD;AAAA,KACjF;AAAA,EACH,cAAc,KAAK;AAAA,EACnB,gBAAgB,KAAK;AAAA,EACrB,aAAa,KAAK;AAAA,EAClB,gBAAgB,KAAK;AAAA,EACrB,MAAM,MAAM;AACd;AAEO,IAAM,iBAAgB,CAAC,OAAc,SAC1C,OACE,MAAM,QACN,aACA,kBACS,gDACP,cAAc,OAAO,IAAI,CAC3B,EAAE,KAAY,iBAAe,uCAA+B,CAAC,CAC/D;AAEK,IAAM,iBAAgB,CAAC,OAAc,SAC1C,OACE,MAAM,QACN,aACA,kBAAyB,6CAAqC,cAAc,OAAO,IAAI,CAAC,EAAE,KACjF,iBAAe,oCAA4B,CACpD,CACF;AAGK,IAAM,iBAAgB,CAAC,UAC5B,OACE,MAAM,QACN,aACO,wCAAgC,EAAE,MAAM,MAAM,KAAK,CAAC,CAC7D,EAAE,KAAY,kBAAS,YAAY,MAAa,aAAI,CAAC;;;ADUhD,IAAM,yBAAyB,WAAiC,yBAAyB;AAKhG,IAAM,eAAc,CAAC,OAAc,oBACjC,UAAU,2CAA2C,kBAAkB,KAAK,GAAG,eAAe;AAChG,IAAM,eAAc,CAAC,UACnB,UAAU,iDAAiD,kBAAkB,KAAK,GAAG,KAAK;AAO5F,IAAM,YAAW;AAAA,EAEf,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAA4B,aAAY,IAAI;AAAA,EACrD,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAMO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,IAAI,KAAK,SAAS,KAAK;AAAA,MAAM,OAAO,EAAE,QAAQ,UAAU;AAAA,IACxD,MAAM,OAAO,OAAO,aAAY,IAAI;AAAA,IACpC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,eAAe,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GACjE;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,aAAY,IAAI;AAAA,IACpC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS;AAAA,MAAW,OAAO,eAAc,MAAM,kBAAkB,IAAI,CAAC;AAAA,IACrE,SAAI,CAAC,eAAe,MAAM,IAAI;AAAA,MAAG,OAAO,eAAc,MAAM,kBAAkB,IAAI,CAAC;AAAA,IACxF,MAAM,QAAQ,OAAO,aAAY,IAAI;AAAA,IACrC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MACF,iCAAiC,KAAK,oEACxC,CACF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAA4B,eAAc,IAAI;AAC3D;AAEO,IAAM,iCAAiC,MACnC,kBACP,wBACO,iBAAQ,uBAAuB,SAAS,GAAG,SAAQ,CAAC,CAC7D;;AG9GF,qBAAS;AACT;AACA;;;ACjBA,uBAAS;AAET;;;ACRA;AAKA;;;ACMA,mBAAS;;;ACYT;AACA;AAmBO,IAAM,aAAa,CACxB,MACA,MAAmB,QAAQ,QACoE;AAAA,EAC/F,MAAM,SAAiC,CAAC;AAAA,EACxC,MAAM,UAAoB,CAAC;AAAA,EAC3B,YAAY,KAAK,QAAQ,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC7C,MAAM,QAAQ,IAAI,IAAI;AAAA,IACtB,IAAI,UAAU,aAAa,UAAU;AAAA,MAAI,QAAQ,KAAK,IAAI,OAAO;AAAA,IAC5D;AAAA,aAAO,OAAO;AAAA,EACrB;AAAA,EACA,OAAO,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG,OAAO;AAAA;AAQzD,IAAM,OAAO,EAAE,GAAG,OAAQ,QAAQ,KAAK,OAAO,MAAM,GAAG,GAAG,GAAG,EAAE;AAC/D,IAAM,SAAS;AAGf,IAAM,YAAY,CAAC,WACjB,KAAK,UACH,OAAO,KAAK,MAAM,EACf,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CACpC;AAEF,IAAM,SAAS,CAAC,MAAc,WAC5B,WAAW,UAAU,MAAM,GAAG,MAAM,IAAI,IAAI;AASvC,IAAM,OAAO,CAAC,QAA0C,SAA0B;AAAA,EACvF,IAAI,OAAO,KAAK,MAAM,EAAE,WAAW;AAAA,IAAG,OAAO;AAAA,EAC7C,MAAM,QAAQ,SAAS,YAAY,YAAY,EAAE,IAAI,OAAO,KAAK,MAAM,MAAM;AAAA,EAC7E,OAAO,GAAG,UAAU,MAAM,SAAS,WAAW,KAAK,OAAO,OAAO,MAAM,EAAE,SAAS,WAAW;AAAA;AASxF,IAAM,cAAc,CAAC,QAAgB,WAAsD;AAAA,EAChG,IAAI,WAAW;AAAA,IAAI,OAAO,OAAO,KAAK,MAAM,EAAE,WAAW;AAAA,EACzD,OAAO,QAAQ,MAAM,QAAQ,SAAS,OAAO,MAAM,GAAG;AAAA,EACtD,IAAI,WAAW,UAAU,SAAS,aAAa,WAAW,aAAa,UAAU,WAAW;AAAA,IAC1F,OAAO;AAAA,EACT;AAAA,EACA,MAAM,WAAW,OAAO,KAAK,QAAQ,WAAW;AAAA,EAChD,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,WAAW,GAAG,MAAM;AAAA,EAC5D,OAAO,SAAS,WAAW,OAAO,UAAU,gBAAgB,UAAU,MAAM;AAAA;;;ADnFvE,IAAM,SAAS,CAAC,UAA0B,QAAO,KAAK,OAAO,MAAM,EAAE,SAAS,QAAQ;AAGtF,IAAM,WAAW,CAAC,UAA0B,QAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,MAAM;AAQxF,IAAM,cAAc,CAAC,SAAmD;AAAA,EAC7E,MAAM,QAAgC,CAAC;AAAA,EACvC,WAAW,QAAQ,KAAK,MAAM,GAAG,GAAG;AAAA,IAClC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC3B,IAAI,KAAK;AAAA,MAAG,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,EACxE;AAAA,EACA,MAAM,QAAQ,MAAM;AAAA,EACpB,OAAO,UAAU,YAAY,EAAE,MAAM,MAAM,WAAW,GAAG,IAAI,EAAE,MAAM,MAAM,WAAW,IAAI,MAAM;AAAA;AAI3F,IAAM,WAAW,CAAC,MAAc,UACrC,QAAQ,cAAc,OAAO,KAAK;AAEpC,IAAM,QAAO,CAAC,UACZ,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC;AAGhE,IAAM,QAAQ,CAAC,SACpB,CAAC,GAAG,IAAI,EACL,OAAO,CAAC,QAAQ,QAAQ,EAAE,EAC1B,KAAK,EACL,KAAK,GAAG;AAON,IAAM,eAAe,CAAC,QAAgB,WAC3C,KAAK,QAAO,8BAA8B,eAAe;AAMpD,IAAM,mBAAmB,CAC9B,MACA,UACoC;AAAA,EACpC,MAAM,UAAkC,CAAC;AAAA,EACzC,WAAW,QAAQ,MAAK,KAAK,SAAS,GAAG;AAAA,IACvC,QAAQ,MAAM,UAAU,YAAY,IAAI;AAAA,IACxC,IAAI,SAAS;AAAA,MAAI,QAAQ,QAAQ,SAAS,SAAS,EAAE;AAAA,EACvD;AAAA,EACA,MAAM,UAAU,MAAK,KAAK,SAAS,EAAE,IAAI,CAAC,SAAS,YAAY,IAAI,EAAE,IAAI;AAAA,EACzE,OAAO;AAAA,IACL,QAAQ,KAAK,KAAK,SAAS;AAAA,IAI3B,MAAM,SAAS,KAAK,KAAK,OAAO,CAAC;AAAA,IACjC,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,QAAQ,MAAM,OAAO,KAAK,OAAO,CAAC;AAAA,IAClC,cAAc,aAAa,MAAM,MAAM,OAAO;AAAA,IAC9C,QAAQ,YAAY,KAAK,SAAS;AAAA,IAClC,eAAe,YAAY,KAAK,cAAc;AAAA,IAC9C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,MAAM,MAAM;AAAA,IAGZ,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,QAAQ,MAAM,OAAO;AAAA,IACrB,QAAQ;AAAA,IACR,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,KAAK,KAAK,KAAK,MAAM;AAAA,IACrB,UAAU,KAAK,KAAK,WAAW;AAAA,EACjC;AAAA;;;AD1FF,IAAM,iBAAgB,CAAC,OAAc,UAAmB;AAAA,KACnD;AAAA,EACH,cAAc,KAAK;AAAA,EACnB,aAAa,KAAK;AAAA,EAClB,MAAM,MAAM;AACd;AAEA,IAAM,QAAO,CACX,UACyF;AAAA,EACzF,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAc,8CAAsC,EAAE,MAAM,MAAM,KAAK,CAAC,EAAE,KACjE,aAAI,CAAC,SAAS;AAAA,WAChB;AAAA,QACH,gBAAgB,IAAI;AAAA,QACpB,eAAe,IAAI;AAAA,MACrB,EAAE,CACJ;AAAA,SACG;AAAA,MACH,OAAc,0CAAkC,EAAE,MAAM,MAAM,KAAK,CAAC,EAAE,KAC7D,aAAI,CAAC,SAAS;AAAA,WAChB;AAAA,QACH,gBAAgB,IAAI;AAAA,QACpB,eAAe,IAAI;AAAA,MACrB,EAAE,CACJ;AAAA,SACG;AAAA,MACH,OACG,6CAAqC,EAAE,MAAM,MAAM,KAAK,CAAC,EACzD,KAAY,aAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;AAAA;AAAA;AAIxC,IAAM,cAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,QAAQ,MAAK,KAAK,CAAC,EAAE,KACjC,aAAI,CAAC,QAAQ,iBAAiB,KAAK,KAAK,CAAC,GACzC,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAGK,IAAM,uBAAsB,CAAC,OAAc,MAAe,SAA8B;AAAA,EAC7F,MAAM,SACJ,SAAS,WACL;AAAA,IACE,UAAiB;AAAA,IACjB,MAAa;AAAA,IACb,SAAgB;AAAA,EAClB,EAAE,MAAM,QACR;AAAA,IACE,UAAiB;AAAA,IACjB,MAAa;AAAA,IACb,SAAgB;AAAA,EAClB,EAAE,MAAM;AAAA,EACd,OAAO,kBAAkB,QAAQ,eAAc,OAAO,IAAI,CAAC,EAAE,KAAY,eAAM;AAAA;AAG1E,IAAM,gBAAe,CAAC,OAAc,SAAkB;AAAA,EAC3D,MAAM,UAAS,eAAc,OAAO,IAAI;AAAA,EACxC,MAAM,YACJ,MAAM,SAAS,aACX,kBAAyB,yDAAiD,OAAM,EAAE,KACzE,iBAAe,gDAAwC,CAChE,IACA,MAAM,SAAS,SACb,kBAAyB,qDAA6C,OAAM,EAAE,KACrE,iBAAe,4CAAoC,CAC5D,IACA,kBAAyB,wDAAgD,OAAM,EAAE,KACxE,iBAAe,+CAAuC,CAC/D;AAAA,EACR,OAAO,OAAO,MAAM,QAAQ,aAAa,SAAS;AAAA;AAG7C,IAAM,gBAAe,CAAC,OAAc,SAAkB;AAAA,EAC3D,MAAM,UAAS,eAAc,OAAO,IAAI;AAAA,EACxC,MAAM,YACJ,MAAM,SAAS,aACX,kBAAyB,sDAA8C,OAAM,EAAE,KACtE,iBAAe,6CAAqC,CAC7D,IACA,MAAM,SAAS,SACb,kBAAyB,kDAA0C,OAAM,EAAE,KAClE,iBAAe,yCAAiC,CACzD,IACA,kBAAyB,qDAA6C,OAAM,EAAE,KACrE,iBAAe,4CAAoC,CAC5D;AAAA,EACR,OAAO,OAAO,MAAM,QAAQ,aAAa,SAAS;AAAA;AAI7C,IAAM,gBAAe,CAAC,UAAiB;AAAA,EAC5C,MAAM,UAAU,EAAE,MAAM,MAAM,KAAK;AAAA,EACnC,MAAM,YACJ,MAAM,SAAS,aACJ,iDAAyC,OAAO,IACvD,MAAM,SAAS,SACN,6CAAqC,OAAO,IAC5C,gDAAwC,OAAO;AAAA,EAC9D,OAAO,OAAO,MAAM,QAAQ,aAAa,SAAS,EAAE,KAC3C,kBAAS,YAAY,MAAa,aAAI,CAC/C;AAAA;;;AG/FF,IAAM,aAAgF;AAAA,EACpF,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACF;AAGO,IAAM,oBAAoB,CAAC,UAChC,WAAU,MAAM;;;AChBlB,IAAM,eAAe;AAGrB,IAAM,kBACJ;AACF,IAAM,oBAAoB;AAEnB,IAAM,mBAAmB,CAAC,SAC/B,kBAAkB,KAAK,IAAI,KAAK,gBAAgB,KAAK,IAAI;AAE3D,IAAM,WAAU,CAAC,UAA2B,UAAU,MAAM,CAAC,aAAa,KAAK,KAAK;AAG7E,IAAM,2BAA2B,CACtC,WAEA,OAAO,QAAQ,UAAU,CAAC,CAAC,EACxB,OAAO,EAAE,MAAM,WAAW,OAAO,UAAU,YAAY,iBAAiB,IAAI,CAAC,EAC7E,OAAO,IAAI,WAAW,SAAQ,KAAe,CAAC,EAC9C,IAAI,EAAE,UAAU,IAAI,EACpB,KAAK;AAOH,IAAM,0BAA0B,CAAC,QAAsC;AAAA,EAC5E,IAAI,QAAQ;AAAA,IAAW,OAAO,CAAC;AAAA,EAC/B,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,YAAY,oCAAoC,KAAK,GAAG,IAAI,MAAM;AAAA,EACxE,MAAM,KAAK,UAAU,YAAY,GAAG;AAAA,EACpC,IAAI,MAAM,GAAG;AAAA,IACX,MAAM,WAAW,UAAU,MAAM,GAAG,EAAE;AAAA,IACtC,MAAM,QAAQ,SAAS,QAAQ,GAAG;AAAA,IAClC,IAAI,SAAS,KAAK,SAAQ,SAAS,MAAM,QAAQ,CAAC,CAAC;AAAA,MAAG,IAAI,KAAK,UAAU;AAAA,EAC3E;AAAA,EAEA,MAAM,SAAS,IAAI,QAAQ,WAAW,EAAE;AAAA,EACxC,WAAW,QAAQ,OAAO,MAAM,OAAO,GAAG;AAAA,IACxC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC3B,MAAM,OAAO,KAAK,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE;AAAA,IAC7C,IAAI,MAAM,KAAK,iBAAiB,IAAI,KAAK,SAAQ,KAAK,MAAM,KAAK,CAAC,CAAC;AAAA,MAAG,IAAI,KAAK,IAAI,MAAM;AAAA,EAC3F;AAAA,EACA,OAAO;AAAA;;;ACvCT,IAAM,QAAoE;AAAA,EACxE,QAAQ,CAAC,YAAY,MAAM;AAAA,EAC3B,MAAM,CAAC,SAAS;AAAA,EAChB,gBAAgB,CAAC,YAAY,MAAM;AAAA,EACnC,QAAQ,CAAC,SAAS;AAAA,EAClB,QAAQ,CAAC,YAAY,MAAM;AAAA,EAC3B,eAAe,CAAC,YAAY,MAAM;AAAA,EAClC,QAAQ,CAAC,SAAS;AAAA,EAClB,MAAM,CAAC,MAAM;AAAA,EACb,UAAU,CAAC,MAAM;AAAA,EACjB,MAAM,CAAC,MAAM;AAAA,EACb,QAAQ,CAAC,SAAS;AAAA,EAClB,QAAQ,CAAC,MAAM;AAAA,EACf,KAAK,CAAC,SAAS;AAAA,EACf,UAAU,CAAC,MAAM;AACnB;AAEA,IAAM,WAA8D;AAAA,EAClE,UAAU,CAAC;AAAA,EACX,MAAM,CAAC,UAAU,cAAc;AAAA,EAC/B,SAAS,CAAC,OAAO,QAAQ;AAC3B;AAGA,IAAM,aAAa;AAGnB,IAAM,aACJ;AAQK,IAAM,WAAW,CAAC,UAA2B;AAAA,EAClD,MAAM,MAAgB,CAAC;AAAA,EACvB,YAAY,QAAO,UAAU,OAAO,QAAQ,KAAK,GAA0C;AAAA,IACzF,IAAI,MAAM,YAAW,aAAa,CAAC,MAAM,SAAS,MAAM,IAAI,GAAG;AAAA,MAC7D,IAAI,KAAK,IAAI,sBAAqB,MAAM,KAAK,GAAG,kBAAkB,MAAM,MAAM;AAAA,IAChF;AAAA,EACF;AAAA,EACA,WAAW,UAAS,SAAS,MAAM,OAAO;AAAA,IACxC,IAAI,MAAM,YAAW,aAAa,MAAM,YAAW;AAAA,MACjD,IAAI,KAAK,GAAG,MAAM,eAAe,SAAQ;AAAA,EAC7C;AAAA,EACA,WAAW,OAAO,CAAC,GAAG,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,GAAG,GAAG,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG;AAAA,IAC1F,IAAI,CAAC,WAAW,KAAK,GAAG;AAAA,MAAG,IAAI,KAAK,IAAI,wCAAwC;AAAA,EAClF;AAAA,EAEA,WAAW,QAAQ,yBAAyB,MAAM,MAAM,GAAG;AAAA,IACzD,IAAI,KAAK,WAAW,qCAAqC,YAAY;AAAA,EACvE;AAAA,EACA,WAAW,SAAS,wBAAwB,MAAM,GAAG,GAAG;AAAA,IACtD,IAAI,KAAK,SAAS,qCAAqC,YAAY;AAAA,EACrE;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,YAAY,CAAC,UAA8C,OAAO,UAAU;AAG3E,IAAM,gBAAgB,CAAC,OAAc,MAAmB,QAAQ,QAAQ;AAAA,EAC7E,MAAM,aAAsC,CAAC;AAAA,EAC7C,MAAM,UAAkC,CAAC;AAAA,EACzC,YAAY,MAAM,UAAU,OAAO,QAAQ,MAAM,UAAU,CAAC,CAAC,GAAG;AAAA,IAC9D,IAAI,UAAU,KAAK;AAAA,MAAG,WAAW,QAAQ;AAAA,IACpC;AAAA,cAAQ,QAAQ;AAAA,EACvB;AAAA,EACA,MAAM,SAAS,WAAW,YAAY,GAAG;AAAA,EACzC,MAAM,aAAsC,CAAC;AAAA,EAC7C,YAAY,MAAM,QAAQ,OAAO,QAAQ,MAAM,UAAU,CAAC,CAAC;AAAA,IAAG,WAAW,UAAU,UAAU;AAAA,EAC7F,IAAI,MAAM,aAAa;AAAA,IAAW,WAAW,cAAc,MAAM;AAAA,EACjE,MAAM,SAAS,WAAW,YAAY,GAAG;AAAA,EACzC,OAAO;AAAA,IACL,QAAQ,EAAE,SAAS,OAAO,SAAS,QAAQ,KAAK,YAAY,OAAO,OAAO,EAAE;AAAA,IAC5E;AAAA,EACF;AAAA;AAMF,IAAM,QAAO,CAAC,UAA8B,SAC1C,aAAa,aAAa,aAAa;AAGlC,IAAM,eAAe,CAAC,MAAuC,UAClE,KAAK,aAAa,MAAM,YAAY,SACpC,MAAK,MAAM,SAAS,KAAK,OAAO,KAChC,MAAK,MAAM,QAAQ,KAAK,MAAM,KAC9B,MAAK,MAAM,iBAAiB,KAAK,eAAe,KAChD,MAAK,MAAM,QAAQ,KAAK,MAAM,MAC7B,MAAM,SAAS,aAAa,MAAM,SAAS,KAAK,SACjD,MAAK,MAAM,MAAM,KAAK,IAAI,KAC1B,MAAK,MAAM,UAAU,KAAK,QAAQ,KAClC,MAAK,MAAM,KAAK,KAAK,GAAG,KACxB,MAAK,MAAM,QAAQ,KAAK,MAAM,KAC9B,MAAK,MAAM,MAAM,KAAK,IAAI,MACzB,MAAM,WAAW,aAAa,YAAY,MAAM,MAAM,MAAM,KAAK,YACjE,MAAM,mBAAmB,aAAa,YAAY,MAAM,cAAc,MAAM,KAAK;AAE7E,IAAM,cAAc,CACzB,MACA,OACA,WACe;AAAA,EACf,IAAI,MAAM,WAAW;AAAA,IAAW,OAAO;AAAA,EACvC,IAAI,MAAM,OAAO,KAAK,MAAM,MAAM,CAAC,MAAM,KAAK;AAAA,IAAQ,OAAO;AAAA,EAC7D,IAAI,OAAO,OAAO,QAAQ,SAAS;AAAA,IAAG,OAAO;AAAA,EAC7C,OAAO,aAAa,MAAM,MAAM,OAAO,OAAO,MAAM,MAAM,KAAK,eAAe,UAAU;AAAA;AAGnF,IAAM,cAAc,CACzB,MACA,OACA,QACA,WACe;AAAA,EACf,IAAI,MAAM,WAAW,aAAa,MAAM,aAAa;AAAA,IAAW,OAAO;AAAA,EACvE,IAAI,MAAM,WAAW,aAAa,MAAM,OAAO,KAAK,MAAM,MAAM,CAAC,MAAM,KAAK;AAAA,IAC1E,OAAO;AAAA,EACT,IAAI,OAAO,OAAO,QAAQ,SAAS,KAAK,WAAW;AAAA,IAAI,OAAO;AAAA,EAC9D,OAAO,YAAY,QAAQ,OAAO,OAAO,MAAM,IAAI,UAAU;AAAA;AAS/D,IAAM,cAAc,CAAC,OAAc,WACjC,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,SACnC,SAAS,MAAM,OAAO,OAAO,OAAO,UAAU,WAAW,EAAE,CAC7D;AAEF,IAAM,cAAc,CAAC,OAAc,WACjC,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,SAAS,MAAM,OAAO,OAAO,OAAO,SAAS,EAAE,CAAC;AAGhG,IAAM,aAAa,CAAC,UAAyD;AAAA,EAC3E,CAAC,UAAU,MAAM,UAAU,EAAE;AAAA,EAC7B,CAAC,QAAQ,MAAM,SAAS,YAAY,KAAK,OAAO,MAAM,IAAI,CAAC;AAAA,EAC3D,CAAC,WAAW,MAAM,WAAW,EAAE;AAAA,EAC/B,CAAC,gBAAgB,MAAM,mBAAmB,EAAE;AAAA,EAC5C,CAAC,UAAU,MAAM,UAAU,EAAE;AAAA,EAC7B,CAAC,QAAQ,MAAM,QAAQ,EAAE;AAAA,EACzB,CAAC,QAAQ,MAAM,SAAS,YAAY,KAAK,OAAO,MAAM,IAAI,CAAC;AAAA,EAC3D,CAAC,UAAU,MAAM,UAAU,EAAE;AAAA,EAC7B,CAAC,OAAO,MAAM,OAAO,EAAE;AAAA,EACvB,CAAC,YAAY,MAAM,YAAY,EAAE;AAAA,EACjC,CAAC,UAAU,MAAM,WAAW,YAAY,CAAC,IAAI,YAAY,MAAM,MAAM,EAAE,MAAM,GAAG,CAAC;AAAA,EACjF;AAAA,IACE;AAAA,IACA,MAAM,mBAAmB,YAAY,CAAC,IAAI,YAAY,MAAM,cAAc,EAAE,MAAM,GAAG;AAAA,EACvF;AACF;AAEA,IAAM,WAAW,CAAC,OAAc,QAC7B,MAA6C,SAAS;AAEzD,IAAM,QAAQ,CAAC,UACb,OAAO,UAAU,WAAW,UAAU,KAAK,MAAM,OAAO,CAAC,SAAS,SAAS,EAAE,EAAE,WAAW;AAQrF,IAAM,aAAa,CACxB,OACA,QACA,OACA,SACY;AAAA,EACZ,MAAM,OAAmD;AAAA,IACvD,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EAC1C;AAAA,EACA,MAAM,UAAoB,CAAC;AAAA,EAC3B,MAAM,MAAM,CAAC,KAAa,UAAsC;AAAA,IAC9D,IAAI,CAAC,MAAM,KAAK;AAAA,MAAG,KAAK,OAAO;AAAA,IAC1B,SAAI,SAAS;AAAA,MAAU,QAAQ,KAAK,GAAG;AAAA;AAAA,EAE9C,YAAY,KAAK,UAAU,WAAW,KAAK;AAAA,IAAG,IAAI,SAAS,OAAO,GAAG;AAAA,MAAG,IAAI,KAAK,KAAK;AAAA,EACtF,IAAI,MAAM,UAAU,MAAM,WAAW;AAAA,IAAW,IAAI,UAAU,YAAY,OAAO,MAAM,CAAC;AAAA,EACxF,IAAI,MAAM,UAAU,MAAM,WAAW;AAAA,IAAW,IAAI,UAAU,YAAY,OAAO,MAAM,CAAC;AAAA,EACxF,IAAI,MAAM,UAAU,MAAM,aAAa,WAAW;AAAA,IAChD,KAAK,cAAc,OAAO,OAAO,OAAO,eAAe;AAAA,EACzD;AAAA,EACA,IAAI,SAAS;AAAA,IAAU,KAAK,UAAU,MAAM;AAAA,EAC5C,IAAI,QAAQ,SAAS;AAAA,IAAG,KAAK,YAAY;AAAA,EACzC,OAAO;AAAA;;;ANvLT,IAAM,OAAO,CAAC,UAAiB,kCAAkC,MAAM,QAAQ,MAAM;AAErF,IAAM,UAAS,CAAC,UAAiB;AAAA,EAC/B,MAAM,UAAU,SAAS,KAAK;AAAA,EAC9B,OAAO,QAAQ,WAAW,IACf,gBACA,aAAI,IAAI,MAAM,GAAG,KAAK,KAAK,MAAM,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA;AAIpE,IAAM,UAAU,CAAC,MAAkB,OAAc,QAAgB,WAAmB;AAAA,EAClF,MAAM,SAAS,YAAY,MAAM,OAAO,MAAM,MAAM;AAAA,EACpD,MAAM,cAAc,YAAY,MAAM,OAAO,QAAQ,MAAM,MAAM;AAAA,EACjE,OAAO,aAAa,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,cAC5C,YACC,EAAE,QAAQ,QAAQ,YAAY;AAAA;AAIrC,IAAM,gBAAgB,CAAC,OAAc,QAAgB,UAAiB;AAAA,EACpE,MAAM,UAAU;AAAA,IACd,GAAI,MAAM,SAAS,OAAO,OAAO,UAAU,CAAC;AAAA,IAC5C,GAAI,MAAM,SAAS,OAAO,OAAO,UAAU,CAAC;AAAA,EAC9C;AAAA,EACA,OAAO,QAAQ,WAAW,IACf,gBACA,aACL,IAAI,MACF,GAAG,KAAK,KAAK,kDAAkD,QAAQ,KAAK,IAAI,OAC9E,6EACJ,CACF;AAAA;AAGC,IAAM,YAAW;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAiB7B,MAAM,GAAG,MAAM,cACZ,WAAW,YAAY,QAAO,IAAI,IAAW,eAAM,KAC3C,iBAAQ,YAAS,IAAI,CAAC,GACtB,aAAI,CAAC,SACV,SAAS,YAAY,YAAY,KAAK,MAAM,QAAQ,QAAQ,UAAU,GAAG,CAC3E,CACF;AAAA,EAOF,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAMO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,WAAW,aAAa,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAC/C,OAAO,QAAO,IAAI;AAAA,IAClB,IAAI,SAAS,cAAc,KAAK,SAAS,KAAK,QAAQ,KAAK,SAAS,KAAK,OAAO;AAAA,MAG9E,MAAM,cAAc,OAAO,YAAS,IAAI;AAAA,MACxC,MAAM,SAAS,cAAc,IAAI;AAAA,MACjC,MAAM,QACJ,gBAAgB,YACZ,EAAE,QAAQ,MAAM,QAAQ,KAAK,IAC7B,QAAQ,aAAa,MAAM,QAAQ,EAAE;AAAA,MAC3C,IAAI,UAAU,WAAW;AAAA,QACvB,OAAO,cAAc,MAAM,QAAQ,KAAK;AAAA,QACxC,MAAM,OAAO,gBAAgB,YAAY,WAAW;AAAA,QACpD,MAAM,OAAO,WAAW,MAAM,QAAQ,OAAO,IAAI;AAAA,QACjD,OAAO,UAAU,kBAAkB,IAAI,EAAE,OAAO,MAAM,gBAAgB,SAAS;AAAA,QAC/E,OAAO,qBAAoB,MAAM,MAAM,IAAI;AAAA,MAC7C;AAAA,MACA,OAAO,EAAE,QAAQ,WAAW,aAAa,KAAK,SAAS,KAAK,KAAK;AAAA,IACnE;AAAA,IACA,MAAM,OAAO,OAAO,YAAS,IAAI;AAAA,IACjC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAClD,OAAO,QAAQ,MAAM,MAAM,cAAc,IAAI,GAAG,OAAO,MAAM,MAAM,YAC9D,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACH,WAAW,GAAG,MAAM,aACX,aAAI,UAAU,GAAG;AAAA,IACtB,OAAO,QAAO,IAAI;AAAA,IAClB,MAAM,SAAS,cAAc,IAAI;AAAA,IACjC,MAAM,OAAO,OAAO,YAAS,IAAI;AAAA,IACjC,IAAI,SAAS,QAAQ,UAAU;AAAA,IAC/B,IAAI,SAAS,WAAW;AAAA,MACtB,MAAM,QAAQ,EAAE,QAAQ,MAAM,QAAQ,KAAK;AAAA,MAC3C,OAAO,cAAc,MAAM,QAAQ,KAAK;AAAA,MACxC,MAAM,OAAO,WAAW,MAAM,QAAQ,OAAO,QAAQ;AAAA,MAQrD,OAAO,UAAU,kBAAkB,IAAI,EAAE,QAAQ,MAAM,IAAI;AAAA,MAC3D,OAAO,cAAa,MAAM,IAAI;AAAA,MAC9B,SAAS,KAAK,OAAO,OAAO,MAAM;AAAA,IACpC,EAAO;AAAA,MACL,MAAM,QAAQ,QAAQ,MAAM,MAAM,QAAQ,MAAM;AAAA,MAChD,IAAI,UAAU,WAAW;AAAA,QACvB,OAAO,cAAc,MAAM,QAAQ,KAAK;AAAA,QACxC,MAAM,OAAO,WAAW,MAAM,QAAQ,OAAO,QAAQ;AAAA,QAErD,OAAO,UAAU,kBAAkB,IAAI,EAAE,QAAQ,MAAM,KAAK;AAAA,QAC5D,OAAO,cAAa,MAAM,IAAI;AAAA,QAC9B,IAAI,MAAM;AAAA,UAAQ,SAAS,KAAK,OAAO,OAAO,MAAM;AAAA,MACtD;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,YAAS,IAAI;AAAA,IAClC,IAAI,UAAU,WAAW;AAAA,MAEvB,OAAO,OAAc,aACnB,IAAI,MAAM,GAAG,KAAK,IAAI,gEAAgE,CACxF;AAAA,IACF;AAAA,IACA,OAAO,KAAK,OAAO,OAAO;AAAA,GAC3B;AAAA,EACH,QAAQ,GAAG,WAA4B,cAAa,IAAI;AAC1D;;;AD3DO,IAAM,wBAAwB,WAAgC,wBAAwB;AAMtF,IAAM,gCAAgC,MAClC,kBACP,uBACO,iBAAQ,sBAAsB,SAAS,GAAG,SAAQ,CAAC,CAC5D;;AQ3DF,qBAAS;AACT;AACA;;;AChFA,uBAAS;AAET;;;ACoCO,IAAM,YAAY;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKA,IAAM,WAAW,CAAC,UAAiD;AAAA,EACjE,MAAM,OAA+B,CAAC;AAAA,EACtC,WAAW,OAAO,WAAW;AAAA,IAC3B,MAAM,QAAQ,MAAM;AAAA,IACpB,IAAI,UAAU;AAAA,MAAW,KAAK,OAAO,OAAO,KAAK;AAAA,EACnD;AAAA,EACA,OAAO;AAAA;AAYF,IAAM,iBAAiB,CAC5B,UACuC;AAAA,EACvC,cAAc,IAAI,KAAK,eAAe,CAAC;AAAA,EACvC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,EACrC,gBAAgB,IAAI,KAAK,iBAAiB,CAAC;AAAA,EAC3C,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAC3C;AASO,IAAM,aAAa,CAAC,aAA+C,UACxE,UAAU,MAAM,CAAC,QAAQ,MAAM,SAAS,aAAa,MAAM,SAAS,YAAW,IAAI;AA2BrF,IAAM,iBAAiB,CAAC,UAAyB,UAAU,KAAK,CAAC,QAAQ,MAAM,SAAS,SAAS;AAEjG,IAAM,eAAe,CAAC,UAAyB;AAAA,EAC7C,IAAI,eAAe,KAAK;AAAA,IAAG;AAAA,EAC3B,MAAM,IAAI,MACR,gBAAgB,MAAM,uEACpB,cAAc,MAAM,wEACpB,gGACA,uFACJ;AAAA;AAIF,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAG7C,IAAM,UAAU,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAoB9F,IAAM,SAAQ,CAAC,WAAkD;AAAA,KAC5D,SAAS,KAAK;AAAA,KACd,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,KAAK,MAAM,OAAO,CAAC;AAAA,KACpC,OAAM,aAAa,QAAQ,MAAM,YAAY,CAAC;AAAA,KAC9C,OAAM,MAAM,MAAM,EAAE;AAAA,EACvB,UAAU,MAAM;AAAA,EAChB,OAAO,MAAM;AACf;AAWO,IAAM,cAAa,CAAC,UAAiD;AAAA,EAC1E,aAAa,KAAK;AAAA,EAClB,OAAO,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA;AA+BlC,IAAM,cAAa,CAAC,UAAiD;AAAA,EAC1E,aAAa,KAAK;AAAA,EAClB,OAAO,OAAM,KAAK;AAAA;;;ACvMpB,IAAM,QAAO,CAAI,WAAyB,SAAY,cAAa,aAAa,cAAa;AAEtF,IAAM,OAAmD;AAAA,EAU9D,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,IACpC,IAAI,MAAM;AAAA,OACP,eAAe,IAAI;AAAA,IACtB,aAAa,IAAI,KAAK,cAAc,EAAE;AAAA,IACtC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,IACvB,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IACnC,OAAO,KAAK,KAAK,UAAU,MAAM,KAAK;AAAA,EACxC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAWZ,UAAU,EAAE,QAAQ,0BAA0B,QAAQ,6BAA6B;AAAA,EACnF,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,YAC9B,YAAW,UAAU,MAAM,SAC3B,MAAK,MAAM,IAAI,YAAW,EAAE,KAC5B,MAAK,MAAM,cAAc,YAAW,YAAY,KAChD,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,WAAW,aAAY,KAAK;AAAA,EAC9B,MAAM,CAAC,UAAU,gBAAgB,MAAM;AAAA,EACvC,YAAY;AACd;;;ACnDA;AACA;AAOA,IAAM,WAAU,CAAC,UAAkC;AAAA,KAC7C,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,kBAAkB,YAAY,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc;AAAA,KACzE,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,oBAAoB,YAAY,CAAC,IAAI,EAAE,cAAc,KAAK,gBAAgB;AAAA,KAC/E,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,mBAAmB,YAAY,CAAC,IAAI,EAAE,aAAa,KAAK,eAAe;AAAA,KAC5E,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,UAAU,YAAY,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;AAAA,KACjD,KAAK,gBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,KAAK,YAAY;AAAA,KACnE,KAAK,aAAa,YAAY,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS;AAChE;AAEA,IAAM,iBAAgB,CAAC,WAA2D;AAAA,KAC7E,SAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,IAAI,MAAM;AAAA,EACV,OAAO,MAAM;AAAA,EACb,UAAU,MAAM;AAClB;AAEA,IAAM,iBAAgB,CAAC,WAAwD;AAAA,KAC1E,SAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,IAAI,MAAM;AACZ;AAGA,IAAM,QAAO,CAAC,SAAiE;AAAA,KAC1E;AAAA,EACH,cAAc,IAAI;AAAA,EAClB,eAAe,IAAI;AAAA,EACnB,aAAa,IAAI;AAAA,EACjB,gBAAgB,IAAI;AAAA,EACpB,eAAe,IAAI;AAAA,EACnB,eAAe,IAAI;AAAA,EACnB,aAAa,IAAI;AACnB;AAGO,IAAM,WAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAe,uBAAe,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC7D,aAAI,CAAC,QAAQ,KAAK,WAAW,MAAK,GAAG,GAAG,KAAK,CAAC,GAC9C,kBAAS,oBAAoB,MAAa,iBAAQ,SAAS,CAAC,CACrE;AAEK,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,0BAAkB,eAAc,KAAK,CAAC,CAAC;AAE3E,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,uBAAe,eAAc,KAAK,CAAC,CAAC;AAGxE,IAAM,aAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EAEtB,KAAK,OAAO,SAAQ,KAAK,OAAO;AAAA,IAAW;AAAA,EAC3C,OAAO,OAAO,OAAO,MAAM,QAAQ,aAAoB,0BAAkB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC;AAAA,CAC3F;;;AH1DH,MAAQ,2BAAa,8BAAgB,WAAW,IAAI;AAE7C,IAAM,YAAW;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAoC,SAAQ,IAAI;AAAA,EACzD,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAKO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,KAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS;AAAA,MAAW,OAAO,WAAU,IAAI;AAAA,IACxC,SAAI,CAAC,KAAK,QAAQ,MAAM,IAAI;AAAA,MAAG,OAAO,WAAU,IAAI;AAAA,IAEzD,MAAM,QAAQ,OAAO,SAAQ,IAAI;AAAA,IACjC,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,cACnB,IAAI,MAAM,GAAG,KAAK,KAAK,IAAI,uCAAuC,CACpE;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAAoC,WAAU,IAAI;AAC/D;;;AD6GO,IAAM,cAAc,WAAsB,cAAc;AAmBxD,IAAM,sBAAsB,MACxB,kBAAO,aAAoB,iBAAQ,YAAY,SAAS,GAAG,SAAQ,CAAC,CAAC;;AK9HhF,qBAAS;AACT;AACA;;;ACvDA,uBAAS;AAET;;;AC+BO,IAAM,SAAQ;AAGrB,IAAM,SAAgC;AAAA,EACpC,IAAI;AAAA,EACJ,GAAG;AAAA,EACH,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AACP;AAkBO,IAAM,QAAQ,CAAC,UAA2B;AAAA,EAC/C,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK;AAAA,EAC7B,MAAM,QAAQ,wCAAwC,KAAK,GAAG;AAAA,EAC9D,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,MAAM,OAAO,OAAM,MAAM,MAAM;AAAA,EAC/B,OAAO,SAAS,YAAY,SAAQ,KAAK,MAAM,OAAO,MAAM,MAAM,GAAG,IAAI,IAAI;AAAA;AAYxE,IAAM,UAAU,CAAC,UACtB,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,KAAK,KAAK;AAsB9F,IAAM,SAAQ,CAAC,WAAyB;AAAA,EACtC,gBAAgB,MAAM;AAAA,EACtB,mBAAmB,MAAM,uBAAuB,OAAO,MAAM;AAAA,EAC7D,OAAO,MAAM;AAAA,KACT,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AAAA,KAClF,MAAM,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,KAC7C,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,KACtD,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW,OAAO,MAAM,UAAU,EAAE;AAAA,KAC5E,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,KACzD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,aAAa;AAAA,KAC1E,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC/D,MAAM,qBAAqB,YAC3B,CAAC,IACD,EAAE,iBAAiB,MAAM,mBAAmB,MAAM,IAAI;AAAA,KACtD,MAAM,qBAAqB,YAC3B,CAAC,IACD,EAAE,iBAAiB,OAAO,MAAM,gBAAgB,EAAE;AACxD;AAYO,IAAM,cAAa,CAAC,WAAiD;AAAA,KACvE,OAAM,KAAK;AAAA,EACd,IAAI,MAAM;AAAA,KACN,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB,MAAM,kBAAkB;AAC/F;AAUO,IAAM,cAAa,CAAC,UAAgD,OAAM,KAAK;AAE/E,IAAM,QAAiD;AAAA,EAiB5D,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,gBAAgB,QAAQ,KAAK,eAAe;AAAA,IAC5C,IAAI,MAAM;AAAA,IACV,aAAa,IAAI,KAAK,cAAc,MAAK;AAAA,IACzC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,IACvB,OAAO,KAAK,KAAK,UAAU,EAAE;AAAA,IAC7B,WAAW,MAAM,KAAK,UAAU;AAAA,IAChC,QAAQ,KAAK,KAAK,WAAW,EAAE;AAAA,IAC/B,aAAa,KAAK,KAAK,cAAc,EAAE;AAAA,IACvC,gBAAgB,KAAK,KAAK,iBAAiB,EAAE;AAAA,IAG7C,mBAAmB,KAAK,KAAK,oBAAoB,KAAK;AAAA,IACtD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IAGnC,iBAAiB,KAAK,KAAK,kBAAkB,KAAK;AAAA,IAClD,OAAO,KAAK,KAAK,UAAU,EAAE;AAAA,IAC7B,kBAAkB,KAAK,KAAK,mBAAmB,MAAM;AAAA,IACrD,iBAAiB,IAAI,KAAK,kBAAkB,MAAK;AAAA,EACnD;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAoBZ,UAAU,EAAE,QAAQ,yBAAyB,QAAQ,4BAA4B;AAAA,EACjF,SAAS,CAAC,aAAY,UACpB,YAAW,wBAAwB,MAAM,uBAAuB,SAChE,YAAW,UAAU,MAAM,SAC3B,YAAW,oBAAoB,MAAM,oBACpC,MAAM,WAAW,aAAa,YAAW,WAAW,MAAM,YAC1D,MAAM,OAAO,aAAa,YAAW,OAAO,MAAM,QAClD,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,aAAa,aAAa,YAAW,aAAa,MAAM,cAC9D,MAAM,YAAY,aAAa,YAAW,YAAY,MAAM,aAC5D,MAAM,UAAU,aAAa,YAAW,UAAU,MAAM,WAIxD,MAAM,qBAAqB,aAC1B,YAAW,qBAAqB,MAAM,sBACvC,MAAM,eAAe,aAAa,YAAW,eAAe,MAAM,gBAClE,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,qBAAqB,aAC1B,YAAW,qBAAqB,MAAM;AAAA,EAE1C,MAAM,CAAC,UAAU,eAAe,MAAM;AAAA,EACtC,YAAY;AACd;;;AC3OA;AACA;AAMA,IAAM,WAAU,CAAC,UAAkC;AAAA,KAC7C,KAAK,oBAAoB,YAAY,CAAC,IAAI,EAAE,cAAc,KAAK,gBAAgB;AAAA,KAC/E,KAAK,uBAAuB,YAAY,CAAC,IAAI,EAAE,iBAAiB,KAAK,mBAAmB;AAAA,KACxF,KAAK,aAAa,YAAY,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS;AAAA,KAC1D,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,UAAU,YAAY,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;AAAA,KACjD,KAAK,aAAa,YAAY,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS;AAAA,KAC1D,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,cAAc,YAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU;AAAA,KAC7D,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,gBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,KAAK,YAAY;AAAA,KACnE,KAAK,qBAAqB,YAAY,CAAC,IAAI,EAAE,eAAe,KAAK,iBAAiB;AAAA,KAClF,KAAK,qBAAqB,YAAY,CAAC,IAAI,EAAE,eAAe,KAAK,iBAAiB;AAAA,KAClF,KAAK,sBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB;AAC3F;AAEA,IAAM,iBAAgB,CAAC,WAAmD;AAAA,KACrE,SAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,IAAI,MAAM;AAAA,EACV,OAAO,MAAM;AAAA,EACb,cAAc,MAAM;AACtB;AAEA,IAAM,iBAAgB,CAAC,WAAsD;AAAA,KACxE,SAAQ,YAAW,KAAK,CAAC;AAAA,EAC5B,IAAI,MAAM;AACZ;AAGA,IAAM,QAAO,CAAC,SAAgE;AAAA,KACzE;AAAA,EACH,gBAAgB,IAAI;AAAA,EACpB,mBAAmB,IAAI;AAAA,EACvB,aAAa,IAAI;AAAA,EACjB,WAAW,IAAI;AAAA,EACf,aAAa,IAAI;AAAA,EACjB,iBAAiB,IAAI;AAAA,EACrB,iBAAiB,IAAI;AAAA,EACrB,kBAAkB,IAAI;AAAA,EACtB,gBAAgB,IAAI;AACtB;AAGO,IAAM,WAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAe,sBAAc,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC5D,aAAI,CAAC,QAAQ,MAAK,WAAW,MAAK,GAAG,GAAG,KAAK,CAAC,GAC9C,kBAAS,mBAAmB,MAAa,iBAAQ,SAAS,CAAC,CACpE;AAEK,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,mBAAW,eAAc,KAAK,CAAC,CAAC;AAEpE,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,sBAAc,eAAc,KAAK,CAAC,CAAC;AAGvE,IAAM,aAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EAEtB,KAAK,OAAO,SAAQ,KAAK,OAAO;AAAA,IAAW;AAAA,EAC3C,OAAO,OAAO,OAAO,MAAM,QAAQ,aAAoB,yBAAiB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC;AAAA,CAC1F;;;AF7DH,MAAQ,2BAAa,8BAAgB,WAAW,KAAI;AAE7C,IAAM,aAAW;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAmC,SAAQ,IAAI;AAAA,EACxD,MAAM,GAAG,MAAM,aACN,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,MAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS;AAAA,MAAW,OAAO,WAAU,IAAI;AAAA,IACxC,SAAI,CAAC,MAAK,QAAQ,MAAM,IAAI;AAAA,MAAG,OAAO,WAAU,IAAI;AAAA,IAEzD,MAAM,QAAQ,OAAO,SAAQ,IAAI;AAAA,IACjC,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,cACnB,IAAI,MAAM,GAAG,MAAK,KAAK,IAAI,uCAAuC,CACpE;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAAmC,WAAU,IAAI;AAC9D;;;ADyKO,IAAM,aAAa,WAAqB,aAAa;AAWrD,IAAM,qBAAqB,MACvB,kBAAO,YAAmB,iBAAQ,WAAW,SAAS,GAAG,UAAQ,CAAC,CAAC;;AIjM9E,qBAAS;AACT;AACA;;;AClCA,uBAAS;AAET;;;AC6EO,IAAM,WAAW,CAAC,gBAAyB,kBAAkC;AAAA,EAClF,IAAI,CAAC;AAAA,IAAgB,OAAO;AAAA,EAG5B,IAAI,gBAAgB;AAAA,IAAG,OAAO;AAAA,EAC9B,OAAO,oCAAoC,OAAO,aAAa;AAAA;AAmC1D,IAAM,SAAQ,CAAC,WAAsD;AAAA,EAC1E,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM;AAAA,EAC9D,OAAO,MAAM;AAAA,KACT,MAAM,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC1D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AAAA,KAClF,MAAM,OAAO,aAAa,MAAM,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,KAChE,MAAM,sBAAsB,YAC5B,CAAC,IACD,EAAE,kBAAkB,OAAO,MAAM,iBAAiB,EAAE;AAC1D;;;ACjHO,IAAM,QAA2D;AAAA,EACtE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,iBAAiB,KAAK,KAAK,oBAAoB,IAAI;AAAA,IACzD,MAAM,gBAAgB,IAAI,KAAK,mBAAmB,EAAE;AAAA,IACpD,OAAO;AAAA,MACL,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,MACjC,IAAI,MAAM;AAAA,MACV,mBAAmB;AAAA,MACnB,aAAa,IAAI,KAAK,cAAc,EAAE;AAAA,MACtC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,MACvB,kBAAkB;AAAA,MAClB,UAAU,SAAS,gBAAgB,aAAa;AAAA,MAChD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,MACnC,OAAO,KAAK,KAAK,UAAU,MAAM,KAAK;AAAA,IACxC;AAAA;AAAA,EAcF,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA,EAaxD,UAAU,EAAE,QAAQ,2BAA2B,QAAQ,8BAA8B;AAAA,EACrF,SAAS,CAAC,aAAY,UACpB,YAAW,UAAU,MAAM,SAI3B,YAAW,cAAc,MAAM,YAAY,OAC3C,YAAW,wBAAwB,MAAM,uBAAuB,WAC/D,MAAM,sBAAsB,aAC3B,YAAW,sBAAsB,MAAM,uBACxC,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,OAAO,aAAa,YAAW,OAAO,MAAM,QAClD,MAAM,YAAY,aAAa,YAAW,YAAY,MAAM;AAAA,EAC/D,MAAM,CAAC,UAAU,iBAAiB,MAAM;AAAA,EACxC,YAAY;AACd;;;AC1EA;AACA;AAOA,IAAM,WAAU,CAAC,UAAkC;AAAA,KAC7C,KAAK,uBAAuB,YAAY,CAAC,IAAI,EAAE,iBAAiB,KAAK,mBAAmB;AAAA,KACxF,KAAK,aAAa,YAAY,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS;AAAA,KAC1D,KAAK,gBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,KAAK,YAAY;AAAA,KACnE,KAAK,eAAe,YAAY,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW;AAAA,KAChE,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,KACtE,KAAK,UAAU,YAAY,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;AAAA,KACjD,KAAK,sBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB;AAC3F;AAEA,IAAM,iBAAgB,CAAC,WAA0D;AAAA,KAC5E,SAAQ,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG,CAAC;AAAA,EAC5C,IAAI,MAAM;AAAA,EACV,OAAO,MAAM;AACf;AAEA,IAAM,iBAAgB,CAAC,WAA6D;AAAA,KAC/E,SAAQ,OAAM,KAAK,CAAC;AAAA,EACvB,IAAI,MAAM;AACZ;AAGA,IAAM,QAAO,CAAC,SAAkE;AAAA,KAC3E;AAAA,EACH,mBAAmB,IAAI;AAAA,EACvB,aAAa,IAAI;AAAA,EACjB,kBAAkB,IAAI;AACxB;AAGO,IAAM,WAAU,CAAC,UACtB,OAAO,MAAM,QAAQ,QAAe,wBAAgB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,KAC9D,aAAI,CAAC,QAAQ,MAAK,WAAW,MAAK,GAAG,GAAG,KAAK,CAAC,GAC9C,kBAAS,qBAAqB,MAAa,iBAAQ,SAAS,CAAC,CACtE;AAEK,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,qBAAa,eAAc,KAAK,CAAC,CAAC;AAEtE,IAAM,aAAY,CAAC,UACxB,OAAO,MAAM,QAAQ,aAAoB,wBAAgB,eAAc,KAAK,CAAC,CAAC;AAGzE,IAAM,aAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EAEtB,KAAK,OAAO,SAAQ,KAAK,OAAO;AAAA,IAAW;AAAA,EAC3C,OAAO,OAAO,OAAO,MAAM,QAAQ,aAAoB,2BAAmB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC;AAAA,CAC5F;;;AHhDH,MAAQ,2BAAa,8BAAgB,WAAW,KAAI;AAE7C,IAAM,aAAW;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAwC,SAAQ,IAAI;AAAA,EAC7D,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAKO,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,MAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACH,WAAW,GAAG,WACL,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,SAAQ,IAAI;AAAA,IAChC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS;AAAA,MAAW,OAAO,WAAU,IAAI;AAAA,IACxC,SAAI,CAAC,MAAK,QAAQ,MAAM,IAAI;AAAA,MAAG,OAAO,WAAU,IAAI;AAAA,IAEzD,MAAM,QAAQ,OAAO,SAAQ,IAAI;AAAA,IACjC,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,cACnB,IAAI,MAAM,GAAG,MAAK,KAAK,IAAI,uCAAuC,CACpE;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACH,QAAQ,GAAG,WAAwC,WAAU,IAAI;AACnE;;;ADwFO,IAAM,eAAe,WAAuB,eAAe;AAgB3D,IAAM,uBAAuB,MACzB,kBAAO,cAAqB,iBAAQ,aAAa,SAAS,GAAG,UAAQ,CAAC,CAAC;;AK3IlF,qBAAS;AACT,uBAAS;AACT;AACA;AACA,8BAAS;AACT;AACA;AA6BO,IAAM,cAAc,WAAsB,cAAc;AAGxD,IAAM,iBAAiB,CAAC,WAAuC;AAAA,EACpE,SAAS,MAAM,WAAW;AAAA,EAC1B,QAAQ,MAAM;AAChB;AAGO,IAAM,iBAAiB,CAAC,WAA6D;AAAA,EAC1F,SAAS,MAAM,WAAW;AAC5B;AAEA,IAAM,QAAO;AAAA,EACX,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,OAAO;AAAA,MACL,SAAS,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU;AAAA,MACzD,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,QAAQ,SAAS;AAAA,MAC3D,QAAQ,MAAM;AAAA,IAChB;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAEZ,UAAU,EAAE,QAAQ,mBAAmB,QAAQ,0BAA0B;AAAA,EACzE,SAAS,CAAC,aAAY,UAAU,YAAW,aAAa,MAAM,WAAW;AAAA,EACzE,MAAM,CAAC,UAAU,SAAS,MAAM;AAAA,EAChC,YAAY;AACd;AAEA,MAAQ,2BAAa,8BAAgB,WAAW,KAAI;AAG7C,IAAM,WAAW,CAAC,UACvB,OAAO,MAAM,QAAQ,QAAQ,OAAa,cAAQ,EAAE,QAAQ,MAAM,OAAO,CAAC,CAAC,EAAE,KACpE,iBAAQ,CAAC,SACP,4BAA2B,eAAa,qBAAe,CAAC,EAAE,IAAI,EAAE,KAC9D,kBACL,MACE,IAAI,mBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC,CACL,GACO,YAAG,IAAI,CAChB,CACF,GACO,aAAI,CAAC,SAAS,MAAK,WAAW,KAAK,KAAK,GAAG,KAAK,CAAC,GACjD,kBAAS,gBAAgB,MAAa,iBAAQ,SAAS,CAAC,GACxD,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAC7D;AAEK,IAAM,cAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,aAAa,MAAY,iBAAW,EAAE,QAAQ,MAAM,OAAO,CAAC,CAAC,EAAE,KAC3E,kBAAS,gBAAgB,MAAa,aAAI,GAC1C,kBAAS,YAAY,MAAa,aAAI,CAC/C;AAEK,IAAM,sBAAsB,MACxB,kBACP,aACO,iBACL,YAAY,SAAS,GAAG;AAAA,EAEtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,SAAS,IAAI;AAAA,EACjC,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,aAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IACjC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,aAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,MAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IACjC,OAAO,aAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,aAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAY,iBAAW,eAAe,IAAI,CAAC,CAAC;AAAA,IACtF,EAAO;AAAA,MACL,MAAM,OAAO,WAAW,MAAK,SAAS,MAAM,MAAM,eAAe,IAAI,CAAC;AAAA,MACtE,IAAI,SAAS;AAAA,QACX,OAAO,OACL,KAAK,QACL,aACA,MACM,cAAQ;AAAA,aACT;AAAA,UACH,QAAQ,KAAK;AAAA,QACf,CAAC,CACH;AAAA;AAAA,IAEJ,MAAM,QAAQ,OAAO,SAAS,IAAI;AAAA,IAClC,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MACF,SAAS,KAAK,6DAChB,CACF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EAED,QAAQ,GAAG,WAAW,YAAW,IAAI;AACvC,CAAC,CACH,CACF;;AC1IK,IAAM,uBAA0C,OAAO,OAAO;AAAA,EACnE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAsDM,IAAM,qBAA6C,OAAO,OAAO;AAAA,EACtE,SACE;AAAA,EACF,WAAW;AAAA,EACX,eAAe;AAAA,EACf,UAAU;AAAA,EACV,UAAU;AAAA,EACV,MAAM;AACR,CAAC;AAyBD,IAAM,KAAK;AACX,IAAM,SAAS;AACf,IAAM,UAAU;AAEhB,IAAM,YAAW,CACf,QACA,UACA,UACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,GAAG,KAAK,OAAM,IAAI;AAAA,IAAG,MAAM,KAAK,UAAU,OAAM,6BAA6B;AAAA,EAClF,IAAI,CAAC,GAAG,KAAK,OAAM,SAAS;AAAA,IAAG,MAAM,KAAK,eAAe,OAAM,+BAA+B;AAAA,EAC9F,IAAI,CAAC,GAAG,KAAK,OAAM,QAAQ;AAAA,IAAG,MAAM,KAAK,cAAc,OAAM,iCAAiC;AAAA,EAC9F,YAAY,QAAO,WAAW;AAAA,IAC5B,CAAC,iBAAiB,OAAM,aAAa;AAAA,IACrC,CAAC,YAAY,OAAM,QAAQ;AAAA,EAC7B,GAAY;AAAA,IACV,IAAI,WAAW,QAAQ,CAAC,OAAO,KAAK,MAAM,GAAG;AAAA,MAC3C,MAAM,KAAK,GAAG,YAAW,wDAAwD;AAAA,IACnF;AAAA,EACF;AAAA,EACA,IAAI,OAAM,aAAa,OAAM;AAAA,IAAe,MAAM,KAAK,yCAAyC;AAAA,EAMhG,MAAM,SAAS,CAAC,UAA8B,WAC5C,aAAa,YAAY,YAAY;AAAA,EACvC,MAAM,UAAyC;AAAA,IAC7C,CAAC,OAAO,MAAM,cAAc,cAAc,GAAG,SAAS,KAAK;AAAA,IAC3D,CAAC,OAAO,MAAM,kBAAkB,kBAAkB,GAAG,SAAS,SAAS;AAAA,EACzE;AAAA,EACA,IAAI,OAAM,aAAa,MAAM;AAAA,IAC3B,QAAQ,KAAK,CAAC,OAAO,MAAM,aAAa,aAAa,GAAG,SAAS,IAAI,CAAC;AAAA,EACxE;AAAA,EACA,MAAM,OAAO,IAAI;AAAA,EACjB,YAAY,QAAO,aAAY,SAAS;AAAA,IACtC,IAAI,QAAQ,KAAK,QAAO,KAAK,KAAK,IAAI,MAAK;AAAA,MAAG;AAAA,IAC9C,KAAK,IAAI,MAAK;AAAA,IACd,MAAM,KAAK,GAAG,uDAAsD;AAAA,EACtE;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,oBAAoB,CAAC,SAAwB,CAAC,MAAyB;AAAA,EAGlF,QAAQ,cAAc,kBAAkB,gBAAgB,SAAS;AAAA,EAEjE,MAAM,QAAQ,OAAO,QAAQ,IAAI,EAAE,OAAO,IAAI,WAAW,UAAU,SAAS;AAAA,EAC5E,MAAM,WAAmC;AAAA,OACpC;AAAA,OACA,OAAO,YAAY,KAAK;AAAA,EAC7B;AAAA,EAGA,MAAM,WAA8B;AAAA,IAClC,OAAO,gBAAgB,SAAS;AAAA,IAChC,WAAW,oBAAoB,SAAS;AAAA,IACxC,MAAM,eAAe,SAAS;AAAA,EAChC;AAAA,EACA,MAAM,QAAQ,UAAS,UAAU,UAAU,MAAK;AAAA,EAChD,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,IAAI,MAAM,uBAAuB,MAAM,KAAK,IAAI,GAAG;AAAA,EAC/E,MAAM,QAA2C;AAAA,IAC/C,CAAC,aAAa,SAAS,eAAe,SAAS,IAAI;AAAA,EACrD;AAAA,EACA,IAAI,SAAS,aAAa;AAAA,IAAM,MAAM,KAAK,CAAC,QAAQ,SAAS,UAAU,SAAS,QAAQ,CAAC;AAAA,EACzF,OAAO;AAAA,IACL,QAAQ,MAAM,IAAI,EAAE,MAAM,QAAQ,aAAa,EAAE,MAAM,QAAQ,OAAO,EAAE;AAAA,IACxE,OAAO,EAAE,SAAS,SAAS,OAAO,SAAS,SAAS,UAAU;AAAA,IAC9D,MAAM,EAAE,OAAO,sBAAsB,QAAQ,SAAS,KAAK;AAAA,IAC3D,OAAO,MAAM,IAAI,EAAE,MAAM,aAAa;AAAA,MACpC,SAAS,SAAS;AAAA,MAClB,QAAQ,CAAC,SAAS,SAAS;AAAA,MAC3B;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AAAA;;AC3LF,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBf,IAAM,WAAW,CAAC,UAAiB,KAAK;AAGxC,IAAM,aACJ,qEACA,iGACA,sEACA,mFACA;AAEF,IAAM,WAAW,GAAG,WAAsC;AAAA,EACxD,MAAM,QAAQ,CAAC,GAAG,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG;AAAA,EAC7C,OAAO;AAAA,SACA,KAAK;AAAA,QACN;AAAA,8BACsB,KAAK;AAAA,8CACW,KAAK;AAAA,oBAC/B,KAAK,+DAA+D,KAAK;AAAA;AAAA,eAE9E,KAAK,mCAAmC,KAAK;AAAA;AAAA;AAAA;AAK5D,IAAM,YAAY,GAAG,YAAuC;AAAA,UAClD,MAAM;AAAA,+BACe,MAAM;AAAA,oBACjB,MAAM,gCAAgC,MAAM;AAAA,qBAC3C,MAAM,qDAAqD,MAAM,sBAAsB,MAAM;AAAA;AAAA,gBAElG,MAAM,qCAAqC,MAAM,sBAAsB,MAAM;AAAA;AAAA;AAI7F,IAAM,WAAW,CAAC,SAAqD;AAAA,EACrE,MAAM,SAAS,CAAC,GAAG,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG;AAAA,EAC/C,MAAM,OAAO,UAAU,gEAAgE,KAAK;AAAA,EAC5F,MAAM,UAAS,YAAY,qBAAqB,KAAK;AAAA,EACrD,OAAO;AAAA,SACA,KAAK,eAAe,KAAK,kBAAkB;AAAA,8BACtB,KAAK,WAAW;AAAA,oBAC1B,4BAA4B,KAAK;AAAA,oBACjC,KAAK;AAAA,wBACD,KAAK,UAAU;AAAA;AAAA,eAExB,KAAK,mCAAmC,KAAK,UAAU;AAAA;AAAA;AAAA;AAKtE,IAAM,YAAY,CAAC,UAAuD;AAAA,EACxE,MAAM,QACJ,sEACA,iBAAiB,SAAS,MAAM,MAAM,wBAAwB,SAAS,MAAM,MAAM,UACnF;AAAA,EACF,OAAO;AAAA,WACE,MAAM,gBAAgB,MAAM,gCAAgC,MAAM;AAAA,2BAClD,oCAAoC,MAAM,UAAU,MAAM;AAAA,mBAClE,MAAM,UAAU,MAAM,iDAAiD,MAAM,kBAAkB,MAAM;AAAA;AAAA;AAKxH,IAAM,cAAc,CAAC,WAA2B;AAAA,oBAC5B,0DAA0D;AAAA;AAOvE,IAAM,qBAAqB,CAAC,SAAwB,CAAC,MAAc;AAAA,EACxE,MAAM,WAAW,kBAAkB,MAAK;AAAA,EACxC,MAAM,WAAW,SAAS,OACvB,IAAI,CAAC,UAAU,MAAM,MAAM,EAC3B,OAAO,CAAC,WAAW,WAAW,SAAS,KAAK,MAAM;AAAA,EACrD,OAAO;AAAA,IACL;AAAA,IACA,GAAG,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,WAAW;AAAA,IACzC,SAAS,QAAQ;AAAA,IACjB,UAAU,QAAQ;AAAA,IAClB,GAAG,SAAS,MAAM,IAAI,QAAQ;AAAA,IAC9B,GAAG,SAAS,OAAO,IAAI,SAAS;AAAA,IAChC;AAAA;AAAA;AAAA,EACF,EAAE,KAAK,EAAE;AAAA;;ACxGX;AACA;AACA;;;ACkBA,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;AC7CO,IAAM,cAAc;AACpB,IAAM,cAAc;AAUpB,IAAM,aAAY,CAAC,UACxB,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK;AAEjF,IAAM,cAAa,CAAC,WAAsD;AAAA,EAC/E,OAAO,WAAU,MAAM,KAAK,EAAE,KAAK,GAAG;AAAA,EACtC,QAAQ,MAAM;AAChB;AAMO,IAAM,cAAa,CAAC,WAAmD;AAAA,EAC5E,OAAO,WAAU,MAAM,KAAK,EAAE,KAAK,GAAG;AAAA,EACtC,QAAQ,MAAM;AAChB;AAEO,IAAM,QAAO,CAAC,MAAyD,WAC5E,KAAK,KAAK,CAAC,QAAQ,IAAI,WAAW,MAAM;AAEnC,IAAM,gBAAe,CAC1B,KACA,WACoB;AAAA,EACpB,OAAO,WAAU,IAAI,UAAU,YAAY,CAAC,IAAI,IAAI,MAAM,MAAM,GAAG,CAAC;AAAA,EACpE,QAAQ,MAAM;AAChB;AAEO,IAAM,WAAU,CAAC,aAA4B,UAClD,WAAU,YAAW,KAAK,EAAE,KAAK,GAAG,MAAM,WAAU,MAAM,KAAK,EAAE,KAAK,GAAG;;;AD4DpE,IAAM,cAAc,WAAsB,cAAc;AAW/D,IAAM,WAAW,CAAC,UAChB,iBAAiB,OAAO,MAAM,QAAQ,QAAQ,OAAc,wBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,KACzE,aAAI,CAAC,SAAS;AAAA,EACnB,IAAI,SAAS;AAAA,IAAY,OAAO;AAAA,EAChC,MAAM,MAAM,MAAK,MAAM,MAAM,MAAM;AAAA,EACnC,OAAO,QAAQ,YAAY,YAAY,cAAa,KAAK,KAAK;AAAA,CAC/D,CACH;AAGF,IAAM,kBAAiB,CAAC,SACtB,SAAS,aAAa,YAAY;AAE7B,IAAM,sBAAsB,MACxB,kBACP,aACO,iBACL,YAAY,SAAS,GAAG;AAAA,EAKtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,GAC5C;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IAGjC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBACL,gBACA,KAAK,QACL,KAAK,OAAO,OACZ,SAAS,KAAK,QAAQ,MAAM,CAC9B;AAAA,MACA,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,IAAI;AAAA,MACrD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAKxC,MAAM,SAAS,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IACnD,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,YAAW,IAAI,CAAC,CAC1C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,sBAAc,YAAW,IAAI,CAAC,CAAC;AAAA,IACtF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IAClD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,gBAAgB,KAAK,yDACnB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,EAAE,QAAQ,KAAK,OAAO,CAAC,CACjD;AAAA,GACD;AACH,CAAC,CACH,CACF;;;AElKF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACrDA;AACA;AAMO,IAAM,cAAc;AACpB,IAAM,cAAc;AAU3B,IAAM,OAAM,CAAC,UAAmB;AAAA,EAC9B,MAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,CAAC;AAAA,EACpE,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA;AAQ5C,IAAM,WAAW,CAAC,UAA6B;AAAA,EAC7C,MAAM,MAAiB,MAAM,QAAQ,KAAK,IACtC,QACA,OAAO,UAAU,WACf,MAAM,MAAM,GAAG,IACf,CAAC;AAAA,EACP,MAAM,SAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,UAAU,EAAE;AAAA,EACnF,OAAO,CAAC,GAAG,IAAI,IAAI,MAAK,CAAC,EAAE,KAAK;AAAA;AASlC,IAAM,aAAa,CAAC,UAClB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,OAAO,KAAK,KAAK,EAAE,KAAK,IACxB,CAAC;AAGP,IAAM,SAAQ,CAAC,WAAsB;AAAA,EACnC,SAAS,MAAM,WAAW;AAAA,EAC1B,OAAO,MAAM,SAAS;AAAA,EACtB,QAAQ,MAAM,WAAW,QAAQ,MAAM;AAAA,EACvC,QAAQ,OAAO,MAAM,UAAU,CAAC;AAAA,EAChC,WAAW,MAAM,aAAa;AAAA,EAQ9B,QAAQ,SAAS,MAAM,MAAM,EAAE,KAAK,GAAG;AAAA,EACvC,UAAU,MAAM,YAAY;AAC9B;AAEO,IAAM,cAAa,CAAC,WAAsD;AAAA,KAC5E,OAAM,KAAK;AAAA,EACd,QAAQ,MAAM;AAChB;AAEO,IAAM,cAAa,CAAC,WAAmD;AAAA,KACzE,OAAM,KAAK;AAAA,EACd,QAAQ,MAAM;AAChB;AAEA,IAAM,gBAAe,CAAC,MAAoC,WAAsC;AAAA,EAC9F,SAAS,KAAK,KAAK,OAAO;AAAA,EAC1B,OAAO,KAAK,KAAK,KAAK;AAAA,EAMtB,QAAQ,KAAK,KAAK,QAAQ,IAAI;AAAA,EAC9B,QAAQ,KAAI,KAAK,MAAM;AAAA,EACvB,WAAW,KAAK,KAAK,SAAS;AAAA,EAC9B,QAAQ,SAAS,KAAK,MAAM;AAAA,EAC5B,UAAU,KAAK,KAAK,QAAQ;AAAA,EAC5B,QAAQ,WAAW,KAAK,MAAM;AAAA,EAE9B,QAAQ,MAAM;AAChB;AAMO,IAAM,WAAU,CAAC,aAA4B,UAClD,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,WAAW,MAAM,SAAS,OACrC,YAAW,YAAY,MAAM,WAAW,UACxC,YAAW,YAAY,MAAM,UAAU,MACvC,YAAW,eAAe,MAAM,aAAa,OAC7C,YAAW,cAAc,MAAM,YAAY,OAC3C,YAAW,OAAO,KAAK,GAAG,MAAM,SAAS,MAAM,MAAM,EAAE,KAAK,GAAG;AAe1D,IAAM,iBAAiB,CAAC,UAC7B,iBACE,OAAO,MAAM,QAAQ,QAAQ,OAAc,sBAAc,EAAE,QAAQ,MAAM,OAAO,CAAC,CAAC,CACpF,EAAE,KAAY,aAAI,CAAC,SAAU,SAAS,aAAa,aAAa,cAAa,MAAM,KAAK,CAAE,CAAC;AAUtF,IAAM,WAAW,CAAC,UACvB,eAAe,KAAK,EAAE,KAAY,kBAAS,gBAAgB,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAGtF,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;;;ADpB7B,IAAM,cAAc,WAAsB,cAAc;AAExD,IAAM,sBAAsB,MACxB,kBACP,aACO,iBACL,YAAY,SAAS,GAAG;AAAA,EAMtB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAY7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,SAAS,IAAI,IAAI,eAAe,IAAI,CACpE;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IAGvC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBACL,gBACA,KAAK,QACL,KAAK,OAAO,OACZ,SAAS,KAAK,QAAQ,MAAM,CAC9B;AAAA,MACA,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,IAAI;AAAA,MACrD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,SAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAKxC,MAAM,SAAS,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IACnD,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IACrE,OAAO,YAAW,aAAa,YAAW,IAAI,GAAG,KAAK;AAAA,IACtD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,YAAW,IAAI,CAAC,CAC1C;AAAA,IACF,EAAO,SAAI,CAAC,SAAQ,QAAQ,IAAI,GAAG;AAAA,MACjC,OAAO,OAAO,KAAK,QAAQ,aAAa,MAAa,sBAAc,YAAW,IAAI,CAAC,CAAC;AAAA,IACtF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,SAAS,IAAI,CAAC;AAAA,IAClD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,gBAAgB,KAAK,4DACnB,iFACA,+EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACO,yBAAiB,EAAE,QAAQ,KAAK,OAAO,CAAC,CACjD;AAAA,GACD;AACH,CAAC,CACH,CACF;;;AHjLK,IAAM,2BAA2B,CACtC,IACA,QACA,SAAwB,CAAC,GACzB,UAAmC,CAAC,MAE7B,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAc,aAAI;AAAA,IACjC,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,IAC3E,KAAK,MAAM,kBAAkB,MAAK;AAAA,EACpC,CAAC;AAAA,EACD,MAAM,QAAQ,CAAO,aAAyC;AAAA,IAC5D,MAAM,OAAO,SAAS,KAAmB,qBAAO,CAAC;AAAA,IACjD,OAAO,QAAQ,UAAU,YAAY,OAAO,KAAK,KAAK,MAAM,QAAQ,KAAK,CAAC;AAAA;AAAA,EAE5E,MAAM,OAAO,OAAO,MAClB,YAAY,GAAG,WAAW;AAAA,IACxB,OAAO,CAAC,GAAG,SAAS,KAAK,KAAK;AAAA,IAC9B,QAAQ,SAAS,KAAK;AAAA,IACtB;AAAA,EACF,CAAC,CACH;AAAA,EACA,MAAM,QAAQ,OAAO,MAAM,aAAa,GAAG,iBAAiB,KAAK,SAAS,OAAO,OAAO,CAAC,CAAC;AAAA,EAG1F,MAAM,QAAQ,OAAc,aAC1B,SAAS,MAAM,IAAI,CAAC,SAClB,MACE,YAAY,GAAG,MAAM,KAAK,aAAa;AAAA,IACrC,SAAS,KAAK;AAAA,IACd,QAAQ,CAAC,GAAG,KAAK,MAAM;AAAA,IACvB;AAAA,IACA,QAAQ,KAAK;AAAA,EACf,CAAC,CACH,CACF,CACF;AAAA,EACA,MAAM,SAAS,OAAc,aAC3B,SAAS,OAAO,IAAI,CAAC,UACnB,MACE,WAAW,GAAG,MAAM,MAAM,cAAc;AAAA,IACtC,MAAM;AAAA,IACN,WAAW;AAAA,IACX,QAAQ,MAAM;AAAA,IACd;AAAA,IACA,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,EACd,CAAC,CACH,CACF,CACF;AAAA,EACA,OAAO,EAAE,UAAU,QAAQ,OAAO,MAAM,MAAM;AAAA,CAC/C;;AKhFH,qBAAS;AACT;AACA;;;ACXA,uBAAS;AAET;AACA;;;ACoEA,IAAM,cAAkC,IAAI,IAAI,CAAC,QAAQ,UAAU,MAAM,CAAC;AAGnE,IAAM,WAAU;AAAA,EACrB,KAAK;AAAA,EACL,UAAU;AAAA,EACV,KAAK;AAAA,EACL,MAAM;AAAA,EACN,QAAQ;AACV;AAIO,IAAM,cAAa,CAAC,QAA8D;AAAA,EACvF,MAAM,QAAQ,+CAA+C,KAAK,GAAG;AAAA,EACrE,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,MAAM,SAAS,MAAM;AAAA,EACrB,MAAM,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC7B,OAAO,QAAQ,SAAQ,UAAU,CAAC,QAAQ,KAAK,IAAI;AAAA;AAIrD,IAAM,cAAmC,IAAI,IAAI;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,IAAM,gBAAe,CAAC,QAC3B,YAAY,IAAI,GAAG,KAAK,YAAW,GAAG,MAAM;AAGvC,IAAM,iBAAgB,CAAC,OAAgB,QAC3C,MAA6C;AAGzC,IAAM,gBAAe,CAAC,UAC3B,OAAO,KAAK,KAAK,EACd,OAAO,CAAC,QAAQ,CAAC,YAAW,IAAI,GAAG,KAAK,eAAc,OAAO,GAAG,MAAM,SAAS,EAC/E,KAAK;AAGH,IAAM,aAAY,CAAC,UACxB,UAAU,OAAO,MAAM,UAAU,QAAQ,MAAM,OAAO,KAAK;AAStD,IAAM,gBAAe,CAAC,SAA0D;AAAA,EACrF,MAAM,MAA8B,CAAC;AAAA,EACrC,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,CAAC,cAAa,GAAG;AAAA,MAAG;AAAA,IACxB,IAAI,UAAU,QAAQ,UAAU,aAAa,OAAO,UAAU;AAAA,MAAU;AAAA,IACxE,IAAI,OAAO,WAAU,KAAK;AAAA,EAC5B;AAAA,EACA,OAAO;AAAA;;;ACtIF,IAAM,eAAe,CAAC,UAC3B,cAAa,KAAK,EACf,OAAO,CAAC,QAAQ,CAAC,cAAa,GAAG,CAAC,EAClC,IAAI,CAAC,QAAQ,GAAG,qDAAqD,OAAO,MAAM,IAAI,KAAK;AAGzF,IAAM,OAAO,CAAC,UAA2C;AAAA,EAC9D,MAAM,MAA8B,CAAC;AAAA,EACrC,WAAW,OAAO,cAAa,KAAK,GAAG;AAAA,IACrC,IAAI,CAAC,cAAa,GAAG;AAAA,MAAG;AAAA,IACxB,IAAI,OAAO,WAAU,eAAc,OAAO,GAAG,CAAC;AAAA,EAChD;AAAA,EACA,OAAO;AAAA;AAWF,IAAM,cAAa,CAAC,WAAoB;AAAA,KAC1C,KAAK,KAAK;AAAA,EACb,MAAM,OAAO,MAAM,IAAI;AACzB;AAGO,IAAM,cAAa;;;ACjDnB,MAAM,yBAAyB,MAAM;AAAA,EAC1C,WAAW,CAAC,SAAiB;AAAA,IAC3B,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA;AAEhB;;;ACqDA,IAAM,YAAW;AAEjB,IAAM,gBAAgB;AAsBf,IAAM,YAAY,CAAC,UAAuB;AAAA,EAC/C,MAAM,OAAO,UAAS,KAAK,KAAI,KAAK,cAAc,KAAK,KAAI;AAAA,EAC3D,IAAI,SAAS,MAAM;AAAA,IACjB,OAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,IAAI;AAAA,MACb,MAAM;AAAA,MACN,QAAQ,KAAK,MAAM;AAAA,MACnB,SAAS;AAAA,IACX;AAAA,EACF;AAAA,EACA,OAAO,UAAU,QAAQ,MAAK,MAAM,GAAG;AAAA,EACvC,MAAM,MAAM,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpC,MAAM,SAAS,OAAO,KAAM,SAAS,MAAO,SAAS,IAAI,MAAM,GAAG,EAAE;AAAA,EACpE,MAAM,UAAU,OAAO,KAAK,MAAM,SAAS,IAAI,MAAM,KAAK,CAAC;AAAA,EAC3D,MAAM,UAAU,IAAI,IAClB,KAAK,IAAI,CAAC,SAA2B;AAAA,IACnC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC3B,OAAO,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,GAAG,EAAE,GAAG,KAAK,MAAM,KAAK,CAAC,CAAC;AAAA,GACvE,CACH;AAAA,EACA,MAAM,OAAO,QAAQ,IAAI,MAAM;AAAA,EAC/B,QAAQ,OAAO,MAAM;AAAA,EACrB,IAAI,YAAY,OAAO,QAAQ,IAAI,aAAa,GAAG;AAAA,IACjD,QAAQ,OAAO,aAAa;AAAA,IAC5B,OAAO,EAAE,MAAM,SAAS,SAAS,MAAM,WAAW,QAAQ,SAAS,GAAG;AAAA,EACxE;AAAA,EACA,OAAO,EAAE,MAAM,UAAU,SAAS,MAAM,QAAQ,QAAQ;AAAA;AAc1D,IAAM,eAAe,CACnB,QACA,SACA,SACA,SAEA;AAAA,EACE,GAAG,UAAU;AAAA,EACb,GAAG,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,GAAG,KAAK,GAAG;AAAA,EAC3C,GAAI,SAAS,YAAY,CAAC,IAAI,CAAC,QAAQ,MAAM;AAC/C,EAAE,KAAK,GAAG;AAEL,IAAM,YAAY,CAAC,KAAa,WAAkB,SAA8B;AAAA,EACrF,MAAM,OAAO,UAAU,SAAQ;AAAA,EAC/B,MAAM,OAAO,UAAU,IAAI;AAAA,EAC3B,IAAI,KAAK,WAAW,KAAK,QAAQ;AAAA,IAC/B,OAAO;AAAA,MACL,QACE,GAAG,yBAAyB,KAAK,uBAAuB,KAAK,2BAC7D;AAAA,IACJ;AAAA,EACF;AAAA,EAUA,IAAI,KAAK,SAAS,SAAS;AAAA,IACzB,IAAI,KAAK,QAAQ,SAAS;AAAA,MAAG,OAAO,CAAC;AAAA,IACrC,IAAI,CAAC,GAAG,KAAK,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC;AAAA,MAAG,OAAO,CAAC;AAAA,IAC5E,OAAO,EAAE,KAAK,aAAa,KAAK,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI,EAAE;AAAA,EACjF;AAAA,EACA,IAAI,KAAK,YAAY,KAAK,SAAS;AAAA,IACjC,OAAO;AAAA,MACL,QACE,GAAG,wBAAwB,KAAK,2BAA2B,KAAK,yBAChE;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI,KAAK,SAAS,aAAa,KAAK,SAAS,aAAa,KAAK,SAAS,KAAK,MAAM;AAAA,IACjF,OAAO;AAAA,MACL,QACE,GAAG,sBAAsB,KAAK,8BAA8B,KAAK,8BACjE;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI,QAAQ,KAAK,SAAS,KAAK,OAAO;AAAA,IAAG,OAAO,CAAC;AAAA,EAEjD,OAAO,EAAE,KAAK,aAAa,KAAK,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI,EAAE;AAAA;;;AC9JjF,IAAM,aAAa;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,IAAM,WAAW,CAAC,UAChB,IAAI,IACF,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,IAAI,CAAC,SAA2B;AAAA,EAC/B,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,OAAO,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,GAAG,EAAE,GAAG,KAAK,MAAM,KAAK,CAAC,CAAC;AAAA,CACvE,CACL;AAEF,IAAM,WAAW,CAAC,UAChB,WAAW,KAAK,CAAC,UAAU,MAAI,IAAI,KAAK,CAAC;AAGpC,IAAM,WAAU,CAAC,WAAkB,SAAiB;AAAA,EACzD,MAAM,OAAO,SAAS,SAAQ;AAAA,EAC9B,MAAM,OAAO,SAAS,IAAI;AAAA,EAC1B,MAAM,YAAY,SAAS,IAAI;AAAA,EAC/B,MAAM,YAAY,SAAS,IAAI;AAAA,EAC/B,IAAI,cAAc,cAAc,KAAK,IAAI,SAAS,KAAK,QAAQ,MAAM,cAAc,WAAW;AAAA,IAC5F,KAAK,IAAI,WAAW,KAAK,IAAI,SAAS,KAAK,EAAE;AAAA,EAC/C;AAAA,EACA,OAAO,EAAE,MAAM,KAAK;AAAA;AAGf,IAAM,UAAU,CAAC,WAAkB,SAA0B;AAAA,EAClE,QAAQ,MAAM,SAAS,SAAQ,WAAU,IAAI;AAAA,EAC7C,OAAO,KAAK,SAAS,KAAK,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC;AAAA;AAI1E,IAAM,YAAW,CAAC,WAAkB,SAAyB;AAAA,EAClE,MAAM,OAAO,SAAS,SAAQ;AAAA,EAC9B,MAAM,YAAY,SAAS,IAAI;AAAA,EAC/B,MAAM,OAAO,SAAS,IAAI;AAAA,EAC1B,MAAM,YAAY,SAAS,IAAI;AAAA,EAC/B,IAAI,cAAc,cAAc,KAAK,IAAI,SAAS,KAAK,QAAQ,MAAM,cAAc,WAAW;AAAA,IAC5F,KAAK,IAAI,WAAW,KAAK,IAAI,SAAS,KAAK,EAAE;AAAA,EAC/C;AAAA,EACA,OAAO,CAAC,GAAG,IAAI,EAAE,IAAI,EAAE,GAAG,OAAQ,MAAM,KAAK,IAAI,GAAG,KAAK,GAAI,EAAE,KAAK,GAAG;AAAA;;;ACnDlE,IAAM,SAAQ,CAAC,OAAgB,YAA6C;AAAA,EACjF,MAAM,MAA8B,CAAC;AAAA,EACrC,MAAM,UAAmB,CAAC;AAAA,EAC1B,MAAM,QAAQ,IAAI;AAAA,EAElB,WAAW,OAAO,cAAa,KAAK,GAAG;AAAA,IACrC,MAAM,OAAO,WAAU,eAAc,OAAO,GAAG,CAAC;AAAA,IAChD,MAAM,OAAO,QAAO;AAAA,IACpB,MAAM,SAAS,YAAW,GAAG,IAAI;AAAA,IAEjC,IAAI,WAAW,UAAU,WAAW,OAAO;AAAA,MACzC,IAAI,SAAS,WAAW;AAAA,QACtB,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,OAAO;AAAA,MACb,EAAO;AAAA,QACL,MAAM,UAAU,UAAU,KAAK,MAAM,IAAI;AAAA,QACzC,IAAI,QAAQ,WAAW,WAAW;AAAA,UAChC,MAAM,IAAI,GAAG;AAAA,UACb,QAAO,KAAK,QAAQ,MAAM;AAAA,QAC5B,EAAO,SAAI,QAAQ,QAAQ,WAAW;AAAA,UACpC,MAAM,IAAI,GAAG;AAAA,UACb,IAAI,OAAO,QAAQ;AAAA,QACrB;AAAA;AAAA,MAEF;AAAA,IACF;AAAA,IAEA,IAAI,WAAW,OAAO;AAAA,MACpB,IAAI,SAAS,WAAW;AAAA,QACtB,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,OAAO;AAAA,MACb,EAAO,SAAI,CAAC,QAAQ,MAAM,IAAI,GAAG;AAAA,QAC/B,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,OAAO,UAAS,MAAM,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AAAA,IAIA,IAAI,UAAU,QAAQ,KAAK;AAAA,MACzB,MAAM,IAAI,GAAG;AAAA,MACb,IAAI,OAAO;AAAA,IACb;AAAA,EACF;AAAA,EACA,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,gBAAO;AAAA;AAS1C,IAAM,kBAAkB,CAAC,MAAc,QAC5C,QAAQ,aAAa,SAAS,MAC1B,YACA,SAAS,OAAO,GAAG,QAAQ,OAAO,IAAI,wDACtC;;;AC7EN;AACA;AACA;AAOA,IAAM,aAAa,CAAC,OAAO,MAAM;AAE1B,IAAM,SAAS,CAAC,UACd,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,MAAM,QAAQ,MAAM;AAAA,EACrD,MAAM,SAAS,OAAO,WACpB,MAAM,QACN,YACA,OACM,0BAAkB,EAAE,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,IAAI,EAAE,CAAC,CACxE,EAAE,KACO,aAAI,CAAC,UAAU,EAAE,MAAM,OAAO,UAAU,EAAE,GAC1C,kBAAS,sBAAsB,CAAC,UAAiB,iBAAQ,EAAE,MAAM,WAAW,MAAM,CAAC,CAAC,CAC7F;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,MAAM,OAAO,OAAO;AAAA,IAEpB,IAAI,OAAO,KAAK,WAAW,YAAY,KAAK,WAAW,IAAI;AAAA,MACzD,OAAO,OAAc,cACnB,IAAI,iBACF,MAAM,OAAO,MAAM,IAAI,wDACzB,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,OAAO,WAClB,MAAM,QACN,YACA,OACQ,+BAAqB,EAAE,MAAM,KAAK,CAAC,CAC7C;AAAA,EACA,IACE,CAAC,MAAM,QAAQ,IAAI,KACnB,KAAK,KACH,CAAC,QACC,CAAC,OAAO,cAAc,OAAO,KAAK,IAAI,CAAC,KACvC,OAAO,KAAK,IAAI,KAAK,KACrB,OAAO,KAAK,SAAS,YACrB,IAAI,SAAS,MACb,CAAC,WAAW,SAAS,IAAI,IAAmC,CAChE,GACA;AAAA,IACA,OAAO,OAAc,cACnB,IAAI,iBAAiB,oDAAoD,CAC3E;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,KAAK,KAAK,CAAC,QAAQ,OAAO,IAAI,IAAI,MAAM,MAAM,IAAI;AAAA,EAChE,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,IAAI,MAAM,SAAS,MAAM,QAAQ,MAAM,SAAS;AAAA,IAAQ,OAAO,OAAc,cAAK,OAAO,KAAK;AAAA,EAC9F,OAAO,OAAc,cACnB,IAAI,iBACF,QAAQ,OAAO,MAAM,IAAI,UAAU,KAAK,MAAM,MAAM,OAAO,UACzD,GAAG,KAAK,MAAM,MAAM,GAAG,kBAAkB,MAAM,iCAC/C,oFACJ,CACF;AAAA,CACD;;;ACvEH;AAEA;AAWO,IAAM,WAAW,CACtB,OACA,WACA,MACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,KAAK,OAAO,WAAW,MAAM,QAAQ,YAAY,MAAM,SAAS,CAAC;AAAA,EAC9E,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAc,cACnB,IAAI,iBACF,GAAG,qFACL,CACF;AAAA,EACF;AAAA,EACA,IAAI,OAAO;AAAA,EACX,SAAS,UAAU,EAAG,UAAU,OAAO,WAAW;AAAA,IAChD,MAAM,SAAS,OAAO,WACpB,MAAM,QACN,YACA,OACM,0BAAkB,EAAE,MAAM,MAAM,MAAM,KAAK,CAAC,CACpD,EAAE,KAAY,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CAAC;AAAA,IAS5C,IAAI,WAAW,aAAa,OAAO,WAAW,WAAW;AAAA,MACvD,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,IAAI,OAAO,WAAW,WAAW;AAAA,MAC/B,OAAO,KAAK,OAAO,YAAY,4BAA4B;AAAA,MAC3D;AAAA,IACF;AAAA,IACA,OAAc,eAAM,UAAU;AAAA,EAChC;AAAA,EACA,IAAI,SAAS,MAAM;AAAA,IACjB,OAAO,OAAc,cACnB,IAAI,iBACF,GAAG,cAAc,eAAe,2DAClC,CACF;AAAA,EACF;AAAA,CACD;;;AR1BH,IAAM,gBAAe;AACrB,IAAM,eAAe;AAErB,IAAM,iBAAe,CAAC,MAA+B,WAAkC;AAAA,EACrF,QAAQ,cAAa,IAAI;AAAA,EACzB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AACd;AAOA,IAAM,YAAU,CAAC,aAA0B,UACzC,cAAa,KAAK,EACf,OAAO,aAAY,EACnB,MAAM,CAAC,QAAQ,YAAW,OAAO,SAAS,WAAU,eAAc,OAAO,GAAG,CAAC,CAAC;AAEnF,IAAM,QAAO;AAAA,EACX,YAAY;AAAA,EACZ,YAAY,CAAC,UAAmB,SAAS,MAAM;AAAA,EAC/C;AAAA,EACA,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,EACA,MAAM,CAAC,UAAmB,SAAS,MAAM,aAAa,OAAO,MAAM,IAAI;AAAA,EACvE;AACF;AAEA,MAAQ,4BAAa,+BAAgB,WAAW,KAAI;AAE7C,IAAM,WAAW,CAAC,UACvB,OAAO,KAAK,EAAE,KACL,aAAI,CAAC,SACV,SAAS,YACL,YAOA,eAAa,MAA4C,KAAK,CACpE,CACF;AAGK,IAAM,aAAa,CAAC,UACzB,SACE,OACM,uBAAe,EAAE,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,IAAI,EAAE,CAAC,GACnE,cAAc,OAAO,MAAM,IAAI,KAC/B,YACF,EAAE,KAAY,kBAAS,sBAAsB,MAAa,aAAI,CAAC;AASjE,IAAM,kBAAkB,CAAC,UAAmB;AAAA,EAC1C,MAAM,WAAU,aAAa,KAAK;AAAA,EAClC,OAAO,SAAQ,WAAW,IAAW,gBAAc,cAAK,IAAI,iBAAiB,SAAQ,KAAK;AAAA,CAAI,CAAC,CAAC;AAAA;AAGlG,IAAM,eAAe,CAAC,WACpB,OAAO,OAAO,WAAW,IACd,gBACA,cAAK,IAAI,iBAAiB,OAAO,OAAO,KAAK;AAAA,CAAI,CAAC,CAAC;AAEzD,IAAM,eAAe;AAAA,EAC1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAO7B,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,KAMC;AAAA,IACD,MAAM,QAAQ,OAAO,SAAS,IAAI;AAAA,IAClC,MAAM,WAAiB,cACrB,MAAM,UAAU,aAAa,OAAM,MAAM,MAAM,MAAM,EAAE,MAAM,WAAW,CAC1E;AAAA,IACA,OAAO,OAAO,UAAU,EAAE,KAAK,YAAY,OAAO,GAAG,OAAO,QAAO;AAAA,GACpE;AAAA,EACD,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,KAKC;AAAA,IACD,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,MAAM,YAAW,gBAAgB,KAAK,MAAM,QAAQ,QAAQ,KAAK,IAAI;AAAA,IACrE,IAAI,cAAa;AAAA,MAAW,OAAO,OAAc,cAAK,IAAI,iBAAiB,SAAQ,CAAC;AAAA,IACpF,OAAO,gBAAgB,IAAI;AAAA,IAC3B,OAAO,cAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,cAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IACjC,IAAI,SAAS,WAAW;AAAA,MAGtB,OAAc,oBACZ,cAAc,KAAK,QAAQ,OAAO,KAAK,IAAI,kDACzC,qDACJ;AAAA,MACA,OAAO,cAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,MAAM,SAAS,OAAM,MAAM,KAAK,MAAM;AAAA,IACtC,OAAO,aAAa,MAAM;AAAA,IAC1B,OAAO,EAAE,QAAQ,OAAO,MAAM,WAAW,IAAI,SAAS,SAAS;AAAA,GAChE;AAAA,EACD,WAAkB,YAAG,UAAU;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,KAOC;AAAA,IACD,MAAM,YAAW,gBAAgB,KAAK,MAAM,QAAQ,QAAQ,MAAM,IAAI;AAAA,IACtE,IAAI,cAAa;AAAA,MAAW,OAAO,OAAc,cAAK,IAAI,iBAAiB,SAAQ,CAAC;AAAA,IACpF,OAAO,gBAAgB,IAAI;AAAA,IAC3B,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,IACjC,OAAO,cAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,cAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,SACL,MACM,uBAAe,KAAK,YAAW,IAAI,GAAG,MAAM,KAAK,KAAK,CAAC,GAC7D,aAAa,OAAO,KAAK,IAAI,KAC7B,aACF;AAAA,IACF,EAAO;AAAA,MAGL,OAAO,eACL,EAAE,KAAK,YAAY,OAAO,GAC1B,iBAAiB,OAAO,KAAK,IAAI,QAAQ,KAAK,MAChD;AAAA,MACA,MAAM,SAAS,OAAM,MAAM,KAAK,MAAM;AAAA,MACtC,OAAO,aAAa,MAAM;AAAA,MAC1B,IAAI,OAAO,KAAK,OAAO,GAAG,EAAE,SAAS,GAAG;AAAA,QACtC,OAAO,OACL,KAAK,QACL,aACA,MACM,0BAAkB,KAAK,OAAO,KAAK,MAAM,KAAK,MAAM,MAAM,OAAO,KAAK,IAAI,EAAE,CAAC,CACrF;AAAA,MACF;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,SAAS,IAAI;AAAA,IAClC,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,cACnB,IAAI,iBACF,GAAG,MAAK,KAAK,IAAI,sDACnB,CACF;AAAA,IACF;AAAA,IACA,MAAM,OAAO,OAAM,MAAM,MAAM,MAAM;AAAA,IACrC,IAAI,KAAK,MAAM,SAAS,GAAG;AAAA,MACzB,OAAO,OAAc,cACnB,IAAI,iBACF,GAAG,MAAK,KAAK,IAAI,uBAAuB,KAAK,MAAM,KAAK,IAAI,6BAC1D,2EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAA8B,WAAW,IAAI;AAC1D;;;ADhMO,IAAM,YAAY,WAAoB,cAAc,EAAE,sBAAsB,SAAS,CAAC;AAQtF,IAAM,oBAAoB,MACtB,kBAAO,WAAkB,iBAAQ,UAAU,SAAS,GAAG,YAAY,CAAC,CAAC;;AUfhF,qBAAS;AACT;AACA;;;AC1BA,uBAAS;AAET;AACA;;;ACEA,IAAM,SAAkD;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAWO,IAAM,gBAAgB,CAC3B,MACA,SACoB;AAAA,EACpB,IAAI,SAAS;AAAA,IAAW,OAAO,EAAE,MAAM,OAAO;AAAA,EAC9C,IAAI,KAAK,aAAa,KAAK,YAAY,KAAK,YAAY,KAAK,SAAS;AAAA,IACpE,OAAO,EAAE,MAAM,UAAU;AAAA,EAC3B;AAAA,EACA,MAAM,UAAU,OAAO,OAAO,CAAC,QAAQ,KAAK,SAAS,KAAK,IAAI;AAAA,EAC9D,IAAI,QAAQ,WAAW;AAAA,IAAG,OAAO,EAAE,MAAM,OAAO;AAAA,EAChD,OAAO;AAAA,IACL,MAAM;AAAA,IACN,QACE,GAAG,KAAK,aAAa,QAAQ,KAAK,IAAI,qDACtC,4FACA;AAAA,EACJ;AAAA;;;AC/CK,MAAM,oCAAoC,MAAM;AAAA,EACrD,WAAW,CAAC,SAAiB;AAAA,IAC3B,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA;AAEhB;;;ACCA;AAEA;AAoBO,IAAM,sBAAsB,CACjC,OACA,WACA,MACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,KAAK,OAAO,WAAW,MAAM,QAAQ,YAAY,MAAM,SAAS,CAAC;AAAA,EAC9E,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAc,cACnB,IAAI,4BACF,GAAG,qFACL,CACF;AAAA,EACF;AAAA,EACA,IAAI,OAAO;AAAA,EACX,SAAS,UAAU,EAAG,UAAU,OAAO,WAAW;AAAA,IAChD,MAAM,SAAS,OAAO,WACpB,MAAM,QACN,YACA,OACM,0BAAkB,EAAE,MAAM,MAAM,MAAM,KAAK,CAAC,CACpD,EAAE,KAAY,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CAAC;AAAA,IAE5C,IAAI,WAAW,aAAa,OAAO,WAAW,WAAW;AAAA,MACvD,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,IAAI,OAAO,WAAW,WAAW;AAAA,MAC/B,OAAO,KAAK,OAAO,YAAY,4BAA4B;AAAA,MAC3D;AAAA,IACF;AAAA,IACA,OAAc,eAAM,UAAU;AAAA,EAChC;AAAA,EACA,IAAI,SAAS,MAAM;AAAA,IACjB,OAAO,OAAc,cACnB,IAAI,4BACF,GAAG,cAAc,eAAe,2DAClC,CACF;AAAA,EACF;AAAA,CACD;;;AH/CH,IAAM,gBAAe;AACrB,IAAM,gBAAe;AAGrB,IAAM,oBAAoB;AAYnB,IAAM,eAAe,CAAC,WAAiC;AAAA,EAC5D,UAAU,MAAM;AAAA,EAChB,sBAAsB,MAAM;AAAA,KACxB,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,EAC5E,SAAS;AAAA,EACT,UAAU,MAAM;AAAA,EAChB,MAAM,MAAM;AAAA,EACZ,SAAS,MAAM;AAAA,EACf,KAAK,MAAM;AAAA,KACP,MAAM,uBAAuB,YAC7B,CAAC,IACD,EAAE,uBAAuB,MAAM,qBAAqB,MAAM,IAAI;AACpE;AAOO,IAAM,kBAAiB,CAAC,UAA0C;AAAA,EACvE,MAAM,UAAmB,CAAC;AAAA,EAC1B,IAAI,MAAM,SAAS,KAAK,MAAM,IAAI;AAAA,IAChC,QAAO,KACL,GAAG,MAAM,6EACX;AAAA,EACF;AAAA,EACA,OAAO,QAAO,OACZ,eAAe,mBAAmB,aAAa,KAAK,GAAG,IAAI,EAAE,IAC3D,CAAC,QAAQ,GAAG,MAAM,aAAa,KACjC,CACF;AAAA;AAUK,IAAM,eAAe,CAAC,UACpB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,QACA,OACM,+BAAuB;AAAA,IAC3B,SAAS;AAAA,IACT,MAAM,MAAM;AAAA,IACZ,SAAS,MAAM;AAAA,EACjB,CAAC,CACH;AAAA,EACA,IAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;AAAA,IACxB,OAAO,OAAc,cACnB,IAAI,4BACF,GAAG,MAAM,wDACX,CACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,MAAM,SAAS,IAAI,MAAM,UAAU,CAAC;AAAA,EACzE,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,OAAO;AAAA,IACL,UAAU,MAAM;AAAA,IAChB,QAAQ,KAAK,MAAM,QAAQ,KAAK;AAAA,IAChC,MAAM,MAAM;AAAA,IACZ,MAAM,IAAI,MAAM,MAAM,CAAC;AAAA,IACvB,SAAS,MAAM;AAAA,IACf,OAAO,KAAK,MAAM,OAAO,EAAE;AAAA,EAC7B;AAAA,CACD;AAGI,IAAM,kBAAkB,CAAC,UACvB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,aAAa,KAAK;AAAA,EACtC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,OAAO,oBACL,OACM,iCAAyB;AAAA,IAC7B,MAAM,MAAM;AAAA,IACZ,SAAS,MAAM;AAAA,IACf,QAAQ,KAAK;AAAA,EACf,CAAC,GACD,UAAU,KAAK,SACf,aACF;AAAA,CACD;AAEI,IAAM,0BAA0B;AAAA,EACrC,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAQ7B,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,KAMC;AAAA,IACD,MAAM,QAAQ,OAAO,aAAa,IAAI;AAAA,IACtC,OAAO,OAAO,UAAU,EAAE,KAAK,YAAY,OAAO,GAAG,OAAc,iBAAQ,IAAI,CAAC;AAAA,GACjF;AAAA,EACD,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,KAKC;AAAA,IACD,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,MAAM,WAAU,gBAAe,IAAI;AAAA,IACnC,IAAI,SAAQ,SAAS,GAAG;AAAA,MACtB,OAAO,OAAc,cAAK,IAAI,4BAA4B,SAAQ,KAAK;AAAA,CAAI,CAAC,CAAC;AAAA,IAC/E;AAAA,IACA,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,YAAW,cAAc,MAAM,IAAI;AAAA,IACzC,IAAI,UAAS,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC5D,MAAM,OAAO,OAAO,aAAa,IAAI;AAAA,IAKrC,IAAI,UAAS,SAAS,iBAAiB,SAAS,WAAW;AAAA,MACzD,OAAO,OAAc,cAAK,IAAI,4BAA4B,UAAS,MAAM,CAAC;AAAA,IAC5E;AAAA,IACA,OAAO,EAAE,QAAQ,SAAS,YAAY,WAAW,OAAO;AAAA,GACzD;AAAA,EACD,WAAkB,YAAG,UAAU;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,KAMC;AAAA,IACD,MAAM,WAAU,gBAAe,IAAI;AAAA,IACnC,IAAI,SAAQ,SAAS,GAAG;AAAA,MACtB,OAAO,OAAc,cAAK,IAAI,4BAA4B,SAAQ,KAAK;AAAA,CAAI,CAAC,CAAC;AAAA,IAC/E;AAAA,IACA,MAAM,OAAO,OAAO,aAAa,IAAI;AAAA,IACrC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,oBACL,MACM,gCAAwB,aAAa,IAAI,CAAC,GAChD,YAAY,KAAK,iBAAiB,KAAK,WACvC,aACF;AAAA,IACF,EAAO;AAAA,MAIL,OAAO,eACL,EAAE,KAAK,YAAY,OAAO,GAC1B,2BAA2B,KAAK,eAAe,KAAK,SACtD;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,aAAa,IAAI;AAAA,IACtC,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,cACnB,IAAI,4BACF,GAAG,KAAK,6CAA6C,KAAK,0BACxD,gFACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAA2C,gBAAgB,IAAI;AAC5E;;;AD9KO,IAAM,yBAAyB,WAAiC,yBAAyB;AAEzF,IAAM,iCAAiC,MACnC,kBACP,wBACO,iBAAQ,uBAAuB,SAAS,GAAG,uBAAuB,CAAC,CAC5E;;AK2BF,qBAAS;AACT;AACA;;;ACrFA,uBAAS;AAET;AACA,8BAAS;AACT;AACA;;;ACkBO,IAAM,mBAAmB;AASzB,IAAM,QAAQ,CAAC,UACpB,GAAG,OAAO,MAAM,KAAK,KAAK,OAAO,MAAM,MAAM;AAe/C,IAAM,SAAQ,CAAC,WAAgC;AAAA,EAC7C,SAAS,MAAM,WAAW;AAAA,EAC1B,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EACxC,UAAU,MAAM,YAAY;AAAA,KACxB,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,OAAO,MAAM,IAAI,EAAE;AACjE;AAUO,IAAM,cAAa,CAAC,WAAgC;AAAA,KACtD,OAAM,KAAK;AAAA,EACd,IAAI,MAAM,KAAK;AAAA,EACf,QAAQ,MAAM;AAAA,EACd,MAAM;AACR;AAgBO,IAAM,cAAa,CAAC,WAAgC;AAAA,KACtD,OAAM,KAAK;AAAA,EACd,QAAQ;AACV;;;ACxEA,IAAM,SAAS,CAAC,UAA2B;AAAA,EACzC,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,SAAS,OAAO,WAAW,KAAK,KAAK,CAAC;AAAA,EAC5C,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA;AAGrC,IAAM,qBAAqB;AAAA,EAWhC,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,IACpC,OAAO,IAAI,KAAK,UAAU,MAAM,KAAK;AAAA,IACrC,IAAI,KAAK,KAAK,OAAO,MAAM,KAAK,CAAC;AAAA,IACjC,QAAQ,IAAI,KAAK,WAAW,MAAM,MAAM;AAAA,IACxC,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,YAAY,KAAK,KAAK,eAAe,EAAE;AAAA,IACvC,UAAU,KAAK,KAAK,aAAa,gBAAgB;AAAA,IACjD,QAAQ,KAAK,KAAK,WAAW,EAAE;AAAA,IAC/B,YAAY,KAAK,KAAK,WAAW,MAAM,UAAU;AAAA,IACjD,MAAM,KAAK,KAAK,SAAS,OAAO;AAAA,EAClC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAmBZ,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS,CAAC,aAAY,UACpB,YAAW,eAAe,MAC1B,YAAW,cAAc,MAAM,YAAY,qBAC3C,YAAW,aAAa,MAAM,YAAY,SAC1C,YAAW,aAAa,MAAM,WAAW,QACxC,MAAM,SAAS,aAAa,YAAW,SAAS,MAAM;AAAA,EACzD,MAAM,CAAC,UAAU,uBAAuB,MAAM,KAAK;AAAA,EACnD,YAAY;AACd;;;AF/DA,MAAQ,4BAAa,+BAAgB,WAAW,kBAAI;AACpD,IAAM,YAAY,MAChB,IAAI,mBAAkB;AAAA,EACpB,MAAM;AAAA,EACN,OAAO;AACT,CAAC;AAEI,IAAM,qBAAqB,CAAC,UACjC,OAAO,MAAM,QAAQ,QAAQ,OAAe,gCAAsB,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,EAAE,KAChF,iBAAQ,CAAC,SAQP,4BAA2B,eAAe,uCAA6B,CAAC,EAAE;AAAA,KAC5E;AAAA,EACH,OAAO,IAAI,KAAK,OAAO,OAAO,GAAG;AAAA,EACjC,QAAQ,IAAI,KAAK,QAAQ,OAAO,GAAG;AAAA,EACnC,MAAM;AACR,CAAC,EAAE,KAAY,kBAAS,SAAS,GAAU,YAAG,IAAI,CAAC,CACrD,GACO,iBAAQ,CAAC,SAId,KAAK,OAAO,MAAM,KAAK,KACvB,IAAI,KAAK,OAAO,OAAO,GAAG,MAAM,MAAM,SACtC,IAAI,KAAK,QAAQ,OAAO,GAAG,MAAM,MAAM,SAC5B,iBAAQ,mBAAK,WAAW,KAAK,KAAK,GAAG,KAAK,CAAC,IAC3C,cAAK,UAAU,CAAC,CAC7B,GACO,kBAAS,0BAA0B,MAAa,iBAAQ,SAAS,CAAC,CAC3E;AAGK,IAAM,uBAAuB,CAAC,UACnC,OACE,MAAM,QACN,aACA,MACQ,mCAAyB,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC,CACvD,EAAE,KAAY,kBAAS,0BAA0B,MAAa,aAAI,CAAC;AAE9D,IAAM,yBAAyB;AAAA,EAEpC,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAA0C,mBAAmB,IAAI;AAAA,EAC1E,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,KAIC;AAAA,IACD,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,cAAY,MAAM,WAAW,SAAS;AAAA,IAC7C,OAAO,cAAY,IAAI;AAAA,IACvB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,mBAAmB,IAAI;AAAA,IAC3C,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,cAAY,MAAM,IAAI;AAAA,MAC7B,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,OAAO,EAAE,QAAQ,mBAAK,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC/D;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAuC;AAAA,IACvE,MAAM,OAAO,OAAO,mBAAmB,IAAI;AAAA,IAC3C,OAAO,cAAY,MAAM,SAAS,SAAS;AAAA,IAC3C,OAAO,cAAY,IAAI;AAAA,IACvB,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OACL,KAAK,QACL,aACA,MACQ,mCAAyB,mBAAK,WAAW,IAAI,CAAC,CACxD;AAAA,IACF,EAAO;AAAA,MACL,MAAM,QAAO,WAAW,mBAAK,SAAS,MAAM,MAAM,mBAAK,WAAW,IAAI,CAAC;AAAA,MACvE,IAAI,UAAS;AAAA,QACX,OAAO,OACL,KAAK,QACL,aACA,MACQ,gCAAsB,KAAK,OAAM,IAAI,MAAM,IAAI,EAAE,CAAC,CAC5D;AAAA;AAAA,IAEJ,MAAM,QAAQ,OAAO,mBAAmB,IAAI;AAAA,IAC5C,IAAI,UAAU;AAAA,MACZ,OAAO,OAAc,cACnB,IAAI,MAAM,GAAG,mBAAK,KAAK,IAAI,4DAA4D,CACzF;AAAA,IACF,OAAO;AAAA,GACR;AAAA,EACD,QAAQ,GAAG,WAA0C,qBAAqB,IAAI;AAChF;;;ADkDO,IAAM,wBAAwB,WAAgC,wBAAwB;AAUtF,IAAM,gCAAgC,MAClC,kBACP,uBACO,iBAAQ,sBAAsB,SAAS,GAAG,sBAAsB,CAAC,CAC1E;;AIhJF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACHA;AAkBA,IAAM,SAAS;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA2BO,IAAM,kBAAkB,CAAC,UAC9B,iBAAiB,YAAY,MAAM,WAAW;AAGhD,IAAM,gBAAgB,CAAC,WACd,aACL,OAAO,IAAI,CAAC,eACV,IAAkB,QAAQ,QAAQ,OAAO,GAAG,sBAAsB,EAAE,KAC3D,aAAI,CAAC,UAAU,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,SAAS,EAAE,MAAM,GAQ1E,iBAAQ,iBAAiB,MAAa,iBAAQ,CAAC,CAAC,CACzD,CACF,GACA,EAAE,aAAa,YAAY,CAC7B,EAAE,KAAY,aAAI,CAAC,WAAW,OAAO,OAAO,CAAC,OAAO,WAAU,QAAQ,QAAO,CAAC,CAAC,CAAC;AAU3E,IAAM,eAAe,CAC1B,QACA,YAC4B;AAAA,EAC5B,IAAI,WAAW,aAAa,YAAY;AAAA,IAAW,OAAO;AAAA,EAC1D,IAAI,WAAW,aAAa,YAAY;AAAA,IAAW,OAAO;AAAA,EAC1D,OAAO,WAAW,UAAU,IAAI;AAAA;AAiBlC,IAAM,gBAAgB,CAAC,WACd,aACL,CAAC,WAAW,SAAS,EAAE,IAAI,CAAC,SAC1B,IAAa,QAAQ,QAAQ,OAAO,2BAA2B,QAAQ,EAAE,KAChE,aAAI,UAAS,GACb,iBAAQ,iBAAiB,MAAa,iBAAQ,SAAS,CAAC,CACjE,CACF,GACA,EAAE,aAAa,YAAY,CAC7B,EAAE,KACO,iBAAQ,EAAE,QAAQ,aAAa;AAAA,EACpC,MAAM,UAAU,aAAa,QAAQ,OAAO;AAAA,EAC5C,OAAO,YAAY,iBACR,aACL,IAAI,MACF,uFACE,6DACJ,CACF,IACO,iBAAQ,OAAO;AAAA,CAC3B,CACH;AAGK,IAAM,aAAY,CAAC,UAA2B,KAAK,UAAU,SAAS,KAAK,CAAC;AAEnF,IAAM,WAAW,CAAC,UAA4B;AAAA,EAC5C,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAO,MACJ,IAAI,QAAQ,EACZ,KAAK,CAAC,MAAM,UAAU,KAAK,UAAU,IAAI,EAAE,cAAc,KAAK,UAAU,KAAK,CAAC,CAAC;AAAA,EACpF;AAAA,EACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,MAAM,UAAU,OAAO,QAAQ,KAAgC,EAC5D,OAAO,EAAE,SAAS,QAAQ,QAAQ,EAClC,KAAK,EAAE,QAAQ,WAAW,KAAK,cAAc,KAAK,CAAC;AAAA,IACtD,OAAO,OAAO,YAAY,QAAQ,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,SAAS,KAAK,CAAC,CAAC,CAAC;AAAA,EACjF;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,kBAAkB,CAAC,WACvB,aAAI,CAAC,cAAc,MAAM,GAAG,cAAc,MAAM,CAAC,GAAG,EAAE,aAAa,YAAY,CAAC,EAAE,KAChF,aAAI,EAAE,QAAQ,YAAY,SAAS,MAAM,CAClD;;;ADjHK,IAAM,kBAAkB,WAA0B,kBAAkB;AAE3E,IAAM,QAAO,CAAC,UACZ,gBAAgB,MAAM,MAAM,EAAE,KAAY,aAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC;AAEpE,IAAM,0BAA0B,MAC5B,kBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,EAE1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAE7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,MAAK,IAAI;AAAA,GACxB;AAAA,EAQD,MAAa,YAAG,UAAU,GAAG,QAAwC;AAAA,IACnE,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,QAAQ,YAAY,OAAO,MAAK,IAAI;AAAA,IACpC,OAAO,YAAY,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAC5E;AAAA,EAED,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAiBxC,MAAM,SAAS,OAAO,MAAK,IAAI;AAAA,IAC/B,IAAI,OAAO,YAAY;AAAA,MAAG,OAAO;AAAA,IAIjC,OAAO;AAAA,IACP,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,aAAa;AAAA,IAOzD,MAAM,QAAQ,OAAO,MAAK,IAAI;AAAA,IAC9B,IAAI,MAAM,YAAY,GAAG;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,0CAA0C,OAAO,MAAM,OAAO,qBAC5D,mFACA,yEACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EASD,QAAQ,MAAa;AACvB,CAAC,CACH,CACF;;AE/FF,qBAAS;AACT;AACA;;;ACjCO,IAAM,WAAW,CAAC,UACvB,GAAG,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK,GAAG;AAG9C,IAAM,cAAc,CAAC,UAAqB,iBAAiB,MAAM,qBAAqB,MAAM;AAoBrF,IAAM,aAAa,CAAC,WACxB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAC9B,IAAI,CAAC,UAAmB,eAAe,KAAK,CAAC,EAC7C,OAAO,CAAC,UAAU,UAAU,EAAE,EAC9B,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,iBAAiB,CAAC,UAC7B,UAAU,YAAY,KAAK,WAAW,CAAC,YAAY,KAAK,CAAC,CAAC;AAO5D,IAAM,QAAQ,CAAC,UACb,UAAU,aAAa,UAAU,KAAK,YAAY;AA0B7C,IAAM,YAAW,CAAC,WAA+D;AAAA,EACtF,mBAAmB,MAAM,MAAM,aAAa;AAAA,EAC5C,cAAc,MAAM,cAAc,YAAY,YAAY,YAAY,MAAM,SAAS;AAAA,EACrF,eAAe,MAAM,MAAM,aAAa;AAAA,EACxC,SAAS,MAAM,MAAM,OAAO;AAC9B;AAUO,IAAM,QAAO,CAAC,WAAmD;AAAA,EACtE,MAAM,MAAM,SAAS,OAAO,MAAM;AAAA,EAClC,MAAM,MAAM;AAAA,KACT,OAAO,YACR,OAAO,QAAQ,UAAS,KAAK,CAAC,EAAE,OAC9B,CAAC,UAAqC,MAAM,OAAO,SACrD,CACF;AACF;AAOO,IAAM,eAAa,CAAC,WAAmD;AAAA,KACzE,MAAK,KAAK;AAAA,EACb,QAAQ,MAAM;AAAA,EACd,MAAM;AACR;AAkBO,IAAM,cAAa,CAAC,UAAkD;AAAA,EAC3E,MAAM,QAAQ,OAAO,QAAQ,UAAS,KAAK,CAAC,EACzC,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,SAAS,GAAG;AAAA,EACrB,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;;;ADY/B,IAAM,mBAAmB,WAA2B,mBAAmB;AAE9E,IAAM,aAAW,YAAiD;AAAA,EAChE,YAAY,CAAC,MAAM,UAAU;AAAA,IAS3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,eAAe,KAAK,KAAK,kBAAkB;AAAA,MAC3C,WAAW,WAAW,KAAK,aAAa;AAAA,MACxC,eAAe,KAAK,KAAK,gBAAgB;AAAA,MACzC,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,MAAM,IAAI,KAAK,SAAS,CAAC;AAAA,MACzB,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,QAAQ;AAAA,MACR,UAAU,SAAS,KAAK;AAAA,MACxB,MAAM,MAAM;AAAA,MACZ,MAAM,KAAK,KAAK,OAAO;AAAA,IACzB;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAClD;AAAA,EAEA,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EAeA,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,UAAU,MAAM,SAAS,SACpC,YAAW,mBAAmB,MAAM,iBAAiB,OACrD,YAAW,mBAAmB,MAAM,iBAAiB,OACrD,YAAW,cAAc,eAAe,MAAM,SAAS;AAAA,EAOzD,MAAM,CAAC,UAAU,qBAAqB,MAAM,gBAAgB,SAAS,KAAK;AAAA,EAC1E;AACF,CAAC;AAYM,IAAM,2BAA2B,MAC7B,kBAAO,kBAAyB,iBAAQ,iBAAiB,SAAS,GAAG,UAAQ,CAAC,CAAC;;AEvM1F,qBAAS;AACT;AACA;AA6DO,IAAM,iBAAiB,WAAyB,iBAAiB;AAQxE,IAAM,QAAQ,CAAC,UAAoB,OAAO,UAAU,WAAW,QAAQ;AAUvE,IAAM,UAAQ,CAAC,UAAgD;AAAA,EAC7D,MAAM,QAAQ,MAAM,SAAS;AAAA,EAC7B,OAAO;AAAA,IAIL,iBAAiB,MAAM,iBAAiB,OAAO,MAAM;AAAA,IACrD,WAAW,MAAM,cAAc,OAAO,MAAM;AAAA,IAC5C,MAAM,MAAM;AAAA,OAIR,UAAU,KAAK,CAAC,IAAI,EAAE,MAAM;AAAA,OAC5B,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,EAC9D;AAAA;AAoBF,IAAM,cAAa,CAAC,UAAgD;AAAA,EAClE,MAAM,SAAQ;AAAA,IACZ,IAAK,MAAM,SAAS,QAAQ,KAAK,CAAC,OAAO,IAAI,CAAC;AAAA,IAC9C,GAAI,MAAM,QAAQ,YAAY,CAAC,KAAK,IAAI,CAAC;AAAA,EAC3C;AAAA,EACA,OAAO,WAAW,QAAM,KAAK,GAAG,MAAK;AAAA;AAGvC,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EACV,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,OAAO,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC3D,QAAQ,MAAM;AAAA,IACd,cAAc,KAAK,KAAK,gBAAgB;AAAA,IACxC,KAAK,MAAM,KAAK,MAAM;AAAA,IACtB,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,MAAM,MAAM;AAAA,IAOZ,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,EAC1D;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,QAAM,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAS5D,UAAU,EAAE,QAAQ,+BAA+B,QAAQ,oCAAoC;AAAA,EAC/F,SAAS,CAAC,aAAY,UACpB,YAAW,SAAS,MAAM,QAC1B,YAAW,WAAW,MAAM,SAAS,OACrC,YAAW,QAAQ,MAAM,OACzB,YAAW,eAAe,MAAM,cAAc,SAC9C,YAAW,kBAAkB,MAAM,iBAAiB;AAAA,EAOtD,MAAM,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAC5C;AACF,CAAC;AAgBM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACrLtF,qBAAS;AACT;AACA;AAwEO,IAAM,iBAAiB,WAAyB,iBAAiB;AAQxE,IAAM,WAAW,CAAC,MAAc,eAC7B,SAAS,KAAK,QAAQ,WAAW,cAAa,aAAa,cAAa,KAAK,QAAQ;AASxF,IAAM,QAAO,CAAC,WAAiD;AAAA,KACzD,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,KACzD,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,KAChD,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,KACnD,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,KACxD,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,KAAK,EAAE;AAAA,KAC3D,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,KAAK,EAAE;AAAA,KAC3D,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,KACxD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AACxF;AAkBA,IAAM,YAAoD;AAAA,EACxD,MAAM,CAAC,OAAO,WAAW,OAAO,OAAO;AAAA,EACvC,MAAM,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EAC/C,QAAQ,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EACjD,MAAM,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EAC/C,OAAO,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAClD;AAEA,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EACV,YAAY,CAAC,MAAM,UAAU;AAAA,IAQ3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,KAAK,KAAK,KAAK,MAAM;AAAA,MACrB,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,MAAM,KAAK,KAAK,OAAO,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO;AAAA,MAC3D,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,MACvB,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AAAA,MAC9B,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AAAA,MAC9B,QAAQ;AAAA,MACR,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,MACvB,MAAM,MAAM;AAAA,MACZ,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,MACrC,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK;AAAA,EAO7E,UAAU,EAAE,QAAQ,+BAA+B,QAAQ,oCAAoC;AAAA,EAC/F,SAAS,CAAC,aAAY,UACpB,YAAW,SAAS,MAAM,OAAO,MACjC,YAAW,UAAU,IAAI,MAAM,KAAK,KACpC,SAAS,YAAW,MAAM,MAAM,IAAI,KACpC,YAAW,SAAS,MAAM,OAAO,OACjC,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,UAAU,IAAI,MAAM,KAAK,KACpC,YAAW,kBAAkB,MAAM,gBAAgB,MACnD,YAAW,SAAS,MAAM,OAAO,MACjC,YAAW,YAAY,MAAM,UAAU;AAAA,EACzC,MAAM,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAC5C,YAAY,CAAC,UAAU;AAAA,IACrB,MAAM,UAAS,MAAK,KAAK;AAAA,IACzB,MAAM,QAAQ,UAAU,MAAM,MAAM,OAAO,CAAC,WAAW,QAAO,YAAY,SAAS;AAAA,IACnF,OAAO,WAAW,SAAQ,KAAK;AAAA;AAEnC,CAAC;AAgBM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;AChLtF,qBAAS;AACT,uBAAS;AACT;AACA;AACA;;;ACjCA,IAAM,wBAA6C,IAAI,IAAI,CAAC,OAAO,OAAO,SAAS,MAAM,CAAC;AAEnF,IAAM,iBAAiB,CAAC,SAA0B,sBAAsB,IAAI,IAAI;;;ACtCvF;AACA;AAqBA,IAAM,OAAM,CAAC,OAAgB,WAAW,OAAQ,OAAO,UAAU,WAAW,QAAQ;AASpF,IAAM,SAAS,CAAC,UACd,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAEN,IAAM,YAAW,CAAC,WAA8B,SACrD,cAAa,aAAa,OAAO,SAAQ,MAAM,OAAO,IAAI;AAErD,IAAM,QAAO,CAAI,WAAyB,SAC/C,cAAa,aAAa,cAAa;AASzC,IAAM,iBAAe,CAAC,MAAe,UAA2C;AAAA,EAC9E,MAAM,OAAO;AAAA,EACb,OAAO;AAAA,IACL,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,OAAO,KAAI,KAAK,QAAQ;AAAA,IACxB,eAAe,KAAI,KAAK,gBAAgB;AAAA,IACxC,iBAAiB,KAAI,KAAK,gBAAgB;AAAA,IAC1C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,SAAS,MAAM;AAAA,IACf,MAAM,KAAI,KAAK,SAAS,MAAM,IAAI;AAAA,EACpC;AAAA;AAqBK,IAAM,oBAAoB,CAAC,UAChC,iBACE,OAAO,MAAM,QAAQ,aAAa,OAAe,mBAAW,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CACzF,EAAE,KAAY,aAAI,CAAC,SAAU,SAAS,aAAa,aAAa,eAAa,MAAM,KAAK,CAAE,CAAC;AAUtF,IAAM,cAAc,CAAC,UAC1B,kBAAkB,KAAK,EAAE,KAChB,kBAAS,mBAAmB,MAAa,iBAAQ,SAAS,CAAC,CACpE;AAGK,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;AAiB7B,IAAM,eAAe,CAC1B,MACA,WAC4B;AAAA,KACxB,UAAS,MAAM,SAAS,KAAK,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KACtE,UAAS,MAAM,OAAO,KAAK,KAAK,IAAI,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,KAC9D,UAAS,MAAM,kBAAkB,KAAK,gBAAgB,IACtD,CAAC,IACD,EAAE,iBAAiB,MAAM,iBAAiB;AAAA,KAC1C,MAAK,MAAM,SAAS,KAAK,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAClE,eAAe,MAAM,IAAI,KAAK,CAAC,MAAK,MAAM,QAAQ,KAAK,MAAM,IAC7D,EAAE,QAAQ,MAAM,OAAO,IACvB,CAAC;AAAA,KACD,MAAK,MAAM,eAAe,KAAK,aAAa,IAAI,CAAC,IAAI,EAAE,eAAe,MAAM,cAAc;AAAA,KAC1F,MAAK,MAAM,SAAS,KAAK,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AACxE;AAgBO,IAAM,YAAU,CAAC,aAA+B,UACrD,CAAC,eAAe,MAAM,IAAI,KAAK,CAAC,MAAK,MAAM,QAAQ,YAAW,MAAM,IACzD,aACL,IAAI,MACF,WAAW,MAAM,6BAA6B,OAAO,MAAM,MAAM,wBAC/D,GAAG,OAAO,YAAW,MAAM,UAAU,MAAM,4CAC3C,wFACA,4DACJ,CACF,IACO,iBAAQ,OAAO,KAAK,aAAa,aAAY,KAAK,CAAC,EAAE,WAAW,CAAC;;;AC7JvE,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;AAsB9B,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAQ7C,IAAM,cAAc,CAAC,aAClB,KAAK,QAAQ;AAgChB,IAAM,cAAc,CAAC,UACnB,OAAO,YAAY,OAAO,QAAQ,KAAI,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,WAAW,KAAK,GAAG,GAAG,KAAK,CAAC,CAAC;AAqClG,IAAM,WAAU,CAAC,MAAc,WAA0B;AAAA,KACpD,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,KAAK,MAAM,OAAO,CAAC;AAAA,KACpC,OAAM,SAAS,MAAM,KAAK;AAAA,KAC1B,OAAM,iBAAiB,MAAM,aAAa;AAAA,KAC1C,OAAM,iBAAiB,MAAM,gBAAgB;AAAA,KAC5C,eAAe,IAAI,IAAI,OAAM,UAAU,KAAK,MAAM,MAAM,CAAC,IAAI,CAAC;AACpE;AASO,IAAM,eAAa,CAAC,WAAiD;AAAA,KACvE,YAAY,MAAM,OAAO;AAAA,KACzB,SAAQ,MAAM,MAAM,KAAK;AAAA,EAC5B,SAAS,MAAM;AAAA,EACf,MAAM,MAAM;AACd;AAmBO,IAAM,eAAa,CACxB,OACA,UAC4B;AAAA,KACzB,SAAQ,MAAM,MAAM,SAAS,YAAY,QAAQ,aAAa,MAAM,KAAK,CAAC;AAAA,EAC7E,SAAS,MAAM;AACjB;AASO,IAAM,qBAAoB,CAAC,UAChC,YAAY,aAAW,KAAK,CAAC;AAUxB,IAAM,qBAAoB,CAAC,UAChC,YAAY,KAAI;;;AHxCX,IAAM,iBAAiB,WAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAEM,IAAM,yBAAyB,MAC3B,kBACP,gBACO,iBACL,eAAe,SAAS,GAAG;AAAA,EAOzB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAQ7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,YAAY,IAAI,IAAI,kBAAkB,IAAI,CAC1E;AAAA,GACD;AAAA,EACD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,YAAW,gBAAgB,aAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAGxE,OAAO,YAAW,gBAAgB,aAAW,MAAM,SAAS,GAAG,KAAK;AAAA,IACpE,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,kBAAkB,IAAI;AAAA,IAG1C,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBACL,mBACA,KAAK,SACL,KAAK,OAAO,OACZ,SAAS,KAAK,QAAQ,WAAW,CACnC;AAAA,MACA,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,YAAW,gBAAgB,aAAW,IAAI,GAAG,IAAI;AAAA,MACxD,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA,QAAQ,OAAO,UAAQ,MAAM,IAAI,KAC5B,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EACD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAIxC,MAAM,SAAS,gBAAe,OAAO,YAAY,IAAI,CAAC;AAAA,IACtD,OAAO,YAAW,gBAAgB,aAAW,IAAI,GAAG,WAAW,SAAS;AAAA,IAKxE,MAAM,UAAS,aAAW,MAAM,MAAM;AAAA,IACtC,OAAO,YAAW,gBAAgB,SAAQ,KAAK;AAAA,IAC/C,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,OACL,KAAK,QACL,aACA,MACQ,uBAAc,mBAAkB,IAAI,CAAC,CAC/C;AAAA,IACF,EAAO,SAAI,EAAE,OAAO,UAAQ,QAAQ,IAAI,IAAI;AAAA,MAC1C,OAAO,OACL,KAAK,QACL,aACA,MACQ,oBAAW,mBAAkB,OAAM,CAAC,CAC9C;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,gBAAe,OAAO,YAAY,IAAI,CAAC;AAAA,IACrD,IAAI,UAAU,WAAW;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,WAAW,KAAK,mEACd,gFACA,0EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAMD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,OACL,KAAK,QACL,aACA,MACQ,uBAAc,EAAE,SAAS,KAAK,QAAQ,CAAC,CACjD;AAAA,GACD;AACH,CAAC,CACH,CACF;;AItLF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACvEA;AACA;AAsCO,IAAM,cAAc,CAAC,aAC1B,MAAM,QAAQ,QAAQ,IAClB,SAAS,QAAQ,CAAC,UAAmB;AAAA,EACnC,MAAM,OAAO;AAAA,EACb,MAAM,SAAS,YAAY,KAAK,QAAQ;AAAA,EACxC,OAAO,OAAO,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,SAAS,EAAE;AAAA,CACnF,IACD,CAAC;AAQP,IAAM,iBAAe,CACnB,MACA,WACuB;AAAA,EACvB,SAAS,YAAY,KAAK,QAAQ,EAAE,KAAK,GAAG;AAAA,EAC5C,QAAQ,KAAK,KAAK,QAAQ,SAAS;AAAA,EACnC,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,EACZ,OAAO,KAAK,KAAK,OAAO,SAAS;AACnC;AAoBO,IAAM,iBAAiB,CAAC,UAC7B,iBACE,OACE,MAAM,QACN,QACA,OACM,uBAAe,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK,CAAC,CAC7D,CACF,EAAE,KACO,aAAI,CAAC,SAAS;AAAA,EACnB,IAAI,SAAS;AAAA,IAAY,OAAO;AAAA,EAGhC,OAAO,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,eAAa,MAAM,KAAK;AAAA,CACrE,CACH;AAaK,IAAM,YAAW,CAAC,UACvB,eAAe,KAAK,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAG3D,IAAM,kBAAiB,CAAC,SAC7B,SAAS,aAAa,YAAY;;;AC9GpC;AACA;AAQO,IAAM,kBAAkB;AA6BxB,IAAM,wBAAwB,CAAC,UACpC,MAAM,YAAY,aAAa,MAAM,cAAc,YAAY,YAAY;AAmBtE,IAAM,eAAa,CAAC,WAAiD;AAAA,KACtE,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ,KAAK,GAAG,EAAE;AAAA,EAC1E,MAAM,MAAM;AAAA,KACR,MAAM,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,KAClE,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,MAAM,MAAM,EAAE;AAAA,KACjE,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,KACxE,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,gBAAgB;AACzF;AAcA,IAAM,qBAAoB,CAAC,UAAwD;AAAA,EACjF,MAAM,QAAO,aAAW,KAAK;AAAA,EAC7B,OAAO;AAAA,OACF;AAAA,IACH,cAAc,MAAK;AAAA,IACnB,MAAM,MAAM;AAAA,EACd;AAAA;AAIF,IAAM,kBAAkB;AAkDjB,IAAM,cAAa,CACxB,OACA,UAEO,cAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,MAAK,KAAK;AAAA,EAClC,IAAI,aAAa;AAAA,IAAW,OAAO;AAAA,EAEnC,IAAI,MAAM,YAAY,aAAa,MAAM,cAAc,WAAW;AAAA,IAChE,OAAO,OAAc,cACnB,IAAI,MACF,GAAG,MAAM,QAAQ,MAAM,gEACrB,0FACA,yFACA,yDACJ,CACF;AAAA,EACF;AAAA,EAaA,OAAO,UAAU,sBAAsB,KAAK,GAAG,QAAO,aAAW,KAAK,CAAC,GAAG,IAAI;AAAA,EAE9E,MAAM,OAAO,OAAO,OAClB,MAAM,QACN,aACA,MACM,0BAAkB,mBAAkB,KAAK,CAAC,CAClD;AAAA,EAEA,MAAM,UAAS,CAAC,aACP,cAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,MAAK,KAAK;AAAA,IAC9B,IAAI,SAAS,aAAa,YAAY;AAAA,MAAG,OAAO;AAAA,IAChD,OAAc,gBAAM,WAAW;AAAA,IAC/B,OAAO,OAAO,QAAO,WAAW,CAAC;AAAA,GAClC;AAAA,EAEH,MAAM,QAAQ,OAAO,QAAO,eAAe;AAAA,EAC3C,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,cACnB,IAAI,MACF,SAAS,MAAM,kBAAkB,MAAM,uBAAuB,KAAK,MAAM,WAAW,OAClF,2FACA,2DAA2D,MAAM,8BACjE,2FACA,yFACA,0FACA,yFACA,0FACA,oCACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAeI,IAAM,cAAc,CAAC,UAC1B,OACE,MAAM,QACN,aACA,MACM,0BAAkB,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK,CAAC,CAChE;;;AFtEK,IAAM,iBAAiB,WAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAEM,IAAM,yBAAyB,MAC3B,kBACP,gBACO,kBACL,eAAe,SAAS,GAAG;AAAA,EAGzB,MAAM,MAAa,kBAAQ,CAAC,CAAC;AAAA,EAM7B,MAAa,aAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,OAAO,gBACL,OAAO,WAAW,YAAY,UAAS,IAAI,IAAI,eAAe,IAAI,CACpE;AAAA,GACD;AAAA,EACD,MAAa,aAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,aAAW,IAAI;AAAA,MAAG;AAAA,IAMvB,OAAO,UACL,sBAAsB,IAAI,GAC1B,QAAO,aAAW,IAAI,CAAC,GACvB,WAAW,SACb;AAAA,IACA,IAAI,WAAW;AAAA,MAAW;AAAA,IAI1B,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,IACvC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBACL,mBACA,GAAG,KAAK,QAAQ,KAAK,QACrB,KAAK,OAAO,OACZ,SAAS,KAAK,QAAQ,MAAM,CAC9B;AAAA,MACA,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IAOA,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,UAAU,sBAAsB,IAAI,GAAG,QAAO,aAAW,IAAI,CAAC,GAAG,IAAI;AAAA,MAC5E,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAIA,OAAO,EAAE,QAAQ,OAAO;AAAA,GACzB;AAAA,EAUD,WAAkB,aAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,OAAO,OAAO,YAAW,MAAM,CAAC,UAC9B,UAAS,KAAK,EAAE,KAAY,cAAI,eAAc,CAAC,CACjD;AAAA,GACD;AAAA,EACD,QAAe,aAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,YAAY,IAAI;AAAA,GACxB;AACH,CAAC,CACH,CACF;",
+  "debugId": "267899A4B122300564756E2164756E21",
   "names": []
 }